@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/scripts/generate-channel-promotion-workflow.mjs

@@ -22,22 +22,22 @@ const routedOutputs = {
 };
 export function generateChannelPromotionWorkflow(source) {
   const component = YAML.parse(source).on.workflow_call;
-  if (Object.keys(component.inputs).join() !== "request-json") throw new Error("Promotion component requires one complete invocation request");
+  if (Object.keys(component.inputs).filter(key => !["runtime-ref", "contract-lock", "runtime-selection"].includes(key)).join() !== "request-json") throw new Error("Promotion component requires one complete invocation request");
   const outputs = Object.fromEntries(Object.entries(routedOutputs).map(([key, value]) => [key, {
     description: `Admitted ${value}.`, value: `\${{ jobs.resolve-promotion.outputs.${value} }}`,
   }]));
   for (const [key, output] of Object.entries(component.outputs)) outputs[key] = { ...output, value: `\${{ jobs.invoke.outputs.${key} }}` };
   const jobs = JSON.parse(fs.readFileSync(path.join(root, "architecture/promotion-job-topology.json"), "utf8"));
   jobs.invoke = {
-    name: "Invoke the current publisher component", needs: ["resolve-promotion", "consumer-admission"],
-    uses: "./.github/workflows/.release-promote.yml", with: { "request-json": "${{ needs.consumer-admission.outputs.invocation-json }}" }, secrets: "inherit",
+    name: "Invoke the current publisher component", needs: ["resolve-promotion", "consumer-admission", "execution-runtime"],
+    uses: "./.github/workflows/.release-promote.yml", with: { "request-json": "${{ needs.consumer-admission.outputs.invocation-json }}", "runtime-selection": "${{ needs.execution-runtime.outputs.selection }}" }, secrets: "inherit",
   };
   return "# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.\n" + YAML.stringify({
     name: "Release Candidate Promote",
     on: { workflow_call: { inputs: { "request-json": {
       description: "JSON object matching contracts/promotion-request-v1.schema.json. The API validates types, defaults and authority before dispatch.",
       required: true, type: "string",
-    } }, secrets: component.secrets, outputs } }, jobs,
+    }, ...Object.fromEntries(["runtime-ref", "contract-lock", "runtime-selection"].map(key => [key, component.inputs[key]])) }, secrets: component.secrets, outputs } }, jobs,
   }, { lineWidth: 0, aliasDuplicateObjects: false });
 }
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url))

package/scripts/inventory/binary.mjs

@@ -5,8 +5,8 @@ export function assertBinaryInventory(root) {
   const file = ".github/workflows/self-build-binary-distribution.yml";
   const workflow = readWorkflow(file, root);
   assert.equal(workflow.name, "Binary Distribution");
-  assert.deepEqual(Object.keys(workflow.jobs), ["preflight", "binary", "passport", "dispatch-publication"]);
-  const graphs = Object.keys(workflow.jobs).map(id => inspectWorkflowJob(file, id, root));
+  assert.deepEqual(Object.keys(workflow.jobs).filter(id => id !== "execution-runtime"), ["preflight", "binary", "passport", "dispatch-publication"]);
+  const graphs = Object.keys(workflow.jobs).filter(id => id !== "execution-runtime").map(id => inspectWorkflowJob(file, id, root));
   for (const graph of graphs) {
     assert.equal(graph.job.permissions.contents, "read");
     assert.notEqual(graph.job.permissions["id-token"], "write");
@@ -23,7 +23,7 @@ export function assertBinaryInventory(root) {
   assert.ok(passport.actions.has("actions/build/binary/qualify"));
   const publish = inspectWorkflowJob(".github/workflows/.release-binary-assets.yml", "publish", root);
   assert.equal(publish.workflow.jobs["publication-authority"].uses, "./.github/workflows/.release-authority.yml");
-  assert.equal(publish.job.needs, "publication-authority");
+  assert.ok(publish.job.needs.includes("publication-authority"));
   assert.equal(publish.job.environment, "buildchain-release-assets");
   assert.equal(publish.job.permissions.contents, "write");
   assert.ok(publish.actions.has("actions/release/binary/publish"));
@@ -32,5 +32,5 @@ export function assertBinaryInventory(root) {
   assert.equal(effect["continue-on-error"], undefined);
   const transaction = publish.modules.get("packages/core/publication/binary/transaction.js");
   assert.match(transaction, /validateBinaryCapability\([\s\S]*await client.publish\(/, "Binary effects must follow capability admission");
-  assert.match(publish.modules.get("packages/core/publication/binary/action.js"), /verifySourceRuntimeCheckouts\([\s\S]*await publishBinaryAssets\(/);
+  assert.match(publish.modules.get("packages/core/publication/binary/action.js"), /verifyCheckoutIdentity\([\s\S]*await publishBinaryAssets\(/);
 }

package/scripts/inventory/promotion.mjs

@@ -15,13 +15,14 @@ export function assertPromotionInventory(root) {
       read(".github/workflows/.release-promote.yml"),
     ),
   );
-  assert.deepEqual(Object.keys(api.on.workflow_call.inputs), ["request-json"]);
+  assert.deepEqual(Object.keys(api.on.workflow_call.inputs), ["request-json", "runtime-ref", "contract-lock", "runtime-selection"]);
   assert.equal(
     api.jobs.invoke.uses,
     "./.github/workflows/.release-promote.yml",
   );
   assert.deepEqual(api.jobs.invoke.with, {
     "request-json": "${{ needs.consumer-admission.outputs.invocation-json }}",
+    "runtime-selection": "${{ needs.execution-runtime.outputs.selection }}",
   });
   const request = JSON.parse(
     read("contracts/promotion-request-v1.schema.json"),
@@ -41,10 +42,11 @@ export function assertPromotionInventory(root) {
   ]) {
     const caller = YAML.parse(read(`.github/workflows/${file}.yml`));
     const calls = Object.values(caller.jobs).filter(
-      (job) => job.uses === `./${publicPath}`,
+      (job) => job.uses === `kungfu-systems/buildchain/${publicPath}@v4`,
     );
     assert.equal(calls.length, 1, file);
-    assert.deepEqual(Object.keys(calls[0].with), ["request-json"]);
+    assert.ok(calls[0].with["request-json"]);
+    assert.ok(Object.keys(calls[0].with).every(key => ["request-json", "runtime-ref", "contract-lock", "runtime-selection"].includes(key)));
   }
   const component = ".github/workflows/.release-promote.yml";
   const expected = {

package/scripts/runtime-source-boundaries.mjs

@@ -0,0 +1,70 @@
+import ts from "typescript";
+
+const equality = new Set([
+  ts.SyntaxKind.EqualsEqualsToken,
+  ts.SyntaxKind.EqualsEqualsEqualsToken,
+  ts.SyntaxKind.ExclamationEqualsToken,
+  ts.SyntaxKind.ExclamationEqualsEqualsToken,
+]);
+
+export function auditRuntimeSourceBoundaries(source, file) {
+  const tree = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true);
+  const aliases = new Map();
+  function collect(node) {
+    if (
+      ts.isVariableDeclaration(node) &&
+      ts.isIdentifier(node.name) &&
+      node.initializer
+    )
+      aliases.set(node.name.text, node.initializer);
+    ts.forEachChild(node, collect);
+  }
+  collect(tree);
+  function origins(node, seen = new Set()) {
+    const text = node.getText(tree);
+    const result = new Set();
+    if (
+      /\b(?:installationRoot|BUILDCHAIN_RUNTIME_ROOT|runtimeRoot)\b/u.test(text)
+    )
+      result.add("runtime");
+    if (
+      /\b(?:GITHUB_WORKSPACE|workspace|sourceRoot|consumerRoot)\b/u.test(text)
+    )
+      result.add("source");
+    if (
+      ts.isIdentifier(node) &&
+      aliases.has(node.text) &&
+      !seen.has(node.text)
+    ) {
+      for (const origin of origins(
+        aliases.get(node.text),
+        new Set([...seen, node.text]),
+      ))
+        result.add(origin);
+    }
+    ts.forEachChild(node, (child) => {
+      for (const origin of origins(child, seen)) result.add(origin);
+    });
+    return result;
+  }
+  const issues = [];
+  function inspect(node) {
+    if (ts.isBinaryExpression(node) && equality.has(node.operatorToken.kind)) {
+      const left = origins(node.left),
+        right = origins(node.right);
+      if (
+        (left.has("runtime") && right.has("source")) ||
+        (right.has("runtime") && left.has("source"))
+      ) {
+        const line =
+          tree.getLineAndCharacterOfPosition(node.getStart(tree)).line + 1;
+        issues.push(
+          `${file}:${line}: business code cannot require runtime and source directory equality`,
+        );
+      }
+    }
+    ts.forEachChild(node, inspect);
+  }
+  inspect(tree);
+  return issues;
+}

package/scripts/site-capability-metadata.mjs

@@ -226,8 +226,8 @@ export function nodeApiMeta(exportName) {
     "./release-candidate": { group: "reusable-build", summary: "PR-stage release-candidate artifact, passport, and promote-only resolver APIs." },
     "./v4-floating-consumer-policy": { group: "governance-versioning", summary: "Semantic floating-selector admission, dual-lock receipt, and independent v4 consumer certification APIs." },
     "./floating-consumer-policy": { group: "governance-versioning", summary: "Semantic floating-selector admission, dual-lock receipt, and independent v4 consumer certification APIs." },
-    "./v4-runtime-ref-resume-authority": { group: "release-passport-trust", summary: "Transient exact-runtime authorization, persisted-selector rejection, fresh-attempt Stage Capsule reuse, and A+B Passport lineage APIs." },
-    "./runtime-ref-resume-authority": { group: "release-passport-trust", summary: "Transient exact-runtime authorization, persisted-selector rejection, fresh-attempt Stage Capsule reuse, and A+B Passport lineage APIs." },
+    "./runtime-resume-lineage": { group: "release-passport-trust", summary: "Source-bound recovery, reusable Stage Capsule evidence and publication readback lineage across execution runtimes." },
+    "./runtime-resume-lineage": { group: "release-passport-trust", summary: "Transient exact-runtime authorization, persisted-selector rejection, fresh-attempt Stage Capsule reuse, and A+B Passport lineage APIs." },
     "./v4-tail-reseal": { group: "release-passport-trust", summary: "Effect-pure retained Stage Capsule validation and explicit Warrant-, credential-, and release-tail-fenced macOS reseal planning APIs." },
     "./tail-reseal": { group: "release-passport-trust", summary: "Effect-pure retained Stage Capsule validation and explicit Warrant-, credential-, and release-tail-fenced macOS reseal planning APIs." },
     "./v4-tail-reseal-receipt": { group: "release-passport-trust", summary: "Four-platform byte readback, standard candidate Passport binding, and terminal v4 tail-reseal receipt APIs." },

package/scripts/workflow-action-graph.mjs

@@ -8,7 +8,7 @@ export const repositoryRoot = path.resolve(import.meta.dirname, "..");
 export function localActionDirectory(uses) {
   if (typeof uses !== "string") return null;
   const match =
-    /^\.\/(?:\.buildchain\/[a-z0-9][a-z0-9-]*\/)?(actions\/[a-z0-9-]+\/[a-z0-9-]+\/[a-z0-9-]+)$/u.exec(
+    /^(?:\$\/|\.\/(?:\.buildchain\/[a-z0-9][a-z0-9-]*\/)?)((?:actions)\/[a-z0-9-]+\/[a-z0-9-]+\/[a-z0-9-]+)$/u.exec(
       uses,
     );
   return match?.[1] || null;
@@ -117,23 +117,10 @@ export function inspectWorkflowJob(relative, jobId, root = repositoryRoot) {
     if (action.runs.using === "composite") {
       for (const child of action.runs.steps) {
         if (excludedPhase(child, childInputs)) continue;
-        const executableText = [child.run, child.with?.script]
-          .filter(Boolean)
-          .join("\n");
-        for (const match of executableText.matchAll(
-          /(?:\$GITHUB_ACTION_PATH\/|["'](?:\.\.\/)+)([^"'\s]+\.[cm]?js)/gu,
-        )) {
-          const prefix = match[0].startsWith("$GITHUB_ACTION_PATH/")
-            ? ""
-            : match[0].slice(1, -match[1].length);
-          sourceModule(path.posix.join(directory, prefix, match[1]));
-        }
-        for (const match of executableText.matchAll(
-          /(?:^|[\s"'/])((?:packages\/core|scripts)\/[^\s"']+\.[cm]?js)/gu,
-        )) {
-          const file = match[1];
-          if (fs.existsSync(path.join(root, file))) sourceModule(file);
-        }
+        assert.ok(
+          child.uses && !child.run && !child.shell && !child.with?.script,
+          `${directory}: composite must invoke actions, not executable scripts`,
+        );
         walk(child, [...ancestry, directory], childInputs);
       }
     } else if (/^node\d+$/u.test(action.runs.using)) {

package/scripts/workflow-self-reference.mjs

@@ -0,0 +1,20 @@
+import YAML from "yaml";
+
+// actionlint 1.7.12 predates GitHub's self-repository action references.
+// Resolve only this syntax in the isolated source project so actionlint still
+// validates the real action's inputs, outputs and every other expression.
+export function lowerSelfReferencesForLint(source) {
+  const document = YAML.parseDocument(source);
+  if (document.errors.length) throw document.errors[0];
+  YAML.visit(document, {
+    Pair(_key, pair) {
+      if (pair.key?.value !== "uses" || typeof pair.value?.value !== "string") return;
+      const reference = pair.value.value;
+      if (!reference.startsWith("$/")) return;
+      if (!/^\$\/actions\/[a-z0-9-]+\/[a-z0-9-]+\/[a-z0-9-]+$/u.test(reference))
+        throw new Error(`Invalid Buildchain self action reference: ${reference}`);
+      pair.value.value = `.${reference.slice(1)}`;
+    },
+  });
+  return String(document);
+}

package/templates/native-dev-delivery.yml

@@ -5,10 +5,10 @@ on:
       - buildchain-dev-delivery-wake
   workflow_dispatch:
     inputs:
-      buildchain-ref:
-        description: "Buildchain runtime selector: v4, v4-alpha, or a trusted train/v4/v4.0/<capability>"
+      runtime-ref:
+        description: "Buildchain runtime selector: v4, v4-alpha, or a trusted train/v4/v4.1/<capability>"
         required: false
-        default: v4-alpha
+        default: ""
       target-branch:
         description: Protected dev/vN/vN.M branch
         required: true
@@ -95,7 +95,7 @@ jobs:
   deliver:
     uses: kungfu-systems/buildchain/.github/workflows/public-ops-dev-auto-merge.yml@v4-alpha
     with:
-      buildchain-ref: ${{ inputs.buildchain-ref || 'v4-alpha' }}
+      runtime-ref: ${{ inputs.runtime-ref || '' }}
       target-branch: ${{ github.event.client_payload.candidate.targetBranch || inputs.target-branch }}
       expected-pr-number: ${{ github.event.client_payload.candidate.pullRequestNumber || inputs.expected-pr-number }}
       expected-head-sha: ${{ github.event.client_payload.candidate.sourceHead || inputs.expected-head-sha }}

package/templates/universal-buildchain-bootstrap.yml

@@ -7,6 +7,16 @@ on:
         description: "Versioned exact-candidate request envelope"
         required: true
         type: string
+      runtime-ref:
+        description: Entry-owned runtime selection parameter.
+        required: false
+        type: string
+        default: ""
+      contract-lock:
+        description: Entry-owned runtime selection parameter.
+        required: false
+        type: string
+        default: ""
     outputs:
       runtime-sha:
         value: ${{ jobs.bootstrap.outputs.runtime-sha }}
@@ -14,8 +24,6 @@ on:
         value: ${{ jobs.bootstrap.outputs.terminal-receipt-json }}
       terminal-receipt-root:
         value: ${{ jobs.bootstrap.outputs.terminal-receipt-root }}
-      backflow-root:
-        value: ${{ jobs.bootstrap.outputs.backflow-root }}
 
 permissions:
   contents: read
@@ -25,4 +33,6 @@ jobs:
     uses: kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4
     with:
       request-json: ${{ inputs.request-json }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      contract-lock: ${{ inputs.contract-lock }}
     secrets: inherit

package/architecture/runtime-ref-resume-authority.json

@@ -1,64 +0,0 @@
-{
-  "schemaVersion": 1,
-  "contract": "kungfu-buildchain-v4-runtime-ref-resume-authority/v1",
-  "schemaAuthority": "contracts/v4-runtime-ref-resume-authority-v1.schema.json",
-  "fixtureAuthority": "contracts/fixtures/v4-runtime-ref-resume-authority-v1/scenario.json",
-  "runtimeAuthority": "packages/core/consumer/runtime-ref-resume-authority.js",
-  "mode": "v4-only",
-  "transientSelection": {
-    "trustedEvent": "workflow_dispatch",
-    "actorPermissions": ["write", "maintain", "admin"],
-    "approvedRefs": [
-      "v4",
-      "v4-alpha",
-      "train/v4/v4.N/*",
-      "authority/v4/v4.N/*"
-    ],
-    "exactShaRequiresApprovedRefReachability": true,
-    "operatorReasonRequired": true,
-    "sourceTreeBound": true,
-    "consumerPolicyReceiptBound": true,
-    "dualContractLockRootsBound": true,
-    "providerReadbackRooted": true
-  },
-  "persistence": {
-    "exactShaDefault": "deny",
-    "trainOrAuthorityDefault": "deny",
-    "repositoryVariableIndirection": "deny",
-    "secretIndirection": "deny",
-    "environmentIndirection": "deny",
-    "oidcIamAndExternalAuthorityInventory": "metadata-only"
-  },
-  "resume": {
-    "freshAttemptRequired": true,
-    "failedJobRerun": false,
-    "floatingRefMovementRequired": true,
-    "buildAndResumeRuntimeMustDiffer": true,
-    "sealedCapsuleIdentity": [
-      "source-sha",
-      "source-tree-sha",
-      "platform",
-      "build-runtime-sha",
-      "consumer-policy-receipt-root",
-      "capsule-root",
-      "identity-root",
-      "artifact-digest"
-    ],
-    "validUnaffectedPlatforms": "reuse",
-    "missingPlatforms": "rebuild",
-    "staleOrAmbiguousCapsules": "reject"
-  },
-  "passport": {
-    "section": "v4RuntimeResume",
-    "recordsRuntimeAAndB": true,
-    "authorizationRootRequired": true,
-    "lineageRootRequired": true,
-    "finalPublicReadbackRootRequired": true
-  },
-  "authority": {
-    "v3BehaviorChange": false,
-    "credentialsInEvidence": false,
-    "persistentExactSha": false,
-    "providerMutation": false
-  }
-}

package/architecture/universal-workflow-train-admission.json

@@ -1,76 +0,0 @@
-{
-  "schema": "kungfu-buildchain-v4-universal-workflow-admission-policy/v1",
-  "sourceRepository": "kungfu-systems/buildchain",
-  "consumerAdmission": "verified-caller",
-  "allowedCapabilities": [
-    "bootstrap-conformance",
-    "release-candidate-promote",
-    "release-invocation"
-  ],
-  "permissionCeiling": {
-    "actions": "write",
-    "artifact-metadata": "write",
-    "attestations": "write",
-    "checks": "write",
-    "contents": "write",
-    "deployments": "write",
-    "id-token": "write",
-    "issues": "write",
-    "packages": "write",
-    "pages": "write",
-    "pull-requests": "write",
-    "security-events": "write",
-    "statuses": "write"
-  },
-  "contractRoots": [
-    "sha256:01afa05effa5be9c3178382ea76b125c431c310f31c930acc51dd2011b0b44c7",
-    "sha256:0e9b473d3e04c4563c81b96bf159b4e8565fb7442cbae9fd5f2b736ecf931965",
-    "sha256:0fc02895c9da6e1eb50fb0d9edcfa29a7be074f8d06e4755c3a8948229e9d615",
-    "sha256:1474f1cc5f9db3903e3961e973f8ba96fac9401850751399841fb3957bb6c917",
-    "sha256:17c5fc05f8599662cd061a94add5313dc0fcea58404f9a92ee632c98abce24c6",
-    "sha256:18546a18c951a7d594b42fc38ee2f8ce90e2506ed514332af0e67d092e2d1f40",
-    "sha256:1a80a52652f61d061f3c427240f35b99a147aff7f4a3995b2b9938d5acaa81f2",
-    "sha256:234e49ec69c1d8bbc57a7e528c07f66cf5c8c21bfcd802aa7610b23d7d5b3c04",
-    "sha256:263b63d25b82255dfc087d76d28b208dd59c44914c3c45cb537c438151214b4b",
-    "sha256:265ccc9da3d84b8bf50746b6722b18c680dcc65bd322a5170e81bd5d0fa5b2b0",
-    "sha256:29dbec8ebd38dd8cef69bbf2fdf8586391863e7e53d78de55ca922409592e94e",
-    "sha256:2af9e624b70654c8a080dacaefa59a61ddf05be542c2f595a8d1970a1a14e8dd",
-    "sha256:3176603b4e69310944aaeda84f6f27c6d57e73bb082a7d7ee6ee62d9bc0816ea",
-    "sha256:3be79c2a7b6d48bcff3a8294cd98835b8e58cbf769bc8ec67a7ea77b065d2e92",
-    "sha256:41de3292e11725b738a41abacc093fca8ddb9d54c58765dfb67ad5c005f102ba",
-    "sha256:43d2812a9d07435b4550386ac8903dfd511802dc38efa8e546430af7a414cb98",
-    "sha256:441430a3dc420f9b1ba363703c3ec28f92606b3b6dd328523b5492d327aa6ba3",
-    "sha256:466bdddfcf06ad60cf038777ceaf793511581336c845cb8daef6e4f233c3a7ff",
-    "sha256:49065b4b7f0e4fd1760e808e310edfea3bd7333c8407c4b419a097ea3d908adc",
-    "sha256:4916bb48f509f3e4db3626ae676e735253ad3aace8b54c20aca6f084ce70802b",
-    "sha256:567970a563ada761dc4889e8a22bd2b67cc70b1318dd43c9584c39f002a5fc0a",
-    "sha256:5e0dae41e7e0c5e375f88cdcc4a30505246000740c6806b1119312171c8d42d8",
-    "sha256:6b95750684c7a4131bd0c7e95326f1b00c01e47a7e5fe5312a916ca86e5bf74d",
-    "sha256:6ead02c396a2580606ebc0bc12aa4606bfdd7596ba1d45d316af5c3767517c39",
-    "sha256:74782cada7ad52a4cd2f6bdf59d288d7514d6647f8f27aaeb70e4b2b41f83d60",
-    "sha256:874fc697abac4a79e77fd133935763f09e027c2f8cdf147b5b1fab2193b49a09",
-    "sha256:8fcb36f28fba242c0259824b47bb63821ced69ed30b5d36530bc4c2ef5192e81",
-    "sha256:990f80c199735e1876c3c8887a4b5ff34b0e8dd304cc35779ae269117f0b933d",
-    "sha256:9a8c11b4787f24447df76a5ee0f31ed7d7cf0284a1251d4d4bdccc895571d4fe",
-    "sha256:9d1c6a36f814360123ea2647962df1bbd7fcba33b9e987d34364894b836ff90c",
-    "sha256:9ed88028c348832cf60b30536f8feda84248350e26fb00256076ff3f7d3d3f19",
-    "sha256:a2a553a0e774224b398e5bccde811f8354638547656453adf7734f416f011a2b",
-    "sha256:ab5681f60da097852e44c254e8c66b50572389b9ebfb94fa0c67af416d7ecb07",
-    "sha256:b4f6e135e44b60097ec926509c705d8f3307de113c9d1155a22a3ea61a5daa28",
-    "sha256:baf0273671278773d931b202de9bd7facc28e2d9962bbdfa038594c8ba00ab51",
-    "sha256:bdd0b125ca2b4fa9828178631bb70bc9417b50f1206d04203c38088f0c077665",
-    "sha256:cb42b0f31edf5bc290ea0634c4b71e27a929c9fe68131f9e113c12c385f96095",
-    "sha256:d309f53c7ab4d2fd99fae0512eee93aebeedc82e6c8db6e2d02107d0d1e6d24f",
-    "sha256:d829866ba8565b432af82aa059af9bcc11b730f1283ba78fb618e50f213cf5a2",
-    "sha256:e8486f542a660129ae63cbba79aa36192038b210b2954d8bf127e907ea286b28",
-    "sha256:f1a22e4a7bc42e63cc34bf43837f4ae38905a8b5e2908163401057af9982b2a0",
-    "sha256:f1ebeb4bc3f4cedea5c325b0f807452576d89fa1be6549ce837a98bdce0d642f",
-    "sha256:f77d617eac0035542baa86f5364db79ccbf93bb7202ed1c36cee5a52cf31f0d1"
-  ],
-  "targetRef": "dev/v4/v4.1",
-  "allowedReviewers": ["kungfu-origin"],
-  "minimumApprovals": 1,
-  "requiredChecks": ["check"],
-  "validFrom": "2026-08-30T00:00:00.000Z",
-  "expiresAt": "2026-09-15T00:00:00.000Z"
-}