@kungfu-tech/buildchain 4.0.2-alpha.0 → 4.0.2-alpha.2

package/scripts/check-v4-release-topology.mjs

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  parseWorkflowDocument,
+  parseYamlUses,
+} from "../packages/core/workflow-yaml-contract.js";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const ledgerPath = path.join(root, "architecture/v4-release-topology.json");
+const releaseMarker =
+  /(?:release-candidate-promote\.yml|promote-buildchain-ref|v4-release-candidate-promote|release-tail-runtime)/u;
+
+function read(relative) {
+  return fs.readFileSync(path.join(root, relative), "utf8");
+}
+
+function jobBlock(source, jobId) {
+  const escaped = jobId.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  return (
+    source.match(
+      new RegExp(
+        `^  ${escaped}:\\n([\\s\\S]*?)(?=^  [A-Za-z0-9_.-]+:|(?![\\s\\S]))`,
+        "mu",
+      ),
+    )?.[1] || ""
+  );
+}
+
+function permission(block, name) {
+  return (
+    new RegExp(`^      ${name}:\\s*([^#\\n]+)`, "mu")
+      .exec(block)?.[1]
+      ?.trim() || null
+  );
+}
+
+function workflowSnapshot(relative) {
+  const source = read(relative);
+  const document = parseWorkflowDocument(source);
+  const jobs = document.jobs.map((job) => {
+    const block = jobBlock(source, job.id);
+    const uses = job.uses || null;
+    return {
+      id: job.id,
+      kind: uses ? "reusable-call" : "runner",
+      uses,
+      permissions: {
+        contents: permission(block, "contents"),
+        idToken: permission(block, "id-token"),
+      },
+      carriers: {
+        artifactDownload: /uses:\s+actions\/download-artifact@/u.test(block),
+        artifactUpload: /uses:\s+actions\/upload-artifact@/u.test(block),
+        jobOutput: /GITHUB_OUTPUT/u.test(block),
+      },
+      mutationSignals: [
+        /contents:\s*write/u.test(block) && "contents-write",
+        /id-token:\s*write/u.test(block) && "oidc-write",
+        /(?:promote-buildchain-ref|v4-release-candidate-promote)/u.test(
+          block,
+        ) && "promotion-runtime",
+        /(?:git push|npm publish|gh release (?:create|upload))/u.test(block) &&
+          "direct-publication-command",
+      ].filter(Boolean),
+    };
+  });
+  return {
+    path: relative,
+    triggers: document.triggers,
+    jobs,
+    reusableEdges: parseYamlUses(source)
+      .map(({ value }) => value)
+      .filter((value) => /\.github\/workflows\//u.test(value))
+      .sort(),
+  };
+}
+
+export function discoverV4ReleaseTopology(
+  workflowPaths,
+  semanticWorkflowPaths = workflowPaths,
+) {
+  const workflows = workflowPaths.map(workflowSnapshot);
+  const jobs = workflows.flatMap((workflow) => workflow.jobs);
+  const mutationJobs = jobs.filter((job) => job.mutationSignals.length > 0);
+  const semanticPaths = new Set(semanticWorkflowPaths);
+  const semanticJobs = workflows
+    .filter((workflow) => semanticPaths.has(workflow.path))
+    .flatMap((workflow) => workflow.jobs);
+  const semanticMutationJobs = semanticJobs.filter(
+    (job) => job.kind === "runner" && job.mutationSignals.length > 0,
+  );
+  return {
+    jobRecordFields: [
+      "id",
+      "kind",
+      "uses",
+      "contentsPermission",
+      "oidcPermission",
+      "carriers",
+      "mutationSignals",
+    ],
+    workflows: workflows.map((workflow) => ({
+      path: workflow.path,
+      triggers: workflow.triggers,
+      jobs: workflow.jobs.map((job) =>
+        [
+          job.id,
+          job.kind,
+          job.uses || "-",
+          job.permissions.contents || "-",
+          job.permissions.idToken || "-",
+          Object.entries(job.carriers)
+            .filter(([, present]) => present)
+            .map(([name]) => name)
+            .join(",") || "-",
+          job.mutationSignals.join(",") || "-",
+        ].join("|"),
+      ),
+      reusableEdges: workflow.reusableEdges,
+    })),
+    metrics: {
+      workflowCount: workflows.length,
+      jobCount: jobs.length,
+      reusableEdgeCount: workflows.reduce(
+        (count, workflow) => count + workflow.reusableEdges.length,
+        0,
+      ),
+      mutationRelevantNodeCount: jobs.filter(
+        (job) =>
+          job.kind === "reusable-call" ||
+          job.mutationSignals.length > 0 ||
+          job.carriers.artifactDownload ||
+          job.carriers.artifactUpload,
+      ).length,
+      contentsWriteJobCount: mutationJobs.filter((job) =>
+        job.mutationSignals.includes("contents-write"),
+      ).length,
+      oidcWriteJobCount: mutationJobs.filter((job) =>
+        job.mutationSignals.includes("oidc-write"),
+      ).length,
+    },
+    semanticMetrics: {
+      workflowCount: semanticPaths.size,
+      mutationRelevantNodeCount: semanticJobs.filter(
+        (job) =>
+          job.kind === "reusable-call" ||
+          job.mutationSignals.length > 0 ||
+          job.carriers.artifactDownload ||
+          job.carriers.artifactUpload,
+      ).length,
+      contentsWriteJobCount: semanticMutationJobs.filter((job) =>
+        job.mutationSignals.includes("contents-write"),
+      ).length,
+      oidcWriteJobCount: semanticMutationJobs.filter((job) =>
+        job.mutationSignals.includes("oidc-write"),
+      ).length,
+    },
+  };
+}
+
+export function findUnknownV4ReleaseTopology(
+  workflowPaths,
+  allWorkflowPaths = fs
+    .readdirSync(path.join(root, ".github/workflows"))
+    .filter((name) => /\.ya?ml$/u.test(name))
+    .map((name) => `.github/workflows/${name}`),
+  readWorkflow = read,
+) {
+  const declared = new Set(workflowPaths);
+  return allWorkflowPaths
+    .filter((relative) => !declared.has(relative))
+    .filter((relative) => releaseMarker.test(readWorkflow(relative)))
+    .sort();
+}
+
+function assertClosedWorld(workflowPaths) {
+  const unknown = findUnknownV4ReleaseTopology(workflowPaths);
+  assert.deepEqual(
+    unknown,
+    [],
+    `unknown v4 release topology workflows: ${unknown.join(", ")}`,
+  );
+}
+
+export function checkV4ReleaseTopology() {
+  const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
+  assert.equal(ledger.contract, "kungfu-buildchain-v4-release-topology/v1");
+  assertClosedWorld(ledger.closedWorld.workflowPaths);
+  const actual = discoverV4ReleaseTopology(
+    ledger.closedWorld.workflowPaths,
+    ledger.semanticScope.workflowPaths,
+  );
+  assert.deepEqual(actual, ledger.observedTopology);
+  assert.equal(
+    ledger.targetBudgets.maximumMutationRelevantNodeCount,
+    Math.floor(ledger.baselineMetrics.semanticMutationRelevantNodeCount / 2),
+  );
+  if (ledger.enforcement === "converged") {
+    assert.ok(
+      actual.semanticMetrics.mutationRelevantNodeCount <=
+        ledger.targetBudgets.maximumMutationRelevantNodeCount,
+    );
+    assert.equal(actual.semanticMetrics.contentsWriteJobCount, 1);
+    assert.equal(actual.semanticMetrics.oidcWriteJobCount, 1);
+    const publisher = actual.workflows.find(
+      ({ path: workflowPath }) =>
+        workflowPath === ".github/workflows/.release-candidate-promote.yml",
+    );
+    assert.deepEqual(
+      publisher.jobs.map((job) => job.split("|", 1)[0]),
+      ["apply", "qualify", "settle"],
+    );
+  }
+  return actual;
+}
+
+if (process.argv.includes("--print")) {
+  const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
+  process.stdout.write(
+    `${JSON.stringify(
+      discoverV4ReleaseTopology(
+        ledger.closedWorld.workflowPaths,
+        ledger.semanticScope.workflowPaths,
+      ),
+      null,
+      2,
+    )}\n`,
+  );
+} else {
+  checkV4ReleaseTopology();
+  process.stdout.write("v4 release topology: ok\n");
+}

package/scripts/dev-delivery-warrant.mjs

@@ -430,20 +430,29 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
       options.command,
     ),
   });
+  let concurrencyRecovery = null;
   if (
     options.expectedOldStateRoot &&
     loaded.queue.stateRoot !== options.expectedOldStateRoot
   ) {
-    throw new Error(
-      `expected-old state drift: ${loaded.queue.stateRoot} != ${options.expectedOldStateRoot}`,
-    );
+    if (options.command !== "heartbeat") {
+      throw new Error(
+        `expected-old state drift: ${loaded.queue.stateRoot} != ${options.expectedOldStateRoot}`,
+      );
+    }
+    concurrencyRecovery = {
+      schema: "kungfu.buildchain.dev-delivery-concurrency-recovery/v1",
+      action: "heartbeat-state-root-rebased",
+      requestedStateRoot: options.expectedOldStateRoot,
+      observedStateRoot: loaded.queue.stateRoot,
+      observedCommitSha: loaded.commitSha,
+    };
   }
   if (options.command === "observe") return observeQueue(loaded, options);
   const initialLoaded = loaded;
   let changed = transitionFor(options.command, loaded.queue, options);
   let mutates = changed.queue.stateRoot !== loaded.queue.stateRoot;
   let write = null;
-  let concurrencyRecovery = null;
   if (options.execute && mutates) {
     if (changed.receipt.expectedOldStateRoot !== loaded.queue.stateRoot) {
       throw new Error(

package/scripts/generate-channel-promotion-workflow.mjs

@@ -74,7 +74,7 @@ function publicInputs(inputBlock) {
 function publicOutputs(outputBlock) {
   const forwarded = entries(outputBlock).map((entry) => entry.source.replace(
     /^        value:.*$/m,
-    `        value: \${{ jobs.alpha.outputs.${entry.name} || jobs.stable.outputs.${entry.name} }}`,
+    `        value: \${{ jobs.invoke.outputs.${entry.name} }}`,
   ));
   const routed = [
     ["buildchain-channel", "Selected promotion workflow-shell channel", "channel"],
@@ -292,7 +292,7 @@ export function generateChannelPromotionWorkflow(source, { major = 2, shellRouti
     },
   };
   const alphaRoute = validateWorkflowRoute("alpha", routes.alpha, `v${major}-alpha`);
-  const stableRoute = validateWorkflowRoute("stable", routes.stable, `v${major}`);
+  validateWorkflowRoute("stable", routes.stable, `v${major}`);
   const inputs = blockBetween(source, "    inputs:\n", "    secrets:\n");
   const secrets = blockBetween(source, "    secrets:\n", "    outputs:\n");
   const outputs = blockBetween(source, "    outputs:\n", "\nconcurrency:\n");
@@ -300,8 +300,7 @@ export function generateChannelPromotionWorkflow(source, { major = 2, shellRouti
   for (const required of ["buildchain-ref", "buildchain-contract-lock-path", "channel", "target-ref", ...internalInputs]) {
     if (!inputNames.includes(required)) throw new Error(`advanced promotion workflow missing input: ${required}`);
   }
-  const alphaForwarded = routedInputs(inputNames, alphaRoute, major);
-  const stableForwarded = routedInputs(inputNames, stableRoute, major);
+  const invokeForwarded = routedInputs(inputNames, alphaRoute, major);
   return `# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.
 name: Release Candidate Promote
 
@@ -336,7 +335,7 @@ jobs:
       target-ref: \${{ steps.route.outputs.target-ref }}
       router-ref: \${{ steps.router.outputs.ref }}
       router-sha: \${{ steps.router.outputs.sha }}
-      shell-ref: \${{ steps.route.outputs.shell-ref }}
+      shell-ref: \${{ steps.identities.outputs.shell-ref }}
       shell-call-ref: \${{ steps.identities.outputs.shell-call-ref }}
       shell-sha: \${{ steps.identities.outputs.shell-sha }}
       runtime-ref: \${{ steps.route.outputs.runtime-ref }}
@@ -425,32 +424,17 @@ jobs:
         shell: bash
         env:
           GITHUB_TOKEN: \${{ github.token }}
-          CHANNEL: \${{ steps.route.outputs.channel }}
-          SELECTED_SHELL_REF: \${{ steps.route.outputs.shell-ref }}
-          ALPHA_SHELL_REF: ${alphaRoute.logicalRef}
-          ALPHA_SHELL_CALL_REF: ${alphaRoute.callRef}
-          STABLE_SHELL_REF: ${stableRoute.logicalRef}
-          STABLE_SHELL_CALL_REF: ${stableRoute.callRef}
+          SELECTED_SHELL_REF: ${alphaRoute.logicalRef}
         run: |
           set -euo pipefail
-          if [[ "\${CHANNEL}" = "alpha" ]]; then
-            expected_ref="\${ALPHA_SHELL_REF}"
-            call_ref="\${ALPHA_SHELL_CALL_REF}"
-          else
-            expected_ref="\${STABLE_SHELL_REF}"
-            call_ref="\${STABLE_SHELL_CALL_REF}"
-          fi
-          if [[ "\${SELECTED_SHELL_REF}" != "\${expected_ref}" ]]; then
-            echo "::error::Selected promotion shell ref \${SELECTED_SHELL_REF} does not match configured \${expected_ref}"
-            exit 1
-          fi
           node .buildchain/router/scripts/promotion-identity-resolver.mjs \\
             --repository "\${{ steps.router.outputs.repository }}" \\
             --router-ref "\${{ steps.router.outputs.ref }}" \\
             --router-sha "\${{ steps.router.outputs.sha }}" \\
             --shell-ref "\${SELECTED_SHELL_REF}" \\
-            --shell-call-ref "\${call_ref}" \\
+            --shell-call-ref "\${SELECTED_SHELL_REF}" \\
             --runtime-ref "\${{ steps.route.outputs.runtime-ref }}"
+          echo "shell-ref=\${SELECTED_SHELL_REF}" >> "$GITHUB_OUTPUT"
 
       - name: Checkout selected promotion workflow shell
         uses: actions/checkout@v7.0.0
@@ -500,29 +484,21 @@ jobs:
       - name: Verify immutable promotion checkouts
         shell: bash
         env:
-          CHANNEL: \${{ steps.route.outputs.channel }}
-          ALPHA_SHELL_WORKFLOW_PATH: ${alphaRoute.workflowPath}
-          STABLE_SHELL_WORKFLOW_PATH: ${stableRoute.workflowPath}
+          SHELL_WORKFLOW_PATH: ${alphaRoute.workflowPath}
           ROUTER_SHA: \${{ steps.router.outputs.sha }}
           SHELL_SHA: \${{ steps.identities.outputs.shell-sha }}
           RUNTIME_SHA: \${{ steps.identities.outputs.runtime-sha }}
         run: |
           set -euo pipefail
-          if [[ "\${CHANNEL}" = "alpha" ]]; then
-            workflow_path="\${ALPHA_SHELL_WORKFLOW_PATH}"
-          else
-            workflow_path="\${STABLE_SHELL_WORKFLOW_PATH}"
-          fi
-          test -f ".buildchain/shell/\${workflow_path}"
+          test -f ".buildchain/shell/\${SHELL_WORKFLOW_PATH}"
           [[ "$(git -C .buildchain/router rev-parse HEAD)" = "\${ROUTER_SHA}" ]] || { echo "::error::Promotion router checkout moved"; exit 1; }
           [[ "$(git -C .buildchain/shell rev-parse HEAD)" = "\${SHELL_SHA}" ]] || { echo "::error::Promotion shell checkout moved"; exit 1; }
           [[ "$(git -C .buildchain/runtime rev-parse HEAD)" = "\${RUNTIME_SHA}" ]] || { echo "::error::Promotion runtime checkout moved"; exit 1; }
 
 ${consumerAdmissionJob()}
-  alpha:
-    name: Promote with alpha workflow shell
+  invoke:
+    name: Invoke the single v4 publisher adapter
     needs: [resolve-promotion, consumer-admission]
-    if: \${{ needs.resolve-promotion.outputs.channel == 'alpha' }}
     uses: kungfu-systems/buildchain/${alphaRoute.workflowPath}@${alphaRoute.callRef}
     permissions:
       actions: write
@@ -534,25 +510,7 @@ ${consumerAdmissionJob()}
       issues: write
       pull-requests: write
     with:
-${alphaForwarded}
-    secrets: inherit
-
-  stable:
-    name: Promote with stable workflow shell
-    needs: [resolve-promotion, consumer-admission]
-    if: \${{ needs.resolve-promotion.outputs.channel == 'stable' }}
-    uses: kungfu-systems/buildchain/${stableRoute.workflowPath}@${stableRoute.callRef}
-    permissions:
-      actions: write
-      artifact-metadata: write
-      attestations: write
-      checks: write
-      contents: write
-      id-token: write
-      issues: write
-      pull-requests: write
-    with:
-${stableForwarded}
+${invokeForwarded}
     secrets: inherit
 `;
 }

package/scripts/v3-v4-capability-catalog.mjs

@@ -23,6 +23,9 @@ const PLATFORM_MARKERS = Object.freeze({
   "self-hosted": /\bself-hosted\b/iu,
   windows: /\bwindows\b/iu,
 });
+const LIVE_V4_PROTECTED_BRANCH = "refs/heads/dev/v4/v4.0";
+const LIVE_V4_PROTECTED_LINEAGE_REF = "refs/remotes/origin/dev/v4/v4.0";
+const PROTECTED_LINEAGE_DEPTH = 256;
 
 export function sha256(value) {
   return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`;
@@ -47,6 +50,110 @@ export function git(root, args, { trim = true } = {}) {
   return trim ? output.trim() : output;
 }
 
+export function assertCapabilityCutAncestor({
+  root = process.cwd(),
+  revision,
+  descendant = "HEAD",
+  label = "capability cut",
+} = {}) {
+  try {
+    execFileSync("git", ["merge-base", "--is-ancestor", revision, descendant], {
+      cwd: root,
+      stdio: "ignore",
+    });
+  } catch {
+    throw new Error(
+      `${label} ${revision} must be an ancestor of ${descendant}; regenerate the cut after rebasing instead of relying on a retained local object`,
+    );
+  }
+}
+
+export function ensureCapabilityCutAncestor({
+  root = process.cwd(),
+  revision,
+  descendant = "HEAD",
+  label = "capability cut",
+} = {}) {
+  try {
+    assertCapabilityCutAncestor({ root, revision, descendant, label });
+    return;
+  } catch (error) {
+    if (git(root, ["rev-parse", "--is-shallow-repository"]) !== "true")
+      throw error;
+  }
+  const descendantCommit = git(root, ["rev-parse", `${descendant}^{commit}`]);
+  try {
+    execFileSync(
+      "git",
+      ["fetch", "--no-tags", "--depth=128", "origin", descendantCommit],
+      { cwd: root, stdio: "ignore" },
+    );
+  } catch {
+    throw new Error(
+      `${label} ${revision} ancestry could not be hydrated from ${descendantCommit} through a bounded origin fetch`,
+    );
+  }
+  assertCapabilityCutAncestor({ root, revision, descendant, label });
+}
+
+function protectedV4TreeWitness(root, descendant) {
+  try {
+    execFileSync(
+      "git",
+      [
+        "fetch",
+        "--no-tags",
+        `--depth=${PROTECTED_LINEAGE_DEPTH}`,
+        "origin",
+        `${LIVE_V4_PROTECTED_BRANCH}:${LIVE_V4_PROTECTED_LINEAGE_REF}`,
+      ],
+      { cwd: root, stdio: "ignore" },
+    );
+  } catch {
+    throw new Error(
+      `protected v4 lineage ${LIVE_V4_PROTECTED_BRANCH} could not be hydrated through a bounded origin fetch`,
+    );
+  }
+  const tree = git(root, ["rev-parse", `${descendant}^{tree}`]);
+  return (
+    git(root, [
+      "log",
+      `--max-count=${PROTECTED_LINEAGE_DEPTH}`,
+      "--format=%H %T",
+      LIVE_V4_PROTECTED_LINEAGE_REF,
+    ])
+      .split("\n")
+      .map((row) => row.split(" "))
+      .find(([, candidateTree]) => candidateTree === tree)?.[0] || ""
+  );
+}
+
+export function ensureCapabilityCutLineage({
+  root = process.cwd(),
+  revision,
+  descendant = "HEAD",
+  label = "capability cut",
+} = {}) {
+  try {
+    ensureCapabilityCutAncestor({ root, revision, descendant, label });
+    return { mode: "direct-ancestry", witness: descendant };
+  } catch (directError) {
+    const witness = protectedV4TreeWitness(root, descendant);
+    if (!witness)
+      throw new Error(
+        `${label} ${revision} is not an ancestor of ${descendant}, and ${descendant} has no tree-equivalent commit in the bounded protected v4 lineage`,
+        { cause: directError },
+      );
+    ensureCapabilityCutAncestor({
+      root,
+      revision,
+      descendant: witness,
+      label: `${label} protected-lineage witness`,
+    });
+    return { mode: "protected-tree-equivalent", witness };
+  }
+}
+
 function gitJson(root, revision, relPath) {
   return JSON.parse(
     git(root, ["show", `${revision}:${relPath}`], { trim: false }),

package/scripts/v4-declarative-promotion-admission.mjs

@@ -8,7 +8,10 @@ export function admitV4DeclarativePromotion({
   runtimeRef,
   declarative,
 }) {
-  if (!/^v4(?:$|[-./])/u.test(String(runtimeRef || ""))) {
+  if (
+    declarative !== true &&
+    !/^v4(?:$|[-./])/u.test(String(runtimeRef || ""))
+  ) {
     return Object.freeze({ mode: "legacy", admitted: true });
   }
   if (declarative !== true) {