@kungfu-tech/buildchain 3.0.9-alpha.9 → 4.0.0-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (262) hide show
  1. package/AGENTS.md +39 -0
  2. package/README.md +17 -13
  3. package/actions/promote-buildchain-ref/README.md +0 -10
  4. package/actions/release-tail/README.md +6 -10
  5. package/architecture/internal-capabilities.json +502 -0
  6. package/architecture/maintainability-baseline.json +59 -0
  7. package/architecture/maintainability-policy.json +1384 -0
  8. package/architecture/release-tail-contract-inventory.json +587 -0
  9. package/architecture/v3-core-mechanism-inventory.json +1043 -0
  10. package/architecture/v3-core-mechanism-inventory.md +67 -0
  11. package/architecture/v4-adopter-delivery-parity.json +47 -0
  12. package/architecture/v4-architecture-constitution.md +210 -0
  13. package/architecture/v4-bootstrap-authority.json +56 -0
  14. package/architecture/v4-canonical-contract-fixtures.json +105 -0
  15. package/architecture/v4-capability-state-machine-manifest.json +480 -0
  16. package/architecture/v4-capability-state-machine-manifest.schema.json +202 -0
  17. package/architecture/v4-delivery-warrant-shadow-bootstrap-plan.json +830 -0
  18. package/architecture/v4-delivery-warrant-shadow-bootstrap-plan.md +223 -0
  19. package/architecture/v4-delivery-warrant-shadow-bootstrap-plan.schema.json +318 -0
  20. package/architecture/v4-delivery-warrant-shadow-fixtures.json +227 -0
  21. package/architecture/v4-delivery-warrant-shadow-fixtures.schema.json +67 -0
  22. package/architecture/v4-exception-ledger.json +5 -0
  23. package/architecture/v4-exception-ledger.schema.json +56 -0
  24. package/architecture/v4-partial-mutation-recovery-qualification.json +65 -0
  25. package/architecture/v4-platform-stage-checkpoints.json +97 -0
  26. package/architecture/v4-provider-operation-journal-contract.json +113 -0
  27. package/architecture/v4-release-activation-shadow-domain.json +61 -0
  28. package/architecture/v4-release-train-parity.json +68 -0
  29. package/architecture/v4-rust-libnode-bridge-evaluation.json +107 -0
  30. package/architecture/v4-rust-libnode-bridge-spike.md +85 -0
  31. package/architecture/v4-stable-publication-fence.json +66 -0
  32. package/architecture/v4-stage-capsule-contract.json +90 -0
  33. package/architecture/v4-stage-capsule-qualification.json +99 -0
  34. package/architecture/v4-stage-capsule-resume-planner.json +52 -0
  35. package/architecture/v4-stage-capsule-store-contract.json +72 -0
  36. package/bin/buildchain.mjs +15 -10
  37. package/contracts/auditable-demo-scenario-v1.schema.json +1 -1
  38. package/contracts/buildchain-v2-residuals-v1.json +2 -2
  39. package/contracts/fixtures/v4-delivery-warrant-trace-v1/golden.json +158 -0
  40. package/contracts/fixtures/v4-delivery-warrant-trace-v1/property.json +380 -0
  41. package/contracts/fixtures/v4-delivery-warrant-trace-v1/replay.json +163 -0
  42. package/contracts/fixtures/v4-partial-mutation-recovery-v1/shared.json +155 -0
  43. package/contracts/fixtures/v4-provider-operation-journal-v1/shared.json +457 -0
  44. package/contracts/fixtures/v4-provider-readback-idempotency-v1/shared.json +682 -0
  45. package/contracts/fixtures/v4-release-activation-shadow-v1/shared.json +53 -0
  46. package/contracts/fixtures/v4-stable-publication-fence-v1/shared.json +56 -0
  47. package/contracts/fixtures/v4-stage-capsule-resume-v1/late-platform-failure.json +176 -0
  48. package/contracts/fixtures/v4-stage-capsule-store-v1/shared.json +132 -0
  49. package/contracts/fixtures/v4-stage-capsule-v1/shared.json +111 -0
  50. package/contracts/v4-canonical-contracts-v1.schema.json +182 -0
  51. package/contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json +284 -0
  52. package/contracts/v4-delivery-warrant-trace-v1.schema.json +215 -0
  53. package/contracts/v4-host-contract-v1.schema.json +135 -0
  54. package/contracts/v4-partial-mutation-recovery-v1.schema.json +168 -0
  55. package/contracts/v4-provider-operation-journal-v1.schema.json +381 -0
  56. package/contracts/v4-release-activation-shadow-v1.schema.json +186 -0
  57. package/contracts/v4-stable-publication-fence-v1.schema.json +125 -0
  58. package/contracts/v4-stage-capsule-resume-v1.schema.json +225 -0
  59. package/contracts/v4-stage-capsule-store-v1.schema.json +154 -0
  60. package/contracts/v4-stage-capsule-v1.schema.json +178 -0
  61. package/crates/buildchain-v4-bridge/Cargo.lock +213 -0
  62. package/crates/buildchain-v4-bridge/Cargo.toml +12 -0
  63. package/crates/buildchain-v4-bridge/src/main.rs +495 -0
  64. package/dist/site/agent-index.json +0 -4
  65. package/dist/site/artifact-schemas.json +0 -8
  66. package/dist/site/buildchain-contract.json +103 -397
  67. package/dist/site/buildchain-site.json +302 -386
  68. package/dist/site/capability-registry.json +9 -11
  69. package/dist/site/cli-registry.json +8 -53
  70. package/dist/site/controller-registry.json +48 -8
  71. package/dist/site/kfd-claims.json +129 -167
  72. package/dist/site/kfd-upstream-aggregate.json +9 -9
  73. package/dist/site/manual-registry.json +18 -49
  74. package/dist/site/node-api-registry.json +4345 -7345
  75. package/dist/site/page-registry.json +278 -346
  76. package/dist/site/public-surface-audit.json +85 -404
  77. package/dist/site/publication-authority-registry.json +11 -1
  78. package/dist/site/publication-registry.json +4 -4
  79. package/dist/site/release-provenance.json +3 -9
  80. package/dist/site/schemas/kfd-support-projection-v1.schema.json +106 -0
  81. package/dist/site/site-manifest.json +22 -38
  82. package/dist/site/workflow-registry.json +78 -35
  83. package/docs/MAP.md +8 -5
  84. package/docs/auditable-demo.md +2 -2
  85. package/docs/aws-us-elastic-runner-burst-plane.md +7 -59
  86. package/docs/cli-reference.md +15 -213
  87. package/docs/cli.md +14 -14
  88. package/docs/dev-alpha-candidate-patrol.md +3 -11
  89. package/docs/dev-delivery-warrant.md +29 -194
  90. package/docs/engineering-housekeeper.md +12 -4
  91. package/docs/getting-started.md +1 -1
  92. package/docs/install.md +5 -5
  93. package/docs/kfd-support.md +2 -7
  94. package/docs/lifecycle-protocol.md +2 -4
  95. package/docs/node-api-reference.md +414 -554
  96. package/docs/release-flow.md +31 -31
  97. package/docs/release-governance.md +16 -28
  98. package/docs/release-passport.md +2 -15
  99. package/docs/release-tail-contract.md +13 -6
  100. package/docs/release-tail-provider-plane.md +13 -19
  101. package/docs/release-train.md +4 -4
  102. package/docs/reusable-build-surface.md +14 -27
  103. package/docs/site-bundle-contract.md +1 -5
  104. package/docs/stable-candidate-patrol.md +7 -7
  105. package/docs/v4-canonical-contracts.md +92 -0
  106. package/docs/v4-delivery-warrant-read-candidate.md +73 -0
  107. package/docs/v4-delivery-warrant-semantic-diff.md +75 -0
  108. package/docs/v4-production-release.md +63 -0
  109. package/docs/v4-stage-capsule.md +193 -0
  110. package/docs/versioning.md +3 -5
  111. package/package.json +19 -19
  112. package/packages/core/adopter-delivery-gate.js +576 -0
  113. package/packages/core/adopter-delivery-json.js +66 -0
  114. package/packages/core/artifact-signing.js +0 -61
  115. package/packages/core/artifact-verification-envelope.js +5 -5
  116. package/packages/core/build-facts.js +12 -4
  117. package/packages/core/buildchain-agent-manuals.js +0 -2
  118. package/packages/core/buildchain-channel-identity.js +3 -2
  119. package/packages/core/buildchain-config.js +4 -69
  120. package/packages/core/buildchain-contract.js +232 -46
  121. package/packages/core/buildchain-kfd-claims.js +1 -1
  122. package/packages/core/channel-candidate.js +0 -8
  123. package/packages/core/channel-promotion-baseline.js +0 -52
  124. package/packages/core/controller-evidence.js +3 -4
  125. package/packages/core/dev-alpha-candidate-selection.js +2 -10
  126. package/packages/core/dev-delivery-warrant-cancellation.js +0 -1
  127. package/packages/core/dev-delivery-warrant-settlement.js +20 -67
  128. package/packages/core/dev-delivery-warrant.js +50 -138
  129. package/packages/core/diagnostics.js +3 -8
  130. package/packages/core/github-governance-authority.js +3 -1
  131. package/packages/core/kfd-adopter-category-driver.js +167 -0
  132. package/packages/core/kfd-adopter-manifest.js +47 -46
  133. package/packages/core/kfd-gate.js +15 -45
  134. package/packages/core/paper-agent-entry.js +7 -16
  135. package/packages/core/paper-fleet.js +2 -2
  136. package/packages/core/paper-repository.js +2 -3
  137. package/packages/core/paper-scaffold-content.js +2 -23
  138. package/packages/core/paper.js +11 -43
  139. package/packages/core/publication-reproducibility.js +4 -4
  140. package/packages/core/release-line-bootstrap.js +21 -8
  141. package/packages/core/release-passport-contract.js +5 -5
  142. package/packages/core/release-passport.js +20 -131
  143. package/packages/core/self-dogfood-version.js +48 -35
  144. package/packages/core/spawn-command.js +232 -8
  145. package/packages/core/v4-adopter-delivery-parity.js +219 -0
  146. package/packages/core/v4-canonical-contracts.js +284 -0
  147. package/packages/core/v4-delivery-warrant-fixture-runner.js +371 -0
  148. package/packages/core/v4-delivery-warrant-read-candidate.js +279 -0
  149. package/packages/core/v4-delivery-warrant-semantic-diff-gate.js +352 -0
  150. package/packages/core/v4-delivery-warrant-shadow-adapter.js +447 -0
  151. package/packages/core/v4-partial-mutation-recovery-qualification.js +395 -0
  152. package/packages/core/v4-platform-stage-checkpoints.js +471 -0
  153. package/packages/core/v4-provider-operation-journal.js +531 -0
  154. package/packages/core/v4-provider-readback-idempotency.js +394 -0
  155. package/packages/core/v4-release-activation-shadow.js +519 -0
  156. package/packages/core/v4-stable-publication-fence.js +357 -0
  157. package/packages/core/v4-stage-capsule-local-store.js +426 -0
  158. package/packages/core/v4-stage-capsule-qualification-campaign.js +512 -0
  159. package/packages/core/v4-stage-capsule-qualification.js +456 -0
  160. package/packages/core/v4-stage-capsule-resume-planner.js +397 -0
  161. package/packages/core/v4-stage-capsule-store.js +401 -0
  162. package/packages/core/v4-stage-capsule.js +319 -0
  163. package/scripts/assemble-self-publication-admission.mjs +1 -1
  164. package/scripts/audit-publication-control-plane.mjs +5 -5
  165. package/scripts/auditable-demo-bundle-verification.mjs +3 -2
  166. package/scripts/auditable-demo-platform.mjs +2 -2
  167. package/scripts/auditable-demo-renditions.mjs +1 -1
  168. package/scripts/auditable-demo.mjs +2 -2
  169. package/scripts/aws-macos-jit-controller-core.mjs +13 -346
  170. package/scripts/aws-macos-jit-controller-runtime.mjs +2 -210
  171. package/scripts/aws-macos-jit-controller.mjs +37 -275
  172. package/scripts/aws-macos-jit-core.mjs +3 -41
  173. package/scripts/aws-macos-jit.mjs +0 -12
  174. package/scripts/aws-windows-jit-campaign.mjs +2 -2
  175. package/scripts/aws-windows-jit-controller-core.mjs +1 -1
  176. package/scripts/aws-windows-jit-controller.mjs +3 -3
  177. package/scripts/build-contract-core.mjs +3 -8
  178. package/scripts/build-standalone-binary.mjs +3 -14
  179. package/scripts/buildchain-channel-router.mjs +4 -0
  180. package/scripts/buildchain-cli-help.mjs +7 -16
  181. package/scripts/buildchain-contract-lock.mjs +0 -6
  182. package/scripts/check-action-bundles.mjs +3 -4
  183. package/scripts/check-internal-architecture.mjs +7 -6
  184. package/scripts/check-inventory.mjs +30 -25
  185. package/scripts/check-v4-public-dogfood-contract.mjs +270 -0
  186. package/scripts/create-release-bundle.mjs +8 -4
  187. package/scripts/dev-alpha-candidate-patrol.mjs +1 -22
  188. package/scripts/dev-delivery-proof.mjs +2 -64
  189. package/scripts/dev-delivery-warrant.mjs +61 -86
  190. package/scripts/dev-pr-auto-merge.mjs +4 -30
  191. package/scripts/dev-pr-delivery-warrant.mjs +0 -55
  192. package/scripts/dispatch-artifact-signing-authority.mjs +7 -4
  193. package/scripts/generate-buildchain-kfd-witnesses.mjs +94 -88
  194. package/scripts/generate-channel-build-workflow.mjs +54 -24
  195. package/scripts/generate-channel-promotion-workflow.mjs +15 -6
  196. package/scripts/generate-site-bundle.mjs +8 -27
  197. package/scripts/git-fetch-process-tree.mjs +34 -1
  198. package/scripts/init-repo.mjs +64 -159
  199. package/scripts/inspect-artifact-signing-requests.mjs +0 -6
  200. package/scripts/locked-source-checkout.mjs +3 -4
  201. package/scripts/maintainability-metrics.mjs +8 -2
  202. package/scripts/npm-publish-dry-run.mjs +2 -2
  203. package/scripts/npm-publish-transaction.mjs +2 -2
  204. package/scripts/publication-commit-evidence.mjs +23 -69
  205. package/scripts/release-candidate-resolver.mjs +11 -17
  206. package/scripts/release-tail.mjs +3 -49
  207. package/scripts/resume-from-candidate-run.mjs +9 -123
  208. package/scripts/run-lifecycle-core.mjs +12 -13
  209. package/scripts/seal-artifact-signing-requests.mjs +17 -21
  210. package/scripts/site-capability-metadata.mjs +3 -20
  211. package/scripts/stable-candidate-qualification.mjs +10 -10
  212. package/scripts/v4-architecture.mjs +12 -2
  213. package/scripts/v4-bridge-bootstrap.mjs +141 -0
  214. package/scripts/v4-bridge-evidence.mjs +141 -0
  215. package/scripts/v4-host-adapter.mjs +182 -0
  216. package/scripts/v4-platform-stage-checkpoint-rehearsal.mjs +207 -0
  217. package/scripts/v4-stage-capsule-qualification.mjs +528 -0
  218. package/scripts/v4-stage-capsule-resume-rehearsal.mjs +57 -0
  219. package/scripts/v4-warrant-shadow-plan.mjs +601 -0
  220. package/scripts/verify-golden-path.mjs +5 -5
  221. package/scripts/web-surface-cloudfront-rewrite.mjs +15 -15
  222. package/scripts/web-surface-core.mjs +2 -8
  223. package/scripts/workflow-call-contract.mjs +5 -184
  224. package/contracts/dev-delivery-authority-v2.schema.json +0 -253
  225. package/contracts/fixtures/kfd-adopter-release-v1/kfd-4-perspective.json +0 -16
  226. package/contracts/fixtures/kfd-adopter-release-v1/kfd-4-replay.json +0 -57
  227. package/contracts/fixtures/next-development-transition-v1/anchored-manual-waiting.json +0 -47
  228. package/contracts/fixtures/next-development-transition-v1/semver-auto-planned.json +0 -47
  229. package/contracts/fixtures/next-development-transition-v1/version-model-cases.json +0 -40
  230. package/contracts/next-development-request-v1.schema.json +0 -66
  231. package/contracts/next-development-transition-v1.schema.json +0 -292
  232. package/contracts/publication-rehearsal-capsule-v1.schema.json +0 -173
  233. package/dist/site/schemas/dev-delivery-authority-v2.schema.json +0 -442
  234. package/dist/site/schemas/publication-rehearsal-capsule-v1.schema.json +0 -269
  235. package/dist/site/schemas/release-tail-capabilities-v1.schema.json +0 -353
  236. package/dist/site/schemas/release-tail-provider-bindings-v1.schema.json +0 -94
  237. package/docs/dev-delivery-qualification-landing-adr.md +0 -137
  238. package/docs/next-development-transition.md +0 -119
  239. package/docs/publication-rehearsal.md +0 -94
  240. package/packages/core/buildchain-compatibility-proof.js +0 -631
  241. package/packages/core/dev-delivery-authority.js +0 -996
  242. package/packages/core/dev-delivery-native-proof.js +0 -418
  243. package/packages/core/dev-delivery-warrant-shadow.js +0 -502
  244. package/packages/core/next-development-candidate-reservation.js +0 -186
  245. package/packages/core/next-development-controller.js +0 -726
  246. package/packages/core/next-development-projection.js +0 -288
  247. package/packages/core/next-development-transition.js +0 -738
  248. package/packages/core/publication-rehearsal-projection.js +0 -173
  249. package/packages/core/publication-rehearsal-runtime.js +0 -921
  250. package/scripts/aws-macos-jit-instance-rehydrate.mjs +0 -260
  251. package/scripts/aws-macos-jit-source-rebind.mjs +0 -724
  252. package/scripts/dev-delivery-authority.mjs +0 -368
  253. package/scripts/dev-delivery-native-run.mjs +0 -235
  254. package/scripts/dev-delivery-two-phase-resume.mjs +0 -90
  255. package/scripts/dev-delivery-two-phase.mjs +0 -577
  256. package/scripts/generate-next-development-guidance.mjs +0 -49
  257. package/scripts/materialize-self-release-candidate-version.mjs +0 -137
  258. package/scripts/next-development-self-dogfood-harness.mjs +0 -409
  259. package/scripts/next-development-self-dogfood.mjs +0 -532
  260. package/scripts/next-development-transition.mjs +0 -47
  261. package/scripts/release-candidate-tail-reseal.mjs +0 -426
  262. package/templates/native-dev-delivery.yml +0 -86
@@ -49,8 +49,8 @@ function runAws(args, { allowFailure = false } = {}) {
49
49
  return { ok: true, status: result.status, stdout, stderr };
50
50
  }
51
51
 
52
- function runAwsJson(args, options = {}) {
53
- const result = runAws([...args, "--output", "json"], options);
52
+ function runAwsJson(args, options = {}, runAwsCommand = runAws) {
53
+ const result = runAwsCommand([...args, "--output", "json"], options);
54
54
  if (!result.ok) {
55
55
  return { ok: false, data: null, stderr: result.stderr };
56
56
  }
@@ -83,10 +83,10 @@ function writeFunctionCode(tmpDir) {
83
83
  return file;
84
84
  }
85
85
 
86
- function ensureFunction({ name, comment, codeFile }) {
86
+ function ensureFunction({ name, comment, codeFile, runAwsCommand }) {
87
87
  const described = runAwsJson(["cloudfront", "describe-function", "--name", name, "--stage", "DEVELOPMENT"], {
88
88
  allowFailure: true,
89
- });
89
+ }, runAwsCommand);
90
90
  if (!described.ok) {
91
91
  const created = runAwsJson([
92
92
  "cloudfront",
@@ -97,7 +97,7 @@ function ensureFunction({ name, comment, codeFile }) {
97
97
  functionConfig(comment),
98
98
  "--function-code",
99
99
  `fileb://${codeFile}`,
100
- ]);
100
+ ], {}, runAwsCommand);
101
101
  return {
102
102
  etag: created.data?.ETag || "",
103
103
  action: "created",
@@ -118,14 +118,14 @@ function ensureFunction({ name, comment, codeFile }) {
118
118
  functionConfig(comment),
119
119
  "--function-code",
120
120
  `fileb://${codeFile}`,
121
- ]);
121
+ ], {}, runAwsCommand);
122
122
  return {
123
123
  etag: updated.data?.ETag || etag,
124
124
  action: "updated",
125
125
  };
126
126
  }
127
127
 
128
- function publishFunction({ name, etag }) {
128
+ function publishFunction({ name, etag, runAwsCommand }) {
129
129
  if (!etag) {
130
130
  throw new Error(`cloudfront publish-function requires an ETag for ${name}`);
131
131
  }
@@ -136,7 +136,7 @@ function publishFunction({ name, etag }) {
136
136
  name,
137
137
  "--if-match",
138
138
  etag,
139
- ]);
139
+ ], {}, runAwsCommand);
140
140
  const summary = published.data?.FunctionSummary || {};
141
141
  const arn = summary.FunctionMetadata?.FunctionARN || summary.FunctionARN || "";
142
142
  if (!arn) {
@@ -148,10 +148,10 @@ function publishFunction({ name, etag }) {
148
148
  };
149
149
  }
150
150
 
151
- function attachFunction({ distributionId, functionArn }) {
151
+ function attachFunction({ distributionId, functionArn, runAwsCommand }) {
152
152
  let previousViewerRequestFunction;
153
153
  for (let attempt = 1; attempt <= DISTRIBUTION_UPDATE_MAX_ATTEMPTS; attempt += 1) {
154
- const current = runAwsJson(["cloudfront", "get-distribution-config", "--id", distributionId]);
154
+ const current = runAwsJson(["cloudfront", "get-distribution-config", "--id", distributionId], {}, runAwsCommand);
155
155
  const etag = current.data?.ETag || "";
156
156
  const config = current.data?.DistributionConfig;
157
157
  if (!etag || !config) {
@@ -207,7 +207,7 @@ function attachFunction({ distributionId, functionArn }) {
207
207
  "--distribution-config",
208
208
  `file://${configFile}`,
209
209
  ];
210
- updated = runAws(args, { allowFailure: true });
210
+ updated = runAwsCommand(args, { allowFailure: true });
211
211
  } finally {
212
212
  fs.rmSync(tmpDir, { recursive: true, force: true });
213
213
  }
@@ -233,7 +233,7 @@ function attachFunction({ distributionId, functionArn }) {
233
233
  export function ensureCloudFrontDirectoryIndexRewrite({
234
234
  distributionId = "",
235
235
  functionName = "",
236
- comment = "Buildchain web-surface directory index rewrite",
236
+ comment = "Buildchain web-surface directory index rewrite", runAwsCommand = runAws,
237
237
  } = {}) {
238
238
  if (!distributionId) {
239
239
  throw new Error("--distribution-id is required");
@@ -244,9 +244,9 @@ export function ensureCloudFrontDirectoryIndexRewrite({
244
244
  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-cloudfront-function-"));
245
245
  try {
246
246
  const codeFile = writeFunctionCode(tmpDir);
247
- const ensured = ensureFunction({ name: functionName, comment, codeFile });
248
- const published = publishFunction({ name: functionName, etag: ensured.etag });
249
- const attached = attachFunction({ distributionId, functionArn: published.arn });
247
+ const ensured = ensureFunction({ name: functionName, comment, codeFile, runAwsCommand });
248
+ const published = publishFunction({ name: functionName, etag: ensured.etag, runAwsCommand });
249
+ const attached = attachFunction({ distributionId, functionArn: published.arn, runAwsCommand });
250
250
  return {
251
251
  schemaVersion: 1,
252
252
  contract: "kungfu-buildchain-web-surface-cloudfront-directory-index-rewrite",
@@ -1725,13 +1725,12 @@ async function fetchWithRetry(url, {
1725
1725
  attempts = 3,
1726
1726
  intervalMs = 5000,
1727
1727
  shouldRetry = () => false,
1728
- requestOptions = { redirect: "follow" },
1729
1728
  } = {}) {
1730
1729
  const maxAttempts = Math.max(1, Number(attempts) || 1);
1731
1730
  let lastError = null;
1732
1731
  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
1733
1732
  try {
1734
- const response = await fetchImpl(url, requestOptions);
1733
+ const response = await fetchImpl(url, { redirect: "follow" });
1735
1734
  if (attempt >= maxAttempts || !shouldRetry(response)) {
1736
1735
  return { response, attempts: attempt };
1737
1736
  }
@@ -1752,11 +1751,6 @@ function retryableHealthResponse(response) {
1752
1751
  return response.status === 403 || response.status === 404 || response.status >= 500;
1753
1752
  }
1754
1753
 
1755
- function retryingHealthFetch(fetchImpl, attempts, intervalMs) {
1756
- return (url, requestOptions) => fetchWithRetry(url, { fetchImpl, attempts, intervalMs,
1757
- shouldRetry: retryableHealthResponse, requestOptions }).then(({ response }) => response);
1758
- }
1759
-
1760
1754
  const DEFAULT_HEALTH_HTTP_RETRY_ATTEMPTS = 12;
1761
1755
  const DEFAULT_HEALTH_HTTP_RETRY_INTERVAL_MS = 10000;
1762
1756
 
@@ -1990,7 +1984,7 @@ export async function checkWebSurfaceHealth({
1990
1984
  };
1991
1985
  const evidence = await verifyInstallerPublicReadback({
1992
1986
  publication: projected,
1993
- fetchImpl: retryingHealthFetch(fetchImpl, httpRetryAttempts, httpRetryIntervalMs),
1987
+ fetchImpl,
1994
1988
  });
1995
1989
  checks.push({
1996
1990
  surface: "__installer__",
@@ -4,170 +4,13 @@ import path from "node:path";
4
4
  import { execFileSync } from "node:child_process";
5
5
  import { pathToFileURL } from "node:url";
6
6
  import { evaluateWorkflowCallContract } from "../packages/core/workflow-call-contract.js";
7
- import { parseWorkflowDocument } from "../packages/core/workflow-yaml-contract.js";
8
-
9
- export const SELF_RELEASE_REF = "cc6c32845ab5779009aeb48cc34efe65e229fe30";
10
- export const SELF_RELEASE_PUBLIC_WORKFLOW = `kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@${SELF_RELEASE_REF}`;
11
-
12
- function parityFailure(message) {
13
- throw new Error(`self-release route parity: ${message}`);
14
- }
15
-
16
- function literal(job, name) {
17
- const value = job?.with?.[name];
18
- if (!value || value.kind === "expression") {
19
- parityFailure(`${job?.id || "<missing>"}.${name} must be a literal`);
20
- }
21
- return value.value;
22
- }
23
-
24
- export function selfReleaseRouteIdentity(workflowText, jobId = "promote") {
25
- const job = parseWorkflowDocument(workflowText).callJobs.find(
26
- (entry) => entry.id === jobId,
27
- );
28
- if (!job) parityFailure(`reusable workflow job is missing: ${jobId}`);
29
- if (
30
- job.uses.startsWith("./") ||
31
- job.uses.includes("/.release-candidate-promote.yml@")
32
- ) {
33
- parityFailure(
34
- `authoritative caller uses an internal or checkout-relative route: ${job.uses}`,
35
- );
36
- }
37
- if (job.uses !== SELF_RELEASE_PUBLIC_WORKFLOW) {
38
- parityFailure(
39
- `caller uses ${job.uses}, expected ${SELF_RELEASE_PUBLIC_WORKFLOW}`,
40
- );
41
- }
42
- if (literal(job, "buildchain-ref") !== SELF_RELEASE_REF) {
43
- parityFailure("caller runtime ref differs from the public workflow ref");
44
- }
45
- if (literal(job, "declarative-release-tail") !== true) {
46
- parityFailure(
47
- "caller does not require the declarative release-tail provider plane",
48
- );
49
- }
50
- return {
51
- publicWorkflow: job.uses,
52
- runtimeRef: SELF_RELEASE_REF,
53
- declarationContract: "kungfu-buildchain-release-tail-capabilities/v1",
54
- declarationCompiler:
55
- "packages/core/release-tail-provider-plane.js#compileReleaseTailDeclaration",
56
- transaction:
57
- "packages/core/release-tail-provider-plane.js#executeReleaseTailTransaction",
58
- providerAdapter:
59
- "packages/core/release-tail-provider-adapters.js#createGitHubReleaseAssetsAdapter",
60
- receiptValidator:
61
- "packages/core/release-tail-provider-plane.js#validateReleaseTailTransaction",
62
- };
63
- }
64
-
65
- export function assertSelfReleaseRouteParity({
66
- selfWorkflowText,
67
- consumerWorkflowText,
68
- routing,
69
- publicWorkflowText,
70
- advancedWorkflowText,
71
- actionText,
72
- providerPlanText,
73
- } = {}) {
74
- const self = selfReleaseRouteIdentity(selfWorkflowText);
75
- const consumer = selfReleaseRouteIdentity(consumerWorkflowText);
76
- if (JSON.stringify(self) !== JSON.stringify(consumer)) {
77
- parityFailure(
78
- "Buildchain self-release and representative consumer identities differ",
79
- );
80
- }
81
- const alphaShellRef = routing?.alpha?.callRef;
82
- if (alphaShellRef !== "train/v3/v3.0/consumer-equivalent-self-dogfood") {
83
- parityFailure(
84
- "alpha workflow shell does not resolve through the self-dogfood train",
85
- );
86
- }
87
- for (const required of [
88
- "uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@train/v3/v3.0/consumer-equivalent-self-dogfood",
89
- "declarative-release-tail: ${{ inputs.declarative-release-tail }}",
90
- ]) {
91
- if (!publicWorkflowText.includes(required)) {
92
- parityFailure(`public router is missing: ${required}`);
93
- }
94
- }
95
- for (const required of [
96
- "declarative-release-tail:",
97
- "declarative-release-tail: ${{ inputs.declarative-release-tail }}",
98
- "release-tail-transaction-root:",
99
- ]) {
100
- if (!advancedWorkflowText.includes(required)) {
101
- parityFailure(`advanced workflow shell is missing: ${required}`);
102
- }
103
- }
104
- for (const required of [
105
- "executeReleaseTailTransaction",
106
- "createGitHubReleaseAssetsAdapter",
107
- "publishDeclarativeGitHubReleaseEvidence",
108
- ]) {
109
- if (!actionText.includes(required)) {
110
- parityFailure(
111
- `promotion action is missing provider-plane identity: ${required}`,
112
- );
113
- }
114
- }
115
- for (const required of [
116
- "compileReleaseTailDeclaration",
117
- "githubReleaseAssetsTargetRoot",
118
- "createDeclarativeGitHubReleasePlan",
119
- ]) {
120
- if (!providerPlanText.includes(required)) {
121
- parityFailure(`declarative GitHub Release plan is missing: ${required}`);
122
- }
123
- }
124
- return {
125
- schema: "kungfu.buildchain.self-release-route-parity/v1",
126
- ok: true,
127
- self,
128
- consumer,
129
- workflowShellRef: routing.alpha.callRef,
130
- };
131
- }
132
-
133
- export function checkSelfReleaseRouteParity({ root, observed = {} } = {}) {
134
- const read = (relative) => fs.readFileSync(path.join(root, relative), "utf8");
135
- const report = assertSelfReleaseRouteParity({
136
- selfWorkflowText: read(".github/workflows/buildchain-ref-promotion.yml"),
137
- consumerWorkflowText: read(
138
- "tests/fixtures/self-release-route/external-consumer.yml",
139
- ),
140
- routing: JSON.parse(read(".buildchain/promotion-shell-routing.json")),
141
- publicWorkflowText: read(".github/workflows/release-candidate-promote.yml"),
142
- advancedWorkflowText: read(
143
- ".github/workflows/.release-candidate-promote.yml",
144
- ),
145
- actionText: `${read("actions/promote-buildchain-ref/index.js")}\n${read("actions/promote-buildchain-ref/github-release.js")}`,
146
- providerPlanText: read("actions/promote-buildchain-ref/github-release.js"),
147
- });
148
- const rootPattern = /^sha256:[0-9a-f]{64}$/u;
149
- const shaPattern = /^[0-9a-f]{40}$/u;
150
- for (const [name, value] of Object.entries(observed)) {
151
- if (!value) continue;
152
- const valid =
153
- name === "runtimeSha" ? shaPattern.test(value) : rootPattern.test(value);
154
- if (!valid)
155
- parityFailure(`observed ${name} is not an exact rooted identity`);
156
- }
157
- return { ...report, observed };
158
- }
159
7
 
160
8
  function usage() {
161
- return `usage:
162
- node scripts/workflow-call-contract.mjs check \\
9
+ return `usage: node scripts/workflow-call-contract.mjs check \\
163
10
  --caller-workflow <path> --job <id> --caller-repository <owner/repo> \\
164
11
  --callee-root <checkout> --callee-workflow <path> --callee-repository <owner/repo> \\
165
12
  --trusted-event <event[:type]> [--trusted-event ...] \\
166
- [--expected-contract-root sha256:...] [--allow-dirty] [--output <path>]
167
- node scripts/workflow-call-contract.mjs self-release-parity \\
168
- [--root <checkout>] [--runtime-sha <sha>] [--contract-root <root>] \\
169
- [--release-tail-declaration-root <root>] [--release-tail-transaction-root <root>] \\
170
- [--release-tail-state-root <root>] [--output <path>]`;
13
+ [--expected-contract-root sha256:...] [--allow-dirty] [--output <path>]`;
171
14
  }
172
15
 
173
16
  function parseArgs(argv) {
@@ -178,7 +21,7 @@ function parseArgs(argv) {
178
21
  options.allowDirty = true;
179
22
  continue;
180
23
  }
181
- if (!arg.startsWith("--") || index + 1 >= argv.length)
24
+ if (!arg.startsWith("--") || !argv[index + 1])
182
25
  throw new Error(`invalid argument: ${arg}`);
183
26
  const value = argv[index + 1];
184
27
  index += 1;
@@ -224,9 +67,7 @@ export function checkWorkflowCall(options) {
224
67
  "--untracked-files=no",
225
68
  );
226
69
  if (calleeStatus) {
227
- throw new Error(
228
- "callee checkout is dirty; exact pinned-ref bytes are required",
229
- );
70
+ throw new Error("callee checkout is dirty; exact pinned-ref bytes are required");
230
71
  }
231
72
  const callerSha = git(callerRoot, "rev-parse", "HEAD");
232
73
  const callerTree = git(callerRoot, "rev-parse", "HEAD^{tree}");
@@ -262,28 +103,8 @@ export function checkWorkflowCall(options) {
262
103
 
263
104
  function main(argv = process.argv.slice(2)) {
264
105
  const command = argv.shift();
265
- const options = parseArgs(argv);
266
- if (command === "self-release-parity") {
267
- const root = options.root ? path.resolve(options.root) : process.cwd();
268
- const report = checkSelfReleaseRouteParity({
269
- root,
270
- observed: {
271
- runtimeSha: options.runtimeSha || "",
272
- contractRoot: options.contractRoot || "",
273
- releaseTailDeclarationRoot: options.releaseTailDeclarationRoot || "",
274
- releaseTailTransactionRoot: options.releaseTailTransactionRoot || "",
275
- releaseTailStateRoot: options.releaseTailStateRoot || "",
276
- },
277
- });
278
- if (options.output) {
279
- const output = path.resolve(root, options.output);
280
- fs.mkdirSync(path.dirname(output), { recursive: true });
281
- fs.writeFileSync(output, `${JSON.stringify(report, null, 2)}\n`);
282
- }
283
- process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
284
- return;
285
- }
286
106
  if (command !== "check") throw new Error(usage());
107
+ const options = parseArgs(argv);
287
108
  required(options, [
288
109
  "callerWorkflow",
289
110
  "job",
@@ -1,253 +0,0 @@
1
- {
2
- "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "$id": "https://buildchain.libkungfu.dev/schemas/dev-delivery-authority-v2.schema.json",
4
- "title": "Buildchain Dev Delivery Authority State v2",
5
- "description": "Opt-in durable state separating bounded qualification-only leases from one exclusive merge_group Landing Warrant.",
6
- "type": "object",
7
- "additionalProperties": false,
8
- "required": [
9
- "schemaVersion",
10
- "contract",
11
- "authorityMode",
12
- "repository",
13
- "protectedBase",
14
- "generation",
15
- "qualificationCounter",
16
- "landingCounter",
17
- "policy",
18
- "qualificationLeases",
19
- "landingWarrant",
20
- "candidates",
21
- "migration",
22
- "updatedAt",
23
- "stateRoot"
24
- ],
25
- "properties": {
26
- "schemaVersion": { "const": 2 },
27
- "contract": { "const": "kungfu-buildchain-dev-delivery-authority" },
28
- "authorityMode": { "const": "bounded-qualification-landing" },
29
- "repository": {
30
- "type": "string",
31
- "pattern": "^[^/\\s]+/[^/\\s]+$"
32
- },
33
- "protectedBase": {
34
- "type": "string",
35
- "pattern": "^dev/v[0-9]+/v[0-9]+\\.[0-9]+$"
36
- },
37
- "generation": { "type": "integer", "minimum": 0 },
38
- "qualificationCounter": { "type": "integer", "minimum": 0 },
39
- "landingCounter": { "type": "integer", "minimum": 0 },
40
- "policy": {
41
- "type": "object",
42
- "additionalProperties": false,
43
- "required": [
44
- "maxQualificationLeases",
45
- "qualificationLeaseSeconds",
46
- "landingLeaseSeconds"
47
- ],
48
- "properties": {
49
- "maxQualificationLeases": { "type": "integer", "minimum": 1 },
50
- "qualificationLeaseSeconds": { "type": "integer", "minimum": 1 },
51
- "landingLeaseSeconds": { "type": "integer", "minimum": 1 },
52
- "maxLandingOvertakes": { "type": "integer", "minimum": 0 },
53
- "maxQualificationAttempts": { "type": "integer", "minimum": 1 }
54
- }
55
- },
56
- "qualificationLeases": {
57
- "type": "array",
58
- "items": { "$ref": "#/$defs/qualificationLease" }
59
- },
60
- "landingWarrant": {
61
- "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/landingWarrant" }]
62
- },
63
- "candidates": {
64
- "type": "array",
65
- "items": { "$ref": "#/$defs/candidate" }
66
- },
67
- "migration": {
68
- "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/migration" }]
69
- },
70
- "updatedAt": { "type": "string", "format": "date-time" },
71
- "stateRoot": { "$ref": "#/$defs/root" }
72
- },
73
- "$defs": {
74
- "root": {
75
- "type": "string",
76
- "pattern": "^sha256:[0-9a-f]{64}$"
77
- },
78
- "sha": {
79
- "type": "string",
80
- "pattern": "^[0-9a-f]{40}$"
81
- },
82
- "qualificationLease": {
83
- "type": "object",
84
- "additionalProperties": false,
85
- "required": [
86
- "schema",
87
- "authority",
88
- "mergeGroupAdmission",
89
- "candidateId",
90
- "token",
91
- "generation",
92
- "issuedAt",
93
- "expiresAt"
94
- ],
95
- "properties": {
96
- "schema": {
97
- "const": "kungfu.buildchain.dev-delivery-qualification-lease/v1"
98
- },
99
- "authority": { "const": "qualification-only" },
100
- "mergeGroupAdmission": { "const": false },
101
- "candidateId": { "$ref": "#/$defs/root" },
102
- "token": { "$ref": "#/$defs/root" },
103
- "generation": { "type": "integer", "minimum": 1 },
104
- "issuedAt": { "type": "string", "format": "date-time" },
105
- "heartbeatAt": { "type": "string", "format": "date-time" },
106
- "expiresAt": { "type": "string", "format": "date-time" }
107
- }
108
- },
109
- "landingWarrant": {
110
- "type": "object",
111
- "additionalProperties": false,
112
- "required": [
113
- "schema",
114
- "authority",
115
- "mergeGroupAdmission",
116
- "candidateId",
117
- "token",
118
- "generation",
119
- "issuedAt",
120
- "expiresAt"
121
- ],
122
- "properties": {
123
- "schema": {
124
- "const": "kungfu.buildchain.dev-delivery-landing-warrant/v1"
125
- },
126
- "authority": { "const": "merge-group-admission" },
127
- "mergeGroupAdmission": { "const": true },
128
- "candidateId": { "$ref": "#/$defs/root" },
129
- "token": { "$ref": "#/$defs/root" },
130
- "generation": { "type": "integer", "minimum": 1 },
131
- "issuedAt": { "type": "string", "format": "date-time" },
132
- "heartbeatAt": { "type": "string", "format": "date-time" },
133
- "expiresAt": { "type": "string", "format": "date-time" }
134
- }
135
- },
136
- "qualification": {
137
- "type": "object",
138
- "additionalProperties": false,
139
- "required": ["evidenceRoot", "qualifiedAt"],
140
- "properties": {
141
- "evidenceRoot": { "$ref": "#/$defs/root" },
142
- "qualifiedAt": { "type": "string", "format": "date-time" }
143
- }
144
- },
145
- "terminal": {
146
- "type": "object",
147
- "additionalProperties": false,
148
- "required": ["outcome", "evidenceRoot", "reason", "settledAt"],
149
- "properties": {
150
- "outcome": {
151
- "enum": ["merged", "terminal-failure", "dequeued", "cancelled"]
152
- },
153
- "evidenceRoot": { "$ref": "#/$defs/root" },
154
- "reason": { "type": "string" },
155
- "settledAt": { "type": "string", "format": "date-time" }
156
- }
157
- },
158
- "migration": {
159
- "type": "object",
160
- "additionalProperties": false,
161
- "required": ["schema", "legacyContract", "legacyStateRoot", "migratedAt"],
162
- "properties": {
163
- "schema": {
164
- "const": "kungfu.buildchain.dev-delivery-authority-migration/v1"
165
- },
166
- "legacyContract": {
167
- "const": "kungfu-buildchain-dev-delivery-warrant-queue"
168
- },
169
- "legacyStateRoot": { "$ref": "#/$defs/root" },
170
- "migratedAt": { "type": "string", "format": "date-time" }
171
- }
172
- },
173
- "candidate": {
174
- "type": "object",
175
- "additionalProperties": false,
176
- "required": [
177
- "repository",
178
- "protectedBase",
179
- "pullRequestNumber",
180
- "assignmentRoot",
181
- "initiativeRoot",
182
- "sourceIdentityRoot",
183
- "deliveryClass",
184
- "candidateId",
185
- "sourceHead",
186
- "sourcePatchRoot",
187
- "sourceProofRoot",
188
- "planRoot",
189
- "closureRoot",
190
- "dependencyRoot",
191
- "toolchainRoot",
192
- "enqueuedAt",
193
- "updatedAt",
194
- "status",
195
- "qualification",
196
- "terminal"
197
- ],
198
- "properties": {
199
- "repository": { "type": "string" },
200
- "protectedBase": { "type": "string" },
201
- "pullRequestNumber": { "type": "integer", "minimum": 1 },
202
- "assignmentRoot": { "$ref": "#/$defs/root" },
203
- "initiativeRoot": { "$ref": "#/$defs/root" },
204
- "sourceIdentityRoot": { "$ref": "#/$defs/root" },
205
- "deliveryClass": {
206
- "enum": [
207
- "non-native-fast",
208
- "native-proof-required",
209
- "cross-platform",
210
- "release"
211
- ]
212
- },
213
- "identitySemantics": { "const": "chained-attempt-v2" },
214
- "predecessorCandidateId": { "$ref": "#/$defs/root" },
215
- "candidateId": { "$ref": "#/$defs/root" },
216
- "sourceHead": { "$ref": "#/$defs/sha" },
217
- "sourcePatchRoot": { "$ref": "#/$defs/root" },
218
- "sourceProofRoot": { "$ref": "#/$defs/root" },
219
- "planRoot": { "$ref": "#/$defs/root" },
220
- "closureRoot": { "$ref": "#/$defs/root" },
221
- "dependencyRoot": { "$ref": "#/$defs/root" },
222
- "toolchainRoot": { "$ref": "#/$defs/root" },
223
- "qualificationDomains": {
224
- "type": "array",
225
- "uniqueItems": true,
226
- "items": { "$ref": "#/$defs/root" }
227
- },
228
- "qualificationAttempts": { "type": "integer", "minimum": 0 },
229
- "landingOvertakes": { "type": "integer", "minimum": 0 },
230
- "enqueuedAt": { "type": "string", "format": "date-time" },
231
- "updatedAt": { "type": "string", "format": "date-time" },
232
- "status": {
233
- "enum": [
234
- "queued",
235
- "qualifying",
236
- "qualified",
237
- "landing",
238
- "merged",
239
- "terminal-failure",
240
- "dequeued",
241
- "cancelled"
242
- ]
243
- },
244
- "qualification": {
245
- "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/qualification" }]
246
- },
247
- "terminal": {
248
- "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/terminal" }]
249
- }
250
- }
251
- }
252
- }
253
- }
@@ -1,16 +0,0 @@
1
- {
2
- "schemaVersion": 1,
3
- "contract": "kfd-4-observer-perspective",
4
- "standard": "kfd-4",
5
- "id": "buildchain-release-maintainer-view",
6
- "observer": { "id": "buildchain-release-maintainer", "kind": "human" },
7
- "acceptedFacts": [
8
- { "sourceId": "kungfu-systems/buildchain@{{SOURCE_SHA}}", "sourceKind": "repository" }
9
- ],
10
- "projectionPolicy": {
11
- "policyVersion": "1",
12
- "causalDominance": true,
13
- "tieBreaker": "source-coordinate"
14
- },
15
- "verification": { "result": "pass" }
16
- }