@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/scripts/check-public-dogfood-contract.mjs

@@ -11,7 +11,7 @@ const DEFAULT_ROOT = path.resolve(
 );
 const CALLER_PATH = ".github/workflows/self-build-public-consumer-dogfood.yml";
 const REUSABLE_PATH = ".github/workflows/public-build-stage-capsule-canary.yml";
-export const PUBLIC_DOGFOOD_ALPHA_REF = "v4-alpha";
+export const PUBLIC_DOGFOOD_ENTRY_REF = "v4";
 const PRIVATE_CONSUMER = ["buildchain", "self", "dogfood"].join("-");
 const PRIVATE_SHADOW = ["kungfu", "shadow"].join("-");
 
@@ -21,6 +21,11 @@ export function expectedPublicDogfoodWorkflow(validationRef) {
 on:
   pull_request:
   workflow_dispatch:
+    inputs:
+      runtime-ref:
+        description: Transient runtime selected by the public entry.
+        type: string
+        default: ""
 
 permissions:
   contents: read
@@ -29,6 +34,7 @@ jobs:
   dogfood:
     uses: kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml@${validationRef}
     with:
+      runtime-ref: \${{ inputs.runtime-ref }}
       consumer: buildchain
       node-version: "24"
       go-version: "1.25.x"
@@ -83,7 +89,7 @@ function assertReusableWorkflow(root) {
     const nodePath = `actions/build/stage-capsule/${CANARY_NODES[phase]}`;
     const call = workflow.jobs?.[phase]?.steps?.at(-1);
     if (
-      call?.uses !== `./.buildchain/workflow-shell/${nodePath}` ||
+      call?.uses !== `./.buildchain/runtime/${nodePath}` ||
       call.with?.["workflow-sha"] !== "${{ job.workflow_sha }}" ||
       call.with?.["request-json"] !== "${{ toJSON(inputs) }}"
     )
@@ -94,18 +100,19 @@ function assertReusableWorkflow(root) {
   });
   const qualification = YAML.parse(nodes[1]);
   const steps = qualification.runs.steps;
-  const prepare = steps.findIndex((step) => step.id === "buildchain-runtime");
   const consumerNode = steps.findIndex((step) =>
     step.uses?.startsWith("actions/setup-node@"),
   );
-  if (
-    prepare < 0 ||
-    prepare >= consumerNode ||
-    steps[prepare].uses !==
-      "./.buildchain/workflow-shell/actions/runtime/environment/prepare"
-  )
+  const jobSteps = workflow.jobs.qualify.steps;
+  const prepare = jobSteps.findIndex(
+    (step) => step.uses === "$/actions/runtime/environment/prepare",
+  );
+  const node = jobSteps.findIndex((step) =>
+    step.uses?.endsWith("/stage-capsule/qualify"),
+  );
+  if (prepare < 0 || prepare >= node || consumerNode < 0)
     fail(
-      "Canary must bind the Buildchain runtime before selecting the consumer Node version",
+      "Canary must prepare its selected runtime before the consumer toolchain",
     );
   if (
     steps[consumerNode].with?.["node-version"] !==
@@ -118,7 +125,7 @@ function assertReusableWorkflow(root) {
       "./.buildchain/runtime/actions/build/stage-capsule/qualify-consumer",
   );
   if (
-    campaign?.with?.["workflow-sha"] !== "${{ steps.runtime.outputs.sha }}" ||
+    campaign?.with?.["workflow-sha"] !== "${{ env.BUILDCHAIN_RUNTIME_SHA }}" ||
     campaign?.with?.["request-json"] !== "${{ inputs.request-json }}" ||
     campaign?.with?.platform !== "${{ fromJSON(inputs.matrix-json).platform }}"
   )
@@ -235,9 +242,9 @@ function assertProtectedVerify(root) {
   const parsed = YAML.parse(verify);
   const nodePath = "actions/build/verification/repository/action.yml";
   if (
-    parsed.jobs.check.needs !== "stage-capsule-checkpoints" ||
+    ![parsed.jobs.check.needs].flat().includes("stage-capsule-checkpoints") ||
     parsed.jobs.check.steps.at(-1).uses !==
-      `./.buildchain/workflow-shell/${nodePath.replace(/\/action.yml$/, "")}`
+      `./.buildchain/runtime/${nodePath.replace(/\/action.yml$/, "")}`
   )
     fail(
       "Verify must bind the protected check node after Stage Capsule checkpoints",
@@ -245,7 +252,10 @@ function assertProtectedVerify(root) {
   const implementation = read(root, nodePath);
   const steps = YAML.parse(implementation).runs.steps;
   const qualify = steps.find((step) => step.id === "source-verification");
-  if (qualify?.uses !== "./actions/build/verification/qualify-source")
+  if (
+    qualify?.uses !==
+    "./.buildchain/runtime/actions/build/verification/qualify-source"
+  )
     fail("Verify is missing its owned source qualification action");
   const transaction = read(root, "packages/core/build/verification/source.js");
   for (const required of [
@@ -271,10 +281,13 @@ function assertArchitecture(root) {
   );
   const dogfood = architecture.publicConsumerDogfood;
   const validationRef = dogfood?.validationRef;
-  if (validationRef !== PUBLIC_DOGFOOD_ALPHA_REF)
-    fail("architecture validationRef must use the floating v4-alpha channel");
+  if (validationRef !== PUBLIC_DOGFOOD_ENTRY_REF)
+    fail("architecture validationRef must use the public v4 entry");
   const caller = read(root, CALLER_PATH);
-  if (caller !== expectedPublicDogfoodWorkflow(validationRef))
+  if (
+    JSON.stringify(YAML.parse(caller)) !==
+    JSON.stringify(YAML.parse(expectedPublicDogfoodWorkflow(validationRef)))
+  )
     fail(`${CALLER_PATH} must remain the exact thin public consumer caller`);
   if (JSON.stringify(architecture.campaign?.consumers) !== '["buildchain"]')
     fail(
@@ -285,7 +298,7 @@ function assertArchitecture(root) {
     dogfood.callerWorkflow !== CALLER_PATH ||
     dogfood.reusableWorkflow !==
       "kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml" ||
-    dogfood.runtimeBinding !== "job.workflow_sha" ||
+    dogfood.runtimeBinding !== "entry-selected-runtime" ||
     dogfood.consumerSourceBinding !== "github.sha" ||
     JSON.stringify(dogfood.executableStages) !==
       '["install","build","verify"]' ||
@@ -351,9 +364,9 @@ function assertPolicySources(root) {
   const agents = read(root, "AGENTS.md");
   for (const invariant of [
     "same public reusable-workflow contract as every other consumer",
-    "No agent may add or restore a relative/self reusable-workflow call",
-    "never solve recursion with an internal exception",
-    "scripts/check-public-dogfood-contract.mjs",
+    "No repository-specific runtime selection or recovery exception",
+    "Normal self workflows",
+    "central entry resolves it once",
     "source-persisted exact commit SHA",
     "v4-alpha",
   ])

package/scripts/check-release-topology.mjs

@@ -150,11 +150,7 @@ export function discoverReleaseAuthorityClosure() {
     [".js", ".mjs", ".cjs"],
     /(?:release-tail-provider-(?:adapters|plane)|create(?:GitHubReleaseAssets|SignedStaticChannel|SiteReleaseActivation|ReleasedEvidence)Adapter)/u,
   );
-  const runtimeSelectors = matchingProductionFiles(
-    [".github/workflows", "scripts", "packages/core"],
-    [".yml", ".yaml", ".js", ".mjs", ".cjs"],
-    /(?:promotion-runtime-sha|resume-buildchain-runtime-sha|BUILDCHAIN_(?:CURRENT_RUNTIME_SHA|RUNTIME_REF|RESUME_CANDIDATE_RUN_ID)|authorizeRuntimeSelection|scanRuntimeSelectorPersistence|release-candidate-adapter)/u,
-  );
+  const runtimeSelectors = productionFiles("packages/core/runtime/entry", [".js"]).sort();
   const terminalProjections = matchingProductionFiles(
     [".github/workflows", "actions", "packages/core", "scripts"],
     [".yml", ".yaml", ".js", ".mjs", ".cjs"],
@@ -560,7 +556,7 @@ export function checkReleaseTopology() {
     );
     assert.deepEqual(
       publisher.jobs.map((job) => job.split("|", 1)[0]),
-      ["apply", "qualify", "settle"],
+      ["apply", "execution-runtime", "qualify", "settle"],
     );
   }
   return actual;

package/scripts/check-runtime-entry.mjs

@@ -0,0 +1,133 @@
+import fs from "node:fs";
+import path from "node:path";
+import YAML from "yaml";
+import { fileURLToPath } from "node:url";
+import { auditRuntimeSourceBoundaries } from "./runtime-source-boundaries.mjs";
+
+const prepare = "actions/runtime/environment/prepare/action.yml";
+const preparation = "$/actions/runtime/environment/prepare";
+const entryActions = new Set([
+  "$/actions/runtime/selection/resolve",
+  preparation,
+  "$/actions/runtime/environment/activate",
+]);
+function yamlFiles(root, directory) {
+  return fs
+    .readdirSync(path.join(root, directory), { withFileTypes: true })
+    .flatMap((entry) => {
+      const file = `${directory}/${entry.name}`;
+      if (entry.isDirectory())
+        return ["node_modules", "dist"].includes(entry.name)
+          ? []
+          : yamlFiles(root, file);
+      return /\.ya?ml$/u.test(file) ? [file] : [];
+    });
+}
+function auditCheckout(step, { file, at, prepared }, issues) {
+  if (!step.uses?.startsWith("actions/checkout")) return 0;
+  const directory = step.with?.path || ".";
+  const acquired =
+    /^\.buildchain\/(?:runtime|workflow-shell|bootstrap|attester-runtime|authority-runtime|policy-runtime|release-tail-runtime)$/u.test(
+      directory,
+    );
+  if (acquired && (file !== prepare || directory !== ".buildchain/runtime"))
+    issues.push(`${at}: execution code acquisition belongs only to ${prepare}`);
+  if (prepared && directory === ".")
+    issues.push(`${at}: source checkout erases the prepared runtime`);
+  if (
+    file !== prepare &&
+    /(?:runtime[-_.]sha|job\.workflow_sha|BUILDCHAIN_RUNTIME_SHA)/u.test(
+      JSON.stringify(step.with || {}),
+    )
+  )
+    issues.push(`${at}: source checkout must not select execution code`);
+  return Number(acquired);
+}
+function auditAction(step, { file, at, prepared }, issues) {
+  const uses = step.uses || "";
+  if (uses.startsWith("$/") && !entryActions.has(uses))
+    issues.push(`${at}: business code must load from the selected runtime`);
+  if (
+    uses.startsWith("./actions/") ||
+    /^\.\/\.buildchain\/(?!runtime\/).*\/actions\//u.test(uses)
+  )
+    issues.push(`${at}: noncanonical business action location`);
+  if (
+    file.startsWith(".github/workflows/") &&
+    uses.startsWith("./.buildchain/runtime/actions/") &&
+    !prepared
+  )
+    issues.push(`${at}: business action runs before preparation`);
+  if (file.startsWith("actions/") && uses === preparation)
+    issues.push(`${at}: business composites cannot prepare a second runtime`);
+}
+function auditBusinessAcquisition(root, directory, issues) {
+  const absolute = path.join(root, directory);
+  if (!fs.existsSync(absolute)) return;
+  for (const entry of fs.readdirSync(absolute, { withFileTypes: true })) {
+    const file = `${directory}/${entry.name}`;
+    if (entry.isDirectory()) {
+      if (!["node_modules", "dist"].includes(entry.name))
+        auditBusinessAcquisition(root, file, issues);
+      continue;
+    }
+    if (
+      !/\.(?:[cm]?js|sh|py|ps1)$/u.test(file) ||
+      file.startsWith("packages/core/runtime/entry/")
+    )
+      continue;
+    const source = fs.readFileSync(path.join(root, file), "utf8");
+    if (/\.[cm]?js$/u.test(file))
+      issues.push(...auditRuntimeSourceBoundaries(source, file));
+    const runtime =
+      /\.buildchain\/(?:runtime|workflow-shell|promotion-router)|BUILDCHAIN_RUNTIME_(?:ROOT|SHA)/u.test(
+        source,
+      );
+    const acquisition =
+      /["'](?:clone|checkout)["']|git\s+(?:clone|checkout)/u.test(source);
+    if (runtime && acquisition)
+      issues.push(`${file}: business code cannot acquire an execution runtime`);
+  }
+}
+export function auditRuntimeEntry(root) {
+  const issues = [];
+  const files = [
+    ...yamlFiles(root, "actions"),
+    ...yamlFiles(root, ".github/workflows"),
+  ];
+  auditBusinessAcquisition(root, "packages/core", issues);
+  let acquisitions = 0;
+  for (const file of files) {
+    const doc = YAML.parse(fs.readFileSync(path.join(root, file), "utf8"));
+    for (const [job, node] of Object.entries(
+      doc.jobs || { action: doc.runs },
+    )) {
+      let preparations = 0;
+      for (const step of node?.steps || []) {
+        if (step.uses === preparation) preparations++;
+        const context = {
+          file,
+          at: `${file}:${job}:${step.id || step.name || step.uses}`,
+          prepared: preparations > 0,
+        };
+        auditAction(step, context, issues);
+        acquisitions += auditCheckout(step, context, issues);
+      }
+      if (preparations > 1)
+        issues.push(`${file}:${job}: runtime is prepared more than once`);
+    }
+  }
+  if (acquisitions !== 1)
+    issues.push(
+      `Expected exactly one execution-code acquisition owner; found ${acquisitions}`,
+    );
+  return { files: files.length, acquisitions, issues };
+}
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+  const result = auditRuntimeEntry(path.resolve(import.meta.dirname, ".."));
+  console.log(JSON.stringify(result));
+  if (result.issues.length) process.exitCode = 1;
+}

package/scripts/check-universal-workflow-bootstrap.mjs

@@ -1,288 +1,52 @@
 import assert from "node:assert/strict";
-import YAML from "yaml";
-
-import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { execFileSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const contract = JSON.parse(
-  fs.readFileSync(
-    path.join(root, "architecture/universal-workflow-bootstrap.json"),
-    "utf8",
-  ),
-);
-const admissionPolicy = JSON.parse(
-  fs.readFileSync(
-    path.join(root, "architecture/universal-workflow-train-admission.json"),
-    "utf8",
-  ),
-);
-const admissionObservedAt = Date.now();
-assert.ok(
-  admissionObservedAt >= Date.parse(admissionPolicy.validFrom) &&
-    admissionObservedAt < Date.parse(admissionPolicy.expiresAt),
-  `release admission policy is outside its validity window (${admissionPolicy.validFrom} to ${admissionPolicy.expiresAt}); renew it through protected review before publishing`,
-);
-const fileRoot = (relative) =>
-  `sha256:${crypto
-    .createHash("sha256")
-    .update(fs.readFileSync(path.join(root, relative)))
-    .digest("hex")}`;
-
-const workflowRoot = path.join(root, ".github/workflows");
-const discovered = fs
-  .readdirSync(workflowRoot)
-  .filter((name) => /\.ya?ml$/u.test(name))
-  .map((name) => ({
-    path: `.github/workflows/${name}`,
-    text: fs.readFileSync(path.join(workflowRoot, name), "utf8"),
-  }))
-  .filter((entry) => /(?:^|\n)\s*workflow_call:\s*(?:\n|$)/u.test(entry.text))
-  .map((entry) => entry.path)
-  .sort();
-
-assert.equal(
-  contract.schema,
-  "kungfu-buildchain-v4-universal-workflow-bootstrap/v1",
-);
-assert.deepEqual(
-  contract.inventoryWorkflows,
-  [...new Set(contract.inventoryWorkflows)].sort(),
-  "inventoried public workflows must be sorted and duplicate-free",
-);
-assert.deepEqual(
-  contract.inventoryWorkflows,
-  discovered,
-  "every active public workflow_call surface must be inventoried",
-);
-for (const relative of contract.inventoryWorkflows)
-  assert.ok(
-    fs.statSync(path.join(root, relative)).isFile(),
-    `inventoried workflow is unavailable: ${relative}`,
-  );
-assert.deepEqual(
-  contract.bootstrapGovernedWorkflows,
-  [...new Set(contract.bootstrapGovernedWorkflows)].sort(),
-  "Bootstrap-governed workflows must be sorted and duplicate-free",
-);
-assert.equal(
-  Object.hasOwn(contract, "migration"),
-  false,
-  "no historical facade regeneration authority",
-);
-assert.equal(
-  Object.hasOwn(contract, "retiredWorkflowSurfaces"),
-  false,
-  "retired workflows must be absent",
-);
-const activeWorkflows = contract.inventoryWorkflows;
-assert.deepEqual(contract.bootstrapGovernedWorkflows, [
-  contract.bootstrap.publicWorkflow,
-]);
-assert.deepEqual(
-  contract.directCapabilityWorkflows,
-  discovered.filter(
-    (relative) =>
-      relative !== contract.bootstrap.publicWorkflow &&
-      relative !== contract.bootstrap.consumerRecoveryWorkflow,
-  ),
-);
-for (const relative of contract.directCapabilityWorkflows) {
-  assert.doesNotMatch(
-    fs.readFileSync(path.join(root, relative), "utf8"),
-    /universal-request-json|universal-bootstrap:/u,
-    `${relative}: use the independent Bootstrap API instead of a dual execution path`,
-  );
-}
-assert.deepEqual(contract.configurationGovernedWorkflows, [
-  ".github/workflows/.build.yml",
-  ".github/workflows/build.yml",
-]);
-for (const relative of contract.configurationGovernedWorkflows) {
-  const source = fs.readFileSync(path.join(root, relative), "utf8");
-  const inputBlock = source
-    .split("    inputs:\n")[1]
-    .split("    secrets:\n")[0];
-  assert.deepEqual(
-    [...inputBlock.matchAll(/^      ([a-z0-9-]+):$/gmu)].map(
-      (match) => match[1],
-    ),
-    ["config-path"],
-  );
-  assert.doesNotMatch(source, /universal-request-json/u);
-}
-for (const relative of contract.bootstrapGovernedWorkflows) {
-  assert.ok(
-    contract.inventoryWorkflows.includes(relative),
-    `Bootstrap-governed workflow is outside the inventory: ${relative}`,
-  );
-  const source = fs.readFileSync(path.join(root, relative), "utf8");
-  assert.ok(
-    relative === contract.bootstrap.publicWorkflow ||
-      /uses:\s+(?:\.\/)?\.github\/workflows\/public-ops-bootstrap\.yml/u.test(
-        source,
-      ) ||
-      /uses:\s+kungfu-systems\/buildchain\/\.github\/workflows\/public-ops-bootstrap\.yml@/u.test(
-        source,
-      ),
-    `workflow is declared governed without a Bootstrap edge: ${relative}`,
-  );
-}
+import crypto from "node:crypto";
+import YAML from "yaml";
+import { auditRuntimeEntry } from "./check-runtime-entry.mjs";
 
-assert.deepEqual(contract.complexityBudget, {
-  bootstrapAbis: 1,
-  requestEnvelopes: 1,
-  candidateResolvers: 1,
-  candidateEngines: 1,
-  terminalReceiptAuthorities: 1,
-  perWorkflowBootstrapImplementations: 0,
-  buildchainOnlySelfReleasePaths: 0,
-  perIncidentConsumerEdits: 0,
-});
-assert.equal(contract.bootstrap.discoveryRefExecutionAuthority, false);
-assert.equal(contract.bootstrap.exactShaExecutionAuthority, true);
-assert.equal(contract.bootstrap.consumerSourceMutationPerIncident, false);
-assert.equal(contract.bootstrap.buildchainReleasePromotionPerIncident, false);
-assert.equal(contract.bootstrap.selfDogfoodUsesPublicContract, true);
-assert.equal(contract.bootstrap.recoveryDependsOnPublishedBuildchain, false);
-assert.equal(
-  contract.bootstrap.reviewRuntimeBinding,
-  "reviewed-head-or-protected-alpha-merge-to-exact-runtime",
-);
-assert.deepEqual(
-  contract.capabilityAdapters.map(({ id }) => id).sort(),
-  [...admissionPolicy.allowedCapabilities].sort(),
-  "every admitted capability must have one real candidate adapter",
-);
-for (const adapter of contract.capabilityAdapters) {
-  assert.match(adapter.execution, /^exact-candidate-/u);
-  assert.ok(adapter.payloadSchema.endsWith("/v1"));
+const root = path.resolve(import.meta.dirname, "..");
+const read = file => fs.readFileSync(path.join(root, file), "utf8");
+const json = file => JSON.parse(read(file));
+const parse = file => YAML.parse(read(file));
+const contract = json("architecture/universal-workflow-bootstrap.json");
+const policy = json("architecture/universal-workflow-capability-policy.json");
+const files = fs.readdirSync(path.join(root, ".github/workflows")).filter(f => /\.ya?ml$/u.test(f)).map(f => `.github/workflows/${f}`);
+const reusable = files.filter(f => parse(f).on?.workflow_call).sort();
+assert.deepEqual(contract.inventoryWorkflows, reusable, "Every reusable API must have an owner");
+assert.deepEqual([...contract.directCapabilityWorkflows, ...contract.bootstrapGovernedWorkflows].sort(), reusable, "Capabilities and bootstrap must partition the APIs");
+assert.equal(contract.bootstrap.runtimeEntry, "architecture/runtime-entry.json");
+assert.equal(contract.bootstrap.runtimeRecovery, "same-public-entry-with-transient-runtime");
+assert.equal(contract.bootstrap.entryRecovery, "upgrade-public-entry-and-full-rerun");
+assert.deepEqual(auditRuntimeEntry(root).issues, []);
+for (const retired of ["templates/bootstrap-recovery", "templates/universal-buildchain-bootstrap-recovery.yml", ".github/workflows/public-ops-bootstrap-recovery.yml"])
+  assert.equal(fs.existsSync(path.join(root, retired)), false, `Copied recovery code must remain retired: ${retired}`);
+assert.deepEqual(contract.capabilityAdapters.map(a => a.id).sort(), [...policy.allowedCapabilities].sort());
+assert.ok(!policy.allowedCapabilities.includes("workflow-contract"), "Validation alone is not capability execution");
+const now = Date.now();
+assert.ok(now >= Date.parse(policy.validFrom) && now < Date.parse(policy.expiresAt), "Capability admission policy requires protected renewal");
+assert.deepEqual(policy.contractRoots, contract.bootstrap.admissionPolicySources.map(f => `sha256:${crypto.createHash("sha256").update(read(f)).digest("hex")}`).sort());
+const workflow = parse(contract.bootstrap.publicWorkflow);
+assert.deepEqual(Object.keys(workflow.jobs), ["execution-runtime", "admit", "execute", "settle"]);
+for (const phase of ["admit", "execute", "settle"]) {
+  const job = workflow.jobs[phase];
+  assert.ok(job.needs.includes("execution-runtime"));
+  assert.ok(job.steps.some(s => s.uses === `./.buildchain/runtime/actions/workflow/bootstrap/${phase}`));
+  assert.ok(job.steps.every(s => s.uses && !s.run && !s.shell));
 }
-assert.ok(!admissionPolicy.allowedCapabilities.includes("workflow-contract"));
-assert.deepEqual(
-  admissionPolicy.contractRoots,
-  contract.bootstrap.admissionPolicySources.map(fileRoot).sort(),
-);
-assert.doesNotMatch(
-  fs.readFileSync(
-    path.join(root, contract.bootstrap.candidateEnginePath),
-    "utf8",
-  ),
-  /request\.capability\.id\s*===\s*["']workflow-contract["']/u,
-  "contract-only validation must not be admitted as successful execution",
-);
-const bootstrapSource = fs.readFileSync(
-  path.join(root, contract.bootstrap.publicWorkflow),
-  "utf8",
-);
-assert.doesNotMatch(
-  bootstrapSource,
-  /admission-policy-json:/u,
-  "callers must not supply their own admission authority",
-);
-assert.doesNotMatch(bootstrapSource, /^    permissions:/mu);
-const parse = (relative) =>
-  YAML.parse(fs.readFileSync(path.join(root, relative), "utf8"));
-const bootstrap = YAML.parse(bootstrapSource);
-assert.deepEqual(bootstrap.jobs.settle.needs, ["admit", "execute"]);
-const execute = parse("actions/workflow/bootstrap/execute/action.yml");
-const executor = execute.runs.steps.find((step) => step.id === "execute");
-assert.equal(
-  executor.with["mutation-token"],
-  "${{ inputs.secrets-buildchain-promotion-token }}",
-);
+assert.ok(workflow.jobs.execute.needs.includes("admit"));
+assert.ok(workflow.jobs.settle.needs.includes("execute"));
+const executor = parse("actions/workflow/bootstrap/execute/action.yml").runs.steps.find(s => s.id === "execute");
+assert.equal(executor.with["mutation-token"], "${{ inputs.secrets-buildchain-promotion-token }}");
 assert.equal(executor.with.token, "${{ github.token }}");
-const recovery = parse(contract.bootstrap.consumerRecoveryTemplate);
-assert.deepEqual(Object.keys(recovery.jobs), [
-  "recovery-admit",
-  "recovery-execute",
-  "recovery-settle",
-]);
-assert.equal(recovery.jobs["recovery-execute"].needs, "recovery-admit");
-assert.equal(recovery.jobs["recovery-execute"].permissions.contents, "write");
-assert.equal(
-  recovery.on.workflow_call.outputs["result-json"].value,
-  "${{ jobs.recovery-execute.outputs.result-json }}",
-);
-for (const [id, job] of Object.entries(recovery.jobs)) {
-  assert.ok(
-    job.steps.length <= 3,
-    `${id}: recovery workflow contains implementation details`,
-  );
-  const node = job.steps.find((step) => step.id === "node");
-  assert.equal(
-    node.uses,
-    `./.buildchain/workflow-shell/.buildchain/bootstrap-recovery/actions/workflow/recovery/${id.replace("recovery-", "")}`,
-  );
-  for (const step of job.steps) {
-    assert.equal(
-      Object.hasOwn(step, "run"),
-      false,
-      "Recovery workflow must dispatch owned nodes",
-    );
-    assert.ok(
-      !step.uses?.startsWith("kungfu-systems/buildchain/"),
-      "Recovery cannot depend on published Buildchain",
-    );
-  }
-}
-const recoveryAdmit = parse("actions/workflow/recovery/admit/action.yml").runs
-  .steps;
-const reviewIndex = recoveryAdmit.findIndex((step) =>
-  /independent review/.test(step.name || ""),
-);
-const installationIndex = recoveryAdmit.findIndex((step) =>
-  step.uses?.endsWith("actions/runtime/environment/prepare"),
-);
-const admissionIndex = recoveryAdmit.findIndex((step) => step.id === "admit");
-assert.ok(
-  reviewIndex >= 0 &&
-    installationIndex > reviewIndex &&
-    admissionIndex > installationIndex,
-  "No candidate dependency or code may execute before independent review",
-);
-execFileSync(
-  process.execPath,
-  [path.join(root, "scripts/generate-bootstrap-recovery.mjs"), "--check"],
-  { cwd: root, stdio: "pipe" },
-);
-const primaryTemplate = parse(contract.bootstrap.consumerTemplate);
-assert.ok(
-  Object.values(primaryTemplate.jobs).some(
-    (job) =>
-      job.uses ===
-      "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4",
-  ),
-);
-const selfDogfood = parse(contract.bootstrap.selfDogfoodWorkflow);
-for (const channel of ["conformance", "alpha", "stable"]) {
-  assert.equal(
-    selfDogfood.jobs[`primary-${channel}`].uses,
-    "./.github/workflows/public-ops-bootstrap.yml",
-  );
-  assert.equal(
-    selfDogfood.jobs[`recovery-${channel}`].uses,
-    "./.github/workflows/public-ops-bootstrap-recovery.yml",
-  );
+assert.doesNotMatch(read(contract.bootstrap.publicWorkflow), /admission-policy-json:/u);
+const template = parse(contract.bootstrap.consumerTemplate);
+assert.equal(template.jobs.bootstrap.uses, "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4");
+assert.equal(template.jobs.bootstrap.with["runtime-ref"], "${{ inputs.runtime-ref }}");
+const dogfood = parse(contract.bootstrap.selfDogfoodWorkflow);
+for (const channel of ["conformance", "alpha", "stable"]) for (const mode of ["primary", "recovery"]) {
+  const job = dogfood.jobs[`${mode}-${channel}`];
+  assert.equal(job.uses, "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4");
+  assert.equal(job.with["runtime-ref"], mode === "primary" ? "${{ inputs.runtime-ref }}" : "${{ inputs.recovery-runtime-ref }}");
 }
-
-console.log(
-  JSON.stringify({
-    ok: true,
-    schema: contract.schema,
-    publicWorkflowCount: discovered.length,
-    activePublicWorkflowCount: activeWorkflows.length,
-    inventoriedWorkflowCount: contract.inventoryWorkflows.length,
-    inventoryCoveragePercent: 100,
-    governedWorkflowCount: contract.bootstrapGovernedWorkflows.length,
-    governedCoveragePercent: Number(
-      (
-        (contract.bootstrapGovernedWorkflows.length / activeWorkflows.length) *
-        100
-      ).toFixed(2),
-    ),
-  }),
-);
+console.log(JSON.stringify({ ok: true, reusableWorkflowCount: reusable.length, runtimeAcquisitionOwners: 1 }));

package/scripts/check-workflows.sh

@@ -1,11 +1,4 @@
 #!/bin/bash
 set -euo pipefail
 
-if command -v actionlint >/dev/null 2>&1; then
-  find .github/workflows -maxdepth 1 -name '*.yml' -print0 | xargs -0 actionlint -color=false
-else
-  find .github/workflows -maxdepth 1 -name '*.yml' -print0 | \
-    xargs -0 go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -color=false
-fi
-
 node scripts/check-dev-delivery-actions.mjs

package/scripts/generate-bootstrap-admission.mjs

@@ -13,7 +13,7 @@ const contract = JSON.parse(
 );
 const target = path.join(
   root,
-  "architecture/universal-workflow-train-admission.json",
+  "architecture/universal-workflow-capability-policy.json",
 );
 const policy = JSON.parse(fs.readFileSync(target, "utf8"));
 policy.contractRoots = contract.bootstrap.admissionPolicySources