@kungfu-tech/buildchain 4.0.2-alpha.0 → 4.0.2-alpha.11

package/scripts/check-inventory.mjs

@@ -127,7 +127,6 @@ const requiredPaths = [
   "scripts/npm-publish-transaction.mjs",
   "scripts/paper.mjs",
   "scripts/publication-package.mjs",
-  "scripts/publication-commit-evidence.mjs",
   "scripts/publication-reproducibility.mjs",
   "scripts/release-candidate-resolver.mjs",
   "scripts/resume-from-candidate-run.mjs",
@@ -300,8 +299,8 @@ if (channelPromotionWorkflow !== generateChannelPromotionWorkflow(advancedPromot
   throw new Error("generated channel promotion workflow is stale");
 }
 for (const requiredSnippet of [
-  "uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@alpha/v4/v4.0",
-  "promotion-shell-ref: ${{ needs.consumer-admission.outputs.shell-call-ref }}",
+  "name: Adapt recovery inputs into the canonical v4 publisher",
+  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha",
   "declarative-release-tail: true",
 ]) {
   if (!boundedAlphaRecoveryWorkflow.includes(requiredSnippet)) {
@@ -316,8 +315,8 @@ for (const workflowSource of [boundedAlphaRecoveryWorkflow, channelPromotionWork
 for (const requiredSnippet of [
   "buildchain-channel:",
   `/${promotionShellRouting.alpha.workflowPath}@${promotionShellRouting.alpha.callRef}`,
-  `/${promotionShellRouting.stable.workflowPath}@${promotionShellRouting.stable.callRef}`,
-  `STABLE_SHELL_REF: v${selfDogfoodMajor}`,
+  `SELECTED_SHELL_REF: v${selfDogfoodMajor}-alpha`,
+  "name: Invoke the single v4 publisher adapter",
   "promotion-contract-lock-digest:",
   "authorize-promotion-runtime-override.cjs",
   "BUILDCHAIN_ROUTER_REPOSITORY: ${{ inputs.buildchain-repository }}",
@@ -329,6 +328,9 @@ for (const requiredSnippet of [
     throw new Error(`channel promotion workflow missing routing contract: ${requiredSnippet}`);
   }
 }
+if (channelPromotionWorkflow.includes("Promote with stable workflow shell")) {
+  throw new Error("channel promotion workflow retains a parallel stable publisher");
+}
 for (const forbiddenSnippet of ["job.workflow_repository", "job.workflow_sha"]) {
   if (channelPromotionWorkflow.includes(forbiddenSnippet)) {
     throw new Error(`channel promotion workflow uses unsupported GitHub context: ${forbiddenSnippet}`);
@@ -1046,7 +1048,6 @@ for (const requiredSnippet of [
   "resume-candidate-run-id:",
   "resume-expected-source-tree:",
   "resume-buildchain-runtime-ref:",
-  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4",
   "release-passport-buildchain-self-kfd: true",
   "declarative-release-tail: true",
   "release-passport-impact-json: .buildchain/release-impact.json",
@@ -1057,61 +1058,28 @@ for (const requiredSnippet of [
 }
 const releaseCandidatePromoteWorkflow = fs.readFileSync(path.join(root, ".github/workflows/.release-candidate-promote.yml"), "utf8");
 for (const requiredSnippet of [
-  "release-passport-kfd-1-witness-jsons:",
-  "release-passport-kfd-1-witness-jsons: ${{ inputs.release-passport-kfd-1-witness-jsons }}",
-  "release-passport-kfd-2-claim-jsons:",
-  "release-passport-kfd-2-claim-jsons: ${{ inputs.release-passport-kfd-2-claim-jsons }}",
-  "release-passport-kfd-3-prebuild-witness-jsons:",
-  "release-passport-kfd-3-prebuild-witness-jsons: ${{ inputs.release-passport-kfd-3-prebuild-witness-jsons }}",
-  "release-passport-kfd-3-artifact-witness-jsons:",
-  "release-passport-kfd-3-artifact-witness-jsons: ${{ inputs.release-passport-kfd-3-artifact-witness-jsons }}",
-  "release-passport-kfd-3-artifact-verify-command:",
-  "release-passport-kfd-adopter-manifest-json:", "release-passport-kfd-adopter-manifest-json: ${{ inputs.release-passport-kfd-adopter-manifest-json }}",
-  "release-passport-kfd-support-matrix-json:", "release-passport-kfd-support-matrix-json: ${{ inputs.release-passport-kfd-support-matrix-json }}",
-  "release-passport-kfd-product-gate-jsons:",
-  "release-passport-kfd-product-gate-jsons: ${{ inputs.release-passport-kfd-product-gate-jsons }}",
-  "release-passport-invariant-passport-jsons:",
-  "release-passport-invariant-passport-jsons: ${{ inputs.release-passport-invariant-passport-jsons }}",
-  "release-passport-invariant-passport-command:",
-  "release-passport-invariant-passport-command: ${{ inputs.release-passport-invariant-passport-command }}",
-  "release-passport-buildchain-self-kfd:",
-  "release-passport-buildchain-self-kfd: ${{ inputs.release-passport-buildchain-self-kfd }}",
-  "github-release:",
-  "default: true",
-  "github-release: ${{ inputs.github-release }}",
-  "github-release-payload-patterns:",
-  "github-release-artifact-paths: ${{ steps.rc.outputs.release-candidate-github-release-artifact-paths }}",
-  "github-release-title: ${{ inputs.github-release-title }}",
-  "github-release-notes: ${{ inputs.github-release-notes }}",
-  "publication-commit-command:",
-  "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY:",
-  "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY:",
-  "Commit consumer publication authority last",
-  "node .buildchain/runtime/scripts/publication-commit-evidence.mjs",
-  "require-publish-source-lock: \"true\"",
-  "publish-source-ref: ${{ steps.publish-gate.outputs.ref }}",
-  "publish-source-sha: ${{ steps.publish-gate.outputs.sha }}",
-  "publish-source-locked: ${{ steps.publish-gate.outputs.locked }}",
-  "expected-publication-version: ${{ needs.publication-plan.outputs.version }}",
-  "publication-version: ${{ needs.publication-plan.outputs.version }}",
-  "name: Plan exact publication version",
-  "name: Install exact publication planning dependencies",
-  "DRY_RUN: ${{ inputs.dry-run }}",
-  "if (dryRun) {",
-  "Enforce Buildchain stable release canary gate",
-  "BUILDCHAIN_STABLE_RELEASE_POLICY: .buildchain/stable-release-policy.json",
-  "Consumer has no binary-distribution.yml; standalone binary dispatch is not applicable.",
-  "gh workflow view binary-distribution.yml",
-  "resume-candidate-run-id:",
-  "node .buildchain/runtime/scripts/resume-from-candidate-run.mjs",
-  "publish-sealed-bundle-root: ${{ steps.rc.outputs.publish-sealed-bundle-root }}",
-  "BUILDCHAIN_EXPECTED_TRANSACTION_ID: ${{ inputs.resume-transaction-id }}",
-  "if: ${{ inputs.resume-candidate-run-id == '' }}",
-  "Bridge Buildchain self-runtime dependencies",
-  "ln -s .buildchain/runtime/node_modules node_modules",
+  "name: QUALIFY canonical v4 release invocation inputs",
+  "name: APPLY one rooted provider transaction",
+  "name: SETTLE terminal ReleaseReceipt projection",
+  "uses: ./.buildchain/runtime/actions/v4-release-candidate-promote",
+  "publisher-workflow-sha:",
+  "runtime-commit:",
+  "runtime-tree:",
+  "release-invocation-root:",
+  "release-transaction-root:",
+  "release-receipt-root:",
 ]) {
   if (!releaseCandidatePromoteWorkflow.includes(requiredSnippet)) {
-    throw new Error(`release candidate promote workflow missing KFD gate pass-through: ${requiredSnippet}`);
+    throw new Error(`release candidate promote workflow missing canonical v4 boundary: ${requiredSnippet}`);
+  }
+}
+for (const retiredSnippet of [
+  "Commit consumer publication authority last",
+  "publish-github-artifact-attestation-evidence.mjs",
+  "capture-package-release-propagation.mjs",
+]) {
+  if (releaseCandidatePromoteWorkflow.includes(retiredSnippet)) {
+    throw new Error(`release candidate promote workflow retains parallel publication authority: ${retiredSnippet}`);
   }
 }
 const workflowDir = path.join(root, ".github/workflows");

package/scripts/check-maintainability.mjs

@@ -19,18 +19,28 @@ import {
   evaluateTestBudgets,
   evaluateWorkflowBudgets,
 } from "./maintainability-governance.mjs";
+import { governUniversalFacadeWorkflowMetrics } from "./universal-facade-maintainability.mjs";
+import { evaluatePublicSurface } from "./maintainability-public-surface.mjs";
 
-function collectHotspots(root, current, limit = 20, shallowFallback = []) {
+function collectHotspots(
+  root,
+  current,
+  limit = 20,
+  shallowFallback = [],
+  {
+    baseRef = process.env.GITHUB_BASE_REF || process.env.GITHUB_REF_NAME || "",
+  } = {},
+) {
   const maintained = new Set([
     ...Object.keys(current.files || {}),
     ...Object.keys(current.tests || {}),
     ...Object.keys(current.workflows || {}),
   ]);
-  // Shallow consumers cannot reproduce repository-wide churn ranking.
-  // Reuse the audited routes; full clones still re-rank them below.
-  // This keeps consumer verification deterministic without inventing history.
+  // Release-line reconciliation reuses audited routes across equivalent-tree DAG shapes.
   if (
-    gitOutput(root, ["rev-parse", "--is-shallow-repository"]).trim() === "true"
+    gitOutput(root, ["rev-parse", "--is-shallow-repository"]).trim() ===
+      "true" ||
+    /^(?:alpha|release|publish-gate)\//u.test(baseRef)
   ) {
     return shallowFallback.slice(0, limit);
   }
@@ -154,116 +164,6 @@ function selectedFunction(metrics, file, name) {
   return metrics.files[file]?.functions.find((entry) => entry.name === name);
 }
 
-function readJsonAtRevision(root, revision, file) {
-  return JSON.parse(gitOutput(root, ["show", `${revision}:${file}`]));
-}
-
-function publicSurfaceContract(entry, kind) {
-  if (kind === "cli") return { id: entry.id, usage: entry.usage };
-  if (kind === "node")
-    return {
-      export: entry.export,
-      specifier: entry.specifier,
-      target: entry.target,
-    };
-  return {
-    id: entry.id,
-    path: entry.path,
-    reusable: entry.reusable,
-    inputs: entry.inputs || [],
-    secrets: entry.secrets || [],
-    outputs: entry.outputs || [],
-  };
-}
-
-function evaluatePublicSurface({ root, revision, policy }) {
-  const issues = [];
-  const lifecycleFields = policy.publicSurfacePolicy.requiredLifecycleFields;
-  const capabilityGroups = new Set(
-    readJson(root, "dist/site/capability-registry.json").groups.map(
-      (entry) => entry.id,
-    ),
-  );
-  const definitions = [
-    {
-      file: "dist/site/cli-registry.json",
-      collection: "commands",
-      kind: "cli",
-      key: "id",
-    },
-    {
-      file: "dist/site/node-api-registry.json",
-      collection: "exports",
-      kind: "node",
-      key: "export",
-    },
-    {
-      file: "dist/site/workflow-registry.json",
-      collection: "workflows",
-      kind: "workflow",
-      key: "id",
-    },
-    {
-      file: "dist/site/workflow-registry.json",
-      collection: "actions",
-      kind: "action",
-      key: "id",
-    },
-  ];
-  for (const definition of definitions) {
-    const current =
-      readJson(root, definition.file)[definition.collection] || [];
-    const baseline =
-      readJsonAtRevision(root, revision, definition.file)[
-        definition.collection
-      ] || [];
-    const baselineByKey = new Map(
-      baseline.map((entry) => [entry[definition.key], entry]),
-    );
-    for (const entry of current) {
-      const label = `${definition.kind}:${entry[definition.key]}`;
-      for (const field of lifecycleFields) {
-        if (
-          !Object.prototype.hasOwnProperty.call(entry, field) ||
-          typeof entry[field] !== "string"
-        ) {
-          issues.push(`${label}: lifecycle field ${field} is missing`);
-        }
-      }
-      if (!capabilityGroups.has(entry.capabilityGroup)) {
-        issues.push(
-          `${label}: capability group ${entry.capabilityGroup || "<empty>"} is not registered`,
-        );
-      }
-      const previous = baselineByKey.get(entry[definition.key]);
-      const currentContract = publicSurfaceContract(entry, definition.kind);
-      if (
-        previous &&
-        JSON.stringify(currentContract) !==
-          JSON.stringify(publicSurfaceContract(previous, definition.kind))
-      ) {
-        const approval = policy.approvedPublicSurfaceTransitions?.[label];
-        const approved =
-          approval?.fromRevision === revision &&
-          String(approval?.rationale || "").trim() &&
-          JSON.stringify(approval?.contract) ===
-            JSON.stringify(currentContract);
-        if (!approved) {
-          issues.push(
-            `${label}: existing public contract drifted from ${revision}`,
-          );
-        }
-      }
-      if (!previous && !entry.nonDuplicationRationale) {
-        issues.push(
-          `${label}: new public surface requires a non-duplication rationale`,
-        );
-      }
-    }
-  }
-  return issues;
-}
-
 function evaluateAddedFunctionBudgets({
   file,
   metrics,
@@ -489,12 +389,18 @@ function checkMaintainability({ root = process.cwd() } = {}) {
     root,
     extendedCoverageRevision,
   );
+  const { governed: governedCurrent, migration: facadeMigration } =
+    governUniversalFacadeWorkflowMetrics({
+      root,
+      current,
+      workflowMetricsAtRevision,
+    });
   const issues = evaluateExceptionGovernance({ policy });
   issues.push(...evaluateExceptionBudget({ policy }));
   const hotspots = collectHotspots(root, current, 20, debt.hotspots || []);
   issues.push(
     ...evaluateDebtAuthority({
-      current,
+      current: governedCurrent,
       policy,
       debt,
       capabilityIds: new Set(
@@ -510,14 +416,19 @@ function checkMaintainability({ root = process.cwd() } = {}) {
   );
   issues.push(
     ...evaluateWorkflowBudgets({
-      current,
+      current: governedCurrent,
       baselineFiles: baselineWorkflows,
       policy,
     }),
   );
   issues.push(...evaluateRepositoryBudgets({ current, policy }));
   issues.push(
-    ...evaluatePublicSurface({ root, revision: enforcementRevision, policy }),
+    ...evaluatePublicSurface({
+      root,
+      revision: enforcementRevision,
+      policy,
+      migration: facadeMigration,
+    }),
   );
   if (issues.length > 0) {
     throw new Error(`maintainability check failed:\n- ${issues.join("\n- ")}`);

package/scripts/check-v3-v4-capability-inventory.mjs

@@ -8,6 +8,7 @@ import {
   collectHistoryRows,
   collectRevisionCatalog,
   countsBy,
+  ensureCapabilityCutLineage,
   git,
   sha256,
 } from "./v3-v4-capability-catalog.mjs";
@@ -17,9 +18,8 @@ export const V3_V4_CAPABILITY_INVENTORY_CONTRACT =
 export const V3_V4_CAPABILITY_CUTS = Object.freeze({
   priorFamilyV3: "6b96bdad8d9f8ccf9275f27d9370a226a9c78465",
   liveV3: "8493bf140a7f567e76aff3119f3d39ff026afc84",
-  liveV4: "11b4ab21405cdffcc9d6dc10cd947618d9d1bf9c",
+  liveV4: "97edd5b93eb67e5bf36ad55726e08231b47b70c0",
 });
-
 const INVENTORY_PATH = "architecture/v3-v4-live-capability-inventory.json";
 const ALLOWED_DISPOSITIONS = new Set([
   "v4-native",
@@ -92,64 +92,6 @@ function capabilityCutAvailable(root, revision) {
   }
 }
 
-export function assertCapabilityCutAncestor({
-  root = process.cwd(),
-  revision,
-  descendant = "HEAD",
-  label = "capability cut",
-} = {}) {
-  try {
-    execFileSync("git", ["merge-base", "--is-ancestor", revision, descendant], {
-      cwd: root,
-      stdio: "ignore",
-    });
-  } catch {
-    throw new Error(
-      `${label} ${revision} must be an ancestor of ${descendant}; regenerate the cut after rebasing instead of relying on a retained local object`,
-    );
-  }
-}
-
-function repositoryIsShallow(root) {
-  return (
-    execFileSync("git", ["rev-parse", "--is-shallow-repository"], {
-      cwd: root,
-      encoding: "utf8",
-    }).trim() === "true"
-  );
-}
-
-export function ensureCapabilityCutAncestor({
-  root = process.cwd(),
-  revision,
-  descendant = "HEAD",
-  label = "capability cut",
-} = {}) {
-  try {
-    assertCapabilityCutAncestor({ root, revision, descendant, label });
-    return;
-  } catch (error) {
-    if (!repositoryIsShallow(root)) throw error;
-  }
-  const descendantCommit = execFileSync(
-    "git",
-    ["rev-parse", `${descendant}^{commit}`],
-    { cwd: root, encoding: "utf8" },
-  ).trim();
-  try {
-    execFileSync(
-      "git",
-      ["fetch", "--no-tags", "--depth=128", "origin", descendantCommit],
-      { cwd: root, stdio: "ignore" },
-    );
-  } catch {
-    throw new Error(
-      `${label} ${revision} ancestry could not be hydrated from ${descendantCommit} through a bounded origin fetch`,
-    );
-  }
-  assertCapabilityCutAncestor({ root, revision, descendant, label });
-}
-
 function ensureCapabilityCutsAvailable(root) {
   const revisions = Object.values(V3_V4_CAPABILITY_CUTS);
   const missing = revisions.filter(
@@ -170,7 +112,7 @@ function ensureCapabilityCutsAvailable(root) {
       `v3/v4 capability cuts are unavailable after a bounded origin fetch: ${unavailable.join(", ")}`,
     );
   }
-  ensureCapabilityCutAncestor({
+  ensureCapabilityCutLineage({
     root,
     revision: V3_V4_CAPABILITY_CUTS.liveV4,
     label: "live v4 capability cut",

package/scripts/check-v4-floating-consumer-policy-contract.mjs

@@ -52,16 +52,11 @@ function assertOrdered(relative, markers) {
 
 export function assertPromotionCertificationWiring(source) {
   for (const marker of [
-    "path: .buildchain/runtime/candidate-policy-runtime",
-    "BUILDCHAIN_EXPECTED_RUNTIME_SHA: ${{ steps.v4-policy-caller.outputs.runtime-sha }}",
-    "policy_runtime=.buildchain/runtime",
-    'node "${policy_runtime}/scripts/v4-consumer-policy.mjs" certify',
-    "passport.consumerPolicy?.receipt?.caller?.sourceSha",
-    "path: .buildchain/runtime/policy-caller",
-    '--caller-root "${{ github.workspace }}/.buildchain/runtime/policy-caller"',
-    '--stable-lock "${{ inputs.buildchain-stable-contract-lock-path }}"',
-    '--alpha-lock "${{ inputs.buildchain-alpha-contract-lock-path }}"',
-    "release-passport-v4-consumer-policy-certification-root: ${{ steps.v4-policy-certification.outputs.v4-consumer-policy-certification-root }}",
+    "Translate and admit legacy-compatible inputs",
+    "BUILDCHAIN_PROMOTION_INPUTS_JSON: ${{ toJSON(inputs) }}",
+    "Resolve and qualify the sealed release candidate",
+    "BUILDCHAIN_RUNTIME_AUTHORIZATION_JSON",
+    "QUALIFY canonical v4 release invocation inputs",
   ]) {
     if (!source.includes(marker)) {
       fail(`promotion certification is missing ${marker}`);
@@ -165,8 +160,7 @@ export function checkV4FloatingConsumerPolicyContract() {
   const promotion = read(".github/workflows/release-candidate-promote.yml");
   if (
     !promotion.includes("consumer-admission:") ||
-    !jobDependsOn(promotion, "alpha", "consumer-admission") ||
-    !jobDependsOn(promotion, "stable", "consumer-admission")
+    !jobDependsOn(promotion, "invoke", "consumer-admission")
   ) {
     fail(
       "release candidate promotion is not transitively gated by consumer admission",
@@ -179,16 +173,12 @@ export function checkV4FloatingConsumerPolicyContract() {
     ["packages/core/release-candidate.js", "consumerPolicy"],
     ["packages/core/release-passport.js", "v4ConsumerPolicy"],
     [
-      "actions/promote-buildchain-ref/action.yml",
-      "release-passport-v4-consumer-policy-certification-json",
+      "actions/v4-release-candidate-promote/index.js",
+      "candidate.consumerPolicy?.receiptRoot",
     ],
     [
-      "actions/promote-buildchain-ref/action.yml",
-      "release-passport-v4-consumer-policy-certification-root",
-    ],
-    [
-      ".github/workflows/.release-candidate-promote.yml",
-      "v4-policy-certification",
+      "actions/v4-release-candidate-promote/index.js",
+      "createV4ReleaseInvocation",
     ],
   ]) {
     if (!read(relative).includes(marker)) {