@kungfu-tech/buildchain 4.0.1-alpha.0 → 4.0.1-alpha.3

package/scripts/generate-release-candidate-passport.mjs

@@ -1,19 +1,30 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import path from "node:path";
+import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
-import {
-  createReleaseCandidatePassport,
-  validateReleaseCandidatePassport,
-} from "../packages/core/release-candidate.js";
+import { createReleaseCandidatePassport, validateReleaseCandidatePassport } from "../packages/core/release-candidate.js";
+import { scanV4FloatingConsumerPolicy, v4ConsumerPolicyScannerRoot } from "../packages/core/v4-floating-consumer-policy.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
-function env(name, fallback = "") {
-  return process.env[name] || fallback;
-}
+const env = (name, fallback = "") => process.env[name] || fallback;
+const readJsonFile = (filePath) => JSON.parse(fs.readFileSync(filePath, "utf8"));
 
-function readJsonFile(filePath) {
-  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+export function resolveLegacyConsumerPolicyReceipt(options = {}) {
+  if (options.json) return { receipt: JSON.parse(options.json), receiptRoot: options.receiptRoot };
+  if (options.repository !== "kungfu-systems/buildchain" || options.targetChannel !== "alpha" || options.workflowShellRef !== "v4-alpha" || options.runtimeOverride !== true) return undefined;
+  if (!/^[0-9a-f]{40}$/u.test(options.runtimeRef || "") || options.runtimeRef !== options.runtimeSha || options.sourceTreeHash !== options.runtimeTreeHash()) return undefined;
+  const root = path.resolve(options.root || ".buildchain/runtime");
+  const alphaLock = readJsonFile(path.join(root, ".buildchain/alpha-contract-lock.json"));
+  const result = scanV4FloatingConsumerPolicy({
+    root, repository: options.repository, sourceSha: options.sourceSha,
+    invokedWorkflow: options.invokedWorkflow || ".github/workflows/build.yml", invocationSourcePath: options.invocationSourcePath,
+    expectedInvocationChannel: "alpha", resolvedWorkflowSha: alphaLock.buildchain?.resolvedSha,
+    resolvedRuntimeSha: options.runtimeSha, scannerRoot: v4ConsumerPolicyScannerRoot(),
+    policy: readJsonFile(path.resolve(import.meta.dirname, "../architecture/v4-floating-consumer-policy.json")),
+  });
+  if (!result.ok) throw new Error(`legacy floating-shell policy receipt invalid: ${result.failures.map(({ code }) => code).join(", ")}`);
+  return { receipt: result.receipt, receiptRoot: result.receiptRoot };
 }
 
 export function generateReleaseCandidatePassportCli() {
@@ -21,23 +32,28 @@ export function generateReleaseCandidatePassportCli() {
   const outputPath = path.resolve(env("BUILDCHAIN_RC_PASSPORT_PATH", ".buildchain/artifacts/release-candidate-passport.json"));
   const buildSummary = readJsonFile(buildSummaryPath);
   const sourceSha = env("BUILDCHAIN_RC_SOURCE_HEAD_SHA", buildSummary.publishSource?.sha || buildSummary.git?.sha || "");
-  const version = env(
-    "BUILDCHAIN_RC_VERSION",
-    buildSummary.publishSource?.consumerVersion || "",
-  );
+  const version = env("BUILDCHAIN_RC_VERSION", buildSummary.publishSource?.consumerVersion || "");
   const gateAggregateJson = env("BUILDCHAIN_GATE_PROFILE_AGGREGATE_JSON");
   const gateAggregate = gateAggregateJson ? JSON.parse(gateAggregateJson) : undefined;
   const controllerReceiptJson = env("BUILDCHAIN_CONTROLLER_RECEIPT_JSON");
   const controllerReceipts = controllerReceiptJson ? [JSON.parse(controllerReceiptJson)] : [];
   const familyEvidenceJson = env("BUILDCHAIN_RC_FAMILY_EVIDENCE_JSON");
   const familyEvidence = familyEvidenceJson ? JSON.parse(familyEvidenceJson) : undefined;
+  const consumerPolicyJson = env("BUILDCHAIN_V4_POLICY_RECEIPT_JSON");
+  const consumerPolicyReceipt = resolveLegacyConsumerPolicyReceipt({
+    json: consumerPolicyJson, receiptRoot: env("BUILDCHAIN_V4_POLICY_RECEIPT_ROOT"),
+    repository: env("GITHUB_REPOSITORY", buildSummary.git?.repository || ""), sourceSha,
+    targetChannel: env("BUILDCHAIN_RC_TARGET_CHANNEL", buildSummary.publishSource?.channel || buildSummary.publishGate?.channel || ""),
+    runtimeRef: env("BUILDCHAIN_RUNTIME_REF", buildSummary.runtime?.ref || ""), runtimeSha: env("BUILDCHAIN_RUNTIME_SHA", buildSummary.runtime?.sha || ""),
+    workflowShellRef: env("BUILDCHAIN_WORKFLOW_SHELL_REF", buildSummary.runtime?.workflowShellRef || ""), runtimeOverride: buildSummary.runtime?.override === true,
+    root: ".buildchain/runtime", invocationSourcePath: env("GITHUB_WORKFLOW_REF"), sourceTreeHash: env("BUILDCHAIN_RC_SOURCE_TREE_HASH"),
+    runtimeTreeHash: () => execFileSync("git", ["-C", ".buildchain/runtime", "rev-parse", "HEAD^{tree}"], { encoding: "utf8" }).trim(),
+  });
   const passport = createReleaseCandidatePassport({
     repository: env("GITHUB_REPOSITORY", buildSummary.git?.repository || ""),
     pullRequest: {
-      number: env("BUILDCHAIN_PULL_REQUEST_NUMBER"),
-      url: env("BUILDCHAIN_PULL_REQUEST_URL"),
-      headRef: env("BUILDCHAIN_PULL_REQUEST_HEAD_REF"),
-      baseRef: env("BUILDCHAIN_PULL_REQUEST_BASE_REF"),
+      number: env("BUILDCHAIN_PULL_REQUEST_NUMBER"), url: env("BUILDCHAIN_PULL_REQUEST_URL"),
+      headRef: env("BUILDCHAIN_PULL_REQUEST_HEAD_REF"), baseRef: env("BUILDCHAIN_PULL_REQUEST_BASE_REF"),
     },
     targetChannel: env("BUILDCHAIN_RC_TARGET_CHANNEL", buildSummary.publishSource?.channel || buildSummary.publishGate?.channel || ""),
     version,
@@ -47,30 +63,21 @@ export function generateReleaseCandidatePassportCli() {
     sourceTreeHash: env("BUILDCHAIN_RC_SOURCE_TREE_HASH"),
     buildSummary,
     buildchain: {
-      ref: env("BUILDCHAIN_RUNTIME_REF", buildSummary.runtime?.ref || ""),
-      sha: env("BUILDCHAIN_RUNTIME_SHA", buildSummary.runtime?.sha || ""),
-      version: env("BUILDCHAIN_RUNTIME_VERSION"),
-      workflowShellRef: env("BUILDCHAIN_WORKFLOW_SHELL_REF", buildSummary.runtime?.workflowShellRef || ""),
+      ref: env("BUILDCHAIN_RUNTIME_REF", buildSummary.runtime?.ref || ""), sha: env("BUILDCHAIN_RUNTIME_SHA", buildSummary.runtime?.sha || ""),
+      version: env("BUILDCHAIN_RUNTIME_VERSION"), workflowShellRef: env("BUILDCHAIN_WORKFLOW_SHELL_REF", buildSummary.runtime?.workflowShellRef || ""),
     },
     gateAggregate,
     familyEvidence,
+    consumerPolicyReceipt,
     controllerReceipts,
     workflow: {
-      name: env("GITHUB_WORKFLOW"),
-      runId: env("GITHUB_RUN_ID", buildSummary.git?.runId || ""),
-      runAttempt: env("GITHUB_RUN_ATTEMPT", buildSummary.git?.runAttempt || ""),
-      url: env("BUILDCHAIN_WORKFLOW_RUN_URL"),
+      name: env("GITHUB_WORKFLOW"), runId: env("GITHUB_RUN_ID", buildSummary.git?.runId || ""),
+      runAttempt: env("GITHUB_RUN_ATTEMPT", buildSummary.git?.runAttempt || ""), url: env("BUILDCHAIN_WORKFLOW_RUN_URL"),
     },
   });
   const validation = validateReleaseCandidatePassport({
-    passport,
-    repository: env("GITHUB_REPOSITORY", buildSummary.git?.repository || ""),
-    sourceHeadSha: sourceSha,
-    buildSummary,
-  });
-  if (!validation.ok) {
-    throw new Error(`release candidate passport invalid: ${validation.errors.join("; ")}`);
-  }
+    passport, repository: env("GITHUB_REPOSITORY", buildSummary.git?.repository || ""), sourceHeadSha: sourceSha, buildSummary });
+  if (!validation.ok) throw new Error(`release candidate passport invalid: ${validation.errors.join("; ")}`);
   fs.mkdirSync(path.dirname(outputPath), { recursive: true });
   fs.writeFileSync(outputPath, `${JSON.stringify(passport, null, 2)}\n`);
   writeGitHubOutputs({
@@ -84,6 +91,7 @@ export function generateReleaseCandidatePassportCli() {
       platformCount: passport.platformMatrix.length,
       gateProfileEvidence: passport.gateProfileEvidence,
       familyEvidence: passport.familyEvidence,
+      consumerPolicy: passport.consumerPolicy,
       controllerReceipts: passport.controllerReceipts || [],
     }),
   });

package/scripts/generate-site-bundle.mjs

@@ -46,6 +46,10 @@ import {
 const SITE_BUNDLE_CONTRACT = "kungfu-buildchain-site-bundle";
 const PUBLICATION_RELEASE_REGISTRY_CONTRACT = "kungfu-buildchain-publication-release-registry";
 const README_PATH = "README.md";
+const DEV_DELIVERY_AUTHORITY_SCHEMA =
+  "schemas/dev-delivery-authority-v2.schema.json";
+const DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE =
+  "contracts/dev-delivery-authority-v2.schema.json";
 const root = path.resolve(import.meta.dirname, "..");
 const outputDir = path.join(root, "dist", "site");
 const requireFromHere = createRequire(import.meta.url);
@@ -73,6 +77,18 @@ function stableJson(value) {
   return `${JSON.stringify(value, null, 2)}\n`;
 }
 
+function siteFileBytes(name, value) {
+  return name === DEV_DELIVERY_AUTHORITY_SCHEMA
+    ? readText(DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE)
+    : stableJson(value);
+}
+
+function writeSiteFile(name, value) {
+  const filePath = path.join(outputDir, name);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, siteFileBytes(name, value));
+}
+
 function env(name) {
   return String(process.env[name] || "").trim();
 }
@@ -931,6 +947,7 @@ function buildSiteBundle() {
       "schemas/release-passport-v1.schema.json",
       "schemas/kfd-agent-hub-adoption.schema.json",
       "schemas/kfd-product-gate-input-v1.schema.json",
+      "schemas/dev-delivery-authority-v2.schema.json",
       "kfd-support.json",
       "artifact-evidence.json",
       "product-mechanism.json",
@@ -965,6 +982,7 @@ function buildSiteBundle() {
       "schemas/release-passport-v1.schema.json",
       "schemas/kfd-agent-hub-adoption.schema.json",
       "schemas/kfd-product-gate-input-v1.schema.json",
+      "schemas/dev-delivery-authority-v2.schema.json",
       "buildchain-contract.json",
       "kfd-claims.json",
       "product-mechanism.json",
@@ -1095,6 +1113,7 @@ function buildSiteBundle() {
       "schemas/release-passport-v1.schema.json",
       "schemas/kfd-agent-hub-adoption.schema.json",
       "schemas/kfd-product-gate-input-v1.schema.json",
+      "schemas/dev-delivery-authority-v2.schema.json",
       "buildchain-contract.json",
       "kfd-upstream-aggregate.json",
       "kfd-claims.json",
@@ -1269,6 +1288,9 @@ function buildSiteBundle() {
     "schemas/release-passport-v1.schema.json": RELEASE_PASSPORT_SCHEMA,
     "schemas/kfd-agent-hub-adoption.schema.json": KFD_AGENT_HUB_ADOPTION_SCHEMA,
     "schemas/kfd-product-gate-input-v1.schema.json": KFD_PRODUCT_GATE_INPUT_SCHEMA,
+    [DEV_DELIVERY_AUTHORITY_SCHEMA]: readJson(
+      DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE,
+    ),
     "badge-endpoint-registry.json": badgeEndpointRegistry,
     "publication-registry.json": publicationRegistry,
     "buildchain-contract.json": createBuildchainContractWorld({ root, controllerRegistry }),
@@ -1288,7 +1310,7 @@ export function writeSiteBundle({ check = false } = {}) {
   const mismatches = [];
   for (const [name, value] of Object.entries(files)) {
     const filePath = path.join(outputDir, name);
-    const next = stableJson(value);
+    const next = siteFileBytes(name, value);
     if (check) {
       if (existingJson(filePath) !== next) {
         mismatches.push(path.relative(root, filePath));
@@ -1301,11 +1323,11 @@ export function writeSiteBundle({ check = false } = {}) {
   if (!check) {
     for (let iteration = 0; iteration < 5; iteration += 1) {
       for (const [name, value] of Object.entries(files)) {
-        writeJson(path.join(outputDir, name), value);
+        writeSiteFile(name, value);
       }
       const nextFiles = buildSiteBundle();
       const stable = Object.entries(nextFiles).every(([name, value]) => (
-        existingJson(path.join(outputDir, name)) === stableJson(value)
+        existingJson(path.join(outputDir, name)) === siteFileBytes(name, value)
       ));
       files = nextFiles;
       if (stable) {
@@ -1316,7 +1338,7 @@ export function writeSiteBundle({ check = false } = {}) {
       }
     }
     for (const [name, value] of Object.entries(files)) {
-      writeJson(path.join(outputDir, name), value);
+      writeSiteFile(name, value);
     }
   }
   return {

package/scripts/init-repo.mjs

@@ -327,7 +327,9 @@ function workflowArtifactPaths(type) {
 }
 
 function publicationWorkflowYaml() {
-  return `name: Build
+  return `# Commit both .buildchain/contract-lock.json and .buildchain/alpha-contract-lock.json.
+# Persist only @v4 or @v4-alpha; pass temporary train/SHA runtimes through workflow_dispatch.
+name: Build
 
 on:
   workflow_dispatch:
@@ -361,6 +363,8 @@ jobs:
 function workflowYaml({ type, runnerPreset, artifactName }) {
   return `# Buildchain v4 lifecycle checkpoints are governed by architecture/v4-platform-stage-checkpoints.json.
 # Do not add undeclared runner-only inputs, outputs, environment, or provider effects.
+# Commit both .buildchain/contract-lock.json and .buildchain/alpha-contract-lock.json.
+# Persist only @v4 or @v4-alpha; pass temporary train/SHA runtimes through workflow_dispatch.
 name: Build
 
 on:

package/scripts/inspect-artifact-signing-requests.mjs

@@ -82,6 +82,10 @@ export function inspectArtifactSigningRequests({
       if (seen.has(key))
         throw new Error(`duplicate artifact signing request: ${key}`);
       seen.add(key);
+      const {
+        entitlementsProfile = "none",
+        entitlementsPaths = [],
+      } = request.signature;
       const item = {
         id: request.artifact.id,
         slug: safeId(request.artifact.id),
@@ -104,6 +108,8 @@ export function inspectArtifactSigningRequests({
         sourceSha: request.source.sha,
         sourceTreeSha: request.source.treeSha,
         transportFormat: request.artifact.transport?.format || "",
+        entitlementsProfile,
+        entitlementsPaths: entitlementsPaths.join(","),
       };
       if (request.signature.profile === "detached-signature-v1")
         matrices.detached.push(item);

package/scripts/npm-publish-transaction.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import crypto from "node:crypto";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { spawnSyncCommand } from "../packages/core/spawn-command.js";
@@ -105,6 +106,20 @@ function sealedPackResult() {
   };
 }
 
+function materializedPackResult({ cwd, registry }) {
+  const temporaryRoot = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-npm-pack-"));
+  try {
+    const pack = parsePackResult(runNpm({
+      cwd,
+      args: ["pack", "--json", "--pack-destination", temporaryRoot, `--registry=${registry}`],
+    }).stdout);
+    return { ...pack, tarballPath: path.join(temporaryRoot, pack.filename), temporaryRoot };
+  } catch (error) {
+    fs.rmSync(temporaryRoot, { recursive: true, force: true });
+    throw error;
+  }
+}
+
 function parseNpmView(stdout) {
   const raw = String(stdout || "").trim();
   if (!raw) {
@@ -113,8 +128,8 @@ function parseNpmView(stdout) {
   const parsed = JSON.parse(raw);
   const dist = parsed?.dist || parsed;
   return {
-    integrity: dist?.integrity || "",
-    shasum: dist?.shasum || "",
+    integrity: dist?.integrity || parsed?.["dist.integrity"] || "",
+    shasum: dist?.shasum || parsed?.["dist.shasum"] || "",
   };
 }
 
@@ -188,46 +203,11 @@ export function npmPublishTransaction({
   const exactTag = assertPackageVersion({ pkg, expectedVersion });
   const distTag = readEnv("BUILDCHAIN_NPM_DIST_TAG", pkg.version.includes("-") ? "alpha" : "latest");
 
-  const pack =
-    sealedPackResult() ||
-    parsePackResult(
-      runNpm({
-        cwd: resolvedCwd,
-        args: ["pack", "--dry-run", "--json", `--registry=${registry}`],
-      }).stdout,
-    );
+  const pack = sealedPackResult() || materializedPackResult({ cwd: resolvedCwd, registry });
   const digest = artifactDigest(pack);
 
-  const existingDigest = skipRegistryLookup
-    ? undefined
-    : publishedDigest({
-        cwd: resolvedCwd,
-        name: pkg.name,
-        version: pkg.version,
-        registry,
-      });
-  let publishAction = "already-published";
-  if (existingDigest) {
-    if (existingDigest !== digest) {
-      throw new Error(`artifact digest mismatch: npm:${pkg.name}@${pkg.version}`);
-    }
-  } else if (dryRunPublish) {
-    publishAction = "dry-run";
-  } else {
-    runNpm({
-      cwd: resolvedCwd,
-      args: [
-        "publish",
-        ...(pack.tarballPath ? [pack.tarballPath] : []),
-        "--access",
-        access,
-        "--tag",
-        distTag,
-        `--registry=${registry}`,
-      ],
-    });
-    publishAction = "published";
-    const registryDigest = skipRegistryLookup
+  try {
+    const existingDigest = skipRegistryLookup
       ? undefined
       : publishedDigest({
           cwd: resolvedCwd,
@@ -235,60 +215,92 @@ export function npmPublishTransaction({
           version: pkg.version,
           registry,
         });
-    if (registryDigest && registryDigest !== digest) {
-      throw new Error(`artifact digest mismatch: npm:${pkg.name}@${pkg.version}`);
+    let publishAction = "already-published";
+    if (existingDigest) {
+      if (existingDigest !== digest) {
+        throw new Error(`artifact digest mismatch: npm:${pkg.name}@${pkg.version}`);
+      }
+    } else if (dryRunPublish) {
+      publishAction = "dry-run";
+    } else {
+      runNpm({
+        cwd: resolvedCwd,
+        args: [
+          "publish",
+          ...(pack.tarballPath ? [pack.tarballPath] : []),
+          "--access",
+          access,
+          "--tag",
+          distTag,
+          `--registry=${registry}`,
+        ],
+      });
+      publishAction = "published";
+      const registryDigest = skipRegistryLookup
+        ? undefined
+        : publishedDigest({
+            cwd: resolvedCwd,
+            name: pkg.name,
+            version: pkg.version,
+            registry,
+          });
+      if (registryDigest && registryDigest !== digest) {
+        throw new Error(`artifact digest mismatch: npm:${pkg.name}@${pkg.version}`);
+      }
     }
-  }
 
-  const evidencePath = readEnv("BUILDCHAIN_PUBLISH_EVIDENCE");
-  if (!evidencePath) {
-    throw new Error("BUILDCHAIN_PUBLISH_EVIDENCE is required");
-  }
-  const evidence = {
-    schema: 1,
-    version: expectedVersion || pkg.version,
-    channel: readEnv("BUILDCHAIN_CHANNEL"),
-    source_sha: readEnv("BUILDCHAIN_SOURCE_SHA"),
-    release_sha: readEnv("BUILDCHAIN_RELEASE_SHA"),
-    target_ref: readEnv("BUILDCHAIN_TARGET_REF"),
-    release_material_sha: readEnv("BUILDCHAIN_RELEASE_MATERIAL_SHA", readEnv("BUILDCHAIN_RELEASE_SHA")),
-    publish_tooling_sha: readEnv("BUILDCHAIN_PUBLISH_TOOLING_SHA", readEnv("BUILDCHAIN_RELEASE_SHA")),
-    artifacts: [{
-      group: "node",
-      kind: "npm",
-      name: pkg.name,
-      ref: pkg.version,
-      digest,
-    }],
-  };
-  const resolvedEvidencePath = writeEvidence({
-    cwd: resolvedCwd,
-    evidencePath,
-    evidence,
-  });
-  writeGitHubOutputs({
-    version: pkg.version,
-    "exact-tag": exactTag,
-    "dist-tag": distTag,
-    "artifact-digest": digest,
-    "publish-action": publishAction,
-    "publish-evidence": resolvedEvidencePath,
-  });
-  return {
-    schemaVersion: 1,
-    package: {
-      name: pkg.name,
+    const evidencePath = readEnv("BUILDCHAIN_PUBLISH_EVIDENCE");
+    if (!evidencePath) {
+      throw new Error("BUILDCHAIN_PUBLISH_EVIDENCE is required");
+    }
+    const evidence = {
+      schema: 1,
+      version: expectedVersion || pkg.version,
+      channel: readEnv("BUILDCHAIN_CHANNEL"),
+      source_sha: readEnv("BUILDCHAIN_SOURCE_SHA"),
+      release_sha: readEnv("BUILDCHAIN_RELEASE_SHA"),
+      target_ref: readEnv("BUILDCHAIN_TARGET_REF"),
+      release_material_sha: readEnv("BUILDCHAIN_RELEASE_MATERIAL_SHA", readEnv("BUILDCHAIN_RELEASE_SHA")),
+      publish_tooling_sha: readEnv("BUILDCHAIN_PUBLISH_TOOLING_SHA", readEnv("BUILDCHAIN_RELEASE_SHA")),
+      artifacts: [{
+        group: "node",
+        kind: "npm",
+        name: pkg.name,
+        ref: pkg.version,
+        digest,
+      }],
+    };
+    const resolvedEvidencePath = writeEvidence({
+      cwd: resolvedCwd,
+      evidencePath,
+      evidence,
+    });
+    writeGitHubOutputs({
       version: pkg.version,
-    },
-    exactTag,
-    distTag,
-    registry,
-    publishAction,
-    pack,
-    sealedBundleRoot: readEnv("BUILDCHAIN_SEALED_BUNDLE_ROOT"),
-    evidencePath: resolvedEvidencePath,
-    evidence,
-  };
+      "exact-tag": exactTag,
+      "dist-tag": distTag,
+      "artifact-digest": digest,
+      "publish-action": publishAction,
+      "publish-evidence": resolvedEvidencePath,
+    });
+    return {
+      schemaVersion: 1,
+      package: {
+        name: pkg.name,
+        version: pkg.version,
+      },
+      exactTag,
+      distTag,
+      registry,
+      publishAction,
+      pack: { ...pack, temporaryRoot: undefined },
+      sealedBundleRoot: readEnv("BUILDCHAIN_SEALED_BUNDLE_ROOT"),
+      evidencePath: resolvedEvidencePath,
+      evidence,
+    };
+  } finally {
+    if (pack.temporaryRoot) fs.rmSync(pack.temporaryRoot, { recursive: true, force: true });
+  }
 }
 
 function usage() {

package/scripts/resume-from-candidate-run.mjs

@@ -8,12 +8,11 @@ import { pathToFileURL } from "node:url";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 import {
   generatePublishRequiredArtifacts,
-  readNpmPackageArtifact,
-  selectReleaseCandidateArtifacts,
-} from "./release-candidate-resolver.mjs";
-import {
   githubDownload,
   githubJson,
+  readNpmPackageArtifact,
+  selectPayloadArtifacts,
+  selectReleaseCandidateArtifacts,
   unzip,
   verifyArtifactArchive,
 } from "./release-candidate-resolver.mjs";
@@ -156,7 +155,7 @@ async function downloadArtifact({ artifact, repoInfo, apiUrl, token, archiveDir,
   };
 }
 
-function candidateArtifactNames({ passport, selected, artifacts, artifactPatterns }) {
+export function candidateArtifactNames({ passport, selected, artifacts, artifactPatterns }) {
   const names = new Set([selected.passport.name, selected.summary.name]);
   for (const reference of passport.controllerReceipts || []) {
     if (!reference.artifact) throw new Error(`Passport controller receipt ${reference.controllerId} has no artifact identity`);
@@ -171,11 +170,9 @@ function candidateArtifactNames({ passport, selected, artifacts, artifactPattern
   for (const artifact of artifacts) {
     if (manifestPattern.test(String(artifact.name || ""))) names.add(artifact.name);
   }
-  const matchers = splitPatterns(artifactPatterns).map(patternMatcher);
-  for (const artifact of artifacts) {
-    if (matchers.some((matcher) => matcher.test(String(artifact.name || "")))) names.add(artifact.name);
-  }
-  return names;
+  const publicationNames = new Set(selectPayloadArtifacts({ artifacts, artifactName: selected.prefix, sourceSha: selected.sourceSha, patterns: artifactPatterns }).map((artifact) => artifact.name));
+  for (const name of publicationNames) names.add(name);
+  return { names, publicationNames };
 }
 
 export function normalizePlatformManifests(downloads, passport) {
@@ -352,7 +349,7 @@ async function recoverCandidateEvidence({
   for (const artifact of [selected.passport, selected.summary]) initialDownloads.push(await downloadArtifact({ artifact, repoInfo, apiUrl, token, archiveDir, bundleRoot, fetchImpl }));
   const passport = readOnlyJson(initialDownloads[0].files.filter((file) => path.basename(file.path) === "release-candidate-passport.json"), "release-candidate-passport.json");
   const buildSummary = readOnlyJson(initialDownloads[1].files.filter((file) => path.basename(file.path) === "build-summary.json"), "build-summary.json");
-  const requiredNames = candidateArtifactNames({ passport, selected, artifacts, artifactPatterns });
+  const { names: requiredNames, publicationNames } = candidateArtifactNames({ passport, selected, artifacts, artifactPatterns });
   const chosen = artifacts.filter((artifact) => requiredNames.has(artifact.name));
   if (chosen.length !== requiredNames.size) {
     const found = new Set(chosen.map((artifact) => artifact.name));
@@ -363,7 +360,7 @@ async function recoverCandidateEvidence({
   for (const artifact of chosen.filter((entry) => ![selected.passport.id, selected.summary.id].includes(entry.id))) downloads.push(await downloadArtifact({ artifact, repoInfo, apiUrl, token, archiveDir, bundleRoot, fetchImpl }));
   return {
     run, workflow, selected, resolvedOutput, bundleRoot, initialDownloads,
-    passport, buildSummary, chosen, downloads,
+    passport, buildSummary, chosen, downloads, publicationNames,
   };
 }
 
@@ -396,7 +393,7 @@ export async function resumeFromCandidateRun({
   try {
     const {
       run, workflow, selected, resolvedOutput, bundleRoot, initialDownloads,
-      passport, buildSummary, chosen, downloads,
+      passport, buildSummary, chosen, downloads, publicationNames,
     } = await recoverCandidateEvidence({
       repoInfo, runId, artifactName, artifactPatterns, requiredArtifactCount,
       outputDir, apiUrl, token, fetchImpl, archiveDir,
@@ -412,7 +409,7 @@ export async function resumeFromCandidateRun({
     const controllerReceipts = normalizeControllerReceipts(downloads, passport);
     const productPayloadManifests = normalizeProductPayloadManifests(downloads);
     const publication = createRecoveredPublication({
-      downloads,
+      downloads: downloads.filter(({ artifact }) => publicationNames.has(artifact.name)),
       bundleRoot,
       repository: repoInfo.fullName,
       passport,

package/scripts/seal-artifact-signing-requests.mjs

@@ -381,6 +381,12 @@ export function sealArtifactSigningRequests({
       signature: {
         profile: declaration.profile,
         required: declaration.required,
+        ...(declaration.entitlementsProfile !== "none"
+          ? {
+              entitlementsProfile: declaration.entitlementsProfile,
+              entitlementsPaths: declaration.entitlementsPaths,
+            }
+          : {}),
       },
     });
     const check = validateArtifactSigningRequest(request);

package/scripts/site-capability-metadata.mjs

@@ -92,6 +92,17 @@ export function cliCommandMeta(id) {
     "kfd-upstream-roles": { group: "kfd-trust", purpose: "List Buildchain-managed KFD upstream role values and inference policy." },
     lifecycle: { group: "reusable-build", purpose: "Run configured lifecycle commands and write deterministic artifact manifests." },
     dev: { group: "governance-versioning", purpose: "Inspect protected development-channel governance command families." },
+    "dev-authority-admit-merge-group": { group: "governance-versioning", purpose: "Verify that one exact candidate holds the exclusive Landing Warrant before merge_group admission." },
+    "dev-authority-complete-qualification": { group: "governance-versioning", purpose: "Bind qualification evidence and release one bounded Qualification Lease without granting landing authority." },
+    "dev-authority-heartbeat-landing": { group: "governance-versioning", purpose: "Extend the exact fenced Landing Warrant while final landing work remains live." },
+    "dev-authority-heartbeat-qualification": { group: "governance-versioning", purpose: "Extend one exact fenced Qualification Lease while qualification work remains live." },
+    "dev-authority-lease-landing": { group: "governance-versioning", purpose: "Issue or retain the single exclusive Landing Warrant for a qualified candidate." },
+    "dev-authority-lease-qualification": { group: "governance-versioning", purpose: "Issue one qualification-only lease within the configured bounded lane count." },
+    "dev-authority-migrate": { group: "governance-versioning", purpose: "Migrate one exact v1 Warrant state into v2 without rewriting candidate or fencing evidence." },
+    "dev-authority-observe": { group: "governance-versioning", purpose: "Read bounded Qualification Leases and the exclusive Landing Warrant without mutating authority." },
+    "dev-authority-recover": { group: "governance-versioning", purpose: "Recover expired qualification or Landing authority and emit one rooted wake instruction." },
+    "dev-authority-settle": { group: "governance-versioning", purpose: "Settle terminal candidate evidence idempotently and release held qualification or Landing authority immediately." },
+    "dev-authority-submit": { group: "governance-versioning", purpose: "Submit an exact candidate to the opt-in bounded-qualification authority state." },
     "dev-proof-classify": { group: "governance-versioning", purpose: "Classify source-qualified candidate changes against a current integration base." },
     "dev-proof-integration": { group: "governance-versioning", purpose: "Seal final exact integration delivery proof for a warranted candidate." },
     "dev-proof-replay": { group: "governance-versioning", purpose: "Replay source qualification against a Project Cut without rewriting candidate source." },
@@ -174,6 +185,7 @@ export function nodeApiMeta(exportName) {
     "./build-facts": { group: "observability-diagnostics", summary: "Git source, version, module output, product artifact, and legacy Kungfu build fact APIs." },
     "./candidate-timeline": { group: "observability-diagnostics", summary: "Source-bound candidate event normalization, per-attempt critical-path-safe aggregation, and compact reporting APIs." },
     "./channel-candidate": { group: "governance-versioning", summary: "Exact-source channel candidate decisions, same-SHA workflow evidence validation, and deterministic source-lock reference APIs." },
+    "./dev-delivery-authority": { group: "governance-versioning", summary: "Opt-in bounded Qualification Lease, exclusive Landing Warrant, provider-attempt admission and heartbeat readback, terminal sealing, and expired-Landing verification APIs." },
     "./dev-delivery-warrant": { group: "governance-versioning", summary: "Durable fair Dev Delivery Warrant queue, fenced lease, and split source and integration proof APIs." },
     "./cache-evidence": { group: "observability-diagnostics", summary: "Content-addressed cache operation receipts and source/platform-bound evidence-set verification APIs." },
     "./diagnostics": { group: "observability-diagnostics", summary: "Native diagnostics collection, summarization, cache, compiler, and process-sampler APIs." },
@@ -201,6 +213,8 @@ export function nodeApiMeta(exportName) {
     "./kfd-agent-hub": { group: "kfd-trust", summary: "Declarative Agent Hub adapter inspection, fixed-suite execution, exact KFD cut locking, and agent explanation APIs." },
     "./release-passport-contract": { group: "release-passport-trust", summary: "Standalone release passport JSON Schema, ownership/check manifest, and structural validation APIs." },
     "./release-candidate": { group: "reusable-build", summary: "PR-stage release-candidate artifact, passport, and promote-only resolver APIs." },
+    "./v4-floating-consumer-policy": { group: "governance-versioning", summary: "Semantic floating-selector admission, dual-lock receipt, and independent v4 consumer certification APIs." },
+    "./v4-runtime-ref-resume-authority": { group: "release-passport-trust", summary: "Transient exact-runtime authorization, persisted-selector rejection, fresh-attempt Stage Capsule reuse, and A+B Passport lineage APIs." },
     "./release-candidate-recovery": { group: "release-passport-trust", summary: "Fail-closed verification and immutable receipts for reusing a successful sealed candidate run without rebuilding product payloads." },
     "./release-train": { group: "governance-versioning", summary: "Frozen Release Cut identity, rooted Release Train transitions, Dev observations, supersession, replay, and legacy read compatibility APIs." },
     "./stable-candidate-ledger": { group: "governance-versioning", summary: "Immutable alpha candidate ledger, qualification, revocation, selection, and exact stable source-lock APIs." },