@kungfu-tech/buildchain 4.0.1-alpha.5 → 4.0.1-alpha.8

package/scripts/site-capability-metadata.mjs

@@ -13,6 +13,11 @@ export function cliCommandMeta(id) {
   const map = new Map(Object.entries({
     audit: { group: "release-passport-trust", purpose: "Inspect read-only publication authority audit commands." },
     architecture: { group: "governance-versioning", purpose: "Inspect and qualify the Buildchain v4 capability and state-machine architecture contract." },
+    "adopter-delivery": { group: "reusable-build", purpose: "Run public protocol-neutral adopter delivery, exact readback, N-1 bootstrap, and published archive checks." },
+    "adopter-delivery-run": { group: "reusable-build", purpose: "Run one exact public adopter driver and artifact-profile selection offline." },
+    "adopter-delivery-verify": { group: "reusable-build", purpose: "Recompute and verify exact adopter delivery readback without authority widening." },
+    "adopter-delivery-bootstrap": { group: "reusable-build", purpose: "Qualify exact v3 N-1 bootstrap lineage against the v4 adopter delivery substrate." },
+    "adopter-delivery-archive": { group: "reusable-build", purpose: "Load content-addressed public npm archive bytes and verify their exact identity and readback root." },
     "architecture-list": { group: "governance-versioning", purpose: "Generate the Agent-readable capability list from the validated v4 architecture manifest." },
     "architecture-qualify": { group: "governance-versioning", purpose: "Qualify an exact candidate against a distinct N-1 Git authority revision without candidate self-qualification." },
     "architecture-show": { group: "governance-versioning", purpose: "Generate one capability and its state-machine details from the validated v4 architecture manifest." },
@@ -190,6 +195,7 @@ export function nodeApiMeta(exportName) {
     "./homebrew": { group: "distribution-indexes", summary: "Homebrew tap fact collection, Formula rendering, update, and check APIs." },
     "./build-facts": { group: "observability-diagnostics", summary: "Git source, version, module output, product artifact, and legacy Kungfu build fact APIs." },
     "./candidate-timeline": { group: "observability-diagnostics", summary: "Source-bound candidate event normalization, per-attempt critical-path-safe aggregation, and compact reporting APIs." },
+    "./ci-lane-change-budget": { group: "governance-versioning", summary: "Exact-baseline CI lane admission requiring authority, trigger, concurrency, runner, cancellation, and merge-critical SLO budgets." },
     "./channel-candidate": { group: "governance-versioning", summary: "Exact-source channel candidate decisions, same-SHA workflow evidence validation, and deterministic source-lock reference APIs." },
     "./dev-delivery-authority": { group: "governance-versioning", summary: "Opt-in bounded Qualification Lease, exclusive Landing Warrant, provider-attempt admission and heartbeat readback, terminal sealing, and expired-Landing verification APIs." },
     "./dev-delivery-warrant": { group: "governance-versioning", summary: "Durable fair Dev Delivery Warrant queue, fenced lease, and split source and integration proof APIs." },
@@ -223,6 +229,17 @@ export function nodeApiMeta(exportName) {
     "./v4-runtime-ref-resume-authority": { group: "release-passport-trust", summary: "Transient exact-runtime authorization, persisted-selector rejection, fresh-attempt Stage Capsule reuse, and A+B Passport lineage APIs." },
     "./v4-tail-reseal": { group: "release-passport-trust", summary: "Effect-pure retained Stage Capsule validation and explicit Warrant-, credential-, and release-tail-fenced macOS reseal planning APIs." },
     "./v4-tail-reseal-receipt": { group: "release-passport-trust", summary: "Four-platform byte readback, standard candidate Passport binding, and terminal v4 tail-reseal receipt APIs." },
+    "./v4-publication-rehearsal": { group: "release-passport-trust", summary: "Content-addressed v4 publication rehearsal capsules, shared production release-tail execution, replay, provider observation, and fail-closed verification APIs." },
+    "./adopter-delivery-gate": { group: "reusable-build", summary: "Protocol-neutral adopter delivery gate, driver interface, artifact profiles, and canonical result APIs." },
+    "./kfd-adopter-category-driver": { group: "kfd-trust", summary: "Published KFD adopter-category driver and exact package-cut verification APIs." },
+    "./buildchain-delivery-infrastructure": { group: "reusable-build", summary: "Public delivery-infrastructure instance creation and KFD verification APIs." },
+    "./buildchain-delivery-bootstrap": { group: "reusable-build", summary: "Protected, published N-1 Buildchain delivery bootstrap qualification APIs." },
+    "./buildchain-delivery-self-dogfood": { group: "reusable-build", summary: "Public archive-backed Buildchain delivery-infrastructure self-dogfood APIs." },
+    "./published-delivery-authority": { group: "release-passport-trust", summary: "Content-addressed public Buildchain and KFD archive loading and identity verification APIs." },
+    "./legacy-kfd-adopter-driver": { group: "kfd-trust", summary: "One-way legacy KFD support-matrix adapter driver APIs." },
+    "./adopter-delivery-passport": { group: "release-passport-trust", summary: "Non-authoritative adopter delivery Release Passport binding and substitution checks." },
+    "./adopter-delivery-vectors": { group: "reusable-build", summary: "Rooted public adopter delivery conformance vector suite APIs." },
+    "./v4-adopter-delivery": { group: "reusable-build", summary: "Public v4 adopter delivery runtime, exact readback, N-1 lineage, and published archive verification APIs." },
     "./release-candidate-recovery": { group: "release-passport-trust", summary: "Fail-closed verification and immutable receipts for reusing a successful sealed candidate run without rebuilding product payloads." },
     "./release-train": { group: "governance-versioning", summary: "Frozen Release Cut identity, rooted Release Train transitions, Dev observations, supersession, replay, and legacy read compatibility APIs." },
     "./next-development-transition": { group: "governance-versioning", summary: "Provider-neutral completed-Alpha preservation and rooted next-development state, version-model, idempotency, and local materialization APIs." },

package/scripts/v4-consumer-policy.mjs

@@ -41,6 +41,9 @@ export function scanCommand(options = {}) {
   const root = path.resolve(
     options.root || env("BUILDCHAIN_CONSUMER_ROOT", process.cwd()),
   );
+  const invocationRoot = path.resolve(
+    options.invocationRoot || env("BUILDCHAIN_INVOCATION_SOURCE_ROOT", root),
+  );
   const output = path.resolve(
     root,
     options.output ||
@@ -54,6 +57,7 @@ export function scanCommand(options = {}) {
   );
   const result = scanV4FloatingConsumerPolicy({
     root,
+    invocationRoot,
     repository: options.repository || env("GITHUB_REPOSITORY"),
     sourceSha: options.sourceSha || env("GITHUB_SHA"),
     invokedWorkflow:

package/scripts/v4-publication-rehearsal-fixture.mjs

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  createV4PublicationRehearsalCapsule,
+  executeV4PublicationRehearsal,
+} from "../packages/core/v4-publication-rehearsal.js";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const fixtureRoot = path.join(
+  root,
+  "contracts/fixtures/v4-publication-rehearsal-v1",
+);
+const candidateRoot = path.join(fixtureRoot, "candidate");
+
+function digest(bytes) {
+  return `sha256:${crypto.createHash("sha256").update(bytes).digest("hex")}`;
+}
+
+function candidateFiles() {
+  const roles = {
+    "artifacts/product.bin": "installable-product",
+    "config/buildchain.toml": "buildchain-config",
+    "documents/release-activation.json": "release-activation-document",
+    "documents/signed-channel.json": "signed-channel-document",
+    "evidence/qualification.json": "qualification-evidence",
+    "manifests/candidate.json": "candidate-manifest",
+    "manifests/release-passport.json": "release-passport",
+  };
+  return Object.keys(roles)
+    .map((relative) => {
+      const bytes = fs.readFileSync(path.join(candidateRoot, relative));
+      return {
+        role: roles[relative],
+        path: relative,
+        size: bytes.length,
+        root: digest(bytes),
+      };
+    })
+    .sort((left, right) =>
+      Buffer.from(left.path).compare(Buffer.from(right.path)),
+    );
+}
+
+async function generated() {
+  const declaration = JSON.parse(
+    fs.readFileSync(
+      path.join(
+        root,
+        "contracts/fixtures/release-tail-capabilities-v1/kungfu-alpha.json",
+      ),
+      "utf8",
+    ),
+  );
+  const files = candidateFiles();
+  const binding = (relative) => ({
+    path: relative,
+    root: files.find((entry) => entry.path === relative).root,
+  });
+  const capsule = createV4PublicationRehearsalCapsule({
+    source: {
+      repository: "kungfu-systems/buildchain",
+      revision: "bc12cd0ff18a7e1d918777ea093c169349952d34",
+    },
+    declaration,
+    manifest: binding("manifests/candidate.json"),
+    config: binding("config/buildchain.toml"),
+    providerBindings: {
+      schema: "kungfu.buildchain.release-tail.provider-bindings/v1",
+      artifacts: {
+        "installable-product": {
+          path: "artifacts/product.bin",
+          name: "product.bin",
+        },
+        "release-passport": {
+          path: "manifests/release-passport.json",
+          name: "release-passport.json",
+        },
+      },
+      documents: {
+        "release.activate": {
+          path: "documents/release-activation.json",
+          method: "PUT",
+        },
+        "signed-channel.commit": {
+          path: "documents/signed-channel.json",
+          method: "PUT",
+        },
+      },
+      evidence: {
+        inputs: ["evidence/qualification.json"],
+        output: "generated/released-evidence.json",
+      },
+    },
+    files,
+  });
+  const vectors = [];
+  for (const platform of ["linux", "macos", "windows"]) {
+    const result = await executeV4PublicationRehearsal({
+      capsule,
+      candidateRoot,
+      mode: "simulate",
+    });
+    vectors.push({
+      platform,
+      capsuleRoot: result.evidence.capsuleRoot,
+      transactionRoot: result.evidence.transactionRoot,
+      stateRoot: result.evidence.stateRoot,
+      evidenceRoot: result.evidence.evidenceRoot,
+    });
+  }
+  return {
+    capsule,
+    vectors: {
+      schema: "buildchain-v4-publication-rehearsal-offline-vectors/v1",
+      vectors,
+      vectorRoot: digest(JSON.stringify(vectors)),
+    },
+  };
+}
+
+const { capsule, vectors } = await generated();
+const outputs = new Map([
+  [path.join(fixtureRoot, "capsule.json"), capsule],
+  [path.join(fixtureRoot, "offline-vectors.json"), vectors],
+]);
+const check = process.argv.includes("--check");
+for (const [file, value] of outputs) {
+  const bytes = `${JSON.stringify(value, null, 2)}\n`;
+  if (check) {
+    if (!fs.existsSync(file) || fs.readFileSync(file, "utf8") !== bytes)
+      throw new Error(`${path.relative(root, file)} is stale`);
+  } else {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, bytes);
+  }
+}
+process.stdout.write(
+  `${JSON.stringify({ capsuleRoot: capsule.capsuleRoot, vectorRoot: vectors.vectorRoot })}\n`,
+);