@kungfu-tech/buildchain 4.0.1-alpha.2 → 4.0.1-alpha.21

package/scripts/dev-delivery-source-proof-replay.mjs

@@ -0,0 +1,153 @@
+import crypto from "node:crypto";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const SHA = /^[0-9a-f]{40}$/u;
+
+function exactSha(value, label) {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (!SHA.test(normalized))
+    throw new Error(`${label} must be an exact 40-hex Git SHA`);
+  return normalized;
+}
+
+function git(args, { cwd, encoding = "utf8" }) {
+  const result = spawnSync("git", args, {
+    cwd,
+    encoding,
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (result.status !== 0)
+    throw new Error(
+      `git ${args.join(" ")} failed: ${String(result.stderr || "").trim()}`,
+    );
+  return encoding === null ? result.stdout : String(result.stdout || "").trim();
+}
+
+function patchRoot(base, head, cwd) {
+  const patch = git(
+    [
+      "diff",
+      "--binary",
+      "--full-index",
+      "--no-ext-diff",
+      `${base}..${head}`,
+    ],
+    { cwd, encoding: null },
+  );
+  return `sha256:${crypto.createHash("sha256").update(patch).digest("hex")}`;
+}
+
+function linearRange(base, head, cwd) {
+  try {
+    git(["merge-base", "--is-ancestor", base, head], { cwd });
+  } catch {
+    return null;
+  }
+  const commits = git(
+    ["rev-list", "--reverse", "--topo-order", `${base}..${head}`],
+    { cwd },
+  )
+    .split(/\s+/u)
+    .filter(Boolean);
+  if (commits.length === 0) return null;
+  let expectedParent = base;
+  const trees = [];
+  const patchRoots = [];
+  for (const rangeCommit of commits) {
+    const [observedCommit, ...parents] = git(
+      ["rev-list", "--parents", "-n", "1", rangeCommit],
+      { cwd },
+    ).split(/\s+/u);
+    if (
+      observedCommit !== rangeCommit ||
+      parents.length !== 1 ||
+      parents[0] !== expectedParent
+    ) {
+      return null;
+    }
+    trees.push(
+      exactSha(
+        git(["rev-parse", `${rangeCommit}^{tree}`], { cwd }),
+        "replayedCommitTree",
+      ),
+    );
+    patchRoots.push(patchRoot(expectedParent, rangeCommit, cwd));
+    expectedParent = rangeCommit;
+  }
+  return { commits, trees, patchRoots };
+}
+
+export function exactMergeGroupBinding(input = {}) {
+  const cwd = path.resolve(input.cwd || process.cwd());
+  const mergeGroupHead = exactSha(input.mergeGroupHead, "mergeGroupHead");
+  const expectedTree = exactSha(input.mergeGroupTree, "mergeGroupTree");
+  const qualifiedBase = exactSha(input.qualifiedBase, "qualifiedBase");
+  const currentBase = exactSha(input.currentBase, "currentBase");
+  const sourceHead = exactSha(input.sourceHead, "sourceHead");
+  const sourcePatchRoot = String(input.sourcePatchRoot || "").trim();
+  const actualTree = exactSha(
+    git(["rev-parse", `${mergeGroupHead}^{tree}`], { cwd }),
+    "mergeGroupTree",
+  );
+  if (actualTree !== expectedTree)
+    return { ok: false, reason: "merge-group-tree-mismatch" };
+  try {
+    git(["merge-base", "--is-ancestor", qualifiedBase, currentBase], { cwd });
+  } catch {
+    return {
+      ok: false,
+      reason: "current-base-not-descendant-of-qualified-base",
+    };
+  }
+  if (!/^sha256:[0-9a-f]{64}$/u.test(sourcePatchRoot))
+    throw new Error("sourcePatchRoot must be an exact SHA-256 root");
+  if (patchRoot(currentBase, mergeGroupHead, cwd) !== sourcePatchRoot)
+    return { ok: false, reason: "merge-group-source-patch-mismatch" };
+
+  const [commit, ...parents] = git(
+    ["rev-list", "--parents", "-n", "1", mergeGroupHead],
+    { cwd },
+  ).split(/\s+/u);
+  if (commit !== mergeGroupHead)
+    return { ok: false, reason: "merge-group-parent-mismatch" };
+  if (
+    parents.length === 2 &&
+    parents[0] === currentBase &&
+    parents[1] === sourceHead
+  ) {
+    return {
+      ok: true,
+      mergeGroupHead,
+      mergeGroupTree: actualTree,
+      parents,
+      compositionMode: "two-parent-merge",
+      replayedCommitTrees: [],
+      replayedCommitPatchRoots: [],
+    };
+  }
+
+  const sourceRange = linearRange(qualifiedBase, sourceHead, cwd);
+  const mergeGroupRange = linearRange(currentBase, mergeGroupHead, cwd);
+  if (
+    !sourceRange ||
+    !mergeGroupRange ||
+    sourceRange.commits.length !== mergeGroupRange.commits.length ||
+    sourceRange.patchRoots.some(
+      (root, index) => root !== mergeGroupRange.patchRoots[index],
+    )
+  ) {
+    return { ok: false, reason: "merge-group-parent-mismatch" };
+  }
+  return {
+    ok: true,
+    mergeGroupHead,
+    mergeGroupTree: actualTree,
+    parents,
+    compositionMode: "linear-replay",
+    replayedCommitTrees: mergeGroupRange.trees,
+    replayedCommitPatchRoots: mergeGroupRange.patchRoots,
+  };
+}

package/scripts/dev-delivery-source-proof-reuse.mjs

@@ -11,6 +11,7 @@ import {
   verifySourceQualificationProof,
 } from "../packages/core/dev-delivery-warrant.js";
 import { validateControllerReceipt } from "../packages/core/controller-evidence.js";
+import { exactMergeGroupBinding } from "./dev-delivery-source-proof-replay.mjs";
 
 const REUSE_DECISION_SCHEMA =
   "kungfu.buildchain.source-qualification-reuse-decision/v1";
@@ -113,98 +114,6 @@ function gitPathRoot(ref, paths, label, cwd) {
   });
 }
 
-function exactMergeGroupBinding(input = {}) {
-  const cwd = path.resolve(input.cwd || process.cwd());
-  const mergeGroupHead = exactSha(input.mergeGroupHead, "mergeGroupHead");
-  const expectedTree = exactSha(input.mergeGroupTree, "mergeGroupTree");
-  const currentBase = exactSha(input.currentBase, "currentBase");
-  const sourceHead = exactSha(input.sourceHead, "sourceHead");
-  const actualTree = exactSha(
-    git(["rev-parse", `${mergeGroupHead}^{tree}`], { cwd }),
-    "mergeGroupTree",
-  );
-  if (actualTree !== expectedTree)
-    return { ok: false, reason: "merge-group-tree-mismatch" };
-  const [commit, ...parents] = git(
-    ["rev-list", "--parents", "-n", "1", mergeGroupHead],
-    { cwd },
-  ).split(/\s+/u);
-  if (commit !== mergeGroupHead) {
-    return { ok: false, reason: "merge-group-parent-mismatch" };
-  }
-  if (
-    parents.length === 2 &&
-    parents[0] === currentBase &&
-    parents[1] === sourceHead
-  ) {
-    return {
-      ok: true,
-      mergeGroupHead,
-      mergeGroupTree: actualTree,
-      parents,
-      compositionMode: "two-parent-merge",
-      replayedCommitTrees: [],
-    };
-  }
-
-  const linearRange = (head) => {
-    try {
-      git(["merge-base", "--is-ancestor", currentBase, head], { cwd });
-    } catch {
-      return null;
-    }
-    const commits = git(
-      ["rev-list", "--reverse", "--topo-order", `${currentBase}..${head}`],
-      { cwd },
-    )
-      .split(/\s+/u)
-      .filter(Boolean);
-    if (commits.length === 0) return null;
-    let expectedParent = currentBase;
-    const trees = [];
-    for (const rangeCommit of commits) {
-      const [observedCommit, ...rangeParents] = git(
-        ["rev-list", "--parents", "-n", "1", rangeCommit],
-        { cwd },
-      ).split(/\s+/u);
-      if (
-        observedCommit !== rangeCommit ||
-        rangeParents.length !== 1 ||
-        rangeParents[0] !== expectedParent
-      ) {
-        return null;
-      }
-      trees.push(
-        exactSha(
-          git(["rev-parse", `${rangeCommit}^{tree}`], { cwd }),
-          "replayedCommitTree",
-        ),
-      );
-      expectedParent = rangeCommit;
-    }
-    return trees;
-  };
-
-  const sourceTrees = linearRange(sourceHead);
-  const mergeGroupTrees = linearRange(mergeGroupHead);
-  if (
-    !sourceTrees ||
-    !mergeGroupTrees ||
-    sourceTrees.length !== mergeGroupTrees.length ||
-    sourceTrees.some((tree, index) => tree !== mergeGroupTrees[index])
-  ) {
-    return { ok: false, reason: "merge-group-parent-mismatch" };
-  }
-  return {
-    ok: true,
-    mergeGroupHead,
-    mergeGroupTree: actualTree,
-    parents,
-    compositionMode: "linear-replay",
-    replayedCommitTrees: mergeGroupTrees,
-  };
-}
-
 export function sourceQualificationPredicates(input = {}) {
   const cwd = path.resolve(input.cwd || process.cwd());
   const repository = required(input.repository, "repository");
@@ -397,7 +306,8 @@ export function materializeReuseLifecycleEvidence({
       decisionRoot: decision.decisionRoot,
       sourceWorkflowRunId: decision.sourceWorkflowRunId,
       sourceHead: decision.sourceHead,
-      qualifiedBase: decision.currentBase,
+      qualifiedBase: decision.qualifiedBase,
+      currentBase: decision.currentBase,
       mergeGroupHead: decision.mergeGroupHead,
       mergeGroupTree: decision.mergeGroupTree,
     },
@@ -446,7 +356,7 @@ export function verifySourceQualificationReuse(input = {}) {
   const verification = verifySourceQualificationProof(proof, {
     repository: required(input.repository, "repository"),
     protectedBase: required(input.protectedBase, "protectedBase"),
-    qualifiedBase: exactSha(input.currentBase, "currentBase"),
+    qualifiedBase: exactSha(proof.qualifiedBase, "qualifiedBase"),
     sourceHead: exactSha(input.sourceHead, "sourceHead"),
     sourceWorkflowRunId: Number(input.sourceWorkflowRunId),
     controllerReceiptRoot: receipt.digest,
@@ -462,7 +372,7 @@ export function verifySourceQualificationReuse(input = {}) {
   }
   const current = sourceQualificationPredicates({
     ...input,
-    qualifiedBase: input.currentBase,
+    qualifiedBase: proof.qualifiedBase,
   });
   const classification = classifyDevDeliveryDelta({
     proof,
@@ -476,7 +386,11 @@ export function verifySourceQualificationReuse(input = {}) {
       reason: classification.reason,
     });
   }
-  const mergeGroup = exactMergeGroupBinding(input);
+  const mergeGroup = exactMergeGroupBinding({
+    ...input,
+    qualifiedBase: proof.qualifiedBase,
+    sourcePatchRoot: proof.sourcePatchRoot,
+  });
   if (!mergeGroup.ok) {
     return rootedDecision({
       schema: REUSE_DECISION_SCHEMA,
@@ -493,12 +407,14 @@ export function verifySourceQualificationReuse(input = {}) {
     sourceProofRoot: proof.proofRoot,
     sourceWorkflowRunId: proof.sourceWorkflowRunId,
     sourceHead: proof.sourceHead,
-    currentBase: proof.qualifiedBase,
+    qualifiedBase: proof.qualifiedBase,
+    currentBase: exactSha(input.currentBase, "currentBase"),
     mergeGroupHead: mergeGroup.mergeGroupHead,
     mergeGroupTree: mergeGroup.mergeGroupTree,
     mergeGroupParents: mergeGroup.parents,
     mergeGroupCompositionMode: mergeGroup.compositionMode,
     mergeGroupReplayTrees: mergeGroup.replayedCommitTrees,
+    mergeGroupReplayPatchRoots: mergeGroup.replayedCommitPatchRoots,
     predicateRoots: {
       sourceIdentityRoot: proof.sourceIdentityRoot,
       sourcePatchRoot: proof.sourcePatchRoot,

package/scripts/dev-delivery-two-phase-resume.mjs

@@ -0,0 +1,345 @@
+import { execFileSync } from "node:child_process";
+
+import {
+  createNativeCommandContract,
+  createNativeProofReuseDecision,
+  createNativeQualificationProof,
+} from "../packages/core/dev-delivery-warrant.js";
+
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+
+function exactLocalSha(value, label) {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (!/^[0-9a-f]{40}$/u.test(normalized))
+    throw new Error(`${label} must be an exact lowercase Git SHA`);
+  return normalized;
+}
+
+export class LocalTwoPhaseClient {
+  constructor({ candidateDirectory } = {}) {
+    this.candidateDirectory = candidateDirectory;
+  }
+
+  git(args, options = {}) {
+    return execFileSync("git", ["-C", this.candidateDirectory, ...args], {
+      encoding: "utf8",
+      ...options,
+    }).trim();
+  }
+
+  async baseSha(branch) {
+    return exactLocalSha(
+      this.git(["rev-parse", `refs/remotes/origin/${branch}`]),
+      "protected base SHA",
+    );
+  }
+
+  async exactPullRequestHead(_pullRequestNumber, expectedHead) {
+    const observed = exactLocalSha(this.git(["rev-parse", "HEAD"]), "PR head");
+    if (observed !== expectedHead)
+      throw new Error(
+        `semantic source head changed: ${observed} != ${expectedHead}`,
+      );
+    return observed;
+  }
+
+  async baseDelta(previousBase, currentBase) {
+    if (previousBase === currentBase)
+      return {
+        graphKnown: true,
+        attributionComplete: true,
+        changedPaths: [],
+        renames: [],
+      };
+    try {
+      this.git(["merge-base", "--is-ancestor", previousBase, currentBase]);
+    } catch {
+      return {
+        graphKnown: false,
+        attributionComplete: false,
+        changedPaths: [],
+        renames: [],
+      };
+    }
+    const entries = this.git([
+      "diff",
+      "--name-status",
+      "-M",
+      previousBase,
+      currentBase,
+    ])
+      .split("\n")
+      .filter(Boolean)
+      .map((line) => line.split("\t"));
+    const renames = entries
+      .filter(([status]) => status.startsWith("R"))
+      .map(([, from, to]) => ({ from, to }));
+    return {
+      graphKnown: true,
+      attributionComplete: renames.every(({ from, to }) => from && to),
+      changedPaths: [
+        ...new Set(entries.flatMap(([, ...paths]) => paths).filter(Boolean)),
+      ].sort(),
+      renames,
+    };
+  }
+}
+
+export class GitHubTwoPhaseClient {
+  constructor({
+    repository,
+    token,
+    apiUrl = "https://api.github.com",
+    fetchImpl = globalThis.fetch,
+  } = {}) {
+    if (!token) throw new Error("GITHUB_TOKEN is required");
+    this.repository = repository;
+    this.token = token;
+    this.apiUrl = apiUrl.replace(/\/+$/u, "");
+    this.fetch = fetchImpl;
+  }
+
+  async request(requestPath, { method = "GET", body } = {}) {
+    const response = await this.fetch(`${this.apiUrl}${requestPath}`, {
+      method,
+      headers: {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${this.token}`,
+        "content-type": "application/json",
+        "x-github-api-version": "2022-11-28",
+      },
+      body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    const raw = await response.text();
+    const data = raw ? JSON.parse(raw) : null;
+    if (!response.ok) throw new Error(data?.message || `${requestPath} failed`);
+    return data;
+  }
+
+  async baseSha(branch) {
+    const data = await this.request(
+      `/repos/${this.repository}/git/ref/heads/${branch
+        .split("/")
+        .map(encodeURIComponent)
+        .join("/")}`,
+    );
+    return exactLocalSha(data?.object?.sha, "protected base SHA");
+  }
+
+  async exactPullRequestHead(pullRequestNumber, expectedHead) {
+    const data = await this.request(
+      `/repos/${this.repository}/pulls/${pullRequestNumber}`,
+    );
+    const observed = exactLocalSha(data?.head?.sha, "observed PR head");
+    if (observed !== expectedHead)
+      throw new Error(
+        `semantic source head changed: ${observed} != ${expectedHead}`,
+      );
+    return observed;
+  }
+
+  async baseDelta(previousBase, currentBase) {
+    if (previousBase === currentBase)
+      return {
+        graphKnown: true,
+        attributionComplete: true,
+        changedPaths: [],
+        renames: [],
+      };
+    const data = await this.request(
+      `/repos/${this.repository}/compare/${previousBase}...${currentBase}`,
+    );
+    return attributedGitHubBaseDelta(data, previousBase);
+  }
+
+  async wake(eventType, candidate) {
+    await this.request(`/repos/${this.repository}/dispatches`, {
+      method: "POST",
+      body: { event_type: eventType, client_payload: { candidate } },
+    });
+  }
+}
+
+export function attributedGitHubBaseDelta(data, previousBase) {
+  const files = Array.isArray(data?.files) ? data.files : [];
+  const graphKnown =
+    data?.status === "ahead" &&
+    data?.merge_base_commit?.sha === previousBase &&
+    files.length < 300;
+  const renames = files
+    .filter((entry) => entry.status === "renamed")
+    .map((entry) => ({
+      from: String(entry.previous_filename || ""),
+      to: String(entry.filename || ""),
+    }));
+  const attributionComplete =
+    graphKnown && renames.every((entry) => entry.from && entry.to);
+  return {
+    graphKnown,
+    attributionComplete,
+    changedPaths: attributionComplete
+      ? [
+          ...new Set(
+            files
+              .flatMap((entry) => [
+                String(entry.filename || ""),
+                String(entry.previous_filename || ""),
+              ])
+              .filter(Boolean),
+          ),
+        ].sort()
+      : [],
+    renames: attributionComplete ? renames : [],
+  };
+}
+
+export async function replayQualifiedNativeWarrant({
+  warrant,
+  pullRequestNumber,
+  expectedHead,
+  exactPullRequestHead,
+}) {
+  if (warrant.phase !== "qualified") return null;
+  if (
+    !ROOT_PATTERN.test(warrant.nativeProofRoot || "") ||
+    !ROOT_PATTERN.test(warrant.nativeProofReuseRoot || "") ||
+    !ROOT_PATTERN.test(warrant.qualificationReceiptRoot || "")
+  ) {
+    throw new Error(
+      "qualified Warrant replay is missing rooted native or qualification evidence",
+    );
+  }
+  await exactPullRequestHead(pullRequestNumber, expectedHead);
+  return {
+    schema: "kungfu.buildchain.two-phase-delivery-result/v1",
+    ok: true,
+    outcome: "already-qualified-warrant",
+    nativeAttempts: 0,
+    nativeProofRoot: warrant.nativeProofRoot,
+    nativeReuseDecisionRoot: warrant.nativeProofReuseRoot,
+    qualificationReceiptRoot: warrant.qualificationReceiptRoot,
+    landingAuthority: false,
+    qualifiedWarrant: warrant,
+  };
+}
+
+export async function classifyNativeProofAgainstCurrent(
+  proof,
+  options,
+  client,
+) {
+  const currentBase = await client.baseSha(options.branch);
+  const delta = await client.baseDelta(proof.qualifiedBase, currentBase);
+  const current = {
+    sourceHead: options.expectedHead,
+    sourceIdentityRoot: options.sourceIdentityRoot,
+    sourcePatchRoot: options.sourcePatchRoot,
+    planRoot: options.planRoot,
+    closureRoot: options.closureRoot,
+    dependencyRoot: options.dependencyRoot,
+    toolchainRoot: options.toolchainRoot,
+    environmentRoot: options.environmentRoot,
+    nativeCommandRoot: options.nativeCommandRoot,
+    currentBase,
+    graphKnown: delta.graphKnown,
+    attributionComplete: delta.attributionComplete,
+    changedPaths: delta.changedPaths,
+    renames: delta.renames,
+  };
+  return {
+    current,
+    decision: createNativeProofReuseDecision({ proof, current }),
+  };
+}
+
+export async function runNativeQualificationAttempt({
+  options,
+  warrant,
+  attempt,
+  client,
+  runCommand,
+  runNative,
+  composeCandidate,
+  writeEvidence,
+}) {
+  await client.exactPullRequestHead(
+    options.pullRequestNumber,
+    options.expectedHead,
+  );
+  const qualifiedBase = await client.baseSha(options.branch);
+  composeCandidate(
+    options.candidateDirectory,
+    options.expectedHead,
+    qualifiedBase,
+  );
+  const commandContract = createNativeCommandContract(options.nativeCommand);
+  if (
+    commandContract.commandRoot !==
+      warrant.nativeCommandContract?.commandRoot ||
+    commandContract.commandRoot !== options.nativeCommandRoot
+  ) {
+    throw new Error(
+      "native command does not match the authorized Warrant contract",
+    );
+  }
+  const nativeExecutionReceipt = await runNative({
+    command: options.nativeCommand,
+    cwd: options.candidateDirectory,
+    intervalMs: options.heartbeatSeconds * 1000,
+    executionBinding: {
+      repository: options.repository,
+      protectedBase: options.branch,
+      sourceHead: options.expectedHead,
+      qualifiedBase,
+      nativeCommandRoot: options.nativeCommandRoot,
+      toolchainRoot: options.toolchainRoot,
+      environmentRoot: options.environmentRoot,
+    },
+    heartbeat: async () => {
+      await runCommand({
+        command: "heartbeat",
+        repository: options.repository,
+        branch: options.branch,
+        fencingToken: warrant.fencingToken,
+        leaseGeneration: warrant.generation,
+        leaseSeconds: options.leaseSeconds,
+        execute: true,
+        token: options.token,
+        apiUrl: options.apiUrl,
+      });
+    },
+  });
+  writeEvidence(
+    `native-heartbeat-attempt-${attempt}.json`,
+    nativeExecutionReceipt,
+  );
+  await client.exactPullRequestHead(
+    options.pullRequestNumber,
+    options.expectedHead,
+  );
+  const proof = createNativeQualificationProof({
+    repository: options.repository,
+    protectedBase: options.branch,
+    sourceIdentityRoot: options.sourceIdentityRoot,
+    sourcePatchRoot: options.sourcePatchRoot,
+    planRoot: options.planRoot,
+    closureRoot: options.closureRoot,
+    dependencyRoot: options.dependencyRoot,
+    toolchainRoot: options.toolchainRoot,
+    environmentRoot: options.environmentRoot,
+    sourceHead: options.expectedHead,
+    qualifiedBase,
+    nativeCommandRoot: options.nativeCommandRoot,
+    nativeExecutionReceipt,
+    affectedPaths: options.affectedPaths,
+    shardEvidenceRoots: [
+      ...options.shardEvidenceRoots,
+      nativeExecutionReceipt.receiptRoot,
+    ],
+    qualifiedAt: new Date().toISOString(),
+  });
+  writeEvidence("native-proof.json", proof);
+  return proof;
+}