@kungfu-tech/buildchain 3.0.9-alpha.0 → 3.0.9-alpha.10

package/packages/core/buildchain-compatibility-proof.js

@@ -7,6 +7,7 @@ import {
   devDeliveryRepository as repository,
   devDeliveryText as text,
 } from "./dev-delivery-common.js";
+import { evaluateBuildchainChannelBinding } from "./buildchain-channel-identity.js";
 
 export const BUILDCHAIN_COMPATIBILITY_PROOF_SCHEMA = "kungfu.buildchain.compatibility-proof/v1";
 export const BUILDCHAIN_COMPATIBILITY_PROOF_REGISTRY_SCHEMA = "kungfu.buildchain.compatibility-proof-registry/v1";
@@ -109,6 +110,28 @@ const HISTORICAL_ACCEPTANCES = [
       compatibilityDigest: "sha256:32a651504c57829085dc8863f0e41dee98eb60708ff6dec958c9c7e4b1010102",
     },
   },
+  {
+    proofId: "build-channel-router-d40dd0-to-30549a",
+    surfaceId: "controller:build-channel-router",
+    surfaceKind: "controller",
+    sourceBreakingDigest: "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
+    targetBreakingDigest: "sha256:30549aa26cd1e1dd81f10fe3529d3c6e3f8438a6efa0100c47ebae4d2f3d71df",
+    evidence: {
+      kind: "protected-pull-request-contract-acceptance",
+      pullRequest: "https://github.com/kungfu-systems/buildchain/pull/2549",
+      protectedBase: "dev/v3/v3.0",
+      sourceCommit: "0d87b772265066f5e6157e1ba6a2ba1021fb5225",
+      mergeCommit: "34fad9d3a94c450d75c0d06fd6ed00470c992ff7",
+      contractDigest: "sha256:2584ba36ab54cd5e9bab9e34dfc08d87a55dc57de1be7641492bf7ceb1366350",
+      compatibilityDigest: "sha256:80f65cc191b1f771475184edf8a1bf9c10dd69bb58060aa09313d0e1e57f508a",
+    },
+    cut: {
+      kind: "protected-git-cut",
+      repository: "kungfu-systems/buildchain",
+      protectedBase: "dev/v3/v3.0",
+      commit: "34fad9d3a94c450d75c0d06fd6ed00470c992ff7",
+    },
+  },
 ];
 
 function exactText(value, label) {
@@ -437,6 +460,19 @@ function evaluateSurfaceRelation({ oldSurface, nextSurface, proofRegistry, major
   };
 }
 
+function evaluateChannelBinding({ lock, workflowShellRef, runtimeRef, expectedChannel, expectedMajor, allowOpaqueRuntime }) {
+  if (!workflowShellRef && !expectedChannel && !expectedMajor) return null;
+  return evaluateBuildchainChannelBinding({
+    workflowShellRef,
+    runtimeRef,
+    lockRef: lock?.buildchain?.ref || "",
+    lockMajorLine: lock?.buildchain?.majorLine || "",
+    expectedChannel,
+    expectedMajor,
+    allowOpaqueRuntime,
+  });
+}
+
 export function evaluateBuildchainContractLock({
   lock,
   current,
@@ -444,11 +480,29 @@ export function evaluateBuildchainContractLock({
   runtimeSha = "",
   runtimeClass = "",
   compatibilityPolicy = "",
+  workflowShellRef = "",
+  expectedChannel = "",
+  expectedMajor = "",
+  allowOpaqueRuntime = false,
 } = {}) {
   if (!current || current.contract !== BUILDCHAIN_CONTRACT) {
     throw new Error("current must be a Buildchain runtime contract world");
   }
   assertBuildchainCompatibilityProjection(current);
+  const binding = evaluateChannelBinding({
+    lock, workflowShellRef, runtimeRef, expectedChannel, expectedMajor, allowOpaqueRuntime,
+  });
+  if (binding?.ok === false) {
+    return {
+      ok: false,
+      status: binding.status,
+      drift: false,
+      compatible: false,
+      issueRecommended: false,
+      reasons: binding.reasons,
+      channelBinding: binding,
+    };
+  }
   if (!new Set(["stable", "alpha"]).has(runtimeClass)) {
     return {
       ok: true,

package/packages/core/buildchain-contract.js

@@ -9,6 +9,13 @@ import {
 import { createControllerRegistry } from "./controller-evidence.js";
 import { enumerateWorkflowInputs } from "./public-surface-audit.js";
 
+export {
+  BUILDCHAIN_CHANNELS,
+  evaluateBuildchainChannelBinding,
+  normalizeBuildchainRef,
+  parseBuildchainRefIdentity,
+} from "./buildchain-channel-identity.js";
+
 export {
   BUILDCHAIN_COMPATIBILITY_PROOF_REGISTRY_SCHEMA,
   BUILDCHAIN_COMPATIBILITY_PROOF_SCHEMA,

package/packages/core/buildchain-delivery-bootstrap.js

@@ -0,0 +1,240 @@
+import { adopterDeliveryGateDigest } from "./adopter-delivery-gate.js";
+import { validateAdopterDeliveryGateResult } from "./adopter-delivery-passport.js";
+
+export const BUILDCHAIN_DELIVERY_BOOTSTRAP_CONTRACT =
+  "kungfu-buildchain-delivery-infrastructure-bootstrap/v1";
+
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const SHA_PATTERN = /^[0-9a-f]{40}$/;
+const SEMVER_PATTERN =
+  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+
+function issue(code, message) {
+  return { code, message };
+}
+
+function exactRoot(value) {
+  return ROOT_PATTERN.test(value ?? "");
+}
+
+function exactCut(cut) {
+  return (
+    cut &&
+    typeof cut === "object" &&
+    typeof cut.version === "string" &&
+    SHA_PATTERN.test(cut.sourceCommit ?? "") &&
+    exactRoot(cut.packageRoot) &&
+    exactRoot(cut.gateRoot) &&
+    typeof cut.protocol?.id === "string" &&
+    typeof cut.protocol?.version === "string" &&
+    exactRoot(cut.protocol?.root) &&
+    typeof cut.profile?.id === "string" &&
+    typeof cut.profile?.version === "string" &&
+    exactRoot(cut.profile?.root)
+  );
+}
+
+function parseSemver(value) {
+  const match = SEMVER_PATTERN.exec(value ?? "");
+  if (!match) return null;
+  return {
+    core: match.slice(1, 4).map(Number),
+    prerelease: match[4] ? match[4].split(".") : [],
+  };
+}
+
+function compareIdentifier(left, right) {
+  const leftNumber = /^\d+$/.test(left) ? Number(left) : null;
+  const rightNumber = /^\d+$/.test(right) ? Number(right) : null;
+  if (leftNumber !== null && rightNumber !== null) {
+    return Math.sign(leftNumber - rightNumber);
+  }
+  if (leftNumber !== null) return -1;
+  if (rightNumber !== null) return 1;
+  return left === right ? 0 : left < right ? -1 : 1;
+}
+
+function compareSemver(leftValue, rightValue) {
+  const left = parseSemver(leftValue);
+  const right = parseSemver(rightValue);
+  if (!left || !right) return null;
+  for (let index = 0; index < left.core.length; index += 1) {
+    if (left.core[index] !== right.core[index]) {
+      return Math.sign(left.core[index] - right.core[index]);
+    }
+  }
+  if (left.prerelease.length === 0 || right.prerelease.length === 0) {
+    if (left.prerelease.length === right.prerelease.length) return 0;
+    return left.prerelease.length === 0 ? 1 : -1;
+  }
+  const width = Math.max(left.prerelease.length, right.prerelease.length);
+  for (let index = 0; index < width; index += 1) {
+    if (left.prerelease[index] === undefined) return -1;
+    if (right.prerelease[index] === undefined) return 1;
+    const comparison = compareIdentifier(
+      left.prerelease[index],
+      right.prerelease[index],
+    );
+    if (comparison !== 0) return comparison;
+  }
+  return 0;
+}
+
+function sameProtocol(left, right) {
+  return (
+    left?.id === right?.id &&
+    left?.version === right?.version &&
+    left?.root === right?.root
+  );
+}
+
+function validTransition(transition, authority, candidate) {
+  if (!transition || typeof transition !== "object") return false;
+  const body = structuredClone(transition);
+  const transitionRoot = body.transitionRoot;
+  delete body.transitionRoot;
+  return (
+    exactRoot(transitionRoot) &&
+    adopterDeliveryGateDigest(body) === transitionRoot &&
+    body.fromGateRoot === authority.gateRoot &&
+    body.toGateRoot === candidate.gateRoot &&
+    body.fromProtocolRoot === authority.protocol.root &&
+    body.toProtocolRoot === candidate.protocol.root &&
+    body.fromProfileRoot === authority.profile.root &&
+    body.toProfileRoot === candidate.profile.root &&
+    exactRoot(body.compatibilityProofRoot) &&
+    exactRoot(body.independentReviewRoot)
+  );
+}
+
+function validateWarrant(warrant, candidate) {
+  return (
+    warrant &&
+    typeof warrant === "object" &&
+    warrant.outcome === "merged" &&
+    warrant.sourceHead === candidate.sourceCommit &&
+    exactRoot(warrant.sourceProofRoot) &&
+    exactRoot(warrant.nativeProofRoot) &&
+    exactRoot(warrant.integrationProofRoot)
+  );
+}
+
+export function qualifyBuildchainDeliveryInfrastructureBootstrap({
+  authority,
+  candidate,
+  gateResult,
+  warrant,
+  transitionEvidence,
+} = {}) {
+  const issues = [];
+  if (!exactCut(authority)) {
+    issues.push(
+      issue("bootstrap.authority.cut", "N-1 authority cut is incomplete"),
+    );
+  }
+  if (!exactCut(candidate)) {
+    issues.push(
+      issue("bootstrap.candidate.cut", "candidate cut is incomplete"),
+    );
+  }
+  if (authority?.protected !== true || authority?.published !== true) {
+    issues.push(
+      issue(
+        "bootstrap.authority.release",
+        "N-1 authority must be both protected and publicly released",
+      ),
+    );
+  }
+  if (candidate?.authorityVersion !== authority?.version) {
+    issues.push(
+      issue(
+        "bootstrap.authority.stale",
+        "candidate must name the exact N-1 authority version",
+      ),
+    );
+  }
+  const versionOrder = compareSemver(authority?.version, candidate?.version);
+  if (versionOrder === null || versionOrder >= 0) {
+    issues.push(
+      issue(
+        "bootstrap.authority.order",
+        "N-1 authority version must precede the candidate version",
+      ),
+    );
+  }
+  if (
+    authority?.sourceCommit === candidate?.sourceCommit ||
+    authority?.packageRoot === candidate?.packageRoot
+  ) {
+    issues.push(
+      issue(
+        "bootstrap.self-authorization",
+        "candidate source or package cannot serve as its own N-1 authority",
+      ),
+    );
+  }
+
+  const gateValidation = validateAdopterDeliveryGateResult(gateResult);
+  if (!gateValidation.passed) {
+    issues.push(
+      issue(
+        "bootstrap.gate.failed",
+        "candidate must retain a passed public adopter delivery gate result",
+      ),
+    );
+  }
+  if (
+    gateResult?.artifact?.root !== candidate?.packageRoot ||
+    gateResult?.project?.adopterId !== "kungfu-systems/buildchain"
+  ) {
+    issues.push(
+      issue(
+        "bootstrap.gate.candidate",
+        "gate result must bind the exact Buildchain candidate package",
+      ),
+    );
+  }
+  if (!validateWarrant(warrant, candidate)) {
+    issues.push(
+      issue(
+        "bootstrap.warrant",
+        "merged Delivery Warrant evidence must bind the candidate source",
+      ),
+    );
+  }
+
+  const transitionRequired =
+    !sameProtocol(authority?.protocol, candidate?.protocol) ||
+    !sameProtocol(authority?.profile, candidate?.profile) ||
+    authority?.gateRoot !== candidate?.gateRoot;
+  if (
+    transitionRequired &&
+    !validTransition(transitionEvidence, authority, candidate)
+  ) {
+    issues.push(
+      issue(
+        "bootstrap.transition",
+        "gate, protocol, or profile changes require exact independent transition evidence",
+      ),
+    );
+  }
+
+  const result = {
+    schemaVersion: 1,
+    contract: BUILDCHAIN_DELIVERY_BOOTSTRAP_CONTRACT,
+    status: issues.length === 0 ? "passed" : "failed",
+    authority: structuredClone(authority ?? null),
+    candidate: structuredClone(candidate ?? null),
+    gateResultRoot: gateResult?.gateRoot ?? null,
+    warrant: structuredClone(warrant ?? null),
+    transitionRequired,
+    transitionEvidenceRoot: transitionEvidence?.transitionRoot ?? null,
+    issues,
+    qualifying: false,
+    selfCertified: false,
+    releaseAuthorized: false,
+    finalAuthority: "protected-n-minus-one-plus-exact-delivery-evidence",
+  };
+  result.bootstrapRoot = adopterDeliveryGateDigest(result);
+  return result;
+}

package/packages/core/buildchain-delivery-infrastructure.js

@@ -0,0 +1,164 @@
+import { semanticRoot } from "@kungfu-tech/kfd/scripts/self-conformance-contract.mjs";
+
+import {
+  resolvePublishedKfdAdopterCategoryProfiles,
+  verifyPublishedKfdAdopterCategoryInstance,
+} from "./kfd-adopter-category-driver.js";
+
+export const BUILDCHAIN_DELIVERY_INFRASTRUCTURE_ADOPTER_ID =
+  "kungfu-systems/buildchain";
+export const BUILDCHAIN_DELIVERY_INFRASTRUCTURE_PROFILE = Object.freeze({
+  id: "kfd.adopter-category/delivery-infrastructure",
+  version: "1.0.0",
+});
+
+const CATEGORY_INSTANCE_SCHEMA =
+  "https://kfd.libkungfu.dev/schemas/kfd-adopter-conformance/category-instance-manifest.schema.json";
+const CATEGORY_INSTANCE_CONTRACT = "kfd.adopter-category-instance-manifest/v1";
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const CLAIM_BOUNDARY = Object.freeze({
+  categoryConformanceIsDeclarationOnly: true,
+  evidenceTransfer: false,
+  runtimePermission: false,
+  releaseAuthorization: false,
+  independentCertification: false,
+  semanticAuthorityTransfer: false,
+});
+
+function exactEvidenceReference(value, index) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new TypeError(`evidence[${index}] must be an object`);
+  }
+  const fields = ["requirementId", "kind", "coordinate", "root", "observedAt"];
+  const actual = Object.keys(value).sort();
+  const expected = [...fields].sort();
+  if (
+    actual.length !== expected.length ||
+    actual.some((field, fieldIndex) => field !== expected[fieldIndex])
+  ) {
+    throw new TypeError(`evidence[${index}] has an invalid field set`);
+  }
+  for (const field of ["requirementId", "kind", "coordinate", "observedAt"]) {
+    if (typeof value[field] !== "string" || value[field].length === 0) {
+      throw new TypeError(`evidence[${index}].${field} must be non-empty`);
+    }
+  }
+  if (!ROOT_PATTERN.test(value.root ?? "")) {
+    throw new TypeError(`evidence[${index}].root must be a sha256 root`);
+  }
+  return structuredClone(value);
+}
+
+function releaseBound(adopterManifest, artifact, release) {
+  return (adopterManifest?.releaseBindings ?? []).some(
+    (binding) =>
+      semanticRoot(binding.artifact) === semanticRoot(artifact) &&
+      semanticRoot(binding.releasePassport) === semanticRoot(release) &&
+      binding.kfdPackageRoot === adopterManifest.kfdCut.package.artifactRoot,
+  );
+}
+
+export function createBuildchainDeliveryInfrastructureInstanceManifest({
+  instanceId,
+  adopterManifest,
+  source,
+  artifact,
+  release,
+  evidence = [],
+} = {}) {
+  if (typeof instanceId !== "string" || instanceId.length === 0) {
+    throw new TypeError("instanceId must be non-empty");
+  }
+  if (
+    adopterManifest?.adopter?.id !==
+    BUILDCHAIN_DELIVERY_INFRASTRUCTURE_ADOPTER_ID
+  ) {
+    throw new TypeError(
+      `adopterManifest must identify ${BUILDCHAIN_DELIVERY_INFRASTRUCTURE_ADOPTER_ID}`,
+    );
+  }
+  if (!releaseBound(adopterManifest, artifact, release)) {
+    throw new TypeError(
+      "adopterManifest must bind the exact Buildchain artifact and release",
+    );
+  }
+
+  const selection = {
+    schemaVersion: 1,
+    contract: "kfd.adopter-category-profile-selection/v1",
+    profiles: [structuredClone(BUILDCHAIN_DELIVERY_INFRASTRUCTURE_PROFILE)],
+  };
+  const resolution = resolvePublishedKfdAdopterCategoryProfiles(selection);
+  if (!resolution.valid) {
+    throw new Error(
+      `published delivery-infrastructure profile did not resolve: ${JSON.stringify(resolution.issues)}`,
+    );
+  }
+
+  const project = {
+    adopterId: BUILDCHAIN_DELIVERY_INFRASTRUCTURE_ADOPTER_ID,
+    source: structuredClone(source),
+    artifact: structuredClone(artifact),
+    release: structuredClone(release),
+  };
+  const projectRoot = semanticRoot(project);
+  const adopterManifestRoot = semanticRoot(adopterManifest);
+  const packageRoot = adopterManifest.kfdCut.package.artifactRoot;
+  const requirementIds = new Set(
+    resolution.requirements.map((requirement) => requirement.id),
+  );
+  const suppliedEvidence = evidence.map(exactEvidenceReference);
+  for (const [index, entry] of suppliedEvidence.entries()) {
+    if (!requirementIds.has(entry.requirementId)) {
+      throw new TypeError(
+        `evidence[${index}].requirementId is not selected by the published profile`,
+      );
+    }
+  }
+
+  return {
+    $schema: CATEGORY_INSTANCE_SCHEMA,
+    schemaVersion: 1,
+    contract: CATEGORY_INSTANCE_CONTRACT,
+    instanceId,
+    rootAlgorithm: "sha256-kfd-canonical-json-v1",
+    project,
+    adopterManifest: {
+      contract: adopterManifest.contract,
+      manifestId: adopterManifest.manifestId,
+      root: adopterManifestRoot,
+    },
+    kfdCut: {
+      packageVersion: adopterManifest.kfdCut.package.version,
+      packageRoot,
+      categoryCatalogRoot: resolution.catalogRoot,
+    },
+    selection,
+    selectionRoot: resolution.selectionRoot,
+    requirements: resolution.requirements.map((requirement) => ({
+      id: requirement.id,
+      evidence: suppliedEvidence
+        .filter((entry) => entry.requirementId === requirement.id)
+        .map(({ requirementId: _requirementId, ...entry }) => ({
+          ...entry,
+          projectInstanceId: instanceId,
+          projectRoot,
+          adopterManifestRoot,
+          kfdPackageRoot: packageRoot,
+          categorySelectionRoot: resolution.selectionRoot,
+        })),
+    })),
+    claimBoundary: structuredClone(CLAIM_BOUNDARY),
+  };
+}
+
+export function verifyBuildchainDeliveryInfrastructureInstance(
+  manifest,
+  { adopterManifest, verifiedAt, maxAgeSeconds } = {},
+) {
+  return verifyPublishedKfdAdopterCategoryInstance(manifest, {
+    adopterManifest,
+    verifiedAt,
+    maxAgeSeconds,
+  });
+}

package/packages/core/channel-candidate.js

@@ -97,6 +97,14 @@ export function decideChannelCandidate(input) {
   const sourceSha = sha(input.sourceSha, "sourceSha");
   const targetSha = sha(input.targetSha, "targetSha");
   const selection = normalizeChannelCandidateSelection(input.selection);
+  if (
+    selection?.versionReservation &&
+    selection.versionReservation.candidateSha !== sourceSha
+  ) {
+    throw new Error(
+      "selection version reservation must bind the selected source SHA",
+    );
+  }
   const now = required(input.now || new Date().toISOString(), "now");
   const maxAgeSeconds = Number(input.maxAgeSeconds ?? 7 * 24 * 60 * 60);
   if (!Number.isSafeInteger(maxAgeSeconds) || maxAgeSeconds <= 0) {

package/packages/core/channel-promotion-baseline.js

@@ -1,5 +1,10 @@
 // SPDX-License-Identifier: Apache-2.0
 
+import {
+  nextDevelopmentPatrolContext,
+  normalizeNextDevelopmentVersionReservation,
+} from "./next-development-candidate-reservation.js";
+
 const SHA = /^[0-9a-f]{40}$/;
 
 function text(value = "") {
@@ -59,6 +64,18 @@ export function normalizeChannelCandidateSelection(input) {
           ),
         }
       : {}),
+    ...(input.versionReservation
+      ? {
+          versionReservation: normalizeNextDevelopmentVersionReservation(
+            input.versionReservation,
+            {
+              reservationSha: input.versionReservation.reservationSha,
+              candidateSha: input.versionReservation.candidateSha,
+              targetVersion: input.versionReservation.targetVersion,
+            },
+          ),
+        }
+      : {}),
   };
 }
 
@@ -117,6 +134,7 @@ export async function resolvePatrolSourceInputs({
   let comparison = headComparison;
   let workflowEvidence = [];
   let skippedNewerCommitCount = 0;
+  let versionReservation;
   let qualificationError;
   if (
     headComparison.status === "ahead" &&
@@ -130,6 +148,8 @@ export async function resolvePatrolSourceInputs({
       ),
     ]);
     try {
+      const { preparations, ignoredSourceShas } =
+        nextDevelopmentPatrolContext(sourceHistory);
       const selected = selectQualifiedSource({
         sourceHistory,
         workflowRunsByPath: new Map(
@@ -141,8 +161,39 @@ export async function resolvePatrolSourceInputs({
         requiredWorkflowPaths,
         now: options.now,
         maxAgeSeconds: options.maxAgeSeconds,
+        ignoredSourceShas,
       });
       ({ sourceSha, skippedNewerCommitCount, workflowEvidence } = selected);
+      const selectedIndex = sourceHistory.findIndex((entry) =>
+        (typeof entry === "string" ? entry : entry?.sha) === sourceSha,
+      );
+      const reservation = preparations.find(
+        ({ index }) => index > selectedIndex,
+      )?.preparation;
+      if (reservation) {
+        if (typeof client.readNextDevelopmentVersionReservation !== "function") {
+          throw new Error(
+            "candidate follows next-development preparation but reservation readback is unavailable",
+          );
+        }
+        versionReservation = normalizeNextDevelopmentVersionReservation(
+          await client.readNextDevelopmentVersionReservation({
+            reservationSha: reservation.sha,
+            candidateSha: sourceSha,
+            targetVersion: reservation.targetVersion,
+          }),
+          {
+            reservationSha: reservation.sha,
+            candidateSha: sourceSha,
+            targetVersion: reservation.targetVersion,
+          },
+        );
+        if (versionReservation.status !== "current") {
+          throw new Error(
+            `next-development version reservation is ${versionReservation.status} for candidate ${sourceSha}`,
+          );
+        }
+      }
       if (sourceSha !== observedSourceHeadSha)
         comparison = await client.compare(boundarySha, sourceSha);
     } catch (error) {
@@ -158,6 +209,7 @@ export async function resolvePatrolSourceInputs({
     comparison,
     workflowEvidence,
     skippedNewerCommitCount,
+    versionReservation,
     qualificationError,
   };
 }

package/packages/core/controller-evidence.js

@@ -53,7 +53,8 @@ const CONTROLLER_SPECS = [
     workflowId: "build",
     version: 1,
     capabilities: ["channel-selection", "runtime-selection", "build-delegation"],
-    stages: ["resolve-channel", "build", "aggregate"],
+    stages: ["resolve-channel", "alpha", "stable", "aggregate"],
+    optionalStages: ["alpha", "stable"],
     evidence: ["nested-controller-receipt", "controller-receipt"],
   },
   {

package/packages/core/dev-alpha-candidate-selection.js

@@ -82,7 +82,9 @@ export function selectLatestQualifiedSource({
   requiredWorkflowPaths,
   now,
   maxAgeSeconds,
+  ignoredSourceShas = [],
 }) {
+  const ignored = new Set(ignoredSourceShas);
   const latestByPath = new Map(
     requiredWorkflowPaths.map((workflow) => [
       workflow,
@@ -90,7 +92,11 @@ export function selectLatestQualifiedSource({
     ]),
   );
   for (let index = 0; index < sourceHistory.length; index += 1) {
-    const sourceSha = sourceHistory[index];
+    const sourceSha =
+      typeof sourceHistory[index] === "string"
+        ? sourceHistory[index]
+        : sourceHistory[index]?.sha;
+    if (ignored.has(sourceSha)) continue;
     const rows = requiredWorkflowPaths.map((workflow) =>
       latestByPath.get(workflow).get(sourceSha),
     );
@@ -115,7 +121,9 @@ export function selectLatestQualifiedSource({
       };
     }
   }
-  const staleSuccessfulPair = sourceHistory.some((sourceSha) => {
+  const staleSuccessfulPair = sourceHistory.some((entry) => {
+    const sourceSha = typeof entry === "string" ? entry : entry?.sha;
+    if (ignored.has(sourceSha)) return false;
     const rows = requiredWorkflowPaths.map((workflow) =>
       latestByPath.get(workflow).get(sourceSha),
     );