@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/packages/core/dev-delivery/dev-delivery-contract-surface.js

@@ -3,65 +3,17 @@ export function devDeliveryWorkflowContractSurface(pkg, majorLine) {
     id: "dev-pr-auto-merge",
     kind: "workflow",
     path: ".github/workflows/public-ops-dev-auto-merge.yml",
-    publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/public-ops-dev-auto-merge.yml@${majorLine}-alpha`,
-    requiredInputs: [
-      "target-branch",
-      "expected-pr-number",
-      "expected-head-sha",
-    ],
-    requiredOutputs: [
-      "admission-receipt-root",
-      "warrant-state-root",
-      "provider-heartbeat-receipt-root",
-      "provider-finalizer-boundary-root",
-    ],
+    publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/public-ops-dev-auto-merge.yml@${majorLine}`,
     breakingDefaults: {
-      runtimeSelectorDefault: majorLine,
+      runtimeSelectorDefault: "consumer-contract-lock-or-entry",
       authorityMode: "two-phase-delivery-warrant",
       boundedAuthorityWorkflowIntegration: "not-advertised",
       boundedAuthoritySupportedSurfaces: ["cli", "node-api", "schema"],
-      publicFloatingCaller: `${majorLine}-alpha`,
-      durableSelfDeliveryRef: `${majorLine}-alpha`,
+      publicFloatingCaller: majorLine,
+      durableSelfDeliveryRef: majorLine,
       independentHeartbeatRunner: "macos-15",
       candidateCredentialAccess: "forbidden",
     },
-    optionalInputs: [
-      "buildchain-repository",
-      "buildchain-ref",
-      "source-workflow-run-id",
-      "delivery-warrant-mode",
-      "handoff-workflow-id",
-      "assignment-root",
-      "initiative-root",
-      "source-identity-root",
-      "source-patch-root",
-      "plan-root",
-      "closure-root",
-      "dependency-root",
-      "toolchain-root",
-      "environment-root",
-      "affected-paths-json",
-      "shard-evidence-roots-json",
-      "release-blocker-priority-json",
-      "native-proof-json",
-      "native-command",
-      "native-command-root",
-      "native-heartbeat-seconds",
-      "delivery-class",
-      "delivery-priority",
-      "required-status-checks",
-      "queue-admission-context",
-      "active-lease-context",
-      "ready-label",
-      "block-labels",
-      "allowed-head-prefixes",
-      "require-approval",
-      "same-repository-only",
-      "max-merges",
-      "merge-method",
-      "landing-mode",
-      "dry-run",
-    ],
     guarantees: [
       "this reusable workflow executes the single-flight v1 Delivery Warrant and does not advertise bounded v2 Landing integration",
       "bounded v2 authority is a separate opt-in CLI, Node API, and schema surface whose controller deployment must be explicit",

package/packages/core/dev-delivery/dev-delivery-execution-transfer.js

@@ -37,12 +37,6 @@ const FAILURE_FILES = [
   "warrant.json",
 ];
 
-const DOMAIN_RUNTIME_SELECTOR =
-  /^(?:[0-9a-f]{40}|v4|v4-alpha|train\/v4\/v4\.0\/[a-z0-9][a-z0-9._-]*)$/u;
-
-const RUNTIME_SELECTOR_DESCRIPTION =
-  "runtime selector must be an exact immutable SHA, v4, v4-alpha, or train/v4/v4.0/<capability>";
-
 function requiredFiles(outcome) {
   if (outcome === "succeeded") return SUCCESS_FILES;
   if (outcome === "failed") return FAILURE_FILES;
@@ -162,12 +156,9 @@ function runtimeBinding(input = {}) {
   const runtime = {
     repository: repository(input.repository),
     selector: text(input.selector, "runtime selector"),
-    resolvedSha: exactSha(input.resolvedSha, "resolved runtime SHA"),
+    resolvedSha: input.resolvedSha,
     selectionRoot: exactRoot(input.selectionRoot, "runtime selection root"),
   };
-  if (!DOMAIN_RUNTIME_SELECTOR.test(runtime.selector)) {
-    throw new Error(RUNTIME_SELECTOR_DESCRIPTION);
-  }
   return runtime;
 }
 
@@ -202,14 +193,11 @@ function verifiedRuntimeSelection(directory, expected = {}) {
     schema: "kungfu.buildchain.dev-delivery-runtime-selection/v1",
     repository: repository(selection.repository),
     selector: text(selection.selector, "runtime selector"),
-    resolvedSha: exactSha(selection.resolvedSha, "resolved runtime SHA"),
+    resolvedSha: selection.resolvedSha,
   };
   if (JSON.stringify(selection) !== JSON.stringify(normalized)) {
     throw new Error("runtime selection is not exact canonical content");
   }
-  if (!DOMAIN_RUNTIME_SELECTOR.test(normalized.selector)) {
-    throw new Error(RUNTIME_SELECTOR_DESCRIPTION);
-  }
   const selectionRoot = sha256Bytes(
     Buffer.from(`${JSON.stringify(normalized, null, 2)}\n`),
   );
@@ -552,7 +540,6 @@ export function verifyNativeExecutionTransfer(
   const runtime = verifiedRuntimeSelection(directory, {
     repository: transfer.runtime.repository,
     selector: transfer.runtime.selector,
-    resolvedSha: transfer.runtime.resolvedSha,
     selectionRoot: transfer.runtime.selectionRoot,
   });
   const warrant = warrantEvidence(directory, transfer);

package/packages/core/dev-delivery/native/action-context.js

@@ -1,24 +1,12 @@
 import path from "node:path";
-import { command } from "../../runtime/action-process.mjs";
 import { installationRoot } from "../../runtime/installation-root.js";
 export function deliveryActionContext(core, env) {
   const runtimeRoot = installationRoot(import.meta.url);
-  const expectedSha = core.getInput("runtime-sha", { required: true });
-  if (
-    !/^[a-f0-9]{40}$/u.test(expectedSha) ||
-    command(
-      "git",
-      ["-C", runtimeRoot, "rev-parse", "--verify", "HEAD^{commit}"],
-      { stdio: "pipe" },
-    ).trim() !== expectedSha
-  )
-    throw new Error(
-      "Delivery action runtime differs from admitted immutable commit",
-    );
   return {
     workspace: path.resolve(env.GITHUB_WORKSPACE),
     runtimeRoot,
-    runtimeSha: expectedSha,
+    runtimeSha: env.BUILDCHAIN_RUNTIME_SHA,
+    runtimeRef: env.BUILDCHAIN_RUNTIME_REF,
     run: {
       id: Number(env.GITHUB_RUN_ID),
       attempt: Number(env.GITHUB_RUN_ATTEMPT),
@@ -34,26 +22,10 @@ export function deliveryActionContext(core, env) {
 
 export function selectedDeliveryActionContext(core, env) {
   const runtimeRoot = installationRoot(import.meta.url);
-  const selector = core.getInput("runtime-ref", { required: true });
-  if (
-    !/^(?:v4(?:-alpha)?|[0-9a-f]{40}|train\/v4\/v4\.\d+\/[a-z0-9][a-z0-9._-]*)$/u.test(
-      selector,
-    )
-  )
-    throw new Error("Unsupported delivery runtime selector");
-  const runtimeSha = command(
-    "git",
-    ["-C", runtimeRoot, "rev-parse", "--verify", "HEAD^{commit}"],
-    { stdio: "pipe" },
-  ).trim();
-  if (
-    !/^[0-9a-f]{40}$/u.test(runtimeSha) ||
-    (/^[0-9a-f]{40}$/u.test(selector) && selector !== runtimeSha)
-  )
-    throw new Error("Delivery runtime differs from immutable selector");
   return {
     workspace: path.resolve(env.GITHUB_WORKSPACE),
     runtimeRoot,
-    runtimeSha,
+    runtimeSha: env.BUILDCHAIN_RUNTIME_SHA,
+    runtimeRef: env.BUILDCHAIN_RUNTIME_REF,
   };
 }

package/packages/core/dev-delivery/native/provider-boundary.js

@@ -7,7 +7,6 @@ import {
 import { readJson, writeJson } from "./files.js";
 export function verifyNativeProviderBoundary({
   directory: directoryInput,
-  runtimeSha,
   runtimeSelectionRoot,
   pullRequestNumber,
   sourceHead,
@@ -35,7 +34,6 @@ export function verifyNativeProviderBoundary({
         "producer.workflowRunId": run.id,
         "producer.workflowRunAttempt": run.attempt,
         "producer.job": nativeJob,
-        "runtime.resolvedSha": runtimeSha,
         "runtime.selectionRoot": runtimeSelectionRoot,
         "warrant.pullRequestNumber": pullRequestNumber,
         "warrant.sourceHead": sourceHead,

package/packages/core/dev-delivery/native/transactions.js

@@ -34,9 +34,8 @@ export function verifyAdmittedRuntimeSelection(
   const bytes = fs.readFileSync(file);
   const selection = JSON.parse(bytes);
   if (
-    selection.resolvedSha !== runtimeSha ||
     `sha256:${crypto.createHash("sha256").update(bytes).digest("hex")}` !==
-      runtimeSelectionRoot
+    runtimeSelectionRoot
   )
     throw new Error("Rooted runtime selection differs from admission");
   return selection;

package/packages/core/dev-delivery/queue/reconciliation-action.js

@@ -1,24 +1,20 @@
 import fs from "node:fs";
 import path from "node:path";
-import { installationRoot } from "../../runtime/installation-root.js";
 import { GitHubTwoPhaseClient } from "../../providers/dev-delivery/candidate.js";
 import { reconcileConfiguredDevMergeQueue } from "../merge-queue-policy.js";
-export async function reconcileMergeQueueAction(core, env) {
+export async function reconcileMergeQueueAction(
+  core,
+  env,
+  { reconcile = reconcileConfiguredDevMergeQueue } = {},
+) {
   const workspace = path.resolve(env.GITHUB_WORKSPACE);
-  if (
-    fs.realpathSync(installationRoot(import.meta.url)) !==
-    fs.realpathSync(workspace)
-  )
-    throw new Error(
-      "Merge queue policy must use the checked-out governed source implementation",
-    );
   const branch = core.getInput("branch", { required: true });
   const provider = new GitHubTwoPhaseClient({
     repository: env.GITHUB_REPOSITORY,
     token: core.getInput("token", { required: true }),
     apiUrl: env.GITHUB_API_URL || "https://api.github.com",
   });
-  const facts = await reconcileConfiguredDevMergeQueue({
+  const facts = await reconcile({
     api: {
       request: (method, endpoint, body) =>
         provider.request(`/${endpoint}`, { method, body }),

package/packages/core/dev-delivery/source-proof/predicates.js

@@ -27,9 +27,6 @@ export function sourceQualificationPredicates(input = {}) {
     .map((entry) => entry.trim())
     .filter(Boolean)
     .sort();
-  const runtimeRef = required(input.runtimeRef, "runtimeRef");
-  const runtimeSha = exactSha(input.runtimeSha, "runtimeSha");
-  const contractDigest = required(input.contractDigest, "contractDigest");
   const nodeVersion = required(input.nodeVersion, "nodeVersion");
   return {
     repository,
@@ -73,9 +70,6 @@ export function sourceQualificationPredicates(input = {}) {
     ),
     toolchainRoot: devDeliveryContentRoot({
       schema: "kungfu.buildchain.source-toolchain/v1",
-      runtimeRef,
-      runtimeSha,
-      contractDigest,
       nodeVersion,
     }),
     policyRoot: gitPathRoot(sourceHead, policyPaths, "source-policy", cwd),

package/packages/core/dev-delivery/source-proof/reuse.js

@@ -18,11 +18,9 @@ export function verifySourceQualificationReuse(input = {}) {
   const proof = readJson(input.sourceProofPath, "source proof");
   const receipt = readJson(input.controllerReceiptPath, "controller receipt");
   const expectedSourceSha = exactSha(input.sourceHead, "sourceHead");
-  const expectedRuntimeSha = exactSha(input.runtimeSha, "runtimeSha");
   const expectedRepository = required(input.repository, "repository");
   const receiptValidation = validateControllerReceipt(receipt, {
     expectedSourceSha,
-    expectedRuntimeSha,
   });
   if (
     !receiptValidation.ok ||

package/packages/core/dev-delivery/source-proof/seal.js

@@ -5,11 +5,9 @@ import { readJson, exactSha, required } from "./io.js";
 export function sealSourceQualificationProof(input = {}) {
   const receipt = readJson(input.controllerReceiptPath, "controller receipt");
   const expectedSourceSha = exactSha(input.sourceHead, "sourceHead");
-  const expectedRuntimeSha = exactSha(input.runtimeSha, "runtimeSha");
   const expectedRepository = required(input.repository, "repository");
   const validation = validateControllerReceipt(receipt, {
     expectedSourceSha,
-    expectedRuntimeSha,
   });
   if (
     !validation.ok ||

package/packages/core/governance/alpha-candidate/action.js

@@ -1,6 +1,5 @@
 import fs from "node:fs";
 import path from "node:path";
-import { command } from "../../runtime/action-process.mjs";
 import { installationRoot } from "../../runtime/installation-root.js";
 import { normalizeDevAlphaPatrolOptions } from "./options.js";
 import { runDevAlphaCandidatePatrol } from "./controller.js";
@@ -20,15 +19,7 @@ export async function reconcileAlphaCandidateAction(core, env) {
   const prior = settle
     ? JSON.parse(core.getInput("observation-json", { required: true }))
     : {};
-  const runtimeSha = command(
-    "git",
-    ["-C", installationRoot(import.meta.url), "rev-parse", "HEAD"],
-    { stdio: "pipe" },
-  ).trim();
-  if (settle && prior["runtime-sha"] !== runtimeSha)
-    throw new Error(
-      "Alpha settlement runtime differs from exact observation runtime",
-    );
+  const runtimeSha = env.BUILDCHAIN_RUNTIME_SHA;
   if (
     settle &&
     [

package/packages/core/governance/audit/actions.js

@@ -1,7 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
 import { getOctokit } from "@actions/github";
-import { installationRoot } from "../../runtime/installation-root.js";
 import {
   collectGovernanceEvidence,
   finalizeGovernanceEvidence,
@@ -17,8 +16,7 @@ export function collectGovernanceEvidenceAction(core, env) {
     repository: scoped ? env.GITHUB_REPOSITORY : "",
     targetRef:
       event.pull_request?.base?.ref || event.merge_group?.base_ref || "",
-    sourceSha: env.GITHUB_SHA,
-    runtimeRoot: installationRoot(import.meta.url),
+    runtimeSha: env.BUILDCHAIN_RUNTIME_SHA,
     workspace: env.GITHUB_WORKSPACE,
     token: core.getInput("token", { required: true }),
   });

package/packages/core/governance/audit/collection.js

@@ -10,7 +10,6 @@ import {
 import { createGovernanceReader } from "./github-reader.js";
 import {
   normalizeMembership,
-  resolveVerifierSourceRevision,
   addMinutes,
   repositoryVisibility,
   selectGithubGovernanceRepositories,
@@ -119,7 +118,6 @@ export function collectGithubGovernanceAudit({
   observedAt = new Date().toISOString(),
   ttlMinutes = 15,
   verifierSourceRevision = "",
-  root,
   token,
   api,
 } = {}) {
@@ -157,7 +155,7 @@ export function collectGithubGovernanceAudit({
   if (targetRef && selected.length !== 1) {
     throw new Error("--target-ref requires exactly one selected repository");
   }
-  const revision = resolveVerifierSourceRevision(root, verifierSourceRevision);
+  const revision = verifierSourceRevision;
   const verifier = {
     runtime: `node-${process.version}`,
     sourceRevision: revision,

package/packages/core/governance/audit/identity.js

@@ -12,41 +12,13 @@ export function normalizeMembership(result) {
       };
 }
 
-export function resolveVerifierSourceRevision(
-  root,
-  requested = "",
-  run = spawnSync,
-) {
+export function readVerifierSourceRevision(root, run = spawnSync) {
   const result = run("git", ["-C", root, "rev-parse", "HEAD"], {
     encoding: "utf8",
     timeout: 10_000,
   });
-  const revision = String(result.stdout || "").trim();
-  if (result.status !== 0 || !/^[0-9a-f]{40}$/i.test(revision)) {
-    throw new Error("verifier source revision is unavailable");
-  }
-  const cleanliness = run(
-    "git",
-    ["-C", root, "diff", "--quiet", "HEAD", "--"],
-    {
-      encoding: "utf8",
-      timeout: 10_000,
-    },
-  );
-  if (cleanliness.status !== 0) {
-    throw new Error("verifier checkout contains tracked drift");
-  }
-  const normalized = revision.toLowerCase();
-  if (
-    requested &&
-    (!/^[0-9a-f]{40}$/i.test(requested) ||
-      requested.toLowerCase() !== normalized)
-  ) {
-    throw new Error(
-      "requested verifier source revision does not match the current checkout",
-    );
-  }
-  return normalized;
+  if (result.status !== 0) throw new Error("verifier source provenance is unavailable");
+  return String(result.stdout || "").trim();
 }
 
 export function addMinutes(iso, minutes) {

package/packages/core/governance/audit/transactions.js

@@ -8,8 +8,7 @@ export function collectGovernanceEvidence(
     organization,
     repository,
     targetRef,
-    sourceSha,
-    runtimeRoot,
+    runtimeSha,
     workspace,
     token,
   },
@@ -19,8 +18,7 @@ export function collectGovernanceEvidence(
     organization,
     repository,
     targetRef,
-    verifierSourceRevision: sourceSha,
-    root: runtimeRoot,
+    verifierSourceRevision: runtimeSha,
     token,
   });
   const { qualifyingCount, nonQualifyingCount } = result.inventory;

package/packages/core/governance/buildchain-publication-authority.js

@@ -58,7 +58,6 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/public-release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
   [".github/workflows/self-build-release-verify-compat.yml", "governance-write"],
   [".github/workflows/public-ops-stable-candidate-patrol.yml", "governance-write"],
-  [".github/workflows/public-ops-bootstrap-recovery.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
   [".github/workflows/self-ops-bootstrap-dogfood.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
   [".github/workflows/self-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
 ]);

package/packages/core/governance/commands/audit-github-governance.mjs

@@ -5,6 +5,7 @@ import { fileURLToPath } from "node:url";
 import { installationRoot } from "../../runtime/installation-root.js";
 import { BUILDCHAIN_GITHUB_GOVERNANCE_AUTHORITY } from "../github-governance-authority.js";
 import { collectGithubGovernanceAudit } from "../audit/collection.js";
+import { readVerifierSourceRevision } from "../audit/identity.js";
 function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
   return index === -1 ? fallback : String(args[index + 1] || "");
@@ -16,13 +17,13 @@ function hasFlag(args, name) {
 
 function main(args = process.argv.slice(2)) {
   const result = collectGithubGovernanceAudit({
-    root: installationRoot(import.meta.url), token: process.env.GH_TOKEN || process.env.GITHUB_TOKEN,
+    token: process.env.GH_TOKEN || process.env.GITHUB_TOKEN,
     organization: flag(args, "organization", BUILDCHAIN_GITHUB_GOVERNANCE_AUTHORITY.organization),
     repository: flag(args, "repository"),
     targetRef: flag(args, "target-ref"),
     observedAt: flag(args, "observed-at", new Date().toISOString()),
     ttlMinutes: Number(flag(args, "ttl-minutes", "15")),
-    verifierSourceRevision: flag(args, "source-revision"),
+    verifierSourceRevision: process.env.BUILDCHAIN_RUNTIME_SHA || readVerifierSourceRevision(installationRoot(import.meta.url)),
   });
   const output = flag(args, "output");
   const serialized = `${JSON.stringify(result, null, 2)}\n`;

package/packages/core/governance/github-governance-authority.js

@@ -888,7 +888,6 @@ export function verifyGithubGovernanceReceipt(receipt, {
   expectedRepositoryIdentityRoot,
   expectedTargetRef,
   expectedPolicyRoot,
-  expectedVerifierSourceRevision,
   now = new Date().toISOString(),
 } = {}) {
   if (receipt?.contract !== GITHUB_GOVERNANCE_RECEIPT_CONTRACT) {
@@ -917,10 +916,6 @@ export function verifyGithubGovernanceReceipt(receipt, {
   if (expectedPolicyRoot && receipt.policyRoot !== expectedPolicyRoot) {
     throw new Error("GitHub governance receipt policy root mismatch");
   }
-  if (expectedVerifierSourceRevision &&
-      receipt.verifier?.sourceRevision !== expectedVerifierSourceRevision) {
-    throw new Error("GitHub governance receipt verifier source revision mismatch");
-  }
   const observed = Date.parse(receipt.observedAt);
   const expires = Date.parse(receipt.expiresAt);
   const instant = Date.parse(now);

package/packages/core/governance/receipt-admission.js

@@ -1,4 +1,3 @@
-import { command } from "../runtime/action-process.mjs";
 import {
   BUILDCHAIN_GITHUB_GOVERNANCE_AUTHORITY,
   verifyGithubGovernanceReceipt,
@@ -6,29 +5,15 @@ import {
 
 export function admitGithubGovernanceReceipt(
   { receipt, repository, targetRef, runtimeRoot, runtimeSha },
-  execute = command,
 ) {
   if (!receipt)
     throw new Error(
       "Production publication requires a fresh GitHub governance receipt",
     );
-  const actual = execute("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], {
-    stdio: "pipe",
-  })
-    .trim()
-    .toLowerCase();
-  if (
-    !/^[0-9a-f]{40}$/.test(actual) ||
-    actual !== String(runtimeSha).toLowerCase()
-  )
-    throw new Error(
-      "Governance verifier checkout does not match the exact Buildchain runtime",
-    );
   return verifyGithubGovernanceReceipt(receipt, {
     expectedOrganization: BUILDCHAIN_GITHUB_GOVERNANCE_AUTHORITY.organization,
     expectedRepository: repository,
     expectedTargetRef: targetRef,
     expectedPolicyRoot: BUILDCHAIN_GITHUB_GOVERNANCE_AUTHORITY.policyRoot,
-    expectedVerifierSourceRevision: actual,
   });
 }

package/packages/core/index.js

@@ -624,7 +624,7 @@ export {
 
 export * from "./release/release-propagation.js";
 export * from "./consumer/floating-consumer-policy.js";
-export * from "./consumer/runtime-ref-resume-authority.js";
+export * from "./release/recovery/lineage.js";
 export * from "./publication/publication-qualification.js";
 
 export {

package/packages/core/observability/controller/identity.js

@@ -2,15 +2,14 @@ import fs from "node:fs";
 import path from "node:path";
 import { command } from "../../runtime/action-process.mjs";
 export function controllerCheckoutIdentity(
-  { workspace, runtimeRoot },
+  { workspace, runtimeRoot, runtimeSha = process.env.BUILDCHAIN_RUNTIME_SHA },
   execute = command,
 ) {
   const sha = (directory) =>
     execute("git", ["-C", directory, "rev-parse", "HEAD"], {
       stdio: "pipe",
     }).trim();
-  const sourceSha = sha(workspace),
-    runtimeSha = sha(runtimeRoot);
+  const sourceSha = sha(workspace);
   const contract = JSON.parse(
     fs.readFileSync(
       path.join(runtimeRoot, "dist/site/buildchain-contract.json"),
@@ -18,11 +17,11 @@ export function controllerCheckoutIdentity(
     ),
   );
   if (
-    ![sourceSha, runtimeSha].every((value) => /^[0-9a-f]{40}$/.test(value)) ||
+    !/^[0-9a-f]{40}$/.test(sourceSha) ||
     !/^sha256:[0-9a-f]{64}$/.test(contract.contractDigest)
   )
     throw new Error(
-      "Exact source, runtime and contract identities are required",
+      "Exact source and contract evidence are required",
     );
   return {
     "source-sha": sourceSha,

package/packages/core/observability/controller-evidence.js

@@ -304,7 +304,7 @@ export function createControllerPlan({ descriptor, source = {}, runtime = {}, in
     },
     runtime: {
       ref: nonEmptyString(runtime.ref, "runtime.ref"),
-      sha: exactSha(runtime.sha, "runtime.sha"),
+      sha: runtime.sha,
       contractDigest: sha256Digest(runtime.contractDigest, "runtime.contractDigest"),
     },
     inputs: normalizedInputs.normalized,
@@ -326,7 +326,7 @@ export function validateControllerPlan(plan) {
   if (plan.contract !== BUILDCHAIN_CONTROLLER_EVIDENCE_CONTRACT) issues.push(`plan contract must be ${BUILDCHAIN_CONTROLLER_EVIDENCE_CONTRACT}`);
   if (plan.kind !== "plan") issues.push("plan kind must be plan");
   if (!GIT_SHA_PATTERN.test(String(plan.source?.sha || ""))) issues.push("plan source SHA must be exact");
-  if (!GIT_SHA_PATTERN.test(String(plan.runtime?.sha || ""))) issues.push("plan runtime SHA must be exact");
+
   if (!SHA256_PATTERN.test(String(plan.runtime?.contractDigest || ""))) issues.push("plan runtime contract digest is invalid");
   if (plan.digest !== digestDocument(plan)) issues.push("plan digest mismatch");
   for (const [name, input] of Object.entries(plan.inputs || {})) {
@@ -421,7 +421,6 @@ export function createControllerReceipt({ plan, stages = [], evidence = [], reas
 export function validateControllerReceipt(receipt, {
   plan = undefined,
   expectedSourceSha = "",
-  expectedRuntimeSha = "",
   expectedPlanDigest = "",
 } = {}) {
   const issues = [];
@@ -431,14 +430,14 @@ export function validateControllerReceipt(receipt, {
   if (receipt.digest !== digestDocument(receipt)) issues.push("receipt digest mismatch");
   if (receipt.status === "passed" && receipt.reason) issues.push("passed controller receipt must not declare a failure reason");
   issues.push(...(receipt.issues || []));
+
   if (plan) {
     if (receipt.planDigest !== plan.digest) issues.push("receipt plan digest mismatch");
     if (receipt.controller?.id !== plan.controller?.id) issues.push("receipt controller mismatch");
     if (receipt.source?.sha !== plan.source?.sha) issues.push("receipt source SHA mismatch");
-    if (receipt.runtime?.sha !== plan.runtime?.sha) issues.push("receipt runtime SHA mismatch");
   }
   if (expectedSourceSha && receipt.source?.sha !== expectedSourceSha) issues.push("receipt source SHA mismatch");
-  if (expectedRuntimeSha && receipt.runtime?.sha !== expectedRuntimeSha) issues.push("receipt runtime SHA mismatch");
+
   if (expectedPlanDigest && receipt.planDigest !== expectedPlanDigest) issues.push("receipt plan digest mismatch");
   const qualifying = issues.length === 0 && receipt.qualifying === true && receipt.status === "passed";
   return { ok: issues.length === 0, qualifying, issues };
@@ -503,7 +502,6 @@ export function createControllerReceiptReference(receipt) {
 export function validateControllerReceiptReference(reference, {
   expectedSourceSha = "",
   acceptedSourceShas = [],
-  expectedRuntimeSha = "",
   requirePassed = false,
 } = {}) {
   const issues = [];
@@ -514,7 +512,6 @@ export function validateControllerReceiptReference(reference, {
   if (!SHA256_PATTERN.test(String(reference.planDigest || ""))) issues.push("controller receipt reference plan digest is invalid");
   if (!SHA256_PATTERN.test(String(reference.receiptDigest || ""))) issues.push("controller receipt reference receipt digest is invalid");
   if (!GIT_SHA_PATTERN.test(String(reference.sourceSha || ""))) issues.push("controller receipt reference source SHA is invalid");
-  if (!GIT_SHA_PATTERN.test(String(reference.runtimeSha || ""))) issues.push("controller receipt reference runtime SHA is invalid");
   if (!["passed", "failed", "skipped", "partial"].includes(String(reference.status || ""))) {
     issues.push("controller receipt reference status is invalid");
   }
@@ -523,7 +520,7 @@ export function validateControllerReceiptReference(reference, {
   if (allowedSourceShas.size > 0 && !allowedSourceShas.has(reference.sourceSha)) {
     issues.push("controller receipt reference source SHA mismatch");
   }
-  if (expectedRuntimeSha && reference.runtimeSha !== expectedRuntimeSha) issues.push("controller receipt reference runtime SHA mismatch");
+
   return { ok: issues.length === 0, issues };
 }
 
@@ -532,7 +529,6 @@ export function normalizeControllerReceiptReferences({
   references = [],
   expectedSourceSha = "",
   acceptedSourceShas = [],
-  expectedRuntimeSha = "",
   requirePassed = false,
 } = {}) {
   const normalized = [
@@ -544,7 +540,6 @@ export function normalizeControllerReceiptReferences({
     const validation = validateControllerReceiptReference(reference, {
       expectedSourceSha,
       acceptedSourceShas,
-      expectedRuntimeSha,
       requirePassed,
     });
     if (!validation.ok) throw new Error(`controller receipt reference is invalid: ${validation.issues.join("; ")}`);