@kungfu-tech/buildchain 4.0.1-alpha.5 → 4.0.1-alpha.8

package/packages/core/workflow-yaml-contract.js

@@ -67,8 +67,7 @@ function directEntries(lines, parentLine) {
     const trimmed = line.trim();
     const indent = indentation(line);
     if (trimmed && indent <= parentIndent) break;
-    if (!trimmed || trimmed.startsWith("#") || indent !== childIndent)
-      continue;
+    if (!trimmed || trimmed.startsWith("#") || indent !== childIndent) continue;
     const match = line.match(/^\s*([A-Za-z0-9_.-]+):(?:\s*(.*))?$/);
     if (match) {
       entries.push({
@@ -263,6 +262,28 @@ export function parseWorkflowCallJobs(text) {
     .filter((job) => job.uses);
 }
 
+export function parseWorkflowJobs(text) {
+  const lines = String(text || "").split(/\r?\n/);
+  const jobs = topLevelEntry(lines, "jobs");
+  if (!jobs) return [];
+  return directEntries(lines, jobs.line)
+    .map((job) => {
+      const properties = directEntries(lines, job.line);
+      const property = (name) =>
+        properties.find((entry) => entry.key === name) || null;
+      return {
+        id: job.key,
+        name: unquote(property("name")?.value || job.key),
+        uses: unquote(property("uses")?.value || ""),
+        runsOn: unquote(property("runs-on")?.value || ""),
+        timeoutMinutes: property("timeout-minutes")
+          ? scalar(property("timeout-minutes").value)
+          : null,
+      };
+    })
+    .sort((left, right) => compareCodeUnits(left.id, right.id));
+}
+
 function blockScalarIndent(lines, lineIndex, parentIndent) {
   for (let index = lineIndex + 1; index < lines.length; index += 1) {
     if (!lines[index].trim()) continue;
@@ -315,6 +336,7 @@ export function parseWorkflowDocument(text) {
   return {
     triggers: parseTriggers(String(text || "").split(/\r?\n/)),
     interface: parseReusableWorkflowInterface(text),
+    jobs: parseWorkflowJobs(text),
     callJobs: parseWorkflowCallJobs(text),
   };
 }

package/scripts/buildchain-cli-help.mjs

@@ -8,6 +8,11 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain architecture qualify --authority-revision <git-revision>
                                       [--candidate-revision <git-revision>]
                                       [--cwd <dir>] [--json]
+  buildchain adopter-delivery run --input <json-or-path> [--output <path>]
+  buildchain adopter-delivery verify --input <json-or-path>
+                                      --readback <json-or-path> [--output <path>]
+  buildchain adopter-delivery bootstrap --input <json-or-path> [--output <path>]
+  buildchain adopter-delivery archive --input <json-or-path> [--output <path>]
   buildchain portable-cache plan --manifest <file-or-json> [--output <file>]
                                  [--github-output <file>] [--json]
   buildchain portable-cache receipt --plan <file-or-json> [--matched-key <key>]
@@ -44,6 +49,11 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain release-tail init --declaration <json-or-path> [--state <path>]
   buildchain release-tail <status|verify> [--state <path>] [--output <path>]
   buildchain release-tail compat --hooks-json <json-or-path> [--output <path>]
+  buildchain release-tail rehearse --capsule <absolute-path>
+                                      --candidate-root <absolute-path>
+                                      --mode <simulate|replay>
+                                      --state <absolute-path>
+                                      --evidence <absolute-path>
   buildchain tail-reseal plan --request <request.json> [--output <plan.json>]
   buildchain tail-reseal admit --request <request.json> [--output <admission.json>]
   buildchain tail-reseal verify-platform --request <request.json> --platform <id>

package/scripts/check-ci-lane-change-budget.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { execFileSync } from "node:child_process";
+import { evaluateCiLaneChangeBudget } from "../packages/core/ci-lane-change-budget.js";
+
+const root = process.cwd();
+const workflowRoot = path.join(root, ".github", "workflows");
+const policyPath = path.join(
+  root,
+  "architecture",
+  "ci-lane-change-budget.json",
+);
+
+const workflows = fs
+  .readdirSync(workflowRoot, { withFileTypes: true })
+  .filter((entry) => entry.isFile() && /\.(?:yaml|yml)$/u.test(entry.name))
+  .map((entry) => {
+    const workflowPath = path.posix.join(".github/workflows", entry.name);
+    return {
+      path: workflowPath,
+      text: fs.readFileSync(path.join(workflowRoot, entry.name), "utf8"),
+    };
+  })
+  .sort((left, right) => left.path.localeCompare(right.path));
+
+const policy = JSON.parse(fs.readFileSync(policyPath, "utf8"));
+const baselineRevision = String(policy.baseline?.gitRevision || "").trim();
+if (!/^[0-9a-f]{40}$/u.test(baselineRevision)) {
+  throw new Error("baseline.gitRevision must be an exact Git commit");
+}
+const embeddedBaselineLanes = policy.baseline?.lanes;
+if (
+  !Array.isArray(embeddedBaselineLanes) ||
+  embeddedBaselineLanes.length === 0
+) {
+  throw new Error("baseline.lanes must contain the exact offline lane set");
+}
+const embeddedLaneSetRoot = `sha256:${crypto
+  .createHash("sha256")
+  .update(`${JSON.stringify(embeddedBaselineLanes)}\n`)
+  .digest("hex")}`;
+if (embeddedLaneSetRoot !== policy.baseline?.laneSetRoot) {
+  throw new Error("baseline laneSetRoot does not match baseline.lanes");
+}
+
+let baselineWorkflows = null;
+try {
+  execFileSync("git", ["cat-file", "-e", `${baselineRevision}^{commit}`], {
+    cwd: root,
+    stdio: "ignore",
+  });
+  const baselinePaths = execFileSync(
+    "git",
+    [
+      "ls-tree",
+      "-r",
+      "--name-only",
+      baselineRevision,
+      "--",
+      ".github/workflows",
+    ],
+    { cwd: root, encoding: "utf8" },
+  )
+    .split(/\r?\n/u)
+    .filter((value) => /\.(?:yaml|yml)$/u.test(value))
+    .sort();
+  baselineWorkflows = baselinePaths.map((workflowPath) => ({
+    path: workflowPath,
+    text: execFileSync("git", ["show", `${baselineRevision}:${workflowPath}`], {
+      cwd: root,
+      encoding: "utf8",
+    }),
+  }));
+} catch {
+  // Shallow and exported source cuts may not contain the pinned commit object.
+  // The content-rooted embedded lane set remains the exact offline authority.
+}
+
+const embeddedEvaluation = evaluateCiLaneChangeBudget({
+  policy,
+  workflows,
+});
+const evaluation = baselineWorkflows
+  ? evaluateCiLaneChangeBudget({ policy, workflows, baselineWorkflows })
+  : embeddedEvaluation;
+if (
+  baselineWorkflows &&
+  (evaluation.baselineLaneCount !== embeddedEvaluation.baselineLaneCount ||
+    JSON.stringify(evaluation.newLanes) !==
+      JSON.stringify(embeddedEvaluation.newLanes))
+) {
+  throw new Error(
+    "embedded baseline lanes do not match the pinned baseline revision",
+  );
+}
+process.stdout.write(`${JSON.stringify(evaluation, null, 2)}\n`);
+if (!evaluation.ok) process.exitCode = 1;

package/scripts/check-inventory.mjs

@@ -1021,16 +1021,16 @@ for (const forbiddenSnippet of [
 for (const requiredSnippet of [
   "id-token: write",
   "actions: write",
-  "uses: ./.github/workflows/.release-candidate-promote.yml",
+  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha",
   "github.event.workflow_run.event == 'push'",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
   "resume-candidate-run-id:",
   "resume-expected-source-tree:",
   "resume-buildchain-runtime-sha:",
-  "github-release: true",
+  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4",
   "release-passport-buildchain-self-kfd: true",
-  "artifact-patterns: ${{ startsWith(github.event.workflow_run.head_branch || inputs['target-ref'], 'alpha/') && 'buildchain-package-*' || '' }}",
+  "buildchain-channel: alpha",
   "release-passport-impact-json: .buildchain/release-impact.json",
 ]) {
   if (!buildchainRefPromotionWorkflow.includes(requiredSnippet)) {

package/scripts/check-v4-floating-consumer-policy-contract.mjs

@@ -52,8 +52,13 @@ function assertOrdered(relative, markers) {
 
 export function assertPromotionCertificationWiring(source) {
   for (const marker of [
-    ".buildchain/runtime/promotion-shell/scripts/v4-consumer-policy.mjs certify",
-    '--caller-root "${{ github.workspace }}"',
+    "path: .buildchain/runtime/candidate-policy-runtime",
+    "BUILDCHAIN_EXPECTED_RUNTIME_SHA: ${{ steps.v4-policy-caller.outputs.runtime-sha }}",
+    "policy_runtime=.buildchain/runtime",
+    'node "${policy_runtime}/scripts/v4-consumer-policy.mjs" certify',
+    "passport.consumerPolicy?.receipt?.caller?.sourceSha",
+    "path: .buildchain/runtime/policy-caller",
+    '--caller-root "${{ github.workspace }}/.buildchain/runtime/policy-caller"',
     '--stable-lock "${{ inputs.buildchain-stable-contract-lock-path }}"',
     '--alpha-lock "${{ inputs.buildchain-alpha-contract-lock-path }}"',
     "release-passport-v4-consumer-policy-certification-root: ${{ steps.v4-policy-certification.outputs.v4-consumer-policy-certification-root }}",
@@ -78,13 +83,22 @@ function assertPersistedSelectors() {
       );
       if (!match) continue;
       const selector = match[2];
+      const protectedBootstrap =
+        relative ===
+          ".github/workflows/buildchain-ref-promotion-recovery.yml" &&
+        match[1] === ".github/workflows/.release-candidate-promote.yml" &&
+        selector === "alpha/v4/v4.0";
       const isV4 =
         selector === "v4" ||
         selector === "v4-alpha" ||
         /^v4(?:[./-]|$)/u.test(selector) ||
         /^[0-9a-f]{40}$/iu.test(selector) ||
         selector.includes("${{");
-      if (isV4 && !["v4", "v4-alpha"].includes(selector)) {
+      if (
+        (isV4 || protectedBootstrap) &&
+        !["v4", "v4-alpha"].includes(selector) &&
+        !protectedBootstrap
+      ) {
         offenders.push(`${relative}:${node.line} @${selector}`);
       }
     }
@@ -112,7 +126,12 @@ export function checkV4FloatingConsumerPolicyContract() {
     "Enforce v4 floating consumer policy",
     "Validate consumer package manager contract",
   ]);
-  if (!read(".github/workflows/.build.yml").includes("BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: ${{ inputs.buildchain-expected-channel }}")) fail("channel builds must disambiguate dual-channel caller invocations");
+  if (
+    !read(".github/workflows/.build.yml").includes(
+      "BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: ${{ inputs.buildchain-expected-channel }}",
+    )
+  )
+    fail("channel builds must disambiguate dual-channel caller invocations");
   assertTrustGatedJobs(read(".github/workflows/.build.yml"), [
     "resolve-source",
     "resolve-contract",

package/scripts/dev-delivery-source-proof-replay.mjs

@@ -0,0 +1,153 @@
+import crypto from "node:crypto";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const SHA = /^[0-9a-f]{40}$/u;
+
+function exactSha(value, label) {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (!SHA.test(normalized))
+    throw new Error(`${label} must be an exact 40-hex Git SHA`);
+  return normalized;
+}
+
+function git(args, { cwd, encoding = "utf8" }) {
+  const result = spawnSync("git", args, {
+    cwd,
+    encoding,
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (result.status !== 0)
+    throw new Error(
+      `git ${args.join(" ")} failed: ${String(result.stderr || "").trim()}`,
+    );
+  return encoding === null ? result.stdout : String(result.stdout || "").trim();
+}
+
+function patchRoot(base, head, cwd) {
+  const patch = git(
+    [
+      "diff",
+      "--binary",
+      "--full-index",
+      "--no-ext-diff",
+      `${base}..${head}`,
+    ],
+    { cwd, encoding: null },
+  );
+  return `sha256:${crypto.createHash("sha256").update(patch).digest("hex")}`;
+}
+
+function linearRange(base, head, cwd) {
+  try {
+    git(["merge-base", "--is-ancestor", base, head], { cwd });
+  } catch {
+    return null;
+  }
+  const commits = git(
+    ["rev-list", "--reverse", "--topo-order", `${base}..${head}`],
+    { cwd },
+  )
+    .split(/\s+/u)
+    .filter(Boolean);
+  if (commits.length === 0) return null;
+  let expectedParent = base;
+  const trees = [];
+  const patchRoots = [];
+  for (const rangeCommit of commits) {
+    const [observedCommit, ...parents] = git(
+      ["rev-list", "--parents", "-n", "1", rangeCommit],
+      { cwd },
+    ).split(/\s+/u);
+    if (
+      observedCommit !== rangeCommit ||
+      parents.length !== 1 ||
+      parents[0] !== expectedParent
+    ) {
+      return null;
+    }
+    trees.push(
+      exactSha(
+        git(["rev-parse", `${rangeCommit}^{tree}`], { cwd }),
+        "replayedCommitTree",
+      ),
+    );
+    patchRoots.push(patchRoot(expectedParent, rangeCommit, cwd));
+    expectedParent = rangeCommit;
+  }
+  return { commits, trees, patchRoots };
+}
+
+export function exactMergeGroupBinding(input = {}) {
+  const cwd = path.resolve(input.cwd || process.cwd());
+  const mergeGroupHead = exactSha(input.mergeGroupHead, "mergeGroupHead");
+  const expectedTree = exactSha(input.mergeGroupTree, "mergeGroupTree");
+  const qualifiedBase = exactSha(input.qualifiedBase, "qualifiedBase");
+  const currentBase = exactSha(input.currentBase, "currentBase");
+  const sourceHead = exactSha(input.sourceHead, "sourceHead");
+  const sourcePatchRoot = String(input.sourcePatchRoot || "").trim();
+  const actualTree = exactSha(
+    git(["rev-parse", `${mergeGroupHead}^{tree}`], { cwd }),
+    "mergeGroupTree",
+  );
+  if (actualTree !== expectedTree)
+    return { ok: false, reason: "merge-group-tree-mismatch" };
+  try {
+    git(["merge-base", "--is-ancestor", qualifiedBase, currentBase], { cwd });
+  } catch {
+    return {
+      ok: false,
+      reason: "current-base-not-descendant-of-qualified-base",
+    };
+  }
+  if (!/^sha256:[0-9a-f]{64}$/u.test(sourcePatchRoot))
+    throw new Error("sourcePatchRoot must be an exact SHA-256 root");
+  if (patchRoot(currentBase, mergeGroupHead, cwd) !== sourcePatchRoot)
+    return { ok: false, reason: "merge-group-source-patch-mismatch" };
+
+  const [commit, ...parents] = git(
+    ["rev-list", "--parents", "-n", "1", mergeGroupHead],
+    { cwd },
+  ).split(/\s+/u);
+  if (commit !== mergeGroupHead)
+    return { ok: false, reason: "merge-group-parent-mismatch" };
+  if (
+    parents.length === 2 &&
+    parents[0] === currentBase &&
+    parents[1] === sourceHead
+  ) {
+    return {
+      ok: true,
+      mergeGroupHead,
+      mergeGroupTree: actualTree,
+      parents,
+      compositionMode: "two-parent-merge",
+      replayedCommitTrees: [],
+      replayedCommitPatchRoots: [],
+    };
+  }
+
+  const sourceRange = linearRange(qualifiedBase, sourceHead, cwd);
+  const mergeGroupRange = linearRange(currentBase, mergeGroupHead, cwd);
+  if (
+    !sourceRange ||
+    !mergeGroupRange ||
+    sourceRange.commits.length !== mergeGroupRange.commits.length ||
+    sourceRange.patchRoots.some(
+      (root, index) => root !== mergeGroupRange.patchRoots[index],
+    )
+  ) {
+    return { ok: false, reason: "merge-group-parent-mismatch" };
+  }
+  return {
+    ok: true,
+    mergeGroupHead,
+    mergeGroupTree: actualTree,
+    parents,
+    compositionMode: "linear-replay",
+    replayedCommitTrees: mergeGroupRange.trees,
+    replayedCommitPatchRoots: mergeGroupRange.patchRoots,
+  };
+}

package/scripts/dev-delivery-source-proof-reuse.mjs

@@ -11,6 +11,7 @@ import {
   verifySourceQualificationProof,
 } from "../packages/core/dev-delivery-warrant.js";
 import { validateControllerReceipt } from "../packages/core/controller-evidence.js";
+import { exactMergeGroupBinding } from "./dev-delivery-source-proof-replay.mjs";
 
 const REUSE_DECISION_SCHEMA =
   "kungfu.buildchain.source-qualification-reuse-decision/v1";
@@ -113,98 +114,6 @@ function gitPathRoot(ref, paths, label, cwd) {
   });
 }
 
-function exactMergeGroupBinding(input = {}) {
-  const cwd = path.resolve(input.cwd || process.cwd());
-  const mergeGroupHead = exactSha(input.mergeGroupHead, "mergeGroupHead");
-  const expectedTree = exactSha(input.mergeGroupTree, "mergeGroupTree");
-  const currentBase = exactSha(input.currentBase, "currentBase");
-  const sourceHead = exactSha(input.sourceHead, "sourceHead");
-  const actualTree = exactSha(
-    git(["rev-parse", `${mergeGroupHead}^{tree}`], { cwd }),
-    "mergeGroupTree",
-  );
-  if (actualTree !== expectedTree)
-    return { ok: false, reason: "merge-group-tree-mismatch" };
-  const [commit, ...parents] = git(
-    ["rev-list", "--parents", "-n", "1", mergeGroupHead],
-    { cwd },
-  ).split(/\s+/u);
-  if (commit !== mergeGroupHead) {
-    return { ok: false, reason: "merge-group-parent-mismatch" };
-  }
-  if (
-    parents.length === 2 &&
-    parents[0] === currentBase &&
-    parents[1] === sourceHead
-  ) {
-    return {
-      ok: true,
-      mergeGroupHead,
-      mergeGroupTree: actualTree,
-      parents,
-      compositionMode: "two-parent-merge",
-      replayedCommitTrees: [],
-    };
-  }
-
-  const linearRange = (head) => {
-    try {
-      git(["merge-base", "--is-ancestor", currentBase, head], { cwd });
-    } catch {
-      return null;
-    }
-    const commits = git(
-      ["rev-list", "--reverse", "--topo-order", `${currentBase}..${head}`],
-      { cwd },
-    )
-      .split(/\s+/u)
-      .filter(Boolean);
-    if (commits.length === 0) return null;
-    let expectedParent = currentBase;
-    const trees = [];
-    for (const rangeCommit of commits) {
-      const [observedCommit, ...rangeParents] = git(
-        ["rev-list", "--parents", "-n", "1", rangeCommit],
-        { cwd },
-      ).split(/\s+/u);
-      if (
-        observedCommit !== rangeCommit ||
-        rangeParents.length !== 1 ||
-        rangeParents[0] !== expectedParent
-      ) {
-        return null;
-      }
-      trees.push(
-        exactSha(
-          git(["rev-parse", `${rangeCommit}^{tree}`], { cwd }),
-          "replayedCommitTree",
-        ),
-      );
-      expectedParent = rangeCommit;
-    }
-    return trees;
-  };
-
-  const sourceTrees = linearRange(sourceHead);
-  const mergeGroupTrees = linearRange(mergeGroupHead);
-  if (
-    !sourceTrees ||
-    !mergeGroupTrees ||
-    sourceTrees.length !== mergeGroupTrees.length ||
-    sourceTrees.some((tree, index) => tree !== mergeGroupTrees[index])
-  ) {
-    return { ok: false, reason: "merge-group-parent-mismatch" };
-  }
-  return {
-    ok: true,
-    mergeGroupHead,
-    mergeGroupTree: actualTree,
-    parents,
-    compositionMode: "linear-replay",
-    replayedCommitTrees: mergeGroupTrees,
-  };
-}
-
 export function sourceQualificationPredicates(input = {}) {
   const cwd = path.resolve(input.cwd || process.cwd());
   const repository = required(input.repository, "repository");
@@ -397,7 +306,8 @@ export function materializeReuseLifecycleEvidence({
       decisionRoot: decision.decisionRoot,
       sourceWorkflowRunId: decision.sourceWorkflowRunId,
       sourceHead: decision.sourceHead,
-      qualifiedBase: decision.currentBase,
+      qualifiedBase: decision.qualifiedBase,
+      currentBase: decision.currentBase,
       mergeGroupHead: decision.mergeGroupHead,
       mergeGroupTree: decision.mergeGroupTree,
     },
@@ -446,7 +356,7 @@ export function verifySourceQualificationReuse(input = {}) {
   const verification = verifySourceQualificationProof(proof, {
     repository: required(input.repository, "repository"),
     protectedBase: required(input.protectedBase, "protectedBase"),
-    qualifiedBase: exactSha(input.currentBase, "currentBase"),
+    qualifiedBase: exactSha(proof.qualifiedBase, "qualifiedBase"),
     sourceHead: exactSha(input.sourceHead, "sourceHead"),
     sourceWorkflowRunId: Number(input.sourceWorkflowRunId),
     controllerReceiptRoot: receipt.digest,
@@ -462,7 +372,7 @@ export function verifySourceQualificationReuse(input = {}) {
   }
   const current = sourceQualificationPredicates({
     ...input,
-    qualifiedBase: input.currentBase,
+    qualifiedBase: proof.qualifiedBase,
   });
   const classification = classifyDevDeliveryDelta({
     proof,
@@ -476,7 +386,11 @@ export function verifySourceQualificationReuse(input = {}) {
       reason: classification.reason,
     });
   }
-  const mergeGroup = exactMergeGroupBinding(input);
+  const mergeGroup = exactMergeGroupBinding({
+    ...input,
+    qualifiedBase: proof.qualifiedBase,
+    sourcePatchRoot: proof.sourcePatchRoot,
+  });
   if (!mergeGroup.ok) {
     return rootedDecision({
       schema: REUSE_DECISION_SCHEMA,
@@ -493,12 +407,14 @@ export function verifySourceQualificationReuse(input = {}) {
     sourceProofRoot: proof.proofRoot,
     sourceWorkflowRunId: proof.sourceWorkflowRunId,
     sourceHead: proof.sourceHead,
-    currentBase: proof.qualifiedBase,
+    qualifiedBase: proof.qualifiedBase,
+    currentBase: exactSha(input.currentBase, "currentBase"),
     mergeGroupHead: mergeGroup.mergeGroupHead,
     mergeGroupTree: mergeGroup.mergeGroupTree,
     mergeGroupParents: mergeGroup.parents,
     mergeGroupCompositionMode: mergeGroup.compositionMode,
     mergeGroupReplayTrees: mergeGroup.replayedCommitTrees,
+    mergeGroupReplayPatchRoots: mergeGroup.replayedCommitPatchRoots,
     predicateRoots: {
       sourceIdentityRoot: proof.sourceIdentityRoot,
       sourcePatchRoot: proof.sourcePatchRoot,

package/scripts/dev-delivery-warrant-store.mjs

@@ -46,7 +46,7 @@ function decodeBlob(blob) {
   ).toString("utf8");
 }
 
-function validateStoredState(queue) {
+function validateStoredState(queue, { allowLegacyV3Readback = false } = {}) {
   const body = structuredClone(queue || {});
   const embeddedStateRoot = body.stateRoot;
   delete body.stateRoot;
@@ -59,7 +59,7 @@ function validateStoredState(queue) {
   ) {
     normalizeDevDeliveryAuthorityState(queue);
   } else {
-    normalizeDevDeliveryQueue(queue);
+    normalizeDevDeliveryQueue(queue, { allowLegacyV3Readback });
   }
   return queue;
 }
@@ -108,7 +108,7 @@ export class GitHubDevDeliveryStore {
     return data;
   }
 
-  async read({ stateRef, protectedBase, now }) {
+  async read({ stateRef, protectedBase, now, allowLegacyV3Readback = false }) {
     let ref;
     try {
       ref = await this.request(
@@ -128,11 +128,13 @@ export class GitHubDevDeliveryStore {
       };
     }
     const commitSha = exactSha(ref?.object?.sha, "state ref commit");
-    const readback = await this.readCommit(commitSha);
+    const readback = await this.readCommit(commitSha, {
+      allowLegacyV3Readback,
+    });
     return { exists: true, ...readback };
   }
 
-  async readCommit(commitShaInput) {
+  async readCommit(commitShaInput, { allowLegacyV3Readback = false } = {}) {
     const commitSha = exactSha(commitShaInput, "state commit");
     const commit = await this.request(
       "GET",
@@ -152,7 +154,9 @@ export class GitHubDevDeliveryStore {
       `/repos/${this.repository.fullName}/git/blobs/${entry.sha}`,
     );
     const bytes = decodeBlob(blob);
-    const queue = validateStoredState(JSON.parse(bytes));
+    const queue = validateStoredState(JSON.parse(bytes), {
+      allowLegacyV3Readback,
+    });
     return { commitSha, queue, bytes };
   }
 

package/scripts/dev-delivery-warrant.mjs

@@ -295,7 +295,10 @@ async function observeQueue(loaded, options) {
   const readMode = text(options.readMode || "v3").toLowerCase();
   if (!["v3", "v4"].includes(readMode))
     throw new Error("readMode must be v3 or v4");
-  let observation = observeDevDeliveryQueue(loaded.queue, { now: options.now });
+  let observation = observeDevDeliveryQueue(loaded.queue, {
+    now: options.now,
+    allowLegacyV3Readback: true,
+  });
   let readCandidate;
   if (readMode === "v4") {
     const qualification =
@@ -374,6 +377,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     stateRef: options.stateRef,
     protectedBase: options.branch,
     now: options.now,
+    allowLegacyV3Readback: options.command === "observe",
   });
   if (
     options.expectedOldStateRoot &&

package/scripts/dev-pr-delivery-warrant.mjs

@@ -143,6 +143,7 @@ export async function readCurrentDeliveryQueueState(client, repository, targetBr
   const { queue } = await store.read({
     stateRef: defaultDevDeliveryStateRef(targetBranch),
     protectedBase: targetBranch,
+    allowLegacyV3Readback: true,
   });
   return queue;
 }

package/scripts/dev-qualification-patrol.mjs

@@ -501,16 +501,16 @@ export function createGitHubDevQualificationClient({
       sourceBranch,
       { activeOnly = false } = {},
     ) {
-      const query = sourceBranch
-        ? `?branch=${encodeURIComponent(sourceBranch)}`
-        : "";
-      const runs = await paged(
-        `/repos/${owner}/${repo}/actions/workflows/${encodeURIComponent(workflow)}/runs${query}`,
-        "workflow_runs",
+      const query = sourceBranch ? `branch=${encodeRef(sourceBranch)}&` : "";
+      const runs = await Promise.all(
+        [...(activeOnly ? ACTIVE_STATUSES : [""])].map((status) =>
+          paged(
+            `/repos/${owner}/${repo}/actions/workflows/${encodeURIComponent(workflow)}/runs?${query}${status ? `status=${status}` : ""}`,
+            "workflow_runs",
+          ),
+        ),
       );
-      return activeOnly
-        ? runs.filter((run) => ACTIVE_STATUSES.has(text(run.status)))
-        : runs;
+      return runs.flat();
     },
     async listRunJobs(runId, runAttempt) {
       return paged(