@kungfu-tech/buildchain 4.0.8 → 4.0.9-alpha.1

package/scripts/check-inventory.mjs

@@ -1,13 +1,13 @@
 import fs from "node:fs";
 import path from "node:path";
+import { parseWorkflowCallJobs } from "../packages/core/workflow-yaml-contract.js";
+import { execFileSync } from "node:child_process";
 import {
   assertPublicSurfaceReverseAudit,
   collectPublicSurfaceReverseAudit,
 } from "../packages/core/public-surface-audit.js";
-import { evaluateBuildchainContractLock } from "../packages/core/buildchain-contract.js";
+import { createBuildchainContractLock, evaluateBuildchainContractLock, finalizeBuildchainContractWorld } from "../packages/core/buildchain-contract.js";
 import {
-  canAdmitSelfDogfoodLockEvaluation,
-  contractForSelfDogfoodEvaluation,
   hasQualifiedSelfDogfoodBootstrapAuthority,
   resolveSelfDogfoodMajor,
 } from "../packages/core/self-dogfood-version.js";
@@ -161,6 +161,7 @@ const requiredPaths = [
   ".github/workflows/self-ops-patrol-weekly.yml",
   ".github/workflows/self-ops-patrol-monthly.yml",
   ".github/workflows/self-build-alpha-dogfood.yml",
+  ".github/workflows/self-build-stable-dogfood.yml",
   ".github/workflows/release-candidate-promote.yml",
   ".github/workflows/.release-candidate-promote.yml",
   ".github/workflows/release-propagation.yml",
@@ -196,16 +197,9 @@ if (rootPackage.name !== "@kungfu-tech/buildchain") {
 if (rootPackage.private !== false) {
   throw new Error("root package must be publishable with private=false");
 }
-const selfDogfoodWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/self-build-alpha-dogfood.yml"),
-  "utf8",
-);
 const selfDogfoodAlphaLock = JSON.parse(
   fs.readFileSync(path.join(root, ".buildchain/alpha-contract-lock.json"), "utf8"),
 );
-const currentBuildchainContract = JSON.parse(
-  fs.readFileSync(path.join(root, "dist/site/buildchain-contract.json"), "utf8"),
-);
 const selfDogfoodBootstrapAuthority = JSON.parse(
   fs.readFileSync(path.join(root, "architecture/bootstrap-authority.json"), "utf8"),
 );
@@ -227,34 +221,66 @@ if (!/^[0-9a-f]{40}$/.test(selfDogfoodAlphaLock.buildchain?.resolvedSha || ""))
 if (selfDogfoodAlphaLock.buildchain?.compatibilityPolicy !== "major-compatible") {
   throw new Error("Buildchain self-dogfood alpha lock must enforce major-compatible policy");
 }
-const selfDogfoodAlphaEvaluation = evaluateBuildchainContractLock({
-  lock: selfDogfoodAlphaLock,
-  current: contractForSelfDogfoodEvaluation({
-    currentContract: currentBuildchainContract,
-    majorResolution: selfDogfoodMajorResolution,
-  }),
-  runtimeRef: `v${selfDogfoodMajor}-alpha`,
-  runtimeSha: "current-development-contract",
-  runtimeClass: "alpha", workflowShellRef: `v${selfDogfoodMajor}-alpha`,
-});
-if (
-  !canAdmitSelfDogfoodLockEvaluation({
-    evaluation: selfDogfoodAlphaEvaluation,
-    majorResolution: selfDogfoodMajorResolution,
-  })
-) {
-  throw new Error("Buildchain self-dogfood alpha lock requires review after a breaking contract change");
-}
-for (const requiredSnippet of [
-  `/.github/workflows/build.yml@v${selfDogfoodMajor}-alpha`,
-  "buildchain-channel: auto",
-  "buildchain-channel: stable",
-  `const alphaRef = "v${selfDogfoodMajor}-alpha"`,
-  `const stableRef = "v${selfDogfoodMajor}"`,
-]) {
-  if (!selfDogfoodWorkflow.includes(requiredSnippet)) {
-    throw new Error(`Buildchain self-dogfood workflow missing current-major snippet: ${requiredSnippet}`);
-  }
+// Consumer locks describe accepted published runtimes, not this unpublished producer.
+// Validate their immutable source worlds here; hosted admission checks floating drift.
+for (const channel of ["alpha-contract-lock.json", "contract-lock.json"]) {
+  const lock = JSON.parse(
+    fs.readFileSync(path.join(root, ".buildchain", channel), "utf8"),
+  );
+  const sha = lock.buildchain?.resolvedSha;
+  if (!/^[0-9a-f]{40}$/u.test(sha || ""))
+    throw new Error(`${channel}: invalid accepted SHA`);
+  let world;
+  try {
+    world = JSON.parse(
+      execFileSync(
+        "git",
+        ["show", `${sha}:dist/site/buildchain-contract.json`],
+        { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] },
+      ),
+    );
+  } catch {
+    const response = await fetch(
+      `https://raw.githubusercontent.com/kungfu-systems/buildchain/${sha}/dist/site/buildchain-contract.json`,
+      { signal: AbortSignal.timeout(30000) },
+    );
+    if (!response.ok)
+      throw new Error(
+        `${channel}: accepted source contract unavailable (${response.status})`,
+      );
+    world = await response.json();
+  }
+  const verified = finalizeBuildchainContractWorld(world);
+  for (const field of ["contractDigest", "compatibilityDigest"]) {
+    if (
+      world[field] !== verified[field] ||
+      lock.buildchain[field] !== world[field]
+    )
+      throw new Error(`${channel}: accepted ${field} mismatch`);
+  }
+  const accepted = createBuildchainContractLock({ contractWorld: verified }).buildchain;
+  if (JSON.stringify(lock.buildchain.surfaces) !== JSON.stringify(accepted.surfaces) || lock.buildchain.majorLine !== verified.majorLine || lock.buildchain.compatibilityPolicy !== "major-compatible") throw new Error(`${channel}: accepted surface set or policy mismatch`);
+  const ref = channel.startsWith("alpha")
+    ? `v${selfDogfoodMajor}-alpha`
+    : `v${selfDogfoodMajor}`;
+  const evaluation = evaluateBuildchainContractLock({
+    lock,
+    current: verified,
+    runtimeRef: ref,
+    runtimeSha: sha,
+    runtimeClass: channel.startsWith("alpha") ? "alpha" : "stable",
+    workflowShellRef: ref,
+  });
+  if (!evaluation.ok || lock.buildchain.ref !== ref)
+    throw new Error(`${channel}: invalid accepted runtime contract`);
+}
+for (const [channel, ref] of [["alpha", `v${selfDogfoodMajor}-alpha`], ["stable", `v${selfDogfoodMajor}`]]) {
+  const workflow = fs.readFileSync(path.join(root, `.github/workflows/self-build-${channel}-dogfood.yml`), "utf8");
+  if (!workflow.includes(`/.github/workflows/build.yml@${ref}`) || /steps:|buildchain-channel:|runner-preset:|working-directory:/u.test(workflow)) throw new Error(`${channel} self-dogfood must remain a thin public TOML build caller`);
+  if (!workflow.includes(`group: buildchain-${channel}-self-dogfood-`) || !workflow.includes("cancel-in-progress: false")) throw new Error(`${channel} self-dogfood must serialize its own runs`);
+  const expectedInputs = channel === "alpha" ? [] : ["config-path"];
+  const call = parseWorkflowCallJobs(workflow).find((job) => job.id === `${channel}-consumer`);
+  if (JSON.stringify(Object.keys(call.with || {})) !== JSON.stringify(expectedInputs)) throw new Error(`${channel} self-dogfood input contract drift`);
 }
 const reusableBuildWorkflow = fs.readFileSync(
   path.join(root, ".github/workflows/.build.yml"),
@@ -262,8 +288,8 @@ const reusableBuildWorkflow = fs.readFileSync(
 );
 for (const requiredSnippet of [
   "BUILDCHAIN_WORKFLOW_REF: ${{ job.workflow_ref }}",
-  "process.env.BUILDCHAIN_WORKFLOW_REF || process.env.GITHUB_WORKFLOW_REF",
-  'replace(/^refs\\/(?:heads|tags)\\//, "")',
+  "BUILDCHAIN_WORKFLOW_SHA: ${{ job.workflow_sha }}",
+  "Resolve rooted build plan from TOML",
 ]) {
   if (!reusableBuildWorkflow.includes(requiredSnippet)) {
     throw new Error(`reusable build workflow missing called-workflow identity: ${requiredSnippet}`);
@@ -343,31 +369,13 @@ const promotionOverrideAuthorization = fs.readFileSync(
 if (!promotionOverrideAuthorization.includes("promotion runtime override is only allowed for trusted workflow_dispatch runs")) {
   throw new Error("promotion runtime override authorization must remain fail closed");
 }
-for (const requiredSnippet of [
-  "buildchain-channel:",
-  "uses: ./.github/workflows/.build.yml",
-  "needs.resolve-channel.outputs.runtime-override != 'true' && needs.resolve-channel.outputs.channel == 'alpha'",
-  "needs.resolve-channel.outputs.runtime-override != 'true' && needs.resolve-channel.outputs.channel == 'stable'",
-  "needs.resolve-channel.outputs.buildchain-ref",
-  "needs.resolve-channel.outputs.contract-lock-path",
-]) {
-  if (!channelBuildWorkflow.includes(requiredSnippet)) {
-    throw new Error(`channel build workflow missing routing contract: ${requiredSnippet}`);
-  }
-}
-if ((channelBuildWorkflow.match(/uses: \.\/\.github\/workflows\/\.build\.yml/g) || []).length !== 3) {
-  throw new Error("channel build workflow must bind override, alpha, and stable to the exact caller workflow shell");
-}
-if (channelBuildWorkflow.includes("uses: kungfu-systems/buildchain/.github/workflows/.build.yml@")) {
-  throw new Error("channel build workflow must not statically fetch another channel shell before its ref exists");
+for (const workflow of [channelBuildWorkflow, reusableBuildWorkflow]) {
+  const block = workflow.split("    inputs:\n")[1].split("    secrets:\n")[0];
+  const names = [...block.matchAll(/^      ([a-z0-9-]+):$/gm)].map((match) => match[1]);
+  if (JSON.stringify(names) !== '["config-path"]') throw new Error("ordinary build inputs must contain only config-path");
 }
-for (const requiredSnippet of [
-  "group: buildchain-release-promotion-${{ github.repository }}",
-  "cancel-in-progress: false",
-]) {
-  if (!selfDogfoodWorkflow.includes(requiredSnippet)) {
-    throw new Error(`Buildchain self-dogfood workflow missing promotion serialization: ${requiredSnippet}`);
-  }
+if ((channelBuildWorkflow.match(/uses: \.\/\.github\/workflows\/\.build\.yml/g) || []).length !== 1) {
+  throw new Error("public build facade must invoke its exact backbone once");
 }
 const actionlintConfig = fs.readFileSync(
   path.join(root, ".github/actionlint.yaml"),
@@ -780,8 +788,9 @@ const registeredActionIds = (workflowRegistry.actions || []).map((entry) => entr
 const readmeActionIndex = fs.readFileSync(path.join(root, "README.md"), "utf8");
 const mapActionIndex = fs.readFileSync(path.join(root, "docs/MAP.md"), "utf8");
 const retrospectiveActionIndex = fs.readFileSync(path.join(root, ".github/retrospectives/2026-07-10-buildchain-consolidation.md"), "utf8");
-if (registeredActionIds.length !== 8) {
-  throw new Error(`workflow-registry.json must expose the eight current action entries, got ${registeredActionIds.length}`);
+const buildOwners = JSON.parse(fs.readFileSync(path.join(root, "architecture/build-orchestration.json"), "utf8")).owners;
+if (registeredActionIds.length !== 8 + Object.keys(buildOwners).length) {
+  throw new Error(`workflow-registry.json must expose the eight public actions and owned build composites, got ${registeredActionIds.length}`);
 }
 for (const actionId of registeredActionIds) {
   if (!readmeActionIndex.includes(`actions/${actionId}`) || !mapActionIndex.includes(`actions/${actionId}`)) {
@@ -925,16 +934,16 @@ for (const requiredSnippet of [
 }
 const reusableBuildSurfaceDoc = fs.readFileSync(path.join(root, "docs/reusable-build-surface.md"), "utf8");
 for (const requiredSnippet of [
-  "Floating Ref Contract Lock",
-  "dist/site/buildchain-contract.json",
-  "buildchain-contract-drift-issue-mode",
-  "compatible drift",
-  "Locked Source Checkout Cache",
-  "checkout-cache-mode",
-  "BUILDCHAIN_CHECKOUT_CACHE_MIRROR_URL_TEMPLATE",
-  "sourceCheckout",
-  "Shifu Cache Profile Passthrough",
-  "opaque reference and digest",
+  "config-path",
+  "buildchain.toml",
+  ".buildchain/contract-lock.json",
+  ".buildchain/alpha-contract-lock.json",
+  "architecture/build-environments.json",
+  "build.contract",
+  "cache roots",
+  "exact consumer source",
+  "build-lifecycle-stage",
+  "build-artifact-transfer",
 ]) {
   if (!reusableBuildSurfaceDoc.includes(requiredSnippet)) {
     throw new Error(`reusable build surface doc missing contract lock snippet: ${requiredSnippet}`);
@@ -1319,7 +1328,12 @@ if (!Array.isArray(inventory.migratedActions) || inventory.migratedActions.lengt
   throw new Error("migratedActions must be empty; buildchain v2 only ships native actions");
 }
 const shippedActions = internalActions;
-const shippedActionNames = shippedActions.map((action) => action.path.replace(/^actions\//, "")).sort();
+if (inventory.compositeActionOwnership !== "architecture/build-orchestration.json#owners") throw new Error("composite action ownership must use the build orchestration contract");
+const compositeNames = Object.keys(buildOwners).map((file) => {
+  if (!/^actions\/[^/]+\/action\.yml$/.test(file) || !/using:\s*composite/.test(fs.readFileSync(path.join(root, file), "utf8"))) throw new Error(`invalid owned composite action: ${file}`);
+  return path.posix.basename(path.posix.dirname(file));
+});
+const shippedActionNames = [...shippedActions.map((action) => action.path.replace(/^actions\//, "")), ...compositeNames].sort();
 
 if (JSON.stringify(actualActions) !== JSON.stringify(shippedActionNames)) {
   throw new Error(

package/scripts/check-maintainability.mjs

@@ -82,15 +82,30 @@ function revisionAvailable(root, revision) {
   }
 }
 
-function ensureRevisionAvailable(root, revision) {
+function ensureRevisionAvailable(
+  root,
+  revision,
+  {
+    fetchRevision = () =>
+      gitOutput(root, ["fetch", "--no-tags", "--depth=1", "origin", revision]),
+  } = {},
+) {
   if (revisionAvailable(root, revision)) return false;
-  try {
-    gitOutput(root, ["fetch", "--no-tags", "--depth=1", "origin", revision]);
-  } catch (error) {
-    const detail = String(error?.stderr || error?.message || error).trim();
-    throw new Error(
-      `maintainability revision ${revision} is unavailable and could not be fetched from origin${detail ? `: ${detail}` : ""}`,
-    );
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      fetchRevision();
+      break;
+    } catch (error) {
+      const detail = String(error?.stderr || error?.message || error).trim();
+      if (
+        attempt < 2 &&
+        /shallow file has changed since we read it/u.test(detail)
+      )
+        continue;
+      throw new Error(
+        `maintainability revision ${revision} is unavailable and could not be fetched from origin${detail ? `: ${detail}` : ""}`,
+      );
+    }
   }
   if (!revisionAvailable(root, revision)) {
     throw new Error(

package/scripts/check-universal-workflow-bootstrap.mjs

@@ -75,13 +75,23 @@ for (const relative of contract.retiredWorkflowSurfaces) {
 const activeWorkflows = contract.inventoryWorkflows.filter(
   (relative) =>
     !contract.retiredWorkflowSurfaces.includes(relative) &&
+    !contract.configurationGovernedWorkflows.includes(relative) &&
     relative !== contract.bootstrap.consumerRecoveryWorkflow,
 );
 assert.deepEqual(
   contract.bootstrapGovernedWorkflows,
   activeWorkflows,
-  "every active public reusable workflow must be Bootstrap-governed",
-);
+  "every active reusable workflow must have its declared configuration or Bootstrap authority",
+);
+assert.deepEqual(contract.configurationGovernedWorkflows, [
+  ".github/workflows/.build.yml", ".github/workflows/build.yml",
+]);
+for (const relative of contract.configurationGovernedWorkflows) {
+  const source = fs.readFileSync(path.join(root, relative), "utf8");
+  const inputBlock = source.split("    inputs:\n")[1].split("    secrets:\n")[0];
+  assert.deepEqual([...inputBlock.matchAll(/^      ([a-z0-9-]+):$/gmu)].map((match) => match[1]), ["config-path"]);
+  assert.doesNotMatch(source, /universal-request-json/u);
+}
 for (const relative of contract.bootstrapGovernedWorkflows) {
   assert.ok(
     contract.inventoryWorkflows.includes(relative),