@kungfu-tech/buildchain 3.0.9-alpha.12 → 3.0.9-alpha.13

package/scripts/dev-delivery-two-phase-resume.mjs

@@ -1,4 +1,4 @@
-import { createNativeProofReuseDecision } from "../packages/core/dev-delivery-warrant.js";
+import { createNativeProofReuseDecision, createNativeQualificationProof } from "../packages/core/dev-delivery-warrant.js";
 
 const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/u;
 
@@ -70,6 +70,7 @@ export async function classifyNativeProofAgainstCurrent(
   const currentBase = await client.baseSha(options.branch);
   const delta = await client.baseDelta(proof.qualifiedBase, currentBase);
   const current = {
+    sourceHead: options.expectedHead,
     sourceIdentityRoot: options.sourceIdentityRoot,
     sourcePatchRoot: options.sourcePatchRoot,
     planRoot: options.planRoot,
@@ -88,3 +89,81 @@ export async function classifyNativeProofAgainstCurrent(
     decision: createNativeProofReuseDecision({ proof, current }),
   };
 }
+
+export async function runNativeQualificationAttempt({
+  options,
+  warrant,
+  attempt,
+  client,
+  runCommand,
+  runNative,
+  composeCandidate,
+  writeEvidence,
+}) {
+  await client.exactPullRequestHead(
+    options.pullRequestNumber,
+    options.expectedHead,
+  );
+  const qualifiedBase = await client.baseSha(options.branch);
+  composeCandidate(
+    options.candidateDirectory,
+    options.expectedHead,
+    qualifiedBase,
+  );
+  const nativeExecutionReceipt = await runNative({
+    command: options.nativeCommand,
+    cwd: options.candidateDirectory,
+    intervalMs: options.heartbeatSeconds * 1000,
+    executionBinding: {
+      repository: options.repository,
+      protectedBase: options.branch,
+      sourceHead: options.expectedHead,
+      qualifiedBase,
+      toolchainRoot: options.toolchainRoot,
+      environmentRoot: options.environmentRoot,
+    },
+    heartbeat: async () => {
+      await runCommand({
+        command: "heartbeat",
+        repository: options.repository,
+        branch: options.branch,
+        fencingToken: warrant.fencingToken,
+        leaseGeneration: warrant.generation,
+        leaseSeconds: options.leaseSeconds,
+        execute: true,
+        token: options.token,
+        apiUrl: options.apiUrl,
+      });
+    },
+  });
+  writeEvidence(
+    `native-heartbeat-attempt-${attempt}.json`,
+    nativeExecutionReceipt,
+  );
+  await client.exactPullRequestHead(
+    options.pullRequestNumber,
+    options.expectedHead,
+  );
+  const proof = createNativeQualificationProof({
+    repository: options.repository,
+    protectedBase: options.branch,
+    sourceIdentityRoot: options.sourceIdentityRoot,
+    sourcePatchRoot: options.sourcePatchRoot,
+    planRoot: options.planRoot,
+    closureRoot: options.closureRoot,
+    dependencyRoot: options.dependencyRoot,
+    toolchainRoot: options.toolchainRoot,
+    environmentRoot: options.environmentRoot,
+    sourceHead: options.expectedHead,
+    qualifiedBase,
+    nativeExecutionReceipt,
+    affectedPaths: options.affectedPaths,
+    shardEvidenceRoots: [
+      ...options.shardEvidenceRoots,
+      nativeExecutionReceipt.receiptRoot,
+    ],
+    qualifiedAt: new Date().toISOString(),
+  });
+  writeEvidence("native-proof.json", proof);
+  return proof;
+}

package/scripts/dev-delivery-two-phase.mjs

@@ -4,7 +4,6 @@ import fs from "node:fs";
 import path from "node:path";
 
 import {
-  createNativeQualificationProof,
   devDeliveryContentRoot,
 } from "../packages/core/dev-delivery-warrant.js";
 import { runNativeWithHeartbeat } from "./dev-delivery-native-run.mjs";
@@ -12,6 +11,7 @@ import {
   attributedGitHubBaseDelta,
   classifyNativeProofAgainstCurrent,
   replayQualifiedNativeWarrant,
+  runNativeQualificationAttempt,
 } from "./dev-delivery-two-phase-resume.mjs";
 import { runDevDeliveryCommand } from "./dev-delivery-warrant.mjs";
 
@@ -49,6 +49,16 @@ function exactSha(value, label) {
   return normalized;
 }
 
+function exactRoot(value, label) {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (!/^sha256:[0-9a-f]{64}$/u.test(normalized)) {
+    throw new Error(`${label} must be a sha256 content root`);
+  }
+  return normalized;
+}
+
 function readJson(file, label) {
   if (!file) throw new Error(`${label} is required`);
   return JSON.parse(fs.readFileSync(file, "utf8"));
@@ -245,13 +255,13 @@ async function releaseFailedAttempt({
 }
 
 export async function runTwoPhaseDelivery(options, dependencies = {}) {
+  options.environmentRoot = exactRoot(
+    options.environmentRoot,
+    "environmentRoot",
+  );
   const client =
     dependencies.client ||
-    new GitHubTwoPhaseClient({
-      repository: options.repository,
-      token: options.token,
-      apiUrl: options.apiUrl,
-    });
+    new GitHubTwoPhaseClient(options);
   const runCommand = dependencies.runCommand || runDevDeliveryCommand;
   const runNative = dependencies.runNative || runNativeWithHeartbeat;
   const warrantResult = readJson(options.warrantResultPath, "Warrant result");
@@ -270,7 +280,12 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
   }
   const evidenceDirectory = path.resolve(options.evidenceDirectory);
   fs.mkdirSync(evidenceDirectory, { recursive: true });
-  const qualifiedReplay = await replayQualifiedNativeWarrant({ warrant, pullRequestNumber: options.pullRequestNumber, expectedHead: options.expectedHead, exactPullRequestHead: (...args) => client.exactPullRequestHead(...args) });
+  const qualifiedReplay = await replayQualifiedNativeWarrant({
+    warrant,
+    pullRequestNumber: options.pullRequestNumber,
+    expectedHead: options.expectedHead,
+    exactPullRequestHead: (...args) => client.exactPullRequestHead(...args),
+  });
   if (qualifiedReplay) return qualifiedReplay;
   let proof = options.nativeProofPath
     ? readJson(options.nativeProofPath, "native proof")
@@ -287,7 +302,11 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
           options.pullRequestNumber,
           options.expectedHead,
         );
-        classified = await classifyNativeProofAgainstCurrent(proof, options, client);
+        classified = await classifyNativeProofAgainstCurrent(
+          proof,
+          options,
+          client,
+        );
         if (classified.decision.reusable) break;
       }
       if (nativeAttempts >= 2) break;
@@ -296,73 +315,23 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
           `native proof cannot be reused (${classified?.decision.reason || "not-supplied"}) and native-command is empty`,
         );
       }
-      await client.exactPullRequestHead(
-        options.pullRequestNumber,
-        options.expectedHead,
-      );
-      const qualifiedBase = await client.baseSha(options.branch);
-      composeCandidate(
-        options.candidateDirectory,
-        options.expectedHead,
-        qualifiedBase,
-      );
       nativeAttempts += 1;
-      const heartbeatReceipt = await runNative({
-        command: options.nativeCommand,
-        cwd: options.candidateDirectory,
-        intervalMs: options.heartbeatSeconds * 1000,
-        executionBinding: {
-          repository: options.repository,
-          protectedBase: options.branch,
-          sourceHead: options.expectedHead,
-          qualifiedBase,
-          toolchainRoot: options.toolchainRoot,
-        },
-        heartbeat: async () => {
-          await runCommand({
-            command: "heartbeat",
-            repository: options.repository,
-            branch: options.branch,
-            fencingToken: warrant.fencingToken,
-            leaseGeneration: warrant.generation,
-            leaseSeconds: options.leaseSeconds,
-            execute: true,
-            token: options.token,
-            apiUrl: options.apiUrl,
-          });
-        },
+      proof = await runNativeQualificationAttempt({
+        options,
+        warrant,
+        attempt: nativeAttempts,
+        client,
+        runCommand,
+        runNative,
+        composeCandidate,
+        writeEvidence: (name, value) =>
+          writeJson(path.join(evidenceDirectory, name), value),
       });
-      writeJson(
-        path.join(
-          evidenceDirectory,
-          `native-heartbeat-attempt-${nativeAttempts}.json`,
-        ),
-        heartbeatReceipt,
+      classified = await classifyNativeProofAgainstCurrent(
+        proof,
+        options,
+        client,
       );
-      await client.exactPullRequestHead(
-        options.pullRequestNumber,
-        options.expectedHead,
-      );
-      proof = createNativeQualificationProof({
-        repository: options.repository,
-        protectedBase: options.branch,
-        sourceIdentityRoot: options.sourceIdentityRoot,
-        sourcePatchRoot: options.sourcePatchRoot,
-        planRoot: options.planRoot,
-        closureRoot: options.closureRoot,
-        dependencyRoot: options.dependencyRoot,
-        toolchainRoot: options.toolchainRoot,
-        environmentRoot: options.environmentRoot,
-        qualifiedBase,
-        affectedPaths: options.affectedPaths,
-        shardEvidenceRoots: [
-          ...options.shardEvidenceRoots,
-          heartbeatReceipt.receiptRoot,
-        ],
-        qualifiedAt: new Date().toISOString(),
-      });
-      writeJson(path.join(evidenceDirectory, "native-proof.json"), proof);
-      classified = await classifyNativeProofAgainstCurrent(proof, options, client);
     }
 
     if (!classified?.decision.reusable) {

package/scripts/dev-delivery-warrant.mjs

@@ -295,6 +295,9 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     now: new Date(optionsInput.now || Date.now()).toISOString(),
     execute: bool(optionsInput.execute, false),
   };
+  if (options.command === "submit" && options.execute && options.deliveryClass !== "non-native-fast") {
+    exactRoot(options.environmentRoot, "environmentRoot");
+  }
   const store =
     clientInput ||
     new GitHubDevDeliveryStore({

package/templates/native-dev-delivery.yml

@@ -40,7 +40,7 @@ on:
         description: "Native toolchain root"
         required: true
       environment-root:
-        description: "Native execution environment contract root"
+        description: "Exact native execution environment contract root bound before native spawn"
         required: true
       affected-paths-json:
         description: "JSON array representing the affected closure"