@kungfu-tech/buildchain 4.1.3-alpha.0 → 4.1.3-alpha.10

package/packages/core/release/discussion/qualification.js

@@ -79,6 +79,7 @@ export async function executeReleaseDiscussion(request, _admission, context) {
         store: journal.store,
         octokit: context.octokit,
       });
+      await retained.diagnostics("transport", "qualification-probe");
       const probe = await retained.checkpoint("transport", {
         schema: "buildchain.material-qualification/v1",
         value: payload.key,

package/packages/core/release/discussion/reader.js

@@ -23,6 +23,10 @@ export function readReleaseDiscussion({ body, records }) {
     new Set(intent.expectedNodes).size !== intent.expectedNodes.length
   )
     throw new Error("Missing or duplicate expected nodes");
+  if (intent.organization && intent.organization !== "attempt-threads/v1")
+    throw new Error(
+      "Discussion organization requires its historical runtime reader",
+    );
   const attempts = groupAttempts(validateRecords(intent, records));
   if (!attempts.size)
     return {
@@ -156,6 +160,11 @@ export function discussionStatus(state) {
     status: state.status,
     attempt: state.attempt || "",
     attempts: state.attempts,
+    threads: [...(state.roots || new Map())].map(([attempt, comment]) => ({
+      attempt,
+      commentId: comment.id,
+      url: comment.url,
+    })),
     missingNodes: state.missingNodes,
     handoff: state.handoff || null,
     nodes: Object.fromEntries(

package/packages/core/release/discussion/session.js

@@ -39,6 +39,7 @@ export async function openReleaseSession({
   dryRun = false,
   recover = false,
   expectedNodes = RELEASE_NODES,
+  onFailure = async () => {},
 }) {
   const intent = createIntent({
     repository,
@@ -101,6 +102,7 @@ export async function openReleaseSession({
           { code: String(error.code || "execution-failed") },
           1,
         );
+        await onFailure(node, error);
       } catch (recordError) {
         error.discussionRecordingError = recordError.message;
       }

package/packages/core/release/discussion/store.js

@@ -1,3 +1,5 @@
+import { readDiscussionThreads, eventParent } from "./threads.js";
+import { renderIntent, renderEvent } from "./presentation.js";
 import { collectDiscussionPages } from "../../providers/github/discussions/transport.js";
 import {
   canonicalJson,
@@ -95,11 +97,10 @@ export function releaseDiscussionStore(
         discussion = await transport.create({
           repositoryId: repository.id,
           categoryId: selected[0].id,
-          title: `Buildchain release: ${intent.key}`,
-          body: encodeRecord(
-            intent,
-            `Release transaction for ${intent.key}. Expected nodes: ${intent.expectedNodes.join(", ")}.`,
-          ),
+          title: intent.source?.qualification
+            ? `Buildchain qualification: ${intent.source.qualification}`
+            : `Buildchain release: ${intent.key}`,
+          body: encodeRecord(intent, renderIntent(intent)),
         });
       } catch (error) {
         discussion = await observeAfterUnknown(find, error);
@@ -110,39 +111,30 @@ export function releaseDiscussionStore(
   }
   async function read(session) {
     const discussion = await transport.get(session.discussion.id);
-    assertDiscussion(discussion, session.intent, session.writerId);
-    const comments = await collectDiscussionPages((after) =>
-      transport.comments(discussion.id, after),
-    );
-    const trusted = comments.filter(
-      (comment) => comment.author?.id === session.writerId,
+    const intent = assertDiscussion(
+      discussion,
+      session.intent,
+      session.writerId,
     );
-    if (
-      trusted.some(
-        (comment) => comment.lastEditedAt && decodeRecord(comment.body),
-      )
-    )
-      throw new Error(
-        "A transaction record was edited; historical facts are no longer intact",
-      );
-    const records = trusted
-      .map((comment) => decodeRecord(comment.body))
-      .filter(Boolean);
+    const threads = await readDiscussionThreads(transport, {
+      ...session,
+      intent,
+      discussion,
+    });
     return {
       discussion,
-      comments: trusted,
-      records,
-      ...readReleaseDiscussion({ body: discussion.body, records }),
+      ...threads,
+      ...readReleaseDiscussion({
+        body: discussion.body,
+        records: threads.records,
+      }),
     };
   }
   async function append(session, record) {
     if (session.dryRun) return { dryRun: true };
-    const body = encodeRecord(
-      record,
-      `${record.node}: ${record.status} (attempt ${record.attempt})`,
-    );
+    let observed;
     const find = async () => {
-      const observed = await read(session);
+      observed = await read(session);
       const existing = observed.comments.find(
         (comment) => decodeRecord(comment.body)?.id === record.id,
       );
@@ -155,8 +147,13 @@ export function releaseDiscussionStore(
     };
     const existing = await find();
     if (existing) return existing;
+    const parent = eventParent(observed, record);
+    const body = encodeRecord(
+      record,
+      renderEvent(record, session.intent, observed),
+    );
     try {
-      await transport.append(session.discussion.id, body);
+      await transport.append(session.discussion.id, body, parent);
     } catch (error) {
       return observeAfterUnknown(find, error);
     }

package/packages/core/release/discussion/threads.js

@@ -0,0 +1,83 @@
+import { decodeRecord } from "./envelope.js";
+import { collectDiscussionPages } from "../../providers/github/discussions/transport.js";
+
+export function isAttemptRoot(record) {
+  return (
+    record?.node === "attempt" &&
+    record.kind === "progress" &&
+    record.status === "running" &&
+    record.sequence === 0
+  );
+}
+
+// Provider placement is checked before the pure reader reduces event semantics.
+// Historical flat records retain their original representation; new writes always
+// use roots and replies. An explicit intent organization makes placement strict.
+export async function readDiscussionThreads(transport, session) {
+  const top = await collectDiscussionPages((after) =>
+    transport.comments(session.discussion.id, after),
+  );
+  const comments = [...top];
+  for (const root of top) {
+    if (root.replies?.totalCount === 0) continue;
+    const replies = await collectDiscussionPages((after) =>
+      transport.replies(root.id, after),
+    );
+    for (const reply of replies) {
+      if (reply.replyTo?.id !== root.id)
+        throw new Error(
+          "Discussion reply parent differs from its queried thread",
+        );
+    }
+    comments.push(...replies);
+    if (Buffer.byteLength(JSON.stringify(comments)) > 32 * 1024 * 1024)
+      throw new Error("Discussion threads exceed the complete-view byte bound");
+  }
+  const trusted = comments.filter(
+    (comment) => comment.author?.id === session.writerId,
+  );
+  const records = new Map();
+  for (const comment of trusted) {
+    const record = decodeRecord(comment.body);
+    if (!record) continue;
+    if (comment.lastEditedAt)
+      throw new Error(
+        "A transaction record was edited; historical facts are no longer intact",
+      );
+    records.set(comment.id, record);
+  }
+  const roots = new Map();
+  for (const comment of trusted) {
+    const record = records.get(comment.id);
+    if (!isAttemptRoot(record)) continue;
+    if (comment.replyTo || roots.has(record.attempt))
+      throw new Error("Ambiguous or nested Discussion attempt root");
+    roots.set(record.attempt, comment);
+  }
+  for (const comment of trusted) {
+    const record = records.get(comment.id);
+    if (!record || isAttemptRoot(record)) continue;
+    const root = roots.get(record.attempt);
+    if (comment.replyTo) {
+      if (!root || comment.replyTo.id !== root.id)
+        throw new Error(
+          "Transaction event is attached to a different attempt root",
+        );
+    } else if (session.intent.organization === "attempt-threads/v1") {
+      throw new Error("Transaction event requires its attempt root reply");
+    }
+  }
+  return { comments: trusted, records: [...records.values()], roots };
+}
+
+export function eventParent(state, record) {
+  const root = state.roots.get(record.attempt);
+  if (isAttemptRoot(record)) {
+    if (root)
+      throw new Error("Attempt root already exists with different content");
+    return null;
+  }
+  if (!root)
+    throw new Error("Open the attempt root before appending its events");
+  return root.id;
+}

package/packages/core/release/next-development-transition.js

@@ -3,6 +3,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { isDeepStrictEqual } from "node:util";
 
 import {
   discoverConfiguredDerivedVersionMaterial,
@@ -606,7 +607,7 @@ function assertStaticTransition(record, recreated) {
       throw new Error(`next-development ${field} drifted`);
   }
   for (const field of ["adapter", "declaredPaths", "effectBounds", "target"]) {
-    if (JSON.stringify(record[field]) !== JSON.stringify(recreated[field])) {
+    if (!isDeepStrictEqual(record[field], recreated[field])) {
       const label = field === "effectBounds" ? "effect bounds" : field;
       throw new Error(`next-development ${label} drifted`);
     }
@@ -638,20 +639,19 @@ function assertStaticTransition(record, recreated) {
 }
 
 function assertMaterialization(record) {
-  if (record.materialization !== null) {
-    const { materializationRoot, ...body } = record.materialization;
-    if (materializationRoot !== nextDevelopmentRoot(body)) {
-      throw new Error("next-development materialization root drifted");
-    }
-    const materializedPaths = (record.materialization.paths || []).map(
-      (entry) => entry.path,
-    );
-    if (
-      JSON.stringify(materializedPaths) !==
-      JSON.stringify(record.adapter.sourcePaths)
-    ) {
-      throw new Error("next-development materialization escaped source paths");
-    }
+  if (record.materialization === null) return;
+  const { materializationRoot, ...body } = record.materialization;
+  if (materializationRoot !== nextDevelopmentRoot(body))
+    throw new Error("next-development materialization root drifted");
+  const { paths = [] } = record.materialization;
+  const materializedPaths = paths.map(({ path }) => path);
+  // Reference adapters cover sources; transaction adapters cover all outputs.
+  if (
+    ![record.adapter.sourcePaths, record.adapter.allowedChangePaths].some(
+      (expected) => isDeepStrictEqual(materializedPaths, expected),
+    )
+  ) {
+    throw new Error("next-development materialization paths drifted");
   }
 }
 

package/packages/core/release/promote-candidate/product-provider-adapters.js

@@ -1,3 +1,5 @@
+import { parseNpmView } from "../../publication/npm/registry.js";
+import { readNpmPackResult } from "../../publication/npm/pack-result.js";
 import { createOciPublicationAdapter } from "./oci-provider.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
@@ -306,8 +308,7 @@ function createPackedPackage(context) {
         { cwd: context.cwd, encoding: "utf8" },
         "npm pack",
       );
-      const payload = JSON.parse(String(result.stdout || "[]"));
-      const pack = Array.isArray(payload) ? payload[0] : payload;
+      const pack = readNpmPackResult(String(result.stdout || "[]"));
       if (
         pack?.name !== context.intent.packageName ||
         pack?.version !== context.intent.version ||
@@ -363,7 +364,7 @@ async function npmReadback(context, packedPackage, effect) {
         "npm-readback-failed",
       );
     }
-    const integrity = JSON.parse(String(result.stdout || '""'));
+    const { integrity } = parseNpmView(result.stdout);
     if (integrity !== expected.integrity) return conflict("npm-integrity-conflict");
     return observed(effect, {
       kind: "npm-package",

package/packages/core/release/promote-ref/internal/npm-existing-evidence.js

@@ -1,3 +1,4 @@
+import { parseNpmView } from "../../../publication/npm/registry.js";
 import { npmPackageSpec } from "./publish-contract.js";
 import { execNpmSync } from "./npm-distribution.js";
 import fs from "node:fs";
@@ -14,7 +15,7 @@ export function readExistingNpmIntegrity({ cwd, artifact }) {
     if (!output) {
       throw new Error("empty dist.integrity");
     }
-    return JSON.parse(output);
+    return parseNpmView(output).integrity;
   } catch (error) {
     const message = error.stderr?.toString?.().trim() || error.message;
     throw new Error(

package/packages/core/release/promote-ref/internal/publish-command.js

@@ -1,3 +1,4 @@
+import { readNpmPackResult } from "../../../publication/npm/pack-result.js";
 import { npmPublishTransaction } from "../../../publication/npm/transaction.js";
 import { npmPublicationEnvironment } from "../../../publication/npm/environment.js";
 import {
@@ -15,10 +16,21 @@ import {
   updateVersionStateContents,
 } from "../../version-state.js";
 import { publishTransactionEnvironment } from "./transaction-context.js";
-export function runPublishCommand({ cwd, command, provider, loadedConfig, env }) {
+export function runPublishCommand({
+  cwd,
+  command,
+  provider,
+  loadedConfig,
+  env,
+}) {
   if (provider) {
-    if (provider.kind !== "npm" || !provider.directory || command) throw new Error("Invalid or ambiguous declarative publication provider");
-    npmPublishTransaction({ cwd: path.resolve(cwd, provider.directory), publication: npmPublicationEnvironment(env), env: { ...process.env, ...env } });
+    if (provider.kind !== "npm" || !provider.directory || command)
+      throw new Error("Invalid or ambiguous declarative publication provider");
+    npmPublishTransaction({
+      cwd: path.resolve(cwd, provider.directory),
+      publication: npmPublicationEnvironment(env),
+      env: { ...process.env, ...env },
+    });
     return "provider:npm";
   }
   const lifecyclePublish = getLifecycleStage(loadedConfig, "publish");
@@ -64,7 +76,7 @@ export function rematerializedNpmPackEnvironment({
     path.join(os.tmpdir(), "buildchain-rematerialized-npm-"),
   );
   try {
-    const packed = JSON.parse(
+    const result = readNpmPackResult(
       execNpmSync(
         [
           "pack",
@@ -82,7 +94,6 @@ export function rematerializedNpmPackEnvironment({
         },
       ),
     );
-    const result = Array.isArray(packed) ? packed[0] : packed;
     if (!result?.filename)
       throw new Error("rematerialized npm pack did not return a filename");
     if (result.name !== pkg.name || result.version !== version) {

package/packages/core/release/stable-release-gate.js

@@ -184,8 +184,19 @@ export function evaluateStableReleaseGate({
     "version-bound impact declares a summary and at least one surface",
     { summary: string(impact?.summary), surfaceIds: surfaceImpacts.map((entry) => string(entry?.id)).filter(Boolean) },
   ));
+  checks.push(check(
+    string(impact?.release?.version) === candidateTag.replace(/^v/, ""),
+    "stable.impact_version",
+    "product impact belongs to the exact candidate version",
+    { expectedVersion: candidateTag.replace(/^v/, ""), observedVersion: string(impact?.release?.version) },
+  ));
 
   const canaryById = new Map(canaries.map((canary) => [string(canary?.id), canary]));
+  checks.push(check(
+    canaryById.size === canaries.length,
+    "canary.evidence_inventory",
+    "each canary has one unambiguous observation",
+  ));
   const canaryCompletionTimes = [];
   for (const required of policy.requiredCanaries) {
     const evidence = canaryById.get(required.id);

package/packages/core/runtime/domain-wasm-artifact.js

@@ -2,6 +2,6 @@
 export const DOMAIN_WASM_ABI_VERSION = 1;
 export const DOMAIN_WASM_RUSTC = "rustc 1.96.0 (ac68faa20 2026-05-25)";
 export const DOMAIN_WASM_SOURCE_SHA256 =
-  "83550684878224e6820594a44fc48f805c5ed1b3182ac32ebeb51b74cfd20a7f";
+  "9275a02bbc3daac66cac3021384bcaaf43bd52ed9af56b4f1ac67f1cbc69fb71";
 export const DOMAIN_WASM_SHA256 =
-  "504e23c9241f43611813f0fbd213b7a694946328b00e23d22f6ba678e7b0c841";
+  "d42ab5ae8d42253d40ab49057e460285a848925cece176c4d68e63e90ca86c72";

package/packages/core/runtime/entry/actions.js

@@ -1,45 +1,38 @@
 import { resolveRecoverySource } from "./recovery.js";
 import { getOctokit } from "@actions/github";
 import { runtimeEntryProvider } from "./github.js";
+import { resolveRuntimeActionSource } from "./source.js";
 import {
   preparedRuntimeSelection,
   selectExecutionRuntime,
 } from "./selection.js";
+import { selectAttemptRecoveryRuntime } from "./attempt.js";
 
 export async function selectExecutionRuntimeAction(
   core,
   env,
-  { providerFactory = runtimeEntryProvider, githubFactory = getOctokit } = {},
+  {
+    providerFactory = runtimeEntryProvider,
+    githubFactory = getOctokit,
+    pipelineLookup,
+  } = {},
 ) {
   const retained = core.getInput("selection");
   const transport = retained
     ? preparedRuntimeSelection(JSON.parse(retained))
     : undefined;
   const github = githubFactory(core.getInput("token", { required: true }));
-  let source = {
-    repository: core.getInput("source-repository") || env.GITHUB_REPOSITORY,
-    sha: core.getInput("source-sha") || env.GITHUB_SHA,
-    ref: env.GITHUB_REF,
-  };
-  const resumeRunId = core.getInput("resume-run-id");
-  if (resumeRunId) {
-    const reader = providerFactory(github, {
-      sourceRepository: source.repository,
-      sourceSha: source.sha,
-      actor: env.GITHUB_ACTOR,
-      eventName: env.GITHUB_EVENT_NAME,
-    });
-    await reader.authorize({ origin: "runtime-parameter" });
-    source = await resolveRecoverySource(
-      {
-        repository: source.repository,
-        runId: resumeRunId,
-        currentRunId: env.GITHUB_RUN_ID,
-        workflow: env.GITHUB_WORKFLOW_REF?.slice(source.repository.length + 1),
-      },
-      reader.readRun,
-    );
-  }
+  const {
+    source: resolvedSource,
+    continuation,
+    resumeRunId,
+    pipelineAttempt,
+  } = await resolveRuntimeActionSource(core, env, {
+    providerFactory,
+    github,
+    pipelineLookup,
+  });
+  let source = resolvedSource;
   const provider = providerFactory(github, {
     sourceRepository: source.repository,
     sourceSha: source.sha,
@@ -91,6 +84,15 @@ export async function selectExecutionRuntimeAction(
       selection.source?.sha !== source.sha
     )
       throw new Error("Runtime transport changed the admitted consumer source");
+  } else if (continuation?.recovery && (!runtimeRef || pipelineAttempt)) {
+    if (runtimeRef)
+      throw new Error(
+        "An admitted recovery runtime can change only through a new recovery attempt",
+      );
+    selection = await selectAttemptRecoveryRuntime(
+      continuation.recovery,
+      provider,
+    );
   } else {
     selection = await selectExecutionRuntime(
       {

package/packages/core/runtime/entry/attempt.js

@@ -0,0 +1,25 @@
+import { validateRuntime } from "../../release/discussion/envelope.js";
+import { selectExecutionRuntime } from "./selection.js";
+
+// This input is read from the canonical current attempt, never from workflow
+// inputs. Continuation retains its admitted repair without reopening an override.
+export async function selectAttemptRecoveryRuntime(recovery, provider) {
+  validateRuntime(recovery.runtime);
+  if (
+    !/^attempt-[0-9a-f]{64}$/u.test(recovery.attempt || "") ||
+    !/^sha256:[0-9a-f]{64}$/u.test(recovery.recordRoot || "") ||
+    recovery.runtime.repository !== "kungfu-systems/buildchain"
+  )
+    throw new Error(
+      "Attempt runtime continuation requires its canonical recovery admission",
+    );
+  const selected = await selectExecutionRuntime(
+    { runtimeRef: recovery.runtime.sha },
+    {
+      ...provider,
+      authorize: (input) =>
+        provider.authorize({ ...input, origin: "attempt-recovery" }),
+    },
+  );
+  return { ...selected, origin: "attempt-recovery", recovery };
+}

package/packages/core/runtime/entry/selection.js

@@ -1,3 +1,6 @@
+import { consumerContractLock } from "../../consumer/contract/identity.js";
+import { canonicalJson } from "../../release/discussion/envelope.js";
+
 const exactSha = /^[a-f0-9]{40}$/iu;
 const repository = "kungfu-systems/buildchain";
 const trainRef =
@@ -28,6 +31,14 @@ export function runtimeSelector({ runtimeRef = "", lock, workflowSha }) {
     return { ref: runtimeRef, origin: "runtime-parameter" };
   }
   if (lock) {
+    if (lock.schema === "buildchain.consumer-contract-lock/v2") {
+      const validated = consumerContractLock(lock);
+      if (canonicalJson(validated) !== canonicalJson(lock))
+        throw new Error(
+          "Minimal consumer contract lock contains unsupported fields",
+        );
+      return { ref: validated.runtime.sha, origin: "consumer-contract-lock" };
+    }
     if (lock.contract !== "kungfu-buildchain-contract-lock")
       throw new Error("Unsupported Buildchain contract lock");
     const sha = commit(lock.buildchain?.resolvedSha, "Contract lock runtime");
@@ -92,6 +103,9 @@ export async function selectExecutionRuntime(
     ...(selected.origin === "contract-lock"
       ? { contract: { digest: request.lock.buildchain.contractDigest } }
       : {}),
+    ...(selected.origin === "consumer-contract-lock"
+      ? { contract: { consumerConfigDigest: request.lock.configDigest } }
+      : {}),
     class:
       selected.origin === "contract-lock" &&
       request.lock.buildchain.ref === "v4-alpha"

package/packages/core/runtime/entry/source.js

@@ -0,0 +1,62 @@
+import { resolveRecoverySource } from "./recovery.js";
+import {
+  pipelineRuntimeContinuation,
+  pipelineRecoveryContinuation,
+} from "../../workflow/pipeline/runtime-source.js";
+
+export async function resolveRuntimeActionSource(
+  core,
+  env,
+  { providerFactory, github, pipelineLookup },
+) {
+  let source = {
+    repository: core.getInput("source-repository") || env.GITHUB_REPOSITORY,
+    sha: core.getInput("source-sha") || env.GITHUB_SHA,
+    ref: env.GITHUB_REF,
+  };
+  const pipelineAttempt = core.getInput("pipeline-attempt");
+  const recoveryAttempt = core.getInput("recovery-attempt");
+  const resumeRunId = core.getInput("resume-run-id");
+  if (
+    [pipelineAttempt, recoveryAttempt, resumeRunId].filter(Boolean).length > 1
+  )
+    throw new Error("Runtime source selectors are mutually exclusive");
+  let continuation;
+  if (recoveryAttempt) {
+    continuation = await pipelineRecoveryContinuation(
+      recoveryAttempt,
+      source.repository,
+      core.getInput("token", { required: true }),
+      pipelineLookup,
+    );
+    source = continuation.source;
+  }
+  if (pipelineAttempt) {
+    continuation = await pipelineRuntimeContinuation(
+      pipelineAttempt,
+      source.repository,
+      core.getInput("token", { required: true }),
+      pipelineLookup,
+    );
+    source = continuation.source;
+  }
+  if (resumeRunId) {
+    const reader = providerFactory(github, {
+      sourceRepository: source.repository,
+      sourceSha: source.sha,
+      actor: env.GITHUB_ACTOR,
+      eventName: env.GITHUB_EVENT_NAME,
+    });
+    await reader.authorize({ origin: "runtime-parameter" });
+    source = await resolveRecoverySource(
+      {
+        repository: source.repository,
+        runId: resumeRunId,
+        currentRunId: env.GITHUB_RUN_ID,
+        workflow: env.GITHUB_WORKFLOW_REF?.slice(source.repository.length + 1),
+      },
+      reader.readRun,
+    );
+  }
+  return { source, continuation, resumeRunId, pipelineAttempt };
+}