@kungfu-tech/buildchain 4.0.1-alpha.2 → 4.0.1-alpha.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.1-alpha.2",
+  "version": "4.0.1-alpha.3",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -28,6 +28,7 @@
     "./cache-evidence": "./packages/core/cache-evidence.js",
     "./controller-evidence": "./packages/core/controller-evidence.js",
     "./diagnostics": "./packages/core/diagnostics.js",
+    "./dev-delivery-authority": "./packages/core/dev-delivery-authority-landing.js",
     "./dev-delivery-warrant": "./packages/core/dev-delivery-warrant.js",
     "./homebrew": "./packages/core/homebrew.js",
     "./issue-reporting": "./packages/core/issue-reporting.js",
@@ -90,6 +91,7 @@
     "./site/schemas/kfd-agent-hub-adoption.schema.json": "./dist/site/schemas/kfd-agent-hub-adoption.schema.json",
     "./site/schemas/kfd-product-gate-input-v1.schema.json": "./dist/site/schemas/kfd-product-gate-input-v1.schema.json",
     "./site/schemas/kfd-support-projection-v1.schema.json": "./dist/site/schemas/kfd-support-projection-v1.schema.json",
+    "./site/schemas/dev-delivery-authority-v2.schema.json": "./dist/site/schemas/dev-delivery-authority-v2.schema.json",
     "./site/buildchain-contract.json": "./dist/site/buildchain-contract.json",
     "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
     "./site/release-provenance.json": "./dist/site/release-provenance.json",
@@ -107,6 +109,7 @@
     "crates/buildchain-v4-bridge/src/",
     "LICENSE-POLICY.md",
     "scripts/*.mjs",
+    "templates/",
     "packages/core/",
     "dist/site/",
     "README.md",
@@ -124,6 +127,7 @@
   },
   "packageManager": "pnpm@11.7.0",
   "scripts": {
+    "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/v4-delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery-authority-candidate.js packages/core/dev-delivery-authority-evidence.js packages/core/dev-delivery-authority-landing.js packages/core/dev-delivery-authority-observation.js packages/core/dev-delivery-authority-qualification.js packages/core/dev-delivery-authority-settlement.js packages/core/dev-delivery-authority-state.js packages/core/dev-delivery-execution-failure.js packages/core/dev-delivery-execution-transfer.js packages/core/dev-delivery-landing-readback.js packages/core/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery-landing-testing-port.js packages/core/dev-delivery-native-execution.js packages/core/dev-delivery-native-proof.js packages/core/dev-delivery-process-boundary.js packages/core/dev-delivery-warrant-qualification.js packages/core/dev-delivery-warrant-state.js scripts/dev-delivery-authority-command-adapters.mjs scripts/dev-delivery-authority-provider.mjs scripts/dev-delivery-authority.mjs scripts/dev-delivery-native-run.mjs scripts/dev-delivery-process-boundary.mjs scripts/dev-delivery-two-phase-resume.mjs scripts/dev-delivery-two-phase.mjs scripts/dev-delivery-warrant-options.mjs scripts/dev-delivery-warrant-store.mjs templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
     "check": "pnpm run check:static && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs packages/core/v4-canonical-contracts.js packages/core/v4-floating-consumer-evidence.js packages/core/v4-floating-consumer-policy.js packages/core/v4-floating-consumer-release-passport.js packages/core/v4-runtime-ref-resume-authority.js packages/core/v4-runtime-selector-persistence.js packages/core/v4-provider-operation-journal.js packages/core/v4-provider-readback-idempotency.js packages/core/v4-release-activation-shadow.js packages/core/v4-stable-publication-fence.js packages/core/v4-partial-mutation-recovery-qualification.js packages/core/v4-stage-capsule.js packages/core/v4-stage-capsule-store.js packages/core/v4-stage-capsule-local-store.js packages/core/v4-platform-stage-checkpoints.js packages/core/v4-stage-capsule-resume-planner.js packages/core/v4-stage-capsule-qualification.js packages/core/v4-stage-capsule-qualification-campaign.js packages/core/v4-delivery-warrant-fixture-runner.js packages/core/v4-delivery-warrant-read-candidate.js packages/core/v4-delivery-warrant-semantic-diff-gate.js packages/core/v4-delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/dev-pr-prequeue-guard.mjs scripts/check-v4-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/v4-bridge-bootstrap.mjs scripts/v4-bridge-evidence.mjs scripts/v4-consumer-policy.mjs scripts/v4-host-adapter.mjs scripts/v4-platform-stage-checkpoint-rehearsal.mjs scripts/v4-stage-capsule-resume-rehearsal.mjs scripts/v4-stage-capsule-qualification.mjs scripts/v4-warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs tests/v4-bridge.test.mjs tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs tests/v4-warrant-shadow-plan.test.mjs",

package/packages/core/buildchain-contract.js

@@ -9,6 +9,7 @@ import {
 } from "./buildchain-channel-identity.js";
 import { createControllerRegistry } from "./controller-evidence.js";
 import { enumerateWorkflowInputs } from "./public-surface-audit.js";
+import { devDeliveryWorkflowContractSurface } from "./dev-delivery-contract-surface.js";
 
 export {
   BUILDCHAIN_CHANNELS,
@@ -125,8 +126,7 @@ export function createBuildchainContractWorld({
   packageJson = undefined,
   controllerRegistry = undefined,
 } = {}) {
-  const pkg = packageJson || readJson(path.join(root, "package.json"), {});
-  const majorLine = majorLineFromPackageVersion(pkg.version);
+  const pkg = packageJson || readJson(path.join(root, "package.json"), {}), majorLine = majorLineFromPackageVersion(pkg.version);
   const workflowDescriptors = controllerRegistry ? [] : enumerateWorkflowInputs({ root });
   const controllerWorkflowIds = new Set([
     "check",
@@ -217,6 +217,7 @@ export function createBuildchainContractWorld({
         "alpha and stable channel selections use separate consumer contract locks by default",
       ],
     }),
+    surface(root, devDeliveryWorkflowContractSurface(pkg, majorLine)),
     surface(root, {
       id: "release-candidate-promote",
       kind: "workflow",

package/packages/core/dev-delivery-authority-candidate.js

@@ -0,0 +1,270 @@
+import {
+  devDeliveryExactRoot as exactRoot,
+  devDeliveryExactSha as exactSha,
+  devDeliveryText as text,
+  devDeliveryTimestamp as timestamp,
+} from "./dev-delivery-common.js";
+import { createDevDeliveryCandidateIdentity } from "./dev-delivery-candidate-identity.js";
+import { normalizeNativeCommandContract } from "./dev-delivery-native-proof.js";
+import { normalizeDevDeliveryTerminalProviderEvidence } from "./dev-delivery-provider-attempt.js";
+import { normalizeProviderFailureAuthorityBinding } from "./dev-delivery-warrant-settlement.js";
+
+export const TERMINAL_STATES = new Set([
+  "merged",
+  "terminal-failure",
+  "dequeued",
+  "cancelled",
+]);
+const DELIVERY_CLASSES = new Set([
+  "non-native-fast",
+  "native-proof-required",
+  "cross-platform",
+  "release",
+]);
+export const DEV_DELIVERY_COMPATIBILITY_QUALIFICATION_SCHEMA =
+  "kungfu.buildchain.dev-delivery-compatibility-qualification/v1";
+export const DEV_DELIVERY_NATIVE_QUALIFICATION_SCHEMA =
+  "kungfu.buildchain.dev-delivery-native-qualification/v1";
+
+function nonNegativeInteger(value, label, fallback = 0) {
+  const parsed = Number(value ?? fallback);
+  if (!Number.isInteger(parsed) || parsed < 0) {
+    throw new Error(`${label} must be a non-negative integer`);
+  }
+  return parsed;
+}
+
+function normalizedDomains(input = []) {
+  if (!Array.isArray(input))
+    throw new Error(
+      "qualificationDomains must be an array of rooted safety domains",
+    );
+  return [
+    ...new Set(input.map((value) => exactRoot(value, "qualification domain"))),
+  ].sort();
+}
+
+function candidateIdentity(input, expected) {
+  return createDevDeliveryCandidateIdentity(input, expected, (value) => {
+    const normalized = text(value);
+    if (!DELIVERY_CLASSES.has(normalized))
+      throw new Error(`unsupported deliveryClass ${normalized}`);
+    return normalized;
+  });
+}
+
+function nullableRoot(value, label) {
+  return value === null ? null : exactRoot(value, label);
+}
+
+function normalizeQualification(input) {
+  if (!input) return null;
+  if (input.schema === DEV_DELIVERY_COMPATIBILITY_QUALIFICATION_SCHEMA) {
+    if (input.authority !== "legacy-compatibility-only")
+      throw new Error(
+        "compatibility qualification cannot claim native authority",
+      );
+    if (input.nativeProofAuthority !== false)
+      throw new Error(
+        "compatibility qualification must deny native proof authority",
+      );
+    if (!["phase-less", "qualified"].includes(input.legacyWarrantPhase))
+      throw new Error(
+        "compatibility qualification legacy phase is unsupported",
+      );
+    return {
+      schema: input.schema,
+      authority: input.authority,
+      nativeProofAuthority: false,
+      legacyStateRoot: exactRoot(
+        input.legacyStateRoot,
+        "compatibility qualification legacyStateRoot",
+      ),
+      legacyWarrantPhase: input.legacyWarrantPhase,
+      legacyFencingToken: exactRoot(
+        input.legacyFencingToken,
+        "compatibility qualification legacyFencingToken",
+      ),
+      legacyGeneration: nonNegativeInteger(
+        input.legacyGeneration,
+        "compatibility qualification legacyGeneration",
+      ),
+      qualificationReceiptRoot: nullableRoot(
+        input.qualificationReceiptRoot,
+        "compatibility qualification receiptRoot",
+      ),
+      sourceProofRoot: exactRoot(
+        input.sourceProofRoot,
+        "compatibility qualification sourceProofRoot",
+      ),
+      nativeProofRoot: nullableRoot(
+        input.nativeProofRoot,
+        "compatibility qualification nativeProofRoot",
+      ),
+      nativeExecutionBindingRoot: nullableRoot(
+        input.nativeExecutionBindingRoot,
+        "compatibility qualification nativeExecutionBindingRoot",
+      ),
+      nativeExecutionReceiptRoot: nullableRoot(
+        input.nativeExecutionReceiptRoot,
+        "compatibility qualification nativeExecutionReceiptRoot",
+      ),
+      nativeCommandRoot: nullableRoot(
+        input.nativeCommandRoot,
+        "compatibility qualification nativeCommandRoot",
+      ),
+      qualificationContractRoot: nullableRoot(
+        input.qualificationContractRoot,
+        "compatibility qualification contractRoot",
+      ),
+      qualifiedAt:
+        input.qualifiedAt === null
+          ? null
+          : timestamp(
+              input.qualifiedAt,
+              "compatibility qualification qualifiedAt",
+            ),
+    };
+  }
+  if (input.schema !== DEV_DELIVERY_NATIVE_QUALIFICATION_SCHEMA)
+    throw new Error("native qualification schema is unsupported");
+  if (
+    input.authority !== "verified-native-qualification" ||
+    input.nativeProofAuthority !== true
+  )
+    throw new Error("native qualification must carry verified proof authority");
+  return {
+    schema: input.schema,
+    authority: input.authority,
+    nativeProofAuthority: true,
+    ...(input.evidenceRoot
+      ? {
+          evidenceRoot: exactRoot(
+            input.evidenceRoot,
+            "qualification evidenceRoot",
+          ),
+        }
+      : {}),
+    qualificationReceiptRoot: exactRoot(
+      input.qualificationReceiptRoot,
+      "qualification receiptRoot",
+    ),
+    sourceProofRoot: exactRoot(
+      input.sourceProofRoot,
+      "qualification sourceProofRoot",
+    ),
+    nativeProofRoot: exactRoot(
+      input.nativeProofRoot,
+      "qualification nativeProofRoot",
+    ),
+    nativeExecutionBindingRoot: exactRoot(
+      input.nativeExecutionBindingRoot,
+      "qualification nativeExecutionBindingRoot",
+    ),
+    nativeExecutionReceiptRoot: exactRoot(
+      input.nativeExecutionReceiptRoot,
+      "qualification nativeExecutionReceiptRoot",
+    ),
+    nativeCommandRoot: exactRoot(
+      input.nativeCommandRoot,
+      "qualification nativeCommandRoot",
+    ),
+    qualificationContractRoot: exactRoot(
+      input.qualificationContractRoot,
+      "qualification contractRoot",
+    ),
+    qualifiedAt: timestamp(input.qualifiedAt, "qualification qualifiedAt"),
+  };
+}
+
+export function normalizeDevDeliveryAuthorityCandidate(input, expected) {
+  const identity = candidateIdentity(input, expected);
+  if (input.candidateId && input.candidateId !== identity.candidateId)
+    throw new Error(
+      `candidateId mismatch for PR #${identity.pullRequestNumber}`,
+    );
+  const status = text(input.status || "queued");
+  if (
+    ![
+      "queued",
+      "qualifying",
+      "qualified",
+      "landing",
+      ...TERMINAL_STATES,
+    ].includes(status)
+  )
+    throw new Error(`unsupported candidate status ${status || "<empty>"}`);
+  const candidate = {
+    ...identity,
+    sourceHead: exactSha(input.sourceHead, "sourceHead"),
+    sourcePatchRoot: exactRoot(input.sourcePatchRoot, "sourcePatchRoot"),
+    sourceProofRoot: exactRoot(input.sourceProofRoot, "sourceProofRoot"),
+    planRoot: exactRoot(input.planRoot, "planRoot"),
+    closureRoot: exactRoot(input.closureRoot, "closureRoot"),
+    dependencyRoot: exactRoot(input.dependencyRoot, "dependencyRoot"),
+    toolchainRoot: exactRoot(input.toolchainRoot, "toolchainRoot"),
+    enqueuedAt: timestamp(input.enqueuedAt, "candidate enqueuedAt"),
+    updatedAt: timestamp(
+      input.updatedAt || input.enqueuedAt,
+      "candidate updatedAt",
+    ),
+    status,
+    qualification: normalizeQualification(input.qualification),
+    terminal: input.terminal
+      ? {
+          outcome: text(input.terminal.outcome),
+          evidenceRoot: exactRoot(
+            input.terminal.evidenceRoot,
+            "terminal evidenceRoot",
+          ),
+          reason: text(input.terminal.reason),
+          settledAt: timestamp(input.terminal.settledAt, "terminal settledAt"),
+          ...(normalizeProviderFailureAuthorityBinding(input.terminal) || {}),
+          ...normalizeDevDeliveryTerminalProviderEvidence(input.terminal),
+        }
+      : null,
+  };
+  if (Object.hasOwn(input, "environmentRoot"))
+    candidate.environmentRoot = exactRoot(
+      input.environmentRoot,
+      "environmentRoot",
+    );
+  if (Object.hasOwn(input, "nativeCommandContract")) {
+    candidate.nativeCommandContract = normalizeNativeCommandContract(
+      input.nativeCommandContract,
+    );
+  }
+  if (Object.hasOwn(input, "affectedPaths")) {
+    if (!Array.isArray(input.affectedPaths))
+      throw new Error("candidate affectedPaths must be an array");
+    candidate.affectedPaths = [
+      ...new Set(input.affectedPaths.map(text).filter(Boolean)),
+    ].sort();
+  }
+  if (Object.hasOwn(input, "shardEvidenceRoots")) {
+    if (!Array.isArray(input.shardEvidenceRoots))
+      throw new Error("candidate shardEvidenceRoots must be an array");
+    candidate.shardEvidenceRoots = [
+      ...new Set(
+        input.shardEvidenceRoots.map((value) =>
+          exactRoot(value, "candidate shardEvidenceRoot"),
+        ),
+      ),
+    ].sort();
+  }
+  if (Object.hasOwn(input, "qualificationDomains"))
+    candidate.qualificationDomains = normalizedDomains(
+      input.qualificationDomains,
+    );
+  if (Object.hasOwn(input, "qualificationAttempts"))
+    candidate.qualificationAttempts = nonNegativeInteger(
+      input.qualificationAttempts,
+      "candidate qualificationAttempts",
+    );
+  if (Object.hasOwn(input, "landingOvertakes"))
+    candidate.landingOvertakes = nonNegativeInteger(
+      input.landingOvertakes,
+      "candidate landingOvertakes",
+    );
+  return candidate;
+}

package/packages/core/dev-delivery-authority-evidence.js

@@ -0,0 +1,146 @@
+import {
+  devDeliveryClone as clone,
+  devDeliveryContentRoot,
+} from "./dev-delivery-common.js";
+import { verifySourceQualificationProof } from "./dev-delivery-proof.js";
+import { verifyNativeQualificationProof } from "./dev-delivery-native-proof.js";
+
+export const DEV_DELIVERY_BOUNDED_QUALIFICATION_CONTRACT_SCHEMA =
+  "kungfu.buildchain.dev-delivery-bounded-qualification-contract/v1";
+export const DEV_DELIVERY_BOUNDED_QUALIFICATION_RECEIPT_SCHEMA =
+  "kungfu.buildchain.dev-delivery-bounded-qualification-receipt/v1";
+
+function contractBody({ state, candidate, lease, sourceProof, nativeProof }) {
+  return {
+    schema: DEV_DELIVERY_BOUNDED_QUALIFICATION_CONTRACT_SCHEMA,
+    authority: "qualification-only",
+    mergeGroupAdmission: false,
+    repository: state.repository,
+    protectedBase: state.protectedBase,
+    candidateId: candidate.candidateId,
+    qualificationLeaseToken: lease.token,
+    qualificationLeaseGeneration: lease.generation,
+    sourceHead: candidate.sourceHead,
+    sourceProofRoot: sourceProof.proofRoot,
+    nativeProofRoot: nativeProof.proofRoot,
+    nativeExecutionBindingRoot: nativeProof.nativeExecutionBindingRoot,
+    nativeExecutionReceiptRoot: nativeProof.nativeExecutionReceiptRoot,
+    nativeCommandRoot: candidate.nativeCommandContract.commandRoot,
+    planRoot: candidate.planRoot,
+    closureRoot: candidate.closureRoot,
+    dependencyRoot: candidate.dependencyRoot,
+    toolchainRoot: candidate.toolchainRoot,
+    environmentRoot: candidate.environmentRoot,
+    qualificationDomains: candidate.qualificationDomains || [],
+    shardEvidenceRoots: candidate.shardEvidenceRoots || [],
+  };
+}
+
+export function createDevDeliveryQualificationContract(input = {}) {
+  const body = contractBody(input);
+  return { ...body, contractRoot: devDeliveryContentRoot(body) };
+}
+
+export function verifyDevDeliveryQualificationEvidence({
+  state,
+  candidate,
+  lease,
+  sourceProof,
+  nativeProof,
+  qualificationContract,
+}) {
+  const source = verifySourceQualificationProof(sourceProof, {
+    repository: state.repository,
+    protectedBase: state.protectedBase,
+    sourceHead: candidate.sourceHead,
+    sourceIdentityRoot: candidate.sourceIdentityRoot,
+    sourcePatchRoot: candidate.sourcePatchRoot,
+    planRoot: candidate.planRoot,
+    closureRoot: candidate.closureRoot,
+    dependencyRoot: candidate.dependencyRoot,
+    toolchainRoot: candidate.toolchainRoot,
+  });
+  if (!source.ok) {
+    throw new Error(`source qualification proof rejected: ${source.reason}`);
+  }
+  if (source.proofRoot !== candidate.sourceProofRoot) {
+    throw new Error("source qualification proof root does not match candidate");
+  }
+  const native = verifyNativeQualificationProof(nativeProof, {
+    repository: state.repository,
+    protectedBase: state.protectedBase,
+    sourceHead: candidate.sourceHead,
+    sourceIdentityRoot: candidate.sourceIdentityRoot,
+    sourcePatchRoot: candidate.sourcePatchRoot,
+    planRoot: candidate.planRoot,
+    closureRoot: candidate.closureRoot,
+    dependencyRoot: candidate.dependencyRoot,
+    toolchainRoot: candidate.toolchainRoot,
+    environmentRoot: candidate.environmentRoot,
+    nativeCommandRoot: candidate.nativeCommandContract?.commandRoot,
+  });
+  if (!native.ok) {
+    throw new Error(`native qualification proof rejected: ${native.reason}`);
+  }
+  const expectedShards = [
+    ...(candidate.shardEvidenceRoots || []),
+    nativeProof.nativeExecutionReceiptRoot,
+  ].sort();
+  if (
+    JSON.stringify(nativeProof.shardEvidenceRoots) !==
+    JSON.stringify([...new Set(expectedShards)])
+  ) {
+    throw new Error(
+      "native qualification shard evidence does not match candidate",
+    );
+  }
+  const expected = createDevDeliveryQualificationContract({
+    state,
+    candidate,
+    lease,
+    sourceProof,
+    nativeProof,
+  });
+  const observed = clone(qualificationContract || {});
+  if (
+    JSON.stringify(observed) !== JSON.stringify(expected) ||
+    observed.contractRoot !== expected.contractRoot
+  ) {
+    throw new Error(
+      "bounded qualification contract does not match exact evidence",
+    );
+  }
+  return {
+    sourceProofRoot: source.proofRoot,
+    nativeProofRoot: native.proofRoot,
+    nativeExecutionBindingRoot: nativeProof.nativeExecutionBindingRoot,
+    nativeExecutionReceiptRoot: nativeProof.nativeExecutionReceiptRoot,
+    nativeCommandRoot: candidate.nativeCommandContract.commandRoot,
+    qualificationContractRoot: expected.contractRoot,
+  };
+}
+
+export function createDevDeliveryBoundedQualificationReceipt({
+  state,
+  candidate,
+  lease,
+  evidence,
+  qualifiedAt,
+}) {
+  const receipt = {
+    schema: DEV_DELIVERY_BOUNDED_QUALIFICATION_RECEIPT_SCHEMA,
+    action: "qualification-completed-lease-released",
+    authority: "qualification-only",
+    mergeGroupAdmission: false,
+    repository: state.repository,
+    protectedBase: state.protectedBase,
+    candidateId: candidate.candidateId,
+    qualificationLeaseToken: lease.token,
+    qualificationLeaseGeneration: lease.generation,
+    ...evidence,
+    qualifiedAt,
+    expectedOldStateRoot: state.stateRoot,
+    nextAction: "Wait for the single exclusive Landing Warrant.",
+  };
+  return { receipt, receiptRoot: devDeliveryContentRoot(receipt) };
+}