@kungfu-tech/buildchain 4.0.1-alpha.2 → 4.0.1-alpha.21

package/scripts/release-candidate-anchor-provenance.mjs

@@ -0,0 +1,99 @@
+import path from "node:path";
+
+export function resolveAnchorRecoveryRequest({ passport, buildSummary, transactionId = "" } = {}) {
+  if (Number(passport?.pullRequest?.number || 0)) return undefined;
+  if (passport?.target?.channel !== "anchor" || passport?.target?.ref !== "publish-gate/anchor") {
+    throw new Error("Release Candidate Passport has no PR identity");
+  }
+  let releaseManifest;
+  try {
+    releaseManifest = JSON.parse(buildSummary?.publishSource?.releaseManifest || "");
+  } catch {
+    throw new Error("anchored candidate release manifest is invalid");
+  }
+  const request = releaseManifest?.anchorRequest;
+  if (
+    releaseManifest?.sourceRef !== "publish-gate/anchor" ||
+    releaseManifest?.sourceSha !== passport.source?.headSha ||
+    request?.schema !== 1 ||
+    request?.contract !== "kungfu-buildchain-explicit-publish-anchor-request/v1" ||
+    !request.assignmentId ||
+    !/^native:[0-9a-f-]+$/u.test(String(request.attemptId || "")) ||
+    request.transactionId !== transactionId ||
+    request.source?.sha !== passport.source?.headSha ||
+    request.source?.tree !== passport.source?.treeHash ||
+    !/^\d+$/u.test(String(request.supersededCandidate?.workflowRunId || "")) ||
+    !/^[0-9a-f]{40}$/u.test(String(request.supersededCandidate?.sha || "")) ||
+    !/^sha256:[0-9a-f]{64}$/u.test(String(request.supersededCandidate?.root || "")) ||
+    request.runtime?.sha !== passport.buildchain?.sha
+  ) {
+    throw new Error("anchored candidate request does not bind the sealed recovery identity");
+  }
+  return request;
+}
+
+function normalizeRun(run, repository) {
+  return {
+    id: String(run.id), repository,
+    headRepository: run.head_repository?.full_name || "",
+    status: run.status, conclusion: run.conclusion,
+    event: run.event, path: run.path, name: run.name,
+    headSha: run.head_sha || "", headBranch: run.head_branch || "",
+    pullRequestNumbers: (run.pull_requests || []).map((entry) => Number(entry.number)),
+  };
+}
+
+export function normalizeCandidateRun(run, repository) {
+  return normalizeRun(run, repository);
+}
+
+export function normalizeAnchorProvenance(anchorProvenance, repository) {
+  if (!anchorProvenance) return undefined;
+  return {
+    request: anchorProvenance.request,
+    run: normalizeRun(anchorProvenance.run, repository),
+    workflow: {
+      path: anchorProvenance.workflow.path,
+      name: anchorProvenance.workflow.name,
+      state: anchorProvenance.workflow.state,
+    },
+    passport: anchorProvenance.passport,
+    buildSummary: anchorProvenance.buildSummary,
+  };
+}
+
+export async function recoverCandidateProvenance({
+  passport, buildSummary, transactionId, repoInfo, artifactName,
+  expectedWorkflowFile, expectedWorkflowName, channel, apiUrl, token,
+  fetchImpl, archiveDir, bundleRoot, githubJson, selectReleaseCandidateArtifacts,
+  downloadArtifact, readOnlyJson,
+}) {
+  const request = resolveAnchorRecoveryRequest({ passport, buildSummary, transactionId });
+  if (!request) {
+    return { anchorProvenance: undefined, provenancePassport: passport };
+  }
+  const runId = String(request.supersededCandidate.workflowRunId);
+  const run = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/runs/${runId}` });
+  const workflow = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/workflows/${run.workflow_id}` });
+  const artifactResponse = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/runs/${runId}/artifacts?per_page=100` });
+  const artifacts = Array.isArray(artifactResponse.artifacts) ? artifactResponse.artifacts : [];
+  if (Number(artifactResponse.total_count || artifacts.length) !== artifacts.length) throw new Error("superseded candidate run has more than 100 artifacts; complete pagination is required before recovery");
+  const selected = selectReleaseCandidateArtifacts({ artifacts, artifactName });
+  const provenanceRoot = path.join(bundleRoot, "anchored-provenance");
+  const passportDownload = await downloadArtifact({ artifact: selected.passport, repoInfo, apiUrl, token, archiveDir, bundleRoot: provenanceRoot, fetchImpl });
+  const summaryDownload = await downloadArtifact({ artifact: selected.summary, repoInfo, apiUrl, token, archiveDir, bundleRoot: provenanceRoot, fetchImpl });
+  const recoveredPassport = readOnlyJson(passportDownload.files.filter((file) => path.basename(file.path) === "release-candidate-passport.json"), "superseded release-candidate-passport.json");
+  const recoveredBuildSummary = readOnlyJson(summaryDownload.files.filter((file) => path.basename(file.path) === "build-summary.json"), "superseded build-summary.json");
+  if (
+    String(run.id) !== runId ||
+    recoveredPassport.workflow?.runId !== runId ||
+    recoveredPassport.workflow?.name !== expectedWorkflowName ||
+    String(workflow.path || run.path || "").split("@")[0].replace(/^\.github\/workflows\//u, "") !== expectedWorkflowFile.replace(/^\.github\/workflows\//u, "") ||
+    recoveredPassport.target?.channel !== channel ||
+    recoveredPassport.source?.headSha !== request.supersededCandidate.sha ||
+    recoveredPassport.source?.treeHash !== request.source.tree ||
+    `sha256:${recoveredPassport.candidateHash}` !== request.supersededCandidate.root
+  ) throw new Error("superseded candidate provenance does not match the anchored request");
+  const anchorProvenance = { request, run, workflow, passport: recoveredPassport, buildSummary: recoveredBuildSummary };
+  return { anchorProvenance, provenancePassport: recoveredPassport };
+}

package/scripts/release-tail.mjs

@@ -11,6 +11,10 @@ import {
   writeReleaseTailTransaction,
 } from "../packages/core/release-tail-provider-plane.js";
 import { diagnoseLegacyReleaseTailHooks } from "../packages/core/release-tail-compatibility.js";
+import {
+  V4_PUBLICATION_REHEARSAL_EVIDENCE_CONTRACT,
+  executeV4PublicationRehearsal,
+} from "../packages/core/v4-publication-rehearsal.js";
 
 function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
@@ -34,8 +38,52 @@ function output(value, filePath = "") {
   process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
 
-export function runReleaseTailCli(args = process.argv.slice(2)) {
+export async function runReleaseTailCli(args = process.argv.slice(2)) {
   const [mode = "status", ...options] = args;
+  if (mode === "rehearse") {
+    const capsulePath = flag(options, "capsule");
+    const candidateRoot = flag(options, "candidate-root");
+    const statePath = flag(options, "state");
+    const evidencePath = flag(options, "evidence");
+    for (const [name, value] of Object.entries({
+      "--capsule": capsulePath,
+      "--candidate-root": candidateRoot,
+      "--state": statePath,
+      "--evidence": evidencePath,
+    }))
+      if (!value || !path.isAbsolute(value))
+        throw new Error(`${name} must be an explicit absolute path`);
+    const rehearsalMode = flag(options, "mode", "simulate");
+    if (!new Set(["simulate", "replay"]).has(rehearsalMode))
+      throw new Error(
+        "local rehearsal --mode must be simulate or replay; authorized provider rehearsal uses the reusable workflow",
+      );
+    try {
+      const result = await executeV4PublicationRehearsal({
+        capsule: readJson(capsulePath, "--capsule"),
+        candidateRoot,
+        mode: rehearsalMode,
+        checkpoint: (transaction) =>
+          writeReleaseTailTransaction(statePath, transaction),
+      });
+      writeReleaseTailTransaction(statePath, result.transaction);
+      output(result.evidence, evidencePath);
+      return result;
+    } catch (error) {
+      output(
+        {
+          schema: V4_PUBLICATION_REHEARSAL_EVIDENCE_CONTRACT,
+          status: "rejected",
+          code: error.code || "publication-rehearsal-runtime-error",
+          message: error.message,
+          productionAuthority: false,
+          releasePassport: null,
+        },
+        evidencePath,
+      );
+      throw error;
+    }
+  }
   if (mode === "plan") {
     const plan = compileReleaseTailDeclaration(
       readJson(flag(options, "declaration"), "--declaration"),
@@ -95,7 +143,7 @@ export function runReleaseTailCli(args = process.argv.slice(2)) {
     return report;
   }
   throw new Error(
-    "usage: buildchain release-tail <plan|init|status|verify|compat> [--declaration <json-or-path>] [--state <path>] [--hooks-json <json-or-path>] [--output <path>]",
+    "usage: buildchain release-tail <plan|init|status|verify|compat|rehearse> [--declaration <json-or-path>] [--capsule <absolute-path>] [--candidate-root <absolute-path>] [--mode <simulate|replay>] [--state <absolute-path>] [--evidence <absolute-path>] [--hooks-json <json-or-path>] [--output <path>]",
   );
 }
 
@@ -105,7 +153,7 @@ if (
   import.meta.url === pathToFileURL(process.argv[1]).href
 ) {
   try {
-    runReleaseTailCli();
+    await runReleaseTailCli();
   } catch (error) {
     console.error(`release-tail: ${error.message}`);
     process.exitCode = 1;

package/scripts/release-train-self-dogfood.mjs

@@ -6,7 +6,11 @@ import fs from "node:fs";
 import {
   closeDevDeliveryWarrant,
   createDevDeliveryQueue,
+  createNativeCommandContract,
+  createNativeProofReuseDecision,
+  createNativeQualificationProof,
   createReleaseBlockerPriorityClaim,
+  qualifyDevDeliveryWarrant,
   selectDevDeliveryWarrant,
   submitDevDeliveryCandidate,
 } from "../packages/core/dev-delivery-warrant.js";
@@ -81,9 +85,12 @@ function branch(value, label) {
   return normalized;
 }
 
-function at(recordedAt, seconds) {
-  return new Date(Date.parse(recordedAt) + seconds * 1000).toISOString();
-}
+const at = (recordedAt, seconds) => new Date(Date.parse(recordedAt) + seconds * 1000).toISOString();
+
+const normalizeFields = (input, fields, normalizer, prefix = "") =>
+  Object.fromEntries(fields.map((field) => [field, normalizer(input?.[field], `${prefix}${field}`)]));
+
+const requireEvidence = (condition, message) => { if (!condition) throw new Error(message); };
 
 function normalizeDelivery(input, expected) {
   const delivery = {
@@ -92,59 +99,44 @@ function normalizeDelivery(input, expected) {
       "delivery.pullRequestNumber",
     ),
     baseBranch: branch(input?.baseBranch, "delivery.baseBranch"),
-    headSha: sha(input?.headSha, "delivery.headSha"),
-    headTreeSha: sha(input?.headTreeSha, "delivery.headTreeSha"),
-    state: text(input?.state, "delivery.state"),
-    reviewState: text(input?.reviewState, "delivery.reviewState"),
-    reviewHeadSha: sha(input?.reviewHeadSha, "delivery.reviewHeadSha"),
-    mergeSha: sha(input?.mergeSha, "delivery.mergeSha"),
-    mergeTreeSha: sha(input?.mergeTreeSha, "delivery.mergeTreeSha"),
-    ciHeadSha: sha(input?.ciHeadSha, "delivery.ciHeadSha"),
-    ciConclusion: text(input?.ciConclusion, "delivery.ciConclusion"),
-    reviewRoot: root(input?.reviewRoot, "delivery.reviewRoot"),
-    ciRoot: root(input?.ciRoot, "delivery.ciRoot"),
-    mergeRoot: root(input?.mergeRoot, "delivery.mergeRoot"),
-    artifactRoot: root(input?.artifactRoot, "delivery.artifactRoot"),
-    installedProductRoot: root(
-      input?.installedProductRoot,
-      "delivery.installedProductRoot",
+    ...normalizeFields(
+      input,
+      ["headSha", "headTreeSha", "reviewHeadSha", "mergeSha", "mergeTreeSha", "ciHeadSha"],
+      sha,
+      "delivery.",
+    ),
+    ...normalizeFields(input, ["state", "reviewState", "ciConclusion"], text, "delivery."),
+    ...normalizeFields(
+      input,
+      ["reviewRoot", "ciRoot", "mergeRoot", "artifactRoot", "installedProductRoot"],
+      root,
+      "delivery.",
     ),
   };
-  if (delivery.baseBranch !== expected.sourceBranch) {
-    throw new Error(
-      "protected delivery base does not match the Release Cut source branch",
-    );
-  }
-  if (
-    delivery.state !== "MERGED" ||
-    delivery.reviewState !== "APPROVED" ||
-    delivery.ciConclusion !== "success"
-  ) {
-    throw new Error(
-      "protected delivery is not merged, approved, and CI-successful",
-    );
-  }
-  if (
-    delivery.headSha !== expected.devLandingSha ||
-    delivery.reviewHeadSha !== delivery.headSha
-  ) {
-    throw new Error(
-      "protected delivery review does not bind the exact repaired head",
-    );
-  }
-  if (
-    delivery.headTreeSha !== expected.cutCandidateTreeSha ||
-    delivery.mergeTreeSha !== delivery.headTreeSha
-  ) {
-    throw new Error(
-      "protected delivery merge tree does not equal the repaired candidate tree",
-    );
-  }
-  if (delivery.ciHeadSha !== delivery.mergeSha) {
-    throw new Error(
-      "protected delivery CI does not bind the merge-group result",
-    );
-  }
+  requireEvidence(
+    delivery.baseBranch === expected.sourceBranch,
+    "protected delivery base does not match the Release Cut source branch",
+  );
+  requireEvidence(
+    delivery.state === "MERGED" &&
+      delivery.reviewState === "APPROVED" &&
+      delivery.ciConclusion === "success",
+    "protected delivery is not merged, approved, and CI-successful",
+  );
+  requireEvidence(
+    delivery.headSha === expected.devLandingSha &&
+      delivery.reviewHeadSha === delivery.headSha,
+    "protected delivery review does not bind the exact repaired head",
+  );
+  requireEvidence(
+    delivery.headTreeSha === expected.cutCandidateTreeSha &&
+      delivery.mergeTreeSha === delivery.headTreeSha,
+    "protected delivery merge tree does not equal the repaired candidate tree",
+  );
+  requireEvidence(
+    delivery.ciHeadSha === delivery.mergeSha,
+    "protected delivery CI does not bind the merge-group result",
+  );
   return delivery;
 }
 
@@ -153,50 +145,32 @@ function normalizeInput(input = {}) {
     repository: repository(input.repository),
     sourceBranch: branch(input.sourceBranch, "sourceBranch"),
     targetBranch: branch(input.targetBranch, "targetBranch"),
-    assignmentRoot: root(input.assignmentRoot, "assignmentRoot"),
-    initiativeRoot: root(input.initiativeRoot, "initiativeRoot"),
-    dependencyProofRoot: root(input.dependencyProofRoot, "dependencyProofRoot"),
-    originDevSha: sha(input.originDevSha, "originDevSha"),
-    candidateSha: sha(input.candidateSha, "candidateSha"),
-    candidateTreeSha: sha(input.candidateTreeSha, "candidateTreeSha"),
-    alphaBaseSha: sha(input.alphaBaseSha, "alphaBaseSha"),
-    buildchainRuntimeSha: sha(
-      input.buildchainRuntimeSha,
-      "buildchainRuntimeSha",
-    ),
-    observedDevSha: sha(input.observedDevSha, "observedDevSha"),
-    blockerRoot: root(input.blockerRoot, "blockerRoot"),
-    patchRoot: root(input.patchRoot, "patchRoot"),
-    cutCandidateSha: sha(input.cutCandidateSha, "cutCandidateSha"),
-    cutCandidateTreeSha: sha(input.cutCandidateTreeSha, "cutCandidateTreeSha"),
-    cutLandingEvidenceRoot: root(
-      input.cutLandingEvidenceRoot,
-      "cutLandingEvidenceRoot",
+    ...normalizeFields(
+      input,
+      ["assignmentRoot", "initiativeRoot", "dependencyProofRoot", "environmentRoot", "blockerRoot", "patchRoot", "cutLandingEvidenceRoot", "devConflictEvidenceRoot", "devLandingEvidenceRoot"],
+      root,
     ),
-    devBaseSha: sha(input.devBaseSha, "devBaseSha"),
-    devLandingSha: sha(input.devLandingSha, "devLandingSha"),
-    devConflictEvidenceRoot: root(
-      input.devConflictEvidenceRoot,
-      "devConflictEvidenceRoot",
-    ),
-    devLandingEvidenceRoot: root(
-      input.devLandingEvidenceRoot,
-      "devLandingEvidenceRoot",
+    ...normalizeFields(
+      input,
+      ["originDevSha", "candidateSha", "candidateTreeSha", "alphaBaseSha", "buildchainRuntimeSha", "observedDevSha", "cutCandidateSha", "cutCandidateTreeSha", "devBaseSha", "devLandingSha"],
+      sha,
     ),
+    nativeCommand: text(input.nativeCommand, "nativeCommand"),
+    nativeExecutionReceipt: structuredClone(input.nativeExecutionReceipt || {}),
     ordinaryPullRequestNumber: positiveInteger(
       input.ordinaryPullRequestNumber,
       "ordinaryPullRequestNumber",
     ),
     recordedAt: timestamp(input.recordedAt, "recordedAt"),
   };
-  if (normalized.observedDevSha === normalized.originDevSha) {
-    throw new Error(
-      "self-dogfood requires dev to advance beyond the frozen origin",
-    );
-  }
-  if (normalized.cutCandidateSha === normalized.candidateSha) {
-    throw new Error("self-dogfood requires a successor repair candidate");
-  }
+  requireEvidence(
+    normalized.observedDevSha !== normalized.originDevSha,
+    "self-dogfood requires dev to advance beyond the frozen origin",
+  );
+  requireEvidence(
+    normalized.cutCandidateSha !== normalized.candidateSha,
+    "self-dogfood requires a successor repair candidate",
+  );
   normalized.delivery = normalizeDelivery(input.delivery, normalized);
   return normalized;
 }
@@ -214,6 +188,10 @@ function deliveryCandidate(input, deliveryClass = "release") {
     closureRoot: input.closureRoot,
     dependencyRoot: input.dependencyRoot,
     toolchainRoot: input.toolchainRoot,
+    ...(input.environmentRoot ? { environmentRoot: input.environmentRoot } : {}),
+    ...(input.nativeCommand
+      ? { nativeCommandContract: createNativeCommandContract(input.nativeCommand) }
+      : {}),
     deliveryClass,
     priority: "ordinary",
     ...(input.releaseBlockerPriority
@@ -366,7 +344,7 @@ function runQueueCampaign(value, repaired, priorityClaim) {
       dependencyRoot: value.dependencyProofRoot,
       toolchainRoot: value.dependencyProofRoot,
     },
-    "native-proof-required",
+    "non-native-fast",
   );
   queue = submitDevDeliveryCandidate(queue, ordinary, {
     now: at(value.recordedAt, 6),
@@ -388,6 +366,8 @@ function runQueueCampaign(value, repaired, priorityClaim) {
     closureRoot: value.delivery.mergeRoot,
     dependencyRoot: value.dependencyProofRoot,
     toolchainRoot: value.delivery.installedProductRoot,
+    environmentRoot: value.environmentRoot,
+    nativeCommand: value.nativeCommand,
     releaseBlockerPriority: priorityClaim,
   });
   const submitted = submitDevDeliveryCandidate(queue, blocker, {
@@ -426,7 +406,29 @@ function runQueueCampaign(value, repaired, priorityClaim) {
       "eligible release blocker did not receive bounded priority",
     );
   }
-  const closed = closeDevDeliveryWarrant(selected.queue, selected.warrant, {
+  const nativeCommandRoot = createNativeCommandContract(value.nativeCommand).commandRoot;
+  const proof = createNativeQualificationProof({
+    ...selected.warrant,
+    repository: value.repository,
+    protectedBase: value.sourceBranch,
+    qualifiedBase: value.devBaseSha,
+    nativeCommandRoot,
+    nativeExecutionReceipt: value.nativeExecutionReceipt,
+    affectedPaths: [], shardEvidenceRoots: [],
+    qualifiedAt: at(value.recordedAt, 12),
+  });
+  const current = {
+    ...selected.warrant,
+    nativeCommandRoot,
+    currentBase: value.devBaseSha,
+    graphKnown: true, attributionComplete: true,
+    changedPaths: [], renames: [],
+  };
+  const reuseDecision = createNativeProofReuseDecision({ proof, current });
+  const qualified = qualifyDevDeliveryWarrant(selected.queue, selected.warrant, {
+    nativeProof: proof, reuseDecision, current, now: at(value.recordedAt, 12),
+  });
+  const closed = closeDevDeliveryWarrant(qualified.queue, qualified.warrant, {
     outcome: "merged",
     evidenceRoot: value.delivery.mergeRoot,
     now: at(value.recordedAt, 13),