@kungfu-tech/buildchain 3.0.5-alpha.7 → 3.0.5

package/scripts/aws-windows-jit-controller-core.mjs

@@ -3,13 +3,12 @@
 import { digest } from "./aws-runner-burst-core.mjs";
 import {
   WINDOWS_EC2_JIT,
-  windowsJitCampaignId,
   windowsJitRunnerLabel,
   windowsJitRunnerLabels,
 } from "./aws-windows-jit-core.mjs";
 
 export const AWS_WINDOWS_JIT_CONTROLLER_CONTRACT =
-  "kungfu-buildchain-aws-windows-jit-controller/v2";
+  "kungfu-buildchain-aws-windows-jit-controller/v1";
 
 function exact(value, pattern, label) {
   const normalized = String(value || "").trim();
@@ -60,9 +59,8 @@ export function createWindowsJitLaunchPlan(values = {}) {
   );
   const jobId = exact(values.jobId, /^\d+$/, "jobId");
   const qualification = qualificationId(values.qualificationId);
-  const campaign = windowsJitCampaignId(values.campaignId);
   const runnerLabel = windowsJitRunnerLabel(values.runnerLabel);
-  const expectedLabel = `${WINDOWS_EC2_JIT.labelPrefix}${campaign}-${qualification}`;
+  const expectedLabel = `${WINDOWS_EC2_JIT.labelPrefix}${qualification}`;
   if (runnerLabel !== expectedLabel) {
     throw new Error(`runnerLabel must be ${expectedLabel}`);
   }
@@ -111,11 +109,6 @@ export function createWindowsJitLaunchPlan(values = {}) {
     /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
     "evidenceBucket",
   );
-  const stateTable = exact(
-    values.stateTable,
-    /^kungfu-buildchain-windows-jit(?:-[A-Za-z0-9_.-]+)?$/,
-    "stateTable",
-  );
   const launchedAt = iso(values.launchedAt, "launchedAt");
   const clientToken = `kungfu-${runId}-${runAttempt}-${qualification}`;
   const jitParameterName =
@@ -132,7 +125,6 @@ export function createWindowsJitLaunchPlan(values = {}) {
     tag("kungfu:owner", "buildchain"),
     tag("kungfu:plane", "aws-us-elastic-runner-burst"),
     tag("kungfu:provider", "windows-ec2-jit"),
-    tag("kungfu:campaign-id", campaign),
     tag("kungfu:github-run-id", runId),
     tag("kungfu:github-run-attempt", runAttempt),
     tag("kungfu:qualification-id", qualification),
@@ -149,7 +141,6 @@ export function createWindowsJitLaunchPlan(values = {}) {
     contract: AWS_WINDOWS_JIT_CONTROLLER_CONTRACT,
     kind: "launch-plan",
     repository,
-    campaign: { id: campaign },
     source: { sha: sourceSha, ref: sourceRef },
     github: {
       runId,
@@ -157,7 +148,6 @@ export function createWindowsJitLaunchPlan(values = {}) {
       jobId,
       qualificationId: qualification,
       event: "workflow_dispatch",
-      displayTitle: `AWS Windows JIT ${campaign} ${qualification}`,
     },
     runner: {
       name: runnerName,
@@ -174,7 +164,6 @@ export function createWindowsJitLaunchPlan(values = {}) {
       securityGroupId,
       instanceProfileName,
       evidenceBucket,
-      stateTable,
       jitParameterName,
       launchedAt,
       clientToken,
@@ -199,13 +188,6 @@ export function createWindowsJitLaunchPlan(values = {}) {
       exactSourceRequired: true,
       queuedJobRequired: true,
       activeInstanceCeiling: WINDOWS_EC2_JIT.maxConcurrentInstances,
-      campaignAcceptedInstanceCeiling: WINDOWS_EC2_JIT.maxAcceptedInstances,
-      campaignReservationUsd:
-        (WINDOWS_EC2_JIT.pricePerHourUsd *
-          WINDOWS_EC2_JIT.maximumInstanceLifetimeMinutes) /
-        60,
-      campaignBudgetLimitUsd: WINDOWS_EC2_JIT.budgetLimitUsd,
-      persistentCampaignLedgerRequired: true,
       awsDryRunRequiredBeforeLaunch: true,
       userDataTransport: "fileb://rendered-bootstrap",
       jitConfigTransport: "0600-temporary-file-to-ssm-secure-string",

package/scripts/aws-windows-jit-controller.mjs

@@ -11,10 +11,6 @@ import {
   createWindowsJitLaunchPlan,
   windowsRunInstancesArgs,
 } from "./aws-windows-jit-controller-core.mjs";
-import {
-  windowsCampaignMarkLaunchedArgs,
-  windowsCampaignReservationItems,
-} from "./aws-windows-jit-campaign-core.mjs";
 import { renderWindowsJitBootstrap } from "./aws-windows-jit-core.mjs";
 
 function arg(name, fallback = "") {
@@ -79,7 +75,6 @@ function assertLivePreflight(plan, profile) {
   );
   if (
     run.event !== plan.github.event ||
-    run.display_title !== plan.github.displayTitle ||
     run.head_sha !== plan.source.sha ||
     run.head_repository?.full_name !== plan.repository ||
     !["queued", "in_progress"].includes(run.status)
@@ -272,169 +267,6 @@ function cleanupFailedLaunch(
   return failures;
 }
 
-function generateJitConfiguration(plan) {
-  const jit = ghJson(
-    [
-      "api",
-      "--method",
-      "POST",
-      `repos/${plan.repository}/actions/runners/generate-jitconfig`,
-      "--input",
-      "-",
-    ],
-    JSON.stringify({
-      name: plan.runner.name,
-      runner_group_id: 1,
-      labels: plan.runner.labels,
-      work_folder: "_work",
-    }),
-    "GitHub JIT configuration",
-  ).encoded_jit_config;
-  if (!jit || typeof jit !== "string") {
-    throw new Error("GitHub JIT configuration was empty");
-  }
-  return jit;
-}
-
-function createJitParameter(plan, profile, parameterInputPath, jit) {
-  fs.writeFileSync(
-    parameterInputPath,
-    JSON.stringify({
-      Name: plan.aws.jitParameterName,
-      Description: `One-shot GitHub Actions JIT config for ${plan.repository} run ${plan.github.runId} attempt ${plan.github.runAttempt}`,
-      Type: "SecureString",
-      Tier: "Advanced",
-      Value: jit,
-      Tags: [
-        { Key: "kungfu:owner", Value: "buildchain" },
-        { Key: "kungfu:plane", Value: "aws-us-elastic-runner-burst" },
-        { Key: "kungfu:provider", Value: "windows-ec2-jit" },
-        { Key: "kungfu:campaign-id", Value: plan.campaign.id },
-        { Key: "kungfu:github-run-id", Value: plan.github.runId },
-        {
-          Key: "kungfu:qualification-id",
-          Value: plan.github.qualificationId,
-        },
-      ],
-    }),
-    { mode: 0o600 },
-  );
-  requireSuccess(
-    commandResult(
-      "aws",
-      awsArgs(plan, profile, [
-        "ssm",
-        "put-parameter",
-        "--cli-input-json",
-        `file://${parameterInputPath}`,
-        "--output",
-        "json",
-      ]),
-    ),
-    "SSM JIT parameter creation",
-  );
-}
-
-function writeBootstrap(plan, bootstrapPath) {
-  const template = fs.readFileSync(
-    path.resolve(
-      "infra/aws-us-elastic-runner-burst-plane/windows-jit-bootstrap.ps1",
-    ),
-    "utf8",
-  );
-  fs.writeFileSync(
-    bootstrapPath,
-    renderWindowsJitBootstrap(template, {
-      region: plan.aws.region,
-      campaignId: plan.campaign.id,
-      jitParameterName: plan.aws.jitParameterName,
-      evidenceBucket: plan.aws.evidenceBucket,
-      runnerLabel: plan.runner.label,
-      sourceSha: plan.source.sha,
-      githubRunId: plan.github.runId,
-      githubRunAttempt: plan.github.runAttempt,
-      amiId: plan.aws.amiId,
-      amiName: plan.aws.amiName,
-      instanceType: plan.aws.instanceType,
-      launchedAt: plan.aws.launchedAt,
-    }),
-    { mode: 0o600 },
-  );
-}
-
-function assertLaunchDryRun(plan, profile, bootstrapPath) {
-  const dryRun = commandResult(
-    "aws",
-    awsArgs(
-      plan,
-      profile,
-      windowsRunInstancesArgs(plan, { bootstrapPath, dryRun: true }),
-    ),
-  );
-  if (
-    dryRun.status === 0 ||
-    !/DryRunOperation/.test(`${dryRun.stdout}\n${dryRun.stderr}`)
-  ) {
-    throw new Error("EC2 RunInstances DryRun did not return DryRunOperation");
-  }
-}
-
-function reserveCampaign(plan, profile) {
-  requireSuccess(
-    commandResult(
-      "aws",
-      awsArgs(plan, profile, [
-        "dynamodb",
-        "transact-write-items",
-        "--transact-items",
-        JSON.stringify(
-          windowsCampaignReservationItems(plan, new Date().toISOString()),
-        ),
-        "--output",
-        "json",
-      ]),
-    ),
-    "Windows campaign atomic reservation",
-  );
-}
-
-function launchInstance(plan, profile, bootstrapPath) {
-  const launched = jsonResult(
-    commandResult(
-      "aws",
-      awsArgs(
-        plan,
-        profile,
-        windowsRunInstancesArgs(plan, { bootstrapPath, dryRun: false }),
-      ),
-    ),
-    "EC2 RunInstances",
-  );
-  const instance = launched.Instances?.[0];
-  if (!/^i-[0-9a-f]+$/.test(String(instance?.InstanceId || ""))) {
-    throw new Error("EC2 RunInstances returned no instance identity");
-  }
-  return instance;
-}
-
-function markCampaignLaunched(plan, profile, instanceId) {
-  requireSuccess(
-    commandResult(
-      "aws",
-      awsArgs(
-        plan,
-        profile,
-        windowsCampaignMarkLaunchedArgs(
-          plan,
-          instanceId,
-          new Date().toISOString(),
-        ),
-      ),
-    ),
-    "Windows campaign launch ledger update",
-  );
-}
-
 export function executeWindowsJitLaunch(plan, { profile = "" } = {}) {
   if (plan?.contract !== AWS_WINDOWS_JIT_CONTROLLER_CONTRACT) {
     throw new Error("Windows JIT launch plan contract is invalid");
@@ -453,23 +285,124 @@ export function executeWindowsJitLaunch(plan, { profile = "" } = {}) {
   let failure;
   const cleanupFailures = [];
   try {
-    const jit = generateJitConfiguration(plan);
-    createJitParameter(plan, profile, parameterInputPath, jit);
+    const jit = ghJson(
+      [
+        "api",
+        "--method",
+        "POST",
+        `repos/${plan.repository}/actions/runners/generate-jitconfig`,
+        "--input",
+        "-",
+      ],
+      JSON.stringify({
+        name: plan.runner.name,
+        runner_group_id: 1,
+        labels: plan.runner.labels,
+        work_folder: "_work",
+      }),
+      "GitHub JIT configuration",
+    ).encoded_jit_config;
+    if (!jit || typeof jit !== "string") {
+      throw new Error("GitHub JIT configuration was empty");
+    }
+    fs.writeFileSync(
+      parameterInputPath,
+      JSON.stringify({
+        Name: plan.aws.jitParameterName,
+        Description: `One-shot GitHub Actions JIT config for ${plan.repository} run ${plan.github.runId} attempt ${plan.github.runAttempt}`,
+        Type: "SecureString",
+        Tier: "Advanced",
+        Value: jit,
+        Tags: [
+          { Key: "kungfu:owner", Value: "buildchain" },
+          { Key: "kungfu:plane", Value: "aws-us-elastic-runner-burst" },
+          { Key: "kungfu:provider", Value: "windows-ec2-jit" },
+          { Key: "kungfu:github-run-id", Value: plan.github.runId },
+          {
+            Key: "kungfu:qualification-id",
+            Value: plan.github.qualificationId,
+          },
+        ],
+      }),
+      { mode: 0o600 },
+    );
+    requireSuccess(
+      commandResult(
+        "aws",
+        awsArgs(plan, profile, [
+          "ssm",
+          "put-parameter",
+          "--cli-input-json",
+          `file://${parameterInputPath}`,
+          "--output",
+          "json",
+        ]),
+      ),
+      "SSM JIT parameter creation",
+    );
     parameterCreated = true;
-    writeBootstrap(plan, bootstrapPath);
-    assertLaunchDryRun(plan, profile, bootstrapPath);
-    reserveCampaign(plan, profile);
+    fs.writeFileSync(
+      bootstrapPath,
+      renderWindowsJitBootstrap(
+        fs.readFileSync(
+          path.resolve(
+            "infra/aws-us-elastic-runner-burst-plane/windows-jit-bootstrap.ps1",
+          ),
+          "utf8",
+        ),
+        {
+          region: plan.aws.region,
+          jitParameterName: plan.aws.jitParameterName,
+          evidenceBucket: plan.aws.evidenceBucket,
+          runnerLabel: plan.runner.label,
+          sourceSha: plan.source.sha,
+          githubRunId: plan.github.runId,
+          githubRunAttempt: plan.github.runAttempt,
+          amiId: plan.aws.amiId,
+          amiName: plan.aws.amiName,
+          instanceType: plan.aws.instanceType,
+          launchedAt: plan.aws.launchedAt,
+        },
+      ),
+      { mode: 0o600 },
+    );
+    const dryRun = commandResult(
+      "aws",
+      awsArgs(
+        plan,
+        profile,
+        windowsRunInstancesArgs(plan, { bootstrapPath, dryRun: true }),
+      ),
+    );
+    if (
+      dryRun.status === 0 ||
+      !/DryRunOperation/.test(`${dryRun.stdout}\n${dryRun.stderr}`)
+    ) {
+      throw new Error("EC2 RunInstances DryRun did not return DryRunOperation");
+    }
     launchAttempted = true;
-    const instance = launchInstance(plan, profile, bootstrapPath);
+    const launched = jsonResult(
+      commandResult(
+        "aws",
+        awsArgs(
+          plan,
+          profile,
+          windowsRunInstancesArgs(plan, { bootstrapPath, dryRun: false }),
+        ),
+      ),
+      "EC2 RunInstances",
+    );
+    const instance = launched.Instances?.[0];
+    if (!/^i-[0-9a-f]+$/.test(String(instance?.InstanceId || ""))) {
+      throw new Error("EC2 RunInstances returned no instance identity");
+    }
     launchSucceeded = true;
-    markCampaignLaunched(plan, profile, instance.InstanceId);
     result = {
       schemaVersion: 1,
       contract: AWS_WINDOWS_JIT_CONTROLLER_CONTRACT,
       kind: "launch-result",
       status: "launched",
       source: plan.source,
-      campaign: plan.campaign,
       github: plan.github,
       runner: plan.runner,
       aws: {
@@ -519,7 +452,6 @@ function planFromArgs(execute) {
     runAttempt: arg("run-attempt", "1"),
     jobId: arg("job-id"),
     qualificationId: arg("qualification-id"),
-    campaignId: arg("campaign-id"),
     runnerLabel: arg("runner-label"),
     runnerName: arg("runner-name"),
     sourceSha: arg("source-sha"),
@@ -532,7 +464,6 @@ function planFromArgs(execute) {
     securityGroupId: arg("security-group-id"),
     instanceProfileName: arg("instance-profile-name"),
     evidenceBucket: arg("evidence-bucket"),
-    stateTable: arg("state-table"),
     jitParameterName: arg("jit-parameter"),
     launchedAt: arg("launched-at", new Date().toISOString()),
   });
@@ -551,12 +482,6 @@ export function main() {
   if (arg("confirm-run-id") !== plan.github.runId) {
     throw new Error("--confirm-run-id must equal the exact GitHub run id");
   }
-  if (arg("confirm-campaign-id") !== plan.campaign.id) {
-    throw new Error("--confirm-campaign-id must equal the campaign id");
-  }
-  if (arg("confirm-state-table") !== plan.aws.stateTable) {
-    throw new Error("--confirm-state-table must equal the campaign state table");
-  }
   const result = executeWindowsJitLaunch(plan, {
     profile: arg("aws-profile"),
   });

package/scripts/aws-windows-jit-core.mjs

@@ -10,9 +10,9 @@ export const WINDOWS_EC2_JIT = Object.freeze({
   instanceType: "c7i.4xlarge",
   pricePerHourUsd: 1.45,
   maximumInstanceLifetimeMinutes: 180,
-  maxConcurrentInstances: 1,
-  maxAcceptedInstances: 5,
-  budgetLimitUsd: 80,
+  maxConcurrentInstances: 2,
+  maxAcceptedInstances: 6,
+  budgetLimitUsd: 40,
   minimumSmokeJobs: 1,
   minimumFullJobs: 3,
   maximumCleanupLatencySeconds: 900,
@@ -75,14 +75,6 @@ export function windowsJitRunnerLabels(value) {
   return ["self-hosted", "Windows", "X64", windowsJitRunnerLabel(value)];
 }
 
-export function windowsJitCampaignId(value) {
-  const campaign = String(value || "").trim();
-  if (!/^win-[a-z0-9][a-z0-9-]{2,15}$/.test(campaign)) {
-    throw new Error("campaignId must be a bounded Windows campaign id");
-  }
-  return campaign;
-}
-
 export function renderWindowsJitBootstrap(template, values = {}) {
   const runnerLabel = windowsJitRunnerLabel(values.runnerLabel);
   const jitParameterName = String(values.jitParameterName || "").trim();
@@ -94,7 +86,6 @@ export function renderWindowsJitBootstrap(template, values = {}) {
   }
   const bounded = {
     REGION: String(values.region || WINDOWS_EC2_JIT.region),
-    CAMPAIGN_ID: String(values.campaignId || ""),
     JIT_PARAMETER_NAME: jitParameterName,
     EVIDENCE_BUCKET: String(values.evidenceBucket || ""),
     RUNNER_LABEL: runnerLabel,
@@ -108,7 +99,6 @@ export function renderWindowsJitBootstrap(template, values = {}) {
   };
   const patterns = {
     REGION: /^us-[a-z]+-\d$/,
-    CAMPAIGN_ID: /^win-[a-z0-9][a-z0-9-]{2,43}$/,
     EVIDENCE_BUCKET: /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
     GITHUB_RUN_ID: /^\d+$/,
     GITHUB_RUN_ATTEMPT: /^\d+$/,
@@ -194,7 +184,6 @@ export function windowsEc2JitPlan(overrides = {}) {
 
 export function createWindowsJitEvidence({
   repository,
-  campaignId,
   sourceSha,
   sourceRef,
   githubRunId,
@@ -246,7 +235,6 @@ export function createWindowsJitEvidence({
     phase: WINDOWS_EC2_JIT.phase,
     provider: "aws-ec2",
     repository,
-    campaign: { id: windowsJitCampaignId(campaignId) },
     source: {
       sha: exactSha(sourceSha, "sourceSha"),
       ref: String(sourceRef || "").trim(),
@@ -298,7 +286,6 @@ export function createWindowsJitEvidence({
 }
 
 export function verifyWindowsEc2JitQualification({
-  campaignId,
   jobs = [],
   cancellationCleanup = {},
   timeoutCleanup = {},
@@ -312,7 +299,6 @@ export function verifyWindowsEc2JitQualification({
 } = {}) {
   const plan = windowsEc2JitPlan();
   const issues = [];
-  const campaign = windowsJitCampaignId(campaignId);
   const accepted = jobs.filter(
     (job) =>
       job?.trusted === true &&
@@ -322,9 +308,6 @@ export function verifyWindowsEc2JitQualification({
   );
   const smokeJobs = accepted.filter((job) => job.kind === "smoke");
   const fullJobs = accepted.filter((job) => job.kind === "full");
-  if (accepted.some((job) => job.campaignId !== campaign)) {
-    issues.push("accepted-jobs-not-bound-to-campaign");
-  }
   if (smokeJobs.length < plan.config.minimumSmokeJobs) {
     issues.push("runner-profile-smoke-missing");
   }
@@ -366,7 +349,6 @@ export function verifyWindowsEc2JitQualification({
     contract: AWS_WINDOWS_JIT_CONTRACT,
     kind: "phase-verification",
     phase: plan.config.phase,
-    campaign: { id: campaign },
     status: issues.length ? "failed" : "passed",
     qualifying: issues.length === 0,
     metrics: {

package/scripts/aws-windows-jit.mjs

@@ -35,7 +35,6 @@ export function main() {
   if (mode === "evidence") {
     const result = createWindowsJitEvidence({
       repository: process.env.GITHUB_REPOSITORY,
-      campaignId: process.env.AWS_EC2_CAMPAIGN_ID,
       sourceSha:
         process.env.BUILDCHAIN_EXPECTED_SOURCE_SHA || process.env.GITHUB_SHA,
       sourceRef:
@@ -78,7 +77,6 @@ export function main() {
       fs.readFileSync(path.resolve(template), "utf8"),
       {
         region: arg("region", "us-east-1"),
-        campaignId: arg("campaign-id"),
         jitParameterName: arg("jit-parameter"),
         evidenceBucket: arg("evidence-bucket"),
         runnerLabel: arg("runner-label"),

package/scripts/build-standalone-binary.mjs

@@ -352,11 +352,7 @@ export function buildStandaloneBinary({
     name,
     version,
     platform: triple,
-    platformId: process.platform === "linux" && process.arch === "x64" ? "linux-x64" : triple,
     binary: relativePath(cwd, binaryPath),
-    sha256: crypto.createHash("sha256").update(fs.readFileSync(binaryPath)).digest("hex"),
-    sourceSha: sourceSha(cwd),
-    runtimeDependencies: [],
     archive: relativePath(cwd, archivePath),
     node: process.version,
     observability: {

package/scripts/buildchain-cli-help.mjs

@@ -208,7 +208,7 @@ export const BUILDCHAIN_USAGE = `Usage:
                           [--execute] [--json]
   buildchain paper status [--cwd <dir>] [--json]
   buildchain paper resume [--cwd <dir>] [--buildchain-ref <ref>] [--execute] [--json]
-  buildchain release-propagation <plan|write-lock|work|pickup> ...
+  buildchain release-propagation <plan|write-lock> ...
   buildchain badges readme [--cwd <dir>] [--readme <path>] [--check] [--write] [--json]
   buildchain badges bundle [--cwd <dir>] [--readme <path>] [--claims <csv>] [--check] [--write] [--json]
   buildchain homebrew update-formula --package <name> --release-passport <file-or-url> [--write] [--json]
@@ -246,7 +246,6 @@ Examples:
   buildchain paper preflight --json
   buildchain paper status --json
   buildchain release-propagation plan --graph graph.json --upstream-release release.json --json
-  buildchain release-propagation pickup plan --config manual-upstreams.json --source-id buildchain --channel release --current-version 3.0.3 --json
   buildchain kfd status --json
   buildchain kfd schema list --json
   buildchain kfd 1 witness --json

package/scripts/capture-package-release-propagation.mjs

@@ -49,30 +49,7 @@ function assertSourcePath(value) {
   return sourcePath;
 }
 
-function hasCommit(sourceSha, cwd) {
-  try {
-    execFileSync("git", ["cat-file", "-e", `${sourceSha}^{commit}`], {
-      cwd,
-      stdio: "ignore",
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export function readConfigAtSource(sourceSha, configPath, cwd) {
-  if (!hasCommit(sourceSha, cwd)) {
-    try {
-      execFileSync("git", ["fetch", "--no-tags", "--depth=1", "origin", sourceSha], {
-        cwd,
-        stdio: ["ignore", "pipe", "pipe"],
-      });
-    } catch (error) {
-      const detail = String(error.stderr || error.message || "unknown git fetch failure").trim();
-      throw new Error(`exact release source ${sourceSha} is unavailable from origin: ${detail}`);
-    }
-  }
+function readConfigAtSource(sourceSha, configPath, cwd) {
   const bytes = execFileSync("git", ["show", `${sourceSha}:${configPath}`], {
     cwd,
     encoding: "utf8",

package/scripts/check-inventory.mjs

@@ -73,7 +73,6 @@ const requiredPaths = [
   "docs/github-artifact-attestation.md",
   "docs/shifu-gate-profiles.md",
   "docs/auditable-demo.md",
-  "contracts/auditable-demo-scenario-v1.schema.json",
   "contracts/auditable-demo-media-profiles-v1.json",
   "contracts/evidence/auditable-demo-web-delivery-v1.json",
   "contracts/evidence/auditable-demo-responsive-web-delivery-v1.json",
@@ -104,8 +103,6 @@ const requiredPaths = [
   "scripts/seal-macos-credential-input.mjs",
   "scripts/shifu-gate-profile.mjs",
   "scripts/auditable-demo.mjs",
-  "scripts/auditable-demo-platform.mjs",
-  "scripts/auditable-demo-capture.py",
   "scripts/resolve-artifact-coordinates.mjs",
   "scripts/artifact-relay-s3.mjs",
   "scripts/anchored-version-material.mjs",
@@ -157,8 +154,6 @@ const requiredPaths = [
   ".github/workflows/.build.yml",
   ".github/workflows/.gate-profile.yml",
   ".github/workflows/.auditable-demo.yml",
-  ".github/workflows/.declarative-auditable-demo.yml",
-  ".github/workflows/auditable-demo.yml",
   ".github/workflows/build.yml",
   ".github/workflows/build-surface-fixture.yml",
   ".github/workflows/candidate-lab.yml",