@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/packages/core/release/next-development/actions.js

@@ -17,10 +17,7 @@ function coordinates(env) {
   )
     throw new Error("exact repository and verification run required");
   const workspace = path.resolve(env.GITHUB_WORKSPACE);
-  if (fs.realpathSync(workspace) !== installationRoot(import.meta.url))
-    throw new Error(
-      "Next-development review must execute the protected source checkout",
-    );
+
   return {
     repository: env.GITHUB_REPOSITORY,
     runId: env.VERIFY_RUN_ID,
@@ -47,7 +44,7 @@ export async function qualifyNextDevelopmentAction(core, env) {
     }).trim();
   if (git("rev-parse", "HEAD") !== env.GITHUB_SHA)
     throw new Error(
-      "Review runtime differs from the exact protected workflow source",
+      "Review source differs from the protected verification source",
     );
   const plan = await verifyNextDevelopmentReview({
     client,

package/packages/core/release/passport/consumer-validation.js

@@ -5,9 +5,8 @@ import {
 import { verifyFloatingConsumerPolicyCertification } from "../../consumer/floating-consumer-evidence.js";
 import { issue } from "./issues.js";
 import {
-  verifyRuntimeAuthorizationReceipt,
   verifyRuntimeResumeLineage,
-} from "../../consumer/runtime-ref-resume-authority.js";
+} from "../recovery/lineage.js";
 import { runtimeResumeSourceSha } from "./consumer-input.js";
 export function validateConsumerPolicyPassportSection({ passport, issues }) {
   const routing = passport?.promotionRouting;
@@ -41,22 +40,6 @@ export function validateRuntimeResumePassportSection({ passport, issues }) {
   if (!evidence) return;
   const consumerPolicyReceiptRoot =
     passport?.v4ConsumerPolicy?.certification?.receiptRoot || "";
-  const authorization = verifyRuntimeAuthorizationReceipt({
-    receipt: evidence.authorization,
-    receiptRoot: evidence.authorizationRoot,
-    repository: passport?.product?.repository || "",
-    sourceSha: runtimeResumeSourceSha(
-      passport?.release,
-      passport?.release?.sourceSha || "",
-    ),
-    runtimeSha: passport?.promotionRouting?.runtime?.resolvedSha || "",
-    consumerPolicyReceiptRoot,
-  });
-  for (const failure of authorization.failures) {
-    issues.push(
-      issue("error", `v4RuntimeResume.authorization.${failure}`, failure),
-    );
-  }
   const lineage = verifyRuntimeResumeLineage({
     lineage: evidence.lineage,
     lineageRoot: evidence.lineageRoot,
@@ -65,19 +48,9 @@ export function validateRuntimeResumePassportSection({ passport, issues }) {
       passport?.release,
       passport?.release?.sourceSha || "",
     ),
-    resumeRuntimeSha: passport?.promotionRouting?.runtime?.resolvedSha || "",
     consumerPolicyReceiptRoot,
   });
   for (const failure of lineage.failures) {
     issues.push(issue("error", `v4RuntimeResume.lineage.${failure}`, failure));
   }
-  if (evidence.lineage?.authorizationRoot !== evidence.authorizationRoot) {
-    issues.push(
-      issue(
-        "error",
-        "v4RuntimeResume.authorization-root-mismatch",
-        "runtime resume lineage must bind the embedded authorization receipt root",
-      ),
-    );
-  }
 }

package/packages/core/release/promote-candidate/development-source.js

@@ -23,14 +23,13 @@ export function prepareDevelopmentSource({ cwd, sourceSha }) {
     // Shallow local clones omit commits reachable only through FETCH_HEAD.
     execFileSync("git", ["fetch", "--no-tags", path.resolve(cwd), sourceSha], { cwd: source, stdio: "pipe" });
     execFileSync("git", ["-c", "core.autocrlf=false", "-c", "core.eol=lf", "checkout", "--detach", sourceSha], { cwd: source, stdio: "pipe" });
-    const runtime = path.join(source, ".buildchain/runtime");
-    fs.mkdirSync(runtime, { recursive: true });
-    fs.symlinkSync(
-      path.resolve(cwd, "node_modules"),
-      path.join(runtime, "node_modules"),
-      "junction",
-    );
-    fs.symlinkSync(path.join(runtime, "node_modules"), path.join(source, "node_modules"), "junction");
+    const dependencies = path.resolve(cwd, "node_modules");
+    if (fs.existsSync(dependencies)) {
+      fs.cpSync(dependencies, path.join(source, "node_modules"), {
+        recursive: true,
+        verbatimSymlinks: true,
+      });
+    }
     return { cwd: source, dispose };
   } catch (error) {
     dispose();

package/packages/core/release/promotion/actions.js

@@ -2,7 +2,6 @@ import fs from "node:fs";
 import path from "node:path";
 import { getOctokit } from "@actions/github";
 import { installationRoot } from "../../runtime/installation-root.js";
-import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 import { routePromotion } from "./routing.js";
 import { bindPromotionSelection } from "./selection.js";
 import { admitPromotionInvocation } from "./admission.js";
@@ -24,34 +23,16 @@ function context(env) {
     payload: JSON.parse(fs.readFileSync(env.GITHUB_EVENT_PATH, "utf8")),
   };
 }
-function requireRuntime(workspace, relative, sha) {
-  const runtimeRoot = installationRoot(import.meta.url);
-  if (
-    fs.realpathSync(runtimeRoot) !==
-    fs.realpathSync(path.join(workspace, relative))
-  )
-    throw new Error(
-      "Promotion action is outside its admitted runtime checkout",
-    );
-  verifyCheckoutIdentity({
-    directory: runtimeRoot,
-    sha,
-    label: "Promotion action runtime",
-  });
-  return runtimeRoot;
-}
+
 export async function routePromotionAction(core, env) {
   const workflowSha = get(core, "workflow-sha"),
     workspace = path.resolve(env.GITHUB_WORKSPACE);
-  const runtimeRoot = requireRuntime(
-    workspace,
-    ".buildchain/workflow-shell",
-    workflowSha,
-  );
+  const runtimeRoot = installationRoot(import.meta.url);
   emit(
     core,
     await routePromotion({
       request: get(core, "request-json"),
+      runtime: JSON.parse(env.BUILDCHAIN_RUNTIME_SELECTION),
       workflowRepository: get(core, "workflow-repository"),
       workflowSha,
       workflowRef: get(core, "workflow-ref"),
@@ -67,11 +48,7 @@ export function bindPromotionSelectionAction(core, env) {
   const selection = JSON.parse(get(core, "selection-json")),
     request = JSON.parse(get(core, "request-json")),
     workspace = path.resolve(env.GITHUB_WORKSPACE);
-  requireRuntime(
-    workspace,
-    ".buildchain/workflow-shell",
-    selection["shell-sha"],
-  );
+
   emit(
     core,
     bindPromotionSelection({
@@ -85,11 +62,7 @@ export function bindPromotionSelectionAction(core, env) {
 export async function admitPromotionInvocationAction(core, env) {
   const selection = JSON.parse(get(core, "selection-json")),
     workspace = path.resolve(env.GITHUB_WORKSPACE);
-  requireRuntime(
-    workspace,
-    ".buildchain/policy-runtime",
-    selection["router-sha"],
-  );
+
   emit(
     core,
     await admitPromotionInvocation({
@@ -104,11 +77,7 @@ export async function admitPromotionInvocationAction(core, env) {
 }
 export function inspectPromotionInvocationAction(core, env) {
   const workflowSha = get(core, "workflow-sha");
-  requireRuntime(
-    path.resolve(env.GITHUB_WORKSPACE),
-    ".buildchain/workflow-shell",
-    workflowSha,
-  );
+
   verifyPromotionInvocation(get(core, "request-json"), workflowSha);
 }
 export async function classifyPublicationHeadAction(core, env) {
@@ -117,7 +86,7 @@ export async function classifyPublicationHeadAction(core, env) {
     throw new Error(
       "Publication classification requires a workflow run with an exact source SHA",
     );
-  requireRuntime(path.resolve(env.GITHUB_WORKSPACE), ".", event.head_sha);
+
   const result = await classifyProductPublication(
     { requestedSha: event.head_sha, targetRef: event.head_branch },
     productPublicationReader(

package/packages/core/release/promotion/admission.js

@@ -1,52 +1,5 @@
-import path from "node:path";
-import { authorizePromotionRuntimeOverride } from "../runtime-override-authorization.js";
 import { bindPromotionInvocation } from "../promotion-request.js";
-export async function admitPromotionInvocation({
-  request,
-  selection,
-  workspace,
-  consumerPolicyRoot,
-  github,
-  context,
-}) {
-  let authorization = {};
-  if (selection["override-used"] === "true") {
-    const root = path.join(workspace, ".buildchain/consumer"),
-      mode = request["resume-candidate-run-id"] ? "resume" : "dispatch";
-    const result = await authorizePromotionRuntimeOverride({
-      github,
-      context,
-      request: {
-        consumerRoot: root,
-        runtimeRepository: request["buildchain-repository"],
-        consumerPolicyReceiptPath: path.join(
-          root,
-          ".buildchain/evidence/consumer-policy-receipt.json",
-        ),
-        consumerPolicyReceiptRoot: consumerPolicyRoot,
-        sourceSha: request["target-sha"] || context.sha,
-        requestedRef: selection["runtime-ref"],
-        resolvedRuntimeSha: selection["runtime-sha"],
-        reason: `trusted ${mode} runtime override ${selection["runtime-ref"]} for source ${request["target-sha"] || context.sha}`,
-        mode,
-        outputPath: path.join(
-          root,
-          ".buildchain/evidence/runtime-authorization.json",
-        ),
-      },
-    });
-    authorization = {
-      "runtime-authorization-json": JSON.stringify({
-        receipt: result.receipt,
-        receiptRoot: result.receiptRoot,
-      }),
-      "runtime-authorization-root": result.receiptRoot,
-    };
-  }
-  return {
-    ...authorization,
-    "invocation-json": JSON.stringify(
-      bindPromotionInvocation(request, selection, authorization),
-    ),
-  };
+
+export async function admitPromotionInvocation({ request, selection }) {
+  return { "invocation-json": JSON.stringify(bindPromotionInvocation(request, selection)) };
 }

package/packages/core/release/promotion/candidate.js

@@ -46,16 +46,14 @@ export async function qualifyPromotionCandidate(
       targetSha: intent["requested-sha"],
       expectedSourceTree: request["resume-expected-source-tree"],
       expectedCandidateRoot: request["resume-expected-candidate-root"],
-      candidateRuntimeSha: request["resume-expected-candidate-runtime-sha"],
-      runtimeSha: request["resume-buildchain-runtime-sha"],
       transactionId: request["resume-transaction-id"],
       rematerializeOnResume: request["publish-rematerialize-on-resume"],
       releasePatterns: request["github-release-payload-patterns"],
       runtimeRoot,
       recoveryRunId,
       recoveryRunAttempt,
-      authorizationJson: request["promotion-runtime-authorization-json"],
-      authorizationRoot: request["promotion-runtime-authorization-root"],
+
+
     });
   return fresh({
     ...shared,

package/packages/core/release/promotion/channel.js

@@ -1,104 +1,16 @@
-import { resolveBuildchainChannel } from "../../consumer/channel-selection.js";
-import { parseBuildchainRefIdentity } from "../../consumer/buildchain-channel-identity.js";
-const TARGETS = [
-  {
-    pattern: /^alpha\/v(\d+)\/v\d+\.\d+$/,
-    publicationChannel: "alpha",
-    shellChannel: "alpha",
-  },
-  {
-    pattern: /^release\/v(\d+)\/v\d+\.\d+$/,
-    publicationChannel: "release",
-    shellChannel: "stable",
-  },
-  {
-    pattern: /^publish-gate\/major$/,
-    publicationChannel: "major",
-    shellChannel: "stable",
-  },
+const targets = [
+  { pattern: /^alpha\/v\d+\/v\d+\.\d+$/, publicationChannel: "alpha", channel: "alpha" },
+  { pattern: /^release\/v\d+\/v\d+\.\d+$/, publicationChannel: "release", channel: "stable" },
+  { pattern: /^publish-gate\/major$/, publicationChannel: "major", channel: "stable" },
 ];
 
-function normalized(value) {
-  return String(value ?? "").trim();
-}
-
-function sameExactSha(left, right) {
-  const first = normalized(left).toLowerCase();
-  const second = normalized(right).toLowerCase();
-  return /^[0-9a-f]{40}$/.test(first) && first === second;
-}
-
-function targetIntent(targetRef, requestedPublicationChannel = "") {
-  const ref = normalized(targetRef).replace(/^refs\/heads\//, "");
-  const target = TARGETS.find((entry) => entry.pattern.test(ref));
-  if (!target)
-    throw new Error(`unsupported promotion target ref: ${ref || "<empty>"}`);
-  const requested = normalized(requestedPublicationChannel).toLowerCase();
-  if (requested && requested !== target.publicationChannel) {
-    throw new Error(
-      `promotion channel ${requested} does not match target ref ${ref} (${target.publicationChannel})`,
-    );
-  }
-  return {
-    targetRef: ref,
-    publicationChannel: target.publicationChannel,
-    shellChannel: target.shellChannel,
-  };
-}
-
-export function resolvePromotionChannel({
-  requestedChannel = "auto",
-  requestedRef = "",
-  publicationChannel = "",
-  targetRef = "",
-  routerRef = "",
-  routerSha = "",
-  packageVersion = "",
-} = {}) {
-  const intent = targetIntent(targetRef, publicationChannel);
-  const selected = resolveBuildchainChannel({
-    requestedChannel,
-    requestedRef,
-    publishChannel: intent.publicationChannel,
-    eventName: "workflow_call",
-    routerRef,
-    packageVersion,
-  });
-  const runtimeIdentity = parseBuildchainRefIdentity(selected.buildchainRef);
-  const opaqueOverride = new Set(["train", "authority", "exact-sha"]).has(
-    runtimeIdentity.kind,
-  );
-  const trustedRouterPin =
-    opaqueOverride && sameExactSha(selected.buildchainRef, routerSha);
-  const overrideUsed = opaqueOverride && !trustedRouterPin;
-  if (
-    !overrideUsed &&
-    !trustedRouterPin &&
-    selected.channel !== intent.shellChannel
-  ) {
-    throw new Error(
-      `promotion target ${intent.targetRef} requires ${intent.shellChannel} shell/runtime, got ${selected.channel}`,
-    );
-  }
-  const shellRef =
-    intent.shellChannel === "alpha"
-      ? `v${selected.major}-alpha`
-      : `v${selected.major}`;
-  return {
-    targetRef: intent.targetRef,
-    publicationChannel: intent.publicationChannel,
-    routerRef: normalized(routerRef),
-    routerSha: normalized(routerSha).toLowerCase(),
-    channel: intent.shellChannel,
-    major: selected.major,
-    shellRef,
-    runtimeRef: selected.buildchainRef,
-    overrideUsed,
-    selectionSource: trustedRouterPin
-      ? "trusted-router-sha"
-      : selected.selectionSource,
-    reason: trustedRouterPin
-      ? `explicit Buildchain runtime ref ${selected.buildchainRef} matches the reusable workflow SHA`
-      : selected.reason,
-  };
+// Publication intent belongs to the product branch. Runtime selection belongs
+// to the entry and cannot be inferred again from the publication channel.
+export function resolvePromotionChannel({ targetRef = "", publicationChannel = "" } = {}) {
+  const ref = String(targetRef).replace(/^refs\/heads\//u, "");
+  const target = targets.find(({ pattern }) => pattern.test(ref));
+  if (!target) throw new Error(`unsupported promotion target ref: ${ref || "<empty>"}`);
+  if (publicationChannel && publicationChannel !== target.publicationChannel)
+    throw new Error(`promotion channel ${publicationChannel} does not match target ref ${ref}`);
+  return { targetRef: ref, publicationChannel: target.publicationChannel, channel: target.channel };
 }

package/packages/core/release/promotion/qualification-action.js

@@ -3,7 +3,6 @@ import path from "node:path";
 import { getOctokit } from "@actions/github";
 import { command } from "../../runtime/action-process.mjs";
 import { installationRoot } from "../../runtime/installation-root.js";
-import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 import { verifyPromotionInvocation } from "../promotion-request.js";
 import { recoveryFailure } from "../release-candidate-recovery.js";
 import { productPublicationReader } from "../../providers/github/product-publication.js";
@@ -17,18 +16,8 @@ export async function qualifyPromotionAction(core, env) {
   const runtimeRoot = installationRoot(import.meta.url),
     workspace = path.resolve(env.GITHUB_WORKSPACE),
     runtimeSha = request["promotion-runtime-sha"];
-  if (
-    fs.realpathSync(runtimeRoot) !==
-    fs.realpathSync(path.join(workspace, ".buildchain/runtime"))
-  )
-    throw new Error(
-      "Promotion qualification requires the selected runtime implementation",
-    );
-  verifyCheckoutIdentity({
-    directory: runtimeRoot,
-    sha: runtimeSha,
-    label: "Promotion qualification runtime",
-  });
+
+
   const tree = command("git", ["-C", runtimeRoot, "rev-parse", "HEAD^{tree}"], {
     stdio: "pipe",
   }).trim();

package/packages/core/release/promotion/routing.js

@@ -1,94 +1,29 @@
 import { resolvePromotionChannel } from "./channel.js";
-import { resolvePromotionIdentities } from "./identities.js";
-import * as override from "../runtime-override-authorization.js";
 import { normalizePromotionRequest } from "../promotion-request.js";
 
-export async function routePromotion({
-  github,
-  context,
-  request: requestValue,
-  workflowRepository,
-  workflowSha,
-  workflowRef,
-  packageVersion,
-}) {
+export async function routePromotion({ context, request: requestValue, workflowRepository, workflowSha, workflowRef, runtime }) {
   const request = normalizePromotionRequest(requestValue);
-  const repository = workflowRepository;
-  const sha = String(workflowSha || "").toLowerCase();
-  const coordinate = workflowRef || "";
-  if (
-    !/^[\w.-]+\/[\w.-]+$/.test(repository) ||
-    !/^[0-9a-f]{40}$/.test(sha) ||
-    !coordinate.startsWith(`${repository}/.github/workflows/`)
-  )
-    throw Error("Promotion requires its exact defining workflow identity");
-  if (request["buildchain-repository"] !== repository)
-    throw Error(
-      "Promotion runtime repository must match its defining workflow repository",
-    );
-  const routerRef = coordinate
-    .split("@")
-    .at(-1)
-    .replace(/^refs\/(?:heads|tags)\//, "");
-  const requestedRef = String(request["buildchain-ref"] || sha).replace(
-    /^refs\/(?:heads|tags)\//,
-    "",
-  );
-  if (
-    !/^(?:v4(?:-alpha)?|[0-9a-f]{40}|(?:train|authority)\/v4\/v4\.\d+\/[\w./-]+)$/.test(
-      requestedRef,
-    ) ||
-    requestedRef.includes("..")
-  )
-    throw Error(
-      "Promotion runtime selection is outside the current v4 authority",
-    );
   const route = resolvePromotionChannel({
-    requestedChannel: request["buildchain-channel"],
-    requestedRef,
     publicationChannel: request.channel,
-    targetRef:
-      request["target-ref"] || context.ref.replace(/^refs\/heads\//, ""),
-    routerRef,
-    routerSha: sha,
-    packageVersion,
+    targetRef: request["target-ref"] || context.ref.replace(/^refs\/heads\//u, ""),
   });
-  if (route.overrideUsed)
-    await override.authorizePromotionRuntimeOverride({ github, context });
-  const [owner, repo] = repository.split("/");
-  const identities = await resolvePromotionIdentities({
-    routerRef,
-    routerSha: sha,
-    shellRef: route.shellRef,
-    shellCallRef: sha,
-    runtimeRef: route.runtimeRef,
-    resolveRef: async (ref) =>
-      (await github.rest.repos.getCommit({ owner, repo, ref })).data.sha,
-  });
-  if (
-    request["resume-candidate-run-id"] &&
-    identities.runtimeSha !==
-      String(request["resume-buildchain-runtime-sha"] || "").toLowerCase()
-  )
-    throw Error(
-      "Recovery runtime does not match resume-buildchain-runtime-sha",
-    );
-  const output = {
+  const entryRef = workflowRef.split("@").at(-1).replace(/^refs\/(?:heads|tags)\//u, "");
+  return {
     "request-json": JSON.stringify(request),
-    repository,
+    repository: runtime.repository,
     channel: route.channel,
     "publication-channel": route.publicationChannel,
     "target-ref": route.targetRef,
-    "router-ref": routerRef,
-    "router-sha": sha,
-    "shell-ref": route.shellRef,
-    "shell-call-ref": sha,
-    "shell-sha": sha,
-    "runtime-ref": route.runtimeRef,
-    "runtime-sha": identities.runtimeSha,
-    "override-used": String(route.overrideUsed),
-    "selection-source": route.selectionSource,
-    reason: route.reason,
+    "router-ref": entryRef,
+    "router-sha": workflowSha,
+    "shell-ref": entryRef,
+    "shell-call-ref": workflowSha,
+    "shell-sha": workflowSha,
+    "contract-lock-path": runtime.contract?.path,
+    "runtime-ref": runtime.ref,
+    "runtime-sha": runtime.sha,
+    "override-used": String(runtime.origin === "runtime-parameter"),
+    "selection-source": runtime.origin,
+    reason: `Execute publication using the runtime selected by the entry (${runtime.origin})`,
   };
-  return output;
 }

package/packages/core/release/promotion/selection.js

@@ -9,8 +9,6 @@ export function bindPromotionSelection(
   run = command,
 ) {
   for (const [directory, expected] of [
-    ["workflow-shell", selection["shell-sha"]],
-    ["runtime", selection["runtime-sha"]],
     ["source", sourceSha],
   ]) {
     verifyCheckoutIdentity(
@@ -23,13 +21,7 @@ export function bindPromotionSelection(
     );
   }
   const source = path.join(workspace, ".buildchain/source");
-  const relative =
-    request["buildchain-contract-lock-path"] ||
-    request[
-      selection.channel === "alpha"
-        ? "buildchain-alpha-contract-lock-path"
-        : "buildchain-stable-contract-lock-path"
-    ];
+  const relative = selection["contract-lock-path"];
   if (
     !relative ||
     path.isAbsolute(relative) ||

package/packages/core/release/promotion-request.js

@@ -55,7 +55,6 @@ export function normalizePromotionRequest(value, kind = "request") {
 export function bindPromotionInvocation(
   requestValue,
   selection,
-  authorization = {},
 ) {
   const request = normalizePromotionRequest(requestValue);
   const projected = Object.fromEntries(
@@ -64,8 +63,6 @@ export function bindPromotionInvocation(
     ),
   );
   const routing = {
-    "buildchain-ref": "runtime-sha",
-    "buildchain-contract-lock-path": "contract-lock-path",
     "buildchain-expected-channel": "channel",
     channel: "publication-channel",
     "target-ref": "target-ref",
@@ -85,33 +82,11 @@ export function bindPromotionInvocation(
       throw new Error(`Promotion selection requires ${source}`);
     projected[key] = selection[source];
   }
-  for (const key of ["runtime-sha", "shell-sha", "router-sha"])
-    if (!/^[0-9a-f]{40}$/.test(selection[key]))
-      throw new Error(`Promotion selection ${key} must be exact`);
-  if (
-    selection["router-sha"] !== selection["shell-sha"] ||
-    selection["shell-call-ref"] !== selection["shell-sha"]
-  )
-    throw new Error("Publisher must use the exact defining workflow");
   if (!/^sha256:[0-9a-f]{64}$/.test(selection["contract-lock-digest"]))
     throw new Error("Promotion contract lock must be rooted");
   if (!["true", "false"].includes(selection["override-used"]))
     throw new Error("Promotion override decision is missing");
   projected["promotion-override-used"] = selection["override-used"] === "true";
-  projected["promotion-runtime-authorization-json"] =
-    authorization["runtime-authorization-json"] || "";
-  projected["promotion-runtime-authorization-root"] =
-    authorization["runtime-authorization-root"] || "";
-  if (
-    projected["promotion-override-used"] &&
-    (!projected["promotion-runtime-authorization-json"] ||
-      !/^sha256:[0-9a-f]{64}$/.test(
-        projected["promotion-runtime-authorization-root"],
-      ))
-  )
-    throw new Error(
-      "Promotion override requires rooted consumer authorization",
-    );
   projected["buildchain-expected-major"] = "4";
   projected["publication-authority-workflow-path"] =
     ".github/workflows/.release-promote.yml";
@@ -119,25 +94,11 @@ export function bindPromotionInvocation(
   return normalizePromotionRequest(projected, "invocation");
 }
 
-export function verifyPromotionInvocation(value, workflowSha) {
+export function verifyPromotionInvocation(value) {
   if (typeof value === "string") value = JSON.parse(value);
   const normalized = normalizePromotionRequest(value, "invocation");
   if (Object.keys(value).length !== Object.keys(normalized).length)
     throw new Error("Promotion invocation must include all normalized fields");
-  if (
-    !/^[0-9a-f]{40}$/.test(workflowSha || "") ||
-    normalized["promotion-shell-sha"] !== workflowSha ||
-    normalized["promotion-router-sha"] !== workflowSha ||
-    normalized["promotion-shell-ref"] !== workflowSha
-  )
-    throw new Error(
-      "Promotion invocation is not bound to this defining workflow",
-    );
-  if (
-    !/^[0-9a-f]{40}$/.test(normalized["promotion-runtime-sha"]) ||
-    normalized["buildchain-ref"] !== normalized["promotion-runtime-sha"]
-  )
-    throw new Error("Promotion runtime must bind one exact admitted commit");
   if (
     !/^sha256:[0-9a-f]{64}$/.test(normalized["promotion-contract-lock-digest"])
   )

package/packages/core/release/qualification/actions.js

@@ -1,17 +1,9 @@
 import fs from "node:fs";
 import path from "node:path";
-import { installationRoot } from "../../runtime/installation-root.js";
 import { createGitHubQualificationClient } from "../../providers/github/qualification.js";
 import { qualifyPublicBuild } from "./public-build.js";
 function inputs(core, env) {
   const workspace = path.resolve(env.GITHUB_WORKSPACE);
-  if (
-    fs.realpathSync(installationRoot(import.meta.url)) !==
-    fs.realpathSync(workspace)
-  )
-    throw new Error(
-      "Stable candidate qualification requires the checked-out source implementation",
-    );
   return {
     workspace,
     repositoryName: env.GITHUB_REPOSITORY,

package/packages/core/release/qualification/public-build.js

@@ -37,7 +37,7 @@ export function resolveStableCandidateQualificationCandidate({
     runtime?.workflowShellRef !== "v4-alpha" ||
     runtime?.class !== "alpha" ||
     runtime?.override !== false ||
-    runtime?.trustDecision !== "workflow-identity"
+    runtime?.trustDecision !== "entry-selection"
   ) {
     throw new Error(
       "public build summary does not bind the exact source run and alpha workflow identity",