@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/scripts/{check-v4-release-topology.mjs → check-release-topology.mjs}

@@ -3,6 +3,8 @@
 import assert from "node:assert/strict";
 import crypto from "node:crypto";
 import fs from "node:fs";
+import ts from "typescript";
+import { workflowCompatibilityIdentity } from "./workflow-taxonomy.mjs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
@@ -12,7 +14,7 @@ import {
 } from "../packages/core/workflow-yaml-contract.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const ledgerPath = path.join(root, "architecture/v4-release-topology.json");
+const ledgerPath = path.join(root, "architecture/release-topology.json");
 
 function read(relative) {
   return fs.readFileSync(path.join(root, relative), "utf8");
@@ -20,14 +22,37 @@ function read(relative) {
 
 const LOCAL_MODULE_EXTENSIONS = ["", ".js", ".mjs", ".cjs"];
 const PRIVILEGED_ENTRYPOINTS = [
-  "actions/v4-release-candidate-promote/index.js",
+  "actions/release-candidate-promote/index.js",
+  "scripts/binary-publication-evidence.mjs",
+  "scripts/next-development-review.mjs",
+  "scripts/oci-compose-preview.mjs",
+  "scripts/publication-settlement.mjs",
 ];
 
-function localModuleSpecifiers(source) {
+export function localModuleSpecifiers(source) {
   const specifiers = [];
-  const expression =
-    /(?:\bfrom\s+|\bimport\s*\(\s*|\bimport\s+)["'](\.[^"']+)["']/gu;
-  for (const match of source.matchAll(expression)) specifiers.push(match[1]);
+  const visit = (node) => {
+    let value;
+    if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node))
+      value = node.moduleSpecifier;
+    else if (
+      ts.isCallExpression(node) &&
+      node.expression.kind === ts.SyntaxKind.ImportKeyword
+    )
+      value = node.arguments[0];
+    if (value && ts.isStringLiteral(value) && value.text.startsWith("."))
+      specifiers.push(value.text);
+    ts.forEachChild(node, visit);
+  };
+  visit(
+    ts.createSourceFile(
+      "module.mjs",
+      source,
+      ts.ScriptTarget.Latest,
+      true,
+      ts.ScriptKind.JS,
+    ),
+  );
   return [...new Set(specifiers)].sort();
 }
 
@@ -83,6 +108,13 @@ function rootedPathSet(paths) {
     .digest("hex")}`;
 }
 
+function fileSha256(relative) {
+  return `sha256:${crypto
+    .createHash("sha256")
+    .update(fs.readFileSync(path.join(root, relative)))
+    .digest("hex")}`;
+}
+
 function productionFiles(relative, extensions) {
   const absolute = path.join(root, relative);
   if (!fs.existsSync(absolute)) return [];
@@ -106,12 +138,12 @@ function productionFiles(relative, extensions) {
 function matchingProductionFiles(roots, extensions, pattern) {
   return roots
     .flatMap((relative) => productionFiles(relative, extensions))
-    .filter((relative) => relative !== "scripts/check-v4-release-topology.mjs")
+    .filter((relative) => relative !== "scripts/check-release-topology.mjs")
     .filter((relative) => pattern.test(read(relative)))
     .sort();
 }
 
-export function discoverV4ReleaseAuthorityClosure() {
+export function discoverReleaseAuthorityClosure() {
   const providerPlane = matchingProductionFiles(
     ["actions", "packages/core"],
     [".js", ".mjs", ".cjs"],
@@ -120,14 +152,20 @@ export function discoverV4ReleaseAuthorityClosure() {
   const runtimeSelectors = matchingProductionFiles(
     [".github/workflows", "scripts", "packages/core"],
     [".yml", ".yaml", ".js", ".mjs", ".cjs"],
-    /(?:promotion-runtime-sha|resume-buildchain-runtime-sha|BUILDCHAIN_(?:CURRENT_RUNTIME_SHA|RUNTIME_REF|RESUME_CANDIDATE_RUN_ID)|authorizeV4RuntimeSelection|scanV4RuntimeSelectorPersistence|v4-release-candidate-adapter)/u,
+    /(?:promotion-runtime-sha|resume-buildchain-runtime-sha|BUILDCHAIN_(?:CURRENT_RUNTIME_SHA|RUNTIME_REF|RESUME_CANDIDATE_RUN_ID)|authorizeRuntimeSelection|scanRuntimeSelectorPersistence|release-candidate-adapter)/u,
   );
   const terminalProjections = matchingProductionFiles(
     [".github/workflows", "actions", "packages/core", "scripts"],
     [".yml", ".yaml", ".js", ".mjs", ".cjs"],
-    /(?:createV4ReleaseReceipt|release-receipt\.json|V4_RELEASE_RECEIPT_CONTRACT)/u,
+    /(?:createReleaseReceipt|release-receipt\.json|RELEASE_RECEIPT_CONTRACT)/u,
   );
   const privilegedModules = discoverStaticModuleClosure(PRIVILEGED_ENTRYPOINTS);
+  const rustWasmArtifact = "packages/core/buildchain-domain.wasm";
+  const rustWasmDistributions = [
+    "actions/promote-buildchain-ref/dist/buildchain-domain.wasm",
+    "actions/release-tail/dist/buildchain-domain.wasm",
+    "actions/release-candidate-promote/dist/buildchain-domain.wasm",
+  ];
   const legacyEngineModules = productionFiles(
     "actions/promote-buildchain-ref",
     [".js", ".mjs", ".cjs"],
@@ -146,13 +184,24 @@ export function discoverV4ReleaseAuthorityClosure() {
       ]),
     ].sort(),
     runtimeSelectors,
-    runtimeEngines: ["actions/v4-release-candidate-promote/index.js"],
+    runtimeEngines: ["actions/release-candidate-promote/index.js"],
     terminalProjections,
     privilegedExecutableClosure: {
       entrypoints: PRIVILEGED_ENTRYPOINTS,
       modules: privilegedModules,
       root: rootedPathSet(privilegedModules),
     },
+    rustWasmAuthority: {
+      loader: "packages/core/domain-wasm.js",
+      metadata: "packages/core/domain-wasm-artifact.js",
+      artifact: rustWasmArtifact,
+      artifactRoot: fileSha256(rustWasmArtifact),
+      distributedArtifacts: rustWasmDistributions,
+      byteIdenticalDistributions: rustWasmDistributions.every(
+        (relative) => fileSha256(relative) === fileSha256(rustWasmArtifact),
+      ),
+      fallbackWriterCount: 0,
+    },
     legacyEngineModules,
   };
 }
@@ -180,33 +229,46 @@ function permission(block, name) {
 function workflowSnapshot(relative) {
   const source = read(relative);
   const document = parseWorkflowDocument(source);
-  const jobs = document.jobs.map((job) => {
-    const block = jobBlock(source, job.id);
-    const uses = job.uses || null;
-    return {
-      id: job.id,
-      kind: uses ? "reusable-call" : "runner",
-      uses,
-      permissions: {
-        contents: permission(block, "contents"),
-        idToken: permission(block, "id-token"),
-      },
-      carriers: {
-        artifactDownload: /uses:\s+actions\/download-artifact@/u.test(block),
-        artifactUpload: /uses:\s+actions\/upload-artifact@/u.test(block),
-        jobOutput: /GITHUB_OUTPUT/u.test(block),
-      },
-      mutationSignals: [
-        /contents:\s*write/u.test(block) && "contents-write",
-        /id-token:\s*write/u.test(block) && "oidc-write",
-        /(?:promote-buildchain-ref|v4-release-candidate-promote)/u.test(
-          block,
-        ) && "promotion-runtime",
-        /(?:git push|npm publish|gh release (?:create|upload))/u.test(block) &&
-          "direct-publication-command",
-      ].filter(Boolean),
-    };
-  });
+  const jobs = document.jobs
+    .filter((job) => job.id !== "universal-bootstrap")
+    .map((job) => {
+      const block = jobBlock(source, job.id);
+      const uses = job.uses || null;
+      // A built-in publisher still requires mutation authority when the caller supplies its envelope.
+      const inheritedPublisher =
+        !/^    permissions:/mu.test(block) &&
+        /uses:.*actions\/release-candidate-promote/u.test(block);
+      return {
+        id: job.id,
+        kind: uses ? "reusable-call" : "runner",
+        uses,
+        permissions: {
+          contents:
+            permission(block, "contents") ||
+            (inheritedPublisher ? "inherited" : null),
+          idToken:
+            permission(block, "id-token") ||
+            (inheritedPublisher ? "inherited" : null),
+        },
+        carriers: {
+          artifactDownload: /uses:\s+actions\/download-artifact@/u.test(block),
+          artifactUpload: /uses:\s+actions\/upload-artifact@/u.test(block),
+          jobOutput: /GITHUB_OUTPUT/u.test(block),
+        },
+        mutationSignals: [
+          (/contents:\s*write/u.test(block) || inheritedPublisher) &&
+            "contents-write",
+          (/id-token:\s*write/u.test(block) || inheritedPublisher) &&
+            "oidc-write",
+          /(?:promote-buildchain-ref|actions\/release-candidate-promote)/u.test(
+            block,
+          ) && "promotion-runtime",
+          /(?:git push|npm publish|gh release (?:create|upload))/u.test(
+            block,
+          ) && "direct-publication-command",
+        ].filter(Boolean),
+      };
+    });
   return {
     path: relative,
     triggers: document.triggers,
@@ -214,11 +276,12 @@ function workflowSnapshot(relative) {
     reusableEdges: parseYamlUses(source)
       .map(({ value }) => value)
       .filter((value) => /\.github\/workflows\//u.test(value))
+      .filter((value) => !/\/bootstrap\.yml(?:@v4)?$/u.test(value))
       .sort(),
   };
 }
 
-export function discoverV4ReleaseTopology(
+export function discoverReleaseTopology(
   workflowPaths,
   semanticWorkflowPaths = workflowPaths,
 ) {
@@ -303,7 +366,7 @@ export function discoverV4ReleaseTopology(
   };
 }
 
-export function findUnknownV4ReleaseTopology(
+export function findUnknownReleaseTopology(
   workflowPaths,
   allWorkflowPaths = fs
     .readdirSync(path.join(root, ".github/workflows"))
@@ -313,11 +376,16 @@ export function findUnknownV4ReleaseTopology(
 ) {
   const declared = new Set(workflowPaths);
   return allWorkflowPaths
-    .filter((relative) => !declared.has(relative))
+    .filter(
+      (relative) =>
+        !declared.has(
+          workflowCompatibilityIdentity(root, relative, readWorkflow(relative)),
+        ),
+    )
     .filter((relative) => {
       const source = readWorkflow(relative);
       const usesReleaseAuthority = parseYamlUses(source).some(({ value }) =>
-        /(?:release-candidate-promote|promote-buildchain-ref|v4-release-candidate-promote|release-tail)/u.test(
+        /(?:release-candidate-promote|promote-buildchain-ref|release-tail)/u.test(
           value,
         ),
       );
@@ -338,7 +406,7 @@ export function findUnknownV4ReleaseTopology(
 }
 
 function assertClosedWorld(workflowPaths) {
-  const unknown = findUnknownV4ReleaseTopology(workflowPaths);
+  const unknown = findUnknownReleaseTopology(workflowPaths);
   assert.deepEqual(
     unknown,
     [],
@@ -369,7 +437,7 @@ function assertAuthorityClosure(ledger) {
         `authority closure path is not a file: ${relative}`,
       );
   }
-  const discovered = discoverV4ReleaseAuthorityClosure();
+  const discovered = discoverReleaseAuthorityClosure();
   for (const className of Object.keys(discovered))
     assert.deepEqual(
       closure[className],
@@ -395,7 +463,7 @@ function assertAuthorityClosure(ledger) {
     `legacy release engines remain reachable from APPLY: ${reachableLegacyEngines.join(", ")}`,
   );
   assert.deepEqual(closure.runtimeEngines, [
-    "actions/v4-release-candidate-promote/index.js",
+    "actions/release-candidate-promote/index.js",
   ]);
   assert.equal(
     closure.freshEntry,
@@ -403,7 +471,7 @@ function assertAuthorityClosure(ledger) {
   );
   assert.equal(
     closure.recoveryEntry,
-    ".github/workflows/buildchain-ref-promotion-recovery.yml",
+    ".github/workflows/self-ops-promotion-recovery.yml",
   );
   const engineSurface = [
     ".github/workflows/.release-candidate-promote.yml",
@@ -422,7 +490,7 @@ function assertAuthorityClosure(ledger) {
   );
   assert.match(
     canonicalWorkflow,
-    /scripts\/v4-release-candidate-adapter\.mjs/u,
+    /scripts\/release-candidate-adapter\.mjs/u,
   );
   assert.match(
     canonicalWorkflow,
@@ -430,12 +498,23 @@ function assertAuthorityClosure(ledger) {
   );
 }
 
-export function checkV4ReleaseTopology() {
+export function checkReleaseTopology() {
   const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
   assert.equal(ledger.contract, "kungfu-buildchain-v4-release-topology/v1");
   assertClosedWorld(ledger.closedWorld.workflowPaths);
   assertAuthorityClosure(ledger);
-  const actual = discoverV4ReleaseTopology(
+  const preview = ledger.postPublicationScope;
+  assert.deepEqual(preview.workflowPaths, [
+    ".github/workflows/public-release-oci-compose-preview.yml",
+  ]);
+  const previewTopology = discoverReleaseTopology(
+    preview.workflowPaths,
+    preview.workflowPaths,
+  );
+  assert.equal(previewTopology.semanticMetrics.contentsWriteJobCount, 1);
+  assert.equal(previewTopology.semanticMetrics.oidcWriteJobCount, 0);
+  assert.deepEqual(preview.observedTopology, previewTopology);
+  const actual = discoverReleaseTopology(
     ledger.closedWorld.workflowPaths,
     ledger.semanticScope.workflowPaths,
   );
@@ -469,13 +548,13 @@ if (
 ) {
   if (process.argv.includes("--print-closure")) {
     process.stdout.write(
-      `${JSON.stringify(discoverV4ReleaseAuthorityClosure(), null, 2)}\n`,
+      `${JSON.stringify(discoverReleaseAuthorityClosure(), null, 2)}\n`,
     );
   } else if (process.argv.includes("--print")) {
     const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
     process.stdout.write(
       `${JSON.stringify(
-        discoverV4ReleaseTopology(
+        discoverReleaseTopology(
           ledger.closedWorld.workflowPaths,
           ledger.semanticScope.workflowPaths,
         ),
@@ -484,7 +563,7 @@ if (
       )}\n`,
     );
   } else {
-    checkV4ReleaseTopology();
+    checkReleaseTopology();
     process.stdout.write("v4 release topology: ok\n");
   }
 }

package/scripts/{check-v4-runtime-semantic-closure.mjs → check-runtime-semantic-closure.mjs}

@@ -4,10 +4,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-export const V4_RUNTIME_SEMANTIC_CLOSURE_CONTRACT =
+export const RUNTIME_SEMANTIC_CLOSURE_CONTRACT =
   "kungfu-buildchain-v4-runtime-semantic-closure";
-export const V4_RUNTIME_SEMANTIC_CLOSURE_PATH =
-  "architecture/v4-runtime-semantic-closure.json";
+export const RUNTIME_SEMANTIC_CLOSURE_PATH =
+  "architecture/runtime-semantic-closure.json";
 export const REQUIRED_RUNTIME_EVIDENCE = Object.freeze([
   "positive",
   "negative",
@@ -35,7 +35,10 @@ function publicSurfaceIds(root) {
   return new Set([
     ...Object.keys(packageJson.exports || {}).map((id) => `export:${id}`),
     ...(cli.commands || []).map((entry) => `cli:${entry.id}`),
-    ...(workflows.workflows || []).map((entry) => `workflow:${entry.id}`),
+    ...(workflows.workflows || []).flatMap((entry) => [
+      `workflow:${entry.id}`,
+      ...(entry.taxonomy ? [`workflow:${entry.taxonomy.id}`] : []),
+    ]),
     ...(workflows.actions || []).map((entry) => `action:${entry.id}`),
   ]);
 }
@@ -156,17 +159,20 @@ function validateAuthority(capability, stateMachine, issues) {
 
 export function validateRuntimeSemanticClosure({
   root = process.cwd(),
-  manifest = loadJson(root, V4_RUNTIME_SEMANTIC_CLOSURE_PATH),
-  v3Inventory = loadJson(root, "architecture/v3-core-mechanism-inventory.json"),
-  v4Manifest = loadJson(
+  manifest = loadJson(root, RUNTIME_SEMANTIC_CLOSURE_PATH),
+  v3Inventory: baselineInventory = loadJson(
     root,
-    "architecture/v4-capability-state-machine-manifest.json",
+    "architecture/baseline-core-mechanism-inventory.json",
+  ),
+  v4Manifest: domainManifest = loadJson(
+    root,
+    "architecture/capability-state-machine-manifest.json",
   ),
 } = {}) {
   const issues = [];
   if (
     manifest?.schemaVersion !== 1 ||
-    manifest?.contract !== V4_RUNTIME_SEMANTIC_CLOSURE_CONTRACT
+    manifest?.contract !== RUNTIME_SEMANTIC_CLOSURE_CONTRACT
   )
     issues.push(
       "runtime semantic closure contract or schemaVersion is invalid",
@@ -175,13 +181,13 @@ export function validateRuntimeSemanticClosure({
     issues.push("runtime semantic closure evidence dimensions drifted");
 
   const mechanisms = new Map(
-    (v3Inventory.mechanisms || []).map((entry) => [entry.id, entry]),
+    (baselineInventory.mechanisms || []).map((entry) => [entry.id, entry]),
   );
-  const v4Capabilities = new Map(
-    (v4Manifest.capabilities || []).map((entry) => [entry.id, entry]),
+  const domainCapabilities = new Map(
+    (domainManifest.capabilities || []).map((entry) => [entry.id, entry]),
   );
   const stateMachines = new Map(
-    (v4Manifest.stateMachines || []).map((entry) => [entry.id, entry]),
+    (domainManifest.stateMachines || []).map((entry) => [entry.id, entry]),
   );
   const capabilities = Array.isArray(manifest?.capabilities)
     ? manifest.capabilities
@@ -198,7 +204,7 @@ export function validateRuntimeSemanticClosure({
   if (
     !sameMembers(
       capabilities.map((entry) => entry.id),
-      v4Capabilities.keys(),
+      domainCapabilities.keys(),
     )
   )
     issues.push(
@@ -216,15 +222,15 @@ export function validateRuntimeSemanticClosure({
     }
     ids.add(capability.id);
     const mechanism = mechanisms.get(capability.id);
-    const v4Capability = v4Capabilities.get(capability.id);
-    if (!mechanism || !v4Capability) continue;
+    const domainCapability = domainCapabilities.get(capability.id);
+    if (!mechanism || !domainCapability) continue;
     if (capability.sourceMechanismId !== capability.id)
       issues.push(`${capability.id}: source mechanism identity drifted`);
     validateImplementation(root, mechanism, capability, issues);
     validateResidualClosure(mechanism, capability, issues);
     validateEvidence(root, mechanism, capability, issues);
     validateAuthority(capability, stateMachines.get(capability.id), issues);
-    for (const surface of v4Capability.surfaces || []) {
+    for (const surface of domainCapability.surfaces || []) {
       if (!surfaces.has(surface))
         issues.push(
           `${capability.id}: executable v4 surface is absent: ${surface}`,