@kungfu-tech/buildchain 4.0.2-alpha.29 → 4.0.2-alpha.32

package/scripts/check-v4-release-topology.mjs

@@ -83,6 +83,13 @@ function rootedPathSet(paths) {
     .digest("hex")}`;
 }
 
+function fileSha256(relative) {
+  return `sha256:${crypto
+    .createHash("sha256")
+    .update(fs.readFileSync(path.join(root, relative)))
+    .digest("hex")}`;
+}
+
 function productionFiles(relative, extensions) {
   const absolute = path.join(root, relative);
   if (!fs.existsSync(absolute)) return [];
@@ -128,6 +135,12 @@ export function discoverV4ReleaseAuthorityClosure() {
     /(?:createV4ReleaseReceipt|release-receipt\.json|V4_RELEASE_RECEIPT_CONTRACT)/u,
   );
   const privilegedModules = discoverStaticModuleClosure(PRIVILEGED_ENTRYPOINTS);
+  const rustWasmArtifact = "packages/core/buildchain-v4-domain.wasm";
+  const rustWasmDistributions = [
+    "actions/promote-buildchain-ref/dist/buildchain-v4-domain.wasm",
+    "actions/release-tail/dist/buildchain-v4-domain.wasm",
+    "actions/v4-release-candidate-promote/dist/buildchain-v4-domain.wasm",
+  ];
   const legacyEngineModules = productionFiles(
     "actions/promote-buildchain-ref",
     [".js", ".mjs", ".cjs"],
@@ -153,6 +166,17 @@ export function discoverV4ReleaseAuthorityClosure() {
       modules: privilegedModules,
       root: rootedPathSet(privilegedModules),
     },
+    rustWasmAuthority: {
+      loader: "packages/core/v4-domain-wasm.js",
+      metadata: "packages/core/v4-domain-wasm-artifact.js",
+      artifact: rustWasmArtifact,
+      artifactRoot: fileSha256(rustWasmArtifact),
+      distributedArtifacts: rustWasmDistributions,
+      byteIdenticalDistributions: rustWasmDistributions.every(
+        (relative) => fileSha256(relative) === fileSha256(rustWasmArtifact),
+      ),
+      fallbackWriterCount: 0,
+    },
     legacyEngineModules,
   };
 }
@@ -183,31 +207,32 @@ function workflowSnapshot(relative) {
   const jobs = document.jobs
     .filter((job) => job.id !== "universal-bootstrap")
     .map((job) => {
-    const block = jobBlock(source, job.id);
-    const uses = job.uses || null;
-    return {
-      id: job.id,
-      kind: uses ? "reusable-call" : "runner",
-      uses,
-      permissions: {
-        contents: permission(block, "contents"),
-        idToken: permission(block, "id-token"),
-      },
-      carriers: {
-        artifactDownload: /uses:\s+actions\/download-artifact@/u.test(block),
-        artifactUpload: /uses:\s+actions\/upload-artifact@/u.test(block),
-        jobOutput: /GITHUB_OUTPUT/u.test(block),
-      },
-      mutationSignals: [
-        /contents:\s*write/u.test(block) && "contents-write",
-        /id-token:\s*write/u.test(block) && "oidc-write",
-        /(?:promote-buildchain-ref|v4-release-candidate-promote)/u.test(
-          block,
-        ) && "promotion-runtime",
-        /(?:git push|npm publish|gh release (?:create|upload))/u.test(block) &&
-          "direct-publication-command",
-      ].filter(Boolean),
-    };
+      const block = jobBlock(source, job.id);
+      const uses = job.uses || null;
+      return {
+        id: job.id,
+        kind: uses ? "reusable-call" : "runner",
+        uses,
+        permissions: {
+          contents: permission(block, "contents"),
+          idToken: permission(block, "id-token"),
+        },
+        carriers: {
+          artifactDownload: /uses:\s+actions\/download-artifact@/u.test(block),
+          artifactUpload: /uses:\s+actions\/upload-artifact@/u.test(block),
+          jobOutput: /GITHUB_OUTPUT/u.test(block),
+        },
+        mutationSignals: [
+          /contents:\s*write/u.test(block) && "contents-write",
+          /id-token:\s*write/u.test(block) && "oidc-write",
+          /(?:promote-buildchain-ref|v4-release-candidate-promote)/u.test(
+            block,
+          ) && "promotion-runtime",
+          /(?:git push|npm publish|gh release (?:create|upload))/u.test(
+            block,
+          ) && "direct-publication-command",
+        ].filter(Boolean),
+      };
     });
   return {
     path: relative,

package/scripts/copy-v4-domain-wasm.mjs

@@ -0,0 +1,14 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const destination = path.resolve(process.argv[2] || "");
+if (!process.argv[2] || path.basename(destination) !== "dist") {
+  throw new Error("usage: copy-v4-domain-wasm.mjs ACTION_DIST_DIRECTORY");
+}
+fs.mkdirSync(destination, { recursive: true });
+fs.copyFileSync(
+  path.join(root, "packages", "core", "buildchain-v4-domain.wasm"),
+  path.join(destination, "buildchain-v4-domain.wasm"),
+);

package/scripts/dev-delivery-authority-command-adapters.mjs

@@ -1,4 +1,3 @@
-import fs from "node:fs";
 import path from "node:path";
 import {
   acquireDevDeliveryLandingWarrant,
@@ -66,6 +65,7 @@ function submitCandidate(state, options) {
     {
       pullRequestNumber: options.pullRequestNumber,
       sourceHead: options.sourceHead,
+      sourceRoot: options.sourceRoot,
       assignmentRoot: options.assignmentRoot,
       initiativeRoot: options.initiativeRoot,
       sourceIdentityRoot: options.sourceIdentityRoot,

package/scripts/dev-delivery-authority.mjs

@@ -276,16 +276,16 @@ export function devDeliveryAuthorityCliOptions(
       "source-head",
       environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_HEAD,
     ),
-    assignmentRoot: flag(
+    sourceRoot: flag(
       rest,
-      "assignment-root",
-      environment.BUILDCHAIN_DEV_DELIVERY_ASSIGNMENT_ROOT,
-    ),
-    initiativeRoot: flag(
-      rest,
-      "initiative-root",
-      environment.BUILDCHAIN_DEV_DELIVERY_INITIATIVE_ROOT,
+      "source-root",
+      environment.BUILDCHAIN_WORK_SOURCE_ROOT ||
+        environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_ROOT,
     ),
+    // Retired roots remain readable in persisted historical candidates.
+    // New authority submissions accept only the Work sourceRoot above.
+    // Retired CLI flags are intentionally ignored by this parser.
+    // This prevents producers from reconstructing obsolete identities.
     sourceIdentityRoot: flag(
       rest,
       "source-identity-root",

package/scripts/dev-delivery-source-proof-reuse.mjs

@@ -479,6 +479,7 @@ function cliInput(args) {
 export function sourceProofReuseCli(args = process.argv.slice(2)) {
   const [command = "", ...rest] = args;
   const input = cliInput(rest);
+  if (command === "predicates") return sourceQualificationPredicates(input);
   if (command === "seal") {
     const proof = sealSourceQualificationProof(input);
     writeJson(input.outputPath, proof);
@@ -527,7 +528,7 @@ export function sourceProofReuseCli(args = process.argv.slice(2)) {
     return decision;
   }
   throw new Error(
-    "usage: dev-delivery-source-proof-reuse.mjs <seal|verify> [options]",
+    "usage: dev-delivery-source-proof-reuse.mjs <predicates|seal|verify> [options]",
   );
 }
 

package/scripts/dev-delivery-warrant-options.mjs

@@ -1,8 +1,8 @@
+import fs from "node:fs";
 export function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
   return index === -1 ? fallback : args[index + 1] || "";
 }
-
 export function hasFlag(args, name) {
   return args.includes(`--${name}`);
 }
@@ -79,16 +79,16 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
       "source-head",
       environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_HEAD,
     ),
-    expectedSourceHead: flag(
-      rest,
-      "expected-source-head",
-      environment.BUILDCHAIN_DEV_DELIVERY_EXPECTED_SOURCE_HEAD,
-    ),
-    observedSourceHead: flag(
+    sourceRoot: flag(
       rest,
-      "observed-source-head",
-      environment.BUILDCHAIN_DEV_DELIVERY_OBSERVED_SOURCE_HEAD,
+      "source-root",
+      environment.BUILDCHAIN_WORK_SOURCE_ROOT ||
+        environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_ROOT ||
+        sourceRootFromGitHubEvent(environment),
     ),
+    // prettier-ignore
+    ...{ expectedSourceHead: flag(rest, "expected-source-head", environment.BUILDCHAIN_DEV_DELIVERY_EXPECTED_SOURCE_HEAD), observedSourceHead: flag(rest, "observed-source-head", environment.BUILDCHAIN_DEV_DELIVERY_OBSERVED_SOURCE_HEAD) },
+
     assignmentRoot: flag(
       rest,
       "assignment-root",
@@ -291,3 +291,8 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
     json: hasFlag(rest, "json"),
   };
 }
+
+// prettier-ignore
+function sourceRootFromGitHubEvent(environment) {
+  try { const event = JSON.parse(fs.readFileSync(environment.GITHUB_EVENT_PATH, "utf8")); return event.client_payload?.candidate?.sourceRoot || JSON.parse(event.inputs?.["native-roots-json"] || "{}").sourceRoot || ""; } catch { return ""; }
+}

package/scripts/dev-delivery-warrant.mjs

@@ -206,8 +206,13 @@ function transitionFor(command, queue, options) {
         "pullRequestNumber",
       ),
       sourceHead: exactSha(options.sourceHead, "sourceHead"),
-      assignmentRoot: exactRoot(options.assignmentRoot, "assignmentRoot"),
-      initiativeRoot: exactRoot(options.initiativeRoot, "initiativeRoot"),
+      ...(options.sourceRoot ? { sourceRoot: options.sourceRoot } : {}),
+      ...(options.assignmentRoot
+        ? { assignmentRoot: options.assignmentRoot }
+        : {}),
+      ...(options.initiativeRoot
+        ? { initiativeRoot: options.initiativeRoot }
+        : {}),
       sourceIdentityRoot: exactRoot(
         options.sourceIdentityRoot,
         "sourceIdentityRoot",

package/scripts/generate-v4-universal-workflow-facades.mjs

@@ -91,8 +91,13 @@ function frozenFacadeSource(relative) {
   });
 }
 
-function isChannelGeneratedFacade(relative) {
-  return (contract.migration.channelGeneratedFacades || []).includes(relative);
+const mutableFacades = new Set([
+  ...(contract.migration.channelGeneratedFacades || []),
+  ".github/workflows/dev-pr-auto-merge.yml",
+]);
+
+function isMutableFacade(relative) {
+  return mutableFacades.has(relative);
 }
 
 function addUniversalInput(source, relative) {
@@ -200,7 +205,7 @@ function verify(source, relative) {
     if (!block.includes("inputs.universal-request-json == ''"))
       fail(`${relative}#${header[1]} can overlap universal execution`);
   }
-  if (!isChannelGeneratedFacade(relative)) {
+  if (!isMutableFacade(relative)) {
     const expected = migrateV4UniversalWorkflowFacade(
       frozenFacadeSource(relative),
       relative,

package/scripts/github-output.mjs

@@ -0,0 +1,31 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+
+function githubOutputRecord(key, value) {
+  const normalized = String(value ?? "");
+  if (!/[\r\n]/u.test(normalized)) return `${key}=${normalized}\n`;
+  const valueLines = normalized.split(/\r\n|\r|\n/u);
+  let delimiter = `BUILDCHAIN_OUTPUT_${crypto
+    .createHash("sha256")
+    .update(`${key}\0${normalized}`)
+    .digest("hex")}`;
+  while (valueLines.includes(delimiter)) delimiter += "_";
+  const separator = normalized.endsWith("\n") ? "" : "\n";
+  return `${key}<<${delimiter}\n${normalized}${separator}${delimiter}\n`;
+}
+
+export function writeGitHubOutputs(outputs) {
+  const outputPath = process.env.GITHUB_OUTPUT;
+  if (!outputPath) {
+    for (const [key, value] of Object.entries(outputs)) {
+      console.log(`${key}=${value}`);
+    }
+    return;
+  }
+  fs.appendFileSync(
+    outputPath,
+    Object.entries(outputs)
+      .map(([key, value]) => githubOutputRecord(key, value))
+      .join(""),
+  );
+}

package/templates/native-dev-delivery.yml

@@ -38,11 +38,8 @@ on:
       source-patch-root:
         description: "Semantic patch root"
         required: true
-      assignment-root:
-        description: "Native Assignment root"
-        required: true
-      initiative-root:
-        description: "Parent Initiative root"
+      native-roots-json:
+        description: "Machine-supplied Work sourceRoot or historical root pair"
         required: true
       plan-root:
         description: "Native qualification plan root"
@@ -117,8 +114,8 @@ jobs:
       delivery-warrant-mode: required
       handoff-workflow-id: native-dev-delivery.yml
       source-workflow-id: ${{ inputs.source-workflow-id || '' }}
-      assignment-root: ${{ github.event.client_payload.candidate.assignmentRoot || inputs.assignment-root }}
-      initiative-root: ${{ github.event.client_payload.candidate.initiativeRoot || inputs.initiative-root }}
+      assignment-root: ${{ github.event.client_payload.candidate.assignmentRoot || fromJSON(inputs.native-roots-json || '{}').assignmentRoot || '' }}
+      initiative-root: ${{ github.event.client_payload.candidate.initiativeRoot || fromJSON(inputs.native-roots-json || '{}').initiativeRoot || '' }}
       source-identity-root: ${{ github.event.client_payload.candidate.sourceIdentityRoot || inputs.source-identity-root }}
       source-patch-root: ${{ github.event.client_payload.candidate.sourcePatchRoot || inputs.source-patch-root }}
       plan-root: ${{ github.event.client_payload.candidate.planRoot || inputs.plan-root }}