@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/packages/core/{v4-delivery-warrant-shadow-adapter.js → delivery-warrant-shadow-adapter.js}

@@ -3,11 +3,11 @@ import crypto from "node:crypto";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { runV4DeliveryWarrantTraceFixture } from "./v4-delivery-warrant-fixture-runner.js";
+import { runDeliveryWarrantTraceFixture } from "./delivery-warrant-fixture-runner.js";
 
-export const V4_DELIVERY_WARRANT_SHADOW_OBSERVATION_CONTRACT =
+export const DELIVERY_WARRANT_SHADOW_OBSERVATION_CONTRACT =
   "buildchain-v4-delivery-warrant-shadow-observation/v1";
-export const V4_DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT =
+export const DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT =
   "buildchain-v4-delivery-warrant-shadow-result/v1";
 
 const HOST_REQUEST_CONTRACT = "kungfu-buildchain-v4-host-request";
@@ -117,7 +117,7 @@ function retainUntil(recordedAt) {
   return new Date(time + RETENTION_DAYS * 24 * 60 * 60 * 1000).toISOString();
 }
 
-export function createV4DeliveryWarrantShadowRequest(
+export function createDeliveryWarrantShadowRequest(
   bytes,
   { requestId = crypto.randomUUID(), timeoutMs = 5_000 } = {},
 ) {
@@ -203,14 +203,14 @@ function defaultHost() {
       "--locked",
       "--quiet",
       "--manifest-path",
-      path.join(root, "crates", "buildchain-v4-contracts", "Cargo.toml"),
+      path.join(root, "crates", "buildchain-domain-contracts", "Cargo.toml"),
       "--",
       "host",
     ],
   };
 }
 
-export function invokeV4RustShadowHost(
+export function invokeRustShadowHost(
   request,
   { command, arguments: commandArguments, cwd = root, signal } = {},
 ) {
@@ -322,12 +322,12 @@ function skippedShadow(inputRoot, code) {
   };
 }
 
-export async function runV4DeliveryWarrantShadow(
+export async function runDeliveryWarrantShadow(
   value,
   {
     enabled = enabledByDefault(),
-    invokeLegacy = runV4DeliveryWarrantTraceFixture,
-    invokeRust = invokeV4RustShadowHost,
+    invokeLegacy = runDeliveryWarrantTraceFixture,
+    invokeRust = invokeRustShadowHost,
     host = {},
     requestId,
     timeoutMs = 5_000,
@@ -343,7 +343,7 @@ export async function runV4DeliveryWarrantShadow(
   const inputRoot = sha256(bytes);
   if (!enabled) {
     return {
-      schema: V4_DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
+      schema: DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
       authoritativeResult,
       shadow: skippedShadow(inputRoot, "shadow-disabled"),
     };
@@ -354,7 +354,7 @@ export async function runV4DeliveryWarrantShadow(
     retentionScope = publicRetention(retention);
   } catch (error) {
     return {
-      schema: V4_DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
+      schema: DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
       authoritativeResult,
       shadow: skippedShadow(inputRoot, error.code || "input-not-public-safe"),
     };
@@ -371,13 +371,13 @@ export async function runV4DeliveryWarrantShadow(
       rustRevision: exactSource(sources.rustRevision, "rustRevision"),
       validatorVersion: exactValidator(sources.validatorVersion),
     };
-    request = createV4DeliveryWarrantShadowRequest(bytes, {
+    request = createDeliveryWarrantShadowRequest(bytes, {
       requestId,
       timeoutMs,
     });
   } catch {
     return {
-      schema: V4_DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
+      schema: DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
       authoritativeResult,
       shadow: skippedShadow(inputRoot, "shadow-config-invalid"),
     };
@@ -396,7 +396,7 @@ export async function runV4DeliveryWarrantShadow(
   }
 
   const observation = {
-    schema: V4_DELIVERY_WARRANT_SHADOW_OBSERVATION_CONTRACT,
+    schema: DELIVERY_WARRANT_SHADOW_OBSERVATION_CONTRACT,
     authority: "typescript-v3",
     rustAuthority: "none",
     rustEffects: "disabled",
@@ -431,7 +431,7 @@ export async function runV4DeliveryWarrantShadow(
     }
   }
   return {
-    schema: V4_DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
+    schema: DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
     authoritativeResult,
     shadow: {
       status,

package/packages/core/dev-delivery-candidate-identity.js

@@ -20,7 +20,21 @@ export const EXACT_DEV_DELIVERY_PROOF_FIELDS = Object.freeze([
   "environmentRoot",
   "sourceWorkflowRunId",
 ]);
-
+export function devDeliverySourceBinding(input = {}) {
+  const [sourceRoot, assignmentRoot, initiativeRoot] = [
+    "sourceRoot",
+    "assignmentRoot",
+    "initiativeRoot",
+  ].map((field) => String(input[field] || "").trim());
+  if (sourceRoot && !assignmentRoot && !initiativeRoot)
+    return { sourceRoot: exactRoot(sourceRoot, "sourceRoot") };
+  if (!sourceRoot && assignmentRoot && initiativeRoot)
+    return {
+      assignmentRoot: exactRoot(assignmentRoot, "assignmentRoot"),
+      initiativeRoot: exactRoot(initiativeRoot, "initiativeRoot"),
+    };
+  throw new Error("provide sourceRoot alone or both historical roots");
+}
 export function matchesExactDevDeliveryCandidate(existing, attempted) {
   return (
     existing.sourceHead === attempted.sourceHead &&
@@ -37,6 +51,29 @@ export function matchesExactDevDeliveryCandidate(existing, attempted) {
       attempted.releaseBlockerPriority?.claimRoot
   );
 }
+export function reuseExactActiveDevDeliverySourceProof(active, input) {
+  const phaseCompatible =
+    ["provisional", "qualified"].includes(active?.phase) ||
+    (!Object.hasOwn(active || {}, "phase") &&
+      active?.deliveryClass === "non-native-fast" &&
+      !Object.hasOwn(active || {}, "environmentRoot"));
+  const exact =
+    phaseCompatible &&
+    ["sourceRoot", "assignmentRoot", "initiativeRoot"].every(
+      (field) => active[field] === input[field],
+    ) &&
+    [
+      "pullRequestNumber",
+      "sourceIdentityRoot",
+      "deliveryClass",
+      "priority",
+    ].every((field) => active[field] === input[field]) &&
+    matchesExactDevDeliveryCandidate(active, {
+      ...input,
+      sourceProofRoot: active.sourceProofRoot,
+    });
+  return exact ? { ...input, sourceProofRoot: active.sourceProofRoot } : input;
+}
 
 export function createDevDeliveryCandidateIdentity(
   input,
@@ -50,8 +87,7 @@ export function createDevDeliveryCandidateIdentity(
       input.pullRequestNumber,
       "pullRequestNumber",
     ),
-    assignmentRoot: exactRoot(input.assignmentRoot, "assignmentRoot"),
-    initiativeRoot: exactRoot(input.initiativeRoot, "initiativeRoot"),
+    ...devDeliverySourceBinding(input),
     sourceIdentityRoot: exactRoot(
       input.sourceIdentityRoot,
       "sourceIdentityRoot",
@@ -59,11 +95,10 @@ export function createDevDeliveryCandidateIdentity(
     deliveryClass: deliveryClass(input.deliveryClass),
   };
   if (input.identitySemantics) {
-    if (text(input.identitySemantics) !== CHAINED_ATTEMPT_IDENTITY) {
+    if (text(input.identitySemantics) !== CHAINED_ATTEMPT_IDENTITY)
       throw new Error(
         `unsupported candidate identity semantics ${input.identitySemantics}`,
       );
-    }
     identity.identitySemantics = CHAINED_ATTEMPT_IDENTITY;
     identity.predecessorCandidateId = exactRoot(
       input.predecessorCandidateId,
@@ -72,7 +107,6 @@ export function createDevDeliveryCandidateIdentity(
   }
   return { ...identity, candidateId: devDeliveryContentRoot(identity) };
 }
-
 export function validateDevDeliveryCandidateChain(candidates, terminalStates) {
   const precedingCandidates = new Map();
   const latestByPullRequest = new Map();

package/packages/core/dev-delivery-execution-transfer.js

@@ -37,10 +37,10 @@ const FAILURE_FILES = [
   "warrant.json",
 ];
 
-const V4_RUNTIME_SELECTOR =
+const DOMAIN_RUNTIME_SELECTOR =
   /^(?:[0-9a-f]{40}|v4|v4-alpha|train\/v4\/v4\.0\/[a-z0-9][a-z0-9._-]*)$/u;
 
-const V4_RUNTIME_SELECTOR_DESCRIPTION =
+const RUNTIME_SELECTOR_DESCRIPTION =
   "runtime selector must be an exact immutable SHA, v4, v4-alpha, or train/v4/v4.0/<capability>";
 
 function requiredFiles(outcome) {
@@ -165,8 +165,8 @@ function runtimeBinding(input = {}) {
     resolvedSha: exactSha(input.resolvedSha, "resolved runtime SHA"),
     selectionRoot: exactRoot(input.selectionRoot, "runtime selection root"),
   };
-  if (!V4_RUNTIME_SELECTOR.test(runtime.selector)) {
-    throw new Error(V4_RUNTIME_SELECTOR_DESCRIPTION);
+  if (!DOMAIN_RUNTIME_SELECTOR.test(runtime.selector)) {
+    throw new Error(RUNTIME_SELECTOR_DESCRIPTION);
   }
   return runtime;
 }
@@ -207,8 +207,8 @@ function verifiedRuntimeSelection(directory, expected = {}) {
   if (JSON.stringify(selection) !== JSON.stringify(normalized)) {
     throw new Error("runtime selection is not exact canonical content");
   }
-  if (!V4_RUNTIME_SELECTOR.test(normalized.selector)) {
-    throw new Error(V4_RUNTIME_SELECTOR_DESCRIPTION);
+  if (!DOMAIN_RUNTIME_SELECTOR.test(normalized.selector)) {
+    throw new Error(RUNTIME_SELECTOR_DESCRIPTION);
   }
   const selectionRoot = sha256Bytes(
     Buffer.from(`${JSON.stringify(normalized, null, 2)}\n`),

package/packages/core/dev-delivery-native-proof.js

@@ -30,7 +30,7 @@ export {
 };
 export const NATIVE_QUALIFICATION_PROOF_SCHEMA =
   "kungfu.buildchain.native-qualification-proof/v4";
-const LEGACY_NATIVE_QUALIFICATION_PROOF_V3_SCHEMA =
+const LEGACY_NATIVE_QUALIFICATION_PROOF_BASELINE_SCHEMA =
   "kungfu.buildchain.native-qualification-proof/v3";
 const LEGACY_NATIVE_QUALIFICATION_PROOF_V2_SCHEMA =
   "kungfu.buildchain.native-qualification-proof/v2";
@@ -44,9 +44,13 @@ export const NATIVE_PROOF_BASE_DELTA_SCHEMA =
   "kungfu.buildchain.native-proof-base-delta/v1";
 const NATIVE_QUALIFICATION_ROOT_SEMANTICS = "semantic-native-identity-v1";
 
-function normalizeQualifiedWarrant(warrant, candidate, allowLegacyV3Readback) {
-  const qualifiedV3Readback =
-    allowLegacyV3Readback &&
+function normalizeQualifiedWarrant(
+  warrant,
+  candidate,
+  allowLegacyBaselineReadback,
+) {
+  const qualifiedBaselineReadback =
+    allowLegacyBaselineReadback &&
     !warrant.nativeCommandContract &&
     !candidate.nativeCommandContract &&
     !warrant.nativeExecutionReceiptRoot &&
@@ -59,7 +63,7 @@ function normalizeQualifiedWarrant(warrant, candidate, allowLegacyV3Readback) {
     warrant.nativeProofReuseRoot,
     "Warrant nativeProofReuseRoot",
   );
-  if (!qualifiedV3Readback) {
+  if (!qualifiedBaselineReadback) {
     warrant.nativeExecutionReceiptRoot = exactRoot(
       warrant.nativeExecutionReceiptRoot,
       "Warrant nativeExecutionReceiptRoot",
@@ -74,7 +78,7 @@ function normalizeQualifiedWarrant(warrant, candidate, allowLegacyV3Readback) {
 
 export function validateActiveDevDeliveryWarrant(
   queue,
-  { allowLegacyV3Readback = false } = {},
+  { allowLegacyBaselineReadback = false } = {},
 ) {
   const warrant = queue.activeWarrant;
   if (warrant.schema !== "kungfu.buildchain.dev-delivery-warrant/v1")
@@ -110,7 +114,7 @@ export function validateActiveDevDeliveryWarrant(
       "exactly one active candidate must match the active Warrant",
     );
   if (warrant.phase === "qualified") {
-    normalizeQualifiedWarrant(warrant, active[0], allowLegacyV3Readback);
+    normalizeQualifiedWarrant(warrant, active[0], allowLegacyBaselineReadback);
   } else if (
     warrant.phase === "provisional" &&
     (warrant.nativeProofRoot ||
@@ -288,7 +292,7 @@ export function verifyNativeQualificationProof(proofInput, expected = {}) {
     if (
       ![
         NATIVE_QUALIFICATION_PROOF_SCHEMA,
-        LEGACY_NATIVE_QUALIFICATION_PROOF_V3_SCHEMA,
+        LEGACY_NATIVE_QUALIFICATION_PROOF_BASELINE_SCHEMA,
         LEGACY_NATIVE_QUALIFICATION_PROOF_V2_SCHEMA,
         LEGACY_NATIVE_QUALIFICATION_PROOF_SCHEMA,
       ].includes(proof.schema)

package/packages/core/dev-delivery-warrant-legacy-recovery.js

@@ -140,7 +140,7 @@ export function recoverLegacyTerminalDevDeliveryQueue(
     );
   }
   const before = normalizeDevDeliveryQueue(queueInput, {
-    allowLegacyV3Readback: true,
+    allowLegacyBaselineReadback: true,
   });
   const expectedOldStateRoot = exactRoot(
     request.expectedOldStateRoot,

package/packages/core/dev-delivery-warrant-native-compatibility.js

@@ -1,6 +1,6 @@
 export function lacksExactNativeExecutionContract(
   candidate,
-  allowLegacyV3Readback = false,
+  allowLegacyBaselineReadback = false,
 ) {
   const native =
     candidate.deliveryClass !== "non-native-fast" ||
@@ -9,17 +9,17 @@ export function lacksExactNativeExecutionContract(
   return Boolean(
     native &&
     (!candidate.environmentRoot ||
-      (!candidate.nativeCommandContract && !allowLegacyV3Readback)),
+      (!candidate.nativeCommandContract && !allowLegacyBaselineReadback)),
   );
 }
 
 export function lacksLiveNativeProof(
   candidate,
   status,
-  { allowLegacyV3Readback = false, allowLegacyQueuedReadback = false } = {},
+  { allowLegacyV3Readback: legacyReadback = false, allowLegacyBaselineReadback = legacyReadback, allowLegacyQueuedReadback = false } = {},
 ) {
   return (
-    lacksExactNativeExecutionContract(candidate, allowLegacyV3Readback) &&
+    lacksExactNativeExecutionContract(candidate, allowLegacyBaselineReadback) &&
     !(status === "queued" && allowLegacyQueuedReadback) &&
     !TERMINAL_STATES.has(status)
   );

package/packages/core/dev-delivery-warrant-state.js

@@ -12,6 +12,7 @@ import {
 import {
   chainedDevDeliveryAttemptInput,
   createDevDeliveryCandidateIdentity,
+  devDeliverySourceBinding,
   EXACT_DEV_DELIVERY_PROOF_FIELDS,
   matchesExactDevDeliveryCandidate,
   validateDevDeliveryCandidateChain,
@@ -86,8 +87,7 @@ export function issueDevDeliveryWarrant(
     candidateId: candidate.candidateId,
     pullRequestNumber: candidate.pullRequestNumber,
     sourceHead: candidate.sourceHead,
-    assignmentRoot: candidate.assignmentRoot,
-    initiativeRoot: candidate.initiativeRoot,
+    ...devDeliverySourceBinding(candidate),
     sourceIdentityRoot: candidate.sourceIdentityRoot,
     sourcePatchRoot: candidate.sourcePatchRoot,
     sourceProofRoot: candidate.sourceProofRoot,
@@ -279,7 +279,8 @@ function normalizeCandidate(input, expected) {
   }
   if (
     lacksLiveNativeProof(candidate, status, {
-      allowLegacyV3Readback: expected.allowLegacyV3Readback,
+      allowLegacyBaselineReadback:
+        expected.allowLegacyBaselineReadback ?? expected.allowLegacyV3Readback,
       allowLegacyQueuedReadback: expected.allowLegacyQueuedNativeReadback,
     })
   )
@@ -358,12 +359,12 @@ export function normalizeDevDeliveryQueue(input, expected = {}) {
   const hasExecutionReceipt = !!queue.activeWarrant?.nativeExecutionReceiptRoot;
   const hasQualificationReceipt =
     !!queue.activeWarrant?.qualificationReceiptRoot;
-  const allowLegacyV3Readback =
-    expected.allowLegacyV3Readback === true &&
-    hasExecutionReceipt === hasQualificationReceipt;
+  const allowLegacyBaselineReadback =
+    (expected.allowLegacyBaselineReadback ?? expected.allowLegacyV3Readback) ===
+      true && hasExecutionReceipt === hasQualificationReceipt;
   const candidateExpected = {
     ...queue,
-    allowLegacyV3Readback,
+    allowLegacyBaselineReadback,
     allowLegacyQueuedNativeReadback: true,
   };
   queue.candidates = (queue.candidates || []).map((candidate) =>
@@ -372,7 +373,7 @@ export function normalizeDevDeliveryQueue(input, expected = {}) {
   validateDevDeliveryCandidateChain(queue.candidates, TERMINAL_STATES);
   queue.updatedAt = timestamp(queue.updatedAt, "queue updatedAt");
   if (queue.activeWarrant) {
-    validateActiveDevDeliveryWarrant(queue, { allowLegacyV3Readback });
+    validateActiveDevDeliveryWarrant(queue, { allowLegacyBaselineReadback });
   } else if (
     queue.candidates.some((candidate) =>
       ["selected", "proving", "waiting", "blocked", "qualified"].includes(
@@ -413,8 +414,7 @@ function submissionReceipt({ before, after, candidate, action, now }) {
     candidateId: candidate.candidateId,
     pullRequestNumber: candidate.pullRequestNumber,
     sourceHead: candidate.sourceHead,
-    assignmentRoot: candidate.assignmentRoot,
-    initiativeRoot: candidate.initiativeRoot,
+    ...devDeliverySourceBinding(candidate),
     sourceIdentityRoot: candidate.sourceIdentityRoot,
     sourcePatchRoot: candidate.sourcePatchRoot,
     sourceProofRoot: candidate.sourceProofRoot,
@@ -572,12 +572,11 @@ function effectivePriority(candidate, policy, now) {
     releaseBlocker: Boolean(candidate.releaseBlockerPriority),
   };
 }
-export function rankDevDeliveryCandidates(
-  queueInput,
-  { now = new Date().toISOString(), allowLegacyV3Readback = false } = {},
-) {
+export function rankDevDeliveryCandidates(queueInput, options = {}) {
+  const { now = new Date().toISOString() } = options;
   const queue = normalizeDevDeliveryQueue(queueInput, {
-    allowLegacyV3Readback,
+    allowLegacyBaselineReadback:
+      options.allowLegacyBaselineReadback ?? options.allowLegacyV3Readback,
   });
   const currentTime = timestamp(now, "now");
   return queue.candidates

package/packages/core/dev-delivery-warrant.js

@@ -198,8 +198,8 @@ export function selectDevDeliveryWarrant(
     candidateId: transaction.result.candidate.candidateId,
     pullRequestNumber: transaction.result.candidate.pullRequestNumber,
     sourceHead: transaction.result.candidate.sourceHead,
-    assignmentRoot: transaction.result.candidate.assignmentRoot,
-    initiativeRoot: transaction.result.candidate.initiativeRoot,
+    ...candidateSourceBinding(transaction.result.candidate),
+
     sourceIdentityRoot: transaction.result.candidate.sourceIdentityRoot,
     sourcePatchRoot: transaction.result.candidate.sourcePatchRoot,
     sourceProofRoot: transaction.result.candidate.sourceProofRoot,
@@ -488,6 +488,7 @@ function createDevDeliverySuccessorWake(queue, now) {
         "candidateId",
         "pullRequestNumber",
         "sourceHead",
+        "sourceRoot",
         "assignmentRoot",
         "initiativeRoot",
         "sourceIdentityRoot",
@@ -533,10 +534,10 @@ export const reconcileDevDeliveryTerminalEvidence =
   });
 export function observeDevDeliveryQueue(
   queueInput,
-  { now = new Date().toISOString(), allowLegacyV3Readback = false } = {},
+  { now = new Date().toISOString(), allowLegacyV3Readback: legacyReadback = false, allowLegacyBaselineReadback = legacyReadback } = {},
 ) {
   const queue = normalizeDevDeliveryQueue(queueInput, {
-    allowLegacyV3Readback,
+    allowLegacyBaselineReadback,
   });
   const currentTime = timestamp(now, "now");
   const states = {};
@@ -544,7 +545,7 @@ export function observeDevDeliveryQueue(
     states[candidate.status] = (states[candidate.status] || 0) + 1;
   const queued = rankDevDeliveryCandidates(queue, {
     now: currentTime,
-    allowLegacyV3Readback,
+    allowLegacyBaselineReadback,
   });
   return {
     schema: "kungfu.buildchain.dev-delivery-queue-observation/v1",
@@ -586,3 +587,12 @@ export function observeDevDeliveryQueue(
     observedAt: currentTime,
   };
 }
+
+function candidateSourceBinding(candidate) {
+  return candidate.sourceRoot
+    ? { sourceRoot: candidate.sourceRoot }
+    : {
+        assignmentRoot: candidate.assignmentRoot,
+        initiativeRoot: candidate.initiativeRoot,
+      };
+}

package/packages/core/domain-wasm-artifact.js

@@ -0,0 +1,7 @@
+// Generated by scripts/build-domain-wasm.mjs.
+export const DOMAIN_WASM_ABI_VERSION = 1;
+export const DOMAIN_WASM_RUSTC = "rustc 1.96.0 (ac68faa20 2026-05-25)";
+export const DOMAIN_WASM_SOURCE_SHA256 =
+  "d575dc3680de68f5f165b9fe584cf63ba2498adf45d286320b797a9caccf19f9";
+export const DOMAIN_WASM_SHA256 =
+  "e04814473796c483e82e450b651b60e63609bfca182140b333dd0e6994ae63db";

package/packages/core/domain-wasm.js

@@ -0,0 +1,216 @@
+import fs from "node:fs";
+import { createHash } from "node:crypto";
+
+import {
+  DOMAIN_WASM_ABI_VERSION,
+  DOMAIN_WASM_SHA256,
+} from "./domain-wasm-artifact.js";
+
+export const DOMAIN_WASM_REQUEST_CONTRACT =
+  "kungfu-buildchain-v4-domain-wasm-request/v1";
+export const DOMAIN_WASM_RESPONSE_CONTRACT =
+  "kungfu-buildchain-v4-domain-wasm-response/v1";
+
+const WASM_URL = new URL("./buildchain-domain.wasm", import.meta.url);
+const REQUIRED_EXPORTS = [
+  "memory",
+  "buildchain_domain_wasm_abi_version",
+  "buildchain_domain_wasm_alloc",
+  "buildchain_domain_wasm_dealloc",
+  "buildchain_domain_wasm_invoke",
+  "buildchain_domain_wasm_response_pointer",
+  "buildchain_domain_wasm_response_length",
+];
+
+let loaded;
+
+export class DomainWasmFault extends Error {
+  constructor(fault) {
+    super(fault?.message || "Rust/WASM domain request failed");
+    this.name = "DomainWasmFault";
+    this.fault = fault;
+    this.code = fault?.code || "rust-wasm-domain-failed";
+    this.path = fault?.path || "$";
+    this.retry = fault?.retry || "stop";
+  }
+}
+
+function failClosed(message, cause) {
+  const error = new Error(`Buildchain v4 Rust/WASM authority: ${message}`);
+  error.code = "rust-wasm-authority-unavailable";
+  error.cause = cause;
+  throw error;
+}
+
+function invalidTransport(code, path, message) {
+  throw new DomainWasmFault({ code, path, message, retry: "stop" });
+}
+
+function validateJsonTransport(value, path, active) {
+  if (value === null || typeof value === "boolean") return;
+  if (typeof value === "string") {
+    for (let index = 0; index < value.length; index += 1) {
+      const code = value.charCodeAt(index);
+      if (code >= 0xd800 && code <= 0xdbff) {
+        const next = value.charCodeAt(index + 1);
+        if (!(next >= 0xdc00 && next <= 0xdfff)) {
+          invalidTransport(
+            "unsupported-string",
+            path,
+            `${path} contains an unpaired surrogate`,
+          );
+        }
+        index += 1;
+      } else if (code >= 0xdc00 && code <= 0xdfff) {
+        invalidTransport(
+          "unsupported-string",
+          path,
+          `${path} contains an unpaired surrogate`,
+        );
+      }
+    }
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value) || Object.is(value, -0)) {
+      invalidTransport(
+        "unsupported-number",
+        path,
+        `${path} must be a safe base-10 integer and must not be negative zero`,
+      );
+    }
+    return;
+  }
+  if (!value || typeof value !== "object") {
+    invalidTransport(
+      "unsupported-json-value",
+      path,
+      `${path} is not a JSON value`,
+    );
+  }
+  if (active.has(value)) {
+    invalidTransport("cyclic-json-value", path, `${path} contains a cycle`);
+  }
+  active.add(value);
+  try {
+    if (Array.isArray(value)) {
+      for (let index = 0; index < value.length; index += 1) {
+        validateJsonTransport(value[index], `${path}/${index}`, active);
+      }
+      return;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      invalidTransport(
+        "unsupported-json-value",
+        path,
+        `${path} must be a plain object`,
+      );
+    }
+    for (const key of Object.keys(value)) {
+      if (!/^[\x20-\x7e]+$/u.test(key)) {
+        invalidTransport(
+          "unsupported-object-key",
+          `${path}/${key}`,
+          "object keys must be non-empty printable ASCII",
+        );
+      }
+      validateJsonTransport(value[key], `${path}/${key}`, active);
+    }
+  } finally {
+    active.delete(value);
+  }
+}
+
+function loadAuthority() {
+  if (loaded) return loaded;
+  let bytes;
+  try {
+    bytes = fs.readFileSync(WASM_URL);
+  } catch (error) {
+    failClosed(`cannot read ${WASM_URL.pathname}`, error);
+  }
+  const observedSha256 = createHash("sha256").update(bytes).digest("hex");
+  if (observedSha256 !== DOMAIN_WASM_SHA256) {
+    failClosed(
+      `artifact digest mismatch (expected ${DOMAIN_WASM_SHA256}, observed ${observedSha256})`,
+    );
+  }
+  let instance;
+  try {
+    instance = new WebAssembly.Instance(new WebAssembly.Module(bytes), {});
+  } catch (error) {
+    failClosed("artifact compilation or instantiation failed", error);
+  }
+  const missing = REQUIRED_EXPORTS.filter(
+    (name) => instance.exports[name] === undefined,
+  );
+  if (missing.length > 0) {
+    failClosed(`artifact is missing exports: ${missing.join(", ")}`);
+  }
+  const abiVersion = instance.exports.buildchain_domain_wasm_abi_version();
+  if (abiVersion !== DOMAIN_WASM_ABI_VERSION) {
+    failClosed(
+      `ABI mismatch (expected ${DOMAIN_WASM_ABI_VERSION}, observed ${abiVersion})`,
+    );
+  }
+  loaded = instance.exports;
+  return loaded;
+}
+
+export function invokeDomainWasm(operation, payload) {
+  if (
+    ["canonical-json", "content-root", "release-tail-root"].includes(operation)
+  ) {
+    validateJsonTransport(payload, "$/payload", new Set());
+  }
+  const authority = loadAuthority();
+  const input = new TextEncoder().encode(
+    JSON.stringify({
+      schema: DOMAIN_WASM_REQUEST_CONTRACT,
+      operation,
+      payload,
+    }),
+  );
+  const inputPointer = authority.buildchain_domain_wasm_alloc(input.byteLength);
+  try {
+    new Uint8Array(authority.memory.buffer, inputPointer, input.byteLength).set(
+      input,
+    );
+    try {
+      authority.buildchain_domain_wasm_invoke(inputPointer, input.byteLength);
+    } catch (error) {
+      failClosed(`operation '${operation}' trapped`, error);
+    }
+    const responsePointer = authority.buildchain_domain_wasm_response_pointer();
+    const responseLength = authority.buildchain_domain_wasm_response_length();
+    let response;
+    try {
+      const responseBytes = new Uint8Array(
+        authority.memory.buffer,
+        responsePointer,
+        responseLength,
+      );
+      response = JSON.parse(new TextDecoder().decode(responseBytes));
+    } catch (error) {
+      failClosed(
+        `operation '${operation}' returned an invalid response`,
+        error,
+      );
+    }
+    if (
+      response?.schema !== DOMAIN_WASM_RESPONSE_CONTRACT ||
+      typeof response.ok !== "boolean"
+    ) {
+      failClosed(`operation '${operation}' returned an unsupported response`);
+    }
+    if (!response.ok) throw new DomainWasmFault(response.fault);
+    return response.value;
+  } finally {
+    authority.buildchain_domain_wasm_dealloc(inputPointer, input.byteLength);
+  }
+}
+
+export function domainWasmInfo() {
+  return invokeDomainWasm("abi-info", {});
+}