@kungfu-tech/buildchain 4.0.1-alpha.9 → 4.0.2-alpha.0

package/scripts/check-v4-runtime-semantic-closure.mjs

@@ -0,0 +1,266 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+export const V4_RUNTIME_SEMANTIC_CLOSURE_CONTRACT =
+  "kungfu-buildchain-v4-runtime-semantic-closure";
+export const V4_RUNTIME_SEMANTIC_CLOSURE_PATH =
+  "architecture/v4-runtime-semantic-closure.json";
+export const REQUIRED_RUNTIME_EVIDENCE = Object.freeze([
+  "positive",
+  "negative",
+  "failure",
+  "recovery",
+  "idempotence",
+]);
+
+function loadJson(root, relativePath) {
+  return JSON.parse(fs.readFileSync(path.join(root, relativePath), "utf8"));
+}
+
+function sorted(values) {
+  return [...values].sort((left, right) => left.localeCompare(right));
+}
+
+function sameMembers(left, right) {
+  return JSON.stringify(sorted(left)) === JSON.stringify(sorted(right));
+}
+
+function publicSurfaceIds(root) {
+  const packageJson = loadJson(root, "package.json");
+  const cli = loadJson(root, "dist/site/cli-registry.json");
+  const workflows = loadJson(root, "dist/site/workflow-registry.json");
+  return new Set([
+    ...Object.keys(packageJson.exports || {}).map((id) => `export:${id}`),
+    ...(cli.commands || []).map((entry) => `cli:${entry.id}`),
+    ...(workflows.workflows || []).map((entry) => `workflow:${entry.id}`),
+    ...(workflows.actions || []).map((entry) => `action:${entry.id}`),
+  ]);
+}
+
+function validateEvidence(root, mechanism, capability, issues) {
+  const sourceTests = new Set(mechanism.testPaths || []);
+  for (const dimension of REQUIRED_RUNTIME_EVIDENCE) {
+    const entries = capability.evidence?.[dimension];
+    if (!Array.isArray(entries) || entries.length === 0) {
+      issues.push(`${capability.id}: ${dimension} evidence is empty`);
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry?.path || !entry?.name) {
+        issues.push(`${capability.id}: ${dimension} evidence is incomplete`);
+        continue;
+      }
+      if (!sourceTests.has(entry.path))
+        issues.push(
+          `${capability.id}: ${dimension} evidence is outside the reverse-scanned test set: ${entry.path}`,
+        );
+      const absolute = path.join(root, entry.path);
+      if (!fs.existsSync(absolute)) {
+        issues.push(
+          `${capability.id}: evidence path is missing: ${entry.path}`,
+        );
+        continue;
+      }
+      const source = fs.readFileSync(absolute, "utf8");
+      if (!source.includes(`test(${JSON.stringify(entry.name)}`))
+        issues.push(
+          `${capability.id}: evidence test is missing from ${entry.path}: ${entry.name}`,
+        );
+    }
+  }
+}
+
+function validateResidualClosure(mechanism, capability, issues) {
+  const sourceResiduals = mechanism.unresolved || [];
+  const closed = capability.resolvedResiduals || [];
+  if (
+    !sameMembers(
+      sourceResiduals,
+      closed.map((entry) => entry?.source || ""),
+    )
+  )
+    issues.push(
+      `${capability.id}: resolved residual identities do not match the reverse scan`,
+    );
+  for (const entry of closed) {
+    if (!String(entry?.resolution || "").trim())
+      issues.push(`${capability.id}: residual resolution is empty`);
+  }
+}
+
+function validateImplementation(root, mechanism, capability, issues) {
+  if (
+    !Array.isArray(capability.implementation) ||
+    capability.implementation.length === 0
+  ) {
+    issues.push(`${capability.id}: implementation route is empty`);
+    return;
+  }
+  const reverseScanned = new Set(mechanism.sourcePaths || []);
+  let boundToReverseScan = false;
+  for (const relativePath of capability.implementation) {
+    if (!fs.existsSync(path.join(root, relativePath)))
+      issues.push(
+        `${capability.id}: implementation path is missing: ${relativePath}`,
+      );
+    if (reverseScanned.has(relativePath)) boundToReverseScan = true;
+  }
+  if (!boundToReverseScan)
+    issues.push(
+      `${capability.id}: implementation is not bound to a reverse-scanned v3 mechanism route`,
+    );
+}
+
+function validateAuthority(capability, stateMachine, issues) {
+  for (const field of [
+    "exactHeadFence",
+    "immutableRootFence",
+    "providerReadbackBeforeRetry",
+    "idempotentReplay",
+  ]) {
+    if (capability.invariants?.[field] !== true)
+      issues.push(`${capability.id}: ${field} must remain true`);
+  }
+  if (capability.routeKind !== "v4-native")
+    issues.push(`${capability.id}: routeKind must be v4-native`);
+  if (capability.legacyFallbackAllowed !== false)
+    issues.push(`${capability.id}: legacy fallback must remain disabled`);
+  if (capability.providerDecisionAuthorityAllowed !== false)
+    issues.push(
+      `${capability.id}: provider decision authority must remain disabled`,
+    );
+  if (stateMachine) {
+    if (capability.stateAuthority !== "single-writer-state-machine")
+      issues.push(
+        `${capability.id}: state-machine authority classification drifted`,
+      );
+    if (
+      stateMachine.writer?.authoritative !== true ||
+      stateMachine.writer?.secondWriterBudget !== 0
+    )
+      issues.push(`${capability.id}: v4 state machine is not single-writer`);
+    if (
+      !Array.isArray(stateMachine.recovery) ||
+      stateMachine.recovery.length === 0
+    )
+      issues.push(`${capability.id}: v4 state machine recovery is empty`);
+  } else if (capability.stateAuthority !== "bounded-protocol") {
+    issues.push(
+      `${capability.id}: bounded protocol authority classification drifted`,
+    );
+  }
+}
+
+export function validateRuntimeSemanticClosure({
+  root = process.cwd(),
+  manifest = loadJson(root, V4_RUNTIME_SEMANTIC_CLOSURE_PATH),
+  v3Inventory = loadJson(root, "architecture/v3-core-mechanism-inventory.json"),
+  v4Manifest = loadJson(
+    root,
+    "architecture/v4-capability-state-machine-manifest.json",
+  ),
+} = {}) {
+  const issues = [];
+  if (
+    manifest?.schemaVersion !== 1 ||
+    manifest?.contract !== V4_RUNTIME_SEMANTIC_CLOSURE_CONTRACT
+  )
+    issues.push(
+      "runtime semantic closure contract or schemaVersion is invalid",
+    );
+  if (!sameMembers(manifest?.requiredEvidence || [], REQUIRED_RUNTIME_EVIDENCE))
+    issues.push("runtime semantic closure evidence dimensions drifted");
+
+  const mechanisms = new Map(
+    (v3Inventory.mechanisms || []).map((entry) => [entry.id, entry]),
+  );
+  const v4Capabilities = new Map(
+    (v4Manifest.capabilities || []).map((entry) => [entry.id, entry]),
+  );
+  const stateMachines = new Map(
+    (v4Manifest.stateMachines || []).map((entry) => [entry.id, entry]),
+  );
+  const capabilities = Array.isArray(manifest?.capabilities)
+    ? manifest.capabilities
+    : [];
+  if (
+    !sameMembers(
+      capabilities.map((entry) => entry.id),
+      mechanisms.keys(),
+    )
+  )
+    issues.push(
+      "runtime semantic closure does not cover every v3 mechanism exactly once",
+    );
+  if (
+    !sameMembers(
+      capabilities.map((entry) => entry.id),
+      v4Capabilities.keys(),
+    )
+  )
+    issues.push(
+      "runtime semantic closure does not match the v4 capability manifest",
+    );
+
+  const surfaces = publicSurfaceIds(root);
+  const ids = new Set();
+  for (const capability of capabilities) {
+    if (!capability?.id || ids.has(capability.id)) {
+      issues.push(
+        `runtime semantic capability id is missing or duplicated: ${capability?.id || "<empty>"}`,
+      );
+      continue;
+    }
+    ids.add(capability.id);
+    const mechanism = mechanisms.get(capability.id);
+    const v4Capability = v4Capabilities.get(capability.id);
+    if (!mechanism || !v4Capability) continue;
+    if (capability.sourceMechanismId !== capability.id)
+      issues.push(`${capability.id}: source mechanism identity drifted`);
+    validateImplementation(root, mechanism, capability, issues);
+    validateResidualClosure(mechanism, capability, issues);
+    validateEvidence(root, mechanism, capability, issues);
+    validateAuthority(capability, stateMachines.get(capability.id), issues);
+    for (const surface of v4Capability.surfaces || []) {
+      if (!surfaces.has(surface))
+        issues.push(
+          `${capability.id}: executable v4 surface is absent: ${surface}`,
+        );
+    }
+  }
+
+  if (issues.length)
+    throw new Error(
+      `v4 runtime semantic closure failed:\n- ${issues.join("\n- ")}`,
+    );
+  return {
+    capabilities: capabilities.length,
+    evidenceDimensions: capabilities.length * REQUIRED_RUNTIME_EVIDENCE.length,
+    residualsClosed: capabilities.reduce(
+      (sum, entry) => sum + entry.resolvedResiduals.length,
+      0,
+    ),
+    legacyFallbacks: 0,
+    providerDecisionAuthorities: 0,
+  };
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href
+) {
+  try {
+    const report = validateRuntimeSemanticClosure();
+    console.log(
+      `v4 runtime semantic closure passed: ${report.capabilities} capabilities, ` +
+        `${report.evidenceDimensions} evidence dimensions, ${report.residualsClosed} reverse-scan residuals closed, ` +
+        "0 legacy fallbacks, 0 provider decision authorities",
+    );
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}

package/scripts/dev-delivery-warrant-options.mjs

@@ -7,11 +7,34 @@ export function hasFlag(args, name) {
   return args.includes(`--${name}`);
 }
 
-export function devDeliveryCliOptions(args = [], environment = process.env) {
-  const [command = "", ...rest] = args;
+function terminalEvidenceOptions(rest, environment) {
+  return {
+    outcome: flag(rest, "outcome", environment.BUILDCHAIN_DEV_DELIVERY_OUTCOME),
+    eventAction: flag(
+      rest,
+      "event-action",
+      environment.BUILDCHAIN_DEV_DELIVERY_EVENT_ACTION,
+    ),
+    evidenceRoot: flag(
+      rest,
+      "evidence-root",
+      environment.BUILDCHAIN_DEV_DELIVERY_EVIDENCE_ROOT,
+    ),
+    expectedPriorEvidenceRoot: flag(
+      rest,
+      "expected-prior-evidence-root",
+      environment.BUILDCHAIN_DEV_DELIVERY_EXPECTED_PRIOR_EVIDENCE_ROOT,
+    ),
+    integrationProofPath: flag(
+      rest,
+      "integration-proof",
+      environment.BUILDCHAIN_DEV_DELIVERY_INTEGRATION_PROOF,
+    ),
+  };
+}
+
+function authorityStateOptions(rest, environment) {
   return {
-    command,
-    repository: flag(rest, "repository", environment.GITHUB_REPOSITORY),
     branch: flag(
       rest,
       "branch",
@@ -27,6 +50,20 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
       "expected-old",
       environment.BUILDCHAIN_DEV_DELIVERY_EXPECTED_OLD,
     ),
+    legacyTerminalRecoveryPath: flag(
+      rest,
+      "legacy-terminal-recovery",
+      environment.BUILDCHAIN_DEV_DELIVERY_LEGACY_TERMINAL_RECOVERY,
+    ),
+  };
+}
+
+export function devDeliveryCliOptions(args = [], environment = process.env) {
+  const [command = "", ...rest] = args;
+  return {
+    command,
+    repository: flag(rest, "repository", environment.GITHUB_REPOSITORY),
+    ...authorityStateOptions(rest, environment),
     pullRequestNumber: flag(
       rest,
       "pull-request",
@@ -196,17 +233,7 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
       "lease-seconds",
       environment.BUILDCHAIN_DEV_DELIVERY_LEASE_SECONDS,
     ),
-    outcome: flag(rest, "outcome", environment.BUILDCHAIN_DEV_DELIVERY_OUTCOME),
-    eventAction: flag(
-      rest,
-      "event-action",
-      environment.BUILDCHAIN_DEV_DELIVERY_EVENT_ACTION,
-    ),
-    evidenceRoot: flag(
-      rest,
-      "evidence-root",
-      environment.BUILDCHAIN_DEV_DELIVERY_EVIDENCE_ROOT,
-    ),
+    ...terminalEvidenceOptions(rest, environment),
     transferRoot: flag(rest, "transfer-root"),
     finalizerBoundaryRoot: flag(rest, "finalizer-boundary-root"),
     nativeJobId: flag(rest, "native-job-id"),

package/scripts/dev-delivery-warrant.mjs

@@ -10,10 +10,12 @@ import {
   observeDevDeliveryQueue,
   qualifyDevDeliveryWarrant,
   recoverExpiredDevDeliveryWarrant,
+  reconcileDevDeliveryTerminalEvidence,
   selectDevDeliveryWarrant,
   settleDevDeliveryTerminalEvent,
   submitDevDeliveryCandidate,
 } from "../packages/core/dev-delivery-warrant.js";
+import { recoverLegacyTerminalDevDeliveryQueue } from "../packages/core/dev-delivery-warrant-legacy-recovery.js";
 import { runV4DeliveryWarrantReadCandidate } from "../packages/core/v4-delivery-warrant-read-candidate.js";
 
 import { GitHubDevDeliveryStore } from "./dev-delivery-warrant-store.mjs";
@@ -52,6 +54,45 @@ function exactSha(value, label) {
   return normalized;
 }
 
+function terminalSourceHead(options) {
+  return exactSha(
+    options.expectedSourceHead || options.sourceHead,
+    "sourceHead",
+  );
+}
+
+function reconcileTerminalEvidenceCommand(queue, options) {
+  return reconcileDevDeliveryTerminalEvidence(
+    queue,
+    {
+      candidateId: exactRoot(options.candidateId, "candidateId"),
+      expectedPriorEvidenceRoot: exactRoot(
+        options.expectedPriorEvidenceRoot,
+        "expectedPriorEvidenceRoot",
+      ),
+      integrationProof:
+        options.integrationProof ||
+        jsonFile(options.integrationProofPath, "integration proof"),
+      reason: options.reason,
+    },
+    { now: options.now },
+  );
+}
+
+function requireTerminalEvidenceCas(options) {
+  if (
+    ["reconcile-terminal-evidence", "recover-legacy-terminal"].includes(
+      options.command,
+    ) &&
+    options.execute &&
+    !options.expectedOldStateRoot
+  ) {
+    throw new Error(
+      "terminal evidence reconciliation execute requires expected-old CAS",
+    );
+  }
+}
+
 function normalizeRepository(value) {
   const normalized = text(value);
   const match = normalized.match(/^([^/\s]+)\/([^/\s]+)$/);
@@ -229,6 +270,13 @@ function transitionFor(command, queue, options) {
   }
   if (command === "recover")
     return recoverExpiredDevDeliveryWarrant(queue, { now: options.now });
+  if (command === "recover-legacy-terminal") {
+    return recoverLegacyTerminalDevDeliveryQueue(
+      queue,
+      jsonFile(options.legacyTerminalRecoveryPath, "legacy terminal recovery"),
+      { now: options.now },
+    );
+  }
   if (command === "close") {
     return closeDevDeliveryWarrant(queue, warrantIdentity(queue, options), {
       outcome: options.outcome,
@@ -245,10 +293,7 @@ function transitionFor(command, queue, options) {
           options.pullRequestNumber,
           "pullRequestNumber",
         ),
-        sourceHead: exactSha(
-          options.expectedSourceHead || options.sourceHead,
-          "sourceHead",
-        ),
+        sourceHead: terminalSourceHead(options),
         fencingToken: options.fencingToken,
         leaseGeneration: options.leaseGeneration,
         outcome: options.outcome,
@@ -263,6 +308,9 @@ function transitionFor(command, queue, options) {
       { now: options.now },
     );
   }
+  if (command === "reconcile-terminal-evidence") {
+    return reconcileTerminalEvidenceCommand(queue, options);
+  }
   if (command === "cancel-queued") {
     return cancelQueuedDevDeliveryCandidate(
       queue,
@@ -356,6 +404,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     now: new Date(optionsInput.now || Date.now()).toISOString(),
     execute: bool(optionsInput.execute, false),
   };
+  requireTerminalEvidenceCas(options);
   if (
     options.command === "submit" &&
     options.execute &&
@@ -377,7 +426,9 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     stateRef: options.stateRef,
     protectedBase: options.branch,
     now: options.now,
-    allowLegacyV3Readback: options.command === "observe",
+    allowLegacyV3Readback: ["observe", "recover-legacy-terminal"].includes(
+      options.command,
+    ),
   });
   if (
     options.expectedOldStateRoot &&
@@ -457,7 +508,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
 }
 
 function usage() {
-  return "Usage:\n  buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|settle|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n\nRead candidate:\n  observe --read-mode v4 --read-qualification FILE --read-qualification-root sha256:... --read-typescript-revision SHA --read-rust-revision SHA --read-validator-version TOKEN [--read-evidence-output FILE]\n";
+  return "Usage:\n  buildchain dev warrant <submit|select|heartbeat|qualify|recover|recover-legacy-terminal|close|settle|reconcile-terminal-evidence|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n\nLegacy terminal recovery:\n  recover-legacy-terminal --expected-old sha256:... --legacy-terminal-recovery FILE [--execute]\n\nRead candidate:\n  observe --read-mode v4 --read-qualification FILE --read-qualification-root sha256:... --read-typescript-revision SHA --read-rust-revision SHA --read-validator-version TOKEN [--read-evidence-output FILE]\n";
 }
 
 async function main() {
@@ -474,8 +525,10 @@ async function main() {
       "heartbeat",
       "qualify",
       "recover",
+      "recover-legacy-terminal",
       "close",
       "settle",
+      "reconcile-terminal-evidence",
       "cancel-queued",
       "observe",
     ].includes(options.command)

package/scripts/dev-pr-auto-merge.mjs

@@ -3,7 +3,7 @@ import crypto from "node:crypto";
 import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import { admitExistingQueueEntry, createDevPrAdmissionReceipt, qualifyAtomicQueueAdmission, readDeliveryWarrantResult, runSourceQualification, runTargetedQueueAdmission, setActiveLeaseStatus, verifyCurrentDeliveryWarrant } from "./dev-pr-delivery-warrant.mjs";
+import { admitExistingQueueEntry, createDevPrAdmissionReceipt, createPreReadinessQueueFence, qualifyAtomicQueueAdmission, readDeliveryWarrantResult, runSourceQualification, runTargetedQueueAdmission, setActiveLeaseStatus, setQueueAdmissionStatus, verifyCurrentDeliveryWarrant } from "./dev-pr-delivery-warrant.mjs";
 import { projectCutQualification } from "./dev-pr-prequeue-guard.mjs";
 const DEFAULT_BLOCK_LABELS = ["blocked", "do-not-merge", "work-in-progress"];
 const DEFAULT_ALLOWED_HEAD_PREFIXES = ["feature/", "fix/", "chore/", "docs/", "ci/", "refactor/"];
@@ -197,12 +197,6 @@ function mergeableAccepted(pr, landingMode = "direct", projectCutQualified = fal
 function rejectBaseMoveBeforeAtomicReplay(options, initialBaseSha, observedBaseSha) {
   return observedBaseSha !== initialBaseSha && options.warrantMode !== "required";
 }
-async function setQueueAdmissionStatus(client, repository, sha, context, state) {
-  if (!context) return null;
-  await client.request("POST", `/repos/${repository.owner}/${repository.repo}/statuses/${sha}`, { body: { state, context, description: state === "success" ? "Buildchain admitted this exact PR head to the merge queue" : "Buildchain rejected merge queue admission for this exact PR head" } });
-  return { context, state, sha };
-}
-
 function skip(reason, details = {}) {
   return { action: "skip", reason, ...details };
 }
@@ -790,8 +784,10 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
     return targetedFailure({ options, pr: {}, state: "missing", reason: "pull-request-not-found" });
   }
 
+  const readinessFence = createPreReadinessQueueFence({ client, options, sleep: delay });
   const reject = async (state, reason, readiness = { observed: hasReadyLabel(pr, options.readyLabel), established: false }) => {
     const result = targetedFailure({ options, pr, state, reason, readiness });
+    await readinessFence.finish(result);
     if (!options.dryRun) result.diagnostic = await publishAdmissionDiagnostic(client, options, result.receipt, result.receiptRoot);
     return result;
   };
@@ -803,6 +799,12 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
   if (pr.draft) return reject("blocked", "draft");
   if (!headPrefixAllowed(pr, options.allowedHeadPrefixes)) return reject("blocked", "head-prefix-not-allowed");
 
+  try {
+    await readinessFence.establish();
+  } catch (error) {
+    return reject("blocked", error.code || "pre-readiness-queue-fence-failed");
+  }
+
   let readiness = { observed: hasReadyLabel(pr, options.readyLabel), established: false };
   if (!readiness.observed) {
     if (options.dryRun) return reject("rejected", "missing-ready-label", readiness);
@@ -825,7 +827,7 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
   }
 
   if (options.qualificationOnly) {
-    return runSourceQualification({
+    const result = await runSourceQualification({
       options, pullRequest: pr, readiness, client, reject,
       evaluate: evaluatePullRequest,
       admissionState: admissionStateFor,
@@ -833,6 +835,7 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
       root: contentRoot,
       publishDiagnostic: publishAdmissionDiagnostic,
     });
+    return readinessFence.finish(result);
   }
 
   const initialQueue = await client.getMergeQueueState(options.targetBranch);
@@ -844,6 +847,7 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
   }
   const matchingEntry = initialQueue.entries.find((entry) =>
     entry.pullRequestNumber === pr.number && entry.pullRequestHeadSha === options.expectedHeadSha);
+  await readinessFence.qualifyExisting(matchingEntry);
   const existing = await admitExistingQueueEntry({
     options, pullRequest: pr, readiness, client, entry: matchingEntry, warrant,
     createReceipt: createAdmissionReceipt,
@@ -852,7 +856,7 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
   });
   if (existing) return existing;
 
-  return runTargetedQueueAdmission({
+  const result = await runTargetedQueueAdmission({
     options, pullRequest: pr, readiness, client, warrant,
     runController: runDevPrAutoMerge,
     admissionState: admissionStateFor,
@@ -860,6 +864,7 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
     root: contentRoot,
     publishDiagnostic: publishAdmissionDiagnostic,
   });
+  return readinessFence.finish(result);
 }
 
 function finalizePatrolResult(result) {
@@ -1132,6 +1137,11 @@ function cliFlag(args, name) {
 
 export function cliOptions(args = [], environment = process.env) {
   const targetPullRequestNumber = cliValue(args, "pull-request", environment.BUILDCHAIN_DEV_PR_EXPECTED_PR_NUMBER);
+  const warrantMode = cliValue(
+    args,
+    "warrant-mode",
+    environment.BUILDCHAIN_DEV_PR_WARRANT_MODE || environment.WARRANT_MODE,
+  );
   return {
     repository: cliValue(args, "repository", environment.BUILDCHAIN_DEV_PR_REPOSITORY || environment.GITHUB_REPOSITORY),
     targetBranch: cliValue(args, "branch", environment.BUILDCHAIN_DEV_PR_TARGET_BRANCH || environment.GITHUB_REF_NAME),
@@ -1141,10 +1151,14 @@ export function cliOptions(args = [], environment = process.env) {
     blockLabels: cliValue(args, "block-labels", environment.BUILDCHAIN_DEV_PR_BLOCK_LABELS),
     allowedHeadPrefixes: cliValue(args, "allowed-head-prefixes", environment.BUILDCHAIN_DEV_PR_ALLOWED_HEAD_PREFIXES),
     requiredChecks: cliValue(args, "required-checks", environment.BUILDCHAIN_DEV_PR_REQUIRED_CHECKS),
-    queueAdmissionContext: cliValue(args, "queue-admission-context", environment.BUILDCHAIN_DEV_PR_QUEUE_ADMISSION_CONTEXT),
+    queueAdmissionContext: cliValue(
+      args,
+      "queue-admission-context",
+      environment.BUILDCHAIN_DEV_PR_QUEUE_ADMISSION_CONTEXT || (warrantMode === "required" ? "Queue admission lease" : ""),
+    ),
     activeLeaseContext: cliValue(args, "active-lease-context", environment.BUILDCHAIN_DEV_PR_ACTIVE_LEASE_CONTEXT),
     diagnosticContext: cliValue(args, "diagnostic-context", environment.BUILDCHAIN_DEV_PR_DIAGNOSTIC_CONTEXT),
-    warrantMode: cliValue(args, "warrant-mode", environment.BUILDCHAIN_DEV_PR_WARRANT_MODE),
+    warrantMode,
     warrantResultPath: cliValue(args, "warrant-result", environment.BUILDCHAIN_DEV_PR_WARRANT_RESULT_PATH),
     projectCutProofPath: cliValue(args, "project-cut-proof", environment.BUILDCHAIN_DEV_PR_PROJECT_CUT_PROOF_PATH),
     sourceProofPath: cliValue(args, "source-proof", environment.BUILDCHAIN_DEV_PR_SOURCE_PROOF_PATH),

package/scripts/dev-pr-delivery-warrant.mjs

@@ -206,6 +206,50 @@ export async function setActiveLeaseStatus(client, repository, sha, context, sta
   return { context, state, sha };
 }
 
+export async function setQueueAdmissionStatus(client, repository, sha, context, state) {
+  if (!context) return null;
+  const descriptions = {
+    pending: "Buildchain is awaiting a qualified Warrant for this exact PR head",
+    success: "Buildchain admitted this exact PR head to the merge queue",
+    failure: "Buildchain rejected merge queue admission for this exact PR head",
+  };
+  await client.request("POST", `/repos/${repository.owner}/${repository.repo}/statuses/${sha}`, {
+    body: { state, context, description: descriptions[state] || descriptions.failure },
+  });
+  return { context, state, sha };
+}
+
+export function createPreReadinessQueueFence({ client, options, sleep }) {
+  let status = null;
+  const write = async (state) => {
+    status = await setQueueAdmissionStatus(client, options.repository, options.expectedHeadSha, options.queueAdmissionContext, state);
+    return status;
+  };
+  return {
+    async establish() {
+      if (options.dryRun || options.warrantMode !== "required") return null;
+      if (!options.queueAdmissionContext) mismatch("queue-admission-context-required-before-readiness");
+      await write("pending");
+      for (let attempt = 1; attempt <= Math.max(1, options.pollMergeableAttempts); attempt += 1) {
+        const checks = await client.listCommitChecks(options.expectedHeadSha);
+        const readback = (checks?.statuses || []).find((entry) => entry.context === options.queueAdmissionContext);
+        if (readback?.state === "pending") return { ...status, readbackAttempts: attempt };
+        if (attempt < options.pollMergeableAttempts) await sleep(options.pollMergeableDelayMs);
+      }
+      await write("failure");
+      mismatch("pre-readiness-queue-fence-readback-mismatch");
+    },
+    async qualifyExisting(entry) {
+      if (entry && status?.state === "pending") await write("success");
+    },
+    async finish(result) {
+      const controllerFailed = result.controller?.evaluated?.some((entry) => entry.queueAdmissionStatus?.state === "failure");
+      if (!result.ok && status?.state === "pending" && !controllerFailed) await write("failure");
+      return result;
+    },
+  };
+}
+
 async function readBackAdmissionStatuses(client, options, expectedHeadSha, sleep) {
   let last = { queueAdmission: null, activeLease: null };
   const attempts = Math.max(1, options.pollMergeableAttempts);

package/scripts/dev-pr-prequeue-guard.mjs

@@ -164,15 +164,6 @@ async function qualifyProjectCut({
 
   let reuseDecision = null;
   if (currentBaseSha !== previousBaseSha) {
-    const observedPullRequestBase = String(
-      observedPullRequest.base?.sha || "",
-    ).toLowerCase();
-    if (observedPullRequestBase !== currentBaseSha) {
-      mismatch("pre-enqueue-project-cut-base-stale", {
-        observedPullRequestBase,
-        currentBaseSha,
-      });
-    }
     const proof = readOptionalJson(options.sourceProofPath);
     if (!proof) mismatch("pre-enqueue-base-attribution-unknown");
     if (
@@ -342,15 +333,6 @@ export async function qualifyPreEnqueueReadback({
   ) {
     mismatch("head-sha-drift-after-project-cut");
   }
-  const casPullRequestBase = String(
-    casPullRequest.base?.sha || "",
-  ).toLowerCase();
-  if (casPullRequestBase && casPullRequestBase !== casBaseSha) {
-    mismatch("pre-enqueue-project-cut-base-stale", {
-      observedPullRequestBase: casPullRequestBase,
-      currentBaseSha: casBaseSha,
-    });
-  }
   if (casPullRequest.mergeable === false) {
     mismatch("pre-enqueue-merge-conflict-after-project-cut");
   }

package/scripts/dispatch-artifact-signing-authority.mjs

@@ -24,7 +24,7 @@ const AUTHORITY_WORKFLOW = "artifact-signing-authority.yml";
 
 export function resolveAuthorityDispatchRef(value) {
   const ref = required(value, "authority ref");
-  return /^[0-9a-f]{40}$/u.test(ref)
+  return /^[0-9a-f]{40}$/u.test(ref) || /^v\d+(?:\.\d+)?(?:-alpha)?$/u.test(ref)
     ? DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF
     : ref;
 }