@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/scripts/binary-publication-evidence.mjs

@@ -0,0 +1,135 @@
+import fs from "node:fs";
+import crypto from "node:crypto";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  SETTLEMENT_ASSET,
+  verifyPublicationSettlement,
+} from "./publication-settlement.mjs";
+import { releaseAssetClient } from "./release-asset-client.mjs";
+
+export async function readBinaryPublicationEvidence({
+  client,
+  repository,
+  tag,
+  sourceSha,
+  attempts = 40,
+  wait = () => new Promise((resolve) => setTimeout(resolve, 15000)),
+}) {
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    let release;
+    try {
+      release = client.release(tag);
+    } catch {
+      /* Tag creation can precede Release creation. */
+    }
+    const assets = release?.assets || [];
+    const settlements = assets.filter(({ name }) => name === SETTLEMENT_ASSET);
+    const passports = assets.filter(
+      ({ name }) => name === "buildchain.release.json",
+    );
+    if (settlements.length > 1 || passports.length > 1)
+      throw new Error("ambiguous immutable publication evidence");
+    if (settlements.length === 1 && passports.length === 1) {
+      const settlement = JSON.parse(client.assetBytes(settlements[0]));
+      const publicPassport = JSON.parse(client.assetBytes(passports[0]));
+      if (
+        settlement.contract !== "buildchain-v4-publication-settlement/v1" ||
+        settlement.release.sourceSha !== sourceSha ||
+        settlement.release.tag !== tag
+      )
+        throw new Error("binary publication settlement identity mismatch");
+      const tagSha = client.json(
+        `repos/${repository}/commits/${encodeURIComponent(tag)}`,
+      ).sha;
+      if (tagSha !== sourceSha)
+        throw new Error("binary source does not match the exact release tag");
+      verifyPublicationSettlement(settlement.documents, {
+        repository,
+        tag,
+        sourceSha,
+        publicPassport,
+      });
+      return settlement;
+    }
+    if (attempt + 1 < attempts) await wait();
+  }
+  throw new Error(
+    "completed v4 publication evidence is not available within the bounded wait",
+  );
+}
+
+export function prepareBinaryAssetPaths({
+  binaryDir,
+  passportDir,
+  outputDir,
+  capabilityPath,
+}) {
+  fs.mkdirSync(outputDir, { recursive: true });
+  const files = [];
+  for (const directory of [binaryDir, passportDir]) {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      if (!entry.isFile()) continue;
+      const source = path.join(directory, entry.name);
+      if (
+        directory === passportDir &&
+        entry.name === "buildchain.release.json"
+      ) {
+        const renamed = path.join(outputDir, "buildchain.binary.release.json");
+        fs.copyFileSync(source, renamed);
+        files.push(renamed);
+      } else files.push(source);
+    }
+  }
+  if (capabilityPath) {
+    const bytes = fs.readFileSync(capabilityPath);
+    const digest = crypto.createHash("sha256").update(bytes).digest("hex");
+    const retained = path.join(
+      outputDir,
+      `buildchain.binary.capability-${digest}.json`,
+    );
+    fs.writeFileSync(retained, bytes);
+    files.push(retained);
+  }
+  return files;
+}
+
+async function main(mode) {
+  const repository = process.env.GITHUB_REPOSITORY;
+  const tag = process.env.RELEASE_TAG;
+  const client = releaseAssetClient(repository);
+  if (mode === "read") {
+    const settlement = await readBinaryPublicationEvidence({
+      client,
+      repository,
+      tag,
+      sourceSha: process.env.SOURCE_SHA,
+    });
+    const directory = ".buildchain/publication-evidence";
+    client.write(`${directory}/${SETTLEMENT_ASSET}`, settlement);
+    client.write(`${directory}/release.json`, {
+      channel: settlement.release.channel,
+    });
+  } else if (mode === "publish") {
+    const release = client.release(tag);
+    const files = prepareBinaryAssetPaths({
+      binaryDir: "dist/binary",
+      passportDir: ".buildchain/release-passport",
+      outputDir: ".buildchain/binary-publication",
+      capabilityPath: ".buildchain/publication-authority/capability.json",
+    });
+    const results = await client.publish(release, files);
+    client.write(".buildchain/binary-publication/readback.json", {
+      repository,
+      tag,
+      assets: results,
+    });
+    console.log(JSON.stringify({ published: results.length, repository, tag }));
+  } else throw new Error(`unknown binary publication mode: ${mode}`);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
+  main(process.argv[2]).catch((error) => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });

package/scripts/{v4-bridge-bootstrap.mjs → bridge-bootstrap.mjs}

@@ -10,7 +10,7 @@ const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const manifestPath = path.join(
   root,
   "crates",
-  "buildchain-v4-bridge",
+  "buildchain-host-bridge",
   "Cargo.toml",
 );
 
@@ -18,14 +18,14 @@ function bridgeBinary(profile = "debug", platform = process.platform) {
   return path.join(
     root,
     "crates",
-    "buildchain-v4-bridge",
+    "buildchain-host-bridge",
     "target",
     profile,
-    `buildchain-v4-bridge${platform === "win32" ? ".exe" : ""}`,
+    `buildchain-host-bridge${platform === "win32" ? ".exe" : ""}`,
   );
 }
 
-function createV4HostRequest({
+function createHostRequest({
   command,
   args = [],
   input = Buffer.alloc(0),
@@ -45,7 +45,7 @@ function createV4HostRequest({
   };
 }
 
-function buildV4Bridge({ release = false } = {}) {
+function buildBridge({ release = false } = {}) {
   return spawnSync(
     "cargo",
     [
@@ -59,14 +59,14 @@ function buildV4Bridge({ release = false } = {}) {
   );
 }
 
-function runV4Bridge(
+function runBridge(
   request,
   { mode = "exchange", profile = "debug", env = {}, encoding = null } = {},
 ) {
   const binary = bridgeBinary(profile);
   if (!fs.existsSync(binary)) {
     throw new Error(
-      `Buildchain v4 bridge is not built: ${path.relative(root, binary)}; run pnpm bridge:v4:build`,
+      `Buildchain v4 bridge is not built: ${path.relative(root, binary)}; run pnpm bridge:build`,
     );
   }
   return spawnSync(binary, [mode], {
@@ -74,11 +74,7 @@ function runV4Bridge(
     env: {
       ...process.env,
       BUILDCHAIN_V4_HOST_COMMAND: process.execPath,
-      BUILDCHAIN_V4_HOST_SCRIPT: path.join(
-        root,
-        "scripts",
-        "v4-host-adapter.mjs",
-      ),
+      BUILDCHAIN_V4_HOST_SCRIPT: path.join(root, "scripts", "host-adapter.mjs"),
       ...env,
     },
     input: JSON.stringify(request),
@@ -94,7 +90,7 @@ function parseRunArgs(args) {
   const command = bridgeArgs[0];
   if (!command) {
     throw new Error(
-      "usage: node scripts/v4-bridge-bootstrap.mjs <run|exchange> <command-id> -- [command-args...]",
+      "usage: node scripts/bridge-bootstrap.mjs <run|exchange> <command-id> -- [command-args...]",
     );
   }
   return { command, commandArgs };
@@ -103,7 +99,7 @@ function parseRunArgs(args) {
 function main(args = process.argv.slice(2)) {
   const [mode = "", ...rest] = args;
   if (mode === "build") {
-    const result = buildV4Bridge({ release: rest.includes("--release") });
+    const result = buildBridge({ release: rest.includes("--release") });
     process.stdout.write(result.stdout || "");
     process.stderr.write(result.stderr || "");
     process.exitCode = result.status ?? 1;
@@ -111,13 +107,13 @@ function main(args = process.argv.slice(2)) {
   }
   if (!["run", "exchange"].includes(mode)) {
     throw new Error(
-      "usage: node scripts/v4-bridge-bootstrap.mjs <build|run|exchange> ...",
+      "usage: node scripts/bridge-bootstrap.mjs <build|run|exchange> ...",
     );
   }
   const { command, commandArgs } = parseRunArgs(rest);
   const input = fs.readFileSync(0);
-  const request = createV4HostRequest({ command, args: commandArgs, input });
-  const result = runV4Bridge(request, {
+  const request = createHostRequest({ command, args: commandArgs, input });
+  const result = runBridge(request, {
     mode: mode === "run" ? "compat" : "exchange",
   });
   if (result.error) throw result.error;
@@ -138,4 +134,4 @@ if (
   }
 }
 
-export { bridgeBinary, buildV4Bridge, createV4HostRequest, main, runV4Bridge };
+export { bridgeBinary, buildBridge, createHostRequest, main, runBridge };

package/scripts/{v4-bridge-evidence.mjs → bridge-evidence.mjs}

@@ -7,13 +7,13 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 
 import {
   bridgeBinary,
-  buildV4Bridge,
-  createV4HostRequest,
-  runV4Bridge,
-} from "./v4-bridge-bootstrap.mjs";
+  buildBridge,
+  createHostRequest,
+  runBridge,
+} from "./bridge-bootstrap.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const hostScript = path.join(root, "scripts", "v4-host-adapter.mjs");
+const hostScript = path.join(root, "scripts", "host-adapter.mjs");
 
 function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
@@ -51,10 +51,10 @@ function collectEvidence(args = process.argv.slice(2)) {
   if (!Number.isInteger(iterations) || iterations < 3 || iterations > 50) {
     throw new Error("--iterations must be between 3 and 50");
   }
-  const build = buildV4Bridge({ release: true });
+  const build = buildBridge({ release: true });
   if (build.status !== 0) throw new Error(build.stderr || build.stdout);
   const binary = bridgeBinary("release");
-  const request = createV4HostRequest({
+  const request = createHostRequest({
     command: "architecture.list",
     args: ["--json"],
   });
@@ -71,7 +71,7 @@ function collectEvidence(args = process.argv.slice(2)) {
   );
   const bridge = timed(
     () =>
-      runV4Bridge(request, {
+      runBridge(request, {
         mode: "exchange",
         profile: "release",
         encoding: "utf8",

package/scripts/build-contract-core.mjs

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { macosJitRunnerLabel } from "./aws-macos-jit-core.mjs";
 import { windowsJitRunnerLabel } from "./aws-windows-jit-core.mjs";
+export { writeGitHubOutputs } from "./github-output.mjs";
 export const RUNNER_PRESETS = Object.freeze({
   "github-hosted": [
     { id: "linux-x64", name: "Linux x64", platform: "linux", runner: '["ubuntu-24.04"]', capabilities: ["node"] },
@@ -1201,20 +1202,6 @@ export function validateExpectedArtifacts({ expected, files, summary }) {
   return { ok: true, source: "expected-artifacts-json", checks };
 }
 
-export function writeGitHubOutputs(outputs) {
-  const outputPath = process.env.GITHUB_OUTPUT;
-  if (!outputPath) {
-    for (const [key, value] of Object.entries(outputs)) {
-      console.log(`${key}=${value}`);
-    }
-    return;
-  }
-  const lines = Object.entries(outputs).map(
-    ([key, value]) => `${key}=${value}`,
-  );
-  fs.appendFileSync(outputPath, `${lines.join("\n")}\n`);
-}
-
 export function findJsonFiles(root) {
   if (!fs.existsSync(root)) {
     return [];

package/scripts/build-domain-wasm.mjs

@@ -0,0 +1,177 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { spawnSyncCommand } from "../packages/core/spawn-command.js";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const crate = path.join(root, "crates", "buildchain-domain-contracts");
+const artifact = path.join(root, "packages", "core", "buildchain-domain.wasm");
+const metadata = path.join(root, "packages", "core", "domain-wasm-artifact.js");
+const check = process.argv.includes("--check");
+const toolchain = process.env.BUILDCHAIN_RUST_WASM_TOOLCHAIN || "1.96.0";
+const expectedRustc = "rustc 1.96.0 (ac68faa20 2026-05-25)";
+const canonicalBuildHost =
+  process.platform === "linux" && process.arch === "x64";
+
+const sha256 = (bytes) =>
+  crypto.createHash("sha256").update(bytes).digest("hex");
+const normalize = (value) => value.split(path.sep).join("/");
+
+function rustBuildEnvironment() {
+  const environment = {
+    ...process.env,
+    RUSTUP_TOOLCHAIN: toolchain,
+    CARGO_INCREMENTAL: "0",
+    SOURCE_DATE_EPOCH: "0",
+  };
+  delete environment.RUSTFLAGS;
+  delete environment.CARGO_ENCODED_RUSTFLAGS;
+
+  const metadata = spawnSyncCommand(
+    "cargo",
+    [
+      "metadata",
+      "--format-version",
+      "1",
+      "--locked",
+      "--manifest-path",
+      path.join(crate, "Cargo.toml"),
+    ],
+    { cwd: root, encoding: "utf8", env: environment },
+  );
+  if (metadata.error) throw metadata.error;
+  if (metadata.status !== 0) process.exit(metadata.status ?? 1);
+  const dependencyRemaps = JSON.parse(metadata.stdout)
+    .packages.filter((entry) => entry.source)
+    .map((entry) => [
+      path.dirname(entry.manifest_path),
+      `/buildchain/dependencies/${entry.name}-${entry.version}`,
+    ])
+    .sort(([left], [right]) => right.length - left.length);
+  const remaps = [[root, "/buildchain/source"], ...dependencyRemaps].map(
+    ([from, to]) => `--remap-path-prefix=${from}=${to}`,
+  );
+  environment.CARGO_ENCODED_RUSTFLAGS = remaps.join("\x1f");
+  return environment;
+}
+
+function sourceFiles(directory) {
+  return fs.readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const absolute = path.join(directory, entry.name);
+    return entry.isDirectory() ? sourceFiles(absolute) : [absolute];
+  });
+}
+
+const rustc = spawnSyncCommand("rustc", ["--version"], {
+  cwd: root,
+  encoding: "utf8",
+  env: { ...process.env, RUSTUP_TOOLCHAIN: toolchain },
+});
+if (rustc.error) throw rustc.error;
+if (rustc.status !== 0) process.exit(rustc.status ?? 1);
+if (rustc.stdout.trim() !== expectedRustc) {
+  throw new Error(
+    `Rust/WASM authority requires ${expectedRustc}; observed ${rustc.stdout.trim()}`,
+  );
+}
+
+const sourceInputs = [
+  path.join(crate, "Cargo.toml"),
+  path.join(crate, "Cargo.lock"),
+  path.join(crate, "rust-toolchain.toml"),
+  ...sourceFiles(path.join(crate, "src")),
+].sort();
+const sourceHash = crypto.createHash("sha256");
+for (const file of sourceInputs) {
+  sourceHash.update(normalize(path.relative(root, file)));
+  sourceHash.update("\0");
+  sourceHash.update(fs.readFileSync(file));
+  sourceHash.update("\0");
+}
+const sourceSha256 = sourceHash.digest("hex");
+const generatedMetadata = (artifactSha256) =>
+  `// Generated by scripts/build-domain-wasm.mjs.\nexport const DOMAIN_WASM_ABI_VERSION = 1;\nexport const DOMAIN_WASM_RUSTC = ${JSON.stringify(expectedRustc)};\nexport const DOMAIN_WASM_SOURCE_SHA256 =\n  ${JSON.stringify(sourceSha256)};\nexport const DOMAIN_WASM_SHA256 =\n  ${JSON.stringify(artifactSha256)};\n`;
+
+if (!canonicalBuildHost && !check) {
+  throw new Error(
+    "Buildchain v4 Rust/WASM generation requires the canonical linux-x64 host",
+  );
+}
+
+if (!canonicalBuildHost) {
+  if (!fs.existsSync(artifact)) {
+    throw new Error("tracked Buildchain v4 Rust/WASM artifact is missing");
+  }
+  const artifactSha256 = sha256(fs.readFileSync(artifact));
+  if (
+    !fs.existsSync(metadata) ||
+    fs.readFileSync(metadata, "utf8") !== generatedMetadata(artifactSha256)
+  ) {
+    throw new Error("tracked Buildchain v4 Rust/WASM metadata is stale");
+  }
+  console.log(
+    `Buildchain v4 Rust/WASM portable artifact verified: sha256:${artifactSha256}`,
+  );
+} else {
+  const buildEnvironment = rustBuildEnvironment();
+
+  const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-wasm-"));
+  try {
+    const build = spawnSyncCommand(
+      "cargo",
+      [
+        "build",
+        "--locked",
+        "--release",
+        "--manifest-path",
+        path.join(crate, "Cargo.toml"),
+        "--target",
+        "wasm32-unknown-unknown",
+        "--target-dir",
+        temporary,
+        "--lib",
+      ],
+      {
+        cwd: root,
+        stdio: "inherit",
+        env: buildEnvironment,
+      },
+    );
+    if (build.error) throw build.error;
+    if (build.status !== 0) process.exit(build.status ?? 1);
+    const builtPath = path.join(
+      temporary,
+      "wasm32-unknown-unknown",
+      "release",
+      "buildchain_domain_contracts.wasm",
+    );
+    const built = fs.readFileSync(builtPath);
+    const artifactSha256 = sha256(built);
+    const generated = generatedMetadata(artifactSha256);
+    if (check) {
+      if (
+        !fs.existsSync(artifact) ||
+        !fs.readFileSync(artifact).equals(built)
+      ) {
+        throw new Error("tracked Buildchain v4 Rust/WASM artifact is stale");
+      }
+      if (
+        !fs.existsSync(metadata) ||
+        fs.readFileSync(metadata, "utf8") !== generated
+      ) {
+        throw new Error("tracked Buildchain v4 Rust/WASM metadata is stale");
+      }
+    } else {
+      fs.copyFileSync(builtPath, artifact);
+      fs.writeFileSync(metadata, generated);
+    }
+    console.log(
+      `Buildchain v4 Rust/WASM ${check ? "verified" : "built"}: sha256:${artifactSha256}`,
+    );
+  } finally {
+    fs.rmSync(temporary, { recursive: true, force: true });
+  }
+}

package/scripts/{v3-v4-capability-catalog.mjs → capability-parity-catalog.mjs}

@@ -23,8 +23,8 @@ const PLATFORM_MARKERS = Object.freeze({
   "self-hosted": /\bself-hosted\b/iu,
   windows: /\bwindows\b/iu,
 });
-const LIVE_V4_PROTECTED_BRANCH = "refs/heads/dev/v4/v4.0";
-const LIVE_V4_PROTECTED_LINEAGE_REF = "refs/remotes/origin/dev/v4/v4.0";
+const LIVE_PROTECTED_BRANCH = "refs/heads/dev/v4/v4.0";
+const LIVE_PROTECTED_LINEAGE_REF = "refs/remotes/origin/dev/v4/v4.0";
 const PROTECTED_LINEAGE_DEPTH = 256;
 
 export function sha256(value) {
@@ -85,7 +85,7 @@ export function ensureCapabilityCutAncestor({
   try {
     execFileSync(
       "git",
-      ["fetch", "--no-tags", "--depth=128", "origin", descendantCommit],
+      ["fetch", "--no-tags", "--depth=256", "origin", descendantCommit],
       { cwd: root, stdio: "ignore" },
     );
   } catch {
@@ -96,7 +96,7 @@ export function ensureCapabilityCutAncestor({
   assertCapabilityCutAncestor({ root, revision, descendant, label });
 }
 
-function protectedV4TreeWitness(root, descendant) {
+function protectedTreeWitness(root, descendant) {
   try {
     execFileSync(
       "git",
@@ -105,13 +105,13 @@ function protectedV4TreeWitness(root, descendant) {
         "--no-tags",
         `--depth=${PROTECTED_LINEAGE_DEPTH}`,
         "origin",
-        `${LIVE_V4_PROTECTED_BRANCH}:${LIVE_V4_PROTECTED_LINEAGE_REF}`,
+        `${LIVE_PROTECTED_BRANCH}:${LIVE_PROTECTED_LINEAGE_REF}`,
       ],
       { cwd: root, stdio: "ignore" },
     );
   } catch {
     throw new Error(
-      `protected v4 lineage ${LIVE_V4_PROTECTED_BRANCH} could not be hydrated through a bounded origin fetch`,
+      `protected v4 lineage ${LIVE_PROTECTED_BRANCH} could not be hydrated through a bounded origin fetch`,
     );
   }
   const tree = git(root, ["rev-parse", `${descendant}^{tree}`]);
@@ -120,7 +120,7 @@ function protectedV4TreeWitness(root, descendant) {
       "log",
       `--max-count=${PROTECTED_LINEAGE_DEPTH}`,
       "--format=%H %T",
-      LIVE_V4_PROTECTED_LINEAGE_REF,
+      LIVE_PROTECTED_LINEAGE_REF,
     ])
       .split("\n")
       .map((row) => row.split(" "))
@@ -138,7 +138,7 @@ export function ensureCapabilityCutLineage({
     ensureCapabilityCutAncestor({ root, revision, descendant, label });
     return { mode: "direct-ancestry", witness: descendant };
   } catch (directError) {
-    const witness = protectedV4TreeWitness(root, descendant);
+    const witness = protectedTreeWitness(root, descendant);
     if (!witness)
       throw new Error(
         `${label} ${revision} is not an ancestor of ${descendant}, and ${descendant} has no tree-equivalent commit in the bounded protected v4 lineage`,
@@ -394,12 +394,12 @@ function addMechanismCatalog(
   catalog,
   mechanismInventory,
   runtimeSemanticClosure,
-  isLiveV3,
+  isLiveBaseline,
 ) {
-  const mechanisms = isLiveV3
+  const mechanisms = isLiveBaseline
     ? mechanismInventory.mechanisms || []
     : runtimeSemanticClosure.capabilities || [];
-  const relPath = isLiveV3
+  const relPath = isLiveBaseline
     ? "architecture/v3-core-mechanism-inventory.json"
     : "architecture/v4-runtime-semantic-closure.json";
   for (const mechanism of mechanisms) {
@@ -439,7 +439,7 @@ function addPlatformCatalog(catalog, root, revision, paths) {
   }
 }
 
-export function collectRevisionCatalog({ root, revision, liveV3Revision }) {
+export function collectRevisionCatalog({ root, revision, liveV3Revision: liveBaselineRevision }) {
   const catalog = new Map();
   const paths = gitPaths(root, revision);
   const pathSet = new Set(paths);
@@ -461,7 +461,7 @@ export function collectRevisionCatalog({ root, revision, liveV3Revision }) {
     "architecture/v3-core-mechanism-inventory.json",
   );
   const runtimeSemanticClosure =
-    revision === liveV3Revision
+    revision === liveBaselineRevision
       ? null
       : gitJson(
           root,
@@ -476,7 +476,7 @@ export function collectRevisionCatalog({ root, revision, liveV3Revision }) {
     catalog,
     mechanismInventory,
     runtimeSemanticClosure,
-    revision === liveV3Revision,
+    revision === liveBaselineRevision,
   );
   addPlatformCatalog(catalog, root, revision, paths);
   return { catalog, paths: pathSet };
@@ -485,8 +485,8 @@ export function collectRevisionCatalog({ root, revision, liveV3Revision }) {
 export function collectHistoryRows({
   root,
   priorRevision,
-  liveV3Revision,
-  v4Paths,
+  liveV3Revision: liveBaselineRevision,
+  v4Paths: domainPaths,
   migrationPaths,
   ownerAssignment,
 }) {
@@ -494,7 +494,7 @@ export function collectHistoryRows({
     "diff",
     "--name-status",
     priorRevision,
-    liveV3Revision,
+    liveBaselineRevision,
   ]);
   return output
     .split("\n")
@@ -503,11 +503,11 @@ export function collectHistoryRows({
       const fields = line.split("\t");
       const sourcePath = fields.at(-1);
       const migrationPath = migrationPaths.get(sourcePath);
-      if (!v4Paths.has(sourcePath) && !migrationPath)
+      if (!domainPaths.has(sourcePath) && !migrationPath)
         throw new Error(
           `unclassified post-family v3 history path: ${sourcePath}`,
         );
-      if (migrationPath && !v4Paths.has(migrationPath))
+      if (migrationPath && !domainPaths.has(migrationPath))
         throw new Error(
           `history migration route is absent from the exact v4 cut: ${migrationPath}`,
         );

package/scripts/check-action-bundles.mjs

@@ -5,7 +5,7 @@ import { spawnSyncCommand } from "../packages/core/spawn-command.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const actionsRoot = path.join(root, "actions");
-const bundlePaths = readdirSync(actionsRoot, { withFileTypes: true })
+const javascriptBundlePaths = readdirSync(actionsRoot, { withFileTypes: true })
   .filter((entry) => entry.isDirectory())
   .map((entry) => path.join(actionsRoot, entry.name, "dist", "index.js"))
   .filter((bundlePath) => {
@@ -17,6 +17,14 @@ const bundlePaths = readdirSync(actionsRoot, { withFileTypes: true })
     }
   })
   .sort();
+const wasmBundlePaths = [
+  "promote-buildchain-ref",
+  "release-tail",
+  "release-candidate-promote",
+].map((name) =>
+  path.join(actionsRoot, name, "dist", "buildchain-domain.wasm"),
+);
+const bundlePaths = [...javascriptBundlePaths, ...wasmBundlePaths];
 
 const before = new Map(
   bundlePaths.map((bundlePath) => [bundlePath, readFileSync(bundlePath)]),
@@ -46,4 +54,6 @@ if (changed.length > 0) {
   process.exit(1);
 }
 
-console.log(`action bundle integrity check passed (${bundlePaths.length} bundles)`);
+console.log(
+  `action bundle integrity check passed (${bundlePaths.length} bundles)`,
+);