@kungfu-tech/buildchain 4.0.1-alpha.5 → 4.0.1-alpha.8

package/architecture/v4-publication-rehearsal-parity.json

@@ -0,0 +1,84 @@
+{
+  "schema": "buildchain.v4.publication-rehearsal-parity/v1",
+  "source": {
+    "branch": "dev/v3/v3.0",
+    "commit": "6b96bdad8d9f8ccf9275f27d9370a226a9c78465",
+    "runtime": "packages/core/publication-rehearsal-runtime.js"
+  },
+  "target": {
+    "branch": "dev/v4/v4.0",
+    "commit": "bc12cd0ff18a7e1d918777ea093c169349952d34",
+    "capsuleContract": "packages/core/v4-publication-rehearsal-capsule.js",
+    "runtime": "packages/core/v4-publication-rehearsal.js",
+    "providerBindings": "packages/core/v4-publication-rehearsal-provider-bindings.js"
+  },
+  "sharedProductionCore": {
+    "planner": "compileReleaseTailDeclaration",
+    "initializer": "createReleaseTailTransaction",
+    "executor": "executeReleaseTailTransaction",
+    "version": "buildchain.release-tail/v1"
+  },
+  "stageCapsuleBoundary": {
+    "contract": "buildchain-v4-stage-capsule/v1",
+    "purpose": "pure platform-stage build checkpoint reuse",
+    "publicationEffects": false,
+    "publicationAuthority": false
+  },
+  "matrix": [
+    {
+      "invariant": "capsule-purpose",
+      "v3": "publication rehearsal",
+      "v4": "publication rehearsal distinct from Stage Capsule",
+      "parity": "safety-strengthened"
+    },
+    {
+      "invariant": "content-addressed-inputs",
+      "v3": "capsule, declaration, transaction, files, data-only provider bindings, policy and observations",
+      "v4": "capsule, source, candidate, manifest, config, provider bindings, provider policy, expected observations and core version",
+      "parity": "safety-strengthened"
+    },
+    {
+      "invariant": "provider-request-binding",
+      "v3": "provider binding payload is capsule-rooted and every input path is in files",
+      "v4": "providerBindingsRoot covers canonical bindings and every request byte is inventory-rooted before adapters",
+      "parity": "exact"
+    },
+    {
+      "invariant": "shared-release-tail-core",
+      "v3": "shared planner and executor",
+      "v4": "same production planner, initializer and executor",
+      "parity": "exact"
+    },
+    {
+      "invariant": "effect-default",
+      "v3": "simulate and replay local defaults",
+      "v4": "provider policy is rooted and effect-disabled by default",
+      "parity": "safety-strengthened"
+    },
+    {
+      "invariant": "authorized-provider-rehearsal",
+      "v3": "provider observations are recorded without authority",
+      "v4": "exact capsule-bound rehearsal-only authority plus request and readback transcript",
+      "parity": "safety-strengthened"
+    },
+    {
+      "invariant": "release-authority",
+      "v3": "externalPublicationClaimed false",
+      "v4": "productionAuthority false and releasePassport null",
+      "parity": "exact"
+    },
+    {
+      "invariant": "tamper-response",
+      "v3": "capsule and file mismatch fail closed",
+      "v4": "every named identity root and core version mismatch fails closed",
+      "parity": "safety-strengthened"
+    },
+    {
+      "invariant": "portability",
+      "v3": "platform-independent local capsule root",
+      "v4": "byte-identical offline linux, macos and windows vector",
+      "parity": "exact"
+    }
+  ],
+  "matrixRoot": "sha256:521694ce2cc1d5b383eaa6b84f1b6926ef8ce8f33085e02507e611e9f9b6e784"
+}

package/bin/buildchain.mjs

@@ -111,6 +111,7 @@ import {
 } from "./internal/trust-release-cli.mjs";
 import { dispatchRegisteredCommand } from "./internal/command-registry.mjs";
 import { runCompatibilityFactsCli } from "./internal/compatibility-facts-cli.mjs";
+import { runAdopterDeliveryCli } from "./internal/adopter-delivery-cli.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const embeddedPackageVersion = process.env.BUILDCHAIN_EMBEDDED_PACKAGE_VERSION || "";
@@ -1675,7 +1676,7 @@ async function handleReleaseGovernanceCommand(args) {
 }
 
 async function handleReleaseTailCommand(args) {
-  runReleaseTailCli(args);
+  await runReleaseTailCli(args);
 }
 
 async function handleTailResealCommand(args) {
@@ -1750,6 +1751,10 @@ async function handleArchitectureCommand(args) {
   runScript("v4-architecture.mjs", args);
 }
 
+async function handleAdopterDeliveryCommand(args) {
+  await runAdopterDeliveryCli(args);
+}
+
 const BUILDCHAIN_COMMAND_HANDLERS = Object.freeze({
   "help": handleHelpCommand,
   "version": handleVersionCommand,
@@ -1790,6 +1795,7 @@ const BUILDCHAIN_COMMAND_HANDLERS = Object.freeze({
   "build-contract": handleBuildContractCommand,
   "publish-source": handlePublishSourceCommand,
   "architecture": handleArchitectureCommand,
+  "adopter-delivery": handleAdopterDeliveryCommand,
 });
 
 async function main(argv = process.argv.slice(2)) {

package/bin/internal/adopter-delivery-cli.mjs

@@ -0,0 +1,70 @@
+import {
+  loadV4PublishedAdopterDeliveryAuthority,
+  qualifyV4AdopterDeliveryBootstrap,
+  runV4AdopterDeliveryGate,
+  verifyV4AdopterDeliveryReadback,
+} from "../../packages/core/v4-adopter-delivery.js";
+import {
+  printJson,
+  readFlag,
+  readJsonInput,
+  writeJsonFile,
+} from "./cli-options.mjs";
+
+function emit(args, value) {
+  writeJsonFile(readFlag(args, "output", ""), value);
+  printJson(value);
+}
+
+export async function runAdopterDeliveryCli(args = []) {
+  const [subcommand = "", ...commandArgs] = args;
+  if (subcommand === "run") {
+    const input = readJsonInput(readFlag(commandArgs, "input", ""), {
+      label: "adopter delivery input",
+    });
+    emit(commandArgs, runV4AdopterDeliveryGate(input));
+    return;
+  }
+  if (subcommand === "verify") {
+    const input = readJsonInput(readFlag(commandArgs, "input", ""), {
+      label: "adopter delivery input",
+    });
+    const readback = readJsonInput(readFlag(commandArgs, "readback", ""), {
+      label: "adopter delivery readback",
+    });
+    emit(commandArgs, verifyV4AdopterDeliveryReadback({ input, readback }));
+    return;
+  }
+  if (subcommand === "bootstrap") {
+    const request = readJsonInput(readFlag(commandArgs, "input", ""), {
+      label: "adopter delivery bootstrap input",
+    });
+    emit(commandArgs, qualifyV4AdopterDeliveryBootstrap(request));
+    return;
+  }
+  if (subcommand === "archive") {
+    const request = readJsonInput(readFlag(commandArgs, "input", ""), {
+      label: "published archive input",
+    });
+    const authority = await loadV4PublishedAdopterDeliveryAuthority(request);
+    try {
+      emit(commandArgs, {
+        schemaVersion: authority.schemaVersion,
+        contract: authority.contract,
+        packages: authority.packages,
+        moduleCoordinates: authority.moduleCoordinates,
+        authorityRoot: authority.authorityRoot,
+        qualifying: authority.qualifying,
+        selfCertified: authority.selfCertified,
+        releaseAuthorized: authority.releaseAuthorized,
+        finalAuthority: authority.finalAuthority,
+      });
+    } finally {
+      await authority.dispose();
+    }
+    return;
+  }
+  throw new Error(
+    "usage: buildchain adopter-delivery <run|verify|bootstrap|archive> --input <json-or-path> [--readback <json-or-path>] [--output <path>]",
+  );
+}

package/bin/internal/command-registry.mjs

@@ -41,6 +41,7 @@ const BUILDCHAIN_COMMAND_REGISTRY = Object.freeze([
   { id: "build-contract", aliases: [] },
   { id: "publish-source", aliases: [] },
   { id: "architecture", aliases: [] },
+  { id: "adopter-delivery", aliases: [] },
 ]);
 
 function buildCommandLookup(registry = BUILDCHAIN_COMMAND_REGISTRY) {

package/contracts/fixtures/v4-adopter-delivery-v1/archive-template.json

@@ -0,0 +1,19 @@
+{
+  "packages": {
+    "buildchain": {
+      "name": "@kungfu-tech/buildchain",
+      "version": "3.0.9-alpha.16",
+      "archivePath": ".buildchain/adopter-delivery-archives/kungfu-tech-buildchain-3.0.9-alpha.16.tgz",
+      "archiveRoot": "sha256:3f425e2c77d11f0bee8eb9aa2448566bca7a9d14672a7e528ced3e505b3f14a3",
+      "artifactRoot": "sha256:3f425e2c77d11f0bee8eb9aa2448566bca7a9d14672a7e528ced3e505b3f14a3"
+    },
+    "kfd": {
+      "name": "@kungfu-tech/kfd",
+      "version": "1.0.0-alpha.65",
+      "archivePath": ".buildchain/adopter-delivery-archives/kungfu-tech-kfd-1.0.0-alpha.65.tgz",
+      "archiveRoot": "sha256:c4dbd3f954910236d7f0823ea6887f4151e43b871df526ccdd599123421bced2",
+      "artifactRoot": "sha256:c0781bcaf191a58561ae32ee2fbedabbb48ed50b5725c356fbd83704089637f8"
+    }
+  },
+  "expectedAuthorityRoot": "sha256:9ba0cc6042b189ce749d01003617b57bcd03ea6ecf40e96d19e8ecbbfa347134"
+}

package/contracts/fixtures/v4-adopter-delivery-v1/bootstrap-positive.json

@@ -0,0 +1,93 @@
+{
+  "input": {
+    "authority": {
+      "version": "3.0.9-alpha.16",
+      "sourceCommit": "6b96bdad8d9f8ccf9275f27d9370a226a9c78465",
+      "packageRoot": "sha256:3f425e2c77d11f0bee8eb9aa2448566bca7a9d14672a7e528ced3e505b3f14a3",
+      "gateRoot": "sha256:cdcb54ea103fe62a94e2f0755fab5b105802f32e569f47e77d7a1f3ff0636cfc",
+      "protocol": {
+        "id": "buildchain.adopter/json-assertion",
+        "version": "1.0.0",
+        "root": "sha256:bcc9fc43402c50e11c68dfec5bba63ecc5b10f2f304921dec2ba95b44c43ad13"
+      },
+      "profile": {
+        "id": "buildchain.adopter/delivery-infrastructure",
+        "version": "1.0.0",
+        "root": "sha256:94dc2f34f76be8f4627fb84b753ad855492555111b37cbf3edcee68e2f30e126"
+      },
+      "protected": true,
+      "published": true
+    },
+    "candidate": {
+      "version": "4.0.1-alpha.4",
+      "sourceCommit": "e0342713c7447960c13bd73377282b2e93f4853d",
+      "packageRoot": "sha256:ca25e78191aedb60e999a12100b52caa2b075e29a46f0baa91722f018adb6609",
+      "gateRoot": "sha256:cdcb54ea103fe62a94e2f0755fab5b105802f32e569f47e77d7a1f3ff0636cfc",
+      "protocol": {
+        "id": "buildchain.adopter/json-assertion",
+        "version": "1.0.0",
+        "root": "sha256:bcc9fc43402c50e11c68dfec5bba63ecc5b10f2f304921dec2ba95b44c43ad13"
+      },
+      "profile": {
+        "id": "buildchain.adopter/delivery-infrastructure",
+        "version": "1.0.0",
+        "root": "sha256:94dc2f34f76be8f4627fb84b753ad855492555111b37cbf3edcee68e2f30e126"
+      },
+      "authorityVersion": "3.0.9-alpha.16"
+    },
+    "gateResult": {
+      "schemaVersion": 1,
+      "contract": "kungfu-buildchain-adopter-delivery-result",
+      "status": "passed",
+      "qualifying": false,
+      "selfCertified": false,
+      "project": {
+        "instanceId": "kungfu-systems/buildchain@4.0.1-alpha.4",
+        "adopterId": "kungfu-systems/buildchain"
+      },
+      "artifact": {
+        "kind": "package",
+        "coordinate": "@kungfu-tech/buildchain@4.0.1-alpha.4",
+        "root": "sha256:ca25e78191aedb60e999a12100b52caa2b075e29a46f0baa91722f018adb6609"
+      },
+      "protocol": {
+        "id": "buildchain.adopter/json-assertion",
+        "version": "1.0.0",
+        "loaded": true,
+        "reportRoot": "sha256:01b903f7315a51d0d26d8759194a82d7d45d0d05ad10480dbb6ebf7398445d5c"
+      },
+      "artifactProfile": {
+        "id": "buildchain.artifact/package",
+        "version": "1.0.0",
+        "loaded": true,
+        "valid": true
+      },
+      "semanticReport": {
+        "valid": true,
+        "qualifying": false,
+        "selfCertified": false,
+        "releaseAuthorized": false
+      },
+      "nonClaims": [
+        "A passing delivery gate does not grant runtime permission, release authorization, or independent certification.",
+        "Protocol semantics remain owned by the selected protocol driver and its published authority."
+      ],
+      "issues": [],
+      "gateRoot": "sha256:8f74b438d1b581c02704d3ff677b2be4dcb5a6d0dc4d9435ef42a368ff834ceb"
+    },
+    "warrant": {
+      "outcome": "merged",
+      "sourceHead": "e0342713c7447960c13bd73377282b2e93f4853d",
+      "sourceProofRoot": "sha256:2aeeaacaa4f2d136155ac2c478a7939772a162c284a3bfd0458dfb00cce872aa",
+      "nativeProofRoot": "sha256:d66669fff994b931c9f89f3c313f37ad625f5aae29af0f6528054b8782b607a5",
+      "integrationProofRoot": "sha256:e5623b4de65781d68a73401857d000fba970bdad62a94b5cd7b2d39fee176613"
+    }
+  },
+  "lineage": {
+    "schemaVersion": 1,
+    "contract": "kungfu-buildchain-v4-adopter-delivery-bootstrap-lineage/v1",
+    "sourceAuthorityCommit": "6b96bdad8d9f8ccf9275f27d9370a226a9c78465",
+    "targetBaseCommit": "e0342713c7447960c13bd73377282b2e93f4853d",
+    "authorityArchiveRoot": "sha256:3f425e2c77d11f0bee8eb9aa2448566bca7a9d14672a7e528ced3e505b3f14a3"
+  }
+}

package/contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json

@@ -0,0 +1,29 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-adopter-delivery/v1",
+  "driverSelector": "json-assertion",
+  "artifactProfileSelector": "git-commit",
+  "request": {
+    "schemaVersion": 1,
+    "contract": "kungfu-buildchain-adopter-delivery-request",
+    "protocol": {
+      "id": "buildchain.adopter/json-assertion",
+      "version": "1.0.0"
+    },
+    "artifactProfile": {
+      "id": "buildchain.artifact/git-commit",
+      "version": "1.0.0"
+    },
+    "project": {
+      "instanceId": "example.org/adopter@1.0.0",
+      "adopterId": "example.org/adopter"
+    },
+    "artifact": {
+      "kind": "git-commit",
+      "coordinate": "example.org/adopter@1111111111111111111111111111111111111111",
+      "root": "sha256:2222222222222222222222222222222222222222222222222222222222222222"
+    },
+    "declaration": { "valid": true }
+  },
+  "context": {}
+}

package/contracts/fixtures/v4-adopter-delivery-v1/gate-unknown-selector.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-adopter-delivery/v1",
+  "driverSelector": "private-buildchain-driver",
+  "artifactProfileSelector": "git-commit",
+  "request": {
+    "schemaVersion": 1,
+    "contract": "kungfu-buildchain-adopter-delivery-request",
+    "protocol": { "id": "private.buildchain/driver", "version": "1.0.0" },
+    "artifactProfile": {
+      "id": "buildchain.artifact/git-commit",
+      "version": "1.0.0"
+    },
+    "project": {
+      "instanceId": "example.org/adopter@1.0.0",
+      "adopterId": "example.org/adopter"
+    },
+    "artifact": {
+      "kind": "git-commit",
+      "coordinate": "example.org/adopter@1111111111111111111111111111111111111111",
+      "root": "sha256:2222222222222222222222222222222222222222222222222222222222222222"
+    },
+    "declaration": { "valid": true }
+  },
+  "context": {}
+}

package/contracts/fixtures/v4-adopter-delivery-v1/offline-vectors.json

@@ -0,0 +1,50 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-adopter-delivery-offline-vectors/v1",
+  "sourceAuthority": {
+    "branch": "dev/v3/v3.0",
+    "commit": "6b96bdad8d9f8ccf9275f27d9370a226a9c78465",
+    "vectorSuiteRoot": "sha256:c978707556406ffda4ef4192032332c01c2da1cebb6ad8c4f0edfc65d5cef0c7"
+  },
+  "initialTargetBase": "e5611377efc03178f8687d99968cfdfa3ce2825b",
+  "targetBase": "e0342713c7447960c13bd73377282b2e93f4853d",
+  "cases": [
+    {
+      "id": "positive-public-driver",
+      "class": "positive",
+      "expected": "passed"
+    },
+    {
+      "id": "positive-n-minus-one-bootstrap",
+      "class": "positive",
+      "expected": "passed"
+    },
+    {
+      "id": "positive-published-archive",
+      "class": "positive",
+      "expected": "loaded"
+    },
+    {
+      "id": "negative-selector",
+      "class": "negative",
+      "expected": "fail-closed"
+    },
+    { "id": "negative-driver", "class": "negative", "expected": "fail-closed" },
+    {
+      "id": "negative-archive-identity",
+      "class": "negative",
+      "expected": "fail-closed"
+    },
+    {
+      "id": "negative-bootstrap-lineage",
+      "class": "negative",
+      "expected": "fail-closed"
+    },
+    {
+      "id": "negative-protocol-version",
+      "class": "negative",
+      "expected": "fail-closed"
+    },
+    { "id": "tamper-readback", "class": "tamper", "expected": "fail-closed" }
+  ]
+}

package/contracts/fixtures/v4-publication-rehearsal-v1/candidate/artifacts/product.bin

@@ -0,0 +1 @@
+portable-publication-product

package/contracts/fixtures/v4-publication-rehearsal-v1/candidate/config/buildchain.toml

@@ -0,0 +1,5 @@
+schema = 1
+
+[publication_rehearsal]
+contract = "buildchain-v4-publication-rehearsal-capsule/v1"
+effect_default = "disabled"

package/contracts/fixtures/v4-publication-rehearsal-v1/candidate/documents/release-activation.json

@@ -0,0 +1 @@
+{"schema":"fixture.release-activation/v1","status":"candidate"}

package/contracts/fixtures/v4-publication-rehearsal-v1/candidate/documents/signed-channel.json

@@ -0,0 +1 @@
+{"schema":"fixture.signed-channel/v1","channel":"alpha"}

package/contracts/fixtures/v4-publication-rehearsal-v1/candidate/evidence/qualification.json

@@ -0,0 +1 @@
+{"schema":"fixture.qualification/v1","qualified":true}

package/contracts/fixtures/v4-publication-rehearsal-v1/candidate/manifests/candidate.json

@@ -0,0 +1,5 @@
+{
+  "schema": "buildchain-v4-publication-rehearsal-candidate/v1",
+  "sourceRevision": "bc12cd0ff18a7e1d918777ea093c169349952d34",
+  "purpose": "offline-publication-rehearsal"
+}

package/contracts/fixtures/v4-publication-rehearsal-v1/candidate/manifests/release-passport.json

@@ -0,0 +1 @@
+{"schema":"fixture.release-passport/v1","productionAuthority":false}