@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/packages/core/build/signing/dispatch.js

@@ -14,44 +14,12 @@ function repository(value, label) {
   return normalized;
 }
 
-const DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF =
-  "authority/v4/v4.1/artifact-signing";
 const AUTHORITY_WORKFLOW = "public-release-signing-authority.yml";
 
-export function resolveAuthorityDispatchRef(value) {
-  const ref = required(value, "authority ref");
-  if (/^[0-9a-f]{40}$/u.test(ref) || /^v4(?:-alpha)?$/u.test(ref))
-    return DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF;
-  if (ref !== DEFAULT_ARTIFACT_SIGNING_AUTHORITY_REF)
-    throw new Error(
-      "Artifact signing requires the current protected authority",
-    );
-  return ref;
-}
-
-export async function resolveArtifactSigningAuthorityRuntime({
-  authorityRepository,
-  authorityRef,
-  token,
-  requestImpl = githubRequest,
-}) {
-  const authorityRepo = repository(authorityRepository, "authority repository");
-  const ref = resolveAuthorityDispatchRef(authorityRef);
-  const encodedRef = ref.split("/").map(encodeURIComponent).join("/");
-  const response = await requestImpl(
-    `/repos/${authorityRepo}/git/ref/heads/${encodedRef}`,
-    { token: required(token, "Buildchain authority dispatch token") },
-  );
-  if (response?.object?.type !== "commit") {
-    throw new Error(
-      "Buildchain signing authority ref does not resolve to a commit",
-    );
-  }
-  const sha = String(response.object.sha || "");
-  if (!/^[0-9a-f]{40}$/u.test(sha)) {
-    throw new Error("Buildchain signing authority runtime SHA must be exact");
-  }
-  return { ref, sha };
+export function resolveAuthorityDispatchRef(value = "v4") {
+  if (!["v4", "v4-alpha"].includes(value))
+    throw new Error("Signing entry must use a public floating channel");
+  return value;
 }
 
 function authorityError(message, outputs = {}) {
@@ -62,7 +30,7 @@ function authorityError(message, outputs = {}) {
 
 export function validateArtifactSigningAuthorityRun(
   run,
-  { authorityRepository, authorityRuntimeSha, expectedTitle },
+  { authorityRepository, expectedTitle },
 ) {
   if (!run || typeof run !== "object") {
     throw new Error("Buildchain signing authority run is missing");
@@ -73,9 +41,6 @@ export function validateArtifactSigningAuthorityRun(
   if (String(run.event || "") !== "workflow_dispatch") {
     throw new Error("Buildchain signing authority event mismatch");
   }
-  if (String(run.head_sha || "") !== authorityRuntimeSha) {
-    throw new Error("Buildchain signing authority runtime SHA mismatch");
-  }
   if (
     run.repository?.full_name &&
     String(run.repository.full_name) !== authorityRepository
@@ -92,7 +57,6 @@ export function validateArtifactSigningAuthorityRun(
 async function pollArtifactSigningAuthorityRun({
   authorityRepository,
   token,
-  authorityRuntimeSha,
   expectedTitle,
   startedAtMs,
   deadline,
@@ -122,8 +86,7 @@ async function pollArtifactSigningAuthorityRun({
       try {
         run = validateArtifactSigningAuthorityRun(matches[0], {
           authorityRepository,
-          authorityRuntimeSha,
-          expectedTitle,
+                  expectedTitle,
         });
       } catch (error) {
         throw authorityError(error.message, {
@@ -194,7 +157,7 @@ function successfulAuthorityResult({
 export async function dispatchArtifactSigningAuthority({
   token,
   authorityRepository = "kungfu-systems/buildchain",
-  authorityRef,
+  authorityRef = "v4",
   sourceRepository,
   sourceRunId,
   sourceRunAttempt = "1",
@@ -213,8 +176,6 @@ export async function dispatchArtifactSigningAuthority({
   const sourceRepo = repository(sourceRepository, "source repository");
   const ref = resolveAuthorityDispatchRef(authorityRef);
   const runtime = required(runtimeSha, "Buildchain runtime SHA");
-  if (!/^[0-9a-f]{40}$/u.test(runtime))
-    throw new Error("Buildchain runtime SHA must be exact");
   const runId = required(sourceRunId, "source run ID");
   const runAttempt = required(sourceRunAttempt, "source run attempt");
   if (!/^[1-9][0-9]*$/u.test(runAttempt)) {
@@ -243,20 +204,14 @@ export async function dispatchArtifactSigningAuthority({
     "controller-started-at": controllerStartedAt,
   };
   try {
-    const authorityRuntime = await resolveArtifactSigningAuthorityRuntime({
-      authorityRepository: authorityRepo,
-      authorityRef: ref,
-      token: authToken,
-      requestImpl,
-    });
-    baseOutputs["authority-runtime-sha"] = authorityRuntime.sha;
+    baseOutputs["authority-runtime-sha"] = runtime;
     await requestImpl(
       `/repos/${authorityRepo}/actions/workflows/${AUTHORITY_WORKFLOW}/dispatches`,
       {
         token: authToken,
         method: "POST",
         body: {
-          ref: authorityRuntime.ref,
+          ref,
           inputs: {
             "source-repository": sourceRepo,
             "source-run-id": runId,
@@ -265,7 +220,7 @@ export async function dispatchArtifactSigningAuthority({
             "expected-request-root": requestRootDigest,
             "result-artifact-name": resultName,
             "correlation-id": correlation,
-            "expected-runtime-sha": runtime,
+            "runtime-ref": runtime,
           },
         },
       },
@@ -274,7 +229,6 @@ export async function dispatchArtifactSigningAuthority({
     const run = await pollArtifactSigningAuthorityRun({
       authorityRepository: authorityRepo,
       token: authToken,
-      authorityRuntimeSha: authorityRuntime.sha,
       expectedTitle,
       startedAtMs: controllerStartedAtMs,
       deadline: controllerStartedAtMs + timeout * 1000,

package/packages/core/build/signing/intake.js

@@ -15,7 +15,6 @@ import { artifactSigningRequestRoot } from "../signing/request.js";
 export function inspectArtifactSigningRequests({
   inputRoot,
   expectedRepository,
-  expectedRuntimeSha,
   expectedRequestRoot,
 } = {}) {
   const root = path.resolve(required(inputRoot, "signing request root"));
@@ -53,9 +52,6 @@ export function inspectArtifactSigningRequests({
       ) {
         throw new Error("signing request source repository mismatch");
       }
-      if (expectedRuntimeSha && request.runtime.sha !== expectedRuntimeSha) {
-        throw new Error("signing request runtime SHA mismatch");
-      }
       const key = `${request.source.sha}:${request.artifact.id}:${request.artifact.platform}`;
       if (seen.has(key))
         throw new Error(`duplicate artifact signing request: ${key}`);

package/packages/core/build/signing/prepare.js

@@ -27,7 +27,7 @@ export async function sealSigning(plan, platform, sourceRoot) {
     sourceSha: plan.source.sha,
     sourceTreeSha: plan.source.tree_sha,
     runtimeRepository: plan.identity.repository,
-    runtimeRef: plan.identity.ref,
+    runtimeRef: plan.runtime?.ref || plan.identity.ref,
     runtimeSha: plan.identity.sha,
     platformId: platform.id,
     platformName: platform.name,

package/packages/core/build/signing/request.js

@@ -139,7 +139,6 @@ export function artifactSigningCorrelation({
   return [
     required(sourceRunId, "source run ID"),
     positiveInteger(sourceRunAttempt, "source run attempt"),
-    exactSha(runtimeSha, "runtime SHA").slice(0, 12),
     required(platformId, "platform ID").replace(/[^A-Za-z0-9._-]+/gu, "-"),
     sha256Root(requestRoot, "request root").slice("sha256:".length, 19),
   ].join("-");
@@ -171,7 +170,7 @@ export function validateArtifactSigningControlRequest(value) {
     runtime: {
       repository: repository(value.runtime?.repository, "runtime.repository"),
       ref: required(value.runtime?.ref, "runtime.ref"),
-      sha: exactSha(value.runtime?.sha, "runtime.sha"),
+      sha: value.runtime?.sha,
     },
     platform: {
       id: required(value.platform?.id, "platform.id"),
@@ -356,8 +355,6 @@ export function assertArtifactSigningControlRequestContext(
     [sourceRunAttempt, String(value.source.runAttempt), "source run attempt"],
     [sourceSha, value.source.sha, "source SHA"],
     [sourceTreeSha, value.source.treeSha, "source tree SHA"],
-    [runtimeRepository, value.runtime.repository, "runtime repository"],
-    [runtimeSha, value.runtime.sha, "runtime SHA"],
     [platformId, value.platform.id, "platform ID"],
   ];
   for (const [expected, actual, label] of expectations) {
@@ -378,7 +375,6 @@ export function artifactSigningControlRequestOutputs(request) {
     "result-artifact": value.authority.resultArtifact,
     "correlation-id": value.authority.correlationId,
     "authority-repository": value.authority.repository,
-    "authority-ref": value.runtime.ref,
     "runtime-sha": value.runtime.sha,
   };
 }
@@ -417,7 +413,7 @@ export function validateArtifactSigningControllerReceipt(value) {
     },
     runtime: {
       repository: repository(value.runtime?.repository, "runtime.repository"),
-      sha: exactSha(value.runtime?.sha, "runtime.sha"),
+      sha: value.runtime?.sha,
     },
     platform: {
       id: required(value.platform?.id, "platform.id"),
@@ -436,7 +432,7 @@ export function validateArtifactSigningControllerReceipt(value) {
         "authority.repository",
       ),
       runtimeSha: value.authority?.runtimeSha
-        ? exactSha(value.authority.runtimeSha, "authority.runtimeSha")
+        ? value.authority.runtimeSha
         : "",
       runId: optional(value.authority?.runId, "authority.runId"),
       runUrl: optional(value.authority?.runUrl, "authority.runUrl"),
@@ -501,7 +497,6 @@ export function validateArtifactSigningControllerReceipt(value) {
     required(receipt.authority.runId, "authority.runId");
     required(receipt.authority.runUrl, "authority.runUrl");
     required(receipt.authority.resultArtifact, "authority.resultArtifact");
-    exactSha(receipt.authority.runtimeSha, "authority.runtimeSha");
   }
   if (
     receipt.request.count === 0 &&

package/packages/core/build/source/checkout-action.js

@@ -1,16 +1,12 @@
 import path from "node:path";
-import { verifySourceRuntimeCheckouts } from "../../runtime/checkout-identity.js";
-export function verifySourceRuntimeAction(core, env) {
-  verifySourceRuntimeCheckouts({
-    sourceDirectory: path.resolve(
+import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
+export function verifySourceCheckoutAction(core, env) {
+  verifyCheckoutIdentity({
+    directory: path.resolve(
       env.GITHUB_WORKSPACE,
       core.getInput("source-directory"),
     ),
-    sourceSha: core.getInput("source-sha", { required: true }),
-    runtimeDirectory: path.resolve(
-      env.GITHUB_WORKSPACE,
-      core.getInput("runtime-directory"),
-    ),
-    runtimeSha: core.getInput("runtime-sha", { required: true }),
+    sha: core.getInput("source-sha", { required: true }),
+    label: "Consumer source",
   });
 }

package/packages/core/build/source/controller.js

@@ -64,10 +64,7 @@ export function sourceQualificationStages({
   return [
     {
       id: "resolve-runtime",
-      status: aggregate([
-        observations.runtime?.outcome,
-        observations["core-runtime"]?.outcome,
-      ]),
+      status: "success",
     },
     { id: "checkout-source", status: sourceOutcome },
     {

package/packages/core/build/source/lifecycle.js

@@ -5,14 +5,13 @@ import {
   loadBuildchainConfig,
   validateBuildchainConfig,
 } from "../../consumer/buildchain-config.js";
-import { collectPaperPreflight } from "../../paper/paper.js";
-import { resolvePaperBuildchainSha } from "../../paper/paper-agent-entry.js";
+import { collectPaperSourcePolicy } from "../../paper/paper.js";
 import { runLifecycle } from "../lifecycle/transaction.js";
 import { consumerCommandSession } from "../../runtime/consumer-shell.js";
 
 export function admitSourcePaper(
   { cwd, runtimeRoot, runtimeRef },
-  inspect = collectPaperPreflight,
+  inspect = collectPaperSourcePolicy,
 ) {
   const config = loadBuildchainConfig(cwd)?.config;
   const applicable =
@@ -21,16 +20,7 @@ export function admitSourcePaper(
     (config?.project?.type === "publication-artifact" &&
       (!config.publication || config.publication.kind === "paper"));
   if (!applicable) return { applicable: false };
-  if (!runtimeRef)
-    throw new Error("Paper policy requires the selected runtime coordinate");
-  const result = inspect({
-    cwd,
-    buildchainRoot: runtimeRoot,
-    buildchainRef: runtimeRef,
-    buildchainSha: resolvePaperBuildchainSha(runtimeRoot),
-    offline: true,
-    agentEntryMode: "ci",
-  });
+  const result = inspect({ cwd });
   console.log(JSON.stringify(result));
   if (!result.ok)
     throw new Error("Paper agent-entry and acceptance policy did not qualify");

package/packages/core/build/stage-capsule/actions.js

@@ -1,24 +1,15 @@
 import path from "node:path";
 import { command } from "../../runtime/action-process.mjs";
 import { installationRoot } from "../../runtime/installation-root.js";
-import { exactWorkflowRuntime } from "../../runtime/workflow-runtime.js";
 import { qualifyStageCapsuleConsumer } from "./canary.js";
 import { aggregateStageCapsuleCampaign } from "./campaign/aggregate.js";
-function runtime(core) {
+function runtime(env) {
   const runtimeRoot = installationRoot(import.meta.url);
-  const runtimeSha = exactWorkflowRuntime(
-    core.getInput("workflow-sha", { required: true }),
-  );
-  if (
-    command("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], {
-      stdio: "pipe",
-    }).trim() !== runtimeSha
-  )
-    throw new Error("Stage Capsule runtime differs from called workflow");
+  const runtimeSha = env.BUILDCHAIN_RUNTIME_SHA;
   return { runtimeRoot, runtimeSha };
 }
 export async function qualifyStageCapsuleConsumerAction(core, env) {
-  const binding = runtime(core);
+  const binding = runtime(env);
   const workspace = path.resolve(env.GITHUB_WORKSPACE);
   if (
     command("git", ["-C", workspace, "rev-parse", "HEAD"], {
@@ -38,7 +29,6 @@ export async function qualifyStageCapsuleConsumerAction(core, env) {
   });
 }
 export function aggregateStageCapsuleConsumerAction(core, env) {
-  runtime(core);
   return aggregateStageCapsuleCampaign({
     directory: path.join(
       env.GITHUB_WORKSPACE,

package/packages/core/build/stage-capsule/campaign/resume.js

@@ -60,13 +60,19 @@ function resumeRequest(state, store) {
   };
 }
 
+function checkpointResult(entry) {
+  const { runtimeRoot: _runtimeProvenance, ...identity } =
+    entry.capsule.identity;
+  return domainCanonicalBytes({
+    identity,
+    manifestRoot: entry.manifest.manifestRoot,
+  }).toString("utf8");
+}
+
 function emitMissing(context, state, store, stageId) {
   const emitted = emitStageCapsuleCampaignCheckpoint(context, stageId, store);
   const expected = state.reference.find(({ stage }) => stage === stageId);
-  if (
-    emitted.capsule.capsuleRoot !== expected.capsule.capsuleRoot ||
-    emitted.manifest.manifestRoot !== expected.manifest.manifestRoot
-  )
+  if (checkpointResult(emitted) !== checkpointResult(expected))
     throw new Error(`resumed ${stageId} differs from the fresh build`);
   return {
     stage: stageId,
@@ -81,7 +87,6 @@ export function resumeStageCapsuleCampaign(context) {
   for (const [name, code] of [
     ["consumer", "stage-capsule-campaign-consumer-drift"],
     ["platform", "stage-capsule-campaign-platform-drift"],
-    ["runtimeRef", "stage-capsule-campaign-runtime-ref-drift"],
     ["consumerSourceRevision", "stage-capsule-campaign-source-revision-drift"],
   ])
     if (state[name] !== context[name])

package/packages/core/build/stage-capsule/rehearsal/verify.js

@@ -1,6 +1,5 @@
 import path from "node:path";
 import { command } from "../../../runtime/action-process.mjs";
-import { installationRoot } from "../../../runtime/installation-root.js";
 import { rehearseStageCheckpoint } from "./run.js";
 import { rehearseStageResume } from "./resume.js";
 import { rehearseTailResealMacos } from "./macos-tail.js";
@@ -38,9 +37,9 @@ export function verifyStageCapsuleCheckpoints({
   return { checkpoint, resume, tail };
 }
 export function verifyStageCapsuleCheckpointsAction(core, env) {
-  const runtimeRoot = installationRoot(import.meta.url);
+  const sourceRoot = path.resolve(env.GITHUB_WORKSPACE);
   if (
-    command("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], {
+    command("git", ["-C", sourceRoot, "rev-parse", "HEAD"], {
       stdio: "pipe",
     }).trim() !== env.GITHUB_SHA
   )
@@ -48,7 +47,7 @@ export function verifyStageCapsuleCheckpointsAction(core, env) {
       "Checkpoint verification must execute exact candidate source",
     );
   return verifyStageCapsuleCheckpoints({
-    runtimeRoot,
+    runtimeRoot: sourceRoot,
     workspace: path.resolve(env.GITHUB_WORKSPACE),
     platform: core.getInput("platform", { required: true }),
     environment: env,

package/packages/core/build/stage-capsule-resume-planner.js

@@ -237,7 +237,6 @@ function changedDecision(node, candidate, availabilityRoot) {
       "toolchain-changed",
       false,
     ],
-    ["runtimeRoot", "runtime-root", "rebuild", "runtime-changed", true],
     ["policyRoot", "policy-root", "rebuild", "policy-changed", true],
     ["declaredInputs", "declared-inputs", "rebuild", "input-changed", false],
     [

package/packages/core/build/summary/aggregation.js

@@ -76,12 +76,12 @@ export async function aggregate(context, plan, jobs, executions) {
     },
     runtime: {
       workflowShellRef: plan.identity.ref,
-      requestedRef: plan.identity.ref,
-      ref: plan.identity.ref,
+      requestedRef: plan.runtime?.ref || plan.identity.ref,
+      ref: plan.runtime?.ref || plan.identity.ref,
       sha: plan.identity.sha,
-      class: plan.identity.channel,
-      override: false,
-      trustDecision: "workflow-identity",
+      class: plan.runtime?.class || plan.identity.channel,
+      override: plan.runtime?.origin === "runtime-parameter",
+      trustDecision: "entry-selection",
       rollbackRef: plan.identity.ref,
     },
   });

package/packages/core/build/summary/finalization.js

@@ -49,7 +49,7 @@ async function finalizeBuild(context, jobs) {
         sourceTreeHash: plan.source.tree_sha,
         buildSummary: aggregated.summary,
         buildchain: {
-          ref: plan.identity.ref,
+          ref: plan.runtime?.ref || plan.identity.ref,
           sha: plan.identity.sha,
           workflowShellRef: plan.identity.ref,
         },

package/packages/core/build/verification/actions.js

@@ -1,5 +1,4 @@
 import path from "node:path";
-import { installationRoot } from "../../runtime/installation-root.js";
 import { command } from "../../runtime/action-process.mjs";
 import { qualifyRepositorySource, verificationProvider } from "./source.js";
 
@@ -8,13 +7,9 @@ export async function qualifyRepositorySourceAction(core, env) {
     runtimeRoot = path.join(workspace, ".buildchain/runtime");
   const sha = (cwd) =>
     command("git", ["rev-parse", "HEAD"], { cwd, stdio: "pipe" }).trim();
-  if (
-    sha(workspace) !== env.GITHUB_SHA ||
-    sha(runtimeRoot) !== env.GITHUB_SHA ||
-    path.resolve(installationRoot(import.meta.url)) !== path.resolve(workspace)
-  )
+  if (sha(workspace) !== env.GITHUB_SHA)
     throw new Error(
-      "Repository verification requires exact source-owned code and matching runtime checkout",
+      "Repository verification requires the invoked source checkout",
     );
   return qualifyRepositorySource(
     {
@@ -37,11 +32,7 @@ export async function qualifyRepositorySourceAction(core, env) {
   );
 }
 export function qualifyBuildBackboneAction(_core, env) {
-  const root = installationRoot(import.meta.url);
-  if (path.resolve(root) !== path.resolve(env.GITHUB_WORKSPACE))
-    throw new Error(
-      "Build backbone tests must execute from the admitted source checkout",
-    );
+  const root = path.resolve(env.GITHUB_WORKSPACE);
   command(
     "node",
     [

package/packages/core/build/verification/runner.js

@@ -2,7 +2,6 @@ import { verifyRepository } from "./repository.js";
 import fs from "node:fs";
 import path from "node:path";
 import { command } from "../../runtime/action-process.mjs";
-import { installationRoot } from "../../runtime/installation-root.js";
 import { collectGitHubReleasePassport } from "../../release/passport/collection.js";
 import { verifyReleasePassport } from "../../release/release-passport.js";
 
@@ -44,26 +43,29 @@ export async function qualifyRunnerCompatibility(
     throw new Error("Runner compatibility passport verification failed");
   return report;
 }
-export async function qualifyRunnerCompatibilityAction(core, env) {
+export async function qualifyRunnerCompatibilityAction(
+  core,
+  env,
+  dependencies,
+) {
   const workspace = env.GITHUB_WORKSPACE;
-  if (
-    path.resolve(installationRoot(import.meta.url)) !== path.resolve(workspace)
-  )
-    throw new Error("Runner compatibility requires source-owned code");
   core.info(`Runner ${env.RUNNER_NAME}: ${env.RUNNER_OS}/${env.RUNNER_ARCH}`);
-  return qualifyRunnerCompatibility({
-    workspace,
-    repository: env.GITHUB_REPOSITORY,
-    sourceSha: env.GITHUB_SHA,
-    env,
-    workflow: {
-      name: env.GITHUB_WORKFLOW || "",
-      runId: env.GITHUB_RUN_ID || "",
-      runAttempt: env.GITHUB_RUN_ATTEMPT || "",
-      url: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}`,
-      runnerOs: env.RUNNER_OS || process.platform,
-      runnerArch: env.RUNNER_ARCH || process.arch,
-      runnerImage: env.ImageOS || "",
+  return qualifyRunnerCompatibility(
+    {
+      workspace,
+      repository: env.GITHUB_REPOSITORY,
+      sourceSha: env.GITHUB_SHA,
+      env,
+      workflow: {
+        name: env.GITHUB_WORKFLOW || "",
+        runId: env.GITHUB_RUN_ID || "",
+        runAttempt: env.GITHUB_RUN_ATTEMPT || "",
+        url: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}`,
+        runnerOs: env.RUNNER_OS || process.platform,
+        runnerArch: env.RUNNER_ARCH || process.arch,
+        runnerImage: env.ImageOS || "",
+      },
     },
-  });
+    dependencies,
+  );
 }

package/packages/core/consumer/floating-consumer-evidence.js

@@ -1,5 +1,4 @@
 import crypto from "node:crypto";
-import { SOURCE_OWNED_PROMOTION } from "./invocation-selector.js";
 
 export const FLOATING_CONSUMER_POLICY =
   "kungfu-buildchain-v4-floating-consumer-policy/v1";
@@ -61,13 +60,6 @@ function verifyIdentity(value, expected, check, label) {
       "invoked-workflow-mismatch",
       `${label} workflow mismatch`,
     );
-  if (expected.resolvedRuntimeSha)
-    check(
-      value?.invocation?.resolvedRuntimeSha ===
-        expected.resolvedRuntimeSha.toLowerCase(),
-      "runtime-sha-mismatch",
-      `${label} runtime SHA mismatch`,
-    );
 }
 
 function verifyAuthorityFields(value, expected, check, label) {
@@ -111,28 +103,18 @@ function verifyAuthorityFields(value, expected, check, label) {
 
 function verifyFloatingSelector(value, check, label) {
   const invocation = value?.invocation;
-  const local =
-    value?.caller?.repository === SOURCE_OWNED_PROMOTION.repository &&
-    invocation?.workflow === SOURCE_OWNED_PROMOTION.workflow &&
-    invocation?.visibleSelector === `./${SOURCE_OWNED_PROMOTION.workflow}` &&
-    invocation?.selectorClass === "repository-local" &&
-    invocation?.definition?.repository === value.caller.repository &&
-    /^[0-9a-f]{40}$/.test(invocation?.definition?.commitSha || "") &&
-    invocation.definition.commitSha === invocation.resolvedWorkflowSha &&
-    SHA256_ROOT.test(invocation?.definition?.filesRoot || "") &&
-    ["stable", "alpha"].includes(invocation?.channel);
   const floating =
     invocation?.selectorClass === "floating" &&
     { v4: "stable", "v4-alpha": "alpha" }[invocation?.visibleSelector] ===
       invocation?.channel &&
     invocation?.definition === undefined;
   check(
-    floating || local,
+    floating,
     "selector-class-invalid",
-    `${label} must bind a floating channel or an authenticated source-owned public invocation`,
+    `${label} must bind a floating channel`,
   );
   check(
-    ["v4", "v4-alpha"].includes(invocation?.visibleSelector) || local,
+    ["v4", "v4-alpha"].includes(invocation?.visibleSelector),
     "selector-invalid",
     `${label} selector is outside the current invocation contract`,
   );