@kungfu-tech/buildchain 4.0.1 → 4.0.2-alpha.10

package/packages/core/dev-delivery-candidate-identity.js

@@ -4,8 +4,39 @@ import {
   devDeliveryPositiveInteger as positiveInteger,
   devDeliveryText as text,
 } from "./dev-delivery-common.js";
-
 export const CHAINED_ATTEMPT_IDENTITY = "chained-attempt-v2";
+const terminalBeforeChainCutover = (candidate, terminalStates) =>
+  terminalStates.has(candidate.status) &&
+  candidate.enqueuedAt < "2026-08-05T14:42:34.000Z";
+const UNCHAINED_SUCCESSOR =
+  "same-PR successor must chain the latest durable predecessor";
+export const EXACT_DEV_DELIVERY_PROOF_FIELDS = Object.freeze([
+  "sourcePatchRoot",
+  "sourceProofRoot",
+  "planRoot",
+  "closureRoot",
+  "dependencyRoot",
+  "toolchainRoot",
+  "environmentRoot",
+  "sourceWorkflowRunId",
+]);
+
+export function matchesExactDevDeliveryCandidate(existing, attempted) {
+  return (
+    existing.sourceHead === attempted.sourceHead &&
+    EXACT_DEV_DELIVERY_PROOF_FIELDS.every(
+      (field) => existing[field] === attempted[field],
+    ) &&
+    JSON.stringify(existing.affectedPaths || []) ===
+      JSON.stringify(attempted.affectedPaths || []) &&
+    JSON.stringify(existing.shardEvidenceRoots || []) ===
+      JSON.stringify(attempted.shardEvidenceRoots || []) &&
+    existing.nativeCommandContract?.commandRoot ===
+      attempted.nativeCommandContract?.commandRoot &&
+    existing.releaseBlockerPriority?.claimRoot ===
+      attempted.releaseBlockerPriority?.claimRoot
+  );
+}
 
 export function createDevDeliveryCandidateIdentity(
   input,
@@ -47,27 +78,24 @@ export function validateDevDeliveryCandidateChain(candidates, terminalStates) {
   const latestByPullRequest = new Map();
   for (const candidate of candidates) {
     const latest = latestByPullRequest.get(candidate.pullRequestNumber);
-    if (latest && candidate.identitySemantics !== CHAINED_ATTEMPT_IDENTITY) {
-      throw new Error(
-        "same-PR successor must chain the latest durable predecessor",
-      );
+    if (
+      latest &&
+      candidate.identitySemantics !== CHAINED_ATTEMPT_IDENTITY &&
+      (!terminalBeforeChainCutover(latest, terminalStates) ||
+        !terminalBeforeChainCutover(candidate, terminalStates))
+    ) {
+      throw new Error(UNCHAINED_SUCCESSOR);
     }
     if (candidate.identitySemantics === CHAINED_ATTEMPT_IDENTITY) {
       const predecessor = precedingCandidates.get(
         candidate.predecessorCandidateId,
       );
-      if (!predecessor)
-        throw new Error(
-          "chained candidate predecessor must appear earlier in the queue",
-        );
-      if (predecessor.pullRequestNumber !== candidate.pullRequestNumber) {
-        throw new Error(
-          "chained candidate predecessor must belong to the same pull request",
-        );
-      }
-      if (!terminalStates.has(predecessor.status)) {
-        throw new Error("chained candidate predecessor must be terminal");
-      }
+      // prettier-ignore
+      if (!predecessor) throw new Error("chained candidate predecessor must appear earlier in the queue");
+      // prettier-ignore
+      if (predecessor.pullRequestNumber !== candidate.pullRequestNumber) throw new Error("chained candidate predecessor must belong to the same pull request");
+      // prettier-ignore
+      if (!terminalStates.has(predecessor.status)) throw new Error("chained candidate predecessor must be terminal");
       if (latest?.candidateId !== predecessor.candidateId) {
         throw new Error(
           "chained candidate must bind the latest durable predecessor",

package/packages/core/dev-delivery-execution-transfer.js

@@ -38,7 +38,10 @@ const FAILURE_FILES = [
 ];
 
 const V4_RUNTIME_SELECTOR =
-  /^(?:v4|v4-alpha|train\/v4\/v4\.0\/[a-z0-9][a-z0-9._-]*)$/u;
+  /^(?:[0-9a-f]{40}|v4|v4-alpha|train\/v4\/v4\.0\/[a-z0-9][a-z0-9._-]*)$/u;
+
+const V4_RUNTIME_SELECTOR_DESCRIPTION =
+  "runtime selector must be an exact immutable SHA, v4, v4-alpha, or train/v4/v4.0/<capability>";
 
 function requiredFiles(outcome) {
   if (outcome === "succeeded") return SUCCESS_FILES;
@@ -163,9 +166,7 @@ function runtimeBinding(input = {}) {
     selectionRoot: exactRoot(input.selectionRoot, "runtime selection root"),
   };
   if (!V4_RUNTIME_SELECTOR.test(runtime.selector)) {
-    throw new Error(
-      "runtime selector must be v4, v4-alpha, or train/v4/v4.0/<capability>",
-    );
+    throw new Error(V4_RUNTIME_SELECTOR_DESCRIPTION);
   }
   return runtime;
 }
@@ -207,9 +208,7 @@ function verifiedRuntimeSelection(directory, expected = {}) {
     throw new Error("runtime selection is not exact canonical content");
   }
   if (!V4_RUNTIME_SELECTOR.test(normalized.selector)) {
-    throw new Error(
-      "runtime selector must be v4, v4-alpha, or train/v4/v4.0/<capability>",
-    );
+    throw new Error(V4_RUNTIME_SELECTOR_DESCRIPTION);
   }
   const selectionRoot = sha256Bytes(
     Buffer.from(`${JSON.stringify(normalized, null, 2)}\n`),

package/packages/core/dev-delivery-provider-heartbeat.js

@@ -138,14 +138,21 @@ function terminal(jobInput) {
 function heartbeatEntry(result, previousStateRoot) {
   const warrant = selectedWarrant(result);
   const receipt = result.receipt;
+  const expectedOldStateRoot = receipt?.expectedOldStateRoot;
+  const recovery = result.concurrencyRecovery;
+  const rebased = expectedOldStateRoot !== previousStateRoot;
   if (
     receipt?.action !== "heartbeat" ||
-    result.before?.stateRoot !== previousStateRoot ||
-    receipt.expectedOldStateRoot !== previousStateRoot ||
+    result.before?.stateRoot !== expectedOldStateRoot ||
     result.after?.stateRoot !== receipt.nextStateRoot ||
     result.observation?.stateRoot !== receipt.nextStateRoot ||
     warrant?.fencingToken !== receipt.fencingToken ||
-    warrant?.generation !== receipt.leaseGeneration
+    warrant?.generation !== receipt.leaseGeneration ||
+    (rebased &&
+      (recovery?.action !== "heartbeat-state-root-rebased" ||
+        recovery.requestedStateRoot !== previousStateRoot ||
+        recovery.observedStateRoot !== expectedOldStateRoot)) ||
+    (!rebased && recovery)
   ) {
     throw new Error(
       "durable provider heartbeat transition is not root-continuous",
@@ -155,8 +162,10 @@ function heartbeatEntry(result, previousStateRoot) {
     throw new Error("durable provider heartbeat receipt root drift");
   }
   return {
-    expectedOldStateRoot: receipt.expectedOldStateRoot,
+    previousStateRoot,
+    expectedOldStateRoot,
     nextStateRoot: receipt.nextStateRoot,
+    concurrencyRecovery: recovery || null,
     receipt,
     receiptRoot: result.receiptRoot,
     heartbeatAt: timestamp(warrant.heartbeatAt, "durable heartbeatAt"),
@@ -274,13 +283,20 @@ function verifyHeartbeatContinuity(receipt, initial) {
   let previousRoot = initial.stateRoot;
   let previousTime = Date.parse(receipt.initialHeartbeatAt);
   for (const entry of receipt.heartbeats) {
+    const rebased = entry.expectedOldStateRoot !== previousRoot;
+    const recovery = entry.concurrencyRecovery;
     if (
-      entry.expectedOldStateRoot !== previousRoot ||
+      entry.previousStateRoot !== previousRoot ||
       devDeliveryContentRoot(entry.receipt) !== entry.receiptRoot ||
       entry.receipt.expectedOldStateRoot !== entry.expectedOldStateRoot ||
       entry.receipt.nextStateRoot !== entry.nextStateRoot ||
       entry.receipt.fencingToken !== initial.fencingToken ||
-      entry.receipt.leaseGeneration !== initial.generation
+      entry.receipt.leaseGeneration !== initial.generation ||
+      (rebased &&
+        (recovery?.action !== "heartbeat-state-root-rebased" ||
+          recovery.requestedStateRoot !== previousRoot ||
+          recovery.observedStateRoot !== entry.expectedOldStateRoot)) ||
+      (!rebased && recovery)
     ) {
       throw new Error("provider heartbeat root continuity mismatch");
     }

package/packages/core/dev-delivery-warrant-legacy-recovery.js

@@ -0,0 +1,248 @@
+import {
+  devDeliveryClone as clone,
+  devDeliveryContentRoot,
+  devDeliveryExactRoot as exactRoot,
+  devDeliveryExactSha as exactSha,
+  devDeliveryPositiveInteger as positiveInteger,
+  devDeliveryText as text,
+  devDeliveryTimestamp as timestamp,
+} from "./dev-delivery-common.js";
+import {
+  TERMINAL_STATES,
+  normalizeDevDeliveryQueue,
+} from "./dev-delivery-warrant-state.js";
+
+export const LEGACY_TERMINAL_RECOVERY_REQUEST_SCHEMA =
+  "kungfu.buildchain.legacy-terminal-recovery-request/v1";
+export const LEGACY_HOSTED_TERMINAL_EVIDENCE_SCHEMA =
+  "kungfu.buildchain.legacy-hosted-terminal-evidence/v1";
+export const LEGACY_TERMINAL_RECOVERY_RECEIPT_SCHEMA =
+  "kungfu.buildchain.legacy-terminal-recovery-receipt/v1";
+
+function legacyLiveNativeCandidate(candidate) {
+  return (
+    !TERMINAL_STATES.has(candidate.status) &&
+    candidate.deliveryClass !== "non-native-fast" &&
+    (!candidate.environmentRoot || !candidate.nativeCommandContract)
+  );
+}
+
+function normalizeProviderJob(input, runAttempt) {
+  const job = {
+    id: positiveInteger(input?.id, "provider job id"),
+    name: text(input?.name),
+    runAttempt: positiveInteger(input?.runAttempt, "provider job runAttempt"),
+    status: text(input?.status).toLowerCase(),
+    conclusion: text(input?.conclusion).toLowerCase(),
+    completedAt: timestamp(input?.completedAt, "provider job completedAt"),
+  };
+  if (job.runAttempt !== runAttempt) {
+    throw new Error("legacy provider job run attempt mismatch");
+  }
+  if (job.status !== "completed" || !job.conclusion) {
+    throw new Error(
+      "legacy recovery requires every provider job to be terminal",
+    );
+  }
+  return job;
+}
+
+function normalizeEvidence(input) {
+  const runAttempt = positiveInteger(input?.runAttempt, "runAttempt");
+  if (!Array.isArray(input?.jobs) || input.jobs.length === 0) {
+    throw new Error("legacy terminal evidence requires provider jobs");
+  }
+  const jobs = input.jobs
+    .map((job) => normalizeProviderJob(job, runAttempt))
+    .sort((left, right) => left.id - right.id);
+  if (new Set(jobs.map((job) => job.id)).size !== jobs.length) {
+    throw new Error(
+      "legacy terminal evidence contains duplicate provider jobs",
+    );
+  }
+  if (!jobs.some((job) => job.conclusion === "failure")) {
+    throw new Error(
+      "legacy failed run evidence requires a failed provider job",
+    );
+  }
+  const runUpdatedAt = timestamp(input?.runUpdatedAt, "runUpdatedAt");
+  if (
+    jobs.some((job) => Date.parse(job.completedAt) > Date.parse(runUpdatedAt))
+  ) {
+    throw new Error("legacy provider job completion follows the run readback");
+  }
+  const body = {
+    schema: text(input?.schema),
+    candidateId: exactRoot(input?.candidateId, "candidateId"),
+    pullRequestNumber: positiveInteger(
+      input?.pullRequestNumber,
+      "pullRequestNumber",
+    ),
+    sourceHead: exactSha(input?.sourceHead, "sourceHead"),
+    sourceWorkflowRunId: positiveInteger(
+      input?.sourceWorkflowRunId,
+      "sourceWorkflowRunId",
+    ),
+    runAttempt,
+    runStatus: text(input?.runStatus).toLowerCase(),
+    runConclusion: text(input?.runConclusion).toLowerCase(),
+    runUpdatedAt,
+    totalJobCount: jobs.length,
+    nonterminalJobCount: 0,
+    workerTerminationProven: true,
+    jobs,
+    reason: text(input?.reason),
+  };
+  if (body.schema !== LEGACY_HOSTED_TERMINAL_EVIDENCE_SCHEMA) {
+    throw new Error(
+      `legacy terminal evidence must use ${LEGACY_HOSTED_TERMINAL_EVIDENCE_SCHEMA}`,
+    );
+  }
+  if (
+    body.runStatus !== "completed" ||
+    body.runConclusion !== "failure" ||
+    !body.reason
+  ) {
+    throw new Error(
+      "legacy terminal evidence requires one completed failed run with zero nonterminal jobs and proven worker termination",
+    );
+  }
+  const evidenceRoot = devDeliveryContentRoot(body);
+  if (exactRoot(input?.evidenceRoot, "evidenceRoot") !== evidenceRoot) {
+    throw new Error("legacy terminal evidence root mismatch");
+  }
+  return { ...body, evidenceRoot };
+}
+
+function assertExactCoverage(candidates, evidence) {
+  const expected = candidates.map((candidate) => candidate.candidateId).sort();
+  const observed = evidence.map((entry) => entry.candidateId).sort();
+  if (
+    expected.length !== observed.length ||
+    expected.some((candidateId, index) => candidateId !== observed[index])
+  ) {
+    throw new Error(
+      "legacy terminal recovery must cover every live legacy native candidate exactly once",
+    );
+  }
+}
+
+export function recoverLegacyTerminalDevDeliveryQueue(
+  queueInput,
+  requestInput,
+  { now = new Date().toISOString() } = {},
+) {
+  const currentTime = timestamp(now, "now");
+  const request = requestInput || {};
+  if (request.schema !== LEGACY_TERMINAL_RECOVERY_REQUEST_SCHEMA) {
+    throw new Error(
+      `legacy terminal recovery must use ${LEGACY_TERMINAL_RECOVERY_REQUEST_SCHEMA}`,
+    );
+  }
+  const before = normalizeDevDeliveryQueue(queueInput, {
+    allowLegacyV3Readback: true,
+  });
+  const expectedOldStateRoot = exactRoot(
+    request.expectedOldStateRoot,
+    "expectedOldStateRoot",
+  );
+  if (expectedOldStateRoot !== before.stateRoot) {
+    throw new Error("legacy terminal recovery expected-old state drift");
+  }
+  const legacyCandidates = before.candidates.filter(legacyLiveNativeCandidate);
+  if (legacyCandidates.length === 0) {
+    throw new Error("legacy terminal recovery found no live legacy candidate");
+  }
+  if (!Array.isArray(request.evidence)) {
+    throw new Error("legacy terminal recovery evidence must be an array");
+  }
+  const evidence = request.evidence.map(normalizeEvidence);
+  if (
+    new Set(evidence.map((entry) => entry.candidateId)).size !== evidence.length
+  ) {
+    throw new Error(
+      "legacy terminal recovery evidence contains duplicate candidates",
+    );
+  }
+  assertExactCoverage(legacyCandidates, evidence);
+
+  const queue = clone(before);
+  delete queue.stateRoot;
+  const transitions = [];
+  for (const entry of evidence) {
+    const candidate = queue.candidates.find(
+      (row) => row.candidateId === entry.candidateId,
+    );
+    if (
+      !candidate ||
+      candidate.pullRequestNumber !== entry.pullRequestNumber ||
+      candidate.sourceHead !== entry.sourceHead ||
+      candidate.sourceWorkflowRunId !== entry.sourceWorkflowRunId
+    ) {
+      throw new Error(
+        "legacy terminal evidence does not match candidate identity",
+      );
+    }
+    const active = queue.activeWarrant?.candidateId === candidate.candidateId;
+    if (!active && candidate.status !== "queued") {
+      throw new Error(
+        `legacy candidate status ${candidate.status} requires the exact active Warrant`,
+      );
+    }
+    const priorStatus = candidate.status;
+    candidate.status = "terminal-failure";
+    candidate.updatedAt = currentTime;
+    candidate.terminal = {
+      outcome: "terminal-failure",
+      reason: entry.reason,
+      evidenceRoot: entry.evidenceRoot,
+      authority: "legacy-hosted-native-terminal-recovery",
+      sourceWorkflowRunId: entry.sourceWorkflowRunId,
+      runAttempt: entry.runAttempt,
+      workerTerminationProven: true,
+      closedAt: currentTime,
+      ...(active
+        ? {
+            fencingToken: queue.activeWarrant.fencingToken,
+            leaseGeneration: queue.activeWarrant.generation,
+          }
+        : {}),
+    };
+    transitions.push({
+      candidateId: candidate.candidateId,
+      pullRequestNumber: candidate.pullRequestNumber,
+      sourceHead: candidate.sourceHead,
+      priorStatus,
+      activeWarrant: active,
+      outcome: "terminal-failure",
+      evidenceRoot: entry.evidenceRoot,
+    });
+  }
+  if (transitions.some((entry) => entry.activeWarrant))
+    queue.activeWarrant = null;
+  queue.generation += 1;
+  queue.updatedAt = currentTime;
+  queue.stateRoot = devDeliveryContentRoot(queue);
+  const after = normalizeDevDeliveryQueue(queue);
+  const requestBody = {
+    schema: LEGACY_TERMINAL_RECOVERY_REQUEST_SCHEMA,
+    expectedOldStateRoot,
+    evidence,
+  };
+  const requestRoot = devDeliveryContentRoot(requestBody);
+  const receipt = {
+    schema: LEGACY_TERMINAL_RECOVERY_RECEIPT_SCHEMA,
+    action: "legacy-terminal-recovery",
+    expectedOldStateRoot,
+    nextStateRoot: after.stateRoot,
+    requestRoot,
+    transitions,
+    nextAction:
+      "Continue the exact active Warrant, or select the next candidate.",
+  };
+  return {
+    queue: after,
+    receipt,
+    receiptRoot: devDeliveryContentRoot(receipt),
+  };
+}

package/packages/core/dev-delivery-warrant-native-compatibility.js

@@ -0,0 +1,33 @@
+export function lacksExactNativeExecutionContract(
+  candidate,
+  allowLegacyV3Readback = false,
+) {
+  const native =
+    candidate.deliveryClass !== "non-native-fast" ||
+    candidate.environmentRoot ||
+    candidate.nativeCommandContract;
+  return Boolean(
+    native &&
+    (!candidate.environmentRoot ||
+      (!candidate.nativeCommandContract && !allowLegacyV3Readback)),
+  );
+}
+
+export function lacksLiveNativeProof(
+  candidate,
+  status,
+  { allowLegacyV3Readback = false, allowLegacyQueuedReadback = false } = {},
+) {
+  return (
+    lacksExactNativeExecutionContract(candidate, allowLegacyV3Readback) &&
+    !(status === "queued" && allowLegacyQueuedReadback) &&
+    !TERMINAL_STATES.has(status)
+  );
+}
+const TERMINAL_STATES = new Set([
+  "merged",
+  "terminal-failure",
+  "dequeued",
+  "cancelled",
+  "superseded",
+]);

package/packages/core/dev-delivery-warrant-state.js

@@ -12,6 +12,8 @@ import {
 import {
   chainedDevDeliveryAttemptInput,
   createDevDeliveryCandidateIdentity,
+  EXACT_DEV_DELIVERY_PROOF_FIELDS,
+  matchesExactDevDeliveryCandidate,
   validateDevDeliveryCandidateChain,
 } from "./dev-delivery-candidate-identity.js";
 import {
@@ -19,6 +21,10 @@ import {
   normalizeNativeCommandContract,
   validateActiveDevDeliveryWarrant,
 } from "./dev-delivery-native-proof.js";
+import {
+  lacksExactNativeExecutionContract,
+  lacksLiveNativeProof,
+} from "./dev-delivery-warrant-native-compatibility.js";
 import {
   normalizeProviderFailureAuthorityBinding,
   normalizeTerminalEvidenceCorrection,
@@ -34,6 +40,8 @@ export const DEV_DELIVERY_WARRANT_SCHEMA =
   "kungfu.buildchain.dev-delivery-warrant/v1";
 export const DEV_DELIVERY_SUBMISSION_RECEIPT_SCHEMA =
   "kungfu.buildchain.dev-delivery-submission-receipt/v1";
+export const DEV_DELIVERY_MINIMUM_WRITER_PROTOCOL_ROOT =
+  "sha256:54a203cadf0b14d4e3c198a3cc3c177c42813aa1c0cca03e900df714b6ae5563";
 export const DEV_DELIVERY_SELECTION_RECEIPT_SCHEMA =
   "kungfu.buildchain.dev-delivery-selection-receipt/v1";
 export const DEV_DELIVERY_LEASE_RECEIPT_SCHEMA =
@@ -146,7 +154,7 @@ function exactRoots(values, label) {
   return [...new Set(values.map((value) => exactRoot(value, label)))].sort();
 }
 function normalizePolicy(policy = {}) {
-  return {
+  const normalized = {
     agingSeconds: positiveInteger(
       policy.agingSeconds,
       "policy agingSeconds",
@@ -160,22 +168,17 @@ function normalizePolicy(policy = {}) {
     ),
     emergencyPolicy: text(policy.emergencyPolicy || "reviewed-explicit-only"),
   };
+  if (Object.hasOwn(policy, "minimumWriterProtocolRoot")) {
+    const root = exactRoot(
+      policy.minimumWriterProtocolRoot,
+      "policy minimumWriterProtocolRoot",
+    );
+    if (root !== DEV_DELIVERY_MINIMUM_WRITER_PROTOCOL_ROOT)
+      throw new Error("unsupported dev delivery minimum writer protocol");
+    normalized.minimumWriterProtocolRoot = root;
+  }
+  return normalized;
 }
-
-function lacksLiveNativeProof(candidate, status, allowLegacyV3Readback) {
-  const { environmentRoot, nativeCommandContract } = candidate;
-  const native =
-    candidate.deliveryClass !== "non-native-fast" ||
-    environmentRoot ||
-    nativeCommandContract;
-  return (
-    native &&
-    (!environmentRoot ||
-      (!nativeCommandContract && allowLegacyV3Readback !== true)) &&
-    !TERMINAL_STATES.has(status)
-  );
-}
-
 function normalizeCandidate(input, expected) {
   const identity = createDevDeliveryCandidateIdentity(
     input,
@@ -274,7 +277,12 @@ function normalizeCandidate(input, expected) {
       "candidate shardEvidenceRoots",
     );
   }
-  if (lacksLiveNativeProof(candidate, status, expected.allowLegacyV3Readback))
+  if (
+    lacksLiveNativeProof(candidate, status, {
+      allowLegacyV3Readback: expected.allowLegacyV3Readback,
+      allowLegacyQueuedReadback: expected.allowLegacyQueuedNativeReadback,
+    })
+  )
     throw new Error("live native candidate requires exact native proof");
   if (Object.hasOwn(input, "releaseBlockerPriority"))
     candidate.releaseBlockerPriority = normalizeReleaseBlockerPriorityClaim(
@@ -308,7 +316,10 @@ export function createDevDeliveryQueue({
     protectedBase: protectedBase(protectedBaseInput),
     generation: 0,
     fencingCounter: 0,
-    policy: normalizePolicy(policy),
+    policy: {
+      ...normalizePolicy(policy),
+      minimumWriterProtocolRoot: DEV_DELIVERY_MINIMUM_WRITER_PROTOCOL_ROOT,
+    },
     activeWarrant: null,
     candidates: [],
     updatedAt: timestamp(now, "now"),
@@ -344,16 +355,19 @@ export function normalizeDevDeliveryQueue(input, expected = {}) {
     "queue fencingCounter",
   );
   queue.policy = normalizePolicy(queue.policy);
+  const hasExecutionReceipt = !!queue.activeWarrant?.nativeExecutionReceiptRoot;
+  const hasQualificationReceipt =
+    !!queue.activeWarrant?.qualificationReceiptRoot;
   const allowLegacyV3Readback =
     expected.allowLegacyV3Readback === true &&
-    !(queue.candidates || []).some(
-      (candidate) => candidate?.nativeCommandContract,
-    ) &&
-    !queue.activeWarrant?.nativeCommandContract &&
-    !queue.activeWarrant?.nativeExecutionReceiptRoot &&
-    !queue.activeWarrant?.qualificationReceiptRoot;
+    hasExecutionReceipt === hasQualificationReceipt;
+  const candidateExpected = {
+    ...queue,
+    allowLegacyV3Readback,
+    allowLegacyQueuedNativeReadback: true,
+  };
   queue.candidates = (queue.candidates || []).map((candidate) =>
-    normalizeCandidate(candidate, { ...queue, allowLegacyV3Readback }),
+    normalizeCandidate(candidate, candidateExpected),
   );
   validateDevDeliveryCandidateChain(queue.candidates, TERMINAL_STATES);
   queue.updatedAt = timestamp(queue.updatedAt, "queue updatedAt");
@@ -380,6 +394,8 @@ export function transitionDevDeliveryQueue(queueInput, mutate, nowInput) {
   delete queue.stateRoot;
   const now = timestamp(nowInput, "now");
   const result = mutate(queue, before, now);
+  if (result.preserveState)
+    return { before, after: before, expectedOldStateRoot, result };
   queue.generation += 1;
   queue.updatedAt = now;
   const after = withQueueRoot(queue);
@@ -478,34 +494,14 @@ export function submitDevDeliveryCandidate(
             `candidate ${attemptedCandidate.candidateId} is terminal and cannot be resubmitted`,
           );
         }
-        const exactProofFields = [
-          "sourcePatchRoot",
-          "sourceProofRoot",
-          "planRoot",
-          "closureRoot",
-          "dependencyRoot",
-          "toolchainRoot",
-          "environmentRoot",
-          "sourceWorkflowRunId",
-        ];
-        const exactProofMatches =
-          exactProofFields.every(
-            (field) => existing[field] === attemptedCandidate[field],
-          ) &&
-          JSON.stringify(existing.affectedPaths || []) ===
-            JSON.stringify(attemptedCandidate.affectedPaths || []) &&
-          JSON.stringify(existing.shardEvidenceRoots || []) ===
-            JSON.stringify(attemptedCandidate.shardEvidenceRoots || []) &&
-          existing.nativeCommandContract?.commandRoot ===
-            attemptedCandidate.nativeCommandContract?.commandRoot &&
-          existing.releaseBlockerPriority?.claimRoot ===
-            attemptedCandidate.releaseBlockerPriority?.claimRoot;
-        if (
-          existing.sourceHead === attemptedCandidate.sourceHead &&
-          exactProofMatches
-        ) {
-          action = "duplicate-noop";
+        if (matchesExactDevDeliveryCandidate(existing, attemptedCandidate)) {
+          action =
+            before.activeWarrant?.candidateId === existing.candidateId
+              ? "active-warrant-noop"
+              : "duplicate-noop";
           selected = existing;
+          if (action === "active-warrant-noop")
+            return { candidate: selected, action, preserveState: true };
         } else {
           if (before.activeWarrant?.candidateId === existing.candidateId) {
             throw new Error(
@@ -515,7 +511,7 @@ export function submitDevDeliveryCandidate(
           const headChanged =
             existing.sourceHead !== attemptedCandidate.sourceHead;
           existing.sourceHead = attemptedCandidate.sourceHead;
-          for (const field of exactProofFields)
+          for (const field of EXACT_DEV_DELIVERY_PROOF_FIELDS)
             existing[field] = attemptedCandidate[field];
           if (attemptedCandidate.nativeCommandContract)
             existing.nativeCommandContract =
@@ -585,7 +581,11 @@ export function rankDevDeliveryCandidates(
   });
   const currentTime = timestamp(now, "now");
   return queue.candidates
-    .filter((candidate) => candidate.status === "queued")
+    .filter(
+      (candidate) =>
+        candidate.status === "queued" &&
+        !lacksExactNativeExecutionContract(candidate),
+    )
     .map((candidate) => ({
       candidate,
       priority: effectivePriority(candidate, queue.policy, currentTime),

package/packages/core/dev-delivery-warrant.js

@@ -29,6 +29,7 @@ import {
   DEV_DELIVERY_QUEUE_CONTRACT,
   DEV_DELIVERY_SELECTION_RECEIPT_SCHEMA,
   DEV_DELIVERY_SUBMISSION_RECEIPT_SCHEMA,
+  DEV_DELIVERY_MINIMUM_WRITER_PROTOCOL_ROOT,
   DEV_DELIVERY_WARRANT_SCHEMA,
   TERMINAL_STATES,
   createDevDeliveryQueue,
@@ -38,6 +39,10 @@ import {
   submitDevDeliveryCandidate,
   transitionDevDeliveryQueue as transition,
 } from "./dev-delivery-warrant-state.js";
+import {
+  DEV_DELIVERY_WRITER_PROTOCOL_FENCE_RECEIPT_SCHEMA,
+  fenceDevDeliveryWriterProtocol,
+} from "./dev-delivery-writer-protocol-transition.js";
 
 export { devDeliveryContentRoot } from "./dev-delivery-common.js";
 export {
@@ -85,8 +90,11 @@ export {
   DEV_DELIVERY_QUEUE_CONTRACT,
   DEV_DELIVERY_SELECTION_RECEIPT_SCHEMA,
   DEV_DELIVERY_SUBMISSION_RECEIPT_SCHEMA,
+  DEV_DELIVERY_MINIMUM_WRITER_PROTOCOL_ROOT,
+  DEV_DELIVERY_WRITER_PROTOCOL_FENCE_RECEIPT_SCHEMA,
   DEV_DELIVERY_WARRANT_SCHEMA,
   createDevDeliveryQueue,
+  fenceDevDeliveryWriterProtocol,
   normalizeDevDeliveryQueue,
   rankDevDeliveryCandidates,
   submitDevDeliveryCandidate,