@kungfu-tech/buildchain 4.0.2-alpha.8 → 4.0.2

package/scripts/binary-publication-evidence.mjs

@@ -0,0 +1,135 @@
+import fs from "node:fs";
+import crypto from "node:crypto";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  SETTLEMENT_ASSET,
+  verifyPublicationSettlement,
+} from "./v4-publication-settlement.mjs";
+import { releaseAssetClient } from "./release-asset-client.mjs";
+
+export async function readBinaryPublicationEvidence({
+  client,
+  repository,
+  tag,
+  sourceSha,
+  attempts = 40,
+  wait = () => new Promise((resolve) => setTimeout(resolve, 15000)),
+}) {
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    let release;
+    try {
+      release = client.release(tag);
+    } catch {
+      /* Tag creation can precede Release creation. */
+    }
+    const assets = release?.assets || [];
+    const settlements = assets.filter(({ name }) => name === SETTLEMENT_ASSET);
+    const passports = assets.filter(
+      ({ name }) => name === "buildchain.release.json",
+    );
+    if (settlements.length > 1 || passports.length > 1)
+      throw new Error("ambiguous immutable publication evidence");
+    if (settlements.length === 1 && passports.length === 1) {
+      const settlement = JSON.parse(client.assetBytes(settlements[0]));
+      const publicPassport = JSON.parse(client.assetBytes(passports[0]));
+      if (
+        settlement.contract !== "buildchain-v4-publication-settlement/v1" ||
+        settlement.release.sourceSha !== sourceSha ||
+        settlement.release.tag !== tag
+      )
+        throw new Error("binary publication settlement identity mismatch");
+      const tagSha = client.json(
+        `repos/${repository}/commits/${encodeURIComponent(tag)}`,
+      ).sha;
+      if (tagSha !== sourceSha)
+        throw new Error("binary source does not match the exact release tag");
+      verifyPublicationSettlement(settlement.documents, {
+        repository,
+        tag,
+        sourceSha,
+        publicPassport,
+      });
+      return settlement;
+    }
+    if (attempt + 1 < attempts) await wait();
+  }
+  throw new Error(
+    "completed v4 publication evidence is not available within the bounded wait",
+  );
+}
+
+export function prepareBinaryAssetPaths({
+  binaryDir,
+  passportDir,
+  outputDir,
+  capabilityPath,
+}) {
+  fs.mkdirSync(outputDir, { recursive: true });
+  const files = [];
+  for (const directory of [binaryDir, passportDir]) {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      if (!entry.isFile()) continue;
+      const source = path.join(directory, entry.name);
+      if (
+        directory === passportDir &&
+        entry.name === "buildchain.release.json"
+      ) {
+        const renamed = path.join(outputDir, "buildchain.binary.release.json");
+        fs.copyFileSync(source, renamed);
+        files.push(renamed);
+      } else files.push(source);
+    }
+  }
+  if (capabilityPath) {
+    const bytes = fs.readFileSync(capabilityPath);
+    const digest = crypto.createHash("sha256").update(bytes).digest("hex");
+    const retained = path.join(
+      outputDir,
+      `buildchain.binary.capability-${digest}.json`,
+    );
+    fs.writeFileSync(retained, bytes);
+    files.push(retained);
+  }
+  return files;
+}
+
+async function main(mode) {
+  const repository = process.env.GITHUB_REPOSITORY;
+  const tag = process.env.RELEASE_TAG;
+  const client = releaseAssetClient(repository);
+  if (mode === "read") {
+    const settlement = await readBinaryPublicationEvidence({
+      client,
+      repository,
+      tag,
+      sourceSha: process.env.SOURCE_SHA,
+    });
+    const directory = ".buildchain/publication-evidence";
+    client.write(`${directory}/${SETTLEMENT_ASSET}`, settlement);
+    client.write(`${directory}/release.json`, {
+      channel: settlement.release.channel,
+    });
+  } else if (mode === "publish") {
+    const release = client.release(tag);
+    const files = prepareBinaryAssetPaths({
+      binaryDir: "dist/binary",
+      passportDir: ".buildchain/release-passport",
+      outputDir: ".buildchain/binary-publication",
+      capabilityPath: ".buildchain/publication-authority/capability.json",
+    });
+    const results = await client.publish(release, files);
+    client.write(".buildchain/binary-publication/readback.json", {
+      repository,
+      tag,
+      assets: results,
+    });
+    console.log(JSON.stringify({ published: results.length, repository, tag }));
+  } else throw new Error(`unknown binary publication mode: ${mode}`);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
+  main(process.argv[2]).catch((error) => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });

package/scripts/build-contract-core.mjs

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { macosJitRunnerLabel } from "./aws-macos-jit-core.mjs";
 import { windowsJitRunnerLabel } from "./aws-windows-jit-core.mjs";
+export { writeGitHubOutputs } from "./github-output.mjs";
 export const RUNNER_PRESETS = Object.freeze({
   "github-hosted": [
     { id: "linux-x64", name: "Linux x64", platform: "linux", runner: '["ubuntu-24.04"]', capabilities: ["node"] },
@@ -1201,20 +1202,6 @@ export function validateExpectedArtifacts({ expected, files, summary }) {
   return { ok: true, source: "expected-artifacts-json", checks };
 }
 
-export function writeGitHubOutputs(outputs) {
-  const outputPath = process.env.GITHUB_OUTPUT;
-  if (!outputPath) {
-    for (const [key, value] of Object.entries(outputs)) {
-      console.log(`${key}=${value}`);
-    }
-    return;
-  }
-  const lines = Object.entries(outputs).map(
-    ([key, value]) => `${key}=${value}`,
-  );
-  fs.appendFileSync(outputPath, `${lines.join("\n")}\n`);
-}
-
 export function findJsonFiles(root) {
   if (!fs.existsSync(root)) {
     return [];

package/scripts/build-v4-domain-wasm.mjs

@@ -0,0 +1,189 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { spawnSyncCommand } from "../packages/core/spawn-command.js";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const crate = path.join(root, "crates", "buildchain-v4-contracts");
+const artifact = path.join(
+  root,
+  "packages",
+  "core",
+  "buildchain-v4-domain.wasm",
+);
+const metadata = path.join(
+  root,
+  "packages",
+  "core",
+  "v4-domain-wasm-artifact.js",
+);
+const check = process.argv.includes("--check");
+const toolchain = process.env.BUILDCHAIN_RUST_WASM_TOOLCHAIN || "1.96.0";
+const expectedRustc = "rustc 1.96.0 (ac68faa20 2026-05-25)";
+const canonicalBuildHost =
+  process.platform === "linux" && process.arch === "x64";
+
+const sha256 = (bytes) =>
+  crypto.createHash("sha256").update(bytes).digest("hex");
+const normalize = (value) => value.split(path.sep).join("/");
+
+function rustBuildEnvironment() {
+  const environment = {
+    ...process.env,
+    RUSTUP_TOOLCHAIN: toolchain,
+    CARGO_INCREMENTAL: "0",
+    SOURCE_DATE_EPOCH: "0",
+  };
+  delete environment.RUSTFLAGS;
+  delete environment.CARGO_ENCODED_RUSTFLAGS;
+
+  const metadata = spawnSyncCommand(
+    "cargo",
+    [
+      "metadata",
+      "--format-version",
+      "1",
+      "--locked",
+      "--manifest-path",
+      path.join(crate, "Cargo.toml"),
+    ],
+    { cwd: root, encoding: "utf8", env: environment },
+  );
+  if (metadata.error) throw metadata.error;
+  if (metadata.status !== 0) process.exit(metadata.status ?? 1);
+  const dependencyRemaps = JSON.parse(metadata.stdout)
+    .packages.filter((entry) => entry.source)
+    .map((entry) => [
+      path.dirname(entry.manifest_path),
+      `/buildchain/dependencies/${entry.name}-${entry.version}`,
+    ])
+    .sort(([left], [right]) => right.length - left.length);
+  const remaps = [[root, "/buildchain/source"], ...dependencyRemaps].map(
+    ([from, to]) => `--remap-path-prefix=${from}=${to}`,
+  );
+  environment.CARGO_ENCODED_RUSTFLAGS = remaps.join("\x1f");
+  return environment;
+}
+
+function sourceFiles(directory) {
+  return fs.readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const absolute = path.join(directory, entry.name);
+    return entry.isDirectory() ? sourceFiles(absolute) : [absolute];
+  });
+}
+
+const rustc = spawnSyncCommand("rustc", ["--version"], {
+  cwd: root,
+  encoding: "utf8",
+  env: { ...process.env, RUSTUP_TOOLCHAIN: toolchain },
+});
+if (rustc.error) throw rustc.error;
+if (rustc.status !== 0) process.exit(rustc.status ?? 1);
+if (rustc.stdout.trim() !== expectedRustc) {
+  throw new Error(
+    `Rust/WASM authority requires ${expectedRustc}; observed ${rustc.stdout.trim()}`,
+  );
+}
+
+const sourceInputs = [
+  path.join(crate, "Cargo.toml"),
+  path.join(crate, "Cargo.lock"),
+  path.join(crate, "rust-toolchain.toml"),
+  ...sourceFiles(path.join(crate, "src")),
+].sort();
+const sourceHash = crypto.createHash("sha256");
+for (const file of sourceInputs) {
+  sourceHash.update(normalize(path.relative(root, file)));
+  sourceHash.update("\0");
+  sourceHash.update(fs.readFileSync(file));
+  sourceHash.update("\0");
+}
+const sourceSha256 = sourceHash.digest("hex");
+const generatedMetadata = (artifactSha256) =>
+  `// Generated by scripts/build-v4-domain-wasm.mjs.\nexport const V4_DOMAIN_WASM_ABI_VERSION = 1;\nexport const V4_DOMAIN_WASM_RUSTC = ${JSON.stringify(expectedRustc)};\nexport const V4_DOMAIN_WASM_SOURCE_SHA256 =\n  ${JSON.stringify(sourceSha256)};\nexport const V4_DOMAIN_WASM_SHA256 =\n  ${JSON.stringify(artifactSha256)};\n`;
+
+if (!canonicalBuildHost && !check) {
+  throw new Error(
+    "Buildchain v4 Rust/WASM generation requires the canonical linux-x64 host",
+  );
+}
+
+if (!canonicalBuildHost) {
+  if (!fs.existsSync(artifact)) {
+    throw new Error("tracked Buildchain v4 Rust/WASM artifact is missing");
+  }
+  const artifactSha256 = sha256(fs.readFileSync(artifact));
+  if (
+    !fs.existsSync(metadata) ||
+    fs.readFileSync(metadata, "utf8") !== generatedMetadata(artifactSha256)
+  ) {
+    throw new Error("tracked Buildchain v4 Rust/WASM metadata is stale");
+  }
+  console.log(
+    `Buildchain v4 Rust/WASM portable artifact verified: sha256:${artifactSha256}`,
+  );
+} else {
+  const buildEnvironment = rustBuildEnvironment();
+
+  const temporary = fs.mkdtempSync(
+    path.join(os.tmpdir(), "buildchain-v4-wasm-"),
+  );
+  try {
+    const build = spawnSyncCommand(
+      "cargo",
+      [
+        "build",
+        "--locked",
+        "--release",
+        "--manifest-path",
+        path.join(crate, "Cargo.toml"),
+        "--target",
+        "wasm32-unknown-unknown",
+        "--target-dir",
+        temporary,
+        "--lib",
+      ],
+      {
+        cwd: root,
+        stdio: "inherit",
+        env: buildEnvironment,
+      },
+    );
+    if (build.error) throw build.error;
+    if (build.status !== 0) process.exit(build.status ?? 1);
+    const builtPath = path.join(
+      temporary,
+      "wasm32-unknown-unknown",
+      "release",
+      "buildchain_v4_contracts.wasm",
+    );
+    const built = fs.readFileSync(builtPath);
+    const artifactSha256 = sha256(built);
+    const generated = generatedMetadata(artifactSha256);
+    if (check) {
+      if (
+        !fs.existsSync(artifact) ||
+        !fs.readFileSync(artifact).equals(built)
+      ) {
+        throw new Error("tracked Buildchain v4 Rust/WASM artifact is stale");
+      }
+      if (
+        !fs.existsSync(metadata) ||
+        fs.readFileSync(metadata, "utf8") !== generated
+      ) {
+        throw new Error("tracked Buildchain v4 Rust/WASM metadata is stale");
+      }
+    } else {
+      fs.copyFileSync(builtPath, artifact);
+      fs.writeFileSync(metadata, generated);
+    }
+    console.log(
+      `Buildchain v4 Rust/WASM ${check ? "verified" : "built"}: sha256:${artifactSha256}`,
+    );
+  } finally {
+    fs.rmSync(temporary, { recursive: true, force: true });
+  }
+}

package/scripts/check-action-bundles.mjs

@@ -5,7 +5,7 @@ import { spawnSyncCommand } from "../packages/core/spawn-command.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const actionsRoot = path.join(root, "actions");
-const bundlePaths = readdirSync(actionsRoot, { withFileTypes: true })
+const javascriptBundlePaths = readdirSync(actionsRoot, { withFileTypes: true })
   .filter((entry) => entry.isDirectory())
   .map((entry) => path.join(actionsRoot, entry.name, "dist", "index.js"))
   .filter((bundlePath) => {
@@ -17,6 +17,14 @@ const bundlePaths = readdirSync(actionsRoot, { withFileTypes: true })
     }
   })
   .sort();
+const wasmBundlePaths = [
+  "promote-buildchain-ref",
+  "release-tail",
+  "v4-release-candidate-promote",
+].map((name) =>
+  path.join(actionsRoot, name, "dist", "buildchain-v4-domain.wasm"),
+);
+const bundlePaths = [...javascriptBundlePaths, ...wasmBundlePaths];
 
 const before = new Map(
   bundlePaths.map((bundlePath) => [bundlePath, readFileSync(bundlePath)]),
@@ -46,4 +54,6 @@ if (changed.length > 0) {
   process.exit(1);
 }
 
-console.log(`action bundle integrity check passed (${bundlePaths.length} bundles)`);
+console.log(
+  `action bundle integrity check passed (${bundlePaths.length} bundles)`,
+);

package/scripts/check-ci-lane-change-budget.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import crypto from "node:crypto";
+import { projectWorkflowIdentities } from "./workflow-taxonomy.mjs";
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
@@ -14,7 +15,7 @@ const policyPath = path.join(
   "ci-lane-change-budget.json",
 );
 
-const workflows = fs
+const physicalWorkflows = fs
   .readdirSync(workflowRoot, { withFileTypes: true })
   .filter((entry) => entry.isFile() && /\.(?:yaml|yml)$/u.test(entry.name))
   .map((entry) => {
@@ -26,6 +27,8 @@ const workflows = fs
   })
   .sort((left, right) => left.path.localeCompare(right.path));
 
+const workflows = projectWorkflowIdentities(root, physicalWorkflows);
+
 const policy = JSON.parse(fs.readFileSync(policyPath, "utf8"));
 const baselineRevision = String(policy.baseline?.gitRevision || "").trim();
 if (!/^[0-9a-f]{40}$/u.test(baselineRevision)) {

package/scripts/check-core-mechanism-inventory.mjs

@@ -34,9 +34,10 @@ function registrySurfaceIds(root) {
     (entry) => `cli:${entry.id}`,
   );
   const workflows = loadJson(root, "dist/site/workflow-registry.json");
-  const workflowIds = workflows.workflows.map(
-    (entry) => `workflow:${entry.id}`,
-  );
+  const workflowIds = workflows.workflows.flatMap((entry) => [
+    `workflow:${entry.id}`,
+    ...(entry.taxonomy ? [`workflow:${entry.taxonomy.id}`] : []),
+  ]);
   const actionIds = workflows.actions.map((entry) => `action:${entry.id}`);
   const exports = Object.keys(loadJson(root, "package.json").exports).map(
     (entry) => `export:${entry}`,

package/scripts/check-inventory.mjs

@@ -145,39 +145,39 @@ const requiredPaths = [
   ".buildchain/alpha-contract-lock.json",
   ".buildchain/release-impact.json",
   ".github/actionlint.yaml",
-  ".github/workflows/self-hosted-runner-smoke.yml",
-  ".github/workflows/buildchain-ref-promotion.yml",
-  ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml",
-  ".github/workflows/release-line-bootstrap.yml",
+  ".github/workflows/self-ops-runner-smoke.yml",
+  ".github/workflows/self-release-promote.yml",
+  ".github/workflows/self-ops-recovery-failure-dogfood.yml",
+  ".github/workflows/self-release-line-open.yml",
   ".github/workflows/release-governance-reconcile.yml",
   ".github/workflows/dev-pr-auto-merge.yml",
-  ".github/workflows/buildchain-dev-delivery.yml",
+  ".github/workflows/self-ops-dev-delivery.yml",
   ".github/workflows/buildchain-patrol.yml",
   ".github/workflows/patrol-daily.yml",
   ".github/workflows/patrol-weekly.yml",
   ".github/workflows/patrol-monthly.yml",
   ".github/workflows/patrol-observed-evidence.yml",
-  ".github/workflows/buildchain-patrol-daily.yml",
-  ".github/workflows/buildchain-patrol-weekly.yml",
-  ".github/workflows/buildchain-patrol-monthly.yml",
-  ".github/workflows/buildchain-alpha-self-dogfood.yml",
+  ".github/workflows/self-ops-patrol-daily.yml",
+  ".github/workflows/self-ops-patrol-weekly.yml",
+  ".github/workflows/self-ops-patrol-monthly.yml",
+  ".github/workflows/self-build-alpha-dogfood.yml",
   ".github/workflows/release-candidate-promote.yml",
   ".github/workflows/.release-candidate-promote.yml",
   ".github/workflows/release-propagation.yml",
-  ".github/workflows/npm-publish.yml",
+  ".github/workflows/self-release-npm-dry-run.yml",
   ".github/workflows/paper-release.yml",
-  ".github/workflows/binary-distribution.yml",
+  ".github/workflows/self-build-binary-distribution.yml",
   ".github/workflows/.binary-release-assets.yml",
-  ".github/workflows/binary-release-assets.yml",
-  ".github/workflows/verify.yml",
+  ".github/workflows/self-release-binary-assets.yml",
+  ".github/workflows/self-build-verify.yml",
   ".github/workflows/.build.yml",
   ".github/workflows/.gate-profile.yml",
   ".github/workflows/.auditable-demo.yml",
   ".github/workflows/.declarative-auditable-demo.yml",
-  ".github/workflows/auditable-demo.yml",
+  ".github/workflows/self-build-demo-dogfood.yml",
   ".github/workflows/build.yml",
-  ".github/workflows/build-surface-fixture.yml",
-  ".github/workflows/candidate-lab.yml",
+  ".github/workflows/self-build-fixture.yml",
+  ".github/workflows/self-build-candidate-lab.yml",
   "fixtures/libnode-shaped/buildchain.toml",
   "fixtures/libnode-shaped/.github/workflows/build.yml",
   "fixtures/libnode-shaped/package.json"
@@ -197,7 +197,7 @@ if (rootPackage.private !== false) {
   throw new Error("root package must be publishable with private=false");
 }
 const selfDogfoodWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/buildchain-alpha-self-dogfood.yml"),
+  path.join(root, ".github/workflows/self-build-alpha-dogfood.yml"),
   "utf8",
 );
 const selfDogfoodAlphaLock = JSON.parse(
@@ -285,7 +285,7 @@ const channelPromotionWorkflow = fs.readFileSync(
   "utf8",
 );
 const boundedAlphaRecoveryWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/buildchain-ref-promotion-recovery.yml"),
+  path.join(root, ".github/workflows/self-ops-promotion-recovery.yml"),
   "utf8",
 );
 const promotionShellRouting = parsePromotionShellRouting(
@@ -1000,11 +1000,11 @@ for (const requiredSnippet of [
 if (commonJsSourcePattern.test(standaloneBinaryScript)) {
   throw new Error("scripts/build-standalone-binary.mjs must use ESM syntax");
 }
-const npmPublishWorkflow = fs.readFileSync(path.join(root, ".github/workflows/npm-publish.yml"), "utf8");
-const buildchainRefPromotionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/buildchain-ref-promotion.yml"), "utf8");
-const binaryDistributionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/binary-distribution.yml"), "utf8");
+const npmPublishWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-release-npm-dry-run.yml"), "utf8");
+const buildchainRefPromotionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-release-promote.yml"), "utf8");
+const binaryDistributionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-build-binary-distribution.yml"), "utf8");
 const binaryReleaseAssetsWorkflow = fs.readFileSync(path.join(root, ".github/workflows/.binary-release-assets.yml"), "utf8");
-const selfHostedRunnerSmokeWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-hosted-runner-smoke.yml"), "utf8");
+const selfHostedRunnerSmokeWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-ops-runner-smoke.yml"), "utf8");
 const npmDryRunScript = fs.readFileSync(path.join(root, "scripts/npm-publish-dry-run.mjs"), "utf8");
 const npmPublishTransactionScript = fs.readFileSync(path.join(root, "scripts/npm-publish-transaction.mjs"), "utf8");
 const rootPackageJson = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
@@ -1043,8 +1043,8 @@ for (const requiredSnippet of [
   "actions: write",
   "uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha",
   "github.event.workflow_run.event == 'push'",
-  "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
-  "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
+  "name: Classify generated product-state finalization",
+  "selectV4FinalizedProductPublicationVersion",
   "resume-candidate-run-id:",
   "resume-expected-source-tree:",
   "resume-buildchain-runtime-ref:",
@@ -1056,12 +1056,19 @@ for (const requiredSnippet of [
     throw new Error(`buildchain ref promotion workflow missing npm transaction snippet: ${requiredSnippet}`);
   }
 }
+if (buildchainRefPromotionWorkflow.includes("workflow_run.display_title")) {
+  throw new Error(
+    "buildchain ref promotion must classify finalization from rooted product state, not a display title",
+  );
+}
 const releaseCandidatePromoteWorkflow = fs.readFileSync(path.join(root, ".github/workflows/.release-candidate-promote.yml"), "utf8");
 for (const requiredSnippet of [
   "name: QUALIFY canonical v4 release invocation inputs",
   "name: APPLY one rooted provider transaction",
   "name: SETTLE terminal ReleaseReceipt projection",
   "uses: ./.buildchain/runtime/actions/v4-release-candidate-promote",
+  "name: Resolve one exact product publication recovery",
+  "selectV4RecoveredProductPublicationVersion",
   "publisher-workflow-sha:",
   "runtime-commit:",
   "runtime-tree:",
@@ -1101,31 +1108,15 @@ for (const workflowFile of fs.readdirSync(workflowDir).filter((entry) => entry.e
   }
 }
 for (const retiredWorkflow of [
+  ".release-docker.yml",
   ".release-new-version.yml",
   ".release-elastic-beanstalk.yml",
   ".sam-release.yml",
   ".wheel-release.yml",
+  "schedule-purge-artifacts.yml",
 ]) {
-  const retiredSource = fs.readFileSync(path.join(workflowDir, retiredWorkflow), "utf8");
-  for (const requiredSnippet of [
-    "release path is retired",
-    "release-candidate-promote.yml@v3",
-    "publish-gate source-lock enforcement",
-  ]) {
-    if (!retiredSource.includes(requiredSnippet)) {
-      throw new Error(`${retiredWorkflow} must fail closed and point callers at the source-locked release-candidate-promote model: ${requiredSnippet}`);
-    }
-  }
-  for (const forbiddenSnippet of [
-    "npm publish --access=public",
-    "actions/publish-prebuilt@v2",
-    "actions/bump-version@v2",
-    "beanstalk-deploy@",
-    "sam deploy",
-  ]) {
-    if (retiredSource.includes(forbiddenSnippet)) {
-      throw new Error(`${retiredWorkflow} must not keep retired publish side effects: ${forbiddenSnippet}`);
-    }
+  if (fs.existsSync(path.join(workflowDir, retiredWorkflow))) {
+    throw new Error(`${retiredWorkflow} is fully retired and must remain deleted`);
   }
 }
 const promoteBuildchainRefAction = fs.readFileSync(path.join(root, "actions/promote-buildchain-ref/action.yml"), "utf8");