@kungfu-tech/buildchain 3.0.6-alpha.2 → 3.0.6-alpha.4

package/contracts/release-candidate-recovery-v1.schema.json

@@ -0,0 +1,103 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.libkungfu.dev/schemas/release-candidate-recovery-v1.schema.json",
+  "title": "Buildchain Release Candidate Recovery Receipt v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "contract",
+    "action",
+    "createdAt",
+    "repository",
+    "recoveryRunId",
+    "originalCandidate",
+    "target",
+    "recovered",
+    "skippedBuildStages",
+    "payloadBytes",
+    "buildchainToolingSha",
+    "transaction",
+    "root"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "contract": { "const": "kungfu-buildchain-release-candidate-recovery/v1" },
+    "action": { "const": "reused" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "repository": { "type": "string", "pattern": "^[^/\\s]+/[^/\\s]+$" },
+    "recoveryRunId": { "type": "string" },
+    "originalCandidate": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["runId", "workflowFile", "workflowName", "pullRequest", "sourceSha", "mergeSha", "tree"],
+      "properties": {
+        "runId": { "type": "string", "pattern": "^[0-9]+$" },
+        "workflowFile": { "type": "string" },
+        "workflowName": { "type": "string" },
+        "pullRequest": { "type": "integer", "minimum": 1 },
+        "sourceSha": { "$ref": "#/$defs/gitSha" },
+        "mergeSha": { "type": "string", "pattern": "^(?:[0-9a-f]{40})?$" },
+        "tree": { "$ref": "#/$defs/gitSha" }
+      }
+    },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["channel", "ref", "sha", "tree", "version"],
+      "properties": {
+        "channel": { "enum": ["alpha", "release", "major"] },
+        "ref": { "type": "string" },
+        "sha": { "$ref": "#/$defs/gitSha" },
+        "tree": { "$ref": "#/$defs/gitSha" },
+        "version": { "type": "string", "minLength": 1 }
+      }
+    },
+    "recovered": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["candidateRoot", "buildSummaryRoot", "artifactRoot", "artifactArchiveRoot", "artifactCount", "artifacts"],
+      "properties": {
+        "candidateRoot": { "$ref": "#/$defs/sha256" },
+        "buildSummaryRoot": { "$ref": "#/$defs/sha256" },
+        "artifactRoot": { "$ref": "#/$defs/sha256" },
+        "artifactArchiveRoot": { "$ref": "#/$defs/sha256" },
+        "artifactCount": { "type": "integer", "minimum": 1 },
+        "artifacts": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name", "size", "digest"],
+            "properties": {
+              "name": { "type": "string", "minLength": 1 },
+              "size": { "type": "integer", "minimum": 0 },
+              "digest": { "$ref": "#/$defs/sha256" }
+            }
+          }
+        }
+      }
+    },
+    "skippedBuildStages": {
+      "const": ["install", "build", "verify", "platform-matrix"]
+    },
+    "payloadBytes": { "const": "unchanged" },
+    "buildchainToolingSha": { "$ref": "#/$defs/gitSha" },
+    "transaction": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["identity", "state", "publicationState"],
+      "properties": {
+        "identity": { "type": "string" },
+        "state": { "enum": ["absent", "prepared", "sealed", "publishing", "publish_failed", "published", "finalizing", "complete", "repair_required", "abandoned", "failed_permanently"] },
+        "publicationState": { "type": "string", "minLength": 1 }
+      }
+    },
+    "root": { "$ref": "#/$defs/sha256" }
+  },
+  "$defs": {
+    "gitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "sha256": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
+  }
+}

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.2",
+    "version": "3.0.6-alpha.4",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -107,7 +107,8 @@
       "requiredOutputs": [
         "promoted-sha",
         "built-source-sha",
-        "release-candidate-artifact"
+        "release-candidate-artifact",
+        "release-candidate-action"
       ],
       "breakingDefaults": {
         "channelDefault": "auto",
@@ -123,6 +124,15 @@
         "buildchain-stable-contract-lock-path",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-expected-source-tree",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-buildchain-runtime-sha",
+        "resume-transaction-id",
         "publish-required-artifacts-json",
         "release-passport-kfd-1-witness-jsons",
         "release-passport-kfd-2-claim-jsons",
@@ -171,13 +181,19 @@
         "train and exact-SHA runtime overrides remain limited to trusted workflow_dispatch actors",
         "promotion reuses PR-stage release-candidate artifacts",
         "promotion does not run the heavy native build matrix",
+        "a fresh workflow event can recover an exact successful candidate run after startup or router failure",
+        "recovery validates repository, workflow, PR, ancestry, tree, candidate roots, controller evidence, manifests, archive digests, and payload bytes before mutation",
+        "recovery emits action reused and never silently falls back to a full build",
         "built source and promotion channel SHA are recorded separately",
         "contract drift is checked before release-candidate resolution and publish",
         "publish-gate source locks are created by the wrapper and enforced by promote-buildchain-ref before publish side effects",
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
-      "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
-      "auditDigest": "sha256:39e885f508cfc6a51817a982ccb14d575782d44650b5da50d8e9e3afbb16eb72"
+      "compatibleBreakingDigests": [
+        "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf"
+      ],
+      "breakingDigest": "sha256:e60642aa298933d2c103284794921a6c340a50aa91ee528b06e58892a2a006bf",
+      "auditDigest": "sha256:952ff4870c1e682ea62141b0c848c33825767212111ef26110617dbdaeacac5b"
     },
     {
       "contractVersion": 1,
@@ -193,7 +209,8 @@
       "requiredOutputs": [
         "promoted-sha",
         "built-source-sha",
-        "release-candidate-artifact"
+        "release-candidate-artifact",
+        "release-candidate-action"
       ],
       "breakingDefaults": {
         "promoteOnlyReleaseCandidate": true,
@@ -212,14 +229,27 @@
         "promotion-contract-lock-digest",
         "promotion-publication-channel",
         "promotion-target-ref",
-        "promotion-override-used"
+        "promotion-override-used",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-expected-source-tree",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-buildchain-runtime-sha",
+        "resume-transaction-id"
       ],
       "guarantees": [
         "advanced promotion verifies routed shell, runtime, lock, publication channel, and target bindings before candidate resolution",
-        "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
+        "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix",
+        "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph"
       ],
-      "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:09d9eaeb13eaa8468b261e7de085d3025f0a1b8b53472292073e02fca182433d"
+      "compatibleBreakingDigests": [
+        "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
+      ],
+      "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
+      "auditDigest": "sha256:2bc947b42da3c5b06cf75c498658c76d58b0205e7ad408011c3d1ecb4ecfa415"
     },
     {
       "contractVersion": 1,
@@ -760,7 +790,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:565f31c93c6f5dacd0d027832e2a291da997dfc71cd9beaf394c8b3512257a45"
+      "auditDigest": "sha256:f24cd2d463263e9309e79c14374762f951d88617f1cd0bee2e5b404bbe39859d"
     },
     {
       "contractVersion": 1,
@@ -782,7 +812,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:4ff63adedbf139619bcdf840b76c6380f9714a5b120598f5a43b38beb16a111f"
+      "auditDigest": "sha256:7f3a40e74933c7cf3fe91cca948f61adb011ca772d0cc039c9167a4277575f4a"
     },
     {
       "contractVersion": 1,
@@ -833,7 +863,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -1016,7 +1046,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:9c0aacca910cef4619a797898ff5c24027c1583f84431a93a5efc854925326e7",
-        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1551,7 +1581,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:48545554883888862984cdf1b6b4b56341531cdd6192600782a76b92ad22fd36",
-        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -2024,7 +2054,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2241,7 +2271,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2485,7 +2515,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2667,7 +2697,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2977,6 +3007,15 @@
         "release-propagation-config-path",
         "required-artifact-count",
         "required-status-check",
+        "resume-buildchain-runtime-sha",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-expected-source-tree",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-transaction-id",
         "runner-preset",
         "standalone-binary-distribution",
         "target-ref",
@@ -2985,8 +3024,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:a13b820669b162ab2f39d213164e7b7ab4e24c65f93cd3265a977fcd667c1303",
-        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
+        "digest": "sha256:bc03b3ac295e33b738fe5168e14ebf4d0fabf2325b4ae4a3d2b3c12afe816068",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3396,6 +3435,42 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "resume-buildchain-runtime-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-candidate-repository": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-candidate-run-id": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-candidate-root": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-candidate-runtime-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-source-tree": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-workflow-file": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-workflow-name": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-transaction-id": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "runner-preset": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -3425,7 +3500,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:09d9eaeb13eaa8468b261e7de085d3025f0a1b8b53472292073e02fca182433d"
+      "auditDigest": "sha256:2bc947b42da3c5b06cf75c498658c76d58b0205e7ad408011c3d1ecb4ecfa415"
     },
     {
       "contractVersion": 1,
@@ -3490,7 +3565,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12",
-        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "agent-work-context-json": {
             "classification": "digest-only",
@@ -3625,7 +3700,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3638,6 +3713,6 @@
       "auditDigest": "sha256:d07482cd66413a2fb3781a3b76f960b8151b6231841799647fe237820de2fde6"
     }
   ],
-  "compatibilityDigest": "sha256:76c3dd58a02887ecd6af33d63e749fef0a988a820fea99bdf4cb078cc48caa83",
-  "contractDigest": "sha256:eae7908098d9561b5a149f8b79e9e4ed484db7f205ee6864b0b70db17edccbe8"
+  "compatibilityDigest": "sha256:80cfdf1786019217c439810f1a80d2866bf8f7ef35a6fa569e1a687fb2bf4cbe",
+  "contractDigest": "sha256:046dc2789bed166a53ef2662f46562c3d131224973372cbdccda5fc53c000ff4"
 }