@kungfu-tech/buildchain 3.0.5 → 3.0.6-alpha.0

package/scripts/dispatch-artifact-signing-authority.mjs

@@ -12,37 +12,110 @@ function required(value, label) {
 
 function repository(value, label) {
   const normalized = required(value, label);
-  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(normalized)) throw new Error(`${label} must be owner/repository`);
+  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(normalized))
+    throw new Error(`${label} must be owner/repository`);
   return normalized;
 }
 
 const TRANSIENT_GITHUB_STATUSES = new Set([408, 429, 500, 502, 503, 504]);
-const DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF = "authority/v3/v3.0/artifact-signing";
+const DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF =
+  "authority/v3/v3.0/artifact-signing";
+const AUTHORITY_WORKFLOW = "artifact-signing-authority.yml";
 
 export function resolveAuthorityDispatchRef(value) {
   const ref = required(value, "authority ref");
-  return /^[0-9a-f]{40}$/u.test(ref) ? DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF : ref;
+  return /^[0-9a-f]{40}$/u.test(ref)
+    ? DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF
+    : ref;
+}
+
+export async function resolveArtifactSigningAuthorityRuntime({
+  authorityRepository,
+  authorityRef,
+  token,
+  requestImpl = githubRequest,
+}) {
+  const authorityRepo = repository(authorityRepository, "authority repository");
+  const ref = resolveAuthorityDispatchRef(authorityRef);
+  const encodedRef = ref.split("/").map(encodeURIComponent).join("/");
+  const response = await requestImpl(
+    `/repos/${authorityRepo}/git/ref/heads/${encodedRef}`,
+    { token: required(token, "Buildchain authority dispatch token") },
+  );
+  if (response?.object?.type !== "commit") {
+    throw new Error(
+      "Buildchain signing authority ref does not resolve to a commit",
+    );
+  }
+  const sha = String(response.object.sha || "");
+  if (!/^[0-9a-f]{40}$/u.test(sha)) {
+    throw new Error("Buildchain signing authority runtime SHA must be exact");
+  }
+  return { ref, sha };
 }
 
 function retryDelayMs(attempt) {
-  return Math.min(1_000 * (2 ** (attempt - 1)), 10_000);
+  return Math.min(1_000 * 2 ** (attempt - 1), 10_000);
 }
 
-export async function githubRequest(url, {
-  token,
-  method = "GET",
-  body,
-  fetchImpl = fetch,
-  delayImpl = delay,
-  maxAttempts = 5,
-  warnImpl = console.warn,
-} = {}) {
+function authorityError(message, outputs = {}) {
+  const error = new Error(message);
+  error.authorityOutputs = outputs;
+  return error;
+}
+
+export function validateArtifactSigningAuthorityRun(
+  run,
+  { authorityRepository, authorityRuntimeSha, expectedTitle },
+) {
+  if (!run || typeof run !== "object") {
+    throw new Error("Buildchain signing authority run is missing");
+  }
+  if (String(run.display_title || "") !== expectedTitle) {
+    throw new Error("Buildchain signing authority correlation mismatch");
+  }
+  if (String(run.event || "") !== "workflow_dispatch") {
+    throw new Error("Buildchain signing authority event mismatch");
+  }
+  if (String(run.head_sha || "") !== authorityRuntimeSha) {
+    throw new Error("Buildchain signing authority runtime SHA mismatch");
+  }
+  if (
+    run.repository?.full_name &&
+    String(run.repository.full_name) !== authorityRepository
+  ) {
+    throw new Error("Buildchain signing authority repository mismatch");
+  }
+  if (
+    run.path &&
+    !String(run.path).startsWith(`.github/workflows/${AUTHORITY_WORKFLOW}@`)
+  ) {
+    throw new Error("Buildchain signing authority workflow path mismatch");
+  }
+  return run;
+}
+
+export async function githubRequest(
+  url,
+  {
+    token,
+    method = "GET",
+    body,
+    fetchImpl = fetch,
+    delayImpl = delay,
+    maxAttempts = 5,
+    warnImpl = console.warn,
+  } = {},
+) {
   const methodName = String(method).toUpperCase();
   const retrySafe = methodName === "GET";
   const requestedAttempts = Number(maxAttempts);
-  const attemptLimit = retrySafe && Number.isSafeInteger(requestedAttempts) && requestedAttempts > 0
-    ? requestedAttempts
-    : 1;
+  const attemptLimit =
+    retrySafe &&
+    Number.isSafeInteger(requestedAttempts) &&
+    requestedAttempts > 0
+      ? requestedAttempts
+      : 1;
   for (let attempt = 1; attempt <= attemptLimit; attempt += 1) {
     let response;
     try {
@@ -59,7 +132,9 @@ export async function githubRequest(url, {
       });
     } catch (error) {
       if (retrySafe && attempt < attemptLimit) {
-        warnImpl(`Buildchain signing authority: GitHub API GET transport failure; retry ${attempt + 1}/${attemptLimit}`);
+        warnImpl(
+          `Buildchain signing authority: GitHub API GET transport failure; retry ${attempt + 1}/${attemptLimit}`,
+        );
         await delayImpl(retryDelayMs(attempt));
         continue;
       }
@@ -67,19 +142,29 @@ export async function githubRequest(url, {
     }
     if (!response.ok) {
       const text = await response.text();
-      if (retrySafe && TRANSIENT_GITHUB_STATUSES.has(response.status) && attempt < attemptLimit) {
-        warnImpl(`Buildchain signing authority: GitHub API GET returned ${response.status}; retry ${attempt + 1}/${attemptLimit}`);
+      if (
+        retrySafe &&
+        TRANSIENT_GITHUB_STATUSES.has(response.status) &&
+        attempt < attemptLimit
+      ) {
+        warnImpl(
+          `Buildchain signing authority: GitHub API GET returned ${response.status}; retry ${attempt + 1}/${attemptLimit}`,
+        );
         await delayImpl(retryDelayMs(attempt));
         continue;
       }
-      throw new Error(`GitHub API ${methodName} ${url} failed (${response.status}): ${text.slice(0, 500)}`);
+      throw new Error(
+        `GitHub API ${methodName} ${url} failed (${response.status}): ${text.slice(0, 500)}`,
+      );
     }
     if (response.status === 204) return {};
     try {
       return await response.json();
     } catch (error) {
       if (retrySafe && attempt < attemptLimit) {
-        warnImpl(`Buildchain signing authority: GitHub API GET response failed to decode; retry ${attempt + 1}/${attemptLimit}`);
+        warnImpl(
+          `Buildchain signing authority: GitHub API GET response failed to decode; retry ${attempt + 1}/${attemptLimit}`,
+        );
         await delayImpl(retryDelayMs(attempt));
         continue;
       }
@@ -89,70 +174,236 @@ export async function githubRequest(url, {
   throw new Error("GitHub API retry loop exhausted");
 }
 
+async function pollArtifactSigningAuthorityRun({
+  authorityRepository,
+  token,
+  authorityRuntimeSha,
+  expectedTitle,
+  startedAtMs,
+  deadline,
+  baseOutputs,
+  requestImpl,
+  delayImpl,
+  nowImpl,
+}) {
+  let run;
+  while (nowImpl() < deadline) {
+    const response = await requestImpl(
+      `/repos/${authorityRepository}/actions/workflows/${AUTHORITY_WORKFLOW}/runs?event=workflow_dispatch&per_page=50`,
+      { token },
+    );
+    const matches = (response.workflow_runs || []).filter(
+      (entry) =>
+        new Date(entry.created_at).getTime() >= startedAtMs - 30_000 &&
+        String(entry.display_title || "") === expectedTitle,
+    );
+    if (matches.length > 1) {
+      throw authorityError(
+        "multiple Buildchain signing authority runs share one correlation",
+        { ...baseOutputs, "authority-status": "failed" },
+      );
+    }
+    if (matches.length === 1) {
+      try {
+        run = validateArtifactSigningAuthorityRun(matches[0], {
+          authorityRepository,
+          authorityRuntimeSha,
+          expectedTitle,
+        });
+      } catch (error) {
+        throw authorityError(error.message, {
+          ...baseOutputs,
+          "authority-run-id": String(matches[0].id || ""),
+          "authority-run-url": String(matches[0].html_url || ""),
+          "authority-status": "failed",
+        });
+      }
+    }
+    if (run?.status === "completed") return run;
+    await delayImpl(10_000);
+  }
+  throw authorityError("timed out waiting for Buildchain signing authority", {
+    ...baseOutputs,
+    "authority-run-id": String(run?.id || ""),
+    "authority-run-url": String(run?.html_url || ""),
+    "authority-status": "timed-out",
+    "authority-conclusion": String(run?.conclusion || "timed-out"),
+    "controller-completed-at": new Date(nowImpl()).toISOString(),
+  });
+}
+
+function successfulAuthorityResult({
+  run,
+  baseOutputs,
+  resultArtifact,
+  correlationId,
+  controllerStartedAt,
+  completedAt,
+}) {
+  if (run.conclusion !== "success") {
+    const status = run.conclusion === "cancelled" ? "cancelled" : "failed";
+    throw authorityError(
+      `Buildchain signing authority failed: ${run.html_url}`,
+      {
+        ...baseOutputs,
+        "authority-run-id": String(run.id),
+        "authority-run-url": String(run.html_url || ""),
+        "authority-status": status,
+        "authority-conclusion": String(run.conclusion || status),
+        "controller-completed-at": completedAt,
+      },
+    );
+  }
+  return {
+    outputs: {
+      ...baseOutputs,
+      "authority-run-id": String(run.id),
+      "authority-run-url": String(run.html_url || ""),
+      "authority-status": "succeeded",
+      "authority-conclusion": "success",
+      "controller-completed-at": completedAt,
+    },
+    result: {
+      runId: run.id,
+      runUrl: run.html_url,
+      authorityRuntimeSha: baseOutputs["authority-runtime-sha"],
+      resultArtifact,
+      correlationId,
+      status: "succeeded",
+      startedAt: controllerStartedAt,
+      completedAt,
+    },
+  };
+}
+
 export async function dispatchArtifactSigningAuthority({
   token = process.env.BUILDCHAIN_AUTHORITY_DISPATCH_TOKEN,
-  authorityRepository = process.env.BUILDCHAIN_AUTHORITY_REPOSITORY || "kungfu-systems/buildchain",
+  authorityRepository = process.env.BUILDCHAIN_AUTHORITY_REPOSITORY ||
+    "kungfu-systems/buildchain",
   authorityRef = process.env.BUILDCHAIN_AUTHORITY_REF,
   sourceRepository = process.env.GITHUB_REPOSITORY,
   sourceRunId = process.env.GITHUB_RUN_ID,
   sourceRunAttempt = process.env.GITHUB_RUN_ATTEMPT || "1",
   requestArtifact = process.env.BUILDCHAIN_SIGNING_REQUEST_ARTIFACT,
+  requestRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT_DIGEST,
   runtimeSha = process.env.BUILDCHAIN_RUNTIME_SHA,
   resultArtifact = process.env.BUILDCHAIN_SIGNING_RESULT_ARTIFACT,
+  correlationId = process.env.BUILDCHAIN_AUTHORITY_CORRELATION_ID || "",
   timeoutSeconds = process.env.BUILDCHAIN_SIGNING_TIMEOUT_SECONDS || "7200",
+  requestImpl = githubRequest,
+  delayImpl = delay,
+  nowImpl = () => Date.now(),
 } = {}) {
   const authToken = required(token, "Buildchain authority dispatch token");
   const authorityRepo = repository(authorityRepository, "authority repository");
   const sourceRepo = repository(sourceRepository, "source repository");
   const ref = resolveAuthorityDispatchRef(authorityRef);
   const runtime = required(runtimeSha, "Buildchain runtime SHA");
-  if (!/^[0-9a-f]{40}$/u.test(runtime)) throw new Error("Buildchain runtime SHA must be exact");
-  const correlationId = `${required(sourceRunId, "source run ID")}-${required(sourceRunAttempt, "source run attempt")}-${runtime.slice(0, 12)}-${required(requestArtifact, "request artifact").replace(/[^A-Za-z0-9._-]+/gu, "-")}`;
+  if (!/^[0-9a-f]{40}$/u.test(runtime))
+    throw new Error("Buildchain runtime SHA must be exact");
+  const runId = required(sourceRunId, "source run ID");
+  const runAttempt = required(sourceRunAttempt, "source run attempt");
+  if (!/^[1-9][0-9]*$/u.test(runAttempt)) {
+    throw new Error("source run attempt must be a positive integer");
+  }
+  const requestName = required(requestArtifact, "request artifact");
+  const requestRootDigest = required(requestRoot, "request root");
+  if (!/^sha256:[0-9a-f]{64}$/u.test(requestRootDigest)) {
+    throw new Error("request root must be a canonical sha256 root");
+  }
+  const correlation = required(
+    correlationId ||
+      `${runId}-${runAttempt}-${runtime.slice(0, 12)}-${requestName.replace(/[^A-Za-z0-9._-]+/gu, "-")}`,
+    "correlation ID",
+  );
   const resultName = required(resultArtifact, "result artifact");
-  const workflow = "artifact-signing-authority.yml";
-  const startedAt = Date.now() - 30_000;
-  await githubRequest(`/repos/${authorityRepo}/actions/workflows/${workflow}/dispatches`, {
-    token: authToken,
-    method: "POST",
-    body: {
-      ref,
-      inputs: {
-        "source-repository": sourceRepo,
-        "source-run-id": String(sourceRunId),
-        "request-artifact-pattern": required(requestArtifact, "request artifact"),
-        "result-artifact-name": resultName,
-        "correlation-id": correlationId,
-        "expected-runtime-sha": runtime,
+  const timeout = Number(timeoutSeconds);
+  if (!Number.isFinite(timeout) || timeout <= 0) {
+    throw new Error("Buildchain signing timeout must be positive");
+  }
+  const controllerStartedAtMs = nowImpl();
+  const controllerStartedAt = new Date(controllerStartedAtMs).toISOString();
+  const baseOutputs = {
+    "result-artifact": resultName,
+    "correlation-id": correlation,
+    "controller-started-at": controllerStartedAt,
+  };
+  try {
+    const authorityRuntime = await resolveArtifactSigningAuthorityRuntime({
+      authorityRepository: authorityRepo,
+      authorityRef: ref,
+      token: authToken,
+      requestImpl,
+    });
+    baseOutputs["authority-runtime-sha"] = authorityRuntime.sha;
+    await requestImpl(
+      `/repos/${authorityRepo}/actions/workflows/${AUTHORITY_WORKFLOW}/dispatches`,
+      {
+        token: authToken,
+        method: "POST",
+        body: {
+          ref: authorityRuntime.ref,
+          inputs: {
+            "source-repository": sourceRepo,
+            "source-run-id": runId,
+            "source-run-attempt": runAttempt,
+            "request-artifact-pattern": requestName,
+            "expected-request-root": requestRootDigest,
+            "result-artifact-name": resultName,
+            "correlation-id": correlation,
+            "expected-runtime-sha": runtime,
+          },
+        },
       },
-    },
-  });
-  const deadline = Date.now() + Number(timeoutSeconds) * 1000;
-  let run;
-  while (Date.now() < deadline) {
-    const response = await githubRequest(`/repos/${authorityRepo}/actions/workflows/${workflow}/runs?event=workflow_dispatch&per_page=50`, { token: authToken });
-    run = (response.workflow_runs || []).find((entry) =>
-      new Date(entry.created_at).getTime() >= startedAt &&
-      String(entry.display_title || "").includes(correlationId),
     );
-    if (run?.status === "completed") break;
-    await delay(10_000);
-  }
-  if (!run || run.status !== "completed") throw new Error("timed out waiting for Buildchain signing authority");
-  if (run.conclusion !== "success") throw new Error(`Buildchain signing authority failed: ${run.html_url}`);
-  writeGitHubOutputs({
-    "authority-run-id": String(run.id),
-    "authority-run-url": run.html_url,
-    "result-artifact": resultName,
-    "correlation-id": correlationId,
-  });
-  return { runId: run.id, runUrl: run.html_url, resultArtifact: resultName, correlationId };
+    const expectedTitle = `Sign ${sourceRepo} run ${runId} (${correlation})`;
+    const run = await pollArtifactSigningAuthorityRun({
+      authorityRepository: authorityRepo,
+      token: authToken,
+      authorityRuntimeSha: authorityRuntime.sha,
+      expectedTitle,
+      startedAtMs: controllerStartedAtMs,
+      deadline: controllerStartedAtMs + timeout * 1000,
+      baseOutputs,
+      requestImpl,
+      delayImpl,
+      nowImpl,
+    });
+    const completedAt = new Date(nowImpl()).toISOString();
+    const completed = successfulAuthorityResult({
+      run,
+      baseOutputs,
+      resultArtifact: resultName,
+      correlationId: correlation,
+      controllerStartedAt,
+      completedAt,
+    });
+    writeGitHubOutputs(completed.outputs);
+    return completed.result;
+  } catch (error) {
+    if (!error.authorityOutputs) {
+      error.authorityOutputs = {
+        ...baseOutputs,
+        "authority-status": "failed",
+        "authority-conclusion": "controller-error",
+        "controller-completed-at": new Date(nowImpl()).toISOString(),
+      };
+    }
+    throw error;
+  }
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
   try {
     await dispatchArtifactSigningAuthority();
   } catch (error) {
-    console.error(`::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`);
+    if (error?.authorityOutputs) writeGitHubOutputs(error.authorityOutputs);
+    console.error(
+      `::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`,
+    );
     process.exitCode = 1;
   }
 }

package/scripts/finalize-native-artifact-signing-result.mjs

@@ -12,6 +12,7 @@ import {
   artifactSigningEvidenceDigest,
   createArtifactSigningResult,
 } from "../packages/core/artifact-signing-result.js";
+import { acceptedMacosCredentialEvidence } from "../actions/macos-credential-island/dmg-assembly.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 function required(value, label) {
@@ -32,15 +33,39 @@ function resolveBelow(root, relative, label) {
   return target;
 }
 
+function expectedCredentialExecution(
+  appBundleResult,
+  expectedRunId,
+  expectedRunAttempt,
+) {
+  if (!appBundleResult) return null;
+  return {
+    runId: required(expectedRunId, "credential execution run id"),
+    runAttempt: required(
+      expectedRunAttempt,
+      "credential execution run attempt",
+    ),
+  };
+}
+
+function acceptedProviderEvidence(evidence, request, expectedExecution) {
+  return expectedExecution
+    ? acceptedMacosCredentialEvidence(evidence, request, expectedExecution)
+    : evidence.status === "passed" &&
+        evidence.provider === request.signature.provider;
+}
+
 export function finalizeNativeArtifactSigningResult({
   requestRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT,
   requestPath = process.env.BUILDCHAIN_SIGNING_REQUEST_PATH,
   signedPayload = process.env.BUILDCHAIN_SIGNED_PAYLOAD,
   evidencePath = process.env.BUILDCHAIN_SIGNING_EVIDENCE,
-  credentialArtifactRoot =
-    process.env.BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
+  credentialArtifactRoot = process.env
+    .BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
   outputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
   checks = process.env.BUILDCHAIN_SIGNING_VERIFICATION_CHECKS,
+  expectedRunId = process.env.GITHUB_RUN_ID,
+  expectedRunAttempt = process.env.GITHUB_RUN_ATTEMPT,
 } = {}) {
   const requests = path.resolve(required(requestRoot, "signing request root"));
   const request = JSON.parse(
@@ -77,19 +102,16 @@ export function finalizeNativeArtifactSigningResult({
   fs.copyFileSync(evidenceSource, evidenceOutput, fs.constants.COPYFILE_EXCL);
   const evidenceDocument = JSON.parse(fs.readFileSync(evidenceOutput, "utf8"));
   const appBundleResult = request.artifact.kind === "app-bundle";
-  const providerEvidencePassed = appBundleResult
-    ? evidenceDocument.schema ===
-        "buildchain.macos-credential-island-evidence/v1" &&
-      evidenceDocument.status === "accepted" &&
-      evidenceDocument.source?.repository === request.source.repository &&
-      evidenceDocument.source?.sha === request.source.sha &&
-      evidenceDocument.source?.treeSha === request.source.treeSha &&
-      evidenceDocument.buildchain?.runtimeSha === request.runtime.sha &&
-      evidenceDocument.app?.architecture === request.artifact.arch &&
-      evidenceDocument.notarization?.application?.status === "Accepted" &&
-      evidenceDocument.notarization?.diskImage?.status === "Accepted"
-    : evidenceDocument.status === "passed" &&
-      evidenceDocument.provider === request.signature.provider;
+  const expectedExecution = expectedCredentialExecution(
+    appBundleResult,
+    expectedRunId,
+    expectedRunAttempt,
+  );
+  const providerEvidencePassed = acceptedProviderEvidence(
+    evidenceDocument,
+    request,
+    expectedExecution,
+  );
   if (!providerEvidencePassed) {
     throw new Error(
       "provider evidence does not prove the requested native signature",

package/scripts/generate-site-bundle.mjs

@@ -364,6 +364,7 @@ const manualMetaById = new Map(Object.entries({
   "release-activation-transaction": { capabilityGroup: "release-passport-trust", audience: ["release-operator", "agent"], maturity: "preview", order: 125 },
   "release-candidate": { capabilityGroup: "reusable-build", audience: ["release-operator", "consumer"], maturity: "stable", order: 130 },
   "stable-candidate-patrol": { capabilityGroup: "governance-versioning", audience: ["release-operator", "consumer"], maturity: "preview", order: 135 },
+  "dev-qualification-patrol": { capabilityGroup: "governance-versioning", audience: ["release-operator", "consumer", "agent"], maturity: "preview", order: 136 },
   "dev-alpha-candidate-patrol": { capabilityGroup: "governance-versioning", audience: ["release-operator", "consumer", "agent"], maturity: "preview", order: 137 },
   "observed-evidence-patrol": { capabilityGroup: "governance-versioning", audience: ["release-operator", "consumer", "agent"], maturity: "preview", order: 140 },
   "reusable-build-surface": { capabilityGroup: "reusable-build", audience: ["consumer", "release-operator"], maturity: "stable", order: 200 },
@@ -724,6 +725,7 @@ function buildSiteBundle() {
       "docs/reusable-build-surface.md",
       "docs/release-candidate.md",
       "docs/stable-candidate-patrol.md",
+      "docs/dev-qualification-patrol.md",
       "docs/dev-alpha-candidate-patrol.md",
       "docs/observed-evidence-patrol.md",
       "docs/release-governance.md",
@@ -767,6 +769,7 @@ function buildSiteBundle() {
         ["build", "channel-build-router"],
         [".build", "reusable-build"],
         [".auditable-demo", "auditable-demo"],
+        [".declarative-auditable-demo", "declarative-auditable-demo"],
         ["web-surface", "site-app-deployment"],
         ["buildchain-ref-promotion", "release-governance"],
         ["release-line-bootstrap", "release-governance"],
@@ -783,6 +786,7 @@ function buildSiteBundle() {
         ["buildchain-patrol-weekly", "repository-patrol"],
         ["buildchain-patrol-monthly", "repository-patrol"],
         ["stable-candidate-patrol", "repository-patrol"],
+        ["dev-qualification-patrol", "repository-patrol"],
         ["dev-alpha-candidate-patrol", "repository-patrol"],
         ["buildchain-stable-candidate-patrol", "repository-patrol"],
         ["buildchain-stable-candidate-qualification", "repository-patrol"],
@@ -793,6 +797,7 @@ function buildSiteBundle() {
       ]);
       const statusById = new Map([
         [".auditable-demo", "preview"],
+        [".declarative-auditable-demo", "preview"],
         ["release-propagation", "preview"],
         ["candidate-lab", "repository-internal"],
         ["build-surface-fixture", "repository-internal"],

package/scripts/inspect-artifact-signing-requests.mjs

@@ -4,6 +4,7 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 
 import { validateArtifactSigningRequest } from "../packages/core/artifact-signing.js";
+import { artifactSigningRequestRoot } from "./artifact-signing-controller-core.mjs";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 function required(value, label) {
@@ -35,12 +36,14 @@ export function inspectArtifactSigningRequests({
   inputRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT,
   expectedRepository = process.env.BUILDCHAIN_SIGNING_SOURCE_REPOSITORY,
   expectedRuntimeSha = process.env.BUILDCHAIN_RUNTIME_SHA,
+  expectedRequestRoot = process.env.BUILDCHAIN_SIGNING_EXPECTED_REQUEST_ROOT,
 } = {}) {
   const root = path.resolve(required(inputRoot, "signing request root"));
   const indexes = walk(root, "index.json");
   if (indexes.length === 0)
     throw new Error("no artifact signing request indexes found");
   const seen = new Set();
+  const observedRoots = [];
   const matrices = {
     detached: [],
     macos: [],
@@ -52,6 +55,7 @@ export function inspectArtifactSigningRequests({
       index.contract !== "kungfu-buildchain-artifact-signing-request-index/v1"
     )
       continue;
+    observedRoots.push(artifactSigningRequestRoot(index));
     for (const entry of index.requests || []) {
       const requestPath = path.resolve(path.dirname(indexPath), entry.path);
       const relative = path.relative(root, requestPath);
@@ -113,6 +117,14 @@ export function inspectArtifactSigningRequests({
         );
     }
   }
+  if (expectedRequestRoot) {
+    if (observedRoots.length !== 1) {
+      throw new Error("signing authority expected exactly one request root");
+    }
+    if (observedRoots[0] !== expectedRequestRoot) {
+      throw new Error("signing authority request root mismatch");
+    }
+  }
   for (const entries of Object.values(matrices))
     entries.sort((a, b) => a.request.localeCompare(b.request));
   writeGitHubOutputs({

package/scripts/locked-source-checkout.mjs

@@ -46,6 +46,14 @@ function normalizeFallback(value = "github") {
   return fallback;
 }
 
+function normalizeHistoryMode(value = "shallow") {
+  const mode = String(value || "shallow").trim().toLowerCase() || "shallow";
+  if (!["shallow", "full"].includes(mode)) {
+    throw new Error(`checkout-history-mode must be shallow or full; got ${value}`);
+  }
+  return mode;
+}
+
 function splitRepository(repository) {
   const match = String(repository || "").trim().match(/^([^/\s]+)\/([^/\s]+)$/);
   if (!match) {
@@ -237,19 +245,25 @@ export function fetchSourceCommit({
   sourceTreeSha = "",
   timeoutMs,
   env = {},
+  historyMode = readEnv("BUILDCHAIN_CHECKOUT_HISTORY_MODE", "shallow"),
   allowFullFetchRetry = false,
   runGit = git,
   containsCommit = hasCommit,
 }) {
+  const normalizedHistoryMode = normalizeHistoryMode(historyMode);
   const fetchEnv = isolatedGitFetchEnv(env, targetPath);
   const fetch = (refspec) => {
     const options = { cwd: targetPath, timeoutMs, env: fetchEnv };
+    const fetchArgs = ["fetch", "--no-tags"];
+    if (normalizedHistoryMode === "shallow") fetchArgs.push("--depth=1");
+    fetchArgs.push(remoteName, refspec);
     try {
-      runGit(["fetch", "--no-tags", "--depth=1", remoteName, refspec], options);
-      return "shallow";
+      runGit(fetchArgs, options);
+      return normalizedHistoryMode;
     } catch (error) {
       if (
-        !allowFullFetchRetry
+        normalizedHistoryMode !== "shallow"
+        || !allowFullFetchRetry
         || !/dumb http transport does not support shallow capabilities/i.test(
           String(error?.message || error || ""),
         )