@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/packages/core/consumer/floating-consumer-policy.js

@@ -1,8 +1,4 @@
 import { installationRoot } from "../runtime/installation-root.js";
-import {
-  SOURCE_OWNED_PROMOTION,
-  verifyWorkflowDefinition,
-} from "./workflow-definition-authority.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
@@ -33,15 +29,12 @@ const BUILDCHAIN_REPOSITORY = "kungfu-systems/buildchain";
 const CHANNELS = Object.freeze({ v4: "stable", "v4-alpha": "alpha" });
 const DEFAULT_STABLE_LOCK_PATH = ".buildchain/contract-lock.json";
 const DEFAULT_ALPHA_LOCK_PATH = ".buildchain/alpha-contract-lock.json";
-const TRANSIENT_ACTION =
-  /^\.\/\.buildchain\/(?:runtime|workflow-shell|attester-runtime|release-tail-runtime)\//u;
+const TRANSIENT_ACTION = /^\.\/\.buildchain\/runtime\//u;
 const SCANNER_PATHS = Object.freeze([
   "architecture/floating-consumer-policy.json",
   "contracts/v4-floating-consumer-policy-receipt-v1.schema.json",
   "packages/core/contracts/buildchain-contract.js",
   "packages/core/consumer/floating-consumer-policy.js",
-  "packages/core/consumer/workflow-definition-authority.js",
-  "packages/core/consumer/invocation-selector.js",
   "packages/core/consumer/floating-consumer-evidence.js",
   "packages/core/contracts/workflow-yaml-contract.js",
   "packages/core/consumer/commands/consumer-policy.mjs",
@@ -259,11 +252,7 @@ function validateScanIdentity(
   { repository, sourceSha, runtimeSha, workflowSha },
   failures,
 ) {
-  for (const [value, code] of [
-    [sourceSha, "caller-source-sha-invalid"],
-    [runtimeSha, "resolved-runtime-sha-invalid"],
-    [workflowSha, "resolved-workflow-sha-invalid"],
-  ])
+  for (const [value, code] of [[sourceSha, "caller-source-sha-invalid"]])
     if (!EXACT_SHA.test(value))
       failures.push({ code, message: `${code} must bind an exact commit` });
   if (!repository || !/^[^/]+\/[^/]+$/u.test(repository))
@@ -290,20 +279,6 @@ function classifyBuildchainUses(
 ) {
   const uses = [];
   for (const record of records) {
-    if (
-      record.uses === `./${SOURCE_OWNED_PROMOTION.workflow}` &&
-      repository === BUILDCHAIN_REPOSITORY
-    ) {
-      uses.push({
-        ...record,
-        repository,
-        path: SOURCE_OWNED_PROMOTION.workflow,
-        selector: record.uses,
-        channel,
-        selectorClass: "repository-local",
-      });
-      continue;
-    }
     const parsed = coordinate(record.uses);
     if (!parsed || parsed.repository !== BUILDCHAIN_REPOSITORY) continue;
     const selectedChannel = CHANNELS[parsed.selector] || "";
@@ -390,45 +365,6 @@ function sourceScanRoot({
   return sha256(stableJson(material));
 }
 
-function verifySelectedLock({
-  selected,
-  stable,
-  alpha,
-  workflowSha,
-  failures,
-}) {
-  // Repository-local composition is qualified by exact definition identity, not
-  // compatibility with a previously published floating-channel API. Both consumer
-  // lock roots remain required evidence for the product's external dependencies.
-  if (selected?.selectorClass === "repository-local") return;
-  const selectedLock = selected?.channel === "alpha" ? alpha : stable;
-  if (!selected?.channel || !selectedLock) return;
-  const authorityRef = selected.selector;
-  try {
-    const compatibility = evaluateBuildchainContractLock({
-      lock: selectedLock,
-      current: createBuildchainContractWorld({ root: defaultRuntimeRoot() }),
-      runtimeRef: authorityRef,
-      runtimeSha: workflowSha,
-      runtimeClass: selected.channel,
-      workflowShellRef: authorityRef,
-      expectedChannel: selected.channel,
-      expectedMajor: "v4",
-    });
-    if (!compatibility.ok) {
-      failures.push({
-        code: "selected-lock-runtime-incompatible",
-        message: `${selected.channel} contract lock rejects resolved workflow shell ${workflowSha}: ${compatibility.reasons?.join("; ") || compatibility.status}`,
-      });
-    }
-  } catch (error) {
-    failures.push({
-      code: "selected-lock-contract-world-invalid",
-      message: `cannot evaluate ${selected.channel} contract lock against the resolved workflow shell: ${error.message}`,
-    });
-  }
-}
-
 export function scanFloatingConsumerPolicy({
   root = process.cwd(),
   invocationRoot = root,
@@ -510,32 +446,6 @@ export function scanFloatingConsumerPolicy({
     sourcePath,
     expectedInvocationChannel,
   );
-  let definition;
-  if (selected?.selectorClass === "repository-local") {
-    try {
-      definition = verifyWorkflowDefinition({
-        root: resolvedInvocationRoot,
-        repository,
-        definitionRepository,
-        definitionSha,
-        workflowSha: normalizedWorkflowSha,
-        files: invocationScan.files,
-      });
-    } catch (error) {
-      failures.push({
-        code: "invocation-definition-invalid",
-        message: error.message,
-      });
-    }
-  }
-  verifySelectedLock({
-    selected,
-    stable,
-    alpha,
-    workflowSha: normalizedWorkflowSha,
-    failures,
-  });
-
   const policyRoot = sha256(stableJson(policy));
   const resolvedScannerRoot = scannerRoot || policyRoot;
   if (!SHA256_ROOT.test(resolvedScannerRoot)) {
@@ -569,7 +479,6 @@ export function scanFloatingConsumerPolicy({
       channel: selected?.channel || "",
       resolvedWorkflowSha: normalizedWorkflowSha,
       resolvedRuntimeSha: normalizedRuntimeSha,
-      ...(definition ? { definition } : {}),
     },
     contractLocks: {
       stable: { path: stableLockPath, root: contractLockRoots.stable },

package/packages/core/consumer/floating-consumer-release-passport.js

@@ -4,10 +4,7 @@ import {
   floatingConsumerDocumentRoot,
   verifyFloatingConsumerPolicyCertification,
 } from "./floating-consumer-evidence.js";
-import {
-  verifyRuntimeAuthorizationReceipt,
-  verifyRuntimeResumeLineage,
-} from "./runtime-ref-resume-authority.js";
+import { verifyRuntimeResumeLineage } from "../release/recovery/lineage.js";
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
 export function isPromotionRouting(value = undefined) {
   return [
@@ -180,17 +177,6 @@ export function normalizePromotionRouting(value = undefined) {
     if (!String(field || "").trim())
       throw new Error(`release.promotionRouting.${label} is required`);
   }
-  for (const [label, sha] of [
-    ["router.sha", value.router.sha],
-    ["shell.sha", value.shell.sha],
-    ["runtime.resolvedSha", value.runtime.resolvedSha],
-  ]) {
-    if (!/^[0-9a-f]{40}$/i.test(String(sha))) {
-      throw new Error(
-        `release.promotionRouting.${label} must be a 40-character Git SHA`,
-      );
-    }
-  }
   if (!/^sha256:[0-9a-f]{64}$/i.test(String(value.contractLock.digest))) {
     throw new Error(
       "release.promotionRouting.contractLock.digest must be a sha256 digest",
@@ -234,25 +220,11 @@ export function normalizeRuntimeResumeEvidence(value, expected = {}) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error("domainRuntimeResumeEvidence must be a JSON object");
   }
-  const authorizationVerification = verifyRuntimeAuthorizationReceipt({
-    receipt: value.authorization,
-    receiptRoot: value.authorizationRoot,
-    repository: expected.repository,
-    sourceSha: expected.sourceSha,
-    runtimeSha: expected.resumeRuntimeSha,
-    consumerPolicyReceiptRoot: expected.consumerPolicyReceiptRoot,
-  });
-  if (!authorizationVerification.ok) {
-    throw new Error(
-      `v4 runtime authorization invalid: ${authorizationVerification.failures.join(", ")}`,
-    );
-  }
   const lineageVerification = verifyRuntimeResumeLineage({
     lineage: value.lineage,
     lineageRoot: value.lineageRoot,
     repository: expected.repository,
     sourceSha: expected.sourceSha,
-    resumeRuntimeSha: expected.resumeRuntimeSha,
     consumerPolicyReceiptRoot: expected.consumerPolicyReceiptRoot,
   });
   if (!lineageVerification.ok) {
@@ -260,12 +232,7 @@ export function normalizeRuntimeResumeEvidence(value, expected = {}) {
       `v4 runtime resume lineage invalid: ${lineageVerification.failures.join(", ")}`,
     );
   }
-  if (value.lineage?.authorizationRoot !== value.authorizationRoot) {
-    throw new Error("v4 runtime resume lineage authorization root mismatch");
-  }
   return {
-    authorizationRoot: value.authorizationRoot,
-    authorization: structuredClone(value.authorization),
     lineageRoot: value.lineageRoot,
     lineage: structuredClone(value.lineage),
   };

package/packages/core/consumer/policy-admission.js

@@ -20,7 +20,6 @@ export function admitCheckedConsumerPolicy({
   alphaLockPath = ".buildchain/alpha-contract-lock.json",
 }) {
   for (const [directory, expected] of [
-    [runtimeRoot, runtimeSha],
     [consumerRoot, consumerSha],
   ]) {
     if (
@@ -70,8 +69,7 @@ export function admitCheckedConsumerPolicyAction(core, env) {
       core.getInput("directory", { required: true }),
     ),
     runtimeSha:
-      core.getInput("runtime-sha") ||
-      core.getInput("workflow-sha", { required: true }),
+      env.BUILDCHAIN_RUNTIME_SHA,
     workflowSha: core.getInput("workflow-sha", { required: true }),
     consumerSha: core.getInput("source-sha") || env.GITHUB_SHA,
     invocationRoot: core.getInput("invocation-directory")

package/packages/core/contracts/buildchain-contract.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import { parseReusableWorkflowInterface } from "./workflow-yaml-contract.js";
 import fs from "node:fs";
 import path from "node:path";
 import {
@@ -100,6 +101,10 @@ function maybeFileDigest(root, relPath) {
 }
 
 function surface(root, value) {
+  if (value.kind === "workflow" && fs.existsSync(path.join(root, value.path))) {
+    const contract = parseReusableWorkflowInterface(fs.readFileSync(path.join(root, value.path), "utf8"));
+    value = { ...value, requiredInputs: contract.inputs.filter(x => x.required).map(x => x.name), optionalInputs: contract.inputs.filter(x => !x.required).map(x => x.name), requiredOutputs: contract.outputs.map(x => typeof x === "string" ? x : x.name) };
+  }
   const breakingModel = {
     id: value.id,
     kind: value.kind,
@@ -131,11 +136,6 @@ function declarativeAuditableDemoSurface(root, pkg, majorLine) {
     kind: "workflow",
     path: ".github/workflows/public-build-demo.yml",
     publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/public-build-demo.yml@${majorLine}`,
-    requiredInputs: ["binary-artifact-name", "binary-artifact-digest", "renderer-image"],
-    requiredOutputs: [
-      "source-sha", "capture-artifact-name", "capture-artifact-digest",
-      "evidence-artifact-name", "evidence-artifact-digest", "publication-pr-url",
-    ],
     breakingDefaults: {
       scenarioPathDefault: ".buildchain/auditable-demo.json",
       renderMediaDefault: false,
@@ -144,10 +144,6 @@ function declarativeAuditableDemoSurface(root, pkg, majorLine) {
       artifactRetentionDaysDefault: 14,
       executionBoundary: "exact-binary-network-none-secret-free-60-seconds",
     },
-    optionalInputs: [
-      "buildchain-repository", "source-ref", "scenario-path", "render-media",
-      "media-profile", "materialize", "materialize-base-ref", "artifact-retention-days",
-    ],
     guarantees: [
       "one versioned declaration can contain multiple demos with multiple ordered literal argv steps",
       "every demo uses the exact same-run standalone binary admitted by producer-owned artifact name and digest",
@@ -222,19 +218,11 @@ export function createBuildchainContractWorld({
       kind: "workflow",
       path: ".github/workflows/.build.yml",
       publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.build.yml@${majorLine}`,
-      requiredInputs: [],
-      requiredOutputs: [
-        "buildchain-runtime-sha",
-        "publish-source-sha",
-        "build-summary-artifact",
-        "release-candidate-artifact",
-      ],
       breakingDefaults: {
         configurationAuthority: "buildchain.toml",
-        runtimeIdentity: "exact-called-workflow",
+        runtimeIdentity: "entry-selected-complete-runtime",
         projectDiscovery: "unambiguous-root-or-config-path",
       },
-      optionalInputs: ["config-path"],
       guarantees: [
         "runtime floating refs are resolved to immutable SHAs before matrix jobs",
         "publish source locks are verified before heavy build jobs",
@@ -248,18 +236,15 @@ export function createBuildchainContractWorld({
       kind: "workflow",
       path: ".github/workflows/build.yml",
       publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/build.yml@${majorLine}`,
-      requiredInputs: [],
-      requiredOutputs: ["buildchain-channel", "buildchain-runtime-sha", "build-summary-artifact"],
       breakingDefaults: {
         configurationAuthority: "buildchain.toml",
-        runtimeIdentity: "exact-called-workflow",
+        runtimeIdentity: "entry-selected-complete-runtime",
         projectDiscovery: "unambiguous-root-or-config-path",
       },
-      optionalInputs: ["config-path"],
       guarantees: [
         "single-project consumers require no workflow inputs",
         "project settings have one TOML authority and environment profiles own infrastructure",
-        "the called floating ref determines channel and exact runtime SHA",
+        "the floating entry selects runtime parameters before contract locks and its default",
         "stable and alpha select their matching repository contract locks",
         "source, runtime and configuration roots are bound before the build matrix",
       ],
@@ -270,48 +255,12 @@ export function createBuildchainContractWorld({
       kind: "workflow",
       path: ".github/workflows/public-release-promote.yml",
       publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/public-release-promote.yml@${majorLine}`,
-      requiredInputs: ["channel"],
-      requiredOutputs: ["promoted-sha", "built-source-sha", "release-candidate-artifact", "release-candidate-action"],
       breakingDefaults: {
         channelDefault: "auto",
-        alphaShellDefault: `${majorLine}-alpha`,
-        stableShellDefault: majorLine,
+        runtimeSelectionOwner: "actions/runtime/selection/resolve",
         promoteOnlyReleaseCandidate: true,
         requiredStatusCheck: "check / check",
       },
-      optionalInputs: [
-        "buildchain-channel",
-        "buildchain-ref",
-        "buildchain-alpha-contract-lock-path",
-        "buildchain-stable-contract-lock-path",
-        "release-candidate-workflow-file",
-        "release-candidate-workflow-name",
-        "resume-candidate-repository",
-        "resume-candidate-run-id",
-        "resume-expected-workflow-file",
-        "resume-expected-workflow-name",
-        "resume-expected-source-tree",
-        "resume-expected-candidate-root",
-        "resume-expected-candidate-runtime-sha",
-        "resume-buildchain-runtime-sha",
-        "resume-transaction-id",
-        "publish-required-artifacts-json",
-        "release-passport-kfd-1-witness-jsons",
-        "release-passport-kfd-2-claim-jsons",
-        "release-passport-kfd-3-prebuild-witness-jsons",
-        "release-passport-kfd-3-artifact-witness-jsons",
-        "release-passport-kfd-3-artifact-verify-command",
-        "release-passport-invariant-passport-jsons",
-        "release-passport-invariant-passport-command",
-        "release-passport-evidence-jsons",
-        "release-passport-attachment-command",
-        "github-artifact-attestation-policy-json",
-        "github-artifact-attestation-environment",
-        "github-artifact-attestation-retention-days",
-        "buildchain-contract-lock-path",
-        "buildchain-contract-drift-issue-mode",
-        "github-release",
-      ],
       publishArtifactSchema: {
         requirementDigest: "optional-before-publish-required-after-publish",
         exactRefResolution: "missing requirement refs resolve to the promoted exact version",
@@ -343,86 +292,32 @@ export function createBuildchainContractWorld({
         "publish-gate source locks are created by the wrapper and enforced by promote-buildchain-ref before publish side effects",
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes",
       ],
-      compatibleBreakingDigests: [
-        "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
-      ],
     }),
     surface(root, {
       id: "advanced-release-candidate-promote",
       kind: "workflow",
       path: ".github/workflows/.release-promote.yml",
       publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.release-promote.yml@${majorLine}`,
-      requiredInputs: ["channel"],
-      requiredOutputs: ["promoted-sha", "built-source-sha", "release-candidate-artifact", "release-candidate-action"],
       breakingDefaults: {
         promoteOnlyReleaseCandidate: true,
         requiredStatusCheck: "check / check",
       },
-      optionalInputs: [
-        "buildchain-ref",
-        "buildchain-expected-channel",
-        "buildchain-expected-major",
-        "buildchain-contract-lock-path",
-        "promotion-router-ref",
-        "promotion-router-sha",
-        "promotion-shell-ref",
-        "promotion-shell-sha",
-        "promotion-runtime-ref",
-        "promotion-runtime-sha",
-        "promotion-contract-lock-path",
-        "promotion-contract-lock-digest",
-        "promotion-publication-channel",
-        "promotion-target-ref",
-        "promotion-override-used",
-        "resume-candidate-repository",
-        "resume-candidate-run-id",
-        "resume-expected-workflow-file",
-        "resume-expected-workflow-name",
-        "resume-expected-source-tree",
-        "resume-expected-candidate-root",
-        "resume-expected-candidate-runtime-sha",
-        "resume-buildchain-runtime-sha",
-        "resume-transaction-id",
-      ],
       guarantees: [
-        "advanced promotion verifies routed shell, runtime, lock, publication channel, and target bindings before candidate resolution",
+        "advanced promotion verifies publication intent and source evidence using the prepared runtime",
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix",
         "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph",
       ],
-      compatibleBreakingDigests: [
-        "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      ],
     }),
     surface(root, {
       id: "web-surface",
       kind: "workflow",
       path: ".github/workflows/public-release-web.yml",
       publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/public-release-web.yml@${majorLine}`,
-      requiredInputs: [],
-      requiredOutputs: [
-        "buildchain-runtime-sha",
-        "web-surface-channel",
-        "web-surface-url",
-        "web-surface-manifest-json",
-      ],
       breakingDefaults: {
-        buildchainRefDefault: "workflow-shell-ref-or-v4",
+        runtimeSelectionOwner: "actions/runtime/selection/resolve",
         contractCompatibilityPolicy: "major-compatible",
         breakingDriftPolicy: "fail-closed-before-build",
       },
-      optionalInputs: [
-        "buildchain-ref",
-        "buildchain-contract-lock-path",
-        "buildchain-contract-compatibility-policy",
-        "buildchain-contract-drift-issue-mode",
-        "build-command",
-        "verify-command",
-        "artifact-path",
-        "preview-apply",
-        "staging-apply",
-        "production-apply",
-        "production-release-on-main",
-      ],
       guarantees: [
         "runtime floating refs are resolved to immutable SHAs before caller build and deploy work",
         "contract drift is checked before caller build, web-surface render, deploy planning, and apply side effects",
@@ -437,27 +332,6 @@ export function createBuildchainContractWorld({
       kind: "workflow",
       path: ".github/workflows/.build-demo-adapter.yml",
       publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.build-demo-adapter.yml@${majorLine}`,
-      requiredInputs: [
-        "source-artifact-name",
-        "source-artifact-digest",
-        "adapter-path",
-        "renderer-image",
-      ],
-      requiredOutputs: [
-        "source-sha",
-        "gate-artifact-name",
-        "gate-artifact-id",
-        "gate-artifact-digest",
-        "gate-artifact-url",
-        "gate-root",
-        "media-artifact-name",
-        "media-artifact-id",
-        "media-artifact-digest",
-        "media-artifact-url",
-        "media-root",
-        "media-profile",
-        "media-qualification-root",
-      ],
       breakingDefaults: {
         trustedEventRequired: true,
         renderMediaDefault: false,
@@ -465,14 +339,6 @@ export function createBuildchainContractWorld({
         artifactRetentionDaysDefault: 14,
         gatePolicy: "required-before-selective-render",
       },
-      optionalInputs: [
-        "buildchain-repository",
-        "source-ref",
-        "render-media",
-        "media-profile",
-        "artifact-retention-days",
-        "require-trusted-event",
-      ],
       guarantees: [
         "the source GitHub Artifact is admitted by exact same-run name and archive digest",
         "the checked-in consumer adapter runs from the exact consumer source with a disposable home and reduced environment",
@@ -1033,6 +899,6 @@ export function renderBuildchainContractDriftIssueBody({
     "",
     evaluation.compatible
       ? "Review the Buildchain release notes, then update the consumer contract lock to the current SHA and contract digest."
-      : "Failing before heavy build is intentional. Review the Buildchain contract change, update the consumer workflow/configuration, or pin the previous Buildchain SHA.",
+      : "Failing before heavy build is intentional. Review the Buildchain contract change, update the consumer workflow/configuration, or refresh the runtime contract lock.",
   ].join("\n");
 }

package/packages/core/contracts/workflow-yaml-contract.js

@@ -33,7 +33,17 @@ function unquote(value) {
 }
 
 function blockValue(lines, entry) {
-  if (!/^[>|][+-]?$/.test(entry.value)) return entry.value;
+  if (!/^[>|][+-]?$/.test(entry.value)) {
+    if (!entry.value) return entry.value;
+    const fragments = [entry.value];
+    for (let index = entry.line + 1; index < lines.length; index += 1) {
+      const line = lines[index];
+      if (line.trim() && indentation(line) <= entry.indent) break;
+      if (!line.trim() || line.trim().startsWith("#")) continue;
+      fragments.push(stripComment(line.trim()));
+    }
+    return fragments.join(" ");
+  }
   const values = [];
   for (let index = entry.line + 1; index < lines.length; index += 1) {
     const line = lines[index];

package/packages/core/dev-delivery/candidate/admission.js

@@ -4,7 +4,6 @@ import crypto from "node:crypto";
 import {
   sourceCoordinates,
   validateNativeContract,
-  validateRuntimeSelector,
 } from "./coordinates.js";
 import {
   verifyProjectCutReplayProof,
@@ -31,13 +30,13 @@ export function admitDeliveryRequest(input, defaultBranch) {
       deliveryClass: input["delivery-class"],
       environmentRoot: input["environment-root"],
     });
-  validateRuntimeSelector({ runtimeRef: input["buildchain-ref"] });
   return target;
 }
 export async function qualifyDeliverySource(
   {
     workspace,
     runtimeSha,
+    runtimeRef,
     request,
     repository,
     branch,
@@ -61,8 +60,8 @@ export async function qualifyDeliverySource(
     writeJson(path.join(workspace, ".buildchain/dev-delivery", name), value);
   const runtime = {
     schema: "kungfu.buildchain.dev-delivery-runtime-selection/v1",
-    repository: request["buildchain-repository"],
-    selector: request["buildchain-ref"],
+    repository: "kungfu-systems/buildchain",
+    selector: runtimeRef,
     resolvedSha: runtimeSha,
   };
   writeEvidence("runtime-selection.json", runtime);

package/packages/core/dev-delivery/candidate/coordinates.js

@@ -36,11 +36,3 @@ export function validateNativeContract(request) {
     "environment-root must be an exact sha256 content root before required native Warrant admission",
   );
 }
-export function validateRuntimeSelector(request) {
-  requireValue(
-    /^(?:v4(?:-alpha)?|[0-9a-f]{40}|train\/v4\/v4\.\d+\/[a-z0-9][a-z0-9._-]*)$/u.test(
-      request.runtimeRef || "",
-    ),
-    "buildchain-ref must be an exact SHA, v4, v4-alpha, or a v4 capability train",
-  );
-}

package/packages/core/dev-delivery/commands/dev-delivery-request.sh

@@ -49,15 +49,8 @@ jq -e --arg repository "$repository" '
 base="$(jq -r .baseRefName <<<"$pr")"
 source_head="$(jq -r .headRefOid <<<"$pr")"
 runtime_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)"
-runtime_sha="$(git -C "$runtime_root" rev-parse 'HEAD^{commit}')"
-workflow_ref="$base"
-if [ "$repository" = kungfu-systems/buildchain ]; then
-  [ "$runtime_sha" = "$source_head" ] || {
-    echo "buildchain dev deliver: source-owned workflow and runtime must match the exact PR head" >&2
-    exit 1
-  }
-  workflow_ref="$(jq -er '.headRefName | select(type == "string" and length > 0)' <<<"$pr")"
-fi
+runtime_ref="${BUILDCHAIN_RUNTIME_REF:-}"
+workflow_ref="$(jq -er '.headRefName | select(type == "string" and length > 0)' <<<"$pr")"
 
 run_id="$(jq -r '[.statusCheckRollup[] | select(.workflowName == "Verify" and .conclusion == "SUCCESS") | .detailsUrl | capture("/runs/(?<id>[0-9]+)").id] | unique | last // empty' <<<"$pr")"
 [ -n "$run_id" ] || { echo "buildchain dev deliver: no successful Verify run covers the PR head" >&2; exit 1; }
@@ -91,8 +84,7 @@ required_contexts="$(jq '[.statusCheckRollup[] | select(.conclusion == "SUCCESS"
 
 predicates="$(node "$runtime_root/packages/core/dev-delivery/commands/dev-delivery-source-proof-reuse.mjs" predicates \
   --cwd "$PWD" --repository "$repository" --branch "$base" --qualified-base "$qualified_base" \
-  --source-head "$source_head" --runtime-ref "$runtime_sha" --runtime-sha "$runtime_sha" \
-  --contract-digest "$runtime_sha" --node-version "${BUILDCHAIN_NODE_VERSION:-24}" \
+  --source-head "$source_head" --node-version "${BUILDCHAIN_NODE_VERSION:-24}" \
   --policy-paths-json "$policy_paths" --closure-paths-json "$existing_paths" \
   --dependency-paths-json "$dependency_paths" --required-contexts-json "$required_contexts")"
 
@@ -132,10 +124,10 @@ if [ -n "$github_token" ]; then
 
 fi
 workflow="self-ops-dev-delivery.yml"
-payload="$(jq --arg ref "$workflow_ref" --arg base "$base" --arg runtime "$runtime_sha" --arg number "$number" \
+payload="$(jq --arg ref "$workflow_ref" --arg base "$base" --arg runtime "$runtime_ref" --arg number "$number" \
   --arg head "$source_head" --arg roots "$(jq -cn --arg root "$source_root" '{sourceRoot:$root}')" \
   --arg run "$run_id" '. as $proof | {ref:$ref,inputs:{
-    "buildchain-ref":$runtime,"target-branch":$base,"expected-pr-number":$number,
+    "runtime-ref":$runtime,"target-branch":$base,"expected-pr-number":$number,
     "expected-head-sha":$head,"native-roots-json":$roots,"source-workflow-run-id":$run,
     "source-identity-root":$proof.sourceIdentityRoot,
     "source-patch-root":$proof.sourcePatchRoot,"plan-root":$proof.planRoot,

package/packages/core/dev-delivery/commands/dev-delivery-source-proof-reuse.mjs

@@ -35,9 +35,6 @@ function cliInput(args) {
       "source-workflow-run-id",
       process.env.GITHUB_RUN_ID,
     ),
-    runtimeRef: flag(args, "runtime-ref"),
-    runtimeSha: flag(args, "runtime-sha"),
-    contractDigest: flag(args, "contract-digest"),
     nodeVersion: flag(args, "node-version", "24"),
     workingDirectory: flag(args, "working-directory", "."),
     policyPaths: flag(args, "policy-paths-json"),