@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/scripts/source-verification-evidence.mjs

@@ -0,0 +1,344 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+import { invokeDomainWasm } from "../packages/core/domain-wasm.js";
+
+const workflow = ".github/workflows/self-build-verify.yml";
+const proofPath = ".buildchain/source-verification/evidence.json";
+const hash = (bytes) =>
+  `sha256:${crypto.createHash("sha256").update(bytes).digest("hex")}`;
+const execute = (command, args, encoding) =>
+  execFileSync(command, args, {
+    encoding,
+    maxBuffer: 32 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+const run = (command, args) => execute(command, args, "utf8").trim();
+const git = (...args) => run("git", args);
+const write = (file, value) => {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+};
+
+export function verificationIdentity({
+  env = process.env,
+  command = run,
+  revision = "HEAD",
+} = {}) {
+  const sourceSha = command("git", ["rev-parse", revision]);
+  const sourceTree = command("git", ["rev-parse", `${revision}^{tree}`]);
+  const bytes = (file) => execute("git", ["show", `${sourceSha}:${file}`]);
+  const named = (files) =>
+    hash(JSON.stringify(files.map((file) => [file, hash(bytes(file))])));
+  for (const key of ["GITHUB_REPOSITORY", "ImageOS", "ImageVersion"])
+    if (!env[key]) throw new Error(`verification identity requires ${key}`);
+  return {
+    repository: env.GITHUB_REPOSITORY,
+    sourceSha,
+    sourceTree,
+    workflowRoot: hash(bytes(workflow)),
+    checkDefinitionRoot: named([
+      "package.json",
+      ".buildchain/buildchain.toml",
+      "scripts/source-verification-evidence.mjs",
+      "scripts/verify-version-state-delta.mjs",
+    ]),
+    runtimeRoot: named([
+      "packages/core/buildchain-domain.wasm",
+      "packages/core/domain-wasm-artifact.js",
+    ]),
+    dependencyRoot: named([
+      "pnpm-lock.yaml",
+      "pnpm-workspace.yaml",
+      "crates/buildchain-domain-contracts/Cargo.lock",
+      "crates/buildchain-host-bridge/Cargo.lock",
+    ]),
+    toolchainRoot: hash(
+      JSON.stringify([
+        process.version,
+        command("corepack", ["pnpm", "--version"]),
+        command("go", ["version"]),
+        command("rustc", ["+1.96.0", "--version"]),
+        command("cargo", ["+1.96.0", "--version"]),
+        command("rustc", ["--version"]),
+        command("cargo", ["--version"]),
+      ]),
+    ),
+    environmentRoot: hash(
+      JSON.stringify([
+        env.ImageOS,
+        env.ImageVersion,
+        process.platform,
+        process.arch,
+        ...[
+          "CI",
+          "NODE_ENV",
+          "TZ",
+          "LANG",
+          "LC_ALL",
+          "SOURCE_DATE_EPOCH",
+          "BUILDCHAIN_SITE_GENERATED_AT",
+          "BUILDCHAIN_SITE_PUBLISHED_AT",
+          "BUILDCHAIN_SITE_TIMESTAMP_POLICY",
+          "BUILDCHAIN_SOURCE_SHA",
+          "RUSTUP_TOOLCHAIN",
+          "RUSTFLAGS",
+          "CARGO_ENCODED_RUSTFLAGS",
+          "NODE_OPTIONS",
+          "GOFLAGS",
+          "GOTOOLCHAIN",
+        ].map((key) => env[key] || ""),
+      ]),
+    ),
+    platform:
+      { linux: "linux", darwin: "macos", win32: "windows" }[process.platform] +
+      `-${process.arch}`,
+  };
+}
+
+export function planVerification(input) {
+  return invokeDomainWasm("source-verification-plan", input);
+}
+
+export function sealVerification(input) {
+  return invokeDomainWasm("source-verification-seal", input);
+}
+
+const api = (endpoint, binary = false) =>
+  execute("gh", ["api", endpoint], binary ? undefined : "utf8");
+
+// Only the one bounded proof file is read; archive paths are never extracted.
+export function readProofArchive(archive, digest) {
+  if (hash(archive) !== digest)
+    throw new Error("artifact archive digest mismatch");
+  const source = [
+    "import io,json,sys,zipfile",
+    "z=zipfile.ZipFile(io.BytesIO(sys.stdin.buffer.read()))",
+    "entries=[e for e in z.infolist() if e.filename=='evidence.json']",
+    "assert len(entries)==1 and entries[0].file_size <= 1048576, 'invalid proof archive'",
+    "sys.stdout.buffer.write(z.read(entries[0]))",
+  ].join("\n");
+  return JSON.parse(
+    execFileSync(
+      process.platform === "win32" ? "python" : "python3",
+      ["-c", source],
+      {
+        input: archive,
+        maxBuffer: 1048576,
+        encoding: "utf8",
+      },
+    ),
+  );
+}
+
+export async function discoverVerification({
+  expected,
+  evaluatedAtMs,
+  fetchJson,
+  fetchArchive,
+}) {
+  const prefix = `repos/${expected.repository}/actions`;
+  const response = await fetchJson(
+    `${prefix}/workflows/self-build-verify.yml/runs?event=merge_group&status=success&head_sha=${expected.sourceSha}&per_page=10`,
+  );
+  const reasons = [];
+  for (const listed of response.workflow_runs || []) {
+    try {
+      const run = await fetchJson(`${prefix}/runs/${listed.id}`);
+      if (
+        run.repository?.full_name !== expected.repository ||
+        run.head_sha !== expected.sourceSha ||
+        run.path !== workflow ||
+        run.event !== "merge_group" ||
+        run.conclusion !== "success" ||
+        run.status !== "completed"
+      )
+        throw new Error("untrusted evidence run");
+      const assets = await fetchJson(
+        `${prefix}/runs/${run.id}/artifacts?per_page=100`,
+      );
+      const matches = (assets.artifacts || []).filter(
+        (a) =>
+          a.name === `source-verification-${run.head_sha}-${run.run_attempt}`,
+      );
+      if (
+        matches.length !== 1 ||
+        matches[0].expired ||
+        matches[0].size_in_bytes > 1048576
+      )
+        throw new Error("missing or expired proof artifact");
+      const asset = matches[0];
+      const candidate = readProofArchive(
+        await fetchArchive(`${prefix}/artifacts/${asset.id}/zip`),
+        asset.digest,
+      );
+      const decision = planVerification({
+        expected,
+        evaluatedAtMs,
+        candidate,
+        provider: {
+          repository: run.repository.full_name,
+          runId: String(run.id),
+          runAttempt: run.run_attempt,
+          headSha: run.head_sha,
+          event: run.event,
+          status: run.status,
+          conclusion: run.conclusion,
+          workflowPath: run.path,
+          artifactDigest: asset.digest,
+        },
+      });
+      if (decision.decision === "reuse")
+        return { ...decision, sourceSha: expected.sourceSha };
+      reasons.push(decision.reason);
+    } catch {
+      // Provider/transport or evidence failures are cache misses, never a green check.
+      reasons.push("unavailable-or-invalid-evidence");
+    }
+  }
+  return {
+    decision: "execute",
+    reason: reasons.join(",") || "missing-evidence",
+  };
+}
+
+function output(decision) {
+  write(".buildchain/source-verification/decision.json", decision);
+  if (process.env.GITHUB_OUTPUT)
+    fs.appendFileSync(
+      process.env.GITHUB_OUTPUT,
+      `decision=${decision.decision}\n`,
+    );
+  if (process.env.GITHUB_STEP_SUMMARY)
+    fs.appendFileSync(
+      process.env.GITHUB_STEP_SUMMARY,
+      `Source verification: **${decision.decision}** (${decision.reason}).${decision.runId ? ` Original full execution: run ${decision.runId}, attempt ${decision.runAttempt}, proof ${decision.evidenceRoot}.` : ""}\n`,
+    );
+  console.log(JSON.stringify(decision));
+}
+
+function providerDiscovery(expected) {
+  return discoverVerification({
+    expected,
+    evaluatedAtMs: Date.now(),
+    fetchJson: async (endpoint) => JSON.parse(api(endpoint)),
+    fetchArchive: async (endpoint) => api(endpoint, true),
+  });
+}
+
+export async function planVersionProjection({
+  baseSha,
+  headSha,
+  discover,
+  regenerate,
+}) {
+  const proof = await discover(baseSha);
+  if (proof.decision !== "reuse")
+    return { decision: "execute", reason: "base-full-proof-unavailable" };
+  const projection = await regenerate(baseSha, headSha);
+  return {
+    ...proof,
+    decision: "projection",
+    reason: "verified-base-and-exact-regenerated-version-delta",
+    projection,
+  };
+}
+
+async function planCurrentVerification() {
+  if (git("status", "--porcelain", "--untracked-files=no"))
+    throw new Error("dirty source");
+  const event = process.env.GITHUB_EVENT_NAME;
+  const headSha = git("rev-parse", "HEAD");
+  if (
+    event === "push" &&
+    process.env.GITHUB_REF?.startsWith("refs/heads/dev/")
+  ) {
+    const exact = await providerDiscovery(verificationIdentity());
+    if (exact.decision === "reuse") return exact;
+  }
+  if (!["pull_request", "merge_group", "push"].includes(event))
+    return { decision: "execute", reason: "full-execution-required-for-event" };
+  const payload = JSON.parse(fs.readFileSync(process.env.GITHUB_EVENT_PATH));
+  const baseSha =
+    event === "merge_group"
+      ? payload.merge_group?.base_sha
+      : event === "pull_request"
+        ? payload.pull_request?.base.sha
+        : process.env.GITHUB_REF?.startsWith("refs/heads/dev/")
+          ? payload.before
+          : null;
+  if (!/^[a-f0-9]{40}$/u.test(baseSha || ""))
+    throw new Error("no exact protected base");
+  return planVersionProjection({
+    baseSha,
+    headSha,
+    discover: (revision) =>
+      providerDiscovery(verificationIdentity({ revision })),
+    regenerate: async (baseSha, headSha) => {
+      const { verifyVersionStateDelta } =
+        await import("./verify-version-state-delta.mjs");
+      return verifyVersionStateDelta({
+        baseSha,
+        headSha,
+        nodeModules: path.resolve(".buildchain/runtime/node_modules"),
+      });
+    },
+  });
+}
+
+export async function main(mode) {
+  if (mode === "plan") {
+    try {
+      output(await planCurrentVerification());
+    } catch {
+      output({
+        decision: "execute",
+        reason: "identity-provider-or-version-delta-unavailable",
+      });
+    }
+  } else if (mode === "start") {
+    write(".buildchain/source-verification/start.json", {
+      identity: verificationIdentity(),
+      startedAtMs: Date.now(),
+    });
+  } else if (mode === "seal") {
+    if (process.env.GITHUB_EVENT_NAME !== "merge_group")
+      throw new Error(
+        "only merge-group full executions produce reusable proof",
+      );
+    const started = JSON.parse(
+      fs.readFileSync(".buildchain/source-verification/start.json"),
+    );
+    if (
+      git("status", "--porcelain", "--untracked-files=no") ||
+      JSON.stringify(started.identity) !==
+        JSON.stringify(verificationIdentity())
+    )
+      throw new Error(
+        "source or verification identity changed during execution",
+      );
+    const completedAtMs = Date.now();
+    write(
+      proofPath,
+      sealVerification({
+        schema: "buildchain-v4-source-verification-evidence/v1",
+        ...started,
+        runId: process.env.GITHUB_RUN_ID,
+        runAttempt: Number(process.env.GITHUB_RUN_ATTEMPT),
+        event: process.env.GITHUB_EVENT_NAME,
+        validationKind: "full-source",
+        exitCode: 0,
+        completedAtMs,
+        expiresAtMs: completedAtMs + 6 * 60 * 60 * 1000,
+      }),
+    );
+  } else throw new Error(`unknown verification evidence mode: ${mode}`);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
+  main(process.argv[2]).catch((error) => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });

package/scripts/stable-candidate-qualification.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 const DEFAULTS = {
-  buildWorkflowFile: "build-surface-fixture.yml",
+  buildWorkflowFile: "self-build-fixture.yml",
   buildWorkflowName: "Build Surface Fixture",
   canaryRepository: "kungfu-systems/site-libkungfu-dev",
   canaryWorkflowFile: "buildchain-stable-canary.yml",

package/scripts/{v4-stage-capsule-qualification.mjs → stage-capsule-qualification.mjs}

@@ -7,31 +7,31 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
 import {
-  V4ContractFault,
-  v4CanonicalBytes,
-  v4ContentRoot,
-} from "../packages/core/v4-canonical-contracts.js";
-import { V4StageCapsuleLocalStore } from "../packages/core/v4-stage-capsule-local-store.js";
+  ContractFault,
+  domainCanonicalBytes,
+  domainContentRoot,
+} from "../packages/core/canonical-contracts.js";
+import { StageCapsuleLocalStore } from "../packages/core/stage-capsule-local-store.js";
 import {
-  restoreV4PlatformStageCheckpoint,
-  validateV4PlatformStageCheckpointDeclaration,
-} from "../packages/core/v4-platform-stage-checkpoints.js";
+  restorePlatformStageCheckpoint,
+  validatePlatformStageCheckpointDeclaration,
+} from "../packages/core/platform-stage-checkpoints.js";
 import {
-  V4_STAGE_CAPSULE_CAMPAIGN_RECORDED_AT,
-  createV4StageCapsuleCampaignProfile,
-  emitV4StageCapsuleCampaignCheckpoint,
-  runV4StageCapsuleFaultCampaign,
-  v4StageCapsuleCampaignAggregateRoots,
-  v4StageCapsuleCampaignDependencies,
-  v4StageCapsuleCampaignStages,
-} from "../packages/core/v4-stage-capsule-qualification-campaign.js";
+  STAGE_CAPSULE_CAMPAIGN_RECORDED_AT,
+  createStageCapsuleCampaignProfile,
+  emitStageCapsuleCampaignCheckpoint,
+  runStageCapsuleFaultCampaign,
+  stageCapsuleCampaignAggregateRoots,
+  stageCapsuleCampaignDependencies,
+  stageCapsuleCampaignStages,
+} from "../packages/core/stage-capsule-qualification-campaign.js";
 import {
-  V4_STAGE_CAPSULE_PLATFORM_QUALIFICATION_CONTRACT,
-  qualifyV4StageCapsuleCampaign,
-  reconcileV4StageCapsuleWave,
-  validateV4StageCapsulePlatformQualification,
-} from "../packages/core/v4-stage-capsule-qualification.js";
-import { planV4StageCapsuleResume } from "../packages/core/v4-stage-capsule-resume-planner.js";
+  STAGE_CAPSULE_PLATFORM_QUALIFICATION_CONTRACT,
+  qualifyStageCapsuleCampaign,
+  reconcileStageCapsuleWave,
+  validateStageCapsulePlatformQualification,
+} from "../packages/core/stage-capsule-qualification.js";
+import { planStageCapsuleResume } from "../packages/core/stage-capsule-resume-planner.js";
 
 const repoRoot = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -56,13 +56,13 @@ function readJson(file) {
 
 function writeJson(file, value) {
   fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, v4CanonicalBytes(value), { flag: "wx" });
+  fs.writeFileSync(file, domainCanonicalBytes(value), { flag: "wx" });
 }
 
 function declaration() {
-  return validateV4PlatformStageCheckpointDeclaration(
+  return validatePlatformStageCheckpointDeclaration(
     readJson(
-      path.join(repoRoot, "architecture/v4-platform-stage-checkpoints.json"),
+      path.join(repoRoot, "architecture/platform-stage-checkpoints.json"),
     ),
   );
 }
@@ -96,7 +96,7 @@ function prepareContext(context) {
   context.lifecycleConfig = buildchainConfigModule.loadBuildchainConfig(
     context.consumerRoot,
   );
-  context.campaignProfile = createV4StageCapsuleCampaignProfile(context);
+  context.campaignProfile = createStageCapsuleCampaignProfile(context);
   return context;
 }
 
@@ -115,28 +115,28 @@ function directoryBytes(directory) {
 
 function seed(context) {
   prepareContext(context);
-  const campaignStages = v4StageCapsuleCampaignStages(context);
+  const campaignStages = stageCapsuleCampaignStages(context);
   const retainedStages = campaignStages.slice(
     0,
     Math.max(1, campaignStages.indexOf("verify")),
   );
   const failedStage = "verify";
   const targetStage = campaignStages.at(-1);
-  const referenceStore = new V4StageCapsuleLocalStore(
+  const referenceStore = new StageCapsuleLocalStore(
     path.join(context.workRoot, "reference-store"),
   );
-  const retainedStore = new V4StageCapsuleLocalStore(
+  const retainedStore = new StageCapsuleLocalStore(
     path.join(context.workRoot, "retained-store"),
   );
   const reference = campaignStages.map((stage) => ({
     stage,
-    ...emitV4StageCapsuleCampaignCheckpoint(context, stage, referenceStore),
+    ...emitStageCapsuleCampaignCheckpoint(context, stage, referenceStore),
   }));
   const retained = retainedStages.map((stage) => ({
     stage,
-    ...emitV4StageCapsuleCampaignCheckpoint(context, stage, retainedStore),
+    ...emitStageCapsuleCampaignCheckpoint(context, stage, retainedStore),
   }));
-  const lateFailure = emitV4StageCapsuleCampaignCheckpoint(
+  const lateFailure = emitStageCapsuleCampaignCheckpoint(
     context,
     failedStage,
     retainedStore,
@@ -150,7 +150,7 @@ function seed(context) {
     platform: context.platform,
     runtimeRef: context.runtimeRef,
     campaignProfileRoot: context.campaignProfile.profileRoot,
-    referenceRoots: v4StageCapsuleCampaignAggregateRoots(reference),
+    referenceRoots: stageCapsuleCampaignAggregateRoots(reference),
     retainedCapsuleRoots: retained.map(({ stage, capsule }) => ({
       stage,
       capsuleRoot: capsule.capsuleRoot,
@@ -165,7 +165,7 @@ function seed(context) {
   };
   const evidence = {
     ...body,
-    evidenceRoot: v4ContentRoot("stage-capsule-seed-evidence", body),
+    evidenceRoot: domainContentRoot("stage-capsule-seed-evidence", body),
   };
   writeJson(path.join(context.workRoot, "seed-evidence.json"), evidence);
   writeJson(path.join(context.workRoot, "campaign-state.json"), {
@@ -179,7 +179,7 @@ function seed(context) {
     dependencies: Object.fromEntries(
       campaignStages.map((stage) => [
         stage,
-        v4StageCapsuleCampaignDependencies(context, stage),
+        stageCapsuleCampaignDependencies(context, stage),
       ]),
     ),
     retainedStages,
@@ -200,7 +200,7 @@ function stageNode(state, store, reference) {
   if (state.retainedStages.includes(reference.stage)) {
     const restored = store.restore({
       capsuleRoot: reference.capsule.capsuleRoot,
-      recordedAt: V4_STAGE_CAPSULE_CAMPAIGN_RECORDED_AT,
+      recordedAt: STAGE_CAPSULE_CAMPAIGN_RECORDED_AT,
     });
     candidate = {
       capsule: restored.capsule,
@@ -219,7 +219,7 @@ function stageNode(state, store, reference) {
 function resumeRequest(state, store) {
   return {
     schema: "buildchain-v4-stage-capsule-resume-request/v1",
-    evaluatedAt: V4_STAGE_CAPSULE_CAMPAIGN_RECORDED_AT,
+    evaluatedAt: STAGE_CAPSULE_CAMPAIGN_RECORDED_AT,
     nodes: state.reference.map((reference) =>
       stageNode(state, store, reference),
     ),
@@ -229,7 +229,7 @@ function resumeRequest(state, store) {
 }
 
 function emitMissing(context, state, store, stageId) {
-  const emitted = emitV4StageCapsuleCampaignCheckpoint(context, stageId, store);
+  const emitted = emitStageCapsuleCampaignCheckpoint(context, stageId, store);
   const expected = state.reference.find(({ stage }) => stage === stageId);
   if (
     emitted.capsule.capsuleRoot !== expected.capsule.capsuleRoot ||
@@ -253,18 +253,18 @@ function resume(context) {
     ["consumerSourceRevision", "stage-capsule-campaign-source-revision-drift"],
   ])
     if (state[name] !== context[name])
-      throw new V4ContractFault(code, `$/campaign/${name}`, `${name} differs`);
+      throw new ContractFault(code, `$/campaign/${name}`, `${name} differs`);
   if (state.campaignProfileRoot !== context.campaignProfile.profileRoot)
-    throw new V4ContractFault(
+    throw new ContractFault(
       "stage-capsule-campaign-lifecycle-profile-drift",
       "$/campaign/campaignProfileRoot",
       "campaign lifecycle profile differs",
     );
-  const store = new V4StageCapsuleLocalStore(
+  const store = new StageCapsuleLocalStore(
     path.join(context.workRoot, "retained-store"),
   );
   const request = resumeRequest(state, store);
-  const plan = planV4StageCapsuleResume(request);
+  const plan = planStageCapsuleResume(request);
   const expectedRestores = [state.retainedStages.at(-1)];
   const expectedStages = state.campaignStages.filter(
     (stage) => !state.retainedStages.includes(stage),
@@ -292,12 +292,12 @@ function resume(context) {
   const started = process.hrtime.bigint();
   for (const stageId of plan.requiredRestores) {
     const reference = state.reference.find(({ stage }) => stage === stageId);
-    restoreV4PlatformStageCheckpoint({
+    restorePlatformStageCheckpoint({
       declaration: context.declaration,
       expectedPlatform: context.platform,
       expectedStage: stageId,
       capsuleRoot: reference.capsule.capsuleRoot,
-      recordedAt: V4_STAGE_CAPSULE_CAMPAIGN_RECORDED_AT,
+      recordedAt: STAGE_CAPSULE_CAMPAIGN_RECORDED_AT,
       targetDirectory: path.join(context.workRoot, "restored", stageId),
       store,
     });
@@ -316,9 +316,9 @@ function resume(context) {
       state.campaignStages.indexOf(left.stage) -
       state.campaignStages.indexOf(right.stage),
   );
-  const freshBuild = v4StageCapsuleCampaignAggregateRoots(state.reference);
-  const resumedBuild = v4StageCapsuleCampaignAggregateRoots(resumedEntries);
-  const campaignFaults = runV4StageCapsuleFaultCampaign(request);
+  const freshBuild = stageCapsuleCampaignAggregateRoots(state.reference);
+  const resumedBuild = stageCapsuleCampaignAggregateRoots(resumedEntries);
+  const campaignFaults = runStageCapsuleFaultCampaign(request);
   const metrics = {
     fullStageCount: state.campaignStages.length,
     rebuiltStageCount: plan.requiredStages.length,
@@ -341,7 +341,7 @@ function resume(context) {
     planRoot: plan.planRoot,
     freshBuild,
     resumedBuild,
-    faultCampaignRoot: v4ContentRoot(
+    faultCampaignRoot: domainContentRoot(
       "stage-capsule-fault-campaign",
       campaignFaults,
     ),
@@ -349,10 +349,13 @@ function resume(context) {
   };
   const resumeEvidence = {
     ...resumeBody,
-    evidenceRoot: v4ContentRoot("stage-capsule-resume-evidence", resumeBody),
+    evidenceRoot: domainContentRoot(
+      "stage-capsule-resume-evidence",
+      resumeBody,
+    ),
   };
   const reportBody = {
-    schema: V4_STAGE_CAPSULE_PLATFORM_QUALIFICATION_CONTRACT,
+    schema: STAGE_CAPSULE_PLATFORM_QUALIFICATION_CONTRACT,
     mode: "shadow-only",
     productionAuthority: "v3",
     consumer: context.consumer,
@@ -389,9 +392,9 @@ function resume(context) {
     providerEffects: false,
     productionWrites: false,
   };
-  const report = validateV4StageCapsulePlatformQualification({
+  const report = validateStageCapsulePlatformQualification({
     ...reportBody,
-    reportRoot: v4ContentRoot(
+    reportRoot: domainContentRoot(
       "stage-capsule-platform-qualification",
       reportBody,
     ),
@@ -401,7 +404,7 @@ function resume(context) {
     resumeEvidence,
   );
   writeJson(path.join(context.workRoot, "report.json"), report);
-  process.stdout.write(v4CanonicalBytes(report));
+  process.stdout.write(domainCanonicalBytes(report));
 }
 
 function child(action, context) {
@@ -439,7 +442,7 @@ function child(action, context) {
 function campaign(context) {
   if (option("stage-capsule-mode", "shadow") === "v3") {
     process.stdout.write(
-      v4CanonicalBytes({
+      domainCanonicalBytes({
         schema: "buildchain-v4-stage-capsule-rollback/v1",
         switch: "stage-capsule-mode=v3",
         productionAuthority: "v3",
@@ -485,13 +488,10 @@ function aggregate() {
         .map((value) => value.trim())
         .filter(Boolean)
     : undefined;
-  const qualification = qualifyV4StageCapsuleCampaign(
-    reports,
-    expectedConsumers,
-  );
+  const qualification = qualifyStageCapsuleCampaign(reports, expectedConsumers);
   const output = option("output");
   if (output) writeJson(path.resolve(output), qualification);
-  process.stdout.write(v4CanonicalBytes(qualification));
+  process.stdout.write(domainCanonicalBytes(qualification));
 }
 
 function reconcile() {
@@ -499,10 +499,10 @@ function reconcile() {
   const request = readJson(path.resolve(required("wave-evidence")));
   if (request.qualificationRoot !== qualification.qualificationRoot)
     throw new Error("wave evidence does not bind the qualification root");
-  const reconciliation = reconcileV4StageCapsuleWave(request);
+  const reconciliation = reconcileStageCapsuleWave(request);
   const output = option("output");
   if (output) writeJson(path.resolve(output), reconciliation);
-  process.stdout.write(v4CanonicalBytes(reconciliation));
+  process.stdout.write(domainCanonicalBytes(reconciliation));
 }
 
 const action = process.argv[2] || "";
@@ -516,7 +516,7 @@ else if (action === "aggregate") aggregate();
 else if (action === "reconcile") reconcile();
 else if (action === "smoke") {
   const temporary = fs.mkdtempSync(
-    path.join(os.tmpdir(), "buildchain-v4-capsule-"),
+    path.join(os.tmpdir(), "buildchain-capsule-"),
   );
   const context = contextFromArgs();
   context.workRoot = temporary;