@kungfu-tech/buildchain 3.0.7-alpha.0 → 3.0.7

package/scripts/auditable-demo-bundle-verification.mjs

@@ -4,11 +4,10 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { readRendererManifest } from "./auditable-demo-renditions.mjs";
+import { MAX_LONG_FORM_RENDERER_MANIFEST_BYTES, readRendererManifest } from "./auditable-demo-renditions.mjs";
 
 const DIGEST = /^sha256:[0-9a-f]{64}$/u;
 const MAX_METADATA_MEMBER_BYTES = 8 * 1024 * 1024;
-const MAX_LONG_FORM_MANIFEST_BYTES = 32 * 1024 * 1024;
 const MAX_TERMINAL_CAPTURE_BYTES = 4 * 1024 * 1024;
 const MAX_TERMINAL_CAPTURE_EVENTS = 10_000;
 const DIGEST_BUFFER_BYTES = 64 * 1024;
@@ -113,7 +112,7 @@ export function verifyBundleChecksums(root, label, options = {}) {
     declared.add(match[2]);
     const metadataMember = match[2].endsWith(".json") || match[2].endsWith(".sha256");
     const maximum = options.allowLongFormRendererManifest && match[2] === "manifest.json"
-      ? MAX_LONG_FORM_MANIFEST_BYTES
+      ? MAX_LONG_FORM_RENDERER_MANIFEST_BYTES
       : metadataMember
         ? MAX_METADATA_MEMBER_BYTES
         : (options.maximumMemberBytes || MAX_METADATA_MEMBER_BYTES);

package/scripts/auditable-demo-platform.mjs

@@ -23,10 +23,10 @@ const NON_AUTHORITIES = [
 ];
 const RENDITIONS = [
   { id: "1080p", role: "primary", columns: 150, rows: 36, width: 1920, height: 1080 },
-  { id: "720p", role: "responsive", columns: 100, rows: 28, width: 1280, height: 720 },
+  { id: "720p", role: "responsive", columns: 150, rows: 28, width: 1280, height: 720 },
 ];
 const STANDARD_MAX_SECONDS = 60;
-const LONG_FORM_MAX_SECONDS = 180;
+const LONG_FORM_MAX_SECONDS = 360;
 const PRESENTATION_FRAMED = "presentation-framed";
 const TERMINAL_FILL = "terminal-fill";
 const MAX_EXECUTABLE_FILES = 32;

package/scripts/auditable-demo-renditions.mjs

@@ -17,7 +17,7 @@ const RENDITION_SET_NON_AUTHORITIES = [
   ...TERMINAL_CAPTURE_NON_AUTHORITIES,
 ];
 const MAX_BUNDLE_MEMBER_BYTES = 8 * 1024 * 1024;
-const MAX_LONG_FORM_RENDERER_MANIFEST_BYTES = 32 * 1024 * 1024;
+export const MAX_LONG_FORM_RENDERER_MANIFEST_BYTES = 64 * 1024 * 1024;
 const PRESENTATION_FRAMED = "presentation-framed";
 const TERMINAL_FILL = "terminal-fill";
 const GEOMETRY_TOLERANCE = 0.001;

package/scripts/auditable-demo.mjs

@@ -7,7 +7,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { readRendererManifest, validateRendererCompositionInputs, validateRenditionSet, validateTerminalCapture } from "./auditable-demo-renditions.mjs";
+import { MAX_LONG_FORM_RENDERER_MANIFEST_BYTES, readRendererManifest, validateRendererCompositionInputs, validateRenditionSet, validateTerminalCapture } from "./auditable-demo-renditions.mjs";
 
 const UTF8 = new TextDecoder("utf-8", { fatal: true });
 const IMAGE_PATTERN = /^[a-z0-9][a-z0-9./_-]*@sha256:[0-9a-f]{64}$/;
@@ -141,7 +141,7 @@ function verifyChecksums(root, checksumName = "checksums.sha256", options = {})
     invariant(!declared.has(member), `duplicate checksum member: ${member}`);
     declared.add(member);
     const maximumBytes = options.allowLongFormRendererManifest && member === "manifest.json"
-      ? 32 * 1024 * 1024
+      ? MAX_LONG_FORM_RENDERER_MANIFEST_BYTES
       : MAX_BUNDLE_MEMBER_BYTES;
     invariant(
       sha256(readRegular(target, member, maximumBytes)).slice(7) === match[1],

package/scripts/build-contract-core.mjs

@@ -1209,9 +1209,14 @@ export function writeGitHubOutputs(outputs) {
     }
     return;
   }
-  const lines = Object.entries(outputs).map(
-    ([key, value]) => `${key}=${value}`,
-  );
+  const lines = Object.entries(outputs).map(([key, value]) => {
+    const text = String(value);
+    if (!/[\r\n]/.test(text)) return `${key}=${text}`;
+    const valueLines = new Set(text.split(/\r?\n/));
+    let delimiter = "BUILDCHAIN_OUTPUT";
+    while (valueLines.has(delimiter)) delimiter += "_";
+    return `${key}<<${delimiter}\n${text}\n${delimiter}`;
+  });
   fs.appendFileSync(outputPath, `${lines.join("\n")}\n`);
 }
 

package/scripts/build-standalone-binary.mjs

@@ -2,7 +2,6 @@
 import { spawnSync } from "node:child_process";
 import crypto from "node:crypto";
 import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { createBuildchainLogger } from "../packages/core/logging.js";
@@ -224,16 +223,16 @@ function postjectArgs(binaryPath, blobPath) {
   return args;
 }
 
-export function buildStandaloneBinary({
+function buildStandaloneBinaryInTemp({
   cwd = process.cwd(),
   outputDir = "dist/binary",
   name = "buildchain",
   version = "",
   packageManagerInstall = false,
   logPath = undefined,
+  tempDir,
 } = {}) {
   const resolvedOutputDir = path.resolve(cwd, outputDir);
-  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-sea-"));
   const triple = platformTriple();
   const archiveBase = `${name}-${triple}`;
   const logger = createBuildchainLogger({
@@ -384,6 +383,18 @@ export function buildStandaloneBinary({
   return manifest;
 }
 
+export function buildStandaloneBinary(options = {}) {
+  const cwd = path.resolve(options.cwd || process.cwd());
+  const tempRoot = path.join(cwd, ".buildchain", "tmp");
+  fs.mkdirSync(tempRoot, { recursive: true });
+  const tempDir = fs.mkdtempSync(path.join(tempRoot, "sea-"));
+  try {
+    return buildStandaloneBinaryInTemp({ ...options, cwd, tempDir });
+  } finally {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  }
+}
+
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   try {
     const result = buildStandaloneBinary({

package/scripts/check-inventory.mjs

@@ -992,7 +992,7 @@ for (const forbiddenSnippet of [
 for (const requiredSnippet of [
   "id-token: write",
   "actions: write",
-  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@9a0cdf8d84aacf8c7daaac82efa43d1b34696a03\n",
+  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@769b221bad7a6b9104afad4c2628d9dca396ab0f\n",
   "github.event.workflow_run.event == 'push'",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
@@ -1038,9 +1038,11 @@ for (const requiredSnippet of [
   "github-release-notes: ${{ inputs.github-release-notes }}",
   "publication-commit-command:",
   "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY:",
+  "BUILDCHAIN_PUBLICATION_COMMIT_CANDIDATE_SOURCE_SHA: ${{ steps.rc.outputs.release-candidate-source-sha || needs.preflight.outputs.requested-sha }}",
   "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY:",
   "Commit consumer publication authority last",
   "node .buildchain/runtime/scripts/publication-commit-evidence.mjs",
+  '--candidate-source-sha "${BUILDCHAIN_PUBLICATION_COMMIT_CANDIDATE_SOURCE_SHA}"',
   "require-publish-source-lock: \"true\"",
   "publish-source-ref: ${{ steps.publish-gate.outputs.ref }}",
   "publish-source-sha: ${{ steps.publish-gate.outputs.sha }}",

package/scripts/dev-delivery-warrant.mjs

@@ -2,6 +2,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { cancelQueuedDevDeliveryCandidate, closeDevDeliveryWarrant, createDevDeliveryQueue, heartbeatDevDeliveryWarrant, observeDevDeliveryQueue, recoverExpiredDevDeliveryWarrant, selectDevDeliveryWarrant, settleDevDeliveryTerminalEvent, submitDevDeliveryCandidate } from "../packages/core/dev-delivery-warrant.js";
+import { planDevDeliveryWarrantShadow, qualifyDevDeliveryWarrantShadow } from "../packages/core/dev-delivery-warrant-shadow.js";
 
 const STATE_PATH = "queue.json";
 const STATE_REF_PREFIX = "buildchain/dev-delivery-warrant/";
@@ -189,6 +190,7 @@ function transitionFor(command, queue, options) {
         closureRoot: exactRoot(options.closureRoot, "closureRoot"),
         dependencyRoot: exactRoot(options.dependencyRoot, "dependencyRoot"),
         toolchainRoot: exactRoot(options.toolchainRoot, "toolchainRoot"),
+        sourceWorkflowRunId: options.sourceWorkflowRunId ? positiveInteger(options.sourceWorkflowRunId, "sourceWorkflowRunId") : 0,
         deliveryClass: options.deliveryClass,
         priority: options.priority || "ordinary",
       },
@@ -345,6 +347,23 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
   };
 }
 
+export function runDevDeliveryShadowCommand(options = {}) {
+  if (bool(options.execute, false)) {
+    throw new Error("shadow qualification is effect-disabled and rejects --execute");
+  }
+  if (!options.inputPath) throw new Error("shadow qualification requires --input FILE");
+  const input = JSON.parse(fs.readFileSync(options.inputPath, "utf8"));
+  if (options.command === "shadow-plan") {
+    return planDevDeliveryWarrantShadow(input, {
+      maxConcurrency: positiveInteger(options.maxConcurrency, "maxConcurrency", 2),
+    });
+  }
+  if (options.command === "shadow-qualify") {
+    return qualifyDevDeliveryWarrantShadow(input);
+  }
+  throw new Error(`unsupported shadow command ${options.command || "<empty>"}`);
+}
+
 function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
   return index === -1 ? fallback : args[index + 1] || "";
@@ -386,6 +405,8 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
     evidenceRoot: flag(rest, "evidence-root", environment.BUILDCHAIN_DEV_DELIVERY_EVIDENCE_ROOT),
     reason: flag(rest, "reason", environment.BUILDCHAIN_DEV_DELIVERY_REASON),
     now: flag(rest, "now", environment.BUILDCHAIN_DEV_DELIVERY_NOW),
+    inputPath: flag(rest, "input", environment.BUILDCHAIN_DEV_DELIVERY_SHADOW_INPUT),
+    maxConcurrency: flag(rest, "max-concurrency", environment.BUILDCHAIN_DEV_DELIVERY_SHADOW_MAX_CONCURRENCY || "2"),
     outputPath: flag(rest, "output", environment.BUILDCHAIN_DEV_DELIVERY_OUTPUT || ".buildchain/dev-delivery/result.json"),
     execute: hasFlag(rest, "execute"),
     json: hasFlag(rest, "json"),
@@ -393,7 +414,7 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
 }
 
 function usage() {
-  return "Usage:\n  buildchain dev warrant <submit|select|heartbeat|recover|close|settle|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n";
+  return "Usage:\n  buildchain dev warrant <submit|select|heartbeat|recover|close|settle|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n  buildchain dev warrant <shadow-plan|shadow-qualify> --input FILE [--max-concurrency 1|2] [--output FILE] [--json]\n";
 }
 
 async function main() {
@@ -403,16 +424,22 @@ async function main() {
     return;
   }
   const options = devDeliveryCliOptions(args);
-  if (!["submit", "select", "heartbeat", "recover", "close", "settle", "cancel-queued", "observe"].includes(options.command)) {
+  if (!["submit", "select", "heartbeat", "recover", "close", "settle", "cancel-queued", "observe", "shadow-plan", "shadow-qualify"].includes(options.command)) {
     throw new Error(usage().trim());
   }
-  const result = await runDevDeliveryCommand(options);
+  const shadow = options.command.startsWith("shadow-");
+  const result = shadow ? runDevDeliveryShadowCommand(options) : await runDevDeliveryCommand(options);
   fs.mkdirSync(path.dirname(options.outputPath), { recursive: true });
   fs.writeFileSync(options.outputPath, `${JSON.stringify(result, null, 2)}\n`);
   if (options.json) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
   else {
     process.stdout.write(`Buildchain dev delivery ${options.command}: ${result.receipt?.reason || result.mode}\n`);
-    process.stdout.write(`State root: ${result.after?.stateRoot || result.observation.stateRoot}\n`);
+    if (shadow) {
+      process.stdout.write(`Decision: ${result.decision}\n`);
+      process.stdout.write(`Evidence root: ${result.planRoot || result.qualificationRoot}\n`);
+    } else {
+      process.stdout.write(`State root: ${result.after?.stateRoot || result.observation.stateRoot}\n`);
+    }
     if (result.receiptRoot) process.stdout.write(`Receipt root: ${result.receiptRoot}\n`);
     process.stdout.write(`Result: ${options.outputPath}\n`);
   }

package/scripts/dev-pr-auto-merge.mjs

@@ -4,7 +4,7 @@ import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { verifyProjectCutReplayProof } from "../packages/core/dev-delivery-warrant.js";
-import { admitExistingQueueEntry, createDevPrAdmissionReceipt, readDeliveryWarrantResult, runSourceQualification, runTargetedQueueAdmission } from "./dev-pr-delivery-warrant.mjs";
+import { admitExistingQueueEntry, createDevPrAdmissionReceipt, enqueueAfterStatusPropagation, readDeliveryWarrantResult, runSourceQualification, runTargetedQueueAdmission, verifyCurrentDeliveryWarrant } from "./dev-pr-delivery-warrant.mjs";
 const DEFAULT_BLOCK_LABELS = ["blocked", "do-not-merge", "work-in-progress"];
 const DEFAULT_ALLOWED_HEAD_PREFIXES = ["feature/", "fix/", "chore/", "docs/", "ci/", "refactor/"];
 const DEFAULT_REQUIRED_CHECKS = ["check"];
@@ -70,6 +70,7 @@ function normalizeOptions(options = {}) {
     allowedHeadPrefixes: splitList(options.allowedHeadPrefixes, DEFAULT_ALLOWED_HEAD_PREFIXES),
     requiredChecks: splitList(options.requiredChecks, DEFAULT_REQUIRED_CHECKS),
     queueAdmissionContext: String(options.queueAdmissionContext || "").trim(),
+    activeLeaseContext: String(options.activeLeaseContext || "").trim(),
     requireApproval: boolOption(options.requireApproval, true),
     sameRepositoryOnly: boolOption(options.sameRepositoryOnly, true),
     maxMerges: intOption(options.maxMerges, 1),
@@ -218,6 +219,20 @@ async function setQueueAdmissionStatus(client, repository, sha, context, state)
   return { context, state, sha };
 }
 
+async function setActiveLeaseStatus(client, repository, sha, context, state) {
+  if (!context) return null;
+  await client.request("POST", `/repos/${repository.owner}/${repository.repo}/statuses/${sha}`, {
+    body: {
+      state,
+      context,
+      description: state === "pending"
+        ? "Buildchain reactivated this exact lease for merge-group qualification"
+        : "Buildchain released this exact lease after queue admission failed",
+    },
+  });
+  return { context, state, sha };
+}
+
 function skip(reason, details = {}) {
   return { action: "skip", reason, ...details };
 }
@@ -853,11 +868,15 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
   let warrant = null;
   try {
     warrant = readDeliveryWarrantResult(options, pr);
+    await verifyCurrentDeliveryWarrant(client, options, pr, warrant);
   } catch (error) {
     return reject("blocked", error.code || "invalid-delivery-warrant");
   }
   const matchingEntry = initialQueue.entries.find((entry) =>
     entry.pullRequestNumber === pr.number && entry.pullRequestHeadSha === options.expectedHeadSha);
+  if (matchingEntry && !options.dryRun) {
+    await setActiveLeaseStatus(client, options.repository, options.expectedHeadSha, options.activeLeaseContext, "pending");
+  }
   const existing = await admitExistingQueueEntry({
     options, pullRequest: pr, readiness, client, entry: matchingEntry, warrant,
     createReceipt: createAdmissionReceipt,
@@ -893,6 +912,7 @@ async function reconcileEnqueueError({ client, options, pr, expectedHeadSha, ent
   const exactEntry = queueReadback?.entries?.find((candidate) =>
     candidate.pullRequestNumber === pr.number && candidate.pullRequestHeadSha === expectedHeadSha);
   if (exactEntry) {
+    entry.activeLeaseStatus = await setActiveLeaseStatus(client, options.repository, expectedHeadSha, options.activeLeaseContext, "pending");
     entry.action = "enqueued";
     entry.reason = "already-enqueued-exact-head";
     entry.queueEntry = exactEntry;
@@ -902,6 +922,7 @@ async function reconcileEnqueueError({ client, options, pr, expectedHeadSha, ent
     return;
   }
   entry.queueAdmissionStatus = await setQueueAdmissionStatus(client, options.repository, expectedHeadSha, options.queueAdmissionContext, "failure");
+  entry.activeLeaseStatus = await setActiveLeaseStatus(client, options.repository, expectedHeadSha, options.activeLeaseContext, "failure");
   entry.action = "skip";
   entry.reason = "enqueue-rejected";
   entry.enqueueError = {
@@ -1067,10 +1088,14 @@ export async function runDevPrAutoMerge(optionsInput = {}, clientInput) {
           result.skipped.push(entry);
         } else {
           try {
+            entry.activeLeaseStatus = await setActiveLeaseStatus(client, options.repository, expectedHeadSha, options.activeLeaseContext, "pending");
             entry.queueAdmissionStatus = await setQueueAdmissionStatus(client, options.repository, expectedHeadSha, options.queueAdmissionContext, "success");
-            const queueEntry = await client.enqueuePullRequest({
-              pullRequestId: decision.pullRequestId,
-              expectedHeadOid: expectedHeadSha,
+            const queueEntry = await enqueueAfterStatusPropagation({
+              enqueue: (input) => client.enqueuePullRequest(input),
+              input: { pullRequestId: decision.pullRequestId, expectedHeadOid: expectedHeadSha },
+              attempts: options.pollMergeableAttempts,
+              delayMs: options.pollMergeableDelayMs,
+              sleep: delay,
             });
             entry.action = "enqueued";
             entry.reason = "enqueued-with-expected-head";
@@ -1155,6 +1180,7 @@ export function cliOptions(args = [], environment = process.env) {
     allowedHeadPrefixes: cliValue(args, "allowed-head-prefixes", environment.BUILDCHAIN_DEV_PR_ALLOWED_HEAD_PREFIXES),
     requiredChecks: cliValue(args, "required-checks", environment.BUILDCHAIN_DEV_PR_REQUIRED_CHECKS),
     queueAdmissionContext: cliValue(args, "queue-admission-context", environment.BUILDCHAIN_DEV_PR_QUEUE_ADMISSION_CONTEXT),
+    activeLeaseContext: cliValue(args, "active-lease-context", environment.BUILDCHAIN_DEV_PR_ACTIVE_LEASE_CONTEXT),
     diagnosticContext: cliValue(args, "diagnostic-context", environment.BUILDCHAIN_DEV_PR_DIAGNOSTIC_CONTEXT),
     warrantMode: cliValue(args, "warrant-mode", environment.BUILDCHAIN_DEV_PR_WARRANT_MODE),
     warrantResultPath: cliValue(args, "warrant-result", environment.BUILDCHAIN_DEV_PR_WARRANT_RESULT_PATH),

package/scripts/dev-pr-delivery-warrant.mjs

@@ -116,6 +116,56 @@ export function readDeliveryWarrantResult(options, pullRequest) {
   };
 }
 
+export async function readCurrentDeliveryQueueState(client, repository, targetBranch) {
+  if (typeof client.getDevDeliveryQueueState === "function") {
+    return client.getDevDeliveryQueueState(targetBranch);
+  }
+  const stateRef = `buildchain/dev-delivery-warrant/${targetBranch.replaceAll("/", "-")}`;
+  const query = new URLSearchParams({ ref: stateRef });
+  const { data } = await client.request(
+    "GET",
+    `/repos/${repository.owner}/${repository.repo}/contents/queue.json?${query}`,
+  );
+  if (data?.type !== "file" || data?.encoding !== "base64" || !data?.content) {
+    mismatch("delivery-warrant-current-readback-invalid");
+  }
+  return JSON.parse(Buffer.from(String(data.content).replace(/\s+/g, ""), "base64").toString("utf8"));
+}
+
+export async function verifyCurrentDeliveryWarrant(client, options, pullRequest, warrant) {
+  if (!warrant) return;
+  let queue;
+  try {
+    queue = await readCurrentDeliveryQueueState(client, options.repository, options.targetBranch);
+  } catch {
+    mismatch("delivery-warrant-current-readback-failed");
+  }
+  const active = queue?.activeWarrant;
+  const candidate = queue?.candidates?.find((entry) => entry.candidateId === active?.candidateId);
+  requireMatch(active?.candidateId === warrant.candidateId, "delivery-warrant-no-longer-active");
+  requireMatch(active?.fencingToken === warrant.fencingToken, "delivery-warrant-current-fencing-mismatch");
+  requireMatch(Number(active?.generation) === Number(warrant.generation), "delivery-warrant-current-generation-mismatch");
+  requireMatch(Number(active?.pullRequestNumber) === Number(pullRequest.number), "delivery-warrant-current-pr-mismatch");
+  requireMatch(String(active?.sourceHead || "").toLowerCase() === options.expectedHeadSha, "delivery-warrant-current-head-mismatch");
+  requireMatch(["selected", "proving", "waiting", "blocked"].includes(candidate?.status), "delivery-warrant-current-candidate-not-selected");
+  requireMatch(candidate?.sourceHead === active.sourceHead, "delivery-warrant-current-candidate-head-mismatch");
+}
+
+export async function enqueueAfterStatusPropagation({ enqueue, input, attempts, delayMs, sleep }) {
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return await enqueue(input);
+    } catch (error) {
+      lastError = error;
+      const propagation = /required status(?:es| check).*failing|failing required status|cannot change this locked branch/i.test(String(error?.message || ""));
+      if (!propagation || attempt === attempts) throw error;
+      await sleep(delayMs);
+    }
+  }
+  throw lastError;
+}
+
 export async function runSourceQualification({ options, pullRequest, readiness, client, evaluate, admissionState, createReceipt, root, publishDiagnostic, reject }) {
   const decision = await evaluate(pullRequest, { ...options, landingMode: options.landingMode, dryRun: true }, client);
   if (decision.observedHeadSha && String(decision.observedHeadSha).toLowerCase() !== options.expectedHeadSha) {