@kungfu-tech/buildchain 4.0.2-alpha.2 → 4.0.2-alpha.4

package/packages/core/v4-protected-publication-source.js

@@ -0,0 +1,93 @@
+import { v4ContentRoot } from "./v4-canonical-contracts.js";
+
+const SHA_PATTERN = /^[0-9a-f]{40}$/u;
+
+function exactSha(value, label) {
+  const normalized = String(value || "").toLowerCase();
+  if (!SHA_PATTERN.test(normalized)) {
+    throw new Error(`${label} must be an exact Git SHA`);
+  }
+  return normalized;
+}
+
+function exactParents(value, label) {
+  if (!Array.isArray(value)) {
+    throw new Error(`${label} must be an ordered Git parent list`);
+  }
+  return value.map((entry, index) => exactSha(entry, `${label}[${index}]`));
+}
+
+export function bindV4ProtectedPublicationSource({
+  repository,
+  protectedCommit,
+  candidateCommit,
+  pullRequest,
+} = {}) {
+  if (!/^[^/\s]+\/[^/\s]+$/u.test(String(repository || ""))) {
+    throw new Error("protected publication source requires owner/repository");
+  }
+  const protectedSource = {
+    sha: exactSha(protectedCommit?.sha, "protected source SHA"),
+    tree: exactSha(protectedCommit?.tree, "protected source tree"),
+    parents: exactParents(protectedCommit?.parents, "protected source parents"),
+  };
+  const candidateSource = {
+    sha: exactSha(candidateCommit?.sha, "candidate source SHA"),
+    tree: exactSha(candidateCommit?.tree, "candidate source tree"),
+    parents: exactParents(candidateCommit?.parents, "candidate source parents"),
+  };
+  if (protectedSource.tree !== candidateSource.tree) {
+    throw new Error(
+      "protected publication source tree does not match the qualified candidate tree",
+    );
+  }
+
+  let mode = "exact-commit";
+  let pullRequestNumber = null;
+  if (protectedSource.sha !== candidateSource.sha) {
+    mode = "merge-equivalent";
+    const sameParents =
+      protectedSource.parents.length === candidateSource.parents.length &&
+      protectedSource.parents.every(
+        (parent, index) => parent === candidateSource.parents[index],
+      );
+    if (!sameParents) {
+      throw new Error(
+        "protected publication source is not parent-equivalent to the qualified merge candidate",
+      );
+    }
+    pullRequestNumber = Number(pullRequest?.number || 0);
+    const pullRequestHead = exactSha(
+      pullRequest?.headSha,
+      "publication pull request head SHA",
+    );
+    const pullRequestMerge = exactSha(
+      pullRequest?.mergeSha,
+      "publication pull request merge SHA",
+    );
+    if (
+      !Number.isSafeInteger(pullRequestNumber) ||
+      pullRequestNumber <= 0 ||
+      pullRequest?.merged !== true ||
+      pullRequestMerge !== protectedSource.sha ||
+      !candidateSource.parents.includes(pullRequestHead)
+    ) {
+      throw new Error(
+        "protected publication source does not match the merged pull request and qualified merge candidate",
+      );
+    }
+  }
+
+  const binding = {
+    schema: "kungfu.buildchain.v4-protected-publication-source/v1",
+    repository,
+    mode,
+    protectedSource,
+    candidateSource,
+    pullRequestNumber,
+  };
+  return {
+    ...binding,
+    bindingRoot: v4ContentRoot("candidate-identity", binding),
+  };
+}

package/packages/core/v4-publication-qualification.js

@@ -207,6 +207,7 @@ export function validateV4PublicationQualificationReceipt(
 export function assertV4DeclarativePromotionInputs(inputs) {
   const forbidden = Object.entries(inputs || {}).filter(
     ([name, value]) =>
+      name !== "dry-run" &&
       /(command|cmd|script|shell|run)$/iu.test(name) &&
       String(value || "").trim() !== "",
   );

package/packages/core/v4-release-invocation.js

@@ -13,6 +13,8 @@ export const V4_RELEASE_TRANSACTION_CONTRACT =
   "kungfu-buildchain-v4-release-transaction/v1";
 export const V4_RELEASE_RECEIPT_CONTRACT =
   "kungfu-buildchain-v4-release-receipt/v1";
+export const V4_RELEASE_PROVIDER_CONTRACT =
+  "kungfu-buildchain-release-tail-provider/v1";
 
 const SHA_PATTERN = /^[0-9a-f]{40}$/u;
 const TAG_PATTERN = /^v[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/u;
@@ -127,10 +129,59 @@ function validateAuthority(value) {
     validateV4Root(value[name], `$/authority/${name}`);
 }
 
+function validateProvider(value, candidate) {
+  exactKeys(value, ["adapter", "contract", "repository"], "$/provider");
+  if (
+    value.adapter !== "built-in-provider-plane" ||
+    value.contract !== V4_RELEASE_PROVIDER_CONTRACT ||
+    value.repository !== candidate.repository
+  )
+    fault(
+      "invalid-release-provider",
+      "$/provider",
+      "provider identity must bind the built-in Provider Plane and candidate repository",
+    );
+}
+
+function validateParent(value) {
+  exactKeys(
+    value,
+    ["invocationRoot", "transactionRoot", "receiptRoot"],
+    "$/parent",
+  );
+  const roots = [
+    value.invocationRoot,
+    value.transactionRoot,
+    value.receiptRoot,
+  ];
+  if (roots.every((root) => root === null)) return;
+  if (roots.some((root) => root === null))
+    fault(
+      "invalid-release-parent-lineage",
+      "$/parent",
+      "parent lineage roots must be either all null or all present",
+    );
+  roots.forEach((root, index) =>
+    validateV4Root(
+      root,
+      `$/parent/${["invocationRoot", "transactionRoot", "receiptRoot"][index]}`,
+    ),
+  );
+}
+
 export function createV4ReleaseInvocation(value) {
   exactKeys(
     value,
-    ["schema", "publisher", "runtime", "candidate", "target", "authority"],
+    [
+      "schema",
+      "publisher",
+      "runtime",
+      "candidate",
+      "target",
+      "authority",
+      "provider",
+      "parent",
+    ],
     "$",
   );
   if (value.schema !== V4_RELEASE_INVOCATION_CONTRACT)
@@ -144,6 +195,8 @@ export function createV4ReleaseInvocation(value) {
   validateCandidate(value.candidate);
   validateTarget(value.target);
   validateAuthority(value.authority);
+  validateProvider(value.provider, value.candidate);
+  validateParent(value.parent);
   v4CanonicalBytes(value);
   const roots = {
     publisherRoot: v4ContentRoot(
@@ -160,6 +213,8 @@ export function createV4ReleaseInvocation(value) {
       "release-invocation-authority",
       value.authority,
     ),
+    providerRoot: v4ContentRoot("release-invocation-provider", value.provider),
+    parentRoot: v4ContentRoot("release-invocation-parent", value.parent),
   };
   const invocationRoot = v4ContentRoot("release-invocation", {
     schema: V4_RELEASE_INVOCATION_CONTRACT,
@@ -261,16 +316,30 @@ export function planV4ReleaseRoute({
 export function createV4ReleaseTransaction(value) {
   exactKeys(
     value,
-    ["invocationRoot", "publisherRoot", "runtimeRoot"],
+    [
+      "invocationRoot",
+      "publisherRoot",
+      "runtimeRoot",
+      "providerRoot",
+      "parentRoot",
+    ],
     "$transaction",
   );
-  for (const name of ["invocationRoot", "publisherRoot", "runtimeRoot"])
+  for (const name of [
+    "invocationRoot",
+    "publisherRoot",
+    "runtimeRoot",
+    "providerRoot",
+    "parentRoot",
+  ])
     validateV4Root(value[name], `$transaction/${name}`);
   const transaction = {
     schema: V4_RELEASE_TRANSACTION_CONTRACT,
     invocationRoot: value.invocationRoot,
     publisherRoot: value.publisherRoot,
     runtimeRoot: value.runtimeRoot,
+    providerRoot: value.providerRoot,
+    parentRoot: value.parentRoot,
     phases: ["QUALIFY", "APPLY", "SETTLE"],
     writer: "canonical-v4-apply",
   };

package/scripts/check-v4-release-topology.mjs

@@ -12,13 +12,68 @@ import {
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const ledgerPath = path.join(root, "architecture/v4-release-topology.json");
-const releaseMarker =
-  /(?:release-candidate-promote\.yml|promote-buildchain-ref|v4-release-candidate-promote|release-tail-runtime)/u;
 
 function read(relative) {
   return fs.readFileSync(path.join(root, relative), "utf8");
 }
 
+function productionFiles(relative, extensions) {
+  const absolute = path.join(root, relative);
+  if (!fs.existsSync(absolute)) return [];
+  const entries = fs.readdirSync(absolute, { withFileTypes: true });
+  return entries.flatMap((entry) => {
+    const child = path.posix.join(relative, entry.name);
+    if (
+      entry.isDirectory() &&
+      !["dist", "node_modules", ".git"].includes(entry.name)
+    )
+      return productionFiles(child, extensions);
+    if (
+      entry.isFile() &&
+      extensions.some((extension) => entry.name.endsWith(extension))
+    )
+      return [child];
+    return [];
+  });
+}
+
+function matchingProductionFiles(roots, extensions, pattern) {
+  return roots
+    .flatMap((relative) => productionFiles(relative, extensions))
+    .filter((relative) => relative !== "scripts/check-v4-release-topology.mjs")
+    .filter((relative) => pattern.test(read(relative)))
+    .sort();
+}
+
+export function discoverV4ReleaseAuthorityClosure() {
+  const providerPlane = matchingProductionFiles(
+    ["actions", "packages/core"],
+    [".js", ".mjs", ".cjs"],
+    /(?:release-tail-provider-(?:adapters|plane)|create(?:GitHubReleaseAssets|SignedStaticChannel|SiteReleaseActivation|ReleasedEvidence)Adapter)/u,
+  );
+  const runtimeSelectors = matchingProductionFiles(
+    [".github/workflows", "scripts", "packages/core"],
+    [".yml", ".yaml", ".js", ".mjs", ".cjs"],
+    /(?:promotion-runtime-sha|resume-buildchain-runtime-sha|BUILDCHAIN_(?:CURRENT_RUNTIME_SHA|RUNTIME_REF|RESUME_CANDIDATE_RUN_ID)|authorizeV4RuntimeSelection|scanV4RuntimeSelectorPersistence|v4-release-candidate-adapter)/u,
+  );
+  const terminalProjections = matchingProductionFiles(
+    [".github/workflows", "actions", "packages/core", "scripts"],
+    [".yml", ".yaml", ".js", ".mjs", ".cjs"],
+    /(?:createV4ReleaseReceipt|release-receipt\.json|V4_RELEASE_RECEIPT_CONTRACT)/u,
+  );
+  return {
+    providerAdapters: [
+      ...new Set([
+        ...providerPlane,
+        "packages/core/release-tail-provider-plane.js",
+      ]),
+    ].sort(),
+    runtimeSelectors,
+    runtimeEngines: ["actions/v4-release-candidate-promote/index.js"],
+    terminalProjections,
+  };
+}
+
 function jobBlock(source, jobId) {
   const escaped = jobId.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
   return (
@@ -104,25 +159,27 @@ export function discoverV4ReleaseTopology(
       "carriers",
       "mutationSignals",
     ],
-    workflows: workflows.map((workflow) => ({
-      path: workflow.path,
-      triggers: workflow.triggers,
-      jobs: workflow.jobs.map((job) =>
-        [
-          job.id,
-          job.kind,
-          job.uses || "-",
-          job.permissions.contents || "-",
-          job.permissions.idToken || "-",
-          Object.entries(job.carriers)
-            .filter(([, present]) => present)
-            .map(([name]) => name)
-            .join(",") || "-",
-          job.mutationSignals.join(",") || "-",
-        ].join("|"),
-      ),
-      reusableEdges: workflow.reusableEdges,
-    })),
+    workflows: workflows
+      .filter((workflow) => semanticPaths.has(workflow.path))
+      .map((workflow) => ({
+        path: workflow.path,
+        triggers: workflow.triggers,
+        jobs: workflow.jobs.map((job) =>
+          [
+            job.id,
+            job.kind,
+            job.uses || "-",
+            job.permissions.contents || "-",
+            job.permissions.idToken || "-",
+            Object.entries(job.carriers)
+              .filter(([, present]) => present)
+              .map(([name]) => name)
+              .join(",") || "-",
+            job.mutationSignals.join(",") || "-",
+          ].join("|"),
+        ),
+        reusableEdges: workflow.reusableEdges,
+      })),
     metrics: {
       workflowCount: workflows.length,
       jobCount: jobs.length,
@@ -174,7 +231,26 @@ export function findUnknownV4ReleaseTopology(
   const declared = new Set(workflowPaths);
   return allWorkflowPaths
     .filter((relative) => !declared.has(relative))
-    .filter((relative) => releaseMarker.test(readWorkflow(relative)))
+    .filter((relative) => {
+      const source = readWorkflow(relative);
+      const usesReleaseAuthority = parseYamlUses(source).some(({ value }) =>
+        /(?:release-candidate-promote|promote-buildchain-ref|v4-release-candidate-promote|release-tail)/u.test(
+          value,
+        ),
+      );
+      const hasReleaseLanguage =
+        /(?:^|[-_ ])(?:release|publish|promotion|distribution|tag)(?:$|[-_ :])/imu.test(
+          source,
+        );
+      const hasMutationAuthority =
+        /(?:contents|id-token):\s*write/u.test(source) ||
+        /(?:git push|npm publish|gh release (?:create|upload)|createRef|updateRef)/u.test(
+          source,
+        );
+      return (
+        usesReleaseAuthority || (hasReleaseLanguage && hasMutationAuthority)
+      );
+    })
     .sort();
 }
 
@@ -187,10 +263,76 @@ function assertClosedWorld(workflowPaths) {
   );
 }
 
+function assertAuthorityClosure(ledger) {
+  const closure = ledger.authorityClosure;
+  assert.ok(
+    closure && typeof closure === "object",
+    "authority closure missing",
+  );
+  for (const className of [
+    "providerAdapters",
+    "runtimeSelectors",
+    "runtimeEngines",
+    "terminalProjections",
+  ]) {
+    assert.ok(
+      Array.isArray(closure[className]) && closure[className].length > 0,
+      `authority closure class ${className} is empty`,
+    );
+    for (const relative of closure[className])
+      assert.ok(
+        fs.statSync(path.join(root, relative)).isFile(),
+        `authority closure path is not a file: ${relative}`,
+      );
+  }
+  const discovered = discoverV4ReleaseAuthorityClosure();
+  for (const className of Object.keys(discovered))
+    assert.deepEqual(
+      closure[className],
+      discovered[className],
+      `authority closure class drifted: ${className}`,
+    );
+  assert.deepEqual(closure.runtimeEngines, [
+    "actions/v4-release-candidate-promote/index.js",
+  ]);
+  assert.equal(
+    closure.freshEntry,
+    ".github/workflows/release-candidate-promote.yml",
+  );
+  assert.equal(
+    closure.recoveryEntry,
+    ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  );
+  const engineSurface = [
+    ".github/workflows/.release-candidate-promote.yml",
+    ...closure.runtimeEngines,
+  ]
+    .map(read)
+    .join("\n");
+  for (const pattern of closure.forbiddenLegacyEnginePatterns)
+    assert.doesNotMatch(
+      engineSurface,
+      new RegExp(pattern, "u"),
+      `legacy release engine remains reachable: ${pattern}`,
+    );
+  const canonicalWorkflow = read(
+    ".github/workflows/.release-candidate-promote.yml",
+  );
+  assert.match(
+    canonicalWorkflow,
+    /scripts\/v4-release-candidate-adapter\.mjs/u,
+  );
+  assert.match(
+    canonicalWorkflow,
+    /release-invocation\.json[\s\S]*release-transaction\.json[\s\S]*release-receipt\.json/u,
+  );
+}
+
 export function checkV4ReleaseTopology() {
   const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
   assert.equal(ledger.contract, "kungfu-buildchain-v4-release-topology/v1");
   assertClosedWorld(ledger.closedWorld.workflowPaths);
+  assertAuthorityClosure(ledger);
   const actual = discoverV4ReleaseTopology(
     ledger.closedWorld.workflowPaths,
     ledger.semanticScope.workflowPaths,
@@ -219,7 +361,11 @@ export function checkV4ReleaseTopology() {
   return actual;
 }
 
-if (process.argv.includes("--print")) {
+if (process.argv.includes("--print-closure")) {
+  process.stdout.write(
+    `${JSON.stringify(discoverV4ReleaseAuthorityClosure(), null, 2)}\n`,
+  );
+} else if (process.argv.includes("--print")) {
   const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
   process.stdout.write(
     `${JSON.stringify(

package/scripts/dev-delivery-warrant.mjs

@@ -6,6 +6,7 @@ import {
   closeDevDeliveryWarrant,
   createDevDeliveryQueue,
   createNativeCommandContract,
+  fenceDevDeliveryWriterProtocol,
   heartbeatDevDeliveryWarrant,
   observeDevDeliveryQueue,
   qualifyDevDeliveryWarrant,
@@ -91,6 +92,13 @@ function requireTerminalEvidenceCas(options) {
       "terminal evidence reconciliation execute requires expected-old CAS",
     );
   }
+  if (
+    options.command === "fence-writer-protocol" &&
+    options.execute &&
+    !options.expectedOldStateRoot
+  ) {
+    throw new Error("writer protocol fence execute requires expected-old CAS");
+  }
 }
 
 function normalizeRepository(value) {
@@ -175,6 +183,9 @@ function jsonObject(value, label) {
 }
 
 function transitionFor(command, queue, options) {
+  if (command === "fence-writer-protocol") {
+    return fenceDevDeliveryWriterProtocol(queue, { now: options.now });
+  }
   if (command === "submit") {
     const nativeCommandContract = options.environmentRoot
       ? createNativeCommandContract(options.nativeCommand)
@@ -517,7 +528,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
 }
 
 function usage() {
-  return "Usage:\n  buildchain dev warrant <submit|select|heartbeat|qualify|recover|recover-legacy-terminal|close|settle|reconcile-terminal-evidence|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n\nLegacy terminal recovery:\n  recover-legacy-terminal --expected-old sha256:... --legacy-terminal-recovery FILE [--execute]\n\nRead candidate:\n  observe --read-mode v4 --read-qualification FILE --read-qualification-root sha256:... --read-typescript-revision SHA --read-rust-revision SHA --read-validator-version TOKEN [--read-evidence-output FILE]\n";
+  return "Usage:\n  buildchain dev warrant <fence-writer-protocol|submit|select|heartbeat|qualify|recover|recover-legacy-terminal|close|settle|reconcile-terminal-evidence|cancel-queued|observe> --repository owner/repo --branch dev/vN/vN.M [--execute] [--output FILE] [--json]\n\nWriter protocol fence:\n  fence-writer-protocol --expected-old sha256:... [--execute]\n\nLegacy terminal recovery:\n  recover-legacy-terminal --expected-old sha256:... --legacy-terminal-recovery FILE [--execute]\n\nRead candidate:\n  observe --read-mode v4 --read-qualification FILE --read-qualification-root sha256:... --read-typescript-revision SHA --read-rust-revision SHA --read-validator-version TOKEN [--read-evidence-output FILE]\n";
 }
 
 async function main() {
@@ -529,6 +540,7 @@ async function main() {
   const options = devDeliveryCliOptions(args);
   if (
     ![
+      "fence-writer-protocol",
       "submit",
       "select",
       "heartbeat",

package/scripts/generate-channel-promotion-workflow.mjs

@@ -214,8 +214,9 @@ function consumerAdmissionJob() {
         id: policy
         env:
           BUILDCHAIN_CONSUMER_ROOT: .buildchain/consumer
+          BUILDCHAIN_INVOCATION_SOURCE_PATH: \${{ inputs.publication-publisher-workflow-path == '.github/workflows/buildchain-ref-promotion-recovery.yml' && '.github/workflows/release-candidate-promote.yml' || inputs.publication-publisher-workflow-path }}
           BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: \${{ needs.resolve-promotion.outputs.channel }}
-          BUILDCHAIN_INVOKED_WORKFLOW: .github/workflows/release-candidate-promote.yml
+          BUILDCHAIN_INVOKED_WORKFLOW: \${{ inputs.publication-publisher-workflow-path == '.github/workflows/buildchain-ref-promotion-recovery.yml' && '.github/workflows/.release-candidate-promote.yml' || '.github/workflows/release-candidate-promote.yml' }}
           BUILDCHAIN_WORKFLOW_SHA: \${{ needs.resolve-promotion.outputs.router-sha }}
           BUILDCHAIN_RUNTIME_SHA: \${{ needs.resolve-promotion.outputs.router-sha }}
           BUILDCHAIN_STABLE_CONTRACT_LOCK_PATH: \${{ inputs.buildchain-stable-contract-lock-path }}

package/scripts/release-candidate-resolver.mjs

@@ -110,13 +110,13 @@ function digestFileSync(filePath, algorithm, encoding) {
   return hash.digest(encoding);
 }
 
-export function selectMergedChannelPullRequest({ pullRequests = [], targetRef, repository }) {
+export function selectMergedChannelPullRequest({ pullRequests = [], targetRef, targetSha = "", repository }) {
   const normalizedTarget = normalizeBranch(targetRef);
   const candidates = pullRequests.filter((pr) => {
-    const baseRef = normalizeBranch(pr.base?.ref || pr.baseRefName || "");
-    const merged = Boolean(pr.merged_at || pr.mergedAt || pr.state === "closed");
-    const sameRepo = !repository || !pr.head?.repo?.full_name || pr.head.repo.full_name === repository;
-    return merged && sameRepo && baseRef === normalizedTarget;
+    const baseRepo = pr.base?.repo?.full_name || pr.baseRepository?.nameWithOwner;
+    const merged = Boolean(pr.merged_at || pr.mergedAt || pr.merged === true);
+    const rooted = !repository || (baseRepo || pr.head?.repo?.full_name) === repository;
+    return merged && rooted && (!targetSha || (pr.merge_commit_sha || pr.mergeCommit?.oid) === targetSha) && normalizeBranch(pr.base?.ref || pr.baseRefName || "") === normalizedTarget;
   });
   candidates.sort((left, right) => {
     const leftTime = Date.parse(left.merged_at || left.updated_at || left.closed_at || "");
@@ -513,11 +513,11 @@ export async function resolveReleaseCandidateArtifacts({
   });
   const channelPullRequest = selectMergedChannelPullRequest({
     pullRequests: Array.isArray(pulls) ? pulls : [],
-    targetRef: normalizedTarget,
+    targetRef: normalizedTarget, targetSha: sha,
     repository: repoInfo.fullName,
   });
   if (!channelPullRequest) {
-    throw new Error(`no same-repository merged channel PR found for ${sha} into ${normalizedTarget}`);
+    throw new Error(`no exact merged channel PR rooted in ${repoInfo.fullName} found for ${sha} into ${normalizedTarget}`);
   }
   let pullRequest = channelPullRequest;
   if (majorGateTarget) {
@@ -725,16 +725,6 @@ export async function resolveReleaseCandidateArtifacts({
     const noun = publishArtifactKind === "npm" ? "npm package tarballs" : "platform manifests";
     throw new Error(`expected at least ${minimumPayloadCount} downloaded ${noun}, found ${downloadedRequiredArtifactCount}`);
   }
-  const manifests = platformManifestPaths.map((manifestPath) => JSON.parse(fs.readFileSync(manifestPath, "utf8")));
-  const generatedRequiredArtifacts = generatePublishRequiredArtifacts({
-    manifests,
-    version: passport.target?.version || "",
-    kind: publishArtifactKind,
-    tarballPaths: npmTarballPaths,
-    mainPackage: publishPackageMain,
-  });
-  const requiredArtifactsPath = path.join(resolvedOutput, "publish-required-artifacts.json");
-  fs.writeFileSync(requiredArtifactsPath, `${JSON.stringify(generatedRequiredArtifacts, null, 2)}\n`);
   const sealedBundle = publishArtifactKind === "npm"
     ? createResolvedPublicationSealedBundle({
         bundleRoot: payloadDir,
@@ -750,6 +740,16 @@ export async function resolveReleaseCandidateArtifacts({
         releaseAssetPaths,
       })
     : undefined;
+  const manifests = platformManifestPaths.map((manifestPath) => JSON.parse(fs.readFileSync(manifestPath, "utf8")));
+  const generatedRequiredArtifacts = generatePublishRequiredArtifacts({
+    manifests,
+    version: [sealedBundle?.manifest?.npm?.version, passport.target?.version, ""].find(Boolean),
+    kind: publishArtifactKind,
+    tarballPaths: npmTarballPaths,
+    mainPackage: publishPackageMain,
+  });
+  const requiredArtifactsPath = path.join(resolvedOutput, "publish-required-artifacts.json");
+  fs.writeFileSync(requiredArtifactsPath, `${JSON.stringify(generatedRequiredArtifacts, null, 2)}\n`);
   const sealedBundleManifestPath = sealedBundle
     ? path.join(resolvedOutput, "sealed-bundle.json")
     : "";

package/scripts/resume-from-candidate-run.mjs

@@ -785,14 +785,13 @@ async function recoverCandidateEvidence({
   for (const artifact of [selected.passport, selected.summary]) initialDownloads.push(await downloadArtifact({ artifact, repoInfo, apiUrl, token, archiveDir, bundleRoot, fetchImpl }));
   const passport = readOnlyJson(initialDownloads[0].files.filter((file) => path.basename(file.path) === "release-candidate-passport.json"), "release-candidate-passport.json");
   const buildSummary = readOnlyJson(initialDownloads[1].files.filter((file) => path.basename(file.path) === "build-summary.json"), "build-summary.json");
-  const sidecarFiles = initialDownloads[0].files.filter(
-    (file) =>
-      path.basename(file.path) === "release-candidate-stage-capsules.json",
-  );
-  const stageCapsuleSidecar =
-    sidecarFiles.length === 1
-      ? readOnlyJson(sidecarFiles, "release-candidate-stage-capsules.json")
-      : undefined;
+  const [stageCapsuleFile, publicationQualificationFile] = [
+    "release-candidate-stage-capsules.json",
+    "release-candidate-publication-qualification.json",
+  ].map((name) => initialDownloads[0].files.find((file) => path.basename(file.path) === name));
+  const stageCapsuleSidecar = stageCapsuleFile
+    ? readOnlyJson([stageCapsuleFile], "release-candidate-stage-capsules.json")
+    : undefined;
   const { names: requiredNames, publicationNames } = candidateArtifactNames({ passport, selected, artifacts, artifactPatterns });
   const chosen = artifacts.filter((artifact) => requiredNames.has(artifact.name));
   if (chosen.length !== requiredNames.size) {
@@ -804,7 +803,7 @@ async function recoverCandidateEvidence({
   for (const artifact of chosen.filter((entry) => ![selected.passport.id, selected.summary.id].includes(entry.id))) downloads.push(await downloadArtifact({ artifact, repoInfo, apiUrl, token, archiveDir, bundleRoot, fetchImpl }));
   return {
     run, workflow, selected, resolvedOutput, bundleRoot, initialDownloads,
-    passport, buildSummary, stageCapsuleSidecar, chosen, downloads, publicationNames,
+    passport, buildSummary, stageCapsuleSidecar, stageCapsuleFile, publicationQualificationFile, chosen, downloads, publicationNames,
   };
 }
 
@@ -878,7 +877,7 @@ export async function resumeFromCandidateRun({
   try {
     const {
       run, workflow, selected, resolvedOutput, bundleRoot, initialDownloads,
-      passport, buildSummary, stageCapsuleSidecar, chosen, downloads, publicationNames,
+      passport, buildSummary, stageCapsuleSidecar, stageCapsuleFile, publicationQualificationFile, chosen, downloads, publicationNames,
     } = await recoverCandidateEvidence({
       repoInfo, runId, artifactName, artifactPatterns, requiredArtifactCount,
       outputDir, apiUrl, token, fetchImpl, archiveDir,
@@ -1023,9 +1022,9 @@ export async function resumeFromCandidateRun({
         sealedBundleRoot: publication.manifest ? outputPath(bundleRoot) : "",
         sealedBundleManifest: publication.manifest ? outputPath(sealedManifestPath) : "",
         recoveryReceipt: outputPath(recoveryReceiptPath),
-        runtimeResumeEvidence: runtimeResumeEvidencePath
-          ? outputPath(runtimeResumeEvidencePath)
-          : "",
+        stageCapsules: stageCapsuleFile ? outputPath(stageCapsuleFile.absolutePath) : "",
+        publicationQualification: publicationQualificationFile ? outputPath(publicationQualificationFile.absolutePath) : "",
+        runtimeResumeEvidence: runtimeResumeEvidencePath ? outputPath(runtimeResumeEvidencePath) : "",
       },
     };
   } finally {
@@ -1077,10 +1076,10 @@ export async function resumeFromCandidateRunCli() {
       "release-candidate-run-url": result.run.url,
       "release-candidate-recovery-receipt-path": result.paths.recoveryReceipt,
       "release-candidate-recovery-root": result.receipt.root,
+      "release-candidate-stage-capsules-path": result.paths.stageCapsules,
+      "release-candidate-publication-qualification-path": result.paths.publicationQualification,
       "v4-runtime-resume-evidence-path": result.paths.runtimeResumeEvidence,
-      "v4-runtime-resume-finalize-command": result.paths.runtimeResumeEvidence
-        ? "node .buildchain/runtime/promotion-shell/scripts/resume-from-candidate-run.mjs finalize"
-        : "",
+      "v4-runtime-resume-finalize-command": result.paths.runtimeResumeEvidence ? "node .buildchain/runtime/promotion-shell/scripts/resume-from-candidate-run.mjs finalize" : "",
       "release-candidate-root": result.candidateRoot,
       "release-candidate-artifact-root": result.artifactRoot,
       "publish-sealed-bundle-root": result.paths.sealedBundleRoot,