@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/packages/core/runtime/entry/activation.js

@@ -0,0 +1,86 @@
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { installLockedDependencies } from "../locked-dependencies.js";
+import { preparedRuntimeSelection } from "./selection.js";
+
+export function activateExecutionRuntime(
+  { selection, workspace },
+  {
+    readCommit = (directory) =>
+      execFileSync("git", ["-C", directory, "rev-parse", "HEAD"], {
+        encoding: "utf8",
+      }).trim(),
+    install = installLockedDependencies,
+  } = {},
+) {
+  const selected = preparedRuntimeSelection(selection);
+  const directory = path.resolve(workspace, ".buildchain/runtime");
+  if (readCommit(directory).toLowerCase() !== selected.sha)
+    throw new Error(
+      "Runtime preparation acquired different bytes than selected",
+    );
+  const protocol = JSON.parse(
+    fs.readFileSync(
+      path.join(directory, "architecture/runtime-entry.json"),
+      "utf8",
+    ),
+  );
+  if (
+    protocol.schema !== "buildchain.runtime-entry/v1" ||
+    protocol.protocol !== selected.protocol
+  )
+    throw new Error(
+      "Acquired runtime does not implement the admitted entry protocol",
+    );
+  const contractFile = path.join(
+    directory,
+    "dist/site/buildchain-contract.json",
+  );
+  const contract = JSON.parse(fs.readFileSync(contractFile, "utf8"));
+  if (!/^sha256:[0-9a-f]{64}$/u.test(contract.contractDigest || ""))
+    throw new Error("Prepared runtime distribution lacks a contract digest");
+  if (
+    selected.contract?.digest &&
+    selected.contract.digest !== contract?.contractDigest
+  )
+    throw new Error("Selected runtime contract differs from the consumer lock");
+  const { nodePath } = install({
+    directory,
+    production: true,
+    ignoreScripts: true,
+  });
+  return { directory, nodePath, selection: selected, contract };
+}
+
+export function activateExecutionRuntimeAction(core, env) {
+  const result = activateExecutionRuntime({
+    selection: JSON.parse(core.getInput("selection", { required: true })),
+    workspace: env.GITHUB_WORKSPACE || process.cwd(),
+  });
+  // Execution identity is provenance. Only this preparation boundary validates it.
+  core.exportVariable("BUILDCHAIN_RUNTIME_ROOT", result.directory);
+  core.exportVariable(
+    "BUILDCHAIN_CONTRACT_DIGEST",
+    result.contract?.contractDigest || "",
+  );
+  core.exportVariable(
+    "BUILDCHAIN_EXECUTION_SOURCE",
+    JSON.stringify(result.selection.source || {}),
+  );
+  core.exportVariable("BUILDCHAIN_RUNTIME_SHA", result.selection.sha);
+  core.exportVariable("BUILDCHAIN_RUNTIME_REF", result.selection.ref);
+  core.exportVariable("BUILDCHAIN_RUNTIME_CLASS", result.selection.class);
+  core.exportVariable("BUILDCHAIN_RUNTIME_ORIGIN", result.selection.origin);
+  core.exportVariable(
+    "BUILDCHAIN_RUNTIME_OVERRIDE",
+    String(result.selection.origin === "runtime-parameter"),
+  );
+  core.exportVariable(
+    "BUILDCHAIN_RUNTIME_SELECTION",
+    JSON.stringify(result.selection),
+  );
+  core.exportVariable("BUILDCHAIN_NODE_PATH", result.nodePath);
+  core.setOutput("directory", result.directory);
+  core.setOutput("node-path", result.nodePath);
+}

package/packages/core/runtime/entry/github.js

@@ -0,0 +1,55 @@
+export function runtimeEntryProvider(
+  github,
+  { sourceRepository, sourceSha, actor, eventName },
+) {
+  const parts = (repository) => {
+    const [owner, repo] = repository.split("/");
+    if (!owner || !repo)
+      throw new Error("Runtime entry requires an owner/repository");
+    return { owner, repo };
+  };
+  async function readJson(repository, ref, file, optional = false) {
+    try {
+      const { data } = await github.rest.repos.getContent({
+        ...parts(repository),
+        ref,
+        path: file,
+      });
+      if (data.type !== "file" || data.encoding !== "base64")
+        throw new Error(`Runtime entry expected a JSON file: ${file}`);
+      return JSON.parse(Buffer.from(data.content, "base64").toString("utf8"));
+    } catch (error) {
+      if (optional && error.status === 404) return undefined;
+      throw error;
+    }
+  }
+  return {
+    readLock: (file) => readJson(sourceRepository, sourceSha, file, true),
+    readRun: async ({ repository, runId }) =>
+      (
+        await github.rest.actions.getWorkflowRun({
+          ...parts(repository),
+          run_id: runId,
+        })
+      ).data,
+    resolveRef: async ({ repository, ref }) =>
+      (await github.rest.repos.getCommit({ ...parts(repository), ref })).data
+        .sha,
+    readProtocol: ({ repository, sha }) =>
+      readJson(repository, sha, "architecture/runtime-entry.json"),
+    authorize: async ({ origin }) => {
+      if (origin !== "runtime-parameter") return;
+      // GitHub already authorizes workflow_dispatch using repository Actions
+      // write permission, including installation tokens without a collaborator.
+      if (eventName === "workflow_dispatch") return;
+      const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+        ...parts(sourceRepository),
+        username: actor,
+      });
+      if (!["admin", "maintain", "write"].includes(data.permission))
+        throw new Error(
+          "Transient runtime selection requires repository write permission",
+        );
+    },
+  };
+}

package/packages/core/runtime/entry/recovery.js

@@ -0,0 +1,37 @@
+export async function resolveRecoverySource(
+  { repository, runId, currentRunId, workflow },
+  readRun,
+) {
+  if (
+    !/^[1-9]\d*$/u.test(String(runId)) ||
+    String(runId) === String(currentRunId)
+  )
+    throw new Error("Recovery requires a different positive workflow run ID");
+  const run = await readRun({ repository, runId: Number(runId) });
+  if (
+    run.repository?.full_name !== repository ||
+    run.head_repository?.full_name !== repository
+  )
+    throw new Error("Recovery cannot cross repository or fork boundaries");
+  if (workflow && run.path?.split("@")[0] !== workflow.split("@")[0])
+    throw new Error(
+      "Recovery must enter through the original consumer workflow",
+    );
+  if (
+    run.status !== "completed" ||
+    !["failure", "cancelled", "timed_out", "action_required"].includes(
+      run.conclusion,
+    )
+  )
+    throw new Error("Recovery requires a completed unsuccessful execution");
+  if (!/^[a-f0-9]{40}$/u.test(run.head_sha || ""))
+    throw new Error("Recovery source commit is unavailable");
+  return {
+    repository,
+    sha: run.head_sha,
+    ref: run.head_branch || run.head_sha,
+    runId: String(run.id),
+    attempt: String(run.run_attempt),
+    workflow: run.path,
+  };
+}

package/packages/core/runtime/entry/selection.js

@@ -0,0 +1,110 @@
+const exactSha = /^[a-f0-9]{40}$/iu;
+const repository = "kungfu-systems/buildchain";
+const trainRef =
+  /^(?:refs\/(?:heads|tags)\/)?train\/v4\/v4\.\d+\/[a-zA-Z0-9._/-]+$/u;
+
+function commit(value, label) {
+  if (!exactSha.test(value || ""))
+    throw new Error(`${label} must resolve to an exact commit`);
+  return value.toLowerCase();
+}
+
+export function runtimeSelector({ runtimeRef = "", lock, workflowSha }) {
+  if (runtimeRef) {
+    if (
+      runtimeRef
+        .split("/")
+        .some((part) => part === ".." || part === "." || part === "")
+    )
+      throw new Error("Runtime parameter contains an unsafe reference");
+    if (
+      !exactSha.test(runtimeRef) &&
+      !trainRef.test(runtimeRef) &&
+      !["v4", "v4-alpha"].includes(runtimeRef)
+    )
+      throw new Error(
+        "Runtime parameter must name an exact commit, channel or train",
+      );
+    return { ref: runtimeRef, origin: "runtime-parameter" };
+  }
+  if (lock) {
+    if (lock.contract !== "kungfu-buildchain-contract-lock")
+      throw new Error("Unsupported Buildchain contract lock");
+    const sha = commit(lock.buildchain?.resolvedSha, "Contract lock runtime");
+    if (
+      lock.schemaVersion !== 1 ||
+      !["v4", "v4-alpha"].includes(lock.buildchain.ref) ||
+      !/^sha256:[0-9a-f]{64}$/u.test(lock.buildchain.contractDigest || "")
+    )
+      throw new Error(
+        "Contract lock must declare its channel and contract digest",
+      );
+    return {
+      ref: sha,
+      origin: "contract-lock",
+    };
+  }
+  return {
+    ref: commit(workflowSha, "Workflow default"),
+    origin: "workflow-default",
+  };
+}
+
+export function preparedRuntimeSelection(value) {
+  if (
+    value?.schema !== "buildchain.runtime-selection/v1" ||
+    value.repository !== repository ||
+    value.protocol !== 1
+  )
+    throw new Error("Unsupported runtime selection");
+  return { ...value, sha: commit(value.sha, "Selected runtime") };
+}
+
+export async function selectExecutionRuntime(
+  request,
+  { resolveRef, authorize, readProtocol },
+) {
+  const selected = runtimeSelector(request);
+  // Authorization belongs to entry selection, never to subsequent business nodes.
+  await authorize({ ...selected, repository });
+  const sha = exactSha.test(selected.ref)
+    ? selected.ref.toLowerCase()
+    : commit(
+        await resolveRef({ repository, ref: selected.ref }),
+        "Runtime reference",
+      );
+  const protocol = await readProtocol({ repository, sha });
+  if (
+    protocol?.schema !== "buildchain.runtime-entry/v1" ||
+    protocol.protocol !== 1
+  )
+    throw new Error("Selected runtime does not implement the entry protocol");
+  return {
+    schema: "buildchain.runtime-selection/v1",
+    protocol: 1,
+    repository,
+    sha,
+    ref:
+      selected.origin === "contract-lock"
+        ? request.lock.buildchain.ref || selected.ref
+        : selected.ref,
+    origin: selected.origin,
+    ...(selected.origin === "contract-lock"
+      ? { contract: { digest: request.lock.buildchain.contractDigest } }
+      : {}),
+    class:
+      selected.origin === "contract-lock" &&
+      request.lock.buildchain.ref === "v4-alpha"
+        ? "alpha"
+        : selected.origin === "contract-lock" &&
+            request.lock.buildchain.ref === "v4"
+          ? "stable"
+          : trainRef.test(selected.ref)
+            ? "train"
+            : selected.ref === "v4-alpha"
+              ? "alpha"
+              : selected.ref === "v4"
+                ? "stable"
+                : "exact-sha",
+  };
+}

package/packages/core/web/controller.js

@@ -58,7 +58,7 @@ export function webControllerStages(observations, prepublication = false) {
     "production-apply",
   ].map(result);
   return [
-    { id: "resolve-runtime", status: result("runtime") },
+    { id: "resolve-runtime", status: result("execution-runtime") },
     { id: "plan", status: result("plan") },
     { id: "build", status: plan["build-outcome"] || result("plan") },
     { id: "verify", status: plan["verify-outcome"] || result("plan") },

package/packages/core/web/publication-admission-action.js

@@ -2,7 +2,6 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { getOctokit } from "@actions/github";
-import { command } from "../runtime/action-process.mjs";
 import { installationRoot } from "../runtime/installation-root.js";
 import { finalizeWebController } from "./controller.js";
 import { assembleWebPublicationAdmission } from "./publication-admission.js";
@@ -15,13 +14,7 @@ export async function sealWebPublicationAction(core, env) {
   const sourceSha =
     observations["release-intent"].outputs["production-source-sha"];
   const runtimeRoot = installationRoot(import.meta.url);
-  const runtimeSha = command("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], {
-    stdio: "pipe",
-  })
-    .trim()
-    .toLowerCase();
-  if (runtimeSha !== observations.runtime.outputs["runtime-sha"])
-    throw new Error("Web publication runtime changed after admission");
+  const runtimeSha = env.BUILDCHAIN_RUNTIME_SHA;
   const { receipt } = finalizeWebController({
     workspace: env.GITHUB_WORKSPACE,
     observations,

package/packages/core/web/web-surface-publication-candidate.js

@@ -89,7 +89,7 @@ export function createWebSurfacePublicationCandidate({
   const normalizedRepository = requiredString(repository, "repository");
   const normalizedSourceSha = normalizeGitSha(sourceSha, "sourceSha");
   const normalizedSourceTreeSha = normalizeGitSha(sourceTreeSha, "sourceTreeSha");
-  const normalizedRuntimeSha = normalizeGitSha(runtimeSha, "runtimeSha");
+  const normalizedRuntimeSha = runtimeSha;
   if (plan?.contract !== "kungfu-buildchain-web-surface-deploy-plan") {
     throw new Error("web-surface publication plan contract mismatch");
   }
@@ -103,9 +103,6 @@ export function createWebSurfacePublicationCandidate({
   if (normalizeDigest(plan.manifest?.artifactHash, "plan.manifest.artifactHash") !== artifactHash) {
     throw new Error("web-surface publication plan artifact hash mismatch");
   }
-  if (plan.manifest?.runtimeId && String(plan.manifest.runtimeId).toLowerCase() !== normalizedRuntimeSha) {
-    throw new Error("web-surface publication plan runtime SHA mismatch");
-  }
   const canonicalPlanDigest = crypto
     .createHash("sha256")
     .update(`${JSON.stringify(plan, null, 2)}\n`)
@@ -115,7 +112,7 @@ export function createWebSurfacePublicationCandidate({
   }
   const controllerValidation = validateControllerReceipt(controllerReceipt, {
     expectedSourceSha: normalizedSourceSha,
-    expectedRuntimeSha: normalizedRuntimeSha,
+
   });
   if (!controllerValidation.ok || !controllerValidation.qualifying) {
     throw new Error(`web-surface publication controller receipt did not qualify: ${controllerValidation.issues.join("; ")}`);

package/packages/core/workflow/admission/actions.js

@@ -1,45 +1,25 @@
 import fs from "node:fs";
 import path from "node:path";
-import { workflowInstallationRoot } from "../installation.js";
+import { installationRoot } from "../../runtime/installation-root.js";
 import {
   inspectUniversalRequest,
-  admitReviewedWorkflow,
+  admitConsumerCapability,
 } from "./transactions.js";
-import { readCandidateReview } from "./review.js";
 const request = (core) =>
   JSON.parse(core.getInput("request-json", { required: true }));
 export function inspectUniversalRequestAction(core) {
   const outputs = inspectUniversalRequest(
     request(core),
-    core.getBooleanInput("recovery"),
   );
   for (const [key, value] of Object.entries(outputs))
     core.setOutput(key, value);
 }
-export function reviewUniversalCandidateAction(core, env) {
-  const review = readCandidateReview({
+export function admitConsumerCapabilityAction(core, env) {
+  const admitted = admitConsumerCapability({
     request: request(core),
+    runtime: JSON.parse(env.BUILDCHAIN_RUNTIME_SELECTION),
     workspace: env.GITHUB_WORKSPACE,
-    runtimeRoot: workflowInstallationRoot(import.meta.url),
-    candidateRoot: path.join(env.GITHUB_WORKSPACE, ".buildchain/candidate"),
-    token: core.getInput("token", { required: true }),
-  });
-  const file = path.join(
-    env.GITHUB_WORKSPACE,
-    ".buildchain/review-evidence.json",
-  );
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, JSON.stringify(review, null, 2) + "\n");
-  core.setOutput("review-json", JSON.stringify(review));
-}
-export function admitUniversalCandidateAction(core, env) {
-  const admitted = admitReviewedWorkflow({
-    request: request(core),
-    reviewEvidence: JSON.parse(
-      core.getInput("review-json", { required: true }),
-    ),
-    workspace: env.GITHUB_WORKSPACE,
-    candidateRoot: path.join(env.GITHUB_WORKSPACE, ".buildchain/candidate"),
+    runtimeRoot: installationRoot(import.meta.url),
     consumer: {
       repository: env.GITHUB_REPOSITORY,
       sha: env.GITHUB_SHA,

package/packages/core/workflow/admission/recovery.js

@@ -1,47 +1,7 @@
-import { requireValue } from "../../runtime/action-process.mjs";
+import { assertResultLineage } from "../engine/execution.js";
 import { completeUniversalWorkflow } from "../universal-workflow-bootstrap.js";
 
-export function recoveryCoordinates(request) {
-  const candidate = request.candidate;
-  requireValue(
-    request.schema === "kungfu-buildchain-v4-universal-workflow-request/v1" &&
-      request.mode === "train",
-    "Recovery requires the current Train request envelope",
-  );
-  requireValue(
-    candidate?.repository === "kungfu-systems/buildchain" &&
-      /^train\/v4\/v4\.\d+\/[A-Za-z0-9][A-Za-z0-9._/-]*$/u.test(
-        candidate.discoveryRef || "",
-      ) &&
-      !candidate.discoveryRef.split("/").includes(".."),
-    "Recovery requires a Buildchain capability Train",
-  );
-  requireValue(
-    /^[0-9a-f]{40}$/u.test(candidate.expectedSha || "") &&
-      Number.isSafeInteger(candidate.reviewPullRequest) &&
-      candidate.reviewPullRequest > 0,
-    "Recovery requires an exact candidate SHA and review PR",
-  );
-  return {
-    repository: candidate.repository,
-    ref: candidate.discoveryRef,
-    sha: candidate.expectedSha,
-    pr: candidate.reviewPullRequest,
-  };
-}
 export function recoveryTerminalReceipt(admission, result) {
-  requireValue(
-    result.schema === "kungfu-buildchain-v4-universal-workflow-result/v1" &&
-      ["succeeded", "failed"].includes(result.status) &&
-      result.requestRoot === admission.requestRoot &&
-      result.capabilityRoot === admission.capabilityRoot &&
-      result.runtime?.repository === admission.runtime?.repository &&
-      result.runtime?.sha === admission.runtime?.sha,
-    "candidate result does not match the consumer-owned admission lineage",
-  );
-  return completeUniversalWorkflow({
-    admission,
-    resultRoot: result.resultRoot,
-    status: result.status,
-  });
+  assertResultLineage(admission, result);
+  return completeUniversalWorkflow({ admission, resultRoot: result.resultRoot, status: result.status });
 }

package/packages/core/workflow/admission/transactions.js

@@ -1,44 +1,29 @@
 import fs from "node:fs";
 import path from "node:path";
-import { command } from "../../runtime/action-process.mjs";
 import {
   validateUniversalWorkflowRequest,
   universalWorkflowRequestRoot,
   admitUniversalWorkflow,
 } from "../universal-workflow-bootstrap.js";
-import { recoveryCoordinates } from "./recovery.js";
-export function inspectUniversalRequest(request, recovery = false) {
-  if (recovery) recoveryCoordinates(request);
+export function inspectUniversalRequest(request) {
   const value = validateUniversalWorkflowRequest(request);
   return {
-    mode: value.mode,
-    repository: value.candidate.repository,
-    "discovery-ref": value.candidate.discoveryRef,
-    "expected-sha": value.candidate.expectedSha,
-    "review-pr": value.candidate.reviewPullRequest,
     "capability-id": value.capability.id,
     "request-root": universalWorkflowRequestRoot(value),
   };
 }
-export function admitReviewedWorkflow({
+export function admitConsumerCapability({
   request,
-  reviewEvidence,
   workspace,
-  candidateRoot,
+  runtimeRoot,
   consumer,
+  runtime,
 }) {
-  const observedSha = command(
-    "git",
-    ["-C", candidateRoot, "rev-parse", "HEAD"],
-    { stdio: "pipe" },
-  )
-    .trim()
-    .toLowerCase();
   const policy = JSON.parse(
     fs.readFileSync(
       path.join(
-        candidateRoot,
-        "architecture/universal-workflow-train-admission.json",
+        runtimeRoot,
+        "architecture/universal-workflow-capability-policy.json",
       ),
       "utf8",
     ),
@@ -46,12 +31,11 @@ export function admitReviewedWorkflow({
   const admitted = admitUniversalWorkflow({
     request,
     policy,
-    observedRefSha: observedSha,
+    runtime,
     observedConsumerRepository: consumer.repository,
     observedConsumerSha: consumer.sha,
     observedConsumerWorkflowRef: consumer.workflowRef,
-    reviewEvidence,
-    now: new Date().toISOString(),
+      now: new Date().toISOString(),
   });
   const file = path.join(workspace, ".buildchain/admission.json");
   fs.mkdirSync(path.dirname(file), { recursive: true });

package/packages/core/workflow/commands/buildchain-cli-help.mjs

@@ -267,7 +267,7 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain paper alpha [--cwd <dir>] [--source-ref <ref>] [--target-ref <ref>]
                           [--execute] [--json]
   buildchain paper status [--cwd <dir>] [--json]
-  buildchain paper resume [--cwd <dir>] [--buildchain-ref <ref>] [--execute] [--json]
+  buildchain paper resume [--cwd <dir>] [--runtime-ref <ref>] [--execute] [--json]
   buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
   buildchain badges readme [--cwd <dir>] [--readme <path>] [--check] [--write] [--json]
   buildchain badges bundle [--cwd <dir>] [--readme <path>] [--claims <csv>] [--check] [--write] [--json]

package/packages/core/workflow/commands/universal-workflow-engine.mjs

@@ -26,8 +26,6 @@ if (command === "inspect") {
   emit({
     schema: "kungfu-buildchain-v4-universal-workflow-inspection/v1",
     requestRoot: universalWorkflowRequestRoot(request),
-    mode: request.mode,
-    candidate: request.candidate,
     consumer: request.consumer,
     capability: request.capability,
   });
@@ -36,15 +34,12 @@ if (command === "inspect") {
     admitUniversalWorkflow({
       request: readJsonEnvironment("BUILDCHAIN_UNIVERSAL_REQUEST_JSON"),
       policy: readJsonEnvironment("BUILDCHAIN_UNIVERSAL_ADMISSION_POLICY_JSON"),
-      observedRefSha: process.env.BUILDCHAIN_UNIVERSAL_OBSERVED_SHA,
+      runtime: readJsonEnvironment("BUILDCHAIN_RUNTIME_SELECTION"),
       observedConsumerRepository:
         process.env.BUILDCHAIN_UNIVERSAL_CONSUMER_REPOSITORY,
       observedConsumerSha: process.env.BUILDCHAIN_UNIVERSAL_CONSUMER_SHA,
       observedConsumerWorkflowRef:
         process.env.BUILDCHAIN_UNIVERSAL_CONSUMER_WORKFLOW_REF,
-      reviewEvidence: readJsonEnvironment(
-        "BUILDCHAIN_UNIVERSAL_REVIEW_EVIDENCE_JSON",
-      ),
       now: process.env.BUILDCHAIN_UNIVERSAL_OBSERVED_AT,
     }),
   );
@@ -54,7 +49,7 @@ if (command === "inspect") {
   );
   const admission = readJsonEnvironment("BUILDCHAIN_UNIVERSAL_ADMISSION_JSON");
   emit(await executeAdmittedWorkflow(request, admission, {
-    engineSha: process.env.BUILDCHAIN_UNIVERSAL_ENGINE_SHA, runtimeRoot: installationRoot(import.meta.url),
+    runtimeRoot: installationRoot(import.meta.url),
     ...providerExecutionContext({ token: process.env.GH_TOKEN || process.env.GITHUB_TOKEN || "", mutationToken: process.env.BUILDCHAIN_PROMOTION_TOKEN || "", env: process.env }),
   }));
 } else if (command === "terminal") {

package/packages/core/workflow/dogfood/actions.js

@@ -1,7 +1,5 @@
 import fs from "node:fs";
 import * as github from "@actions/github";
-import { installationRoot } from "../../runtime/installation-root.js";
-import { command } from "../../runtime/action-process.mjs";
 import { readSelfDogfoodReadiness } from "./readiness.js";
 import {
   selfDogfoodCoordinates,
@@ -26,24 +24,10 @@ export async function admitSelfDogfoodAction(core, env) {
   }))
     core.setOutput(key, value);
 }
-function exactCandidate(sha) {
-  if (
-    !/^[0-9a-f]{40}$/.test(sha || "") ||
-    command(
-      "git",
-      ["-C", installationRoot(import.meta.url), "rev-parse", "HEAD"],
-      { stdio: "pipe" },
-    ).trim() !== sha
-  )
-    throw new Error(
-      "Self-dogfood must execute the exact independently reviewed candidate",
-    );
-}
 export function generateSelfDogfoodRequestsAction(core) {
   const coordinates = JSON.parse(
     core.getInput("coordinates-json", { required: true }),
   );
-  exactCandidate(coordinates["candidate-sha"]);
   for (const [key, value] of Object.entries(
     createSelfDogfoodRequests(coordinates),
   ))
@@ -51,7 +35,6 @@ export function generateSelfDogfoodRequestsAction(core) {
 }
 export function reconcileSelfDogfoodAction(core, env) {
   const candidateSha = core.getInput("candidate-sha", { required: true });
-  exactCandidate(candidateSha);
   return reconcileSelfDogfood({
     workspace: env.GITHUB_WORKSPACE,
     candidateSha,

package/packages/core/workflow/engine/action.js

@@ -1,6 +1,5 @@
 import fs from "node:fs";
 import path from "node:path";
-import { command } from "../../runtime/action-process.mjs";
 import { installationRoot } from "../../runtime/installation-root.js";
 import { executeAdmittedWorkflow } from "./execution.js";
 import { providerExecutionContext } from "./provider-context.js";
@@ -18,15 +17,11 @@ export function candidateResultOutputs(value) {
 }
 export async function executeCandidateAction(core, env) {
   const runtimeRoot = installationRoot(import.meta.url);
-  const engineSha = command("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], {
-    stdio: "pipe",
-  }).trim();
   const result = await executeAdmittedWorkflow(
     JSON.parse(core.getInput("request-json", { required: true })),
     JSON.parse(core.getInput("admission-json", { required: true })),
     {
       runtimeRoot,
-      engineSha,
       ...providerExecutionContext({
         token: core.getInput("token", { required: true }),
         mutationToken: core.getInput("mutation-token"),

package/packages/core/workflow/engine/conformance.js

@@ -37,7 +37,7 @@ export function executeBootstrapConformance(
     fs.readFileSync(
       path.join(
         runtimeRoot,
-        "architecture/universal-workflow-train-admission.json",
+        "architecture/universal-workflow-capability-policy.json",
       ),
     ),
   );

package/packages/core/workflow/engine/execution.js

@@ -24,11 +24,6 @@ async function executeCandidate(request, admission, context) {
   const runtime = exactRuntime(admission);
   if (universalWorkflowRequestRoot(request) !== admission.requestRoot)
     fail("candidate request does not match the admitted request root");
-  const engineSha = String(context.engineSha || "")
-    .trim()
-    .toLowerCase();
-  if (engineSha !== runtime.sha)
-    fail("candidate engine checkout does not match the admitted runtime SHA");
   try {
     return {
       status: "succeeded",
@@ -65,12 +60,13 @@ export async function executeAdmittedWorkflow(request, admission, context) {
 }
 
 export function assertResultLineage(admission, result) {
+  const { resultRoot, ...body } = result || {};
+  if (resultRoot !== contentRoot("universal-workflow-result", body)) fail("candidate result root mismatch");
   if (
     result?.schema !== "kungfu-buildchain-v4-universal-workflow-result/v1" ||
     result.requestRoot !== admission.requestRoot ||
     result.capabilityRoot !== admission.capabilityRoot ||
     result.runtime?.repository !== admission.runtime?.repository ||
-    result.runtime?.sha !== admission.runtime?.sha ||
     !["succeeded", "failed"].includes(result.status)
   )
     fail("candidate result does not match the admitted lineage");