@kungfu-tech/buildchain 4.0.1-alpha.4 → 4.0.1-alpha.41

package/scripts/dev-delivery-source-proof-reuse.mjs

@@ -11,6 +11,7 @@ import {
   verifySourceQualificationProof,
 } from "../packages/core/dev-delivery-warrant.js";
 import { validateControllerReceipt } from "../packages/core/controller-evidence.js";
+import { exactMergeGroupBinding } from "./dev-delivery-source-proof-replay.mjs";
 
 const REUSE_DECISION_SCHEMA =
   "kungfu.buildchain.source-qualification-reuse-decision/v1";
@@ -113,98 +114,6 @@ function gitPathRoot(ref, paths, label, cwd) {
   });
 }
 
-function exactMergeGroupBinding(input = {}) {
-  const cwd = path.resolve(input.cwd || process.cwd());
-  const mergeGroupHead = exactSha(input.mergeGroupHead, "mergeGroupHead");
-  const expectedTree = exactSha(input.mergeGroupTree, "mergeGroupTree");
-  const currentBase = exactSha(input.currentBase, "currentBase");
-  const sourceHead = exactSha(input.sourceHead, "sourceHead");
-  const actualTree = exactSha(
-    git(["rev-parse", `${mergeGroupHead}^{tree}`], { cwd }),
-    "mergeGroupTree",
-  );
-  if (actualTree !== expectedTree)
-    return { ok: false, reason: "merge-group-tree-mismatch" };
-  const [commit, ...parents] = git(
-    ["rev-list", "--parents", "-n", "1", mergeGroupHead],
-    { cwd },
-  ).split(/\s+/u);
-  if (commit !== mergeGroupHead) {
-    return { ok: false, reason: "merge-group-parent-mismatch" };
-  }
-  if (
-    parents.length === 2 &&
-    parents[0] === currentBase &&
-    parents[1] === sourceHead
-  ) {
-    return {
-      ok: true,
-      mergeGroupHead,
-      mergeGroupTree: actualTree,
-      parents,
-      compositionMode: "two-parent-merge",
-      replayedCommitTrees: [],
-    };
-  }
-
-  const linearRange = (head) => {
-    try {
-      git(["merge-base", "--is-ancestor", currentBase, head], { cwd });
-    } catch {
-      return null;
-    }
-    const commits = git(
-      ["rev-list", "--reverse", "--topo-order", `${currentBase}..${head}`],
-      { cwd },
-    )
-      .split(/\s+/u)
-      .filter(Boolean);
-    if (commits.length === 0) return null;
-    let expectedParent = currentBase;
-    const trees = [];
-    for (const rangeCommit of commits) {
-      const [observedCommit, ...rangeParents] = git(
-        ["rev-list", "--parents", "-n", "1", rangeCommit],
-        { cwd },
-      ).split(/\s+/u);
-      if (
-        observedCommit !== rangeCommit ||
-        rangeParents.length !== 1 ||
-        rangeParents[0] !== expectedParent
-      ) {
-        return null;
-      }
-      trees.push(
-        exactSha(
-          git(["rev-parse", `${rangeCommit}^{tree}`], { cwd }),
-          "replayedCommitTree",
-        ),
-      );
-      expectedParent = rangeCommit;
-    }
-    return trees;
-  };
-
-  const sourceTrees = linearRange(sourceHead);
-  const mergeGroupTrees = linearRange(mergeGroupHead);
-  if (
-    !sourceTrees ||
-    !mergeGroupTrees ||
-    sourceTrees.length !== mergeGroupTrees.length ||
-    sourceTrees.some((tree, index) => tree !== mergeGroupTrees[index])
-  ) {
-    return { ok: false, reason: "merge-group-parent-mismatch" };
-  }
-  return {
-    ok: true,
-    mergeGroupHead,
-    mergeGroupTree: actualTree,
-    parents,
-    compositionMode: "linear-replay",
-    replayedCommitTrees: mergeGroupTrees,
-  };
-}
-
 export function sourceQualificationPredicates(input = {}) {
   const cwd = path.resolve(input.cwd || process.cwd());
   const repository = required(input.repository, "repository");
@@ -397,7 +306,8 @@ export function materializeReuseLifecycleEvidence({
       decisionRoot: decision.decisionRoot,
       sourceWorkflowRunId: decision.sourceWorkflowRunId,
       sourceHead: decision.sourceHead,
-      qualifiedBase: decision.currentBase,
+      qualifiedBase: decision.qualifiedBase,
+      currentBase: decision.currentBase,
       mergeGroupHead: decision.mergeGroupHead,
       mergeGroupTree: decision.mergeGroupTree,
     },
@@ -446,7 +356,7 @@ export function verifySourceQualificationReuse(input = {}) {
   const verification = verifySourceQualificationProof(proof, {
     repository: required(input.repository, "repository"),
     protectedBase: required(input.protectedBase, "protectedBase"),
-    qualifiedBase: exactSha(input.currentBase, "currentBase"),
+    qualifiedBase: exactSha(proof.qualifiedBase, "qualifiedBase"),
     sourceHead: exactSha(input.sourceHead, "sourceHead"),
     sourceWorkflowRunId: Number(input.sourceWorkflowRunId),
     controllerReceiptRoot: receipt.digest,
@@ -462,7 +372,7 @@ export function verifySourceQualificationReuse(input = {}) {
   }
   const current = sourceQualificationPredicates({
     ...input,
-    qualifiedBase: input.currentBase,
+    qualifiedBase: proof.qualifiedBase,
   });
   const classification = classifyDevDeliveryDelta({
     proof,
@@ -476,7 +386,11 @@ export function verifySourceQualificationReuse(input = {}) {
       reason: classification.reason,
     });
   }
-  const mergeGroup = exactMergeGroupBinding(input);
+  const mergeGroup = exactMergeGroupBinding({
+    ...input,
+    qualifiedBase: proof.qualifiedBase,
+    sourcePatchRoot: proof.sourcePatchRoot,
+  });
   if (!mergeGroup.ok) {
     return rootedDecision({
       schema: REUSE_DECISION_SCHEMA,
@@ -493,12 +407,14 @@ export function verifySourceQualificationReuse(input = {}) {
     sourceProofRoot: proof.proofRoot,
     sourceWorkflowRunId: proof.sourceWorkflowRunId,
     sourceHead: proof.sourceHead,
-    currentBase: proof.qualifiedBase,
+    qualifiedBase: proof.qualifiedBase,
+    currentBase: exactSha(input.currentBase, "currentBase"),
     mergeGroupHead: mergeGroup.mergeGroupHead,
     mergeGroupTree: mergeGroup.mergeGroupTree,
     mergeGroupParents: mergeGroup.parents,
     mergeGroupCompositionMode: mergeGroup.compositionMode,
     mergeGroupReplayTrees: mergeGroup.replayedCommitTrees,
+    mergeGroupReplayPatchRoots: mergeGroup.replayedCommitPatchRoots,
     predicateRoots: {
       sourceIdentityRoot: proof.sourceIdentityRoot,
       sourcePatchRoot: proof.sourcePatchRoot,

package/scripts/dev-delivery-warrant-options.mjs

@@ -7,6 +7,32 @@ export function hasFlag(args, name) {
   return args.includes(`--${name}`);
 }
 
+function terminalEvidenceOptions(rest, environment) {
+  return {
+    outcome: flag(rest, "outcome", environment.BUILDCHAIN_DEV_DELIVERY_OUTCOME),
+    eventAction: flag(
+      rest,
+      "event-action",
+      environment.BUILDCHAIN_DEV_DELIVERY_EVENT_ACTION,
+    ),
+    evidenceRoot: flag(
+      rest,
+      "evidence-root",
+      environment.BUILDCHAIN_DEV_DELIVERY_EVIDENCE_ROOT,
+    ),
+    expectedPriorEvidenceRoot: flag(
+      rest,
+      "expected-prior-evidence-root",
+      environment.BUILDCHAIN_DEV_DELIVERY_EXPECTED_PRIOR_EVIDENCE_ROOT,
+    ),
+    integrationProofPath: flag(
+      rest,
+      "integration-proof",
+      environment.BUILDCHAIN_DEV_DELIVERY_INTEGRATION_PROOF,
+    ),
+  };
+}
+
 export function devDeliveryCliOptions(args = [], environment = process.env) {
   const [command = "", ...rest] = args;
   return {
@@ -196,17 +222,7 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
       "lease-seconds",
       environment.BUILDCHAIN_DEV_DELIVERY_LEASE_SECONDS,
     ),
-    outcome: flag(rest, "outcome", environment.BUILDCHAIN_DEV_DELIVERY_OUTCOME),
-    eventAction: flag(
-      rest,
-      "event-action",
-      environment.BUILDCHAIN_DEV_DELIVERY_EVENT_ACTION,
-    ),
-    evidenceRoot: flag(
-      rest,
-      "evidence-root",
-      environment.BUILDCHAIN_DEV_DELIVERY_EVIDENCE_ROOT,
-    ),
+    ...terminalEvidenceOptions(rest, environment),
     transferRoot: flag(rest, "transfer-root"),
     finalizerBoundaryRoot: flag(rest, "finalizer-boundary-root"),
     nativeJobId: flag(rest, "native-job-id"),

package/scripts/dev-delivery-warrant-store.mjs

@@ -46,7 +46,7 @@ function decodeBlob(blob) {
   ).toString("utf8");
 }
 
-function validateStoredState(queue) {
+function validateStoredState(queue, { allowLegacyV3Readback = false } = {}) {
   const body = structuredClone(queue || {});
   const embeddedStateRoot = body.stateRoot;
   delete body.stateRoot;
@@ -59,7 +59,7 @@ function validateStoredState(queue) {
   ) {
     normalizeDevDeliveryAuthorityState(queue);
   } else {
-    normalizeDevDeliveryQueue(queue);
+    normalizeDevDeliveryQueue(queue, { allowLegacyV3Readback });
   }
   return queue;
 }
@@ -108,7 +108,7 @@ export class GitHubDevDeliveryStore {
     return data;
   }
 
-  async read({ stateRef, protectedBase, now }) {
+  async read({ stateRef, protectedBase, now, allowLegacyV3Readback = false }) {
     let ref;
     try {
       ref = await this.request(
@@ -128,11 +128,13 @@ export class GitHubDevDeliveryStore {
       };
     }
     const commitSha = exactSha(ref?.object?.sha, "state ref commit");
-    const readback = await this.readCommit(commitSha);
+    const readback = await this.readCommit(commitSha, {
+      allowLegacyV3Readback,
+    });
     return { exists: true, ...readback };
   }
 
-  async readCommit(commitShaInput) {
+  async readCommit(commitShaInput, { allowLegacyV3Readback = false } = {}) {
     const commitSha = exactSha(commitShaInput, "state commit");
     const commit = await this.request(
       "GET",
@@ -152,7 +154,9 @@ export class GitHubDevDeliveryStore {
       `/repos/${this.repository.fullName}/git/blobs/${entry.sha}`,
     );
     const bytes = decodeBlob(blob);
-    const queue = validateStoredState(JSON.parse(bytes));
+    const queue = validateStoredState(JSON.parse(bytes), {
+      allowLegacyV3Readback,
+    });
     return { commitSha, queue, bytes };
   }
 

package/scripts/dev-delivery-warrant.mjs

@@ -10,6 +10,7 @@ import {
   observeDevDeliveryQueue,
   qualifyDevDeliveryWarrant,
   recoverExpiredDevDeliveryWarrant,
+  reconcileDevDeliveryTerminalEvidence,
   selectDevDeliveryWarrant,
   settleDevDeliveryTerminalEvent,
   submitDevDeliveryCandidate,
@@ -52,6 +53,43 @@ function exactSha(value, label) {
   return normalized;
 }
 
+function terminalSourceHead(options) {
+  return exactSha(
+    options.expectedSourceHead || options.sourceHead,
+    "sourceHead",
+  );
+}
+
+function reconcileTerminalEvidenceCommand(queue, options) {
+  return reconcileDevDeliveryTerminalEvidence(
+    queue,
+    {
+      candidateId: exactRoot(options.candidateId, "candidateId"),
+      expectedPriorEvidenceRoot: exactRoot(
+        options.expectedPriorEvidenceRoot,
+        "expectedPriorEvidenceRoot",
+      ),
+      integrationProof:
+        options.integrationProof ||
+        jsonFile(options.integrationProofPath, "integration proof"),
+      reason: options.reason,
+    },
+    { now: options.now },
+  );
+}
+
+function requireTerminalEvidenceCas(options) {
+  if (
+    options.command === "reconcile-terminal-evidence" &&
+    options.execute &&
+    !options.expectedOldStateRoot
+  ) {
+    throw new Error(
+      "terminal evidence reconciliation execute requires expected-old CAS",
+    );
+  }
+}
+
 function normalizeRepository(value) {
   const normalized = text(value);
   const match = normalized.match(/^([^/\s]+)\/([^/\s]+)$/);
@@ -245,10 +283,7 @@ function transitionFor(command, queue, options) {
           options.pullRequestNumber,
           "pullRequestNumber",
         ),
-        sourceHead: exactSha(
-          options.expectedSourceHead || options.sourceHead,
-          "sourceHead",
-        ),
+        sourceHead: terminalSourceHead(options),
         fencingToken: options.fencingToken,
         leaseGeneration: options.leaseGeneration,
         outcome: options.outcome,
@@ -263,6 +298,9 @@ function transitionFor(command, queue, options) {
       { now: options.now },
     );
   }
+  if (command === "reconcile-terminal-evidence") {
+    return reconcileTerminalEvidenceCommand(queue, options);
+  }
   if (command === "cancel-queued") {
     return cancelQueuedDevDeliveryCandidate(
       queue,
@@ -295,7 +333,10 @@ async function observeQueue(loaded, options) {
   const readMode = text(options.readMode || "v3").toLowerCase();
   if (!["v3", "v4"].includes(readMode))
     throw new Error("readMode must be v3 or v4");
-  let observation = observeDevDeliveryQueue(loaded.queue, { now: options.now });
+  let observation = observeDevDeliveryQueue(loaded.queue, {
+    now: options.now,
+    allowLegacyV3Readback: true,
+  });
   let readCandidate;
   if (readMode === "v4") {
     const qualification =
@@ -353,6 +394,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     now: new Date(optionsInput.now || Date.now()).toISOString(),
     execute: bool(optionsInput.execute, false),
   };
+  requireTerminalEvidenceCas(options);
   if (
     options.command === "submit" &&
     options.execute &&
@@ -374,6 +416,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     stateRef: options.stateRef,
     protectedBase: options.branch,
     now: options.now,
+    allowLegacyV3Readback: options.command === "observe",
   });
   if (
     options.expectedOldStateRoot &&
@@ -453,7 +496,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
 }
 
 function usage() {
-  return "Usage:\n  buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|settle|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n\nRead candidate:\n  observe --read-mode v4 --read-qualification FILE --read-qualification-root sha256:... --read-typescript-revision SHA --read-rust-revision SHA --read-validator-version TOKEN [--read-evidence-output FILE]\n";
+  return "Usage:\n  buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|settle|reconcile-terminal-evidence|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n\nRead candidate:\n  observe --read-mode v4 --read-qualification FILE --read-qualification-root sha256:... --read-typescript-revision SHA --read-rust-revision SHA --read-validator-version TOKEN [--read-evidence-output FILE]\n";
 }
 
 async function main() {
@@ -472,6 +515,7 @@ async function main() {
       "recover",
       "close",
       "settle",
+      "reconcile-terminal-evidence",
       "cancel-queued",
       "observe",
     ].includes(options.command)

package/scripts/dev-pr-auto-merge.mjs

@@ -3,7 +3,7 @@ import crypto from "node:crypto";
 import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import { admitExistingQueueEntry, createDevPrAdmissionReceipt, qualifyAtomicQueueAdmission, readDeliveryWarrantResult, runSourceQualification, runTargetedQueueAdmission, setActiveLeaseStatus, verifyCurrentDeliveryWarrant } from "./dev-pr-delivery-warrant.mjs";
+import { admitExistingQueueEntry, createDevPrAdmissionReceipt, createPreReadinessQueueFence, qualifyAtomicQueueAdmission, readDeliveryWarrantResult, runSourceQualification, runTargetedQueueAdmission, setActiveLeaseStatus, setQueueAdmissionStatus, verifyCurrentDeliveryWarrant } from "./dev-pr-delivery-warrant.mjs";
 import { projectCutQualification } from "./dev-pr-prequeue-guard.mjs";
 const DEFAULT_BLOCK_LABELS = ["blocked", "do-not-merge", "work-in-progress"];
 const DEFAULT_ALLOWED_HEAD_PREFIXES = ["feature/", "fix/", "chore/", "docs/", "ci/", "refactor/"];
@@ -197,12 +197,6 @@ function mergeableAccepted(pr, landingMode = "direct", projectCutQualified = fal
 function rejectBaseMoveBeforeAtomicReplay(options, initialBaseSha, observedBaseSha) {
   return observedBaseSha !== initialBaseSha && options.warrantMode !== "required";
 }
-async function setQueueAdmissionStatus(client, repository, sha, context, state) {
-  if (!context) return null;
-  await client.request("POST", `/repos/${repository.owner}/${repository.repo}/statuses/${sha}`, { body: { state, context, description: state === "success" ? "Buildchain admitted this exact PR head to the merge queue" : "Buildchain rejected merge queue admission for this exact PR head" } });
-  return { context, state, sha };
-}
-
 function skip(reason, details = {}) {
   return { action: "skip", reason, ...details };
 }
@@ -790,8 +784,10 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
     return targetedFailure({ options, pr: {}, state: "missing", reason: "pull-request-not-found" });
   }
 
+  const readinessFence = createPreReadinessQueueFence({ client, options, sleep: delay });
   const reject = async (state, reason, readiness = { observed: hasReadyLabel(pr, options.readyLabel), established: false }) => {
     const result = targetedFailure({ options, pr, state, reason, readiness });
+    await readinessFence.finish(result);
     if (!options.dryRun) result.diagnostic = await publishAdmissionDiagnostic(client, options, result.receipt, result.receiptRoot);
     return result;
   };
@@ -803,6 +799,12 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
   if (pr.draft) return reject("blocked", "draft");
   if (!headPrefixAllowed(pr, options.allowedHeadPrefixes)) return reject("blocked", "head-prefix-not-allowed");
 
+  try {
+    await readinessFence.establish();
+  } catch (error) {
+    return reject("blocked", error.code || "pre-readiness-queue-fence-failed");
+  }
+
   let readiness = { observed: hasReadyLabel(pr, options.readyLabel), established: false };
   if (!readiness.observed) {
     if (options.dryRun) return reject("rejected", "missing-ready-label", readiness);
@@ -825,7 +827,7 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
   }
 
   if (options.qualificationOnly) {
-    return runSourceQualification({
+    const result = await runSourceQualification({
       options, pullRequest: pr, readiness, client, reject,
       evaluate: evaluatePullRequest,
       admissionState: admissionStateFor,
@@ -833,6 +835,7 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
       root: contentRoot,
       publishDiagnostic: publishAdmissionDiagnostic,
     });
+    return readinessFence.finish(result);
   }
 
   const initialQueue = await client.getMergeQueueState(options.targetBranch);
@@ -844,6 +847,7 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
   }
   const matchingEntry = initialQueue.entries.find((entry) =>
     entry.pullRequestNumber === pr.number && entry.pullRequestHeadSha === options.expectedHeadSha);
+  await readinessFence.qualifyExisting(matchingEntry);
   const existing = await admitExistingQueueEntry({
     options, pullRequest: pr, readiness, client, entry: matchingEntry, warrant,
     createReceipt: createAdmissionReceipt,
@@ -852,7 +856,7 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
   });
   if (existing) return existing;
 
-  return runTargetedQueueAdmission({
+  const result = await runTargetedQueueAdmission({
     options, pullRequest: pr, readiness, client, warrant,
     runController: runDevPrAutoMerge,
     admissionState: admissionStateFor,
@@ -860,6 +864,7 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
     root: contentRoot,
     publishDiagnostic: publishAdmissionDiagnostic,
   });
+  return readinessFence.finish(result);
 }
 
 function finalizePatrolResult(result) {
@@ -1132,6 +1137,11 @@ function cliFlag(args, name) {
 
 export function cliOptions(args = [], environment = process.env) {
   const targetPullRequestNumber = cliValue(args, "pull-request", environment.BUILDCHAIN_DEV_PR_EXPECTED_PR_NUMBER);
+  const warrantMode = cliValue(
+    args,
+    "warrant-mode",
+    environment.BUILDCHAIN_DEV_PR_WARRANT_MODE || environment.WARRANT_MODE,
+  );
   return {
     repository: cliValue(args, "repository", environment.BUILDCHAIN_DEV_PR_REPOSITORY || environment.GITHUB_REPOSITORY),
     targetBranch: cliValue(args, "branch", environment.BUILDCHAIN_DEV_PR_TARGET_BRANCH || environment.GITHUB_REF_NAME),
@@ -1141,10 +1151,14 @@ export function cliOptions(args = [], environment = process.env) {
     blockLabels: cliValue(args, "block-labels", environment.BUILDCHAIN_DEV_PR_BLOCK_LABELS),
     allowedHeadPrefixes: cliValue(args, "allowed-head-prefixes", environment.BUILDCHAIN_DEV_PR_ALLOWED_HEAD_PREFIXES),
     requiredChecks: cliValue(args, "required-checks", environment.BUILDCHAIN_DEV_PR_REQUIRED_CHECKS),
-    queueAdmissionContext: cliValue(args, "queue-admission-context", environment.BUILDCHAIN_DEV_PR_QUEUE_ADMISSION_CONTEXT),
+    queueAdmissionContext: cliValue(
+      args,
+      "queue-admission-context",
+      environment.BUILDCHAIN_DEV_PR_QUEUE_ADMISSION_CONTEXT || (warrantMode === "required" ? "Queue admission lease" : ""),
+    ),
     activeLeaseContext: cliValue(args, "active-lease-context", environment.BUILDCHAIN_DEV_PR_ACTIVE_LEASE_CONTEXT),
     diagnosticContext: cliValue(args, "diagnostic-context", environment.BUILDCHAIN_DEV_PR_DIAGNOSTIC_CONTEXT),
-    warrantMode: cliValue(args, "warrant-mode", environment.BUILDCHAIN_DEV_PR_WARRANT_MODE),
+    warrantMode,
     warrantResultPath: cliValue(args, "warrant-result", environment.BUILDCHAIN_DEV_PR_WARRANT_RESULT_PATH),
     projectCutProofPath: cliValue(args, "project-cut-proof", environment.BUILDCHAIN_DEV_PR_PROJECT_CUT_PROOF_PATH),
     sourceProofPath: cliValue(args, "source-proof", environment.BUILDCHAIN_DEV_PR_SOURCE_PROOF_PATH),

package/scripts/dev-pr-delivery-warrant.mjs

@@ -143,6 +143,7 @@ export async function readCurrentDeliveryQueueState(client, repository, targetBr
   const { queue } = await store.read({
     stateRef: defaultDevDeliveryStateRef(targetBranch),
     protectedBase: targetBranch,
+    allowLegacyV3Readback: true,
   });
   return queue;
 }
@@ -205,6 +206,50 @@ export async function setActiveLeaseStatus(client, repository, sha, context, sta
   return { context, state, sha };
 }
 
+export async function setQueueAdmissionStatus(client, repository, sha, context, state) {
+  if (!context) return null;
+  const descriptions = {
+    pending: "Buildchain is awaiting a qualified Warrant for this exact PR head",
+    success: "Buildchain admitted this exact PR head to the merge queue",
+    failure: "Buildchain rejected merge queue admission for this exact PR head",
+  };
+  await client.request("POST", `/repos/${repository.owner}/${repository.repo}/statuses/${sha}`, {
+    body: { state, context, description: descriptions[state] || descriptions.failure },
+  });
+  return { context, state, sha };
+}
+
+export function createPreReadinessQueueFence({ client, options, sleep }) {
+  let status = null;
+  const write = async (state) => {
+    status = await setQueueAdmissionStatus(client, options.repository, options.expectedHeadSha, options.queueAdmissionContext, state);
+    return status;
+  };
+  return {
+    async establish() {
+      if (options.dryRun || options.warrantMode !== "required") return null;
+      if (!options.queueAdmissionContext) mismatch("queue-admission-context-required-before-readiness");
+      await write("pending");
+      for (let attempt = 1; attempt <= Math.max(1, options.pollMergeableAttempts); attempt += 1) {
+        const checks = await client.listCommitChecks(options.expectedHeadSha);
+        const readback = (checks?.statuses || []).find((entry) => entry.context === options.queueAdmissionContext);
+        if (readback?.state === "pending") return { ...status, readbackAttempts: attempt };
+        if (attempt < options.pollMergeableAttempts) await sleep(options.pollMergeableDelayMs);
+      }
+      await write("failure");
+      mismatch("pre-readiness-queue-fence-readback-mismatch");
+    },
+    async qualifyExisting(entry) {
+      if (entry && status?.state === "pending") await write("success");
+    },
+    async finish(result) {
+      const controllerFailed = result.controller?.evaluated?.some((entry) => entry.queueAdmissionStatus?.state === "failure");
+      if (!result.ok && status?.state === "pending" && !controllerFailed) await write("failure");
+      return result;
+    },
+  };
+}
+
 async function readBackAdmissionStatuses(client, options, expectedHeadSha, sleep) {
   let last = { queueAdmission: null, activeLease: null };
   const attempts = Math.max(1, options.pollMergeableAttempts);

package/scripts/dev-pr-prequeue-guard.mjs

@@ -164,15 +164,6 @@ async function qualifyProjectCut({
 
   let reuseDecision = null;
   if (currentBaseSha !== previousBaseSha) {
-    const observedPullRequestBase = String(
-      observedPullRequest.base?.sha || "",
-    ).toLowerCase();
-    if (observedPullRequestBase !== currentBaseSha) {
-      mismatch("pre-enqueue-project-cut-base-stale", {
-        observedPullRequestBase,
-        currentBaseSha,
-      });
-    }
     const proof = readOptionalJson(options.sourceProofPath);
     if (!proof) mismatch("pre-enqueue-base-attribution-unknown");
     if (
@@ -342,15 +333,6 @@ export async function qualifyPreEnqueueReadback({
   ) {
     mismatch("head-sha-drift-after-project-cut");
   }
-  const casPullRequestBase = String(
-    casPullRequest.base?.sha || "",
-  ).toLowerCase();
-  if (casPullRequestBase && casPullRequestBase !== casBaseSha) {
-    mismatch("pre-enqueue-project-cut-base-stale", {
-      observedPullRequestBase: casPullRequestBase,
-      currentBaseSha: casBaseSha,
-    });
-  }
   if (casPullRequest.mergeable === false) {
     mismatch("pre-enqueue-merge-conflict-after-project-cut");
   }

package/scripts/dev-qualification-patrol.mjs

@@ -501,16 +501,16 @@ export function createGitHubDevQualificationClient({
       sourceBranch,
       { activeOnly = false } = {},
     ) {
-      const query = sourceBranch
-        ? `?branch=${encodeURIComponent(sourceBranch)}`
-        : "";
-      const runs = await paged(
-        `/repos/${owner}/${repo}/actions/workflows/${encodeURIComponent(workflow)}/runs${query}`,
-        "workflow_runs",
+      const query = sourceBranch ? `branch=${encodeRef(sourceBranch)}&` : "";
+      const runs = await Promise.all(
+        [...(activeOnly ? ACTIVE_STATUSES : [""])].map((status) =>
+          paged(
+            `/repos/${owner}/${repo}/actions/workflows/${encodeURIComponent(workflow)}/runs?${query}${status ? `status=${status}` : ""}`,
+            "workflow_runs",
+          ),
+        ),
       );
-      return activeOnly
-        ? runs.filter((run) => ACTIVE_STATUSES.has(text(run.status)))
-        : runs;
+      return runs.flat();
     },
     async listRunJobs(runId, runAttempt) {
       return paged(

package/scripts/dispatch-artifact-signing-authority.mjs

@@ -24,7 +24,7 @@ const AUTHORITY_WORKFLOW = "artifact-signing-authority.yml";
 
 export function resolveAuthorityDispatchRef(value) {
   const ref = required(value, "authority ref");
-  return /^[0-9a-f]{40}$/u.test(ref)
+  return /^[0-9a-f]{40}$/u.test(ref) || /^v\d+(?:\.\d+)?(?:-alpha)?$/u.test(ref)
     ? DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF
     : ref;
 }

package/scripts/generate-channel-promotion-workflow.mjs

@@ -159,8 +159,8 @@ function validateWorkflowRoute(name, route, expectedLogicalRef) {
   if (!/^\.github\/workflows\/[.a-z0-9-]+\.ya?ml$/.test(route.workflowPath || "")) {
     throw new Error(`promotion shell ${name} workflowPath must name a reusable workflow`);
   }
-  if (!/^(?:v[0-9]+(?:-alpha)?|train\/[A-Za-z0-9._+\/-]+|[0-9a-f]{40})$/.test(route.callRef || "")) {
-    throw new Error(`promotion shell ${name} callRef must be an official channel ref, trusted train, or exact SHA`);
+  if (!/^(?:v[0-9]+(?:-alpha)?|(?:train|alpha|release)\/[A-Za-z0-9._+\/-]+|[0-9a-f]{40})$/.test(route.callRef || "")) {
+    throw new Error(`promotion shell ${name} callRef must be an official tag, protected channel ref, trusted train, or exact SHA`);
   }
   if (typeof route.forwardInternalInputs !== "boolean") {
     throw new Error(`promotion shell ${name} forwardInternalInputs must be boolean`);