@kungfu-tech/buildchain 4.1.3-alpha.0 → 4.1.3-alpha.10

package/packages/core/dev-delivery/candidate/admission.js

@@ -1,10 +1,7 @@
 import path from "node:path";
 import fs from "node:fs";
 import crypto from "node:crypto";
-import {
-  sourceCoordinates,
-  validateNativeContract,
-} from "./coordinates.js";
+import { sourceCoordinates, validateNativeContract } from "./coordinates.js";
 import {
   verifyProjectCutReplayProof,
   createSourceQualificationProof,
@@ -16,6 +13,7 @@ import { assertBranchUnlocked } from "../../providers/dev-delivery/protection.js
 import { deriveSourcePaths } from "./source-paths.js";
 import { admissionPolicyRequest } from "../admission/request.js";
 import { runAdmissionTransaction } from "../admission/transaction.js";
+import { guardPipelineAdmission } from "../../workflow/pipeline/guard.js";
 export function admitDeliveryRequest(input, defaultBranch) {
   const target = sourceCoordinates({
     branch: input["target-branch"],
@@ -46,6 +44,7 @@ export async function qualifyDeliverySource(
   },
   dependencies = {},
 ) {
+  const pipeline = await guardPipelineAdmission(request, { repository, token });
   const outputs = {
     "runtime-sha": runtimeSha,
     "qualify-outcome": "skipped",
@@ -146,7 +145,12 @@ export async function qualifyDeliverySource(
   if (!affectedPaths.length)
     affectedPaths = await (dependencies.derivePaths || deriveSourcePaths)(
       source,
-      { token, apiUrl, environment },
+      {
+        token,
+        apiUrl,
+        environment,
+        qualifiedBase: pipeline?.history.at(-1).generation.baseCommit,
+      },
     );
   const receiptRoot = qualification.result.receiptRoot;
   if (!/^sha256:[0-9a-f]{64}$/u.test(receiptRoot || ""))

package/packages/core/dev-delivery/candidate/reservation.js

@@ -10,6 +10,8 @@ import { dispatchDeliveryHandoff } from "../warrant/handoff.js";
 import { resolveCandidateAffectedPaths } from "./evidence.js";
 import { deliverySubmissionRequest } from "./submission.js";
 import { jsonList } from "../warrant/values.js";
+import { guardPipelineAdmission } from "../../workflow/pipeline/guard.js";
+import { wakePipelineCandidate } from "../../workflow/pipeline/wake.js";
 export async function reserveDeliveryCandidate(
   {
     workspace,
@@ -31,6 +33,7 @@ export async function reserveDeliveryCandidate(
     );
   if (!predecessorsOk || proofOutcome !== "success")
     throw new Error("Delivery candidate submission failed");
+  await guardPipelineAdmission(input, connection);
   const service =
     dependencies.service ||
     createDeliveryWarrantService({ ...connection, branch });
@@ -77,6 +80,14 @@ export async function reserveDeliveryCandidate(
     warrant.pullRequestNumber !== Number(input["expected-pr-number"]) ||
     warrant.sourceHead !== input["expected-head-sha"]
   ) {
+    if (input["pipeline-attempt"]) {
+      await wakePipelineCandidate(warrant, { ...connection, branch });
+      return {
+        "warrant-outcome": "success",
+        "warrant-handoff-required": "true",
+        "warrant-handoff-dispatched": "true",
+      };
+    }
     outputs = await dispatchDeliveryHandoff(
       {
         warrant,

package/packages/core/dev-delivery/candidate/source-paths.js

@@ -52,7 +52,7 @@ export function pathsAtQualifiedSource(directory, qualifiedBase, source) {
 
 export async function deriveSourcePaths(
   source,
-  { token, apiUrl, environment = process.env },
+  { token, apiUrl, environment = process.env, qualifiedBase },
   provider = new GitHubTwoPhaseClient({
     repository: source.repository,
     token,
@@ -65,10 +65,18 @@ export async function deriveSourcePaths(
       /^[1-9]\d*$/u.test(String(source.sourceWorkflowRunId || "")),
     "Exact source run coordinates are required",
   );
-  const run = await provider.request(
-    `/repos/${source.repository}/actions/runs/${source.sourceWorkflowRunId}`,
+  if (qualifiedBase === undefined) {
+    const run = await provider.request(
+      `/repos/${source.repository}/actions/runs/${source.sourceWorkflowRunId}`,
+    );
+    qualifiedBase = qualifiedRunBase(run, source);
+  }
+  // The internal pipeline guard already requalifies the source run and immutable
+  // generation. Zero-delta recovery still verifies the full source identity below.
+  requireValue(
+    /^[0-9a-f]{40}$/u.test(qualifiedBase || ""),
+    "Exact qualified source base is required",
   );
-  const qualifiedBase = qualifiedRunBase(run, source);
   const directory = fs.mkdtempSync(
     path.join(os.tmpdir(), "buildchain-source-paths-"),
   );

package/packages/core/dev-delivery/commands/project-cut-merge-queue-admission.mjs

@@ -61,19 +61,32 @@ function git(
   {
     env = {},
     input = undefined,
+    inputFile = undefined,
+    outputFile = undefined,
     encoding = "utf8",
     reason = "git-failed",
   } = {},
 ) {
-  const result = spawnSync("git", args, {
-    cwd,
-    env: { ...process.env, ...env },
-    input,
-    encoding,
-    maxBuffer: 64 * 1024 * 1024,
-  });
+  let result, inputDescriptor, outputDescriptor;
+  try {
+    if (inputFile) inputDescriptor = fs.openSync(inputFile, "r");
+    if (outputFile) outputDescriptor = fs.openSync(outputFile, "w");
+    result = spawnSync("git", args, {
+      cwd,
+      env: { ...process.env, ...env },
+      input,
+      encoding,
+      stdio: [inputDescriptor ?? "pipe", outputDescriptor ?? "pipe", "pipe"],
+      maxBuffer: 64 * 1024 * 1024,
+    });
+  } finally {
+    for (const descriptor of [inputDescriptor, outputDescriptor])
+      if (descriptor !== undefined) fs.closeSync(descriptor);
+  }
   if (result.status !== 0) {
-    const detail = String(result.stderr || result.stdout || "").trim();
+    const detail = String(
+      result.stderr || result.error?.message || result.stdout || "",
+    ).trim();
     throw new ProjectCutAdmissionError(
       reason,
       `git ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`,
@@ -135,7 +148,7 @@ function linearSourceCommits(cwd, fork, head) {
 
 function patchId(cwd, patch) {
   const output = git(cwd, ["patch-id", "--stable"], {
-    input: patch,
+    inputFile: patch,
     encoding: "utf8",
     reason: "patch-id-failed",
   });
@@ -184,30 +197,41 @@ function replayProjectCut(cwd, base, head) {
       env: indexEnvironment,
       reason: "base-tree-unreadable",
     });
-    const sourcePatch = git(
+    // Generated bundles can exceed the metadata-output bound. Git streams the
+    // exact patches through private files; patch identity and replay stay intact.
+    const sourcePatch = path.join(temporary, "source.patch");
+    git(
       cwd,
       ["diff", "--binary", "--full-index", "--no-ext-diff", fork, head],
       {
-        encoding: null,
+        outputFile: sourcePatch,
         reason: "source-patch-unreadable",
       },
     );
-    const emptySourcePatch = sourcePatch.length === 0;
+    const emptySourcePatch = fs.statSync(sourcePatch).size === 0;
     if (emptySourcePatch && commits.length !== 1)
-      throw new ProjectCutAdmissionError("empty-source-composition", "an empty source composition must be exactly one linear commit");
-    if (!emptySourcePatch) git(cwd, ["apply", "--cached", "--3way", "--whitespace=nowarn", "-"], {
-        env: indexEnvironment, input: sourcePatch, encoding: "utf8", reason: "project-cut-conflict",
+      throw new ProjectCutAdmissionError(
+        "empty-source-composition",
+        "an empty source composition must be exactly one linear commit",
+      );
+    if (!emptySourcePatch)
+      git(cwd, ["apply", "--cached", "--3way", "--whitespace=nowarn", "-"], {
+        env: indexEnvironment,
+        inputFile: sourcePatch,
+        encoding: "utf8",
+        reason: "project-cut-conflict",
       });
     const candidateTreeOid = git(cwd, ["write-tree"], {
       env: indexEnvironment,
       reason: "candidate-tree-unreadable",
     });
-    const replayPatch = git(
+    const replayPatch = path.join(temporary, "replay.patch");
+    git(
       cwd,
       ["diff", "--cached", "--binary", "--full-index", "--no-ext-diff", base],
       {
         env: indexEnvironment,
-        encoding: null,
+        outputFile: replayPatch,
         reason: "replay-patch-unreadable",
       },
     );
@@ -226,9 +250,12 @@ function replayProjectCut(cwd, base, head) {
         reason: "replay-paths-unreadable",
       },
     );
-    const compositionDrifted = emptySourcePatch ? replayPatch.length !== 0 ||
-      sourceNames !== "" || replayNames !== "" : patchId(cwd, sourcePatch) !==
-      patchId(cwd, replayPatch) || sourceNames !== replayNames;
+    const compositionDrifted = emptySourcePatch
+      ? fs.statSync(replayPatch).size !== 0 ||
+        sourceNames !== "" ||
+        replayNames !== ""
+      : patchId(cwd, sourcePatch) !== patchId(cwd, replayPatch) ||
+        sourceNames !== replayNames;
     if (compositionDrifted) {
       throw new ProjectCutAdmissionError(
         "composition-drift",

package/packages/core/dev-delivery/dev-delivery-provider-heartbeat.js

@@ -207,29 +207,32 @@ export async function runDevDeliveryProviderHeartbeat(
   const startedAt = timestamp(now(), "provider heartbeat startedAt");
   let previousStateRoot = initial.stateRoot;
   const heartbeats = [];
+  let untilHeartbeat = 0;
   let jobs;
   try {
     while (true) {
-      const result = await heartbeat({
-        expectedOldStateRoot: previousStateRoot,
-        fencingToken: initial.fencingToken,
-        leaseGeneration: initial.generation,
-        leaseSeconds: duration,
-      });
-      const entry = heartbeatEntry(result, previousStateRoot);
-      heartbeats.push(entry);
-      previousStateRoot = entry.nextStateRoot;
+      if (untilHeartbeat === 0) {
+        const result = await heartbeat({
+          expectedOldStateRoot: previousStateRoot,
+          fencingToken: initial.fencingToken,
+          leaseGeneration: initial.generation,
+          leaseSeconds: duration,
+        });
+        const entry = heartbeatEntry(result, previousStateRoot);
+        heartbeats.push(entry);
+        previousStateRoot = entry.nextStateRoot;
+        untilHeartbeat = cadence * 1000;
+      }
       jobs = providerJobs(
         await readJobs(),
         { nativeJobName, sealJobName },
         { allowMissingSeal: true },
       );
-      if (!jobs) {
-        await wait(cadence * 1000);
-        continue;
-      }
-      if (terminal(jobs.native) && terminal(jobs.seal)) break;
-      await wait(cadence * 1000);
+      if (jobs && terminal(jobs.native) && terminal(jobs.seal)) break;
+      // Terminal detection must not wait for the next durable lease renewal.
+      const interval = Math.min(untilHeartbeat, 5000);
+      await wait(interval);
+      untilHeartbeat -= interval;
     }
   } catch (error) {
     await onHeartbeatLoss({

package/packages/core/dev-delivery/native/actions.js

@@ -5,6 +5,8 @@ import {
   qualifyTransferredNative,
 } from "./transactions.js";
 import { admitProviderFinalizer } from "./finalizer-admission.js";
+import { guardPipelineAdmission } from "../../workflow/pipeline/guard.js";
+import { replaceNativeActionProcess } from "./process-entry.js";
 function request(core, env) {
   const candidate = JSON.parse(
     core.getInput("request-json", { required: true }),
@@ -22,6 +24,7 @@ function outputs(core, result) {
     core.setOutput(name, value);
 }
 export async function executeDeliveryNativeAction(core, env) {
+  replaceNativeActionProcess();
   const context = deliveryActionContext(core, env);
   const input = request(core, env);
   outputs(
@@ -41,11 +44,16 @@ export async function executeDeliveryNativeAction(core, env) {
 }
 export async function qualifyTransferredNativeAction(core, env) {
   const context = deliveryActionContext(core, env);
+  const input = request(core, env);
+  await guardPipelineAdmission(input.request, {
+    repository: env.GITHUB_REPOSITORY,
+    token: core.getInput("token", { required: true }),
+  });
   outputs(
     core,
     await qualifyTransferredNative({
       ...context,
-      candidate: request(core, env).candidate,
+      candidate: input.candidate,
       sourceProofRoot: core.getInput("source-proof-root", { required: true }),
       token: core.getInput("token", { required: true }),
       apiUrl: env.GITHUB_API_URL || "https://api.github.com",

package/packages/core/dev-delivery/native/heartbeat-action.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { deliveryActionContext } from "./action-context.js";
 import { heartbeatDeliveryAttempt } from "./heartbeat.js";
+import { guardPipelineDelivery } from "../../workflow/pipeline/guard.js";
 export async function heartbeatDeliveryAttemptAction(core, env) {
   const { workspace, run } = deliveryActionContext(core, env);
   const admission = JSON.parse(
@@ -20,6 +21,21 @@ export async function heartbeatDeliveryAttemptAction(core, env) {
     apiUrl: env.GITHUB_API_URL || "https://api.github.com",
     leaseSeconds: Number(core.getInput("lease-seconds")),
     heartbeatSeconds: Number(core.getInput("heartbeat-seconds")),
+    beforeHeartbeat: () => {
+      const warrant = admission.observation?.activeWarrant || admission.warrant;
+      return guardPipelineDelivery(
+        {
+          "pipeline-attempt": core.getInput("pipeline-attempt"),
+          "target-branch": core.getInput("branch", { required: true }),
+          "expected-pr-number": warrant?.pullRequestNumber,
+          "expected-head-sha": warrant?.sourceHead,
+        },
+        {
+          repository: env.GITHUB_REPOSITORY,
+          token: core.getInput("token", { required: true }),
+        },
+      );
+    },
   });
   fs.writeFileSync(
     path.join(workspace, ".buildchain/provider-heartbeat-receipt.json"),

package/packages/core/dev-delivery/native/heartbeat.js

@@ -68,13 +68,14 @@ export async function heartbeatDeliveryAttempt(options) {
       heartbeatSeconds: options.heartbeatSeconds,
     },
     {
-      heartbeat: ({
+      heartbeat: async ({
         expectedOldStateRoot,
         fencingToken,
         leaseGeneration,
         leaseSeconds,
-      }) =>
-        runDevDeliveryCommand({
+      }) => {
+        await options.beforeHeartbeat?.();
+        return runDevDeliveryCommand({
           command: "heartbeat",
           repository: options.repository,
           branch: options.branch,
@@ -85,7 +86,8 @@ export async function heartbeatDeliveryAttempt(options) {
           execute: true,
           token: options.token,
           apiUrl: options.apiUrl,
-        }),
+        });
+      },
       readJobs: () =>
         githubJson(
           options.apiUrl,

package/packages/core/dev-delivery/native/process-entry.js

@@ -0,0 +1,19 @@
+// Node Actions receive artifact/OIDC authority even without token inputs.
+// Replace the process before candidate work so the original environment is
+// absent from /proc, memory and ancestry. A scrubbed child would retain it.
+export function replaceNativeActionProcess(host = process) {
+  const injected = ["ACTIONS_RUNTIME_TOKEN", "ACTIONS_ID_TOKEN_REQUEST_TOKEN"];
+  if (!injected.some((name) => host.env[name])) return;
+  if (host.platform !== "linux" || typeof host.execve !== "function") {
+    throw new Error("credentialless native action requires Linux execve");
+  }
+  const environment = { ...host.env };
+  for (const name of injected) delete environment[name];
+  // Other credential-like variables remain subject to the ancestry guard.
+  host.execve(
+    host.execPath,
+    [host.execPath, ...host.execArgv, ...host.argv.slice(1)],
+    environment,
+  );
+  throw new Error("credentialless native process replacement returned");
+}

package/packages/core/dev-delivery/queue/landing-action.js

@@ -3,9 +3,31 @@ import { deliveryActionContext } from "../native/action-context.js";
 import { admissionPolicyRequest } from "../admission/request.js";
 import { runAdmissionTransaction } from "../admission/transaction.js";
 import { enforceLanding } from "./completion.js";
+import { guardPipelineAdmission } from "../../workflow/pipeline/guard.js";
+import { githubJsonClient } from "../../providers/github/json-client.js";
+import { publishPipelineBuildStatus } from "../../workflow/pipeline/guard-build.js";
+import { publishIntegratedPipelineStatus } from "../../workflow/pipeline/integration-status.js";
+import { githubPipelineIntegration } from "../../providers/github/pipeline-integration.js";
+import { githubPipelineSource } from "../../providers/github/pipeline-source.js";
+import { githubPipelineRuns } from "../../providers/github/pipeline-runs.js";
+import { GitHubClient } from "../admission/github-client.js";
 export async function admitLandingAction(core, env) {
   const context = deliveryActionContext(core, env);
   const request = JSON.parse(core.getInput("request-json", { required: true }));
+  const admitted = await guardPipelineAdmission(request, {
+    repository: env.GITHUB_REPOSITORY,
+    token: core.getInput("token", { required: true }),
+    publishBuildStatus: (build) =>
+      publishPipelineBuildStatus(
+        request,
+        build,
+        githubJsonClient({
+          token: core.getInput("status-token", { required: true }),
+          userAgent: "buildchain-qualified-status",
+        }),
+        env.GITHUB_REPOSITORY,
+      ),
+  });
   const result = await runAdmissionTransaction(
     {
       ...admissionPolicyRequest(request, {
@@ -40,6 +62,37 @@ export async function admitLandingAction(core, env) {
     await core.summary.addRaw(result.summary).write();
   if (!result.ok)
     throw new Error("Targeted PR was not admitted at its expected head");
+  if (admitted) {
+    const repository = env.GITHUB_REPOSITORY;
+    const token = core.getInput("token", { required: true });
+    const read = githubJsonClient({
+      token,
+      userAgent: "buildchain-integration-status",
+    });
+    const [owner, repo] = repository.split("/");
+    const queue = new GitHubClient({ repository: { owner, repo }, token });
+    await publishIntegratedPipelineStatus(
+      {
+        ...admitted.history.at(-1),
+        intent: admitted.intent,
+      },
+      {
+        repository,
+        request: read,
+        queue: (branch) => queue.getMergeQueueState(branch),
+        integration: githubPipelineIntegration(
+          read,
+          repository,
+          githubPipelineSource(read, repository),
+          githubPipelineRuns(read, repository),
+        ),
+        status: githubJsonClient({
+          token: core.getInput("status-token", { required: true }),
+          userAgent: "buildchain-qualified-integration-status",
+        }),
+      },
+    );
+  }
 }
 export function completeDeliveryAction(core) {
   enforceLanding({

package/packages/core/dev-delivery/warrant/failure-settlement.js

@@ -11,13 +11,15 @@ export function verifyFailureSettlement(result, settlement, stateRoot) {
       result.receipt.evidenceRoot === settlement.evidenceRoot,
     "Failure settlement receipt does not bind its exact evidence and prior state",
   );
-  const candidate = result.observation?.candidates?.find(
-    (item) =>
-      item.pullRequestNumber === settlement.pullRequestNumber &&
-      item.sourceHead === settlement.sourceHead &&
-      item.terminal?.evidenceRoot === settlement.evidenceRoot,
+  const candidate = result.terminalCandidate;
+  requireValue(
+    candidate?.candidateId === result.receipt.candidateId &&
+      candidate?.pullRequestNumber === settlement.pullRequestNumber &&
+      candidate?.sourceHead === settlement.sourceHead &&
+      candidate?.status === "terminal-failure" &&
+      candidate?.terminal?.evidenceRoot === settlement.evidenceRoot,
+    "Failure settlement terminal candidate is missing",
   );
-  requireValue(candidate, "Failure settlement terminal candidate is missing");
   for (const key of [
     "transferRoot",
     "finalizerBoundaryRoot",

package/packages/core/dev-delivery/warrant/service.js

@@ -104,6 +104,13 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     concurrencyRecovery,
     receipt: persisted.changed.receipt,
     receiptRoot: persisted.changed.receiptRoot,
+    terminalCandidate:
+      options.command === "settle"
+        ? persisted.changed.queue.candidates.find(
+            (candidate) =>
+              candidate.candidateId === persisted.changed.receipt.candidateId,
+          ) || null
+        : null,
     warrant:
       persisted.changed.warrant ||
       persisted.changed.queue.activeWarrant ||

package/packages/core/governance/buildchain-publication-authority.js

@@ -4,6 +4,8 @@ import path from "node:path";
 import { createPublicationAuthorityRegistry } from "../publication/publication-authority.js";
 
 const DESCRIPTORS = Object.freeze([
+  [".github/workflows/buildchain.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
+  [".github/workflows/buildchain-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
   [".github/workflows/public-release-oci-compose-preview.yml", "product-publication", true, ["oci-compose-preview"], "caller-secrets", "none", "fixed", "caller-bound"],
   [".github/workflows/.build-demo-adapter.yml", "non-publication-oidc"],
   [".github/workflows/public-build-demo.yml", "governance-write"],
@@ -16,36 +18,23 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/public-release-web.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
   [".github/workflows/.build-wheel-verify-compat.yml", "retired-deny"],
   [".github/workflows/.release-binary-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
-  [".github/workflows/self-build-binary-distribution.yml", "evidence-publication"],
-  [".github/workflows/self-release-binary-assets.yml", "governance-write"],
   [".github/workflows/public-release-signing-authority.yml", "evidence-publication"],
-  [".github/workflows/self-build-demo-dogfood.yml", "governance-write"],
-  [".github/workflows/self-build-fixture.yml", "non-publication-oidc"],
   [".github/workflows/build.yml", "non-publication-oidc"],
   [".github/workflows/public-ops-bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-build-alpha-dogfood.yml", "non-publication-oidc"],
-  [".github/workflows/self-build-stable-dogfood.yml", "non-publication-oidc"],
-  [".github/workflows/self-ops-dev-delivery.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-daily.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-monthly.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-weekly.yml", "governance-write"],
   [".github/workflows/public-ops-patrol.yml", "governance-write"],
-  [".github/workflows/self-ops-promotion-recovery.yml", "governance-write"],
-  [".github/workflows/self-release-promote.yml", "governance-write"],
-  [".github/workflows/self-ops-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/public-ops-dev-qualification-patrol.yml", "governance-write"],
   [".github/workflows/public-ops-alpha-candidate-patrol.yml", "governance-write"],
   [".github/workflows/public-ops-warrant-close.yml", "governance-write"],
   [".github/workflows/public-ops-warrant-cancel.yml", "governance-write"],
-  [".github/workflows/self-ops-merge-queue.yml", "governance-write"],
   [".github/workflows/public-ops-dev-auto-merge.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-daily.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-monthly.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-weekly.yml", "governance-write"],
+  [".github/workflows/public-ops-pipeline.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
+  [".github/workflows/public-ops-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
+  [".github/workflows/.ops-pipeline-execute.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
+  [".github/workflows/.release-pipeline-products.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed"],
+  [".github/workflows/.release-pipeline-version.yml", "governance-write"],
+  [".github/workflows/.ops-pipeline-delivery.yml", "governance-write"],
   [".github/workflows/public-ops-housekeeping.yml", "governance-write"],
-  [".github/workflows/self-ops-governance-audit.yml", "governance-write"],
   [".github/workflows/public-release-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/self-release-npm-dry-run.yml", "dry-run-only"],
   [".github/workflows/public-release-paper.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/public-ops-patrol-daily.yml", "governance-write"],
   [".github/workflows/public-ops-patrol-monthly.yml", "governance-write"],
@@ -53,13 +42,9 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/public-ops-patrol-weekly.yml", "governance-write"],
   [".github/workflows/public-build-publication.yml", "evidence-publication"],
   [".github/workflows/public-release-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-release-line-open.yml", "governance-write"],
   [".github/workflows/public-release-propagation.yml", "governance-write"],
   [".github/workflows/public-release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
-  [".github/workflows/self-build-release-verify-compat.yml", "governance-write"],
   [".github/workflows/public-ops-stable-candidate-patrol.yml", "governance-write"],
-  [".github/workflows/self-ops-bootstrap-dogfood.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
 ]);
 
 export function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) {

package/packages/core/governance/github-governance-authority.js

@@ -1257,6 +1257,7 @@ export function createGithubRulesetGovernanceRolloutPlan({
       dismiss_stale_reviews_on_push: true,
       require_code_owner_review: true,
       require_last_push_approval: true,
+      require_extra_approval_for_unattributed_changes: true,
       required_approving_review_count: requiredApprovals,
       required_review_thread_resolution: true,
     },

package/packages/core/observability/controller-evidence.js

@@ -124,14 +124,6 @@ const CONTROLLER_SPECS = [
     ],
     evidence: ["propagation-plan", "propagation-lock", "controller-receipt"],
   },
-  {
-    id: "binary-distribution",
-    workflowId: "binary-distribution",
-    version: 1,
-    capabilities: ["standalone-binary-build", "release-evidence-bundle", "artifact-admission"],
-    stages: ["resolve-runtime", "build", "verify", "bundle", "aggregate"],
-    evidence: ["release-evidence-bundle", "release-passport", "controller-receipt"],
-  },
 ];
 
 function stableJson(value) {

package/packages/core/paper/operations/bootstrap.js

@@ -1,3 +1,4 @@
+import { readNpmPackResult } from "../../publication/npm/pack-result.js";
 import path from "node:path";
 import fs from "node:fs";
 import { jsonText, extractUrls, safeParseJson, toPosix } from "./files.js";
@@ -66,6 +67,7 @@ export function executePaperNpmBootstrap(options = {}) {
     path,
     resolvePaperRepository,
     safeParseJson,
+    readNpmPackResult,
     toPosix,
     validatePaperProvisioningAuthority,
     writePaperReceipt,

package/packages/core/paper/paper-npm-bootstrap.js

@@ -20,6 +20,7 @@ function executePaperNpmBootstrap(options = {}, runtime) {
     path,
     resolvePaperRepository,
     safeParseJson,
+    readNpmPackResult,
     toPosix,
     validatePaperProvisioningAuthority,
     writePaperReceipt,
@@ -208,8 +209,7 @@ function executePaperNpmBootstrap(options = {}, runtime) {
           pack: {
             status: pack.ok ? "pass" : "fail",
             entryCount: (() => {
-              const parsed = safeParseJson(pack.stdout);
-              const value = Array.isArray(parsed) ? parsed[0] : parsed;
+              const value = pack.ok ? readNpmPackResult(pack.stdout) : null;
               return Array.isArray(value?.files) ? value.files.length : 0;
             })(),
           },