@kungfu-tech/buildchain 4.0.2-alpha.0 → 4.0.2-alpha.11

package/scripts/check-v4-universal-workflow-bootstrap.mjs

@@ -0,0 +1,257 @@
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const contract = JSON.parse(
+  fs.readFileSync(
+    path.join(root, "architecture/v4-universal-workflow-bootstrap.json"),
+    "utf8",
+  ),
+);
+const admissionPolicy = JSON.parse(
+  fs.readFileSync(
+    path.join(root, "architecture/v4-universal-workflow-train-admission.json"),
+    "utf8",
+  ),
+);
+const fileRoot = (relative) =>
+  `sha256:${crypto
+    .createHash("sha256")
+    .update(fs.readFileSync(path.join(root, relative)))
+    .digest("hex")}`;
+
+const workflowRoot = path.join(root, ".github/workflows");
+const discovered = fs
+  .readdirSync(workflowRoot)
+  .filter((name) => /\.ya?ml$/u.test(name))
+  .map((name) => `.github/workflows/${name}`)
+  .filter((relative) =>
+    /(?:^|\n)\s*workflow_call:\s*(?:\n|$)/u.test(
+      fs.readFileSync(path.join(root, relative), "utf8"),
+    ),
+  )
+  .sort();
+
+assert.equal(
+  contract.schema,
+  "kungfu-buildchain-v4-universal-workflow-bootstrap/v1",
+);
+assert.deepEqual(
+  contract.inventoryWorkflows,
+  [...new Set(contract.inventoryWorkflows)].sort(),
+  "inventoried public workflows must be sorted and duplicate-free",
+);
+assert.deepEqual(
+  contract.inventoryWorkflows,
+  discovered,
+  "every active public workflow_call surface must be inventoried",
+);
+for (const relative of contract.inventoryWorkflows)
+  assert.ok(
+    fs.statSync(path.join(root, relative)).isFile(),
+    `inventoried workflow is unavailable: ${relative}`,
+  );
+assert.deepEqual(
+  contract.bootstrapGovernedWorkflows,
+  [...new Set(contract.bootstrapGovernedWorkflows)].sort(),
+  "Bootstrap-governed workflows must be sorted and duplicate-free",
+);
+assert.deepEqual(
+  contract.retiredWorkflowSurfaces,
+  [...new Set(contract.retiredWorkflowSurfaces)].sort(),
+  "retired workflow surfaces must be sorted and duplicate-free",
+);
+for (const relative of contract.retiredWorkflowSurfaces) {
+  assert.ok(
+    contract.inventoryWorkflows.includes(relative),
+    `retired workflow is outside the inventory: ${relative}`,
+  );
+  assert.match(
+    fs.readFileSync(path.join(root, relative), "utf8"),
+    /retired/u,
+    `retired workflow does not fail closed explicitly: ${relative}`,
+  );
+}
+const activeWorkflows = contract.inventoryWorkflows.filter(
+  (relative) =>
+    !contract.retiredWorkflowSurfaces.includes(relative) &&
+    relative !== contract.bootstrap.consumerRecoveryWorkflow,
+);
+assert.deepEqual(
+  contract.bootstrapGovernedWorkflows,
+  activeWorkflows,
+  "every active public reusable workflow must be Bootstrap-governed",
+);
+for (const relative of contract.bootstrapGovernedWorkflows) {
+  assert.ok(
+    contract.inventoryWorkflows.includes(relative),
+    `Bootstrap-governed workflow is outside the inventory: ${relative}`,
+  );
+  const source = fs.readFileSync(path.join(root, relative), "utf8");
+  assert.ok(
+    relative === contract.bootstrap.publicWorkflow ||
+      /uses:\s+(?:\.\/)?\.github\/workflows\/bootstrap\.yml/u.test(source) ||
+      /uses:\s+kungfu-systems\/buildchain\/\.github\/workflows\/bootstrap\.yml@/u.test(
+        source,
+      ),
+    `workflow is declared governed without a Bootstrap edge: ${relative}`,
+  );
+}
+
+assert.deepEqual(contract.complexityBudget, {
+  bootstrapAbis: 1,
+  requestEnvelopes: 1,
+  candidateResolvers: 1,
+  candidateEngines: 1,
+  terminalReceiptAuthorities: 1,
+  perWorkflowBootstrapImplementations: 0,
+  buildchainOnlySelfReleasePaths: 0,
+  perIncidentConsumerEdits: 0,
+});
+assert.equal(contract.bootstrap.discoveryRefExecutionAuthority, false);
+assert.equal(contract.bootstrap.exactShaExecutionAuthority, true);
+assert.equal(contract.bootstrap.consumerSourceMutationPerIncident, false);
+assert.equal(contract.bootstrap.buildchainReleasePromotionPerIncident, false);
+assert.equal(contract.bootstrap.selfDogfoodUsesPublicContract, true);
+assert.equal(contract.bootstrap.recoveryDependsOnPublishedBuildchain, false);
+assert.deepEqual(
+  contract.capabilityAdapters.map(({ id }) => id).sort(),
+  [...admissionPolicy.allowedCapabilities].sort(),
+  "every admitted capability must have one real candidate adapter",
+);
+for (const adapter of contract.capabilityAdapters) {
+  assert.match(adapter.execution, /^exact-candidate-/u);
+  assert.ok(adapter.payloadSchema.endsWith("/v1"));
+}
+assert.ok(!admissionPolicy.allowedCapabilities.includes("workflow-contract"));
+assert.deepEqual(
+  admissionPolicy.contractRoots,
+  [
+    fileRoot("architecture/v4-universal-workflow-bootstrap.json"),
+    fileRoot(contract.bootstrap.faultCampaign),
+    fileRoot("packages/core/v4-universal-workflow-bootstrap.js"),
+    fileRoot("scripts/v4-universal-workflow-backflow.mjs"),
+    fileRoot("scripts/v4-universal-workflow-engine.mjs"),
+    fileRoot("scripts/v4-universal-workflow-self-dogfood.mjs"),
+    fileRoot(contract.bootstrap.publicWorkflow),
+  ].sort(),
+);
+assert.doesNotMatch(
+  fs.readFileSync(
+    path.join(root, contract.bootstrap.candidateEnginePath),
+    "utf8",
+  ),
+  /request\.capability\.id\s*===\s*["']workflow-contract["']/u,
+  "contract-only validation must not be admitted as successful execution",
+);
+const bootstrapSource = fs.readFileSync(
+  path.join(root, contract.bootstrap.publicWorkflow),
+  "utf8",
+);
+assert.doesNotMatch(
+  bootstrapSource,
+  /admission-policy-json:/u,
+  "callers must not supply their own admission authority",
+);
+execFileSync(
+  process.execPath,
+  [path.join(root, contract.migration.compatibilityFacadeGenerator), "--check"],
+  { stdio: "inherit" },
+);
+assert.doesNotMatch(bootstrapSource, /^    permissions:/mu);
+assert.match(bootstrapSource, /settle:[\s\S]*needs: \[admit, execute\]/u);
+assert.match(
+  bootstrapSource,
+  /ascii_downcase\) == "kungfu-origin"[\s\S]*\.name == "check"[\s\S]*map\(select\(\.status == "completed" and \(\.conclusion \/\/ ""\) != ""\)\)[\s\S]*candidate\/architecture\/v4-universal-workflow-train-admission\.json/u,
+);
+const consumerTemplate = fs.readFileSync(
+  path.join(root, contract.bootstrap.consumerTemplate),
+  "utf8",
+);
+const consumerRecoveryTemplate = fs.readFileSync(
+  path.join(root, contract.bootstrap.consumerRecoveryTemplate),
+  "utf8",
+);
+const consumerRecoveryWorkflow = fs.readFileSync(
+  path.join(root, contract.bootstrap.consumerRecoveryWorkflow),
+  "utf8",
+);
+const selfDogfood = fs.readFileSync(
+  path.join(root, contract.bootstrap.selfDogfoodWorkflow),
+  "utf8",
+);
+assert.match(
+  consumerTemplate,
+  /uses:\s+kungfu-systems\/buildchain\/\.github\/workflows\/bootstrap\.yml@v4/u,
+);
+assert.match(
+  consumerRecoveryTemplate,
+  /recovery-admit:[\s\S]*recovery-execute:/u,
+);
+assert.match(
+  consumerRecoveryTemplate,
+  /Parse exact recovery coordinates without Buildchain code[\s\S]*Prove exact independent review before candidate code runs[\s\S]*ascii_downcase\) == "kungfu-origin"[\s\S]*\.name == "check"[\s\S]*Admit candidate policy and exact-head checks[\s\S]*map\(select\(\.status == "completed" and \(\.conclusion \/\/ ""\) != ""\)\)/u,
+);
+assert.match(
+  consumerRecoveryTemplate,
+  /recovery-execute:[\s\S]*needs: recovery-admit[\s\S]*contents: write/u,
+);
+assert.doesNotMatch(
+  consumerRecoveryTemplate,
+  /uses:\s+kungfu-systems\/buildchain\/\.github\/workflows\//u,
+  "consumer recovery must not parse any published Buildchain workflow",
+);
+assert.equal(
+  consumerRecoveryWorkflow,
+  consumerRecoveryTemplate,
+  "the Buildchain self-consumer must exercise the exact distributable recovery shell",
+);
+assert.match(
+  selfDogfood,
+  /uses:\s+kungfu-systems\/buildchain\/\.github\/workflows\/bootstrap\.yml@train\/v4\/v4\.0\/universal-reusable-workflow-bootstrap/u,
+);
+assert.match(
+  selfDogfood,
+  /uses:\s+\.\/\.github\/workflows\/universal-bootstrap-recovery\.yml/u,
+);
+assert.doesNotMatch(
+  selfDogfood,
+  /\.github\/workflows\/bootstrap\.yml@(?:v4|v4-alpha)(?:\s|$)/u,
+  "Train self-dogfood must not depend on an alpha or stable Bootstrap tag",
+);
+for (const channel of ["conformance", "alpha", "stable"]) {
+  assert.match(selfDogfood, new RegExp(`primary-${channel}:`, "u"));
+  assert.match(selfDogfood, new RegExp(`recovery-${channel}:`, "u"));
+}
+assert.match(
+  selfDogfood,
+  /\.state == "APPROVED"[\s\S]*ascii_downcase\) == "kungfu-origin"[\s\S]*\.name == "check"[\s\S]*\.conclusion == "success"/u,
+);
+assert.match(
+  consumerRecoveryTemplate,
+  /result-json:[\s\S]*value:\s*\$\{\{ jobs\.recovery-execute\.outputs\.result-json \}\}/u,
+);
+
+console.log(
+  JSON.stringify({
+    ok: true,
+    schema: contract.schema,
+    publicWorkflowCount: discovered.length,
+    activePublicWorkflowCount: activeWorkflows.length,
+    retiredWorkflowCount: contract.retiredWorkflowSurfaces.length,
+    inventoriedWorkflowCount: contract.inventoryWorkflows.length,
+    inventoryCoveragePercent: 100,
+    governedWorkflowCount: contract.bootstrapGovernedWorkflows.length,
+    governedCoveragePercent: Number(
+      (
+        (contract.bootstrapGovernedWorkflows.length / activeWorkflows.length) *
+        100
+      ).toFixed(2),
+    ),
+    migration: contract.migration,
+  }),
+);

package/scripts/dev-delivery-warrant.mjs

@@ -6,6 +6,7 @@ import {
   closeDevDeliveryWarrant,
   createDevDeliveryQueue,
   createNativeCommandContract,
+  fenceDevDeliveryWriterProtocol,
   heartbeatDevDeliveryWarrant,
   observeDevDeliveryQueue,
   qualifyDevDeliveryWarrant,
@@ -91,6 +92,13 @@ function requireTerminalEvidenceCas(options) {
       "terminal evidence reconciliation execute requires expected-old CAS",
     );
   }
+  if (
+    options.command === "fence-writer-protocol" &&
+    options.execute &&
+    !options.expectedOldStateRoot
+  ) {
+    throw new Error("writer protocol fence execute requires expected-old CAS");
+  }
 }
 
 function normalizeRepository(value) {
@@ -175,6 +183,9 @@ function jsonObject(value, label) {
 }
 
 function transitionFor(command, queue, options) {
+  if (command === "fence-writer-protocol") {
+    return fenceDevDeliveryWriterProtocol(queue, { now: options.now });
+  }
   if (command === "submit") {
     const nativeCommandContract = options.environmentRoot
       ? createNativeCommandContract(options.nativeCommand)
@@ -430,20 +441,29 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
       options.command,
     ),
   });
+  let concurrencyRecovery = null;
   if (
     options.expectedOldStateRoot &&
     loaded.queue.stateRoot !== options.expectedOldStateRoot
   ) {
-    throw new Error(
-      `expected-old state drift: ${loaded.queue.stateRoot} != ${options.expectedOldStateRoot}`,
-    );
+    if (options.command !== "heartbeat") {
+      throw new Error(
+        `expected-old state drift: ${loaded.queue.stateRoot} != ${options.expectedOldStateRoot}`,
+      );
+    }
+    concurrencyRecovery = {
+      schema: "kungfu.buildchain.dev-delivery-concurrency-recovery/v1",
+      action: "heartbeat-state-root-rebased",
+      requestedStateRoot: options.expectedOldStateRoot,
+      observedStateRoot: loaded.queue.stateRoot,
+      observedCommitSha: loaded.commitSha,
+    };
   }
   if (options.command === "observe") return observeQueue(loaded, options);
   const initialLoaded = loaded;
   let changed = transitionFor(options.command, loaded.queue, options);
   let mutates = changed.queue.stateRoot !== loaded.queue.stateRoot;
   let write = null;
-  let concurrencyRecovery = null;
   if (options.execute && mutates) {
     if (changed.receipt.expectedOldStateRoot !== loaded.queue.stateRoot) {
       throw new Error(
@@ -508,7 +528,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
 }
 
 function usage() {
-  return "Usage:\n  buildchain dev warrant <submit|select|heartbeat|qualify|recover|recover-legacy-terminal|close|settle|reconcile-terminal-evidence|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n\nLegacy terminal recovery:\n  recover-legacy-terminal --expected-old sha256:... --legacy-terminal-recovery FILE [--execute]\n\nRead candidate:\n  observe --read-mode v4 --read-qualification FILE --read-qualification-root sha256:... --read-typescript-revision SHA --read-rust-revision SHA --read-validator-version TOKEN [--read-evidence-output FILE]\n";
+  return "Usage:\n  buildchain dev warrant <fence-writer-protocol|submit|select|heartbeat|qualify|recover|recover-legacy-terminal|close|settle|reconcile-terminal-evidence|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n\nWriter protocol fence:\n  fence-writer-protocol --expected-old sha256:... [--execute]\n\nLegacy terminal recovery:\n  recover-legacy-terminal --expected-old sha256:... --legacy-terminal-recovery FILE [--execute]\n\nRead candidate:\n  observe --read-mode v4 --read-qualification FILE --read-qualification-root sha256:... --read-typescript-revision SHA --read-rust-revision SHA --read-validator-version TOKEN [--read-evidence-output FILE]\n";
 }
 
 async function main() {
@@ -520,6 +540,7 @@ async function main() {
   const options = devDeliveryCliOptions(args);
   if (
     ![
+      "fence-writer-protocol",
       "submit",
       "select",
       "heartbeat",

package/scripts/generate-channel-build-workflow.mjs

@@ -3,6 +3,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { migrateV4UniversalWorkflowFacade } from "./generate-v4-universal-workflow-facades.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const sourcePath = path.join(root, ".github/workflows/.build.yml");
@@ -403,7 +404,10 @@ export function generateChannelBuildWorkflow(source) {
       ].join("\n"),
     )
     .replace("\n  alpha:\n", `\n${routerControllerPlanJob()}\n\n  alpha:\n`);
-  return `${generated.trimEnd()}\n\n${routerControllerReceiptJob()}\n\n${routerAggregateJob()}\n`;
+  return migrateV4UniversalWorkflowFacade(
+    `${generated.trimEnd()}\n\n${routerControllerReceiptJob()}\n\n${routerAggregateJob()}\n`,
+    ".github/workflows/build.yml",
+  );
 }
 
 function main() {

package/scripts/generate-channel-promotion-workflow.mjs

@@ -3,6 +3,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { migrateV4UniversalWorkflowFacade } from "./generate-v4-universal-workflow-facades.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const sourcePath = path.join(root, ".github/workflows/.release-candidate-promote.yml");
@@ -74,7 +75,7 @@ function publicInputs(inputBlock) {
 function publicOutputs(outputBlock) {
   const forwarded = entries(outputBlock).map((entry) => entry.source.replace(
     /^        value:.*$/m,
-    `        value: \${{ jobs.alpha.outputs.${entry.name} || jobs.stable.outputs.${entry.name} }}`,
+    `        value: \${{ jobs.invoke.outputs.${entry.name} }}`,
   ));
   const routed = [
     ["buildchain-channel", "Selected promotion workflow-shell channel", "channel"],
@@ -214,8 +215,9 @@ function consumerAdmissionJob() {
         id: policy
         env:
           BUILDCHAIN_CONSUMER_ROOT: .buildchain/consumer
+          BUILDCHAIN_INVOCATION_SOURCE_PATH: \${{ inputs.publication-publisher-workflow-path == '.github/workflows/buildchain-ref-promotion-recovery.yml' && '.github/workflows/release-candidate-promote.yml' || inputs.publication-publisher-workflow-path }}
           BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: \${{ needs.resolve-promotion.outputs.channel }}
-          BUILDCHAIN_INVOKED_WORKFLOW: .github/workflows/release-candidate-promote.yml
+          BUILDCHAIN_INVOKED_WORKFLOW: \${{ inputs.publication-publisher-workflow-path == '.github/workflows/buildchain-ref-promotion-recovery.yml' && '.github/workflows/.release-candidate-promote.yml' || '.github/workflows/release-candidate-promote.yml' }}
           BUILDCHAIN_WORKFLOW_SHA: \${{ needs.resolve-promotion.outputs.router-sha }}
           BUILDCHAIN_RUNTIME_SHA: \${{ needs.resolve-promotion.outputs.router-sha }}
           BUILDCHAIN_STABLE_CONTRACT_LOCK_PATH: \${{ inputs.buildchain-stable-contract-lock-path }}
@@ -292,7 +294,7 @@ export function generateChannelPromotionWorkflow(source, { major = 2, shellRouti
     },
   };
   const alphaRoute = validateWorkflowRoute("alpha", routes.alpha, `v${major}-alpha`);
-  const stableRoute = validateWorkflowRoute("stable", routes.stable, `v${major}`);
+  validateWorkflowRoute("stable", routes.stable, `v${major}`);
   const inputs = blockBetween(source, "    inputs:\n", "    secrets:\n");
   const secrets = blockBetween(source, "    secrets:\n", "    outputs:\n");
   const outputs = blockBetween(source, "    outputs:\n", "\nconcurrency:\n");
@@ -300,9 +302,8 @@ export function generateChannelPromotionWorkflow(source, { major = 2, shellRouti
   for (const required of ["buildchain-ref", "buildchain-contract-lock-path", "channel", "target-ref", ...internalInputs]) {
     if (!inputNames.includes(required)) throw new Error(`advanced promotion workflow missing input: ${required}`);
   }
-  const alphaForwarded = routedInputs(inputNames, alphaRoute, major);
-  const stableForwarded = routedInputs(inputNames, stableRoute, major);
-  return `# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.
+  const invokeForwarded = routedInputs(inputNames, alphaRoute, major);
+  return migrateV4UniversalWorkflowFacade(`# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.
 name: Release Candidate Promote
 
 on:
@@ -336,7 +337,7 @@ jobs:
       target-ref: \${{ steps.route.outputs.target-ref }}
       router-ref: \${{ steps.router.outputs.ref }}
       router-sha: \${{ steps.router.outputs.sha }}
-      shell-ref: \${{ steps.route.outputs.shell-ref }}
+      shell-ref: \${{ steps.identities.outputs.shell-ref }}
       shell-call-ref: \${{ steps.identities.outputs.shell-call-ref }}
       shell-sha: \${{ steps.identities.outputs.shell-sha }}
       runtime-ref: \${{ steps.route.outputs.runtime-ref }}
@@ -425,32 +426,17 @@ jobs:
         shell: bash
         env:
           GITHUB_TOKEN: \${{ github.token }}
-          CHANNEL: \${{ steps.route.outputs.channel }}
-          SELECTED_SHELL_REF: \${{ steps.route.outputs.shell-ref }}
-          ALPHA_SHELL_REF: ${alphaRoute.logicalRef}
-          ALPHA_SHELL_CALL_REF: ${alphaRoute.callRef}
-          STABLE_SHELL_REF: ${stableRoute.logicalRef}
-          STABLE_SHELL_CALL_REF: ${stableRoute.callRef}
+          SELECTED_SHELL_REF: ${alphaRoute.logicalRef}
         run: |
           set -euo pipefail
-          if [[ "\${CHANNEL}" = "alpha" ]]; then
-            expected_ref="\${ALPHA_SHELL_REF}"
-            call_ref="\${ALPHA_SHELL_CALL_REF}"
-          else
-            expected_ref="\${STABLE_SHELL_REF}"
-            call_ref="\${STABLE_SHELL_CALL_REF}"
-          fi
-          if [[ "\${SELECTED_SHELL_REF}" != "\${expected_ref}" ]]; then
-            echo "::error::Selected promotion shell ref \${SELECTED_SHELL_REF} does not match configured \${expected_ref}"
-            exit 1
-          fi
           node .buildchain/router/scripts/promotion-identity-resolver.mjs \\
             --repository "\${{ steps.router.outputs.repository }}" \\
             --router-ref "\${{ steps.router.outputs.ref }}" \\
             --router-sha "\${{ steps.router.outputs.sha }}" \\
             --shell-ref "\${SELECTED_SHELL_REF}" \\
-            --shell-call-ref "\${call_ref}" \\
+            --shell-call-ref "\${SELECTED_SHELL_REF}" \\
             --runtime-ref "\${{ steps.route.outputs.runtime-ref }}"
+          echo "shell-ref=\${SELECTED_SHELL_REF}" >> "$GITHUB_OUTPUT"
 
       - name: Checkout selected promotion workflow shell
         uses: actions/checkout@v7.0.0
@@ -500,29 +486,21 @@ jobs:
       - name: Verify immutable promotion checkouts
         shell: bash
         env:
-          CHANNEL: \${{ steps.route.outputs.channel }}
-          ALPHA_SHELL_WORKFLOW_PATH: ${alphaRoute.workflowPath}
-          STABLE_SHELL_WORKFLOW_PATH: ${stableRoute.workflowPath}
+          SHELL_WORKFLOW_PATH: ${alphaRoute.workflowPath}
           ROUTER_SHA: \${{ steps.router.outputs.sha }}
           SHELL_SHA: \${{ steps.identities.outputs.shell-sha }}
           RUNTIME_SHA: \${{ steps.identities.outputs.runtime-sha }}
         run: |
           set -euo pipefail
-          if [[ "\${CHANNEL}" = "alpha" ]]; then
-            workflow_path="\${ALPHA_SHELL_WORKFLOW_PATH}"
-          else
-            workflow_path="\${STABLE_SHELL_WORKFLOW_PATH}"
-          fi
-          test -f ".buildchain/shell/\${workflow_path}"
+          test -f ".buildchain/shell/\${SHELL_WORKFLOW_PATH}"
           [[ "$(git -C .buildchain/router rev-parse HEAD)" = "\${ROUTER_SHA}" ]] || { echo "::error::Promotion router checkout moved"; exit 1; }
           [[ "$(git -C .buildchain/shell rev-parse HEAD)" = "\${SHELL_SHA}" ]] || { echo "::error::Promotion shell checkout moved"; exit 1; }
           [[ "$(git -C .buildchain/runtime rev-parse HEAD)" = "\${RUNTIME_SHA}" ]] || { echo "::error::Promotion runtime checkout moved"; exit 1; }
 
 ${consumerAdmissionJob()}
-  alpha:
-    name: Promote with alpha workflow shell
+  invoke:
+    name: Invoke the single v4 publisher adapter
     needs: [resolve-promotion, consumer-admission]
-    if: \${{ needs.resolve-promotion.outputs.channel == 'alpha' }}
     uses: kungfu-systems/buildchain/${alphaRoute.workflowPath}@${alphaRoute.callRef}
     permissions:
       actions: write
@@ -534,27 +512,9 @@ ${consumerAdmissionJob()}
       issues: write
       pull-requests: write
     with:
-${alphaForwarded}
-    secrets: inherit
-
-  stable:
-    name: Promote with stable workflow shell
-    needs: [resolve-promotion, consumer-admission]
-    if: \${{ needs.resolve-promotion.outputs.channel == 'stable' }}
-    uses: kungfu-systems/buildchain/${stableRoute.workflowPath}@${stableRoute.callRef}
-    permissions:
-      actions: write
-      artifact-metadata: write
-      attestations: write
-      checks: write
-      contents: write
-      id-token: write
-      issues: write
-      pull-requests: write
-    with:
-${stableForwarded}
+${invokeForwarded}
     secrets: inherit
-`;
+`, ".github/workflows/release-candidate-promote.yml");
 }
 
 function main() {