@kungfu-tech/buildchain 4.0.2-alpha.30 → 4.0.2-alpha.32

package/docs/v4-rust-wasm-production-authority.md

@@ -0,0 +1,58 @@
+---
+status: draft
+period: 2026-09-04
+theme: buildchain-v4-rust-wasm-production-authority
+doc_type: architecture
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-09-04
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-09-04
+  invisible_context: not-claimed
+---
+
+# Buildchain v4 Rust/WASM production authority
+
+Buildchain v4 的确定性发布语义由
+`crates/buildchain-v4-contracts` 编译出的同一份 WebAssembly artifact 执行。Node
+仍是 GitHub Action 和 npm 包的宿主，但只负责 provider SDK、文件系统、凭据、环境变量及
+workflow 输入输出等副作用边界。权威契约见
+`architecture/v4-rust-wasm-production-authority.json`。
+
+## 分发与调用
+
+`packages/core/buildchain-v4-domain.wasm` 与 JavaScript 一起提交和发布。三个生产 Action
+在构建时把完全相同的字节复制到各自 `dist/`；运行时不进入调用方仓库寻找 Rust
+源码，也不要求安装 Rust。`packages/core/v4-domain-wasm.js` 从自身相邻路径同步读取
+artifact，先核验生成元数据中的 SHA-256，再实例化 WebAssembly 并通过封闭 JSON/bytes
+ABI 调用领域操作。
+
+缺失、被篡改、无法实例化、缺少导出、ABI 版本不符、trap 或非法响应都会失败关闭；
+不存在 JavaScript 领域算法回退。公共 JavaScript API 保留为薄 facade，调用者无须改成
+直接操作 WASM 内存。
+
+## 构建和审计
+
+`pnpm run build:v4-wasm` 使用锁定的 Rust 工具链和 `wasm32-unknown-unknown` target 生成
+artifact 与绑定元数据，并把 Cargo 依赖源目录映射到稳定的虚拟路径，禁止主机 Cargo
+registry 路径进入 artifact。`pnpm run check:v4-wasm` 在干净临时 target 目录重新构建并逐字节
+比较已跟踪 artifact。这个检查不是生产运行时的重复编译：生产只加载已提交字节；检查
+用于证明这些字节仍能由当前 Rust 真相源和锁定工具链唯一导出，从而阻止源码、二进制或
+生成元数据静默漂移。
+
+受保护的 Verify 在 Linux 完成可复现构建，并在 Linux x64、macOS arm64 和 Windows x64
+上用 Node 24 直接加载同一提交中的 artifact。Action bundle 检查同时证明三个 `dist/`
+副本与核心 artifact 完全一致。
+
+## 权威边界
+
+Rust/WASM 决定 canonical JSON/content root、release invocation、product publication、
+provider journal/readback fold、activation、stable fence、partial-mutation recovery 与
+release-tail 的计划、状态转换、重试/readback 和 receipt。Node 执行 Rust 返回的明确
+instruction，把 provider observation 或归类后的 provider fault 回送给 Rust，由 Rust
+决定下一状态；Node 不写第二套相同领域规则。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.30",
+  "version": "4.0.2-alpha.32",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -156,10 +156,12 @@
   "scripts": {
     "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/v4-delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery-authority-candidate.js packages/core/dev-delivery-authority-evidence.js packages/core/dev-delivery-authority-landing.js packages/core/dev-delivery-authority-observation.js packages/core/dev-delivery-authority-qualification.js packages/core/dev-delivery-authority-settlement.js packages/core/dev-delivery-authority-state.js packages/core/dev-delivery-execution-failure.js packages/core/dev-delivery-execution-transfer.js packages/core/dev-delivery-landing-readback.js packages/core/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery-landing-testing-port.js packages/core/dev-delivery-native-execution.js packages/core/dev-delivery-native-proof.js packages/core/dev-delivery-process-boundary.js packages/core/dev-delivery-warrant-qualification.js packages/core/dev-delivery-warrant-state.js scripts/dev-delivery-authority-command-adapters.mjs scripts/dev-delivery-authority-provider.mjs scripts/dev-delivery-authority.mjs scripts/dev-delivery-native-run.mjs scripts/dev-delivery-process-boundary.mjs scripts/dev-delivery-two-phase-resume.mjs scripts/dev-delivery-two-phase.mjs scripts/dev-delivery-warrant-options.mjs scripts/dev-delivery-warrant-store.mjs templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && node scripts/check-v4-release-topology.mjs && node scripts/check-v4-universal-workflow-bootstrap.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-v4-runtime-semantic-closure.mjs && node scripts/check-v3-v4-capability-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-publication-rehearsal-fixture.mjs --check && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check": "pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && node scripts/check-v4-release-topology.mjs && node scripts/check-v4-universal-workflow-bootstrap.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && pnpm run check:v4-wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-v4-runtime-semantic-closure.mjs && node scripts/check-v3-v4-capability-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-publication-rehearsal-fixture.mjs --check && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs bin/internal/compatibility-facts-cli.mjs packages/core/v4-canonical-contracts.js packages/core/kungfu-temporal-fact.js packages/core/buildchain-compatibility-fact.js packages/core/buildchain-compatibility-authority.js packages/core/buildchain-compatibility-proof.js packages/core/v4-floating-consumer-evidence.js packages/core/v4-floating-consumer-policy.js packages/core/v4-floating-consumer-release-passport.js packages/core/v4-runtime-ref-resume-authority.js packages/core/v4-tail-reseal-contract.js packages/core/v4-tail-reseal-github.js packages/core/v4-tail-reseal-receipt.js packages/core/v4-tail-reseal.js packages/core/v4-runtime-selector-persistence.js packages/core/v4-provider-operation-journal.js packages/core/v4-provider-readback-idempotency.js packages/core/v4-release-activation-shadow.js packages/core/v4-stable-publication-fence.js packages/core/v4-partial-mutation-recovery-qualification.js packages/core/v4-stage-capsule.js packages/core/v4-stage-capsule-store.js packages/core/v4-stage-capsule-local-store.js packages/core/v4-platform-stage-checkpoints.js packages/core/v4-stage-capsule-resume-planner.js packages/core/v4-stage-capsule-qualification.js packages/core/v4-stage-capsule-qualification-campaign.js packages/core/v4-delivery-warrant-fixture-runner.js packages/core/v4-delivery-warrant-read-candidate.js packages/core/v4-delivery-warrant-semantic-diff-gate.js packages/core/v4-delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-v4-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/dev-pr-prequeue-guard.mjs scripts/check-v4-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/v4-bridge-bootstrap.mjs scripts/v4-bridge-evidence.mjs scripts/v4-consumer-policy.mjs scripts/v4-host-adapter.mjs scripts/v4-platform-stage-checkpoint-rehearsal.mjs scripts/v4-stage-capsule-resume-rehearsal.mjs scripts/v4-stage-capsule-qualification.mjs scripts/v4-tail-reseal-macos-rehearsal.mjs scripts/v4-tail-reseal.mjs scripts/v4-warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs tests/v4-bridge.test.mjs tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-runtime-semantic-closure.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs tests/v4-warrant-shadow-plan.test.mjs",
     "check:v4-bridge": "cargo fmt --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml",
-    "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-publication-rehearsal.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
+    "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-domain-wasm.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-publication-rehearsal.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
+    "build:v4-wasm": "node scripts/build-v4-domain-wasm.mjs",
+    "check:v4-wasm": "prettier --check packages/core/v4-domain-wasm.js packages/core/v4-domain-wasm-artifact.js scripts/build-v4-domain-wasm.mjs scripts/copy-v4-domain-wasm.mjs tests/v4-domain-wasm.test.mjs && node scripts/build-v4-domain-wasm.mjs --check",
     "check:workflows": "bash scripts/check-workflows.sh",
     "generate:reference": "node scripts/generate-public-reference.mjs",
     "check:reference": "node scripts/generate-public-reference.mjs --check",

package/packages/core/dev-delivery-candidate-identity.js

@@ -21,9 +21,18 @@ export const EXACT_DEV_DELIVERY_PROOF_FIELDS = Object.freeze([
   "sourceWorkflowRunId",
 ]);
 export function devDeliverySourceBinding(input = {}) {
-  const [sourceRoot, assignmentRoot, initiativeRoot] = ["sourceRoot", "assignmentRoot", "initiativeRoot"].map((field) => String(input[field] || "").trim());
-  if (sourceRoot && !assignmentRoot && !initiativeRoot) return { sourceRoot: exactRoot(sourceRoot, "sourceRoot") };
-  if (!sourceRoot && assignmentRoot && initiativeRoot) return { assignmentRoot: exactRoot(assignmentRoot, "assignmentRoot"), initiativeRoot: exactRoot(initiativeRoot, "initiativeRoot") };
+  const [sourceRoot, assignmentRoot, initiativeRoot] = [
+    "sourceRoot",
+    "assignmentRoot",
+    "initiativeRoot",
+  ].map((field) => String(input[field] || "").trim());
+  if (sourceRoot && !assignmentRoot && !initiativeRoot)
+    return { sourceRoot: exactRoot(sourceRoot, "sourceRoot") };
+  if (!sourceRoot && assignmentRoot && initiativeRoot)
+    return {
+      assignmentRoot: exactRoot(assignmentRoot, "assignmentRoot"),
+      initiativeRoot: exactRoot(initiativeRoot, "initiativeRoot"),
+    };
   throw new Error("provide sourceRoot alone or both historical roots");
 }
 export function matchesExactDevDeliveryCandidate(existing, attempted) {
@@ -43,10 +52,22 @@ export function matchesExactDevDeliveryCandidate(existing, attempted) {
   );
 }
 export function reuseExactActiveDevDeliverySourceProof(active, input) {
+  const phaseCompatible =
+    ["provisional", "qualified"].includes(active?.phase) ||
+    (!Object.hasOwn(active || {}, "phase") &&
+      active?.deliveryClass === "non-native-fast" &&
+      !Object.hasOwn(active || {}, "environmentRoot"));
   const exact =
-    ["provisional", "qualified"].includes(active?.phase) &&
-    ["sourceRoot", "assignmentRoot", "initiativeRoot"].every((field) => active[field] === input[field]) &&
-    ["pullRequestNumber", "sourceIdentityRoot", "deliveryClass", "priority"].every((field) => active[field] === input[field]) &&
+    phaseCompatible &&
+    ["sourceRoot", "assignmentRoot", "initiativeRoot"].every(
+      (field) => active[field] === input[field],
+    ) &&
+    [
+      "pullRequestNumber",
+      "sourceIdentityRoot",
+      "deliveryClass",
+      "priority",
+    ].every((field) => active[field] === input[field]) &&
     matchesExactDevDeliveryCandidate(active, {
       ...input,
       sourceProofRoot: active.sourceProofRoot,
@@ -54,19 +75,35 @@ export function reuseExactActiveDevDeliverySourceProof(active, input) {
   return exact ? { ...input, sourceProofRoot: active.sourceProofRoot } : input;
 }
 
-export function createDevDeliveryCandidateIdentity(input, expected, deliveryClass) {
+export function createDevDeliveryCandidateIdentity(
+  input,
+  expected,
+  deliveryClass,
+) {
   const identity = {
     repository: expected.repository,
     protectedBase: expected.protectedBase,
-    pullRequestNumber: positiveInteger(input.pullRequestNumber, "pullRequestNumber"),
+    pullRequestNumber: positiveInteger(
+      input.pullRequestNumber,
+      "pullRequestNumber",
+    ),
     ...devDeliverySourceBinding(input),
-    sourceIdentityRoot: exactRoot(input.sourceIdentityRoot, "sourceIdentityRoot"),
+    sourceIdentityRoot: exactRoot(
+      input.sourceIdentityRoot,
+      "sourceIdentityRoot",
+    ),
     deliveryClass: deliveryClass(input.deliveryClass),
   };
   if (input.identitySemantics) {
-    if (text(input.identitySemantics) !== CHAINED_ATTEMPT_IDENTITY) throw new Error(`unsupported candidate identity semantics ${input.identitySemantics}`);
+    if (text(input.identitySemantics) !== CHAINED_ATTEMPT_IDENTITY)
+      throw new Error(
+        `unsupported candidate identity semantics ${input.identitySemantics}`,
+      );
     identity.identitySemantics = CHAINED_ATTEMPT_IDENTITY;
-    identity.predecessorCandidateId = exactRoot(input.predecessorCandidateId, "predecessorCandidateId");
+    identity.predecessorCandidateId = exactRoot(
+      input.predecessorCandidateId,
+      "predecessorCandidateId",
+    );
   }
   return { ...identity, candidateId: devDeliveryContentRoot(identity) };
 }