@kungfu-tech/buildchain 3.0.6-alpha.0 → 3.0.6-alpha.10

package/scripts/check-inventory.mjs

@@ -74,6 +74,7 @@ const requiredPaths = [
   "docs/shifu-gate-profiles.md",
   "docs/auditable-demo.md",
   "contracts/auditable-demo-scenario-v1.schema.json",
+  "contracts/release-candidate-recovery-v1.schema.json",
   "contracts/auditable-demo-media-profiles-v1.json",
   "contracts/evidence/auditable-demo-web-delivery-v1.json",
   "contracts/evidence/auditable-demo-responsive-web-delivery-v1.json",
@@ -117,6 +118,7 @@ const requiredPaths = [
   "scripts/publication-commit-evidence.mjs",
   "scripts/publication-reproducibility.mjs",
   "scripts/release-candidate-resolver.mjs",
+  "scripts/resume-from-candidate-run.mjs",
   "scripts/buildchain-patrol.mjs",
   "scripts/observed-evidence.mjs",
   "scripts/workflow-friction-report.mjs",
@@ -134,9 +136,11 @@ const requiredPaths = [
   ".github/actionlint.yaml",
   ".github/workflows/self-hosted-runner-smoke.yml",
   ".github/workflows/buildchain-ref-promotion.yml",
+  ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml",
   ".github/workflows/release-line-bootstrap.yml",
   ".github/workflows/release-governance-reconcile.yml",
   ".github/workflows/dev-pr-auto-merge.yml",
+  ".github/workflows/buildchain-dev-delivery.yml",
   ".github/workflows/buildchain-patrol.yml",
   ".github/workflows/patrol-daily.yml",
   ".github/workflows/patrol-weekly.yml",
@@ -272,16 +276,25 @@ if (channelPromotionWorkflow !== generateChannelPromotionWorkflow(advancedPromot
 }
 for (const requiredSnippet of [
   "buildchain-channel:",
-  `/.github/workflows/.release-candidate-promote.yml@v${selfDogfoodMajor}-alpha`,
+  `/${promotionShellRouting.alpha.workflowPath}@${promotionShellRouting.alpha.callRef}`,
   `/${promotionShellRouting.stable.workflowPath}@${promotionShellRouting.stable.callRef}`,
   `STABLE_SHELL_REF: v${selfDogfoodMajor}`,
   "promotion-contract-lock-digest:",
   "authorize-promotion-runtime-override.cjs",
+  "BUILDCHAIN_ROUTER_REPOSITORY: ${{ inputs.buildchain-repository }}",
+  "BUILDCHAIN_RESUME_RUNTIME_SHA: ${{ inputs.resume-buildchain-runtime-sha }}",
+  "git ls-remote",
+  "Recovery router ref does not match resume-buildchain-runtime-sha",
 ]) {
   if (!channelPromotionWorkflow.includes(requiredSnippet)) {
     throw new Error(`channel promotion workflow missing routing contract: ${requiredSnippet}`);
   }
 }
+for (const forbiddenSnippet of ["job.workflow_repository", "job.workflow_sha"]) {
+  if (channelPromotionWorkflow.includes(forbiddenSnippet)) {
+    throw new Error(`channel promotion workflow uses unsupported GitHub context: ${forbiddenSnippet}`);
+  }
+}
 const promotionOverrideAuthorization = fs.readFileSync(
   path.join(root, "scripts/authorize-promotion-runtime-override.cjs"),
   "utf8",
@@ -983,10 +996,12 @@ for (const requiredSnippet of [
   "github.event.workflow_run.event == 'push'",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
-  "target-sha: ${{ github.event.workflow_run.head_sha || inputs.sha || github.sha }}",
+  "resume-candidate-run-id:",
+  "resume-expected-source-tree:",
+  "resume-buildchain-runtime-sha:",
   "github-release: true",
   "release-passport-buildchain-self-kfd: true",
-  "publish-required-artifacts-json: \"[]\"",
+  'artifact-patterns: "buildchain-package-*"',
   "release-passport-impact-json: .buildchain/release-impact.json",
 ]) {
   if (!buildchainRefPromotionWorkflow.includes(requiredSnippet)) {
@@ -1040,6 +1055,13 @@ for (const requiredSnippet of [
   "BUILDCHAIN_STABLE_RELEASE_POLICY: .buildchain/stable-release-policy.json",
   "Consumer has no binary-distribution.yml; standalone binary dispatch is not applicable.",
   "gh workflow view binary-distribution.yml",
+  "resume-candidate-run-id:",
+  "node .buildchain/runtime/scripts/resume-from-candidate-run.mjs",
+  "publish-sealed-bundle-root: ${{ steps.rc.outputs.publish-sealed-bundle-root }}",
+  "BUILDCHAIN_EXPECTED_TRANSACTION_ID: ${{ inputs.resume-transaction-id }}",
+  "if: ${{ inputs.resume-candidate-run-id == '' }}",
+  "Bridge Buildchain self-runtime dependencies",
+  "ln -s .buildchain/runtime/node_modules node_modules",
 ]) {
   if (!releaseCandidatePromoteWorkflow.includes(requiredSnippet)) {
     throw new Error(`release candidate promote workflow missing KFD gate pass-through: ${requiredSnippet}`);

package/scripts/dev-alpha-candidate-patrol.mjs

@@ -5,6 +5,10 @@ import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 import { decideChannelCandidate } from "../packages/core/channel-candidate.js";
+import {
+  resolveManagedPromotionBaseline,
+  resolvePatrolSourceInputs,
+} from "../packages/core/channel-promotion-baseline.js";
 
 export const DEV_ALPHA_CANDIDATE_STATE_SCHEMA =
   "kungfu-buildchain-dev-alpha-candidate-state/v1";
@@ -301,8 +305,7 @@ export function normalizeDevAlphaPatrolOptions(options = {}) {
       false,
     ),
     mergeMethod: autoMergeMethod(
-      options.mergeMethod ??
-        process.env.BUILDCHAIN_CHANNEL_PATROL_MERGE_METHOD,
+      options.mergeMethod ?? process.env.BUILDCHAIN_CHANNEL_PATROL_MERGE_METHOD,
     ),
     dryRun: bool(
       options.dryRun ?? process.env.BUILDCHAIN_CHANNEL_PATROL_DRY_RUN,
@@ -321,7 +324,10 @@ export function normalizeDevAlphaPatrolOptions(options = {}) {
 function latestWorkflowEvidence(runs, workflowPathValue, sourceSha) {
   const matching = runs
     .filter(
-      (run) => run.path === workflowPathValue && run.head_sha === sourceSha,
+      (run) =>
+        run.conclusion !== "cancelled" &&
+        run.path === workflowPathValue &&
+        run.head_sha === sourceSha,
     )
     .sort((left, right) => Number(right.id) - Number(left.id));
   if (matching.length === 0)
@@ -356,7 +362,9 @@ function workflowEvidenceIsFreshAndSuccessful(run, { now, maxAgeSeconds }) {
 
 function latestRunsBySha(runs, workflowPathValue) {
   const latest = new Map();
-  for (const run of runs.filter((row) => row.path === workflowPathValue)) {
+  for (const run of runs.filter(
+    (row) => row.path === workflowPathValue && row.conclusion !== "cancelled",
+  )) {
     const current = latest.get(run.head_sha);
     if (!current || Number(run.id) > Number(current.id))
       latest.set(run.head_sha, run);
@@ -620,52 +628,26 @@ export async function runDevAlphaCandidatePatrol(
       repository: options.repository,
       token: process.env.GITHUB_TOKEN,
     });
-  const [observedSourceHeadSha, targetSha] = await Promise.all([
-    client.resolveBranch(options.sourceBranch),
-    client.resolveBranch(options.targetBranch),
-  ]);
-  const headComparison = await client.compare(targetSha, observedSourceHeadSha);
   const requiredWorkflowPaths = [
     options.devWorkflowPath,
     options.alphaWorkflowPath,
   ];
-  let sourceSha = observedSourceHeadSha;
-  let comparison = headComparison;
-  let workflowEvidence = [];
-  let skippedNewerCommitCount = 0;
-  let qualificationError;
-  if (
-    headComparison.status === "ahead" &&
-    Number(headComparison.ahead_by) > 0
-  ) {
-    const [sourceHistory, ...workflowRunSets] = await Promise.all([
-      client.listBranchHistory(options.sourceBranch, targetSha),
-      ...requiredWorkflowPaths.map((workflow) =>
-        client.listCompletedWorkflowRuns(workflow, options.sourceBranch),
-      ),
-    ]);
-    try {
-      const selected = selectLatestQualifiedSource({
-        sourceHistory,
-        workflowRunsByPath: new Map(
-          requiredWorkflowPaths.map((workflow, index) => [
-            workflow,
-            workflowRunSets[index],
-          ]),
-        ),
-        requiredWorkflowPaths,
-        now: options.now,
-        maxAgeSeconds: options.maxAgeSeconds,
-      });
-      sourceSha = selected.sourceSha;
-      skippedNewerCommitCount = selected.skippedNewerCommitCount;
-      workflowEvidence = selected.workflowEvidence;
-      if (sourceSha !== observedSourceHeadSha)
-        comparison = await client.compare(targetSha, sourceSha);
-    } catch (error) {
-      qualificationError = error;
-    }
-  }
+  const {
+    observedSourceHeadSha,
+    targetSha,
+    headComparison,
+    targetBaseline,
+    sourceSha,
+    comparison,
+    workflowEvidence,
+    skippedNewerCommitCount,
+    qualificationError,
+  } = await resolvePatrolSourceInputs({
+    client,
+    options,
+    requiredWorkflowPaths,
+    selectQualifiedSource: selectLatestQualifiedSource,
+  });
   const decision = qualificationError
     ? blockedCandidateDecision({
         options,
@@ -682,9 +664,12 @@ export async function runDevAlphaCandidatePatrol(
         targetSha,
         comparison: { status: comparison.status, aheadBy: comparison.ahead_by },
         selection: {
-          mode: "latest-qualified-source-ancestor",
+          mode: targetBaseline
+            ? "latest-qualified-source-after-managed-promotion"
+            : "latest-qualified-source-ancestor",
           observedSourceHeadSha,
           skippedNewerCommitCount,
+          ...(targetBaseline ? { targetBaseline } : {}),
         },
         workflowEvidence,
         requiredWorkflowPaths,
@@ -927,7 +912,12 @@ export async function runDevAlphaCandidatePatrol(
       }
     }
   }
-  const autoMerge = await armCandidateAutoMerge(options, controllerState, pullRequest, client);
+  const autoMerge = await armCandidateAutoMerge(
+    options,
+    controllerState,
+    pullRequest,
+    client,
+  );
   return {
     schema: "kungfu-buildchain-dev-alpha-candidate-patrol/v1",
     dryRun: options.dryRun,
@@ -1015,6 +1005,13 @@ export function createGitHubChannelCandidateClient({
     async compare(baseSha, headSha) {
       return api(`/repos/${owner}/${repo}/compare/${baseSha}...${headSha}`);
     },
+    resolveManagedPromotionBaseline: (targetSha, targetBranch) =>
+      resolveManagedPromotionBaseline({
+        api: (requestPath) => api(`/repos/${owner}/${repo}${requestPath}`),
+        targetSha,
+        targetBranch,
+        parseCandidate: managedCandidateFromPullRequest,
+      }),
     async listCompletedWorkflowRuns(workflowPathValue, sourceBranch) {
       const runs = [];
       for (let page = 1; page <= 10; page += 1) {

package/scripts/dev-delivery-proof.mjs

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { classifyDevDeliveryDelta, createIntegrationDeliveryProof, createProjectCutReplayPlan, createProjectCutReplayProof, createSourceQualificationProof, verifyIntegrationDeliveryProof, verifyProjectCutReplayProof, verifySourceQualificationProof } from "../packages/core/dev-delivery-warrant.js";
+
+function flag(args, name, fallback = "") {
+  const index = args.indexOf(`--${name}`);
+  return index === -1 ? fallback : args[index + 1] || "";
+}
+
+function hasFlag(args, name) {
+  return args.includes(`--${name}`);
+}
+
+function jsonFile(file, label) {
+  if (!file) throw new Error(`${label} is required`);
+  return JSON.parse(fs.readFileSync(file, "utf8"));
+}
+
+function jsonList(value, label, { required = false } = {}) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value || "[]");
+  } catch (cause) {
+    throw new Error(`${label} must be a JSON array: ${cause.message}`);
+  }
+  if (!Array.isArray(parsed) || (required && parsed.length === 0)) {
+    throw new Error(`${label} must be ${required ? "a non-empty" : "a"} JSON array`);
+  }
+  return parsed;
+}
+
+function boolean(value, fallback = false) {
+  if (value === undefined || value === null || value === "") return fallback;
+  if (typeof value === "boolean") return value;
+  return ["1", "true", "yes", "on"].includes(String(value).trim().toLowerCase());
+}
+
+export function devDeliveryProofCliOptions(args = [], environment = process.env) {
+  const [command = "", ...rest] = args;
+  return {
+    command,
+    repository: flag(rest, "repository", environment.GITHUB_REPOSITORY),
+    protectedBase: flag(rest, "branch", environment.BUILDCHAIN_DEV_DELIVERY_BRANCH || environment.GITHUB_BASE_REF),
+    sourceIdentityRoot: flag(rest, "source-identity-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_IDENTITY_ROOT),
+    sourceHead: flag(rest, "source-head", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_HEAD),
+    sourcePatchRoot: flag(rest, "source-patch-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PATCH_ROOT),
+    planRoot: flag(rest, "plan-root", environment.BUILDCHAIN_DEV_DELIVERY_PLAN_ROOT),
+    closureRoot: flag(rest, "closure-root", environment.BUILDCHAIN_DEV_DELIVERY_CLOSURE_ROOT),
+    dependencyRoot: flag(rest, "dependency-root", environment.BUILDCHAIN_DEV_DELIVERY_DEPENDENCY_ROOT),
+    toolchainRoot: flag(rest, "toolchain-root", environment.BUILDCHAIN_DEV_DELIVERY_TOOLCHAIN_ROOT),
+    affectedPaths: flag(rest, "affected-paths-json", environment.BUILDCHAIN_DEV_DELIVERY_AFFECTED_PATHS || "[]"),
+    shardEvidenceRoots: flag(rest, "shard-evidence-roots-json", environment.BUILDCHAIN_DEV_DELIVERY_SHARD_EVIDENCE_ROOTS || "[]"),
+    qualifiedAt: flag(rest, "qualified-at", environment.BUILDCHAIN_DEV_DELIVERY_QUALIFIED_AT),
+    sourceProofPath: flag(rest, "source-proof", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PROOF),
+    sourceProofRoot: flag(rest, "source-proof-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PROOF_ROOT),
+    warrantResultPath: flag(rest, "warrant-result", environment.BUILDCHAIN_DEV_DELIVERY_WARRANT_RESULT),
+    currentBase: flag(rest, "current-base", environment.BUILDCHAIN_DEV_DELIVERY_CURRENT_BASE),
+    previousBase: flag(rest, "previous-base", environment.BUILDCHAIN_DEV_DELIVERY_PREVIOUS_BASE),
+    replayTree: flag(rest, "replay-tree", environment.BUILDCHAIN_DEV_DELIVERY_REPLAY_TREE),
+    qualificationReceiptPath: flag(rest, "qualification-receipt", environment.BUILDCHAIN_DEV_DELIVERY_QUALIFICATION_RECEIPT),
+    mergeGroupHead: flag(rest, "merge-group-head", environment.BUILDCHAIN_DEV_DELIVERY_MERGE_GROUP_HEAD),
+    mergeGroupTree: flag(rest, "merge-group-tree", environment.BUILDCHAIN_DEV_DELIVERY_MERGE_GROUP_TREE),
+    requiredContextRoots: flag(rest, "required-context-roots-json", environment.BUILDCHAIN_DEV_DELIVERY_REQUIRED_CONTEXT_ROOTS || "[]"),
+    verifiedAt: flag(rest, "verified-at", environment.BUILDCHAIN_DEV_DELIVERY_VERIFIED_AT),
+    pullRequestNumber: flag(rest, "pull-request", environment.BUILDCHAIN_DEV_DELIVERY_PR_NUMBER),
+    changedPaths: flag(rest, "changed-paths-json", environment.BUILDCHAIN_DEV_DELIVERY_CHANGED_PATHS || "[]"),
+    graphKnown: boolean(flag(rest, "graph-known", environment.BUILDCHAIN_DEV_DELIVERY_GRAPH_KNOWN), false),
+    outputPath: flag(rest, "output", environment.BUILDCHAIN_DEV_DELIVERY_PROOF_OUTPUT || ".buildchain/dev-delivery/proof.json"),
+    json: hasFlag(rest, "json"),
+  };
+}
+
+function sourceProof(options) {
+  return createSourceQualificationProof({
+    repository: options.repository,
+    protectedBase: options.protectedBase,
+    sourceIdentityRoot: options.sourceIdentityRoot,
+    sourceHead: options.sourceHead,
+    sourcePatchRoot: options.sourcePatchRoot,
+    planRoot: options.planRoot,
+    closureRoot: options.closureRoot,
+    dependencyRoot: options.dependencyRoot,
+    toolchainRoot: options.toolchainRoot,
+    affectedPaths: jsonList(options.affectedPaths, "affected paths"),
+    shardEvidenceRoots: jsonList(options.shardEvidenceRoots, "shard evidence roots", { required: true }),
+    qualifiedAt: options.qualifiedAt,
+  });
+}
+
+function activeWarrant(options) {
+  const result = jsonFile(options.warrantResultPath, "Warrant result");
+  const warrant = result.warrant || result.observation?.activeWarrant;
+  if (result.schema !== "kungfu.buildchain.dev-delivery-command-result/v1" || !warrant) {
+    throw new Error("Warrant result does not contain an active Buildchain Delivery Warrant");
+  }
+  return warrant;
+}
+
+export function runDevDeliveryProofCommand(options) {
+  if (options.command === "source") return sourceProof(options);
+  if (options.command === "verify-source") {
+    return verifySourceQualificationProof(jsonFile(options.sourceProofPath, "source proof"));
+  }
+  if (options.command === "classify") {
+    return classifyDevDeliveryDelta({
+      proof: jsonFile(options.sourceProofPath, "source proof"),
+      current: {
+        sourceIdentityRoot: options.sourceIdentityRoot,
+        sourcePatchRoot: options.sourcePatchRoot,
+        planRoot: options.planRoot,
+        closureRoot: options.closureRoot,
+        dependencyRoot: options.dependencyRoot,
+        toolchainRoot: options.toolchainRoot,
+        graphKnown: options.graphKnown,
+        changedPaths: jsonList(options.changedPaths, "changed paths"),
+      },
+    });
+  }
+  if (options.command === "replay") {
+    return createProjectCutReplayPlan({
+      repository: options.repository,
+      protectedBase: options.protectedBase,
+      pullRequestNumber: options.pullRequestNumber,
+      sourceHead: options.sourceHead,
+      previousBase: options.previousBase,
+      currentBase: options.currentBase,
+      sourcePatchRoot: options.sourcePatchRoot,
+      replayTree: options.replayTree,
+    });
+  }
+  if (options.command === "replay-proof") {
+    return createProjectCutReplayProof({
+      repository: options.repository,
+      protectedBase: options.protectedBase,
+      pullRequestNumber: options.pullRequestNumber,
+      sourceHead: options.sourceHead,
+      sourcePatchRoot: options.sourcePatchRoot,
+      currentBase: options.currentBase,
+      replayTree: options.replayTree,
+      qualificationReceipt: jsonFile(options.qualificationReceiptPath, "Project Cut qualification receipt"),
+      requiredContextRoots: jsonList(options.requiredContextRoots, "required context roots", { required: true }),
+      verifiedAt: options.verifiedAt,
+    });
+  }
+  if (options.command === "verify-replay") {
+    return verifyProjectCutReplayProof(jsonFile(options.sourceProofPath, "Project Cut replay proof"));
+  }
+  if (options.command === "integration") {
+    const sourceProofRoot = options.sourceProofRoot || jsonFile(options.sourceProofPath, "source proof").proofRoot;
+    return createIntegrationDeliveryProof({
+      repository: options.repository,
+      protectedBase: options.protectedBase,
+      sourceProofRoot,
+      currentBase: options.currentBase,
+      replayTree: options.replayTree,
+      mergeGroupHead: options.mergeGroupHead,
+      mergeGroupTree: options.mergeGroupTree,
+      warrant: activeWarrant(options),
+      requiredContextRoots: jsonList(options.requiredContextRoots, "required context roots", { required: true }),
+      verifiedAt: options.verifiedAt,
+    });
+  }
+  if (options.command === "verify-integration") {
+    return verifyIntegrationDeliveryProof(jsonFile(options.sourceProofPath, "integration proof"));
+  }
+  throw new Error("unsupported dev delivery proof command");
+}
+
+function usage() {
+  return "Usage:\n  buildchain dev proof <source|verify-source|classify|replay|replay-proof|verify-replay|integration|verify-integration> [options] [--output FILE] [--json]\n";
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.length === 0 || hasFlag(args, "help")) {
+    process.stdout.write(usage());
+    return;
+  }
+  const options = devDeliveryProofCliOptions(args);
+  const result = runDevDeliveryProofCommand(options);
+  fs.mkdirSync(path.dirname(options.outputPath), { recursive: true });
+  fs.writeFileSync(options.outputPath, `${JSON.stringify(result, null, 2)}\n`);
+  if (options.json) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  else process.stdout.write(`Buildchain dev delivery proof ${options.command}: ${result.proofRoot || result.reason}\n`);
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main().catch((error) => {
+    console.error(`buildchain dev proof: ${error.message}`);
+    process.exit(1);
+  });
+}