@kungfu-tech/buildchain 3.0.9-alpha.11 → 3.0.9-alpha.13

package/packages/core/dev-delivery-native-proof.js

@@ -10,9 +10,15 @@ import {
 } from "./dev-delivery-common.js";
 
 export const NATIVE_QUALIFICATION_PROOF_SCHEMA =
+  "kungfu.buildchain.native-qualification-proof/v3";
+const LEGACY_NATIVE_QUALIFICATION_PROOF_V2_SCHEMA =
   "kungfu.buildchain.native-qualification-proof/v2";
 const LEGACY_NATIVE_QUALIFICATION_PROOF_SCHEMA =
   "kungfu.buildchain.native-qualification-proof/v1";
+export const NATIVE_EXECUTION_BINDING_SCHEMA =
+  "kungfu.buildchain.native-execution-binding/v1";
+export const NATIVE_EXECUTION_RECEIPT_SCHEMA =
+  "kungfu.buildchain.native-heartbeat-run-receipt/v2";
 export const NATIVE_PROOF_REUSE_DECISION_SCHEMA =
   "kungfu.buildchain.native-proof-reuse-decision/v1";
 export const DEV_DELIVERY_QUALIFICATION_RECEIPT_SCHEMA =
@@ -85,7 +91,94 @@ function rooted(body) {
   return { ...body, decisionRoot: devDeliveryContentRoot(body) };
 }
 
+export function createNativeExecutionBinding(input = {}) {
+  return {
+    schema: NATIVE_EXECUTION_BINDING_SCHEMA,
+    repository: repository(input.repository),
+    protectedBase: protectedBase(input.protectedBase),
+    sourceHead: exactSha(input.sourceHead, "sourceHead"),
+    qualifiedBase: exactSha(input.qualifiedBase, "qualifiedBase"),
+    toolchainRoot: exactRoot(input.toolchainRoot, "toolchainRoot"),
+    environmentRoot: exactRoot(input.environmentRoot, "environmentRoot"),
+  };
+}
+
+export function createNativeExecutionReceipt(input = {}) {
+  const executionBinding = createNativeExecutionBinding(input.executionBinding);
+  const receipt = {
+    schema: NATIVE_EXECUTION_RECEIPT_SCHEMA,
+    outcome: input.outcome === "succeeded" ? "succeeded" : text(input.outcome),
+    commandRoot: exactRoot(input.commandRoot, "commandRoot"),
+    executionBinding,
+    executionBindingRoot: devDeliveryContentRoot(executionBinding),
+    startedAt: timestamp(input.startedAt, "startedAt"),
+    completedAt: timestamp(input.completedAt, "completedAt"),
+    heartbeatCount: Number(input.heartbeatCount),
+  };
+  if (receipt.outcome !== "succeeded") {
+    throw new Error("native execution receipt must record succeeded outcome");
+  }
+  if (!Number.isInteger(receipt.heartbeatCount) || receipt.heartbeatCount < 1) {
+    throw new Error("heartbeatCount must be a positive integer");
+  }
+  return { ...receipt, receiptRoot: devDeliveryContentRoot(receipt) };
+}
+
+export function verifyNativeExecutionReceipt(receiptInput, expected = {}) {
+  try {
+    const receipt = clone(receiptInput || {});
+    if (receipt.schema !== NATIVE_EXECUTION_RECEIPT_SCHEMA) {
+      return { ok: false, reason: "unsupported-schema" };
+    }
+    const receiptRoot = receipt.receiptRoot;
+    delete receipt.receiptRoot;
+    if (devDeliveryContentRoot(receipt) !== receiptRoot) {
+      return { ok: false, reason: "receipt-root-drift" };
+    }
+    const normalized = createNativeExecutionReceipt({
+      ...receipt,
+      executionBinding: receipt.executionBinding,
+    });
+    if (normalized.receiptRoot !== receiptRoot) {
+      return { ok: false, reason: "receipt-input-drift" };
+    }
+    for (const [field, value] of Object.entries(expected)) {
+      if (value !== undefined && receipt.executionBinding?.[field] !== value) {
+        return { ok: false, reason: `${field}-mismatch` };
+      }
+    }
+    return {
+      ok: true,
+      reason: "exact-native-execution-receipt",
+      receiptRoot,
+      executionBindingRoot: receipt.executionBindingRoot,
+    };
+  } catch (error) {
+    return { ok: false, reason: "invalid-receipt", error: error.message };
+  }
+}
+
 export function createNativeQualificationProof(input = {}) {
+  const sourceHead = exactSha(input.sourceHead, "sourceHead");
+  const qualifiedBase = exactSha(input.qualifiedBase, "qualifiedBase");
+  const toolchainRoot = exactRoot(input.toolchainRoot, "toolchainRoot");
+  const environmentRoot = exactRoot(input.environmentRoot, "environmentRoot");
+  const executionReceipt = verifyNativeExecutionReceipt(
+    input.nativeExecutionReceipt,
+    {
+      repository: repository(input.repository),
+      protectedBase: protectedBase(input.protectedBase),
+      sourceHead,
+      qualifiedBase,
+      toolchainRoot,
+      environmentRoot,
+    },
+  );
+  if (!executionReceipt.ok) {
+    throw new Error(
+      `native execution receipt rejected: ${executionReceipt.reason}`,
+    );
+  }
   const body = {
     schema: NATIVE_QUALIFICATION_PROOF_SCHEMA,
     rootSemantics: NATIVE_QUALIFICATION_ROOT_SEMANTICS,
@@ -99,12 +192,15 @@ export function createNativeQualificationProof(input = {}) {
     planRoot: exactRoot(input.planRoot, "planRoot"),
     closureRoot: exactRoot(input.closureRoot, "closureRoot"),
     dependencyRoot: exactRoot(input.dependencyRoot, "dependencyRoot"),
-    toolchainRoot: exactRoot(input.toolchainRoot, "toolchainRoot"),
-    environmentRoot: exactRoot(input.environmentRoot, "environmentRoot"),
-    qualifiedBase: exactSha(input.qualifiedBase, "qualifiedBase"),
+    toolchainRoot,
+    environmentRoot,
+    sourceHead,
+    qualifiedBase,
+    nativeExecutionBindingRoot: executionReceipt.executionBindingRoot,
+    nativeExecutionReceiptRoot: executionReceipt.receiptRoot,
     affectedPaths: normalizedPaths(input.affectedPaths || []),
     shardEvidenceRoots: exactRoots(
-      input.shardEvidenceRoots,
+      [...(input.shardEvidenceRoots || []), executionReceipt.receiptRoot],
       "shardEvidenceRoots",
     ),
     qualifiedAt: timestamp(input.qualifiedAt, "qualifiedAt"),
@@ -122,6 +218,7 @@ export function verifyNativeQualificationProof(proofInput, expected = {}) {
     if (
       ![
         NATIVE_QUALIFICATION_PROOF_SCHEMA,
+        LEGACY_NATIVE_QUALIFICATION_PROOF_V2_SCHEMA,
         LEGACY_NATIVE_QUALIFICATION_PROOF_SCHEMA,
       ].includes(proof.schema)
     ) {
@@ -146,7 +243,38 @@ export function verifyNativeQualificationProof(proofInput, expected = {}) {
       }
     }
     if (proof.schema === NATIVE_QUALIFICATION_PROOF_SCHEMA) {
-      createNativeQualificationProof(proof);
+      repository(proof.repository);
+      protectedBase(proof.protectedBase);
+      exactSha(proof.sourceHead, "sourceHead");
+      exactSha(proof.qualifiedBase, "qualifiedBase");
+      for (const field of [
+        "sourceIdentityRoot",
+        "sourcePatchRoot",
+        "planRoot",
+        "closureRoot",
+        "dependencyRoot",
+        "toolchainRoot",
+        "environmentRoot",
+        "nativeExecutionBindingRoot",
+        "nativeExecutionReceiptRoot",
+      ]) {
+        exactRoot(proof[field], field);
+      }
+      const expectedBindingRoot = devDeliveryContentRoot(
+        createNativeExecutionBinding(proof),
+      );
+      if (proof.nativeExecutionBindingRoot !== expectedBindingRoot) {
+        return { ok: false, reason: "native-execution-binding-root-drift" };
+      }
+      const shardEvidenceRoots = exactRoots(
+        proof.shardEvidenceRoots,
+        "shardEvidenceRoots",
+      );
+      if (!shardEvidenceRoots.includes(proof.nativeExecutionReceiptRoot)) {
+        return { ok: false, reason: "native-execution-receipt-unbound" };
+      }
+      normalizedPaths(proof.affectedPaths || []);
+      timestamp(proof.qualifiedAt, "qualifiedAt");
     } else {
       repository(proof.repository);
       protectedBase(proof.protectedBase);
@@ -205,8 +333,15 @@ function nativeReuseBody(proof, current) {
     requiredValidation: "full-native",
   };
   if (!verification.ok) return base;
+  if (proof.schema !== NATIVE_QUALIFICATION_PROOF_SCHEMA) {
+    return {
+      ...base,
+      reason: "native-execution-evidence-unbound",
+    };
+  }
 
   const semanticFields = [
+    "sourceHead",
     "sourceIdentityRoot",
     "sourcePatchRoot",
     "planRoot",
@@ -346,6 +481,7 @@ export function createDevDeliveryWarrantQualifier({
         const proofVerification = verifyNativeQualificationProof(nativeProof, {
           repository: before.repository,
           protectedBase: before.protectedBase,
+          sourceHead: active.sourceHead,
           sourceIdentityRoot: active.sourceIdentityRoot,
           sourcePatchRoot: active.sourcePatchRoot,
           planRoot: active.planRoot,
@@ -363,6 +499,7 @@ export function createDevDeliveryWarrantQualifier({
             proof: nativeProof,
             current: {
               ...current,
+              sourceHead: active.sourceHead,
               sourceIdentityRoot: active.sourceIdentityRoot,
               sourcePatchRoot: active.sourcePatchRoot,
               planRoot: active.planRoot,

package/packages/core/dev-delivery-warrant.js

@@ -7,7 +7,7 @@ import { compareReleaseBlockerPriority, normalizeReleaseBlockerPriorityClaim } f
 export { devDeliveryContentRoot } from "./dev-delivery-common.js";
 export { RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA, createReleaseBlockerPriorityClaim } from "./release-blocker-priority.js";
 export { SOURCE_QUALIFICATION_PROOF_SCHEMA, PROJECT_CUT_REPLAY_PROOF_SCHEMA, INTEGRATION_DELIVERY_PROOF_SCHEMA, classifyDevDeliveryDelta, createIntegrationDeliveryProof, createProjectCutReplayPlan, createProjectCutReplayProof, createSourceQualificationProof, verifyIntegrationDeliveryProof, verifyProjectCutReplayProof, verifySourceQualificationProof } from "./dev-delivery-proof.js";
-export { DEV_DELIVERY_QUALIFICATION_RECEIPT_SCHEMA, NATIVE_QUALIFICATION_PROOF_SCHEMA, NATIVE_PROOF_REUSE_DECISION_SCHEMA, NATIVE_PROOF_BASE_DELTA_SCHEMA, createNativeProofBaseDelta, createNativeProofReuseDecision, createNativeQualificationProof, verifyNativeProofReuseDecision, verifyNativeQualificationProof } from "./dev-delivery-native-proof.js";
+export { DEV_DELIVERY_QUALIFICATION_RECEIPT_SCHEMA, NATIVE_EXECUTION_BINDING_SCHEMA, NATIVE_EXECUTION_RECEIPT_SCHEMA, NATIVE_QUALIFICATION_PROOF_SCHEMA, NATIVE_PROOF_REUSE_DECISION_SCHEMA, NATIVE_PROOF_BASE_DELTA_SCHEMA, createNativeExecutionBinding, createNativeExecutionReceipt, createNativeProofBaseDelta, createNativeProofReuseDecision, createNativeQualificationProof, verifyNativeExecutionReceipt, verifyNativeProofReuseDecision, verifyNativeQualificationProof } from "./dev-delivery-native-proof.js";
 export { DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA };
 export const DEV_DELIVERY_QUEUE_CONTRACT = "kungfu-buildchain-dev-delivery-warrant-queue";
 export const DEV_DELIVERY_WARRANT_SCHEMA = "kungfu.buildchain.dev-delivery-warrant/v1";

package/scripts/dev-delivery-native-run.mjs

@@ -3,7 +3,7 @@ import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
-import { devDeliveryContentRoot } from "../packages/core/dev-delivery-warrant.js";
+import { createNativeExecutionBinding, createNativeExecutionReceipt, devDeliveryContentRoot } from "../packages/core/dev-delivery-warrant.js";
 import { runDevDeliveryCommand } from "./dev-delivery-warrant.mjs";
 
 function flag(args, name, fallback = "") {
@@ -46,6 +46,7 @@ export async function runNativeWithHeartbeat({
   if (typeof heartbeat !== "function") {
     throw new Error("heartbeat callback is required");
   }
+  const boundExecution = createNativeExecutionBinding(executionBinding);
   const startedAt = now();
   try {
     await heartbeat();
@@ -138,16 +139,14 @@ export async function runNativeWithHeartbeat({
   }
   await beat();
   const completedAt = now();
-  const receipt = {
-    schema: "kungfu.buildchain.native-heartbeat-run-receipt/v1",
+  return createNativeExecutionReceipt({
     outcome: "succeeded",
     commandRoot: devDeliveryContentRoot({ command }),
-    executionBindingRoot: devDeliveryContentRoot(executionBinding),
+    executionBinding: boundExecution,
     startedAt,
     completedAt,
     heartbeatCount,
-  };
-  return { ...receipt, receiptRoot: devDeliveryContentRoot(receipt) };
+  });
 }
 
 async function main() {
@@ -163,6 +162,26 @@ async function main() {
     "command",
     process.env.BUILDCHAIN_DEV_DELIVERY_NATIVE_COMMAND,
   );
+  const sourceHead = flag(
+    args,
+    "source-head",
+    process.env.BUILDCHAIN_DEV_DELIVERY_SOURCE_HEAD,
+  );
+  const qualifiedBase = flag(
+    args,
+    "qualified-base",
+    process.env.BUILDCHAIN_DEV_DELIVERY_QUALIFIED_BASE,
+  );
+  const toolchainRoot = flag(
+    args,
+    "toolchain-root",
+    process.env.BUILDCHAIN_DEV_DELIVERY_TOOLCHAIN_ROOT,
+  );
+  const environmentRoot = flag(
+    args,
+    "environment-root",
+    process.env.BUILDCHAIN_DEV_DELIVERY_ENVIRONMENT_ROOT,
+  );
   const cwd = path.resolve(
     flag(args, "working-directory", process.env.GITHUB_WORKSPACE),
   );
@@ -210,6 +229,14 @@ async function main() {
     command,
     cwd,
     intervalMs: heartbeatSeconds * 1000,
+    executionBinding: {
+      repository,
+      protectedBase: branch,
+      sourceHead,
+      qualifiedBase,
+      toolchainRoot,
+      environmentRoot,
+    },
     heartbeat: async () => {
       await runDevDeliveryCommand({
         command: "heartbeat",

package/scripts/dev-delivery-proof.mjs

@@ -54,6 +54,7 @@ export function devDeliveryProofCliOptions(args = [], environment = process.env)
     shardEvidenceRoots: flag(rest, "shard-evidence-roots-json", environment.BUILDCHAIN_DEV_DELIVERY_SHARD_EVIDENCE_ROOTS || "[]"),
     qualifiedAt: flag(rest, "qualified-at", environment.BUILDCHAIN_DEV_DELIVERY_QUALIFIED_AT),
     qualifiedBase: flag(rest, "qualified-base", environment.BUILDCHAIN_DEV_DELIVERY_QUALIFIED_BASE),
+    nativeExecutionReceiptPath: flag(rest, "native-execution-receipt", environment.BUILDCHAIN_DEV_DELIVERY_NATIVE_EXECUTION_RECEIPT),
     sourceProofPath: flag(rest, "source-proof", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PROOF),
     sourceProofRoot: flag(rest, "source-proof-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PROOF_ROOT),
     warrantResultPath: flag(rest, "warrant-result", environment.BUILDCHAIN_DEV_DELIVERY_WARRANT_RESULT),
@@ -132,7 +133,9 @@ export function runDevDeliveryProofCommand(options) {
       dependencyRoot: options.dependencyRoot,
       toolchainRoot: options.toolchainRoot,
       environmentRoot: options.environmentRoot,
+      sourceHead: options.sourceHead,
       qualifiedBase: options.qualifiedBase,
+      nativeExecutionReceipt: jsonFile(options.nativeExecutionReceiptPath, "native execution receipt"),
       affectedPaths: jsonList(options.affectedPaths, "affected paths"),
       shardEvidenceRoots: jsonList(options.shardEvidenceRoots, "shard evidence roots", { required: true }),
       qualifiedAt: options.qualifiedAt,

package/scripts/dev-delivery-two-phase-resume.mjs

@@ -1,4 +1,4 @@
-import { createNativeProofReuseDecision } from "../packages/core/dev-delivery-warrant.js";
+import { createNativeProofReuseDecision, createNativeQualificationProof } from "../packages/core/dev-delivery-warrant.js";
 
 const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/u;
 
@@ -70,6 +70,7 @@ export async function classifyNativeProofAgainstCurrent(
   const currentBase = await client.baseSha(options.branch);
   const delta = await client.baseDelta(proof.qualifiedBase, currentBase);
   const current = {
+    sourceHead: options.expectedHead,
     sourceIdentityRoot: options.sourceIdentityRoot,
     sourcePatchRoot: options.sourcePatchRoot,
     planRoot: options.planRoot,
@@ -88,3 +89,81 @@ export async function classifyNativeProofAgainstCurrent(
     decision: createNativeProofReuseDecision({ proof, current }),
   };
 }
+
+export async function runNativeQualificationAttempt({
+  options,
+  warrant,
+  attempt,
+  client,
+  runCommand,
+  runNative,
+  composeCandidate,
+  writeEvidence,
+}) {
+  await client.exactPullRequestHead(
+    options.pullRequestNumber,
+    options.expectedHead,
+  );
+  const qualifiedBase = await client.baseSha(options.branch);
+  composeCandidate(
+    options.candidateDirectory,
+    options.expectedHead,
+    qualifiedBase,
+  );
+  const nativeExecutionReceipt = await runNative({
+    command: options.nativeCommand,
+    cwd: options.candidateDirectory,
+    intervalMs: options.heartbeatSeconds * 1000,
+    executionBinding: {
+      repository: options.repository,
+      protectedBase: options.branch,
+      sourceHead: options.expectedHead,
+      qualifiedBase,
+      toolchainRoot: options.toolchainRoot,
+      environmentRoot: options.environmentRoot,
+    },
+    heartbeat: async () => {
+      await runCommand({
+        command: "heartbeat",
+        repository: options.repository,
+        branch: options.branch,
+        fencingToken: warrant.fencingToken,
+        leaseGeneration: warrant.generation,
+        leaseSeconds: options.leaseSeconds,
+        execute: true,
+        token: options.token,
+        apiUrl: options.apiUrl,
+      });
+    },
+  });
+  writeEvidence(
+    `native-heartbeat-attempt-${attempt}.json`,
+    nativeExecutionReceipt,
+  );
+  await client.exactPullRequestHead(
+    options.pullRequestNumber,
+    options.expectedHead,
+  );
+  const proof = createNativeQualificationProof({
+    repository: options.repository,
+    protectedBase: options.branch,
+    sourceIdentityRoot: options.sourceIdentityRoot,
+    sourcePatchRoot: options.sourcePatchRoot,
+    planRoot: options.planRoot,
+    closureRoot: options.closureRoot,
+    dependencyRoot: options.dependencyRoot,
+    toolchainRoot: options.toolchainRoot,
+    environmentRoot: options.environmentRoot,
+    sourceHead: options.expectedHead,
+    qualifiedBase,
+    nativeExecutionReceipt,
+    affectedPaths: options.affectedPaths,
+    shardEvidenceRoots: [
+      ...options.shardEvidenceRoots,
+      nativeExecutionReceipt.receiptRoot,
+    ],
+    qualifiedAt: new Date().toISOString(),
+  });
+  writeEvidence("native-proof.json", proof);
+  return proof;
+}

package/scripts/dev-delivery-two-phase.mjs

@@ -4,7 +4,6 @@ import fs from "node:fs";
 import path from "node:path";
 
 import {
-  createNativeQualificationProof,
   devDeliveryContentRoot,
 } from "../packages/core/dev-delivery-warrant.js";
 import { runNativeWithHeartbeat } from "./dev-delivery-native-run.mjs";
@@ -12,6 +11,7 @@ import {
   attributedGitHubBaseDelta,
   classifyNativeProofAgainstCurrent,
   replayQualifiedNativeWarrant,
+  runNativeQualificationAttempt,
 } from "./dev-delivery-two-phase-resume.mjs";
 import { runDevDeliveryCommand } from "./dev-delivery-warrant.mjs";
 
@@ -49,6 +49,16 @@ function exactSha(value, label) {
   return normalized;
 }
 
+function exactRoot(value, label) {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (!/^sha256:[0-9a-f]{64}$/u.test(normalized)) {
+    throw new Error(`${label} must be a sha256 content root`);
+  }
+  return normalized;
+}
+
 function readJson(file, label) {
   if (!file) throw new Error(`${label} is required`);
   return JSON.parse(fs.readFileSync(file, "utf8"));
@@ -245,13 +255,13 @@ async function releaseFailedAttempt({
 }
 
 export async function runTwoPhaseDelivery(options, dependencies = {}) {
+  options.environmentRoot = exactRoot(
+    options.environmentRoot,
+    "environmentRoot",
+  );
   const client =
     dependencies.client ||
-    new GitHubTwoPhaseClient({
-      repository: options.repository,
-      token: options.token,
-      apiUrl: options.apiUrl,
-    });
+    new GitHubTwoPhaseClient(options);
   const runCommand = dependencies.runCommand || runDevDeliveryCommand;
   const runNative = dependencies.runNative || runNativeWithHeartbeat;
   const warrantResult = readJson(options.warrantResultPath, "Warrant result");
@@ -270,7 +280,12 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
   }
   const evidenceDirectory = path.resolve(options.evidenceDirectory);
   fs.mkdirSync(evidenceDirectory, { recursive: true });
-  const qualifiedReplay = await replayQualifiedNativeWarrant({ warrant, pullRequestNumber: options.pullRequestNumber, expectedHead: options.expectedHead, exactPullRequestHead: (...args) => client.exactPullRequestHead(...args) });
+  const qualifiedReplay = await replayQualifiedNativeWarrant({
+    warrant,
+    pullRequestNumber: options.pullRequestNumber,
+    expectedHead: options.expectedHead,
+    exactPullRequestHead: (...args) => client.exactPullRequestHead(...args),
+  });
   if (qualifiedReplay) return qualifiedReplay;
   let proof = options.nativeProofPath
     ? readJson(options.nativeProofPath, "native proof")
@@ -287,7 +302,11 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
           options.pullRequestNumber,
           options.expectedHead,
         );
-        classified = await classifyNativeProofAgainstCurrent(proof, options, client);
+        classified = await classifyNativeProofAgainstCurrent(
+          proof,
+          options,
+          client,
+        );
         if (classified.decision.reusable) break;
       }
       if (nativeAttempts >= 2) break;
@@ -296,73 +315,23 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
           `native proof cannot be reused (${classified?.decision.reason || "not-supplied"}) and native-command is empty`,
         );
       }
-      await client.exactPullRequestHead(
-        options.pullRequestNumber,
-        options.expectedHead,
-      );
-      const qualifiedBase = await client.baseSha(options.branch);
-      composeCandidate(
-        options.candidateDirectory,
-        options.expectedHead,
-        qualifiedBase,
-      );
       nativeAttempts += 1;
-      const heartbeatReceipt = await runNative({
-        command: options.nativeCommand,
-        cwd: options.candidateDirectory,
-        intervalMs: options.heartbeatSeconds * 1000,
-        executionBinding: {
-          repository: options.repository,
-          protectedBase: options.branch,
-          sourceHead: options.expectedHead,
-          qualifiedBase,
-          toolchainRoot: options.toolchainRoot,
-        },
-        heartbeat: async () => {
-          await runCommand({
-            command: "heartbeat",
-            repository: options.repository,
-            branch: options.branch,
-            fencingToken: warrant.fencingToken,
-            leaseGeneration: warrant.generation,
-            leaseSeconds: options.leaseSeconds,
-            execute: true,
-            token: options.token,
-            apiUrl: options.apiUrl,
-          });
-        },
+      proof = await runNativeQualificationAttempt({
+        options,
+        warrant,
+        attempt: nativeAttempts,
+        client,
+        runCommand,
+        runNative,
+        composeCandidate,
+        writeEvidence: (name, value) =>
+          writeJson(path.join(evidenceDirectory, name), value),
       });
-      writeJson(
-        path.join(
-          evidenceDirectory,
-          `native-heartbeat-attempt-${nativeAttempts}.json`,
-        ),
-        heartbeatReceipt,
+      classified = await classifyNativeProofAgainstCurrent(
+        proof,
+        options,
+        client,
       );
-      await client.exactPullRequestHead(
-        options.pullRequestNumber,
-        options.expectedHead,
-      );
-      proof = createNativeQualificationProof({
-        repository: options.repository,
-        protectedBase: options.branch,
-        sourceIdentityRoot: options.sourceIdentityRoot,
-        sourcePatchRoot: options.sourcePatchRoot,
-        planRoot: options.planRoot,
-        closureRoot: options.closureRoot,
-        dependencyRoot: options.dependencyRoot,
-        toolchainRoot: options.toolchainRoot,
-        environmentRoot: options.environmentRoot,
-        qualifiedBase,
-        affectedPaths: options.affectedPaths,
-        shardEvidenceRoots: [
-          ...options.shardEvidenceRoots,
-          heartbeatReceipt.receiptRoot,
-        ],
-        qualifiedAt: new Date().toISOString(),
-      });
-      writeJson(path.join(evidenceDirectory, "native-proof.json"), proof);
-      classified = await classifyNativeProofAgainstCurrent(proof, options, client);
     }
 
     if (!classified?.decision.reusable) {

package/scripts/dev-delivery-warrant.mjs

@@ -295,6 +295,9 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     now: new Date(optionsInput.now || Date.now()).toISOString(),
     execute: bool(optionsInput.execute, false),
   };
+  if (options.command === "submit" && options.execute && options.deliveryClass !== "non-native-fast") {
+    exactRoot(options.environmentRoot, "environmentRoot");
+  }
   const store =
     clientInput ||
     new GitHubDevDeliveryStore({

package/templates/native-dev-delivery.yml

@@ -40,7 +40,7 @@ on:
         description: "Native toolchain root"
         required: true
       environment-root:
-        description: "Native execution environment contract root"
+        description: "Exact native execution environment contract root bound before native spawn"
         required: true
       affected-paths-json:
         description: "JSON array representing the affected closure"