@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.0

package/scripts/observed-evidence.mjs

@@ -24,6 +24,40 @@ function assertHex(value, label) {
   if (!/^[0-9a-f]{64}$/.test(String(value || ""))) throw new Error(`${label} must be a lowercase sha256 hex digest`);
 }
 
+function requiredHeader(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized || /[\r\n]/.test(normalized)) throw new Error(`${label} must be a non-empty single-line value`);
+  return normalized;
+}
+
+function validatePublicationEntry({ entry, kind, root, snapshotId, requireSnapshotDocument = false, requireHeaders = false }) {
+  const source = safeRelative(entry.source, `${kind}.source`);
+  const key = safeRelative(entry.key, `${kind}.key`);
+  const file = path.resolve(root, source);
+  if (file !== root && !file.startsWith(`${root}${path.sep}`)) throw new Error(`${kind}.source escapes artifact root`);
+  if (!fs.statSync(file).isFile()) throw new Error(`${kind}.source is not a file: ${source}`);
+  assertHex(entry.sha256, `${kind}.sha256`);
+  const actual = sha256(file);
+  if (actual !== entry.sha256) throw new Error(`${kind}.sha256 does not match ${source}`);
+  if (requireSnapshotDocument) {
+    const document = readJson(file);
+    if (document.snapshotId !== snapshotId) throw new Error(`${kind} document snapshotId does not match manifest`);
+  }
+  return {
+    kind,
+    source,
+    key,
+    file,
+    sha256: actual,
+    contentType: requireHeaders
+      ? requiredHeader(entry.contentType, `${kind}.contentType`)
+      : String(entry.contentType || "application/json"),
+    cacheControl: requireHeaders
+      ? requiredHeader(entry.cacheControl, `${kind}.cacheControl`)
+      : String(entry.cacheControl || ""),
+  };
+}
+
 export function validateObservedEvidenceBundle({ manifestPath, artifactRoot = path.dirname(manifestPath) }) {
   const resolvedManifest = path.resolve(manifestPath);
   const root = path.resolve(artifactRoot);
@@ -36,26 +70,39 @@ export function validateObservedEvidenceBundle({ manifestPath, artifactRoot = pa
   if (!Number.isFinite(Date.parse(manifest.snapshot?.observedAt || ""))) throw new Error("snapshot.observedAt must be ISO-8601");
   const immutable = manifest.publication?.immutable || {};
   const latest = manifest.publication?.latest || {};
-  const entries = [["immutable", immutable], ["latest", latest]].map(([kind, entry]) => {
-    const source = safeRelative(entry.source, `${kind}.source`);
-    const key = safeRelative(entry.key, `${kind}.key`);
-    const file = path.resolve(root, source);
-    if (file !== root && !file.startsWith(`${root}${path.sep}`)) throw new Error(`${kind}.source escapes artifact root`);
-    if (!fs.statSync(file).isFile()) throw new Error(`${kind}.source is not a file: ${source}`);
-    assertHex(entry.sha256, `${kind}.sha256`);
-    const actual = sha256(file);
-    if (actual !== entry.sha256) throw new Error(`${kind}.sha256 does not match ${source}`);
-    const document = readJson(file);
-    if (document.snapshotId !== snapshotId) throw new Error(`${kind} document snapshotId does not match manifest`);
-    return { kind, source, key, file, sha256: actual, contentType: entry.contentType || "application/json" };
-  });
-  if (!entries[0].key.includes(`/${snapshotId}.json`)) throw new Error("immutable key must bind snapshot.id below a versioned path");
-  if (entries[0].key === entries[1].key) throw new Error("immutable and latest keys must differ");
+  const immutableEntry = validatePublicationEntry({ entry: immutable, kind: "immutable", root, snapshotId, requireSnapshotDocument: true });
+  const latestEntry = validatePublicationEntry({ entry: latest, kind: "latest", root, snapshotId, requireSnapshotDocument: true });
+  const projectionInput = manifest.publication?.projections ?? [];
+  if (!Array.isArray(projectionInput) || projectionInput.length > 16) {
+    throw new Error("publication.projections must be an array with at most 16 entries");
+  }
+  const projections = projectionInput.map((entry, index) => validatePublicationEntry({
+    entry,
+    kind: `projection[${index}]`,
+    root,
+    snapshotId,
+    requireHeaders: true,
+  }));
+  const entries = [immutableEntry, ...projections, latestEntry];
+  if (!immutableEntry.key.includes(`/${snapshotId}.json`)) throw new Error("immutable key must bind snapshot.id below a versioned path");
+  if (new Set(entries.map((entry) => entry.key)).size !== entries.length) {
+    throw new Error("immutable, projection, and latest keys must be unique");
+  }
   const invalidationPaths = [...new Set(manifest.publication?.invalidationPaths || [])];
   if (invalidationPaths.some((entry) => typeof entry !== "string" || !entry.startsWith("/") || entry.includes(".."))) {
     throw new Error("invalidation paths must be absolute viewer paths without traversal");
   }
-  return { manifest, manifestPath: resolvedManifest, artifactRoot: root, snapshotId, entries, invalidationPaths };
+  return {
+    manifest,
+    manifestPath: resolvedManifest,
+    artifactRoot: root,
+    snapshotId,
+    entries,
+    immutable: immutableEntry,
+    latest: latestEntry,
+    projections,
+    invalidationPaths,
+  };
 }
 
 function defaultRunner(args) {
@@ -79,6 +126,8 @@ function headEvidence(result) {
     snapshotId: String(value.Metadata?.["snapshot-id"] || ""),
     etag: String(value.ETag || "").replaceAll('"', ""),
     versionId: String(value.VersionId || ""),
+    contentType: String(value.ContentType || ""),
+    cacheControl: String(value.CacheControl || ""),
   };
 }
 
@@ -90,7 +139,7 @@ function putArgs({ bucket, entry, snapshotId, immutable }) {
   const args = [
     "s3api", "put-object", "--bucket", bucket, "--key", entry.key, "--body", entry.file,
     "--content-type", entry.contentType,
-    "--cache-control", immutable ? "public,max-age=31536000,immutable" : "public,max-age=0,must-revalidate",
+    "--cache-control", entry.cacheControl || (immutable ? "public,max-age=31536000,immutable" : "public,max-age=0,must-revalidate"),
     "--checksum-sha256", base64Digest(entry.sha256),
     "--metadata", `snapshot-id=${snapshotId},sha256=${entry.sha256}`,
   ];
@@ -98,10 +147,39 @@ function putArgs({ bucket, entry, snapshotId, immutable }) {
   return args;
 }
 
+function copySource(bucket, key, versionId) {
+  const encoded = `${encodeURIComponent(bucket)}/${key.split("/").map(encodeURIComponent).join("/")}`;
+  return `${encoded}?versionId=${encodeURIComponent(versionId)}`;
+}
+
+function rollbackMutableEntries({ commandRunner, bucket, applied }) {
+  const operations = [];
+  for (const { entry, previous } of [...applied].reverse()) {
+    const result = previous
+      ? commandRunner([
+          "s3api", "copy-object", "--bucket", bucket, "--key", entry.key,
+          "--copy-source", copySource(bucket, entry.key, previous.versionId),
+          "--metadata-directive", "COPY",
+        ])
+      : commandRunner(["s3api", "delete-object", "--bucket", bucket, "--key", entry.key]);
+    operations.push({ action: previous ? "restore-previous-version" : "remove-new-projection", key: entry.key, status: result.status });
+    if (result.status !== 0) {
+      throw new Error(`rollback failed for ${entry.key}: ${result.stderr || result.stdout}`);
+    }
+  }
+  return operations;
+}
+
 function assertHeadMatches(head, entry, snapshotId, label) {
   if (!head || head.sha256 !== entry.sha256 || head.snapshotId !== snapshotId) {
     throw new Error(`${label} object does not match the admitted snapshot and sha256`);
   }
+  if (
+    entry.kind.startsWith("projection[") &&
+    (head.contentType !== entry.contentType || head.cacheControl !== entry.cacheControl)
+  ) {
+    throw new Error(`${label} object does not match the admitted content type and cache control`);
+  }
 }
 
 export function publishObservedEvidence(options, { commandRunner = defaultRunner } = {}) {
@@ -110,7 +188,7 @@ export function publishObservedEvidence(options, { commandRunner = defaultRunner
   if (!bucket) throw new Error("bucket is required");
   const distributionId = String(options.distributionId || "").trim();
   const dryRun = options.dryRun !== false;
-  const [immutable, latest] = bundle.entries;
+  const { immutable, latest, projections } = bundle;
   const receipt = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-observed-evidence-publication-receipt",
@@ -121,8 +199,17 @@ export function publishObservedEvidence(options, { commandRunner = defaultRunner
     bucket,
     distributionId,
     immutable: { key: immutable.key, sha256: immutable.sha256, status: "planned" },
+    projections: projections.map((entry) => ({
+      key: entry.key,
+      sha256: entry.sha256,
+      contentType: entry.contentType,
+      cacheControl: entry.cacheControl,
+      status: "planned",
+    })),
     latest: { key: latest.key, sha256: latest.sha256, status: "planned" },
+    previousProjections: [],
     previousLatest: null,
+    rollback: { status: "not-needed", operations: [] },
     invalidationPaths: bundle.invalidationPaths,
     operations: [],
   };
@@ -147,21 +234,52 @@ export function publishObservedEvidence(options, { commandRunner = defaultRunner
   assertHeadMatches(verifiedImmutable, immutable, bundle.snapshotId, "verified immutable");
   receipt.immutable.verification = verifiedImmutable;
 
-  receipt.previousLatest = headEvidence(headObject(commandRunner, bucket, latest.key));
-  const latestPut = commandRunner(putArgs({ bucket, entry: latest, snapshotId: bundle.snapshotId, immutable: false }));
-  receipt.operations.push({ action: "advance-latest", status: latestPut.status });
-  if (latestPut.status !== 0) throw new Error(`latest alias update failed: ${latestPut.stderr || latestPut.stdout}`);
-  const verifiedLatest = headEvidence(headObject(commandRunner, bucket, latest.key));
-  assertHeadMatches(verifiedLatest, latest, bundle.snapshotId, "verified latest");
-  receipt.latest = { ...receipt.latest, status: "written", verification: verifiedLatest };
-
-  if (distributionId && bundle.invalidationPaths.length > 0) {
-    const invalidation = commandRunner([
-      "cloudfront", "create-invalidation", "--distribution-id", distributionId,
-      "--paths", ...bundle.invalidationPaths,
-    ]);
-    receipt.operations.push({ action: "invalidate-cdn", status: invalidation.status, result: jsonOutput(invalidation) });
-    if (invalidation.status !== 0) throw new Error(`CloudFront invalidation failed: ${invalidation.stderr || invalidation.stdout}`);
+  const mutableEntries = [...projections, latest];
+  const previousByKey = new Map(mutableEntries.map((entry) => [entry.key, headEvidence(headObject(commandRunner, bucket, entry.key))]));
+  if (projections.length > 0) {
+    for (const [key, previous] of previousByKey) {
+      if (previous && !previous.versionId) {
+        throw new Error(`mutable projection transaction requires bucket versioning before replacing ${key}`);
+      }
+    }
+  }
+  receipt.previousProjections = projections.map((entry) => ({ key: entry.key, previous: previousByKey.get(entry.key) }));
+  receipt.previousLatest = previousByKey.get(latest.key);
+  const applied = [];
+  try {
+    for (const [index, projection] of projections.entries()) {
+      const put = commandRunner(putArgs({ bucket, entry: projection, snapshotId: bundle.snapshotId, immutable: false }));
+      receipt.operations.push({ action: "advance-projection", key: projection.key, status: put.status });
+      if (put.status !== 0) throw new Error(`projection update failed for ${projection.key}: ${put.stderr || put.stdout}`);
+      applied.push({ entry: projection, previous: previousByKey.get(projection.key) });
+      const verified = headEvidence(headObject(commandRunner, bucket, projection.key));
+      assertHeadMatches(verified, projection, bundle.snapshotId, `verified projection ${projection.key}`);
+      receipt.projections[index] = { ...receipt.projections[index], status: "written", verification: verified };
+    }
+
+    const latestPut = commandRunner(putArgs({ bucket, entry: latest, snapshotId: bundle.snapshotId, immutable: false }));
+    receipt.operations.push({ action: "advance-latest", status: latestPut.status });
+    if (latestPut.status !== 0) throw new Error(`latest alias update failed: ${latestPut.stderr || latestPut.stdout}`);
+    applied.push({ entry: latest, previous: previousByKey.get(latest.key) });
+    const verifiedLatest = headEvidence(headObject(commandRunner, bucket, latest.key));
+    assertHeadMatches(verifiedLatest, latest, bundle.snapshotId, "verified latest");
+    receipt.latest = { ...receipt.latest, status: "written", verification: verifiedLatest };
+
+    if (distributionId && bundle.invalidationPaths.length > 0) {
+      const invalidation = commandRunner([
+        "cloudfront", "create-invalidation", "--distribution-id", distributionId,
+        "--paths", ...bundle.invalidationPaths,
+      ]);
+      receipt.operations.push({ action: "invalidate-cdn", status: invalidation.status, result: jsonOutput(invalidation) });
+      if (invalidation.status !== 0) throw new Error(`CloudFront invalidation failed: ${invalidation.stderr || invalidation.stdout}`);
+    }
+  } catch (error) {
+    if (projections.length > 0 && applied.length > 0) {
+      receipt.rollback.status = "applying";
+      receipt.rollback.operations = rollbackMutableEntries({ commandRunner, bucket, applied });
+      receipt.rollback.status = "restored";
+    }
+    throw error;
   }
   receipt.status = "published";
   receipt.publishedAt = new Date().toISOString();

package/scripts/reconcile-github-governance.mjs

@@ -96,6 +96,11 @@ function writeJson(filePath, value) {
   fs.writeFileSync(target, `${JSON.stringify(value, null, 2)}\n`);
 }
 
+export function githubApiFailureIsAbsence(method, output) {
+  return String(method || "GET").toUpperCase() === "GET" &&
+    /404|not found/i.test(String(output || ""));
+}
+
 function githubApi(route, { method = "GET", body } = {}) {
   const args = [
     "api",
@@ -115,7 +120,9 @@ function githubApi(route, { method = "GET", body } = {}) {
   });
   const output = `${result.stdout || ""}\n${result.stderr || ""}`;
   if (result.status !== 0) {
-    if (/404|not found/i.test(output)) return { exists: false, data: null };
+    if (githubApiFailureIsAbsence(method, output)) {
+      return { exists: false, data: null };
+    }
     throw new Error(`GitHub API ${method} ${route} failed closed`);
   }
   return {

package/scripts/resolve-artifact-signing-upload-route.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
+
+function normalize(value, name) {
+  const normalized = String(value ?? "").trim();
+  if (/\r|\n|\0/.test(normalized)) {
+    throw new Error(`${name} must be a single-line NO_PROXY value`);
+  }
+  return normalized;
+}
+
+export function resolveArtifactSigningUploadRoute({
+  requestedNoProxy = "",
+  noProxy = "",
+  lowerNoProxy = "",
+} = {}) {
+  const requested = normalize(requestedNoProxy, "artifact signing request upload NO_PROXY");
+  const currentUpper = normalize(noProxy, "NO_PROXY");
+  const currentLower = normalize(lowerNoProxy, "no_proxy");
+
+  return {
+    noProxy: requested || currentUpper || currentLower,
+    overrideApplied: requested !== "",
+  };
+}
+
+export function writeGitHubOutputs(route, outputPath = process.env.GITHUB_OUTPUT) {
+  if (!outputPath) return;
+  fs.appendFileSync(
+    outputPath,
+    [
+      `no-proxy=${route.noProxy}`,
+      `override-applied=${route.overrideApplied}`,
+      "",
+    ].join("\n"),
+  );
+}
+
+function main() {
+  const route = resolveArtifactSigningUploadRoute({
+    requestedNoProxy: process.env.BUILDCHAIN_SIGNING_REQUEST_UPLOAD_NO_PROXY,
+    noProxy: process.env.NO_PROXY,
+    lowerNoProxy: process.env.no_proxy,
+  });
+  writeGitHubOutputs(route);
+  process.stdout.write(
+    `Resolved artifact signing request upload route (override=${route.overrideApplied ? "yes" : "no"}).\n`,
+  );
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  main();
+}

package/scripts/run-candidate-body-prefix-renderer.mjs

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+
+import childProcess from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { TextDecoder } from "node:util";
+
+const EXACT_SHA = /^[0-9a-f]{40}$/u;
+const MANAGED_MARKER = "<!-- buildchain-dev-alpha-candidate-state";
+const MAX_PREFIX_CHARACTERS = 32768;
+
+function required(value, name) {
+  const normalized = String(value ?? "").trim();
+  if (!normalized) throw new Error(`${name} is required`);
+  return normalized;
+}
+
+export function resolveRendererPath(consumerRootValue, rendererValue) {
+  const consumerRoot = fs.realpathSync(
+    path.resolve(required(consumerRootValue, "consumerRoot")),
+  );
+  const renderer = required(rendererValue, "renderer");
+  if (path.isAbsolute(renderer))
+    throw new Error("renderer must be repository-relative");
+  const candidate = path.resolve(consumerRoot, renderer);
+  const candidateRelative = path.relative(consumerRoot, candidate);
+  if (
+    !candidateRelative ||
+    candidateRelative.startsWith("..") ||
+    path.isAbsolute(candidateRelative)
+  )
+    throw new Error("renderer must resolve inside the consumer checkout");
+  const absolute = fs.realpathSync(candidate);
+  const relative = path.relative(consumerRoot, absolute);
+  if (relative.startsWith("..") || path.isAbsolute(relative))
+    throw new Error("renderer must resolve inside the consumer checkout");
+  const stat = fs.statSync(absolute);
+  if (!stat.isFile())
+    throw new Error("renderer must resolve to a regular file");
+  return { consumerRoot, renderer: absolute };
+}
+
+function safeEnvironment(values, source = process.env) {
+  const retained = [
+    "CI",
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "PATH",
+    "RUNNER_ARCH",
+    "RUNNER_OS",
+    "TEMP",
+    "TMP",
+    "TMPDIR",
+    "TZ",
+  ];
+  return {
+    ...Object.fromEntries(
+      retained
+        .filter((key) => source[key] !== undefined)
+        .map((key) => [key, source[key]]),
+    ),
+    BUILDCHAIN_CHANNEL_PATROL_PR_BODY_PREFIX_OUTPUT: values.outputPath,
+    BUILDCHAIN_CHANNEL_PATROL_SELECTED_SHA: values.selectedSha,
+    BUILDCHAIN_CHANNEL_PATROL_SOURCE_BRANCH: values.sourceBranch,
+    BUILDCHAIN_CHANNEL_PATROL_TARGET_BRANCH: values.targetBranch,
+    GIT_TERMINAL_PROMPT: "0",
+  };
+}
+
+function checkedSpawn(command, args, options, label) {
+  const result = childProcess.spawnSync(command, args, {
+    ...options,
+    encoding: "utf8",
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    const detail = String(result.stderr || result.stdout || "").trim();
+    throw new Error(`${label} failed${detail ? `: ${detail}` : ""}`);
+  }
+  return result;
+}
+
+function readPrefix(outputPath) {
+  const bytes = fs.readFileSync(outputPath);
+  let value;
+  try {
+    value = new TextDecoder("utf-8", { fatal: true }).decode(bytes).trim();
+  } catch {
+    throw new Error("renderer output must be valid UTF-8");
+  }
+  if (!value) throw new Error("renderer output must not be empty");
+  if (value.length > MAX_PREFIX_CHARACTERS)
+    throw new Error(
+      `renderer output exceeds ${MAX_PREFIX_CHARACTERS} characters`,
+    );
+  if (value.includes(MANAGED_MARKER))
+    throw new Error(
+      "renderer output must not contain the managed candidate state marker",
+    );
+  return value;
+}
+
+export function appendMultilineOutput(outputFile, name, value) {
+  let delimiter;
+  do {
+    delimiter = `buildchain_${crypto.randomUUID()}`;
+  } while (value.split(/\r?\n/u).includes(delimiter));
+  fs.appendFileSync(
+    outputFile,
+    `${name}<<${delimiter}\n${value}\n${delimiter}\n`,
+  );
+}
+
+export function runCandidateBodyPrefixRenderer(options = {}) {
+  const { consumerRoot, renderer } = resolveRendererPath(
+    options.consumerRoot,
+    options.renderer,
+  );
+  const selectedSha = required(options.selectedSha, "selectedSha");
+  if (!EXACT_SHA.test(selectedSha))
+    throw new Error("selectedSha must be an exact 40-character commit SHA");
+  const sourceBranch = required(options.sourceBranch, "sourceBranch");
+  const targetBranch = required(options.targetBranch, "targetBranch");
+  const outputPath = path.resolve(required(options.outputPath, "outputPath"));
+  const githubOutput = required(options.githubOutput, "githubOutput");
+
+  const head = checkedSpawn(
+    "git",
+    ["rev-parse", "HEAD"],
+    {
+      cwd: consumerRoot,
+      env: safeEnvironment({
+        outputPath,
+        selectedSha,
+        sourceBranch,
+        targetBranch,
+      }),
+    },
+    "consumer HEAD resolution",
+  ).stdout.trim();
+  if (head !== selectedSha)
+    throw new Error(
+      `consumer checkout HEAD ${head} does not match selected SHA ${selectedSha}`,
+    );
+
+  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+  fs.rmSync(outputPath, { force: true });
+  const env = safeEnvironment({
+    outputPath,
+    selectedSha,
+    sourceBranch,
+    targetBranch,
+  });
+  checkedSpawn(
+    process.execPath,
+    [renderer],
+    { cwd: consumerRoot, env },
+    "PR body prefix renderer",
+  );
+  const value = readPrefix(outputPath);
+  appendMultilineOutput(githubOutput, "pull-request-body-prefix", value);
+  return value;
+}
+
+function main() {
+  runCandidateBodyPrefixRenderer({
+    consumerRoot: process.env.BUILDCHAIN_CHANNEL_PATROL_CONSUMER_ROOT,
+    renderer: process.env.BUILDCHAIN_CHANNEL_PATROL_PR_BODY_PREFIX_RENDERER,
+    outputPath: process.env.BUILDCHAIN_CHANNEL_PATROL_PR_BODY_PREFIX_OUTPUT,
+    selectedSha: process.env.BUILDCHAIN_CHANNEL_PATROL_SELECTED_SHA,
+    sourceBranch: process.env.BUILDCHAIN_CHANNEL_PATROL_SOURCE_BRANCH,
+    targetBranch: process.env.BUILDCHAIN_CHANNEL_PATROL_TARGET_BRANCH,
+    githubOutput: process.env.GITHUB_OUTPUT,
+  });
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  try {
+    main();
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+}

package/scripts/runtime-ref-core.mjs

@@ -3,7 +3,7 @@ const TRAIN_REF_RE = /^train\/v\d+\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
 const AUTHORITY_REF_RE = /^authority\/v\d+\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
 const OFFICIAL_CHANNEL_REF_RE = /^v\d+(?:\.\d+)?(?:-alpha)?$/;
 
-export function parseWorkflowShellRef(workflowRef = "", fallback = "v2", buildchainRepository = "kungfu-systems/buildchain") {
+export function parseWorkflowShellRef(workflowRef = "", fallback = "v3", buildchainRepository = "kungfu-systems/buildchain") {
   const value = String(workflowRef || "");
   const expectedPrefix = `${buildchainRepository}/.github/workflows/`;
   if (!value.startsWith(expectedPrefix)) {
@@ -80,7 +80,7 @@ export function normalizeRequestedRuntimeRef(requestedRef = "") {
 export function resolveRuntimeSelection({
   requestedRef = "",
   workflowRef = "",
-  defaultStableRef = "v2",
+  defaultStableRef = "v3",
   buildchainRepository = "kungfu-systems/buildchain",
 } = {}) {
   const requested = String(requestedRef || "").trim();
@@ -114,9 +114,11 @@ export function resolveRuntimeSelection({
 export function validateRuntimeOverrideTrust({
   requestedRef = "",
   eventName = "",
+  eventAction = "",
   actorPermission = "",
   sameRepositoryPullRequest = false,
   pullRequestHeadSha = "",
+  workflowShellSha = "",
 } = {}) {
   if (!String(requestedRef || "").trim()) {
     return { ok: true, decision: "stable-default" };
@@ -126,6 +128,15 @@ export function validateRuntimeOverrideTrust({
   }
   const normalizedRequested = String(requestedRef || "").trim().toLowerCase();
   const normalizedHeadSha = String(pullRequestHeadSha || "").trim().toLowerCase();
+  const normalizedWorkflowShellSha = String(workflowShellSha || "").trim().toLowerCase();
+  if (
+    eventName === "pull_request" &&
+    eventAction === "closed" &&
+    EXACT_SHA_RE.test(normalizedRequested) &&
+    normalizedRequested === normalizedWorkflowShellSha
+  ) {
+    return { ok: true, decision: "closed-release-pr-shell-runtime" };
+  }
   if (
     eventName === "pull_request" &&
     sameRepositoryPullRequest === true &&

package/scripts/seal-artifact-signing-requests.mjs

@@ -52,6 +52,31 @@ function assertInside(root, target, label) {
   }
 }
 
+function containsPath(root, target) {
+  const relative = path.relative(root, target);
+  return (
+    !relative || (!relative.startsWith("..") && !path.isAbsolute(relative))
+  );
+}
+
+function resetGeneratedOutputRoot({
+  workspace,
+  cwd,
+  outputRoot,
+  protectedPaths = [],
+}) {
+  const protectedRoots = [workspace, cwd, ...protectedPaths];
+  for (const protectedPath of protectedRoots) {
+    if (containsPath(outputRoot, protectedPath)) {
+      throw new Error(
+        "signing request output must not contain the workspace, working directory, manifest, or a declared artifact",
+      );
+    }
+  }
+  fs.rmSync(outputRoot, { recursive: true, force: true });
+  fs.mkdirSync(outputRoot, { recursive: true });
+}
+
 function walkSubject(subjectRoot) {
   const entries = [];
   function visit(current) {
@@ -255,8 +280,12 @@ export function sealArtifactSigningRequests({
   );
   const resolvedOutputRoot = path.resolve(resolvedWorkspace, outputRoot);
   assertInside(resolvedWorkspace, resolvedOutputRoot, "signing request output");
-  fs.mkdirSync(resolvedOutputRoot, { recursive: true });
   if (selected.length === 0) {
+    resetGeneratedOutputRoot({
+      workspace: resolvedWorkspace,
+      cwd: resolvedCwd,
+      outputRoot: resolvedOutputRoot,
+    });
     const index = { schemaVersion: 1, contract: INDEX_CONTRACT, requests: [] };
     const indexPath = path.join(resolvedOutputRoot, "index.json");
     fs.writeFileSync(indexPath, `${JSON.stringify(index, null, 2)}\n`);
@@ -274,8 +303,7 @@ export function sealArtifactSigningRequests({
   assertInside(resolvedWorkspace, resolvedManifest, "artifact manifest");
   const manifest = JSON.parse(fs.readFileSync(resolvedManifest, "utf8"));
   const platform = normalizePlatform(manifest.platform?.os || process.platform);
-  const requests = [];
-  for (const declaration of selected) {
+  const prepared = selected.map((declaration) => {
     const subjectPath = path.resolve(resolvedCwd, declaration.path);
     assertInside(
       resolvedWorkspace,
@@ -288,7 +316,7 @@ export function sealArtifactSigningRequests({
       );
     const realSubject = fs.realpathSync(subjectPath);
     assertInside(
-      resolvedWorkspace,
+      fs.realpathSync(resolvedWorkspace),
       realSubject,
       `signing artifact ${declaration.id}`,
     );
@@ -299,8 +327,25 @@ export function sealArtifactSigningRequests({
       subjectPath,
       descriptor,
     });
-    const id = safeId(declaration.id);
-    const kind = inferKind(subjectPath, declaration.kind);
+    return {
+      declaration,
+      subjectPath,
+      descriptor,
+      id: safeId(declaration.id),
+      kind: inferKind(subjectPath, declaration.kind),
+    };
+  });
+  resetGeneratedOutputRoot({
+    workspace: resolvedWorkspace,
+    cwd: resolvedCwd,
+    outputRoot: resolvedOutputRoot,
+    protectedPaths: [
+      resolvedManifest,
+      ...prepared.map((entry) => entry.subjectPath),
+    ],
+  });
+  const requests = [];
+  for (const { declaration, subjectPath, descriptor, id, kind } of prepared) {
     const transport = archiveSubject({
       subjectPath,
       outputRoot: resolvedOutputRoot,