@kungfu-tech/buildchain 4.1.3-alpha.0 → 4.1.3-alpha.2

package/packages/core/release/discussion/presentation.js

@@ -0,0 +1,92 @@
+import { isAttemptRoot } from "./threads.js";
+
+const text = (value) =>
+  String(value ?? "")
+    .replace(
+      /[&<>\[\]`*_\\|]/gu,
+      (character) => `&#${character.charCodeAt(0)};`,
+    )
+    .replace(/[\r\n]/gu, " ");
+const code = (value) => `\`${String(value).replace(/[`\r\n]/gu, " ")}\``;
+
+function runLink(repository, writer) {
+  const match = /^(\d+):(\d+)(?::.*)?$/u.exec(writer);
+  return match
+    ? `[${text(writer)}](https://github.com/${repository}/actions/runs/${match[1]}/attempts/${match[2]})`
+    : code(writer);
+}
+
+function runtimeLink(runtime) {
+  return `[${runtime.repository}@${runtime.sha.slice(0, 12)}](https://github.com/${runtime.repository}/commit/${runtime.sha})`;
+}
+
+export function renderIntent(intent) {
+  return [
+    `## ${intent.source?.qualification ? "Qualification" : "Release"}: ${text(intent.key)}`,
+    `Repository: ${code(intent.repository)}`,
+    "Each top-level transaction comment owns one attempt. Its replies contain node results, recovery checkpoints and downloadable evidence. Recovery attempts link to their predecessors.",
+    `Expected nodes: ${intent.expectedNodes.map(code).join(" → ")}`,
+    `Intent: ${code(intent.id)}`,
+  ].join("\n\n");
+}
+
+function attachmentRows(record, repository) {
+  return (record.payload?.attachments || []).map((attachment) => {
+    const url = new URL(attachment.downloadUrl);
+    if (
+      url.protocol !== "https:" ||
+      url.hostname !== "github.com" ||
+      !url.pathname.startsWith(`/${repository}/releases/download/`) ||
+      url.search ||
+      url.hash
+    )
+      throw new Error(
+        "Attachment download must belong to the consumer repository",
+      );
+    return `| [${text(attachment.name)}](${url.href}) | ${text(attachment.mediaType)} | ${attachment.size} | ${code(attachment.digest)} |`;
+  });
+}
+
+export function renderEvent(record, intent, state) {
+  if (isAttemptRoot(record)) {
+    const predecessor = state.roots.get(record.predecessor);
+    return [
+      `## Attempt ${text(record.attempt)}`,
+      `Execution: ${runLink(intent.repository, record.writer)}  \nRuntime: ${runtimeLink(record.runtime)}`,
+      record.predecessor
+        ? `Resumes: ${predecessor?.url ? `[${text(record.predecessor)}](${predecessor.url})` : code(record.predecessor)}`
+        : "Initial execution of this release intent.",
+      `Nodes: ${intent.expectedNodes.map(code).join(" → ")}`,
+      "Results and evidence are appended below. This root preserves the original execution context.",
+    ].join("\n\n");
+  }
+  const label =
+    record.kind === "checkpoint"
+      ? `checkpoint ${record.sequence}`
+      : record.status;
+  const lines = [
+    `### ${text(record.node)} · ${label}`,
+    `Attempt: ${code(record.attempt)} · Writer: ${runLink(intent.repository, record.writer)}`,
+    `Runtime: ${runtimeLink(record.runtime)}`,
+  ];
+  if (record.payload?.label) lines.push(text(record.payload.label));
+  if (record.payload?.code)
+    lines.push(`Failure code: ${code(record.payload.code)}`);
+  const attachments = attachmentRows(record, intent.repository);
+  if (attachments.length)
+    lines.push(
+      "| Attachment | Type | Bytes | SHA-256 |\n| --- | --- | ---: | --- |\n" +
+        attachments.join("\n"),
+      "Retained files use the transaction material archive. Access requires repository permission to read draft release assets.",
+    );
+  const { attachments: _attachments, ...details } = record.payload || {};
+  if (Object.keys(details).length) {
+    const json = JSON.stringify(details, null, 2);
+    // HTML escaping keeps payload strings from closing the presentation container.
+    lines.push(
+      `<details><summary>Record details</summary><pre>${json.slice(0, 6000).replace(/[&<>]/gu, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" })[c])}${json.length > 6000 ? "\n… See the retained JSON attachment for the complete material." : ""}</pre></details>`,
+    );
+  }
+  lines.push(`Record: ${code(record.id)}`);
+  return lines.join("\n\n");
+}

package/packages/core/release/discussion/publication.js

@@ -40,8 +40,10 @@ export async function publishWithDiscussion(
     observe = () => {},
   },
 ) {
+  let retained;
   const journal = await openReleaseSession({
     graphql: octokit.graphql,
+    onFailure: (node, error) => retained.diagnostics(node, error.code),
     repository: request.repository,
     key: request.version,
     source: { version: request.version },
@@ -54,7 +56,7 @@ export async function publishWithDiscussion(
       request["publish-transaction-override"],
     ),
   });
-  const retained = releaseCheckpoints({
+  retained = releaseCheckpoints({
     session: journal.session,
     store: journal.store,
     octokit,

package/packages/core/release/discussion/qualification.js

@@ -79,6 +79,7 @@ export async function executeReleaseDiscussion(request, _admission, context) {
         store: journal.store,
         octokit: context.octokit,
       });
+      await retained.diagnostics("transport", "qualification-probe");
       const probe = await retained.checkpoint("transport", {
         schema: "buildchain.material-qualification/v1",
         value: payload.key,

package/packages/core/release/discussion/reader.js

@@ -23,6 +23,10 @@ export function readReleaseDiscussion({ body, records }) {
     new Set(intent.expectedNodes).size !== intent.expectedNodes.length
   )
     throw new Error("Missing or duplicate expected nodes");
+  if (intent.organization && intent.organization !== "attempt-threads/v1")
+    throw new Error(
+      "Discussion organization requires its historical runtime reader",
+    );
   const attempts = groupAttempts(validateRecords(intent, records));
   if (!attempts.size)
     return {
@@ -156,6 +160,11 @@ export function discussionStatus(state) {
     status: state.status,
     attempt: state.attempt || "",
     attempts: state.attempts,
+    threads: [...(state.roots || new Map())].map(([attempt, comment]) => ({
+      attempt,
+      commentId: comment.id,
+      url: comment.url,
+    })),
     missingNodes: state.missingNodes,
     handoff: state.handoff || null,
     nodes: Object.fromEntries(

package/packages/core/release/discussion/session.js

@@ -39,6 +39,7 @@ export async function openReleaseSession({
   dryRun = false,
   recover = false,
   expectedNodes = RELEASE_NODES,
+  onFailure = async () => {},
 }) {
   const intent = createIntent({
     repository,
@@ -101,6 +102,7 @@ export async function openReleaseSession({
           { code: String(error.code || "execution-failed") },
           1,
         );
+        await onFailure(node, error);
       } catch (recordError) {
         error.discussionRecordingError = recordError.message;
       }

package/packages/core/release/discussion/store.js

@@ -1,3 +1,5 @@
+import { readDiscussionThreads, eventParent } from "./threads.js";
+import { renderIntent, renderEvent } from "./presentation.js";
 import { collectDiscussionPages } from "../../providers/github/discussions/transport.js";
 import {
   canonicalJson,
@@ -95,11 +97,10 @@ export function releaseDiscussionStore(
         discussion = await transport.create({
           repositoryId: repository.id,
           categoryId: selected[0].id,
-          title: `Buildchain release: ${intent.key}`,
-          body: encodeRecord(
-            intent,
-            `Release transaction for ${intent.key}. Expected nodes: ${intent.expectedNodes.join(", ")}.`,
-          ),
+          title: intent.source?.qualification
+            ? `Buildchain qualification: ${intent.source.qualification}`
+            : `Buildchain release: ${intent.key}`,
+          body: encodeRecord(intent, renderIntent(intent)),
         });
       } catch (error) {
         discussion = await observeAfterUnknown(find, error);
@@ -110,39 +111,30 @@ export function releaseDiscussionStore(
   }
   async function read(session) {
     const discussion = await transport.get(session.discussion.id);
-    assertDiscussion(discussion, session.intent, session.writerId);
-    const comments = await collectDiscussionPages((after) =>
-      transport.comments(discussion.id, after),
-    );
-    const trusted = comments.filter(
-      (comment) => comment.author?.id === session.writerId,
+    const intent = assertDiscussion(
+      discussion,
+      session.intent,
+      session.writerId,
     );
-    if (
-      trusted.some(
-        (comment) => comment.lastEditedAt && decodeRecord(comment.body),
-      )
-    )
-      throw new Error(
-        "A transaction record was edited; historical facts are no longer intact",
-      );
-    const records = trusted
-      .map((comment) => decodeRecord(comment.body))
-      .filter(Boolean);
+    const threads = await readDiscussionThreads(transport, {
+      ...session,
+      intent,
+      discussion,
+    });
     return {
       discussion,
-      comments: trusted,
-      records,
-      ...readReleaseDiscussion({ body: discussion.body, records }),
+      ...threads,
+      ...readReleaseDiscussion({
+        body: discussion.body,
+        records: threads.records,
+      }),
     };
   }
   async function append(session, record) {
     if (session.dryRun) return { dryRun: true };
-    const body = encodeRecord(
-      record,
-      `${record.node}: ${record.status} (attempt ${record.attempt})`,
-    );
+    let observed;
     const find = async () => {
-      const observed = await read(session);
+      observed = await read(session);
       const existing = observed.comments.find(
         (comment) => decodeRecord(comment.body)?.id === record.id,
       );
@@ -155,8 +147,13 @@ export function releaseDiscussionStore(
     };
     const existing = await find();
     if (existing) return existing;
+    const parent = eventParent(observed, record);
+    const body = encodeRecord(
+      record,
+      renderEvent(record, session.intent, observed),
+    );
     try {
-      await transport.append(session.discussion.id, body);
+      await transport.append(session.discussion.id, body, parent);
     } catch (error) {
       return observeAfterUnknown(find, error);
     }

package/packages/core/release/discussion/threads.js

@@ -0,0 +1,83 @@
+import { decodeRecord } from "./envelope.js";
+import { collectDiscussionPages } from "../../providers/github/discussions/transport.js";
+
+export function isAttemptRoot(record) {
+  return (
+    record?.node === "attempt" &&
+    record.kind === "progress" &&
+    record.status === "running" &&
+    record.sequence === 0
+  );
+}
+
+// Provider placement is checked before the pure reader reduces event semantics.
+// Historical flat records retain their original representation; new writes always
+// use roots and replies. An explicit intent organization makes placement strict.
+export async function readDiscussionThreads(transport, session) {
+  const top = await collectDiscussionPages((after) =>
+    transport.comments(session.discussion.id, after),
+  );
+  const comments = [...top];
+  for (const root of top) {
+    if (root.replies?.totalCount === 0) continue;
+    const replies = await collectDiscussionPages((after) =>
+      transport.replies(root.id, after),
+    );
+    for (const reply of replies) {
+      if (reply.replyTo?.id !== root.id)
+        throw new Error(
+          "Discussion reply parent differs from its queried thread",
+        );
+    }
+    comments.push(...replies);
+    if (Buffer.byteLength(JSON.stringify(comments)) > 32 * 1024 * 1024)
+      throw new Error("Discussion threads exceed the complete-view byte bound");
+  }
+  const trusted = comments.filter(
+    (comment) => comment.author?.id === session.writerId,
+  );
+  const records = new Map();
+  for (const comment of trusted) {
+    const record = decodeRecord(comment.body);
+    if (!record) continue;
+    if (comment.lastEditedAt)
+      throw new Error(
+        "A transaction record was edited; historical facts are no longer intact",
+      );
+    records.set(comment.id, record);
+  }
+  const roots = new Map();
+  for (const comment of trusted) {
+    const record = records.get(comment.id);
+    if (!isAttemptRoot(record)) continue;
+    if (comment.replyTo || roots.has(record.attempt))
+      throw new Error("Ambiguous or nested Discussion attempt root");
+    roots.set(record.attempt, comment);
+  }
+  for (const comment of trusted) {
+    const record = records.get(comment.id);
+    if (!record || isAttemptRoot(record)) continue;
+    const root = roots.get(record.attempt);
+    if (comment.replyTo) {
+      if (!root || comment.replyTo.id !== root.id)
+        throw new Error(
+          "Transaction event is attached to a different attempt root",
+        );
+    } else if (session.intent.organization === "attempt-threads/v1") {
+      throw new Error("Transaction event requires its attempt root reply");
+    }
+  }
+  return { comments: trusted, records: [...records.values()], roots };
+}
+
+export function eventParent(state, record) {
+  const root = state.roots.get(record.attempt);
+  if (isAttemptRoot(record)) {
+    if (root)
+      throw new Error("Attempt root already exists with different content");
+    return null;
+  }
+  if (!root)
+    throw new Error("Open the attempt root before appending its events");
+  return root.id;
+}

package/packages/core/release/promote-candidate/product-provider-adapters.js

@@ -1,3 +1,5 @@
+import { parseNpmView } from "../../publication/npm/registry.js";
+import { readNpmPackResult } from "../../publication/npm/pack-result.js";
 import { createOciPublicationAdapter } from "./oci-provider.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
@@ -306,8 +308,7 @@ function createPackedPackage(context) {
         { cwd: context.cwd, encoding: "utf8" },
         "npm pack",
       );
-      const payload = JSON.parse(String(result.stdout || "[]"));
-      const pack = Array.isArray(payload) ? payload[0] : payload;
+      const pack = readNpmPackResult(String(result.stdout || "[]"));
       if (
         pack?.name !== context.intent.packageName ||
         pack?.version !== context.intent.version ||
@@ -363,7 +364,7 @@ async function npmReadback(context, packedPackage, effect) {
         "npm-readback-failed",
       );
     }
-    const integrity = JSON.parse(String(result.stdout || '""'));
+    const { integrity } = parseNpmView(result.stdout);
     if (integrity !== expected.integrity) return conflict("npm-integrity-conflict");
     return observed(effect, {
       kind: "npm-package",

package/packages/core/release/promote-ref/internal/npm-existing-evidence.js

@@ -1,3 +1,4 @@
+import { parseNpmView } from "../../../publication/npm/registry.js";
 import { npmPackageSpec } from "./publish-contract.js";
 import { execNpmSync } from "./npm-distribution.js";
 import fs from "node:fs";
@@ -14,7 +15,7 @@ export function readExistingNpmIntegrity({ cwd, artifact }) {
     if (!output) {
       throw new Error("empty dist.integrity");
     }
-    return JSON.parse(output);
+    return parseNpmView(output).integrity;
   } catch (error) {
     const message = error.stderr?.toString?.().trim() || error.message;
     throw new Error(

package/packages/core/release/promote-ref/internal/publish-command.js

@@ -1,3 +1,4 @@
+import { readNpmPackResult } from "../../../publication/npm/pack-result.js";
 import { npmPublishTransaction } from "../../../publication/npm/transaction.js";
 import { npmPublicationEnvironment } from "../../../publication/npm/environment.js";
 import {
@@ -15,10 +16,21 @@ import {
   updateVersionStateContents,
 } from "../../version-state.js";
 import { publishTransactionEnvironment } from "./transaction-context.js";
-export function runPublishCommand({ cwd, command, provider, loadedConfig, env }) {
+export function runPublishCommand({
+  cwd,
+  command,
+  provider,
+  loadedConfig,
+  env,
+}) {
   if (provider) {
-    if (provider.kind !== "npm" || !provider.directory || command) throw new Error("Invalid or ambiguous declarative publication provider");
-    npmPublishTransaction({ cwd: path.resolve(cwd, provider.directory), publication: npmPublicationEnvironment(env), env: { ...process.env, ...env } });
+    if (provider.kind !== "npm" || !provider.directory || command)
+      throw new Error("Invalid or ambiguous declarative publication provider");
+    npmPublishTransaction({
+      cwd: path.resolve(cwd, provider.directory),
+      publication: npmPublicationEnvironment(env),
+      env: { ...process.env, ...env },
+    });
     return "provider:npm";
   }
   const lifecyclePublish = getLifecycleStage(loadedConfig, "publish");
@@ -64,7 +76,7 @@ export function rematerializedNpmPackEnvironment({
     path.join(os.tmpdir(), "buildchain-rematerialized-npm-"),
   );
   try {
-    const packed = JSON.parse(
+    const result = readNpmPackResult(
       execNpmSync(
         [
           "pack",
@@ -82,7 +94,6 @@ export function rematerializedNpmPackEnvironment({
         },
       ),
     );
-    const result = Array.isArray(packed) ? packed[0] : packed;
     if (!result?.filename)
       throw new Error("rematerialized npm pack did not return a filename");
     if (result.name !== pkg.name || result.version !== version) {

package/packages/core/runtime/domain-wasm-artifact.js

@@ -2,6 +2,6 @@
 export const DOMAIN_WASM_ABI_VERSION = 1;
 export const DOMAIN_WASM_RUSTC = "rustc 1.96.0 (ac68faa20 2026-05-25)";
 export const DOMAIN_WASM_SOURCE_SHA256 =
-  "83550684878224e6820594a44fc48f805c5ed1b3182ac32ebeb51b74cfd20a7f";
+  "9275a02bbc3daac66cac3021384bcaaf43bd52ed9af56b4f1ac67f1cbc69fb71";
 export const DOMAIN_WASM_SHA256 =
-  "504e23c9241f43611813f0fbd213b7a694946328b00e23d22f6ba678e7b0c841";
+  "d42ab5ae8d42253d40ab49057e460285a848925cece176c4d68e63e90ca86c72";

package/packages/core/runtime/entry/actions.js

@@ -1,45 +1,38 @@
 import { resolveRecoverySource } from "./recovery.js";
 import { getOctokit } from "@actions/github";
 import { runtimeEntryProvider } from "./github.js";
+import { resolveRuntimeActionSource } from "./source.js";
 import {
   preparedRuntimeSelection,
   selectExecutionRuntime,
 } from "./selection.js";
+import { selectAttemptRecoveryRuntime } from "./attempt.js";
 
 export async function selectExecutionRuntimeAction(
   core,
   env,
-  { providerFactory = runtimeEntryProvider, githubFactory = getOctokit } = {},
+  {
+    providerFactory = runtimeEntryProvider,
+    githubFactory = getOctokit,
+    pipelineLookup,
+  } = {},
 ) {
   const retained = core.getInput("selection");
   const transport = retained
     ? preparedRuntimeSelection(JSON.parse(retained))
     : undefined;
   const github = githubFactory(core.getInput("token", { required: true }));
-  let source = {
-    repository: core.getInput("source-repository") || env.GITHUB_REPOSITORY,
-    sha: core.getInput("source-sha") || env.GITHUB_SHA,
-    ref: env.GITHUB_REF,
-  };
-  const resumeRunId = core.getInput("resume-run-id");
-  if (resumeRunId) {
-    const reader = providerFactory(github, {
-      sourceRepository: source.repository,
-      sourceSha: source.sha,
-      actor: env.GITHUB_ACTOR,
-      eventName: env.GITHUB_EVENT_NAME,
-    });
-    await reader.authorize({ origin: "runtime-parameter" });
-    source = await resolveRecoverySource(
-      {
-        repository: source.repository,
-        runId: resumeRunId,
-        currentRunId: env.GITHUB_RUN_ID,
-        workflow: env.GITHUB_WORKFLOW_REF?.slice(source.repository.length + 1),
-      },
-      reader.readRun,
-    );
-  }
+  const {
+    source: resolvedSource,
+    continuation,
+    resumeRunId,
+    pipelineAttempt,
+  } = await resolveRuntimeActionSource(core, env, {
+    providerFactory,
+    github,
+    pipelineLookup,
+  });
+  let source = resolvedSource;
   const provider = providerFactory(github, {
     sourceRepository: source.repository,
     sourceSha: source.sha,
@@ -91,6 +84,15 @@ export async function selectExecutionRuntimeAction(
       selection.source?.sha !== source.sha
     )
       throw new Error("Runtime transport changed the admitted consumer source");
+  } else if (continuation?.recovery && (!runtimeRef || pipelineAttempt)) {
+    if (runtimeRef)
+      throw new Error(
+        "An admitted recovery runtime can change only through a new recovery attempt",
+      );
+    selection = await selectAttemptRecoveryRuntime(
+      continuation.recovery,
+      provider,
+    );
   } else {
     selection = await selectExecutionRuntime(
       {

package/packages/core/runtime/entry/attempt.js

@@ -0,0 +1,25 @@
+import { validateRuntime } from "../../release/discussion/envelope.js";
+import { selectExecutionRuntime } from "./selection.js";
+
+// This input is read from the canonical current attempt, never from workflow
+// inputs. Continuation retains its admitted repair without reopening an override.
+export async function selectAttemptRecoveryRuntime(recovery, provider) {
+  validateRuntime(recovery.runtime);
+  if (
+    !/^attempt-[0-9a-f]{64}$/u.test(recovery.attempt || "") ||
+    !/^sha256:[0-9a-f]{64}$/u.test(recovery.recordRoot || "") ||
+    recovery.runtime.repository !== "kungfu-systems/buildchain"
+  )
+    throw new Error(
+      "Attempt runtime continuation requires its canonical recovery admission",
+    );
+  const selected = await selectExecutionRuntime(
+    { runtimeRef: recovery.runtime.sha },
+    {
+      ...provider,
+      authorize: (input) =>
+        provider.authorize({ ...input, origin: "attempt-recovery" }),
+    },
+  );
+  return { ...selected, origin: "attempt-recovery", recovery };
+}

package/packages/core/runtime/entry/selection.js

@@ -1,3 +1,6 @@
+import { consumerContractLock } from "../../consumer/contract/identity.js";
+import { canonicalJson } from "../../release/discussion/envelope.js";
+
 const exactSha = /^[a-f0-9]{40}$/iu;
 const repository = "kungfu-systems/buildchain";
 const trainRef =
@@ -28,6 +31,14 @@ export function runtimeSelector({ runtimeRef = "", lock, workflowSha }) {
     return { ref: runtimeRef, origin: "runtime-parameter" };
   }
   if (lock) {
+    if (lock.schema === "buildchain.consumer-contract-lock/v2") {
+      const validated = consumerContractLock(lock);
+      if (canonicalJson(validated) !== canonicalJson(lock))
+        throw new Error(
+          "Minimal consumer contract lock contains unsupported fields",
+        );
+      return { ref: validated.runtime.sha, origin: "consumer-contract-lock" };
+    }
     if (lock.contract !== "kungfu-buildchain-contract-lock")
       throw new Error("Unsupported Buildchain contract lock");
     const sha = commit(lock.buildchain?.resolvedSha, "Contract lock runtime");
@@ -92,6 +103,9 @@ export async function selectExecutionRuntime(
     ...(selected.origin === "contract-lock"
       ? { contract: { digest: request.lock.buildchain.contractDigest } }
       : {}),
+    ...(selected.origin === "consumer-contract-lock"
+      ? { contract: { consumerConfigDigest: request.lock.configDigest } }
+      : {}),
     class:
       selected.origin === "contract-lock" &&
       request.lock.buildchain.ref === "v4-alpha"

package/packages/core/runtime/entry/source.js

@@ -0,0 +1,62 @@
+import { resolveRecoverySource } from "./recovery.js";
+import {
+  pipelineRuntimeContinuation,
+  pipelineRecoveryContinuation,
+} from "../../workflow/pipeline/runtime-source.js";
+
+export async function resolveRuntimeActionSource(
+  core,
+  env,
+  { providerFactory, github, pipelineLookup },
+) {
+  let source = {
+    repository: core.getInput("source-repository") || env.GITHUB_REPOSITORY,
+    sha: core.getInput("source-sha") || env.GITHUB_SHA,
+    ref: env.GITHUB_REF,
+  };
+  const pipelineAttempt = core.getInput("pipeline-attempt");
+  const recoveryAttempt = core.getInput("recovery-attempt");
+  const resumeRunId = core.getInput("resume-run-id");
+  if (
+    [pipelineAttempt, recoveryAttempt, resumeRunId].filter(Boolean).length > 1
+  )
+    throw new Error("Runtime source selectors are mutually exclusive");
+  let continuation;
+  if (recoveryAttempt) {
+    continuation = await pipelineRecoveryContinuation(
+      recoveryAttempt,
+      source.repository,
+      core.getInput("token", { required: true }),
+      pipelineLookup,
+    );
+    source = continuation.source;
+  }
+  if (pipelineAttempt) {
+    continuation = await pipelineRuntimeContinuation(
+      pipelineAttempt,
+      source.repository,
+      core.getInput("token", { required: true }),
+      pipelineLookup,
+    );
+    source = continuation.source;
+  }
+  if (resumeRunId) {
+    const reader = providerFactory(github, {
+      sourceRepository: source.repository,
+      sourceSha: source.sha,
+      actor: env.GITHUB_ACTOR,
+      eventName: env.GITHUB_EVENT_NAME,
+    });
+    await reader.authorize({ origin: "runtime-parameter" });
+    source = await resolveRecoverySource(
+      {
+        repository: source.repository,
+        runId: resumeRunId,
+        currentRunId: env.GITHUB_RUN_ID,
+        workflow: env.GITHUB_WORKFLOW_REF?.slice(source.repository.length + 1),
+      },
+      reader.readRun,
+    );
+  }
+  return { source, continuation, resumeRunId, pipelineAttempt };
+}