@kungfu-tech/buildchain 3.0.9-alpha.1 → 3.0.9-alpha.11

package/scripts/aws-macos-jit-instance-rehydrate.mjs

@@ -0,0 +1,260 @@
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+  AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+  macosRunInstancesArgs,
+} from "./aws-macos-jit-controller-core.mjs";
+import { MACOS_EC2_JIT_REGIONS } from "./aws-macos-jit-core.mjs";
+import {
+  assertDryRun,
+  assertMacosBudgetLaunchGate,
+  assertOwnership,
+  awsArgs,
+  awsJson,
+  commandResult,
+  ghJson,
+  requireSuccess,
+} from "./aws-macos-jit-controller-runtime.mjs";
+
+function assertInstanceRehydratePreflight(plan, profile) {
+  const launchGate = assertMacosBudgetLaunchGate(plan, profile);
+  const commit = ghJson(
+    ["api", `repos/${plan.repository}/commits/${plan.source.sha}`],
+    undefined,
+    "GitHub exact-source preflight",
+  );
+  if (String(commit.sha || "").toLowerCase() !== plan.source.sha) {
+    throw new Error("GitHub did not resolve the exact campaign source SHA");
+  }
+  const host = awsJson(
+    plan,
+    profile,
+    [
+      "ec2",
+      "describe-hosts",
+      "--host-ids",
+      plan.aws.hostId,
+      "--output",
+      "json",
+    ],
+    "macOS rehydration host preflight",
+  ).Hosts?.[0];
+  if (
+    !host ||
+    host.State !== "available" ||
+    host.AvailabilityZone !== plan.aws.availabilityZone ||
+    host.HostProperties?.InstanceType !== plan.aws.instanceType ||
+    (host.Instances || []).length !== 0 ||
+    new Date(host.AllocationTime).toISOString() !== plan.aws.hostAllocatedAt
+  ) {
+    throw new Error("macOS rehydration host identity or capacity mismatch");
+  }
+  assertOwnership(host.Tags, plan);
+
+  const regionalPlans = Object.keys(MACOS_EC2_JIT_REGIONS).map((region) => ({
+    ...plan,
+    aws: { ...plan.aws, region },
+  }));
+  const otherHosts = regionalPlans.flatMap((regionalPlan) =>
+    (
+      awsJson(
+        regionalPlan,
+        profile,
+        [
+          "ec2",
+          "describe-hosts",
+          "--filter",
+          "Name=tag:kungfu:plane,Values=aws-us-elastic-runner-burst",
+          "Name=tag:kungfu:provider,Values=macos-ec2-jit",
+          "Name=state,Values=available,pending,under-assessment",
+          "--output",
+          "json",
+        ],
+        `macOS rehydration host ceiling in ${regionalPlan.aws.region}`,
+      ).Hosts || []
+    ).filter((candidate) => candidate.HostId !== plan.aws.hostId),
+  );
+  if (otherHosts.length !== 0) {
+    throw new Error("macOS rehydration found another active Dedicated Host");
+  }
+  const activeInstances = regionalPlans.flatMap((regionalPlan) => {
+    const active = awsJson(
+      regionalPlan,
+      profile,
+      [
+        "ec2",
+        "describe-instances",
+        "--filters",
+        "Name=tag:kungfu:plane,Values=aws-us-elastic-runner-burst",
+        "Name=tag:kungfu:provider,Values=macos-ec2-jit",
+        "Name=instance-state-name,Values=pending,running,stopping,stopped,shutting-down",
+        "--output",
+        "json",
+      ],
+      `active macOS JIT instance preflight in ${regionalPlan.aws.region}`,
+    );
+    return (active.Reservations || []).flatMap(
+      (reservation) => reservation.Instances || [],
+    );
+  });
+  if (activeInstances.length !== 0) {
+    throw new Error("macOS rehydration requires zero active JIT instances");
+  }
+  const runners = ghJson(
+    ["api", `repos/${plan.repository}/actions/runners?per_page=100`],
+    undefined,
+    "macOS rehydration runner preflight",
+  ).runners;
+  if (
+    (runners || []).some((runner) =>
+      (runner.labels || []).some((label) =>
+        String(label.name || label).startsWith("aws-us-ec2-macos-jit-"),
+      ),
+    )
+  ) {
+    throw new Error("macOS rehydration requires zero JIT runner residue");
+  }
+  const image = awsJson(
+    plan,
+    profile,
+    [
+      "ec2",
+      "describe-images",
+      "--image-ids",
+      plan.aws.amiId,
+      "--output",
+      "json",
+    ],
+    "macOS rehydration AMI preflight",
+  ).Images?.[0];
+  if (
+    !image ||
+    image.Name !== plan.aws.amiName ||
+    image.Architecture !== "arm64_mac" ||
+    image.State !== "available"
+  ) {
+    throw new Error("macOS AMI identity or availability mismatch");
+  }
+  const subnet = awsJson(
+    plan,
+    profile,
+    [
+      "ec2",
+      "describe-subnets",
+      "--subnet-ids",
+      plan.aws.subnetId,
+      "--output",
+      "json",
+    ],
+    "macOS rehydration subnet preflight",
+  ).Subnets?.[0];
+  if (!subnet || subnet.AvailabilityZone !== plan.aws.availabilityZone) {
+    throw new Error(
+      "macOS subnet and Dedicated Host availability zone mismatch",
+    );
+  }
+  return {
+    ...launchGate,
+    exactCommit: plan.source.sha,
+    hostId: host.HostId,
+    hostState: host.State,
+    activeInstances: 0,
+    otherActiveHosts: 0,
+    amiOwnerId: image.OwnerId,
+    subnetAvailabilityZone: subnet.AvailabilityZone,
+  };
+}
+
+export function executeMacosJitInstanceRehydrate(plan, { profile = "" } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "instance-rehydrate-plan"
+  ) {
+    throw new Error("macOS JIT instance rehydrate plan contract is invalid");
+  }
+  const preflight = assertInstanceRehydratePreflight(plan, profile);
+  assertDryRun(
+    commandResult(
+      "aws",
+      awsArgs(
+        plan,
+        profile,
+        macosRunInstancesArgs(plan, { hostId: plan.aws.hostId, dryRun: true }),
+      ),
+    ),
+    "EC2 same-host RunInstances DryRun",
+  );
+  const launched = awsJson(
+    plan,
+    profile,
+    macosRunInstancesArgs(plan, { hostId: plan.aws.hostId }),
+    "EC2 same-host RunInstances",
+  );
+  const instanceId = launched.Instances?.[0]?.InstanceId;
+  if (!/^i-[0-9a-f]+$/.test(String(instanceId || ""))) {
+    throw new Error("EC2 same-host RunInstances returned no instance identity");
+  }
+  requireSuccess(
+    commandResult(
+      "aws",
+      awsArgs(plan, profile, [
+        "ec2",
+        "wait",
+        "instance-running",
+        "--instance-ids",
+        instanceId,
+      ]),
+    ),
+    "macOS rehydrated instance-running waiter",
+  );
+  const instance = awsJson(
+    plan,
+    profile,
+    [
+      "ec2",
+      "describe-instances",
+      "--instance-ids",
+      instanceId,
+      "--output",
+      "json",
+    ],
+    "macOS rehydrated instance readback",
+  ).Reservations?.[0]?.Instances?.[0];
+  if (
+    !instance ||
+    instance.State?.Name !== "running" ||
+    instance.Placement?.HostId !== plan.aws.hostId ||
+    instance.ImageId !== plan.aws.amiId ||
+    instance.InstanceType !== plan.aws.instanceType
+  ) {
+    throw new Error("macOS rehydrated instance identity or placement mismatch");
+  }
+  assertOwnership(instance.Tags, plan);
+  return {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "instance-rehydrate-result",
+    status: "rehydrated",
+    repository: plan.repository,
+    campaign: plan.campaign,
+    source: plan.source,
+    replacement: {
+      rehydrationId: plan.aws.rehydrationId,
+      replacesInstanceId: plan.aws.replacesInstanceId,
+    },
+    aws: {
+      region: plan.aws.region,
+      availabilityZone: plan.aws.availabilityZone,
+      hostId: plan.aws.hostId,
+      hostAllocatedAt: plan.aws.hostAllocatedAt,
+      instanceId,
+      instanceType: instance.InstanceType,
+      imageId: instance.ImageId,
+      launchTime: new Date(instance.LaunchTime).toISOString(),
+    },
+    preflight,
+    dryRun: "RunInstances:DryRunOperation",
+    hostAllocated: false,
+    planDigest: plan.digest,
+  };
+}

package/scripts/aws-macos-jit-source-rebind.mjs

@@ -28,7 +28,169 @@ function priorOwnershipPlan(plan) {
   };
 }
 
-function campaignRunsWithNoWork(plan) {
+function assertRunMatchesPolicy(policy, run, jobs, jobCount, artifactCount) {
+  if (policy === "unused") {
+    if (jobCount !== 0 || artifactCount !== 0) {
+      throw new Error(
+        `macOS campaign run ${run.id} already has jobs or artifacts`,
+      );
+    }
+    return;
+  }
+  if (policy === "preflight-failure") {
+    const jobList = jobs.jobs || [];
+    const failedJobs = jobList.filter((job) => job.conclusion === "failure");
+    const nonFailedJobs = jobList.filter((job) => job.conclusion !== "failure");
+    const hasJitLabel = jobList.some((job) =>
+      (job.labels || []).some((label) =>
+        String(label.name || label).startsWith(MACOS_JIT_RUNNER_LABEL_PREFIX),
+      ),
+    );
+    if (
+      run.status !== "completed" ||
+      run.conclusion !== "failure" ||
+      jobCount === 0 ||
+      artifactCount === 0 ||
+      jobList.some((job) => job.status !== "completed") ||
+      failedJobs.length !== 1 ||
+      !String(failedJobs[0].name || "").endsWith(" / Trust gate") ||
+      nonFailedJobs.some((job) => job.conclusion !== "skipped") ||
+      hasJitLabel
+    ) {
+      throw new Error(
+        `macOS campaign run ${run.id} is not an exact preflight Trust gate failure`,
+      );
+    }
+    return;
+  }
+  if (
+    run.status !== "completed" ||
+    run.conclusion !== "failure" ||
+    jobCount === 0 ||
+    artifactCount === 0 ||
+    (jobs.jobs || []).some((job) => job.status !== "completed")
+  ) {
+    throw new Error(
+      `macOS campaign run ${run.id} is not a terminal failed run with retained evidence`,
+    );
+  }
+}
+
+function assertExactStartupFailure(run, jobCount, artifactCount) {
+  if (
+    run.status !== "completed" ||
+    run.conclusion !== "startup_failure" ||
+    jobCount !== 0 ||
+    artifactCount !== 0
+  ) {
+    throw new Error(
+      `macOS campaign run ${run.id} is not an exact startup failure`,
+    );
+  }
+}
+
+function assertExactSuccessfulRun(run, jobs, jobCount, artifactCount) {
+  if (
+    run.status !== "completed" ||
+    run.conclusion !== "success" ||
+    jobCount === 0 ||
+    artifactCount === 0 ||
+    (jobs.jobs || []).some((job) => job.status !== "completed")
+  ) {
+    throw new Error(
+      `macOS campaign run ${run.id} is not a terminal successful run with retained evidence`,
+    );
+  }
+}
+
+function classifyCampaignRun(plan, run) {
+  const startupFailure = plan.github.startupFailureRuns.find(
+    ({ runId }) => runId === String(run.id),
+  );
+  const historicalTerminalFailure =
+    plan.github.historicalTerminalFailureRuns.find(
+      ({ runId }) => runId === String(run.id),
+    );
+  const historicalPreflightFailure =
+    plan.github.historicalPreflightFailureRuns.find(
+      ({ runId }) => runId === String(run.id),
+    );
+  const preflightFailure = plan.github.preflightFailureRunIds.includes(
+    String(run.id),
+  );
+  const successfulRun = plan.github.successfulRunIds.includes(String(run.id));
+  return {
+    startupFailure,
+    historicalTerminalFailure,
+    historicalPreflightFailure,
+    successfulRun,
+    expectedSourceSha:
+      startupFailure?.sourceSha ||
+      historicalTerminalFailure?.sourceSha ||
+      historicalPreflightFailure?.sourceSha ||
+      plan.previousSource.sha,
+    classification: startupFailure
+      ? "startup-failure"
+      : historicalTerminalFailure
+        ? "historical-terminal-failure"
+        : historicalPreflightFailure
+          ? "historical-preflight-failure"
+          : successfulRun
+            ? "successful-run"
+            : preflightFailure
+              ? "preflight-failure"
+              : plan.github.priorRunPolicy,
+  };
+}
+
+function exactReceiptInventory(receipts, classification, withSource = false) {
+  return receipts
+    .filter((receipt) => receipt.classification === classification)
+    .map((receipt) =>
+      withSource
+        ? { runId: receipt.runId, sourceSha: receipt.sourceSha }
+        : receipt.runId,
+    )
+    .sort(
+      (left, right) =>
+        Number(withSource ? left.runId : left) -
+        Number(withSource ? right.runId : right),
+    );
+}
+
+function assertExactReceiptInventories(plan, receipts) {
+  if (plan.github.priorRunPolicy === "unused") return;
+  const inventories = [
+    ["terminal-failure", plan.github.terminalFailureRunIds, false],
+    ["preflight-failure", plan.github.preflightFailureRunIds, false],
+    ["successful-run", plan.github.successfulRunIds, false],
+    ["startup-failure", plan.github.startupFailureRuns, true],
+    [
+      "historical-terminal-failure",
+      plan.github.historicalTerminalFailureRuns,
+      true,
+    ],
+    [
+      "historical-preflight-failure",
+      plan.github.historicalPreflightFailureRuns,
+      true,
+    ],
+  ];
+  for (const [classification, expected, withSource] of inventories) {
+    const observed = exactReceiptInventory(
+      receipts,
+      classification,
+      withSource,
+    );
+    if (JSON.stringify(observed) !== JSON.stringify(expected)) {
+      throw new Error(
+        `macOS campaign ${classification} inventory does not match the confirmed runs`,
+      );
+    }
+  }
+}
+
+function campaignRunReceipts(plan) {
   const branch = sourceRefName(plan.source.ref);
   const response = ghJson(
     [
@@ -46,7 +208,8 @@ function campaignRunsWithNoWork(plan) {
   }
   const receipts = [];
   for (const run of matching) {
-    if (run.head_sha !== plan.previousSource.sha) {
+    const classification = classifyCampaignRun(plan, run);
+    if (run.head_sha !== classification.expectedSourceSha) {
       throw new Error(
         `macOS campaign run ${run.id} is bound to an unexpected source`,
       );
@@ -68,19 +231,41 @@ function campaignRunsWithNoWork(plan) {
     const artifactCount = Number(
       artifacts.total_count || (artifacts.artifacts || []).length || 0,
     );
-    if (jobCount !== 0 || artifactCount !== 0) {
-      throw new Error(
-        `macOS campaign run ${run.id} already has jobs or artifacts`,
+    if (classification.startupFailure) {
+      assertExactStartupFailure(run, jobCount, artifactCount);
+    } else if (classification.successfulRun) {
+      assertExactSuccessfulRun(run, jobs, jobCount, artifactCount);
+    } else {
+      assertRunMatchesPolicy(
+        classification.historicalTerminalFailure
+          ? "terminal-failure"
+          : classification.historicalPreflightFailure
+            ? "preflight-failure"
+            : plan.github.priorRunPolicy,
+        run,
+        jobs,
+        jobCount,
+        artifactCount,
       );
     }
     receipts.push({
       runId: String(run.id),
+      sourceSha: String(run.head_sha || ""),
+      classification: classification.classification,
       status: String(run.status || "unknown"),
       conclusion: String(run.conclusion || ""),
       jobCount,
       artifactCount,
+      artifacts: (artifacts.artifacts || []).map((artifact) => ({
+        id: String(artifact.id),
+        name: String(artifact.name || ""),
+        sizeInBytes: Number(artifact.size_in_bytes || 0),
+        digest: String(artifact.digest || ""),
+        expired: artifact.expired === true,
+      })),
     });
   }
+  assertExactReceiptInventories(plan, receipts);
   return receipts;
 }
 
@@ -286,8 +471,22 @@ function assertZeroCampaignResidue(plan, profile) {
   if (matchingRunners.length !== 0) {
     throw new Error("macOS campaign already has a registered JIT runner");
   }
-  const evidenceObjectCounts = {};
-  for (const sourceSha of [plan.previousSource.sha, plan.source.sha]) {
+  const evidenceObjects = {};
+  const historicalTerminalSources =
+    plan.github.historicalTerminalFailureRuns.map(({ sourceSha }) => sourceSha);
+  const historicalPreflightSources =
+    plan.github.historicalPreflightFailureRuns.map(
+      ({ sourceSha }) => sourceSha,
+    );
+  const evidenceSources = [
+    ...new Set([
+      plan.previousSource.sha,
+      ...historicalTerminalSources,
+      ...historicalPreflightSources,
+      plan.source.sha,
+    ]),
+  ];
+  for (const sourceSha of evidenceSources) {
     const evidence = awsJson(
       plan,
       profile,
@@ -299,27 +498,44 @@ function assertZeroCampaignResidue(plan, profile) {
         "--prefix",
         `macos/${sourceSha}/`,
         "--max-keys",
-        "1",
+        "1000",
         "--output",
         "json",
       ],
       `macOS campaign evidence inventory for ${sourceSha}`,
     );
+    if (evidence.IsTruncated === true) {
+      throw new Error(
+        `macOS campaign source ${sourceSha} evidence inventory is incomplete`,
+      );
+    }
+    const objects = (evidence.Contents || []).map((object) => ({
+      key: String(object.Key || ""),
+      size: Number(object.Size || 0),
+      etag: String(object.ETag || ""),
+    }));
     const count = Number(
       evidence.KeyCount || (evidence.Contents || []).length || 0,
     );
-    if (count !== 0) {
+    const terminalEvidenceSource =
+      (sourceSha === plan.previousSource.sha &&
+        plan.github.priorRunPolicy === "terminal-failure") ||
+      historicalTerminalSources.includes(sourceSha);
+    if (
+      (!terminalEvidenceSource && count !== 0) ||
+      (terminalEvidenceSource && count === 0)
+    ) {
       throw new Error(
-        `macOS campaign source ${sourceSha} already has bootstrap evidence`,
+        `macOS campaign source ${sourceSha} bootstrap evidence does not match the rebind policy`,
       );
     }
-    evidenceObjectCounts[sourceSha] = count;
+    evidenceObjects[sourceSha] = objects;
   }
   return {
-    priorRuns: campaignRunsWithNoWork(plan),
+    priorRuns: campaignRunReceipts(plan),
     jitParameterCount: parameters.length,
     runnerCount: matchingRunners.length,
-    evidenceObjectCounts,
+    evidenceObjects,
   };
 }
 
@@ -480,7 +696,12 @@ export function executeMacosJitSourceRebind(plan, { profile = "" } = {}) {
     schemaVersion: 1,
     contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
     kind: "campaign-source-rebind-result",
-    status: "rebound-zero-allocation",
+    status:
+      plan.github.priorRunPolicy === "terminal-failure"
+        ? "rebound-after-terminal-failure-zero-allocation"
+        : plan.github.priorRunPolicy === "preflight-failure"
+          ? "rebound-after-preflight-failure-zero-allocation"
+          : "rebound-zero-allocation",
     repository: plan.repository,
     campaign: plan.campaign,
     previousSource: plan.previousSource,

package/scripts/aws-macos-jit.mjs

@@ -25,6 +25,17 @@ function writeJson(file, value) {
   return resolved;
 }
 
+export function writeMacosJitQualificationEnvironment(
+  githubEnv = process.env.GITHUB_ENV,
+) {
+  if (!githubEnv) return false;
+  fs.appendFileSync(
+    path.resolve(githubEnv),
+    "BUILDCHAIN_SIGNING_REQUESTS_ENABLED=false\n",
+  );
+  return true;
+}
+
 export function main() {
   const mode = process.argv[2] || "plan";
   if (mode === "plan") {
@@ -64,6 +75,7 @@ export function main() {
         ".buildchain/aws-macos-jit.json",
       result,
     );
+    writeMacosJitQualificationEnvironment();
     process.stdout.write(`${output}\n`);
     return result;
   }

package/scripts/buildchain-cli-help.mjs

@@ -67,6 +67,7 @@ export const BUILDCHAIN_USAGE = `Usage:
                                     [--kfd-3-prebuild-witness-json <json-or-path>]...
                                     [--kfd-3-artifact-witness-json <json-or-path>]...
                                     [--kfd-3-artifact-verify-cmd <command>]
+                                    [--adopter-delivery-json <json-or-path>]
                                     [--kfd-adopter-manifest-json <json-or-path>]
                                     [--kfd-support-matrix-json <json-or-path>]
                                     [--kfd-product-gate-json <json-or-path>]...
@@ -129,11 +130,18 @@ export const BUILDCHAIN_USAGE = `Usage:
                              [--from-config | --workflow <required-workflow.yml>...] [--cwd <dir>]
                              [--check-response-timeout-minutes <n>]
                              [--max-entries-to-build <n>] [--apply]
-  buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|observe>
+  buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|cancel-queued|observe>
                              --repository <owner/repo> --branch <dev/vN/vN.M>
                              [--execute] [--output <file>] [--json]
-  buildchain dev proof <source|verify-source|classify|replay|integration|verify-integration>
+  buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe>
+                             --repository <owner/repo> --branch <dev/vN/vN.M>
+                             [--execute] [--output <file>] [--json]
+  buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration>
                              [--output <file>] [--json]
+  buildchain dev two-phase --repository <owner/repo> --branch <dev/vN/vN.M>
+                             --pull-request <n> --expected-head <sha>
+                             --warrant-result <file> [--native-proof <file>]
+                             [--native-command <command>]
   buildchain log <info|warn|error> --event <name> [--phase <phase>]
                  [--component <name>] [--source <name>] [--attribute key=value]...
                  [--path <jsonl>] [--json]

package/scripts/check-internal-architecture.mjs

@@ -131,6 +131,7 @@ function repositoryJavaScriptFiles(root) {
     .filter((file) => [".js", ".mjs", ".cjs"].includes(path.extname(file)))
     .filter((file) => !file.startsWith("tests/"))
     .filter((file) => !/(?:^|\/)tests?\//u.test(file))
+    .filter((file) => !file.startsWith(".buildchain/"))
     .filter((file) => !/^actions\/[^/]+\/dist\//u.test(file))
     .sort();
 }

package/scripts/check-inventory.mjs

@@ -53,6 +53,10 @@ const requiredPaths = [
   "packages/core/homebrew.js",
   "packages/core/artifact-verification-envelope.js",
   "packages/core/anchored-version-material.js",
+  "packages/core/next-development-transition.js",
+  "packages/core/next-development-controller.js",
+  "packages/core/next-development-candidate-reservation.js",
+  "packages/core/next-development-projection.js",
   "packages/core/build-facts.js",
   "packages/core/publication-package.js",
   "packages/core/publication-reproducibility.js",
@@ -75,6 +79,8 @@ const requiredPaths = [
   "docs/auditable-demo.md",
   "contracts/auditable-demo-scenario-v1.schema.json",
   "contracts/release-candidate-recovery-v1.schema.json",
+  "contracts/next-development-request-v1.schema.json",
+  "contracts/next-development-transition-v1.schema.json",
   "contracts/auditable-demo-media-profiles-v1.json",
   "contracts/evidence/auditable-demo-web-delivery-v1.json",
   "contracts/evidence/auditable-demo-responsive-web-delivery-v1.json",
@@ -86,10 +92,15 @@ const requiredPaths = [
   "contracts/fixtures/auditable-demo-responsive-web-delivery-v1/public-projection.json",
   "contracts/fixtures/auditable-demo-responsive-web-delivery-v1/scene.json",
   "docs/release-propagation.md",
+  "docs/next-development-transition.md",
   "docs/site-bundle-contract.md",
   "docs/toolkit-observability.md",
   "docs/versioning.md",
   "scripts/release-line-dry-run.mjs",
+  "scripts/next-development-transition.mjs",
+  "scripts/next-development-self-dogfood.mjs",
+  "scripts/next-development-self-dogfood-harness.mjs",
+  "scripts/generate-next-development-guidance.mjs",
   "scripts/reconcile-release-governance.mjs",
   "scripts/buildchain-channel-router.mjs",
   "scripts/generate-channel-build-workflow.mjs",
@@ -992,7 +1003,7 @@ for (const forbiddenSnippet of [
 for (const requiredSnippet of [
   "id-token: write",
   "actions: write",
-  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@769b221bad7a6b9104afad4c2628d9dca396ab0f\n",
+  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@15db8a9d7c39f7a649a0e3971af68490356dd9ac\n",
   "github.event.workflow_run.event == 'push'",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",