@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/bin/buildchain.mjs

@@ -11,7 +11,7 @@ import { runLifecycle } from "../scripts/run-lifecycle-core.mjs";
 import { runReleasePropagationCli } from "../scripts/release-propagation.mjs";
 import { runReleaseGovernanceCli } from "../scripts/reconcile-release-governance.mjs";
 import { runReleaseTailCli } from "../scripts/release-tail.mjs";
-import { runV4TailResealCli } from "../scripts/v4-tail-reseal.mjs";
+import { runTailResealCli } from "../scripts/tail-reseal.mjs";
 import { runPublicationArtifactCli } from "../scripts/publication-artifact.mjs";
 import { runPublicationPackageCli } from "../scripts/publication-package.mjs";
 import { runPublicationReproducibilityCli } from "../scripts/publication-reproducibility.mjs";
@@ -204,9 +204,9 @@ function runDoctor({ cwd = process.cwd(), requirePublishSourceLock = false } = {
   };
 }
 
-function runScript(scriptName, args) {
+function runScript(scriptName, args, runner = process.execPath) {
   const scriptPath = path.join(root, "scripts", scriptName);
-  const result = spawnSync(process.execPath, [scriptPath, ...args], {
+  const result = spawnSync(runner, [scriptPath, ...args], {
     cwd: process.cwd(),
     env: process.env,
     stdio: "inherit",
@@ -1378,13 +1378,11 @@ async function handleDoctorCommand(args) {
       }
     }
     return;
-
 }
-
 async function handleDevCommand(args) {
     const [subcommand = "", ...devArgs] = args;
-    if (subcommand === "pr-admit") {
-      runScript("dev-pr-auto-merge.mjs", devArgs);
+    const directScript = { deliver: ["dev-delivery-request.sh", "/bin/bash"], "pr-admit": ["dev-pr-auto-merge.mjs", process.execPath] }[subcommand]; if (directScript) {
+      runScript(directScript[0], devArgs, directScript[1]);
       return;
     }
     if (subcommand === "warrant") {
@@ -1404,11 +1402,13 @@ async function handleDevCommand(args) {
       return;
     }
     if (subcommand !== "merge-queue") {
-      throw new Error("usage: buildchain dev <pr-admit|merge-queue|warrant|authority|proof|two-phase> [options]");
+      throw new Error("usage: buildchain dev <deliver|pr-admit|merge-queue|warrant|authority|proof|two-phase> [options]");
     }
     runScript("dev-merge-queue.mjs", devArgs);
     return;
 
+
+
 }
 
 async function handleLogCommand(args) {
@@ -1680,7 +1680,7 @@ async function handleReleaseTailCommand(args) {
 }
 
 async function handleTailResealCommand(args) {
-  await runV4TailResealCli(args);
+  await runTailResealCli(args);
 }
 
 async function handleNextDevelopmentCommand(args) {
@@ -1748,7 +1748,7 @@ async function handlePublishSourceCommand(args) {
 }
 
 async function handleArchitectureCommand(args) {
-  runScript("v4-architecture.mjs", args);
+  runScript("architecture.mjs", args);
 }
 
 async function handleAdopterDeliveryCommand(args) {

package/bin/internal/adopter-delivery-cli.mjs

@@ -1,9 +1,9 @@
 import {
-  loadV4PublishedAdopterDeliveryAuthority,
-  qualifyV4AdopterDeliveryBootstrap,
-  runV4AdopterDeliveryGate,
-  verifyV4AdopterDeliveryReadback,
-} from "../../packages/core/v4-adopter-delivery.js";
+  loadPublishedAdopterDeliveryAuthority,
+  qualifyAdopterDeliveryBootstrap,
+  runAdopterDeliveryGate,
+  verifyAdopterDeliveryReadback,
+} from "../../packages/core/adopter-delivery.js";
 import {
   printJson,
   readFlag,
@@ -22,7 +22,7 @@ export async function runAdopterDeliveryCli(args = []) {
     const input = readJsonInput(readFlag(commandArgs, "input", ""), {
       label: "adopter delivery input",
     });
-    emit(commandArgs, runV4AdopterDeliveryGate(input));
+    emit(commandArgs, runAdopterDeliveryGate(input));
     return;
   }
   if (subcommand === "verify") {
@@ -32,21 +32,21 @@ export async function runAdopterDeliveryCli(args = []) {
     const readback = readJsonInput(readFlag(commandArgs, "readback", ""), {
       label: "adopter delivery readback",
     });
-    emit(commandArgs, verifyV4AdopterDeliveryReadback({ input, readback }));
+    emit(commandArgs, verifyAdopterDeliveryReadback({ input, readback }));
     return;
   }
   if (subcommand === "bootstrap") {
     const request = readJsonInput(readFlag(commandArgs, "input", ""), {
       label: "adopter delivery bootstrap input",
     });
-    emit(commandArgs, qualifyV4AdopterDeliveryBootstrap(request));
+    emit(commandArgs, qualifyAdopterDeliveryBootstrap(request));
     return;
   }
   if (subcommand === "archive") {
     const request = readJsonInput(readFlag(commandArgs, "input", ""), {
       label: "published archive input",
     });
-    const authority = await loadV4PublishedAdopterDeliveryAuthority(request);
+    const authority = await loadPublishedAdopterDeliveryAuthority(request);
     try {
       emit(commandArgs, {
         schemaVersion: authority.schemaVersion,

package/contracts/buildchain-v2-residuals-v1.json

@@ -16,33 +16,6 @@
       "owner": "buildchain-maintainers",
       "sunsetCondition": "Remove after every known caller migrates to the lifecycle version command."
     },
-    {
-      "path": ".github/workflows/.release-docker.yml",
-      "token": "workflows v2 Docker release path is retired",
-      "expectedOccurrences": 1,
-      "classification": "retired-path-tombstone",
-      "callerStatus": "fail-closed",
-      "owner": "buildchain-maintainers",
-      "sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
-    },
-    {
-      "path": ".github/workflows/.release-elastic-beanstalk.yml",
-      "token": "workflows v2 Elastic Beanstalk release path is retired",
-      "expectedOccurrences": 1,
-      "classification": "retired-path-tombstone",
-      "callerStatus": "fail-closed",
-      "owner": "buildchain-maintainers",
-      "sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
-    },
-    {
-      "path": ".github/workflows/.release-new-version.yml",
-      "token": "default: \"v2\"",
-      "expectedOccurrences": 1,
-      "classification": "retired-input-tombstone",
-      "callerStatus": "fail-closed-unused-input",
-      "owner": "buildchain-maintainers",
-      "sunsetCondition": "Remove with the retired workflow input compatibility surface."
-    },
     {
       "path": ".github/workflows/.release-verify.yml",
       "token": "workflows v2",
@@ -52,15 +25,6 @@
       "owner": "buildchain-maintainers",
       "sunsetCondition": "Remove each message with its corresponding retired input or path."
     },
-    {
-      "path": ".github/workflows/.sam-release.yml",
-      "token": "workflows v2 SAM release path is retired",
-      "expectedOccurrences": 1,
-      "classification": "retired-path-tombstone",
-      "callerStatus": "fail-closed",
-      "owner": "buildchain-maintainers",
-      "sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
-    },
     {
       "path": ".github/workflows/.sam-verify.yml",
       "token": "kungfu-systems/buildchain/actions/bump-version@v2",
@@ -88,15 +52,6 @@
       "owner": "buildchain-maintainers",
       "sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
     },
-    {
-      "path": ".github/workflows/.wheel-release.yml",
-      "token": "workflows v2 wheel release path is retired",
-      "expectedOccurrences": 1,
-      "classification": "retired-path-tombstone",
-      "callerStatus": "fail-closed",
-      "owner": "buildchain-maintainers",
-      "sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
-    },
     {
       "path": ".github/workflows/.wheel-verify.yml",
       "token": "kungfu-systems/buildchain/actions/publish-prebuilt@v2",
@@ -116,7 +71,7 @@
       "sunsetCondition": "Remove after wheel consumers migrate to the lifecycle version command."
     },
     {
-      "path": ".github/workflows/candidate-lab.yml",
+      "path": ".github/workflows/self-build-candidate-lab.yml",
       "token": "default: \"v2\"",
       "expectedOccurrences": 1,
       "classification": "legacy-compatibility-ref",
@@ -125,13 +80,67 @@
       "sunsetCondition": "Remove after the legacy workflows comparison lane is formally retired."
     },
     {
-      "path": ".github/workflows/schedule-purge-artifacts.yml",
-      "token": "not shipped in buildchain v2",
+      "path": ".github/workflows/.release-minor-bump-compat.yml",
+      "token": "kungfu-systems/buildchain/actions/bump-version@v2",
+      "expectedOccurrences": 1,
+      "classification": "legacy-compatibility-action",
+      "callerStatus": "legacy-reusable",
+      "owner": "buildchain-maintainers",
+      "sunsetCondition": "Remove after every known caller migrates to the lifecycle version command."
+    },
+    {
+      "path": ".github/workflows/.build-release-verify-compat.yml",
+      "token": "workflows v2",
+      "expectedOccurrences": 3,
+      "classification": "retired-path-tombstone",
+      "callerStatus": "fail-closed",
+      "owner": "buildchain-maintainers",
+      "sunsetCondition": "Remove each message with its corresponding retired input or path."
+    },
+    {
+      "path": ".github/workflows/.build-sam-verify-compat.yml",
+      "token": "kungfu-systems/buildchain/actions/bump-version@v2",
+      "expectedOccurrences": 3,
+      "classification": "legacy-compatibility-action",
+      "callerStatus": "legacy-reusable",
+      "owner": "buildchain-maintainers",
+      "sunsetCondition": "Remove after SAM consumers migrate to the lifecycle version command."
+    },
+    {
+      "path": ".github/workflows/.build-sam-verify-compat.yml",
+      "token": "aws-actions/setup-sam@v2",
+      "expectedOccurrences": 1,
+      "classification": "third-party-action-version",
+      "callerStatus": "legacy-reusable",
+      "owner": "aws-actions/setup-sam maintainers",
+      "sunsetCondition": "Upgrade through normal dependency review when a compatible successor is adopted."
+    },
+    {
+      "path": ".github/workflows/.release-page-sync-retired.yml",
+      "token": "retired in workflows v2",
       "expectedOccurrences": 1,
       "classification": "retired-path-tombstone",
       "callerStatus": "fail-closed",
       "owner": "buildchain-maintainers",
       "sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
+    },
+    {
+      "path": ".github/workflows/.build-wheel-verify-compat.yml",
+      "token": "kungfu-systems/buildchain/actions/publish-prebuilt@v2",
+      "expectedOccurrences": 1,
+      "classification": "legacy-compatibility-action",
+      "callerStatus": "legacy-reusable",
+      "owner": "buildchain-maintainers",
+      "sunsetCondition": "Remove after wheel consumers migrate to the publication authority path."
+    },
+    {
+      "path": ".github/workflows/.build-wheel-verify-compat.yml",
+      "token": "kungfu-systems/buildchain/actions/bump-version@v2",
+      "expectedOccurrences": 3,
+      "classification": "legacy-compatibility-action",
+      "callerStatus": "legacy-reusable",
+      "owner": "buildchain-maintainers",
+      "sunsetCondition": "Remove after wheel consumers migrate to the lifecycle version command."
     }
   ]
 }

package/contracts/dev-delivery-authority-v2.schema.json

@@ -558,8 +558,6 @@
         "repository",
         "protectedBase",
         "pullRequestNumber",
-        "assignmentRoot",
-        "initiativeRoot",
         "sourceIdentityRoot",
         "deliveryClass",
         "candidateId",
@@ -576,10 +574,26 @@
         "qualification",
         "terminal"
       ],
+      "oneOf": [
+        {
+          "required": ["sourceRoot"],
+          "not": {
+            "anyOf": [
+              { "required": ["assignmentRoot"] },
+              { "required": ["initiativeRoot"] }
+            ]
+          }
+        },
+        {
+          "required": ["assignmentRoot", "initiativeRoot"],
+          "not": { "required": ["sourceRoot"] }
+        }
+      ],
       "properties": {
         "repository": { "type": "string" },
         "protectedBase": { "type": "string" },
         "pullRequestNumber": { "type": "integer", "minimum": 1 },
+        "sourceRoot": { "$ref": "#/$defs/root" },
         "assignmentRoot": { "$ref": "#/$defs/root" },
         "initiativeRoot": { "$ref": "#/$defs/root" },
         "sourceIdentityRoot": { "$ref": "#/$defs/root" },

package/contracts/fixtures/v4-tail-reseal-v1/valid.json

@@ -22,7 +22,7 @@
     "ref": "v4-alpha",
     "sha": "dddddddddddddddddddddddddddddddddddddddd",
     "contractRoot": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
-    "consumerPolicyReceiptRoot": "sha256:8d8e55a4ae07a57a2a262e138f55148b05916c364b3d086530e1392c982b886f"
+    "consumerPolicyReceiptRoot": "sha256:acee2edcda59dfaf5fc0dd5877b7a20405fc6e0fa419abdd279a68aef32a0e5c"
   },
   "warrant": {
     "candidateId": "candidate-alpha-2",

package/contracts/v4-canonical-contracts-v1.schema.json

@@ -69,6 +69,7 @@
             "stage-capsule-quarantine",
             "stage-capsule-resume-observation",
             "stage-capsule-resume-plan",
+            "source-verification-evidence",
             "stage-capsule-artifact-manifest",
             "stage-capsule-artifact-content",
             "stage-capsule-fault-campaign",

package/crates/{buildchain-v4-bridge → buildchain-host-bridge}/Cargo.lock

@@ -24,7 +24,7 @@ dependencies = [
 ]
 
 [[package]]
-name = "buildchain-v4-bridge"
+name = "buildchain-host-bridge"
 version = "0.1.0"
 dependencies = [
  "base64",

package/crates/{buildchain-v4-bridge → buildchain-host-bridge}/Cargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "buildchain-v4-bridge"
+name = "buildchain-host-bridge"
 version = "0.1.0"
 edition = "2024"
 license = "Apache-2.0"

package/crates/{buildchain-v4-bridge → buildchain-host-bridge}/src/main.rs

@@ -222,7 +222,7 @@ fn read_bounded(
 fn execute(request: &HostRequest, serialized_request: &[u8]) -> HostResponse {
     let command = env::var("BUILDCHAIN_V4_HOST_COMMAND").unwrap_or_else(|_| "node".to_owned());
     let script = env::var("BUILDCHAIN_V4_HOST_SCRIPT")
-        .unwrap_or_else(|_| "scripts/v4-host-adapter.mjs".to_owned());
+        .unwrap_or_else(|_| "scripts/host-adapter.mjs".to_owned());
     let mut child = match Command::new(&command)
         .arg(&script)
         .stdin(Stdio::piped())
@@ -415,7 +415,7 @@ fn execute(request: &HostRequest, serialized_request: &[u8]) -> HostResponse {
 fn run() -> Result<i32, String> {
     let mode = env::args().nth(1).unwrap_or_else(|| "exchange".to_owned());
     if !["exchange", "compat"].contains(&mode.as_str()) {
-        return Err("usage: buildchain-v4-bridge [exchange|compat]".to_owned());
+        return Err("usage: buildchain-host-bridge [exchange|compat]".to_owned());
     }
     let mut serialized = Vec::new();
     io::stdin()
@@ -448,7 +448,7 @@ fn main() {
     match run() {
         Ok(code) => std::process::exit(code),
         Err(error) => {
-            eprintln!("buildchain-v4-bridge: {error}");
+            eprintln!("buildchain-host-bridge: {error}");
             std::process::exit(DATA_EXIT);
         }
     }