@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/packages/core/dev-delivery/native/heartbeat.js

@@ -0,0 +1,137 @@
+import {
+  runDevDeliveryProviderHeartbeat,
+  verifyDevDeliveryProviderHeartbeat,
+} from "../dev-delivery-provider-heartbeat.js";
+import { runDevDeliveryCommand } from "../warrant/service.js";
+async function githubJson(apiUrl, token, requestPath, method = "GET") {
+  if (!token) throw new Error("provider heartbeat requires GitHub credentials");
+  const response = await fetch(
+    `${String(apiUrl).replace(/\/$/u, "")}${requestPath}`,
+    {
+      method,
+      headers: {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${token}`,
+        "x-github-api-version": "2022-11-28",
+      },
+    },
+  );
+  const bytes = await response.text();
+  const body = bytes ? JSON.parse(bytes) : {};
+  if (!response.ok) {
+    throw new Error(
+      `GitHub provider ${requestPath} failed with ${response.status}: ${body.message || "unknown error"}`,
+    );
+  }
+  return body;
+}
+
+function repositoryParts(value) {
+  const match = String(value || "").match(/^([^/\s]+)\/([^/\s]+)$/u);
+  if (!match) throw new Error("repository must be owner/repo");
+  return { owner: match[1], repo: match[2] };
+}
+
+export async function coordinateExactProviderAttemptAfterHeartbeatLoss(
+  { repository, workflowRunId, workflowRunAttempt },
+  { readRun },
+) {
+  const run = await readRun(workflowRunId);
+  if (
+    Number(run.id) !== workflowRunId ||
+    Number(run.run_attempt) !== workflowRunAttempt ||
+    run.repository?.full_name !== repository ||
+    run.status !== "in_progress"
+  ) {
+    throw new Error(
+      "heartbeat loss cannot coordinate a different provider attempt",
+    );
+  }
+  return {
+    action: "exact-attempt-heartbeat-loss-observed",
+    workflowRunId,
+    workflowRunAttempt,
+    cancellation: "withheld-run-scoped-api",
+    nextAction:
+      "Wait for terminal readback of this exact attempt; never cancel the run-scoped coordinate.",
+  };
+}
+
+export async function heartbeatDeliveryAttempt(options) {
+  const { owner, repo } = repositoryParts(options.repository);
+  return runDevDeliveryProviderHeartbeat(
+    {
+      admission: options.admission,
+      workflowRunId: options.workflowRunId,
+      workflowRunAttempt: options.workflowRunAttempt,
+      leaseSeconds: options.leaseSeconds,
+      heartbeatSeconds: options.heartbeatSeconds,
+    },
+    {
+      heartbeat: ({
+        expectedOldStateRoot,
+        fencingToken,
+        leaseGeneration,
+        leaseSeconds,
+      }) =>
+        runDevDeliveryCommand({
+          command: "heartbeat",
+          repository: options.repository,
+          branch: options.branch,
+          expectedOldStateRoot,
+          fencingToken,
+          leaseGeneration,
+          leaseSeconds,
+          execute: true,
+          token: options.token,
+          apiUrl: options.apiUrl,
+        }),
+      readJobs: () =>
+        githubJson(
+          options.apiUrl,
+          options.token,
+          `/repos/${owner}/${repo}/actions/runs/${options.workflowRunId}/attempts/${options.workflowRunAttempt}/jobs?per_page=100`,
+        ),
+      onHeartbeatLoss:
+        options.onHeartbeatLoss ||
+        (async ({ workflowRunId, workflowRunAttempt }) => {
+          await coordinateExactProviderAttemptAfterHeartbeatLoss(
+            {
+              repository: options.repository,
+              workflowRunId,
+              workflowRunAttempt,
+            },
+            {
+              readRun: (runId) =>
+                githubJson(
+                  options.apiUrl,
+                  options.token,
+                  `/repos/${owner}/${repo}/actions/runs/${runId}`,
+                ),
+            },
+          );
+        }),
+    },
+  );
+}
+
+export async function verifyDeliveryHeartbeat(options) {
+  const observed = await runDevDeliveryCommand({
+    command: "observe",
+    repository: options.repository,
+    branch: options.branch,
+    token: options.token,
+    apiUrl: options.apiUrl,
+  });
+  return verifyDevDeliveryProviderHeartbeat(options.receipt, {
+    admission: options.admission,
+    jobsReadback: options.jobsReadback,
+    liveObservation: observed.observation,
+    workflowRunId: options.workflowRunId,
+    workflowRunAttempt: options.workflowRunAttempt,
+    admissionJobName: options.admissionJobName,
+    heartbeatJobName: options.heartbeatJobName,
+    finalizerJobName: options.finalizerJobName,
+    observedAt: options.now,
+  });
+}

package/packages/core/dev-delivery/native/provider-boundary.js

@@ -0,0 +1,71 @@
+import path from "node:path";
+import {
+  verifyNativeExecutionTransfer,
+  createProviderFinalizerBoundary,
+  verifyProviderFailureSettlementBinding,
+} from "../dev-delivery-process-boundary.js";
+import { readJson, writeJson } from "./files.js";
+export function verifyNativeProviderBoundary({
+  directory: directoryInput,
+  runtimeSha,
+  runtimeSelectionRoot,
+  pullRequestNumber,
+  sourceHead,
+  run,
+  runner,
+  jobs,
+  pullRequestReadback,
+  baseRefReadback,
+  output,
+  nativeJob = "native-execution",
+  nativeJobName = "Credentialless native execution",
+  sealJobName = "Credentialless native evidence seal",
+  finalizerJobName = "Credentialed provider finalizer",
+  observedAt = new Date().toISOString(),
+}) {
+  const directory = path.resolve(directoryInput);
+  const transfer = verifyNativeExecutionTransfer(
+    readJson(
+      path.join(directory, "execution-transfer.json"),
+      "execution transfer",
+    ),
+    {
+      directory,
+      expected: {
+        "producer.workflowRunId": run.id,
+        "producer.workflowRunAttempt": run.attempt,
+        "producer.job": nativeJob,
+        "runtime.resolvedSha": runtimeSha,
+        "runtime.selectionRoot": runtimeSelectionRoot,
+        "warrant.pullRequestNumber": pullRequestNumber,
+        "warrant.sourceHead": sourceHead,
+      },
+    },
+  );
+  const boundary = createProviderFinalizerBoundary({
+    jobs,
+    executionTransfer: transfer,
+    workflowRunId: run.id,
+    workflowRunAttempt: run.attempt,
+    nativeJobName,
+    sealJobName,
+    finalizerJobName,
+    finalizerRunnerName: runner.name,
+    finalizerRunnerEnvironment: runner.environment,
+    pullRequestReadback,
+    baseRefReadback,
+    observedAt: observedAt,
+  });
+  writeJson(output, boundary);
+  if (transfer.outcome === "failed") {
+    const settlement = verifyProviderFailureSettlementBinding(
+      boundary,
+      transfer,
+    );
+    writeJson(
+      path.join(path.dirname(output), "provider-failure-settlement.json"),
+      settlement,
+    );
+  }
+  return boundary;
+}

package/packages/core/dev-delivery/native/qualification.js

@@ -0,0 +1,228 @@
+import fs from "node:fs";
+import path from "node:path";
+import { exactRoot } from "../warrant/values.js";
+import { readJson, writeJson } from "./files.js";
+import { composeCandidate, LocalTwoPhaseClient } from "./candidate.js";
+import { GitHubTwoPhaseClient } from "../../providers/dev-delivery/candidate.js";
+import { runNativeWithHeartbeat } from "./execution.js";
+import {
+  replayQualifiedNativeWarrant,
+  classifyNativeProofAgainstCurrent,
+} from "./reuse.js";
+import { runNativeQualificationAttempt } from "./attempt.js";
+import { releaseFailedAttempt } from "./failure.js";
+import { runDevDeliveryCommand } from "../warrant/service.js";
+function retainedWarrantStateRoot(warrantResult) {
+  return warrantResult.observation?.stateRoot || warrantResult.after?.stateRoot;
+}
+
+function bindNativeWarrantExecution(warrant, options) {
+  for (const field of [
+    "sourceIdentityRoot",
+    "sourcePatchRoot",
+    "planRoot",
+    "closureRoot",
+    "dependencyRoot",
+    "toolchainRoot",
+    "environmentRoot",
+  ]) {
+    if (warrant[field] !== options[field]) {
+      throw new Error(`provisional Warrant ${field} does not match execution`);
+    }
+  }
+  if (
+    JSON.stringify([...(warrant.affectedPaths || [])].sort()) !==
+      JSON.stringify([...options.affectedPaths].sort()) ||
+    JSON.stringify([...(warrant.shardEvidenceRoots || [])].sort()) !==
+      JSON.stringify([...options.shardEvidenceRoots].sort())
+  ) {
+    throw new Error(
+      "provisional Warrant candidate evidence roots do not match execution",
+    );
+  }
+  if (
+    !warrant.nativeCommandContract ||
+    warrant.nativeCommandContract.command !== options.nativeCommand
+  ) {
+    throw new Error(
+      "provisional Warrant native command contract does not match execution",
+    );
+  }
+  options.nativeCommandRoot = warrant.nativeCommandContract.commandRoot;
+}
+
+function admittedNativeWarrant(warrantResult, options) {
+  const warrant =
+    warrantResult.observation?.activeWarrant || warrantResult.warrant;
+  if (!warrant || !["provisional", "qualified"].includes(warrant.phase)) {
+    throw new Error(
+      "two-phase delivery requires an active provisional or qualified Warrant",
+    );
+  }
+  if (
+    Number(warrant.pullRequestNumber) !== options.pullRequestNumber ||
+    warrant.sourceHead !== options.expectedHead
+  ) {
+    throw new Error("provisional Warrant does not match the exact PR head");
+  }
+
+  return warrant;
+}
+
+export async function runTwoPhaseDelivery(options, dependencies = {}) {
+  options.environmentRoot = exactRoot(
+    options.environmentRoot,
+    "environmentRoot",
+  );
+  const client =
+    dependencies.client ||
+    (options.nativeOnly
+      ? new LocalTwoPhaseClient(options)
+      : new GitHubTwoPhaseClient(options));
+  const runNative = dependencies.runNative || runNativeWithHeartbeat;
+  const warrantResult = readJson(options.warrantResultPath, "Warrant result");
+  const warrant = admittedNativeWarrant(warrantResult, options);
+  const runCommand =
+    dependencies.runCommand ||
+    (options.nativeOnly
+      ? async ({ command }) => {
+          if (command !== "heartbeat")
+            throw new Error(
+              "credentialless native phase cannot mutate provider state",
+            );
+          return {
+            action: "immutable-admission-binding",
+            fencingToken: warrant.fencingToken,
+            leaseGeneration: warrant.generation,
+          };
+        }
+      : runDevDeliveryCommand);
+  bindNativeWarrantExecution(warrant, options);
+  const evidenceDirectory = path.resolve(options.evidenceDirectory);
+  fs.mkdirSync(evidenceDirectory, { recursive: true });
+  const qualifiedReplay = await replayQualifiedNativeWarrant({
+    warrant,
+    pullRequestNumber: options.pullRequestNumber,
+    expectedHead: options.expectedHead,
+    exactPullRequestHead: (...args) => client.exactPullRequestHead(...args),
+  });
+  if (qualifiedReplay) return qualifiedReplay;
+  let proof = options.nativeProofPath
+    ? readJson(options.nativeProofPath, "native proof")
+    : null;
+  let classified = proof
+    ? await classifyNativeProofAgainstCurrent(proof, options, client)
+    : null;
+  let nativeAttempts = 0;
+  try {
+    while (true) {
+      if (classified?.decision.reusable) {
+        await client.exactPullRequestHead(
+          options.pullRequestNumber,
+          options.expectedHead,
+        );
+        classified = await classifyNativeProofAgainstCurrent(
+          proof,
+          options,
+          client,
+        );
+        if (classified.decision.reusable) break;
+      }
+      if (options.finalizeOnly) break;
+      if (nativeAttempts >= 2) break;
+      if (!String(options.nativeCommand || "").trim()) {
+        throw new Error(
+          `native proof cannot be reused (${classified?.decision.reason || "not-supplied"}) and native-command is empty`,
+        );
+      }
+      nativeAttempts += 1;
+      proof = await runNativeQualificationAttempt({
+        options,
+        warrant,
+        attempt: nativeAttempts,
+        client,
+        runCommand,
+        runNative,
+        composeCandidate: dependencies.composeCandidate || composeCandidate,
+        writeEvidence: (name, value) =>
+          writeJson(path.join(evidenceDirectory, name), value),
+      });
+      classified = await classifyNativeProofAgainstCurrent(
+        proof,
+        options,
+        client,
+      );
+    }
+
+    if (!classified?.decision.reusable) {
+      throw new Error(
+        `native proof remains non-reusable after ${nativeAttempts} attempt(s): ${classified?.decision.reason || "unknown"}`,
+      );
+    }
+    writeJson(path.join(evidenceDirectory, "native-proof.json"), proof);
+    writeJson(
+      path.join(evidenceDirectory, "native-reuse-decision.json"),
+      classified.decision,
+    );
+    if (options.nativeOnly) {
+      return {
+        schema: "kungfu.buildchain.two-phase-delivery-result/v1",
+        ok: true,
+        outcome: "native-proof-ready",
+        nativeAttempts,
+        nativeProofRoot: proof.proofRoot,
+        nativeReuseDecisionRoot: classified.decision.decisionRoot,
+        qualificationReceiptRoot: null,
+        landingAuthority: false,
+        qualifiedWarrant: warrant,
+      };
+    }
+    const qualified = await runCommand({
+      command: "qualify",
+      repository: options.repository,
+      branch: options.branch,
+      fencingToken: warrant.fencingToken,
+      leaseGeneration: warrant.generation,
+      nativeProofPath: path.join(evidenceDirectory, "native-proof.json"),
+      nativeReuseDecisionPath: path.join(
+        evidenceDirectory,
+        "native-reuse-decision.json",
+      ),
+      currentBase: classified.current.currentBase,
+      graphKnown: classified.current.graphKnown,
+      attributionComplete: classified.current.attributionComplete,
+      changedPaths: JSON.stringify(classified.current.changedPaths),
+      renames: JSON.stringify(classified.current.renames),
+      execute: true,
+      token: options.token,
+      apiUrl: options.apiUrl,
+    });
+    writeJson(
+      path.join(evidenceDirectory, "qualified-warrant.json"),
+      qualified,
+    );
+    return {
+      schema: "kungfu.buildchain.two-phase-delivery-result/v1",
+      ok: true,
+      outcome: "qualified-warrant",
+      nativeAttempts,
+      nativeProofRoot: proof.proofRoot,
+      nativeReuseDecisionRoot: classified.decision.decisionRoot,
+      qualificationReceiptRoot: qualified.receiptRoot,
+      landingAuthority: false,
+      qualifiedWarrant: qualified.observation.activeWarrant,
+    };
+  } catch (error) {
+    await releaseFailedAttempt({
+      error,
+      options,
+      warrant,
+      warrantStateRoot: retainedWarrantStateRoot(warrantResult),
+      nativeAttempts,
+      evidenceDirectory,
+      runCommand,
+      client,
+    });
+    throw error;
+  }
+}

package/packages/core/dev-delivery/native/readback.js

@@ -0,0 +1,32 @@
+export function verifyNativeQualificationReadback(
+  result,
+  { pullRequestNumber, expectedHead },
+  { native },
+) {
+  if (
+    result.ok !== true ||
+    result.outcome !== (native ? "native-proof-ready" : "qualified-warrant")
+  )
+    throw new Error("Native qualification did not reach the expected outcome");
+  if (
+    result.qualifiedWarrant?.phase !== (native ? "provisional" : "qualified") ||
+    result.qualifiedWarrant.pullRequestNumber !== pullRequestNumber ||
+    result.qualifiedWarrant.sourceHead !== expectedHead
+  )
+    throw new Error("Native qualification Warrant identity or phase drift");
+  for (const key of [
+    "nativeProofRoot",
+    "nativeReuseDecisionRoot",
+    ...(!native ? ["qualificationReceiptRoot"] : []),
+  ]) {
+    if (!/^sha256:[0-9a-f]{64}$/u.test(result[key] || ""))
+      throw new Error(`Native qualification ${key} is missing`);
+  }
+  return {
+    "native-proof-root": result.nativeProofRoot,
+    "decision-root": result.nativeReuseDecisionRoot,
+    ...(!native
+      ? { "qualification-receipt-root": result.qualificationReceiptRoot }
+      : {}),
+  };
+}

package/packages/core/dev-delivery/native/reuse.js

@@ -0,0 +1,60 @@
+import { createNativeProofReuseDecision } from "../dev-delivery-warrant.js";
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+export async function replayQualifiedNativeWarrant({
+  warrant,
+  pullRequestNumber,
+  expectedHead,
+  exactPullRequestHead,
+}) {
+  if (warrant.phase !== "qualified") return null;
+  if (
+    !ROOT_PATTERN.test(warrant.nativeProofRoot || "") ||
+    !ROOT_PATTERN.test(warrant.nativeProofReuseRoot || "") ||
+    !ROOT_PATTERN.test(warrant.qualificationReceiptRoot || "")
+  ) {
+    throw new Error(
+      "qualified Warrant replay is missing rooted native or qualification evidence",
+    );
+  }
+  await exactPullRequestHead(pullRequestNumber, expectedHead);
+  return {
+    schema: "kungfu.buildchain.two-phase-delivery-result/v1",
+    ok: true,
+    outcome: "already-qualified-warrant",
+    nativeAttempts: 0,
+    nativeProofRoot: warrant.nativeProofRoot,
+    nativeReuseDecisionRoot: warrant.nativeProofReuseRoot,
+    qualificationReceiptRoot: warrant.qualificationReceiptRoot,
+    landingAuthority: false,
+    qualifiedWarrant: warrant,
+  };
+}
+
+export async function classifyNativeProofAgainstCurrent(
+  proof,
+  options,
+  client,
+) {
+  const currentBase = await client.baseSha(options.branch);
+  const delta = await client.baseDelta(proof.qualifiedBase, currentBase);
+  const current = {
+    sourceHead: options.expectedHead,
+    sourceIdentityRoot: options.sourceIdentityRoot,
+    sourcePatchRoot: options.sourcePatchRoot,
+    planRoot: options.planRoot,
+    closureRoot: options.closureRoot,
+    dependencyRoot: options.dependencyRoot,
+    toolchainRoot: options.toolchainRoot,
+    environmentRoot: options.environmentRoot,
+    nativeCommandRoot: options.nativeCommandRoot,
+    currentBase,
+    graphKnown: delta.graphKnown,
+    attributionComplete: delta.attributionComplete,
+    changedPaths: delta.changedPaths,
+    renames: delta.renames,
+  };
+  return {
+    current,
+    decision: createNativeProofReuseDecision({ proof, current }),
+  };
+}

package/packages/core/dev-delivery/native/seal-action.js

@@ -0,0 +1,19 @@
+import path from "node:path";
+import { deliveryActionContext } from "./action-context.js";
+import { sealNativeExecution } from "./transfer.js";
+export function sealNativeExecutionAction(core, env) {
+  const { workspace, runner } = deliveryActionContext(core, env);
+  const result = sealNativeExecution({
+    directory: path.join(workspace, ".buildchain/native-raw"),
+    stagingDirectory: path.join(
+      workspace,
+      ".buildchain/native-transfer-staging",
+    ),
+    runtimeSelectionRoot: core.getInput("runtime-selection-root", {
+      required: true,
+    }),
+    runner,
+  });
+  core.setOutput("root", result.transferRoot);
+  core.setOutput("native-outcome", result.outcome);
+}

package/packages/core/dev-delivery/native/transactions.js

@@ -0,0 +1,156 @@
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { verifyNativeQualificationProof } from "../dev-delivery-warrant.js";
+import { resolveCandidateAffectedPaths } from "../candidate/evidence.js";
+import { readJson, writeJson } from "./files.js";
+import { runTwoPhaseDelivery } from "./qualification.js";
+import { verifyNativeQualificationReadback } from "./readback.js";
+import { recordNativeJobContext } from "./context-record.js";
+function candidateEvidence(workspace, candidate, sourceProofRoot) {
+  return {
+    ...candidate,
+    affectedPaths: resolveCandidateAffectedPaths({
+      affectedPaths: candidate.affectedPaths,
+      sourceProofRoot,
+      source: {
+        repository: candidate.repository,
+        protectedBase: candidate.branch,
+        sourceHead: candidate.expectedHead,
+        sourceIdentityRoot: candidate.sourceIdentityRoot,
+      },
+      readProof: () =>
+        readJson(
+          path.join(workspace, ".buildchain/dev-delivery/source-proof.json"),
+          "source proof",
+        ),
+    }),
+  };
+}
+export function verifyAdmittedRuntimeSelection(
+  file,
+  { runtimeSha, runtimeSelectionRoot },
+) {
+  const bytes = fs.readFileSync(file);
+  const selection = JSON.parse(bytes);
+  if (
+    selection.resolvedSha !== runtimeSha ||
+    `sha256:${crypto.createHash("sha256").update(bytes).digest("hex")}` !==
+      runtimeSelectionRoot
+  )
+    throw new Error("Rooted runtime selection differs from admission");
+  return selection;
+}
+export function verifyNativeProofFile(file, output) {
+  const result = verifyNativeQualificationProof(readJson(file, "native proof"));
+  writeJson(output, result);
+  if (!result.ok || result.reason !== "exact-native-proof")
+    throw new Error(`Native proof verification failed: ${result.reason}`);
+  return result;
+}
+export async function executeDeliveryNative(
+  {
+    workspace,
+    candidate,
+    runtimeSha,
+    runtimeSelectionRoot,
+    sourceProofRoot,
+    reusableNativeProof,
+    run,
+    runner,
+  },
+  dependencies = {},
+) {
+  const evidenceDirectory = path.join(workspace, ".buildchain/dev-delivery");
+  let outcome = "failed";
+  try {
+    verifyAdmittedRuntimeSelection(
+      path.join(evidenceDirectory, "runtime-selection.json"),
+      { runtimeSha, runtimeSelectionRoot },
+    );
+    let nativeProofPath = "";
+    if (reusableNativeProof) {
+      nativeProofPath = path.join(
+        evidenceDirectory,
+        "reusable-native-proof.json",
+      );
+      writeJson(nativeProofPath, reusableNativeProof);
+      verifyNativeProofFile(
+        nativeProofPath,
+        path.join(evidenceDirectory, "reusable-native-proof-verification.json"),
+      );
+    }
+    const result = await runTwoPhaseDelivery(
+      {
+        ...candidateEvidence(workspace, candidate, sourceProofRoot),
+        warrantResultPath: path.join(evidenceDirectory, "warrant.json"),
+        candidateDirectory: path.join(workspace, ".buildchain/candidate"),
+        evidenceDirectory,
+        nativeProofPath,
+        nativeOnly: true,
+        finalizeOnly: false,
+      },
+      dependencies,
+    );
+    writeJson(
+      path.join(evidenceDirectory, "two-phase-native-result.json"),
+      result,
+    );
+    const outputs = verifyNativeQualificationReadback(result, candidate, {
+      native: true,
+    });
+    outcome = "succeeded";
+    return outputs;
+  } finally {
+    recordNativeJobContext({
+      output: path.join(evidenceDirectory, "native-job-context.json"),
+      outcome,
+      run,
+      runner,
+    });
+  }
+}
+export async function qualifyTransferredNative(
+  { workspace, runtimeRoot, candidate, sourceProofRoot, token, apiUrl },
+  dependencies = {},
+) {
+  const evidenceDirectory = path.join(
+    workspace,
+    ".buildchain/finalizer-evidence",
+  );
+  const nativeProofPath = path.join(
+    workspace,
+    ".buildchain/native-transfer/native-proof.json",
+  );
+  // Proof validation precedes any Warrant provider mutation.
+  verifyNativeProofFile(
+    nativeProofPath,
+    path.join(workspace, ".buildchain/provider-native-proof-verification.json"),
+  );
+  const result = await runTwoPhaseDelivery(
+    {
+      ...candidateEvidence(workspace, candidate, sourceProofRoot),
+      token,
+      apiUrl,
+      warrantResultPath: path.join(
+        workspace,
+        ".buildchain/dev-delivery/warrant.json",
+      ),
+      candidateDirectory: runtimeRoot,
+      evidenceDirectory,
+      nativeProofPath,
+      nativeOnly: false,
+      finalizeOnly: true,
+    },
+    dependencies,
+  );
+  writeJson(path.join(evidenceDirectory, "two-phase-result.json"), result);
+  const outputs = verifyNativeQualificationReadback(result, candidate, {
+    native: false,
+  });
+  fs.copyFileSync(
+    path.join(evidenceDirectory, "qualified-warrant.json"),
+    path.join(workspace, ".buildchain/dev-delivery/warrant.json"),
+  );
+  return outputs;
+}