@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/packages/core/buildchain-publication-authority.js

@@ -1,118 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-
-import { createPublicationAuthorityRegistry } from "./publication-authority.js";
-
-const DESCRIPTORS = Object.freeze([
-  [".github/workflows/public-release-oci-compose-preview.yml", "product-publication", true, ["oci-compose-preview"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/.auditable-demo.yml", "non-publication-oidc"],
-  [".github/workflows/.declarative-auditable-demo.yml", "governance-write"],
-  [".github/workflows/.build.yml", "non-publication-oidc"],
-  [".github/workflows/.release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
-  [".github/workflows/.publication-authority.yml", "evidence-publication"],
-  [".github/workflows/.release-verify.yml", "governance-write"],
-  [".github/workflows/.sam-verify.yml", "retired-deny"],
-  [".github/workflows/.sync-remote-git.yml", "governance-write"],
-  [".github/workflows/.web-surface.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/.wheel-verify.yml", "retired-deny"],
-  [".github/workflows/.binary-release-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
-  [".github/workflows/self-build-binary-distribution.yml", "evidence-publication"],
-  [".github/workflows/self-release-binary-assets.yml", "governance-write"],
-  [".github/workflows/artifact-signing-authority.yml", "evidence-publication"],
-  [".github/workflows/self-build-demo-dogfood.yml", "governance-write"],
-  [".github/workflows/self-build-fixture.yml", "non-publication-oidc"],
-  [".github/workflows/build.yml", "non-publication-oidc"],
-  [".github/workflows/bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-build-alpha-dogfood.yml", "non-publication-oidc"],
-  [".github/workflows/self-build-stable-dogfood.yml", "non-publication-oidc"],
-  [".github/workflows/self-ops-dev-delivery.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-daily.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-monthly.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-weekly.yml", "governance-write"],
-  [".github/workflows/buildchain-patrol.yml", "governance-write"],
-  [".github/workflows/self-ops-promotion-recovery.yml", "governance-write"],
-  [".github/workflows/self-release-promote.yml", "governance-write"],
-  [".github/workflows/self-ops-stable-candidate-patrol.yml", "governance-write"],
-  [".github/workflows/dev-qualification-patrol.yml", "governance-write"],
-  [".github/workflows/dev-alpha-candidate-patrol.yml", "governance-write"],
-  [".github/workflows/dev-delivery-warrant-close.yml", "governance-write"],
-  [".github/workflows/dev-delivery-warrant-cancel.yml", "governance-write"],
-  [".github/workflows/self-ops-merge-queue.yml", "governance-write"],
-  [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-daily.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-monthly.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-weekly.yml", "governance-write"],
-  [".github/workflows/engineering-housekeeper.yml", "governance-write"],
-  [".github/workflows/self-ops-governance-audit.yml", "governance-write"],
-  [".github/workflows/github-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/self-release-npm-dry-run.yml", "dry-run-only"],
-  [".github/workflows/paper-release-sealed.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
-  [".github/workflows/paper-release.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
-  [".github/workflows/patrol-daily.yml", "governance-write"],
-  [".github/workflows/patrol-monthly.yml", "governance-write"],
-  [".github/workflows/patrol-observed-evidence.yml", "product-publication", true, ["observed-evidence-publication"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/patrol-weekly.yml", "governance-write"],
-  [".github/workflows/publication-artifact.yml", "evidence-publication"],
-  [".github/workflows/release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-release-line-open.yml", "governance-write"],
-  [".github/workflows/release-propagation.yml", "governance-write"],
-  [".github/workflows/release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
-  [".github/workflows/self-build-release-verify-compat.yml", "governance-write"],
-  [".github/workflows/stable-candidate-patrol.yml", "governance-write"],
-  [".github/workflows/universal-bootstrap-recovery.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-ops-bootstrap-dogfood.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
-]);
-
-export function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) {
-  const descriptors = DESCRIPTORS.map(([
-    workflowPath,
-    authorityClass,
-    publicationCapable = false,
-    capabilityIds = [],
-    credentialMode = "none",
-    environment = "",
-    environmentMode = "fixed",
-    publisherWorkflowMode = "fixed",
-    publisherWorkflowPath = workflowPath,
-  ]) => ({
-    workflowPath,
-    authorityClass,
-    publicationCapable,
-    capabilityIds,
-    credentialMode,
-    publisherWorkflowMode,
-    publisherWorkflowPath,
-    environment,
-    environmentMode,
-    runnerPolicy: publicationCapable ? "qualified-measured" : "unqualified",
-  }));
-  const taxonomyPath = path.join(root, "architecture/workflow-taxonomy.json");
-  if (!fs.existsSync(taxonomyPath)) return descriptors;
-  const taxonomy = JSON.parse(fs.readFileSync(taxonomyPath, "utf8"));
-  for (const entry of taxonomy.entries) {
-    if (!entry.compatibility) continue;
-    const previous = descriptors.find((item) => item.workflowPath === entry.compatibility.path);
-    if (!previous) continue;
-    const prefix = entry.role === "component" ? "." : `${entry.role}-`;
-    const workflowPath = `.github/workflows/${prefix}${entry.category}-${entry.purpose}.yml`;
-    if (fs.readFileSync(path.join(root, workflowPath), "utf8") !== fs.readFileSync(path.join(root, entry.compatibility.path), "utf8")) {
-      throw new Error(`publication authority alias differs from canonical workflow: ${workflowPath}`);
-    }
-    descriptors.push({ ...previous, workflowPath, publisherWorkflowPath: previous.publisherWorkflowPath === previous.workflowPath ? workflowPath : previous.publisherWorkflowPath });
-  }
-  return descriptors;
-}
-export function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) {
-  const workflowsDir = path.join(root, ".github", "workflows");
-  const workflows = fs.readdirSync(workflowsDir)
-    .filter((name) => name.endsWith(".yml") || name.endsWith(".yaml"))
-    .map((name) => ({
-      path: `.github/workflows/${name}`,
-      text: fs.readFileSync(path.join(workflowsDir, name), "utf8"),
-    }));
-  return createPublicationAuthorityRegistry({
-    descriptors: buildchainPublicationAuthorityDescriptors({ root }),
-    workflows,
-  });
-}

package/packages/core/canonical-contracts.js

@@ -1,239 +0,0 @@
-import { DomainWasmFault, invokeDomainWasm } from "./domain-wasm.js";
-
-export const CANONICAL_JSON_CONTRACT = "buildchain-canonical-json/v1";
-export const EVENT_ENVELOPE_CONTRACT = "buildchain-v4-event-envelope/v1";
-export const RECEIPT_ENVELOPE_CONTRACT = "buildchain-v4-receipt-envelope/v1";
-export const CONTRACT_FAULT_CONTRACT = "buildchain-v4-contract-fault/v1";
-
-const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/u;
-const CLOCK_PATTERN = /^(?!0000)\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
-const ASCII_KEY_PATTERN = /^[\x20-\x7e]+$/u;
-const ASCII_TOKEN_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
-const ROOT_DOMAINS = new Set([
-  "queue-state",
-  "candidate-identity",
-  "fencing-token",
-  "transition-receipt",
-  "observation",
-  "semantic-diff",
-  "bootstrap-evidence",
-  "stage-capsule-identity",
-  "stage-capsule",
-  "stage-capsule-availability",
-  "stage-capsule-output-manifest",
-  "stage-capsule-retention-promise",
-  "stage-capsule-retention-state",
-  "stage-capsule-transport",
-  "stage-capsule-store-receipt",
-  "stage-capsule-quarantine",
-  "stage-capsule-resume-observation",
-  "stage-capsule-resume-plan",
-  "source-verification-evidence",
-  "stage-capsule-artifact-manifest",
-  "stage-capsule-artifact-content",
-  "stage-capsule-fault-campaign",
-  "stage-capsule-seed-evidence",
-  "stage-capsule-resume-evidence",
-  "stage-capsule-platform-qualification",
-  "stage-capsule-qualification",
-  "stage-capsule-wave-reconciliation",
-  "provider-operation-identity",
-  "provider-operation-intent",
-  "provider-operation-attempt",
-  "provider-operation-observation",
-  "provider-operation-confirmation",
-  "provider-operation-reconciliation",
-  "provider-operation-journal",
-  "provider-operation-journal-state",
-  "provider-readback-sample",
-  "provider-readback-fold",
-  "release-activation-step",
-  "release-activation-plan",
-  "release-activation-state",
-  "stable-publication-candidate",
-  "stable-publication-qualification",
-  "stable-publication-target",
-  "stable-publication-plan",
-  "stable-publication-fence",
-  "partial-mutation-recovery-checkpoint",
-  "partial-mutation-recovery-plan",
-  "v4-product-required-artifacts",
-  "oci-publication-family",
-  "v4-product-publication-intent",
-  "v4-product-publication-operation",
-  "v4-product-publication-plan",
-  "tail-reseal-plan",
-  "tail-reseal-admission",
-  "tail-reseal-artifact-files",
-  "tail-reseal-receipt",
-  "release-candidate-passport",
-  "release-invocation-publisher",
-  "release-invocation-runtime",
-  "release-invocation-candidate",
-  "release-invocation-target",
-  "release-invocation-authority",
-  "release-invocation-provider",
-  "release-invocation-parent",
-  "release-invocation",
-  "release-transaction",
-  "release-receipt",
-]);
-const FAULT_CLASSES = new Set([
-  "validation",
-  "concurrency",
-  "authority",
-  "idempotence",
-]);
-const RETRY_DECISIONS = new Set(["stop", "reread", "redecide", "reselect"]);
-const RECEIPT_OUTCOMES = new Set(["accepted", "rejected", "noop"]);
-
-export class ContractFault extends Error {
-  constructor(code, path, message) {
-    super(message);
-    this.name = "ContractFault";
-    this.code = code;
-    this.path = path;
-  }
-}
-
-function fault(code, path, message) {
-  throw new ContractFault(code, path, message);
-}
-
-function exactKeys(value, keys, path) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    fault("invalid-object", path, `${path} must be an object`);
-  const actual = Object.keys(value).sort();
-  const expected = [...keys].sort();
-  if (
-    actual.length !== expected.length ||
-    actual.some((key, index) => key !== expected[index])
-  )
-    fault("invalid-envelope-shape", path, `${path} keys are not canonical`);
-}
-
-function wasm(operation, payload) {
-  try {
-    return invokeDomainWasm(operation, payload);
-  } catch (error) {
-    if (error instanceof DomainWasmFault) {
-      fault(error.code, error.path, error.message);
-    }
-    throw error;
-  }
-}
-
-export function domainCanonicalBytes(value) {
-  return Buffer.from(wasm("canonical-json", value).canonicalUtf8, "utf8");
-}
-
-export function domainContentRoot(domain, value) {
-  return wasm("content-root", { domain, value }).root;
-}
-
-export function validateRoot(value, path = "$.root") {
-  if (typeof value !== "string" || !ROOT_PATTERN.test(value))
-    fault("invalid-root", path, `${path} must be a lowercase sha256 root`);
-  return value;
-}
-
-export function validateClock(value, path = "$.clock") {
-  if (typeof value !== "string" || !CLOCK_PATTERN.test(value))
-    fault(
-      "invalid-clock",
-      path,
-      `${path} must be RFC3339 UTC with millisecond precision`,
-    );
-  const parsed = new Date(value);
-  if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value)
-    fault("invalid-clock", path, `${path} is not a real UTC instant`);
-  return value;
-}
-
-export function validateContractFault(value, path = "$.fault") {
-  exactKeys(
-    value,
-    ["schema", "code", "class", "path", "message", "retry"],
-    path,
-  );
-  if (value.schema !== CONTRACT_FAULT_CONTRACT)
-    fault("invalid-fault", `${path}/schema`, "unsupported fault schema");
-  if (!ASCII_TOKEN_PATTERN.test(value.code))
-    fault("invalid-fault", `${path}/code`, "fault code must be an ASCII token");
-  if (!FAULT_CLASSES.has(value.class))
-    fault("invalid-fault", `${path}/class`, "fault class is unsupported");
-  if (typeof value.path !== "string" || !value.path.startsWith("$"))
-    fault("invalid-fault", `${path}/path`, "fault path must start with $");
-  if (typeof value.message !== "string" || value.message.length === 0)
-    fault("invalid-fault", `${path}/message`, "fault message is required");
-  if (!RETRY_DECISIONS.has(value.retry))
-    fault(
-      "invalid-fault",
-      `${path}/retry`,
-      "fault retry decision is unsupported",
-    );
-  domainCanonicalBytes(value);
-  return value;
-}
-
-export function validateEventEnvelope(value) {
-  exactKeys(
-    value,
-    ["schema", "eventId", "eventType", "occurredAt", "subjectRoot", "payload"],
-    "$",
-  );
-  if (value.schema !== EVENT_ENVELOPE_CONTRACT)
-    fault("invalid-event", "$/schema", "unsupported event schema");
-  validateRoot(value.eventId, "$/eventId");
-  validateRoot(value.subjectRoot, "$/subjectRoot");
-  validateClock(value.occurredAt, "$/occurredAt");
-  if (!ASCII_TOKEN_PATTERN.test(value.eventType))
-    fault("invalid-event", "$/eventType", "event type must be an ASCII token");
-  domainCanonicalBytes(value.payload);
-  return value;
-}
-
-export function validateReceiptEnvelope(value) {
-  exactKeys(
-    value,
-    [
-      "schema",
-      "receiptType",
-      "recordedAt",
-      "eventRoot",
-      "priorStateRoot",
-      "nextStateRoot",
-      "outcome",
-      "fault",
-    ],
-    "$",
-  );
-  if (value.schema !== RECEIPT_ENVELOPE_CONTRACT)
-    fault("invalid-receipt", "$/schema", "unsupported receipt schema");
-  if (!ASCII_TOKEN_PATTERN.test(value.receiptType))
-    fault(
-      "invalid-receipt",
-      "$/receiptType",
-      "receipt type must be an ASCII token",
-    );
-  validateClock(value.recordedAt, "$/recordedAt");
-  validateRoot(value.eventRoot, "$/eventRoot");
-  if (value.priorStateRoot !== null)
-    validateRoot(value.priorStateRoot, "$/priorStateRoot");
-  if (value.nextStateRoot !== null)
-    validateRoot(value.nextStateRoot, "$/nextStateRoot");
-  if (!RECEIPT_OUTCOMES.has(value.outcome))
-    fault("invalid-receipt", "$/outcome", "receipt outcome is unsupported");
-  if (value.fault !== null) validateContractFault(value.fault);
-  if ((value.outcome === "rejected") !== (value.fault !== null))
-    fault(
-      "invalid-receipt",
-      "$/fault",
-      "only rejected receipts carry a typed fault",
-    );
-  return value;
-}
-
-export function contractDomains() {
-  return [...ROOT_DOMAINS];
-}

package/packages/core/ci-lane-change-budget.js

@@ -1,260 +0,0 @@
-import crypto from "node:crypto";
-import { parseWorkflowDocument } from "./workflow-yaml-contract.js";
-
-export const CI_LANE_CHANGE_BUDGET_CONTRACT =
-  "buildchain.ci-lane-change-budget/v1";
-
-const AUTHORITY_CLASSES = new Set([
-  "merge-critical-required",
-  "merge-critical-admission",
-  "post-merge-advisory",
-  "diagnostic",
-  "evidence",
-  "governed-delegation",
-  "release",
-]);
-const TRIGGER_CLASSES = new Set([
-  "merge-group",
-  "pull-request",
-  "push",
-  "scheduled",
-  "manual",
-  "reusable",
-  "release",
-  "mixed",
-]);
-const CONCURRENCY_MODES = new Set([
-  "none",
-  "ref-scoped",
-  "workflow-scoped",
-  "serialized",
-]);
-const CANCELLATION_BEHAVIORS = new Set([
-  "cancel-stale",
-  "finish-started",
-  "provider-default",
-  "not-applicable",
-]);
-
-function canonical(value) {
-  if (Array.isArray(value)) return value.map(canonical);
-  if (value && typeof value === "object") {
-    return Object.fromEntries(
-      Object.keys(value)
-        .sort()
-        .map((key) => [key, canonical(value[key])]),
-    );
-  }
-  return value;
-}
-
-function root(value) {
-  return `sha256:${crypto
-    .createHash("sha256")
-    .update(JSON.stringify(canonical(value)))
-    .digest("hex")}`;
-}
-
-function triggerClass(triggers) {
-  const classes = new Set();
-  for (const trigger of triggers) {
-    if (trigger === "merge_group") classes.add("merge-group");
-    else if (trigger.startsWith("pull_request")) classes.add("pull-request");
-    else if (trigger === "push") classes.add("push");
-    else if (trigger === "schedule") classes.add("scheduled");
-    else if (trigger === "workflow_dispatch") classes.add("manual");
-    else if (trigger === "workflow_call") classes.add("reusable");
-    else if (trigger === "release") classes.add("release");
-    else classes.add("mixed");
-  }
-  return classes.size === 1 ? [...classes][0] : "mixed";
-}
-
-function diagnostic(code, laneId, message) {
-  return { code, laneId, message };
-}
-
-function validateDeclaration(declaration, observed) {
-  const laneId = String(declaration?.laneId || "");
-  const diagnostics = [];
-  if (!AUTHORITY_CLASSES.has(declaration?.authorityClass)) {
-    diagnostics.push(
-      diagnostic(
-        "invalid-authority-class",
-        laneId,
-        "authorityClass must identify the lane's merge or non-merge authority",
-      ),
-    );
-  }
-  if (!TRIGGER_CLASSES.has(declaration?.triggerClass)) {
-    diagnostics.push(
-      diagnostic(
-        "invalid-trigger-class",
-        laneId,
-        "triggerClass must identify the workflow trigger class",
-      ),
-    );
-  } else if (observed && declaration.triggerClass !== observed.triggerClass) {
-    diagnostics.push(
-      diagnostic(
-        "trigger-class-mismatch",
-        laneId,
-        `declared ${declaration.triggerClass}, observed ${observed.triggerClass}`,
-      ),
-    );
-  }
-  const concurrency = declaration?.concurrencyPolicy;
-  if (
-    !concurrency ||
-    !CONCURRENCY_MODES.has(concurrency.mode) ||
-    typeof concurrency.cancelInProgress !== "boolean"
-  ) {
-    diagnostics.push(
-      diagnostic(
-        "invalid-concurrency-policy",
-        laneId,
-        "concurrencyPolicy requires a known mode and boolean cancelInProgress",
-      ),
-    );
-  }
-  if (
-    !Number.isFinite(declaration?.expectedRunnerMinutes) ||
-    declaration.expectedRunnerMinutes <= 0
-  ) {
-    diagnostics.push(
-      diagnostic(
-        "invalid-runner-budget",
-        laneId,
-        "expectedRunnerMinutes must be greater than zero",
-      ),
-    );
-  }
-  if (!CANCELLATION_BEHAVIORS.has(declaration?.cancellationBehavior)) {
-    diagnostics.push(
-      diagnostic(
-        "invalid-cancellation-behavior",
-        laneId,
-        "cancellationBehavior must describe how stale or started work settles",
-      ),
-    );
-  }
-  const impact = declaration?.sloImpact;
-  if (
-    !impact ||
-    typeof impact.mergeCritical !== "boolean" ||
-    !String(impact.metric || "").trim() ||
-    !Number.isFinite(impact.expectedContributionSeconds) ||
-    impact.expectedContributionSeconds < 0 ||
-    !String(impact.rationale || "").trim()
-  ) {
-    diagnostics.push(
-      diagnostic(
-        "invalid-slo-impact",
-        laneId,
-        "sloImpact requires mergeCritical, metric, expectedContributionSeconds, and rationale",
-      ),
-    );
-  }
-  return diagnostics;
-}
-
-function collectLanes(workflows) {
-  const lanes = new Map();
-  for (const workflow of workflows) {
-    const workflowPath = String(workflow?.path || "").trim();
-    if (!workflowPath) throw new Error("workflow path is required");
-    const document = parseWorkflowDocument(workflow.text);
-    for (const job of document.jobs) {
-      const laneId = `${workflowPath}#${job.id}`;
-      if (lanes.has(laneId)) throw new Error(`duplicate CI lane: ${laneId}`);
-      lanes.set(laneId, {
-        laneId,
-        workflowPath,
-        jobId: job.id,
-        triggerClass: triggerClass(document.triggers),
-      });
-    }
-  }
-  return lanes;
-}
-
-export function evaluateCiLaneChangeBudget({
-  policy,
-  workflows,
-  baselineWorkflows = null,
-} = {}) {
-  if (policy?.schema !== CI_LANE_CHANGE_BUDGET_CONTRACT) {
-    throw new Error(`expected ${CI_LANE_CHANGE_BUDGET_CONTRACT}`);
-  }
-  if (!Array.isArray(workflows)) throw new Error("workflows must be an array");
-  const observed = collectLanes(workflows);
-  const baselineLaneIds = baselineWorkflows
-    ? [...collectLanes(baselineWorkflows).keys()]
-    : policy.baseline?.lanes || [];
-  const baseline = new Set(baselineLaneIds);
-  if (baseline.size !== baselineLaneIds.length) {
-    throw new Error("baseline CI lanes must be unique");
-  }
-  const declarations = new Map();
-  const diagnostics = [];
-  const familyDeclarations = (policy.declarationFamilies || []).flatMap(
-    ({ laneIds, ...declaration }) => {
-      if (!Array.isArray(laneIds) || laneIds.length === 0)
-        throw new Error("CI lane declaration family requires laneIds");
-      if (new Set(laneIds).size !== laneIds.length)
-        throw new Error("CI lane declaration family laneIds must be unique");
-      return laneIds.map((laneId) => ({ ...declaration, laneId }));
-    },
-  );
-  for (const declaration of [
-    ...(policy.declarations || []),
-    ...familyDeclarations,
-  ]) {
-    const laneId = String(declaration?.laneId || "").trim();
-    if (!laneId) throw new Error("CI lane declaration laneId is required");
-    if (declarations.has(laneId))
-      throw new Error(`duplicate CI lane declaration: ${laneId}`);
-    declarations.set(laneId, declaration);
-    if (!observed.has(laneId)) {
-      diagnostics.push(
-        diagnostic(
-          "stale-declaration",
-          laneId,
-          "declared CI lane is absent from the current workflow cut",
-        ),
-      );
-    }
-    diagnostics.push(
-      ...validateDeclaration(declaration, observed.get(laneId) || null),
-    );
-  }
-  const newLanes = [...observed.keys()]
-    .filter((laneId) => !baseline.has(laneId))
-    .sort();
-  for (const laneId of newLanes) {
-    if (!declarations.has(laneId)) {
-      diagnostics.push(
-        diagnostic(
-          "undeclared-new-lane",
-          laneId,
-          "new CI lane must declare authority, trigger, concurrency, runner, cancellation, and SLO budgets",
-        ),
-      );
-    }
-  }
-  const result = {
-    schema: "buildchain.ci-lane-change-budget.evaluation/v1",
-    ok: diagnostics.length === 0,
-    observedLaneCount: observed.size,
-    baselineLaneCount: baseline.size,
-    newLaneCount: newLanes.length,
-    declaredLaneCount: declarations.size,
-    newLanes,
-    diagnostics: diagnostics.sort((left, right) =>
-      `${left.laneId}:${left.code}`.localeCompare(
-        `${right.laneId}:${right.code}`,
-      ),
-    ),
-  };
-  return { ...result, evaluationRoot: root(result) };
-}