@kungfu-tech/buildchain 3.0.5-alpha.8 → 3.0.6-alpha.0

package/scripts/build-standalone-binary.mjs

@@ -346,6 +346,7 @@ export function buildStandaloneBinary({
       phase: "archive",
     });
   }
+  const binarySha256 = crypto.createHash("sha256").update(fs.readFileSync(binaryPath)).digest("hex");
   const manifest = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-standalone-binary",
@@ -354,7 +355,8 @@ export function buildStandaloneBinary({
     platform: triple,
     platformId: process.platform === "linux" && process.arch === "x64" ? "linux-x64" : triple,
     binary: relativePath(cwd, binaryPath),
-    sha256: crypto.createHash("sha256").update(fs.readFileSync(binaryPath)).digest("hex"),
+    sha256: binarySha256,
+    executableFiles: [{ path: path.basename(binaryPath), sha256: binarySha256 }],
     sourceSha: sourceSha(cwd),
     runtimeDependencies: [],
     archive: relativePath(cwd, archivePath),

package/scripts/buildchain-cli-help.mjs

@@ -208,7 +208,7 @@ export const BUILDCHAIN_USAGE = `Usage:
                           [--execute] [--json]
   buildchain paper status [--cwd <dir>] [--json]
   buildchain paper resume [--cwd <dir>] [--buildchain-ref <ref>] [--execute] [--json]
-  buildchain release-propagation <plan|write-lock|work|pickup> ...
+  buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
   buildchain badges readme [--cwd <dir>] [--readme <path>] [--check] [--write] [--json]
   buildchain badges bundle [--cwd <dir>] [--readme <path>] [--claims <csv>] [--check] [--write] [--json]
   buildchain homebrew update-formula --package <name> --release-passport <file-or-url> [--write] [--json]

package/scripts/check-inventory.mjs

@@ -105,6 +105,7 @@ const requiredPaths = [
   "scripts/shifu-gate-profile.mjs",
   "scripts/auditable-demo.mjs",
   "scripts/auditable-demo-platform.mjs",
+  "scripts/auditable-demo-transport-smoke.mjs",
   "scripts/auditable-demo-capture.py",
   "scripts/resolve-artifact-coordinates.mjs",
   "scripts/artifact-relay-s3.mjs",

package/scripts/compiler-cache-evidence.mjs

@@ -7,6 +7,12 @@ import { fileURLToPath } from "node:url";
 export const BUILDCHAIN_COMPILER_CACHE_PREPARATION_CONTRACT =
   "kungfu-buildchain-compiler-cache-preparation";
 
+const SCCACHE_COMPILER_BINDINGS = Object.freeze({
+  RUSTC_WRAPPER: "sccache",
+  CMAKE_C_COMPILER_LAUNCHER: "sccache",
+  CMAKE_CXX_COMPILER_LAUNCHER: "sccache",
+});
+
 const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
 
 function stableValue(value) {
@@ -76,6 +82,33 @@ function appendGithubEnv(filePath, values) {
   );
 }
 
+function sumCounters(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (!value || typeof value !== "object") return 0;
+  return Object.values(value).reduce((total, entry) => total + sumCounters(entry), 0);
+}
+
+function readSccacheStats({ cwd, env, runCommand }) {
+  const result = runCommand(
+    "sccache",
+    ["--show-stats", "--stats-format", "json"],
+    { cwd, env },
+  );
+  assertCommandSucceeded(result, "sccache current-run stats probe");
+  let payload;
+  try {
+    payload = JSON.parse(cleanText(result.stdout));
+  } catch {
+    throw new Error("sccache current-run stats probe returned invalid JSON");
+  }
+  const stats = payload?.stats || payload;
+  return {
+    compileRequests: sumCounters(stats?.compile_requests),
+    cacheHits: sumCounters(stats?.cache_hits),
+    cacheMisses: sumCounters(stats?.cache_misses),
+  };
+}
+
 function readToolEvidence({ cwd, env, expectedRoot }) {
   const configured = cleanText(
     env.BUILDCHAIN_COMPILER_CACHE_TOOL_EVIDENCE_PATH,
@@ -178,6 +211,7 @@ export function prepareCompilerCacheEvidence({
     action: {
       statsReset: true,
       command: ["sccache", "--zero-stats"],
+      compilerBindings: SCCACHE_COMPILER_BINDINGS,
     },
     bindings,
   };
@@ -191,25 +225,74 @@ export function prepareCompilerCacheEvidence({
     BUILDCHAIN_COMPILER_CACHE_ACTIVE_PROVIDER: provider,
     BUILDCHAIN_COMPILER_CACHE_PREPARATION_PATH: outputPath,
     BUILDCHAIN_COMPILER_CACHE_PREPARATION_ROOT: receipt.root,
+    ...SCCACHE_COMPILER_BINDINGS,
   });
   return receipt;
 }
 
+export function verifyCompilerCacheActivity({
+  cwd = process.cwd(),
+  env = process.env,
+  runCommand = defaultRunCommand,
+} = {}) {
+  const provider = cleanText(
+    env.BUILDCHAIN_COMPILER_CACHE_ACTIVE_PROVIDER ||
+      env.BUILDCHAIN_COMPILER_CACHE_PROVIDER ||
+      "none",
+  ).toLowerCase();
+  const required = cleanText(env.BUILDCHAIN_COMPILER_CACHE_REQUIRED).toLowerCase() === "true";
+  if (provider !== "sccache") {
+    if (required) {
+      throw new Error(`required compiler cache provider must be sccache, received ${provider || "empty"}`);
+    }
+    return undefined;
+  }
+
+  const stats = readSccacheStats({ cwd, env, runCommand });
+  const cacheableRequests = stats.cacheHits + stats.cacheMisses;
+  if (required && stats.compileRequests < 1) {
+    throw new Error(
+      "required sccache observed zero compile requests; compiler launcher bindings were not effective",
+    );
+  }
+  if (required && cacheableRequests < 1) {
+    throw new Error(
+      "required sccache observed no cacheable compiler requests",
+    );
+  }
+  return {
+    ...stats,
+    cacheableRequests,
+  };
+}
+
 function main() {
   const command = process.argv[2] || "";
-  if (command !== "prepare") {
-    throw new Error("usage: node scripts/compiler-cache-evidence.mjs prepare");
+  if (!new Set(["prepare", "verify"]).has(command)) {
+    throw new Error("usage: node scripts/compiler-cache-evidence.mjs <prepare|verify>");
   }
-  const receipt = prepareCompilerCacheEvidence();
-  if (receipt) {
-    console.log(`compiler_cache_provider=${receipt.provider}`);
-    console.log(`compiler_cache_preparation_root=${receipt.root}`);
+  if (command === "prepare") {
+    const receipt = prepareCompilerCacheEvidence();
+    if (receipt) {
+      console.log(`compiler_cache_provider=${receipt.provider}`);
+      console.log(`compiler_cache_preparation_root=${receipt.root}`);
+    } else {
+      console.log("compiler_cache_provider=none");
+    }
   } else {
-    console.log("compiler_cache_provider=none");
+    const activity = verifyCompilerCacheActivity();
+    if (activity) {
+      console.log(`compiler_cache_compile_requests=${activity.compileRequests}`);
+      console.log(`compiler_cache_hits=${activity.cacheHits}`);
+      console.log(`compiler_cache_misses=${activity.cacheMisses}`);
+    } else {
+      console.log("compiler_cache_activity=not-applicable");
+    }
   }
 }
 
 const isMain = process.argv[1] &&
+  path.basename(process.argv[1]) === "compiler-cache-evidence.mjs" &&
   path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
 if (isMain) {
   try {

package/scripts/dev-alpha-candidate-patrol.mjs

@@ -24,6 +24,16 @@ function bool(value, fallback = false) {
   return ["1", "true", "yes", "on"].includes(text(value).toLowerCase());
 }
 
+function autoMergeMethod(value, fallback = "merge") {
+  const normalized = text(value || fallback).toLowerCase();
+  if (!["merge", "squash", "rebase"].includes(normalized)) {
+    throw new Error(
+      `mergeMethod must be merge, squash, or rebase, got ${value || "<empty>"}`,
+    );
+  }
+  return normalized;
+}
+
 function repository(value) {
   const normalized = text(value);
   if (!/^[^/\s]+\/[^/\s]+$/.test(normalized))
@@ -169,6 +179,8 @@ export function managedCandidateFromPullRequest(pullRequest, targetBranch) {
     }
     return {
       number: Number(pullRequest.number),
+      nodeId: text(pullRequest.node_id),
+      autoMerge: pullRequest.auto_merge || null,
       url: text(pullRequest.html_url),
       body,
       sourceSha,
@@ -191,6 +203,8 @@ export function managedCandidateFromPullRequest(pullRequest, targetBranch) {
     );
   return {
     number: Number(pullRequest.number),
+    nodeId: text(pullRequest.node_id),
+    autoMerge: pullRequest.auto_merge || null,
     url: text(pullRequest.html_url),
     body,
     sourceSha,
@@ -282,6 +296,14 @@ export function normalizeDevAlphaPatrolOptions(options = {}) {
         process.env.BUILDCHAIN_CHANNEL_PATROL_SETTLEMENT_AUTHORIZED,
       createPullRequest,
     ),
+    autoMerge: bool(
+      options.autoMerge ?? process.env.BUILDCHAIN_CHANNEL_PATROL_AUTO_MERGE,
+      false,
+    ),
+    mergeMethod: autoMergeMethod(
+      options.mergeMethod ??
+        process.env.BUILDCHAIN_CHANNEL_PATROL_MERGE_METHOD,
+    ),
     dryRun: bool(
       options.dryRun ?? process.env.BUILDCHAIN_CHANNEL_PATROL_DRY_RUN,
       true,
@@ -541,12 +563,50 @@ function pullRequestBody({
         `- ${row.workflowName}: [run ${row.runId} attempt ${row.runAttempt}](${row.url})`,
     ),
     "",
-    "The source-lock branch must continue to point at the exact source SHA. This patrol never merges the PR, publishes a package, creates a tag, or creates a release.",
+    "The source-lock branch must continue to point at the exact source SHA. This patrol never directly merges the PR, publishes a package, creates a tag, or creates a release. Repository policy may arm GitHub auto-merge while every protected branch gate remains authoritative.",
     "",
     candidateStateMarker(state),
   ].join("\n");
 }
 
+async function armCandidateAutoMerge(
+  options,
+  controllerState,
+  pullRequest,
+  client,
+) {
+  if (
+    !options.autoMerge ||
+    !options.settlementAuthorized ||
+    options.dryRun ||
+    controllerState !== "active" ||
+    !pullRequest
+  ) {
+    return {
+      requested: options.autoMerge,
+      enabled: false,
+      mergeMethod: options.mergeMethod,
+    };
+  }
+  if (!pullRequest.auto_merge) {
+    await client.enableAutoMerge(pullRequest, options.mergeMethod);
+  }
+  return {
+    requested: true,
+    enabled: true,
+    mergeMethod: options.mergeMethod,
+  };
+}
+
+function activePullRequest(candidate) {
+  return {
+    number: candidate.number,
+    node_id: candidate.nodeId,
+    auto_merge: candidate.autoMerge,
+    html_url: candidate.url,
+  };
+}
+
 export async function runDevAlphaCandidatePatrol(
   optionsInput = {},
   clientInput,
@@ -793,10 +853,7 @@ export async function runDevAlphaCandidatePatrol(
             : "retain-next-candidate"
           : "reconcile-active-candidate";
       }
-      pullRequest = {
-        number: activeCandidate.number,
-        html_url: activeCandidate.url,
-      };
+      pullRequest = activePullRequest(activeCandidate);
     } else if (decision.eligible) {
       await client.ensureImmutableBranch(decision.sourceLockRef, sourceSha);
       state = candidateStateBody({
@@ -870,11 +927,13 @@ export async function runDevAlphaCandidatePatrol(
       }
     }
   }
+  const autoMerge = await armCandidateAutoMerge(options, controllerState, pullRequest, client);
   return {
     schema: "kungfu-buildchain-dev-alpha-candidate-patrol/v1",
     dryRun: options.dryRun,
     createPullRequest: options.createPullRequest,
     settlementAuthorized: options.settlementAuthorized,
+    autoMerge,
     decision,
     controller: {
       schema: DEV_ALPHA_CANDIDATE_STATE_SCHEMA,
@@ -1031,6 +1090,22 @@ export function createGitHubChannelCandidateClient({
         body: { head, base, title, body },
       });
     },
+    async enableAutoMerge(pullRequest, mergeMethod) {
+      if (!text(pullRequest.node_id)) {
+        throw new Error("candidate pull request has no GraphQL node id");
+      }
+      const query = `mutation($id:ID!,$mergeMethod:PullRequestMergeMethod!){enablePullRequestAutoMerge(input:{pullRequestId:$id,mergeMethod:$mergeMethod}){pullRequest{url}}}`;
+      return api("/graphql", {
+        method: "POST",
+        body: {
+          query,
+          variables: {
+            id: pullRequest.node_id,
+            mergeMethod: autoMergeMethod(mergeMethod).toUpperCase(),
+          },
+        },
+      });
+    },
     async updatePullRequestBody(
       number,
       body,

package/scripts/dev-pr-auto-merge.mjs

@@ -152,11 +152,11 @@ function summarizeChecks({ statuses = [], checkRuns = [] } = {}, requiredChecks
   };
 }
 
-function mergeableAccepted(pr) {
+function mergeableAccepted(pr, landingMode = "direct") {
   if (pr.mergeable === false) return false;
   const state = String(pr.mergeable_state || pr.mergeStateStatus || "").toLowerCase();
   if (!state) return pr.mergeable === true;
-  return ["clean", "has_hooks", "unstable", "unknown"].includes(state);
+  return ["clean", "has_hooks", "unstable", "unknown", ...(landingMode === "queue" && pr.mergeable === true ? ["blocked"] : [])].includes(state);
 }
 
 function skip(reason, details = {}) {
@@ -189,7 +189,7 @@ export async function evaluatePullRequest(pr, options, client) {
       observedBaseRef: detailed.base.ref,
     });
   }
-  if (!mergeableAccepted(detailed)) {
+  if (!mergeableAccepted(detailed, options.landingMode)) {
     return skip("not-mergeable", {
       mergeable: detailed.mergeable,
       mergeableState: detailed.mergeable_state || detailed.mergeStateStatus || "",
@@ -629,7 +629,7 @@ export async function runDevPrAutoMerge(optionsInput = {}, clientInput) {
       } else if (observedHeadSha !== expectedHeadSha) {
         admissionDecision = "rejected";
         admissionReason = "head-sha-drift";
-      } else if (!mergeableAccepted(observedPullRequest)) {
+      } else if (!mergeableAccepted(observedPullRequest, landingMode)) {
         admissionDecision = "rejected";
         admissionReason = "not-mergeable-on-admission-recheck";
       }