@kungfu-tech/buildchain 3.0.9-alpha.9 → 4.0.0-alpha.1

package/scripts/aws-macos-jit-controller.mjs

@@ -6,21 +6,14 @@ import {
   AWS_MACOS_JIT_CONTROLLER_CONTRACT,
   createMacosJitCampaignPlan,
   createMacosJitClosePlan,
-  createMacosJitInstanceRehydratePlan,
   createMacosJitJobPlan,
-  createMacosJitSourceRebindPlan,
   macosAllocateHostsArgs,
   macosReleaseHostsArgs,
   macosRunInstancesArgs,
 } from "./aws-macos-jit-controller-core.mjs";
-import { MACOS_EC2_JIT_REGIONS } from "./aws-macos-jit-core.mjs";
-import { executeMacosJitInstanceRehydrate } from "./aws-macos-jit-instance-rehydrate.mjs";
 import { executeMacosJitJob } from "./aws-macos-jit-job-controller.mjs";
-import { executeMacosJitSourceRebind } from "./aws-macos-jit-source-rebind.mjs";
 import {
   assertDryRun,
-  assertAllowedPolicySimulation,
-  assertMacosBudgetLaunchGate,
   assertOwnership,
   awsArgs,
   awsJson,
@@ -38,21 +31,7 @@ function flag(name) {
   return process.argv.includes(`--${name}`);
 }
 
-function jsonArrayArg(name) {
-  let parsed;
-  try {
-    parsed = JSON.parse(arg(name));
-  } catch {
-    throw new Error(`--${name} must be valid JSON`);
-  }
-  if (!Array.isArray(parsed)) {
-    throw new Error(`--${name} must be a JSON array`);
-  }
-  return parsed;
-}
-
 function assertCampaignLaunchPreflight(plan, profile) {
-  const launchGate = assertMacosBudgetLaunchGate(plan, profile);
   const commit = ghJson(
     ["api", `repos/${plan.repository}/commits/${plan.source.sha}`],
     undefined,
@@ -61,51 +40,43 @@ function assertCampaignLaunchPreflight(plan, profile) {
   if (String(commit.sha || "").toLowerCase() !== plan.source.sha) {
     throw new Error("GitHub did not resolve the exact campaign source SHA");
   }
-  const regionalPlans = Object.keys(MACOS_EC2_JIT_REGIONS).map((region) => ({
-    ...plan,
-    aws: { ...plan.aws, region },
-  }));
-  const activeHosts = regionalPlans.flatMap(
-    (regionalPlan) =>
-      awsJson(
-        regionalPlan,
-        profile,
-        [
-          "ec2",
-          "describe-hosts",
-          "--filter",
-          "Name=tag:kungfu:plane,Values=aws-us-elastic-runner-burst",
-          "Name=tag:kungfu:provider,Values=macos-ec2-jit",
-          "Name=state,Values=available,pending,under-assessment",
-          "--output",
-          "json",
-        ],
-        `active macOS JIT host preflight in ${regionalPlan.aws.region}`,
-      ).Hosts || [],
-  );
-  if (activeHosts.length >= plan.safety.activeHostCeiling) {
-    throw new Error("macOS JIT active Dedicated Host ceiling is reached");
-  }
-  const instances = regionalPlans.flatMap((regionalPlan) => {
-    const active = awsJson(
-      regionalPlan,
+  const activeHosts =
+    awsJson(
+      plan,
       profile,
       [
         "ec2",
-        "describe-instances",
-        "--filters",
+        "describe-hosts",
+        "--filter",
         "Name=tag:kungfu:plane,Values=aws-us-elastic-runner-burst",
         "Name=tag:kungfu:provider,Values=macos-ec2-jit",
-        "Name=instance-state-name,Values=pending,running,stopping,stopped,shutting-down",
+        "Name=state,Values=available,pending,under-assessment",
         "--output",
         "json",
       ],
-      `active macOS JIT instance preflight in ${regionalPlan.aws.region}`,
-    );
-    return (active.Reservations || []).flatMap(
-      (reservation) => reservation.Instances || [],
-    );
-  });
+      "active macOS JIT host preflight",
+    ).Hosts || [];
+  if (activeHosts.length >= plan.safety.activeHostCeiling) {
+    throw new Error("macOS JIT active Dedicated Host ceiling is reached");
+  }
+  const active = awsJson(
+    plan,
+    profile,
+    [
+      "ec2",
+      "describe-instances",
+      "--filters",
+      "Name=tag:kungfu:plane,Values=aws-us-elastic-runner-burst",
+      "Name=tag:kungfu:provider,Values=macos-ec2-jit",
+      "Name=instance-state-name,Values=pending,running,stopping,stopped,shutting-down",
+      "--output",
+      "json",
+    ],
+    "active macOS JIT instance preflight",
+  );
+  const instances = (active.Reservations || []).flatMap(
+    (reservation) => reservation.Instances || [],
+  );
   if (instances.length >= plan.safety.activeInstanceCeiling) {
     throw new Error("macOS JIT active instance ceiling is reached");
   }
@@ -149,7 +120,6 @@ function assertCampaignLaunchPreflight(plan, profile) {
     );
   }
   return {
-    ...launchGate,
     exactCommit: plan.source.sha,
     activeHosts: activeHosts.length,
     activeInstances: instances.length,
@@ -166,11 +136,12 @@ export function executeMacosJitCampaignLaunch(plan, { profile = "" } = {}) {
     throw new Error("macOS JIT campaign launch plan contract is invalid");
   }
   const preflight = assertCampaignLaunchPreflight(plan, profile);
-  const allocationPermission = assertAllowedPolicySimulation(
-    plan,
-    profile,
-    preflight.principalArn,
-    "ec2:AllocateHosts",
+  assertDryRun(
+    commandResult(
+      "aws",
+      awsArgs(plan, profile, macosAllocateHostsArgs(plan, { dryRun: true })),
+    ),
+    "EC2 AllocateHosts DryRun",
   );
   const hostId = awsJson(
     plan,
@@ -252,8 +223,8 @@ export function executeMacosJitCampaignLaunch(plan, { profile = "" } = {}) {
       imageId: instance.ImageId,
       launchTime: new Date(instance.LaunchTime).toISOString(),
     },
-    preflight: { ...preflight, allocationPermission },
-    dryRuns: ["RunInstances:DryRunOperation"],
+    preflight,
+    dryRuns: ["AllocateHosts:DryRunOperation", "RunInstances:DryRunOperation"],
     planDigest: plan.digest,
   };
 }
@@ -491,7 +462,6 @@ export function executeMacosJitCampaignClose(plan, { profile = "" } = {}) {
 function commonValues(execute) {
   return {
     execute,
-    accountId: arg("account-id"),
     repository: arg("repository", "kungfu-systems/kungfu"),
     campaignId: arg("campaign-id"),
     sourceSha: arg("source-sha"),
@@ -508,20 +478,6 @@ function commonValues(execute) {
   };
 }
 
-function confirmHistoricalPreflightFailures(plan) {
-  const confirmed = flag("confirm-historical-preflight-failure-runs-json")
-    ? jsonArrayArg("confirm-historical-preflight-failure-runs-json")
-    : [];
-  if (
-    JSON.stringify(confirmed) !==
-    JSON.stringify(plan.github.historicalPreflightFailureRuns)
-  ) {
-    throw new Error(
-      "--confirm-historical-preflight-failure-runs-json must equal the exact historical preflight failure inventory",
-    );
-  }
-}
-
 function confirm(plan) {
   if (arg("confirm-source-sha") !== plan.source.sha) {
     throw new Error("--confirm-source-sha must equal the exact source SHA");
@@ -529,131 +485,6 @@ function confirm(plan) {
   if (arg("confirm-campaign-id") !== plan.campaign.id) {
     throw new Error("--confirm-campaign-id must equal the campaign id");
   }
-  if (plan.kind === "campaign-source-rebind-plan") {
-    if (arg("confirm-previous-source-sha") !== plan.previousSource.sha) {
-      throw new Error(
-        "--confirm-previous-source-sha must equal previousSourceSha",
-      );
-    }
-    if (arg("confirm-host-id") !== plan.aws.hostId) {
-      throw new Error("--confirm-host-id must equal the exact host id");
-    }
-    if (arg("confirm-instance-id") !== plan.aws.instanceId) {
-      throw new Error("--confirm-instance-id must equal the exact instance id");
-    }
-    if (!flag("confirm-zero-allocation")) {
-      throw new Error("--confirm-zero-allocation is required");
-    }
-    if (plan.github.priorRunPolicy === "terminal-failure") {
-      const confirmed = jsonArrayArg(
-        "confirm-terminal-failure-run-ids-json",
-      ).map(String);
-      if (
-        JSON.stringify(confirmed) !==
-        JSON.stringify(plan.github.terminalFailureRunIds)
-      ) {
-        throw new Error(
-          "--confirm-terminal-failure-run-ids-json must equal the exact failed run inventory",
-        );
-      }
-      const confirmedStartupFailures = flag("confirm-startup-failure-runs-json")
-        ? jsonArrayArg("confirm-startup-failure-runs-json")
-        : [];
-      if (
-        JSON.stringify(confirmedStartupFailures) !==
-        JSON.stringify(plan.github.startupFailureRuns)
-      ) {
-        throw new Error(
-          "--confirm-startup-failure-runs-json must equal the exact startup failure inventory",
-        );
-      }
-      const confirmedHistoricalTerminalFailures = flag(
-        "confirm-historical-terminal-failure-runs-json",
-      )
-        ? jsonArrayArg("confirm-historical-terminal-failure-runs-json")
-        : [];
-      if (
-        JSON.stringify(confirmedHistoricalTerminalFailures) !==
-        JSON.stringify(plan.github.historicalTerminalFailureRuns)
-      ) {
-        throw new Error(
-          "--confirm-historical-terminal-failure-runs-json must equal the exact historical terminal failure inventory",
-        );
-      }
-      const confirmedSuccessfulRuns = flag("confirm-successful-run-ids-json")
-        ? jsonArrayArg("confirm-successful-run-ids-json").map(String)
-        : [];
-      if (
-        JSON.stringify(confirmedSuccessfulRuns) !==
-        JSON.stringify(plan.github.successfulRunIds)
-      ) {
-        throw new Error(
-          "--confirm-successful-run-ids-json must equal the exact successful run inventory",
-        );
-      }
-    } else if (plan.github.priorRunPolicy === "preflight-failure") {
-      const confirmed = jsonArrayArg(
-        "confirm-preflight-failure-run-ids-json",
-      ).map(String);
-      if (
-        JSON.stringify(confirmed) !==
-        JSON.stringify(plan.github.preflightFailureRunIds)
-      ) {
-        throw new Error(
-          "--confirm-preflight-failure-run-ids-json must equal the exact preflight failure inventory",
-        );
-      }
-      const confirmedStartupFailures = flag("confirm-startup-failure-runs-json")
-        ? jsonArrayArg("confirm-startup-failure-runs-json")
-        : [];
-      if (
-        JSON.stringify(confirmedStartupFailures) !==
-        JSON.stringify(plan.github.startupFailureRuns)
-      ) {
-        throw new Error(
-          "--confirm-startup-failure-runs-json must equal the exact startup failure inventory",
-        );
-      }
-      const confirmedHistoricalTerminalFailures = flag(
-        "confirm-historical-terminal-failure-runs-json",
-      )
-        ? jsonArrayArg("confirm-historical-terminal-failure-runs-json")
-        : [];
-      if (
-        JSON.stringify(confirmedHistoricalTerminalFailures) !==
-        JSON.stringify(plan.github.historicalTerminalFailureRuns)
-      ) {
-        throw new Error(
-          "--confirm-historical-terminal-failure-runs-json must equal the exact historical terminal failure inventory",
-        );
-      }
-      const confirmedSuccessfulRuns = flag("confirm-successful-run-ids-json")
-        ? jsonArrayArg("confirm-successful-run-ids-json").map(String)
-        : [];
-      if (
-        JSON.stringify(confirmedSuccessfulRuns) !==
-        JSON.stringify(plan.github.successfulRunIds)
-      ) {
-        throw new Error(
-          "--confirm-successful-run-ids-json must equal the exact successful run inventory",
-        );
-      }
-    }
-    confirmHistoricalPreflightFailures(plan);
-  }
-  if (plan.kind === "instance-rehydrate-plan") {
-    if (arg("confirm-host-id") !== plan.aws.hostId) {
-      throw new Error("--confirm-host-id must equal the exact host id");
-    }
-    if (arg("confirm-replaces-instance-id") !== plan.aws.replacesInstanceId) {
-      throw new Error(
-        "--confirm-replaces-instance-id must equal replacesInstanceId",
-      );
-    }
-    if (!flag("confirm-no-host-allocation")) {
-      throw new Error("--confirm-no-host-allocation is required");
-    }
-  }
 }
 
 function emit(plan, mode, execute, operation) {
@@ -679,75 +510,6 @@ export function main() {
       executeMacosJitCampaignLaunch(plan, { profile: arg("aws-profile") }),
     );
   }
-  if (["plan-rehydrate", "rehydrate-instance"].includes(mode)) {
-    const plan = createMacosJitInstanceRehydratePlan({
-      ...commonValues(execute),
-      hostId: arg("host-id"),
-      hostAllocatedAt: arg("host-allocated-at"),
-      replacesInstanceId: arg("replaces-instance-id"),
-      rehydrationId: arg("rehydration-id"),
-    });
-    return emit(plan, mode, execute, () =>
-      executeMacosJitInstanceRehydrate(plan, {
-        profile: arg("aws-profile"),
-      }),
-    );
-  }
-  if (
-    [
-      "plan-rebind",
-      "rebind-campaign",
-      "plan-rebind-after-failure",
-      "rebind-campaign-after-failure",
-      "plan-rebind-after-preflight-failure",
-      "rebind-campaign-after-preflight-failure",
-    ].includes(mode)
-  ) {
-    const afterFailure = mode.endsWith("after-failure");
-    const afterPreflightFailure = mode.endsWith("after-preflight-failure");
-    const plan = createMacosJitSourceRebindPlan({
-      ...commonValues(execute),
-      previousSourceSha: arg("previous-source-sha"),
-      previousSourceRef: arg("previous-source-ref"),
-      workflowId: arg("workflow-id"),
-      hostId: arg("host-id"),
-      instanceId: arg("instance-id"),
-      priorRunPolicy: afterPreflightFailure
-        ? "preflight-failure"
-        : afterFailure
-          ? "terminal-failure"
-          : "unused",
-      terminalFailureRunIds: afterFailure
-        ? jsonArrayArg("terminal-failure-run-ids-json")
-        : [],
-      preflightFailureRunIds: afterPreflightFailure
-        ? jsonArrayArg("preflight-failure-run-ids-json")
-        : [],
-      startupFailureRuns:
-        (afterFailure || afterPreflightFailure) &&
-        flag("startup-failure-runs-json")
-          ? jsonArrayArg("startup-failure-runs-json")
-          : [],
-      historicalTerminalFailureRuns:
-        (afterFailure || afterPreflightFailure) &&
-        flag("historical-terminal-failure-runs-json")
-          ? jsonArrayArg("historical-terminal-failure-runs-json")
-          : [],
-      historicalPreflightFailureRuns:
-        (afterFailure || afterPreflightFailure) &&
-        flag("historical-preflight-failure-runs-json")
-          ? jsonArrayArg("historical-preflight-failure-runs-json")
-          : [],
-      successfulRunIds:
-        (afterFailure || afterPreflightFailure) &&
-        flag("successful-run-ids-json")
-          ? jsonArrayArg("successful-run-ids-json")
-          : [],
-    });
-    return emit(plan, mode, execute, () =>
-      executeMacosJitSourceRebind(plan, { profile: arg("aws-profile") }),
-    );
-  }
   if (["plan-job", "run-job"].includes(mode)) {
     const plan = createMacosJitJobPlan({
       ...commonValues(execute),

package/scripts/aws-macos-jit-core.mjs

@@ -2,29 +2,13 @@ import { digest } from "./aws-runner-burst-core.mjs";
 
 export const AWS_MACOS_JIT_CONTRACT = "kungfu-buildchain-aws-macos-jit/v1";
 
-export const MACOS_EC2_JIT_REGIONS = Object.freeze({
-  "us-east-1": Object.freeze({
-    stack: "kungfu-buildchain-macos-jit",
-  }),
-  "us-east-2": Object.freeze({
-    stack: "kungfu-buildchain-macos-jit-us-east-2",
-  }),
-});
-
 export const MACOS_EC2_JIT = Object.freeze({
   phase: "macos-ec2-jit",
   region: "us-east-1",
   repository: "kungfu-systems/kungfu",
-  workflowId: "323846928",
   stack: "kungfu-buildchain-macos-jit",
-  budgetName: "kungfu-buildchain-macos-jit-actual-spend",
-  budgetUsageTypes: Object.freeze([
-    "HostUsage:mac2",
-    "USE2-HostUsage:mac2",
-  ]),
-  budgetOperation: "RunInstances",
   instanceType: "mac2.metal",
-  pricePerHourUsd: 0.65,
+  pricePerHourUsd: 0.6498,
   minimumHostAllocationHours: 24,
   maximumHostAllocationHours: 30,
   maxAcceptedHosts: 1,
@@ -39,22 +23,6 @@ export const MACOS_EC2_JIT = Object.freeze({
   jitParameterPrefix: "/kungfu/burst/macos/",
 });
 
-export function macosJitRegionConfig(region) {
-  const resolved = String(region || MACOS_EC2_JIT.region).trim();
-  const config = MACOS_EC2_JIT_REGIONS[resolved];
-  if (!config) {
-    throw new Error(
-      `region must be one of ${Object.keys(MACOS_EC2_JIT_REGIONS).join(", ")}`,
-    );
-  }
-  return {
-    ...config,
-    budgetName: MACOS_EC2_JIT.budgetName,
-    budgetUsageTypes: MACOS_EC2_JIT.budgetUsageTypes,
-    budgetRegions: Object.keys(MACOS_EC2_JIT_REGIONS),
-  };
-}
-
 function exactSha(value, label) {
   const normalized = String(value || "")
     .trim()
@@ -355,14 +323,8 @@ export function verifyMacosEc2JitQualification({
   }
   let allocationHours = 0;
   try {
-    const allocatedAt = iso(
-      hostLifecycle.allocatedAt,
-      "hostLifecycle.allocatedAt",
-    );
-    const releasedAt = iso(
-      hostLifecycle.releasedAt,
-      "hostLifecycle.releasedAt",
-    );
+    const allocatedAt = iso(hostLifecycle.allocatedAt, "hostLifecycle.allocatedAt");
+    const releasedAt = iso(hostLifecycle.releasedAt, "hostLifecycle.releasedAt");
     allocationHours = elapsedHours(allocatedAt, releasedAt);
     if (
       hostLifecycle.status !== "passed" ||

package/scripts/aws-macos-jit.mjs

@@ -25,17 +25,6 @@ function writeJson(file, value) {
   return resolved;
 }
 
-export function writeMacosJitQualificationEnvironment(
-  githubEnv = process.env.GITHUB_ENV,
-) {
-  if (!githubEnv) return false;
-  fs.appendFileSync(
-    path.resolve(githubEnv),
-    "BUILDCHAIN_SIGNING_REQUESTS_ENABLED=false\n",
-  );
-  return true;
-}
-
 export function main() {
   const mode = process.argv[2] || "plan";
   if (mode === "plan") {
@@ -75,7 +64,6 @@ export function main() {
         ".buildchain/aws-macos-jit.json",
       result,
     );
-    writeMacosJitQualificationEnvironment();
     process.stdout.write(`${output}\n`);
     return result;
   }

package/scripts/aws-windows-jit-campaign.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 // SPDX-License-Identifier: Apache-2.0
 
-import { spawnSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
+import { spawnSyncCommand } from "../packages/core/spawn-command.js";
 import {
   createWindowsJitCampaignArmPlan,
   windowsCampaignArmItems,
@@ -16,7 +16,7 @@ function arg(name, fallback = "") {
 
 function aws(plan, serviceArgs) {
   const profile = arg("aws-profile");
-  const result = spawnSync(
+  const result = spawnSyncCommand(
     "aws",
     [
       ...(profile ? ["--profile", profile] : []),

package/scripts/aws-windows-jit-controller-core.mjs

@@ -230,7 +230,7 @@ export function windowsRunInstancesArgs(
   }
   const resolvedBootstrap = exact(
     bootstrapPath,
-    /^(?:<rendered-bootstrap>|\/[^\0]+)$/,
+    /^(?:<rendered-bootstrap>|\/[^\0]+|[A-Za-z]:[\\/][^\0]+)$/,
     "bootstrapPath",
   );
   const args = [

package/scripts/aws-windows-jit-controller.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 // SPDX-License-Identifier: Apache-2.0
 
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+import { spawnSyncCommand } from "../packages/core/spawn-command.js";
 import {
   AWS_WINDOWS_JIT_CONTROLLER_CONTRACT,
   createWindowsJitLaunchPlan,
@@ -27,7 +27,7 @@ function flag(name) {
 }
 
 function commandResult(command, args, options = {}) {
-  const result = spawnSync(command, args, {
+  const result = spawnSyncCommand(command, args, {
     encoding: "utf8",
     maxBuffer: 16 * 1024 * 1024,
     stdio: [options.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
@@ -164,7 +164,7 @@ function assertLivePreflight(plan, profile) {
     throw new Error("Windows AMI identity or availability mismatch");
   }
   return {
-    budgetGuard: jsonResult(commandResult("/bin/bash", ["scripts/aws-windows-jit-operator.sh", "launch-gate", "--region", plan.aws.region, ...(profile ? ["--aws-profile", profile] : [])]), "provider Budget launch gate"),
+    budgetGuard: jsonResult(commandResult("bash", ["scripts/aws-windows-jit-operator.sh", "launch-gate", "--region", plan.aws.region, ...(profile ? ["--aws-profile", profile] : [])]), "provider Budget launch gate"),
     runStatus: run.status,
     jobStatus: job.status,
     activeInstances: activeInstances.length,

package/scripts/build-contract-core.mjs

@@ -1209,14 +1209,9 @@ export function writeGitHubOutputs(outputs) {
     }
     return;
   }
-  const lines = Object.entries(outputs).map(([key, value]) => {
-    const text = String(value);
-    if (!/[\r\n]/.test(text)) return `${key}=${text}`;
-    const valueLines = new Set(text.split(/\r?\n/));
-    let delimiter = "BUILDCHAIN_OUTPUT";
-    while (valueLines.has(delimiter)) delimiter += "_";
-    return `${key}<<${delimiter}\n${text}\n${delimiter}`;
-  });
+  const lines = Object.entries(outputs).map(
+    ([key, value]) => `${key}=${value}`,
+  );
   fs.appendFileSync(outputPath, `${lines.join("\n")}\n`);
 }
 

package/scripts/build-standalone-binary.mjs

@@ -2,6 +2,7 @@
 import { spawnSync } from "node:child_process";
 import crypto from "node:crypto";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { createBuildchainLogger } from "../packages/core/logging.js";
@@ -223,16 +224,16 @@ function postjectArgs(binaryPath, blobPath) {
   return args;
 }
 
-function buildStandaloneBinaryInTemp({
+export function buildStandaloneBinary({
   cwd = process.cwd(),
   outputDir = "dist/binary",
   name = "buildchain",
   version = "",
   packageManagerInstall = false,
   logPath = undefined,
-  tempDir,
 } = {}) {
   const resolvedOutputDir = path.resolve(cwd, outputDir);
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-sea-"));
   const triple = platformTriple();
   const archiveBase = `${name}-${triple}`;
   const logger = createBuildchainLogger({
@@ -383,18 +384,6 @@ function buildStandaloneBinaryInTemp({
   return manifest;
 }
 
-export function buildStandaloneBinary(options = {}) {
-  const cwd = path.resolve(options.cwd || process.cwd());
-  const tempRoot = path.join(cwd, ".buildchain", "tmp");
-  fs.mkdirSync(tempRoot, { recursive: true });
-  const tempDir = fs.mkdtempSync(path.join(tempRoot, "sea-"));
-  try {
-    return buildStandaloneBinaryInTemp({ ...options, cwd, tempDir });
-  } finally {
-    fs.rmSync(tempDir, { recursive: true, force: true });
-  }
-}
-
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   try {
     const result = buildStandaloneBinary({

package/scripts/buildchain-channel-router.mjs

@@ -79,6 +79,7 @@ function selected(channel, major, source, reason) {
     channel,
     major,
     buildchainRef: channel === "alpha" ? `v${major}-alpha` : `v${major}`,
+    runtimeOverride: false,
     selectionSource: source,
     reason,
   };
@@ -120,6 +121,7 @@ export function resolveBuildchainChannel({
         ...lane,
         major,
         buildchainRef: explicitRef.ref,
+        runtimeOverride: true,
         selectionSource: "explicit-buildchain-ref+channel-evidence",
         reason: `trusted runtime override ${explicitRef.ref} bound to ${lane.channel}`,
       };
@@ -128,6 +130,7 @@ export function resolveBuildchainChannel({
       channel: explicitRef.kind,
       major,
       buildchainRef: explicitRef.ref,
+      runtimeOverride: false,
       selectionSource: "explicit-buildchain-ref",
       reason: `explicit Buildchain runtime ref ${explicitRef.ref}`,
     };
@@ -197,6 +200,7 @@ function appendOutputs(file, result) {
     channel: result.channel,
     major: String(result.major),
     "buildchain-ref": result.buildchainRef,
+    "runtime-override": String(result.runtimeOverride),
     "selection-source": result.selectionSource,
     reason: result.reason,
   };