@kungfu-tech/buildchain 4.0.1-alpha.3 → 4.0.1-alpha.5

package/packages/core/v4-tail-reseal.js

@@ -0,0 +1,594 @@
+import {
+  v4ContentRoot,
+  validateV4Clock,
+  validateV4Root,
+} from "./v4-canonical-contracts.js";
+import {
+  V4_TAIL_RESEAL_PLAN_CONTRACT,
+  V4_TAIL_RESEAL_PLATFORMS as PLATFORM_IDS,
+  V4_TAIL_RESEAL_PLATFORM_RUNNERS as PLATFORM_RUNNERS,
+  V4_TAIL_RESEAL_REQUEST_CONTRACT,
+  V4_TAIL_RESEAL_REUSED_STAGE_KEYS as REUSED_STAGE_KEYS,
+} from "./v4-tail-reseal-contract.js";
+
+export {
+  V4_TAIL_RESEAL_PLAN_CONTRACT,
+  V4_TAIL_RESEAL_REQUEST_CONTRACT,
+} from "./v4-tail-reseal-contract.js";
+
+const SHA = /^[0-9a-f]{40}$/u;
+const TOKEN = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/u;
+const V4_RUNTIME_REF = /^(?:v4-alpha|train\/v4\/v4\.0\/[A-Za-z0-9._/-]+)$/u;
+
+export class V4TailResealFault extends Error {
+  constructor(code, path, message) {
+    super(`${path}: ${message}`);
+    this.name = "V4TailResealFault";
+    this.code = code;
+    this.path = path;
+  }
+}
+
+function fault(code, path, message) {
+  throw new V4TailResealFault(code, path, message);
+}
+
+function exactKeys(value, expected, path) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fault("invalid-tail-reseal-shape", path, "object required");
+  const actual = Object.keys(value).sort();
+  const canonical = [...expected].sort();
+  if (
+    actual.length !== canonical.length ||
+    actual.some((key, index) => key !== canonical[index])
+  )
+    fault(
+      "invalid-tail-reseal-shape",
+      path,
+      "keys do not match the closed tail-reseal contract",
+    );
+}
+
+function token(value, path) {
+  if (typeof value !== "string" || !TOKEN.test(value))
+    fault("invalid-tail-reseal-token", path, "ASCII identity token required");
+  return value;
+}
+
+function text(value, path) {
+  if (typeof value !== "string" || value.trim() === "")
+    fault("invalid-tail-reseal-text", path, "non-empty string required");
+  return value.trim();
+}
+
+function artifactPath(value, path) {
+  const normalized = text(value, path).replaceAll("\\", "/");
+  if (
+    normalized.startsWith("/") ||
+    normalized.split("/").includes("..") ||
+    normalized.startsWith(".buildchain/tail-reseal")
+  )
+    fault(
+      "invalid-tail-reseal-artifact-path",
+      path,
+      "artifact paths must be safe relative payload paths",
+    );
+  return normalized;
+}
+
+function sha(value, path) {
+  if (typeof value !== "string" || !SHA.test(value))
+    fault("invalid-tail-reseal-sha", path, "exact lowercase Git SHA required");
+  return value;
+}
+
+function root(value, path) {
+  try {
+    validateV4Root(value, path);
+  } catch (error) {
+    fault("invalid-tail-reseal-root", path, error.message);
+  }
+  return value;
+}
+
+function clock(value, path) {
+  try {
+    validateV4Clock(value, path);
+  } catch (error) {
+    fault("invalid-tail-reseal-clock", path, error.message);
+  }
+  return value;
+}
+
+function positiveInteger(value, path) {
+  if (!Number.isSafeInteger(value) || value < 1)
+    fault(
+      "invalid-tail-reseal-integer",
+      path,
+      "positive safe integer required",
+    );
+  return value;
+}
+
+function sortedUnique(values, path, validate = token) {
+  if (!Array.isArray(values) || values.length === 0)
+    fault("invalid-tail-reseal-shape", path, "non-empty array required");
+  const normalized = values.map((value, index) =>
+    validate(value, `${path}/${index}`),
+  );
+  const canonical = [...new Set(normalized)].sort((left, right) =>
+    Buffer.from(left).compare(Buffer.from(right)),
+  );
+  if (
+    normalized.length !== canonical.length ||
+    normalized.some((value, index) => value !== canonical[index])
+  )
+    fault(
+      "unordered-tail-reseal-evidence",
+      path,
+      "values must be byte-sorted and duplicate-free",
+    );
+  return normalized;
+}
+
+function validateSource(value) {
+  exactKeys(
+    value,
+    [
+      "runId",
+      "runAttempt",
+      "sha",
+      "treeSha",
+      "sourceRoot",
+      "workflowFile",
+      "workflowName",
+    ],
+    "$/source",
+  );
+  positiveInteger(value.runId, "$/source/runId");
+  positiveInteger(value.runAttempt, "$/source/runAttempt");
+  sha(value.sha, "$/source/sha");
+  sha(value.treeSha, "$/source/treeSha");
+  root(value.sourceRoot, "$/source/sourceRoot");
+  text(value.workflowFile, "$/source/workflowFile");
+  text(value.workflowName, "$/source/workflowName");
+}
+
+function validateTarget(value) {
+  exactKeys(value, ["channel", "ref", "baseSha", "version"], "$/target");
+  if (value.channel !== "alpha" || value.ref !== "alpha/v4/v4.0")
+    fault(
+      "tail-reseal-target-mismatch",
+      "$/target",
+      "tail reseal is limited to alpha/v4/v4.0",
+    );
+  sha(value.baseSha, "$/target/baseSha");
+  if (!/^4\.0\.0-alpha\.\d+$/u.test(value.version))
+    fault(
+      "tail-reseal-target-mismatch",
+      "$/target/version",
+      "v4 Alpha version required",
+    );
+}
+
+function validateRuntime(value) {
+  exactKeys(
+    value,
+    ["repository", "ref", "sha", "contractRoot", "consumerPolicyReceiptRoot"],
+    "$/runtime",
+  );
+  if (value.repository !== "kungfu-systems/buildchain")
+    fault(
+      "tail-reseal-runtime-mismatch",
+      "$/runtime/repository",
+      "official Buildchain runtime required",
+    );
+  if (!V4_RUNTIME_REF.test(value.ref))
+    fault(
+      "tail-reseal-runtime-mismatch",
+      "$/runtime/ref",
+      "v4-alpha or a transient v4 train is required",
+    );
+  sha(value.sha, "$/runtime/sha");
+  root(value.contractRoot, "$/runtime/contractRoot");
+  root(value.consumerPolicyReceiptRoot, "$/runtime/consumerPolicyReceiptRoot");
+}
+
+function validateWarrant(value) {
+  exactKeys(
+    value,
+    [
+      "candidateId",
+      "generation",
+      "fencingToken",
+      "status",
+      "lineageRoot",
+      "qualificationRoot",
+      "stateReadbackRoot",
+    ],
+    "$/warrant",
+  );
+  token(value.candidateId, "$/warrant/candidateId");
+  positiveInteger(value.generation, "$/warrant/generation");
+  token(value.fencingToken, "$/warrant/fencingToken");
+  if (value.status !== "qualified")
+    fault(
+      "tail-reseal-warrant-ineligible",
+      "$/warrant/status",
+      "exact qualified Warrant required",
+    );
+  root(value.lineageRoot, "$/warrant/lineageRoot");
+  root(value.qualificationRoot, "$/warrant/qualificationRoot");
+  root(value.stateReadbackRoot, "$/warrant/stateReadbackRoot");
+}
+
+function validateRetention(value, evaluatedAt) {
+  exactKeys(
+    value,
+    ["status", "retainUntil", "policyRoot", "readbackRoot"],
+    "$/retention",
+  );
+  if (value.status !== "retained")
+    fault(
+      "tail-reseal-retention-invalid",
+      "$/retention/status",
+      "retained artifact status required",
+    );
+  clock(value.retainUntil, "$/retention/retainUntil");
+  if (Date.parse(value.retainUntil) <= Date.parse(evaluatedAt))
+    fault(
+      "tail-reseal-retention-expired",
+      "$/retention/retainUntil",
+      "retention must extend beyond evaluation",
+    );
+  root(value.policyRoot, "$/retention/policyRoot");
+  root(value.readbackRoot, "$/retention/readbackRoot");
+}
+
+function validateFailure(value) {
+  exactKeys(
+    value,
+    [
+      "platformId",
+      "stage",
+      "jobId",
+      "jobName",
+      "stepName",
+      "code",
+      "evidenceRoot",
+    ],
+    "$/failure",
+  );
+  const exactFailure =
+    value.platformId === "macos-arm64" &&
+    value.stage === "signing-finalization" &&
+    value.jobName === "build / Finalize signed artifact macOS ARM64" &&
+    value.stepName === "Recompute manifest over final signed bytes";
+  if (!exactFailure)
+    fault(
+      "tail-reseal-failure-mismatch",
+      "$/failure",
+      "single known macOS signing-finalization failure required",
+    );
+  positiveInteger(value.jobId, "$/failure/jobId");
+  token(value.code, "$/failure/code");
+  root(value.evidenceRoot, "$/failure/evidenceRoot");
+}
+
+function validateStageResume(value) {
+  exactKeys(
+    value,
+    ["planRoot", "qualificationRoot", "zeroEffectReuse", "decisions"],
+    "$/stageResume",
+  );
+  root(value.planRoot, "$/stageResume/planRoot");
+  root(value.qualificationRoot, "$/stageResume/qualificationRoot");
+  if (value.zeroEffectReuse !== true)
+    fault(
+      "tail-reseal-capsule-effect",
+      "$/stageResume/zeroEffectReuse",
+      "Stage Capsule reuse must remain effect-pure",
+    );
+  if (!Array.isArray(value.decisions))
+    fault(
+      "invalid-tail-reseal-shape",
+      "$/stageResume/decisions",
+      "array required",
+    );
+  const stageKeys = [];
+  for (const [index, decision] of value.decisions.entries()) {
+    const path = `$/stageResume/decisions/${index}`;
+    exactKeys(
+      decision,
+      ["stageKey", "decision", "capsuleRoot", "evidenceRoot"],
+      path,
+    );
+    stageKeys.push(token(decision.stageKey, `${path}/stageKey`));
+    if (decision.decision !== "reuse")
+      fault(
+        "tail-reseal-rebuild-required",
+        `${path}/decision`,
+        "all pre-tail stages must be exact reusable capsules",
+      );
+    root(decision.capsuleRoot, `${path}/capsuleRoot`);
+    root(decision.evidenceRoot, `${path}/evidenceRoot`);
+  }
+  if (JSON.stringify(stageKeys) !== JSON.stringify(REUSED_STAGE_KEYS))
+    fault(
+      "tail-reseal-stage-coverage-mismatch",
+      "$/stageResume/decisions",
+      "exact install, build, verify, and package reuse proof is required for every platform",
+    );
+}
+
+function validateSigning(value, evaluatedAt) {
+  exactKeys(
+    value,
+    [
+      "authorityRepository",
+      "authorityRunId",
+      "runtimeSha",
+      "requestRoot",
+      "delegationRoot",
+      "resultArtifact",
+      "resultArtifactRoot",
+      "credentialAuthorityId",
+      "credentialScopeRoot",
+      "credentialLeaseRoot",
+      "credentialExpiresAt",
+      "providerReadbackRoot",
+    ],
+    "$/signing",
+  );
+  text(value.authorityRepository, "$/signing/authorityRepository");
+  positiveInteger(value.authorityRunId, "$/signing/authorityRunId");
+  sha(value.runtimeSha, "$/signing/runtimeSha");
+  for (const field of [
+    "requestRoot",
+    "delegationRoot",
+    "resultArtifactRoot",
+    "credentialScopeRoot",
+    "credentialLeaseRoot",
+    "providerReadbackRoot",
+  ])
+    root(value[field], `$/signing/${field}`);
+  text(value.resultArtifact, "$/signing/resultArtifact");
+  token(value.credentialAuthorityId, "$/signing/credentialAuthorityId");
+  clock(value.credentialExpiresAt, "$/signing/credentialExpiresAt");
+  if (Date.parse(value.credentialExpiresAt) <= Date.parse(evaluatedAt))
+    fault(
+      "tail-reseal-credential-expired",
+      "$/signing/credentialExpiresAt",
+      "live credential authority is required",
+    );
+}
+
+function validateReleaseTail(value) {
+  exactKeys(
+    value,
+    [
+      "declarationRoot",
+      "transactionRoot",
+      "operationRoot",
+      "idempotencyKey",
+      "providerReadbackRoot",
+    ],
+    "$/releaseTail",
+  );
+  for (const field of [
+    "declarationRoot",
+    "transactionRoot",
+    "operationRoot",
+    "providerReadbackRoot",
+  ])
+    root(value[field], `$/releaseTail/${field}`);
+  token(value.idempotencyKey, "$/releaseTail/idempotencyKey");
+}
+
+function validatePlatforms(values) {
+  if (!Array.isArray(values) || values.length !== PLATFORM_IDS.length)
+    fault(
+      "tail-reseal-platform-mismatch",
+      "$/platforms",
+      "exact four-platform candidate required",
+    );
+  const ids = [];
+  const names = new Set();
+  for (const [index, value] of values.entries()) {
+    const path = `$/platforms/${index}`;
+    exactKeys(
+      value,
+      [
+        "id",
+        "name",
+        "runner",
+        "artifactName",
+        "artifactRoot",
+        "artifactArchiveRoot",
+        "manifestArtifactName",
+        "manifestRoot",
+        "manifestArchiveRoot",
+        "artifactPaths",
+        "capsuleRoot",
+      ],
+      path,
+    );
+    ids.push(token(value.id, `${path}/id`));
+    text(value.name, `${path}/name`);
+    text(value.runner, `${path}/runner`);
+    if (value.runner !== PLATFORM_RUNNERS[value.id])
+      fault(
+        "tail-reseal-runner-mismatch",
+        `${path}/runner`,
+        "platform runner differs from the declared v4 platform authority",
+      );
+    for (const field of ["artifactName", "manifestArtifactName"]) {
+      const name = text(value[field], `${path}/${field}`);
+      if (names.has(name))
+        fault(
+          "tail-reseal-artifact-ambiguous",
+          `${path}/${field}`,
+          "artifact names must be unique",
+        );
+      names.add(name);
+    }
+    root(value.artifactRoot, `${path}/artifactRoot`);
+    root(value.artifactArchiveRoot, `${path}/artifactArchiveRoot`);
+    root(value.manifestRoot, `${path}/manifestRoot`);
+    root(value.manifestArchiveRoot, `${path}/manifestArchiveRoot`);
+    const artifactPaths = sortedUnique(
+      value.artifactPaths,
+      `${path}/artifactPaths`,
+      artifactPath,
+    );
+    if (artifactPaths.length !== 2)
+      fault(
+        "tail-reseal-artifact-path-mismatch",
+        `${path}/artifactPaths`,
+        "exactly two declared payload roots are required",
+      );
+    root(value.capsuleRoot, `${path}/capsuleRoot`);
+  }
+  if (JSON.stringify(ids) !== JSON.stringify(PLATFORM_IDS))
+    fault(
+      "tail-reseal-platform-mismatch",
+      "$/platforms",
+      `platforms must be byte-ordered as ${PLATFORM_IDS.join(", ")}`,
+    );
+}
+
+export function normalizeV4TailResealRequest(request) {
+  exactKeys(
+    request,
+    [
+      "schema",
+      "evaluatedAt",
+      "repository",
+      "source",
+      "target",
+      "runtime",
+      "warrant",
+      "retention",
+      "failure",
+      "stageResume",
+      "signing",
+      "releaseTail",
+      "platforms",
+    ],
+    "$",
+  );
+  if (request.schema !== V4_TAIL_RESEAL_REQUEST_CONTRACT)
+    fault(
+      "unsupported-tail-reseal-version",
+      "$/schema",
+      "unsupported v4 tail-reseal request",
+    );
+  clock(request.evaluatedAt, "$/evaluatedAt");
+  text(request.repository, "$/repository");
+  validateSource(request.source);
+  validateTarget(request.target);
+  validateRuntime(request.runtime);
+  validateWarrant(request.warrant);
+  validateRetention(request.retention, request.evaluatedAt);
+  validateFailure(request.failure);
+  validateStageResume(request.stageResume);
+  validateSigning(request.signing, request.evaluatedAt);
+  validateReleaseTail(request.releaseTail);
+  validatePlatforms(request.platforms);
+  if (request.signing.runtimeSha !== request.runtime.sha)
+    fault(
+      "tail-reseal-signing-runtime-mismatch",
+      "$/signing/runtimeSha",
+      "signing authority runtime differs from candidate runtime",
+    );
+  const capsuleRoots = new Map(
+    request.platforms.map((platform) => [platform.id, platform.capsuleRoot]),
+  );
+  for (const decision of request.stageResume.decisions) {
+    const platformId = decision.stageKey.split(":", 1)[0];
+    if (decision.capsuleRoot !== capsuleRoots.get(platformId))
+      fault(
+        "tail-reseal-capsule-mismatch",
+        "$/stageResume/decisions",
+        `Stage Capsule root drifted for ${platformId}`,
+      );
+  }
+  return structuredClone(request);
+}
+
+export function planV4TailReseal(request) {
+  const normalized = normalizeV4TailResealRequest(request);
+  const payload = {
+    schema: V4_TAIL_RESEAL_PLAN_CONTRACT,
+    mode: "production",
+    productionAuthority: "v4",
+    evaluatedAt: normalized.evaluatedAt,
+    repository: normalized.repository,
+    sourceRoot: normalized.source.sourceRoot,
+    runtimeSha: normalized.runtime.sha,
+    warrantLineageRoot: normalized.warrant.lineageRoot,
+    stageResumePlanRoot: normalized.stageResume.planRoot,
+    retainedPlatformRoots: normalized.platforms.map((platform) => ({
+      platformId: platform.id,
+      artifactRoot: platform.artifactRoot,
+      artifactArchiveRoot: platform.artifactArchiveRoot,
+      manifestRoot: platform.manifestRoot,
+      manifestArchiveRoot: platform.manifestArchiveRoot,
+      capsuleRoot: platform.capsuleRoot,
+    })),
+    skippedStages: ["build", "install", "package", "platform-matrix", "verify"],
+    rerunStages: [
+      "macos-signing-finalization",
+      "aggregate",
+      "candidate-passport",
+      "protected-readback",
+    ],
+    capsuleReuse: {
+      authority: "content-addressed-stage-capsule",
+      effectAuthority: "none",
+      zeroExternalMutations: true,
+      qualificationRoot: normalized.stageResume.qualificationRoot,
+    },
+    signingEffect: {
+      authority: "explicit-live-release-tail",
+      platformId: "macos-arm64",
+      operationRoot: normalized.releaseTail.operationRoot,
+      idempotencyKey: normalized.releaseTail.idempotencyKey,
+      fencedBy: [
+        normalized.warrant.stateReadbackRoot,
+        normalized.signing.credentialLeaseRoot,
+        normalized.releaseTail.transactionRoot,
+      ].sort(),
+      providerReadbackRoots: [
+        normalized.signing.providerReadbackRoot,
+        normalized.releaseTail.providerReadbackRoot,
+      ].sort(),
+    },
+    passport: {
+      contract: "kungfu-buildchain-release-candidate-passport",
+      consumerPolicyReceiptRoot: normalized.runtime.consumerPolicyReceiptRoot,
+      sourceSha: normalized.source.sha,
+      version: normalized.target.version,
+    },
+    invalidationConditions: [
+      "artifact-byte-drift",
+      "credential-authority-drift",
+      "manifest-drift",
+      "platform-drift",
+      "prior-failure-drift",
+      "retention-expired",
+      "signer-authority-drift",
+      "source-drift",
+      "warrant-lineage-drift",
+    ],
+  };
+  return {
+    ...payload,
+    planRoot: v4ContentRoot("tail-reseal-plan", payload),
+  };
+}
+
+export {
+  V4_TAIL_RESEAL_PLATFORMS,
+  V4_TAIL_RESEAL_REUSED_STAGE_KEYS,
+} from "./v4-tail-reseal-contract.js";

package/scripts/buildchain-cli-help.mjs

@@ -44,6 +44,18 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain release-tail init --declaration <json-or-path> [--state <path>]
   buildchain release-tail <status|verify> [--state <path>] [--output <path>]
   buildchain release-tail compat --hooks-json <json-or-path> [--output <path>]
+  buildchain tail-reseal plan --request <request.json> [--output <plan.json>]
+  buildchain tail-reseal admit --request <request.json> [--output <admission.json>]
+  buildchain tail-reseal verify-platform --request <request.json> --platform <id>
+                                      [--artifact-root <dir>] [--mode retained|resealed]
+                                      [--provider-readback-root <sha256:...>]
+                                      [--output <readback.json>]
+  buildchain tail-reseal seal --request <request.json> --plan <plan.json>
+                                      --readbacks <dir> --passport <passport.json>
+                                      --protected-readback-root <sha256:...>
+                                      [--output <receipt.json>]
+  buildchain next-development materialize --input <request.json> [--cwd <dir>]
+                                      [--write] [--output <path>] [--json]
   buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...
   buildchain release <inspect|recover|finalize|abort> ...
   buildchain transaction inspect ...
@@ -154,6 +166,14 @@ export const BUILDCHAIN_USAGE = `Usage:
                              [--module-fact <file>]... [--artifact <path>]...
                              [--output <file>] [--json]
   buildchain facts verify [--cwd <dir>] --fact <file> [--json]
+  buildchain facts compatibility project [--cwd <dir>] [--registry <json-or-path>]
+                                      [--output <file>] [--json]
+  buildchain facts compatibility verify [--cwd <dir>] [--registry <json-or-path>] [--json]
+  buildchain facts compatibility query --query <json-or-path>
+                                      [--registry <json-or-path>] [--cwd <dir>] [--json]
+  buildchain facts compatibility query-template --fact-root <sha256:...>
+                                      [--query-id <id>] [--registry <json-or-path>]
+                                      [--cwd <dir>] [--json]
   buildchain kfd ...
   buildchain kfd hub <init|inspect|test|explain> [--cwd <dir>]
                      [--declaration <path>] [--output-dir <path>]

package/scripts/check-inventory.mjs

@@ -54,6 +54,10 @@ const requiredPaths = [
   "packages/core/homebrew.js",
   "packages/core/artifact-verification-envelope.js",
   "packages/core/anchored-version-material.js",
+  "packages/core/next-development-transition.js",
+  "packages/core/next-development-controller.js",
+  "packages/core/next-development-candidate-reservation.js",
+  "packages/core/next-development-projection.js",
   "packages/core/build-facts.js",
   "packages/core/publication-package.js",
   "packages/core/publication-reproducibility.js",
@@ -76,6 +80,8 @@ const requiredPaths = [
   "docs/auditable-demo.md",
   "contracts/auditable-demo-scenario-v1.schema.json",
   "contracts/release-candidate-recovery-v1.schema.json",
+  "contracts/next-development-request-v1.schema.json",
+  "contracts/next-development-transition-v1.schema.json",
   "contracts/auditable-demo-media-profiles-v1.json",
   "contracts/evidence/auditable-demo-web-delivery-v1.json",
   "contracts/evidence/auditable-demo-responsive-web-delivery-v1.json",
@@ -87,10 +93,15 @@ const requiredPaths = [
   "contracts/fixtures/auditable-demo-responsive-web-delivery-v1/public-projection.json",
   "contracts/fixtures/auditable-demo-responsive-web-delivery-v1/scene.json",
   "docs/release-propagation.md",
+  "docs/next-development-transition.md",
   "docs/site-bundle-contract.md",
   "docs/toolkit-observability.md",
   "docs/versioning.md",
   "scripts/release-line-dry-run.mjs",
+  "scripts/next-development-transition.mjs",
+  "scripts/next-development-self-dogfood.mjs",
+  "scripts/next-development-self-dogfood-harness.mjs",
+  "scripts/generate-next-development-guidance.mjs",
   "scripts/reconcile-release-governance.mjs",
   "scripts/buildchain-channel-router.mjs",
   "scripts/generate-channel-build-workflow.mjs",

package/scripts/check-v4-floating-consumer-policy-contract.mjs

@@ -6,7 +6,6 @@ import { parseYamlUses } from "../packages/core/workflow-yaml-contract.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const read = (relative) => fs.readFileSync(path.join(root, relative), "utf8");
-
 function fail(message) {
   throw new Error(`v4-floating-consumer-policy-contract: ${message}`);
 }
@@ -113,6 +112,7 @@ export function checkV4FloatingConsumerPolicyContract() {
     "Enforce v4 floating consumer policy",
     "Validate consumer package manager contract",
   ]);
+  if (!read(".github/workflows/.build.yml").includes("BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: ${{ inputs.buildchain-expected-channel }}")) fail("channel builds must disambiguate dual-channel caller invocations");
   assertTrustGatedJobs(read(".github/workflows/.build.yml"), [
     "resolve-source",
     "resolve-contract",