@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/packages/core/release/recovery/runtime.js

@@ -1,36 +1,8 @@
-import { readOnlyJson } from "./files.js";
-import { readPublicResumeState } from "./readback.js";
-import { resolveRuntimeResumePublicRuntimeSha } from "./readback.js";
 import fs from "node:fs";
 import path from "node:path";
-import { execFileSync } from "node:child_process";
-import { authorizeRuntimeSelection } from "../../consumer/runtime-ref-resume-authority.js";
-import { createRuntimeResumeLineage } from "../../consumer/runtime-ref-resume-authority.js";
-import { scanRuntimeSelectorPersistence } from "../../consumer/runtime-ref-resume-authority.js";
-import { runtimeResumeDocumentRoot } from "../../consumer/runtime-ref-resume-authority.js";
-import { verifyRuntimeAuthorizationReceipt } from "../../consumer/runtime-ref-resume-authority.js";
+import { readPublicResumeState } from "./readback.js";
+import { createRuntimeResumeLineage, runtimeResumeDocumentRoot } from "./lineage.js";
 import { splitRepository } from "../candidate/selection.js";
-import { installationRoot } from "../../runtime/installation-root.js";
-export function trackedRuntimePersistenceScan({
-  runtimeRoot = installationRoot(import.meta.url),
-} = {}) {
-  const paths = execFileSync(
-    "git",
-    [
-      "-C",
-      runtimeRoot,
-      "ls-files",
-      ".github/workflows",
-      "actions",
-      ".buildchain",
-    ],
-    { encoding: "utf8" },
-  )
-    .split(/\r?\n/)
-    .filter((entry) => /\.(?:json|toml|ya?ml)$/u.test(entry));
-  return scanRuntimeSelectorPersistence({ root: runtimeRoot, paths });
-}
-
 export function prepareRuntimeResumeEvidence({
   repoInfo,
   targetRef,
@@ -41,61 +13,9 @@ export function prepareRuntimeResumeEvidence({
   stageCapsules,
   recovery,
   outputDir,
-  runtimeRoot,
   recoveryRunId,
   recoveryRunAttempt,
-  authorizationPath,
-  authorizationJson,
-  authorizationRoot,
 }) {
-  const delegatedRaw = String(authorizationJson || "").trim();
-  const delegatedRoot = String(authorizationRoot || "").trim();
-  const authorizationFileExists =
-    authorizationPath && fs.existsSync(authorizationPath);
-  if (!authorizationFileExists && (!delegatedRaw || !delegatedRoot))
-    throw new Error(
-      "cross-runtime recovery requires a fresh runtime authorization receipt",
-    );
-  const delegated = authorizationFileExists
-    ? readOnlyJson(
-        [{ absolutePath: authorizationPath }],
-        "runtime authorization",
-      )
-    : JSON.parse(delegatedRaw);
-  if (!authorizationFileExists && delegated.receiptRoot !== delegatedRoot)
-    throw new Error(
-      "fresh recovery runtime authorization handoff root mismatch",
-    );
-  const delegatedVerification = verifyRuntimeAuthorizationReceipt({
-    receipt: delegated.receipt,
-    receiptRoot: delegated.receiptRoot,
-    repository: repoInfo.fullName,
-    runtimeSha,
-  });
-  if (!delegatedVerification.ok) {
-    throw new Error(
-      `fresh recovery runtime authorization rejected: ${delegatedVerification.failures.join(", ")}`,
-    );
-  }
-  const policy = passport.consumerPolicy.receipt;
-  const authorization = authorizeRuntimeSelection({
-    repository: repoInfo.fullName,
-    eventName: "workflow_dispatch",
-    mode: "resume",
-    actor: delegated.receipt.actor.login,
-    actorPermission: delegated.receipt.actor.permission,
-    reason: `resume sealed candidate run ${passport.workflow.runId} from a tree-equivalent protected source`,
-    authorizedAt: new Date().toISOString(),
-    sourceSha: sidecar.source.sha,
-    sourceTreeSha: sidecar.source.treeSha,
-    requestedRef: delegated.receipt.request.ref,
-    resolvedRuntimeSha: runtimeSha,
-    approvedRefReadbacks: delegated.receipt.runtime.reachableFrom,
-    stableContractLockRoot: policy.contractLocks.stable.root,
-    alphaContractLockRoot: policy.contractLocks.alpha.root,
-    consumerPolicyReceiptRoot: sidecar.consumerPolicyReceiptRoot,
-    persistenceScan: trackedRuntimePersistenceScan({ runtimeRoot }),
-  });
   const planBody = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-v4-runtime-resume-plan/v1",
@@ -115,8 +35,6 @@ export function prepareRuntimeResumeEvidence({
     targetRef,
     runtimeSha,
     version,
-    authorization: authorization.receipt,
-    authorizationRoot: authorization.receiptRoot,
     buildAttempt: sidecar.buildAttempt,
     resumeAttempt: {
       id: `github-run:${recoveryRunId}:attempt:${recoveryRunAttempt}`,
@@ -127,10 +45,7 @@ export function prepareRuntimeResumeEvidence({
     requiredPlatforms: stageCapsules.map((entry) => entry.platform),
     stageCapsules,
     resumePlanRoot: plan.root,
-    floatingRefBefore: {
-      ref: "v4-alpha",
-      sha: sidecar.buildAttempt.runtimeSha,
-    },
+
   };
   const material = {
     ...materialBody,
@@ -183,7 +98,6 @@ export async function finalizeRuntimeResumeEvidence({
   const readback = await readPublicResumeState({
     repoInfo,
     targetRef,
-    runtimeSha: resolveRuntimeResumePublicRuntimeSha(material),
     version,
     transaction,
     token,
@@ -191,8 +105,7 @@ export async function finalizeRuntimeResumeEvidence({
     fetchImpl,
   });
   const resumed = createRuntimeResumeLineage({
-    authorization: material.authorization,
-    authorizationRoot: material.authorizationRoot,
+    repository: material.repository,
     buildAttempt: material.buildAttempt,
     resumeAttempt: material.resumeAttempt,
     source: material.source,
@@ -201,12 +114,8 @@ export async function finalizeRuntimeResumeEvidence({
     stageCapsules: material.stageCapsules,
     resumePlanRoot: material.resumePlanRoot,
     finalPublicReadbackRoot: readback.root,
-    floatingRefBefore: material.floatingRefBefore,
-    floatingRefAfter: { ref: "v4-alpha", sha: readback.refs.floating.sha },
   });
   const evidence = {
-    authorization: material.authorization,
-    authorizationRoot: material.authorizationRoot,
     lineage: resumed.lineage,
     lineageRoot: resumed.lineageRoot,
   };

package/packages/core/release/release-candidate-recovery.js

@@ -282,7 +282,7 @@ function validatePlatformPayloads(passport, artifacts, platformManifests, platfo
   }
 }
 
-function validateProductPayloads({ passport, artifacts, productPayloadManifests, candidateRoot, buildSummaryRoot, runtimeSha }) {
+function validateProductPayloads({ passport, artifacts, productPayloadManifests, candidateRoot, buildSummaryRoot }) {
   const byName = new Map(artifacts.map((artifact) => [artifact.name, artifact]));
   for (const [index, manifest] of (productPayloadManifests || []).entries()) {
     if (manifest?.contract !== "kungfu-buildchain-product-payload-manifest/v1") {
@@ -293,7 +293,6 @@ function validateProductPayloads({ passport, artifacts, productPayloadManifests,
     assertEqual(manifest.candidateRoot, candidateRoot, "candidate-root-mismatch", "product payload candidate root", "Use the product payload sealed for this exact candidate.");
     assertEqual(manifest.buildSummaryRoot, buildSummaryRoot, "build-summary-root-mismatch", "product payload build summary root", "Use the payload produced from the exact candidate summary.");
     assertEqual(manifest.source?.tree, passport.source?.treeHash, "source-tree-mismatch", "product payload source tree", "Use payload bytes produced from the exact candidate tree.");
-    assertEqual(manifest.runtimeSha, runtimeSha, "runtime-mismatch", "product payload candidate runtime", "Use payload evidence created by the candidate runtime.");
     const artifact = byName.get(manifest.artifactName);
     if (!artifact) fail("artifact-missing", `product payload artifact is missing: ${manifest.artifactName}`, "Restore the exact product payload artifact.");
     const manifestName = String(manifest.manifestPath || "product-payload-manifest.json");
@@ -394,7 +393,6 @@ function validateCandidateIdentity({
   targetSha,
   targetTree,
   expectedSourceTree,
-  expectedRuntimeSha,
   currentToolingSha,
   passport,
   buildSummary,
@@ -402,8 +400,8 @@ function validateCandidateIdentity({
 }) {
   const sha = exactSha(targetSha, "targetSha");
   const tree = exactSha(targetTree, "targetTree");
-  const runtimeSha = exactSha(expectedRuntimeSha, "expectedRuntimeSha");
-  const toolingSha = exactSha(currentToolingSha, "currentToolingSha");
+  const runtimeSha = passport.buildchain?.sha;
+  const toolingSha = currentToolingSha;
   const validation = validateReleaseCandidatePassport({ passport, repository, targetChannel: anchorProvenance ? "" : channel, buildSummary });
   if (!validation.ok) fail("passport-invalid", `Release Candidate Passport validation failed: ${validation.errors.join("; ")}`, "Preserve the candidate evidence and explicitly create a new candidate after fixing the producer.");
   const expectedPassportHash = sha256Json({
@@ -420,7 +418,6 @@ function validateCandidateIdentity({
   if (passport.candidateHash !== expectedPassportHash) fail("candidate-root-mismatch", "Release Candidate Passport candidate hash does not match its content", "Preserve the run evidence and explicitly create a new candidate after fixing the producer.");
   assertEqual(passport.source?.treeHash, tree, "source-tree-mismatch", "promotion Git tree", "Select a promotion SHA with the exact candidate Git tree or create a new candidate explicitly.");
   if (expectedSourceTree) assertEqual(passport.source?.treeHash, exactSha(expectedSourceTree, "expectedSourceTree"), "source-tree-mismatch", "expected source tree", "Correct the expected tree or create a new candidate.");
-  assertEqual(passport.buildchain?.sha, runtimeSha, "runtime-mismatch", "candidate Buildchain runtime SHA", "Run recovery with the exact trusted Buildchain runtime recorded by the candidate.");
   return { sha, tree, runtimeSha, toolingSha };
 }
 
@@ -454,7 +451,6 @@ export function verifyReleaseCandidateRecovery({
   targetTree,
   expectedSourceTree = "",
   expectedCandidateRoot = "",
-  expectedRuntimeSha,
   expectedTransactionId = "",
   existingTransaction = undefined,
   run,
@@ -481,7 +477,7 @@ export function verifyReleaseCandidateRecovery({
   });
   const { sha, tree, runtimeSha, toolingSha } = validateCandidateIdentity({
     repository, channel, targetSha, targetTree, expectedSourceTree,
-    expectedRuntimeSha, currentToolingSha, passport, buildSummary, anchorProvenance,
+    currentToolingSha, passport, buildSummary, anchorProvenance,
   });
 
   const recoveredArtifacts = artifacts.map(normalizeArtifact).sort((left, right) => left.name.localeCompare(right.name));
@@ -495,7 +491,6 @@ export function verifyReleaseCandidateRecovery({
   for (const receipt of controllerReceipts) {
     const receiptValidation = validateControllerReceipt(receipt, {
       expectedSourceSha: passport.source?.headSha,
-      expectedRuntimeSha: runtimeSha,
     });
     if (!receiptValidation.ok || !receiptValidation.qualifying) {
       fail("controller-receipt-invalid", `controller receipt is not qualifying: ${receiptValidation.issues.join("; ")}`, "Use a successful candidate with complete controller evidence.");

package/packages/core/release/release-candidate.js

@@ -189,7 +189,6 @@ function normalizeConsumerPolicyEvidence(value, expected = {}) {
     receiptRoot: value.receiptRoot || "",
     repository: expected.repository,
     sourceSha: expected.sourceSha,
-    resolvedRuntimeSha: expected.runtimeSha,
   });
   if (!verification.ok) {
     throw new Error(`consumer policy receipt invalid: ${verification.failures.map((failure) => failure.code).join(", ")}`);
@@ -215,7 +214,6 @@ function validateConsumerPolicyEvidence(passport, check) {
 }
 
 function validateEvidenceBoundCandidateHash(passport, check) {
-  if (!passport.familyEvidence && !passport.consumerPolicy) return;
   const expectedCandidateHash = sha256Json({
     repository: passport.repository,
     target: passport.target,
@@ -404,7 +402,6 @@ export function createReleaseCandidatePassport({
   const normalizedConsumerPolicy = normalizeConsumerPolicyEvidence(consumerPolicyReceipt, {
     repository: repository || normalizedSummary.git?.repository || "",
     sourceSha: normalizedSummary.publishSource?.ref === "publish-gate/anchor" ? (consumerPolicyReceipt?.receipt || consumerPolicyReceipt)?.caller?.sourceSha : sourceSha,
-    runtimeSha: resolvedBuildchain.sha,
   });
   if (isBuildchainRuntime(resolvedBuildchain) && !normalizedConsumerPolicy) {
     throw new Error("Buildchain v4 release candidate passport requires a valid floating consumer policy receipt");
@@ -413,7 +410,7 @@ export function createReleaseCandidatePassport({
     receipts: controllerReceipts,
     references: controllerReceiptReferences,
     expectedSourceSha: sourceSha,
-    expectedRuntimeSha: optionalString(buildchain.sha || normalizedSummary.runtime?.sha),
+
     requirePassed: true,
   });
   const candidate = {
@@ -578,7 +575,7 @@ export function validateReleaseCandidatePassport({
     for (const [index, reference] of (passport.controllerReceipts || []).entries()) {
       const validation = validateControllerReceiptReference(reference, {
         expectedSourceSha: passport.source?.headSha || "",
-        expectedRuntimeSha: passport.buildchain?.sha || "",
+
         requirePassed: true,
       });
       for (const issue of validation.issues) check(false, `controllerReceipts[${index}]: ${issue}`);

package/packages/core/release/reseal/actions.js

@@ -1,28 +1,9 @@
 import path from "node:path";
 import { getOctokit } from "@actions/github";
-import { command } from "../../runtime/action-process.mjs";
-import { installationRoot } from "../../runtime/installation-root.js";
-import { exactWorkflowRuntime } from "../../runtime/workflow-runtime.js";
 import { admitTailResealPlan } from "./plan.js";
 import { finalizeResealPlatform } from "./finalize-platform.js";
 import { sealTailReseal } from "./seal.js";
 import { tailPlanOutputs } from "./outputs.js";
-function runtime(core) {
-  const sha = exactWorkflowRuntime(
-    core.getInput("runtime-sha", { required: true }),
-  );
-  if (
-    command(
-      "git",
-      ["-C", installationRoot(import.meta.url), "rev-parse", "HEAD"],
-      { stdio: "pipe" },
-    ).trim() !== sha
-  )
-    throw new Error(
-      "Tail action runtime differs from admitted immutable commit",
-    );
-  return sha;
-}
 export async function admitTailResealPlanAction(core, env) {
   const request = JSON.parse(core.getInput("request-json", { required: true }));
   const result = await admitTailResealPlan(
@@ -30,7 +11,7 @@ export async function admitTailResealPlanAction(core, env) {
       request: JSON.parse(request["request-json"]),
       receipt: JSON.parse(request["consumer-policy-receipt-json"]),
       workspace: path.resolve(env.GITHUB_WORKSPACE),
-      runtimeSha: runtime(core),
+      runtimeSha: env.BUILDCHAIN_RUNTIME_SHA,
       sourceSha: env.GITHUB_SHA,
       repository: env.GITHUB_REPOSITORY,
     },
@@ -49,7 +30,7 @@ export async function admitTailResealPlanAction(core, env) {
 export function finalizeResealPlatformAction(core, env) {
   return finalizeResealPlatform({
     workspace: path.resolve(env.GITHUB_WORKSPACE),
-    runtimeSha: runtime(core),
+    runtimeSha: env.BUILDCHAIN_RUNTIME_SHA,
     platformId: core.getInput("platform", { required: true }),
     finalizationCommand: core.getInput("finalization-command"),
     signingToken: core.getInput("signing-token"),
@@ -61,7 +42,7 @@ export function finalizeResealPlatformAction(core, env) {
 export function sealTailResealAction(core, env) {
   const { passport, receipt } = sealTailReseal({
     workspace: path.resolve(env.GITHUB_WORKSPACE),
-    runtimeSha: runtime(core),
+    runtimeSha: env.BUILDCHAIN_RUNTIME_SHA,
     sourceSha: env.GITHUB_SHA,
     sourceRef: env.GITHUB_REF,
     repository: env.GITHUB_REPOSITORY,

package/packages/core/release/reseal/admission.js

@@ -6,8 +6,6 @@ export function verifyTailPolicyBindings({
   runtimeSha,
   sourceSha,
 }) {
-  if (request.runtime.sha !== runtimeSha)
-    throw new Error("Tail runtime differs from job.workflow_sha");
   if (request.source.sha !== sourceSha)
     throw new Error("Tail source differs from the fresh workflow source");
   const result = verifyFloatingConsumerPolicyReceipt({

package/packages/core/release/reseal/finalize-platform.js

@@ -17,8 +17,6 @@ export async function finalizeResealPlatform({
   const request = normalizeTailResealRequest(
     readJson(path.join(directory, "request.json")),
   );
-  if (request.runtime.sha !== runtimeSha)
-    throw new Error("Reseal platform runtime differs from admitted request");
   let readback = verifyTailResealPlatform({
     request,
     platformId,

package/packages/core/release/tail-reseal-github.js

@@ -122,8 +122,7 @@ function validateSigningAuthority(normalized, signingRun, signingArtifacts) {
   if (
     Number(signingRun?.id) !== normalized.signing.authorityRunId ||
     signingRun?.status !== "completed" ||
-    signingRun?.conclusion !== "success" ||
-    signingRun?.head_sha !== normalized.signing.runtimeSha
+    signingRun?.conclusion !== "success"
   )
     fault(
       "tail-reseal-signer-authority-mismatch",

package/packages/core/release/tail-reseal-receipt.js

@@ -157,7 +157,6 @@ export function createTailResealReceipt({
     );
   if (
     passport.contract !== "kungfu-buildchain-release-candidate-passport" ||
-    passport.buildchain?.sha !== normalized.runtime.sha ||
     passport.consumerPolicy?.receiptRoot !==
       normalized.runtime.consumerPolicyReceiptRoot
   )

package/packages/core/release/tail-reseal.js

@@ -177,19 +177,7 @@ function validateRuntime(value) {
     ["repository", "ref", "sha", "contractRoot", "consumerPolicyReceiptRoot"],
     "$/runtime",
   );
-  if (value.repository !== "kungfu-systems/buildchain")
-    fault(
-      "tail-reseal-runtime-mismatch",
-      "$/runtime/repository",
-      "official Buildchain runtime required",
-    );
-  if (!DOMAIN_RUNTIME_REF.test(value.ref))
-    fault(
-      "tail-reseal-runtime-mismatch",
-      "$/runtime/ref",
-      "v4-alpha or a transient v4 train is required",
-    );
-  sha(value.sha, "$/runtime/sha");
+
   root(value.contractRoot, "$/runtime/contractRoot");
   root(value.consumerPolicyReceiptRoot, "$/runtime/consumerPolicyReceiptRoot");
 }
@@ -342,7 +330,6 @@ function validateSigning(value, evaluatedAt) {
   );
   text(value.authorityRepository, "$/signing/authorityRepository");
   positiveInteger(value.authorityRunId, "$/signing/authorityRunId");
-  sha(value.runtimeSha, "$/signing/runtimeSha");
   for (const field of [
     "requestRoot",
     "delegationRoot",
@@ -495,12 +482,7 @@ export function normalizeTailResealRequest(request) {
   validateSigning(request.signing, request.evaluatedAt);
   validateReleaseTail(request.releaseTail);
   validatePlatforms(request.platforms);
-  if (request.signing.runtimeSha !== request.runtime.sha)
-    fault(
-      "tail-reseal-signing-runtime-mismatch",
-      "$/signing/runtimeSha",
-      "signing authority runtime differs from candidate runtime",
-    );
+
   const capsuleRoots = new Map(
     request.platforms.map((platform) => [platform.id, platform.capsuleRoot]),
   );

package/packages/core/release/version-state.js

@@ -236,6 +236,10 @@ function createTreeEquivalentReleaseImpact({
 }
 
 function assertAllowedLocalChanges(cwd, allowedPaths) {
+  const dependencies = fs.lstatSync(path.join(cwd, "node_modules"), { throwIfNoEntry: false });
+  if (dependencies?.isSymbolicLink()) {
+    throw new Error("Unexpected local changes: ?? node_modules (dependency bridge)");
+  }
   const allowed = new Set(allowedPaths);
   const output = execSync("git status --porcelain --untracked-files=all", {
     cwd,
@@ -266,14 +270,6 @@ function assertAllowedLocalChanges(cwd, allowedPaths) {
         ? filePath.startsWith(allowedPath)
         : filePath === allowedPath,
     );
-  const runtimeBridgePath = path.join(cwd, "node_modules");
-  let runtimeBridgePresent = false;
-  let isExactRuntimeBridge = false;
-  try {
-    runtimeBridgePresent = Boolean(fs.lstatSync(runtimeBridgePath));
-    isExactRuntimeBridge = fs.realpathSync(runtimeBridgePath) ===
-      fs.realpathSync(path.resolve(cwd, ".buildchain/runtime/node_modules"));
-  } catch { /* Missing paths are not the exact runtime bridge. */ }
   const unexpected = output
     .split(/\r?\n/)
     .filter(Boolean)
@@ -281,13 +277,8 @@ function assertAllowedLocalChanges(cwd, allowedPaths) {
       const status = line.slice(0, 2);
       const filePath = line.slice(3).trim();
       if (isEphemeralBuildchainEvidence(status, filePath)) return false;
-      if (status === "??" && filePath === "node_modules" && isExactRuntimeBridge) return false;
       return !(allowed.has(filePath) && status !== "??" && !status.includes("D"));
     });
-  if (runtimeBridgePresent && !isExactRuntimeBridge &&
-    !unexpected.includes("?? node_modules")) {
-    unexpected.push("?? node_modules");
-  }
   if (unexpected.length) throw new Error(`Unexpected version changes: ${unexpected.join(", ")}`);
 }
 
@@ -338,6 +329,18 @@ function runVersionVerification({
   if (!command && (!runLifecycleVerify || !lifecycleVerify) && !lifecycleVersionState) {
     return changedFiles;
   }
+  const lifecycleInstall = getLifecycleStage(loadedConfig, "install");
+  if (lifecycleVersionState && lifecycleInstall) {
+    // Source generators own their dependencies. Install against the original
+    // manifests before materializing the next version, independently of runtime X.
+    runLifecycleStage({
+      cwd,
+      loadedConfig,
+      name: "install",
+      stage: lifecycleInstall,
+      env: extraEnv,
+    });
+  }
   applyLocalVersionState(cwd, changedFiles);
   const lifecycleEnv = { BUILDCHAIN_VERSION: version, ...(extraEnv || {}) };
   if (lifecycleVersionState) {

package/packages/core/runtime/checkout-identity.js

@@ -12,16 +12,3 @@ export function verifyCheckoutIdentity(
     throw new Error(`${label} does not match the checked-out commit`);
   return actual;
 }
-export function verifySourceRuntimeCheckouts(
-  { sourceDirectory, sourceSha, runtimeDirectory, runtimeSha },
-  execute = command,
-) {
-  verifyCheckoutIdentity(
-    { directory: runtimeDirectory, sha: runtimeSha, label: "Runtime" },
-    execute,
-  );
-  verifyCheckoutIdentity(
-    { directory: sourceDirectory, sha: sourceSha, label: "Source" },
-    execute,
-  );
-}

package/packages/core/runtime/domain-wasm-artifact.js

@@ -2,6 +2,6 @@
 export const DOMAIN_WASM_ABI_VERSION = 1;
 export const DOMAIN_WASM_RUSTC = "rustc 1.96.0 (ac68faa20 2026-05-25)";
 export const DOMAIN_WASM_SOURCE_SHA256 =
-  "4434517a11caafc878c3829922144f68923d661f9f2f13d4b6e4734d9e62775c";
+  "83550684878224e6820594a44fc48f805c5ed1b3182ac32ebeb51b74cfd20a7f";
 export const DOMAIN_WASM_SHA256 =
-  "d1b4a91dfb0bee972b0460fc22d784840226b9bc116de44c823f6d504465aebb";
+  "504e23c9241f43611813f0fbd213b7a694946328b00e23d22f6ba678e7b0c841";

package/packages/core/runtime/entry/actions.js

@@ -0,0 +1,121 @@
+import { resolveRecoverySource } from "./recovery.js";
+import { getOctokit } from "@actions/github";
+import { runtimeEntryProvider } from "./github.js";
+import {
+  preparedRuntimeSelection,
+  selectExecutionRuntime,
+} from "./selection.js";
+
+export async function selectExecutionRuntimeAction(
+  core,
+  env,
+  { providerFactory = runtimeEntryProvider, githubFactory = getOctokit } = {},
+) {
+  const retained = core.getInput("selection");
+  const transport = retained
+    ? preparedRuntimeSelection(JSON.parse(retained))
+    : undefined;
+  const github = githubFactory(core.getInput("token", { required: true }));
+  let source = {
+    repository: core.getInput("source-repository") || env.GITHUB_REPOSITORY,
+    sha: core.getInput("source-sha") || env.GITHUB_SHA,
+    ref: env.GITHUB_REF,
+  };
+  const resumeRunId = core.getInput("resume-run-id");
+  if (resumeRunId) {
+    const reader = providerFactory(github, {
+      sourceRepository: source.repository,
+      sourceSha: source.sha,
+      actor: env.GITHUB_ACTOR,
+      eventName: env.GITHUB_EVENT_NAME,
+    });
+    await reader.authorize({ origin: "runtime-parameter" });
+    source = await resolveRecoverySource(
+      {
+        repository: source.repository,
+        runId: resumeRunId,
+        currentRunId: env.GITHUB_RUN_ID,
+        workflow: env.GITHUB_WORKFLOW_REF?.slice(source.repository.length + 1),
+      },
+      reader.readRun,
+    );
+  }
+  const provider = providerFactory(github, {
+    sourceRepository: source.repository,
+    sourceSha: source.sha,
+    actor: env.GITHUB_ACTOR,
+    eventName: env.GITHUB_EVENT_NAME,
+  });
+  const workflowSha = core.getInput("workflow-sha", { required: true });
+  const workflowRef = core.getInput("workflow-ref", { required: true });
+  const lockPath =
+    core.getInput("contract-lock") ||
+    transport?.contract?.path ||
+    (/@(?:refs\/tags\/)?v4-alpha$/u.test(workflowRef)
+      ? ".buildchain/alpha-contract-lock.json"
+      : ".buildchain/contract-lock.json");
+  if (
+    lockPath.startsWith("/") ||
+    lockPath.includes("\\") ||
+    lockPath.split("/").some((part) => !part || part === "." || part === "..")
+  )
+    throw new Error(
+      "Contract lock path must be relative to the consumer repository",
+    );
+  const runtimeRef = core.getInput("runtime-ref");
+  let selection;
+  if (retained) {
+    if (runtimeRef || resumeRunId)
+      throw new Error(
+        "Retained selection cannot be combined with a new runtime or recovery request",
+      );
+    selection = transport;
+    if (selection.origin === "runtime-parameter")
+      await provider.authorize({ origin: "runtime-parameter" });
+    if (selection.source?.runId) {
+      await provider.authorize({ origin: "runtime-parameter" });
+      source = await resolveRecoverySource(
+        {
+          repository: source.repository,
+          runId: selection.source.runId,
+          currentRunId: env.GITHUB_RUN_ID,
+          workflow: env.GITHUB_WORKFLOW_REF?.slice(
+            source.repository.length + 1,
+          ),
+        },
+        provider.readRun,
+      );
+    }
+    if (
+      selection.source?.repository !== source.repository ||
+      selection.source?.sha !== source.sha
+    )
+      throw new Error("Runtime transport changed the admitted consumer source");
+  } else {
+    selection = await selectExecutionRuntime(
+      {
+        workflowSha: core.getInput("workflow-sha", { required: true }),
+        runtimeRef,
+        lock: runtimeRef ? undefined : await provider.readLock(lockPath),
+      },
+      provider,
+    );
+  }
+  selection = {
+    ...selection,
+    source,
+    contract: {
+      ...selection.contract,
+      path: selection.contract?.path || lockPath,
+    },
+  };
+  core.setOutput("selection", selection);
+  core.setOutput("source-sha", selection.source.sha);
+  core.setOutput("source-ref", selection.source.ref);
+  core.setOutput("repository", selection.repository);
+  core.setOutput("sha", selection.sha);
+  core.setOutput("ref", selection.ref);
+  core.setOutput("class", selection.class);
+  core.setOutput("origin", selection.origin);
+  core.setOutput("override", String(selection.origin === "runtime-parameter"));
+}