@kungfu-tech/buildchain 4.1.3-alpha.1 → 4.1.3-alpha.10

package/packages/core/dev-delivery/commands/project-cut-merge-queue-admission.mjs

@@ -61,19 +61,32 @@ function git(
   {
     env = {},
     input = undefined,
+    inputFile = undefined,
+    outputFile = undefined,
     encoding = "utf8",
     reason = "git-failed",
   } = {},
 ) {
-  const result = spawnSync("git", args, {
-    cwd,
-    env: { ...process.env, ...env },
-    input,
-    encoding,
-    maxBuffer: 64 * 1024 * 1024,
-  });
+  let result, inputDescriptor, outputDescriptor;
+  try {
+    if (inputFile) inputDescriptor = fs.openSync(inputFile, "r");
+    if (outputFile) outputDescriptor = fs.openSync(outputFile, "w");
+    result = spawnSync("git", args, {
+      cwd,
+      env: { ...process.env, ...env },
+      input,
+      encoding,
+      stdio: [inputDescriptor ?? "pipe", outputDescriptor ?? "pipe", "pipe"],
+      maxBuffer: 64 * 1024 * 1024,
+    });
+  } finally {
+    for (const descriptor of [inputDescriptor, outputDescriptor])
+      if (descriptor !== undefined) fs.closeSync(descriptor);
+  }
   if (result.status !== 0) {
-    const detail = String(result.stderr || result.stdout || "").trim();
+    const detail = String(
+      result.stderr || result.error?.message || result.stdout || "",
+    ).trim();
     throw new ProjectCutAdmissionError(
       reason,
       `git ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`,
@@ -135,7 +148,7 @@ function linearSourceCommits(cwd, fork, head) {
 
 function patchId(cwd, patch) {
   const output = git(cwd, ["patch-id", "--stable"], {
-    input: patch,
+    inputFile: patch,
     encoding: "utf8",
     reason: "patch-id-failed",
   });
@@ -184,30 +197,41 @@ function replayProjectCut(cwd, base, head) {
       env: indexEnvironment,
       reason: "base-tree-unreadable",
     });
-    const sourcePatch = git(
+    // Generated bundles can exceed the metadata-output bound. Git streams the
+    // exact patches through private files; patch identity and replay stay intact.
+    const sourcePatch = path.join(temporary, "source.patch");
+    git(
       cwd,
       ["diff", "--binary", "--full-index", "--no-ext-diff", fork, head],
       {
-        encoding: null,
+        outputFile: sourcePatch,
         reason: "source-patch-unreadable",
       },
     );
-    const emptySourcePatch = sourcePatch.length === 0;
+    const emptySourcePatch = fs.statSync(sourcePatch).size === 0;
     if (emptySourcePatch && commits.length !== 1)
-      throw new ProjectCutAdmissionError("empty-source-composition", "an empty source composition must be exactly one linear commit");
-    if (!emptySourcePatch) git(cwd, ["apply", "--cached", "--3way", "--whitespace=nowarn", "-"], {
-        env: indexEnvironment, input: sourcePatch, encoding: "utf8", reason: "project-cut-conflict",
+      throw new ProjectCutAdmissionError(
+        "empty-source-composition",
+        "an empty source composition must be exactly one linear commit",
+      );
+    if (!emptySourcePatch)
+      git(cwd, ["apply", "--cached", "--3way", "--whitespace=nowarn", "-"], {
+        env: indexEnvironment,
+        inputFile: sourcePatch,
+        encoding: "utf8",
+        reason: "project-cut-conflict",
       });
     const candidateTreeOid = git(cwd, ["write-tree"], {
       env: indexEnvironment,
       reason: "candidate-tree-unreadable",
     });
-    const replayPatch = git(
+    const replayPatch = path.join(temporary, "replay.patch");
+    git(
       cwd,
       ["diff", "--cached", "--binary", "--full-index", "--no-ext-diff", base],
       {
         env: indexEnvironment,
-        encoding: null,
+        outputFile: replayPatch,
         reason: "replay-patch-unreadable",
       },
     );
@@ -226,9 +250,12 @@ function replayProjectCut(cwd, base, head) {
         reason: "replay-paths-unreadable",
       },
     );
-    const compositionDrifted = emptySourcePatch ? replayPatch.length !== 0 ||
-      sourceNames !== "" || replayNames !== "" : patchId(cwd, sourcePatch) !==
-      patchId(cwd, replayPatch) || sourceNames !== replayNames;
+    const compositionDrifted = emptySourcePatch
+      ? fs.statSync(replayPatch).size !== 0 ||
+        sourceNames !== "" ||
+        replayNames !== ""
+      : patchId(cwd, sourcePatch) !== patchId(cwd, replayPatch) ||
+        sourceNames !== replayNames;
     if (compositionDrifted) {
       throw new ProjectCutAdmissionError(
         "composition-drift",

package/packages/core/dev-delivery/dev-delivery-provider-heartbeat.js

@@ -207,29 +207,32 @@ export async function runDevDeliveryProviderHeartbeat(
   const startedAt = timestamp(now(), "provider heartbeat startedAt");
   let previousStateRoot = initial.stateRoot;
   const heartbeats = [];
+  let untilHeartbeat = 0;
   let jobs;
   try {
     while (true) {
-      const result = await heartbeat({
-        expectedOldStateRoot: previousStateRoot,
-        fencingToken: initial.fencingToken,
-        leaseGeneration: initial.generation,
-        leaseSeconds: duration,
-      });
-      const entry = heartbeatEntry(result, previousStateRoot);
-      heartbeats.push(entry);
-      previousStateRoot = entry.nextStateRoot;
+      if (untilHeartbeat === 0) {
+        const result = await heartbeat({
+          expectedOldStateRoot: previousStateRoot,
+          fencingToken: initial.fencingToken,
+          leaseGeneration: initial.generation,
+          leaseSeconds: duration,
+        });
+        const entry = heartbeatEntry(result, previousStateRoot);
+        heartbeats.push(entry);
+        previousStateRoot = entry.nextStateRoot;
+        untilHeartbeat = cadence * 1000;
+      }
       jobs = providerJobs(
         await readJobs(),
         { nativeJobName, sealJobName },
         { allowMissingSeal: true },
       );
-      if (!jobs) {
-        await wait(cadence * 1000);
-        continue;
-      }
-      if (terminal(jobs.native) && terminal(jobs.seal)) break;
-      await wait(cadence * 1000);
+      if (jobs && terminal(jobs.native) && terminal(jobs.seal)) break;
+      // Terminal detection must not wait for the next durable lease renewal.
+      const interval = Math.min(untilHeartbeat, 5000);
+      await wait(interval);
+      untilHeartbeat -= interval;
     }
   } catch (error) {
     await onHeartbeatLoss({

package/packages/core/dev-delivery/native/actions.js

@@ -5,6 +5,8 @@ import {
   qualifyTransferredNative,
 } from "./transactions.js";
 import { admitProviderFinalizer } from "./finalizer-admission.js";
+import { guardPipelineAdmission } from "../../workflow/pipeline/guard.js";
+import { replaceNativeActionProcess } from "./process-entry.js";
 function request(core, env) {
   const candidate = JSON.parse(
     core.getInput("request-json", { required: true }),
@@ -22,6 +24,7 @@ function outputs(core, result) {
     core.setOutput(name, value);
 }
 export async function executeDeliveryNativeAction(core, env) {
+  replaceNativeActionProcess();
   const context = deliveryActionContext(core, env);
   const input = request(core, env);
   outputs(
@@ -41,11 +44,16 @@ export async function executeDeliveryNativeAction(core, env) {
 }
 export async function qualifyTransferredNativeAction(core, env) {
   const context = deliveryActionContext(core, env);
+  const input = request(core, env);
+  await guardPipelineAdmission(input.request, {
+    repository: env.GITHUB_REPOSITORY,
+    token: core.getInput("token", { required: true }),
+  });
   outputs(
     core,
     await qualifyTransferredNative({
       ...context,
-      candidate: request(core, env).candidate,
+      candidate: input.candidate,
       sourceProofRoot: core.getInput("source-proof-root", { required: true }),
       token: core.getInput("token", { required: true }),
       apiUrl: env.GITHUB_API_URL || "https://api.github.com",

package/packages/core/dev-delivery/native/heartbeat-action.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { deliveryActionContext } from "./action-context.js";
 import { heartbeatDeliveryAttempt } from "./heartbeat.js";
+import { guardPipelineDelivery } from "../../workflow/pipeline/guard.js";
 export async function heartbeatDeliveryAttemptAction(core, env) {
   const { workspace, run } = deliveryActionContext(core, env);
   const admission = JSON.parse(
@@ -20,6 +21,21 @@ export async function heartbeatDeliveryAttemptAction(core, env) {
     apiUrl: env.GITHUB_API_URL || "https://api.github.com",
     leaseSeconds: Number(core.getInput("lease-seconds")),
     heartbeatSeconds: Number(core.getInput("heartbeat-seconds")),
+    beforeHeartbeat: () => {
+      const warrant = admission.observation?.activeWarrant || admission.warrant;
+      return guardPipelineDelivery(
+        {
+          "pipeline-attempt": core.getInput("pipeline-attempt"),
+          "target-branch": core.getInput("branch", { required: true }),
+          "expected-pr-number": warrant?.pullRequestNumber,
+          "expected-head-sha": warrant?.sourceHead,
+        },
+        {
+          repository: env.GITHUB_REPOSITORY,
+          token: core.getInput("token", { required: true }),
+        },
+      );
+    },
   });
   fs.writeFileSync(
     path.join(workspace, ".buildchain/provider-heartbeat-receipt.json"),

package/packages/core/dev-delivery/native/heartbeat.js

@@ -68,13 +68,14 @@ export async function heartbeatDeliveryAttempt(options) {
       heartbeatSeconds: options.heartbeatSeconds,
     },
     {
-      heartbeat: ({
+      heartbeat: async ({
         expectedOldStateRoot,
         fencingToken,
         leaseGeneration,
         leaseSeconds,
-      }) =>
-        runDevDeliveryCommand({
+      }) => {
+        await options.beforeHeartbeat?.();
+        return runDevDeliveryCommand({
           command: "heartbeat",
           repository: options.repository,
           branch: options.branch,
@@ -85,7 +86,8 @@ export async function heartbeatDeliveryAttempt(options) {
           execute: true,
           token: options.token,
           apiUrl: options.apiUrl,
-        }),
+        });
+      },
       readJobs: () =>
         githubJson(
           options.apiUrl,

package/packages/core/dev-delivery/native/process-entry.js

@@ -0,0 +1,19 @@
+// Node Actions receive artifact/OIDC authority even without token inputs.
+// Replace the process before candidate work so the original environment is
+// absent from /proc, memory and ancestry. A scrubbed child would retain it.
+export function replaceNativeActionProcess(host = process) {
+  const injected = ["ACTIONS_RUNTIME_TOKEN", "ACTIONS_ID_TOKEN_REQUEST_TOKEN"];
+  if (!injected.some((name) => host.env[name])) return;
+  if (host.platform !== "linux" || typeof host.execve !== "function") {
+    throw new Error("credentialless native action requires Linux execve");
+  }
+  const environment = { ...host.env };
+  for (const name of injected) delete environment[name];
+  // Other credential-like variables remain subject to the ancestry guard.
+  host.execve(
+    host.execPath,
+    [host.execPath, ...host.execArgv, ...host.argv.slice(1)],
+    environment,
+  );
+  throw new Error("credentialless native process replacement returned");
+}

package/packages/core/dev-delivery/queue/landing-action.js

@@ -3,9 +3,31 @@ import { deliveryActionContext } from "../native/action-context.js";
 import { admissionPolicyRequest } from "../admission/request.js";
 import { runAdmissionTransaction } from "../admission/transaction.js";
 import { enforceLanding } from "./completion.js";
+import { guardPipelineAdmission } from "../../workflow/pipeline/guard.js";
+import { githubJsonClient } from "../../providers/github/json-client.js";
+import { publishPipelineBuildStatus } from "../../workflow/pipeline/guard-build.js";
+import { publishIntegratedPipelineStatus } from "../../workflow/pipeline/integration-status.js";
+import { githubPipelineIntegration } from "../../providers/github/pipeline-integration.js";
+import { githubPipelineSource } from "../../providers/github/pipeline-source.js";
+import { githubPipelineRuns } from "../../providers/github/pipeline-runs.js";
+import { GitHubClient } from "../admission/github-client.js";
 export async function admitLandingAction(core, env) {
   const context = deliveryActionContext(core, env);
   const request = JSON.parse(core.getInput("request-json", { required: true }));
+  const admitted = await guardPipelineAdmission(request, {
+    repository: env.GITHUB_REPOSITORY,
+    token: core.getInput("token", { required: true }),
+    publishBuildStatus: (build) =>
+      publishPipelineBuildStatus(
+        request,
+        build,
+        githubJsonClient({
+          token: core.getInput("status-token", { required: true }),
+          userAgent: "buildchain-qualified-status",
+        }),
+        env.GITHUB_REPOSITORY,
+      ),
+  });
   const result = await runAdmissionTransaction(
     {
       ...admissionPolicyRequest(request, {
@@ -40,6 +62,37 @@ export async function admitLandingAction(core, env) {
     await core.summary.addRaw(result.summary).write();
   if (!result.ok)
     throw new Error("Targeted PR was not admitted at its expected head");
+  if (admitted) {
+    const repository = env.GITHUB_REPOSITORY;
+    const token = core.getInput("token", { required: true });
+    const read = githubJsonClient({
+      token,
+      userAgent: "buildchain-integration-status",
+    });
+    const [owner, repo] = repository.split("/");
+    const queue = new GitHubClient({ repository: { owner, repo }, token });
+    await publishIntegratedPipelineStatus(
+      {
+        ...admitted.history.at(-1),
+        intent: admitted.intent,
+      },
+      {
+        repository,
+        request: read,
+        queue: (branch) => queue.getMergeQueueState(branch),
+        integration: githubPipelineIntegration(
+          read,
+          repository,
+          githubPipelineSource(read, repository),
+          githubPipelineRuns(read, repository),
+        ),
+        status: githubJsonClient({
+          token: core.getInput("status-token", { required: true }),
+          userAgent: "buildchain-qualified-integration-status",
+        }),
+      },
+    );
+  }
 }
 export function completeDeliveryAction(core) {
   enforceLanding({

package/packages/core/dev-delivery/warrant/failure-settlement.js

@@ -11,13 +11,15 @@ export function verifyFailureSettlement(result, settlement, stateRoot) {
       result.receipt.evidenceRoot === settlement.evidenceRoot,
     "Failure settlement receipt does not bind its exact evidence and prior state",
   );
-  const candidate = result.observation?.candidates?.find(
-    (item) =>
-      item.pullRequestNumber === settlement.pullRequestNumber &&
-      item.sourceHead === settlement.sourceHead &&
-      item.terminal?.evidenceRoot === settlement.evidenceRoot,
+  const candidate = result.terminalCandidate;
+  requireValue(
+    candidate?.candidateId === result.receipt.candidateId &&
+      candidate?.pullRequestNumber === settlement.pullRequestNumber &&
+      candidate?.sourceHead === settlement.sourceHead &&
+      candidate?.status === "terminal-failure" &&
+      candidate?.terminal?.evidenceRoot === settlement.evidenceRoot,
+    "Failure settlement terminal candidate is missing",
   );
-  requireValue(candidate, "Failure settlement terminal candidate is missing");
   for (const key of [
     "transferRoot",
     "finalizerBoundaryRoot",

package/packages/core/dev-delivery/warrant/service.js

@@ -104,6 +104,13 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     concurrencyRecovery,
     receipt: persisted.changed.receipt,
     receiptRoot: persisted.changed.receiptRoot,
+    terminalCandidate:
+      options.command === "settle"
+        ? persisted.changed.queue.candidates.find(
+            (candidate) =>
+              candidate.candidateId === persisted.changed.receipt.candidateId,
+          ) || null
+        : null,
     warrant:
       persisted.changed.warrant ||
       persisted.changed.queue.activeWarrant ||

package/packages/core/governance/buildchain-publication-authority.js

@@ -4,6 +4,8 @@ import path from "node:path";
 import { createPublicationAuthorityRegistry } from "../publication/publication-authority.js";
 
 const DESCRIPTORS = Object.freeze([
+  [".github/workflows/buildchain.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
+  [".github/workflows/buildchain-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
   [".github/workflows/public-release-oci-compose-preview.yml", "product-publication", true, ["oci-compose-preview"], "caller-secrets", "none", "fixed", "caller-bound"],
   [".github/workflows/.build-demo-adapter.yml", "non-publication-oidc"],
   [".github/workflows/public-build-demo.yml", "governance-write"],
@@ -16,36 +18,23 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/public-release-web.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
   [".github/workflows/.build-wheel-verify-compat.yml", "retired-deny"],
   [".github/workflows/.release-binary-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
-  [".github/workflows/self-build-binary-distribution.yml", "evidence-publication"],
-  [".github/workflows/self-release-binary-assets.yml", "governance-write"],
   [".github/workflows/public-release-signing-authority.yml", "evidence-publication"],
-  [".github/workflows/self-build-demo-dogfood.yml", "governance-write"],
-  [".github/workflows/self-build-fixture.yml", "non-publication-oidc"],
   [".github/workflows/build.yml", "non-publication-oidc"],
   [".github/workflows/public-ops-bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-build-alpha-dogfood.yml", "non-publication-oidc"],
-  [".github/workflows/self-build-stable-dogfood.yml", "non-publication-oidc"],
-  [".github/workflows/self-ops-dev-delivery.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-daily.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-monthly.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-weekly.yml", "governance-write"],
   [".github/workflows/public-ops-patrol.yml", "governance-write"],
-  [".github/workflows/self-ops-promotion-recovery.yml", "governance-write"],
-  [".github/workflows/self-release-promote.yml", "governance-write"],
-  [".github/workflows/self-ops-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/public-ops-dev-qualification-patrol.yml", "governance-write"],
   [".github/workflows/public-ops-alpha-candidate-patrol.yml", "governance-write"],
   [".github/workflows/public-ops-warrant-close.yml", "governance-write"],
   [".github/workflows/public-ops-warrant-cancel.yml", "governance-write"],
-  [".github/workflows/self-ops-merge-queue.yml", "governance-write"],
   [".github/workflows/public-ops-dev-auto-merge.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-daily.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-monthly.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-weekly.yml", "governance-write"],
+  [".github/workflows/public-ops-pipeline.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
+  [".github/workflows/public-ops-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
+  [".github/workflows/.ops-pipeline-execute.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
+  [".github/workflows/.release-pipeline-products.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed"],
+  [".github/workflows/.release-pipeline-version.yml", "governance-write"],
+  [".github/workflows/.ops-pipeline-delivery.yml", "governance-write"],
   [".github/workflows/public-ops-housekeeping.yml", "governance-write"],
-  [".github/workflows/self-ops-governance-audit.yml", "governance-write"],
   [".github/workflows/public-release-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/self-release-npm-dry-run.yml", "dry-run-only"],
   [".github/workflows/public-release-paper.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/public-ops-patrol-daily.yml", "governance-write"],
   [".github/workflows/public-ops-patrol-monthly.yml", "governance-write"],
@@ -53,13 +42,9 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/public-ops-patrol-weekly.yml", "governance-write"],
   [".github/workflows/public-build-publication.yml", "evidence-publication"],
   [".github/workflows/public-release-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-release-line-open.yml", "governance-write"],
   [".github/workflows/public-release-propagation.yml", "governance-write"],
   [".github/workflows/public-release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
-  [".github/workflows/self-build-release-verify-compat.yml", "governance-write"],
   [".github/workflows/public-ops-stable-candidate-patrol.yml", "governance-write"],
-  [".github/workflows/self-ops-bootstrap-dogfood.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
 ]);
 
 export function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) {

package/packages/core/governance/github-governance-authority.js

@@ -1257,6 +1257,7 @@ export function createGithubRulesetGovernanceRolloutPlan({
       dismiss_stale_reviews_on_push: true,
       require_code_owner_review: true,
       require_last_push_approval: true,
+      require_extra_approval_for_unattributed_changes: true,
       required_approving_review_count: requiredApprovals,
       required_review_thread_resolution: true,
     },

package/packages/core/observability/controller-evidence.js

@@ -124,14 +124,6 @@ const CONTROLLER_SPECS = [
     ],
     evidence: ["propagation-plan", "propagation-lock", "controller-receipt"],
   },
-  {
-    id: "binary-distribution",
-    workflowId: "binary-distribution",
-    version: 1,
-    capabilities: ["standalone-binary-build", "release-evidence-bundle", "artifact-admission"],
-    stages: ["resolve-runtime", "build", "verify", "bundle", "aggregate"],
-    evidence: ["release-evidence-bundle", "release-passport", "controller-receipt"],
-  },
 ];
 
 function stableJson(value) {

package/packages/core/paper/operations/bootstrap.js

@@ -1,3 +1,4 @@
+import { readNpmPackResult } from "../../publication/npm/pack-result.js";
 import path from "node:path";
 import fs from "node:fs";
 import { jsonText, extractUrls, safeParseJson, toPosix } from "./files.js";
@@ -66,6 +67,7 @@ export function executePaperNpmBootstrap(options = {}) {
     path,
     resolvePaperRepository,
     safeParseJson,
+    readNpmPackResult,
     toPosix,
     validatePaperProvisioningAuthority,
     writePaperReceipt,

package/packages/core/paper/paper-npm-bootstrap.js

@@ -20,6 +20,7 @@ function executePaperNpmBootstrap(options = {}, runtime) {
     path,
     resolvePaperRepository,
     safeParseJson,
+    readNpmPackResult,
     toPosix,
     validatePaperProvisioningAuthority,
     writePaperReceipt,
@@ -208,8 +209,7 @@ function executePaperNpmBootstrap(options = {}, runtime) {
           pack: {
             status: pack.ok ? "pass" : "fail",
             entryCount: (() => {
-              const parsed = safeParseJson(pack.stdout);
-              const value = Array.isArray(parsed) ? parsed[0] : parsed;
+              const value = pack.ok ? readNpmPackResult(pack.stdout) : null;
               return Array.isArray(value?.files) ? value.files.length : 0;
             })(),
           },

package/packages/core/providers/github/attempt-index.js

@@ -0,0 +1,60 @@
+// Immutable lookup pointers are derived from admitted journal commits. The
+// canonical intent journal must contain the selected root before a pointer can
+// resolve; an orphan commit or pointer cannot create attempt authority.
+export function githubAttemptIndex(request, journal, repository) {
+  if (!/^[\w.-]+\/[\w.-]+$/u.test(repository || ""))
+    throw new Error("Invalid attempt lookup repository");
+  const base = `/repos/${repository}`;
+  function ref(attempt) {
+    if (!/^attempt-[0-9a-f]{64}$/u.test(attempt || ""))
+      throw new Error("Invalid business attempt selector");
+    return `buildchain/attempt-index/${attempt}`;
+  }
+  function root(snapshot, attempt) {
+    const roots = snapshot.records.filter(
+      (record) => record.attempt === attempt && record.node === "attempt",
+    );
+    if (roots.length !== 1)
+      throw new Error("Lookup does not identify one admitted attempt root");
+    return roots[0];
+  }
+  async function resolve(attempt) {
+    const pointer = await request(`${base}/git/ref/heads/${ref(attempt)}`, {
+      allow404: true,
+    });
+    if (!pointer) throw new Error("Business attempt lookup is not retained");
+    const indexed = await journal.readCommit(repository, pointer.object?.sha);
+    const selected = root(indexed.snapshot, attempt);
+    const current = await journal.read(indexed.snapshot.intent);
+    if (!current || root(current.snapshot, attempt).id !== selected.id)
+      throw new Error(
+        "Lookup attempt is absent from the authoritative journal",
+      );
+    return { ...current, selectedAttempt: attempt };
+  }
+  async function retain(intent, attempt) {
+    if (intent.repository !== repository)
+      throw new Error("Attempt lookup repository drift");
+    const current = await journal.read(intent);
+    if (!current) throw new Error("Cannot index an unadmitted attempt");
+    const expected = root(current.snapshot, attempt);
+    let failure;
+    try {
+      await request(`${base}/git/refs`, {
+        method: "POST",
+        body: { ref: `refs/heads/${ref(attempt)}`, sha: current.commit },
+      });
+    } catch (error) {
+      failure = error;
+    }
+    try {
+      const result = await resolve(attempt);
+      if (root(result.snapshot, attempt).id !== expected.id)
+        throw new Error("Conflicting business attempt lookup");
+      return result;
+    } catch (error) {
+      throw failure || error;
+    }
+  }
+  return { retain, resolve };
+}