@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/packages/core/{v4-floating-consumer-evidence.js → floating-consumer-evidence.js}

@@ -1,16 +1,16 @@
 import crypto from "node:crypto";
 
-export const V4_FLOATING_CONSUMER_POLICY =
+export const FLOATING_CONSUMER_POLICY =
   "kungfu-buildchain-v4-floating-consumer-policy/v1";
-export const V4_FLOATING_CONSUMER_RECEIPT =
+export const FLOATING_CONSUMER_RECEIPT =
   "kungfu-buildchain-v4-floating-consumer-policy-receipt/v1";
-export const V4_FLOATING_CONSUMER_CERTIFICATION =
+export const FLOATING_CONSUMER_CERTIFICATION =
   "kungfu-buildchain-v4-floating-consumer-certification/v1";
 
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
 const ALPHA_RECOVERY_BOOTSTRAP = Object.freeze({
   repository: "kungfu-systems/buildchain",
-  sourcePath: ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  sourcePath: ".github/workflows/self-ops-promotion-recovery.yml",
   workflow: ".github/workflows/.release-candidate-promote.yml",
   selector: "alpha/v4/v4.0",
 });
@@ -135,18 +135,18 @@ function verifyFloatingSelector(value, check, label) {
   );
 }
 
-export function v4FloatingConsumerDocumentRoot(value) {
+export function floatingConsumerDocumentRoot(value) {
   return documentRoot(value);
 }
 
-export function verifyV4FloatingConsumerPolicyReceipt(options = {}) {
+export function verifyFloatingConsumerPolicyReceipt(options = {}) {
   const { receipt, receiptRoot = "", expectedReceiptRoot = "" } = options;
   const failures = [];
   const check = checker(failures);
   check(
-    receipt?.schema === V4_FLOATING_CONSUMER_RECEIPT,
+    receipt?.schema === FLOATING_CONSUMER_RECEIPT,
     "receipt-contract-invalid",
-    `receipt must use ${V4_FLOATING_CONSUMER_RECEIPT}`,
+    `receipt must use ${FLOATING_CONSUMER_RECEIPT}`,
   );
   check(
     receipt?.status === "passed",
@@ -199,10 +199,10 @@ function defaultAuthority(options, receiptRoot) {
   };
 }
 
-export function certifyV4FloatingConsumerPolicyReceipt(options = {}) {
-  const verification = verifyV4FloatingConsumerPolicyReceipt(options);
+export function certifyFloatingConsumerPolicyReceipt(options = {}) {
+  const verification = verifyFloatingConsumerPolicyReceipt(options);
   const certification = {
-    schema: V4_FLOATING_CONSUMER_CERTIFICATION,
+    schema: FLOATING_CONSUMER_CERTIFICATION,
     status: verification.ok ? "certified" : "rejected",
     receiptRoot: verification.receiptRoot,
     caller: options.receipt?.caller || {},
@@ -284,14 +284,14 @@ function verifyCertificationAuthority(certification, expected, check) {
     );
 }
 
-export function verifyV4FloatingConsumerPolicyCertification(options = {}) {
+export function verifyFloatingConsumerPolicyCertification(options = {}) {
   const { certification, certificationRoot = "" } = options;
   const failures = [];
   const check = checker(failures);
   check(
-    certification?.schema === V4_FLOATING_CONSUMER_CERTIFICATION,
+    certification?.schema === FLOATING_CONSUMER_CERTIFICATION,
     "certification-contract-invalid",
-    `certification must use ${V4_FLOATING_CONSUMER_CERTIFICATION}`,
+    `certification must use ${FLOATING_CONSUMER_CERTIFICATION}`,
   );
   check(
     certification?.status === "certified",

package/packages/core/{v4-floating-consumer-policy.js → floating-consumer-policy.js}

@@ -7,20 +7,20 @@ import {
 } from "./buildchain-contract.js";
 import { parseYamlUses } from "./workflow-yaml-contract.js";
 import {
-  V4_FLOATING_CONSUMER_POLICY,
-  V4_FLOATING_CONSUMER_RECEIPT,
-  v4FloatingConsumerDocumentRoot,
-} from "./v4-floating-consumer-evidence.js";
+  FLOATING_CONSUMER_POLICY,
+  FLOATING_CONSUMER_RECEIPT,
+  floatingConsumerDocumentRoot,
+} from "./floating-consumer-evidence.js";
 
 export {
-  V4_FLOATING_CONSUMER_CERTIFICATION,
-  V4_FLOATING_CONSUMER_POLICY,
-  V4_FLOATING_CONSUMER_RECEIPT,
-  certifyV4FloatingConsumerPolicyReceipt,
-  v4FloatingConsumerDocumentRoot,
-  verifyV4FloatingConsumerPolicyCertification,
-  verifyV4FloatingConsumerPolicyReceipt,
-} from "./v4-floating-consumer-evidence.js";
+  FLOATING_CONSUMER_CERTIFICATION,
+  FLOATING_CONSUMER_POLICY,
+  FLOATING_CONSUMER_RECEIPT,
+  certifyFloatingConsumerPolicyReceipt,
+  floatingConsumerDocumentRoot,
+  verifyFloatingConsumerPolicyCertification,
+  verifyFloatingConsumerPolicyReceipt,
+} from "./floating-consumer-evidence.js";
 
 const EXACT_SHA = /^[0-9a-f]{40}$/u;
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
@@ -28,7 +28,7 @@ const BUILDCHAIN_REPOSITORY = "kungfu-systems/buildchain";
 const CHANNELS = Object.freeze({ v4: "stable", "v4-alpha": "alpha" });
 const ALPHA_RECOVERY_BOOTSTRAP = Object.freeze({
   selector: "alpha/v4/v4.0",
-  sourcePath: ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  sourcePath: ".github/workflows/self-ops-promotion-recovery.yml",
   workflow: ".github/workflows/.release-candidate-promote.yml",
 });
 const DEFAULT_STABLE_LOCK_PATH = ".buildchain/contract-lock.json";
@@ -36,12 +36,12 @@ const DEFAULT_ALPHA_LOCK_PATH = ".buildchain/alpha-contract-lock.json";
 const TRANSIENT_ACTION =
   /^\.\/\.buildchain\/(?:runtime|workflow-shell|attester-runtime|release-tail-runtime)\//u;
 const SCANNER_PATHS = Object.freeze([
-  "architecture/v4-floating-consumer-policy.json",
+  "architecture/floating-consumer-policy.json",
   "contracts/v4-floating-consumer-policy-receipt-v1.schema.json",
   "packages/core/buildchain-contract.js",
-  "packages/core/v4-floating-consumer-policy.js",
+  "packages/core/floating-consumer-policy.js",
   "packages/core/workflow-yaml-contract.js",
-  "scripts/v4-consumer-policy.mjs",
+  "scripts/consumer-policy.mjs",
 ]);
 
 function defaultRuntimeRoot() {
@@ -73,9 +73,7 @@ function resolveInside(root, relative, label) {
   return file;
 }
 
-export function v4ConsumerPolicyScannerRoot(
-  runtimeRoot = defaultRuntimeRoot(),
-) {
+export function consumerPolicyScannerRoot(runtimeRoot = defaultRuntimeRoot()) {
   return sha256(
     stableJson(
       SCANNER_PATHS.map((relative) => ({
@@ -86,7 +84,7 @@ export function v4ConsumerPolicyScannerRoot(
   );
 }
 
-export function resolveV4FloatingConsumerPolicyAuthority({
+export function resolveFloatingConsumerPolicyAuthority({
   runtimeRoot = defaultRuntimeRoot(),
   callerRoot = process.cwd(),
   stableLockPath = DEFAULT_STABLE_LOCK_PATH,
@@ -94,7 +92,7 @@ export function resolveV4FloatingConsumerPolicyAuthority({
 } = {}) {
   const policy = readJson(
     runtimeRoot,
-    "architecture/v4-floating-consumer-policy.json",
+    "architecture/floating-consumer-policy.json",
     "v4 floating consumer policy",
   ).value;
   const readLock = (relative, label) => {
@@ -102,12 +100,12 @@ export function resolveV4FloatingConsumerPolicyAuthority({
     if (!fs.existsSync(file))
       throw new Error(`${label} contract lock is missing: ${relative}`);
     const value = JSON.parse(fs.readFileSync(file, "utf8"));
-    return { path: relative, root: v4FloatingConsumerDocumentRoot(value) };
+    return { path: relative, root: floatingConsumerDocumentRoot(value) };
   };
   return {
     policy,
-    policyRoot: v4FloatingConsumerDocumentRoot(policy),
-    scannerRoot: v4ConsumerPolicyScannerRoot(runtimeRoot),
+    policyRoot: floatingConsumerDocumentRoot(policy),
+    scannerRoot: consumerPolicyScannerRoot(runtimeRoot),
     contractLocks: {
       stable: readLock(stableLockPath, "stable"),
       alpha: readLock(alphaLockPath, "alpha"),
@@ -287,14 +285,14 @@ function classifyBuildchainUses(records, failures, { repository } = {}) {
   for (const record of records) {
     const parsed = coordinate(record.uses);
     if (!parsed || parsed.repository !== BUILDCHAIN_REPOSITORY) continue;
-    const v4Candidate =
+    const domainCandidate =
       parsed.selector === "v4" ||
       parsed.selector === "v4-alpha" ||
       /^v4(?:[./-]|$)/u.test(parsed.selector) ||
       parsed.selector === ALPHA_RECOVERY_BOOTSTRAP.selector ||
       EXACT_SHA.test(parsed.selector.toLowerCase()) ||
       parsed.selector.includes("${{");
-    if (!v4Candidate) continue;
+    if (!domainCandidate) continue;
     const bootstrapShape =
       normalizeWorkflowPath(parsed.path) ===
         ALPHA_RECOVERY_BOOTSTRAP.workflow &&
@@ -429,7 +427,7 @@ function verifySelectedLock({
   }
 }
 
-export function scanV4FloatingConsumerPolicy({
+export function scanFloatingConsumerPolicy({
   root = process.cwd(),
   invocationRoot = root,
   repository = "",
@@ -446,8 +444,8 @@ export function scanV4FloatingConsumerPolicy({
 } = {}) {
   const resolvedRoot = path.resolve(root);
   const resolvedInvocationRoot = path.resolve(invocationRoot);
-  if (!policy || policy.contract !== V4_FLOATING_CONSUMER_POLICY) {
-    throw new Error(`policy must use ${V4_FLOATING_CONSUMER_POLICY}`);
+  if (!policy || policy.contract !== FLOATING_CONSUMER_POLICY) {
+    throw new Error(`policy must use ${FLOATING_CONSUMER_POLICY}`);
   }
   const failures = [];
   const normalizedSourceSha = String(sourceSha || "").toLowerCase();
@@ -535,7 +533,7 @@ export function scanV4FloatingConsumerPolicy({
     invocationUses,
   });
   const receipt = {
-    schema: V4_FLOATING_CONSUMER_RECEIPT,
+    schema: FLOATING_CONSUMER_RECEIPT,
     status: failures.length ? "failed" : "passed",
     caller: { repository, sourceSha: normalizedSourceSha },
     invocation: {

package/packages/core/{v4-floating-consumer-release-passport.js → floating-consumer-release-passport.js}

@@ -1,15 +1,15 @@
 import fs from "node:fs";
 import path from "node:path";
 import {
-  v4FloatingConsumerDocumentRoot,
-  verifyV4FloatingConsumerPolicyCertification,
-} from "./v4-floating-consumer-evidence.js";
+  floatingConsumerDocumentRoot,
+  verifyFloatingConsumerPolicyCertification,
+} from "./floating-consumer-evidence.js";
 import {
-  verifyV4RuntimeAuthorizationReceipt,
-  verifyV4RuntimeResumeLineage,
-} from "./v4-runtime-ref-resume-authority.js";
+  verifyRuntimeAuthorizationReceipt,
+  verifyRuntimeResumeLineage,
+} from "./runtime-ref-resume-authority.js";
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
-export function isV4PromotionRouting(value = undefined) {
+export function isPromotionRouting(value = undefined) {
   return [
     value?.router?.ref,
     value?.shell?.ref,
@@ -31,13 +31,13 @@ function resolveCallerLock(root, relative, label) {
   }
   return {
     path: relative,
-    root: v4FloatingConsumerDocumentRoot(
+    root: floatingConsumerDocumentRoot(
       JSON.parse(fs.readFileSync(file, "utf8")),
     ),
   };
 }
 
-export function resolveV4FloatingConsumerCallerLocks(value, cwd) {
+export function resolveFloatingConsumerCallerLocks(value, cwd) {
   const certification = value?.certification || value;
   const declared = certification?.authority || {};
   const stableLockPath = declared?.contractLocks?.stable?.path || "";
@@ -55,7 +55,7 @@ function normalizeCertification(value, expected) {
     throw new Error("v4ConsumerPolicyCertification must be a JSON object");
   }
   const certification = value.certification || value;
-  const verification = verifyV4FloatingConsumerPolicyCertification({
+  const verification = verifyFloatingConsumerPolicyCertification({
     certification,
     certificationRoot: value.certificationRoot || "",
     expectedCertificationRoot: expected.certificationRoot,
@@ -76,7 +76,7 @@ function normalizeCertification(value, expected) {
   }
   return { certificationRoot: verification.certificationRoot, certification };
 }
-export function resolveV4ConsumerPolicyCertificationIdentity({
+export function resolveConsumerPolicyCertificationIdentity({
   release = {},
   routing = {},
   runtimeResume = undefined,
@@ -101,7 +101,7 @@ export function resolveV4ConsumerPolicyCertificationIdentity({
     runtimeSha: buildSha || certifiedSha || routing?.runtime?.resolvedSha || "",
   };
 }
-export function requireV4ConsumerPolicyCertification({
+export function requireConsumerPolicyCertification({
   value,
   repository,
   sourceSha,
@@ -110,14 +110,14 @@ export function requireV4ConsumerPolicyCertification({
   cwd,
   certificationRoot,
 }) {
-  const v4Routing = isV4PromotionRouting(routing);
-  if (v4Routing && !value) {
+  const domainRouting = isPromotionRouting(routing);
+  if (domainRouting && !value) {
     throw new Error(
       "Buildchain v4 Release Passport requires an external floating consumer policy certification",
     );
   }
   if (!value) return undefined;
-  if (v4Routing && !SHA256_ROOT.test(String(certificationRoot || ""))) {
+  if (domainRouting && !SHA256_ROOT.test(String(certificationRoot || ""))) {
     throw new Error(
       "Buildchain v4 Release Passport requires an expected external certification root",
     );
@@ -127,7 +127,7 @@ export function requireV4ConsumerPolicyCertification({
     sourceSha,
     runtimeSha: runtimeSha || routing?.runtime?.resolvedSha || "",
     certificationRoot,
-    ...(v4Routing ? resolveV4FloatingConsumerCallerLocks(value, cwd) : {}),
+    ...(domainRouting ? resolveFloatingConsumerCallerLocks(value, cwd) : {}),
   });
 }
 
@@ -137,7 +137,7 @@ export function releasePassportCertificationVerificationOptions({
   routing,
 }) {
   const authority = evidence?.certification?.authority || {};
-  const identity = resolveV4ConsumerPolicyCertificationIdentity({
+  const identity = resolveConsumerPolicyCertificationIdentity({
     release: { ...passport?.release, certification: evidence?.certification },
     routing,
     runtimeResume: passport?.v4RuntimeResume,
@@ -203,21 +203,21 @@ export function normalizePromotionEvidence({
   release = {},
   v4ConsumerPolicyCertification: certification,
   v4ConsumerPolicyCertificationRoot: certificationRoot,
-  v4RuntimeResumeEvidence,
+  domainRuntimeResumeEvidence,
   repository,
   sourceSha,
   cwd,
 }) {
   const routing = normalizePromotionRouting(release.promotionRouting);
-  const identity = resolveV4ConsumerPolicyCertificationIdentity({
+  const identity = resolveConsumerPolicyCertificationIdentity({
     release: { ...release, certification },
     routing,
-    runtimeResume: v4RuntimeResumeEvidence,
+    runtimeResume: domainRuntimeResumeEvidence,
     sourceSha,
   });
   return {
     routing,
-    consumerPolicy: requireV4ConsumerPolicyCertification({
+    consumerPolicy: requireConsumerPolicyCertification({
       value: certification,
       repository,
       sourceSha: identity.sourceSha,
@@ -229,12 +229,12 @@ export function normalizePromotionEvidence({
   };
 }
 
-export function normalizeV4RuntimeResumeEvidence(value, expected = {}) {
+export function normalizeRuntimeResumeEvidence(value, expected = {}) {
   if (value === undefined || value === null || value === "") return undefined;
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("v4RuntimeResumeEvidence must be a JSON object");
+    throw new Error("domainRuntimeResumeEvidence must be a JSON object");
   }
-  const authorizationVerification = verifyV4RuntimeAuthorizationReceipt({
+  const authorizationVerification = verifyRuntimeAuthorizationReceipt({
     receipt: value.authorization,
     receiptRoot: value.authorizationRoot,
     repository: expected.repository,
@@ -247,7 +247,7 @@ export function normalizeV4RuntimeResumeEvidence(value, expected = {}) {
       `v4 runtime authorization invalid: ${authorizationVerification.failures.join(", ")}`,
     );
   }
-  const lineageVerification = verifyV4RuntimeResumeLineage({
+  const lineageVerification = verifyRuntimeResumeLineage({
     lineage: value.lineage,
     lineageRoot: value.lineageRoot,
     repository: expected.repository,

package/packages/core/github-governance-authority.js

@@ -118,12 +118,12 @@ const PROTECTED_AUTHORITY_PATHS = Object.freeze([
   ".github/CODEOWNERS",
   ".github/workflows/.publication-authority.yml",
   ".github/workflows/.release-candidate-promote.yml",
-  ".github/workflows/buildchain-ref-promotion-recovery.yml",
-  ".github/workflows/buildchain-ref-promotion.yml",
-  ".github/workflows/github-governance-audit.yml",
+  ".github/workflows/self-ops-promotion-recovery.yml",
+  ".github/workflows/self-release-promote.yml",
+  ".github/workflows/self-ops-governance-audit.yml",
   ".github/workflows/paper-release-sealed.yml",
   ".github/workflows/paper-release.yml",
-  ".github/workflows/release-line-bootstrap.yml",
+  ".github/workflows/self-release-line-open.yml",
   ".github/workflows/release-candidate-promote.yml",
   "actions/promote-buildchain-ref/action.yml",
   "actions/promote-buildchain-ref/dist/index.js",

package/packages/core/index.js

@@ -644,9 +644,9 @@ export {
 } from "./kfd3-surface-register.js";
 
 export * from "./release-propagation.js";
-export * from "./v4-floating-consumer-policy.js";
-export * from "./v4-runtime-ref-resume-authority.js";
-export * from "./v4-publication-qualification.js";
+export * from "./floating-consumer-policy.js";
+export * from "./runtime-ref-resume-authority.js";
+export * from "./publication-qualification.js";
 
 export {
   RELEASE_ACTIVATION_CONTRACT,
@@ -698,8 +698,4 @@ export {
   writePaperScaffold,
 } from "./paper.js"; export * from "./paper-work.js"; export * from "./paper-fleet.js";
 
-export {
-  SURFACE_TIMESTAMP_POLICY_CONTRACT,
-  applySurfaceTimestampPolicy,
-  createSurfaceTimestampPolicy,
-} from "./surface-manifest.js";
+export * from "./public-export-compatibility.js";