@kungfu-tech/buildchain 3.0.9-alpha.8 → 4.0.0-alpha.0

package/packages/core/paper.js

@@ -46,16 +46,6 @@ import {
   scaffoldReadme,
 } from "./paper-scaffold-content.js";
 import { executePaperNpmBootstrap as executePaperNpmBootstrapOperation } from "./paper-npm-bootstrap.js";
-import {
-  appendPublicationRehearsalToml,
-  projectPublicationRehearsalToml,
-  publicationRehearsalWorkflow,
-} from "./publication-rehearsal-projection.js";
-import {
-  appendNextDevelopmentToml,
-  nextDevelopmentWorkflowHeader,
-  projectNextDevelopmentToml,
-} from "./next-development-projection.js";
 
 export { PAPER_PATHS, resolvePaperRepository } from "./paper-repository.js";
 export {
@@ -124,7 +114,6 @@ const PAPER_SCAFFOLD_PATHS = Object.freeze([
   PAPER_PATHS.buildWorkflow,
   PAPER_PATHS.verifyWorkflow,
   PAPER_PATHS.releaseWorkflow,
-  PAPER_PATHS.rehearsalWorkflow,
   PAPER_PATHS.pnpmWorkspace,
   PAPER_PATHS.provisioningAuthority,
   "Makefile",
@@ -361,7 +350,7 @@ immutable_base_url = ${tomlString(joinUrl(siteBaseUrl, "archive").replace(/\/$/,
 registry_path = ".buildchain/publication/publication-registry.json"
 `
     : "";
-  return appendNextDevelopmentToml(appendPublicationRehearsalToml(`schema = 1
+  return `schema = 1
 
 [project]
 type = "publication-artifact"
@@ -395,14 +384,14 @@ command = "make pdf"
 
 [lifecycle.verify]
 command = "make check"
-`));
+`;
 }
 
 function scaffoldBuildWorkflow(
   buildchainSha,
   { artifactName = "paper-publication" } = {},
 ) {
-  return `${nextDevelopmentWorkflowHeader()}name: Build
+  return `name: Build
 
 on:
   workflow_dispatch:
@@ -430,7 +419,7 @@ jobs:
 }
 
 function scaffoldVerifyWorkflow(buildchainSha) {
-  return `${nextDevelopmentWorkflowHeader()}name: Verify
+  return `name: Verify
 
 on:
   pull_request:
@@ -461,7 +450,7 @@ function scaffoldReleaseWorkflow(
   const passportInput = releasePassportProductName
     ? `      release-passport-product-name: ${JSON.stringify(releasePassportProductName)}\n`
     : "";
-  return `${nextDevelopmentWorkflowHeader()}name: Paper Release
+  return `name: Paper Release
 
 on:
   workflow_dispatch:
@@ -536,7 +525,6 @@ export function createPaperProvisioningAuthority({
   buildWorkflow,
   verifyWorkflow,
   releaseWorkflow,
-  rehearsalWorkflow,
   agentEntry,
   agentInstructions,
   environment = "",
@@ -576,12 +564,6 @@ export function createPaperProvisioningAuthority({
         reusablePath: ".github/workflows/paper-release-sealed.yml",
         reusableRef: buildchainSha,
       },
-      rehearsal: {
-        path: PAPER_PATHS.rehearsalWorkflow,
-        sourceDigest: sha256Text(rehearsalWorkflow),
-        reusablePath: ".github/workflows/release-tail.yml",
-        reusableRef: buildchainSha,
-      },
     },
     agentEntry: {
       contract: PAPER_AGENT_ENTRY_CONTRACT,
@@ -648,7 +630,6 @@ function scaffoldFiles({
     releasePassportProductName: title,
   });
   const verifyWorkflow = scaffoldVerifyWorkflow(buildchainSha);
-  const rehearsalWorkflow = publicationRehearsalWorkflow(buildchainSha);
   const agentEntry = paperAgentEntryFiles({
     cwd,
     buildchainVersion,
@@ -666,7 +647,6 @@ function scaffoldFiles({
     buildWorkflow,
     verifyWorkflow,
     releaseWorkflow,
-    rehearsalWorkflow,
     agentEntry: agentEntry.get(PAPER_PATHS.agentEntry),
     agentInstructions: agentEntry.get(PAPER_PATHS.agentInstructions),
   });
@@ -687,7 +667,6 @@ function scaffoldFiles({
     [PAPER_PATHS.buildWorkflow, buildWorkflow],
     [PAPER_PATHS.verifyWorkflow, verifyWorkflow],
     [PAPER_PATHS.releaseWorkflow, releaseWorkflow],
-    [PAPER_PATHS.rehearsalWorkflow, rehearsalWorkflow],
     [PAPER_PATHS.pnpmWorkspace, paperPnpmWorkspace("", buildchainVersion)],
     [PAPER_PATHS.provisioningAuthority, jsonText(provisioningAuthority)],
     ...agentEntry,
@@ -985,7 +964,6 @@ function migrationFiles({
     releasePassportProductName: config.publication.title,
   });
   const verifyWorkflow = scaffoldVerifyWorkflow(runtimeSha);
-  const rehearsalWorkflow = publicationRehearsalWorkflow(runtimeSha);
   const agentEntry = paperAgentEntryFiles({
     cwd,
     buildchainVersion: runtimeIdentity.version,
@@ -1000,7 +978,6 @@ function migrationFiles({
     buildWorkflow,
     verifyWorkflow,
     releaseWorkflow,
-    rehearsalWorkflow,
     agentEntry: agentEntry.get(PAPER_PATHS.agentEntry),
     agentInstructions: agentEntry.get(PAPER_PATHS.agentInstructions),
   });
@@ -1020,20 +997,11 @@ function migrationFiles({
     runtimeIdentity.version,
   );
   const files = new Map([
-    [
-      PAPER_PATHS.config,
-      projectNextDevelopmentToml(
-        projectPublicationRehearsalToml(
-          fs.readFileSync(path.resolve(cwd, PAPER_PATHS.config), "utf8"),
-        ),
-      ),
-    ],
     [PAPER_PATHS.contractLock, contractLockText],
     [PAPER_PATHS.versionPin, `${runtimeIdentity.version}\n`],
     [PAPER_PATHS.buildWorkflow, buildWorkflow],
     [PAPER_PATHS.verifyWorkflow, verifyWorkflow],
     [PAPER_PATHS.releaseWorkflow, releaseWorkflow],
-    [PAPER_PATHS.rehearsalWorkflow, rehearsalWorkflow],
     [PAPER_PATHS.pnpmWorkspace, pnpmWorkspace],
     [PAPER_PATHS.provisioningAuthority, jsonText(provisioningAuthority)],
     ...agentEntry,
@@ -1053,10 +1021,11 @@ export function planPaperMigration({
     "rev-parse",
     "--show-toplevel",
   ]);
-  if (
-    !repositoryRoot ||
-    fs.realpathSync(repositoryRoot) !== fs.realpathSync(resolvedCwd)
-  ) {
+  const repositoryPrefix = gitValue(resolvedCwd, [
+    "rev-parse",
+    "--show-prefix",
+  ]).replace(/\/+$/u, "");
+  if (!repositoryRoot || repositoryPrefix) {
     throw new Error("paper migration must target the exact repository root");
   }
   const source = {
@@ -1147,7 +1116,7 @@ export function planPaperMigration({
               id: "refresh-pnpm-lock",
               command: "pnpm install --lockfile-only",
               description:
-                "Bind the exact Buildchain v3 dependency into pnpm-lock.yaml after the reviewed package update.",
+                "Bind the exact Buildchain semantic dependency into pnpm-lock.yaml after the reviewed package update.",
             },
           ],
   };
@@ -1787,7 +1756,6 @@ function validatePaperProvisioningAuthority(cwd) {
     value.workflows?.build,
     value.workflows?.verify,
     value.workflows?.release,
-    value.workflows?.rehearsal,
   ]) {
     if (!workflow?.path || !workflow?.sourceDigest) {
       errors.push("paper workflow authority is incomplete");

package/packages/core/publication-reproducibility.js

@@ -1,5 +1,4 @@
 import crypto from "node:crypto";
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -8,6 +7,7 @@ import zlib from "node:zlib";
 import { loadBuildchainConfig } from "./buildchain-config.js";
 import { writePublicationArtifact } from "./publication-artifact.js";
 import { preparePublicationNpmPackage } from "./publication-package.js";
+import { spawnSyncCommand } from "./spawn-command.js";
 
 export const PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT =
   "kungfu-buildchain-publication-reproducibility-receipt";
@@ -62,7 +62,7 @@ function run(
   args,
   { cwd, env = process.env, label = [command, ...args].join(" ") } = {},
 ) {
-  const result = spawnSync(command, args, {
+  const result = spawnSyncCommand(command, args, {
     cwd,
     env,
     encoding: "utf8",
@@ -286,8 +286,8 @@ function sourceFacts(cwd, requestedSha = "") {
   const repositoryRoot = fs.realpathSync(
     git(canonicalCwd, ["rev-parse", "--show-toplevel"]),
   );
-  const projectPath =
-    toPosix(path.relative(repositoryRoot, canonicalCwd)) || ".";
+  const projectPath = toPosix(git(canonicalCwd, ["rev-parse", "--show-prefix"]))
+    .replace(/\/+$/u, "") || ".";
   const head = git(repositoryRoot, ["rev-parse", "HEAD"]);
   const sha = git(repositoryRoot, [
     "rev-parse",

package/packages/core/release-line-bootstrap.js

@@ -65,6 +65,26 @@ function writeJson(value) {
   return `${JSON.stringify(value, null, 2)}\n`;
 }
 
+function relineBuildchainSummary(value, line) {
+  return String(value || "").replace(/^Buildchain v\d+\.\d+(?=\s)/u, `Buildchain ${line}`);
+}
+
+function updateReleaseImpactForLine(current, plan) {
+  return {
+    ...current,
+    release: {
+      ...(current.release && typeof current.release === "object" ? current.release : {}),
+      version: plan.initialVersion,
+      line: plan.line,
+    },
+    versionImpact: {
+      ...(current.versionImpact && typeof current.versionImpact === "object" ? current.versionImpact : {}),
+      rationale: relineBuildchainSummary(current.versionImpact?.rationale, plan.line),
+    },
+    summary: relineBuildchainSummary(current.summary, plan.line),
+  };
+}
+
 function updateReleaseImpactVersionState(cwd, plan) {
   const filePath = path.join(cwd, ".buildchain", "release-impact.json");
   if (!fs.existsSync(filePath)) {
@@ -74,14 +94,7 @@ function updateReleaseImpactVersionState(cwd, plan) {
   if (!current || typeof current !== "object" || Array.isArray(current)) {
     throw new Error(".buildchain/release-impact.json must be a JSON object");
   }
-  const next = {
-    ...current,
-    release: {
-      ...(current.release && typeof current.release === "object" ? current.release : {}),
-      version: plan.initialVersion,
-      line: plan.line,
-    },
-  };
+  const next = updateReleaseImpactForLine(current, plan);
   const content = writeJson(next);
   if (content !== writeJson(current)) {
     fs.writeFileSync(filePath, content);

package/packages/core/release-passport-contract.js

@@ -405,7 +405,7 @@ export function prepareReleasePassportKfdSections({ kfd1, kfd2Claims, kfd3, kfdA
   };
 }
 
-export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], comparisonMatrix, expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", sourceSha = "", checkedAt } = {}) {
+export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], comparisonMatrix, sourceSha = "", checkedAt } = {}) {
   if (!manifest) {
     if (comparisonMatrix || gateResults.length > 0) {
       throw new Error("KFD support and product-gate inputs require --kfd-adopter-manifest-json; --kfd-support-matrix-json is comparison-only");
@@ -414,7 +414,7 @@ export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], c
   }
   const manifestGate = createKfdAdopterManifestGate({
     manifest, packageArtifactRoot: installedKfdPackageArtifactRoot(), gateResults,
-    authorityPath: "kfd-adopter-manifest.json", expectedAdopterId, expectedSourceRepository, expectedSourceSha: sourceSha, checkedAt,
+    expectedSourceSha: sourceSha, checkedAt,
   });
   const legacyProjection = createKfdLegacySupportMatrixProjection({ manifest, manifestGate });
   if (comparisonMatrix) {
@@ -425,18 +425,18 @@ export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], c
   }
   return {
     manifest, manifestGate, legacyProjection,
-    binding: createKfdAdopterReleaseBinding({ manifest, manifestGate, legacyProjection, expectedAdopterId, expectedSourceRepository, expectedSourceSha: sourceSha }),
+    binding: createKfdAdopterReleaseBinding({ manifest, manifestGate, legacyProjection, expectedSourceSha: sourceSha }),
   };
 }
 
-export function validateKfdAdopterReleaseEvidence({ binding, artifactBinding, manifest, manifestGate, legacyProjection, passportLegacyProjection, expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "" } = {}) {
+export function validateKfdAdopterReleaseEvidence({ binding, artifactBinding, manifest, manifestGate, legacyProjection, passportLegacyProjection, expectedSourceSha = "" } = {}) {
   if (!binding) {
     return passportLegacyProjection
       ? [{ code: "kfdSupport.authority", message: "legacy KFD support projection requires the standard adopter manifest binding" }]
       : [];
   }
   const issues = validateKfdAdopterReleaseBinding(binding, {
-    manifest, manifestGate, legacyProjection, expectedAdopterId, expectedSourceRepository, expectedSourceSha,
+    manifest, manifestGate, legacyProjection, expectedSourceSha,
   }).issues.map((entry) => ({ code: `kfdAdopter.${entry.path || entry.code}`, message: entry.message, details: entry }));
   if (!artifactBinding || passportStableJson(artifactBinding) !== passportStableJson(binding)) {
     issues.push({ code: "kfdAdopter.artifactEvidence", message: "release passport and artifact evidence must bind the same exact KFD adopter closure" });

package/packages/core/release-passport.js

@@ -154,15 +154,6 @@ function invariantSemanticPreimage(passport) {
   return value;
 }
 
-function hasCompleteInvariantCoverage(value) {
-  const coverage = value?.coverage;
-  return Number.isInteger(coverage?.required)
-    && coverage.required > 0
-    && coverage.verified === coverage.required
-    && [coverage.missing, coverage.falsified, coverage.unqualified]
-      .every((items) => Array.isArray(items) && items.length === 0);
-}
-
 function normalizeInvariantPassport(meta, index = 0) {
   const value = meta?.value;
   const label = `invariantPassportJsons[${index}]`;
@@ -182,18 +173,11 @@ function normalizeInvariantPassport(meta, index = 0) {
   if (value.passportRoot !== expectedRoot) {
     throw new Error(`${label}.passportRoot mismatch: expected ${expectedRoot}, got ${value.passportRoot}`);
   }
-  const verifiedPassport = value.verdict === "verified" && value.coverage?.complete === true;
-  const scopedUnqualifiedClaim = value.verdict === "unqualified"
-    && value.coverage?.complete === false
-    && hasCompleteInvariantCoverage(value)
-    && value.releaseClaims?.verdict === "unqualified"
-    && /^sha256:[0-9a-f]{64}$/.test(optionalString(value.releaseClaims?.claimRoot))
-    && Array.isArray(value.releaseClaims?.diagnostics)
-    && value.releaseClaims.diagnostics.length > 0
-    && Array.isArray(value.diagnostics)
-    && value.diagnostics.length === 0;
-  if (!verifiedPassport && !scopedUnqualifiedClaim) {
-    throw new Error(`${label}.verdict must be verified, or unqualified only for complete invariant coverage with one explicit unqualified releaseClaims section`);
+  if (value.verdict !== "verified") {
+    throw new Error(`${label}.verdict must be verified, got ${value.verdict}`);
+  }
+  if (value.coverage?.complete !== true) {
+    throw new Error(`${label}.coverage.complete must be true`);
   }
   if (value.source?.dirty !== false) {
     throw new Error(`${label}.source.dirty must be false`);
@@ -206,9 +190,6 @@ function normalizeInvariantPassport(meta, index = 0) {
     : [];
   if (platforms.length === 0) throw new Error(`${label}.coverage.platforms must be non-empty`);
   if (!Array.isArray(value.residualRisk)) throw new Error(`${label}.residualRisk must be an array`);
-  const releaseClaimRisks = scopedUnqualifiedClaim
-    ? value.releaseClaims.diagnostics.map((entry) => `Exit/provider claim ${optionalString(entry?.code) || "unqualified"}: ${optionalString(entry?.message) || "consumer claim remains unqualified"}`)
-    : [];
   return {
     path: optionalString(meta.path),
     sha256: optionalString(meta.sha256),
@@ -221,15 +202,7 @@ function normalizeInvariantPassport(meta, index = 0) {
     source: structuredClone(value.source),
     coverage: structuredClone(value.coverage),
     platforms,
-    admission: {
-      scope: "consumer-invariant-coverage",
-      result: "passed",
-      consumerVerdict: value.verdict,
-      releaseClaimsVerdict: optionalString(value.releaseClaims?.verdict),
-    },
-    releaseClaims: value.releaseClaims ? structuredClone(value.releaseClaims) : undefined,
-    diagnostics: Array.isArray(value.diagnostics) ? structuredClone(value.diagnostics) : [],
-    residualRisk: [...new Set([...value.residualRisk, ...releaseClaimRisks])].sort(),
+    residualRisk: structuredClone(value.residualRisk),
   };
 }
 
@@ -490,12 +463,7 @@ function mergeAuthoritativeImpactBase(impact, basePassport = undefined) {
   return merged;
 }
 
-function parseJsonCommandOutput({
-  command = "",
-  cwd = process.cwd(),
-  label = "command",
-  acceptNonzeroJson = undefined,
-} = {}) {
+function parseJsonCommandOutput({ command = "", cwd = process.cwd(), label = "command" } = {}) {
   const normalized = String(command || "").trim();
   if (!normalized) {
     return { value: undefined, path: "", sha256: "" };
@@ -509,7 +477,7 @@ function parseJsonCommandOutput({
   if (result.error) {
     throw new Error(`${label} failed to start: ${result.error.message}`);
   }
-  if (result.status !== 0 && typeof acceptNonzeroJson !== "function") {
+  if (result.status !== 0) {
     const stderr = String(result.stderr || "").trim();
     throw new Error(`${label} exited with ${result.status}${stderr ? `: ${stderr.slice(-1000)}` : ""}`);
   }
@@ -523,15 +491,10 @@ function parseJsonCommandOutput({
   } catch (error) {
     throw new Error(`${label} output must be valid JSON: ${error.message}`, { cause: error });
   }
-  if (result.status !== 0 && !acceptNonzeroJson({ status: result.status, value: parsed })) {
-    const stderr = String(result.stderr || "").trim();
-    throw new Error(`${label} exited with ${result.status}${stderr ? `: ${stderr.slice(-1000)}` : ""}`);
-  }
   return {
     value: parsed,
     path: "",
     sha256: sha256Text(stableJson(parsed)),
-    status: result.status,
   };
 }
 
@@ -846,41 +809,6 @@ function arrayOrSingleton(value) {
   return value && typeof value === "object" ? [value] : [];
 }
 
-const KFD2_RESIDUAL_RISK_SCHEMA = "https://kfd.libkungfu.dev/schemas/kfd-2/trust-taxonomy.schema.json#/$defs/residualRisk";
-
-function normalizeKfd2ResidualRisk(entry, { claim = {}, claimIndex = 0, riskIndex = 0 } = {}) {
-  if (entry && typeof entry === "object" && !Array.isArray(entry)) {
-    return entry;
-  }
-  const reason = optionalString(entry).trim();
-  if (!reason) {
-    return entry;
-  }
-  const claimId = optionalString(claim.id || `claim-${claimIndex + 1}`)
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "") || `claim-${claimIndex + 1}`;
-  const responsibility = claim.responsibility && typeof claim.responsibility === "object" && !Array.isArray(claim.responsibility)
-    ? claim.responsibility
-    : {};
-  return {
-    id: `${claimId}-residual-risk-${riskIndex + 1}`,
-    definedBy: KFD2_RESIDUAL_RISK_SCHEMA,
-    riskType: "manual-review-risk",
-    trustImpact: "downgrade-warning",
-    machineProvability: "not-machine-verifiable",
-    agentAction: "request-maintainer-review",
-    reason,
-    owner: optionalString(
-      responsibility.releaseDecisionOwner
-      || responsibility.owner
-      || responsibility.sourceOwner
-      || responsibility.sourceContractOwner
-      || "release maintainer",
-    ),
-  };
-}
-
 function normalizeKfd2Claim(raw = {}, index = 0) {
   const claim = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
   const sourceBindings = arrayOrEmpty(claim.sourceBindings || claim.source_bindings || claim.sources || claim.declaredSources);
@@ -894,13 +822,10 @@ function normalizeKfd2Claim(raw = {}, index = 0) {
       ? claim.audit_boundary
       : {};
   const responsibility = claim.responsibility && typeof claim.responsibility === "object" && !Array.isArray(claim.responsibility) ? claim.responsibility : {};
-  const residualRisk = arrayOrSingleton(claim.residualRisk || claim.residual_risk).map((entry, riskIndex) => validateKfd2TrustTaxonomyEntry(
-    normalizeKfd2ResidualRisk(entry, { claim, claimIndex: index, riskIndex }),
-    {
-      kind: "residualRisk",
-      label: `kfd-2.claims[${index}].residualRisk[${riskIndex}]`,
-    },
-  ));
+  const residualRisk = arrayOrSingleton(claim.residualRisk || claim.residual_risk).map((entry, riskIndex) => validateKfd2TrustTaxonomyEntry(entry, {
+    kind: "residualRisk",
+    label: `kfd-2.claims[${index}].residualRisk[${riskIndex}]`,
+  }));
   const downgradeReasons = arrayOrSingleton(claim.downgradeReasons || claim.downgrade_reasons || claim.downgradeReason || claim.downgrade_reason)
     .map((entry, reasonIndex) => validateKfd2TrustTaxonomyEntry(entry, {
       kind: "downgradeReason",
@@ -1465,7 +1390,7 @@ export function createReleasePassport({
   };
 }
 
-function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson, productGateJsons, repository, sourceSha, checkedAt }) {
+function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson, productGateJsons, sourceSha, checkedAt }) {
   const manifestMeta = parseJsonInputWithMeta(manifestJson, undefined, { cwd, label: "kfdAdopterManifestJson" });
   const supportMatrixMeta = parseJsonInputWithMeta(supportMatrixJson, undefined, { cwd, label: "kfdSupportMatrixJson" });
   const productGateMetas = (productGateJsons || [])
@@ -1476,7 +1401,7 @@ function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson,
     manifest: manifestMeta.value,
     gateResults: productGateMetas.map((meta) => meta.value),
     comparisonMatrix: supportMatrixMeta.value,
-    expectedAdopterId: repository || "kungfu-systems/buildchain", expectedSourceRepository: repository, sourceSha,
+    sourceSha,
     checkedAt,
   });
 }
@@ -1505,7 +1430,6 @@ export function collectGitHubReleasePassport({
   outputDir = ".buildchain/release-passport",
   assetsJson = "",
   assetsDir = "",
-  kfdArtifactSearchRoots = [],
   releaseJson = "",
   productName = "Buildchain",
   packageName = "@kungfu-tech/buildchain",
@@ -1581,12 +1505,12 @@ export function collectGitHubReleasePassport({
     .filter(Boolean)
     .map((witnessJson) => parseJsonInputWithMeta(witnessJson, undefined, { cwd, label: "kfd3ArtifactWitnessJsons entry" }))
     .filter((meta) => meta.value);
+  const basePassportMeta = parseJsonInputWithMeta(basePassportJson, undefined, { cwd, label: "basePassportJson" });
   const kfd3ArtifactCommandMeta = parseJsonCommandOutput({
     command: kfd3ArtifactVerifyCommand,
     cwd,
     label: "KFD-3 artifact verify command",
   });
-  const basePassportMeta = parseJsonInputWithMeta(basePassportJson, undefined, { cwd, label: "basePassportJson" });
   const invariantPassportMetas = (invariantPassportJsons || [])
     .filter(Boolean)
     .map((passportJson) => parseJsonInputWithMeta(passportJson, undefined, { cwd, label: "invariantPassportJsons entry" }))
@@ -1595,22 +1519,6 @@ export function collectGitHubReleasePassport({
     command: invariantPassportCommand,
     cwd,
     label: "invariant passport command",
-    acceptNonzeroJson: ({ status, value }) => {
-      if (status !== 2) return false;
-      try {
-        const normalized = normalizeInvariantPassport(
-          { value, path: "", sha256: sha256Text(stableJson(value)) },
-          invariantPassportMetas.length,
-        );
-        return normalized.verdict === "unqualified"
-          && normalized.coverage?.complete === false
-          && normalized.releaseClaims?.verdict === "unqualified"
-          && normalized.admission?.scope === "consumer-invariant-coverage"
-          && normalized.admission?.result === "passed";
-      } catch {
-        return false;
-      }
-    },
   });
   if (invariantPassportCommandMeta.value) invariantPassportMetas.push(invariantPassportCommandMeta);
   const invariantPassports = createInvariantPassportGate(invariantPassportMetas);
@@ -1662,7 +1570,7 @@ export function collectGitHubReleasePassport({
   const productMechanism = defaultProductMechanism({ repository, productName });
   const kfdAdopterEvidence = collectKfdAdopterReleaseInputs({
     cwd, manifestJson: kfdAdopterManifestJson, supportMatrixJson: kfdSupportMatrixJson,
-    productGateJsons: kfdProductGateJsons, repository, sourceSha, checkedAt: resolvedCheckedAt,
+    productGateJsons: kfdProductGateJsons, sourceSha, checkedAt: resolvedCheckedAt,
   });
   const {
     manifest: kfdAdopterManifest,
@@ -1687,7 +1595,6 @@ export function collectGitHubReleasePassport({
   const kfd1 = createKfd1ReleaseGateEvidence({
     cwd,
     artifactRoot: assetsDir ? path.resolve(cwd, assetsDir) : "",
-    artifactSearchRoots: kfdArtifactSearchRoots.map((root) => path.resolve(cwd, root)),
     artifacts: assets,
     witnesses: kfd1WitnessMetas.map((meta) => meta.value),
   });
@@ -2101,8 +2008,7 @@ function validateReleaseEvidenceContracts({
     manifestGate: kfdAdopterManifestGate,
     legacyProjection: kfdSupportEvidence,
     passportLegacyProjection: passport?.kfdSupport,
-    expectedAdopterId: optionalString(passport?.product?.repository) || "kungfu-systems/buildchain",
-    expectedSourceRepository: optionalString(passport?.product?.repository), expectedSourceSha: optionalString(passport?.release?.sourceSha),
+    expectedSourceSha: optionalString(passport?.release?.sourceSha),
   })) {
     issues.push(issue("error", entry.code, entry.message, entry.details));
   }
@@ -2113,17 +2019,7 @@ function validateReleaseEvidenceContracts({
   for (const [index, value] of (passport?.githubArtifactAttestations || []).entries()) {
     try {
       const policy = normalizeGitHubArtifactAttestationPolicy(value);
-      const release = passport?.release || {};
-      const acceptedSourceShas = new Set([String(release.sourceSha || "").toLowerCase()]);
-      if (
-        release.treeEquivalent === true
-        && release.builtSourceTreeSha
-        && release.builtSourceTreeSha === release.promotionChannelTreeSha
-        && release.builtSourceSha
-      ) {
-        acceptedSourceShas.add(String(release.builtSourceSha).toLowerCase());
-      }
-      if (!acceptedSourceShas.has(policy.caller.sourceSha)) {
+      if (policy.caller.sourceSha !== String(passport?.release?.sourceSha || "").toLowerCase()) {
         issues.push(issue(
           "error",
           `githubArtifactAttestations[${index}].caller.sourceSha`,
@@ -2521,15 +2417,8 @@ function validatePassportTrustSections({ passport, issues }) {
   ].filter(Boolean));
   for (const [index, entry] of (section.passports || []).entries()) {
     const prefix = `invariantPassports.passports[${index}]`;
-    if (entry.admission?.scope !== "consumer-invariant-coverage" || entry.admission?.result !== "passed") {
-      issues.push(issue("error", `${prefix}.admission`, `${prefix}.admission must record passed consumer invariant coverage`));
-    }
-    if (entry.verdict !== "verified" && !(entry.verdict === "unqualified" && entry.releaseClaims?.verdict === "unqualified")) {
-      issues.push(issue("error", `${prefix}.verdict`, `${prefix}.verdict must be verified or preserve one explicit unqualified releaseClaims verdict`));
-    }
-    if (entry.coverage?.complete !== true && !hasCompleteInvariantCoverage(entry)) {
-      issues.push(issue("error", `${prefix}.coverage`, `${prefix}.coverage must be complete or prove every required invariant coordinate verified`));
-    }
+    if (entry.verdict !== "verified") issues.push(issue("error", `${prefix}.verdict`, `${prefix}.verdict must be verified`));
+    if (entry.coverage?.complete !== true) issues.push(issue("error", `${prefix}.coverage`, `${prefix}.coverage.complete must be true`));
     if (entry.source?.dirty !== false) issues.push(issue("error", `${prefix}.source.dirty`, `${prefix}.source.dirty must be false`));
     if (acceptedSourceShas.size > 0 && !acceptedSourceShas.has(entry.source?.revision)) {
       issues.push(issue("error", `${prefix}.source.revision`, `${prefix}.source.revision must match a release source identity`));