@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/packages/core/paper/commands/paper.mjs

@@ -42,7 +42,7 @@ function usage() {
   buildchain paper alpha [--cwd <dir>] [--source-ref <ref>] [--target-ref <ref>]
                           [--execute] [--json]
   buildchain paper status [--cwd <dir>] [--json]
-  buildchain paper resume [--cwd <dir>] [--buildchain-ref <ref>]
+  buildchain paper resume [--cwd <dir>] [--runtime-ref <ref>]
                            [--execute] [--json]
 
 Safety:
@@ -389,7 +389,7 @@ function executeAlphaPlan(plan) {
   };
 }
 
-function executeResumePlan(plan, buildchainRef) {
+function executeResumePlan(plan, runtimeRef) {
   if (!plan.resumable || !plan.transaction?.targetRef) {
     return {
       ...plan,
@@ -404,8 +404,8 @@ function executeResumePlan(plan, buildchainRef) {
     "--ref",
     plan.transaction.targetRef,
   ];
-  if (buildchainRef) {
-    args.push("-f", `buildchain-ref=${buildchainRef}`);
+  if (runtimeRef) {
+    args.push("-f", `runtime-ref=${runtimeRef}`);
   }
   const dispatched = commandResult("gh", args, { cwd: plan.cwd });
   if (!dispatched.ok) {
@@ -569,10 +569,10 @@ export async function runPaperCli(
         ? executeAlphaPlan(plan)
         : plan;
     } else if (command === "resume") {
-      const runtimeRef = readFlag(effectiveArgs, "buildchain-ref", "");
+      const runtimeRef = readFlag(effectiveArgs, "runtime-ref", "");
       const plan = createPaperResumePlan({
         cwd,
-        buildchainRef: runtimeRef,
+        runtimeRef,
       });
       result = hasFlag(effectiveArgs, "execute")
         ? executeResumePlan(plan, runtimeRef)

package/packages/core/paper/operations/plans.js

@@ -133,7 +133,7 @@ export function createPaperAlphaPlan({
 }
 export function createPaperResumePlan({
   cwd = process.cwd(),
-  buildchainRef = "",
+  runtimeRef = "",
 } = {}) {
   const resolvedCwd = path.resolve(cwd);
   const status = collectPaperStatus({ cwd: resolvedCwd });
@@ -179,7 +179,7 @@ export function createPaperResumePlan({
   const command = [
     "gh workflow run .github/workflows/public-release-paper.yml",
     targetRef ? `--ref ${targetRef}` : "",
-    buildchainRef ? `-f buildchain-ref=${buildchainRef}` : "",
+    runtimeRef ? `-f runtime-ref=${runtimeRef}` : "",
   ]
     .filter(Boolean)
     .join(" ");

package/packages/core/paper/operations/provisioning-validation.js

@@ -51,7 +51,7 @@ export function validatePaperProvisioningAuthority(cwd) {
   }
   if (
     !GIT_SHA_PATTERN.test(String(value.runtime?.resolvedSha || "")) ||
-    (!floating && value.runtime?.ref !== value.runtime?.resolvedSha) ||
+    !floating ||
     value.admission?.acceptedRef !== value.runtime?.ref ||
     value.admission?.acceptedSha !== value.runtime?.resolvedSha
   ) {

package/packages/core/paper/operations/scaffold-workflows.js

@@ -1,12 +1,17 @@
 import { nextDevelopmentWorkflowHeader } from "../../release/next-development-projection.js";
 export function scaffoldBuildWorkflow(
-  buildchainSha,
+  entryRef,
   { artifactName = "paper-publication" } = {},
 ) {
   return `${nextDevelopmentWorkflowHeader()}name: Build
 
 on:
   workflow_dispatch:
+    inputs:
+      runtime-ref:
+        description: Transient execution runtime; empty selects the consumer lock.
+        required: false
+        default: ""
   pull_request:
   push:
     branches:
@@ -20,16 +25,16 @@ permissions:
 
 jobs:
   publication:
-    uses: kungfu-systems/buildchain/.github/workflows/public-build-publication.yml@${buildchainSha}
+    uses: kungfu-systems/buildchain/.github/workflows/public-build-publication.yml@${entryRef}
     with:
-      buildchain-ref: ${buildchainSha}
-      buildchain-contract-lock-path: .buildchain/contract-lock.json
+      runtime-ref: \${{ inputs.runtime-ref || '' }}
+      contract-lock: .buildchain/contract-lock.json
       toolchain-type: config
       verify-command: make check
       artifact-name: ${JSON.stringify(artifactName)}
 `;
 }
-export function scaffoldVerifyWorkflow(buildchainSha, buildchainVersion = "") {
+export function scaffoldVerifyWorkflow(entryRef) {
   return `${nextDevelopmentWorkflowHeader()}name: Verify
 
 on:
@@ -40,21 +45,28 @@ on:
       - "alpha/v*/v*"
       - "release/v*/v*"
   workflow_dispatch:
+    inputs:
+      runtime-ref:
+        description: Transient execution runtime; empty selects the consumer lock.
+        required: false
+        default: ""
 
 permissions:
-${buildchainVersion.startsWith("4.") ? "  actions: read\n  contents: read\n  pull-requests: read" : "  contents: read"}
+  actions: read
+  contents: read
+  pull-requests: read
 
 jobs:
   check:
-    uses: kungfu-systems/buildchain/.github/workflows/public-build-check.yml@${buildchainSha}
+    uses: kungfu-systems/buildchain/.github/workflows/public-build-check.yml@${entryRef}
     with:
-      buildchain-ref: ${buildchainSha}
+      runtime-ref: \${{ inputs.runtime-ref || '' }}
       require-version-state: true
       upload-artifacts: true
 `;
 }
 export function scaffoldReleaseWorkflow(
-  buildchainSha,
+  entryRef,
   { artifactPaths = "_build/main.pdf", releasePassportProductName = "" } = {},
 ) {
   const passportInput = releasePassportProductName
@@ -64,6 +76,11 @@ export function scaffoldReleaseWorkflow(
 
 on:
   workflow_dispatch:
+    inputs:
+      runtime-ref:
+        description: Transient execution runtime; empty selects the consumer lock.
+        required: false
+        default: ""
   push:
     branches:
       - "alpha/**"
@@ -74,7 +91,7 @@ permissions:
 
 jobs:
   paper-release:
-    uses: kungfu-systems/buildchain/.github/workflows/public-release-paper.yml@${buildchainSha}
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-paper.yml@${entryRef}
     permissions:
       actions: read
       checks: write
@@ -83,8 +100,8 @@ jobs:
       issues: write
       pull-requests: write
     with:
-      buildchain-ref: ${buildchainSha}
-      buildchain-contract-lock-path: .buildchain/contract-lock.json
+      runtime-ref: \${{ inputs.runtime-ref || '' }}
+      contract-lock: .buildchain/contract-lock.json
       publisher-workflow-path: .github/workflows/public-release-paper.yml
       toolchain-type: config
       verify-command: make check

package/packages/core/paper/operations/scaffold.js

@@ -77,17 +77,14 @@ export function scaffoldFiles({
     acceptedAt,
   });
   const contractLockText = jsonText(contractLock);
-  const buildWorkflow = scaffoldBuildWorkflow(buildchainSha, {
+  const buildWorkflow = scaffoldBuildWorkflow("v4-alpha", {
     artifactName: name,
   });
-  const releaseWorkflow = scaffoldReleaseWorkflow(buildchainSha, {
+  const releaseWorkflow = scaffoldReleaseWorkflow("v4-alpha", {
     artifactPaths: "_build/main.pdf",
     releasePassportProductName: title,
   });
-  const verifyWorkflow = scaffoldVerifyWorkflow(
-    buildchainSha,
-    buildchainVersion,
-  );
+  const verifyWorkflow = scaffoldVerifyWorkflow("v4-alpha");
   const agentEntry = paperAgentEntryFiles({
     cwd,
     buildchainVersion,
@@ -109,7 +106,7 @@ export function scaffoldFiles({
     agentInstructions: agentEntry.get(PAPER_PATHS.agentInstructions),
   });
   const licenseText = runtimeLicenseText(buildchainRoot);
-  return new Map([
+  const files = new Map([
     [
       PAPER_PATHS.config,
       scaffoldConfig({
@@ -155,6 +152,15 @@ export function scaffoldFiles({
       "node_modules/\n_build/\n.buildchain/publication/\n.buildchain/release-state/\n.buildchain/release-evidence/\n.buildchain/paper/npm-bootstrap.json\n.buildchain/paper/npm-trust.json\n",
     ],
   ]);
+  return finalizePaperEntryFiles({
+    files,
+    cwd,
+    buildchainRoot,
+    buildchainVersion,
+    buildchainSha,
+    contractLock,
+    provisioningAuthority,
+  });
 }
 export function migrationFiles({
   cwd,
@@ -207,17 +213,14 @@ export function migrationFiles({
     runtimeSha,
   });
   const contractLockText = jsonText(contractLock);
-  const buildWorkflow = scaffoldBuildWorkflow(runtimeSha, {
+  const buildWorkflow = scaffoldBuildWorkflow("v4-alpha", {
     artifactName: config.project.name,
   });
-  const releaseWorkflow = scaffoldReleaseWorkflow(runtimeSha, {
+  const releaseWorkflow = scaffoldReleaseWorkflow("v4-alpha", {
     artifactPaths: config.publication.artifactPaths.join(","),
     releasePassportProductName: config.publication.title,
   });
-  const verifyWorkflow = scaffoldVerifyWorkflow(
-    runtimeSha,
-    runtimeIdentity.version,
-  );
+  const verifyWorkflow = scaffoldVerifyWorkflow("v4-alpha");
   const agentEntry = paperAgentEntryFiles({
     cwd,
     buildchainVersion: runtimeIdentity.version,
@@ -275,62 +278,17 @@ export function migrationFiles({
       ),
     ],
   ]);
-  if (runtimeIdentity.version.startsWith("4.")) {
-    const channelPlan = paperChannels({
-      cwd,
-      buildchainRoot,
-      buildchainVersion: runtimeIdentity.version,
-      buildchainSha: runtimeSha,
-      contractWorld: runtimeContractWorld(buildchainRoot),
-      acceptedAt: contractLock.buildchain.acceptedAt,
-      stableBuildchainRoot,
-      alphaBuildchainRoot,
-    });
-    for (const channel of Object.values(channelPlan.channels))
-      files.set(channel.lockPath, channel.content);
-    for (const workflowPath of [
-      PAPER_PATHS.buildWorkflow,
-      PAPER_PATHS.verifyWorkflow,
-    ]) {
-      files.set(
-        workflowPath,
-        files
-          .get(workflowPath)
-          .replaceAll(runtimeSha, "v4-alpha")
-          .replaceAll(
-            ".buildchain/contract-lock.json",
-            ".buildchain/alpha-contract-lock.json",
-          ),
-      );
-    }
-    const releaseStart = releaseWorkflow.indexOf("  paper-release:\n");
-    const releaseJob = releaseWorkflow.slice(releaseStart);
-    const alphaJob = releaseJob
-      .replace(
-        "  paper-release:\n",
-        "  paper-release-alpha:\n    if: ${{ startsWith(github.ref_name, 'alpha/') }}\n",
-      )
-      .replaceAll(runtimeSha, "v4-alpha")
-      .replaceAll(
-        ".buildchain/contract-lock.json",
-        ".buildchain/alpha-contract-lock.json",
-      );
-    const stableJob = releaseJob
-      .replace(
-        "  paper-release:\n",
-        "  paper-release:\n    if: ${{ startsWith(github.ref_name, 'release/') }}\n",
-      )
-      .replaceAll(runtimeSha, "v4");
-    files.set(
-      PAPER_PATHS.releaseWorkflow,
-      `${releaseWorkflow.slice(0, releaseStart)}${alphaJob}\n${stableJob}`,
-    );
-    files.set(
-      PAPER_PATHS.provisioningAuthority,
-      jsonText(bindPaperAuthority(provisioningAuthority, channelPlan, files)),
-    );
-  }
-  return files;
+  return finalizePaperEntryFiles({
+    files,
+    cwd,
+    buildchainRoot,
+    buildchainVersion: runtimeIdentity.version,
+    buildchainSha: runtimeSha,
+    contractLock,
+    provisioningAuthority,
+    stableBuildchainRoot,
+    alphaBuildchainRoot,
+  });
 }
 export const {
   planPaperMigration,
@@ -368,3 +326,73 @@ function migrationContractLock({
           ),
   });
 }
+
+function finalizePaperEntryFiles({
+  files,
+  cwd,
+  buildchainRoot,
+  buildchainVersion,
+  buildchainSha,
+  contractLock,
+  provisioningAuthority,
+  stableBuildchainRoot,
+  alphaBuildchainRoot,
+}) {
+  if (!buildchainVersion.startsWith("4."))
+    throw new Error("Paper provisioning requires a Buildchain v4 runtime");
+  const channelPlan = paperChannels({
+    cwd,
+    buildchainRoot,
+    buildchainVersion: buildchainVersion,
+    buildchainSha: buildchainSha,
+    contractWorld: runtimeContractWorld(buildchainRoot),
+    acceptedAt: contractLock.buildchain.acceptedAt,
+    stableBuildchainRoot,
+    alphaBuildchainRoot,
+  });
+  for (const channel of Object.values(channelPlan.channels))
+    files.set(channel.lockPath, channel.content);
+  for (const workflowPath of [
+    PAPER_PATHS.buildWorkflow,
+    PAPER_PATHS.verifyWorkflow,
+  ]) {
+    files.set(
+      workflowPath,
+      files
+        .get(workflowPath)
+
+        .replaceAll(
+          ".buildchain/contract-lock.json",
+          ".buildchain/alpha-contract-lock.json",
+        ),
+    );
+  }
+  const releaseWorkflow = files.get(PAPER_PATHS.releaseWorkflow);
+  const releaseStart = releaseWorkflow.indexOf("  paper-release:\n");
+  const releaseJob = releaseWorkflow.slice(releaseStart);
+  const alphaJob = releaseJob
+    .replace(
+      "  paper-release:\n",
+      "  paper-release-alpha:\n    if: ${{ startsWith(github.ref_name, 'alpha/') }}\n",
+    )
+
+    .replaceAll(
+      ".buildchain/contract-lock.json",
+      ".buildchain/alpha-contract-lock.json",
+    );
+  const stableJob = releaseJob
+    .replace(
+      "  paper-release:\n",
+      "  paper-release:\n    if: ${{ startsWith(github.ref_name, 'release/') }}\n",
+    )
+    .replaceAll("@v4-alpha", "@v4");
+  files.set(
+    PAPER_PATHS.releaseWorkflow,
+    `${releaseWorkflow.slice(0, releaseStart)}${alphaJob}\n${stableJob}`,
+  );
+  files.set(
+    PAPER_PATHS.provisioningAuthority,
+    jsonText(bindPaperAuthority(provisioningAuthority, channelPlan, files)),
+  );
+  return files;
+}

package/packages/core/paper/paper-agent-entry.js

@@ -1,6 +1,5 @@
 import fs from "node:fs";
 import path from "node:path";
-import { paperRuntimeSourceMatches } from "./paper-runtime-channels.js";
 
 import {
   PAPER_PATHS,
@@ -281,14 +280,11 @@ export function collectPaperAgentEntry({
   buildchainSha = "",
   mode = "contract",
   env = process.env,
-  runtimeAdmission,
 } = {}) {
   const resolvedCwd = path.resolve(cwd);
   const developmentRef = paperDevelopmentRef(resolvedCwd);
   const source = readJson(path.resolve(resolvedCwd, PAPER_PATHS.agentEntry));
   const entry = source.value || {};
-  const effectiveBuildchainSha =
-    buildchainSha || String(entry.runtime?.sourceSha || "");
   const packageJson =
     readJson(path.resolve(resolvedCwd, "package.json")).value || {};
   const pinPath = path.resolve(resolvedCwd, PAPER_PATHS.versionPin);
@@ -334,13 +330,6 @@ export function collectPaperAgentEntry({
       "The agent-entry contract, version pin, and exact Buildchain dependency agree.",
       "buildchain paper migrate --write --json && pnpm install --lockfile-only",
     ),
-    workCheck(
-      "agent-entry.runtime-source",
-      GIT_SHA_PATTERN.test(effectiveBuildchainSha) &&
-        paperRuntimeSourceMatches(entry.runtime, effectiveBuildchainSha, mode, runtimeAdmission),
-      "The executing Buildchain source is pinned locally or admitted by its v4 channel contract in CI.",
-      "buildchain paper migrate --write --json",
-    ),
     workCheck(
       "agent-entry.development-ref",
       entry.repository?.developmentRef === developmentRef &&

package/packages/core/paper/paper-runtime-channels.js

@@ -3,7 +3,6 @@ import path from "node:path";
 import {
   createBuildchainContractLock,
   createBuildchainContractWorld,
-  finalizeBuildchainContractWorld,
   readBuildchainContractWorld,
 } from "../contracts/buildchain-contract.js";
 import {
@@ -94,12 +93,10 @@ function workflowErrors(cwd, authority, workflow) {
     return ["paper workflow authority is incomplete"];
   if (!fileDigestMatches(cwd, workflow.path, workflow.sourceDigest))
     return [`paper workflow source digest mismatch: ${workflow.path}`];
-  const floating = /^v4(?:-alpha)?$/.test(authority.runtime?.ref || "");
-  const refs = floating
-    ? workflow.reusablePath === ".github/workflows/public-release-paper.yml"
+  const refs =
+    workflow.reusablePath === ".github/workflows/public-release-paper.yml"
       ? ["v4-alpha", "v4"]
-      : ["v4-alpha"]
-    : [authority.runtime.resolvedSha];
+      : ["v4-alpha"];
   const text = fs.readFileSync(path.resolve(cwd, workflow.path), "utf8");
   const errors = [];
   if (
@@ -113,13 +110,11 @@ function workflowErrors(cwd, authority, workflow) {
     errors.push(
       `paper workflow reusable source is not exact: ${workflow.path}`,
     );
+  if (/^\s*buildchain-ref:/mu.test(text))
+    errors.push(
+      `paper workflow has a retired runtime selector: ${workflow.path}`,
+    );
   if (
-    (floating || workflow.reusablePath !== ".github/workflows/public-build-check.yml") &&
-    refs.some((ref) => !text.includes(`buildchain-ref: ${ref}\n`))
-  )
-    errors.push(`paper workflow runtime input is not exact: ${workflow.path}`);
-  if (
-    floating &&
     [
       ...text.matchAll(/uses:\s*kungfu-systems\/buildchain\/[^\s@]+@([^\s]+)/g),
     ].some((match) => !refs.includes(match[1]))
@@ -161,7 +156,7 @@ export function paperProvisioningWorkflowErrors(cwd, authority) {
     )
   )
     errors.push("paper contract lock bytes differ from provisioning authority");
-  if (/^v4(?:-alpha)?$/.test(authority.runtime?.ref || "")) {
+  {
     for (const [ref, lockPath] of [
       ["v4", ".buildchain/contract-lock.json"],
       ["v4-alpha", PAPER_ALPHA_LOCK],
@@ -175,24 +170,19 @@ export function paperProvisioningWorkflowErrors(cwd, authority) {
   return errors;
 }
 
-export function paperRuntimeSourceMatches(runtime, sha, mode, admission) {
-  return (
-    runtime?.sourceSha === sha ||
-    (mode === "ci" &&
-      /^4\./.test(runtime?.version || "") &&
-      ([runtime?.channels?.v4, runtime?.channels?.["v4-alpha"]].includes(sha) ||
-        (admission?.compatible === true &&
-          admission.sha === sha &&
-          /^v4(?:-alpha)?$/.test(admission.ref))))
-  );
-}
-
 export function selectPaperRuntime(runtime, authority) {
-  const channel = Object.values(authority?.admission?.channels || {}).find(
-    (entry) => entry.resolvedSha === runtime.resolvedSha,
-  );
-  const ref =
-    channel?.ref || (runtime.version.includes("-") ? "v4-alpha" : "v4");
+  const preferredRef =
+    authority?.runtime?.ref ||
+    (runtime.version.includes("-") ? "v4-alpha" : "v4");
+  const channels = authority?.admission?.channels || {};
+  const preferred = channels[preferredRef];
+  const channel =
+    preferred?.resolvedSha === runtime.resolvedSha
+      ? preferred
+      : Object.values(channels).find(
+          (entry) => entry.resolvedSha === runtime.resolvedSha,
+        );
+  const ref = channel?.ref || preferredRef;
   return authority?.admission?.channels?.[ref] ? { ...runtime, ref } : runtime;
 }
 
@@ -204,39 +194,6 @@ export function paperRuntimeLockPath(cwd, runtime, authority) {
   );
 }
 
-function channelWorld(root, ref, current) {
-  if (current) return current;
-  const sha = gitValue(root, [
-    "rev-parse",
-    "--verify",
-    `refs/tags/${ref}^{commit}`,
-  ]);
-  const text =
-    sha &&
-    gitValue(root, ["show", `${sha}:dist/site/buildchain-contract.json`]);
-  if (!/^[0-9a-f]{40}$/.test(sha) || !text) {
-    throw new Error(
-      `Paper migration needs the fetched ${ref} tag or an explicit ${ref === "v4" ? "stable" : "alpha"} Buildchain root`,
-    );
-  }
-  const published = JSON.parse(text);
-  if (!Array.isArray(published.compatibilityFacts)) {
-    throw new Error(`Paper ${ref} needs the current Buildchain contract format`);
-  }
-  const world = finalizeBuildchainContractWorld(published);
-  if (
-    published.contractDigest !== world.contractDigest ||
-    published.compatibilityDigest !== world.compatibilityDigest
-  ) {
-    throw new Error(`Paper ${ref} contract digest mismatch`);
-  }
-  return {
-    sha,
-    world,
-    acceptedAt: gitValue(root, ["show", "-s", "--format=%cI", sha]),
-  };
-}
-
 function explicitWorld(root, ref) {
   const sha = gitValue(root, ["rev-parse", "HEAD"]);
   if (!/^[0-9a-f]{40}$/.test(sha))
@@ -281,9 +238,7 @@ export function paperChannels({
     ["v4", ".buildchain/contract-lock.json", stableBuildchainRoot],
     ["v4-alpha", PAPER_ALPHA_LOCK, alphaBuildchainRoot],
   ]) {
-    const resolved = explicitRoot
-      ? explicitWorld(explicitRoot, ref)
-      : channelWorld(buildchainRoot, ref, ref === selectedRef ? current : null);
+    const resolved = explicitRoot ? explicitWorld(explicitRoot, ref) : current;
     if (resolved.world.majorLine !== "v4")
       throw new Error(`Paper ${ref} contract must belong to v4`);
     const existing = readJson(path.join(cwd, lockPath)).value;

package/packages/core/paper/paper-scaffold-content.js

@@ -181,7 +181,7 @@ function planPaperScaffold(
     cwd = process.cwd(),
     buildchainRoot = process.cwd(),
     buildchainVersion = "",
-    buildchainRef = "v3",
+    buildchainRef = "v4",
     buildchainSha = "",
     name = path.basename(path.resolve(cwd)),
     title = "",

package/packages/core/paper/paper.js

@@ -43,6 +43,15 @@ import {
   paperPreflightPublicationChecks,
   paperPreflightNextActions,
 } from "./operations/preflight-checks.js";
+export function collectPaperSourcePolicy({ cwd = process.cwd() } = {}) {
+  const agentEntry = collectPaperAgentEntry({ cwd, mode: "ci" });
+  const provisioning = validatePaperProvisioningAuthority(cwd);
+  const checks = [...agentEntry.checks, { id: "provisioning.authority", status: provisioning.valid ? "pass" : "fail", message: provisioning.errors.join("; ") }];
+  try { validateBuildchainConfig(cwd, { requireLifecycleStages: ["verify"] }); }
+  catch (error) { checks.push({ id: "config.publication", status: "fail", message: error.message }); }
+  return { ok: checks.every(check => check.status === "pass" || check.status === "skip"), checks };
+}
+
 export function collectPaperPreflight({
   cwd = process.cwd(),
   buildchainRoot = process.cwd(),
@@ -110,11 +119,6 @@ export function collectPaperPreflight({
     cwd: resolvedCwd,
     buildchainSha: runtime.resolvedSha,
     mode: agentEntryMode,
-    runtimeAdmission: {
-      compatible: lockEvaluation.compatible,
-      sha: runtime.resolvedSha,
-      ref: runtime.ref,
-    },
   });
   const source = {
     repositoryRoot: gitValue(resolvedCwd, ["rev-parse", "--show-toplevel"]),

package/packages/core/paper/publication/candidate.js

@@ -32,15 +32,6 @@ export function verifyAdmittedCandidate({
   })
     .trim()
     .toLowerCase();
-  const actualRuntimeSha = execFileSync(
-    "git",
-    ["-C", runtimeRoot, "rev-parse", "HEAD"],
-    { encoding: "utf8" },
-  )
-    .trim()
-    .toLowerCase();
-  if (actualRuntimeSha !== runtimeSha)
-    throw new Error("admitted paper runtime checkout mismatch");
   const bundle = buildPublicationArtifactCandidate({
     artifactRoot: root,
     controllerRoot: path.join(workspace, ".buildchain/admitted/controller"),

package/packages/core/paper/publication-controller.js

@@ -9,14 +9,12 @@ import { requireValue } from "../runtime/action-process.mjs";
 function requireCandidate(receipt, source, runtime) {
   const result = validateControllerReceipt(receipt, {
     expectedSourceSha: source.sha,
-    expectedRuntimeSha: runtime.sha,
   });
   requireValue(
     result.qualifying &&
       receipt.controller.id === "publication-artifact" &&
-      receipt.source.repository === source.repository &&
-      receipt.runtime.contractDigest === runtime.contractDigest,
-    "Paper candidate controller must qualify for the exact source and runtime",
+      receipt.source.repository === source.repository,
+    "Paper candidate controller must qualify for the exact source",
   );
 }
 

package/packages/core/providers/github/artifact-attestation.js

@@ -12,7 +12,7 @@ export function verifyArtifactAttestationSigner(request, execute = command) {
       "--signer-workflow",
       "kungfu-systems/buildchain/.github/workflows/public-release-artifact-attestation.yml",
       "--signer-digest",
-      request.runtimeSha,
+      request.signerDigest,
       "--source-digest",
       request.sourceSha,
       "--predicate-type",