@kungfu-tech/buildchain 4.0.1-alpha.4 → 4.0.1-alpha.6

package/packages/core/buildchain-delivery-self-dogfood.js

@@ -0,0 +1,395 @@
+import { initAdopterManifest } from "@kungfu-tech/kfd/adopter-conformance/toolchain";
+
+import { adopterDeliveryGateDigest } from "./adopter-delivery-gate.js";
+import { withPublishedBuildchainDeliveryAuthority } from "./published-delivery-authority.js";
+
+export const BUILDCHAIN_DELIVERY_SELF_DOGFOOD_CONTRACT =
+  "kungfu-buildchain-delivery-infrastructure-self-dogfood/v1";
+
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const SHA_PATTERN = /^[0-9a-f]{40}$/;
+const BUILDCHAIN_PACKAGE = "@kungfu-tech/buildchain";
+const KFD_PACKAGE = "@kungfu-tech/kfd";
+const PROFILE_REQUIREMENTS = Object.freeze([
+  ["adopter-identity", ["declaration"]],
+  ["artifact-readback", ["verification"]],
+  ["claim-boundary", ["declaration"]],
+  ["delivery-policy-cut", ["declaration", "verification"]],
+  ["kfd-cut", ["verification"]],
+  ["protected-delivery", ["implementation", "review", "verification"]],
+  ["source-artifact", ["implementation"]],
+]);
+
+function exactPackage(value, { name, version = "", root = "", label }) {
+  if (
+    value?.name !== name ||
+    typeof value.version !== "string" ||
+    value.version.length === 0 ||
+    !ROOT_PATTERN.test(value.artifactRoot ?? "")
+  ) {
+    throw new TypeError(`${label} package identity is incomplete`);
+  }
+  if (version && value.version !== version) {
+    throw new TypeError(`${label} package version does not match its binding`);
+  }
+  if (root && value.artifactRoot !== root) {
+    throw new TypeError(`${label} package root does not match its binding`);
+  }
+  return structuredClone(value);
+}
+
+function authorityFunctions(authorityRuntime) {
+  const names = [
+    "createBuildchainDeliveryInfrastructureInstanceManifest",
+    "verifyBuildchainDeliveryInfrastructureInstance",
+    "createAdopterDeliveryGate",
+    "createPackageArtifactProfile",
+    "createKfdAdopterCategoryProtocolDriver",
+    "qualifyBuildchainDeliveryInfrastructureBootstrap",
+  ];
+  for (const name of names) {
+    if (typeof authorityRuntime?.[name] !== "function") {
+      throw new TypeError(`authority runtime is missing ${name}`);
+    }
+  }
+  return authorityRuntime;
+}
+
+function passed(value, label) {
+  if (value?.status !== "passed") {
+    throw new Error(
+      `${label} failed closed: ${JSON.stringify(value?.issues ?? [])}`,
+    );
+  }
+  return value;
+}
+
+function candidateWarrant(candidate) {
+  const terminal = candidate?.terminal;
+  if (
+    candidate?.status !== "merged" ||
+    !SHA_PATTERN.test(candidate?.sourceHead ?? "") ||
+    !ROOT_PATTERN.test(candidate?.sourceProofRoot ?? "") ||
+    terminal?.outcome !== "merged" ||
+    !ROOT_PATTERN.test(terminal?.nativeProofRoot ?? "") ||
+    !ROOT_PATTERN.test(terminal?.evidenceRoot ?? "")
+  ) {
+    throw new TypeError("candidate Warrant settlement is incomplete");
+  }
+  return {
+    outcome: "merged",
+    sourceHead: candidate.sourceHead,
+    sourceProofRoot: candidate.sourceProofRoot,
+    nativeProofRoot: terminal.nativeProofRoot,
+    integrationProofRoot: terminal.evidenceRoot,
+  };
+}
+
+function deliveryCut() {
+  const protocol = {
+    id: "kfd.adopter-category/instance-manifest",
+    version: "1.0.0",
+  };
+  protocol.root = adopterDeliveryGateDigest(protocol);
+  const profile = {
+    id: "kfd.adopter-category/delivery-infrastructure",
+    version: "1.0.0",
+  };
+  profile.root = adopterDeliveryGateDigest({
+    ...profile,
+    requirements: PROFILE_REQUIREMENTS,
+  });
+  return {
+    gateRoot: adopterDeliveryGateDigest({
+      protocol,
+      profile,
+      artifactProfile: {
+        id: "buildchain.artifact/package",
+        version: "1.0.0",
+      },
+    }),
+    protocol,
+    profile,
+  };
+}
+
+function candidateEvidence({
+  source,
+  artifact,
+  authority,
+  warrant,
+  kfdRoot,
+  observedAt,
+}) {
+  const roots = {
+    "adopter-identity:declaration": source.root,
+    "artifact-readback:verification": artifact.root,
+    "claim-boundary:declaration": adopterDeliveryGateDigest({
+      qualifying: false,
+      selfCertified: false,
+      releaseAuthorized: false,
+    }),
+    "delivery-policy-cut:declaration": authority.gateRoot,
+    "delivery-policy-cut:verification": warrant.integrationProofRoot,
+    "kfd-cut:verification": kfdRoot,
+    "protected-delivery:implementation": artifact.root,
+    "protected-delivery:review": warrant.sourceProofRoot,
+    "protected-delivery:verification": warrant.nativeProofRoot,
+    "source-artifact:implementation": source.root,
+  };
+  return PROFILE_REQUIREMENTS.flatMap(([requirementId, kinds]) =>
+    kinds.map((kind) => ({
+      requirementId,
+      kind,
+      coordinate: `evidence://kungfu-systems/buildchain/${requirementId}/${kind}`,
+      root: roots[`${requirementId}:${kind}`],
+      observedAt,
+    })),
+  );
+}
+
+export function createBuildchainDeliveryInfrastructureSelfDogfood(
+  {
+    authorityPackage,
+    kfdPackage,
+    authority,
+    candidate,
+    instanceId,
+    adopterManifest,
+    source,
+    artifact,
+    release,
+    evidence = [],
+    warrant,
+    transitionEvidence,
+    verifiedAt,
+    maxAgeSeconds,
+  } = {},
+  authorityRuntime,
+) {
+  const runtime = authorityFunctions(authorityRuntime);
+  const boundAuthorityPackage = exactPackage(authorityPackage, {
+    name: BUILDCHAIN_PACKAGE,
+    version: authority?.version,
+    root: authority?.packageRoot,
+    label: "Buildchain authority",
+  });
+  const boundKfdPackage = exactPackage(kfdPackage, {
+    name: KFD_PACKAGE,
+    version: adopterManifest?.kfdCut?.package?.version,
+    root: adopterManifest?.kfdCut?.package?.artifactRoot,
+    label: "KFD authority",
+  });
+  if (candidate?.authorityVersion !== boundAuthorityPackage.version) {
+    throw new TypeError(
+      "candidate does not name the exact Buildchain N-1 authority",
+    );
+  }
+
+  const instanceManifest =
+    runtime.createBuildchainDeliveryInfrastructureInstanceManifest({
+      instanceId,
+      adopterManifest,
+      source,
+      artifact,
+      release,
+      evidence,
+    });
+  const instanceReport = runtime.verifyBuildchainDeliveryInfrastructureInstance(
+    instanceManifest,
+    {
+      adopterManifest,
+      verifiedAt,
+      maxAgeSeconds,
+    },
+  );
+  if (instanceReport?.valid !== true) {
+    throw new Error(
+      `delivery-infrastructure instance failed closed: ${JSON.stringify(instanceReport?.issues ?? [])}`,
+    );
+  }
+
+  const gateResult = passed(
+    runtime
+      .createAdopterDeliveryGate({
+        drivers: [runtime.createKfdAdopterCategoryProtocolDriver()],
+        artifactProfiles: [runtime.createPackageArtifactProfile()],
+      })
+      .evaluate(
+        {
+          schemaVersion: 1,
+          contract: "kungfu-buildchain-adopter-delivery-request",
+          protocol: {
+            id: "kfd.adopter-category/instance-manifest",
+            version: "1.0.0",
+          },
+          artifactProfile: {
+            id: "buildchain.artifact/package",
+            version: "1.0.0",
+          },
+          project: {
+            instanceId,
+            adopterId: "kungfu-systems/buildchain",
+          },
+          artifact: structuredClone(artifact),
+          declaration: instanceManifest,
+        },
+        { adopterManifest, verifiedAt, maxAgeSeconds },
+      ),
+    "adopter delivery gate",
+  );
+  const bootstrap = passed(
+    runtime.qualifyBuildchainDeliveryInfrastructureBootstrap({
+      authority,
+      candidate,
+      gateResult,
+      warrant,
+      transitionEvidence,
+    }),
+    "delivery-infrastructure bootstrap",
+  );
+
+  const result = {
+    schemaVersion: 1,
+    contract: BUILDCHAIN_DELIVERY_SELF_DOGFOOD_CONTRACT,
+    status: "passed",
+    authorityRuntime: {
+      buildchainPackage: boundAuthorityPackage,
+      kfdPackage: boundKfdPackage,
+    },
+    candidate: structuredClone(candidate),
+    roots: {
+      adopterManifest: adopterDeliveryGateDigest(adopterManifest),
+      instanceManifest: adopterDeliveryGateDigest(instanceManifest),
+      instanceReport: adopterDeliveryGateDigest(instanceReport),
+      gateResult: gateResult.gateRoot,
+      bootstrap: bootstrap.bootstrapRoot,
+      warrant: adopterDeliveryGateDigest(warrant),
+    },
+    instanceManifest,
+    instanceReport,
+    gateResult,
+    bootstrap,
+    qualifying: false,
+    selfCertified: false,
+    releaseAuthorized: false,
+    finalAuthority:
+      "protected-n-minus-one-runtime-plus-exact-delivery-evidence",
+  };
+  result.selfDogfoodRoot = adopterDeliveryGateDigest(result);
+  return result;
+}
+
+export async function createPublishedBuildchainDeliveryInfrastructureSelfDogfood({
+  authorityPackages,
+  selfDogfood,
+} = {}) {
+  return withPublishedBuildchainDeliveryAuthority(
+    authorityPackages,
+    async ({ packages, authorityRuntime, authorityRoot }) => {
+      const result = createBuildchainDeliveryInfrastructureSelfDogfood(
+        {
+          ...structuredClone(selfDogfood ?? {}),
+          authorityPackage: packages.buildchain,
+          kfdPackage: packages.kfd,
+        },
+        authorityRuntime,
+      );
+      return {
+        ...result,
+        publishedAuthorityRoot: authorityRoot,
+      };
+    },
+  );
+}
+
+export async function createPublishedBuildchainDeliveryInfrastructureCandidateSelfDogfood({
+  authorityPackages,
+  authoritySourceCommit,
+  candidatePackage,
+  warrantCandidate,
+  source,
+  release,
+  verifiedAt,
+  maxAgeSeconds = 86400,
+} = {}) {
+  if (!SHA_PATTERN.test(authoritySourceCommit ?? "")) {
+    throw new TypeError("authority source commit is invalid");
+  }
+  const artifact = exactPackage(candidatePackage, {
+    name: BUILDCHAIN_PACKAGE,
+    label: "Buildchain candidate",
+  });
+  if (
+    source?.coordinate !==
+      `kungfu-systems/buildchain@${warrantCandidate?.sourceHead ?? ""}` ||
+    !ROOT_PATTERN.test(source?.root ?? "") ||
+    !ROOT_PATTERN.test(release?.root ?? "")
+  ) {
+    throw new TypeError("candidate source or release binding is incomplete");
+  }
+  const warrant = candidateWarrant(warrantCandidate);
+  const cut = deliveryCut();
+  const authority = {
+    version: authorityPackages?.buildchain?.version,
+    sourceCommit: authoritySourceCommit,
+    packageRoot: authorityPackages?.buildchain?.artifactRoot,
+    ...cut,
+    protected: true,
+    published: true,
+  };
+  const candidate = {
+    version: artifact.version,
+    sourceCommit: warrant.sourceHead,
+    packageRoot: artifact.artifactRoot,
+    ...cut,
+    authorityVersion: authority.version,
+  };
+  const adopterManifest = initAdopterManifest({
+    manifestId: `buildchain-delivery-infrastructure-${artifact.version}`,
+    adopterId: "kungfu-systems/buildchain",
+    artifactKind: "package",
+    artifactCoordinate: `${artifact.name}@${artifact.version}`,
+    artifactRoot: artifact.artifactRoot,
+    scope: "Buildchain delivery infrastructure release candidate self-dogfood",
+    packageArtifactRoot: authorityPackages?.kfd?.artifactRoot,
+    verifiedAt,
+    maxAgeSeconds,
+  });
+  adopterManifest.releaseBindings.push({
+    id: `buildchain-${artifact.version}`,
+    artifact: {
+      kind: "package",
+      coordinate: `${artifact.name}@${artifact.version}`,
+      root: artifact.artifactRoot,
+    },
+    releasePassport: structuredClone(release),
+    kfdPackageRoot: authorityPackages.kfd.artifactRoot,
+  });
+  const evidence = candidateEvidence({
+    source,
+    artifact: adopterManifest.releaseBindings[0].artifact,
+    authority,
+    warrant,
+    kfdRoot: authorityPackages.kfd.artifactRoot,
+    observedAt: verifiedAt,
+  });
+  const result =
+    await createPublishedBuildchainDeliveryInfrastructureSelfDogfood({
+      authorityPackages,
+      selfDogfood: {
+        authority,
+        candidate,
+        instanceId: `kungfu-systems/buildchain@${artifact.version}`,
+        adopterManifest,
+        source,
+        artifact: adopterManifest.releaseBindings[0].artifact,
+        release,
+        evidence,
+        warrant,
+        verifiedAt,
+        maxAgeSeconds,
+      },
+    });
+  return { ...result, adopterManifest, deliveryEvidence: evidence };
+}

package/packages/core/channel-candidate.js

@@ -97,6 +97,14 @@ export function decideChannelCandidate(input) {
   const sourceSha = sha(input.sourceSha, "sourceSha");
   const targetSha = sha(input.targetSha, "targetSha");
   const selection = normalizeChannelCandidateSelection(input.selection);
+  if (
+    selection?.versionReservation &&
+    selection.versionReservation.candidateSha !== sourceSha
+  ) {
+    throw new Error(
+      "selection version reservation must bind the selected source SHA",
+    );
+  }
   const now = required(input.now || new Date().toISOString(), "now");
   const maxAgeSeconds = Number(input.maxAgeSeconds ?? 7 * 24 * 60 * 60);
   if (!Number.isSafeInteger(maxAgeSeconds) || maxAgeSeconds <= 0) {

package/packages/core/channel-promotion-baseline.js

@@ -1,5 +1,10 @@
 // SPDX-License-Identifier: Apache-2.0
 
+import {
+  nextDevelopmentPatrolContext,
+  normalizeNextDevelopmentVersionReservation,
+} from "./next-development-candidate-reservation.js";
+
 const SHA = /^[0-9a-f]{40}$/;
 
 function text(value = "") {
@@ -59,6 +64,18 @@ export function normalizeChannelCandidateSelection(input) {
           ),
         }
       : {}),
+    ...(input.versionReservation
+      ? {
+          versionReservation: normalizeNextDevelopmentVersionReservation(
+            input.versionReservation,
+            {
+              reservationSha: input.versionReservation.reservationSha,
+              candidateSha: input.versionReservation.candidateSha,
+              targetVersion: input.versionReservation.targetVersion,
+            },
+          ),
+        }
+      : {}),
   };
 }
 
@@ -117,6 +134,7 @@ export async function resolvePatrolSourceInputs({
   let comparison = headComparison;
   let workflowEvidence = [];
   let skippedNewerCommitCount = 0;
+  let versionReservation;
   let qualificationError;
   if (
     headComparison.status === "ahead" &&
@@ -130,6 +148,8 @@ export async function resolvePatrolSourceInputs({
       ),
     ]);
     try {
+      const { preparations, ignoredSourceShas } =
+        nextDevelopmentPatrolContext(sourceHistory);
       const selected = selectQualifiedSource({
         sourceHistory,
         workflowRunsByPath: new Map(
@@ -141,8 +161,42 @@ export async function resolvePatrolSourceInputs({
         requiredWorkflowPaths,
         now: options.now,
         maxAgeSeconds: options.maxAgeSeconds,
+        ignoredSourceShas,
       });
       ({ sourceSha, skippedNewerCommitCount, workflowEvidence } = selected);
+      const selectedIndex = sourceHistory.findIndex(
+        (entry) =>
+          (typeof entry === "string" ? entry : entry?.sha) === sourceSha,
+      );
+      const reservation = preparations.find(
+        ({ index }) => index > selectedIndex,
+      )?.preparation;
+      if (reservation) {
+        if (
+          typeof client.readNextDevelopmentVersionReservation !== "function"
+        ) {
+          throw new Error(
+            "candidate follows next-development preparation but reservation readback is unavailable",
+          );
+        }
+        versionReservation = normalizeNextDevelopmentVersionReservation(
+          await client.readNextDevelopmentVersionReservation({
+            reservationSha: reservation.sha,
+            candidateSha: sourceSha,
+            targetVersion: reservation.targetVersion,
+          }),
+          {
+            reservationSha: reservation.sha,
+            candidateSha: sourceSha,
+            targetVersion: reservation.targetVersion,
+          },
+        );
+        if (versionReservation.status !== "current") {
+          throw new Error(
+            `next-development version reservation is ${versionReservation.status} for candidate ${sourceSha}`,
+          );
+        }
+      }
       if (sourceSha !== observedSourceHeadSha)
         comparison = await client.compare(boundarySha, sourceSha);
     } catch (error) {
@@ -158,6 +212,7 @@ export async function resolvePatrolSourceInputs({
     comparison,
     workflowEvidence,
     skippedNewerCommitCount,
+    versionReservation,
     qualificationError,
   };
 }

package/packages/core/dev-alpha-candidate-selection.js

@@ -82,7 +82,9 @@ export function selectLatestQualifiedSource({
   requiredWorkflowPaths,
   now,
   maxAgeSeconds,
+  ignoredSourceShas = [],
 }) {
+  const ignored = new Set(ignoredSourceShas);
   const latestByPath = new Map(
     requiredWorkflowPaths.map((workflow) => [
       workflow,
@@ -90,7 +92,11 @@ export function selectLatestQualifiedSource({
     ]),
   );
   for (let index = 0; index < sourceHistory.length; index += 1) {
-    const sourceSha = sourceHistory[index];
+    const sourceSha =
+      typeof sourceHistory[index] === "string"
+        ? sourceHistory[index]
+        : sourceHistory[index]?.sha;
+    if (ignored.has(sourceSha)) continue;
     const rows = requiredWorkflowPaths.map((workflow) =>
       latestByPath.get(workflow).get(sourceSha),
     );
@@ -115,7 +121,9 @@ export function selectLatestQualifiedSource({
       };
     }
   }
-  const staleSuccessfulPair = sourceHistory.some((sourceSha) => {
+  const staleSuccessfulPair = sourceHistory.some((entry) => {
+    const sourceSha = typeof entry === "string" ? entry : entry?.sha;
+    if (ignored.has(sourceSha)) return false;
     const rows = requiredWorkflowPaths.map((workflow) =>
       latestByPath.get(workflow).get(sourceSha),
     );

package/packages/core/dev-delivery-execution-transfer.js

@@ -13,6 +13,7 @@ import {
   devDeliveryText as text,
   devDeliveryTimestamp as timestamp,
 } from "./dev-delivery-common.js";
+import { verifyNativeProofReuseDecision } from "./dev-delivery-native-proof.js";
 import { verifyNativeQualificationProof } from "./dev-delivery-native-proof.js";
 import { verifyNativeExecutionFailureOutcome } from "./dev-delivery-execution-failure.js";
 
@@ -408,8 +409,28 @@ function verifySuccessOutcome(transfer, directory, warrant) {
     "native proof reuse decision root",
   );
   delete decisionBody.decisionRoot;
+  const reuseVerification = verifyNativeProofReuseDecision(decision, {
+    proof,
+    current: {
+      sourceHead: warrant.sourceHead,
+      sourceIdentityRoot: warrant.sourceIdentityRoot,
+      sourcePatchRoot: warrant.sourcePatchRoot,
+      planRoot: warrant.planRoot,
+      closureRoot: warrant.closureRoot,
+      dependencyRoot: warrant.dependencyRoot,
+      toolchainRoot: warrant.toolchainRoot,
+      environmentRoot: warrant.environmentRoot,
+      nativeCommandRoot: warrant.nativeCommandContract?.commandRoot,
+      currentBase: decision.currentBase,
+      graphKnown: decision.graphKnown,
+      attributionComplete: decision.attributionComplete,
+      changedPaths: decision.changedPaths,
+      renames: decision.renames,
+    },
+  });
   if (
     !proofVerification.ok ||
+    !reuseVerification.ok ||
     result.nativeProofRoot !== transfer.nativeProofRoot ||
     proof.proofRoot !== transfer.nativeProofRoot ||
     result.nativeReuseDecisionRoot !== transfer.nativeReuseDecisionRoot ||
@@ -420,7 +441,6 @@ function verifySuccessOutcome(transfer, directory, warrant) {
     proof.repository !== transfer.warrant.repository ||
     proof.protectedBase !== transfer.warrant.protectedBase ||
     proof.sourceHead !== transfer.warrant.sourceHead ||
-    proof.qualifiedBase !== warrant.qualifiedBase ||
     proof.sourceIdentityRoot !== warrant.sourceIdentityRoot ||
     proof.sourcePatchRoot !== warrant.sourcePatchRoot ||
     proof.planRoot !== warrant.planRoot ||

package/packages/core/dev-delivery-process-boundary.js

@@ -30,7 +30,7 @@ const PROVIDER_CREDENTIAL_NAME =
   /(?:^(?:ACTIONS_ID_TOKEN_REQUEST_TOKEN|ACTIONS_RUNTIME_TOKEN|AWS_SESSION_TOKEN|AWS_WEB_IDENTITY_TOKEN_FILE|AZURE_FEDERATED_TOKEN_FILE|GH_TOKEN|GITHUB_TOKEN|GOOGLE_GHA_CREDS_PATH|KUNGFU_GITHUB_TOKEN|NPM_TOKEN|SSH_AUTH_SOCK)$|(?:^|_)(?:(?:api|access|auth|publish|release|provider|promotion|governance|approval|mutation|write)_?(?:key|token)|authorization|credentials?|password|secret|private_key|client_secret|signing_key)(?:_|$))/iu;
 const HOSTED_RUNNER_BOUNDARY = "github-actions-runner-worker/v1";
 const GITHUB_HOSTED_LINUX_WORKER =
-  /^\/home\/runner\/runners\/(\d+\.\d+\.\d+)\/bin\/Runner\.Worker$/u;
+  /^\/home\/runner\/(?:runners|actions-runner\/cached)\/(\d+\.\d+\.\d+)\/bin\/Runner\.Worker$/u;
 function text(value, label) {
   const normalized = normalizedText(value);
   if (!normalized) throw new Error(`${label} is required`);
@@ -61,10 +61,16 @@ function processCredentialNames(procRoot, pid, readFileSync) {
     .split("\0")
     .filter((entry) => {
       const separator = entry.indexOf("=");
+      const name = entry.slice(0, separator);
+      const value = entry.slice(separator + 1);
       return (
         separator > 0 &&
-        Boolean(entry.slice(separator + 1)) &&
-        isCredentialVariableName(entry.slice(0, separator))
+        Boolean(value) &&
+        !(
+          name === "BUILDCHAIN_CREDENTIAL_ANCESTRY_BOUNDARY" &&
+          value === HOSTED_RUNNER_BOUNDARY
+        ) &&
+        isCredentialVariableName(name)
       );
     })
     .map((entry) => entry.slice(0, entry.indexOf("=")));
@@ -108,9 +114,11 @@ function hostedBoundary(procRoot, pid, command, readlinkSync) {
   const executable = ancestryRead(readlinkSync, link);
   if (
     !GITHUB_HOSTED_LINUX_WORKER.test(executable) ||
-    !new Set([executable, path.posix.basename(executable)]).has(command[0])
+    path.posix.basename(command[0]) !== path.posix.basename(executable)
   ) {
-    throw new Error("credential ancestry found an untrusted Runner.Worker");
+    throw new Error(
+      `credential ancestry found an untrusted Runner.Worker: executable=${JSON.stringify(executable)} argv0=${JSON.stringify(command[0])}`,
+    );
   }
   return { pid, kind: HOSTED_RUNNER_BOUNDARY, executable };
 }
@@ -163,7 +171,11 @@ export function assertCredentiallessProcessAncestry(options = {}) {
   return inspection;
 }
 
-export function devDeliveryProviderJobByName(jobs, expectedName) {
+export function devDeliveryProviderJobByName(
+  jobs,
+  expectedName,
+  { allowMissing = false } = {},
+) {
   const exactName = text(expectedName, "provider job name");
   const suffix = ` / ${exactName}`;
   const matches = jobs.filter((job) => {
@@ -173,6 +185,7 @@ export function devDeliveryProviderJobByName(jobs, expectedName) {
       (actualName.endsWith(suffix) && actualName.length > suffix.length)
     );
   });
+  if (matches.length === 0 && allowMissing) return null;
   if (matches.length !== 1) {
     throw new Error(`expected exactly one provider job named ${exactName}`);
   }

package/packages/core/dev-delivery-provider-heartbeat.js

@@ -13,7 +13,7 @@ export const DEV_DELIVERY_PROVIDER_HEARTBEAT_SCHEMA =
   "kungfu.buildchain.provider-heartbeat-receipt/v1";
 
 function selectedWarrant(result = {}) {
-  return result.observation?.activeWarrant || result.warrant || null;
+  return result.warrant || result.observation?.activeWarrant || null;
 }
 
 function exactWarrant(input = {}) {
@@ -40,8 +40,9 @@ function exactWarrant(input = {}) {
   };
 }
 
-function job(entries, name) {
-  const entry = devDeliveryProviderJobByName(entries, name);
+function job(entries, name, options) {
+  const entry = devDeliveryProviderJobByName(entries, name, options);
+  if (!entry) return null;
   const providerJob = {
     id: positiveInteger(entry.id, `${name} job id`),
     name,
@@ -66,13 +67,16 @@ function job(entries, name) {
   return providerJob;
 }
 
-function providerJobs(input, expected) {
+function providerJobs(input, expected, { allowMissingSeal = false } = {}) {
   const entries = Array.isArray(input) ? input : input?.jobs;
   if (!Array.isArray(entries)) {
     throw new Error("provider heartbeat jobs readback must contain jobs");
   }
   const native = job(entries, expected.nativeJobName);
-  const seal = job(entries, expected.sealJobName);
+  const seal = job(entries, expected.sealJobName, {
+    allowMissing: allowMissingSeal,
+  });
+  if (!seal) return null;
   if (native.id === seal.id) {
     throw new Error("provider heartbeat native and seal jobs must be distinct");
   }
@@ -206,7 +210,15 @@ export async function runDevDeliveryProviderHeartbeat(
       const entry = heartbeatEntry(result, previousStateRoot);
       heartbeats.push(entry);
       previousStateRoot = entry.nextStateRoot;
-      jobs = providerJobs(await readJobs(), { nativeJobName, sealJobName });
+      jobs = providerJobs(
+        await readJobs(),
+        { nativeJobName, sealJobName },
+        { allowMissingSeal: true },
+      );
+      if (!jobs) {
+        await wait(cadence * 1000);
+        continue;
+      }
       if (terminal(jobs.native) && terminal(jobs.seal)) break;
       await wait(cadence * 1000);
     }