@kungfu-tech/buildchain 4.0.1-alpha.3 → 4.0.1-alpha.4

package/dist/site/public-surface-audit.json

@@ -8417,8 +8417,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "3632f0332f9c0e270a522a4af358482833974757d77ac40a2d7e2efe6a56cb28",
-    "workflowRegistryDigest": "f2c315d3df35fc3067cb98f626dfae8b5f4f400a6ce1d39a62e724072f52ae18",
-    "pageRegistryDigest": "d25d802e1298cc2867ea8c3b3fc4b483fc41cfe76084022c762c121f58a6b978"
+    "workflowRegistryDigest": "91b72955489bf4a98fa0c3d3b8ef245e34acb5993e3a59c26caad214b004cfde",
+    "pageRegistryDigest": "07068ff6f889aaae1bb0def76cc041b2e8c63092eebf728b245f3f9451e1ea24"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-15T19:57:44.433Z",
-  "publishedAt": "2026-08-15T19:57:44.433Z",
+  "generatedAt": "2026-08-16T00:38:02.716Z",
+  "publishedAt": "2026-08-16T00:38:02.716Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "cfc0256de1826e0e0ec4a4e55644c869f3286f91",
+  "sourceRevision": "e6b14caa6b3dd2af4ea2f6c480baf84006ed0131",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.3",
+    "version": "4.0.1-alpha.4",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-15T19:57:44.433Z",
-  "publishedAt": "2026-08-15T19:57:44.433Z",
+  "generatedAt": "2026-08-16T00:38:02.716Z",
+  "publishedAt": "2026-08-16T00:38:02.716Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "cfc0256de1826e0e0ec4a4e55644c869f3286f91",
+  "sourceRevision": "e6b14caa6b3dd2af4ea2f6c480baf84006ed0131",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.3",
+    "version": "4.0.1-alpha.4",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -245,7 +245,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:8f0c42d4453003d9bff861392c890f557a54608662e1cc380ed9aaa6635df016"
+      "digest": "sha256:a409b078692ebb18ca7bb817ebd35c416cc6be3842f671c17d019c9aa32d0638"
     },
     {
       "id": "build-facts",

package/dist/site/workflow-registry.json

@@ -2006,7 +2006,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.3",
+      "introducedVersion": "4.0.1-alpha.4",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2027,7 +2027,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.3",
+      "introducedVersion": "4.0.1-alpha.4",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2048,7 +2048,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.3",
+      "introducedVersion": "4.0.1-alpha.4",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2098,7 +2098,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.3",
+      "introducedVersion": "4.0.1-alpha.4",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/dev-delivery-warrant.md

@@ -383,8 +383,10 @@ The reusable `dev-pr-auto-merge.yml` supports three explicit rollout modes:
   The shipped Buildchain caller and native template configure this handoff path
   and accept the same complete input contract. A historical phase-less owner
   uses the distinct `legacy-phase-less-active-owner` command path. That path
-  carries the exact queue state root, fencing token, generation, PR, head, and
-  source-run binding, omits `environment-root`, `native-command`, and
+  carries the exact queue state root observed before its duplicate submission,
+  fencing token, generation, PR, head, and source-run binding. The submission
+  receipt proves that pre-transition root even though the queue transition
+  advances the current state root. The path omits `environment-root`, `native-command`, and
   `native-command-root`, and rejects readback drift. It therefore resumes the
   historical non-native authority without inventing a native command contract
   or upgrading the owner to native proof authority.
@@ -471,8 +473,10 @@ consumer workflow. It supports both explicit dispatch and the bounded wake
 event, calls the allowed floating `@v4-alpha` selector, explicitly passes the v4
 runtime ref that locks every delivery job to the same checkout, and keeps the
 native command in the consumer repository rather than inventing
-provider-specific shards. The reusable workflow defaults that explicit input
-to `v4-alpha`; an empty input or any v3 selector fails before the first runtime
+provider-specific shards. Both callers explicitly bind the queue-admission
+and active-lease status contexts so write/readback fencing uses the same exact
+names. The reusable workflow defaults the explicit runtime input to
+`v4-alpha`; an empty input or any v3 selector fails before the first runtime
 checkout.
 
 This mechanism schedules protected delivery only. It does not serialize local

package/docs/node-api-reference.md

@@ -1609,9 +1609,9 @@ Target: `./packages/core/dev-delivery-warrant.js`. Public symbols: 54.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `cancelQueuedDevDeliveryCandidate` | function: function cancelQueuedDevDeliveryCandidate(queueInput, input, options) | queueInput, input, options | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { cancelQueuedDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:507` |
+| `cancelQueuedDevDeliveryCandidate` | function: function cancelQueuedDevDeliveryCandidate(queueInput, input, options) | queueInput, input, options | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { cancelQueuedDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:508` |
 | `classifyDevDeliveryDelta` | function: function classifyDevDeliveryDelta({ proof, current = {} } = {}) | { proof, current = {} } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { classifyDevDeliveryDelta } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:109` |
-| `closeDevDeliveryWarrant` | function: function closeDevDeliveryWarrant(queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {}) | queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { closeDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:383` |
+| `closeDevDeliveryWarrant` | function: function closeDevDeliveryWarrant(queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {}) | queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { closeDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:384` |
 | `createDevDeliveryQueue` | value: createDevDeliveryQueue | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { createDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `createIntegrationDeliveryProof` | function: function createIntegrationDeliveryProof(input = {}) | input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createIntegrationDeliveryProof } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:241` |
 | `createNativeCommandContract` | value: createNativeCommandContract | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { createNativeCommandContract } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-native-proof.js:1` |
@@ -1646,14 +1646,14 @@ Target: `./packages/core/dev-delivery-warrant.js`. Public symbols: 54.
 | `NATIVE_QUALIFICATION_PROOF_SCHEMA` | constant: const NATIVE_QUALIFICATION_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { NATIVE_QUALIFICATION_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-native-proof.js:31` |
 | `normalizeDevDeliveryQueue` | value: normalizeDevDeliveryQueue | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { normalizeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `normalizeNativeCommandContract` | value: normalizeNativeCommandContract | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { normalizeNativeCommandContract } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-native-proof.js:1` |
-| `observeDevDeliveryQueue` | function: function observeDevDeliveryQueue(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { observeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:516` |
+| `observeDevDeliveryQueue` | function: function observeDevDeliveryQueue(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { observeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:517` |
 | `PROJECT_CUT_REPLAY_PROOF_SCHEMA` | constant: const PROJECT_CUT_REPLAY_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { PROJECT_CUT_REPLAY_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:5` |
-| `qualifyDevDeliveryWarrant` | constant: const qualifyDevDeliveryWarrant | none | value | Import does not declare a throw contract. | none-on-import | `import { qualifyDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:379` |
+| `qualifyDevDeliveryWarrant` | constant: const qualifyDevDeliveryWarrant | none | value | Import does not declare a throw contract. | none-on-import | `import { qualifyDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:380` |
 | `rankDevDeliveryCandidates` | value: rankDevDeliveryCandidates | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { rankDevDeliveryCandidates } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
-| `recoverExpiredDevDeliveryWarrant` | function: function recoverExpiredDevDeliveryWarrant(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoverExpiredDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:300` |
+| `recoverExpiredDevDeliveryWarrant` | function: function recoverExpiredDevDeliveryWarrant(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoverExpiredDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:301` |
 | `RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA` | constant: const RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/release-blocker-priority.js:15` |
 | `selectDevDeliveryWarrant` | function: function selectDevDeliveryWarrant(queueInput, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { selectDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:95` |
-| `settleDevDeliveryTerminalEvent` | constant: const settleDevDeliveryTerminalEvent | none | value | Import does not declare a throw contract. | none-on-import | `import { settleDevDeliveryTerminalEvent } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:510` |
+| `settleDevDeliveryTerminalEvent` | constant: const settleDevDeliveryTerminalEvent | none | value | Import does not declare a throw contract. | none-on-import | `import { settleDevDeliveryTerminalEvent } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:511` |
 | `SOURCE_QUALIFICATION_PROOF_SCHEMA` | constant: const SOURCE_QUALIFICATION_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { SOURCE_QUALIFICATION_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:3` |
 | `SOURCE_QUALIFICATION_PROOF_V2_SCHEMA` | constant: const SOURCE_QUALIFICATION_PROOF_V2_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { SOURCE_QUALIFICATION_PROOF_V2_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:4` |
 | `submitDevDeliveryCandidate` | value: submitDevDeliveryCandidate | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { submitDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.1-alpha.3",
+  "version": "4.0.1-alpha.4",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/dev-delivery-process-boundary.js

@@ -98,7 +98,6 @@ function assertHostedLinuxController(environment) {
 function hostedBoundary(procRoot, pid, command, readlinkSync) {
   if (
     command.length !== 4 ||
-    !GITHUB_HOSTED_LINUX_WORKER.test(command[0] || "") ||
     command[1] !== "spawnclient" ||
     !/^\d+$/u.test(command[2] || "") ||
     !/^\d+$/u.test(command[3] || "")
@@ -109,7 +108,7 @@ function hostedBoundary(procRoot, pid, command, readlinkSync) {
   const executable = ancestryRead(readlinkSync, link);
   if (
     !GITHUB_HOSTED_LINUX_WORKER.test(executable) ||
-    command[0] !== executable
+    !new Set([executable, path.posix.basename(executable)]).has(command[0])
   ) {
     throw new Error("credential ancestry found an untrusted Runner.Worker");
   }

package/packages/core/dev-delivery-warrant-state.js

@@ -246,11 +246,10 @@ function normalizeCandidate(input, expected) {
       "candidate shardEvidenceRoots",
     );
   }
-  if (candidate.environmentRoot && !candidate.nativeCommandContract) {
-    throw new Error(
-      "native candidate requires an exact native command contract",
-    );
-  }
+  const { environmentRoot: env, nativeCommandContract: cmd } = candidate;
+  const native = candidate.deliveryClass !== "non-native-fast" || env || cmd;
+  if (native && (!env || !cmd) && !TERMINAL_STATES.has(status))
+    throw new Error("live native candidate requires exact native proof");
   if (Object.hasOwn(input, "releaseBlockerPriority"))
     candidate.releaseBlockerPriority = normalizeReleaseBlockerPriorityClaim(
       input.releaseBlockerPriority,

package/packages/core/dev-delivery-warrant.js

@@ -267,6 +267,7 @@ export function heartbeatDevDeliveryWarrant(
         "leaseSeconds",
         queue.policy.leaseSeconds,
       );
+      queue.activeWarrant.heartbeatAt = currentTime;
       queue.activeWarrant.expiresAt = new Date(
         Date.parse(currentTime) + effectiveLeaseSeconds * 1000,
       ).toISOString();

package/scripts/check-v4-floating-consumer-policy-contract.mjs

@@ -6,7 +6,6 @@ import { parseYamlUses } from "../packages/core/workflow-yaml-contract.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const read = (relative) => fs.readFileSync(path.join(root, relative), "utf8");
-
 function fail(message) {
   throw new Error(`v4-floating-consumer-policy-contract: ${message}`);
 }
@@ -113,6 +112,7 @@ export function checkV4FloatingConsumerPolicyContract() {
     "Enforce v4 floating consumer policy",
     "Validate consumer package manager contract",
   ]);
+  if (!read(".github/workflows/.build.yml").includes("BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: ${{ inputs.buildchain-expected-channel }}")) fail("channel builds must disambiguate dual-channel caller invocations");
   assertTrustGatedJobs(read(".github/workflows/.build.yml"), [
     "resolve-source",
     "resolve-contract",

package/scripts/dev-pr-auto-merge.mjs

@@ -70,7 +70,7 @@ function normalizeOptions(options = {}) {
     allowedHeadPrefixes: splitList(options.allowedHeadPrefixes, DEFAULT_ALLOWED_HEAD_PREFIXES),
     requiredChecks: splitList(options.requiredChecks, DEFAULT_REQUIRED_CHECKS),
     queueAdmissionContext: String(options.queueAdmissionContext || "").trim(),
-    activeLeaseContext: String(options.activeLeaseContext || "").trim(),
+    activeLeaseContext: String(options.activeLeaseContext || (choiceOption(options.warrantMode, VALID_WARRANT_MODES, "off", "delivery Warrant mode") === "required" ? "Queue family lease/exact" : "")).trim(),
     requireApproval: boolOption(options.requireApproval, true),
     sameRepositoryOnly: boolOption(options.sameRepositoryOnly, true),
     maxMerges: intOption(options.maxMerges, 1),

package/scripts/release-train-self-dogfood.mjs

@@ -6,7 +6,11 @@ import fs from "node:fs";
 import {
   closeDevDeliveryWarrant,
   createDevDeliveryQueue,
+  createNativeCommandContract,
+  createNativeProofReuseDecision,
+  createNativeQualificationProof,
   createReleaseBlockerPriorityClaim,
+  qualifyDevDeliveryWarrant,
   selectDevDeliveryWarrant,
   submitDevDeliveryCandidate,
 } from "../packages/core/dev-delivery-warrant.js";
@@ -81,9 +85,12 @@ function branch(value, label) {
   return normalized;
 }
 
-function at(recordedAt, seconds) {
-  return new Date(Date.parse(recordedAt) + seconds * 1000).toISOString();
-}
+const at = (recordedAt, seconds) => new Date(Date.parse(recordedAt) + seconds * 1000).toISOString();
+
+const normalizeFields = (input, fields, normalizer, prefix = "") =>
+  Object.fromEntries(fields.map((field) => [field, normalizer(input?.[field], `${prefix}${field}`)]));
+
+const requireEvidence = (condition, message) => { if (!condition) throw new Error(message); };
 
 function normalizeDelivery(input, expected) {
   const delivery = {
@@ -92,59 +99,44 @@ function normalizeDelivery(input, expected) {
       "delivery.pullRequestNumber",
     ),
     baseBranch: branch(input?.baseBranch, "delivery.baseBranch"),
-    headSha: sha(input?.headSha, "delivery.headSha"),
-    headTreeSha: sha(input?.headTreeSha, "delivery.headTreeSha"),
-    state: text(input?.state, "delivery.state"),
-    reviewState: text(input?.reviewState, "delivery.reviewState"),
-    reviewHeadSha: sha(input?.reviewHeadSha, "delivery.reviewHeadSha"),
-    mergeSha: sha(input?.mergeSha, "delivery.mergeSha"),
-    mergeTreeSha: sha(input?.mergeTreeSha, "delivery.mergeTreeSha"),
-    ciHeadSha: sha(input?.ciHeadSha, "delivery.ciHeadSha"),
-    ciConclusion: text(input?.ciConclusion, "delivery.ciConclusion"),
-    reviewRoot: root(input?.reviewRoot, "delivery.reviewRoot"),
-    ciRoot: root(input?.ciRoot, "delivery.ciRoot"),
-    mergeRoot: root(input?.mergeRoot, "delivery.mergeRoot"),
-    artifactRoot: root(input?.artifactRoot, "delivery.artifactRoot"),
-    installedProductRoot: root(
-      input?.installedProductRoot,
-      "delivery.installedProductRoot",
+    ...normalizeFields(
+      input,
+      ["headSha", "headTreeSha", "reviewHeadSha", "mergeSha", "mergeTreeSha", "ciHeadSha"],
+      sha,
+      "delivery.",
+    ),
+    ...normalizeFields(input, ["state", "reviewState", "ciConclusion"], text, "delivery."),
+    ...normalizeFields(
+      input,
+      ["reviewRoot", "ciRoot", "mergeRoot", "artifactRoot", "installedProductRoot"],
+      root,
+      "delivery.",
     ),
   };
-  if (delivery.baseBranch !== expected.sourceBranch) {
-    throw new Error(
-      "protected delivery base does not match the Release Cut source branch",
-    );
-  }
-  if (
-    delivery.state !== "MERGED" ||
-    delivery.reviewState !== "APPROVED" ||
-    delivery.ciConclusion !== "success"
-  ) {
-    throw new Error(
-      "protected delivery is not merged, approved, and CI-successful",
-    );
-  }
-  if (
-    delivery.headSha !== expected.devLandingSha ||
-    delivery.reviewHeadSha !== delivery.headSha
-  ) {
-    throw new Error(
-      "protected delivery review does not bind the exact repaired head",
-    );
-  }
-  if (
-    delivery.headTreeSha !== expected.cutCandidateTreeSha ||
-    delivery.mergeTreeSha !== delivery.headTreeSha
-  ) {
-    throw new Error(
-      "protected delivery merge tree does not equal the repaired candidate tree",
-    );
-  }
-  if (delivery.ciHeadSha !== delivery.mergeSha) {
-    throw new Error(
-      "protected delivery CI does not bind the merge-group result",
-    );
-  }
+  requireEvidence(
+    delivery.baseBranch === expected.sourceBranch,
+    "protected delivery base does not match the Release Cut source branch",
+  );
+  requireEvidence(
+    delivery.state === "MERGED" &&
+      delivery.reviewState === "APPROVED" &&
+      delivery.ciConclusion === "success",
+    "protected delivery is not merged, approved, and CI-successful",
+  );
+  requireEvidence(
+    delivery.headSha === expected.devLandingSha &&
+      delivery.reviewHeadSha === delivery.headSha,
+    "protected delivery review does not bind the exact repaired head",
+  );
+  requireEvidence(
+    delivery.headTreeSha === expected.cutCandidateTreeSha &&
+      delivery.mergeTreeSha === delivery.headTreeSha,
+    "protected delivery merge tree does not equal the repaired candidate tree",
+  );
+  requireEvidence(
+    delivery.ciHeadSha === delivery.mergeSha,
+    "protected delivery CI does not bind the merge-group result",
+  );
   return delivery;
 }
 
@@ -153,50 +145,32 @@ function normalizeInput(input = {}) {
     repository: repository(input.repository),
     sourceBranch: branch(input.sourceBranch, "sourceBranch"),
     targetBranch: branch(input.targetBranch, "targetBranch"),
-    assignmentRoot: root(input.assignmentRoot, "assignmentRoot"),
-    initiativeRoot: root(input.initiativeRoot, "initiativeRoot"),
-    dependencyProofRoot: root(input.dependencyProofRoot, "dependencyProofRoot"),
-    originDevSha: sha(input.originDevSha, "originDevSha"),
-    candidateSha: sha(input.candidateSha, "candidateSha"),
-    candidateTreeSha: sha(input.candidateTreeSha, "candidateTreeSha"),
-    alphaBaseSha: sha(input.alphaBaseSha, "alphaBaseSha"),
-    buildchainRuntimeSha: sha(
-      input.buildchainRuntimeSha,
-      "buildchainRuntimeSha",
-    ),
-    observedDevSha: sha(input.observedDevSha, "observedDevSha"),
-    blockerRoot: root(input.blockerRoot, "blockerRoot"),
-    patchRoot: root(input.patchRoot, "patchRoot"),
-    cutCandidateSha: sha(input.cutCandidateSha, "cutCandidateSha"),
-    cutCandidateTreeSha: sha(input.cutCandidateTreeSha, "cutCandidateTreeSha"),
-    cutLandingEvidenceRoot: root(
-      input.cutLandingEvidenceRoot,
-      "cutLandingEvidenceRoot",
+    ...normalizeFields(
+      input,
+      ["assignmentRoot", "initiativeRoot", "dependencyProofRoot", "environmentRoot", "blockerRoot", "patchRoot", "cutLandingEvidenceRoot", "devConflictEvidenceRoot", "devLandingEvidenceRoot"],
+      root,
     ),
-    devBaseSha: sha(input.devBaseSha, "devBaseSha"),
-    devLandingSha: sha(input.devLandingSha, "devLandingSha"),
-    devConflictEvidenceRoot: root(
-      input.devConflictEvidenceRoot,
-      "devConflictEvidenceRoot",
-    ),
-    devLandingEvidenceRoot: root(
-      input.devLandingEvidenceRoot,
-      "devLandingEvidenceRoot",
+    ...normalizeFields(
+      input,
+      ["originDevSha", "candidateSha", "candidateTreeSha", "alphaBaseSha", "buildchainRuntimeSha", "observedDevSha", "cutCandidateSha", "cutCandidateTreeSha", "devBaseSha", "devLandingSha"],
+      sha,
     ),
+    nativeCommand: text(input.nativeCommand, "nativeCommand"),
+    nativeExecutionReceipt: structuredClone(input.nativeExecutionReceipt || {}),
     ordinaryPullRequestNumber: positiveInteger(
       input.ordinaryPullRequestNumber,
       "ordinaryPullRequestNumber",
     ),
     recordedAt: timestamp(input.recordedAt, "recordedAt"),
   };
-  if (normalized.observedDevSha === normalized.originDevSha) {
-    throw new Error(
-      "self-dogfood requires dev to advance beyond the frozen origin",
-    );
-  }
-  if (normalized.cutCandidateSha === normalized.candidateSha) {
-    throw new Error("self-dogfood requires a successor repair candidate");
-  }
+  requireEvidence(
+    normalized.observedDevSha !== normalized.originDevSha,
+    "self-dogfood requires dev to advance beyond the frozen origin",
+  );
+  requireEvidence(
+    normalized.cutCandidateSha !== normalized.candidateSha,
+    "self-dogfood requires a successor repair candidate",
+  );
   normalized.delivery = normalizeDelivery(input.delivery, normalized);
   return normalized;
 }
@@ -214,6 +188,10 @@ function deliveryCandidate(input, deliveryClass = "release") {
     closureRoot: input.closureRoot,
     dependencyRoot: input.dependencyRoot,
     toolchainRoot: input.toolchainRoot,
+    ...(input.environmentRoot ? { environmentRoot: input.environmentRoot } : {}),
+    ...(input.nativeCommand
+      ? { nativeCommandContract: createNativeCommandContract(input.nativeCommand) }
+      : {}),
     deliveryClass,
     priority: "ordinary",
     ...(input.releaseBlockerPriority
@@ -366,7 +344,7 @@ function runQueueCampaign(value, repaired, priorityClaim) {
       dependencyRoot: value.dependencyProofRoot,
       toolchainRoot: value.dependencyProofRoot,
     },
-    "native-proof-required",
+    "non-native-fast",
   );
   queue = submitDevDeliveryCandidate(queue, ordinary, {
     now: at(value.recordedAt, 6),
@@ -388,6 +366,8 @@ function runQueueCampaign(value, repaired, priorityClaim) {
     closureRoot: value.delivery.mergeRoot,
     dependencyRoot: value.dependencyProofRoot,
     toolchainRoot: value.delivery.installedProductRoot,
+    environmentRoot: value.environmentRoot,
+    nativeCommand: value.nativeCommand,
     releaseBlockerPriority: priorityClaim,
   });
   const submitted = submitDevDeliveryCandidate(queue, blocker, {
@@ -426,7 +406,29 @@ function runQueueCampaign(value, repaired, priorityClaim) {
       "eligible release blocker did not receive bounded priority",
     );
   }
-  const closed = closeDevDeliveryWarrant(selected.queue, selected.warrant, {
+  const nativeCommandRoot = createNativeCommandContract(value.nativeCommand).commandRoot;
+  const proof = createNativeQualificationProof({
+    ...selected.warrant,
+    repository: value.repository,
+    protectedBase: value.sourceBranch,
+    qualifiedBase: value.devBaseSha,
+    nativeCommandRoot,
+    nativeExecutionReceipt: value.nativeExecutionReceipt,
+    affectedPaths: [], shardEvidenceRoots: [],
+    qualifiedAt: at(value.recordedAt, 12),
+  });
+  const current = {
+    ...selected.warrant,
+    nativeCommandRoot,
+    currentBase: value.devBaseSha,
+    graphKnown: true, attributionComplete: true,
+    changedPaths: [], renames: [],
+  };
+  const reuseDecision = createNativeProofReuseDecision({ proof, current });
+  const qualified = qualifyDevDeliveryWarrant(selected.queue, selected.warrant, {
+    nativeProof: proof, reuseDecision, current, now: at(value.recordedAt, 12),
+  });
+  const closed = closeDevDeliveryWarrant(qualified.queue, qualified.warrant, {
     outcome: "merged",
     evidenceRoot: value.delivery.mergeRoot,
     now: at(value.recordedAt, 13),

package/templates/native-dev-delivery.yml

@@ -135,6 +135,8 @@ jobs:
       native-heartbeat-seconds: ${{ inputs.native-heartbeat-seconds || 300 }}
       delivery-class: ${{ github.event.client_payload.candidate.deliveryClass || inputs.delivery-class || 'native-proof-required' }}
       delivery-priority: ${{ github.event.client_payload.candidate.priority || inputs.delivery-priority || 'ordinary' }}
+      queue-admission-context: Queue admission lease
+      active-lease-context: Queue family lease/exact
       landing-mode: queue
       dry-run: false
     secrets: