@kungfu-tech/buildchain 3.0.9-alpha.7 → 3.0.9-alpha.9

package/scripts/dev-delivery-two-phase.mjs

@@ -4,11 +4,15 @@ import fs from "node:fs";
 import path from "node:path";
 
 import {
-  createNativeProofReuseDecision,
   createNativeQualificationProof,
   devDeliveryContentRoot,
 } from "../packages/core/dev-delivery-warrant.js";
 import { runNativeWithHeartbeat } from "./dev-delivery-native-run.mjs";
+import {
+  attributedGitHubBaseDelta,
+  classifyNativeProofAgainstCurrent,
+  replayQualifiedNativeWarrant,
+} from "./dev-delivery-two-phase-resume.mjs";
 import { runDevDeliveryCommand } from "./dev-delivery-warrant.mjs";
 
 function flag(args, name, fallback = "") {
@@ -111,31 +115,17 @@ export class GitHubTwoPhaseClient {
 
   async baseDelta(previousBase, currentBase) {
     if (previousBase === currentBase) {
-      return { graphKnown: true, changedPaths: [] };
+      return {
+        graphKnown: true,
+        attributionComplete: true,
+        changedPaths: [],
+        renames: [],
+      };
     }
     const data = await this.request(
       `/repos/${this.repository}/compare/${previousBase}...${currentBase}`,
     );
-    const files = Array.isArray(data.files) ? data.files : [];
-    const graphKnown =
-      data.status === "ahead" &&
-      data.merge_base_commit?.sha === previousBase &&
-      files.length < 300;
-    return {
-      graphKnown,
-      changedPaths: graphKnown
-        ? [
-            ...new Set(
-              files
-                .flatMap((entry) => [
-                  String(entry.filename || ""),
-                  String(entry.previous_filename || ""),
-                ])
-                .filter(Boolean),
-            ),
-          ].sort()
-        : [],
-    };
+    return attributedGitHubBaseDelta(data, previousBase);
   }
 
   async wake(eventType, candidate) {
@@ -143,26 +133,13 @@ export class GitHubTwoPhaseClient {
       method: "POST",
       body: {
         event_type: eventType,
-        client_payload: candidate,
+        // Preserve every binding in one property under GitHub's ten-property limit.
+        client_payload: { candidate },
       },
     });
   }
 }
 
-function semanticCurrent(options, currentBase, delta) {
-  return {
-    sourceIdentityRoot: options.sourceIdentityRoot,
-    sourcePatchRoot: options.sourcePatchRoot,
-    planRoot: options.planRoot,
-    closureRoot: options.closureRoot,
-    dependencyRoot: options.dependencyRoot,
-    toolchainRoot: options.toolchainRoot,
-    currentBase,
-    graphKnown: delta.graphKnown,
-    changedPaths: delta.changedPaths,
-  };
-}
-
 export function composeCandidate(candidateDirectory, expectedHead, baseSha) {
   try {
     execFileSync("git", ["-C", candidateDirectory, "merge", "--abort"], {
@@ -193,16 +170,6 @@ export function composeCandidate(candidateDirectory, expectedHead, baseSha) {
   );
 }
 
-async function classifyAgainstCurrent(proof, options, client) {
-  const currentBase = await client.baseSha(options.branch);
-  const delta = await client.baseDelta(proof.qualifiedBase, currentBase);
-  const current = semanticCurrent(options, currentBase, delta);
-  return {
-    current,
-    decision: createNativeProofReuseDecision({ proof, current }),
-  };
-}
-
 async function releaseFailedAttempt({
   error,
   options,
@@ -290,9 +257,9 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
   const warrantResult = readJson(options.warrantResultPath, "Warrant result");
   const warrant =
     warrantResult.observation?.activeWarrant || warrantResult.warrant;
-  if (!warrant || warrant.phase !== "provisional") {
+  if (!warrant || !["provisional", "qualified"].includes(warrant.phase)) {
     throw new Error(
-      "two-phase delivery requires an active provisional Warrant",
+      "two-phase delivery requires an active provisional or qualified Warrant",
     );
   }
   if (
@@ -303,11 +270,13 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
   }
   const evidenceDirectory = path.resolve(options.evidenceDirectory);
   fs.mkdirSync(evidenceDirectory, { recursive: true });
+  const qualifiedReplay = await replayQualifiedNativeWarrant({ warrant, pullRequestNumber: options.pullRequestNumber, expectedHead: options.expectedHead, exactPullRequestHead: (...args) => client.exactPullRequestHead(...args) });
+  if (qualifiedReplay) return qualifiedReplay;
   let proof = options.nativeProofPath
     ? readJson(options.nativeProofPath, "native proof")
     : null;
   let classified = proof
-    ? await classifyAgainstCurrent(proof, options, client)
+    ? await classifyNativeProofAgainstCurrent(proof, options, client)
     : null;
   let nativeAttempts = 0;
 
@@ -318,7 +287,7 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
           options.pullRequestNumber,
           options.expectedHead,
         );
-        classified = await classifyAgainstCurrent(proof, options, client);
+        classified = await classifyNativeProofAgainstCurrent(proof, options, client);
         if (classified.decision.reusable) break;
       }
       if (nativeAttempts >= 2) break;
@@ -383,6 +352,7 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
         closureRoot: options.closureRoot,
         dependencyRoot: options.dependencyRoot,
         toolchainRoot: options.toolchainRoot,
+        environmentRoot: options.environmentRoot,
         qualifiedBase,
         affectedPaths: options.affectedPaths,
         shardEvidenceRoots: [
@@ -391,7 +361,8 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
         ],
         qualifiedAt: new Date().toISOString(),
       });
-      classified = await classifyAgainstCurrent(proof, options, client);
+      writeJson(path.join(evidenceDirectory, "native-proof.json"), proof);
+      classified = await classifyNativeProofAgainstCurrent(proof, options, client);
     }
 
     if (!classified?.decision.reusable) {
@@ -417,7 +388,9 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
       ),
       currentBase: classified.current.currentBase,
       graphKnown: classified.current.graphKnown,
+      attributionComplete: classified.current.attributionComplete,
       changedPaths: JSON.stringify(classified.current.changedPaths),
+      renames: JSON.stringify(classified.current.renames),
       execute: true,
       token: options.token,
       apiUrl: options.apiUrl,
@@ -434,6 +407,7 @@ export async function runTwoPhaseDelivery(options, dependencies = {}) {
       nativeProofRoot: proof.proofRoot,
       nativeReuseDecisionRoot: classified.decision.decisionRoot,
       qualificationReceiptRoot: qualified.receiptRoot,
+      landingAuthority: false,
       qualifiedWarrant: qualified.observation.activeWarrant,
     };
   } catch (error) {
@@ -521,6 +495,11 @@ function cliOptions(args, environment = process.env) {
       "toolchain-root",
       environment.BUILDCHAIN_DEV_DELIVERY_TOOLCHAIN_ROOT,
     ),
+    environmentRoot: flag(
+      args,
+      "environment-root",
+      environment.BUILDCHAIN_DEV_DELIVERY_ENVIRONMENT_ROOT,
+    ),
     affectedPaths: jsonList(
       flag(
         args,

package/scripts/dev-delivery-warrant.mjs

@@ -73,13 +73,14 @@ function decodeBlob(blob) {
 }
 
 export class GitHubDevDeliveryStore {
-  constructor({ repository, token, apiUrl = "https://api.github.com", fetchImpl = globalThis.fetch } = {}) {
+  constructor({ repository, token, apiUrl = "https://api.github.com", fetchImpl = globalThis.fetch, createInitialState = createDevDeliveryQueue } = {}) {
     this.repository = normalizeRepository(repository);
     if (!fetchImpl) throw new Error("fetch is required");
     if (!token) throw new Error("GITHUB_TOKEN is required for the GitHub dev delivery store");
     this.token = token;
     this.apiUrl = apiUrl.replace(/\/+$/, "");
     this.fetch = fetchImpl;
+    this.createInitialState = createInitialState;
   }
 
   async request(method, requestPath, body) {
@@ -113,7 +114,7 @@ export class GitHubDevDeliveryStore {
       return {
         exists: false,
         commitSha: "",
-        queue: createDevDeliveryQueue({
+        queue: this.createInitialState({
           repository: this.repository.fullName,
           protectedBase,
           now,
@@ -206,6 +207,7 @@ function transitionFor(command, queue, options) {
         closureRoot: exactRoot(options.closureRoot, "closureRoot"),
         dependencyRoot: exactRoot(options.dependencyRoot, "dependencyRoot"),
         toolchainRoot: exactRoot(options.toolchainRoot, "toolchainRoot"),
+        ...(options.environmentRoot ? { environmentRoot: exactRoot(options.environmentRoot, "environmentRoot") } : {}),
         affectedPaths: jsonList(options.affectedPaths, "affected paths"),
         sourceWorkflowRunId: options.sourceWorkflowRunId ? positiveInteger(options.sourceWorkflowRunId, "sourceWorkflowRunId") : 0,
         deliveryClass: options.deliveryClass,
@@ -233,7 +235,9 @@ function transitionFor(command, queue, options) {
       current: {
         currentBase: options.currentBase,
         graphKnown: options.graphKnown,
+        attributionComplete: options.attributionComplete,
         changedPaths: jsonList(options.changedPaths, "changed paths"),
+        renames: jsonList(options.renames, "renames"),
       },
       now: options.now,
     });
@@ -426,10 +430,13 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
     currentBase: flag(rest, "current-base", environment.BUILDCHAIN_DEV_DELIVERY_CURRENT_BASE),
     changedPaths: flag(rest, "changed-paths-json", environment.BUILDCHAIN_DEV_DELIVERY_CHANGED_PATHS || "[]"),
     graphKnown: ["1", "true", "yes", "on"].includes(flag(rest, "graph-known", environment.BUILDCHAIN_DEV_DELIVERY_GRAPH_KNOWN).trim().toLowerCase()),
+    attributionComplete: ["1", "true", "yes", "on"].includes(flag(rest, "attribution-complete", environment.BUILDCHAIN_DEV_DELIVERY_ATTRIBUTION_COMPLETE).trim().toLowerCase()),
+    renames: flag(rest, "renames-json", environment.BUILDCHAIN_DEV_DELIVERY_RENAMES || "[]"),
     planRoot: flag(rest, "plan-root", environment.BUILDCHAIN_DEV_DELIVERY_PLAN_ROOT),
     closureRoot: flag(rest, "closure-root", environment.BUILDCHAIN_DEV_DELIVERY_CLOSURE_ROOT),
     dependencyRoot: flag(rest, "dependency-root", environment.BUILDCHAIN_DEV_DELIVERY_DEPENDENCY_ROOT),
     toolchainRoot: flag(rest, "toolchain-root", environment.BUILDCHAIN_DEV_DELIVERY_TOOLCHAIN_ROOT),
+    environmentRoot: flag(rest, "environment-root", environment.BUILDCHAIN_DEV_DELIVERY_ENVIRONMENT_ROOT),
     deliveryClass: flag(rest, "delivery-class", environment.BUILDCHAIN_DEV_DELIVERY_CLASS),
     priority: flag(rest, "priority", environment.BUILDCHAIN_DEV_DELIVERY_PRIORITY || "ordinary"),
     fencingToken: flag(rest, "fencing-token", environment.BUILDCHAIN_DEV_DELIVERY_FENCING_TOKEN),

package/scripts/generate-site-bundle.mjs

@@ -931,7 +931,7 @@ function buildSiteBundle() {
       "schemas/release-tail-capabilities-v1.schema.json",
       "schemas/release-tail-provider-bindings-v1.schema.json",
       "schemas/kfd-agent-hub-adoption.schema.json",
-      "schemas/kfd-product-gate-input-v1.schema.json",
+      "schemas/kfd-product-gate-input-v1.schema.json", "schemas/dev-delivery-authority-v2.schema.json",
       "kfd-support.json",
       "artifact-evidence.json",
       "product-mechanism.json",
@@ -968,7 +968,7 @@ function buildSiteBundle() {
       "schemas/release-tail-capabilities-v1.schema.json",
       "schemas/release-tail-provider-bindings-v1.schema.json",
       "schemas/kfd-agent-hub-adoption.schema.json",
-      "schemas/kfd-product-gate-input-v1.schema.json",
+      "schemas/kfd-product-gate-input-v1.schema.json", "schemas/dev-delivery-authority-v2.schema.json",
       "buildchain-contract.json",
       "kfd-claims.json",
       "product-mechanism.json",
@@ -1101,7 +1101,7 @@ function buildSiteBundle() {
       "schemas/release-tail-capabilities-v1.schema.json",
       "schemas/release-tail-provider-bindings-v1.schema.json",
       "schemas/kfd-agent-hub-adoption.schema.json",
-      "schemas/kfd-product-gate-input-v1.schema.json",
+      "schemas/kfd-product-gate-input-v1.schema.json", "schemas/dev-delivery-authority-v2.schema.json",
       "buildchain-contract.json",
       "kfd-upstream-aggregate.json",
       "kfd-claims.json",
@@ -1285,6 +1285,9 @@ function buildSiteBundle() {
     ),
     "schemas/kfd-agent-hub-adoption.schema.json": KFD_AGENT_HUB_ADOPTION_SCHEMA,
     "schemas/kfd-product-gate-input-v1.schema.json": KFD_PRODUCT_GATE_INPUT_SCHEMA,
+    "schemas/dev-delivery-authority-v2.schema.json": readJson(
+      "contracts/dev-delivery-authority-v2.schema.json",
+    ),
     "badge-endpoint-registry.json": badgeEndpointRegistry,
     "publication-registry.json": publicationRegistry,
     "buildchain-contract.json": createBuildchainContractWorld({ root, controllerRegistry }),

package/scripts/site-capability-metadata.mjs

@@ -92,6 +92,17 @@ export function cliCommandMeta(id) {
     "kfd-upstream-roles": { group: "kfd-trust", purpose: "List Buildchain-managed KFD upstream role values and inference policy." },
     lifecycle: { group: "reusable-build", purpose: "Run configured lifecycle commands and write deterministic artifact manifests." },
     dev: { group: "governance-versioning", purpose: "Inspect protected development-channel governance command families." },
+    "dev-authority-admit-merge-group": { group: "governance-versioning", purpose: "Verify that one exact candidate holds the exclusive Landing Warrant before merge_group admission." },
+    "dev-authority-complete-qualification": { group: "governance-versioning", purpose: "Bind qualification evidence and release one bounded Qualification Lease without granting landing authority." },
+    "dev-authority-heartbeat-landing": { group: "governance-versioning", purpose: "Extend the exact fenced Landing Warrant while final landing work remains live." },
+    "dev-authority-heartbeat-qualification": { group: "governance-versioning", purpose: "Extend one exact fenced Qualification Lease while qualification work remains live." },
+    "dev-authority-lease-landing": { group: "governance-versioning", purpose: "Issue or retain the single exclusive Landing Warrant for a qualified candidate." },
+    "dev-authority-lease-qualification": { group: "governance-versioning", purpose: "Issue one qualification-only lease within the configured bounded lane count." },
+    "dev-authority-migrate": { group: "governance-versioning", purpose: "Migrate one exact v1 Warrant state into v2 without rewriting candidate or fencing evidence." },
+    "dev-authority-observe": { group: "governance-versioning", purpose: "Read bounded Qualification Leases and the exclusive Landing Warrant without mutating authority." },
+    "dev-authority-recover": { group: "governance-versioning", purpose: "Recover expired qualification or Landing authority and emit one rooted wake instruction." },
+    "dev-authority-settle": { group: "governance-versioning", purpose: "Settle terminal candidate evidence idempotently and release held qualification or Landing authority immediately." },
+    "dev-authority-submit": { group: "governance-versioning", purpose: "Submit an exact candidate to the opt-in bounded-qualification authority state." },
     "dev-proof-classify": { group: "governance-versioning", purpose: "Classify source-qualified candidate changes against a current integration base." },
     "dev-proof-integration": { group: "governance-versioning", purpose: "Seal final exact integration delivery proof for a warranted candidate." },
     "dev-proof-replay": { group: "governance-versioning", purpose: "Replay source qualification against a Project Cut without rewriting candidate source." },
@@ -174,7 +185,8 @@ export function nodeApiMeta(exportName) {
     "./build-facts": { group: "observability-diagnostics", summary: "Git source, version, module output, product artifact, and legacy Kungfu build fact APIs." },
     "./candidate-timeline": { group: "observability-diagnostics", summary: "Source-bound candidate event normalization, per-attempt critical-path-safe aggregation, and compact reporting APIs." },
     "./channel-candidate": { group: "governance-versioning", summary: "Exact-source channel candidate decisions, same-SHA workflow evidence validation, and deterministic source-lock reference APIs." },
-    "./dev-delivery-warrant": { group: "governance-versioning", summary: "Durable fair Dev Delivery Warrant queue, fenced lease, and split source and integration proof APIs." },
+    "./dev-delivery-authority": { group: "governance-versioning", summary: "Opt-in bounded Qualification Lease, exclusive Landing Warrant, exact v1 migration, admission, and terminal settlement APIs." },
+    "./dev-delivery-warrant": { group: "governance-versioning", summary: "Durable single-flight Warrant queue, fenced lease, and split source and integration proof APIs." },
     "./cache-evidence": { group: "observability-diagnostics", summary: "Content-addressed cache operation receipts and source/platform-bound evidence-set verification APIs." },
     "./diagnostics": { group: "observability-diagnostics", summary: "Native diagnostics collection, summarization, cache, compiler, and process-sampler APIs." },
     "./logging": { group: "observability-diagnostics", summary: "Buildchain JSONL logging, span, summary, and verification APIs." },

package/scripts/workflow-call-contract.mjs

@@ -6,7 +6,7 @@ import { pathToFileURL } from "node:url";
 import { evaluateWorkflowCallContract } from "../packages/core/workflow-call-contract.js";
 import { parseWorkflowDocument } from "../packages/core/workflow-yaml-contract.js";
 
-export const SELF_RELEASE_REF = "769b221bad7a6b9104afad4c2628d9dca396ab0f";
+export const SELF_RELEASE_REF = "cc6c32845ab5779009aeb48cc34efe65e229fe30";
 export const SELF_RELEASE_PUBLIC_WORKFLOW = `kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@${SELF_RELEASE_REF}`;
 
 function parityFailure(message) {

package/templates/native-dev-delivery.yml

@@ -39,6 +39,9 @@ on:
       toolchain-root:
         description: "Native toolchain root"
         required: true
+      environment-root:
+        description: "Native execution environment contract root"
+        required: true
       affected-paths-json:
         description: "JSON array representing the affected closure"
         required: true
@@ -58,20 +61,21 @@ jobs:
   deliver:
     uses: kungfu-systems/buildchain/.github/workflows/dev-pr-auto-merge.yml@v3
     with:
-      target-branch: ${{ github.event.client_payload.targetBranch || inputs.target-branch }}
-      expected-pr-number: ${{ github.event.client_payload.pullRequestNumber || inputs.expected-pr-number }}
-      expected-head-sha: ${{ github.event.client_payload.sourceHead || inputs.expected-head-sha }}
-      source-workflow-run-id: ${{ github.event.client_payload.sourceWorkflowRunId || github.run_id }}
+      target-branch: ${{ github.event.client_payload.candidate.targetBranch || inputs.target-branch }}
+      expected-pr-number: ${{ github.event.client_payload.candidate.pullRequestNumber || inputs.expected-pr-number }}
+      expected-head-sha: ${{ github.event.client_payload.candidate.sourceHead || inputs.expected-head-sha }}
+      source-workflow-run-id: ${{ github.event.client_payload.candidate.sourceWorkflowRunId || github.run_id }}
       delivery-warrant-mode: required
-      assignment-root: ${{ github.event.client_payload.assignmentRoot || inputs.assignment-root }}
-      initiative-root: ${{ github.event.client_payload.initiativeRoot || inputs.initiative-root }}
-      source-identity-root: ${{ github.event.client_payload.sourceIdentityRoot || inputs.source-identity-root }}
-      source-patch-root: ${{ github.event.client_payload.sourcePatchRoot || inputs.source-patch-root }}
-      plan-root: ${{ github.event.client_payload.planRoot || inputs.plan-root }}
-      closure-root: ${{ github.event.client_payload.closureRoot || inputs.closure-root }}
-      dependency-root: ${{ github.event.client_payload.dependencyRoot || inputs.dependency-root }}
-      toolchain-root: ${{ github.event.client_payload.toolchainRoot || inputs.toolchain-root }}
-      affected-paths-json: ${{ github.event_name == 'repository_dispatch' && toJSON(github.event.client_payload.affectedPaths) || inputs.affected-paths-json }}
+      assignment-root: ${{ github.event.client_payload.candidate.assignmentRoot || inputs.assignment-root }}
+      initiative-root: ${{ github.event.client_payload.candidate.initiativeRoot || inputs.initiative-root }}
+      source-identity-root: ${{ github.event.client_payload.candidate.sourceIdentityRoot || inputs.source-identity-root }}
+      source-patch-root: ${{ github.event.client_payload.candidate.sourcePatchRoot || inputs.source-patch-root }}
+      plan-root: ${{ github.event.client_payload.candidate.planRoot || inputs.plan-root }}
+      closure-root: ${{ github.event.client_payload.candidate.closureRoot || inputs.closure-root }}
+      dependency-root: ${{ github.event.client_payload.candidate.dependencyRoot || inputs.dependency-root }}
+      toolchain-root: ${{ github.event.client_payload.candidate.toolchainRoot || inputs.toolchain-root }}
+      environment-root: ${{ github.event.client_payload.candidate.environmentRoot || inputs.environment-root }}
+      affected-paths-json: ${{ github.event_name == 'repository_dispatch' && toJSON(github.event.client_payload.candidate.affectedPaths) || inputs.affected-paths-json }}
       native-proof-json: ${{ inputs.native-proof-json || '' }}
       native-command: cmake -S . -B build && cmake --build build --parallel && ctest --test-dir build --output-on-failure
       native-heartbeat-seconds: 300