@kungfu-tech/buildchain 4.0.0 → 4.0.1-alpha.10

package/scripts/dev-pr-prequeue-guard.mjs

@@ -0,0 +1,399 @@
+import fs from "node:fs";
+
+import {
+  classifyDevDeliveryDelta,
+  verifyProjectCutReplayProof,
+} from "../packages/core/dev-delivery-warrant.js";
+
+function mismatch(code, details = {}) {
+  const error = new Error(code);
+  error.code = code;
+  Object.assign(error, details);
+  throw error;
+}
+
+function readOptionalJson(file) {
+  if (!file) return null;
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function attributedBaseDelta(data, previousBase) {
+  const files = Array.isArray(data?.files) ? data.files : [];
+  const graphKnown =
+    data?.status === "ahead" &&
+    data?.merge_base_commit?.sha === previousBase &&
+    files.length < 300;
+  const renames = files
+    .filter((entry) => entry.status === "renamed")
+    .map((entry) => ({
+      from: String(entry.previous_filename || ""),
+      to: String(entry.filename || ""),
+    }));
+  const attributionComplete =
+    graphKnown &&
+    files.every((entry) => String(entry.filename || "")) &&
+    renames.every((entry) => entry.from && entry.to);
+  return {
+    graphKnown,
+    attributionComplete,
+    changedPaths: attributionComplete
+      ? [
+          ...new Set(
+            files
+              .flatMap((entry) => [
+                String(entry.filename || ""),
+                String(entry.previous_filename || ""),
+              ])
+              .filter(Boolean),
+          ),
+        ].sort()
+      : [],
+    renames: attributionComplete ? renames : [],
+  };
+}
+
+function reuseFailure(decision) {
+  if (decision.reason === "dev-delta-overlaps-affected-closure") {
+    return "pre-enqueue-base-delta-overlap";
+  }
+  if (
+    [
+      "dependency-attribution-unknown",
+      "affected-closure-paths-unknown",
+    ].includes(decision.reason)
+  ) {
+    return "pre-enqueue-base-attribution-unknown";
+  }
+  return "pre-enqueue-source-proof-drift";
+}
+
+async function githubBaseDelta(
+  client,
+  options,
+  previousBaseSha,
+  currentBaseSha,
+) {
+  if (typeof client.getBaseDelta === "function") {
+    return client.getBaseDelta(previousBaseSha, currentBaseSha);
+  }
+  const { data } = await client.request(
+    "GET",
+    `/repos/${options.repository.owner}/${options.repository.repo}/compare/${previousBaseSha}...${currentBaseSha}`,
+  );
+  return data;
+}
+
+async function githubCommitTree(client, options, mergeCommitSha) {
+  if (typeof client.getCommitTree === "function") {
+    return client.getCommitTree(mergeCommitSha);
+  }
+  const { data } = await client.request(
+    "GET",
+    `/repos/${options.repository.owner}/${options.repository.repo}/git/commits/${mergeCommitSha}`,
+  );
+  return String(data?.tree?.sha || "").toLowerCase();
+}
+
+export async function projectCutQualification(pr, options, client) {
+  if (!options.projectCutProofPath) {
+    return { ok: false, reason: "project-cut-proof-required" };
+  }
+  let proof;
+  try {
+    proof = JSON.parse(fs.readFileSync(options.projectCutProofPath, "utf8"));
+  } catch {
+    return { ok: false, reason: "project-cut-proof-invalid" };
+  }
+  const currentBase = await client
+    .getBranchSha(options.targetBranch)
+    .catch(() => "");
+  const verification = verifyProjectCutReplayProof(proof, {
+    repository: options.repository.fullName,
+    protectedBase: options.targetBranch,
+    pullRequestNumber: Number(pr.number),
+    sourceHead: String(pr.head?.sha || "").toLowerCase(),
+    ...(options.sourcePatchRoot
+      ? { sourcePatchRoot: options.sourcePatchRoot }
+      : {}),
+    currentBase,
+  });
+  return verification.ok
+    ? {
+        ok: true,
+        reason: verification.reason,
+        proofRoot: verification.proofRoot,
+        currentBase,
+      }
+    : {
+        ok: false,
+        reason: `project-cut-${verification.reason}`,
+        currentBase,
+      };
+}
+
+async function qualifyProjectCut({
+  client,
+  options,
+  pullRequest,
+  previousBaseSha,
+  currentBaseSha,
+  expectedHeadSha,
+  observedPullRequest,
+  projectCut,
+  mergeableAccepted,
+  root,
+}) {
+  const observedHeadSha = String(
+    observedPullRequest.head?.sha || "",
+  ).toLowerCase();
+  if (observedHeadSha !== expectedHeadSha) {
+    mismatch("head-sha-drift-after-lease-readback", { observedHeadSha });
+  }
+  if (observedPullRequest.mergeable === false) {
+    mismatch("pre-enqueue-merge-conflict");
+  }
+  if (
+    !mergeableAccepted(observedPullRequest, "queue", projectCut?.ok === true)
+  ) {
+    mismatch("not-mergeable-after-latest-base-replay");
+  }
+
+  let reuseDecision = null;
+  if (currentBaseSha !== previousBaseSha) {
+    const observedPullRequestBase = String(
+      observedPullRequest.base?.sha || "",
+    ).toLowerCase();
+    if (observedPullRequestBase !== currentBaseSha) {
+      mismatch("pre-enqueue-project-cut-base-stale", {
+        observedPullRequestBase,
+        currentBaseSha,
+      });
+    }
+    const proof = readOptionalJson(options.sourceProofPath);
+    if (!proof) mismatch("pre-enqueue-base-attribution-unknown");
+    if (
+      proof.sourceHead !== expectedHeadSha ||
+      proof.proofRoot !== options.verifiedDeliveryWarrant?.sourceProofRoot ||
+      (options.sourcePatchRoot &&
+        proof.sourcePatchRoot !== options.sourcePatchRoot)
+    ) {
+      mismatch("pre-enqueue-source-proof-drift");
+    }
+    let delta;
+    try {
+      delta = attributedBaseDelta(
+        await githubBaseDelta(client, options, previousBaseSha, currentBaseSha),
+        previousBaseSha,
+      );
+    } catch {
+      mismatch("pre-enqueue-base-attribution-unknown");
+    }
+    reuseDecision = classifyDevDeliveryDelta({
+      proof,
+      current: {
+        sourceIdentityRoot: proof.sourceIdentityRoot,
+        sourcePatchRoot: proof.sourcePatchRoot,
+        planRoot: proof.planRoot,
+        closureRoot: proof.closureRoot,
+        dependencyRoot: proof.dependencyRoot,
+        toolchainRoot: proof.toolchainRoot,
+        graphKnown: delta.graphKnown,
+        changedPaths: delta.changedPaths,
+      },
+    });
+    if (!reuseDecision.reusable) {
+      mismatch(reuseFailure(reuseDecision), { reuseDecision });
+    }
+  }
+
+  const mergeCommitSha = String(
+    observedPullRequest.merge_commit_sha || "",
+  ).toLowerCase();
+  const replayTree = /^[0-9a-f]{40}$/u.test(mergeCommitSha)
+    ? await githubCommitTree(client, options, mergeCommitSha).catch(() => "")
+    : "";
+  if (
+    currentBaseSha !== previousBaseSha &&
+    (!/^[0-9a-f]{40}$/u.test(mergeCommitSha) ||
+      !/^[0-9a-f]{40}$/u.test(replayTree))
+  ) {
+    mismatch("pre-enqueue-project-cut-composition-missing", {
+      mergeCommitSha,
+      replayTree,
+    });
+  }
+  const receipt = {
+    schema: "kungfu.buildchain.pre-enqueue-project-cut/v1",
+    repository: options.repository.fullName,
+    protectedBase: options.targetBranch,
+    pullRequestNumber: pullRequest.number,
+    sourceHead: expectedHeadSha,
+    previousBase: previousBaseSha,
+    admittedBase: currentBaseSha,
+    baseMoved: currentBaseSha !== previousBaseSha,
+    sourceHeadMutationRequired: false,
+    composition: { mergeCommitSha, replayTree },
+    sourceProofReuseDecisionRoot: reuseDecision ? root(reuseDecision) : "",
+    projectCutProofRoot: projectCut?.proofRoot || "",
+    decision: "qualified",
+  };
+  return { receipt, receiptRoot: root(receipt) };
+}
+
+function exactQueueEntry(queueState, pullRequest, expectedHeadSha) {
+  return queueState.entries.find(
+    (candidate) =>
+      candidate.pullRequestNumber === pullRequest.number &&
+      candidate.pullRequestHeadSha === expectedHeadSha,
+  );
+}
+
+export async function qualifyPreEnqueueReadback({
+  client,
+  options,
+  pullRequest,
+  expectedBaseSha,
+  expectedHeadSha,
+  projectCut,
+  mergeableAccepted,
+  root,
+  verifyCurrentWarrant,
+}) {
+  const [
+    observedPullRequest,
+    observedBaseSha,
+    observedQueueState,
+    currentWarrant,
+  ] = await Promise.all([
+    client.getPullRequest(pullRequest.number, {
+      attempts: options.pollMergeableAttempts,
+      delayMs: options.pollMergeableDelayMs,
+    }),
+    client.getBranchSha(options.targetBranch),
+    client.getMergeQueueState(options.targetBranch),
+    verifyCurrentWarrant(
+      client,
+      options,
+      pullRequest,
+      options.verifiedDeliveryWarrant,
+    ),
+  ]);
+  const observedHeadSha = String(
+    observedPullRequest.head?.sha || "",
+  ).toLowerCase();
+  if (observedHeadSha !== expectedHeadSha) {
+    mismatch("head-sha-drift-after-lease-readback", { observedHeadSha });
+  }
+  if (options.warrantMode !== "required") {
+    if (observedBaseSha !== expectedBaseSha) {
+      mismatch("base-sha-drift-after-lease-readback", { observedBaseSha });
+    }
+    if (
+      !mergeableAccepted(observedPullRequest, "queue", projectCut?.ok === true)
+    ) {
+      mismatch("not-mergeable-after-lease-readback");
+    }
+    return {
+      observedBaseSha,
+      observedQueueState,
+      currentWarrant,
+      preEnqueueProjectCut: null,
+    };
+  }
+
+  const preEnqueueProjectCut = await qualifyProjectCut({
+    client,
+    options,
+    pullRequest,
+    previousBaseSha: expectedBaseSha,
+    currentBaseSha: observedBaseSha,
+    expectedHeadSha,
+    observedPullRequest,
+    projectCut,
+    mergeableAccepted,
+    root,
+  });
+  const [casPullRequest, casBaseSha, casQueueState, casWarrant] =
+    await Promise.all([
+      client.getPullRequest(pullRequest.number, {
+        attempts: options.pollMergeableAttempts,
+        delayMs: options.pollMergeableDelayMs,
+      }),
+      client.getBranchSha(options.targetBranch),
+      client.getMergeQueueState(options.targetBranch),
+      verifyCurrentWarrant(
+        client,
+        options,
+        pullRequest,
+        options.verifiedDeliveryWarrant,
+      ),
+    ]);
+  if (casBaseSha !== observedBaseSha) {
+    mismatch("base-sha-drift-after-project-cut", {
+      observedBaseSha: casBaseSha,
+    });
+  }
+  if (
+    String(casPullRequest.head?.sha || "").toLowerCase() !== expectedHeadSha
+  ) {
+    mismatch("head-sha-drift-after-project-cut");
+  }
+  const casPullRequestBase = String(
+    casPullRequest.base?.sha || "",
+  ).toLowerCase();
+  if (casPullRequestBase && casPullRequestBase !== casBaseSha) {
+    mismatch("pre-enqueue-project-cut-base-stale", {
+      observedPullRequestBase: casPullRequestBase,
+      currentBaseSha: casBaseSha,
+    });
+  }
+  if (casPullRequest.mergeable === false) {
+    mismatch("pre-enqueue-merge-conflict-after-project-cut");
+  }
+  if (!mergeableAccepted(casPullRequest, "queue", projectCut?.ok === true)) {
+    mismatch("not-mergeable-after-project-cut");
+  }
+  const casMergeCommitSha = String(
+    casPullRequest.merge_commit_sha || "",
+  ).toLowerCase();
+  if (
+    casMergeCommitSha !==
+    preEnqueueProjectCut.receipt.composition.mergeCommitSha
+  ) {
+    mismatch("pre-enqueue-project-cut-composition-drift", {
+      observedMergeCommitSha: casMergeCommitSha,
+    });
+  }
+  if (preEnqueueProjectCut.receipt.composition.replayTree) {
+    const casReplayTree = await githubCommitTree(
+      client,
+      options,
+      casMergeCommitSha,
+    ).catch(() => "");
+    if (casReplayTree !== preEnqueueProjectCut.receipt.composition.replayTree) {
+      mismatch("pre-enqueue-project-cut-composition-drift", {
+        observedReplayTree: casReplayTree,
+      });
+    }
+  }
+  const exactEntry = exactQueueEntry(
+    casQueueState,
+    pullRequest,
+    expectedHeadSha,
+  );
+  const predecessor =
+    casQueueState.entries.find((candidate) => candidate !== exactEntry) || null;
+  if (predecessor) {
+    mismatch("queue-predecessor-after-project-cut", { predecessor });
+  }
+  return {
+    observedBaseSha,
+    observedQueueState: casQueueState,
+    currentWarrant: casWarrant,
+    preEnqueueProjectCut,
+  };
+}

package/scripts/dev-qualification-patrol.mjs

@@ -501,16 +501,16 @@ export function createGitHubDevQualificationClient({
       sourceBranch,
       { activeOnly = false } = {},
     ) {
-      const query = sourceBranch
-        ? `?branch=${encodeURIComponent(sourceBranch)}`
-        : "";
-      const runs = await paged(
-        `/repos/${owner}/${repo}/actions/workflows/${encodeURIComponent(workflow)}/runs${query}`,
-        "workflow_runs",
+      const query = sourceBranch ? `branch=${encodeRef(sourceBranch)}&` : "";
+      const runs = await Promise.all(
+        [...(activeOnly ? ACTIVE_STATUSES : [""])].map((status) =>
+          paged(
+            `/repos/${owner}/${repo}/actions/workflows/${encodeURIComponent(workflow)}/runs?${query}${status ? `status=${status}` : ""}`,
+            "workflow_runs",
+          ),
+        ),
       );
-      return activeOnly
-        ? runs.filter((run) => ACTIVE_STATUSES.has(text(run.status)))
-        : runs;
+      return runs.flat();
     },
     async listRunJobs(runId, runAttempt) {
       return paged(

package/scripts/dispatch-artifact-signing-authority.mjs

@@ -24,7 +24,7 @@ const AUTHORITY_WORKFLOW = "artifact-signing-authority.yml";
 
 export function resolveAuthorityDispatchRef(value) {
   const ref = required(value, "authority ref");
-  return /^[0-9a-f]{40}$/u.test(ref)
+  return /^[0-9a-f]{40}$/u.test(ref) || /^v\d+(?:\.\d+)?(?:-alpha)?$/u.test(ref)
     ? DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF
     : ref;
 }

package/scripts/ensure-github-release.mjs

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import { pathToFileURL } from "node:url";
-
 function classifyPublicationChannel(channel = "") {
   const normalized = String(channel || "").trim().toLowerCase();
   if (!normalized) return undefined;
@@ -131,6 +130,8 @@ export async function ensureGitHubRelease({
     if (tagRef.status === 404) {
       throw new Error(`Git tag ${metadata.tag} does not exist in ${repository}`);
     }
+    // Existing exact tags are authoritative; target_commitish is redundant and
+    // can require workflow mutation authority for workflow-changing commits.
     const created = await githubRequest({
       apiUrl,
       token,
@@ -142,11 +143,11 @@ export async function ensureGitHubRelease({
         body: notes || `Buildchain release passport assets for ${metadata.tag}.`,
         prerelease: metadata.prerelease,
         make_latest: metadata.makeLatest,
-        ...(target ? { target_commitish: target } : {}),
       },
     });
     return { action: "created", release: created.data, metadata };
   }
+  if (metadata.prerelease === true && existing.data?.tag_name === metadata.tag && existing.data?.name === (title || metadata.tag) && existing.data?.body === (notes || `Buildchain release passport assets for ${metadata.tag}.`) && existing.data?.prerelease === true && existing.data?.draft !== true && (!target || existing.data?.target_commitish === target)) return { action: "existing", release: existing.data, metadata };
   const patched = await githubRequest({
     apiUrl,
     token,
@@ -156,7 +157,6 @@ export async function ensureGitHubRelease({
       name: title || existing.data.name || metadata.tag,
       prerelease: metadata.prerelease,
       make_latest: metadata.makeLatest,
-      ...(target ? { target_commitish: target } : {}),
     },
   });
   return { action: "updated", release: patched.data, metadata };

package/scripts/generate-channel-build-workflow.mjs

@@ -90,6 +90,9 @@ function forwardedInputs(names) {
       if (name === "buildchain-contract-lock-path") {
         return "      buildchain-contract-lock-path: ${{ needs.resolve-channel.outputs.contract-lock-path }}";
       }
+      if (name === "buildchain-visible-workflow") {
+        return "      buildchain-visible-workflow: .github/workflows/build.yml";
+      }
       return `      ${name}: \${{ inputs.${name} }}`;
     })
     .join("\n");

package/scripts/generate-channel-promotion-workflow.mjs

@@ -20,9 +20,13 @@ const internalInputs = new Set([
   "promotion-publication-channel",
   "promotion-target-ref",
   "promotion-override-used",
+  "promotion-runtime-authorization-json",
+  "promotion-runtime-authorization-root",
   "publication-authority-workflow-path",
   "buildchain-expected-channel",
   "buildchain-expected-major",
+  "buildchain-alpha-contract-lock-path",
+  "buildchain-stable-contract-lock-path",
 ]);
 
 function blockBetween(source, start, end) {
@@ -120,6 +124,12 @@ function forwardedInputs(inputNames, { includeInternal = true, major = 2, unsupp
       if (name === "promotion-override-used") {
         return `      ${name}: \${{ needs.resolve-promotion.outputs.override-used == 'true' }}`;
       }
+      if (name === "promotion-runtime-authorization-json") {
+        return `      ${name}: \${{ needs.consumer-admission.outputs.runtime-authorization-json }}`;
+      }
+      if (name === "promotion-runtime-authorization-root") {
+        return `      ${name}: \${{ needs.consumer-admission.outputs.runtime-authorization-root }}`;
+      }
       if (name === "buildchain-expected-major") {
         return `      buildchain-expected-major: "${major}"`;
       }
@@ -132,6 +142,15 @@ function forwardedInputs(inputNames, { includeInternal = true, major = 2, unsupp
     }).join("\n");
 }
 
+function routedInputs(inputNames, route, major) {
+  return forwardedInputs(inputNames, {
+    includeInternal: route.forwardInternalInputs,
+    major,
+    unsupportedInputs: route.unsupportedInputs,
+    workflowPath: route.workflowPath,
+  });
+}
+
 function validateWorkflowRoute(name, route, expectedLogicalRef) {
   if (!route || typeof route !== "object") throw new Error(`promotion shell routing missing ${name} route`);
   if (route.logicalRef !== expectedLogicalRef) {
@@ -140,8 +159,8 @@ function validateWorkflowRoute(name, route, expectedLogicalRef) {
   if (!/^\.github\/workflows\/[.a-z0-9-]+\.ya?ml$/.test(route.workflowPath || "")) {
     throw new Error(`promotion shell ${name} workflowPath must name a reusable workflow`);
   }
-  if (!/^(?:v[0-9]+(?:-alpha)?|train\/[A-Za-z0-9._+\/-]+|[0-9a-f]{40})$/.test(route.callRef || "")) {
-    throw new Error(`promotion shell ${name} callRef must be an official channel ref, trusted train, or exact SHA`);
+  if (!/^(?:v[0-9]+(?:-alpha)?|(?:train|alpha|release)\/[A-Za-z0-9._+\/-]+|[0-9a-f]{40})$/.test(route.callRef || "")) {
+    throw new Error(`promotion shell ${name} callRef must be an official tag, protected channel ref, trusted train, or exact SHA`);
   }
   if (typeof route.forwardInternalInputs !== "boolean") {
     throw new Error(`promotion shell ${name} forwardInternalInputs must be boolean`);
@@ -167,6 +186,94 @@ export function parsePromotionShellRouting(source, { major = 2 } = {}) {
   };
 }
 
+function consumerAdmissionJob() {
+  return `  consumer-admission:
+    name: Admit v4 floating consumer policy
+    needs: resolve-promotion
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    outputs:
+      runtime-authorization-json: \${{ steps.runtime-authority.outputs.runtime-authorization-json }}
+      runtime-authorization-root: \${{ steps.runtime-authority.outputs.runtime-authorization-root }}
+    steps:
+      - name: Checkout exact consumer source
+        uses: actions/checkout@v7.0.0
+        with:
+          ref: \${{ inputs.target-sha || github.sha }}
+          path: .buildchain/consumer
+          persist-credentials: false
+      - name: Checkout exact policy runtime
+        uses: actions/checkout@v7.0.0
+        with:
+          repository: \${{ inputs.buildchain-repository }}
+          ref: \${{ needs.resolve-promotion.outputs.router-sha }}
+          path: .buildchain/v4-policy-runtime
+          persist-credentials: false
+      - name: Enforce v4 floating consumer policy
+        id: policy
+        env:
+          BUILDCHAIN_CONSUMER_ROOT: .buildchain/consumer
+          BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: \${{ needs.resolve-promotion.outputs.channel }}
+          BUILDCHAIN_INVOKED_WORKFLOW: .github/workflows/release-candidate-promote.yml
+          BUILDCHAIN_WORKFLOW_SHA: \${{ needs.resolve-promotion.outputs.router-sha }}
+          BUILDCHAIN_RUNTIME_SHA: \${{ needs.resolve-promotion.outputs.router-sha }}
+          BUILDCHAIN_STABLE_CONTRACT_LOCK_PATH: \${{ inputs.buildchain-stable-contract-lock-path }}
+          BUILDCHAIN_ALPHA_CONTRACT_LOCK_PATH: \${{ inputs.buildchain-alpha-contract-lock-path }}
+          BUILDCHAIN_V4_POLICY_RECEIPT_PATH: .buildchain/evidence/v4-consumer-policy-receipt.json
+        run: >-
+          node .buildchain/v4-policy-runtime/scripts/v4-consumer-policy.mjs scan
+          --source-sha "\${{ inputs.target-sha || github.sha }}"
+
+      - name: Upload rooted consumer admission receipt
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: v4-consumer-policy-release-candidate-promote-\${{ github.sha }}
+          path: .buildchain/consumer/.buildchain/evidence/v4-consumer-policy-receipt.json
+          if-no-files-found: error
+
+      - name: Authorize transient v4 runtime selection
+        id: runtime-authority
+        if: \${{ needs.resolve-promotion.outputs.override-used == 'true' }}
+        uses: actions/github-script@v8
+        env:
+          BUILDCHAIN_RUNTIME_AUTHORIZATION_PATH: .buildchain/consumer/.buildchain/evidence/v4-runtime-authorization.json
+        with:
+          script: |
+            const script = require(process.env.GITHUB_WORKSPACE + "/.buildchain/v4-policy-runtime/scripts/authorize-promotion-runtime-override.cjs");
+            const result = await script.authorizePromotionRuntimeOverride({
+              github,
+              context,
+              request: {
+                consumerRoot: process.env.GITHUB_WORKSPACE + "/.buildchain/consumer",
+                runtimeModulePath: process.env.GITHUB_WORKSPACE + "/.buildchain/v4-policy-runtime/packages/core/v4-runtime-ref-resume-authority.js",
+                runtimeRepository: "\${{ inputs.buildchain-repository }}",
+                consumerPolicyReceiptPath: process.env.GITHUB_WORKSPACE + "/.buildchain/consumer/.buildchain/evidence/v4-consumer-policy-receipt.json",
+                consumerPolicyReceiptRoot: "\${{ steps.policy.outputs.v4-consumer-policy-receipt-root }}",
+                sourceSha: "\${{ inputs.target-sha || github.sha }}",
+                requestedRef: "\${{ needs.resolve-promotion.outputs.runtime-ref }}",
+                resolvedRuntimeSha: "\${{ needs.resolve-promotion.outputs.runtime-sha }}",
+                reason: "trusted \${{ inputs.resume-candidate-run-id != '' && 'resume' || 'dispatch' }} runtime override \${{ needs.resolve-promotion.outputs.runtime-ref }} for source \${{ inputs.target-sha || github.sha }}",
+                mode: "\${{ inputs.resume-candidate-run-id != '' && 'resume' || 'dispatch' }}",
+                outputPath: process.env.BUILDCHAIN_RUNTIME_AUTHORIZATION_PATH,
+              },
+            });
+            core.setOutput("runtime-authorization-json", JSON.stringify({
+              receipt: result.receipt,
+              receiptRoot: result.receiptRoot,
+            }));
+            core.setOutput("runtime-authorization-root", result.receiptRoot);
+
+      - name: Upload transient runtime authorization receipt
+        if: \${{ needs.resolve-promotion.outputs.override-used == 'true' }}
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: v4-runtime-authorization-release-candidate-promote-\${{ github.run_id }}
+          path: .buildchain/consumer/.buildchain/evidence/v4-runtime-authorization.json
+          if-no-files-found: error
+`;
+}
+
 export function generateChannelPromotionWorkflow(source, { major = 2, shellRouting } = {}) {
   const routes = shellRouting || {
     alpha: {
@@ -193,16 +300,8 @@ export function generateChannelPromotionWorkflow(source, { major = 2, shellRouti
   for (const required of ["buildchain-ref", "buildchain-contract-lock-path", "channel", "target-ref", ...internalInputs]) {
     if (!inputNames.includes(required)) throw new Error(`advanced promotion workflow missing input: ${required}`);
   }
-  const alphaForwarded = forwardedInputs(inputNames, {
-    includeInternal: alphaRoute.forwardInternalInputs,
-    major,
-    unsupportedInputs: alphaRoute.unsupportedInputs, workflowPath: alphaRoute.workflowPath,
-  });
-  const stableForwarded = forwardedInputs(inputNames, {
-    includeInternal: stableRoute.forwardInternalInputs,
-    major,
-    unsupportedInputs: stableRoute.unsupportedInputs, workflowPath: stableRoute.workflowPath,
-  });
+  const alphaForwarded = routedInputs(inputNames, alphaRoute, major);
+  const stableForwarded = routedInputs(inputNames, stableRoute, major);
   return `# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.
 name: Release Candidate Promote
 
@@ -419,9 +518,10 @@ jobs:
           [[ "$(git -C .buildchain/shell rev-parse HEAD)" = "\${SHELL_SHA}" ]] || { echo "::error::Promotion shell checkout moved"; exit 1; }
           [[ "$(git -C .buildchain/runtime rev-parse HEAD)" = "\${RUNTIME_SHA}" ]] || { echo "::error::Promotion runtime checkout moved"; exit 1; }
 
+${consumerAdmissionJob()}
   alpha:
     name: Promote with alpha workflow shell
-    needs: resolve-promotion
+    needs: [resolve-promotion, consumer-admission]
     if: \${{ needs.resolve-promotion.outputs.channel == 'alpha' }}
     uses: kungfu-systems/buildchain/${alphaRoute.workflowPath}@${alphaRoute.callRef}
     permissions:
@@ -439,7 +539,7 @@ ${alphaForwarded}
 
   stable:
     name: Promote with stable workflow shell
-    needs: resolve-promotion
+    needs: [resolve-promotion, consumer-admission]
     if: \${{ needs.resolve-promotion.outputs.channel == 'stable' }}
     uses: kungfu-systems/buildchain/${stableRoute.workflowPath}@${stableRoute.callRef}
     permissions: