@kungfu-tech/buildchain 4.0.2 → 4.0.3-alpha.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +4 -4
- package/CONTRIBUTING.md +34 -0
- package/README.md +1 -1
- package/architecture/agent-change-map.md +154 -147
- package/architecture/{v4-architecture-constitution.md → architecture-constitution.md} +11 -11
- package/architecture/{v3-core-mechanism-inventory.md → baseline-core-mechanism-inventory.md} +1 -1
- package/architecture/{v4-bootstrap-authority.json → bootstrap-authority.json} +3 -3
- package/architecture/{v3-v4-capability-closure.md → capability-parity-closure.md} +3 -3
- package/architecture/{v3-v4-live-capability-inventory.json → capability-parity-live-capability-inventory.json} +4 -4
- package/architecture/{v4-capability-state-machine-manifest.json → capability-state-machine-manifest.json} +2 -2
- package/architecture/{v4-capability-state-machine-manifest.schema.json → capability-state-machine-manifest.schema.json} +2 -2
- package/architecture/ci-lane-change-budget.json +18 -0
- package/architecture/{v4-cross-platform-adopter-qualification.json → cross-platform-adopter-qualification.json} +3 -3
- package/architecture/{v4-delivery-authority-parity.json → delivery-authority-parity.json} +16 -16
- package/architecture/{v4-delivery-warrant-shadow-bootstrap-plan.json → delivery-warrant-shadow-bootstrap-plan.json} +3 -3
- package/architecture/{v4-delivery-warrant-shadow-bootstrap-plan.md → delivery-warrant-shadow-bootstrap-plan.md} +7 -7
- package/architecture/{v4-floating-consumer-policy.md → floating-consumer-policy.md} +1 -1
- package/architecture/implementation-naming.json +1273 -0
- package/architecture/internal-capabilities.json +171 -169
- package/architecture/maintainability-debt.json +87 -82
- package/architecture/maintainability-policy.json +15 -15
- package/architecture/{v4-next-development-parity.json → next-development-parity.json} +8 -8
- package/architecture/{v4-partial-mutation-recovery-qualification.json → partial-mutation-recovery-qualification.json} +8 -8
- package/architecture/{v4-platform-stage-checkpoints.json → platform-stage-checkpoints.json} +2 -2
- package/architecture/{v4-provider-operation-journal-contract.json → provider-operation-journal-contract.json} +9 -9
- package/architecture/{v4-publication-rehearsal-parity.json → publication-rehearsal-parity.json} +4 -4
- package/architecture/{v4-release-activation-shadow-domain.json → release-activation-shadow-domain.json} +8 -8
- package/architecture/{v4-release-topology.json → release-topology.json} +112 -56
- package/architecture/{v4-release-train-parity.json → release-train-parity.json} +2 -2
- package/architecture/{v4-runtime-ref-resume-authority.json → runtime-ref-resume-authority.json} +1 -1
- package/architecture/{v4-runtime-semantic-closure.json → runtime-semantic-closure.json} +2 -2
- package/architecture/{v4-rust-libnode-bridge-evaluation.json → rust-libnode-bridge-evaluation.json} +3 -3
- package/architecture/{v4-rust-libnode-bridge-spike.md → rust-libnode-bridge-spike.md} +6 -6
- package/architecture/{v4-rust-wasm-production-authority.json → rust-wasm-production-authority.json} +11 -11
- package/architecture/{v4-stable-publication-fence.json → stable-publication-fence.json} +6 -6
- package/architecture/{v4-stage-capsule-contract.json → stage-capsule-contract.json} +1 -1
- package/architecture/{v4-stage-capsule-qualification.json → stage-capsule-qualification.json} +6 -6
- package/architecture/{v4-stage-capsule-resume-planner.json → stage-capsule-resume-planner.json} +2 -2
- package/architecture/{v4-stage-capsule-store-contract.json → stage-capsule-store-contract.json} +4 -4
- package/architecture/{v4-tail-reseal-parity.json → tail-reseal-parity.json} +28 -28
- package/architecture/{v4-universal-workflow-bootstrap.json → universal-workflow-bootstrap.json} +9 -4
- package/architecture/{v4-universal-workflow-fault-campaign.json → universal-workflow-fault-campaign.json} +8 -8
- package/architecture/{v4-universal-workflow-train-admission.json → universal-workflow-train-admission.json} +8 -8
- package/architecture/workflow-taxonomy.json +11 -0
- package/bin/buildchain.mjs +3 -3
- package/bin/internal/adopter-delivery-cli.mjs +9 -9
- package/contracts/fixtures/v4-tail-reseal-v1/valid.json +1 -1
- package/crates/{buildchain-v4-bridge → buildchain-host-bridge}/Cargo.lock +1 -1
- package/crates/{buildchain-v4-bridge → buildchain-host-bridge}/Cargo.toml +1 -1
- package/crates/{buildchain-v4-bridge → buildchain-host-bridge}/src/main.rs +3 -3
- package/dist/site/buildchain-contract.json +18 -18
- package/dist/site/buildchain-site.json +167 -71
- package/dist/site/capability-registry.json +5 -5
- package/dist/site/kfd-claims.json +226 -90
- package/dist/site/kfd-upstream-aggregate.json +1 -1
- package/dist/site/manual-registry.json +7 -7
- package/dist/site/node-api-registry.json +12929 -10491
- package/dist/site/page-registry.json +155 -59
- package/dist/site/public-surface-audit.json +65 -46
- package/dist/site/publication-authority-registry.json +27 -17
- package/dist/site/publication-registry.json +4 -4
- package/dist/site/release-provenance.json +18 -9
- package/dist/site/site-manifest.json +11 -11
- package/dist/site/workflow-registry.json +86 -52
- package/docs/MAP.md +4 -3
- package/docs/next-development-transition.md +24 -1
- package/docs/node-api-reference.md +435 -175
- package/docs/oci-publication.md +173 -0
- package/docs/publish-transaction.md +36 -3
- package/docs/release-flow.md +1 -1
- package/docs/reusable-build-surface.md +1 -1
- package/docs/v4-adopter-delivery.md +2 -2
- package/docs/v4-canonical-contracts.md +7 -7
- package/docs/v4-delivery-warrant-read-candidate.md +3 -3
- package/docs/v4-delivery-warrant-semantic-diff.md +3 -3
- package/docs/v4-production-release.md +8 -2
- package/docs/v4-publication-rehearsal.md +3 -3
- package/docs/v4-runtime-ref-resume-authority.md +2 -2
- package/docs/v4-rust-wasm-production-authority.md +6 -6
- package/docs/v4-stage-capsule.md +7 -7
- package/docs/v4-tail-reseal.md +1 -1
- package/docs/workflow-catalog.md +1 -0
- package/package.json +37 -26
- package/packages/compatibility/adopter-delivery.js +16 -0
- package/packages/compatibility/cross-platform-adopter-qualification.js +12 -0
- package/packages/compatibility/floating-consumer-policy.js +14 -0
- package/packages/compatibility/publication-qualification.js +11 -0
- package/packages/compatibility/publication-rehearsal.js +18 -0
- package/packages/compatibility/runtime-ref-resume-authority.js +13 -0
- package/packages/compatibility/tail-reseal-receipt.js +7 -0
- package/packages/compatibility/tail-reseal.js +11 -0
- package/packages/core/{v4-adopter-delivery-parity.js → adopter-delivery-parity.js} +12 -12
- package/packages/core/{v4-adopter-delivery.js → adopter-delivery.js} +24 -24
- package/packages/core/buildchain-contract.js +5 -5
- package/packages/core/buildchain-domain.wasm +0 -0
- package/packages/core/buildchain-publication-authority.js +1 -0
- package/packages/core/{v4-canonical-contracts.js → canonical-contracts.js} +32 -31
- package/packages/core/{v4-cross-platform-adopter-qualification.js → cross-platform-adopter-qualification.js} +19 -19
- package/packages/core/{v4-delivery-warrant-fixture-runner.js → delivery-warrant-fixture-runner.js} +36 -32
- package/packages/core/{v4-delivery-warrant-read-candidate.js → delivery-warrant-read-candidate.js} +40 -40
- package/packages/core/{v4-delivery-warrant-semantic-diff-gate.js → delivery-warrant-semantic-diff-gate.js} +58 -59
- package/packages/core/{v4-delivery-warrant-shadow-adapter.js → delivery-warrant-shadow-adapter.js} +15 -15
- package/packages/core/dev-delivery-execution-transfer.js +6 -6
- package/packages/core/dev-delivery-native-proof.js +12 -8
- package/packages/core/dev-delivery-warrant-legacy-recovery.js +1 -1
- package/packages/core/dev-delivery-warrant-native-compatibility.js +4 -4
- package/packages/core/dev-delivery-warrant-state.js +11 -11
- package/packages/core/dev-delivery-warrant.js +3 -3
- package/packages/core/domain-wasm-artifact.js +7 -0
- package/packages/core/{v4-domain-wasm.js → domain-wasm.js} +31 -31
- package/packages/core/{v4-floating-consumer-evidence.js → floating-consumer-evidence.js} +13 -13
- package/packages/core/{v4-floating-consumer-policy.js → floating-consumer-policy.js} +27 -29
- package/packages/core/{v4-floating-consumer-release-passport.js → floating-consumer-release-passport.js} +25 -25
- package/packages/core/index.js +4 -8
- package/packages/core/next-development-projection.js +24 -1
- package/packages/core/next-development-transition.js +5 -6
- package/packages/core/oci-compose-qualification.js +143 -0
- package/packages/core/oci-publication-bundle.js +281 -0
- package/packages/core/oci-publication-graph.js +206 -0
- package/packages/core/paper-runtime-channels.js +2 -2
- package/packages/core/paper.js +3 -3
- package/packages/core/partial-mutation-recovery-qualification.js +18 -0
- package/packages/core/{v4-platform-stage-checkpoints.js → platform-stage-checkpoints.js} +37 -37
- package/packages/core/{v4-product-publication.js → product-publication.js} +11 -9
- package/packages/core/{v4-protected-publication-source.js → protected-publication-source.js} +3 -3
- package/packages/core/provider-operation-journal.js +62 -0
- package/packages/core/{v4-provider-readback-idempotency.js → provider-readback-idempotency.js} +33 -33
- package/packages/core/public-export-compatibility.js +33 -0
- package/packages/core/publication-development.js +72 -0
- package/packages/core/{v4-publication-qualification.js → publication-qualification.js} +17 -17
- package/packages/core/{v4-publication-rehearsal-capsule.js → publication-rehearsal-capsule.js} +23 -23
- package/packages/core/publication-rehearsal-projection.js +2 -2
- package/packages/core/{v4-publication-rehearsal-provider-bindings.js → publication-rehearsal-provider-bindings.js} +4 -4
- package/packages/core/publication-rehearsal-runtime.js +21 -21
- package/packages/core/{v4-publication-rehearsal.js → publication-rehearsal.js} +33 -33
- package/packages/core/publication-sealed-bundle.js +78 -13
- package/packages/core/release-activation-shadow.js +32 -0
- package/packages/core/release-candidate.js +6 -6
- package/packages/core/{v4-release-invocation.js → release-invocation.js} +15 -15
- package/packages/core/release-passport.js +36 -36
- package/packages/core/release-tail-product-capabilities.js +9 -0
- package/packages/core/release-tail-provider-plane.js +10 -10
- package/packages/core/{v4-runtime-ref-resume-authority.js → runtime-ref-resume-authority.js} +36 -40
- package/packages/core/{v4-runtime-selector-persistence.js → runtime-selector-persistence.js} +7 -7
- package/packages/core/stable-publication-fence.js +28 -0
- package/packages/core/{v4-stage-capsule-local-store.js → stage-capsule-local-store.js} +56 -54
- package/packages/core/{v4-stage-capsule-qualification-campaign.js → stage-capsule-qualification-campaign.js} +37 -38
- package/packages/core/{v4-stage-capsule-qualification.js → stage-capsule-qualification.js} +28 -29
- package/packages/core/{v4-stage-capsule-resume-planner.js → stage-capsule-resume-planner.js} +29 -29
- package/packages/core/{v4-stage-capsule-store.js → stage-capsule-store.js} +59 -56
- package/packages/core/{v4-stage-capsule.js → stage-capsule.js} +45 -45
- package/packages/core/{v4-tail-reseal-contract.js → tail-reseal-contract.js} +6 -6
- package/packages/core/{v4-tail-reseal-github.js → tail-reseal-github.js} +12 -12
- package/packages/core/{v4-tail-reseal-receipt.js → tail-reseal-receipt.js} +22 -22
- package/packages/core/{v4-tail-reseal.js → tail-reseal.js} +29 -29
- package/packages/core/{v4-universal-workflow-bootstrap.js → universal-workflow-bootstrap.js} +23 -23
- package/scripts/{v4-architecture.mjs → architecture.mjs} +6 -6
- package/scripts/binary-publication-evidence.mjs +1 -1
- package/scripts/{v4-bridge-bootstrap.mjs → bridge-bootstrap.mjs} +14 -18
- package/scripts/{v4-bridge-evidence.mjs → bridge-evidence.mjs} +8 -8
- package/scripts/{build-v4-domain-wasm.mjs → build-domain-wasm.mjs} +6 -18
- package/scripts/{v3-v4-capability-catalog.mjs → capability-parity-catalog.mjs} +19 -19
- package/scripts/check-action-bundles.mjs +2 -2
- package/scripts/{check-v3-v4-capability-inventory.mjs → check-capability-parity-inventory.mjs} +42 -42
- package/scripts/check-core-mechanism-inventory.mjs +4 -1
- package/scripts/{check-v4-floating-consumer-policy-contract.mjs → check-floating-consumer-policy-contract.mjs} +8 -8
- package/scripts/check-implementation-naming.mjs +135 -0
- package/scripts/check-inventory.mjs +6 -5
- package/scripts/check-maintainability.mjs +9 -2
- package/scripts/{check-v4-public-dogfood-contract.mjs → check-public-dogfood-contract.mjs} +15 -15
- package/scripts/{check-v4-release-topology.mjs → check-release-topology.mjs} +53 -31
- package/scripts/{check-v4-runtime-semantic-closure.mjs → check-runtime-semantic-closure.mjs} +19 -16
- package/scripts/{check-v4-universal-workflow-bootstrap.mjs → check-universal-workflow-bootstrap.mjs} +14 -14
- package/scripts/{v4-consumer-policy.mjs → consumer-policy.mjs} +15 -15
- package/scripts/{copy-v4-domain-wasm.mjs → copy-domain-wasm.mjs} +3 -3
- package/scripts/{v4-cross-platform-adopter-qualification.mjs → cross-platform-adopter-qualification.mjs} +9 -9
- package/scripts/{v4-declarative-promotion-admission.mjs → declarative-promotion-admission.mjs} +4 -4
- package/scripts/dev-delivery-warrant-options.mjs +1 -1
- package/scripts/dev-delivery-warrant-store.mjs +29 -10
- package/scripts/dev-delivery-warrant.mjs +4 -4
- package/scripts/dev-pr-delivery-warrant.mjs +1 -1
- package/scripts/generate-channel-build-workflow.mjs +2 -2
- package/scripts/generate-channel-promotion-workflow.mjs +14 -31
- package/scripts/generate-release-candidate-passport.mjs +23 -23
- package/scripts/generate-site-bundle.mjs +17 -17
- package/scripts/{generate-v4-universal-workflow-facades.mjs → generate-universal-workflow-facades.mjs} +61 -21
- package/scripts/{v4-host-adapter.mjs → host-adapter.mjs} +1 -1
- package/scripts/implementation-references.mjs +25 -0
- package/scripts/init-repo.mjs +1 -1
- package/scripts/next-development-review.mjs +17 -11
- package/scripts/oci-compose-preview.mjs +261 -0
- package/scripts/{v4-platform-stage-checkpoint-rehearsal.mjs → platform-stage-checkpoint-rehearsal.mjs} +17 -17
- package/scripts/{v4-product-publication-intent.mjs → product-publication-intent.mjs} +16 -8
- package/scripts/publication-candidate-kind.mjs +93 -0
- package/scripts/publication-candidate-sealer.mjs +16 -1
- package/scripts/{v4-publication-rehearsal-fixture.mjs → publication-rehearsal-fixture.mjs} +5 -5
- package/scripts/{v4-publication-settlement.mjs → publication-settlement.mjs} +8 -8
- package/scripts/{v4-release-candidate-adapter.mjs → release-candidate-adapter.mjs} +4 -4
- package/scripts/release-candidate-resolver.mjs +15 -26
- package/scripts/release-tail.mjs +5 -5
- package/scripts/resume-from-candidate-run.mjs +35 -42
- package/scripts/site-capability-metadata.mjs +9 -0
- package/scripts/source-verification-evidence.mjs +7 -7
- package/scripts/{v4-stage-capsule-qualification.mjs → stage-capsule-qualification.mjs} +62 -62
- package/scripts/{v4-stage-capsule-resume-rehearsal.mjs → stage-capsule-resume-rehearsal.mjs} +6 -6
- package/scripts/{v4-tail-reseal-macos-rehearsal.mjs → tail-reseal-macos-rehearsal.mjs} +9 -9
- package/scripts/{v4-tail-reseal.mjs → tail-reseal.mjs} +19 -19
- package/scripts/universal-facade-maintainability.mjs +12 -3
- package/scripts/{v4-universal-workflow-backflow.mjs → universal-workflow-backflow.mjs} +10 -10
- package/scripts/{v4-universal-workflow-engine.mjs → universal-workflow-engine.mjs} +40 -38
- package/scripts/{v4-universal-workflow-self-dogfood.mjs → universal-workflow-self-dogfood.mjs} +12 -12
- package/scripts/verify-version-state-delta.mjs +4 -2
- package/scripts/{v4-warrant-shadow-plan.mjs → warrant-shadow-plan.mjs} +6 -6
- package/templates/universal-buildchain-bootstrap-recovery.yml +4 -4
- package/packages/core/buildchain-v4-domain.wasm +0 -0
- package/packages/core/v4-domain-wasm-artifact.js +0 -7
- package/packages/core/v4-partial-mutation-recovery-qualification.js +0 -18
- package/packages/core/v4-provider-operation-journal.js +0 -62
- package/packages/core/v4-release-activation-shadow.js +0 -32
- package/packages/core/v4-stable-publication-fence.js +0 -28
- /package/actions/{v4-release-candidate-promote → release-candidate-promote}/README.md +0 -0
- /package/architecture/{v4-adopter-delivery-parity.json → adopter-delivery-parity.json} +0 -0
- /package/architecture/{v3-core-mechanism-inventory.json → baseline-core-mechanism-inventory.json} +0 -0
- /package/architecture/{v4-canonical-contract-fixtures.json → canonical-contract-fixtures.json} +0 -0
- /package/architecture/{v4-compatibility-facts-parity.json → compatibility-facts-parity.json} +0 -0
- /package/architecture/{v4-delivery-warrant-shadow-bootstrap-plan.schema.json → delivery-warrant-shadow-bootstrap-plan.schema.json} +0 -0
- /package/architecture/{v4-delivery-warrant-shadow-fixtures.json → delivery-warrant-shadow-fixtures.json} +0 -0
- /package/architecture/{v4-delivery-warrant-shadow-fixtures.schema.json → delivery-warrant-shadow-fixtures.schema.json} +0 -0
- /package/architecture/{v4-exception-ledger.json → exception-ledger.json} +0 -0
- /package/architecture/{v4-exception-ledger.schema.json → exception-ledger.schema.json} +0 -0
- /package/architecture/{v4-floating-consumer-policy.json → floating-consumer-policy.json} +0 -0
- /package/architecture/{v4-publication-facade-patches.json → publication-facade-patches.json} +0 -0
- /package/architecture/{v4-release-invocation-fixtures.json → release-invocation-fixtures.json} +0 -0
package/packages/core/{v4-delivery-warrant-read-candidate.js → delivery-warrant-read-candidate.js}
RENAMED
|
@@ -5,19 +5,19 @@ import {
|
|
|
5
5
|
observeDevDeliveryQueue,
|
|
6
6
|
} from "./dev-delivery-warrant.js";
|
|
7
7
|
import {
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
} from "./
|
|
13
|
-
import {
|
|
14
|
-
import {
|
|
8
|
+
domainCanonicalBytes,
|
|
9
|
+
domainContentRoot,
|
|
10
|
+
validateClock,
|
|
11
|
+
validateRoot,
|
|
12
|
+
} from "./canonical-contracts.js";
|
|
13
|
+
import { invokeRustShadowHost } from "./delivery-warrant-shadow-adapter.js";
|
|
14
|
+
import { DELIVERY_WARRANT_SEMANTIC_DIFF_REPORT_CONTRACT } from "./delivery-warrant-semantic-diff-gate.js";
|
|
15
15
|
|
|
16
|
-
export const
|
|
16
|
+
export const DELIVERY_WARRANT_READ_PROJECTION_CONTRACT =
|
|
17
17
|
"buildchain-v4-delivery-warrant-read-projection/v1";
|
|
18
|
-
export const
|
|
18
|
+
export const DELIVERY_WARRANT_READ_RESULT_CONTRACT =
|
|
19
19
|
"buildchain-v4-delivery-warrant-read-result/v1";
|
|
20
|
-
export const
|
|
20
|
+
export const DELIVERY_WARRANT_READ_EVIDENCE_CONTRACT =
|
|
21
21
|
"buildchain-v4-delivery-warrant-read-evidence/v1";
|
|
22
22
|
|
|
23
23
|
const HOST_REQUEST_CONTRACT = "kungfu-buildchain-v4-host-request";
|
|
@@ -33,16 +33,16 @@ const REQUIRED_CAPABILITIES = Object.freeze([
|
|
|
33
33
|
const REVISION = /^[0-9a-f]{40,64}$/u;
|
|
34
34
|
const MAX_TIMEOUT_MS = 30_000;
|
|
35
35
|
|
|
36
|
-
export class
|
|
36
|
+
export class DeliveryWarrantReadFault extends Error {
|
|
37
37
|
constructor(code, message) {
|
|
38
38
|
super(message);
|
|
39
|
-
this.name = "
|
|
39
|
+
this.name = "DeliveryWarrantReadFault";
|
|
40
40
|
this.code = code;
|
|
41
41
|
}
|
|
42
42
|
}
|
|
43
43
|
|
|
44
44
|
function fail(code, message) {
|
|
45
|
-
throw new
|
|
45
|
+
throw new DeliveryWarrantReadFault(code, message);
|
|
46
46
|
}
|
|
47
47
|
|
|
48
48
|
function validateSources(actual, expected) {
|
|
@@ -61,22 +61,22 @@ function validateSources(actual, expected) {
|
|
|
61
61
|
fail("qualification-source-drift", "qualification revisions are invalid");
|
|
62
62
|
}
|
|
63
63
|
|
|
64
|
-
export function
|
|
64
|
+
export function validateDeliveryWarrantReadQualification(
|
|
65
65
|
report,
|
|
66
66
|
{ expectedRoot, expectedSources, observedAt },
|
|
67
67
|
) {
|
|
68
|
-
|
|
69
|
-
|
|
68
|
+
validateRoot(expectedRoot, "$/expectedQualificationRoot");
|
|
69
|
+
validateClock(observedAt, "$/observedAt");
|
|
70
70
|
const body = structuredClone(report || {});
|
|
71
71
|
const reportedRoot = body.reportRoot;
|
|
72
72
|
delete body.reportRoot;
|
|
73
73
|
if (
|
|
74
74
|
reportedRoot !== expectedRoot ||
|
|
75
|
-
|
|
75
|
+
domainContentRoot("semantic-diff", body) !== expectedRoot
|
|
76
76
|
)
|
|
77
77
|
fail("qualification-root-drift", "semantic-diff report root drifted");
|
|
78
78
|
if (
|
|
79
|
-
report.schema !==
|
|
79
|
+
report.schema !== DELIVERY_WARRANT_SEMANTIC_DIFF_REPORT_CONTRACT ||
|
|
80
80
|
report.authority !== "typescript-v3" ||
|
|
81
81
|
report.rustAuthority !== "none" ||
|
|
82
82
|
report.rustEffects !== "disabled" ||
|
|
@@ -92,16 +92,16 @@ export function validateV4DeliveryWarrantReadQualification(
|
|
|
92
92
|
"qualification-not-eligible",
|
|
93
93
|
"semantic-diff report does not authorize a read-only candidate",
|
|
94
94
|
);
|
|
95
|
-
|
|
95
|
+
validateClock(report.retainUntil, "$/qualification/retainUntil");
|
|
96
96
|
if (Date.parse(report.retainUntil) <= Date.parse(observedAt))
|
|
97
97
|
fail("qualification-expired", "semantic-diff retention window expired");
|
|
98
98
|
validateSources(report.sources, expectedSources);
|
|
99
99
|
return report;
|
|
100
100
|
}
|
|
101
101
|
|
|
102
|
-
export function
|
|
102
|
+
export function projectBaselineQueueToReadState(queueInput) {
|
|
103
103
|
const queue = normalizeDevDeliveryQueue(queueInput, {
|
|
104
|
-
|
|
104
|
+
allowLegacyBaselineReadback: true,
|
|
105
105
|
});
|
|
106
106
|
return {
|
|
107
107
|
schema: STATE_CONTRACT,
|
|
@@ -137,7 +137,7 @@ export function projectV3QueueToV4ReadState(queueInput) {
|
|
|
137
137
|
};
|
|
138
138
|
}
|
|
139
139
|
|
|
140
|
-
export function
|
|
140
|
+
export function createDeliveryWarrantReadRequest(
|
|
141
141
|
state,
|
|
142
142
|
{ requestId = crypto.randomUUID(), timeoutMs = 5_000 } = {},
|
|
143
143
|
) {
|
|
@@ -155,7 +155,7 @@ export function createV4DeliveryWarrantReadRequest(
|
|
|
155
155
|
command: { id: "delivery-warrant.state-project", arguments: [] },
|
|
156
156
|
input: {
|
|
157
157
|
encoding: "base64",
|
|
158
|
-
bytes:
|
|
158
|
+
bytes: domainCanonicalBytes(state).toString("base64"),
|
|
159
159
|
},
|
|
160
160
|
requiredCapabilities: [...REQUIRED_CAPABILITIES],
|
|
161
161
|
timeoutMs,
|
|
@@ -184,22 +184,22 @@ function validateProjection(response, request, expectedState) {
|
|
|
184
184
|
fail("rust-projection-failed", "Rust read projection failed closed");
|
|
185
185
|
const projection = response.structuredResult;
|
|
186
186
|
if (
|
|
187
|
-
projection?.schema !==
|
|
187
|
+
projection?.schema !== DELIVERY_WARRANT_READ_PROJECTION_CONTRACT ||
|
|
188
188
|
!projection.stateRoot
|
|
189
189
|
)
|
|
190
190
|
fail("host-response-invalid", "Rust read projection shape is invalid");
|
|
191
|
-
|
|
191
|
+
validateRoot(projection.stateRoot, "$/projection/stateRoot");
|
|
192
192
|
if (
|
|
193
|
-
!
|
|
194
|
-
|
|
193
|
+
!domainCanonicalBytes(projection.state).equals(
|
|
194
|
+
domainCanonicalBytes(expectedState),
|
|
195
195
|
) ||
|
|
196
|
-
projection.stateRoot !==
|
|
196
|
+
projection.stateRoot !== domainContentRoot("queue-state", expectedState)
|
|
197
197
|
)
|
|
198
198
|
fail("projection-drift", "Rust read projection disagrees with v3 state");
|
|
199
199
|
return projection;
|
|
200
200
|
}
|
|
201
201
|
|
|
202
|
-
export async function
|
|
202
|
+
export async function runDeliveryWarrantReadCandidate(
|
|
203
203
|
queueInput,
|
|
204
204
|
{
|
|
205
205
|
qualification,
|
|
@@ -209,12 +209,12 @@ export async function runV4DeliveryWarrantReadCandidate(
|
|
|
209
209
|
requestId,
|
|
210
210
|
timeoutMs = 5_000,
|
|
211
211
|
signal,
|
|
212
|
-
invokeRust =
|
|
212
|
+
invokeRust = invokeRustShadowHost,
|
|
213
213
|
host = {},
|
|
214
214
|
retain,
|
|
215
215
|
} = {},
|
|
216
216
|
) {
|
|
217
|
-
|
|
217
|
+
validateDeliveryWarrantReadQualification(qualification, {
|
|
218
218
|
expectedRoot: expectedQualificationRoot,
|
|
219
219
|
expectedSources,
|
|
220
220
|
observedAt,
|
|
@@ -222,10 +222,10 @@ export async function runV4DeliveryWarrantReadCandidate(
|
|
|
222
222
|
if (typeof retain !== "function")
|
|
223
223
|
fail("retention-required", "v4 read evidence retention is required");
|
|
224
224
|
const queue = normalizeDevDeliveryQueue(queueInput, {
|
|
225
|
-
|
|
225
|
+
allowLegacyBaselineReadback: true,
|
|
226
226
|
});
|
|
227
|
-
const state =
|
|
228
|
-
const request =
|
|
227
|
+
const state = projectBaselineQueueToReadState(queue);
|
|
228
|
+
const request = createDeliveryWarrantReadRequest(state, {
|
|
229
229
|
requestId,
|
|
230
230
|
timeoutMs,
|
|
231
231
|
});
|
|
@@ -241,10 +241,10 @@ export async function runV4DeliveryWarrantReadCandidate(
|
|
|
241
241
|
const projection = validateProjection(response, request, state);
|
|
242
242
|
const observation = observeDevDeliveryQueue(queue, {
|
|
243
243
|
now: observedAt,
|
|
244
|
-
|
|
244
|
+
allowLegacyBaselineReadback: true,
|
|
245
245
|
});
|
|
246
246
|
const evidence = {
|
|
247
|
-
schema:
|
|
247
|
+
schema: DELIVERY_WARRANT_READ_EVIDENCE_CONTRACT,
|
|
248
248
|
authority: "typescript-v3",
|
|
249
249
|
writerAuthority: "typescript-v3",
|
|
250
250
|
rustAuthority: "read-only",
|
|
@@ -254,21 +254,21 @@ export async function runV4DeliveryWarrantReadCandidate(
|
|
|
254
254
|
qualificationRoot: expectedQualificationRoot,
|
|
255
255
|
legacyStateRoot: queue.stateRoot,
|
|
256
256
|
v4StateRoot: projection.stateRoot,
|
|
257
|
-
observationRoot:
|
|
257
|
+
observationRoot: domainContentRoot("observation", observation),
|
|
258
258
|
parity: "matched",
|
|
259
259
|
};
|
|
260
|
-
const evidenceRoot =
|
|
260
|
+
const evidenceRoot = domainContentRoot("observation", evidence);
|
|
261
261
|
let retentionReceipt;
|
|
262
262
|
try {
|
|
263
263
|
retentionReceipt = await retain(
|
|
264
264
|
structuredClone({ ...evidence, evidenceRoot }),
|
|
265
265
|
);
|
|
266
|
-
|
|
266
|
+
validateRoot(retentionReceipt?.receiptRoot, "$/retention/receiptRoot");
|
|
267
267
|
} catch {
|
|
268
268
|
fail("retention-failed", "v4 read evidence retention failed");
|
|
269
269
|
}
|
|
270
270
|
return {
|
|
271
|
-
schema:
|
|
271
|
+
schema: DELIVERY_WARRANT_READ_RESULT_CONTRACT,
|
|
272
272
|
mode: "v4-read",
|
|
273
273
|
authority: "typescript-v3",
|
|
274
274
|
writerAuthority: "typescript-v3",
|
|
@@ -1,42 +1,41 @@
|
|
|
1
1
|
import crypto from "node:crypto";
|
|
2
2
|
|
|
3
3
|
import {
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
} from "./
|
|
4
|
+
domainContentRoot,
|
|
5
|
+
validateClock,
|
|
6
|
+
validateRoot,
|
|
7
|
+
} from "./canonical-contracts.js";
|
|
8
8
|
import {
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
} from "./
|
|
9
|
+
DELIVERY_WARRANT_PROJECTION_CONTRACT,
|
|
10
|
+
DELIVERY_WARRANT_RUNNER_CONTRACT,
|
|
11
|
+
DELIVERY_WARRANT_TRACE_CONTRACT,
|
|
12
|
+
} from "./delivery-warrant-fixture-runner.js";
|
|
13
13
|
import {
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
} from "./
|
|
14
|
+
DELIVERY_WARRANT_SHADOW_OBSERVATION_CONTRACT,
|
|
15
|
+
runDeliveryWarrantShadow,
|
|
16
|
+
} from "./delivery-warrant-shadow-adapter.js";
|
|
17
17
|
|
|
18
|
-
export const
|
|
18
|
+
export const DELIVERY_WARRANT_SEMANTIC_DIFF_REPORT_CONTRACT =
|
|
19
19
|
"buildchain-v4-delivery-warrant-semantic-diff-report/v1";
|
|
20
|
-
export const
|
|
20
|
+
export const DELIVERY_WARRANT_SEMANTIC_DIFF_VALIDATOR_VERSION =
|
|
21
21
|
"semantic-diff-gate-v1";
|
|
22
|
-
export const
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
]);
|
|
22
|
+
export const DELIVERY_WARRANT_SEMANTIC_DIFF_REQUIRED_COVERAGE = Object.freeze([
|
|
23
|
+
"cancellation",
|
|
24
|
+
"cas",
|
|
25
|
+
"conflict",
|
|
26
|
+
"duplicate",
|
|
27
|
+
"golden",
|
|
28
|
+
"lease-fence",
|
|
29
|
+
"property",
|
|
30
|
+
"replay",
|
|
31
|
+
"response-loss",
|
|
32
|
+
]);
|
|
34
33
|
|
|
35
34
|
const REVISION = /^[0-9a-f]{40,64}$/u;
|
|
36
35
|
const TOKEN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
|
|
37
36
|
const stop = (code) => ({ code, retry: "stop" });
|
|
38
37
|
const valueRoot = (value) =>
|
|
39
|
-
value === undefined ? null :
|
|
38
|
+
value === undefined ? null : domainContentRoot("semantic-diff", { value });
|
|
40
39
|
|
|
41
40
|
function difference(path, kind, legacy, rust) {
|
|
42
41
|
const summary = {
|
|
@@ -47,11 +46,11 @@ function difference(path, kind, legacy, rust) {
|
|
|
47
46
|
};
|
|
48
47
|
return {
|
|
49
48
|
...summary,
|
|
50
|
-
differenceRoot:
|
|
49
|
+
differenceRoot: domainContentRoot("semantic-diff", summary),
|
|
51
50
|
};
|
|
52
51
|
}
|
|
53
52
|
|
|
54
|
-
export function
|
|
53
|
+
export function compareDeliveryWarrantSemantics(legacy, rust, path = "$") {
|
|
55
54
|
if (Object.is(legacy, rust)) return [];
|
|
56
55
|
if (legacy === undefined)
|
|
57
56
|
return [difference(path, "missing-legacy", legacy, rust)];
|
|
@@ -69,12 +68,12 @@ export function compareV4DeliveryWarrantSemantics(legacy, rust, path = "$") {
|
|
|
69
68
|
? Array.from({ length: Math.max(legacy.length, rust.length) }, (_, i) => i)
|
|
70
69
|
: [...new Set([...Object.keys(legacy), ...Object.keys(rust)])].sort();
|
|
71
70
|
return keys.flatMap((key) =>
|
|
72
|
-
|
|
71
|
+
compareDeliveryWarrantSemantics(legacy[key], rust[key], `${path}/${key}`),
|
|
73
72
|
);
|
|
74
73
|
}
|
|
75
74
|
|
|
76
|
-
export function
|
|
77
|
-
return
|
|
75
|
+
export function deliveryWarrantDispositionRoot(value) {
|
|
76
|
+
return domainContentRoot("semantic-diff", {
|
|
78
77
|
differenceRoot: value.differenceRoot,
|
|
79
78
|
disposition: value.disposition,
|
|
80
79
|
reasonCode: value.reasonCode,
|
|
@@ -85,13 +84,13 @@ export function v4DeliveryWarrantDispositionRoot(value) {
|
|
|
85
84
|
function dispositions(values = []) {
|
|
86
85
|
return new Map(
|
|
87
86
|
values.map((value) => {
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
87
|
+
validateRoot(value.differenceRoot);
|
|
88
|
+
validateRoot(value.reviewRoot);
|
|
89
|
+
validateRoot(value.dispositionRoot);
|
|
91
90
|
if (
|
|
92
91
|
value.disposition !== "reviewed-exclusion" ||
|
|
93
92
|
!TOKEN.test(value.reasonCode) ||
|
|
94
|
-
value.dispositionRoot !==
|
|
93
|
+
value.dispositionRoot !== deliveryWarrantDispositionRoot(value)
|
|
95
94
|
)
|
|
96
95
|
throw new TypeError(
|
|
97
96
|
"semantic difference disposition is not review-rooted",
|
|
@@ -145,7 +144,7 @@ async function projectCase(definition, options, dispositionIndex) {
|
|
|
145
144
|
blockers.push(stop("missing-observation"));
|
|
146
145
|
if (
|
|
147
146
|
observation &&
|
|
148
|
-
(observation.schema !==
|
|
147
|
+
(observation.schema !== DELIVERY_WARRANT_SHADOW_OBSERVATION_CONTRACT ||
|
|
149
148
|
observation.authority !== "typescript-v3" ||
|
|
150
149
|
observation.rustAuthority !== "none" ||
|
|
151
150
|
observation.rustEffects !== "disabled")
|
|
@@ -171,7 +170,7 @@ async function projectCase(definition, options, dispositionIndex) {
|
|
|
171
170
|
const rust = observation?.rust?.projection;
|
|
172
171
|
const differences = classify(
|
|
173
172
|
rust
|
|
174
|
-
?
|
|
173
|
+
? compareDeliveryWarrantSemantics(result.authoritativeResult, rust)
|
|
175
174
|
: [],
|
|
176
175
|
dispositionIndex,
|
|
177
176
|
);
|
|
@@ -182,18 +181,18 @@ async function projectCase(definition, options, dispositionIndex) {
|
|
|
182
181
|
coverage: [...new Set(definition.coverage)].sort(),
|
|
183
182
|
inputRoot,
|
|
184
183
|
observationRoot: observation
|
|
185
|
-
?
|
|
184
|
+
? domainContentRoot("semantic-diff", observation)
|
|
186
185
|
: null,
|
|
187
186
|
legacyProjectionRoot: result.authoritativeResult?.projectionRoot || null,
|
|
188
187
|
rustProjectionRoot: rust?.projectionRoot || null,
|
|
189
188
|
differences,
|
|
190
|
-
differenceRoot:
|
|
189
|
+
differenceRoot: domainContentRoot("semantic-diff", differences),
|
|
191
190
|
blockers,
|
|
192
191
|
};
|
|
193
192
|
return {
|
|
194
193
|
report: {
|
|
195
194
|
...evidence,
|
|
196
|
-
evidenceRoot:
|
|
195
|
+
evidenceRoot: domainContentRoot("semantic-diff", evidence),
|
|
197
196
|
status: blockers.length ? "blocked" : "zero-unexplained-diff",
|
|
198
197
|
},
|
|
199
198
|
legacy: result.authoritativeResult,
|
|
@@ -220,7 +219,7 @@ function probeReceipts(probes, runtime) {
|
|
|
220
219
|
return probes.map((probe) => {
|
|
221
220
|
const target = runtime.get(probe.caseId);
|
|
222
221
|
const differences = target?.rust
|
|
223
|
-
?
|
|
222
|
+
? compareDeliveryWarrantSemantics(
|
|
224
223
|
target.legacy,
|
|
225
224
|
inject(target.rust, probe),
|
|
226
225
|
)
|
|
@@ -233,15 +232,15 @@ function probeReceipts(probes, runtime) {
|
|
|
233
232
|
detected: differences.length > 0,
|
|
234
233
|
differenceRoots: differences.map((entry) => entry.differenceRoot).sort(),
|
|
235
234
|
};
|
|
236
|
-
return {
|
|
235
|
+
return {
|
|
236
|
+
...receipt,
|
|
237
|
+
receiptRoot: domainContentRoot("semantic-diff", receipt),
|
|
238
|
+
};
|
|
237
239
|
});
|
|
238
240
|
}
|
|
239
241
|
|
|
240
|
-
export async function
|
|
241
|
-
|
|
242
|
-
options = {},
|
|
243
|
-
) {
|
|
244
|
-
validateV4Clock(options.recordedAt);
|
|
242
|
+
export async function runDeliveryWarrantSemanticDiffGate(cases, options = {}) {
|
|
243
|
+
validateClock(options.recordedAt);
|
|
245
244
|
if (!Array.isArray(cases) || cases.length < 1 || cases.length > 64)
|
|
246
245
|
throw new RangeError("semantic diff cases must contain 1-64 entries");
|
|
247
246
|
if (
|
|
@@ -251,7 +250,7 @@ export async function runV4DeliveryWarrantSemanticDiffGate(
|
|
|
251
250
|
)
|
|
252
251
|
throw new TypeError("semantic diff source binding is invalid");
|
|
253
252
|
for (const key of ["traceSchemaRoot", "reportSchemaRoot", "runnerRoot"])
|
|
254
|
-
|
|
253
|
+
validateRoot(options.contracts?.[key]);
|
|
255
254
|
const index = dispositions(options.dispositions);
|
|
256
255
|
const projected = [];
|
|
257
256
|
for (const entry of cases)
|
|
@@ -260,7 +259,7 @@ export async function runV4DeliveryWarrantSemanticDiffGate(
|
|
|
260
259
|
entry,
|
|
261
260
|
{
|
|
262
261
|
...options,
|
|
263
|
-
runShadow: options.runShadow ||
|
|
262
|
+
runShadow: options.runShadow || runDeliveryWarrantShadow,
|
|
264
263
|
},
|
|
265
264
|
index,
|
|
266
265
|
),
|
|
@@ -268,7 +267,7 @@ export async function runV4DeliveryWarrantSemanticDiffGate(
|
|
|
268
267
|
const runtime = new Map(projected.map((entry, i) => [cases[i].id, entry]));
|
|
269
268
|
const receipts = probeReceipts(options.faultProbes, runtime);
|
|
270
269
|
const coverage = new Set(cases.flatMap((entry) => entry.coverage));
|
|
271
|
-
const missing =
|
|
270
|
+
const missing = DELIVERY_WARRANT_SEMANTIC_DIFF_REQUIRED_COVERAGE.filter(
|
|
272
271
|
(entry) => !coverage.has(entry),
|
|
273
272
|
);
|
|
274
273
|
const blockers = projected.flatMap((entry) => entry.report.blockers);
|
|
@@ -276,7 +275,7 @@ export async function runV4DeliveryWarrantSemanticDiffGate(
|
|
|
276
275
|
if (receipts.some((entry) => !entry.detected))
|
|
277
276
|
blockers.push(stop("fault-injection-undetected"));
|
|
278
277
|
const body = {
|
|
279
|
-
schema:
|
|
278
|
+
schema: DELIVERY_WARRANT_SEMANTIC_DIFF_REPORT_CONTRACT,
|
|
280
279
|
authority: "typescript-v3",
|
|
281
280
|
rustAuthority: "none",
|
|
282
281
|
rustEffects: "disabled",
|
|
@@ -286,14 +285,14 @@ export async function runV4DeliveryWarrantSemanticDiffGate(
|
|
|
286
285
|
).toISOString(),
|
|
287
286
|
sources: options.sources,
|
|
288
287
|
contracts: {
|
|
289
|
-
trace:
|
|
290
|
-
projection:
|
|
291
|
-
observation:
|
|
292
|
-
runner:
|
|
288
|
+
trace: DELIVERY_WARRANT_TRACE_CONTRACT,
|
|
289
|
+
projection: DELIVERY_WARRANT_PROJECTION_CONTRACT,
|
|
290
|
+
observation: DELIVERY_WARRANT_SHADOW_OBSERVATION_CONTRACT,
|
|
291
|
+
runner: DELIVERY_WARRANT_RUNNER_CONTRACT,
|
|
293
292
|
...options.contracts,
|
|
294
293
|
},
|
|
295
294
|
coverage: {
|
|
296
|
-
required: [...
|
|
295
|
+
required: [...DELIVERY_WARRANT_SEMANTIC_DIFF_REQUIRED_COVERAGE],
|
|
297
296
|
observed: [...coverage].sort(),
|
|
298
297
|
missing,
|
|
299
298
|
},
|
|
@@ -316,12 +315,12 @@ export async function runV4DeliveryWarrantSemanticDiffGate(
|
|
|
316
315
|
};
|
|
317
316
|
let retention = {
|
|
318
317
|
status: "failed",
|
|
319
|
-
evidenceRoot:
|
|
318
|
+
evidenceRoot: domainContentRoot("semantic-diff", body),
|
|
320
319
|
receiptRoot: null,
|
|
321
320
|
};
|
|
322
321
|
try {
|
|
323
322
|
const receipt = await options.retain?.(structuredClone(body));
|
|
324
|
-
|
|
323
|
+
validateRoot(receipt?.receiptRoot);
|
|
325
324
|
retention = {
|
|
326
325
|
...retention,
|
|
327
326
|
status: "retained",
|
|
@@ -348,5 +347,5 @@ export async function runV4DeliveryWarrantSemanticDiffGate(
|
|
|
348
347
|
v4WriteAuthorized: false,
|
|
349
348
|
},
|
|
350
349
|
};
|
|
351
|
-
return { ...report, reportRoot:
|
|
350
|
+
return { ...report, reportRoot: domainContentRoot("semantic-diff", report) };
|
|
352
351
|
}
|
package/packages/core/{v4-delivery-warrant-shadow-adapter.js → delivery-warrant-shadow-adapter.js}
RENAMED
|
@@ -3,11 +3,11 @@ import crypto from "node:crypto";
|
|
|
3
3
|
import path from "node:path";
|
|
4
4
|
import { fileURLToPath } from "node:url";
|
|
5
5
|
|
|
6
|
-
import {
|
|
6
|
+
import { runDeliveryWarrantTraceFixture } from "./delivery-warrant-fixture-runner.js";
|
|
7
7
|
|
|
8
|
-
export const
|
|
8
|
+
export const DELIVERY_WARRANT_SHADOW_OBSERVATION_CONTRACT =
|
|
9
9
|
"buildchain-v4-delivery-warrant-shadow-observation/v1";
|
|
10
|
-
export const
|
|
10
|
+
export const DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT =
|
|
11
11
|
"buildchain-v4-delivery-warrant-shadow-result/v1";
|
|
12
12
|
|
|
13
13
|
const HOST_REQUEST_CONTRACT = "kungfu-buildchain-v4-host-request";
|
|
@@ -117,7 +117,7 @@ function retainUntil(recordedAt) {
|
|
|
117
117
|
return new Date(time + RETENTION_DAYS * 24 * 60 * 60 * 1000).toISOString();
|
|
118
118
|
}
|
|
119
119
|
|
|
120
|
-
export function
|
|
120
|
+
export function createDeliveryWarrantShadowRequest(
|
|
121
121
|
bytes,
|
|
122
122
|
{ requestId = crypto.randomUUID(), timeoutMs = 5_000 } = {},
|
|
123
123
|
) {
|
|
@@ -203,14 +203,14 @@ function defaultHost() {
|
|
|
203
203
|
"--locked",
|
|
204
204
|
"--quiet",
|
|
205
205
|
"--manifest-path",
|
|
206
|
-
path.join(root, "crates", "buildchain-
|
|
206
|
+
path.join(root, "crates", "buildchain-domain-contracts", "Cargo.toml"),
|
|
207
207
|
"--",
|
|
208
208
|
"host",
|
|
209
209
|
],
|
|
210
210
|
};
|
|
211
211
|
}
|
|
212
212
|
|
|
213
|
-
export function
|
|
213
|
+
export function invokeRustShadowHost(
|
|
214
214
|
request,
|
|
215
215
|
{ command, arguments: commandArguments, cwd = root, signal } = {},
|
|
216
216
|
) {
|
|
@@ -322,12 +322,12 @@ function skippedShadow(inputRoot, code) {
|
|
|
322
322
|
};
|
|
323
323
|
}
|
|
324
324
|
|
|
325
|
-
export async function
|
|
325
|
+
export async function runDeliveryWarrantShadow(
|
|
326
326
|
value,
|
|
327
327
|
{
|
|
328
328
|
enabled = enabledByDefault(),
|
|
329
|
-
invokeLegacy =
|
|
330
|
-
invokeRust =
|
|
329
|
+
invokeLegacy = runDeliveryWarrantTraceFixture,
|
|
330
|
+
invokeRust = invokeRustShadowHost,
|
|
331
331
|
host = {},
|
|
332
332
|
requestId,
|
|
333
333
|
timeoutMs = 5_000,
|
|
@@ -343,7 +343,7 @@ export async function runV4DeliveryWarrantShadow(
|
|
|
343
343
|
const inputRoot = sha256(bytes);
|
|
344
344
|
if (!enabled) {
|
|
345
345
|
return {
|
|
346
|
-
schema:
|
|
346
|
+
schema: DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
|
|
347
347
|
authoritativeResult,
|
|
348
348
|
shadow: skippedShadow(inputRoot, "shadow-disabled"),
|
|
349
349
|
};
|
|
@@ -354,7 +354,7 @@ export async function runV4DeliveryWarrantShadow(
|
|
|
354
354
|
retentionScope = publicRetention(retention);
|
|
355
355
|
} catch (error) {
|
|
356
356
|
return {
|
|
357
|
-
schema:
|
|
357
|
+
schema: DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
|
|
358
358
|
authoritativeResult,
|
|
359
359
|
shadow: skippedShadow(inputRoot, error.code || "input-not-public-safe"),
|
|
360
360
|
};
|
|
@@ -371,13 +371,13 @@ export async function runV4DeliveryWarrantShadow(
|
|
|
371
371
|
rustRevision: exactSource(sources.rustRevision, "rustRevision"),
|
|
372
372
|
validatorVersion: exactValidator(sources.validatorVersion),
|
|
373
373
|
};
|
|
374
|
-
request =
|
|
374
|
+
request = createDeliveryWarrantShadowRequest(bytes, {
|
|
375
375
|
requestId,
|
|
376
376
|
timeoutMs,
|
|
377
377
|
});
|
|
378
378
|
} catch {
|
|
379
379
|
return {
|
|
380
|
-
schema:
|
|
380
|
+
schema: DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
|
|
381
381
|
authoritativeResult,
|
|
382
382
|
shadow: skippedShadow(inputRoot, "shadow-config-invalid"),
|
|
383
383
|
};
|
|
@@ -396,7 +396,7 @@ export async function runV4DeliveryWarrantShadow(
|
|
|
396
396
|
}
|
|
397
397
|
|
|
398
398
|
const observation = {
|
|
399
|
-
schema:
|
|
399
|
+
schema: DELIVERY_WARRANT_SHADOW_OBSERVATION_CONTRACT,
|
|
400
400
|
authority: "typescript-v3",
|
|
401
401
|
rustAuthority: "none",
|
|
402
402
|
rustEffects: "disabled",
|
|
@@ -431,7 +431,7 @@ export async function runV4DeliveryWarrantShadow(
|
|
|
431
431
|
}
|
|
432
432
|
}
|
|
433
433
|
return {
|
|
434
|
-
schema:
|
|
434
|
+
schema: DELIVERY_WARRANT_SHADOW_RESULT_CONTRACT,
|
|
435
435
|
authoritativeResult,
|
|
436
436
|
shadow: {
|
|
437
437
|
status,
|
|
@@ -37,10 +37,10 @@ const FAILURE_FILES = [
|
|
|
37
37
|
"warrant.json",
|
|
38
38
|
];
|
|
39
39
|
|
|
40
|
-
const
|
|
40
|
+
const DOMAIN_RUNTIME_SELECTOR =
|
|
41
41
|
/^(?:[0-9a-f]{40}|v4|v4-alpha|train\/v4\/v4\.0\/[a-z0-9][a-z0-9._-]*)$/u;
|
|
42
42
|
|
|
43
|
-
const
|
|
43
|
+
const RUNTIME_SELECTOR_DESCRIPTION =
|
|
44
44
|
"runtime selector must be an exact immutable SHA, v4, v4-alpha, or train/v4/v4.0/<capability>";
|
|
45
45
|
|
|
46
46
|
function requiredFiles(outcome) {
|
|
@@ -165,8 +165,8 @@ function runtimeBinding(input = {}) {
|
|
|
165
165
|
resolvedSha: exactSha(input.resolvedSha, "resolved runtime SHA"),
|
|
166
166
|
selectionRoot: exactRoot(input.selectionRoot, "runtime selection root"),
|
|
167
167
|
};
|
|
168
|
-
if (!
|
|
169
|
-
throw new Error(
|
|
168
|
+
if (!DOMAIN_RUNTIME_SELECTOR.test(runtime.selector)) {
|
|
169
|
+
throw new Error(RUNTIME_SELECTOR_DESCRIPTION);
|
|
170
170
|
}
|
|
171
171
|
return runtime;
|
|
172
172
|
}
|
|
@@ -207,8 +207,8 @@ function verifiedRuntimeSelection(directory, expected = {}) {
|
|
|
207
207
|
if (JSON.stringify(selection) !== JSON.stringify(normalized)) {
|
|
208
208
|
throw new Error("runtime selection is not exact canonical content");
|
|
209
209
|
}
|
|
210
|
-
if (!
|
|
211
|
-
throw new Error(
|
|
210
|
+
if (!DOMAIN_RUNTIME_SELECTOR.test(normalized.selector)) {
|
|
211
|
+
throw new Error(RUNTIME_SELECTOR_DESCRIPTION);
|
|
212
212
|
}
|
|
213
213
|
const selectionRoot = sha256Bytes(
|
|
214
214
|
Buffer.from(`${JSON.stringify(normalized, null, 2)}\n`),
|
|
@@ -30,7 +30,7 @@ export {
|
|
|
30
30
|
};
|
|
31
31
|
export const NATIVE_QUALIFICATION_PROOF_SCHEMA =
|
|
32
32
|
"kungfu.buildchain.native-qualification-proof/v4";
|
|
33
|
-
const
|
|
33
|
+
const LEGACY_NATIVE_QUALIFICATION_PROOF_BASELINE_SCHEMA =
|
|
34
34
|
"kungfu.buildchain.native-qualification-proof/v3";
|
|
35
35
|
const LEGACY_NATIVE_QUALIFICATION_PROOF_V2_SCHEMA =
|
|
36
36
|
"kungfu.buildchain.native-qualification-proof/v2";
|
|
@@ -44,9 +44,13 @@ export const NATIVE_PROOF_BASE_DELTA_SCHEMA =
|
|
|
44
44
|
"kungfu.buildchain.native-proof-base-delta/v1";
|
|
45
45
|
const NATIVE_QUALIFICATION_ROOT_SEMANTICS = "semantic-native-identity-v1";
|
|
46
46
|
|
|
47
|
-
function normalizeQualifiedWarrant(
|
|
48
|
-
|
|
49
|
-
|
|
47
|
+
function normalizeQualifiedWarrant(
|
|
48
|
+
warrant,
|
|
49
|
+
candidate,
|
|
50
|
+
allowLegacyBaselineReadback,
|
|
51
|
+
) {
|
|
52
|
+
const qualifiedBaselineReadback =
|
|
53
|
+
allowLegacyBaselineReadback &&
|
|
50
54
|
!warrant.nativeCommandContract &&
|
|
51
55
|
!candidate.nativeCommandContract &&
|
|
52
56
|
!warrant.nativeExecutionReceiptRoot &&
|
|
@@ -59,7 +63,7 @@ function normalizeQualifiedWarrant(warrant, candidate, allowLegacyV3Readback) {
|
|
|
59
63
|
warrant.nativeProofReuseRoot,
|
|
60
64
|
"Warrant nativeProofReuseRoot",
|
|
61
65
|
);
|
|
62
|
-
if (!
|
|
66
|
+
if (!qualifiedBaselineReadback) {
|
|
63
67
|
warrant.nativeExecutionReceiptRoot = exactRoot(
|
|
64
68
|
warrant.nativeExecutionReceiptRoot,
|
|
65
69
|
"Warrant nativeExecutionReceiptRoot",
|
|
@@ -74,7 +78,7 @@ function normalizeQualifiedWarrant(warrant, candidate, allowLegacyV3Readback) {
|
|
|
74
78
|
|
|
75
79
|
export function validateActiveDevDeliveryWarrant(
|
|
76
80
|
queue,
|
|
77
|
-
{
|
|
81
|
+
{ allowLegacyBaselineReadback = false } = {},
|
|
78
82
|
) {
|
|
79
83
|
const warrant = queue.activeWarrant;
|
|
80
84
|
if (warrant.schema !== "kungfu.buildchain.dev-delivery-warrant/v1")
|
|
@@ -110,7 +114,7 @@ export function validateActiveDevDeliveryWarrant(
|
|
|
110
114
|
"exactly one active candidate must match the active Warrant",
|
|
111
115
|
);
|
|
112
116
|
if (warrant.phase === "qualified") {
|
|
113
|
-
normalizeQualifiedWarrant(warrant, active[0],
|
|
117
|
+
normalizeQualifiedWarrant(warrant, active[0], allowLegacyBaselineReadback);
|
|
114
118
|
} else if (
|
|
115
119
|
warrant.phase === "provisional" &&
|
|
116
120
|
(warrant.nativeProofRoot ||
|
|
@@ -288,7 +292,7 @@ export function verifyNativeQualificationProof(proofInput, expected = {}) {
|
|
|
288
292
|
if (
|
|
289
293
|
![
|
|
290
294
|
NATIVE_QUALIFICATION_PROOF_SCHEMA,
|
|
291
|
-
|
|
295
|
+
LEGACY_NATIVE_QUALIFICATION_PROOF_BASELINE_SCHEMA,
|
|
292
296
|
LEGACY_NATIVE_QUALIFICATION_PROOF_V2_SCHEMA,
|
|
293
297
|
LEGACY_NATIVE_QUALIFICATION_PROOF_SCHEMA,
|
|
294
298
|
].includes(proof.schema)
|