@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/packages/core/governance/buildchain-compatibility-proof.js

@@ -0,0 +1,523 @@
+import {
+  devDeliveryClone as clone,
+  devDeliveryContentRoot as contentRoot,
+  devDeliveryExactRoot as exactRoot,
+  devDeliveryText as text,
+} from "../dev-delivery/dev-delivery-common.js";
+import { evaluateBuildchainChannelBinding } from "../consumer/buildchain-channel-identity.js";
+import {
+  assertBuildchainCompatibilityProjection,
+  createBuildchainCompatibilityProofRegistry,
+  resolveBuildchainCompatibilityProof,
+} from "./buildchain-compatibility-authority.js";
+
+export {
+  BUILDCHAIN_COMPATIBILITY_FACT_REGISTRY_SCHEMA,
+  BUILDCHAIN_COMPATIBILITY_RELEASE_EVIDENCE_SCHEMA,
+  BUILDCHAIN_COMPATIBILITY_FACT_SCHEMA,
+  BUILDCHAIN_COMPATIBILITY_PROOF_REGISTRY_SCHEMA,
+  BUILDCHAIN_COMPATIBILITY_PROOF_SCHEMA,
+  createBuildchainCompatibilityFact,
+  createBuildchainCompatibilityFactRegistry,
+  createBuildchainCompatibilityProof,
+  verifyBuildchainCompatibilityFact,
+  verifyBuildchainCompatibilityFactRegistry,
+  verifyBuildchainCompatibilityProof,
+} from "./buildchain-compatibility-fact.js";
+export {
+  assertBuildchainCompatibilityProjection,
+  createBuildchainCompatibilityPathQuery,
+  createBuildchainCompatibilityProofRegistry,
+  createBuildchainCompatibilityReleaseEvidence,
+  resolveBuildchainCompatibilityProof,
+  verifyBuildchainCompatibilityPath,
+} from "./buildchain-compatibility-authority.js";
+
+export const BUILDCHAIN_COMPATIBILITY_VERIFICATION_RECEIPT_SCHEMA =
+  "kungfu.buildchain.compatibility-verification-receipt/v2";
+
+const BUILDCHAIN_CONTRACT = "kungfu-buildchain-runtime-contract-world";
+const COMPATIBILITY_OPERATION = "accept-contract-lock";
+const COMPATIBILITY_DIRECTION = "source-to-target";
+
+function exactText(value, label) {
+  const normalized = text(value);
+  if (!normalized) throw new Error(`${label} must not be empty`);
+  return normalized;
+}
+
+export function createBuildchainCompatibilityVerificationReceipt(input = {}) {
+  const decisions = clone(input.decisions || []);
+  const usedProofRoots = [
+    ...new Set(
+      decisions
+        .map((decision) => decision.proofRoot)
+        .filter(Boolean)
+        .map((root) => exactRoot(root, "decision.proofRoot")),
+    ),
+  ].sort();
+  const usedFactRoots = [
+    ...new Set(
+      decisions
+        .map((decision) => decision.factRoot)
+        .filter(Boolean)
+        .map((root) => exactRoot(root, "decision.factRoot")),
+    ),
+  ].sort();
+  const pathReceiptRoots = [
+    ...new Set(
+      decisions
+        .map((decision) => decision.pathReceiptRoot)
+        .filter(Boolean)
+        .map((root) => exactRoot(root, "decision.pathReceiptRoot")),
+    ),
+  ].sort();
+  const body = {
+    schema: BUILDCHAIN_COMPATIBILITY_VERIFICATION_RECEIPT_SCHEMA,
+    operation: COMPATIBILITY_OPERATION,
+    direction: COMPATIBILITY_DIRECTION,
+    status: exactText(input.status, "status"),
+    compatible: input.compatible === true,
+    policy: exactText(input.policy, "policy"),
+    scope: clone(input.scope || {}),
+    acceptedContractDigest: text(input.acceptedContractDigest),
+    acceptedCompatibilityDigest: text(input.acceptedCompatibilityDigest),
+    acceptedFactRegistryRoot: text(input.acceptedFactRegistryRoot),
+    acceptedProofRegistryRoot: text(input.acceptedProofRegistryRoot),
+    currentContractDigest: text(input.currentContractDigest),
+    currentCompatibilityDigest: text(input.currentCompatibilityDigest),
+    currentFactRegistryRoot: exactRoot(
+      input.currentFactRegistryRoot,
+      "currentFactRegistryRoot",
+    ),
+    currentFactCutRoot: exactRoot(
+      input.currentFactCutRoot,
+      "currentFactCutRoot",
+    ),
+    currentProofRegistryRoot: text(input.currentProofRegistryRoot),
+    decisions,
+    usedProofRoots,
+    usedFactRoots,
+    pathReceiptRoots,
+    reasonCodes: [
+      ...new Set(
+        (input.reasonCodes || []).map((reason) =>
+          exactText(reason, "reasonCode"),
+        ),
+      ),
+    ].sort(),
+  };
+  return { ...body, receiptRoot: contentRoot(body) };
+}
+
+export function verifyBuildchainCompatibilityVerificationReceipt(receiptInput) {
+  try {
+    const receipt = clone(receiptInput || {});
+    const normalized =
+      receipt.schema === BUILDCHAIN_COMPATIBILITY_VERIFICATION_RECEIPT_SCHEMA
+        ? createBuildchainCompatibilityVerificationReceipt(receipt)
+        : null;
+    if (!normalized) return { ok: false, reason: "unsupported-schema" };
+    if (normalized.receiptRoot !== receipt.receiptRoot)
+      return { ok: false, reason: "receipt-root-drift" };
+    if (JSON.stringify(normalized) !== JSON.stringify(receipt))
+      return { ok: false, reason: "non-canonical-receipt" };
+    return {
+      ok: true,
+      reason: "exact-compatibility-verification-receipt",
+      receiptRoot: receipt.receiptRoot,
+    };
+  } catch (error) {
+    return { ok: false, reason: "invalid-receipt", error: error.message };
+  }
+}
+
+export function contractSummary(
+  contractWorld,
+  runtimeRef = "",
+  runtimeSha = "",
+) {
+  return {
+    ref: runtimeRef,
+    resolvedSha: runtimeSha,
+    contract: contractWorld.contract,
+    contractDigest: contractWorld.contractDigest,
+    compatibilityDigest: contractWorld.compatibilityDigest,
+    compatibilityFactRegistryRoot: contractWorld.compatibilityFactRegistryRoot,
+    compatibilityFactCutRoot: contractWorld.compatibilityFactCutRoot,
+    compatibilityProofRegistryRoot:
+      contractWorld.compatibilityProofRegistryRoot,
+    majorLine: contractWorld.majorLine,
+    surfaceCount: Array.isArray(contractWorld.surfaces)
+      ? contractWorld.surfaces.length
+      : 0,
+  };
+}
+
+function evaluationReceipt({
+  status,
+  compatible,
+  policy,
+  accepted,
+  current,
+  decisions = [],
+  reasons = [],
+}) {
+  return createBuildchainCompatibilityVerificationReceipt({
+    status,
+    compatible,
+    policy,
+    scope: { contract: current.contract, majorLine: current.majorLine },
+    acceptedContractDigest: accepted.contractDigest,
+    acceptedCompatibilityDigest: accepted.compatibilityDigest,
+    acceptedFactRegistryRoot: accepted.compatibilityFactRegistryRoot,
+    acceptedProofRegistryRoot: accepted.compatibilityProofRegistryRoot,
+    currentContractDigest: current.contractDigest,
+    currentCompatibilityDigest: current.compatibilityDigest,
+    currentFactRegistryRoot: current.compatibilityFactRegistryRoot,
+    currentFactCutRoot: current.compatibilityFactCutRoot,
+    currentProofRegistryRoot: current.compatibilityProofRegistryRoot,
+    decisions,
+    reasonCodes: reasons,
+  });
+}
+
+function contractPolicyReasons(accepted, current, policy) {
+  const reasons = [];
+  if (accepted.contract !== current.contract)
+    reasons.push(
+      `contract changed from ${accepted.contract || "(unknown)"} to ${current.contract}`,
+    );
+  if (accepted.majorLine && accepted.majorLine !== current.majorLine)
+    reasons.push(
+      `major line changed from ${accepted.majorLine} to ${current.majorLine}`,
+    );
+  if (policy === "exact" && accepted.contractDigest !== current.contractDigest)
+    reasons.push(
+      "exact policy requires the contract digest to remain unchanged",
+    );
+  if (!["major-compatible", "allow-additive", "exact"].includes(policy))
+    reasons.push(`unsupported compatibility policy: ${policy}`);
+  return reasons;
+}
+
+function evaluateSurfaceRelation({
+  oldSurface,
+  nextSurface,
+  proofRegistry,
+  majorLine,
+}) {
+  if (!nextSurface) {
+    return {
+      reason: `surface removed: ${oldSurface.id}`,
+      decision: {
+        surfaceId: oldSurface.id,
+        status: "surface-removed",
+        sourceBreakingDigest: oldSurface.breakingDigest,
+        targetBreakingDigest: "",
+        reason: "surface-removed",
+      },
+    };
+  }
+  if (nextSurface.breakingDigest === oldSurface.breakingDigest) return {};
+  const resolution = resolveBuildchainCompatibilityProof({
+    registry: proofRegistry,
+    surface: nextSurface,
+    sourceBreakingDigest: oldSurface.breakingDigest,
+    majorLine,
+  });
+  if (!resolution.ok) {
+    return {
+      reason: `surface breaking digest changed without a valid compatibility proof: ${oldSurface.id} (${resolution.reason})`,
+      decision: {
+        surfaceId: oldSurface.id,
+        status: "rejected",
+        sourceBreakingDigest: oldSurface.breakingDigest,
+        targetBreakingDigest: nextSurface.breakingDigest,
+        reason: resolution.reason,
+      },
+    };
+  }
+  const proof = resolution.proof;
+  return {
+    decision: {
+      surfaceId: oldSurface.id,
+      status: "accepted",
+      sourceBreakingDigest: oldSurface.breakingDigest,
+      targetBreakingDigest: nextSurface.breakingDigest,
+      proofRoot: proof.proofRoot,
+      factRoot: resolution.factRoot,
+      pathReceipt: resolution.pathReceipt,
+      pathReceiptRoot: resolution.pathReceiptRoot,
+      direction: proof.direction,
+      operation: proof.operation,
+      scope: proof.scope,
+      scopeRoot: proof.scopeRoot,
+      evidence: proof.evidence,
+      evidenceRoot: proof.evidenceRoot,
+      authority: proof.authority,
+      authorityRoot: proof.authorityRoot,
+      cut: proof.cut,
+      cutRoot: proof.cutRoot,
+    },
+  };
+}
+
+function evaluateChannelBinding({
+  lock,
+  workflowShellRef,
+  runtimeRef,
+  expectedChannel,
+  expectedMajor,
+  allowOpaqueRuntime,
+}) {
+  if (!workflowShellRef && !expectedChannel && !expectedMajor) return null;
+  return evaluateBuildchainChannelBinding({
+    workflowShellRef,
+    runtimeRef,
+    lockRef: lock?.buildchain?.ref || "",
+    lockMajorLine: lock?.buildchain?.majorLine || "",
+    expectedChannel,
+    expectedMajor,
+    allowOpaqueRuntime,
+  });
+}
+
+export function evaluateBuildchainContractLock({
+  lock,
+  current,
+  runtimeRef = "",
+  runtimeSha = "",
+  runtimeClass = "",
+  compatibilityPolicy = "",
+  workflowShellRef = "",
+  expectedChannel = "",
+  expectedMajor = "",
+  allowOpaqueRuntime = false,
+} = {}) {
+  if (!current || current.contract !== BUILDCHAIN_CONTRACT) {
+    throw new Error("current must be a Buildchain runtime contract world");
+  }
+  assertBuildchainCompatibilityProjection(current);
+  const binding = evaluateChannelBinding({
+    lock,
+    workflowShellRef,
+    runtimeRef,
+    expectedChannel,
+    expectedMajor,
+    allowOpaqueRuntime,
+  });
+  if (binding?.ok === false) {
+    return {
+      ok: false,
+      status: binding.status,
+      drift: false,
+      compatible: false,
+      issueRecommended: false,
+      reasons: binding.reasons,
+      channelBinding: binding,
+    };
+  }
+  if (!new Set(["stable", "alpha"]).has(runtimeClass)) {
+    return {
+      ok: true,
+      status: "non-floating-runtime",
+      drift: false,
+      compatible: true,
+      issueRecommended: false,
+      reason: `runtime class ${runtimeClass || "unknown"} is not a stable floating ref`,
+    };
+  }
+  if (!lock) {
+    return {
+      ok: true,
+      status: "missing-lock",
+      drift: false,
+      compatible: true,
+      issueRecommended: false,
+      reason: "consumer repository has no Buildchain contract lock",
+    };
+  }
+  const accepted = lock.buildchain || {};
+  const policy =
+    compatibilityPolicy || accepted.compatibilityPolicy || "major-compatible";
+  const shaDrift =
+    !!accepted.resolvedSha &&
+    !!runtimeSha &&
+    accepted.resolvedSha !== runtimeSha;
+  const contractDrift =
+    !!accepted.contractDigest &&
+    accepted.contractDigest !== current.contractDigest;
+  if (!shaDrift && !contractDrift) {
+    const verificationReceipt = evaluationReceipt({
+      status: "unchanged",
+      compatible: true,
+      policy,
+      accepted,
+      current,
+    });
+    return {
+      ok: true,
+      status: "unchanged",
+      drift: false,
+      compatible: true,
+      issueRecommended: false,
+      policy,
+      accepted,
+      current: contractSummary(current, runtimeRef, runtimeSha),
+      compatibilityDecisions: [],
+      usedProofRoots: [],
+      usedFactRoots: [],
+      pathReceiptRoots: [],
+      verificationReceipt,
+      receiptRoot: verificationReceipt.receiptRoot,
+    };
+  }
+  const reasons = contractPolicyReasons(accepted, current, policy);
+  const compatibilityDecisions = [];
+  const currentSurfaces = new Map(
+    current.surfaces.map((entry) => [entry.id, entry]),
+  );
+  const proofRegistry = createBuildchainCompatibilityProofRegistry({
+    proofs: current.compatibilityProofs,
+    surfaces: current.surfaces,
+    majorLine: current.majorLine,
+  });
+  for (const oldSurface of accepted.surfaces || []) {
+    const result = evaluateSurfaceRelation({
+      oldSurface,
+      nextSurface: currentSurfaces.get(oldSurface.id),
+      proofRegistry,
+      majorLine: current.majorLine,
+    });
+    if (result.reason) reasons.push(result.reason);
+    if (result.decision) compatibilityDecisions.push(result.decision);
+  }
+  const compatible = reasons.length === 0;
+  const status = compatible ? "compatible-drift" : "breaking-drift";
+  const verificationReceipt = evaluationReceipt({
+    status,
+    compatible,
+    policy,
+    accepted,
+    current,
+    decisions: compatibilityDecisions,
+    reasons,
+  });
+  return {
+    ok: compatible,
+    status,
+    drift: shaDrift || contractDrift,
+    shaDrift,
+    contractDrift,
+    compatible,
+    issueRecommended: true,
+    policy,
+    reasons,
+    accepted,
+    current: contractSummary(current, runtimeRef, runtimeSha),
+    compatibilityDecisions,
+    usedProofRoots: verificationReceipt.usedProofRoots,
+    usedFactRoots: verificationReceipt.usedFactRoots,
+    pathReceiptRoots: verificationReceipt.pathReceiptRoots,
+    verificationReceipt,
+    receiptRoot: verificationReceipt.receiptRoot,
+  };
+}
+
+function shown(value, fallback = "(unknown)") {
+  return value ? value : fallback;
+}
+
+function renderCompatibilityDecision(decision) {
+  const lines = [
+    `- Surface \`${decision.surfaceId}\`: ${decision.status}`,
+    `  - Relation: \`${shown(decision.sourceBreakingDigest, "(missing)")}\` -> \`${shown(decision.targetBreakingDigest, "(missing)")}\``,
+    `  - Reason: \`${shown(decision.reason, "proof-backed-compatible-relation")}\``,
+  ];
+  if (!decision.proofRoot) return lines.join("\n");
+  lines.push(
+    `  - Proof root: \`${decision.proofRoot}\``,
+    `  - Fact root: \`${decision.factRoot}\``,
+    `  - Temporal path receipt: \`${decision.pathReceiptRoot}\``,
+    `  - Direction / operation: \`${decision.direction}\` / \`${decision.operation}\``,
+    `  - Scope root: \`${decision.scopeRoot}\``,
+    `  - Evidence: ${shown(decision.evidence && decision.evidence.pullRequest)} (\`${decision.evidenceRoot}\`)`,
+    `  - Authority: \`${shown(decision.authority && decision.authority.repository)}@${shown(decision.authority && decision.authority.protectedBase)}\` (\`${decision.authorityRoot}\`)`,
+    `  - Cut: \`${shown(decision.cut && decision.cut.commit)}\` (\`${decision.cutRoot}\`)`,
+  );
+  return lines.join("\n");
+}
+
+function renderCompatibilityDecisions(decisions) {
+  if (decisions.length === 0)
+    return "- No breaking-digest relation required proof resolution.";
+  return decisions.map(renderCompatibilityDecision).join("\n");
+}
+
+export function renderBuildchainContractDriftIssueBody({
+  repository = "",
+  workflow = "",
+  runUrl = "",
+  lockPath = "",
+  evaluation,
+} = {}) {
+  const accepted = evaluation.accepted || {};
+  const current = evaluation.current || {};
+  const decisions = evaluation.compatibilityDecisions || [];
+  const renderedDecisions = renderCompatibilityDecisions(decisions);
+  return [
+    "# Buildchain contract drift",
+    "",
+    "## Summary",
+    "",
+    `Buildchain detected ${evaluation.compatible ? "compatible" : "breaking"} contract drift for a floating runtime ref before expensive Buildchain work continued.`,
+    "",
+    "## Consumer",
+    "",
+    `- Repository: ${shown(repository)}`,
+    `- Workflow: ${shown(workflow)}`,
+    `- Run: ${shown(runUrl)}`,
+    `- Lock path: ${shown(lockPath)}`,
+    "",
+    "## Accepted Buildchain contract",
+    "",
+    `- Ref: ${shown(accepted.ref)}`,
+    `- SHA: ${shown(accepted.resolvedSha)}`,
+    `- Contract digest: ${shown(accepted.contractDigest)}`,
+    `- Compatibility digest: ${shown(accepted.compatibilityDigest)}`,
+    `- Compatibility Fact registry: ${shown(accepted.compatibilityFactRegistryRoot, "(missing Fact registry)")}`,
+    `- Compatibility proof registry: ${shown(accepted.compatibilityProofRegistryRoot, "(missing proof registry)")}`,
+    `- Policy: ${shown(evaluation.policy || accepted.compatibilityPolicy)}`,
+    "",
+    "## Current Buildchain contract",
+    "",
+    `- Ref: ${shown(current.ref)}`,
+    `- SHA: ${shown(current.resolvedSha)}`,
+    `- Contract digest: ${shown(current.contractDigest)}`,
+    `- Compatibility digest: ${shown(current.compatibilityDigest)}`,
+    `- Compatibility Fact registry: ${shown(current.compatibilityFactRegistryRoot)}`,
+    `- Compatibility Fact Cut: ${shown(current.compatibilityFactCutRoot)}`,
+    `- Compatibility proof registry: ${shown(current.compatibilityProofRegistryRoot)}`,
+    `- Major line: ${shown(current.majorLine)}`,
+    "",
+    "## Compatibility",
+    "",
+    `- Status: ${shown(evaluation.status)}`,
+    `- Compatible: ${evaluation.compatible ? "yes" : "no"}`,
+    evaluation.reasons && evaluation.reasons.length
+      ? evaluation.reasons.map((reason) => `- ${reason}`).join("\n")
+      : "- No breaking drift detected.",
+    "",
+    "## Proof-backed decisions",
+    "",
+    renderedDecisions,
+    `- Verification receipt: \`${shown(evaluation.receiptRoot, "(not produced)")}\``,
+    "",
+    "## Suggested next action",
+    "",
+    evaluation.compatible
+      ? "Review the Buildchain release notes, then update the consumer contract lock to the current SHA and contract digest."
+      : "Failing before heavy build is intentional. Review the Buildchain contract change, update the consumer workflow/configuration, or pin the previous Buildchain SHA.",
+  ].join("\n");
+}

package/packages/core/governance/buildchain-publication-authority.js

@@ -0,0 +1,117 @@
+import fs from "node:fs";
+import path from "node:path";
+
+import { createPublicationAuthorityRegistry } from "../publication/publication-authority.js";
+
+const DESCRIPTORS = Object.freeze([
+  [".github/workflows/public-release-oci-compose-preview.yml", "product-publication", true, ["oci-compose-preview"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/.build-demo-adapter.yml", "non-publication-oidc"],
+  [".github/workflows/public-build-demo.yml", "governance-write"],
+  [".github/workflows/.build.yml", "non-publication-oidc"],
+  [".github/workflows/.release-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
+  [".github/workflows/.release-authority.yml", "evidence-publication"],
+  [".github/workflows/.build-release-verify-compat.yml", "governance-write"],
+  [".github/workflows/.build-sam-verify-compat.yml", "retired-deny"],
+  [".github/workflows/.ops-git-sync.yml", "governance-write"],
+  [".github/workflows/public-release-web.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
+  [".github/workflows/.build-wheel-verify-compat.yml", "retired-deny"],
+  [".github/workflows/.release-binary-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
+  [".github/workflows/self-build-binary-distribution.yml", "evidence-publication"],
+  [".github/workflows/self-release-binary-assets.yml", "governance-write"],
+  [".github/workflows/public-release-signing-authority.yml", "evidence-publication"],
+  [".github/workflows/self-build-demo-dogfood.yml", "governance-write"],
+  [".github/workflows/self-build-fixture.yml", "non-publication-oidc"],
+  [".github/workflows/build.yml", "non-publication-oidc"],
+  [".github/workflows/public-ops-bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/self-build-alpha-dogfood.yml", "non-publication-oidc"],
+  [".github/workflows/self-build-stable-dogfood.yml", "non-publication-oidc"],
+  [".github/workflows/self-ops-dev-delivery.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-daily.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-monthly.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-weekly.yml", "governance-write"],
+  [".github/workflows/public-ops-patrol.yml", "governance-write"],
+  [".github/workflows/self-ops-promotion-recovery.yml", "governance-write"],
+  [".github/workflows/self-release-promote.yml", "governance-write"],
+  [".github/workflows/self-ops-stable-candidate-patrol.yml", "governance-write"],
+  [".github/workflows/public-ops-dev-qualification-patrol.yml", "governance-write"],
+  [".github/workflows/public-ops-alpha-candidate-patrol.yml", "governance-write"],
+  [".github/workflows/public-ops-warrant-close.yml", "governance-write"],
+  [".github/workflows/public-ops-warrant-cancel.yml", "governance-write"],
+  [".github/workflows/self-ops-merge-queue.yml", "governance-write"],
+  [".github/workflows/public-ops-dev-auto-merge.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-daily.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-monthly.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-weekly.yml", "governance-write"],
+  [".github/workflows/public-ops-housekeeping.yml", "governance-write"],
+  [".github/workflows/self-ops-governance-audit.yml", "governance-write"],
+  [".github/workflows/public-release-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
+  [".github/workflows/self-release-npm-dry-run.yml", "dry-run-only"],
+  [".github/workflows/public-release-paper.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
+  [".github/workflows/public-ops-patrol-daily.yml", "governance-write"],
+  [".github/workflows/public-ops-patrol-monthly.yml", "governance-write"],
+  [".github/workflows/public-ops-observed-evidence.yml", "product-publication", true, ["observed-evidence-publication"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
+  [".github/workflows/public-ops-patrol-weekly.yml", "governance-write"],
+  [".github/workflows/public-build-publication.yml", "evidence-publication"],
+  [".github/workflows/public-release-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
+  [".github/workflows/self-release-line-open.yml", "governance-write"],
+  [".github/workflows/public-release-propagation.yml", "governance-write"],
+  [".github/workflows/public-release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
+  [".github/workflows/self-build-release-verify-compat.yml", "governance-write"],
+  [".github/workflows/public-ops-stable-candidate-patrol.yml", "governance-write"],
+  [".github/workflows/public-ops-bootstrap-recovery.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/self-ops-bootstrap-dogfood.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/self-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
+]);
+
+export function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) {
+  const descriptors = DESCRIPTORS.map(([
+    workflowPath,
+    authorityClass,
+    publicationCapable = false,
+    capabilityIds = [],
+    credentialMode = "none",
+    environment = "",
+    environmentMode = "fixed",
+    publisherWorkflowMode = "fixed",
+    publisherWorkflowPath = workflowPath,
+  ]) => ({
+    workflowPath,
+    authorityClass,
+    publicationCapable,
+    capabilityIds,
+    credentialMode,
+    publisherWorkflowMode,
+    publisherWorkflowPath,
+    environment,
+    environmentMode,
+    runnerPolicy: publicationCapable ? "qualified-measured" : "unqualified",
+  }));
+  const taxonomyPath = path.join(root, "architecture/workflow-taxonomy.json");
+  if (!fs.existsSync(taxonomyPath)) return descriptors;
+  const taxonomy = JSON.parse(fs.readFileSync(taxonomyPath, "utf8"));
+  for (const entry of taxonomy.entries) {
+    if (!entry.compatibility) continue;
+    const previous = descriptors.find((item) => item.workflowPath === entry.compatibility.path);
+    if (!previous) continue;
+    const prefix = entry.role === "component" ? "." : `${entry.role}-`;
+    const workflowPath = `.github/workflows/${prefix}${entry.category}-${entry.purpose}.yml`;
+    if (fs.readFileSync(path.join(root, workflowPath), "utf8") !== fs.readFileSync(path.join(root, entry.compatibility.path), "utf8")) {
+      throw new Error(`publication authority alias differs from canonical workflow: ${workflowPath}`);
+    }
+    descriptors.push({ ...previous, workflowPath, publisherWorkflowPath: previous.publisherWorkflowPath === previous.workflowPath ? workflowPath : previous.publisherWorkflowPath });
+  }
+  return descriptors;
+}
+export function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) {
+  const workflowsDir = path.join(root, ".github", "workflows");
+  const workflows = fs.readdirSync(workflowsDir)
+    .filter((name) => name.endsWith(".yml") || name.endsWith(".yaml"))
+    .map((name) => ({
+      path: `.github/workflows/${name}`,
+      text: fs.readFileSync(path.join(workflowsDir, name), "utf8"),
+    }));
+  return createPublicationAuthorityRegistry({
+    descriptors: buildchainPublicationAuthorityDescriptors({ root }),
+    workflows,
+  });
+}

package/packages/core/governance/candidate/body-action.js

@@ -0,0 +1,18 @@
+import path from "node:path";
+import { runCandidateBodyPrefixRenderer } from "./body-renderer.js";
+export function renderCandidateBodyAction(core, env) {
+  const request = JSON.parse(core.getInput("request-json", { required: true }));
+  const value = runCandidateBodyPrefixRenderer({
+    consumerRoot: path.join(env.GITHUB_WORKSPACE, ".buildchain/consumer"),
+    renderer: request["pull-request-body-prefix-renderer"],
+    selectedSha: core.getInput("source-sha", { required: true }),
+    sourceBranch: request["source-branch"],
+    targetBranch: request["target-branch"],
+    outputPath: path.join(
+      env.GITHUB_WORKSPACE,
+      ".buildchain/patrol/pull-request-body-prefix.txt",
+    ),
+    environment: env,
+  });
+  core.setOutput("pull-request-body-prefix", value);
+}