@kungfu-tech/buildchain 3.0.9-alpha.9 → 4.0.0-alpha.0

package/scripts/dev-delivery-proof.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import path from "node:path";
-import { classifyDevDeliveryDelta, createIntegrationDeliveryProof, createNativeProofReuseDecision, createNativeQualificationProof, createProjectCutReplayPlan, createProjectCutReplayProof, createSourceQualificationProof, verifyIntegrationDeliveryProof, verifyNativeProofReuseDecision, verifyNativeQualificationProof, verifyProjectCutReplayProof, verifySourceQualificationProof } from "../packages/core/dev-delivery-warrant.js";
+import { classifyDevDeliveryDelta, createIntegrationDeliveryProof, createProjectCutReplayPlan, createProjectCutReplayProof, createSourceQualificationProof, verifyIntegrationDeliveryProof, verifyProjectCutReplayProof, verifySourceQualificationProof } from "../packages/core/dev-delivery-warrant.js";
 
 function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
@@ -49,11 +49,9 @@ export function devDeliveryProofCliOptions(args = [], environment = process.env)
     closureRoot: flag(rest, "closure-root", environment.BUILDCHAIN_DEV_DELIVERY_CLOSURE_ROOT),
     dependencyRoot: flag(rest, "dependency-root", environment.BUILDCHAIN_DEV_DELIVERY_DEPENDENCY_ROOT),
     toolchainRoot: flag(rest, "toolchain-root", environment.BUILDCHAIN_DEV_DELIVERY_TOOLCHAIN_ROOT),
-    environmentRoot: flag(rest, "environment-root", environment.BUILDCHAIN_DEV_DELIVERY_ENVIRONMENT_ROOT),
     affectedPaths: flag(rest, "affected-paths-json", environment.BUILDCHAIN_DEV_DELIVERY_AFFECTED_PATHS || "[]"),
     shardEvidenceRoots: flag(rest, "shard-evidence-roots-json", environment.BUILDCHAIN_DEV_DELIVERY_SHARD_EVIDENCE_ROOTS || "[]"),
     qualifiedAt: flag(rest, "qualified-at", environment.BUILDCHAIN_DEV_DELIVERY_QUALIFIED_AT),
-    qualifiedBase: flag(rest, "qualified-base", environment.BUILDCHAIN_DEV_DELIVERY_QUALIFIED_BASE),
     sourceProofPath: flag(rest, "source-proof", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PROOF),
     sourceProofRoot: flag(rest, "source-proof-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PROOF_ROOT),
     warrantResultPath: flag(rest, "warrant-result", environment.BUILDCHAIN_DEV_DELIVERY_WARRANT_RESULT),
@@ -68,8 +66,6 @@ export function devDeliveryProofCliOptions(args = [], environment = process.env)
     pullRequestNumber: flag(rest, "pull-request", environment.BUILDCHAIN_DEV_DELIVERY_PR_NUMBER),
     changedPaths: flag(rest, "changed-paths-json", environment.BUILDCHAIN_DEV_DELIVERY_CHANGED_PATHS || "[]"),
     graphKnown: boolean(flag(rest, "graph-known", environment.BUILDCHAIN_DEV_DELIVERY_GRAPH_KNOWN), false),
-    attributionComplete: boolean(flag(rest, "attribution-complete", environment.BUILDCHAIN_DEV_DELIVERY_ATTRIBUTION_COMPLETE), false),
-    renames: flag(rest, "renames-json", environment.BUILDCHAIN_DEV_DELIVERY_RENAMES || "[]"),
     outputPath: flag(rest, "output", environment.BUILDCHAIN_DEV_DELIVERY_PROOF_OUTPUT || ".buildchain/dev-delivery/proof.json"),
     json: hasFlag(rest, "json"),
   };
@@ -121,64 +117,6 @@ export function runDevDeliveryProofCommand(options) {
       },
     });
   }
-  if (options.command === "native") {
-    return createNativeQualificationProof({
-      repository: options.repository,
-      protectedBase: options.protectedBase,
-      sourceIdentityRoot: options.sourceIdentityRoot,
-      sourcePatchRoot: options.sourcePatchRoot,
-      planRoot: options.planRoot,
-      closureRoot: options.closureRoot,
-      dependencyRoot: options.dependencyRoot,
-      toolchainRoot: options.toolchainRoot,
-      environmentRoot: options.environmentRoot,
-      qualifiedBase: options.qualifiedBase,
-      affectedPaths: jsonList(options.affectedPaths, "affected paths"),
-      shardEvidenceRoots: jsonList(options.shardEvidenceRoots, "shard evidence roots", { required: true }),
-      qualifiedAt: options.qualifiedAt,
-    });
-  }
-  if (options.command === "verify-native") {
-    return verifyNativeQualificationProof(jsonFile(options.sourceProofPath, "native proof"));
-  }
-  if (options.command === "classify-native") {
-    return createNativeProofReuseDecision({
-      proof: jsonFile(options.sourceProofPath, "native proof"),
-      current: {
-        sourceIdentityRoot: options.sourceIdentityRoot,
-        sourcePatchRoot: options.sourcePatchRoot,
-        planRoot: options.planRoot,
-        closureRoot: options.closureRoot,
-        dependencyRoot: options.dependencyRoot,
-        toolchainRoot: options.toolchainRoot,
-        environmentRoot: options.environmentRoot,
-        currentBase: options.currentBase,
-        graphKnown: options.graphKnown,
-        attributionComplete: options.attributionComplete,
-        changedPaths: jsonList(options.changedPaths, "changed paths"),
-        renames: jsonList(options.renames, "renames"),
-      },
-    });
-  }
-  if (options.command === "verify-native-reuse") {
-    return verifyNativeProofReuseDecision(jsonFile(options.qualificationReceiptPath, "native reuse decision"), {
-      proof: jsonFile(options.sourceProofPath, "native proof"),
-      current: {
-        sourceIdentityRoot: options.sourceIdentityRoot,
-        sourcePatchRoot: options.sourcePatchRoot,
-        planRoot: options.planRoot,
-        closureRoot: options.closureRoot,
-        dependencyRoot: options.dependencyRoot,
-        toolchainRoot: options.toolchainRoot,
-        environmentRoot: options.environmentRoot,
-        currentBase: options.currentBase,
-        graphKnown: options.graphKnown,
-        attributionComplete: options.attributionComplete,
-        changedPaths: jsonList(options.changedPaths, "changed paths"),
-        renames: jsonList(options.renames, "renames"),
-      },
-    });
-  }
   if (options.command === "replay") {
     return createProjectCutReplayPlan({
       repository: options.repository,
@@ -230,7 +168,7 @@ export function runDevDeliveryProofCommand(options) {
 }
 
 function usage() {
-  return "Usage:\n  buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|replay-proof|verify-replay|integration|verify-integration> [options] [--output FILE] [--json]\n";
+  return "Usage:\n  buildchain dev proof <source|verify-source|classify|replay|replay-proof|verify-replay|integration|verify-integration> [options] [--output FILE] [--json]\n";
 }
 
 async function main() {

package/scripts/dev-delivery-warrant.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import path from "node:path";
-import { cancelQueuedDevDeliveryCandidate, closeDevDeliveryWarrant, createDevDeliveryQueue, heartbeatDevDeliveryWarrant, observeDevDeliveryQueue, qualifyDevDeliveryWarrant, recoverExpiredDevDeliveryWarrant, selectDevDeliveryWarrant, settleDevDeliveryTerminalEvent, submitDevDeliveryCandidate } from "../packages/core/dev-delivery-warrant.js";
-import { planDevDeliveryWarrantShadow, qualifyDevDeliveryWarrantShadow } from "../packages/core/dev-delivery-warrant-shadow.js";
+import { cancelQueuedDevDeliveryCandidate, closeDevDeliveryWarrant, createDevDeliveryQueue, heartbeatDevDeliveryWarrant, observeDevDeliveryQueue, recoverExpiredDevDeliveryWarrant, selectDevDeliveryWarrant, settleDevDeliveryTerminalEvent, submitDevDeliveryCandidate } from "../packages/core/dev-delivery-warrant.js";
+import { runV4DeliveryWarrantReadCandidate } from "../packages/core/v4-delivery-warrant-read-candidate.js";
 
 const STATE_PATH = "queue.json";
 const STATE_REF_PREFIX = "buildchain/dev-delivery-warrant/";
@@ -73,14 +73,13 @@ function decodeBlob(blob) {
 }
 
 export class GitHubDevDeliveryStore {
-  constructor({ repository, token, apiUrl = "https://api.github.com", fetchImpl = globalThis.fetch, createInitialState = createDevDeliveryQueue } = {}) {
+  constructor({ repository, token, apiUrl = "https://api.github.com", fetchImpl = globalThis.fetch } = {}) {
     this.repository = normalizeRepository(repository);
     if (!fetchImpl) throw new Error("fetch is required");
     if (!token) throw new Error("GITHUB_TOKEN is required for the GitHub dev delivery store");
     this.token = token;
     this.apiUrl = apiUrl.replace(/\/+$/, "");
     this.fetch = fetchImpl;
-    this.createInitialState = createInitialState;
   }
 
   async request(method, requestPath, body) {
@@ -114,7 +113,7 @@ export class GitHubDevDeliveryStore {
       return {
         exists: false,
         commitSha: "",
-        queue: this.createInitialState({
+        queue: createDevDeliveryQueue({
           repository: this.repository.fullName,
           protectedBase,
           now,
@@ -175,22 +174,6 @@ function warrantIdentity(queue, options) {
   return { candidateId: active.candidateId, fencingToken, generation };
 }
 
-function jsonFile(file, label) {
-  if (!file) throw new Error(`${label} is required`);
-  return JSON.parse(fs.readFileSync(file, "utf8"));
-}
-
-function jsonList(value, label) {
-  let parsed;
-  try {
-    parsed = JSON.parse(value || "[]");
-  } catch (cause) {
-    throw new Error(`${label} must be a JSON array: ${cause.message}`);
-  }
-  if (!Array.isArray(parsed)) throw new Error(`${label} must be a JSON array`);
-  return parsed;
-}
-
 function transitionFor(command, queue, options) {
   if (command === "submit") {
     return submitDevDeliveryCandidate(
@@ -207,9 +190,6 @@ function transitionFor(command, queue, options) {
         closureRoot: exactRoot(options.closureRoot, "closureRoot"),
         dependencyRoot: exactRoot(options.dependencyRoot, "dependencyRoot"),
         toolchainRoot: exactRoot(options.toolchainRoot, "toolchainRoot"),
-        ...(options.environmentRoot ? { environmentRoot: exactRoot(options.environmentRoot, "environmentRoot") } : {}),
-        affectedPaths: jsonList(options.affectedPaths, "affected paths"),
-        sourceWorkflowRunId: options.sourceWorkflowRunId ? positiveInteger(options.sourceWorkflowRunId, "sourceWorkflowRunId") : 0,
         deliveryClass: options.deliveryClass,
         priority: options.priority || "ordinary",
       },
@@ -228,20 +208,6 @@ function transitionFor(command, queue, options) {
       leaseSeconds: options.leaseSeconds,
     });
   }
-  if (command === "qualify") {
-    return qualifyDevDeliveryWarrant(queue, warrantIdentity(queue, options), {
-      nativeProof: jsonFile(options.nativeProofPath, "native proof"),
-      reuseDecision: jsonFile(options.nativeReuseDecisionPath, "native reuse decision"),
-      current: {
-        currentBase: options.currentBase,
-        graphKnown: options.graphKnown,
-        attributionComplete: options.attributionComplete,
-        changedPaths: jsonList(options.changedPaths, "changed paths"),
-        renames: jsonList(options.renames, "renames"),
-      },
-      now: options.now,
-    });
-  }
   if (command === "recover") return recoverExpiredDevDeliveryWarrant(queue, { now: options.now });
   if (command === "close") {
     return closeDevDeliveryWarrant(queue, warrantIdentity(queue, options), {
@@ -286,6 +252,50 @@ function transitionFor(command, queue, options) {
   throw new Error(`unsupported dev delivery command ${command || "<empty>"}`);
 }
 
+async function observeQueue(loaded, options) {
+  const readMode = text(options.readMode || "v3").toLowerCase();
+  if (!["v3", "v4"].includes(readMode)) throw new Error("readMode must be v3 or v4");
+  let observation = observeDevDeliveryQueue(loaded.queue, { now: options.now });
+  let readCandidate;
+  if (readMode === "v4") {
+    const qualification = options.readQualification || JSON.parse(fs.readFileSync(options.readQualificationPath, "utf8"));
+    const retain =
+      options.retainReadEvidence ||
+      (async (evidence) => {
+        if (!options.readEvidenceOutput) throw new Error("readEvidenceOutput is required");
+        fs.mkdirSync(path.dirname(options.readEvidenceOutput), { recursive: true });
+        fs.writeFileSync(options.readEvidenceOutput, `${JSON.stringify(evidence, null, 2)}\n`);
+        return { receiptRoot: evidence.evidenceRoot };
+      });
+    readCandidate = await runV4DeliveryWarrantReadCandidate(loaded.queue, {
+      qualification,
+      expectedQualificationRoot: options.readQualificationRoot,
+      expectedSources: {
+        typescriptRevision: options.readTypescriptRevision,
+        rustRevision: options.readRustRevision,
+        validatorVersion: options.readValidatorVersion,
+      },
+      observedAt: options.now,
+      timeoutMs: positiveInteger(options.readTimeoutMs, "readTimeoutMs", 5_000),
+      signal: options.readSignal,
+      invokeRust: options.invokeV4ReadHost,
+      host: options.readHost,
+      retain,
+    });
+    observation = readCandidate.observation;
+  }
+  return {
+    schema: "kungfu.buildchain.dev-delivery-command-result/v1",
+    ok: true,
+    mode: "observe",
+    readMode,
+    stateRef: options.stateRef,
+    stateCommit: loaded.commitSha,
+    observation,
+    ...(readCandidate ? { readCandidate } : {}),
+  };
+}
+
 export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
   const options = {
     ...optionsInput,
@@ -310,16 +320,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
   if (options.expectedOldStateRoot && loaded.queue.stateRoot !== options.expectedOldStateRoot) {
     throw new Error(`expected-old state drift: ${loaded.queue.stateRoot} != ${options.expectedOldStateRoot}`);
   }
-  if (options.command === "observe") {
-    return {
-      schema: "kungfu.buildchain.dev-delivery-command-result/v1",
-      ok: true,
-      mode: "observe",
-      stateRef: options.stateRef,
-      stateCommit: loaded.commitSha,
-      observation: observeDevDeliveryQueue(loaded.queue, { now: options.now }),
-    };
-  }
+  if (options.command === "observe") return observeQueue(loaded, options);
   const initialLoaded = loaded;
   let changed = transitionFor(options.command, loaded.queue, options);
   let mutates = changed.queue.stateRoot !== loaded.queue.stateRoot;
@@ -380,23 +381,6 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
   };
 }
 
-export function runDevDeliveryShadowCommand(options = {}) {
-  if (bool(options.execute, false)) {
-    throw new Error("shadow qualification is effect-disabled and rejects --execute");
-  }
-  if (!options.inputPath) throw new Error("shadow qualification requires --input FILE");
-  const input = JSON.parse(fs.readFileSync(options.inputPath, "utf8"));
-  if (options.command === "shadow-plan") {
-    return planDevDeliveryWarrantShadow(input, {
-      maxConcurrency: positiveInteger(options.maxConcurrency, "maxConcurrency", 2),
-    });
-  }
-  if (options.command === "shadow-qualify") {
-    return qualifyDevDeliveryWarrantShadow(input);
-  }
-  throw new Error(`unsupported shadow command ${options.command || "<empty>"}`);
-}
-
 function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
   return index === -1 ? fallback : args[index + 1] || "";
@@ -424,19 +408,10 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
     sourceIdentityRoot: flag(rest, "source-identity-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_IDENTITY_ROOT),
     sourcePatchRoot: flag(rest, "source-patch-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PATCH_ROOT),
     sourceProofRoot: flag(rest, "source-proof-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PROOF_ROOT),
-    affectedPaths: flag(rest, "affected-paths-json", environment.BUILDCHAIN_DEV_DELIVERY_AFFECTED_PATHS || "[]"),
-    nativeProofPath: flag(rest, "native-proof", environment.BUILDCHAIN_DEV_DELIVERY_NATIVE_PROOF),
-    nativeReuseDecisionPath: flag(rest, "native-reuse-decision", environment.BUILDCHAIN_DEV_DELIVERY_NATIVE_REUSE_DECISION),
-    currentBase: flag(rest, "current-base", environment.BUILDCHAIN_DEV_DELIVERY_CURRENT_BASE),
-    changedPaths: flag(rest, "changed-paths-json", environment.BUILDCHAIN_DEV_DELIVERY_CHANGED_PATHS || "[]"),
-    graphKnown: ["1", "true", "yes", "on"].includes(flag(rest, "graph-known", environment.BUILDCHAIN_DEV_DELIVERY_GRAPH_KNOWN).trim().toLowerCase()),
-    attributionComplete: ["1", "true", "yes", "on"].includes(flag(rest, "attribution-complete", environment.BUILDCHAIN_DEV_DELIVERY_ATTRIBUTION_COMPLETE).trim().toLowerCase()),
-    renames: flag(rest, "renames-json", environment.BUILDCHAIN_DEV_DELIVERY_RENAMES || "[]"),
     planRoot: flag(rest, "plan-root", environment.BUILDCHAIN_DEV_DELIVERY_PLAN_ROOT),
     closureRoot: flag(rest, "closure-root", environment.BUILDCHAIN_DEV_DELIVERY_CLOSURE_ROOT),
     dependencyRoot: flag(rest, "dependency-root", environment.BUILDCHAIN_DEV_DELIVERY_DEPENDENCY_ROOT),
     toolchainRoot: flag(rest, "toolchain-root", environment.BUILDCHAIN_DEV_DELIVERY_TOOLCHAIN_ROOT),
-    environmentRoot: flag(rest, "environment-root", environment.BUILDCHAIN_DEV_DELIVERY_ENVIRONMENT_ROOT),
     deliveryClass: flag(rest, "delivery-class", environment.BUILDCHAIN_DEV_DELIVERY_CLASS),
     priority: flag(rest, "priority", environment.BUILDCHAIN_DEV_DELIVERY_PRIORITY || "ordinary"),
     fencingToken: flag(rest, "fencing-token", environment.BUILDCHAIN_DEV_DELIVERY_FENCING_TOKEN),
@@ -446,9 +421,15 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
     eventAction: flag(rest, "event-action", environment.BUILDCHAIN_DEV_DELIVERY_EVENT_ACTION),
     evidenceRoot: flag(rest, "evidence-root", environment.BUILDCHAIN_DEV_DELIVERY_EVIDENCE_ROOT),
     reason: flag(rest, "reason", environment.BUILDCHAIN_DEV_DELIVERY_REASON),
+    readMode: flag(rest, "read-mode", environment.BUILDCHAIN_V4_WARRANT_READ_MODE || "v3"),
+    readQualificationPath: flag(rest, "read-qualification", environment.BUILDCHAIN_V4_WARRANT_READ_QUALIFICATION),
+    readQualificationRoot: flag(rest, "read-qualification-root", environment.BUILDCHAIN_V4_WARRANT_READ_QUALIFICATION_ROOT),
+    readTypescriptRevision: flag(rest, "read-typescript-revision", environment.BUILDCHAIN_V4_WARRANT_TYPESCRIPT_REVISION),
+    readRustRevision: flag(rest, "read-rust-revision", environment.BUILDCHAIN_V4_WARRANT_RUST_REVISION),
+    readValidatorVersion: flag(rest, "read-validator-version", environment.BUILDCHAIN_V4_WARRANT_VALIDATOR_VERSION),
+    readTimeoutMs: flag(rest, "read-timeout-ms", environment.BUILDCHAIN_V4_WARRANT_READ_TIMEOUT_MS || "5000"),
+    readEvidenceOutput: flag(rest, "read-evidence-output", environment.BUILDCHAIN_V4_WARRANT_READ_EVIDENCE || ".buildchain/dev-delivery/v4-read-evidence.json"),
     now: flag(rest, "now", environment.BUILDCHAIN_DEV_DELIVERY_NOW),
-    inputPath: flag(rest, "input", environment.BUILDCHAIN_DEV_DELIVERY_SHADOW_INPUT),
-    maxConcurrency: flag(rest, "max-concurrency", environment.BUILDCHAIN_DEV_DELIVERY_SHADOW_MAX_CONCURRENCY || "2"),
     outputPath: flag(rest, "output", environment.BUILDCHAIN_DEV_DELIVERY_OUTPUT || ".buildchain/dev-delivery/result.json"),
     execute: hasFlag(rest, "execute"),
     json: hasFlag(rest, "json"),
@@ -456,7 +437,7 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
 }
 
 function usage() {
-  return "Usage:\n  buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|settle|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n  buildchain dev warrant <shadow-plan|shadow-qualify> --input FILE [--max-concurrency 1|2] [--output FILE] [--json]\n";
+  return "Usage:\n  buildchain dev warrant <submit|select|heartbeat|recover|close|settle|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n\nRead candidate:\n  observe --read-mode v4 --read-qualification FILE --read-qualification-root sha256:... --read-typescript-revision SHA --read-rust-revision SHA --read-validator-version TOKEN [--read-evidence-output FILE]\n";
 }
 
 async function main() {
@@ -466,22 +447,16 @@ async function main() {
     return;
   }
   const options = devDeliveryCliOptions(args);
-  if (!["submit", "select", "heartbeat", "qualify", "recover", "close", "settle", "cancel-queued", "observe", "shadow-plan", "shadow-qualify"].includes(options.command)) {
+  if (!["submit", "select", "heartbeat", "recover", "close", "settle", "cancel-queued", "observe"].includes(options.command)) {
     throw new Error(usage().trim());
   }
-  const shadow = options.command.startsWith("shadow-");
-  const result = shadow ? runDevDeliveryShadowCommand(options) : await runDevDeliveryCommand(options);
+  const result = await runDevDeliveryCommand(options);
   fs.mkdirSync(path.dirname(options.outputPath), { recursive: true });
   fs.writeFileSync(options.outputPath, `${JSON.stringify(result, null, 2)}\n`);
   if (options.json) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
   else {
     process.stdout.write(`Buildchain dev delivery ${options.command}: ${result.receipt?.reason || result.mode}\n`);
-    if (shadow) {
-      process.stdout.write(`Decision: ${result.decision}\n`);
-      process.stdout.write(`Evidence root: ${result.planRoot || result.qualificationRoot}\n`);
-    } else {
-      process.stdout.write(`State root: ${result.after?.stateRoot || result.observation.stateRoot}\n`);
-    }
+    process.stdout.write(`State root: ${result.after?.stateRoot || result.observation.stateRoot}\n`);
     if (result.receiptRoot) process.stdout.write(`Receipt root: ${result.receiptRoot}\n`);
     process.stdout.write(`Result: ${options.outputPath}\n`);
   }

package/scripts/dev-pr-auto-merge.mjs

@@ -4,7 +4,7 @@ import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { verifyProjectCutReplayProof } from "../packages/core/dev-delivery-warrant.js";
-import { admitExistingQueueEntry, createDevPrAdmissionReceipt, enqueueAfterStatusPropagation, readDeliveryWarrantResult, runSourceQualification, runTargetedQueueAdmission, verifyCurrentDeliveryWarrant } from "./dev-pr-delivery-warrant.mjs";
+import { admitExistingQueueEntry, createDevPrAdmissionReceipt, readDeliveryWarrantResult, runSourceQualification, runTargetedQueueAdmission } from "./dev-pr-delivery-warrant.mjs";
 const DEFAULT_BLOCK_LABELS = ["blocked", "do-not-merge", "work-in-progress"];
 const DEFAULT_ALLOWED_HEAD_PREFIXES = ["feature/", "fix/", "chore/", "docs/", "ci/", "refactor/"];
 const DEFAULT_REQUIRED_CHECKS = ["check"];
@@ -70,7 +70,6 @@ function normalizeOptions(options = {}) {
     allowedHeadPrefixes: splitList(options.allowedHeadPrefixes, DEFAULT_ALLOWED_HEAD_PREFIXES),
     requiredChecks: splitList(options.requiredChecks, DEFAULT_REQUIRED_CHECKS),
     queueAdmissionContext: String(options.queueAdmissionContext || "").trim(),
-    activeLeaseContext: String(options.activeLeaseContext || "").trim(),
     requireApproval: boolOption(options.requireApproval, true),
     sameRepositoryOnly: boolOption(options.sameRepositoryOnly, true),
     maxMerges: intOption(options.maxMerges, 1),
@@ -219,20 +218,6 @@ async function setQueueAdmissionStatus(client, repository, sha, context, state)
   return { context, state, sha };
 }
 
-async function setActiveLeaseStatus(client, repository, sha, context, state) {
-  if (!context) return null;
-  await client.request("POST", `/repos/${repository.owner}/${repository.repo}/statuses/${sha}`, {
-    body: {
-      state,
-      context,
-      description: state === "pending"
-        ? "Buildchain reactivated this exact lease for merge-group qualification"
-        : "Buildchain released this exact lease after queue admission failed",
-    },
-  });
-  return { context, state, sha };
-}
-
 function skip(reason, details = {}) {
   return { action: "skip", reason, ...details };
 }
@@ -868,15 +853,11 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
   let warrant = null;
   try {
     warrant = readDeliveryWarrantResult(options, pr);
-    await verifyCurrentDeliveryWarrant(client, options, pr, warrant);
   } catch (error) {
     return reject("blocked", error.code || "invalid-delivery-warrant");
   }
   const matchingEntry = initialQueue.entries.find((entry) =>
     entry.pullRequestNumber === pr.number && entry.pullRequestHeadSha === options.expectedHeadSha);
-  if (matchingEntry && !options.dryRun) {
-    await setActiveLeaseStatus(client, options.repository, options.expectedHeadSha, options.activeLeaseContext, "pending");
-  }
   const existing = await admitExistingQueueEntry({
     options, pullRequest: pr, readiness, client, entry: matchingEntry, warrant,
     createReceipt: createAdmissionReceipt,
@@ -912,7 +893,6 @@ async function reconcileEnqueueError({ client, options, pr, expectedHeadSha, ent
   const exactEntry = queueReadback?.entries?.find((candidate) =>
     candidate.pullRequestNumber === pr.number && candidate.pullRequestHeadSha === expectedHeadSha);
   if (exactEntry) {
-    entry.activeLeaseStatus = await setActiveLeaseStatus(client, options.repository, expectedHeadSha, options.activeLeaseContext, "pending");
     entry.action = "enqueued";
     entry.reason = "already-enqueued-exact-head";
     entry.queueEntry = exactEntry;
@@ -922,7 +902,6 @@ async function reconcileEnqueueError({ client, options, pr, expectedHeadSha, ent
     return;
   }
   entry.queueAdmissionStatus = await setQueueAdmissionStatus(client, options.repository, expectedHeadSha, options.queueAdmissionContext, "failure");
-  entry.activeLeaseStatus = await setActiveLeaseStatus(client, options.repository, expectedHeadSha, options.activeLeaseContext, "failure");
   entry.action = "skip";
   entry.reason = "enqueue-rejected";
   entry.enqueueError = {
@@ -1088,14 +1067,10 @@ export async function runDevPrAutoMerge(optionsInput = {}, clientInput) {
           result.skipped.push(entry);
         } else {
           try {
-            entry.activeLeaseStatus = await setActiveLeaseStatus(client, options.repository, expectedHeadSha, options.activeLeaseContext, "pending");
             entry.queueAdmissionStatus = await setQueueAdmissionStatus(client, options.repository, expectedHeadSha, options.queueAdmissionContext, "success");
-            const queueEntry = await enqueueAfterStatusPropagation({
-              enqueue: (input) => client.enqueuePullRequest(input),
-              input: { pullRequestId: decision.pullRequestId, expectedHeadOid: expectedHeadSha },
-              attempts: options.pollMergeableAttempts,
-              delayMs: options.pollMergeableDelayMs,
-              sleep: delay,
+            const queueEntry = await client.enqueuePullRequest({
+              pullRequestId: decision.pullRequestId,
+              expectedHeadOid: expectedHeadSha,
             });
             entry.action = "enqueued";
             entry.reason = "enqueued-with-expected-head";
@@ -1180,7 +1155,6 @@ export function cliOptions(args = [], environment = process.env) {
     allowedHeadPrefixes: cliValue(args, "allowed-head-prefixes", environment.BUILDCHAIN_DEV_PR_ALLOWED_HEAD_PREFIXES),
     requiredChecks: cliValue(args, "required-checks", environment.BUILDCHAIN_DEV_PR_REQUIRED_CHECKS),
     queueAdmissionContext: cliValue(args, "queue-admission-context", environment.BUILDCHAIN_DEV_PR_QUEUE_ADMISSION_CONTEXT),
-    activeLeaseContext: cliValue(args, "active-lease-context", environment.BUILDCHAIN_DEV_PR_ACTIVE_LEASE_CONTEXT),
     diagnosticContext: cliValue(args, "diagnostic-context", environment.BUILDCHAIN_DEV_PR_DIAGNOSTIC_CONTEXT),
     warrantMode: cliValue(args, "warrant-mode", environment.BUILDCHAIN_DEV_PR_WARRANT_MODE),
     warrantResultPath: cliValue(args, "warrant-result", environment.BUILDCHAIN_DEV_PR_WARRANT_RESULT_PATH),

package/scripts/dev-pr-delivery-warrant.mjs

@@ -34,11 +34,6 @@ function exactActiveReadback(result) {
   const warrant = result.observation.activeWarrant;
   const candidate = result.observation.activeCandidate;
   requireMatch(warrant?.schema === "kungfu.buildchain.dev-delivery-warrant/v1", "delivery-warrant-missing");
-  requireMatch((warrant.phase || "qualified") === "qualified", "delivery-warrant-not-qualified");
-  if (warrant.phase === "qualified") {
-    requireMatch(ROOT_PATTERN.test(String(warrant.nativeProofRoot || "")), "delivery-warrant-native-proof-missing");
-    requireMatch(ROOT_PATTERN.test(String(warrant.nativeProofReuseRoot || "")), "delivery-warrant-native-reuse-missing");
-  }
   requireMatch(candidate?.candidateId === warrant.candidateId, "delivery-warrant-candidate-readback-missing");
   requireMatch(!result.warrant || JSON.stringify(result.warrant) === JSON.stringify(warrant), "delivery-warrant-readback-mismatch");
   return { warrant, candidate };
@@ -121,56 +116,6 @@ export function readDeliveryWarrantResult(options, pullRequest) {
   };
 }
 
-export async function readCurrentDeliveryQueueState(client, repository, targetBranch) {
-  if (typeof client.getDevDeliveryQueueState === "function") {
-    return client.getDevDeliveryQueueState(targetBranch);
-  }
-  const stateRef = `buildchain/dev-delivery-warrant/${targetBranch.replaceAll("/", "-")}`;
-  const query = new URLSearchParams({ ref: stateRef });
-  const { data } = await client.request(
-    "GET",
-    `/repos/${repository.owner}/${repository.repo}/contents/queue.json?${query}`,
-  );
-  if (data?.type !== "file" || data?.encoding !== "base64" || !data?.content) {
-    mismatch("delivery-warrant-current-readback-invalid");
-  }
-  return JSON.parse(Buffer.from(String(data.content).replace(/\s+/g, ""), "base64").toString("utf8"));
-}
-
-export async function verifyCurrentDeliveryWarrant(client, options, pullRequest, warrant) {
-  if (!warrant) return;
-  let queue;
-  try {
-    queue = await readCurrentDeliveryQueueState(client, options.repository, options.targetBranch);
-  } catch {
-    mismatch("delivery-warrant-current-readback-failed");
-  }
-  const active = queue?.activeWarrant;
-  const candidate = queue?.candidates?.find((entry) => entry.candidateId === active?.candidateId);
-  requireMatch(active?.candidateId === warrant.candidateId, "delivery-warrant-no-longer-active");
-  requireMatch(active?.fencingToken === warrant.fencingToken, "delivery-warrant-current-fencing-mismatch");
-  requireMatch(Number(active?.generation) === Number(warrant.generation), "delivery-warrant-current-generation-mismatch");
-  requireMatch(Number(active?.pullRequestNumber) === Number(pullRequest.number), "delivery-warrant-current-pr-mismatch");
-  requireMatch(String(active?.sourceHead || "").toLowerCase() === options.expectedHeadSha, "delivery-warrant-current-head-mismatch");
-  requireMatch(["selected", "proving", "waiting", "blocked", "qualified"].includes(candidate?.status), "delivery-warrant-current-candidate-not-selected");
-  requireMatch(candidate?.sourceHead === active.sourceHead, "delivery-warrant-current-candidate-head-mismatch");
-}
-
-export async function enqueueAfterStatusPropagation({ enqueue, input, attempts, delayMs, sleep }) {
-  let lastError;
-  for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    try {
-      return await enqueue(input);
-    } catch (error) {
-      lastError = error;
-      const propagation = /required status(?:es| check).*failing|failing required status|cannot change this locked branch/i.test(String(error?.message || ""));
-      if (!propagation || attempt === attempts) throw error;
-      await sleep(delayMs);
-    }
-  }
-  throw lastError;
-}
-
 export async function runSourceQualification({ options, pullRequest, readiness, client, evaluate, admissionState, createReceipt, root, publishDiagnostic, reject }) {
   const decision = await evaluate(pullRequest, { ...options, landingMode: options.landingMode, dryRun: true }, client);
   if (decision.observedHeadSha && String(decision.observedHeadSha).toLowerCase() !== options.expectedHeadSha) {

package/scripts/dispatch-artifact-signing-authority.mjs

@@ -39,15 +39,18 @@ export async function resolveArtifactSigningAuthorityRuntime({
   const ref = resolveAuthorityDispatchRef(authorityRef);
   const encodedRef = ref.split("/").map(encodeURIComponent).join("/");
   const response = await requestImpl(
-    `/repos/${authorityRepo}/commits/${encodedRef}`,
+    `/repos/${authorityRepo}/git/ref/heads/${encodedRef}`,
     { token: required(token, "Buildchain authority dispatch token") },
   );
-  const sha = String(response?.sha || "");
-  if (!/^[0-9a-f]{40}$/u.test(sha)) {
+  if (response?.object?.type !== "commit") {
     throw new Error(
-      "Buildchain signing authority ref must resolve to an exact commit SHA",
+      "Buildchain signing authority ref does not resolve to a commit",
     );
   }
+  const sha = String(response.object.sha || "");
+  if (!/^[0-9a-f]{40}$/u.test(sha)) {
+    throw new Error("Buildchain signing authority runtime SHA must be exact");
+  }
   return { ref, sha };
 }