@kungfu-tech/buildchain 4.0.2-alpha.28 → 4.0.2-alpha.30

package/dist/site/public-surface-audit.json

@@ -8905,8 +8905,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "d89f5d875f63d04ba2ab055fe3741acb72c5a537e53db8af9df3fe3170317d52",
-    "pageRegistryDigest": "ae0b1b9c7b883027cf53403221ff2fe2e41ad1aa4d16851d4550e89947d6d6d7"
+    "workflowRegistryDigest": "2ed63e5df83b2a9e069c9ffb139612ab7d25db037e275625c0c15e38b822b517",
+    "pageRegistryDigest": "182e0474bd22e436c079396460f654a0fa310cef11316c03a0996852e9dcdc5b"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-03T11:14:58.000Z",
-  "publishedAt": "2026-09-03T11:14:58.000Z",
+  "generatedAt": "2026-09-04T06:13:05.000Z",
+  "publishedAt": "2026-09-04T06:13:05.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "6b0935c5663d38893a9ff4688fed4cbbe6b9f0ac",
+  "sourceRevision": "2c0f05aceb6bf547dea5a2edc5556c87a74f03fc",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.28",
+    "version": "4.0.2-alpha.30",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/schemas/dev-delivery-authority-v2.schema.json

@@ -558,8 +558,6 @@
         "repository",
         "protectedBase",
         "pullRequestNumber",
-        "assignmentRoot",
-        "initiativeRoot",
         "sourceIdentityRoot",
         "deliveryClass",
         "candidateId",
@@ -576,10 +574,26 @@
         "qualification",
         "terminal"
       ],
+      "oneOf": [
+        {
+          "required": ["sourceRoot"],
+          "not": {
+            "anyOf": [
+              { "required": ["assignmentRoot"] },
+              { "required": ["initiativeRoot"] }
+            ]
+          }
+        },
+        {
+          "required": ["assignmentRoot", "initiativeRoot"],
+          "not": { "required": ["sourceRoot"] }
+        }
+      ],
       "properties": {
         "repository": { "type": "string" },
         "protectedBase": { "type": "string" },
         "pullRequestNumber": { "type": "integer", "minimum": 1 },
+        "sourceRoot": { "$ref": "#/$defs/root" },
         "assignmentRoot": { "$ref": "#/$defs/root" },
         "initiativeRoot": { "$ref": "#/$defs/root" },
         "sourceIdentityRoot": { "$ref": "#/$defs/root" },

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-03T11:14:58.000Z",
-  "publishedAt": "2026-09-03T11:14:58.000Z",
+  "generatedAt": "2026-09-04T06:13:05.000Z",
+  "publishedAt": "2026-09-04T06:13:05.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "6b0935c5663d38893a9ff4688fed4cbbe6b9f0ac",
+  "sourceRevision": "2c0f05aceb6bf547dea5a2edc5556c87a74f03fc",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.28",
+    "version": "4.0.2-alpha.30",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:977a362563fd8fb93571dd670fea95b2285751140bfca2bc4d133123a0b4bb20"
+      "digest": "sha256:5bf8600323e802258023088612be0f68d86fef9ea409e9250dd55358c907f65a"
     },
     {
       "id": "build-facts",

package/dist/site/workflow-registry.json

@@ -1926,7 +1926,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.28",
+      "introducedVersion": "4.0.2-alpha.30",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1947,7 +1947,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.28",
+      "introducedVersion": "4.0.2-alpha.30",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1968,7 +1968,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.28",
+      "introducedVersion": "4.0.2-alpha.30",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2019,7 +2019,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.28",
+      "introducedVersion": "4.0.2-alpha.30",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/node-api-reference.md

@@ -1692,7 +1692,7 @@ Target: `./packages/core/dev-delivery-warrant.js`. Public symbols: 59.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `cancelQueuedDevDeliveryCandidate` | function: function cancelQueuedDevDeliveryCandidate(queueInput, input, options) | queueInput, input, options | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { cancelQueuedDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:520` |
+| `cancelQueuedDevDeliveryCandidate` | function: function cancelQueuedDevDeliveryCandidate(queueInput, input, options) | queueInput, input, options | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { cancelQueuedDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:521` |
 | `classifyDevDeliveryDelta` | function: function classifyDevDeliveryDelta({ proof, current = {} } = {}) | { proof, current = {} } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { classifyDevDeliveryDelta } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:109` |
 | `closeDevDeliveryWarrant` | function: function closeDevDeliveryWarrant(queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {}) | queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { closeDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:395` |
 | `createDevDeliveryQueue` | value: createDevDeliveryQueue | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { createDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
@@ -1733,15 +1733,15 @@ Target: `./packages/core/dev-delivery-warrant.js`. Public symbols: 59.
 | `NATIVE_QUALIFICATION_PROOF_SCHEMA` | constant: const NATIVE_QUALIFICATION_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { NATIVE_QUALIFICATION_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-native-proof.js:31` |
 | `normalizeDevDeliveryQueue` | value: normalizeDevDeliveryQueue | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { normalizeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `normalizeNativeCommandContract` | value: normalizeNativeCommandContract | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { normalizeNativeCommandContract } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-native-proof.js:1` |
-| `observeDevDeliveryQueue` | function: function observeDevDeliveryQueue(queueInput, { now = new Date().toISOString(), allowLegacyV3Readback = false } = {}) | queueInput, { now = new Date().toISOString(), allowLegacyV3Readback = false } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { observeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:534` |
+| `observeDevDeliveryQueue` | function: function observeDevDeliveryQueue(queueInput, { now = new Date().toISOString(), allowLegacyV3Readback = false } = {}) | queueInput, { now = new Date().toISOString(), allowLegacyV3Readback = false } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { observeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:535` |
 | `PROJECT_CUT_REPLAY_PROOF_SCHEMA` | constant: const PROJECT_CUT_REPLAY_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { PROJECT_CUT_REPLAY_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:5` |
 | `qualifyDevDeliveryWarrant` | constant: const qualifyDevDeliveryWarrant | none | value | Import does not declare a throw contract. | none-on-import | `import { qualifyDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:391` |
 | `rankDevDeliveryCandidates` | value: rankDevDeliveryCandidates | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { rankDevDeliveryCandidates } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
-| `reconcileDevDeliveryTerminalEvidence` | constant: const reconcileDevDeliveryTerminalEvidence | none | value | Import does not declare a throw contract. | none-on-import | `import { reconcileDevDeliveryTerminalEvidence } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:529` |
+| `reconcileDevDeliveryTerminalEvidence` | constant: const reconcileDevDeliveryTerminalEvidence | none | value | Import does not declare a throw contract. | none-on-import | `import { reconcileDevDeliveryTerminalEvidence } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:530` |
 | `recoverExpiredDevDeliveryWarrant` | function: function recoverExpiredDevDeliveryWarrant(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoverExpiredDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:312` |
 | `RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA` | constant: const RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/release-blocker-priority.js:15` |
 | `selectDevDeliveryWarrant` | function: function selectDevDeliveryWarrant(queueInput, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { selectDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:106` |
-| `settleDevDeliveryTerminalEvent` | constant: const settleDevDeliveryTerminalEvent | none | value | Import does not declare a throw contract. | none-on-import | `import { settleDevDeliveryTerminalEvent } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:523` |
+| `settleDevDeliveryTerminalEvent` | constant: const settleDevDeliveryTerminalEvent | none | value | Import does not declare a throw contract. | none-on-import | `import { settleDevDeliveryTerminalEvent } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:524` |
 | `SOURCE_QUALIFICATION_PROOF_SCHEMA` | constant: const SOURCE_QUALIFICATION_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { SOURCE_QUALIFICATION_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:3` |
 | `SOURCE_QUALIFICATION_PROOF_V2_SCHEMA` | constant: const SOURCE_QUALIFICATION_PROOF_V2_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { SOURCE_QUALIFICATION_PROOF_V2_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:4` |
 | `submitDevDeliveryCandidate` | value: submitDevDeliveryCandidate | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { submitDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.28",
+  "version": "4.0.2-alpha.30",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/dev-delivery-candidate-identity.js

@@ -20,7 +20,12 @@ export const EXACT_DEV_DELIVERY_PROOF_FIELDS = Object.freeze([
   "environmentRoot",
   "sourceWorkflowRunId",
 ]);
-
+export function devDeliverySourceBinding(input = {}) {
+  const [sourceRoot, assignmentRoot, initiativeRoot] = ["sourceRoot", "assignmentRoot", "initiativeRoot"].map((field) => String(input[field] || "").trim());
+  if (sourceRoot && !assignmentRoot && !initiativeRoot) return { sourceRoot: exactRoot(sourceRoot, "sourceRoot") };
+  if (!sourceRoot && assignmentRoot && initiativeRoot) return { assignmentRoot: exactRoot(assignmentRoot, "assignmentRoot"), initiativeRoot: exactRoot(initiativeRoot, "initiativeRoot") };
+  throw new Error("provide sourceRoot alone or both historical roots");
+}
 export function matchesExactDevDeliveryCandidate(existing, attempted) {
   return (
     existing.sourceHead === attempted.sourceHead &&
@@ -37,18 +42,11 @@ export function matchesExactDevDeliveryCandidate(existing, attempted) {
       attempted.releaseBlockerPriority?.claimRoot
   );
 }
-
 export function reuseExactActiveDevDeliverySourceProof(active, input) {
   const exact =
     ["provisional", "qualified"].includes(active?.phase) &&
-    [
-      "pullRequestNumber",
-      "assignmentRoot",
-      "initiativeRoot",
-      "sourceIdentityRoot",
-      "deliveryClass",
-      "priority",
-    ].every((field) => active[field] === input[field]) &&
+    ["sourceRoot", "assignmentRoot", "initiativeRoot"].every((field) => active[field] === input[field]) &&
+    ["pullRequestNumber", "sourceIdentityRoot", "deliveryClass", "priority"].every((field) => active[field] === input[field]) &&
     matchesExactDevDeliveryCandidate(active, {
       ...input,
       sourceProofRoot: active.sourceProofRoot,
@@ -56,41 +54,22 @@ export function reuseExactActiveDevDeliverySourceProof(active, input) {
   return exact ? { ...input, sourceProofRoot: active.sourceProofRoot } : input;
 }
 
-export function createDevDeliveryCandidateIdentity(
-  input,
-  expected,
-  deliveryClass,
-) {
+export function createDevDeliveryCandidateIdentity(input, expected, deliveryClass) {
   const identity = {
     repository: expected.repository,
     protectedBase: expected.protectedBase,
-    pullRequestNumber: positiveInteger(
-      input.pullRequestNumber,
-      "pullRequestNumber",
-    ),
-    assignmentRoot: exactRoot(input.assignmentRoot, "assignmentRoot"),
-    initiativeRoot: exactRoot(input.initiativeRoot, "initiativeRoot"),
-    sourceIdentityRoot: exactRoot(
-      input.sourceIdentityRoot,
-      "sourceIdentityRoot",
-    ),
+    pullRequestNumber: positiveInteger(input.pullRequestNumber, "pullRequestNumber"),
+    ...devDeliverySourceBinding(input),
+    sourceIdentityRoot: exactRoot(input.sourceIdentityRoot, "sourceIdentityRoot"),
     deliveryClass: deliveryClass(input.deliveryClass),
   };
   if (input.identitySemantics) {
-    if (text(input.identitySemantics) !== CHAINED_ATTEMPT_IDENTITY) {
-      throw new Error(
-        `unsupported candidate identity semantics ${input.identitySemantics}`,
-      );
-    }
+    if (text(input.identitySemantics) !== CHAINED_ATTEMPT_IDENTITY) throw new Error(`unsupported candidate identity semantics ${input.identitySemantics}`);
     identity.identitySemantics = CHAINED_ATTEMPT_IDENTITY;
-    identity.predecessorCandidateId = exactRoot(
-      input.predecessorCandidateId,
-      "predecessorCandidateId",
-    );
+    identity.predecessorCandidateId = exactRoot(input.predecessorCandidateId, "predecessorCandidateId");
   }
   return { ...identity, candidateId: devDeliveryContentRoot(identity) };
 }
-
 export function validateDevDeliveryCandidateChain(candidates, terminalStates) {
   const precedingCandidates = new Map();
   const latestByPullRequest = new Map();

package/packages/core/dev-delivery-warrant-state.js

@@ -12,6 +12,7 @@ import {
 import {
   chainedDevDeliveryAttemptInput,
   createDevDeliveryCandidateIdentity,
+  devDeliverySourceBinding,
   EXACT_DEV_DELIVERY_PROOF_FIELDS,
   matchesExactDevDeliveryCandidate,
   validateDevDeliveryCandidateChain,
@@ -86,8 +87,7 @@ export function issueDevDeliveryWarrant(
     candidateId: candidate.candidateId,
     pullRequestNumber: candidate.pullRequestNumber,
     sourceHead: candidate.sourceHead,
-    assignmentRoot: candidate.assignmentRoot,
-    initiativeRoot: candidate.initiativeRoot,
+    ...devDeliverySourceBinding(candidate),
     sourceIdentityRoot: candidate.sourceIdentityRoot,
     sourcePatchRoot: candidate.sourcePatchRoot,
     sourceProofRoot: candidate.sourceProofRoot,
@@ -413,8 +413,7 @@ function submissionReceipt({ before, after, candidate, action, now }) {
     candidateId: candidate.candidateId,
     pullRequestNumber: candidate.pullRequestNumber,
     sourceHead: candidate.sourceHead,
-    assignmentRoot: candidate.assignmentRoot,
-    initiativeRoot: candidate.initiativeRoot,
+    ...devDeliverySourceBinding(candidate),
     sourceIdentityRoot: candidate.sourceIdentityRoot,
     sourcePatchRoot: candidate.sourcePatchRoot,
     sourceProofRoot: candidate.sourceProofRoot,

package/packages/core/dev-delivery-warrant.js

@@ -198,8 +198,8 @@ export function selectDevDeliveryWarrant(
     candidateId: transaction.result.candidate.candidateId,
     pullRequestNumber: transaction.result.candidate.pullRequestNumber,
     sourceHead: transaction.result.candidate.sourceHead,
-    assignmentRoot: transaction.result.candidate.assignmentRoot,
-    initiativeRoot: transaction.result.candidate.initiativeRoot,
+    ...candidateSourceBinding(transaction.result.candidate),
+
     sourceIdentityRoot: transaction.result.candidate.sourceIdentityRoot,
     sourcePatchRoot: transaction.result.candidate.sourcePatchRoot,
     sourceProofRoot: transaction.result.candidate.sourceProofRoot,
@@ -488,6 +488,7 @@ function createDevDeliverySuccessorWake(queue, now) {
         "candidateId",
         "pullRequestNumber",
         "sourceHead",
+        "sourceRoot",
         "assignmentRoot",
         "initiativeRoot",
         "sourceIdentityRoot",
@@ -586,3 +587,12 @@ export function observeDevDeliveryQueue(
     observedAt: currentTime,
   };
 }
+
+function candidateSourceBinding(candidate) {
+  return candidate.sourceRoot
+    ? { sourceRoot: candidate.sourceRoot }
+    : {
+        assignmentRoot: candidate.assignmentRoot,
+        initiativeRoot: candidate.initiativeRoot,
+      };
+}

package/scripts/build-contract-core.mjs

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { macosJitRunnerLabel } from "./aws-macos-jit-core.mjs";
 import { windowsJitRunnerLabel } from "./aws-windows-jit-core.mjs";
+export { writeGitHubOutputs } from "./github-output.mjs";
 export const RUNNER_PRESETS = Object.freeze({
   "github-hosted": [
     { id: "linux-x64", name: "Linux x64", platform: "linux", runner: '["ubuntu-24.04"]', capabilities: ["node"] },
@@ -1201,20 +1202,6 @@ export function validateExpectedArtifacts({ expected, files, summary }) {
   return { ok: true, source: "expected-artifacts-json", checks };
 }
 
-export function writeGitHubOutputs(outputs) {
-  const outputPath = process.env.GITHUB_OUTPUT;
-  if (!outputPath) {
-    for (const [key, value] of Object.entries(outputs)) {
-      console.log(`${key}=${value}`);
-    }
-    return;
-  }
-  const lines = Object.entries(outputs).map(
-    ([key, value]) => `${key}=${value}`,
-  );
-  fs.appendFileSync(outputPath, `${lines.join("\n")}\n`);
-}
-
 export function findJsonFiles(root) {
   if (!fs.existsSync(root)) {
     return [];

package/scripts/dev-delivery-authority-command-adapters.mjs

@@ -1,4 +1,3 @@
-import fs from "node:fs";
 import path from "node:path";
 import {
   acquireDevDeliveryLandingWarrant,
@@ -66,6 +65,7 @@ function submitCandidate(state, options) {
     {
       pullRequestNumber: options.pullRequestNumber,
       sourceHead: options.sourceHead,
+      sourceRoot: options.sourceRoot,
       assignmentRoot: options.assignmentRoot,
       initiativeRoot: options.initiativeRoot,
       sourceIdentityRoot: options.sourceIdentityRoot,

package/scripts/dev-delivery-authority.mjs

@@ -276,16 +276,16 @@ export function devDeliveryAuthorityCliOptions(
       "source-head",
       environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_HEAD,
     ),
-    assignmentRoot: flag(
+    sourceRoot: flag(
       rest,
-      "assignment-root",
-      environment.BUILDCHAIN_DEV_DELIVERY_ASSIGNMENT_ROOT,
-    ),
-    initiativeRoot: flag(
-      rest,
-      "initiative-root",
-      environment.BUILDCHAIN_DEV_DELIVERY_INITIATIVE_ROOT,
+      "source-root",
+      environment.BUILDCHAIN_WORK_SOURCE_ROOT ||
+        environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_ROOT,
     ),
+    // Retired roots remain readable in persisted historical candidates.
+    // New authority submissions accept only the Work sourceRoot above.
+    // Retired CLI flags are intentionally ignored by this parser.
+    // This prevents producers from reconstructing obsolete identities.
     sourceIdentityRoot: flag(
       rest,
       "source-identity-root",

package/scripts/dev-delivery-source-proof-reuse.mjs

@@ -479,6 +479,7 @@ function cliInput(args) {
 export function sourceProofReuseCli(args = process.argv.slice(2)) {
   const [command = "", ...rest] = args;
   const input = cliInput(rest);
+  if (command === "predicates") return sourceQualificationPredicates(input);
   if (command === "seal") {
     const proof = sealSourceQualificationProof(input);
     writeJson(input.outputPath, proof);
@@ -527,7 +528,7 @@ export function sourceProofReuseCli(args = process.argv.slice(2)) {
     return decision;
   }
   throw new Error(
-    "usage: dev-delivery-source-proof-reuse.mjs <seal|verify> [options]",
+    "usage: dev-delivery-source-proof-reuse.mjs <predicates|seal|verify> [options]",
   );
 }
 

package/scripts/dev-delivery-warrant-options.mjs

@@ -1,8 +1,8 @@
+import fs from "node:fs";
 export function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
   return index === -1 ? fallback : args[index + 1] || "";
 }
-
 export function hasFlag(args, name) {
   return args.includes(`--${name}`);
 }
@@ -79,16 +79,16 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
       "source-head",
       environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_HEAD,
     ),
-    expectedSourceHead: flag(
-      rest,
-      "expected-source-head",
-      environment.BUILDCHAIN_DEV_DELIVERY_EXPECTED_SOURCE_HEAD,
-    ),
-    observedSourceHead: flag(
+    sourceRoot: flag(
       rest,
-      "observed-source-head",
-      environment.BUILDCHAIN_DEV_DELIVERY_OBSERVED_SOURCE_HEAD,
+      "source-root",
+      environment.BUILDCHAIN_WORK_SOURCE_ROOT ||
+        environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_ROOT ||
+        sourceRootFromGitHubEvent(environment),
     ),
+    // prettier-ignore
+    ...{ expectedSourceHead: flag(rest, "expected-source-head", environment.BUILDCHAIN_DEV_DELIVERY_EXPECTED_SOURCE_HEAD), observedSourceHead: flag(rest, "observed-source-head", environment.BUILDCHAIN_DEV_DELIVERY_OBSERVED_SOURCE_HEAD) },
+
     assignmentRoot: flag(
       rest,
       "assignment-root",
@@ -291,3 +291,8 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
     json: hasFlag(rest, "json"),
   };
 }
+
+// prettier-ignore
+function sourceRootFromGitHubEvent(environment) {
+  try { const event = JSON.parse(fs.readFileSync(environment.GITHUB_EVENT_PATH, "utf8")); return event.client_payload?.candidate?.sourceRoot || JSON.parse(event.inputs?.["native-roots-json"] || "{}").sourceRoot || ""; } catch { return ""; }
+}

package/scripts/dev-delivery-warrant.mjs

@@ -206,8 +206,9 @@ function transitionFor(command, queue, options) {
         "pullRequestNumber",
       ),
       sourceHead: exactSha(options.sourceHead, "sourceHead"),
-      assignmentRoot: exactRoot(options.assignmentRoot, "assignmentRoot"),
-      initiativeRoot: exactRoot(options.initiativeRoot, "initiativeRoot"),
+      sourceRoot: options.sourceRoot,
+      assignmentRoot: options.assignmentRoot,
+      initiativeRoot: options.initiativeRoot,
       sourceIdentityRoot: exactRoot(
         options.sourceIdentityRoot,
         "sourceIdentityRoot",

package/scripts/github-output.mjs

@@ -0,0 +1,31 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+
+function githubOutputRecord(key, value) {
+  const normalized = String(value ?? "");
+  if (!/[\r\n]/u.test(normalized)) return `${key}=${normalized}\n`;
+  const valueLines = normalized.split(/\r\n|\r|\n/u);
+  let delimiter = `BUILDCHAIN_OUTPUT_${crypto
+    .createHash("sha256")
+    .update(`${key}\0${normalized}`)
+    .digest("hex")}`;
+  while (valueLines.includes(delimiter)) delimiter += "_";
+  const separator = normalized.endsWith("\n") ? "" : "\n";
+  return `${key}<<${delimiter}\n${normalized}${separator}${delimiter}\n`;
+}
+
+export function writeGitHubOutputs(outputs) {
+  const outputPath = process.env.GITHUB_OUTPUT;
+  if (!outputPath) {
+    for (const [key, value] of Object.entries(outputs)) {
+      console.log(`${key}=${value}`);
+    }
+    return;
+  }
+  fs.appendFileSync(
+    outputPath,
+    Object.entries(outputs)
+      .map(([key, value]) => githubOutputRecord(key, value))
+      .join(""),
+  );
+}

package/scripts/release-candidate-resolver.mjs

@@ -263,17 +263,17 @@ export function selectReleaseAssetPaths({
       `release candidate payload patterns matched no files: ${splitPatterns(patterns).join(", ")}`,
     );
   }
-  const basenames = new Set();
+  const selectedByBasename = new Map();
+  const digest = (filePath) => digestFileSync(filePath, "sha256", "hex");
   for (const filePath of files) {
     const basename = path.basename(filePath);
-    if (basenames.has(basename)) {
-      throw new Error(
-        `release candidate public asset basename is not unique: ${basename}`,
-      );
-    }
-    basenames.add(basename);
+    const existing = selectedByBasename.get(basename);
+    if (!existing) selectedByBasename.set(basename, filePath);
+    else if (digest(existing) !== digest(filePath))
+      throw new Error(`release candidate public asset basename is not unique: ${basename}`);
   }
-  return files;
+  // Repeated paths are safe only when they name the same immutable bytes.
+  return [...selectedByBasename.values()];
 }
 
 function packageNameFromArtifactPath(filePath) {

package/templates/native-dev-delivery.yml

@@ -38,11 +38,8 @@ on:
       source-patch-root:
         description: "Semantic patch root"
         required: true
-      assignment-root:
-        description: "Native Assignment root"
-        required: true
-      initiative-root:
-        description: "Parent Initiative root"
+      native-roots-json:
+        description: "Machine-supplied Work sourceRoot or historical root pair"
         required: true
       plan-root:
         description: "Native qualification plan root"
@@ -117,8 +114,8 @@ jobs:
       delivery-warrant-mode: required
       handoff-workflow-id: native-dev-delivery.yml
       source-workflow-id: ${{ inputs.source-workflow-id || '' }}
-      assignment-root: ${{ github.event.client_payload.candidate.assignmentRoot || inputs.assignment-root }}
-      initiative-root: ${{ github.event.client_payload.candidate.initiativeRoot || inputs.initiative-root }}
+      assignment-root: ${{ github.event.client_payload.candidate.assignmentRoot || fromJSON(inputs.native-roots-json || '{}').assignmentRoot || '' }}
+      initiative-root: ${{ github.event.client_payload.candidate.initiativeRoot || fromJSON(inputs.native-roots-json || '{}').initiativeRoot || '' }}
       source-identity-root: ${{ github.event.client_payload.candidate.sourceIdentityRoot || inputs.source-identity-root }}
       source-patch-root: ${{ github.event.client_payload.candidate.sourcePatchRoot || inputs.source-patch-root }}
       plan-root: ${{ github.event.client_payload.candidate.planRoot || inputs.plan-root }}