@kungfu-tech/buildchain 4.0.2-alpha.0 → 4.0.2-alpha.4

package/architecture/v4-release-topology.json

@@ -0,0 +1,243 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-release-topology/v1",
+  "sourceCut": {
+    "branch": "dev/v4/v4.0",
+    "commit": "c3a50c941d018fcc3bec624e19a1298357b7f84a",
+    "tree": "213cdcaded8d90c823ecdafdd9968bceceed9057"
+  },
+  "enforcement": "converged",
+  "closedWorld": {
+    "workflowPaths": [
+      ".github/workflows/.binary-release-assets.yml",
+      ".github/workflows/.build.yml",
+      ".github/workflows/.declarative-auditable-demo.yml",
+      ".github/workflows/.publication-authority.yml",
+      ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/.release-elastic-beanstalk.yml",
+      ".github/workflows/.release-new-version.yml",
+      ".github/workflows/.sam-release.yml",
+      ".github/workflows/.web-surface.yml",
+      ".github/workflows/.wheel-release.yml",
+      ".github/workflows/auditable-demo.yml",
+      ".github/workflows/binary-release-assets.yml",
+      ".github/workflows/build-surface-fixture.yml",
+      ".github/workflows/build.yml",
+      ".github/workflows/buildchain-alpha-self-dogfood.yml",
+      ".github/workflows/buildchain-dev-delivery.yml",
+      ".github/workflows/buildchain-ref-promotion-recovery.yml",
+      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/buildchain-patrol-daily.yml",
+      ".github/workflows/buildchain-patrol-monthly.yml",
+      ".github/workflows/buildchain-patrol-weekly.yml",
+      ".github/workflows/buildchain-stable-candidate-patrol.yml",
+      ".github/workflows/dev-alpha-candidate-patrol.yml",
+      ".github/workflows/dev-pr-auto-merge.yml",
+      ".github/workflows/github-artifact-attestation.yml",
+      ".github/workflows/npm-publish.yml",
+      ".github/workflows/paper-release-sealed.yml",
+      ".github/workflows/paper-release.yml",
+      ".github/workflows/patrol-observed-evidence.yml",
+      ".github/workflows/release-candidate-promote.yml",
+      ".github/workflows/release-line-bootstrap.yml",
+      ".github/workflows/release-new-version.yml",
+      ".github/workflows/release-propagation.yml",
+      ".github/workflows/release-tail.yml",
+      ".github/workflows/stable-candidate-patrol.yml",
+      ".github/workflows/v4-publication-rehearsal-dogfood.yml",
+      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+    ],
+    "unknownTopologyPolicy": "fail-closed"
+  },
+  "semanticScope": {
+    "workflowPaths": [
+      ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/buildchain-ref-promotion-recovery.yml",
+      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/release-candidate-promote.yml",
+      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+    ],
+    "excludedMechanisms": [
+      "Paper product release",
+      "npm dry-run",
+      "v3 rollback workflows",
+      "retired compatibility workflows"
+    ]
+  },
+  "authorityClosure": {
+    "providerAdapters": [
+      "actions/promote-buildchain-ref/github-release.js",
+      "actions/promote-buildchain-ref/v4-provider-plane.js",
+      "actions/release-tail/index.js",
+      "actions/v4-release-candidate-promote/index.js",
+      "actions/v4-release-candidate-promote/product-provider.js",
+      "packages/core/buildchain-agent-manuals.js",
+      "packages/core/index.js",
+      "packages/core/publication-rehearsal-runtime.js",
+      "packages/core/release-tail-provider-adapters.js",
+      "packages/core/release-tail-provider-plane.js",
+      "packages/core/v4-publication-rehearsal-capsule.js",
+      "packages/core/v4-publication-rehearsal.js"
+    ],
+    "runtimeSelectors": [
+      ".github/workflows/.build.yml",
+      ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/.web-surface.yml",
+      ".github/workflows/buildchain-ref-promotion-recovery.yml",
+      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/paper-release.yml",
+      ".github/workflows/publication-artifact.yml",
+      ".github/workflows/release-candidate-promote.yml",
+      ".github/workflows/v4-tail-reseal.yml",
+      "packages/core/buildchain-contract.js",
+      "packages/core/v4-runtime-ref-resume-authority.js",
+      "packages/core/v4-runtime-selector-persistence.js",
+      "scripts/aggregate-build-summary.mjs",
+      "scripts/artifact-signing-controller-core.mjs",
+      "scripts/authorize-promotion-runtime-override.cjs",
+      "scripts/buildchain-contract-lock.mjs",
+      "scripts/check-inventory.mjs",
+      "scripts/generate-channel-promotion-workflow.mjs",
+      "scripts/generate-release-candidate-passport.mjs",
+      "scripts/release-candidate-resolver.mjs",
+      "scripts/resume-from-candidate-run.mjs",
+      "scripts/v4-declarative-promotion-admission.mjs",
+      "scripts/v4-release-candidate-adapter.mjs"
+    ],
+    "runtimeEngines": ["actions/v4-release-candidate-promote/index.js"],
+    "terminalProjections": [
+      ".github/workflows/.release-candidate-promote.yml",
+      "actions/v4-release-candidate-promote/index.js",
+      "packages/core/v4-release-invocation.js"
+    ],
+    "freshEntry": ".github/workflows/release-candidate-promote.yml",
+    "recoveryEntry": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+    "forbiddenLegacyEnginePatterns": [
+      "legacy-promote",
+      "v4-declarative-promote",
+      "BUILDCHAIN_DECLARATIVE_PROMOTION",
+      "Select declarative or legacy promotion result"
+    ]
+  },
+  "baselineMetrics": {
+    "workflowCount": 15,
+    "jobCount": 38,
+    "reusableEdgeCount": 11,
+    "mutationRelevantNodeCount": 25,
+    "contentsWriteJobCount": 10,
+    "oidcWriteJobCount": 9,
+    "semanticMutationRelevantNodeCount": 17
+  },
+  "targetBudgets": {
+    "semanticBoundaries": ["QUALIFY", "APPLY", "SETTLE"],
+    "maximumMutationRelevantNodeCount": 8,
+    "contentsWriteJobCount": 1,
+    "oidcWriteJobCount": 1,
+    "publisherIdentityCount": 1,
+    "runtimeIdentityCount": 1,
+    "terminalReceiptAuthorityCount": 1
+  },
+  "authorityClassification": {
+    "publisher": {
+      "current": [
+        ".github/workflows/.release-candidate-promote.yml#legacy-promote",
+        ".github/workflows/.release-candidate-promote.yml#v4-declarative-promote"
+      ],
+      "target": ".github/workflows/.release-candidate-promote.yml#apply"
+    },
+    "runtimeSelectors": {
+      "discoveryOnly": ["v4-alpha", "v4", "alpha/v4/v4.0"],
+      "postAdmissionPolicy": "exact-sha-only"
+    },
+    "engines": {
+      "current": ["legacy-promote", "v4-declarative-promote"],
+      "target": "release-transaction"
+    },
+    "terminalProjections": {
+      "current": ["promote", "controller-receipt", "release-tail receipt"],
+      "target": "ReleaseReceipt"
+    }
+  },
+  "observedTopology": {
+    "jobRecordFields": [
+      "id",
+      "kind",
+      "uses",
+      "contentsPermission",
+      "oidcPermission",
+      "carriers",
+      "mutationSignals"
+    ],
+    "workflows": [
+      {
+        "path": ".github/workflows/.release-candidate-promote.yml",
+        "triggers": ["workflow_call"],
+        "jobs": [
+          "apply|runner|-|write|write|artifactDownload,artifactUpload|contents-write,oidc-write,promotion-runtime",
+          "qualify|runner|-|read|-|artifactUpload,jobOutput|-",
+          "settle|runner|-|read|-|artifactDownload,artifactUpload,jobOutput|-"
+        ],
+        "reusableEdges": []
+      },
+      {
+        "path": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+        "triggers": ["workflow_dispatch"],
+        "jobs": [
+          "resume|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha"
+        ]
+      },
+      {
+        "path": ".github/workflows/buildchain-ref-promotion.yml",
+        "triggers": ["workflow_dispatch", "workflow_run:completed"],
+        "jobs": [
+          "promote|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
+          "reject-invalid-candidate-recovery|runner|-|read|-|-|-",
+          "reject-invalid-durable-recovery|runner|-|read|-|-|-",
+          "reject-manual-apply|runner|-|read|-|-|-"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha"
+        ]
+      },
+      {
+        "path": ".github/workflows/release-candidate-promote.yml",
+        "triggers": ["workflow_call"],
+        "jobs": [
+          "consumer-admission|runner|-|read|-|artifactUpload|-",
+          "invoke|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
+          "resolve-promotion|runner|-|read|-|jobOutput|-"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha"
+        ]
+      },
+      {
+        "path": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
+        "triggers": ["workflow_dispatch"],
+        "jobs": [
+          "publish|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|-|-|-|-"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha"
+        ]
+      }
+    ],
+    "metrics": {
+      "workflowCount": 37,
+      "jobCount": 92,
+      "reusableEdgeCount": 23,
+      "mutationRelevantNodeCount": 74,
+      "contentsWriteJobCount": 14,
+      "oidcWriteJobCount": 16
+    },
+    "semanticMetrics": {
+      "workflowCount": 5,
+      "mutationRelevantNodeCount": 8,
+      "contentsWriteJobCount": 1,
+      "oidcWriteJobCount": 1
+    }
+  }
+}

package/architecture/v4-runtime-semantic-closure.json

@@ -73,7 +73,10 @@
       "stateAuthority": "single-writer-state-machine",
       "legacyFallbackAllowed": false,
       "providerDecisionAuthorityAllowed": false,
-      "implementation": ["packages/core/dev-delivery-warrant.js"],
+      "implementation": [
+        "packages/core/dev-delivery-warrant-native-compatibility.js",
+        "packages/core/dev-delivery-warrant.js"
+      ],
       "invariants": {
         "exactHeadFence": true,
         "immutableRootFence": true,

package/contracts/buildchain-v2-residuals-v1.json

@@ -16,15 +16,6 @@
       "owner": "buildchain-maintainers",
       "sunsetCondition": "Remove after every known caller migrates to the lifecycle version command."
     },
-    {
-      "path": ".github/workflows/.release-candidate-promote.yml",
-      "token": "actions/create-github-app-token@v2",
-      "expectedOccurrences": 1,
-      "classification": "third-party-action-version",
-      "callerStatus": "active",
-      "owner": "actions/create-github-app-token maintainers",
-      "sunsetCondition": "Upgrade through normal dependency review when a compatible successor is adopted."
-    },
     {
       "path": ".github/workflows/.release-docker.yml",
       "token": "workflows v2 Docker release path is retired",

package/contracts/fixtures/v4-tail-reseal-v1/valid.json

@@ -22,7 +22,7 @@
     "ref": "v4-alpha",
     "sha": "dddddddddddddddddddddddddddddddddddddddd",
     "contractRoot": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
-    "consumerPolicyReceiptRoot": "sha256:e545cb7dc918ba14b02e9a557623edb7aaadeee180b211b8a3164d67af03e789"
+    "consumerPolicyReceiptRoot": "sha256:8d8e55a4ae07a57a2a262e138f55148b05916c364b3d086530e1392c982b886f"
   },
   "warrant": {
     "candidateId": "candidate-alpha-2",

package/contracts/v4-release-invocation-v1.schema.json

@@ -0,0 +1,134 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.libkungfu.dev/schema/v4-release-invocation-v1.schema.json",
+  "title": "Buildchain v4 canonical ReleaseInvocation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "publisher",
+    "runtime",
+    "candidate",
+    "target",
+    "authority",
+    "provider",
+    "parent"
+  ],
+  "properties": {
+    "schema": { "const": "kungfu-buildchain-v4-release-invocation/v1" },
+    "publisher": { "$ref": "#/$defs/publisher" },
+    "runtime": { "$ref": "#/$defs/runtime" },
+    "candidate": { "$ref": "#/$defs/candidate" },
+    "target": { "$ref": "#/$defs/target" },
+    "authority": { "$ref": "#/$defs/authority" },
+    "provider": { "$ref": "#/$defs/provider" },
+    "parent": { "$ref": "#/$defs/parent" }
+  },
+  "$defs": {
+    "sha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "root": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+    "publisher": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "workflow", "workflowSha", "job"],
+      "properties": {
+        "repository": { "const": "kungfu-systems/buildchain" },
+        "workflow": {
+          "const": ".github/workflows/.release-candidate-promote.yml"
+        },
+        "workflowSha": { "$ref": "#/$defs/sha" },
+        "job": { "const": "apply" }
+      }
+    },
+    "runtime": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "commit", "tree"],
+      "properties": {
+        "repository": { "const": "kungfu-systems/buildchain" },
+        "commit": { "$ref": "#/$defs/sha" },
+        "tree": { "$ref": "#/$defs/sha" }
+      }
+    },
+    "candidate": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "commit", "tree", "version"],
+      "properties": {
+        "repository": { "type": "string", "pattern": "^[ -~]+$" },
+        "commit": { "$ref": "#/$defs/sha" },
+        "tree": { "$ref": "#/$defs/sha" },
+        "version": { "type": "string", "pattern": "^[ -~]+$" }
+      }
+    },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["channel", "tag", "expectedOldSha"],
+      "properties": {
+        "channel": { "enum": ["alpha", "stable"] },
+        "tag": {
+          "type": "string",
+          "pattern": "^v[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?$"
+        },
+        "expectedOldSha": {
+          "oneOf": [{ "$ref": "#/$defs/sha" }, { "type": "null" }]
+        }
+      }
+    },
+    "authority": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["policyRoot", "qualificationRoot", "warrantRoot"],
+      "properties": {
+        "policyRoot": { "$ref": "#/$defs/root" },
+        "qualificationRoot": { "$ref": "#/$defs/root" },
+        "warrantRoot": { "$ref": "#/$defs/root" }
+      }
+    },
+    "provider": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["adapter", "contract", "repository"],
+      "properties": {
+        "adapter": { "const": "built-in-provider-plane" },
+        "contract": {
+          "const": "kungfu-buildchain-release-tail-provider/v1"
+        },
+        "repository": { "type": "string", "pattern": "^[ -~]+$" }
+      }
+    },
+    "parent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["invocationRoot", "transactionRoot", "receiptRoot"],
+      "properties": {
+        "invocationRoot": {
+          "oneOf": [{ "$ref": "#/$defs/root" }, { "type": "null" }]
+        },
+        "transactionRoot": {
+          "oneOf": [{ "$ref": "#/$defs/root" }, { "type": "null" }]
+        },
+        "receiptRoot": {
+          "oneOf": [{ "$ref": "#/$defs/root" }, { "type": "null" }]
+        }
+      },
+      "oneOf": [
+        {
+          "properties": {
+            "invocationRoot": { "type": "null" },
+            "transactionRoot": { "type": "null" },
+            "receiptRoot": { "type": "null" }
+          }
+        },
+        {
+          "properties": {
+            "invocationRoot": { "$ref": "#/$defs/root" },
+            "transactionRoot": { "$ref": "#/$defs/root" },
+            "receiptRoot": { "$ref": "#/$defs/root" }
+          }
+        }
+      ]
+    }
+  }
+}

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.0",
+    "version": "4.0.2-alpha.4",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -1492,7 +1492,7 @@
         "durable consumers call the public floating workflow and may route a train or exact runtime only through trusted non-persistent dispatch input"
       ],
       "breakingDigest": "sha256:21b65d0746d2e8b3e8a7df4c6fab295a85c8fd42cc405ec3bc5df5cdab0421f0",
-      "auditDigest": "sha256:bcfd872260c754e68cabe183c8c1c3acb2b2196e1601208bf7bc846b8e32af74"
+      "auditDigest": "sha256:adbe8a9e29cd30db5b2e9685864ea36bf88ab959fb151b65d1b00e87a2dea144"
     },
     {
       "contractVersion": 1,
@@ -1591,7 +1591,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:5f10c81d3f80cb417960be682921884639c40b6d875f1a3b1ffae7e652c3f468",
-      "auditDigest": "sha256:d9821bf071e83386e596e1d460c1adc46808451fce44b6586ae26fb11e535991"
+      "auditDigest": "sha256:8ca8fd8e7b111357a7267e150a268ce8f4b9a06d89360e07a08d1a49656e619e"
     },
     {
       "contractVersion": 1,
@@ -1646,7 +1646,7 @@
         "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph"
       ],
       "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
-      "auditDigest": "sha256:1b77b563669a70c8e0a7c6d335f2ddcef9a95178d08e742ecf4aaf66652e7b4f",
+      "auditDigest": "sha256:bb006a22c17a67a79dcd3bf566e2fdf9f5a1c4841580d1cfbaa44229f2a8b8b1",
       "compatibleBreakingDigests": [
         "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
       ],
@@ -1863,7 +1863,7 @@
         "no consumer command, script, shell, checkout, or executable tail hook is accepted"
       ],
       "breakingDigest": "sha256:9229eb3a000fb408feb6b8793c209c77afbf9327026467d68954470e22e4f8f4",
-      "auditDigest": "sha256:83fd394419851e6da877c50018e879b447497db52b0ac871dfd83e074f5459a8"
+      "auditDigest": "sha256:28f962e2c7542d650417975ea9d5922816f57c63798e895ed0eac61840a02af4"
     },
     {
       "contractVersion": 1,
@@ -2257,7 +2257,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:dd80914275c60efcf95b29d44e861aeba5075ee7da9094adaa5cdb5714b59bf6"
+      "auditDigest": "sha256:27bcd57f554c2f254fb350097e15fe8f3954bafb2fc04c72f725bdaf444fbea7"
     },
     {
       "contractVersion": 1,
@@ -2279,7 +2279,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:dab7be33bf7d0c36fd59b55f74b3cb964ae24f348b95cd863f276c70e6d3db6e"
+      "auditDigest": "sha256:1c6b63d2359c9d04f83081ddfbfc2a7cb66ccbba5795471c98980775d2bebf2c"
     },
     {
       "contractVersion": 1,
@@ -5173,7 +5173,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:1b77b563669a70c8e0a7c6d335f2ddcef9a95178d08e742ecf4aaf66652e7b4f"
+      "auditDigest": "sha256:bb006a22c17a67a79dcd3bf566e2fdf9f5a1c4841580d1cfbaa44229f2a8b8b1"
     },
     {
       "contractVersion": 1,
@@ -5399,5 +5399,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:20411029d83211dff426fb6535a608902129844a5ccb4788db77d3f81becb839",
-  "contractDigest": "sha256:9b8272580aaff37c2ee2772f9a72ca9de83160994f8e7c12156cc3c60fbee5f5"
+  "contractDigest": "sha256:8ff6ce161a7573f2dbeabea7f331fa726539d226648d9b4866a481f15006833c"
 }