@kungfu-tech/buildchain 4.1.2 → 4.1.3-alpha.1

package/packages/core/release/promote-candidate/transaction.js

@@ -1,103 +1,47 @@
-import {
-  resolveCandidateBuildSummaryPath,
-  resolveCandidateProviderInputs,
-  resolvePublicationTarget,
-} from "./evidence-inputs.js";
-import {
-  assertCandidateEvidenceBinding,
-  canonicalChannel,
-  observeProtectedPublicationSource,
-} from "./evidence-binding.js";
-import { productProviderRequest } from "./provider-request.js";
-import { createReleaseDocuments } from "./release-documents.js";
+import { prepareCandidatePublication } from "./preparation.js";
 import { applyAndSettle } from "./provider-settlement.js";
-import { read } from "./files.js";
 import { candidatePublicationOutputs } from "./outputs.js";
 import { completePublicationDevelopment } from "./publication-completion.js";
 import {
-  activateExactPnpm,
-  planProductPublication,
-} from "./product-provider.js";
-import path from "node:path";
+  readApplyDocuments,
+  verifyPublicationSettlement,
+} from "../../publication/settlement/transaction.js";
+import { canonicalChannel } from "./evidence-binding.js";
+import { activateExactPnpm } from "./product-provider.js";
+
 export async function promoteReleaseCandidate(
   request,
-  { octokit, mutationOctokit, actor, runId, observe = () => {} },
-) {
-  const repository = request["repository"];
-  const declaredSourceSha = request["source-sha"];
-  const fallbackVersion = request["version"];
-  const fallbackTag = request["tag"];
-  const channel = request["channel"];
-  const expectedTransactionId = request["resume-transaction-id"];
-  const candidatePassportPath = request["candidate-passport-path"];
-  const buildSummaryPath = resolveCandidateBuildSummaryPath({
-    declaredPath: request["candidate-build-summary-path"],
-  });
-  const candidate = read(candidatePassportPath);
-  const stageCapsules = read(request["stage-capsules-path"]);
-  const qualification = read(request["publication-qualification-path"]);
-  const token = request["token"];
-  const publicationTarget = resolvePublicationTarget({
-    recoveryReceiptPath: request["recovery-receipt-path"],
-    candidate,
-    repository,
-    channel,
-    sourceSha: declaredSourceSha,
-    targetRef: request["target-ref"],
-    targetSha: request["target-sha"],
-    expectedTransactionId,
-  });
-  const sourceSha = publicationTarget.sourceSha;
-  assertCandidateEvidenceBinding({ candidate, stageCapsules, repository });
-  const sourceBinding = await observeProtectedPublicationSource({
-    octokit,
-    repository,
-    protectedSourceSha: sourceSha,
-    candidate,
-  });
-  const providerInputs = resolveCandidateProviderInputs({
-    recoveryReceiptPath: request["recovery-receipt-path"],
-    artifactKind: request["publish-artifact-kind"] || "npm",
-    sealedBundleRoot: request["sealed-bundle-root"],
-    sealedBundleManifest: request["sealed-bundle-manifest"],
-    requiredArtifactsPath: request["required-artifacts-path"],
-    publishPackageMain: request["publish-package-main"],
-  });
-  const providerRequest = productProviderRequest({
-    request,
-    actor,
-    runId,
+  {
     octokit,
     mutationOctokit,
-    repository,
-    targetRef: publicationTarget.targetRef,
-    targetSha: publicationTarget.targetSha,
-    candidate,
-    candidatePassportPath,
-    buildSummaryPath,
-    qualification,
-    providerInputs,
-  });
-  const publicationPlan = await planProductPublication(providerRequest, {
-    fallbackVersion,
-    fallbackTag,
-  });
-  const documents = await createReleaseDocuments({
-    request,
     actor,
     runId,
+    observe = () => {},
+    observeNode = (_node, effect) => effect(),
+  },
+) {
+  const context = await observeNode("qualification", async () => {
+    const prepared = await prepareCandidatePublication(request, {
+      octokit,
+      mutationOctokit,
+      actor,
+      runId,
+    });
+    if (request.retainRecoveryMaterials)
+      await request.retainRecoveryMaterials();
+    return prepared;
+  });
+  const {
     repository,
     sourceSha,
-    fallbackVersion,
+    token,
     channel,
-    candidate,
-    stageCapsules,
     qualification,
-    sourceBinding,
+    providerRequest,
     publicationPlan,
-    publicationIntent: providerRequest.publicationIntent,
-    octokit,
-  });
+    documents,
+    sourceBinding,
+  } = context;
   activateExactPnpm();
   const settlement = await applyAndSettle({
     request,
@@ -111,20 +55,34 @@ export async function promoteReleaseCandidate(
     providerRequest,
     publicationPlan,
     documents,
+    observeNode,
   });
-  await completePublicationDevelopment({
-    repository,
-    sourceSha,
-    token,
-    channel: canonicalChannel(channel),
-    settlement,
-    documents,
-    sourceBinding,
-    providerRequest,
-    octokit,
-    mutationOctokit,
-  });
+  await observeNode("next-development", () =>
+    completePublicationDevelopment({
+      repository,
+      sourceSha,
+      token,
+      channel: canonicalChannel(channel),
+      settlement,
+      documents,
+      sourceBinding,
+      providerRequest,
+      octokit,
+      mutationOctokit,
+    }),
+  );
   const outputs = candidatePublicationOutputs(documents, settlement);
+  await observeNode(
+    "settlement",
+    async () =>
+      verifyPublicationSettlement(readApplyDocuments(".buildchain"), {
+        repository,
+        tag: documents.tag,
+        sourceSha: settlement.productProviderResult.publication.releaseSha,
+        candidateSha: sourceSha,
+      }),
+    (status) => status,
+  );
   observe(outputs);
   return { documents, settlement, outputs };
 }

package/packages/core/release/promotion/candidate.js

@@ -1,3 +1,4 @@
+import { recoverDiscussionCandidate } from "../discussion/recovery.js";
 import { resolveReleaseCandidateArtifacts } from "../candidate/resolve.js";
 import { resumeFromCandidateRun } from "../recovery/candidate.js";
 export async function qualifyPromotionCandidate(
@@ -16,6 +17,7 @@ export async function qualifyPromotionCandidate(
   {
     fresh = resolveReleaseCandidateArtifacts,
     recover = resumeFromCandidateRun,
+    recoverDiscussion = recoverDiscussionCandidate,
   } = {},
 ) {
   const shared = {
@@ -29,6 +31,15 @@ export async function qualifyPromotionCandidate(
     runtimeSha,
     outputDir,
   };
+  if (request["resume-discussion-id"])
+    return recoverDiscussion({
+      discussionId: request["resume-discussion-id"],
+      repository,
+      token,
+      outputDir,
+      targetSha: intent["requested-sha"],
+      targetRef: intent["target-ref"],
+    });
   if (request["resume-candidate-run-id"])
     return recover({
       ...shared,
@@ -52,8 +63,6 @@ export async function qualifyPromotionCandidate(
       runtimeRoot,
       recoveryRunId,
       recoveryRunAttempt,
-
-
     });
   return fresh({
     ...shared,

package/packages/core/release/promotion/qualification.js

@@ -24,6 +24,7 @@ export async function qualifyPromotion(
       requestedChannel: request.channel,
       dryRun: request["dry-run"],
       resume: Boolean(
+        request["resume-discussion-id"] ||
         request["resume-candidate-run-id"] ||
         request["publish-transaction-override"],
       ),
@@ -46,8 +47,10 @@ export async function qualifyPromotion(
     );
   const candidateVersion = qualified.candidateVersion || qualified.version,
     publicationVersion = qualified.publicationVersion || qualified.version;
-  const recoveredVersion =
-    request["publish-transaction-override"] || request["resume-transaction-id"]
+  const recoveredVersion = request["resume-discussion-id"]
+    ? publicationVersion
+    : request["publish-transaction-override"] ||
+        request["resume-transaction-id"]
       ? await recoverVersion(
           {
             requestedSha: intent["requested-sha"],

package/packages/core/release/promotion-request.js

@@ -49,13 +49,17 @@ export function normalizePromotionRequest(value, kind = "request") {
       throw new Error(`Unsupported promotion ${kind} schema`);
     result[key] = input;
   }
+  if (
+    result["resume-discussion-id"] &&
+    (result["resume-candidate-run-id"] || result["resume-transaction-id"])
+  )
+    throw new Error(
+      "Discussion recovery cannot be combined with candidate-run or transaction-id recovery",
+    );
   return result;
 }
 
-export function bindPromotionInvocation(
-  requestValue,
-  selection,
-) {
+export function bindPromotionInvocation(requestValue, selection) {
   const request = normalizePromotionRequest(requestValue);
   const projected = Object.fromEntries(
     Object.entries(request).filter(([key]) =>

package/packages/core/workflow/engine/execution.js

@@ -6,7 +6,10 @@ import {
 import { createReleaseInvocation } from "../../release/release-invocation.js";
 import { executeBootstrapConformance } from "./conformance.js";
 import { executeReleasePromotion } from "./release-promotion.js";
+import { executeReleaseDiscussion } from "../../release/discussion/qualification.js";
 async function capabilityResult(request, admission, context) {
+  if (request.capability.id === "release-discussion")
+    return executeReleaseDiscussion(request, admission, context);
   if (request.capability.id === "bootstrap-conformance")
     return executeBootstrapConformance(request, admission, context);
   if (request.capability.id === "release-invocation") {
@@ -61,7 +64,8 @@ export async function executeAdmittedWorkflow(request, admission, context) {
 
 export function assertResultLineage(admission, result) {
   const { resultRoot, ...body } = result || {};
-  if (resultRoot !== contentRoot("universal-workflow-result", body)) fail("candidate result root mismatch");
+  if (resultRoot !== contentRoot("universal-workflow-result", body))
+    fail("candidate result root mismatch");
   if (
     result?.schema !== "kungfu-buildchain-v4-universal-workflow-result/v1" ||
     result.requestRoot !== admission.requestRoot ||

package/packages/core/workflow/engine/provider-context.js

@@ -7,6 +7,8 @@ export function providerExecutionContext({ token, mutationToken, env }) {
     apiUrl,
     actor: env.GITHUB_ACTOR,
     runId: env.GITHUB_RUN_ID,
+    runAttempt: env.GITHUB_RUN_ATTEMPT,
+    runtimeSelection: env.BUILDCHAIN_RUNTIME_SELECTION,
     octokit: token ? getOctokit(token, { baseUrl: apiUrl }) : undefined,
     mutationOctokit:
       mutationToken || token

package/packages/core/workflow/engine/release-observation.js

@@ -29,6 +29,7 @@ export async function observeReleaseRoute(
     targetRef,
     dryRun: inputs["dry-run"] === true,
     resume:
+      Boolean(inputs["resume-discussion-id"]) ||
       String(inputs["resume-candidate-run-id"] || "") !== "" ||
       inputs["publish-transaction-override"] === true,
   });

package/packages/core/workflow/engine/release-promotion.js

@@ -6,9 +6,10 @@ import { planReleaseRoute } from "../../release/release-invocation.js";
 import { selectRecoveredProductPublicationVersion } from "../universal-workflow-bootstrap.js";
 import { assertDeclarativePromotionInputs } from "../../publication/publication-qualification.js";
 import { normalizePromotionRequest } from "../../release/promotion-request.js";
-import { resolveReleaseCandidateArtifacts } from "../../release/candidate/resolve.js";
+import { qualifyPromotionCandidate } from "../../release/promotion/candidate.js";
 import { materializePublicationIntent } from "../../release/candidate/publication-intent.js";
-import { promoteReleaseCandidate } from "../../release/promote-candidate/transaction.js";
+import { publishWithDiscussion } from "../../release/discussion/publication.js";
+import { selectedRecordRuntime } from "../../release/discussion/session.js";
 import {
   observeReleaseRoute,
   observedSourceTimestamp,
@@ -34,7 +35,9 @@ async function materializeProductPublicationIntent(
   const version = String(
     candidate.publicationVersion || candidate.version || "",
   ).trim();
-  const explicitResume = String(inputs["resume-transaction-id"] || "") !== "";
+  const explicitResume = Boolean(
+    inputs["resume-transaction-id"] || inputs["resume-discussion-id"],
+  );
   const recovery =
     route.decision !== "Resume" || explicitResume
       ? {}
@@ -45,14 +48,16 @@ async function materializeProductPublicationIntent(
           route.channel,
           context,
         );
-  const recoveredVersion = selectRecoveredProductPublicationVersion({
-    routeDecision: route.decision,
-    candidateVersion: version,
-    channel: route.channel,
-    requestedSha: route.requestedSha,
-    explicitResume,
-    ...recovery,
-  });
+  const recoveredVersion = inputs["resume-discussion-id"]
+    ? version
+    : selectRecoveredProductPublicationVersion({
+        routeDecision: route.decision,
+        candidateVersion: version,
+        channel: route.channel,
+        requestedSha: route.requestedSha,
+        explicitResume,
+        ...recovery,
+      });
   materializePublicationIntent({
     repository,
     channel: route.channel,
@@ -128,24 +133,21 @@ export async function executeReleasePromotion(request, admission, context) {
   prepareReleaseConsumerDependencies();
   if (payload.inputs["trusted-publishing"] === true)
     prepareTrustedPublishingNpm();
-  const candidate = await resolveReleaseCandidateArtifacts({
+  const candidate = await qualifyPromotionCandidate({
+    request: payload.inputs,
+    intent: {
+      "target-ref": route.targetRef,
+      "requested-sha": route.requestedSha,
+      channel: route.channel,
+    },
     repository,
-    targetRef: route.targetRef,
-    targetSha: route.requestedSha,
     token: context.token,
     apiUrl: context.apiUrl,
-    workflowFile: payload.inputs["release-candidate-workflow-file"],
-    workflowName: payload.inputs["release-candidate-workflow-name"],
-    artifactName: payload.inputs["artifact-name"],
-    artifactPatterns: payload.inputs["artifact-patterns"],
-    githubReleasePayloadPatterns:
-      payload.inputs["github-release-payload-patterns"],
-    requiredArtifactCount: payload.inputs["required-artifact-count"],
-    publishArtifactKind: payload.inputs["publish-artifact-kind"],
-    publishPackageMain: payload.inputs["publish-package-main"],
     runtimeSha: admission.runtime.sha,
-    outputDir: ".buildchain/release-candidate",
-    waitSeconds: payload.inputs["release-candidate-wait-seconds"],
+    runtimeRoot: context.runtimeRoot,
+    recoveryRunId: context.runId,
+    recoveryRunAttempt: context.runAttempt,
+    outputDir: path.resolve(".buildchain/release-candidate"),
   });
   if (!candidate.enabled)
     fail(candidate.reason || "release candidate is unavailable");
@@ -203,12 +205,22 @@ export async function executeReleasePromotion(request, admission, context) {
     "publish-transaction-override":
       payload.inputs["publish-transaction-override"],
     "resume-transaction-id": payload.inputs["resume-transaction-id"],
+    "resume-discussion-id": payload.inputs["resume-discussion-id"],
+    "standalone-binary-distribution":
+      payload.inputs["standalone-binary-distribution"],
     "artifact-paths": candidate.paths.releaseAssets,
     "state-path": ".buildchain/release-tail/state.json",
     "failure-after-capability":
       payload.inputs["provider-failure-after-capability"],
   };
-  const provider = await promoteReleaseCandidate(publicationRequest, {
+  const provider = await publishWithDiscussion(publicationRequest, {
+    runtime: selectedRecordRuntime({
+      BUILDCHAIN_RUNTIME_SELECTION: context.runtimeSelection,
+      BUILDCHAIN_RUNTIME_ROOT: context.runtimeRoot,
+    }),
+    workspace: process.cwd(),
+    runtimeRoot: context.runtimeRoot,
+    attempt: `${context.runId}:${context.runAttempt || "1"}:bootstrap`,
     octokit: context.octokit,
     mutationOctokit: context.mutationOctokit,
     actor: context.actor,

package/packages/core/workflow/universal-workflow-bootstrap.js

@@ -22,6 +22,7 @@ const PERMISSIONS = new Set([
   "checks",
   "contents",
   "deployments",
+  "discussions",
   "id-token",
   "issues",
   "packages",

package/scripts/build-release-discussion-reader.mjs

@@ -0,0 +1,34 @@
+import { build } from "tsup";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+const check = process.argv.includes("--check");
+const output = check
+  ? fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-reader-check-"))
+  : "dist/readers";
+try {
+  await build({
+    entry: {
+      "release-discussion": "packages/core/release/discussion/reader-entry.js",
+    },
+    outDir: output,
+    format: ["cjs"],
+    target: "node24",
+    platform: "node",
+    splitting: false,
+    sourcemap: false,
+    minify: false,
+    clean: false,
+    outExtension: () => ({ js: ".cjs" }),
+    silent: true,
+  });
+  if (
+    check &&
+    !fs
+      .readFileSync(path.join(output, "release-discussion.cjs"))
+      .equals(fs.readFileSync("dist/readers/release-discussion.cjs"))
+  )
+    throw new Error("Historical release reader bundle is stale");
+} finally {
+  if (check) fs.rmSync(output, { recursive: true, force: true });
+}

package/scripts/inventory/binary.mjs

@@ -32,5 +32,5 @@ export function assertBinaryInventory(root) {
   assert.equal(effect["continue-on-error"], undefined);
   const transaction = publish.modules.get("packages/core/publication/binary/transaction.js");
   assert.match(transaction, /validateBinaryCapability\([\s\S]*await client.publish\(/, "Binary effects must follow capability admission");
-  assert.match(publish.modules.get("packages/core/publication/binary/action.js"), /verifyCheckoutIdentity\([\s\S]*await publishBinaryAssets\(/);
+  assert.match(publish.modules.get("packages/core/publication/binary/action.js"), /verifyCheckoutIdentity\([\s\S]*await observeBinaryDistribution\([\s\S]*publishBinaryAssets\(/);
 }

package/scripts/maintainability-metrics.mjs

@@ -52,6 +52,7 @@ function isTestFile(file) {
 function isGeneratedFile(file) {
   return (
     GENERATED_PATTERN.test(file) ||
+    /^dist\/readers\/[^/]+\.cjs$/u.test(file) ||
     file.startsWith("templates/bootstrap-recovery/")
   );
 }

package/scripts/site-capability-metadata.mjs

@@ -231,6 +231,7 @@ export function nodeApiMeta(exportName) {
     "./v4-tail-reseal": { group: "release-passport-trust", summary: "Effect-pure retained Stage Capsule validation and explicit Warrant-, credential-, and release-tail-fenced macOS reseal planning APIs." },
     "./tail-reseal": { group: "release-passport-trust", summary: "Effect-pure retained Stage Capsule validation and explicit Warrant-, credential-, and release-tail-fenced macOS reseal planning APIs." },
     "./v4-tail-reseal-receipt": { group: "release-passport-trust", summary: "Four-platform byte readback, standard candidate Passport binding, and terminal v4 tail-reseal receipt APIs." },
+    "./release-discussion-reader": { group: "release-passport-trust", summary: "Standalone historical decoder for append-only release Discussion intent, attempt lineage and recovery handoff." },
     "./tail-reseal-receipt": { group: "release-passport-trust", summary: "Four-platform byte readback, standard candidate Passport binding, and terminal v4 tail-reseal receipt APIs." },
     "./v4-publication-rehearsal": { group: "release-passport-trust", summary: "Content-addressed v4 publication rehearsal capsules, shared production release-tail execution, replay, provider observation, and fail-closed verification APIs." },
     "./publication-rehearsal": { group: "release-passport-trust", summary: "Content-addressed v4 publication rehearsal capsules, shared production release-tail execution, replay, provider observation, and fail-closed verification APIs." },