@kungfu-tech/buildchain 4.0.1-alpha.2 → 4.0.1-alpha.4

package/scripts/generate-site-bundle.mjs

@@ -46,6 +46,10 @@ import {
 const SITE_BUNDLE_CONTRACT = "kungfu-buildchain-site-bundle";
 const PUBLICATION_RELEASE_REGISTRY_CONTRACT = "kungfu-buildchain-publication-release-registry";
 const README_PATH = "README.md";
+const DEV_DELIVERY_AUTHORITY_SCHEMA =
+  "schemas/dev-delivery-authority-v2.schema.json";
+const DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE =
+  "contracts/dev-delivery-authority-v2.schema.json";
 const root = path.resolve(import.meta.dirname, "..");
 const outputDir = path.join(root, "dist", "site");
 const requireFromHere = createRequire(import.meta.url);
@@ -73,6 +77,18 @@ function stableJson(value) {
   return `${JSON.stringify(value, null, 2)}\n`;
 }
 
+function siteFileBytes(name, value) {
+  return name === DEV_DELIVERY_AUTHORITY_SCHEMA
+    ? readText(DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE)
+    : stableJson(value);
+}
+
+function writeSiteFile(name, value) {
+  const filePath = path.join(outputDir, name);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, siteFileBytes(name, value));
+}
+
 function env(name) {
   return String(process.env[name] || "").trim();
 }
@@ -931,6 +947,7 @@ function buildSiteBundle() {
       "schemas/release-passport-v1.schema.json",
       "schemas/kfd-agent-hub-adoption.schema.json",
       "schemas/kfd-product-gate-input-v1.schema.json",
+      "schemas/dev-delivery-authority-v2.schema.json",
       "kfd-support.json",
       "artifact-evidence.json",
       "product-mechanism.json",
@@ -965,6 +982,7 @@ function buildSiteBundle() {
       "schemas/release-passport-v1.schema.json",
       "schemas/kfd-agent-hub-adoption.schema.json",
       "schemas/kfd-product-gate-input-v1.schema.json",
+      "schemas/dev-delivery-authority-v2.schema.json",
       "buildchain-contract.json",
       "kfd-claims.json",
       "product-mechanism.json",
@@ -1095,6 +1113,7 @@ function buildSiteBundle() {
       "schemas/release-passport-v1.schema.json",
       "schemas/kfd-agent-hub-adoption.schema.json",
       "schemas/kfd-product-gate-input-v1.schema.json",
+      "schemas/dev-delivery-authority-v2.schema.json",
       "buildchain-contract.json",
       "kfd-upstream-aggregate.json",
       "kfd-claims.json",
@@ -1269,6 +1288,9 @@ function buildSiteBundle() {
     "schemas/release-passport-v1.schema.json": RELEASE_PASSPORT_SCHEMA,
     "schemas/kfd-agent-hub-adoption.schema.json": KFD_AGENT_HUB_ADOPTION_SCHEMA,
     "schemas/kfd-product-gate-input-v1.schema.json": KFD_PRODUCT_GATE_INPUT_SCHEMA,
+    [DEV_DELIVERY_AUTHORITY_SCHEMA]: readJson(
+      DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE,
+    ),
     "badge-endpoint-registry.json": badgeEndpointRegistry,
     "publication-registry.json": publicationRegistry,
     "buildchain-contract.json": createBuildchainContractWorld({ root, controllerRegistry }),
@@ -1288,7 +1310,7 @@ export function writeSiteBundle({ check = false } = {}) {
   const mismatches = [];
   for (const [name, value] of Object.entries(files)) {
     const filePath = path.join(outputDir, name);
-    const next = stableJson(value);
+    const next = siteFileBytes(name, value);
     if (check) {
       if (existingJson(filePath) !== next) {
         mismatches.push(path.relative(root, filePath));
@@ -1301,11 +1323,11 @@ export function writeSiteBundle({ check = false } = {}) {
   if (!check) {
     for (let iteration = 0; iteration < 5; iteration += 1) {
       for (const [name, value] of Object.entries(files)) {
-        writeJson(path.join(outputDir, name), value);
+        writeSiteFile(name, value);
       }
       const nextFiles = buildSiteBundle();
       const stable = Object.entries(nextFiles).every(([name, value]) => (
-        existingJson(path.join(outputDir, name)) === stableJson(value)
+        existingJson(path.join(outputDir, name)) === siteFileBytes(name, value)
       ));
       files = nextFiles;
       if (stable) {
@@ -1316,7 +1338,7 @@ export function writeSiteBundle({ check = false } = {}) {
       }
     }
     for (const [name, value] of Object.entries(files)) {
-      writeJson(path.join(outputDir, name), value);
+      writeSiteFile(name, value);
     }
   }
   return {

package/scripts/npm-publish-transaction.mjs

@@ -128,8 +128,8 @@ function parseNpmView(stdout) {
   const parsed = JSON.parse(raw);
   const dist = parsed?.dist || parsed;
   return {
-    integrity: dist?.integrity || "",
-    shasum: dist?.shasum || "",
+    integrity: dist?.integrity || parsed?.["dist.integrity"] || "",
+    shasum: dist?.shasum || parsed?.["dist.shasum"] || "",
   };
 }
 

package/scripts/release-train-self-dogfood.mjs

@@ -6,7 +6,11 @@ import fs from "node:fs";
 import {
   closeDevDeliveryWarrant,
   createDevDeliveryQueue,
+  createNativeCommandContract,
+  createNativeProofReuseDecision,
+  createNativeQualificationProof,
   createReleaseBlockerPriorityClaim,
+  qualifyDevDeliveryWarrant,
   selectDevDeliveryWarrant,
   submitDevDeliveryCandidate,
 } from "../packages/core/dev-delivery-warrant.js";
@@ -81,9 +85,12 @@ function branch(value, label) {
   return normalized;
 }
 
-function at(recordedAt, seconds) {
-  return new Date(Date.parse(recordedAt) + seconds * 1000).toISOString();
-}
+const at = (recordedAt, seconds) => new Date(Date.parse(recordedAt) + seconds * 1000).toISOString();
+
+const normalizeFields = (input, fields, normalizer, prefix = "") =>
+  Object.fromEntries(fields.map((field) => [field, normalizer(input?.[field], `${prefix}${field}`)]));
+
+const requireEvidence = (condition, message) => { if (!condition) throw new Error(message); };
 
 function normalizeDelivery(input, expected) {
   const delivery = {
@@ -92,59 +99,44 @@ function normalizeDelivery(input, expected) {
       "delivery.pullRequestNumber",
     ),
     baseBranch: branch(input?.baseBranch, "delivery.baseBranch"),
-    headSha: sha(input?.headSha, "delivery.headSha"),
-    headTreeSha: sha(input?.headTreeSha, "delivery.headTreeSha"),
-    state: text(input?.state, "delivery.state"),
-    reviewState: text(input?.reviewState, "delivery.reviewState"),
-    reviewHeadSha: sha(input?.reviewHeadSha, "delivery.reviewHeadSha"),
-    mergeSha: sha(input?.mergeSha, "delivery.mergeSha"),
-    mergeTreeSha: sha(input?.mergeTreeSha, "delivery.mergeTreeSha"),
-    ciHeadSha: sha(input?.ciHeadSha, "delivery.ciHeadSha"),
-    ciConclusion: text(input?.ciConclusion, "delivery.ciConclusion"),
-    reviewRoot: root(input?.reviewRoot, "delivery.reviewRoot"),
-    ciRoot: root(input?.ciRoot, "delivery.ciRoot"),
-    mergeRoot: root(input?.mergeRoot, "delivery.mergeRoot"),
-    artifactRoot: root(input?.artifactRoot, "delivery.artifactRoot"),
-    installedProductRoot: root(
-      input?.installedProductRoot,
-      "delivery.installedProductRoot",
+    ...normalizeFields(
+      input,
+      ["headSha", "headTreeSha", "reviewHeadSha", "mergeSha", "mergeTreeSha", "ciHeadSha"],
+      sha,
+      "delivery.",
+    ),
+    ...normalizeFields(input, ["state", "reviewState", "ciConclusion"], text, "delivery."),
+    ...normalizeFields(
+      input,
+      ["reviewRoot", "ciRoot", "mergeRoot", "artifactRoot", "installedProductRoot"],
+      root,
+      "delivery.",
     ),
   };
-  if (delivery.baseBranch !== expected.sourceBranch) {
-    throw new Error(
-      "protected delivery base does not match the Release Cut source branch",
-    );
-  }
-  if (
-    delivery.state !== "MERGED" ||
-    delivery.reviewState !== "APPROVED" ||
-    delivery.ciConclusion !== "success"
-  ) {
-    throw new Error(
-      "protected delivery is not merged, approved, and CI-successful",
-    );
-  }
-  if (
-    delivery.headSha !== expected.devLandingSha ||
-    delivery.reviewHeadSha !== delivery.headSha
-  ) {
-    throw new Error(
-      "protected delivery review does not bind the exact repaired head",
-    );
-  }
-  if (
-    delivery.headTreeSha !== expected.cutCandidateTreeSha ||
-    delivery.mergeTreeSha !== delivery.headTreeSha
-  ) {
-    throw new Error(
-      "protected delivery merge tree does not equal the repaired candidate tree",
-    );
-  }
-  if (delivery.ciHeadSha !== delivery.mergeSha) {
-    throw new Error(
-      "protected delivery CI does not bind the merge-group result",
-    );
-  }
+  requireEvidence(
+    delivery.baseBranch === expected.sourceBranch,
+    "protected delivery base does not match the Release Cut source branch",
+  );
+  requireEvidence(
+    delivery.state === "MERGED" &&
+      delivery.reviewState === "APPROVED" &&
+      delivery.ciConclusion === "success",
+    "protected delivery is not merged, approved, and CI-successful",
+  );
+  requireEvidence(
+    delivery.headSha === expected.devLandingSha &&
+      delivery.reviewHeadSha === delivery.headSha,
+    "protected delivery review does not bind the exact repaired head",
+  );
+  requireEvidence(
+    delivery.headTreeSha === expected.cutCandidateTreeSha &&
+      delivery.mergeTreeSha === delivery.headTreeSha,
+    "protected delivery merge tree does not equal the repaired candidate tree",
+  );
+  requireEvidence(
+    delivery.ciHeadSha === delivery.mergeSha,
+    "protected delivery CI does not bind the merge-group result",
+  );
   return delivery;
 }
 
@@ -153,50 +145,32 @@ function normalizeInput(input = {}) {
     repository: repository(input.repository),
     sourceBranch: branch(input.sourceBranch, "sourceBranch"),
     targetBranch: branch(input.targetBranch, "targetBranch"),
-    assignmentRoot: root(input.assignmentRoot, "assignmentRoot"),
-    initiativeRoot: root(input.initiativeRoot, "initiativeRoot"),
-    dependencyProofRoot: root(input.dependencyProofRoot, "dependencyProofRoot"),
-    originDevSha: sha(input.originDevSha, "originDevSha"),
-    candidateSha: sha(input.candidateSha, "candidateSha"),
-    candidateTreeSha: sha(input.candidateTreeSha, "candidateTreeSha"),
-    alphaBaseSha: sha(input.alphaBaseSha, "alphaBaseSha"),
-    buildchainRuntimeSha: sha(
-      input.buildchainRuntimeSha,
-      "buildchainRuntimeSha",
-    ),
-    observedDevSha: sha(input.observedDevSha, "observedDevSha"),
-    blockerRoot: root(input.blockerRoot, "blockerRoot"),
-    patchRoot: root(input.patchRoot, "patchRoot"),
-    cutCandidateSha: sha(input.cutCandidateSha, "cutCandidateSha"),
-    cutCandidateTreeSha: sha(input.cutCandidateTreeSha, "cutCandidateTreeSha"),
-    cutLandingEvidenceRoot: root(
-      input.cutLandingEvidenceRoot,
-      "cutLandingEvidenceRoot",
+    ...normalizeFields(
+      input,
+      ["assignmentRoot", "initiativeRoot", "dependencyProofRoot", "environmentRoot", "blockerRoot", "patchRoot", "cutLandingEvidenceRoot", "devConflictEvidenceRoot", "devLandingEvidenceRoot"],
+      root,
     ),
-    devBaseSha: sha(input.devBaseSha, "devBaseSha"),
-    devLandingSha: sha(input.devLandingSha, "devLandingSha"),
-    devConflictEvidenceRoot: root(
-      input.devConflictEvidenceRoot,
-      "devConflictEvidenceRoot",
-    ),
-    devLandingEvidenceRoot: root(
-      input.devLandingEvidenceRoot,
-      "devLandingEvidenceRoot",
+    ...normalizeFields(
+      input,
+      ["originDevSha", "candidateSha", "candidateTreeSha", "alphaBaseSha", "buildchainRuntimeSha", "observedDevSha", "cutCandidateSha", "cutCandidateTreeSha", "devBaseSha", "devLandingSha"],
+      sha,
     ),
+    nativeCommand: text(input.nativeCommand, "nativeCommand"),
+    nativeExecutionReceipt: structuredClone(input.nativeExecutionReceipt || {}),
     ordinaryPullRequestNumber: positiveInteger(
       input.ordinaryPullRequestNumber,
       "ordinaryPullRequestNumber",
     ),
     recordedAt: timestamp(input.recordedAt, "recordedAt"),
   };
-  if (normalized.observedDevSha === normalized.originDevSha) {
-    throw new Error(
-      "self-dogfood requires dev to advance beyond the frozen origin",
-    );
-  }
-  if (normalized.cutCandidateSha === normalized.candidateSha) {
-    throw new Error("self-dogfood requires a successor repair candidate");
-  }
+  requireEvidence(
+    normalized.observedDevSha !== normalized.originDevSha,
+    "self-dogfood requires dev to advance beyond the frozen origin",
+  );
+  requireEvidence(
+    normalized.cutCandidateSha !== normalized.candidateSha,
+    "self-dogfood requires a successor repair candidate",
+  );
   normalized.delivery = normalizeDelivery(input.delivery, normalized);
   return normalized;
 }
@@ -214,6 +188,10 @@ function deliveryCandidate(input, deliveryClass = "release") {
     closureRoot: input.closureRoot,
     dependencyRoot: input.dependencyRoot,
     toolchainRoot: input.toolchainRoot,
+    ...(input.environmentRoot ? { environmentRoot: input.environmentRoot } : {}),
+    ...(input.nativeCommand
+      ? { nativeCommandContract: createNativeCommandContract(input.nativeCommand) }
+      : {}),
     deliveryClass,
     priority: "ordinary",
     ...(input.releaseBlockerPriority
@@ -366,7 +344,7 @@ function runQueueCampaign(value, repaired, priorityClaim) {
       dependencyRoot: value.dependencyProofRoot,
       toolchainRoot: value.dependencyProofRoot,
     },
-    "native-proof-required",
+    "non-native-fast",
   );
   queue = submitDevDeliveryCandidate(queue, ordinary, {
     now: at(value.recordedAt, 6),
@@ -388,6 +366,8 @@ function runQueueCampaign(value, repaired, priorityClaim) {
     closureRoot: value.delivery.mergeRoot,
     dependencyRoot: value.dependencyProofRoot,
     toolchainRoot: value.delivery.installedProductRoot,
+    environmentRoot: value.environmentRoot,
+    nativeCommand: value.nativeCommand,
     releaseBlockerPriority: priorityClaim,
   });
   const submitted = submitDevDeliveryCandidate(queue, blocker, {
@@ -426,7 +406,29 @@ function runQueueCampaign(value, repaired, priorityClaim) {
       "eligible release blocker did not receive bounded priority",
     );
   }
-  const closed = closeDevDeliveryWarrant(selected.queue, selected.warrant, {
+  const nativeCommandRoot = createNativeCommandContract(value.nativeCommand).commandRoot;
+  const proof = createNativeQualificationProof({
+    ...selected.warrant,
+    repository: value.repository,
+    protectedBase: value.sourceBranch,
+    qualifiedBase: value.devBaseSha,
+    nativeCommandRoot,
+    nativeExecutionReceipt: value.nativeExecutionReceipt,
+    affectedPaths: [], shardEvidenceRoots: [],
+    qualifiedAt: at(value.recordedAt, 12),
+  });
+  const current = {
+    ...selected.warrant,
+    nativeCommandRoot,
+    currentBase: value.devBaseSha,
+    graphKnown: true, attributionComplete: true,
+    changedPaths: [], renames: [],
+  };
+  const reuseDecision = createNativeProofReuseDecision({ proof, current });
+  const qualified = qualifyDevDeliveryWarrant(selected.queue, selected.warrant, {
+    nativeProof: proof, reuseDecision, current, now: at(value.recordedAt, 12),
+  });
+  const closed = closeDevDeliveryWarrant(qualified.queue, qualified.warrant, {
     outcome: "merged",
     evidenceRoot: value.delivery.mergeRoot,
     now: at(value.recordedAt, 13),

package/scripts/site-capability-metadata.mjs

@@ -92,6 +92,17 @@ export function cliCommandMeta(id) {
     "kfd-upstream-roles": { group: "kfd-trust", purpose: "List Buildchain-managed KFD upstream role values and inference policy." },
     lifecycle: { group: "reusable-build", purpose: "Run configured lifecycle commands and write deterministic artifact manifests." },
     dev: { group: "governance-versioning", purpose: "Inspect protected development-channel governance command families." },
+    "dev-authority-admit-merge-group": { group: "governance-versioning", purpose: "Verify that one exact candidate holds the exclusive Landing Warrant before merge_group admission." },
+    "dev-authority-complete-qualification": { group: "governance-versioning", purpose: "Bind qualification evidence and release one bounded Qualification Lease without granting landing authority." },
+    "dev-authority-heartbeat-landing": { group: "governance-versioning", purpose: "Extend the exact fenced Landing Warrant while final landing work remains live." },
+    "dev-authority-heartbeat-qualification": { group: "governance-versioning", purpose: "Extend one exact fenced Qualification Lease while qualification work remains live." },
+    "dev-authority-lease-landing": { group: "governance-versioning", purpose: "Issue or retain the single exclusive Landing Warrant for a qualified candidate." },
+    "dev-authority-lease-qualification": { group: "governance-versioning", purpose: "Issue one qualification-only lease within the configured bounded lane count." },
+    "dev-authority-migrate": { group: "governance-versioning", purpose: "Migrate one exact v1 Warrant state into v2 without rewriting candidate or fencing evidence." },
+    "dev-authority-observe": { group: "governance-versioning", purpose: "Read bounded Qualification Leases and the exclusive Landing Warrant without mutating authority." },
+    "dev-authority-recover": { group: "governance-versioning", purpose: "Recover expired qualification or Landing authority and emit one rooted wake instruction." },
+    "dev-authority-settle": { group: "governance-versioning", purpose: "Settle terminal candidate evidence idempotently and release held qualification or Landing authority immediately." },
+    "dev-authority-submit": { group: "governance-versioning", purpose: "Submit an exact candidate to the opt-in bounded-qualification authority state." },
     "dev-proof-classify": { group: "governance-versioning", purpose: "Classify source-qualified candidate changes against a current integration base." },
     "dev-proof-integration": { group: "governance-versioning", purpose: "Seal final exact integration delivery proof for a warranted candidate." },
     "dev-proof-replay": { group: "governance-versioning", purpose: "Replay source qualification against a Project Cut without rewriting candidate source." },
@@ -174,6 +185,7 @@ export function nodeApiMeta(exportName) {
     "./build-facts": { group: "observability-diagnostics", summary: "Git source, version, module output, product artifact, and legacy Kungfu build fact APIs." },
     "./candidate-timeline": { group: "observability-diagnostics", summary: "Source-bound candidate event normalization, per-attempt critical-path-safe aggregation, and compact reporting APIs." },
     "./channel-candidate": { group: "governance-versioning", summary: "Exact-source channel candidate decisions, same-SHA workflow evidence validation, and deterministic source-lock reference APIs." },
+    "./dev-delivery-authority": { group: "governance-versioning", summary: "Opt-in bounded Qualification Lease, exclusive Landing Warrant, provider-attempt admission and heartbeat readback, terminal sealing, and expired-Landing verification APIs." },
     "./dev-delivery-warrant": { group: "governance-versioning", summary: "Durable fair Dev Delivery Warrant queue, fenced lease, and split source and integration proof APIs." },
     "./cache-evidence": { group: "observability-diagnostics", summary: "Content-addressed cache operation receipts and source/platform-bound evidence-set verification APIs." },
     "./diagnostics": { group: "observability-diagnostics", summary: "Native diagnostics collection, summarization, cache, compiler, and process-sampler APIs." },

package/templates/native-dev-delivery.yml

@@ -0,0 +1,143 @@
+name: Protected Dev Delivery
+
+on:
+  repository_dispatch:
+    types: [buildchain-dev-delivery-wake]
+  workflow_dispatch:
+    inputs:
+      buildchain-ref:
+        description: "Buildchain runtime selector: v4, v4-alpha, or a trusted train/v4/v4.0/<capability>"
+        required: false
+        default: "v4-alpha"
+      target-branch:
+        description: "Protected dev/vN/vN.M branch"
+        required: true
+      expected-pr-number:
+        description: "Exact ready and approved PR number"
+        required: true
+        type: number
+      expected-head-sha:
+        description: "Exact immutable PR head"
+        required: true
+      source-workflow-run-id:
+        description: "Exact successful source workflow run"
+        required: false
+        type: number
+        default: 0
+      legacy-active-owner-binding-json:
+        description: "Explicit legacy-safe phase-less owner binding JSON"
+        required: false
+        default: ""
+      source-workflow-id:
+        description: "Pull-request workflow used only to recover a historical active owner with no recorded run"
+        required: false
+        default: ""
+      source-identity-root:
+        description: "Semantic source identity root"
+        required: true
+      source-patch-root:
+        description: "Semantic patch root"
+        required: true
+      assignment-root:
+        description: "Native Assignment root"
+        required: true
+      initiative-root:
+        description: "Parent Initiative root"
+        required: true
+      plan-root:
+        description: "Native qualification plan root"
+        required: true
+      closure-root:
+        description: "Affected closure root"
+        required: true
+      dependency-root:
+        description: "Dependency graph root"
+        required: true
+      toolchain-root:
+        description: "Native toolchain root"
+        required: true
+      environment-root:
+        description: "Exact native execution environment contract root bound before native spawn"
+        required: false
+        default: ""
+      affected-paths-json:
+        description: "JSON array representing the affected closure"
+        required: true
+      shard-evidence-roots-json:
+        description: "JSON array of exact native shard evidence roots"
+        required: false
+        default: "[]"
+      release-blocker-priority-json:
+        description: "Optional exact rooted release-blocker priority claim"
+        required: false
+        default: ""
+      native-proof-json:
+        description: "Optional reusable native proof"
+        required: false
+        default: ""
+      native-command:
+        description: "Slow native qualification command"
+        required: false
+        default: ""
+      native-command-root:
+        description: "Optional exact native command contract root"
+        required: false
+        default: ""
+      native-heartbeat-seconds:
+        description: "Heartbeat cadence while native qualification runs"
+        required: false
+        type: number
+        default: 300
+      delivery-class:
+        description: "Bounded delivery class"
+        required: false
+        default: "native-proof-required"
+      delivery-priority:
+        description: "Reviewed delivery priority"
+        required: false
+        default: "ordinary"
+
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+  checks: read
+  statuses: write
+
+jobs:
+  deliver:
+    uses: kungfu-systems/buildchain/.github/workflows/dev-pr-auto-merge.yml@v4-alpha
+    with:
+      buildchain-ref: ${{ inputs.buildchain-ref || 'v4-alpha' }}
+      target-branch: ${{ github.event.client_payload.candidate.targetBranch || inputs.target-branch }}
+      expected-pr-number: ${{ github.event.client_payload.candidate.pullRequestNumber || inputs.expected-pr-number }}
+      expected-head-sha: ${{ github.event.client_payload.candidate.sourceHead || inputs.expected-head-sha }}
+      source-workflow-run-id: ${{ github.event.client_payload.candidate.sourceWorkflowRunId || inputs.source-workflow-run-id || github.run_id }}
+      legacy-active-owner-binding-json: ${{ inputs.legacy-active-owner-binding-json || '' }}
+      delivery-warrant-mode: required
+      handoff-workflow-id: native-dev-delivery.yml
+      source-workflow-id: ${{ inputs.source-workflow-id || '' }}
+      assignment-root: ${{ github.event.client_payload.candidate.assignmentRoot || inputs.assignment-root }}
+      initiative-root: ${{ github.event.client_payload.candidate.initiativeRoot || inputs.initiative-root }}
+      source-identity-root: ${{ github.event.client_payload.candidate.sourceIdentityRoot || inputs.source-identity-root }}
+      source-patch-root: ${{ github.event.client_payload.candidate.sourcePatchRoot || inputs.source-patch-root }}
+      plan-root: ${{ github.event.client_payload.candidate.planRoot || inputs.plan-root }}
+      closure-root: ${{ github.event.client_payload.candidate.closureRoot || inputs.closure-root }}
+      dependency-root: ${{ github.event.client_payload.candidate.dependencyRoot || inputs.dependency-root }}
+      toolchain-root: ${{ github.event.client_payload.candidate.toolchainRoot || inputs.toolchain-root }}
+      environment-root: ${{ github.event.client_payload.candidate.environmentRoot || inputs.environment-root }}
+      affected-paths-json: ${{ github.event_name == 'repository_dispatch' && toJSON(github.event.client_payload.candidate.affectedPaths) || inputs.affected-paths-json }}
+      shard-evidence-roots-json: ${{ github.event_name == 'repository_dispatch' && toJSON(github.event.client_payload.candidate.shardEvidenceRoots) || inputs.shard-evidence-roots-json || '[]' }}
+      release-blocker-priority-json: ${{ github.event_name == 'repository_dispatch' && toJSON(github.event.client_payload.candidate.releaseBlockerPriority) || inputs.release-blocker-priority-json || '' }}
+      native-proof-json: ${{ inputs.native-proof-json || '' }}
+      native-command: ${{ github.event.client_payload.candidate.nativeCommandContract.command || inputs.native-command || '' }}
+      native-command-root: ${{ github.event.client_payload.candidate.nativeCommandContract.commandRoot || inputs.native-command-root || '' }}
+      native-heartbeat-seconds: ${{ inputs.native-heartbeat-seconds || 300 }}
+      delivery-class: ${{ github.event.client_payload.candidate.deliveryClass || inputs.delivery-class || 'native-proof-required' }}
+      delivery-priority: ${{ github.event.client_payload.candidate.priority || inputs.delivery-priority || 'ordinary' }}
+      queue-admission-context: Queue admission lease
+      active-lease-context: Queue family lease/exact
+      landing-mode: queue
+      dry-run: false
+    secrets:
+      github-token: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}