@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/packages/core/workflow/engine/identity.js

@@ -1,12 +1,7 @@
 import crypto from "node:crypto";
 export function exactRuntime(admission) {
   const runtime = admission?.runtime;
-  if (
-    admission?.status !== "admitted" ||
-    runtime?.repository !== "kungfu-systems/buildchain" ||
-    !/^[0-9a-f]{40}$/u.test(runtime?.sha || "")
-  )
-    fail("an exact admitted Buildchain runtime is required");
+  if (admission?.status !== "admitted") fail("Capability execution requires an admitted request");
   return runtime;
 }
 export function contentRoot(domain, value) {

package/packages/core/workflow/engine/release-environment.js

@@ -9,7 +9,7 @@ export function prepareTrustedPublishingNpm() {
     !process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN
   )
     fail("trusted publishing requires GitHub Actions OIDC authority");
-  const binDirectory = path.resolve(".buildchain/runtime/bin");
+  const binDirectory = path.resolve(".buildchain/tooling/trusted-publishing/bin");
   const npmShim = path.join(binDirectory, "npm");
   fs.mkdirSync(binDirectory, { recursive: true });
   fs.writeFileSync(
@@ -20,38 +20,14 @@ export function prepareTrustedPublishingNpm() {
   fs.chmodSync(npmShim, 0o755);
   process.env.PATH = `${binDirectory}${path.delimiter}${process.env.PATH || ""}`;
 }
-export function prepareReleasePromotionConsumerDependencies(repository) {
-  if (repository !== "kungfu-systems/buildchain") return;
-  const manifest = JSON.parse(fs.readFileSync("package.json", "utf8"));
-  if (
-    manifest.packageManager !== "pnpm@11.7.0" ||
-    !fs.existsSync("pnpm-lock.yaml")
-  )
-    fail("Buildchain release consumer dependency lock is unavailable");
-  const consumerModules = path.resolve("node_modules"),
-    runtimeModules = path.resolve(".buildchain/runtime/node_modules");
-  if (!fs.existsSync(consumerModules) && fs.existsSync(runtimeModules))
-    fs.symlinkSync(
-      path.relative(path.dirname(consumerModules), runtimeModules),
-      consumerModules,
-      "dir",
-    );
-  if (!fs.existsSync("node_modules/@kungfu-tech/kfd/package.json"))
-    execFileSync(
-      "corepack",
-      "pnpm@11.7.0 install --frozen-lockfile --ignore-scripts".split(" "),
-      { stdio: ["ignore", 2, 2] },
-    );
-  if (fs.existsSync(runtimeModules)) {
-    if (fs.realpathSync(consumerModules) !== fs.realpathSync(runtimeModules))
-      fail("Buildchain release consumer runtime bridge conflicts");
-    return;
-  }
-  fs.mkdirSync(path.dirname(runtimeModules), { recursive: true });
-  fs.renameSync(consumerModules, runtimeModules);
-  fs.symlinkSync(
-    path.relative(path.dirname(consumerModules), runtimeModules),
-    consumerModules,
-    "dir",
-  );
+export function prepareReleaseConsumerDependencies(directory = process.cwd(), execute = execFileSync) {
+  const file = path.join(directory, "package.json");
+  if (!fs.existsSync(file)) return;
+  const manifest = JSON.parse(fs.readFileSync(file, "utf8"));
+  const manager = String(manifest.packageManager || "");
+  if (!/^(?:npm|pnpm|yarn)@\d+\.\d+\.\d+(?:\+sha\d+\.[a-zA-Z0-9]+)?$/u.test(manager))
+    fail("Release consumer dependencies require a pinned packageManager");
+  const kind = manager.split("@")[0];
+  const args = kind === "npm" ? ["ci", "--ignore-scripts"] : kind === "pnpm" ? ["install", "--frozen-lockfile", "--ignore-scripts"] : /^yarn@1\./u.test(manager) ? ["install", "--frozen-lockfile", "--ignore-scripts"] : ["install", "--immutable", "--mode=skip-builds"];
+  execute("corepack", [manager, ...args], { cwd: directory, stdio: ["ignore", 2, 2] });
 }

package/packages/core/workflow/engine/release-promotion.js

@@ -16,7 +16,7 @@ import {
 } from "./release-observation.js";
 import {
   prepareTrustedPublishingNpm,
-  prepareReleasePromotionConsumerDependencies,
+  prepareReleaseConsumerDependencies,
 } from "./release-environment.js";
 import { verifiedReleaseDocuments } from "./release-evidence.js";
 async function materializeProductPublicationIntent(
@@ -125,7 +125,7 @@ export async function executeReleasePromotion(request, admission, context) {
     fail(`release route blocked: ${route.reason}`);
   if (route.decision === "NoOp" || payload.inputs["dry-run"] === true)
     return { route, dryRun: payload.inputs["dry-run"] === true };
-  prepareReleasePromotionConsumerDependencies(repository);
+  prepareReleaseConsumerDependencies();
   if (payload.inputs["trusted-publishing"] === true)
     prepareTrustedPublishingNpm();
   const candidate = await resolveReleaseCandidateArtifacts({

package/packages/core/workflow/settlement/actions.js

@@ -1,7 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
 import { recoveryTerminalReceipt } from "../admission/recovery.js";
-import { upsertUniversalBackflow } from "./backflow.js";
 export function sealUniversalReceiptAction(core, env) {
   const admission = JSON.parse(
       core.getInput("admission-json", { required: true }),
@@ -21,14 +20,3 @@ export function sealUniversalReceiptAction(core, env) {
       "Candidate workflow failed after sealing its terminal receipt",
     );
 }
-export async function reconcileUniversalBackflowAction(core, env) {
-  const result = await upsertUniversalBackflow({
-    request: JSON.parse(core.getInput("request-json", { required: true })),
-    receipt: JSON.parse(core.getInput("receipt-json", { required: true })),
-    token: core.getInput("token", { required: true }),
-  });
-  const file = path.join(env.GITHUB_WORKSPACE, ".buildchain/backflow.json");
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, JSON.stringify(result, null, 2) + "\n");
-  core.setOutput("backflow-root", result.backflowRoot || "");
-}

package/packages/core/workflow/universal-self-dogfood.js

@@ -33,7 +33,7 @@ function contentRoot(domain, value) {
   return `sha256:${hash.digest("hex")}`;
 }
 
-function defaultPolicy() { return JSON.parse(fs.readFileSync(path.join(installationRoot(import.meta.url), "architecture/universal-workflow-train-admission.json"), "utf8")); }
+function defaultPolicy() { return JSON.parse(fs.readFileSync(path.join(installationRoot(import.meta.url), "architecture/universal-workflow-capability-policy.json"), "utf8")); }
 
 function exactSha(value, label) {
   const normalized = String(value || "").toLowerCase();
@@ -42,16 +42,11 @@ function exactSha(value, label) {
 }
 
 export function createUniversalSelfDogfoodRequest({
-  candidateSha,
   consumerSha,
-  pullRequest,
   channel,
   policy = defaultPolicy(),
 }) {
-  const expectedSha = exactSha(candidateSha, "candidateSha");
   const sourceSha = exactSha(consumerSha, "consumerSha");
-  if (!Number.isSafeInteger(pullRequest) || pullRequest < 1)
-    fail("pullRequest must be a positive integer");
   if (!["alpha", "stable", "conformance"].includes(channel))
     fail("channel must be alpha, stable, or conformance");
   const capability =
@@ -85,14 +80,6 @@ export function createUniversalSelfDogfoodRequest({
         };
   return validateUniversalWorkflowRequest({
     schema: UNIVERSAL_WORKFLOW_REQUEST,
-    mode: "exact",
-    candidate: {
-      repository: "kungfu-systems/buildchain",
-      discoveryRef: expectedSha,
-      expectedSha,
-      admissionRoot: universalWorkflowAdmissionRoot(policy),
-      reviewPullRequest: pullRequest,
-    },
     consumer: {
       repository: "kungfu-systems/buildchain",
       workflow: ".github/workflows/self-ops-bootstrap-dogfood.yml",
@@ -111,8 +98,7 @@ function exactResult(value, label, expectedSha, expectedChannel) {
   if (
     value?.schema !== "kungfu-buildchain-v4-universal-workflow-result/v1" ||
     value.status !== "succeeded" ||
-    value.runtime?.repository !== "kungfu-systems/buildchain" ||
-    value.runtime?.sha !== expectedSha
+    value.runtime?.repository !== "kungfu-systems/buildchain"
   )
     fail(`${label} is not a successful exact-candidate result`);
   if (expectedChannel === "conformance") {

package/packages/core/workflow/universal-workflow-bootstrap.js

@@ -1,13 +1,13 @@
 import crypto from "node:crypto";
 
 export const UNIVERSAL_WORKFLOW_REQUEST =
-  "kungfu-buildchain-v4-universal-workflow-request/v1";
+  "buildchain.universal-workflow-request/v2";
 export const UNIVERSAL_WORKFLOW_ADMISSION_POLICY =
-  "kungfu-buildchain-v4-universal-workflow-admission-policy/v1";
+  "buildchain.universal-workflow-admission-policy/v2";
 export const UNIVERSAL_WORKFLOW_ADMISSION =
-  "kungfu-buildchain-v4-universal-workflow-admission/v1";
+  "buildchain.universal-workflow-admission/v2";
 export const UNIVERSAL_WORKFLOW_TERMINAL_RECEIPT =
-  "kungfu-buildchain-v4-universal-workflow-terminal-receipt/v1";
+  "buildchain.universal-workflow-terminal-receipt/v2";
 const EXACT_SHA = /^[0-9a-f]{40}$/u;
 const ROOT = /^sha256:[0-9a-f]{64}$/u;
 const REPOSITORY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
@@ -169,45 +169,11 @@ function timestamp(value, label) {
 export function validateUniversalWorkflowRequest(value) {
   exactKeys(
     value,
-    ["schema", "mode", "candidate", "consumer", "capability", "payload"],
+    ["schema", "consumer", "capability", "payload"],
     "request",
   );
   if (value.schema !== UNIVERSAL_WORKFLOW_REQUEST)
     fail("unsupported-request-schema", "request schema is unsupported");
-  if (!MODES.has(value.mode))
-    fail("unsupported-mode", "request mode is unsupported");
-  exactKeys(
-    value.candidate,
-    [
-      "repository",
-      "discoveryRef",
-      "expectedSha",
-      "admissionRoot",
-      "reviewPullRequest",
-    ],
-    "request.candidate",
-  );
-  const candidateRepository = repository(
-    value.candidate.repository,
-    "request.candidate.repository",
-  );
-  if (candidateRepository !== "kungfu-systems/buildchain")
-    fail(
-      "untrusted-candidate-repository",
-      "candidate repository must be kungfu-systems/buildchain",
-    );
-  const discoveryRef = nonEmpty(
-    value.candidate.discoveryRef,
-    "request.candidate.discoveryRef",
-  ).replace(/^refs\/(?:heads|tags)\//u, "");
-  if (value.mode === "train" && !TRAIN.test(discoveryRef))
-    fail("invalid-train-ref", "train mode requires a governed v4 Train ref");
-  if (value.mode === "exact" && !EXACT_SHA.test(discoveryRef.toLowerCase()))
-    fail("invalid-exact-ref", "exact mode requires an exact Git SHA selector");
-  if (value.mode === "alpha" && discoveryRef !== "v4-alpha")
-    fail("invalid-alpha-ref", "alpha mode requires v4-alpha discovery");
-  if (value.mode === "stable" && discoveryRef !== "v4")
-    fail("invalid-stable-ref", "stable mode requires v4 discovery");
   exactKeys(
     value.consumer,
     ["repository", "workflow", "sourceSha"],
@@ -224,23 +190,6 @@ export function validateUniversalWorkflowRequest(value) {
   canonical(value.payload);
   return {
     schema: value.schema,
-    mode: value.mode,
-    candidate: {
-      repository: candidateRepository,
-      discoveryRef,
-      expectedSha: exactSha(
-        value.candidate.expectedSha,
-        "request.candidate.expectedSha",
-      ),
-      admissionRoot: root(
-        value.candidate.admissionRoot,
-        "request.candidate.admissionRoot",
-      ),
-      reviewPullRequest: positiveInteger(
-        value.candidate.reviewPullRequest,
-        "request.candidate.reviewPullRequest",
-      ),
-    },
     consumer: {
       repository: repository(
         value.consumer.repository,
@@ -290,10 +239,6 @@ function validatePolicy(value) {
       "allowedCapabilities",
       "permissionCeiling",
       "contractRoots",
-      "targetRef",
-      "allowedReviewers",
-      "minimumApprovals",
-      "requiredChecks",
       "validFrom",
       "expiresAt",
     ],
@@ -323,19 +268,6 @@ function validatePolicy(value) {
       "policy.permissionCeiling",
     ),
     contractRoots: sortedRoots(value.contractRoots, "policy.contractRoots"),
-    targetRef: nonEmpty(value.targetRef, "policy.targetRef"),
-    allowedReviewers: sortedTokens(
-      value.allowedReviewers,
-      "policy.allowedReviewers",
-    ),
-    minimumApprovals: positiveInteger(
-      value.minimumApprovals,
-      "policy.minimumApprovals",
-    ),
-    requiredChecks: sortedStrings(
-      value.requiredChecks,
-      "policy.requiredChecks",
-    ),
     validFrom: timestamp(value.validFrom, "policy.validFrom"),
     expiresAt: timestamp(value.expiresAt, "policy.expiresAt"),
   };
@@ -344,56 +276,6 @@ function validatePolicy(value) {
   return policy;
 }
 
-function validateReviewEvidence(value) {
-  const hasBinding = Object.hasOwn(value || {}, "runtimeBinding");
-  exactKeys(value, ["repository", "pullRequest", "headSha", "baseRef", "approvals", "checks", "observedAt", ...(hasBinding ? ["runtimeBinding"] : [])], "reviewEvidence");
-  const approvals = value.approvals.map((approval, index) => {
-    exactKeys(approval, ["reviewer", "commitSha", "submittedAt"], `reviewEvidence.approvals[${index}]`);
-    return {
-      reviewer: nonEmpty(approval.reviewer, `reviewEvidence.approvals[${index}].reviewer`),
-      commitSha: exactSha(approval.commitSha, `reviewEvidence.approvals[${index}].commitSha`),
-      submittedAt: timestamp(approval.submittedAt, `reviewEvidence.approvals[${index}].submittedAt`),
-    };
-  });
-  const checks = value.checks.map((check, index) => {
-    const hasCommit = Object.hasOwn(check || {}, "commitSha");
-    exactKeys(check, ["name", "status", "conclusion", ...(hasCommit ? ["commitSha"] : [])], `reviewEvidence.checks[${index}]`);
-    return {
-      name: nonEmpty(check.name, `reviewEvidence.checks[${index}].name`),
-      status: nonEmpty(check.status, `reviewEvidence.checks[${index}].status`),
-      conclusion: nonEmpty(check.conclusion, `reviewEvidence.checks[${index}].conclusion`),
-      ...(hasCommit ? { commitSha: exactSha(check.commitSha, `reviewEvidence.checks[${index}].commitSha`) } : {}),
-    };
-  });
-  let runtimeBinding;
-  if (hasBinding) {
-    exactKeys(value.runtimeBinding, ["kind", "runtimeSha", "parentShas", "mergedAt"], "reviewEvidence.runtimeBinding");
-    const kind = nonEmpty(value.runtimeBinding.kind, "reviewEvidence.runtimeBinding.kind");
-    if (!new Set(["reviewed-head", "protected-alpha-merge"]).has(kind)) fail("invalid-runtime-binding", "review evidence runtime binding kind is unsupported");
-    const parentShas = value.runtimeBinding.parentShas.map((parent, index) => exactSha(parent, `reviewEvidence.runtimeBinding.parentShas[${index}]`));
-    if (new Set(parentShas).size !== parentShas.length) fail("invalid-runtime-binding", "review evidence runtime parents must be duplicate-free");
-    runtimeBinding = { kind, runtimeSha: exactSha(value.runtimeBinding.runtimeSha, "reviewEvidence.runtimeBinding.runtimeSha"), parentShas, mergedAt: value.runtimeBinding.mergedAt === null ? null : timestamp(value.runtimeBinding.mergedAt, "reviewEvidence.runtimeBinding.mergedAt") };
-  }
-  return {
-    repository: repository(value.repository, "reviewEvidence.repository"),
-    pullRequest: positiveInteger(value.pullRequest, "reviewEvidence.pullRequest"),
-    headSha: exactSha(value.headSha, "reviewEvidence.headSha"),
-    baseRef: nonEmpty(value.baseRef, "reviewEvidence.baseRef"),
-    approvals, checks,
-    observedAt: timestamp(value.observedAt, "reviewEvidence.observedAt"),
-    ...(runtimeBinding ? { runtimeBinding } : {}),
-  };
-}
-
-function reviewedRuntimeSha(request, policy, evidence, runtimeSha) {
-  const binding = evidence.runtimeBinding || { kind: "reviewed-head", runtimeSha: evidence.headSha, parentShas: [], mergedAt: null };
-  if (binding.runtimeSha !== runtimeSha) fail("review-runtime-mismatch", "review evidence runtime binding does not match the candidate");
-  const direct = binding.kind === "reviewed-head" && evidence.headSha === runtimeSha && evidence.baseRef === policy.targetRef && binding.mergedAt === null;
-  const alphaMerge = binding.kind === "protected-alpha-merge" && request.mode === "alpha" && evidence.baseRef === policy.targetRef.replace(/^dev\//u, "alpha/") && binding.parentShas.length === 2 && binding.parentShas.includes(evidence.headSha) && binding.mergedAt !== null && Date.parse(binding.mergedAt) <= Date.parse(evidence.observedAt);
-  if (!direct && !alphaMerge) fail("review-identity-mismatch", "review evidence does not bind the candidate runtime");
-  return evidence.headSha;
-}
-
 export function universalWorkflowAdmissionRoot(value) {
   return documentRoot("universal-workflow-admission", validatePolicy(value));
 }
@@ -409,128 +291,25 @@ function assertPermissionCeiling(requested, ceiling) {
   }
 }
 
-export function admitUniversalWorkflow({
-  request: requestValue,
-  policy: policyValue,
-  observedRefSha,
-  observedConsumerRepository,
-  observedConsumerSha,
-  observedConsumerWorkflowRef,
-  reviewEvidence: reviewEvidenceValue,
-  now,
-} = {}) {
+export function admitUniversalWorkflow({ request: requestValue, policy: policyValue, runtime, observedConsumerRepository, observedConsumerSha, observedConsumerWorkflowRef, now } = {}) {
   const request = validateUniversalWorkflowRequest(requestValue);
   const policy = validatePolicy(policyValue);
-  const admissionRoot = universalWorkflowAdmissionRoot(policy);
-  if (request.candidate.admissionRoot !== admissionRoot)
-    fail("stale-admission", "request is not bound to the current admission");
-  if (policy.sourceRepository !== request.candidate.repository)
-    fail("source-repository-mismatch", "admission source repository mismatch");
   const workflowRef = nonEmpty(observedConsumerWorkflowRef, "workflow ref");
-  const expectedWorkflowPrefix = `${request.consumer.repository}/${request.consumer.workflow}@`;
-  if (
-    request.consumer.repository !== observedConsumerRepository ||
-    request.consumer.sourceSha !==
-      exactSha(observedConsumerSha, "observedConsumerSha") ||
-    !workflowRef.startsWith(expectedWorkflowPrefix) ||
-    workflowRef.length === expectedWorkflowPrefix.length
-  )
+  const prefix = `${request.consumer.repository}/${request.consumer.workflow}@`;
+  if (request.consumer.repository !== observedConsumerRepository || request.consumer.sourceSha !== exactSha(observedConsumerSha, "observedConsumerSha") || !workflowRef.startsWith(prefix) || workflowRef.length === prefix.length)
     fail("consumer-identity-mismatch", "caller identity mismatch");
-  if (!policy.allowedCapabilities.includes(request.capability.id))
-    fail("capability-not-admitted", "capability is not admitted");
-  if (
-    request.capability.contractRoots.length !== policy.contractRoots.length ||
-    request.capability.contractRoots.some(
-      (value, index) => value !== policy.contractRoots[index],
-    )
-  )
-    fail("contract-root-mismatch", "candidate contract roots are not admitted");
-  assertPermissionCeiling(
-    request.capability.permissions,
-    policy.permissionCeiling,
-  );
+  if (!policy.allowedCapabilities.includes(request.capability.id)) fail("capability-not-admitted", "capability is not admitted");
+  assertPermissionCeiling(request.capability.permissions, policy.permissionCeiling);
   const observedAt = timestamp(now, "now");
-  if (
-    Date.parse(observedAt) < Date.parse(policy.validFrom) ||
-    Date.parse(observedAt) >= Date.parse(policy.expiresAt)
-  )
-    fail("stale-admission", "admission is outside its validity window");
-  const runtimeSha = exactSha(observedRefSha, "observedRefSha");
-  if (runtimeSha !== request.candidate.expectedSha)
-    fail(
-      "candidate-ref-moved",
-      "candidate ref readback does not match expected SHA",
-    );
-  const reviewEvidence = validateReviewEvidence(reviewEvidenceValue);
-  if (
-    reviewEvidence.repository !== request.candidate.repository ||
-    reviewEvidence.pullRequest !== request.candidate.reviewPullRequest
-  )
-    fail(
-      "review-identity-mismatch",
-      "review evidence does not bind the candidate",
-    );
-  const reviewedSha = reviewedRuntimeSha(request, policy, reviewEvidence, runtimeSha);
-  const approvedReviewers = new Set(
-    reviewEvidence.approvals
-      .filter((approval) => approval.commitSha === reviewedSha)
-      .map((approval) => approval.reviewer),
-  );
-  const admittedApprovalCount = policy.allowedReviewers.filter((reviewer) =>
-    approvedReviewers.has(reviewer),
-  ).length;
-  if (admittedApprovalCount < policy.minimumApprovals)
-    fail(
-      "independent-review-missing",
-      "candidate lacks exact-head independent review",
-    );
-  const checksByName = new Map();
-  for (const check of reviewEvidence.checks) {
-    const entries = checksByName.get(check.name) || [];
-    entries.push(check);
-    checksByName.set(check.name, entries);
-  }
-  if (
-    policy.requiredChecks.some((name) => {
-      const checks = checksByName.get(name) || [];
-      return (
-        checks.length === 0 ||
-        checks.some(
-          (check) =>
-            check.status !== "completed" || check.conclusion !== "success" ||
-            (check.commitSha !== undefined && check.commitSha !== runtimeSha),
-        )
-      );
-    })
-  )
-    fail(
-      "exact-head-checks-incomplete",
-      "candidate exact-head checks are not successful",
-    );
-  const requestRoot = universalWorkflowRequestRoot(request);
-  const discovery = {
-    repository: request.candidate.repository,
-    ref: request.candidate.discoveryRef,
-    expectedSha: request.candidate.expectedSha,
-    observedSha: runtimeSha,
-    observedAt,
-  };
+  if (Date.parse(observedAt) < Date.parse(policy.validFrom) || Date.parse(observedAt) >= Date.parse(policy.expiresAt)) fail("stale-admission", "capability policy is outside its validity window");
   return {
     schema: UNIVERSAL_WORKFLOW_ADMISSION,
     status: "admitted",
-    requestRoot,
-    admissionRoot,
-    discoveryRoot: documentRoot("universal-workflow-discovery", discovery),
-    reviewRoot: documentRoot("universal-workflow-review", reviewEvidence),
+    requestRoot: universalWorkflowRequestRoot(request),
+    admissionRoot: universalWorkflowAdmissionRoot(policy),
     consumerRoot: documentRoot("universal-workflow-consumer", request.consumer),
-    capabilityRoot: documentRoot(
-      "universal-workflow-capability",
-      request.capability,
-    ),
-    runtime: {
-      repository: request.candidate.repository,
-      sha: runtimeSha,
-    },
+    capabilityRoot: documentRoot("universal-workflow-capability", request.capability),
+    runtime,
     permissions: request.capability.permissions,
     contractRoots: request.capability.contractRoots,
   };
@@ -544,8 +323,6 @@ export function completeUniversalWorkflow({ admission, resultRoot, status }) {
       "status",
       "requestRoot",
       "admissionRoot",
-      "discoveryRoot",
-      "reviewRoot",
       "consumerRoot",
       "capabilityRoot",
       "runtime",
@@ -566,8 +343,6 @@ export function completeUniversalWorkflow({ admission, resultRoot, status }) {
     status,
     requestRoot: root(admission.requestRoot, "admission.requestRoot"),
     admissionRoot: root(admission.admissionRoot, "admission.admissionRoot"),
-    discoveryRoot: root(admission.discoveryRoot, "admission.discoveryRoot"),
-    reviewRoot: root(admission.reviewRoot, "admission.reviewRoot"),
     consumerRoot: root(admission.consumerRoot, "admission.consumerRoot"),
     capabilityRoot: root(admission.capabilityRoot, "admission.capabilityRoot"),
     runtime: {
@@ -575,7 +350,7 @@ export function completeUniversalWorkflow({ admission, resultRoot, status }) {
         admission.runtime?.repository,
         "admission.runtime.repository",
       ),
-      sha: exactSha(admission.runtime?.sha, "admission.runtime.sha"),
+      sha: admission.runtime?.sha,
     },
     resultRoot: root(resultRoot, "resultRoot"),
   };

package/packages/core/workflow/workflow-taxonomy.mjs

@@ -208,13 +208,13 @@ function validateGateIntegration(root, errors) {
       errors.push(`required Verify workflow lacks ${trigger}`);
   }
   const checkJob = verify.match(/^  check:\n([\s\S]*?)(?=^  [\w-]+:|(?![\s\S]))/mu)?.[1] || "";
-  const verifyNode = "./.buildchain/workflow-shell/actions/build/verification/repository";
+  const verifyNode = "./.buildchain/runtime/actions/build/verification/repository";
   const verifyAction = read("actions/build/verification/repository/action.yml");
   const sourceAction = read("actions/build/verification/qualify-source/action.yml");
   const sourceVerification = read("packages/core/build/verification/source.js");
   const sourceLifecycle = read("packages/core/build/source/lifecycle.js");
   if (!parseYamlUses(checkJob).some(call => call.value === verifyNode) ||
-      !parseYamlUses(verifyAction).some(call => call.value === "./actions/build/verification/qualify-source") ||
+      !parseYamlUses(verifyAction).some(call => call.value === "./.buildchain/runtime/actions/build/verification/qualify-source") ||
       !/using: node24/u.test(sourceAction) ||
       !/qualify = qualifySourceLifecycle/u.test(sourceVerification) ||
       !/mode: "verify"/u.test(sourceVerification) ||

package/scripts/check-dev-delivery-actions.mjs

@@ -5,11 +5,17 @@ import path from "node:path";
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import YAML from "yaml";
+import { lowerSelfReferencesForLint } from "./workflow-self-reference.mjs";
 const root = process.cwd();
 const contract = JSON.parse(fs.readFileSync(path.join(root, "architecture/dev-delivery-orchestration.json"), "utf8"));
-const temp = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-delivery-actionlint-"));
+const temp = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-delivery-actionlint-")));
 try {
-  const files = [];
+  const workflows = path.join(temp, ".github/workflows");
+  fs.cpSync(path.join(root, ".github"), path.join(temp, ".github"), { recursive: true });
+  fs.mkdirSync(path.join(temp, ".git")); // actionlint's isolated project boundary, never a runtime checkout.
+  fs.mkdirSync(path.join(temp, ".buildchain"));
+  fs.symlinkSync(path.join(root, "actions"), path.join(temp, "actions"), "junction");
+  const files = fs.readdirSync(workflows).filter(file => /\.ya?ml$/u.test(file)).map(file => path.join(workflows, file));
   for (const node of contract.nodes) for (const implementation of node.implementations) {
     const action = YAML.parse(fs.readFileSync(path.join(root, implementation.action), "utf8"));
     assert.deepEqual(Object.keys(action.inputs || {}), implementation.inputs, `${implementation.action}: input contract drift`);
@@ -21,15 +27,18 @@ try {
     }
     const inputs = Object.fromEntries(Object.entries(action.inputs || {}).map(([name, input]) => [name, { ...input, type: "string" }]));
     const outputs = Object.fromEntries(Object.entries(action.outputs || {}).map(([name, output]) => [name, output.value]));
-    const file = path.join(temp, `${node.id}-${files.length}.yml`);
+    const file = path.join(workflows, `lint-composite-${node.id}-${files.length}.yml`);
     fs.writeFileSync(file, YAML.stringify({ name: `Validate ${node.id} composite`, on: { workflow_call: { inputs } }, jobs: { node: { "runs-on": "ubuntu-24.04", ...(Object.keys(outputs).length ? { outputs } : {}), steps: action.runs.steps } } }));
     files.push(file);
   }
-  const probe = spawnSync("actionlint", ["-version"], { stdio: "ignore" });
-  const command = probe.error?.code === "ENOENT" ? "go" : "actionlint";
-  const prefix = command === "go" ? ["run", "github.com/rhysd/actionlint/cmd/actionlint@v1.7.12"] : [];
-  const result = spawnSync(command, [...prefix, "-color=false", ...files], { stdio: "inherit" });
+  const aliases = new Set(files.flatMap(file => [...fs.readFileSync(file, "utf8").matchAll(/\.\/\.buildchain\/([a-z0-9][a-z0-9-]*)\/actions\//gu)].map(match => match[1])));
+  for (const alias of aliases) fs.symlinkSync(root, path.join(temp, ".buildchain", alias), "junction");
+  for (const file of files) fs.writeFileSync(file, lowerSelfReferencesForLint(fs.readFileSync(file, "utf8")));
+  const version = "1.7.12", probe = spawnSync("actionlint", ["-version"], { encoding: "utf8" });
+  const command = probe.status === 0 && probe.stdout.trim().split(/\s/u)[0].replace(/^v/u, "") === version ? "actionlint" : "go";
+  const prefix = command === "go" ? ["run", `github.com/rhysd/actionlint/cmd/actionlint@v${version}`] : [];
+  const result = spawnSync(command, [...prefix, "-color=false", ...files], { cwd: temp, stdio: "inherit" });
   if (result.error) throw result.error;
   if (result.signal || result.status !== 0) process.exitCode = result.status || 1;
-  else console.log(`Validated ${files.length} delivery composite bodies and interfaces.`);
+  else console.log(`Validated ${files.length} source workflows and delivery composite interfaces.`);
 } finally { fs.rmSync(temp, { recursive: true, force: true }); }

package/scripts/check-floating-consumer-policy-contract.mjs

@@ -52,7 +52,7 @@ function assertOrdered(relative, markers) {
 export function assertPromotionCertificationWiring(source) {
   const workflow = YAML.parse(source);
   const node = workflow?.jobs?.qualify?.steps?.find((step) => step.id === "node");
-  if (node?.uses !== "./.buildchain/workflow-shell/actions/release/promotion/qualify" ||
+  if (node?.uses !== "./.buildchain/runtime/actions/release/promotion/qualify" ||
       node.with?.["request-json"] !== "${{ inputs.request-json }}" ||
       node.with?.["job-workflow-sha"] !== "${{ toJSON(job.workflow_sha) }}")
     fail("promotion certification is missing its exact owned node and typed request binding");
@@ -101,12 +101,12 @@ export function checkFloatingConsumerPolicyContract() {
     fail("architecture policy contract is missing");
   }
   if (
-    policy.contractLocks?.selectedLockMustBindResolvedWorkflowShell !== true
+    policy.contractLocks?.runtimeSelectionOwner !== "actions/runtime/selection/resolve"
   ) {
-    fail("contract lock must bind the visible workflow shell");
+    fail("contract lock selection must belong to the unified entry");
   }
   assertPersistedSelectors();
-  assertOrdered("packages/core/build/plan/admission.js", ["const policy = scanConsumerPolicy(", "validatePackageManagerContract({", "const lock = inspectRuntimeContract({", "assertRuntimeContractAccepted(lock)"]);
+  assertOrdered("packages/core/build/plan/admission.js", ["const policy = scanConsumerPolicy(", "validatePackageManagerContract({"]);
   const buildWorkflow = read(".github/workflows/.build.yml");
   const planner = read("packages/core/build/plan/admission.js");
   if (!planner.includes("expectedInvocationChannel: plan.identity.channel") ||
@@ -114,7 +114,7 @@ export function checkFloatingConsumerPolicyContract() {
       !buildWorkflow.includes("actions/build/lifecycle/plan")) fail("build planning must bind called workflow and channel admission");
   assertTrustGatedJobs(buildWorkflow, ["build-native", "build-container", "sign", "attest", "deliver"]);
   assertOrdered("actions/publication/candidate/plan/action.yml", [
-    "ref: ${{ inputs.runtime-sha }}", "Prepare exact publication runtime", "Enforce v4 floating consumer policy", "Resolve controller identities",
+    "Admit source checkout", "Enforce v4 floating consumer policy", "Resolve controller identities",
   ]);
   const publication = YAML.parse(read(".github/workflows/public-build-publication.yml"));
   if (!Object.values(publication.jobs).some((job) => job.steps?.some((step) => step.uses?.endsWith("/actions/publication/candidate/plan"))))
@@ -122,7 +122,7 @@ export function checkFloatingConsumerPolicyContract() {
   const stageCanary = read(".github/workflows/public-build-stage-capsule-canary.yml");
   if (
     !stageCanary.includes("consumer-admission:") ||
-    !stageCanary.includes("needs: consumer-admission")
+    !jobDependsOn(stageCanary, "qualify", "consumer-admission")
   ) {
     fail(
       "Stage Capsule qualification is not transitively gated by consumer admission",

package/scripts/check-inventory.mjs

@@ -106,9 +106,7 @@ const requiredPaths = [
   "scripts/next-development-self-dogfood-harness.mjs",
   "scripts/generate-next-development-guidance.mjs",
   "packages/core/governance/commands/reconcile-release-governance.mjs",
-  "packages/core/consumer/commands/buildchain-channel-router.mjs",
   "packages/core/release/commands/promotion-channel-router.mjs",
-  "packages/core/release/commands/promotion-identity-resolver.mjs",
   "scripts/generate-channel-promotion-workflow.mjs",
   "scripts/build-standalone-binary.mjs",
   "packages/core/publication/commands/create-release-bundle.mjs",
@@ -317,17 +315,10 @@ const boundedAlphaRecoveryWorkflow = fs.readFileSync(
   "utf8",
 );
 assertPromotionInventory(root);
-const promotionOverrideAuthorization = fs.readFileSync(
-  path.join(root, "packages/core/release/runtime-override-authorization.js"),
-  "utf8",
-);
-if (!promotionOverrideAuthorization.includes("promotion runtime override is only allowed for trusted workflow_dispatch runs")) {
-  throw new Error("promotion runtime override authorization must remain fail closed");
-}
 for (const workflow of [channelBuildWorkflow, reusableBuildWorkflow]) {
   const block = workflow.split("    inputs:\n")[1].split("    secrets:\n")[0];
   const names = [...block.matchAll(/^      ([a-z0-9-]+):$/gm)].map((match) => match[1]);
-  if (JSON.stringify(names) !== '["config-path"]') throw new Error("ordinary build inputs must contain only config-path");
+  if (JSON.stringify(names.sort()) !== JSON.stringify(['config-path','contract-lock','resume-run-id','runtime-ref','runtime-selection'])) throw new Error('build API must expose only the locator and unified runtime entry inputs');
 }
 if ((channelBuildWorkflow.match(/uses: \.\/\.github\/workflows\/\.build\.yml/g) || []).length !== 1) {
   throw new Error("public build facade must invoke its exact backbone once");