@kungfu-tech/buildchain 3.0.6-alpha.0 → 3.0.6-alpha.2

package/scripts/auditable-demo-renditions.mjs

@@ -16,6 +16,270 @@ const RENDITION_SET_NON_AUTHORITIES = [
   "runtime-authority",
   ...TERMINAL_CAPTURE_NON_AUTHORITIES,
 ];
+const MAX_BUNDLE_MEMBER_BYTES = 8 * 1024 * 1024;
+const MAX_LONG_FORM_RENDERER_MANIFEST_BYTES = 32 * 1024 * 1024;
+const PRESENTATION_FRAMED = "presentation-framed";
+const TERMINAL_FILL = "terminal-fill";
+const GEOMETRY_TOLERANCE = 0.001;
+
+function closeEnough(left, right, tolerance = GEOMETRY_TOLERANCE) {
+  return Number.isFinite(left) && Number.isFinite(right) && Math.abs(left - right) <= tolerance;
+}
+
+function validateContentViewport(composition, expected, expectedMode, label, helpers) {
+  const { exactKeys, invariant } = helpers;
+  const viewport = composition.contentViewport;
+  exactKeys(viewport, ["x", "y", "width", "height", "fillRatio"], [], `${label}.contentViewport`);
+  invariant(
+    [viewport.x, viewport.y, viewport.width, viewport.height, viewport.fillRatio].every(Number.isFinite),
+    `${label} content viewport is malformed or out of bounds`,
+  );
+  invariant(
+    viewport.x >= 0 && viewport.y >= 0 && viewport.width > 0 && viewport.height > 0,
+    `${label} content viewport is malformed or out of bounds`,
+  );
+  invariant(
+    viewport.x + viewport.width <= expected.width + GEOMETRY_TOLERANCE
+      && viewport.y + viewport.height <= expected.height + GEOMETRY_TOLERANCE,
+    `${label} content viewport is malformed or out of bounds`,
+  );
+  invariant(
+    viewport.fillRatio > 0
+      && viewport.fillRatio <= 1
+      && closeEnough(viewport.fillRatio, (viewport.width * viewport.height) / (expected.width * expected.height), 0.000001),
+    `${label} content viewport is malformed or out of bounds`,
+  );
+  if (expectedMode === TERMINAL_FILL) {
+    invariant(
+      closeEnough(viewport.x, 0)
+        && closeEnough(viewport.y, 0)
+        && closeEnough(viewport.width, expected.width)
+        && closeEnough(viewport.height, expected.height)
+        && closeEnough(viewport.fillRatio, 1, 0.000001),
+      `${label} does not provide a full-frame terminal viewport`,
+    );
+  }
+}
+
+function validateTerminalGeometry(composition, expected, expectedMode, label, helpers) {
+  const { exactKeys, invariant } = helpers;
+  const geometry = composition.terminalGeometry;
+  if (expected.columns == null || expected.rows == null) {
+    invariant(geometry === null, `${label} unexpectedly declares terminal cell geometry`);
+    return;
+  }
+  exactKeys(
+    geometry,
+    ["columns", "rows", "cellWidth", "cellHeight", "fontSize", "lineHeight", "layout"],
+    [],
+    `${label}.terminalGeometry`,
+  );
+  invariant(
+    geometry.columns === expected.columns && geometry.rows === expected.rows,
+    `${label} terminal cell geometry is malformed or rendition-mismatched`,
+  );
+  invariant(
+    [geometry.cellWidth, geometry.cellHeight, geometry.fontSize, geometry.lineHeight]
+      .every((value) => Number.isFinite(value) && value > 0),
+    `${label} terminal cell geometry is malformed or rendition-mismatched`,
+  );
+  invariant(
+    geometry.layout === (expectedMode === TERMINAL_FILL ? "exact-grid" : "presentation-flow"),
+    `${label} terminal cell geometry is malformed or rendition-mismatched`,
+  );
+  if (expectedMode === TERMINAL_FILL) {
+    invariant(
+      closeEnough(geometry.cellWidth * geometry.columns, expected.width)
+        && closeEnough(geometry.cellHeight * geometry.rows, expected.height)
+        && closeEnough(geometry.lineHeight, geometry.cellHeight),
+      `${label} terminal cell geometry does not resolve to the full frame`,
+    );
+  }
+}
+
+function validateCompositionFrameSet(frameSet, expected, expectedMode, multiple, index, helpers) {
+  const { exactKeys, invariant } = helpers;
+  const label = `renderer composition frame set ${index}`;
+  invariant(frameSet && typeof frameSet === "object", `${label} is missing`);
+  invariant(
+    multiple
+      ? frameSet.id === expected.id
+        && frameSet.role === expected.role
+        && frameSet.width === expected.width
+        && frameSet.height === expected.height
+      : frameSet.width === expected.width && frameSet.height === expected.height,
+    multiple
+      ? `${label} does not match the requested rendition`
+      : `${label} dimensions do not match the requested scene`,
+  );
+  const composition = frameSet.composition;
+  exactKeys(composition, ["mode", "contentViewport", "terminalGeometry"], [], `${label}.composition`);
+  invariant(composition.mode === expectedMode, `${label} mode drifted from the requested scene`);
+  validateContentViewport(composition, expected, expectedMode, label, helpers);
+  validateTerminalGeometry(composition, expected, expectedMode, label, helpers);
+  return composition;
+}
+
+export function validateRendererComposition(manifest, renditions, helpers) {
+  const { exactKeys, invariant } = helpers;
+  invariant(Array.isArray(renditions) && renditions.length >= 1, "renderer composition requires declared renditions");
+  const expectedMode = renditions[0].compositionMode ?? PRESENTATION_FRAMED;
+  invariant(
+    (expectedMode === PRESENTATION_FRAMED || expectedMode === TERMINAL_FILL)
+      && renditions.every((entry) => (entry.compositionMode ?? PRESENTATION_FRAMED) === expectedMode),
+    "requested rendition composition modes do not match",
+  );
+  const version = String(manifest.renderer?.contractVersion || "").split(".").map(Number);
+  invariant(
+    version.length === 3 && version.every(Number.isInteger) && version[0] === 1,
+    "renderer contract version is unsupported",
+  );
+  const supportsCompositionEvidence = version[1] >= 4;
+  if (!supportsCompositionEvidence) {
+    invariant(expectedMode === PRESENTATION_FRAMED, "renderer contract does not support composition evidence");
+    const sourceFrames = manifest.derivation?.sourceFrames;
+    const frameSets = manifest.derivation?.sourceFrameSets;
+    invariant(
+      manifest.policy?.compositionMode === undefined
+        && sourceFrames?.composition === undefined
+        && (!Array.isArray(frameSets) || frameSets.every((entry) => entry?.composition === undefined)),
+      "legacy renderer contract cannot declare composition evidence",
+    );
+    return { mode: expectedMode, frameSets: [], evidence: "legacy-presentation-default" };
+  }
+  invariant(manifest.policy?.compositionMode === expectedMode, "renderer composition policy drifted from the requested scene");
+  const sourceFrames = manifest.derivation?.sourceFrames;
+  const frameSets = renditions.length === 1
+    ? [sourceFrames]
+    : manifest.derivation?.sourceFrameSets;
+  invariant(Array.isArray(frameSets) && frameSets.length === renditions.length, "renderer composition frame-set evidence is missing");
+  const compositions = frameSets.map((frameSet, index) => validateCompositionFrameSet(
+    frameSet,
+    renditions[index],
+    expectedMode,
+    renditions.length > 1,
+    index,
+    helpers,
+  ));
+  if (renditions.length > 1) {
+    invariant(
+      JSON.stringify(sourceFrames?.composition) === JSON.stringify(frameSets[0].composition),
+      "renderer primary composition evidence drifted between sourceFrames and sourceFrameSets",
+    );
+  }
+  return { mode: expectedMode, frameSets: compositions };
+}
+
+export function rendererCompositionRenditions(expectedInputs, primaryScene, helpers) {
+  const { invariant, readJson } = helpers;
+  if (expectedInputs.renditionSet) {
+    const set = validateRenditionSet(path.dirname(expectedInputs.renditionSet), helpers);
+    invariant(set, "renderer expected rendition set is missing");
+    return set.renditions.map((rendition) => ({
+      id: rendition.id,
+      role: rendition.role,
+      width: rendition.scene.width,
+      height: rendition.scene.height,
+      columns: rendition.capture.dimensions.columns,
+      rows: rendition.capture.dimensions.rows,
+      compositionMode: rendition.scene.compositionMode,
+    }));
+  }
+  const terminal = expectedInputs.terminalCapture
+    ? validateTerminalCapture(
+      readJson(expectedInputs.terminalCapture, "renderer expected terminal capture"),
+      primaryScene,
+      helpers,
+    )
+    : null;
+  return [{
+    width: primaryScene.width,
+    height: primaryScene.height,
+    columns: terminal?.dimensions.columns ?? null,
+    rows: terminal?.dimensions.rows ?? null,
+    compositionMode: primaryScene.compositionMode,
+  }];
+}
+
+export function validateRendererCompositionInputs(manifest, expectedInputs, helpers) {
+  const { invariant, readJson, validateScene } = helpers;
+  if (expectedInputs.renditionSet) {
+    invariant(
+      manifest.derivation?.policy === "independent-native-frame-sets/v1",
+      "renderer did not use independent native frame sets",
+    );
+    invariant(
+      Array.isArray(manifest.inputs?.renditions)
+        && manifest.inputs.renditions.length === 2
+        && manifest.inputs.renditions[0]?.role === "primary"
+        && manifest.inputs.renditions[1]?.role === "responsive"
+        && manifest.inputs.renditions[0]?.terminalCapture?.root
+          !== manifest.inputs.renditions[1]?.terminalCapture?.root,
+      "renderer native rendition inputs are not independently bound",
+    );
+  }
+  const primaryScene = validateScene(readJson(expectedInputs.scene, "renderer expected scene"));
+  return validateRendererComposition(
+    manifest,
+    rendererCompositionRenditions(expectedInputs, primaryScene, helpers),
+    helpers,
+  );
+}
+
+function validateLongFormManifestRendition(entry, declaration, index, helpers) {
+  const { digestPattern, invariant, maxBytes, maxEvents } = helpers;
+  const scene = entry?.scene?.path;
+  const capture = entry?.terminalCapture;
+  invariant(
+    entry?.id === declaration.id
+      && entry?.role === declaration.role
+      && scene?.durationClass === "long-form"
+      && scene?.width === declaration.width
+      && scene?.height === declaration.height
+      && Number.isInteger(scene?.durationMs)
+      && scene.durationMs >= 500
+      && scene.durationMs <= 180000
+      && Number.isInteger(scene?.fps)
+      && scene.fps >= 1
+      && scene.fps <= 10
+      && capture?.schema === "kungfu.terminal-capture/v1"
+      && digestPattern.test(capture?.root)
+      && Number.isInteger(capture?.durationMs)
+      && capture.durationMs >= 500
+      && capture.durationMs <= scene.durationMs
+      && scene.durationMs - capture.durationMs <= 2000
+      && Number.isInteger(capture?.events)
+      && capture.events >= 1
+      && capture.events <= maxEvents
+      && Number.isInteger(capture?.bytes)
+      && capture.bytes >= 1
+      && capture.bytes <= maxBytes,
+    `oversized renderer manifest rendition ${index} is not bounded long-form evidence`,
+  );
+}
+
+export function readRendererManifest(filePath, helpers) {
+  const { decodeUtf8, invariant, readRegular } = helpers;
+  const bytes = readRegular(filePath, "renderer manifest", MAX_LONG_FORM_RENDERER_MANIFEST_BYTES);
+  let manifest;
+  try {
+    manifest = JSON.parse(decodeUtf8(bytes, "renderer manifest"));
+  } catch (error) {
+    if (error instanceof SyntaxError) throw new Error("renderer manifest must be valid JSON");
+    throw error;
+  }
+  invariant(manifest.schema === "build-images.auditable-demo-render/v1", "unexpected renderer manifest schema");
+  if (bytes.length > MAX_BUNDLE_MEMBER_BYTES) {
+    const renditions = manifest.inputs?.renditions;
+    invariant(Array.isArray(renditions) && renditions.length === 2, "oversized renderer manifest requires exactly two bounded long-form native renditions");
+    const expected = [
+      { id: "1080p", role: "primary", width: 1920, height: 1080 },
+      { id: "720p", role: "responsive", width: 1280, height: 720 },
+    ];
+    renditions.forEach((entry, index) => validateLongFormManifestRendition(entry, expected[index], index, helpers));
+  }
+  return { bytes, manifest };
+}
 export function validateTerminalCapture(value, scene, helpers) {
   const { decodeBase64, digestPattern, exactKeys, integer, invariant, maxBytes, maxEvents, text } = helpers;
   exactKeys(

package/scripts/auditable-demo.mjs

@@ -7,10 +7,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import {
-  validateRenditionSet,
-  validateTerminalCapture,
-} from "./auditable-demo-renditions.mjs";
+import { readRendererManifest, validateRendererCompositionInputs, validateRenditionSet, validateTerminalCapture } from "./auditable-demo-renditions.mjs";
 
 const UTF8 = new TextDecoder("utf-8", { fatal: true });
 const IMAGE_PATTERN = /^[a-z0-9][a-z0-9./_-]*@sha256:[0-9a-f]{64}$/;
@@ -130,7 +127,7 @@ function writeChecksums(root, checksumName = "checksums.sha256") {
   return sha256(Buffer.from(bytes));
 }
 
-function verifyChecksums(root, checksumName = "checksums.sha256") {
+function verifyChecksums(root, checksumName = "checksums.sha256", options = {}) {
   const bytes = readRegular(path.join(root, checksumName), checksumName);
   const text = decodeUtf8(bytes, checksumName);
   invariant(text.endsWith("\n"), `${checksumName} must end with a newline`);
@@ -143,8 +140,11 @@ function verifyChecksums(root, checksumName = "checksums.sha256") {
     const target = resolveInside(root, member, "checksum member");
     invariant(!declared.has(member), `duplicate checksum member: ${member}`);
     declared.add(member);
+    const maximumBytes = options.allowLongFormRendererManifest && member === "manifest.json"
+      ? 32 * 1024 * 1024
+      : MAX_BUNDLE_MEMBER_BYTES;
     invariant(
-      sha256(readRegular(target, member, MAX_BUNDLE_MEMBER_BYTES)).slice(7) === match[1],
+      sha256(readRegular(target, member, maximumBytes)).slice(7) === match[1],
       `checksum mismatch: ${member}`,
     );
   }
@@ -190,7 +190,7 @@ function validateScene(value) {
   exactKeys(
     value,
     ["schema", "id", "width", "height", "fps", "durationMs", "title"],
-    ["durationClass", "commandLabel", "background", "accent"],
+    ["durationClass", "compositionMode", "commandLabel", "background", "accent"],
     "scene",
   );
   invariant(value.schema === "build-images.demo-scene/v1", "unsupported scene schema");
@@ -199,6 +199,11 @@ function validateScene(value) {
   integer(value.height, 360, 1080, "scene.height");
   const durationClass = value.durationClass ?? "standard";
   invariant(durationClass === "standard" || durationClass === "long-form", "scene.durationClass is invalid");
+  const compositionMode = value.compositionMode ?? "presentation-framed";
+  invariant(
+    compositionMode === "presentation-framed" || compositionMode === "terminal-fill",
+    "scene.compositionMode is invalid",
+  );
   const maximumDurationMs = durationClass === "long-form" ? LONG_FORM_MAX_DURATION_MS : STANDARD_MAX_DURATION_MS;
   const maximumFps = durationClass === "long-form" ? LONG_FORM_MAX_FPS : 30;
   integer(value.fps, 1, maximumFps, "scene.fps");
@@ -216,6 +221,7 @@ function validateScene(value) {
     height: value.height,
     fps: value.fps,
     ...(value.durationClass === undefined ? {} : { durationClass }),
+    compositionMode,
     durationMs: value.durationMs,
     title: value.title,
     commandLabel: value.commandLabel ?? "",
@@ -674,8 +680,7 @@ function inspectRendererMedia(values) {
   const rendererImage = required(values, "--renderer-image");
   invariant(IMAGE_PATTERN.test(rendererImage), "renderer image must use an immutable sha256 coordinate");
   invariant(!fs.existsSync(output), "media inspection output must not already exist");
-  const manifest = readJson(path.join(renderOutput, "manifest.json"), "renderer manifest");
-  invariant(manifest.schema === "build-images.auditable-demo-render/v1", "unexpected renderer manifest schema");
+  const { manifest } = readRendererManifest(path.join(renderOutput, "manifest.json"), RENDITION_VALIDATION_HELPERS);
   invariant(manifest.renderer?.image === rendererImage, "renderer manifest image coordinate mismatch");
   const members = Object.keys(manifest.outputs || {})
     .filter((name) => name !== "media-probe.json")
@@ -739,7 +744,7 @@ function qualifyMediaFixture(values) {
         sha256(readRegular(path.join(renderOutput, name), `fixture ${name}`)),
       ]),
     ),
-    rendererManifestRoot: sha256(readRegular(path.join(renderOutput, "manifest.json"), "renderer manifest")),
+    rendererManifestRoot: sha256(readRendererManifest(path.join(renderOutput, "manifest.json"), RENDITION_VALIDATION_HELPERS).bytes),
     qualification: verified.qualification,
   };
   writeJson(output, { ...body, evidenceRoot: semanticRoot(body) });
@@ -979,9 +984,8 @@ function verifyRendererOutput(renderOutput, expectedImage, expectedInputs, optio
     "public-projection.json",
     "scene.json",
   ];
-  verifyChecksums(renderOutput);
-  const manifest = readJson(path.join(renderOutput, "manifest.json"), "renderer manifest");
-  invariant(manifest.schema === "build-images.auditable-demo-render/v1", "unexpected renderer manifest schema");
+  verifyChecksums(renderOutput, "checksums.sha256", { allowLongFormRendererManifest: true });
+  const { manifest } = readRendererManifest(path.join(renderOutput, "manifest.json"), RENDITION_VALIDATION_HELPERS);
   invariant(manifest.renderer?.image === expectedImage, "renderer manifest image coordinate mismatch");
   const outputNames = Object.keys(manifest.outputs || {}).sort();
   invariant(outputNames.includes("media-probe.json"), "renderer manifest must declare media-probe.json");
@@ -999,21 +1003,11 @@ function verifyRendererOutput(renderOutput, expectedImage, expectedInputs, optio
     const observed = manifest.inputs?.[key]?.root;
     invariant(observed === sha256(readRegular(filePath, `${key} input`)), `renderer ${key} input root mismatch`);
   }
-  if (expectedInputs.renditionSet) {
-    invariant(
-      manifest.derivation?.policy === "independent-native-frame-sets/v1",
-      "renderer did not use independent native frame sets",
-    );
-    invariant(
-      Array.isArray(manifest.inputs?.renditions)
-        && manifest.inputs.renditions.length === 2
-        && manifest.inputs.renditions[0]?.role === "primary"
-        && manifest.inputs.renditions[1]?.role === "responsive"
-        && manifest.inputs.renditions[0]?.terminalCapture?.root
-          !== manifest.inputs.renditions[1]?.terminalCapture?.root,
-      "renderer native rendition inputs are not independently bound",
-    );
-  }
+  const composition = validateRendererCompositionInputs(
+    manifest,
+    expectedInputs,
+    RENDITION_VALIDATION_HELPERS,
+  );
   const probe = readJson(path.join(renderOutput, "media-probe.json"), "media probe");
   invariant(probe.schema === "build-images.demo-media-probe/v1" && probe.passed === true, "renderer media probe failed");
   const qualification = qualifyRendererOutput(
@@ -1024,7 +1018,7 @@ function verifyRendererOutput(renderOutput, expectedImage, expectedInputs, optio
     options.inspectMedia || inspectMediaFile,
     options.inspectionRoot || "",
   );
-  return { manifest, probe, qualification };
+  return { manifest, probe, qualification, composition };
 }
 
 function renditionInputRoots(root, renditions) {
@@ -1254,7 +1248,7 @@ function finalizeMedia(values) {
     sourceSha,
     qualifiedGateRoot: gateRoot,
     rendererImage,
-    rendererManifestRoot: sha256(readRegular(path.join(renderOutput, "manifest.json"), "renderer manifest")),
+    rendererManifestRoot: sha256(readRendererManifest(path.join(renderOutput, "manifest.json"), RENDITION_VALIDATION_HELPERS).bytes),
   };
   const mediaReceipt = selectedProfile.mode === "archive"
     ? { schema: "buildchain.auditable-demo-media/v1", ...commonReceipt }

package/scripts/aws-windows-jit-campaign-core.mjs

@@ -35,18 +35,15 @@ function tableName(value) {
 }
 
 function number(value) {
-  return { N: String(value) };
+  return { N: String(Math.round(value * 100_000_000) / 100_000_000) };
 }
 
 function money(value, label) {
   const normalized = String(value ?? "").trim();
-  if (!normalized) {
-    throw new Error(`${label} is required`);
-  }
+  if (!normalized) throw new Error(`${label} is required`);
   const parsed = Number(normalized);
-  if (!Number.isFinite(parsed) || parsed < 0) {
+  if (!Number.isFinite(parsed) || parsed < 0)
     throw new Error(`${label} must be a non-negative finite number`);
-  }
   return Math.round(parsed * 100_000_000) / 100_000_000;
 }
 
@@ -90,9 +87,11 @@ export function createWindowsJitCampaignArmPlan(values = {}) {
   );
   const maxAcceptedInstances = acceptedInstances(values.maxAcceptedInstances);
   const campaignReservationCeilingUsd = reservationUsd * maxAcceptedInstances;
-  const campaignSafetyCeilingUsd =
+  const campaignSafetyCeilingUsd = money(
     campaignReservationCeilingUsd +
-    reservationUsd * WINDOWS_EC2_JIT.maxConcurrentInstances;
+      reservationUsd * WINDOWS_EC2_JIT.maxConcurrentInstances,
+    "campaignSafetyCeilingUsd",
+  );
   const remainingPhaseBudgetUsd =
     WINDOWS_EC2_JIT.budgetLimitUsd - phaseSpendBaselineUsd;
   if (campaignSafetyCeilingUsd >= remainingPhaseBudgetUsd) {

package/scripts/aws-windows-jit-controller.mjs

@@ -164,6 +164,7 @@ function assertLivePreflight(plan, profile) {
     throw new Error("Windows AMI identity or availability mismatch");
   }
   return {
+    budgetGuard: jsonResult(commandResult("/bin/bash", ["scripts/aws-windows-jit-operator.sh", "launch-gate", "--region", plan.aws.region, ...(profile ? ["--aws-profile", profile] : [])]), "provider Budget launch gate"),
     runStatus: run.status,
     jobStatus: job.status,
     activeInstances: activeInstances.length,

package/scripts/aws-windows-jit-core.mjs

@@ -12,7 +12,7 @@ export const WINDOWS_EC2_JIT = Object.freeze({
   maximumInstanceLifetimeMinutes: 180,
   maxConcurrentInstances: 1,
   maxAcceptedInstances: 5,
-  budgetLimitUsd: 80,
+  budgetLimitUsd: 110,
   minimumSmokeJobs: 1,
   minimumFullJobs: 3,
   maximumCleanupLatencySeconds: 900,

package/scripts/build-contract-core.mjs

@@ -3,7 +3,6 @@ import fs from "node:fs";
 import path from "node:path";
 import { macosJitRunnerLabel } from "./aws-macos-jit-core.mjs";
 import { windowsJitRunnerLabel } from "./aws-windows-jit-core.mjs";
-
 export const RUNNER_PRESETS = Object.freeze({
   "github-hosted": [
     { id: "linux-x64", name: "Linux x64", platform: "linux", runner: '["ubuntu-24.04"]', capabilities: ["node"] },
@@ -768,6 +767,55 @@ function platformIsLinux(platform) {
   );
 }
 
+function platformUsesGitHubHostedRunner(platform, index) {
+  if (platform?.githubHosted !== undefined) {
+    if (typeof platform.githubHosted !== "boolean") {
+      throw new Error(
+        `platforms-json[${index}].githubHosted must be a boolean`,
+      );
+    }
+    return platform.githubHosted;
+  }
+  if (String(platform?.provider || "").trim()) {
+    return false;
+  }
+  const runnerLabels = parseJsonArray(
+    String(platform?.runner || "[]"),
+    `platforms-json[${index}].runner`,
+  ).map((label) => String(label || "").toLowerCase());
+  if (runnerLabels.includes("self-hosted") || runnerLabels.length !== 1) {
+    return false;
+  }
+  return /^(ubuntu-(latest|20\.04|22\.04|24\.04|24\.04-arm)|windows-(latest|2019|2022|2025|11-arm)|macos-(latest|13|14|15|26)(-intel)?)$/.test(
+    runnerLabels[0],
+  );
+}
+
+function bindRunnerHosting(platforms) {
+  return platforms.map((platform, index) => ({
+    ...platform,
+    githubHosted: platformUsesGitHubHostedRunner(platform, index),
+  }));
+}
+
+function runnerHostingSummary(platforms) {
+  const githubHostedPlatforms = platforms.filter(
+    (platform) => platform.githubHosted,
+  );
+  const relayPlatforms = platforms.filter((platform) => !platform.githubHosted);
+  return {
+    githubHostedPlatforms,
+    githubHostedPlatformsJson: JSON.stringify(githubHostedPlatforms),
+    githubHostedPlatformIdsJson: JSON.stringify(
+      githubHostedPlatforms.map((platform) => platform.id),
+    ),
+    githubHostedPlatformCount: githubHostedPlatforms.length,
+    relayPlatforms,
+    relayPlatformsJson: JSON.stringify(relayPlatforms),
+    relayPlatformCount: relayPlatforms.length,
+  };
+}
+
 function normalizePlatform(platform, index) {
   const id = String(platform?.id || "").trim();
   const name = String(platform?.name || id).trim();
@@ -793,7 +841,9 @@ function normalizePlatform(platform, index) {
   if (platform?.platform !== undefined) normalized.platform = String(platform.platform || "").trim();
   if (platform?.provider !== undefined) normalized.provider = String(platform.provider || "").trim();
   if (platform?.project !== undefined) normalized.project = String(platform.project || "").trim();
+  if (platform?.githubHosted !== undefined) normalized.githubHosted = platform.githubHosted;
   normalized.capabilities = capabilities.sort();
+  if (platform?.environment !== undefined) normalized.environment = platform.environment;
   if (platform?.required === false) normalized.required = false;
   return normalized;
 }
@@ -813,8 +863,10 @@ export function resolveRunnerMatrix({
     linuxContainerImage,
   });
   if (customPlatformsJson) {
-    const platforms = parseJsonArray(customPlatformsJson, "platforms-json").map(
-      normalizePlatform,
+    const platforms = bindRunnerHosting(
+      parseJsonArray(customPlatformsJson, "platforms-json").map(
+        normalizePlatform,
+      ),
     );
     if (platforms.length === 0) {
       throw new Error("platforms-json must include at least one platform");
@@ -838,6 +890,7 @@ export function resolveRunnerMatrix({
       containerPlatformsJson: JSON.stringify(containerPlatforms),
       containerPlatformCount: containerPlatforms.length,
       linuxContainer,
+      ...runnerHostingSummary(platforms),
     };
   }
 
@@ -875,6 +928,7 @@ export function resolveRunnerMatrix({
       runner: JSON.stringify(["self-hosted", "macOS", "ARM64", runnerLabel]),
     }));
   }
+  resolvedPlatforms = bindRunnerHosting(resolvedPlatforms);
   const containerPlatforms = linuxContainer.enabled
     ? resolvedPlatforms.filter(platformIsLinux)
     : [];
@@ -894,6 +948,7 @@ export function resolveRunnerMatrix({
     containerPlatformsJson: JSON.stringify(containerPlatforms),
     containerPlatformCount: containerPlatforms.length,
     linuxContainer,
+    ...runnerHostingSummary(resolvedPlatforms),
   };
 }
 

package/scripts/buildchain-cli-help.mjs

@@ -108,10 +108,18 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain inspect release --passport <file-or-url> [--json]
   buildchain inspect artifact <subject> [--passport <file-or-url>] [--npm-registry <url>] [--json]
   buildchain doctor [--cwd <dir>] [--require-publish-source-lock] [--json]
+  buildchain dev pr-admit --repository <owner/repo> --branch <dev/vN/vN.M>
+                             --pull-request <n> --expected-head <sha>
+                             [--execute] [--output <file>] [--json]
   buildchain dev merge-queue --repository <owner/repo> --branch <dev/vN/vN.M>
                              [--from-config | --workflow <required-workflow.yml>...] [--cwd <dir>]
                              [--check-response-timeout-minutes <n>]
                              [--max-entries-to-build <n>] [--apply]
+  buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|observe>
+                             --repository <owner/repo> --branch <dev/vN/vN.M>
+                             [--execute] [--output <file>] [--json]
+  buildchain dev proof <source|verify-source|classify|replay|integration|verify-integration>
+                             [--output <file>] [--json]
   buildchain log <info|warn|error> --event <name> [--phase <phase>]
                  [--component <name>] [--source <name>] [--attribute key=value]...
                  [--path <jsonl>] [--json]

package/scripts/buildchain-patrol.mjs

@@ -194,6 +194,15 @@ export async function runBuildchainPatrol(optionsInput = {}, clientInput) {
   }
 
   result.summary.plannedCount = result.planned.length;
+  const admissionActions = result.actions.flatMap((action) => action.result?.actions || []);
+  result.runKind = "cadence-patrol";
+  result.outcome = result.summary.evaluatedCount === 0
+    ? "no-op-no-candidates"
+    : admissionActions.length === 0
+      ? "no-op-all-skipped"
+      : "actions-present";
+  result.noOp = admissionActions.length === 0;
+  result.qualification = false;
   result.ok = result.inspections.every((inspection) => inspection.ok !== false);
   return result;
 }

package/scripts/check-inventory.mjs

@@ -137,6 +137,7 @@ const requiredPaths = [
   ".github/workflows/release-line-bootstrap.yml",
   ".github/workflows/release-governance-reconcile.yml",
   ".github/workflows/dev-pr-auto-merge.yml",
+  ".github/workflows/buildchain-dev-delivery.yml",
   ".github/workflows/buildchain-patrol.yml",
   ".github/workflows/patrol-daily.yml",
   ".github/workflows/patrol-weekly.yml",