@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/packages/core/publication/authority/actions.js

@@ -12,6 +12,7 @@ const parse = (value) => (value ? JSON.parse(value) : undefined);
 function context(core, env) {
   const request = publicationAuthorityRequest(
     JSON.parse(core.getInput("request-json", { required: true })),
+    JSON.parse(env.BUILDCHAIN_RUNTIME_SELECTION),
   );
   return {
     request: { ...request, callerRepository: env.GITHUB_REPOSITORY },
@@ -22,12 +23,16 @@ function context(core, env) {
 export function inspectPublicationAuthorityAction(core, env) {
   admitPublicationAuthorityRequest(context(core, env).request);
 }
-export function verifyPublicationGovernanceAction(core, env) {
+export function verifyPublicationGovernanceAction(
+  core,
+  env,
+  { verify = verifyLivePublicationGovernance } = {},
+) {
   const { request, workspace, runtimeRoot } = context(core, env);
-  return verifyLivePublicationGovernance({
+  return verify({
     repository: request.evidenceRepository || env.GITHUB_REPOSITORY,
     targetRef: request.targetRef,
-    runtimeSha: request.buildchainRef,
+    runtimeSha: request.runtimeSha,
     runtimeRoot,
     outputRoot: path.join(workspace, ".buildchain/publication-authority"),
     token: core.getInput("token", { required: true }),
@@ -43,11 +48,7 @@ export function locateAuthorityControllerAction(core, env) {
 }
 export async function qualifyAuthorityConsumerGateAction(core, env) {
   const { request, workspace, runtimeRoot } = context(core, env);
-  verifyCheckoutIdentity({
-    directory: runtimeRoot,
-    sha: request.buildchainRef,
-    label: "Consumer Gate authority",
-  });
+
   const subjectRoot = path.join(
       workspace,
       ".buildchain/publication-consumer-source",

package/packages/core/publication/authority/admission.js

@@ -1,11 +1,5 @@
 import { requireValue } from "../../runtime/action-process.mjs";
 
-export function requireImmutableAuthority(request) {
-  requireValue(
-    /^[0-9a-f]{40}$/i.test(request.buildchainRef || ""),
-    "Publication authority requires an exact 40-character GitHub commit SHA",
-  );
-}
 export function requireSealedInputs(request) {
   const names = [
     "admissionJson",
@@ -21,10 +15,6 @@ export function requireSealedInputs(request) {
   );
 }
 export function requireManagedInputs(request) {
-  requireValue(
-    request.buildchainRepository === "kungfu-systems/buildchain",
-    "Automatic publication admission requires the canonical Buildchain authority repository",
-  );
   requireValue(
     /^[0-9a-f]{40}$/i.test(request.sourceSha),
     "Automatic publication admission requires an exact source SHA",
@@ -107,7 +97,6 @@ export function requireManagedInputs(request) {
 
 export function admitPublicationAuthorityRequest(request) {
   if (request.dryRun) return;
-  requireImmutableAuthority(request);
   if (request.autoAdmission) requireManagedInputs(request);
   else requireSealedInputs(request);
 }

package/packages/core/publication/authority/assembly.js

@@ -7,16 +7,11 @@ import { sealManagedPublicationAdmission } from "./seal.js";
 import { readGitHubSourceTree } from "../../providers/github/commits.js";
 import { auditPublicationControlPlane } from "../../governance/publication/audit.js";
 import { publicationControlPlaneRequest } from "./control-plane.js";
-import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 export async function assemblePublicationAdmission(
   { request, workspace, runtimeRoot, runner, token, governanceToken, apiUrl },
   { audit = auditPublicationControlPlane, tree = readGitHubSourceTree } = {},
 ) {
-  verifyCheckoutIdentity({
-    directory: runtimeRoot,
-    sha: request.buildchainRef,
-    label: "Publication authority",
-  });
+
   const outputRoot = path.join(
       workspace,
       ".buildchain/publication-authority/auto",
@@ -58,7 +53,7 @@ export async function assemblePublicationAdmission(
     repository: request.evidenceRepository,
     sourceSha: request.sourceSha,
     sourceTreeSha,
-    runtimeSha: request.buildchainRef,
+    runtimeSha: request.runtimeSha,
     publicationVersion: request.publicationVersion,
   });
   const bundle = sealManagedPublicationAdmission({

package/packages/core/publication/authority/control-plane.js

@@ -11,10 +11,10 @@ export function publicationControlPlaneRequest(request) {
     candidate = kind === "release-candidate";
   return {
     repository: request.evidenceRepository,
-    workflowRepository: request.buildchainRepository,
+    workflowRepository: request.runtimeRepository,
     branch: request.targetRef,
     sourceSha: request.sourceSha,
-    workflowRef: request.buildchainRef,
+    workflowRef: request.runtimeSha,
     publisherWorkflowPath: request.publisherWorkflowPath,
     requiredStatusCheck: request.requiredStatusCheck || "",
     workflowPath: request.authorityWorkflowPath || defaults[kind],

package/packages/core/publication/authority/governance.js

@@ -5,23 +5,17 @@ import {
   BUILDCHAIN_GITHUB_GOVERNANCE_AUTHORITY,
   verifyGithubGovernanceReceipt,
 } from "../../governance/github-governance-authority.js";
-import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 export function verifyLivePublicationGovernance(
-  { repository, targetRef, runtimeSha, runtimeRoot, outputRoot, token },
+  { repository, targetRef, runtimeSha, outputRoot, token },
   collect = collectGithubGovernanceAudit,
 ) {
   if (!repository || !targetRef || !token)
     throw new Error(
       "Live GitHub governance verification requires an exact repository, target ref and scoped credential",
     );
-  verifyCheckoutIdentity({
-    directory: runtimeRoot,
-    sha: runtimeSha,
-    label: "Governance verifier",
-  });
+
   fs.mkdirSync(outputRoot, { recursive: true });
   const audit = collect({
-    root: runtimeRoot,
     token,
     organization: repository.split("/")[0],
     repository,
@@ -51,7 +45,6 @@ export function verifyLivePublicationGovernance(
     expectedRepository: repository,
     expectedTargetRef: targetRef,
     expectedPolicyRoot: BUILDCHAIN_GITHUB_GOVERNANCE_AUTHORITY.policyRoot,
-    expectedVerifierSourceRevision: runtimeSha,
   });
   fs.writeFileSync(
     path.join(outputRoot, "github-governance-receipt.json"),

package/packages/core/publication/authority/request.js

@@ -1,10 +1,15 @@
-export function publicationAuthorityRequest(input) {
-  return Object.fromEntries(
+export function publicationAuthorityRequest(input, selectedRuntime) {
+  const request = Object.fromEntries(
     Object.entries(input).map(([key, value]) => [
       key.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase()),
       value,
     ]),
   );
+  return {
+    ...request,
+    runtimeRepository: selectedRuntime.repository,
+    runtimeSha: selectedRuntime.sha,
+  };
 }
 export function requireAuthorityValue(value, label) {
   if (value === undefined || value === null || value === "")

package/packages/core/publication/authority/verification.js

@@ -1,7 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
 import { verifyPublicationAdmission } from "../publication-authority.js";
-import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 import { readGitHubSourceTree } from "../../providers/github/commits.js";
 import { publicationVerificationEvidence } from "./verification-evidence.js";
 export async function verifySealedAdmission(
@@ -18,13 +17,8 @@ export async function verifySealedAdmission(
     expected,
     usedNonces,
   },
-  { tree = readGitHubSourceTree, verifyCheckout = verifyCheckoutIdentity } = {},
+  { tree = readGitHubSourceTree } = {},
 ) {
-  verifyCheckout({
-    directory: runtimeRoot,
-    sha: request.buildchainRef,
-    label: "Authority runtime",
-  });
   const sourceTreeSha = await tree({
     repository: admission.repository,
     sourceSha: admission.sourceSha,
@@ -35,7 +29,7 @@ export async function verifySealedAdmission(
     kind: request.autoAdmissionKind,
     evidenceRoot: path.join(workspace, ".buildchain/publication-evidence"),
     sourceTreeSha,
-    runtimeSha: request.buildchainRef,
+    runtimeSha: request.runtimeSha,
     admission,
     gateAggregate,
   });
@@ -53,22 +47,13 @@ export async function verifySealedAdmission(
     expected,
     usedNonces,
   });
-  validateCapabilityBinding(capability, request, request.buildchainRef);
+  validateCapabilityBinding(capability, request);
   return { capability, gateAggregate: publicationEvidence.gateAggregate };
 }
 export function validateCapabilityBinding(
   capability,
   request,
-  actualRuntimeSha,
 ) {
-  if (
-    request.autoAdmissionKind !== "binary-release-assets" &&
-    capability.runtimeSha !== actualRuntimeSha
-  ) {
-    throw new Error(
-      `authority runtime checkout mismatch: expected ${capability.runtimeSha}, got ${actualRuntimeSha}`,
-    );
-  }
   if (capability.version !== request.publicationVersion) {
     throw new Error(
       `authority publication version mismatch: planned ${request.publicationVersion || "<empty>"}, capability ${capability.version || "<empty>"}`,

package/packages/core/publication/binary/action.js

@@ -1,16 +1,14 @@
 import path from "node:path";
-import { verifySourceRuntimeCheckouts } from "../../runtime/checkout-identity.js";
-import { installationRoot } from "../../runtime/installation-root.js";
+import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 import { releaseAssetClient } from "../../providers/github/release-assets.js";
 import { publishBinaryAssets } from "./transaction.js";
 export async function publishBinaryAssetsAction(core, env) {
   const workspace = path.resolve(env.GITHUB_WORKSPACE),
     sourceSha = core.getInput("source-sha", { required: true });
-  verifySourceRuntimeCheckouts({
-    sourceDirectory: workspace,
-    sourceSha,
-    runtimeDirectory: installationRoot(import.meta.url),
-    runtimeSha: core.getInput("runtime-sha", { required: true }),
+  verifyCheckoutIdentity({
+    directory: workspace,
+    sha: sourceSha,
+    label: "Publication source",
   });
   const client = releaseAssetClient(env.GITHUB_REPOSITORY, {
     token: core.getInput("token", { required: true }),

package/packages/core/publication/candidate/qualification-action.js

@@ -1,6 +1,5 @@
 import path from "node:path";
 import { installationRoot } from "../../runtime/installation-root.js";
-import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 import { qualifyPublicationCandidate } from "./qualification.js";
 export async function qualifyPublicationCandidateAction(core, env) {
   const input = JSON.parse(core.getInput("request-json", { required: true }));
@@ -10,11 +9,7 @@ export async function qualifyPublicationCandidateAction(core, env) {
     throw new Error(
       "Publication working directory escapes its admitted source",
     );
-  verifyCheckoutIdentity({
-    directory: installationRoot(import.meta.url),
-    sha: core.getInput("runtime-sha", { required: true }),
-    label: "Publication runtime",
-  });
+
   const request = {
     cwd,
     env,

package/packages/core/publication/candidate/stage-capsules.js

@@ -8,7 +8,7 @@ import {
   stageCapsuleRoot,
   validateStageCapsule,
 } from "../../build/stage-capsule.js";
-import { runtimeResumeDocumentRoot } from "../../consumer/runtime-ref-resume-authority.js";
+import { runtimeResumeDocumentRoot } from "../../release/recovery/lineage.js";
 import { createDomainPublicationQualificationReceipt } from "../publication-qualification.js";
 
 const readJsonFile = (file) => JSON.parse(fs.readFileSync(file, "utf8"));

package/packages/core/publication/npm/preview-action.js

@@ -1,6 +1,4 @@
-import fs from "node:fs";
 import path from "node:path";
-import { installationRoot } from "../../runtime/installation-root.js";
 import { verifyRepository } from "../../build/verification/repository.js";
 import { npmPublishDryRun } from "./preview.js";
 export function previewNpmPublication(
@@ -10,20 +8,16 @@ export function previewNpmPublication(
   if (runCheck) verify({ workspace, env });
   return preview({ cwd: workspace, env });
 }
-export function previewNpmPublicationAction(core, env) {
+export function previewNpmPublicationAction(core, env, dependencies) {
   const workspace = path.resolve(env.GITHUB_WORKSPACE);
-  if (
-    fs.realpathSync(installationRoot(import.meta.url)) !==
-    fs.realpathSync(workspace)
-  )
-    throw new Error(
-      "npm preview requires the checked-out source implementation",
-    );
-  const result = previewNpmPublication({
-    workspace,
-    runCheck: core.getBooleanInput("run-check"),
-    env,
-  });
+  const result = previewNpmPublication(
+    {
+      workspace,
+      runCheck: core.getBooleanInput("run-check"),
+      env,
+    },
+    dependencies,
+  );
   core.info(
     `npm preview qualified: ${result.package.name}@${result.package.version}; ${result.pack.entryCount} package entries`,
   );

package/packages/core/publication/oci/preview-actions.js

@@ -1,20 +1,11 @@
 import fs from "node:fs";
 import path from "node:path";
 import { releaseAssetClient } from "../../providers/github/release-assets.js";
-import { installationRoot } from "../../runtime/installation-root.js";
-import { sourceSha } from "../../build/standalone/identity.js";
 import { admitComposePreview } from "./preview-admission.js";
 import { applyComposePreview } from "./preview-transaction.js";
 import { createComposePreviewRegistry } from "./preview-registry.js";
 function inputs(core, env) {
-  const sha = core.getInput("workflow-sha", { required: true });
-  if (
-    !/^[0-9a-f]{40}$/.test(sha) ||
-    sourceSha(installationRoot(import.meta.url)) !== sha
-  )
-    throw new Error(
-      "Compose preview runtime differs from its exact called workflow",
-    );
+
   return {
     request: {
       workspace: path.resolve(env.GITHUB_WORKSPACE),

package/packages/core/publication/publication-artifact-candidate.js

@@ -65,7 +65,7 @@ export function createPublicationArtifactCandidate({
   const normalizedRepository = requiredString(repository, "repository");
   const normalizedSourceSha = normalizeGitSha(sourceSha, "sourceSha");
   const normalizedSourceTreeSha = normalizeGitSha(sourceTreeSha, "sourceTreeSha");
-  const normalizedRuntimeSha = normalizeGitSha(runtimeSha, "runtimeSha");
+  const normalizedRuntimeSha = runtimeSha;
   if (manifest?.contract !== MANIFEST_CONTRACT) throw new Error("publication artifact manifest contract mismatch");
   if (passport?.contract !== PASSPORT_CONTRACT || passport.status !== "passed") {
     throw new Error("publication artifact passport is not qualifying");
@@ -82,7 +82,7 @@ export function createPublicationArtifactCandidate({
   }
   const controllerValidation = validateControllerReceipt(controllerReceipt, {
     expectedSourceSha: normalizedSourceSha,
-    expectedRuntimeSha: normalizedRuntimeSha,
+
   });
   if (!controllerValidation.ok || !controllerValidation.qualifying) {
     throw new Error(`publication artifact controller receipt did not qualify: ${controllerValidation.issues.join("; ")}`);

package/packages/core/publication/publication-authority.js

@@ -502,7 +502,7 @@ function validatePublicationEvidence(publicationEvidence, admission) {
     const controllerReceipt = evidence.controllerReceipt;
     const controllerValidation = validateControllerReceipt(controllerReceipt, {
       expectedSourceSha: admission.sourceSha,
-      expectedRuntimeSha: admission.runtimeSha,
+
     });
     if (!controllerValidation.ok || !controllerValidation.qualifying) {
       throw new Error(`binary distribution controller receipt did not qualify: ${controllerValidation.issues.join("; ")}`);
@@ -662,7 +662,7 @@ function validatePublicationEvidence(publicationEvidence, admission) {
   const controllerReceipt = publicationEvidence.controllerReceipt;
   const controllerValidation = validateControllerReceipt(controllerReceipt, {
     expectedSourceSha: passport.source?.headSha || "",
-    expectedRuntimeSha: passport.buildchain?.sha || "",
+
   });
   if (!controllerValidation.ok || !controllerValidation.qualifying) {
     throw new Error(`controller receipt did not qualify: ${controllerValidation.issues.join("; ")}`);

package/packages/core/publication/publication-rehearsal-projection.js

@@ -98,7 +98,7 @@ export function mergePublicationRehearsalAgentInstructions(current = "") {
 
 export function publicationRehearsalWorkflow(buildchainRef) {
   const ref = String(buildchainRef || "").trim();
-  if (!ref)
-    throw new Error("publication rehearsal workflow requires a Buildchain ref");
-  return `name: Publication Rehearsal\n\non:\n  workflow_dispatch:\n    inputs:\n      capsule-path:\n        description: "Source-bound v4 publication rehearsal capsule"\n        required: true\n        default: ".buildchain/publication-rehearsal/capsule.json"\n      candidate-root:\n        description: "Repository-relative candidate root"\n        required: true\n        default: ".buildchain/publication-rehearsal/candidate"\n\npermissions:\n  contents: read\n\njobs:\n  rehearsal:\n    uses: kungfu-systems/buildchain/.github/workflows/public-release-tail.yml@${ref}\n    with:\n      buildchain-ref: ${ref}\n      rehearsal-capsule-path: \${{ inputs.capsule-path }}\n      candidate-root: \${{ inputs.candidate-root }}\n      rehearsal-mode: simulate\n      state-path: ".buildchain/publication-rehearsal/state.json"\n      rehearsal-evidence-path: ".buildchain/publication-rehearsal/evidence.json"\n`;
+  if (!/^v4(?:-alpha)?$/u.test(ref))
+    throw new Error("publication rehearsal workflow requires a floating public entry");
+  return `name: Publication Rehearsal\n\non:\n  workflow_dispatch:\n    inputs:\n      capsule-path:\n        description: "Source-bound v4 publication rehearsal capsule"\n        required: true\n        default: ".buildchain/publication-rehearsal/capsule.json"\n      candidate-root:\n        description: "Repository-relative candidate root"\n        required: true\n        default: ".buildchain/publication-rehearsal/candidate"\n\npermissions:\n  contents: read\n\njobs:\n  rehearsal:\n    uses: kungfu-systems/buildchain/.github/workflows/public-release-tail.yml@${ref}\n    with:\n      rehearsal-capsule-path: \${{ inputs.capsule-path }}\n      candidate-root: \${{ inputs.candidate-root }}\n      rehearsal-mode: simulate\n      state-path: ".buildchain/publication-rehearsal/state.json"\n      rehearsal-evidence-path: ".buildchain/publication-rehearsal/evidence.json"\n`;
 }

package/packages/core/publication/settlement/actions.js

@@ -1,7 +1,6 @@
 import path from "node:path";
 import fs from "node:fs";
 import { installationRoot } from "../../runtime/installation-root.js";
-import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 import { releaseAssetClient } from "../../providers/github/release-assets.js";
 import {
   settlePublication,
@@ -11,16 +10,8 @@ import {
 function input(core, env) {
   const runtimeRoot = installationRoot(import.meta.url),
     workspace = path.resolve(env.GITHUB_WORKSPACE);
-  if (
-    fs.realpathSync(runtimeRoot) !==
-    fs.realpathSync(path.join(workspace, ".buildchain/runtime"))
-  )
-    throw new Error("Settlement must execute the admitted runtime");
-  verifyCheckoutIdentity({
-    directory: runtimeRoot,
-    sha: core.getInput("runtime-sha", { required: true }),
-    label: "Publication settlement runtime",
-  });
+
+
   return {
     repository: env.GITHUB_REPOSITORY,
     candidateSha: core.getInput("candidate-sha", { required: true }),

package/packages/core/release/binary/coordinates-action.js

@@ -1,24 +1,11 @@
 import { getOctokit } from "@actions/github";
-import { command } from "../../runtime/action-process.mjs";
-import { installationRoot } from "../../runtime/installation-root.js";
 import { resolveBinaryPublicationCoordinates } from "./coordinates.js";
 export async function resolveBinaryPublicationAction(core, env) {
   const request = JSON.parse(core.getInput("request-json", { required: true }));
-  const executingSha = command(
-    "git",
-    ["-C", installationRoot(import.meta.url), "rev-parse", "HEAD"],
-    { stdio: "pipe" },
-  ).trim();
-  if (executingSha !== env.GITHUB_SHA)
-    throw new Error(
-      "Binary publication coordinator must execute exact workflow source bytes",
-    );
   const values = await resolveBinaryPublicationCoordinates({
     repository: env.GITHUB_REPOSITORY,
     runId: request["evidence-run-id"],
     tag: request["release-tag"],
-    runtime: request["buildchain-ref"],
-    workflowSha: env.GITHUB_SHA,
     github: getOctokit(core.getInput("token", { required: true })),
   });
   for (const [key, value] of Object.entries(values)) core.setOutput(key, value);

package/packages/core/release/binary/coordinates.js

@@ -2,10 +2,7 @@ import { requireValue } from "../../runtime/action-process.mjs";
 export function validateBinaryPublicationSelection({
   runId,
   tag,
-  runtime,
-  workflowSha,
 }) {
-  runtime = (runtime || "").toLowerCase();
   requireValue(
     /^[1-9][0-9]*$/u.test(runId),
     "Binary release publication requires an exact evidence run id",
@@ -15,19 +12,10 @@ export function validateBinaryPublicationSelection({
     match,
     "Binary release publication requires an exact semver tag",
   );
-  requireValue(
-    /^[0-9a-f]{40}$/u.test(runtime),
-    "buildchain-ref must be an exact commit SHA",
-  );
-  requireValue(
-    runtime === (workflowSha || "").toLowerCase(),
-    "buildchain-ref must equal the exact workflow source SHA",
-  );
   return {
     runId,
     tag,
-    runtime,
-    targetRef: `${match[3] ? "alpha" : "release"}/v${match[1]}/v${match[1]}.${match[2]}`,
+      targetRef: `${match[3] ? "alpha" : "release"}/v${match[1]}/v${match[1]}.${match[2]}`,
   };
 }
 
@@ -35,16 +23,12 @@ export async function resolveBinaryPublicationCoordinates({
   repository,
   runId,
   tag,
-  runtime,
-  workflowSha,
   github,
 }) {
   const selected = validateBinaryPublicationSelection({
     runId,
     tag,
-    runtime,
-    workflowSha,
-  });
+    });
   const [owner, repo] = repository.split("/");
   const first = await github.rest.repos.getCommit({
     owner,
@@ -66,7 +50,6 @@ export async function resolveBinaryPublicationCoordinates({
   );
   await github.rest.repos.getReleaseByTag({ owner, repo, tag: selected.tag });
   return {
-    "buildchain-ref": selected.runtime,
     "evidence-run-id": selected.runId,
     "release-tag": selected.tag,
     "source-sha": first.data.sha,

package/packages/core/release/commands/promotion-channel-router.mjs

@@ -1,62 +1,18 @@
 #!/usr/bin/env node
 import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
 import { resolvePromotionChannel } from "../promotion/channel.js";
-function parseArgs(argv) {
-  const values = {};
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index];
-    if (!token.startsWith("--")) throw new Error(`unexpected argument: ${token}`);
-    const value = argv[index + 1];
-    if (value === undefined || value.startsWith("--")) throw new Error(`missing value for ${token}`);
-    values[token.slice(2)] = value;
-    index += 1;
-  }
-  return values;
-}
-
-function readPackageVersion(cwd) {
-  return JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf8")).version;
-}
 
-function writeOutputs(file, result) {
-  const outputs = {
-    "target-ref": result.targetRef, "publication-channel": result.publicationChannel,
-    "router-ref": result.routerRef, "router-sha": result.routerSha,
-    channel: result.channel,
-    major: String(result.major),
-    "shell-ref": result.shellRef,
-    "runtime-ref": result.runtimeRef,
-    "override-used": String(result.overrideUsed),
-    "selection-source": result.selectionSource,
-    reason: result.reason,
-  };
-  fs.appendFileSync(file, Object.entries(outputs).map(([key, value]) => `${key}=${value}\n`).join(""));
-}
-
-function main() {
-  const args = parseArgs(process.argv.slice(2));
-  const cwd = path.resolve(args.cwd || process.cwd());
-  const result = resolvePromotionChannel({
-    requestedChannel: args.channel,
-    requestedRef: args["buildchain-ref"],
-    publicationChannel: args["publication-channel"],
-    targetRef: args["target-ref"],
-    routerRef: args["router-ref"],
-    routerSha: args["router-sha"],
-    packageVersion: readPackageVersion(cwd),
-  });
-  if (process.env.GITHUB_OUTPUT) writeOutputs(process.env.GITHUB_OUTPUT, result);
+try {
+  const { values } = parseArgs({ options: {
+    "target-ref": { type: "string" },
+    "publication-channel": { type: "string" },
+  }});
+  const result = resolvePromotionChannel({ targetRef: values["target-ref"], publicationChannel: values["publication-channel"] });
+  if (process.env.GITHUB_OUTPUT) fs.appendFileSync(process.env.GITHUB_OUTPUT,
+    Object.entries({ "target-ref": result.targetRef, "publication-channel": result.publicationChannel, channel: result.channel }).map(([k,v]) => `${k}=${v}\n`).join(""));
   process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-}
-
-const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
-if (isMain) {
-  try {
-    main();
-  } catch (error) {
-    console.error(`promotion-channel-router: ${error.message}`);
-    process.exitCode = 1;
-  }
+} catch (error) {
+  console.error(`promotion-channel-router: ${error.message}`);
+  process.exitCode = 1;
 }

package/packages/core/release/commands/resume-from-candidate-run.mjs

@@ -16,7 +16,7 @@ export async function resumeFromCandidateRunCli() {
   try {
     const result = await resumeFromCandidateRun({
       token: env("GITHUB_TOKEN"), apiUrl: env("GITHUB_API_URL", "https://api.github.com"), recoveryRunId: env("GITHUB_RUN_ID"), recoveryRunAttempt: env("GITHUB_RUN_ATTEMPT", "1"),
-      authorizationPath: path.resolve(".buildchain/release-candidate/runtime-authorization.json"), authorizationJson: env("BUILDCHAIN_RUNTIME_AUTHORIZATION_JSON"), authorizationRoot: env("BUILDCHAIN_RUNTIME_AUTHORIZATION_ROOT"),
+
       repository: requiredEnv("BUILDCHAIN_RESUME_CANDIDATE_REPOSITORY"),
       targetRepository: env("GITHUB_REPOSITORY"),
       candidateRunId: requiredEnv("BUILDCHAIN_RESUME_CANDIDATE_RUN_ID"),
@@ -27,7 +27,6 @@ export async function resumeFromCandidateRunCli() {
       targetSha: requiredEnv("BUILDCHAIN_RESUME_TARGET_SHA"),
       expectedSourceTree: env("BUILDCHAIN_RESUME_EXPECTED_SOURCE_TREE"),
       expectedCandidateRoot: env("BUILDCHAIN_RESUME_EXPECTED_CANDIDATE_ROOT"),
-      candidateRuntimeSha: requiredEnv("BUILDCHAIN_RESUME_EXPECTED_CANDIDATE_RUNTIME_SHA"),
       runtimeSha: requiredEnv("BUILDCHAIN_RESUME_RUNTIME_SHA"),
       transactionId: env("BUILDCHAIN_RESUME_TRANSACTION_ID"), rematerializeOnResume: env("BUILDCHAIN_PUBLISH_REMATERIALIZE_ON_RESUME") === "true",
       artifactName: env("BUILDCHAIN_ARTIFACT_NAME"),
@@ -61,7 +60,7 @@ export async function resumeFromCandidateRunCli() {
       "release-candidate-stage-capsules-path": result.paths.stageCapsules,
       "release-candidate-publication-qualification-path": result.paths.publicationQualification,
       "v4-runtime-resume-evidence-path": result.paths.runtimeResumeEvidence,
-      "v4-runtime-resume-finalize-command": result.paths.runtimeResumeEvidence ? "node .buildchain/runtime/promotion-shell/packages/core/release/commands/resume-from-candidate-run.mjs finalize" : "",
+      "v4-runtime-resume-finalize-command": result.paths.runtimeResumeEvidence ? "node .buildchain/runtime/packages/core/release/commands/resume-from-candidate-run.mjs finalize" : "",
       "release-candidate-root": result.candidateRoot,
       "release-candidate-artifact-root": result.artifactRoot,
       "publish-sealed-bundle-root": result.paths.sealedBundleRoot,

package/packages/core/release/dev-alpha-active-release-train.js

@@ -211,11 +211,6 @@ export function reconcileActiveReleaseTrain({
       "alpha-base-drift",
       "the Alpha base moved after the Release Cut and requires explicit supersession or repair",
     ],
-    [
-      buildchainRuntimeSha !== cut.buildchainRuntimeSha,
-      "runtime-drift",
-      "the Buildchain runtime moved after the Release Cut and requires explicit supersession or repair",
-    ],
   ];
   const failure = checks.find(([failed]) => failed);
   if (failure) {

package/packages/core/release/line/action.js

@@ -1,7 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
 import { installationRoot } from "../../runtime/installation-root.js";
-import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 import { createGitHubCliApi } from "../../providers/github-cli-api.js";
 import { pullRequestProvider } from "../../providers/github/pull-requests.js";
 import { normalizeLineBootstrapRequest } from "./request.js";
@@ -13,18 +12,8 @@ export async function lineBootstrapAction(core, env) {
     ),
     sourceRoot = path.resolve(env.GITHUB_WORKSPACE),
     runtimeRoot = installationRoot(import.meta.url);
-  if (
-    fs.realpathSync(runtimeRoot) !==
-    fs.realpathSync(path.join(sourceRoot, ".buildchain/workflow-shell"))
-  )
-    throw new Error(
-      "Release line action requires its defining workflow implementation",
-    );
-  verifyCheckoutIdentity({
-    directory: runtimeRoot,
-    sha: core.getInput("workflow-sha", { required: true }),
-    label: "Release line workflow",
-  });
+
+
   const token = core.getInput("token", { required: request.apply }),
     repository = env.GITHUB_REPOSITORY;
   const providers = request.apply