@kungfu-tech/buildchain 4.1.2 → 4.1.3-alpha.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.1.2",
+  "version": "4.1.3-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -122,7 +122,8 @@
     "./publication-rehearsal": "./packages/core/publication/publication-rehearsal.js",
     "./publication-qualification": "./packages/core/publication/publication-qualification.js",
     "./adopter-delivery": "./packages/core/adoption/adopter-delivery.js",
-    "./cross-platform-adopter-qualification": "./packages/core/adoption/cross-platform-adopter-qualification.js"
+    "./cross-platform-adopter-qualification": "./packages/core/adoption/cross-platform-adopter-qualification.js",
+    "./release-discussion-reader": "./packages/core/release/discussion/reader.js"
   },
   "files": [
     "AGENTS.md",
@@ -142,7 +143,8 @@
     "docs/*.md",
     "fixtures/*/README.md",
     "scripts/",
-    "actions/*/*/*/README.md"
+    "actions/*/*/*/README.md",
+    "dist/readers/"
   ],
   "engines": {
     "node": ">=22.14.0"
@@ -155,7 +157,7 @@
   "scripts": {
     "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery/dev-delivery-authority-candidate.js packages/core/dev-delivery/dev-delivery-authority-evidence.js packages/core/dev-delivery/dev-delivery-authority-landing.js packages/core/dev-delivery/dev-delivery-authority-observation.js packages/core/dev-delivery/dev-delivery-authority-qualification.js packages/core/dev-delivery/dev-delivery-authority-settlement.js packages/core/dev-delivery/dev-delivery-authority-state.js packages/core/dev-delivery/dev-delivery-execution-failure.js packages/core/dev-delivery/dev-delivery-execution-transfer.js packages/core/dev-delivery/dev-delivery-landing-readback.js packages/core/dev-delivery/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery/dev-delivery-landing-testing-port.js packages/core/dev-delivery/dev-delivery-native-execution.js packages/core/dev-delivery/dev-delivery-native-proof.js packages/core/dev-delivery/dev-delivery-process-boundary.js packages/core/dev-delivery/dev-delivery-warrant-qualification.js packages/core/dev-delivery/dev-delivery-warrant-state.js packages/core/dev-delivery/commands/dev-delivery-authority-command-adapters.mjs packages/core/dev-delivery/commands/dev-delivery-authority-provider.mjs packages/core/dev-delivery/commands/dev-delivery-authority.mjs packages/core/dev-delivery/native/execution.js packages/core/dev-delivery/commands/dev-delivery-process-boundary.mjs packages/core/dev-delivery/native/transactions.js packages/core/dev-delivery/commands/dev-delivery-two-phase.mjs packages/core/dev-delivery/commands/dev-delivery-warrant-options.mjs packages/core/dev-delivery/warrant/persistence.js templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash packages/core/providers/commands/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:layout && node scripts/check-runtime-entry.mjs && pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node packages/core/governance/commands/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check": "pnpm run check:discussion-reader && pnpm run check:layout && node scripts/check-runtime-entry.mjs && pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node packages/core/governance/commands/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && node scripts/check-source-bindings.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/runtime-resume-lineage-v2.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/runtime-resume-lineage-v2/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json packages/core/contracts/command-registry.mjs packages/core/governance/cli/compatibility-facts.mjs packages/core/contracts/canonical-contracts.js packages/core/contracts/kungfu-temporal-fact.js packages/core/governance/buildchain-compatibility-fact.js packages/core/governance/buildchain-compatibility-authority.js packages/core/governance/buildchain-compatibility-proof.js packages/core/consumer/floating-consumer-evidence.js packages/core/consumer/floating-consumer-policy.js packages/core/consumer/floating-consumer-release-passport.js packages/core/release/recovery/lineage.js packages/core/release/tail-reseal-contract.js packages/core/release/tail-reseal-github.js packages/core/release/tail-reseal-receipt.js packages/core/release/tail-reseal.js packages/core/consumer/runtime-selector-persistence.js packages/core/release/provider-operation-journal.js packages/core/release/provider-readback-idempotency.js packages/core/release/release-activation-shadow.js packages/core/release/stable-publication-fence.js packages/core/release/partial-mutation-recovery-qualification.js packages/core/build/stage-capsule.js packages/core/build/stage-capsule-store.js packages/core/build/stage-capsule-local-store.js packages/core/build/platform-stage-checkpoints.js packages/core/build/stage-capsule-resume-planner.js packages/core/build/stage-capsule-qualification.js packages/core/build/stage-capsule-qualification-campaign.js packages/core/dev-delivery/delivery-warrant-fixture-runner.js packages/core/dev-delivery/delivery-warrant-read-candidate.js packages/core/dev-delivery/delivery-warrant-semantic-diff-gate.js packages/core/dev-delivery/delivery-warrant-shadow-adapter.js scripts/check-core-mechanism-inventory.mjs scripts/check-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs packages/core/dev-delivery/commands/dev-pr-prequeue-guard.mjs scripts/check-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs packages/core/governance/commands/architecture.mjs packages/core/runtime/commands/bridge-bootstrap.mjs scripts/bridge-evidence.mjs packages/core/consumer/commands/consumer-policy.mjs packages/core/runtime/commands/host-adapter.mjs scripts/platform-stage-checkpoint-rehearsal.mjs scripts/stage-capsule-resume-rehearsal.mjs packages/core/build/commands/stage-capsule-qualification.mjs scripts/tail-reseal-macos-rehearsal.mjs packages/core/release/commands/tail-reseal.mjs scripts/warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/runtime-entry-provider.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/architecture.test.mjs tests/bridge.test.mjs tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-resume-lineage.test.mjs tests/runtime-semantic-closure.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs tests/warrant-shadow-plan.test.mjs",
     "check:bridge": "cargo fmt --manifest-path crates/buildchain-host-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml",
     "check:contracts": "pnpm run check:contracts:rust && node --test tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/domain-wasm.test.mjs tests/floating-consumer-policy-contract.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-resume-lineage.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/publication-rehearsal.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs",
@@ -170,7 +172,7 @@
     "check:site": "pnpm run check:next-development && pnpm run check:reference && node scripts/generate-site-bundle.mjs --check",
     "check:golden-path": "node scripts/verify-golden-path.mjs",
     "test:unit": "node --test tests/*.test.mjs",
-    "build": "pnpm -r --filter \"./actions/**\" build",
+    "build": "pnpm run build:discussion-reader && pnpm -r --filter \"./actions/**\" build",
     "binary:build": "node scripts/build-standalone-binary.mjs",
     "package": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
     "pack:check": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
@@ -180,7 +182,9 @@
     "check:contracts:rust": "cargo fmt --manifest-path crates/buildchain-domain-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-domain-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-domain-contracts/Cargo.toml",
     "generate:workflows": "node scripts/generate-workflow-taxonomy.mjs && node scripts/generate-bootstrap-admission.mjs",
     "check:implementation-naming": "node scripts/check-implementation-naming.mjs",
-    "check:layout": "node scripts/check-code-layout.mjs"
+    "check:layout": "node scripts/check-code-layout.mjs",
+    "build:discussion-reader": "node scripts/build-release-discussion-reader.mjs",
+    "check:discussion-reader": "node scripts/build-release-discussion-reader.mjs --check"
   },
   "devDependencies": {
     "@actions/expressions": "0.3.61",

package/packages/core/providers/github/discussions/materials.js

@@ -0,0 +1,157 @@
+import { createHash } from "node:crypto";
+
+export function materialDigest(bytes) {
+  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+
+// Draft release assets retain immutable recovery bytes outside the source Git
+// object database. Only the Discussion record selects a committed manifest.
+export function discussionMaterials({ octokit, repository, intentId }) {
+  const [owner, repo] = repository.split("/");
+  const tag = `buildchain-records/${intentId.replace("sha256:", "")}`;
+  const repos = octokit.rest.repos;
+  let retainedArchive;
+  async function findArchive() {
+    let pages = 0;
+    const releases = await octokit.paginate(
+      repos.listReleases,
+      { owner, repo, per_page: 100 },
+      (response) => {
+        if (++pages > 100)
+          throw new Error("Material archive pagination exceeded its bound");
+        return response.data.filter((release) => release.tag_name === tag);
+      },
+    );
+    const matches = releases.filter((release) => release.tag_name === tag);
+    if (matches.length > 1)
+      throw new Error("Ambiguous transaction material archive");
+    return matches[0];
+  }
+  async function archive() {
+    if (retainedArchive) return retainedArchive;
+    let release = await findArchive();
+    if (!release) {
+      try {
+        release = (
+          await repos.createRelease({
+            owner,
+            repo,
+            tag_name: tag,
+            // Storage archives use the repository default; candidate identity is
+            // retained in the material manifest, never in a storage Git ref.
+            name: `Buildchain transaction materials ${intentId}`,
+            body: "Immutable recovery material. The associated Discussion owns transaction state.",
+            draft: true,
+            prerelease: true,
+          })
+        ).data;
+      } catch (error) {
+        release = await findArchive();
+        if (!release)
+          throw new Error("Material archive creation outcome is unknown", {
+            cause: error,
+          });
+      }
+    }
+    if (!release.draft || release.tag_name !== tag)
+      throw new Error("Transaction material archive identity mismatch");
+    retainedArchive = release;
+    return release;
+  }
+  async function read(handle) {
+    const response = await repos.getReleaseAsset({
+      owner,
+      repo,
+      asset_id: handle.id,
+      headers: { accept: "application/octet-stream" },
+    });
+    const bytes = Buffer.from(response.data);
+    if (bytes.length !== handle.size || materialDigest(bytes) !== handle.digest)
+      throw new Error(
+        "Retained transaction material failed integrity verification",
+      );
+    return bytes;
+  }
+  async function put(bytes, descriptor = {}) {
+    const extension =
+      descriptor.name?.match(/\.([a-zA-Z0-9]{1,8})$/u)?.[1] || "";
+    if (bytes.length > 256 * 1024 * 1024)
+      throw new Error("Transaction material exceeds the supported file bound");
+    const digest = materialDigest(bytes),
+      name = digest.replace(":", "-") + (extension ? `.${extension}` : "");
+    const release = await archive();
+    const find = async () => {
+      const assets = await octokit.paginate(repos.listReleaseAssets, {
+        owner,
+        repo,
+        release_id: release.id,
+        per_page: 100,
+      });
+      const matches = assets.filter((asset) => asset.name === name);
+      if (matches.length > 1)
+        throw new Error("Ambiguous immutable transaction material");
+      return matches[0];
+    };
+    let asset = await find();
+    if (!asset) {
+      try {
+        asset = (
+          await repos.uploadReleaseAsset({
+            owner,
+            repo,
+            release_id: release.id,
+            name,
+            data: bytes,
+            headers: {
+              "content-type":
+                descriptor.mediaType || "application/octet-stream",
+            },
+          })
+        ).data;
+      } catch (error) {
+        asset = await find();
+        if (!asset)
+          throw new Error("Transaction material upload outcome is unknown", {
+            cause: error,
+          });
+      }
+    }
+    const handle = {
+      id: asset.id,
+      digest,
+      size: bytes.length,
+      ...(asset.browser_download_url
+        ? { downloadUrl: asset.browser_download_url }
+        : {}),
+      ...(release.html_url ? { archiveUrl: release.html_url } : {}),
+    };
+    await read(handle);
+    return handle;
+  }
+  async function diagnose(operation, effect) {
+    try {
+      return await effect();
+    } catch (error) {
+      let cause = error;
+      for (let depth = 0; depth < 4 && cause.cause; depth++)
+        cause = cause.cause;
+      const details = [
+        operation,
+        cause.name,
+        cause.status,
+        cause.request?.method,
+        cause.response?.data?.errors?.[0]?.code,
+        cause.code,
+      ].filter(Boolean);
+      error.code = `discussion-material-${details
+        .join("-")
+        .replace(/[^a-zA-Z0-9-]/gu, "-")
+        .slice(0, 140)}`;
+      throw error;
+    }
+  }
+  return {
+    put: (bytes, descriptor) => diagnose("put", () => put(bytes, descriptor)),
+    read: (handle) => diagnose("read", () => read(handle)),
+  };
+}

package/packages/core/providers/github/discussions/transport.js

@@ -0,0 +1,126 @@
+const fields =
+  "id number url body author { __typename login ... on Node { id } } lastEditedAt repository { nameWithOwner }";
+const commentFields =
+  "id url body author { __typename login ... on Node { id } } lastEditedAt replyTo { id }";
+
+export function discussionTransport(graphql) {
+  async function request(query, variables) {
+    try {
+      return await graphql(query, variables);
+    } catch (error) {
+      const code =
+        error.errors?.[0]?.extensions?.code ||
+        error.errors?.[0]?.type ||
+        error.status ||
+        "unknown";
+      error.code = `discussion-provider-${String(code).replace(/[^a-zA-Z0-9-]/gu, "-")}`;
+      throw error;
+    }
+  }
+  async function repository(repository) {
+    const [owner, name] = repository.split("/");
+    const result = await request(
+      `
+        query ($owner: String!, $name: String!) {
+          viewer {
+            login
+            id
+          }
+          repository(owner: $owner, name: $name) {
+            id
+            hasDiscussionsEnabled
+            discussionCategories(first: 25) {
+              nodes {
+                id
+                name
+                slug
+              }
+            }
+          }
+        }
+      `,
+      { owner, name },
+    );
+    if (!result.repository?.hasDiscussionsEnabled)
+      throw new Error(
+        `Enable Discussions in ${repository} before release execution`,
+      );
+    return { ...result.repository, viewer: result.viewer };
+  }
+  async function list(repository, categoryId, after = null) {
+    const [owner, name] = repository.split("/");
+    const result = await request(
+      `query($owner:String!,$name:String!,$category:ID!,$after:String){repository(owner:$owner,name:$name){discussions(first:100,after:$after,categoryId:$category,orderBy:{field:CREATED_AT,direction:ASC}){nodes{${fields}} pageInfo{hasNextPage endCursor}}}}`,
+      { owner, name, category: categoryId, after },
+    );
+    return result.repository.discussions;
+  }
+  async function get(id) {
+    const result = await request(
+      `query($id:ID!){node(id:$id){... on Discussion{${fields}}}}`,
+      { id },
+    );
+    if (!result.node?.repository)
+      throw new Error("Release Discussion was not found");
+    return result.node;
+  }
+  async function comments(id, after = null) {
+    const result = await request(
+      `query($id:ID!,$after:String){node(id:$id){... on Discussion{comments(first:100,after:$after){nodes{${commentFields} replies{totalCount}} pageInfo{hasNextPage endCursor}}}}}`,
+      { id, after },
+    );
+    if (!result.node?.comments)
+      throw new Error("Release Discussion comments are unavailable");
+    return result.node.comments;
+  }
+  async function replies(id, after = null) {
+    const result = await request(
+      `query($id:ID!,$after:String){node(id:$id){... on DiscussionComment{replies(first:100,after:$after){nodes{${commentFields}} pageInfo{hasNextPage endCursor}}}}}`,
+      { id, after },
+    );
+    if (!result.node?.replies)
+      throw new Error("Release Discussion replies are unavailable");
+    return result.node.replies;
+  }
+  async function create({ repositoryId, categoryId, title, body }) {
+    const result = await request(
+      `mutation($input:CreateDiscussionInput!){createDiscussion(input:$input){discussion{${fields}}}}`,
+      { input: { repositoryId, categoryId, title, body } },
+    );
+    return result.createDiscussion.discussion;
+  }
+  async function append(id, body, replyToId = null) {
+    const result = await request(
+      `mutation($input:AddDiscussionCommentInput!){addDiscussionComment(input:$input){comment{${commentFields}}}}`,
+      {
+        input: { discussionId: id, body, ...(replyToId ? { replyToId } : {}) },
+      },
+    );
+    return result.addDiscussionComment.comment;
+  }
+  return { repository, list, get, comments, replies, create, append };
+}
+
+export async function collectDiscussionPages(readPage, limit = 100) {
+  let cursor = null;
+  const nodes = [];
+  const cursors = new Set();
+  for (let page = 0; page < limit; page++) {
+    const result = await readPage(cursor);
+    if (!Array.isArray(result?.nodes) || !result.pageInfo)
+      throw new Error("Incomplete Discussion page");
+    nodes.push(...result.nodes);
+    if (Buffer.byteLength(JSON.stringify(nodes)) > 32 * 1024 * 1024)
+      throw new Error(
+        "Discussion read exceeds its byte bound; refusing an incomplete view",
+      );
+    if (!result.pageInfo.hasNextPage) return nodes;
+    cursor = result.pageInfo.endCursor;
+    if (!cursor || cursors.has(cursor))
+      throw new Error("Discussion pagination did not advance");
+    cursors.add(cursor);
+  }
+  throw new Error(
+    "Discussion page limit exceeded; refusing an incomplete transaction view",
+  );
+}

package/packages/core/publication/binary/action.js

@@ -1,3 +1,6 @@
+import { getOctokit } from "@actions/github";
+import { observeBinaryDistribution } from "../../release/discussion/binary.js";
+import { selectedRecordRuntime } from "../../release/discussion/session.js";
 import path from "node:path";
 import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 import { releaseAssetClient } from "../../providers/github/release-assets.js";
@@ -13,17 +16,28 @@ export async function publishBinaryAssetsAction(core, env) {
   const client = releaseAssetClient(env.GITHUB_REPOSITORY, {
     token: core.getInput("token", { required: true }),
   });
-  const result = await publishBinaryAssets(
+  const result = await observeBinaryDistribution(
     {
-      workspace,
+      client,
+      octokit: getOctokit(core.getInput("token", { required: true })),
       repository: env.GITHUB_REPOSITORY,
-      sourceSha,
       tag: core.getInput("tag", { required: true }),
-      capability: JSON.parse(
-        core.getInput("capability-json", { required: true }),
-      ),
+      runtime: selectedRecordRuntime(env),
+      writer: `${env.GITHUB_RUN_ID}:${env.GITHUB_RUN_ATTEMPT}:${env.GITHUB_JOB}`,
     },
-    client,
+    () =>
+      publishBinaryAssets(
+        {
+          workspace,
+          repository: env.GITHUB_REPOSITORY,
+          sourceSha,
+          tag: core.getInput("tag", { required: true }),
+          capability: JSON.parse(
+            core.getInput("capability-json", { required: true }),
+          ),
+        },
+        client,
+      ),
   );
   core.info(
     `Verified ${result.assets.length} immutable binary assets for ${result.tag}`,

package/packages/core/release/discussion/actions.js

@@ -0,0 +1,65 @@
+import { discussionStatus } from "./reader.js";
+import * as github from "@actions/github";
+import { openReleaseSession, selectedRecordRuntime } from "./session.js";
+import { releaseDiscussionStore } from "./store.js";
+import { discussionTransport } from "../../providers/github/discussions/transport.js";
+import { createProgress } from "./envelope.js";
+
+function actionStore(core) {
+  return releaseDiscussionStore(
+    discussionTransport(
+      github.getOctokit(core.getInput("token", { required: true })).graphql,
+    ),
+  );
+}
+
+export async function openDiscussionAction(core, env) {
+  const result = await openReleaseSession({
+    graphql: github.getOctokit(core.getInput("token", { required: true }))
+      .graphql,
+    repository: env.GITHUB_REPOSITORY,
+    key: core.getInput("intent-key", { required: true }),
+    source: JSON.parse(core.getInput("source-json", { required: true })),
+    expectedNodes: JSON.parse(
+      core.getInput("expected-nodes-json", { required: true }),
+    ),
+    runtime: selectedRecordRuntime(env),
+    attempt: `${env.GITHUB_RUN_ID}:${env.GITHUB_RUN_ATTEMPT}`,
+    discussionId: core.getInput("discussion-id"),
+    predecessor: core.getInput("predecessor"),
+    dryRun: core.getBooleanInput("dry-run"),
+  });
+  core.setOutput("session-json", JSON.stringify(result.session));
+  core.setOutput("discussion-id", result.session.discussion?.id || "");
+  core.setOutput("discussion-url", result.session.discussion?.url || "");
+}
+
+export async function recordDiscussionAction(core, env) {
+  const session = JSON.parse(core.getInput("session-json", { required: true }));
+  if (session.dryRun) return;
+  const record = createProgress({
+    intent: session.intent,
+    runtime: selectedRecordRuntime(env),
+    attempt: session.attempt,
+    writer: `${env.GITHUB_RUN_ID}:${env.GITHUB_RUN_ATTEMPT}:${env.GITHUB_JOB}`,
+    predecessor: session.predecessor,
+    node: core.getInput("node", { required: true }),
+    status: core.getInput("status", { required: true }),
+    sequence: Number(core.getInput("sequence")),
+    payload: JSON.parse(core.getInput("payload-json") || "{}"),
+  });
+  const result = await actionStore(core).append(session, record);
+  core.setOutput("record-id", result.id);
+}
+
+export async function inspectDiscussionAction(core) {
+  const session = JSON.parse(core.getInput("session-json", { required: true }));
+  if (session.dryRun) {
+    core.setOutput("status", "dry-run");
+    return;
+  }
+  const result = await actionStore(core).read(session);
+  core.setOutput("status", result.status);
+  core.setOutput("handoff-json", JSON.stringify(result.handoff || {}));
+  core.setOutput("state-json", JSON.stringify(discussionStatus(result)));
+}

package/packages/core/release/discussion/binary.js

@@ -0,0 +1,103 @@
+import { releaseCheckpoints } from "./checkpoints.js";
+import { discussionTransport } from "../../providers/github/discussions/transport.js";
+import { releaseDiscussionStore } from "./store.js";
+import { createProgress, decodeRecord } from "./envelope.js";
+
+// An independent distribution workflow joins the existing intent after resolving
+// its public release locator. Capturing the attempt before execution keeps a late
+// result on its original attempt when another workflow starts recovery.
+export async function observeBinaryDistribution(
+  { client, octokit, repository, tag, runtime, writer },
+  effect,
+) {
+  const release = await client.release(tag);
+  const assets = release.assets.filter(
+    ({ name }) => name === "buildchain.release-transaction.json",
+  );
+  if (assets.length !== 1)
+    throw new Error(
+      "Binary distribution requires one release transaction locator",
+    );
+  const locator = JSON.parse(client.assetBytes(assets[0]));
+  if (
+    locator.schema !== "buildchain.release-locator/v1" ||
+    locator.repository !== repository ||
+    `v${locator.version}` !== tag
+  )
+    throw new Error("Binary transaction locator does not match its release");
+  const transport = discussionTransport(octokit.graphql);
+  const discussion = await transport.get(locator.discussionId);
+  const intent = decodeRecord(discussion.body);
+  if (
+    intent?.id !== locator.intent ||
+    intent.repository !== repository ||
+    discussion.author?.__typename !== "Bot" ||
+    discussion.author.login !== "github-actions"
+  )
+    throw new Error(
+      "Binary transaction intent does not match the consumer workflow",
+    );
+  const store = releaseDiscussionStore(transport);
+  const session = { discussion, intent, writerId: discussion.author.id };
+  const state = await store.read(session);
+  if (!state.attempt || !intent.expectedNodes.includes("binary-distribution"))
+    throw new Error(
+      "Binary distribution was not declared by this release intent",
+    );
+  const attemptRecord = state.records.find(
+    (record) => record.attempt === state.attempt,
+  );
+  Object.assign(session, {
+    attempt: state.attempt,
+    predecessor: attemptRecord.predecessor,
+    runtime,
+    writer,
+  });
+  const sequence =
+    Math.max(
+      -1,
+      ...state.records
+        .filter(
+          (record) =>
+            record.kind === "progress" &&
+            record.attempt === state.attempt &&
+            record.node === "binary-distribution",
+        )
+        .map((record) => record.sequence),
+    ) + 1;
+  const record = (status, offset, payload = {}) =>
+    store.append(
+      session,
+      createProgress({
+        intent,
+        runtime,
+        writer,
+        attempt: state.attempt,
+        predecessor: attemptRecord.predecessor,
+        node: "binary-distribution",
+        status,
+        sequence: sequence + offset,
+        payload,
+      }),
+    );
+  await record("running", 0);
+  let result;
+  try {
+    result = await effect();
+  } catch (error) {
+    try {
+      await record("failure", 1, {
+        code: String(error.code || "execution-failed"),
+      });
+      await releaseCheckpoints({ session, store, octokit }).diagnostics(
+        "binary-distribution",
+        error.code,
+      );
+    } catch (recordError) {
+      error.discussionRecordingError = recordError.message;
+    }
+    throw error;
+  }
+  await record("success", 1, { tag, assets: result.assets.length });
+  return result;
+}