@kungfu-tech/buildchain 4.0.1-alpha.5 → 4.0.1-alpha.55

package/scripts/generate-release-candidate-passport.mjs

@@ -5,11 +5,183 @@ import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import { createReleaseCandidatePassport, validateReleaseCandidatePassport } from "../packages/core/release-candidate.js";
 import { scanV4FloatingConsumerPolicy, v4ConsumerPolicyScannerRoot } from "../packages/core/v4-floating-consumer-policy.js";
+import { v4ContentRoot } from "../packages/core/v4-canonical-contracts.js";
+import { V4_STAGE_CAPSULE_CONTRACT, V4_STAGE_CAPSULE_IDENTITY_CONTRACT, v4StageCapsuleIdentityRoot, v4StageCapsuleRoot, validateV4StageCapsule } from "../packages/core/v4-stage-capsule.js";
+import { v4RuntimeResumeDocumentRoot } from "../packages/core/v4-runtime-ref-resume-authority.js";
+import { createV4PublicationQualificationReceipt } from "../packages/core/v4-publication-qualification.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 const env = (name, fallback = "") => process.env[name] || fallback;
 const readJsonFile = (filePath) => JSON.parse(fs.readFileSync(filePath, "utf8"));
 
+export function createReleaseCandidateStageCapsules({
+  passport,
+  buildSummary,
+  coordinates,
+}) {
+  if (!passport.consumerPolicy?.receiptRoot) return undefined;
+  if (
+    coordinates.repository !== passport.repository ||
+    String(coordinates.runId) !== String(passport.workflow.runId) ||
+    String(coordinates.runAttempt) !== String(passport.workflow.runAttempt) ||
+    coordinates.sourceSha !== passport.source.headSha
+  ) {
+    throw new Error(
+      "Stage Capsule coordinate set does not bind the candidate run",
+    );
+  }
+  const coordinateByPlatform = new Map(
+    coordinates.artifacts.map((entry) => [entry.platformId, entry]),
+  );
+  const qualificationArtifacts = passport.platformMatrix.map((platform) => {
+    const coordinate = coordinateByPlatform.get(platform.platformId);
+    if (!coordinate || coordinate.name !== platform.artifactName) throw new Error(`Stage Capsule coordinate missing for ${platform.platformId}`);
+    const manifest = readJsonFile(platform.manifestPath);
+    return { role: platform.artifactName, platform: platform.platformId, artifactRoot: coordinate.digest, manifestRoot: v4ContentRoot("stage-capsule-artifact-manifest", manifest) };
+  });
+  const qualificationExpiresAt = coordinates.artifacts.map((entry) => entry.expiresAt).sort((left, right) => Date.parse(left) - Date.parse(right))[0];
+  const qualificationReceipt = createV4PublicationQualificationReceipt({
+    repository: passport.repository, candidateRoot: `sha256:${passport.candidateHash}`,
+    sourceSha: passport.source.headSha, sourceRoot: v4ContentRoot("candidate-identity", passport.source),
+    policyDigest: passport.consumerPolicy.receiptRoot, artifacts: qualificationArtifacts,
+    issuedAt: passport.createdAt || new Date(Date.parse(qualificationExpiresAt) - 86_400_000).toISOString(), expiresAt: qualificationExpiresAt,
+  });
+  const qualificationRoot = qualificationReceipt.receiptRoot;
+  const entries = passport.platformMatrix
+    .map((platform) => {
+      const coordinate = coordinateByPlatform.get(platform.platformId);
+      if (!coordinate || coordinate.name !== platform.artifactName) {
+        throw new Error(
+          `Stage Capsule coordinate missing for ${platform.platformId}`,
+        );
+      }
+      const manifest = readJsonFile(platform.manifestPath);
+      const identity = {
+        schema: V4_STAGE_CAPSULE_IDENTITY_CONTRACT,
+        sourceRoot: v4ContentRoot("candidate-identity", passport.source),
+        platform: platform.platformId,
+        platformRoot: v4ContentRoot("candidate-identity", manifest.platform),
+        stage: "verify",
+        toolchainRoots: [],
+        runtimeRoot: v4ContentRoot("candidate-identity", {
+          sha: passport.buildchain.sha,
+        }),
+        policyRoot: passport.consumerPolicy.receiptRoot,
+        declaredInputs: [
+          {
+            name: "release-candidate",
+            root: `sha256:${passport.candidateHash}`,
+          },
+        ],
+        transformationRoot: v4ContentRoot("candidate-identity", {
+          lifecycle: manifest.lifecycle,
+          summary: platform.summary,
+        }),
+        outputManifestRoot: v4ContentRoot(
+          "stage-capsule-artifact-manifest",
+          { artifact: coordinate, manifest },
+        ),
+        qualificationRoot,
+        observationRoots: [
+          {
+            name: "provider-coordinate",
+            root: v4ContentRoot("provider-readback-sample", coordinate),
+          },
+        ],
+      };
+      const capsule = {
+        schema: V4_STAGE_CAPSULE_CONTRACT,
+        writerAuthority: "typescript-v3",
+        rustAuthority: "validation-only",
+        identity,
+        identityRoot: v4StageCapsuleIdentityRoot(identity),
+        retentionPromise: {
+          class: "github-artifact",
+          retainUntil: coordinate.expiresAt,
+        },
+        capsuleRoot: `sha256:${"0".repeat(64)}`,
+      };
+      capsule.capsuleRoot = v4StageCapsuleRoot(capsule);
+      validateV4StageCapsule(capsule);
+      return {
+        platform: platform.platformId,
+        artifactName: coordinate.name,
+        artifactDigest: coordinate.digest,
+        publicationArtifact: qualificationArtifacts.find(
+          ({ platform: platformId }) => platformId === platform.platformId,
+        ),
+        artifact: coordinate,
+        capsule,
+      };
+    })
+    .sort((left, right) => left.platform.localeCompare(right.platform));
+  const body = {
+    schemaVersion: 1,
+    contract: "kungfu-buildchain-v4-release-candidate-stage-capsules/v1",
+    status: "sealed",
+    repository: passport.repository,
+    buildAttempt: {
+      id: `github-run:${passport.workflow.runId}:attempt:${passport.workflow.runAttempt}`,
+      runtimeSha: passport.buildchain.sha,
+    },
+    source: {
+      sha: passport.source.headSha,
+      treeSha: passport.source.treeHash,
+    },
+    consumerPolicyReceiptRoot: passport.consumerPolicy.receiptRoot,
+    publicationQualificationRoot: qualificationRoot,
+    publicationQualificationReceipt: qualificationReceipt,
+    capsules: entries,
+  };
+  return { ...body, root: v4RuntimeResumeDocumentRoot(body) };
+}
+
+function writeReleaseCandidateStageCapsules({
+  passport,
+  buildSummary,
+  outputPath,
+}) {
+  const coordinatesPath = path.resolve(
+    env(
+      "BUILDCHAIN_ARTIFACT_COORDINATES_PATH",
+      ".buildchain/artifacts/artifact-coordinates.json",
+    ),
+  );
+  if (!fs.existsSync(coordinatesPath)) {
+    if (passport.consumerPolicy?.receiptRoot) {
+      throw new Error(
+        "v4 release candidate Stage Capsules require exact artifact coordinates",
+      );
+    }
+    return { path: "", root: "" };
+  }
+  const stageCapsules = createReleaseCandidateStageCapsules({
+    passport,
+    buildSummary,
+    coordinates: readJsonFile(coordinatesPath),
+  });
+  if (!stageCapsules) return { path: "", root: "" };
+  const stageCapsulesPath = path.join(
+    path.dirname(outputPath),
+    "release-candidate-stage-capsules.json",
+  );
+  fs.writeFileSync(
+    stageCapsulesPath,
+    `${JSON.stringify(stageCapsules, null, 2)}\n`,
+  );
+  const qualificationPath = path.join(path.dirname(outputPath), "release-candidate-publication-qualification.json");
+  fs.writeFileSync(qualificationPath, `${JSON.stringify(stageCapsules.publicationQualificationReceipt, null, 2)}\n`);
+  return {
+    path: path
+      .relative(process.cwd(), stageCapsulesPath)
+      .split(path.sep)
+      .join("/"),
+    root: stageCapsules.root,
+    qualificationPath: path.relative(process.cwd(), qualificationPath).split(path.sep).join("/"),
+    qualificationRoot: stageCapsules.publicationQualificationRoot,
+  };
+}
+
 export function resolveLegacyConsumerPolicyReceipt(options = {}) {
   if (options.json) return { receipt: JSON.parse(options.json), receiptRoot: options.receiptRoot };
   if (options.repository !== "kungfu-systems/buildchain" || options.targetChannel !== "alpha" || options.workflowShellRef !== "v4-alpha" || options.runtimeOverride !== true) return undefined;
@@ -80,6 +252,7 @@ export function generateReleaseCandidatePassportCli() {
   if (!validation.ok) throw new Error(`release candidate passport invalid: ${validation.errors.join("; ")}`);
   fs.mkdirSync(path.dirname(outputPath), { recursive: true });
   fs.writeFileSync(outputPath, `${JSON.stringify(passport, null, 2)}\n`);
+  const stageCapsules = writeReleaseCandidateStageCapsules({ passport, buildSummary, outputPath });
   writeGitHubOutputs({
     "release-candidate-passport-path": path.relative(process.cwd(), outputPath).split(path.sep).join("/"),
     "release-candidate-passport-json": JSON.stringify({
@@ -94,6 +267,10 @@ export function generateReleaseCandidatePassportCli() {
       consumerPolicy: passport.consumerPolicy,
       controllerReceipts: passport.controllerReceipts || [],
     }),
+    "release-candidate-stage-capsules-path": stageCapsules.path,
+    "release-candidate-stage-capsules-root": stageCapsules.root,
+    "release-candidate-publication-qualification-path": stageCapsules.qualificationPath,
+    "release-candidate-publication-qualification-root": stageCapsules.qualificationRoot,
   });
   return passport;
 }

package/scripts/generate-site-bundle.mjs

@@ -54,6 +54,28 @@ const V4_COMPATIBILITY_FACTS_SCHEMA =
   "schemas/v4-compatibility-facts-v1.schema.json";
 const V4_COMPATIBILITY_FACTS_SCHEMA_SOURCE =
   "contracts/v4-compatibility-facts-v1.schema.json";
+const V4_PUBLICATION_REHEARSAL_SCHEMA =
+  "schemas/v4-publication-rehearsal-capsule-v1.schema.json";
+const V4_PUBLICATION_REHEARSAL_SCHEMA_SOURCE =
+  "contracts/v4-publication-rehearsal-capsule-v1.schema.json";
+const V4_ADOPTER_DELIVERY_SCHEMA =
+  "schemas/v4-adopter-delivery-v1.schema.json";
+const V4_ADOPTER_DELIVERY_SCHEMA_SOURCE =
+  "contracts/v4-adopter-delivery-v1.schema.json";
+const RELEASE_TAIL_CAPABILITIES_SCHEMA =
+  "schemas/release-tail-capabilities-v1.schema.json";
+const RELEASE_TAIL_CAPABILITIES_SCHEMA_SOURCE =
+  "contracts/release-tail-capabilities-v1.schema.json";
+const V4_PUBLICATION_QUALIFICATION_SCHEMA =
+  "schemas/v4-publication-qualification-v1.schema.json";
+const V4_PUBLICATION_QUALIFICATION_SCHEMA_SOURCE =
+  "contracts/v4-publication-qualification-v1.schema.json";
+const PUBLICATION_REHEARSAL_SITE_SCHEMAS = [
+  V4_PUBLICATION_REHEARSAL_SCHEMA,
+  V4_ADOPTER_DELIVERY_SCHEMA,
+  RELEASE_TAIL_CAPABILITIES_SCHEMA,
+  V4_PUBLICATION_QUALIFICATION_SCHEMA,
+];
 const root = path.resolve(import.meta.dirname, "..");
 const outputDir = path.join(root, "dist", "site");
 const requireFromHere = createRequire(import.meta.url);
@@ -84,6 +106,10 @@ function stableJson(value) {
 function siteFileBytes(name, value) {
   if (name === DEV_DELIVERY_AUTHORITY_SCHEMA) return readText(DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE);
   if (name === V4_COMPATIBILITY_FACTS_SCHEMA) return readText(V4_COMPATIBILITY_FACTS_SCHEMA_SOURCE);
+  if (name === V4_PUBLICATION_REHEARSAL_SCHEMA) return readText(V4_PUBLICATION_REHEARSAL_SCHEMA_SOURCE);
+  if (name === V4_PUBLICATION_QUALIFICATION_SCHEMA) return readText(V4_PUBLICATION_QUALIFICATION_SCHEMA_SOURCE);
+  if (name === V4_ADOPTER_DELIVERY_SCHEMA) return readText(V4_ADOPTER_DELIVERY_SCHEMA_SOURCE);
+  if (name === RELEASE_TAIL_CAPABILITIES_SCHEMA) return readText(RELEASE_TAIL_CAPABILITIES_SCHEMA_SOURCE);
   return stableJson(value);
 }
 
@@ -396,6 +422,7 @@ const manualMetaById = new Map(Object.entries({
   "observed-evidence-patrol": { capabilityGroup: "governance-versioning", audience: ["release-operator", "consumer", "agent"], maturity: "preview", order: 140 },
   "engineering-housekeeper": { capabilityGroup: "governance-versioning", audience: ["maintainer", "consumer", "agent"], maturity: "preview", order: 145 },
   "reusable-build-surface": { capabilityGroup: "reusable-build", audience: ["consumer", "release-operator"], maturity: "stable", order: 200 },
+  "v4-adopter-delivery": { capabilityGroup: "reusable-build", audience: ["consumer", "developer", "agent"], maturity: "preview", order: 205 },
   "lifecycle-protocol": { capabilityGroup: "reusable-build", audience: ["consumer", "developer"], maturity: "stable", order: 210 },
   "runtime-train-validation": { capabilityGroup: "governance-versioning", audience: ["maintainer", "consumer"], maturity: "stable", order: 220 },
   "kfd-support": { capabilityGroup: "kfd-trust", audience: ["agent", "maintainer"], maturity: "stable", order: 300 },
@@ -956,6 +983,7 @@ function buildSiteBundle() {
       "schemas/kfd-product-gate-input-v1.schema.json",
       "schemas/dev-delivery-authority-v2.schema.json",
       "schemas/v4-compatibility-facts-v1.schema.json",
+      ...PUBLICATION_REHEARSAL_SITE_SCHEMAS,
       "kfd-support.json",
       "artifact-evidence.json",
       "product-mechanism.json",
@@ -992,6 +1020,7 @@ function buildSiteBundle() {
       "schemas/kfd-product-gate-input-v1.schema.json",
       "schemas/dev-delivery-authority-v2.schema.json",
       "schemas/v4-compatibility-facts-v1.schema.json",
+      ...PUBLICATION_REHEARSAL_SITE_SCHEMAS,
       "buildchain-contract.json",
       "kfd-claims.json",
       "product-mechanism.json",
@@ -1124,6 +1153,7 @@ function buildSiteBundle() {
       "schemas/kfd-product-gate-input-v1.schema.json",
       "schemas/dev-delivery-authority-v2.schema.json",
       "schemas/v4-compatibility-facts-v1.schema.json",
+      ...PUBLICATION_REHEARSAL_SITE_SCHEMAS,
       "buildchain-contract.json",
       "kfd-upstream-aggregate.json",
       "kfd-claims.json",
@@ -1304,6 +1334,12 @@ function buildSiteBundle() {
     [V4_COMPATIBILITY_FACTS_SCHEMA]: readJson(
       V4_COMPATIBILITY_FACTS_SCHEMA_SOURCE,
     ),
+    ...Object.fromEntries(
+      PUBLICATION_REHEARSAL_SITE_SCHEMAS.map((name) => [
+        name,
+        JSON.parse(siteFileBytes(name)),
+      ]),
+    ),
     "badge-endpoint-registry.json": badgeEndpointRegistry,
     "publication-registry.json": publicationRegistry,
     "buildchain-contract.json": createBuildchainContractWorld({ root, controllerRegistry }),

package/scripts/maintainability-domain-metrics.mjs

@@ -0,0 +1,237 @@
+import { parseWorkflowDocument } from "../packages/core/workflow-yaml-contract.js";
+
+function lineCount(source) {
+  const text = String(source || "");
+  if (!text) return 0;
+  const lines = text.split(/\r?\n/u);
+  return lines.at(-1) === "" ? lines.length - 1 : lines.length;
+}
+
+function rustTokens(source) {
+  const tokens = [];
+  let index = 0;
+  let line = 1;
+  const advance = () => {
+    if (source[index] === "\n") line += 1;
+    index += 1;
+  };
+  while (index < source.length) {
+    if (/\s/u.test(source[index])) {
+      advance();
+      continue;
+    }
+    if (source.startsWith("//", index)) {
+      while (index < source.length && source[index] !== "\n") advance();
+      continue;
+    }
+    if (source.startsWith("/*", index)) {
+      let depth = 1;
+      advance();
+      advance();
+      while (index < source.length && depth > 0) {
+        if (source.startsWith("/*", index)) {
+          depth += 1;
+          advance();
+          advance();
+        } else if (source.startsWith("*/", index)) {
+          depth -= 1;
+          advance();
+          advance();
+        } else {
+          advance();
+        }
+      }
+      continue;
+    }
+    const raw = source.slice(index).match(/^(?:br|r)(#+)?"/u);
+    if (raw) {
+      const suffix = `"${raw[1] || ""}`;
+      for (let count = 0; count < raw[0].length; count += 1) advance();
+      while (index < source.length && !source.startsWith(suffix, index)) {
+        advance();
+      }
+      for (let count = 0; count < suffix.length; count += 1) advance();
+      continue;
+    }
+    if (source[index] === '"' || source.startsWith('b"', index)) {
+      if (source[index] === "b") advance();
+      advance();
+      while (index < source.length) {
+        if (source[index] === "\\") {
+          advance();
+          if (index < source.length) advance();
+        } else if (source[index] === '"') {
+          advance();
+          break;
+        } else {
+          advance();
+        }
+      }
+      continue;
+    }
+    const character = source.slice(index).match(/^'(?:\\.|[^'\\\n])'/u);
+    if (character) {
+      for (let count = 0; count < character[0].length; count += 1) advance();
+      continue;
+    }
+    const identifier = source.slice(index).match(/^[A-Za-z_][A-Za-z0-9_]*/u);
+    if (identifier) {
+      tokens.push({ value: identifier[0], line });
+      index += identifier[0].length;
+      continue;
+    }
+    const operator = [
+      "=>",
+      "&&",
+      "||",
+      "::",
+      "->",
+      "<=",
+      ">=",
+      "==",
+      "!=",
+    ].find((candidate) => source.startsWith(candidate, index));
+    tokens.push({ value: operator || source[index], line });
+    index += (operator || source[index]).length;
+  }
+  return tokens;
+}
+
+function rustFunctions(tokens) {
+  const functions = [];
+  for (let index = 0; index < tokens.length; index += 1) {
+    if (tokens[index].value !== "fn") continue;
+    const name =
+      tokens[index + 1]?.value || `<anonymous@${tokens[index].line}>`;
+    let body = index + 2;
+    while (body < tokens.length && !["{", ";"].includes(tokens[body].value)) {
+      body += 1;
+    }
+    if (tokens[body]?.value !== "{") continue;
+    let depth = 1;
+    let end = body + 1;
+    while (end < tokens.length && depth > 0) {
+      if (tokens[end].value === "{") depth += 1;
+      if (tokens[end].value === "}") depth -= 1;
+      end += 1;
+    }
+    if (depth !== 0) continue;
+    functions.push({ name, token: index, body, end: end - 1 });
+  }
+  return functions;
+}
+
+function isRustDecision(tokens, index) {
+  const value = tokens[index].value;
+  if (["if", "for", "while", "loop", "?", "=>"].includes(value)) return true;
+  if (!["&&", "||"].includes(value)) return false;
+  return !["=", "(", "{", "[", ",", ";", "return", "move"].includes(
+    tokens[index - 1]?.value,
+  );
+}
+
+function analyzeRust(_file, source) {
+  const tokens = rustTokens(source);
+  const parsed = rustFunctions(tokens);
+  const byStart = new Map(parsed.map((entry) => [entry.token, entry]));
+  const functions = parsed.map((entry) => {
+    let complexity = 1;
+    for (let index = entry.body + 1; index < entry.end; index += 1) {
+      const nested = byStart.get(index);
+      if (nested && nested.end <= entry.end) {
+        index = nested.end;
+        continue;
+      }
+      if (isRustDecision(tokens, index)) complexity += 1;
+    }
+    const start = tokens[entry.token].line;
+    const end = tokens[entry.end].line;
+    return {
+      name: entry.name,
+      start,
+      end,
+      lines: end - start + 1,
+      complexity,
+    };
+  });
+  return {
+    lines: lineCount(source),
+    complexity: functions.reduce((total, entry) => total + entry.complexity, 0),
+    functions,
+  };
+}
+
+function semanticYamlLines(source) {
+  const result = [];
+  let blockIndent = null;
+  for (const [line, raw] of String(source || "")
+    .split(/\r?\n/u)
+    .entries()) {
+    const indent = raw.match(/^(\s*)/u)?.[1].length || 0;
+    if (blockIndent !== null) {
+      if (!raw.trim() || indent > blockIndent) continue;
+      blockIndent = null;
+    }
+    const text = raw.trim();
+    if (!text || text.startsWith("#")) continue;
+    result.push({ line: line + 1, indent, text });
+    if (/:\s*[>|][+-]?\s*(?:#.*)?$/u.test(raw)) blockIndent = indent;
+  }
+  return result;
+}
+
+function analyzeWorkflow(_file, source) {
+  const lines = semanticYamlLines(source);
+  const document = parseWorkflowDocument(source);
+  const jobsEntry = lines.find(
+    (entry) => entry.indent === 0 && entry.text === "jobs:",
+  );
+  const jobs = [];
+  if (jobsEntry) {
+    const candidates = lines.filter(
+      (entry) => entry.line > jobsEntry.line && entry.indent > jobsEntry.indent,
+    );
+    const jobIndent = Math.min(...candidates.map((entry) => entry.indent));
+    for (const entry of candidates) {
+      if (
+        entry.indent === jobIndent &&
+        /^[A-Za-z0-9_.-]+:\s*(?:#.*)?$/u.test(entry.text)
+      ) {
+        jobs.push(entry);
+      }
+    }
+  }
+  const stepsByJob = jobs.map((job, jobIndex) => {
+    const endLine = jobs[jobIndex + 1]?.line || Number.POSITIVE_INFINITY;
+    const stepRoot = lines.find(
+      (entry) =>
+        entry.line > job.line &&
+        entry.line < endLine &&
+        entry.indent > job.indent &&
+        entry.text === "steps:",
+    );
+    if (!stepRoot) return 0;
+    const stepLines = lines.filter(
+      (entry) =>
+        entry.line > stepRoot.line &&
+        entry.line < endLine &&
+        entry.indent > stepRoot.indent,
+    );
+    const stepIndent = Math.min(...stepLines.map((entry) => entry.indent));
+    return stepLines.filter(
+      (entry) => entry.indent === stepIndent && entry.text.startsWith("- "),
+    ).length;
+  });
+  const decisions = lines.filter((entry) =>
+    /^(?:-\s+)?(?:if|matrix):/u.test(entry.text),
+  ).length;
+  return {
+    lines: lineCount(source),
+    jobs: document.jobs.length,
+    steps: stepsByJob.reduce((total, count) => total + count, 0),
+    maxStepsPerJob: Math.max(0, ...stepsByJob),
+    decisions,
+  };
+}
+
+export { analyzeRust, analyzeWorkflow };