@kungfu-tech/buildchain 4.1.3-alpha.1 → 4.1.3-alpha.10

package/packages/core/publication/pipeline/worker.js

@@ -0,0 +1,72 @@
+import { resumePipelineSession } from "../../workflow/pipeline/session.js";
+import { pipelinePublicationJournal } from "./journal.js";
+import { retainedPipelineStableWait } from "./stable-wait.js";
+
+export async function claimPipelinePublicationWorker(
+  attempt,
+  publisherSha,
+  host,
+) {
+  const { run: execution } = await host.runs.read(host.runId, host.runAttempt);
+  const definitions = (execution.referenced_workflows || []).filter((entry) =>
+    entry.path?.startsWith(
+      "kungfu-systems/buildchain/.github/workflows/.release-pipeline-products.yml@",
+    ),
+  );
+  if (
+    !/^[0-9a-f]{40}$/u.test(publisherSha || "") ||
+    definitions.length !== 1 ||
+    definitions[0].sha !== publisherSha
+  )
+    throw new Error(
+      "Publisher definition is not the exact hosted reusable workflow",
+    );
+  const session = await resumePipelineSession({ ...host, attempt }, host);
+  const observed = session.observed;
+  if (observed.phases.merge?.payload.state !== "success")
+    throw new Error(
+      "Product publication requires completed protected integration",
+    );
+  if (observed.status === "complete") return null;
+  const phase = observed.missing[0];
+  if (!["publish", "distribution", "next-development"].includes(phase))
+    throw new Error("Attempt is not at product publication");
+  const prior = observed.history
+    .at(-1)
+    .events.filter((event) =>
+      event.payload.materials.some((material) =>
+        material.id.startsWith("publication/worker/"),
+      ),
+    )
+    .at(-1)?.payload.writer;
+  if (
+    prior &&
+    (prior.runId !== String(host.runId) ||
+      prior.runAttempt !== String(host.runAttempt))
+  ) {
+    const { run } = await host.runs.read(
+      Number(prior.runId),
+      Number(prior.runAttempt),
+    );
+    // A time-only wait releases publication ownership before its outer run ends.
+    // The next worker still claims the exact native head under the publication lock.
+    if (
+      run.status !== "completed" &&
+      !(await retainedPipelineStableWait(observed, host))
+    )
+      return null;
+  }
+  const journal = pipelinePublicationJournal(session, host);
+  const claim = {
+    schema: "buildchain.pipeline-publication-worker/v1",
+    attempt,
+    runId: host.runId,
+    runAttempt: host.runAttempt,
+  };
+  await journal.record("publication/worker", claim, {
+    phase,
+    expectedHead: observed.head,
+  });
+  await journal.fence();
+  return { session, journal, phase };
+}

package/packages/core/publication/publication-reproducibility.js

@@ -1,3 +1,4 @@
+import { readNpmPackResult } from "./npm/pack-result.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
@@ -564,8 +565,7 @@ function packPublication({ buildRoot, packageDir, source, toolchain }) {
       label: "npm pack reproducibility candidate",
     },
   );
-  const parsed = JSON.parse(output);
-  const result = Array.isArray(parsed) ? parsed[0] : parsed;
+  const result = readNpmPackResult(output);
   if (!result?.filename || !result?.integrity || !result?.shasum) {
     throw new Error(
       "npm pack reproducibility candidate did not report filename, integrity, and shasum",

package/packages/core/release/next-development-transition.js

@@ -3,6 +3,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { isDeepStrictEqual } from "node:util";
 
 import {
   discoverConfiguredDerivedVersionMaterial,
@@ -606,7 +607,7 @@ function assertStaticTransition(record, recreated) {
       throw new Error(`next-development ${field} drifted`);
   }
   for (const field of ["adapter", "declaredPaths", "effectBounds", "target"]) {
-    if (JSON.stringify(record[field]) !== JSON.stringify(recreated[field])) {
+    if (!isDeepStrictEqual(record[field], recreated[field])) {
       const label = field === "effectBounds" ? "effect bounds" : field;
       throw new Error(`next-development ${label} drifted`);
     }
@@ -638,20 +639,19 @@ function assertStaticTransition(record, recreated) {
 }
 
 function assertMaterialization(record) {
-  if (record.materialization !== null) {
-    const { materializationRoot, ...body } = record.materialization;
-    if (materializationRoot !== nextDevelopmentRoot(body)) {
-      throw new Error("next-development materialization root drifted");
-    }
-    const materializedPaths = (record.materialization.paths || []).map(
-      (entry) => entry.path,
-    );
-    if (
-      JSON.stringify(materializedPaths) !==
-      JSON.stringify(record.adapter.sourcePaths)
-    ) {
-      throw new Error("next-development materialization escaped source paths");
-    }
+  if (record.materialization === null) return;
+  const { materializationRoot, ...body } = record.materialization;
+  if (materializationRoot !== nextDevelopmentRoot(body))
+    throw new Error("next-development materialization root drifted");
+  const { paths = [] } = record.materialization;
+  const materializedPaths = paths.map(({ path }) => path);
+  // Reference adapters cover sources; transaction adapters cover all outputs.
+  if (
+    ![record.adapter.sourcePaths, record.adapter.allowedChangePaths].some(
+      (expected) => isDeepStrictEqual(materializedPaths, expected),
+    )
+  ) {
+    throw new Error("next-development materialization paths drifted");
   }
 }
 

package/packages/core/release/promote-candidate/product-provider-adapters.js

@@ -1,3 +1,5 @@
+import { parseNpmView } from "../../publication/npm/registry.js";
+import { readNpmPackResult } from "../../publication/npm/pack-result.js";
 import { createOciPublicationAdapter } from "./oci-provider.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
@@ -306,8 +308,7 @@ function createPackedPackage(context) {
         { cwd: context.cwd, encoding: "utf8" },
         "npm pack",
       );
-      const payload = JSON.parse(String(result.stdout || "[]"));
-      const pack = Array.isArray(payload) ? payload[0] : payload;
+      const pack = readNpmPackResult(String(result.stdout || "[]"));
       if (
         pack?.name !== context.intent.packageName ||
         pack?.version !== context.intent.version ||
@@ -363,7 +364,7 @@ async function npmReadback(context, packedPackage, effect) {
         "npm-readback-failed",
       );
     }
-    const integrity = JSON.parse(String(result.stdout || '""'));
+    const { integrity } = parseNpmView(result.stdout);
     if (integrity !== expected.integrity) return conflict("npm-integrity-conflict");
     return observed(effect, {
       kind: "npm-package",

package/packages/core/release/promote-ref/internal/npm-existing-evidence.js

@@ -1,3 +1,4 @@
+import { parseNpmView } from "../../../publication/npm/registry.js";
 import { npmPackageSpec } from "./publish-contract.js";
 import { execNpmSync } from "./npm-distribution.js";
 import fs from "node:fs";
@@ -14,7 +15,7 @@ export function readExistingNpmIntegrity({ cwd, artifact }) {
     if (!output) {
       throw new Error("empty dist.integrity");
     }
-    return JSON.parse(output);
+    return parseNpmView(output).integrity;
   } catch (error) {
     const message = error.stderr?.toString?.().trim() || error.message;
     throw new Error(

package/packages/core/release/promote-ref/internal/publish-command.js

@@ -1,3 +1,4 @@
+import { readNpmPackResult } from "../../../publication/npm/pack-result.js";
 import { npmPublishTransaction } from "../../../publication/npm/transaction.js";
 import { npmPublicationEnvironment } from "../../../publication/npm/environment.js";
 import {
@@ -15,10 +16,21 @@ import {
   updateVersionStateContents,
 } from "../../version-state.js";
 import { publishTransactionEnvironment } from "./transaction-context.js";
-export function runPublishCommand({ cwd, command, provider, loadedConfig, env }) {
+export function runPublishCommand({
+  cwd,
+  command,
+  provider,
+  loadedConfig,
+  env,
+}) {
   if (provider) {
-    if (provider.kind !== "npm" || !provider.directory || command) throw new Error("Invalid or ambiguous declarative publication provider");
-    npmPublishTransaction({ cwd: path.resolve(cwd, provider.directory), publication: npmPublicationEnvironment(env), env: { ...process.env, ...env } });
+    if (provider.kind !== "npm" || !provider.directory || command)
+      throw new Error("Invalid or ambiguous declarative publication provider");
+    npmPublishTransaction({
+      cwd: path.resolve(cwd, provider.directory),
+      publication: npmPublicationEnvironment(env),
+      env: { ...process.env, ...env },
+    });
     return "provider:npm";
   }
   const lifecyclePublish = getLifecycleStage(loadedConfig, "publish");
@@ -64,7 +76,7 @@ export function rematerializedNpmPackEnvironment({
     path.join(os.tmpdir(), "buildchain-rematerialized-npm-"),
   );
   try {
-    const packed = JSON.parse(
+    const result = readNpmPackResult(
       execNpmSync(
         [
           "pack",
@@ -82,7 +94,6 @@ export function rematerializedNpmPackEnvironment({
         },
       ),
     );
-    const result = Array.isArray(packed) ? packed[0] : packed;
     if (!result?.filename)
       throw new Error("rematerialized npm pack did not return a filename");
     if (result.name !== pkg.name || result.version !== version) {

package/packages/core/release/stable-release-gate.js

@@ -184,8 +184,19 @@ export function evaluateStableReleaseGate({
     "version-bound impact declares a summary and at least one surface",
     { summary: string(impact?.summary), surfaceIds: surfaceImpacts.map((entry) => string(entry?.id)).filter(Boolean) },
   ));
+  checks.push(check(
+    string(impact?.release?.version) === candidateTag.replace(/^v/, ""),
+    "stable.impact_version",
+    "product impact belongs to the exact candidate version",
+    { expectedVersion: candidateTag.replace(/^v/, ""), observedVersion: string(impact?.release?.version) },
+  ));
 
   const canaryById = new Map(canaries.map((canary) => [string(canary?.id), canary]));
+  checks.push(check(
+    canaryById.size === canaries.length,
+    "canary.evidence_inventory",
+    "each canary has one unambiguous observation",
+  ));
   const canaryCompletionTimes = [];
   for (const required of policy.requiredCanaries) {
     const evidence = canaryById.get(required.id);

package/packages/core/runtime/domain-wasm-artifact.js

@@ -2,6 +2,6 @@
 export const DOMAIN_WASM_ABI_VERSION = 1;
 export const DOMAIN_WASM_RUSTC = "rustc 1.96.0 (ac68faa20 2026-05-25)";
 export const DOMAIN_WASM_SOURCE_SHA256 =
-  "83550684878224e6820594a44fc48f805c5ed1b3182ac32ebeb51b74cfd20a7f";
+  "9275a02bbc3daac66cac3021384bcaaf43bd52ed9af56b4f1ac67f1cbc69fb71";
 export const DOMAIN_WASM_SHA256 =
-  "504e23c9241f43611813f0fbd213b7a694946328b00e23d22f6ba678e7b0c841";
+  "d42ab5ae8d42253d40ab49057e460285a848925cece176c4d68e63e90ca86c72";

package/packages/core/runtime/entry/actions.js

@@ -1,45 +1,38 @@
 import { resolveRecoverySource } from "./recovery.js";
 import { getOctokit } from "@actions/github";
 import { runtimeEntryProvider } from "./github.js";
+import { resolveRuntimeActionSource } from "./source.js";
 import {
   preparedRuntimeSelection,
   selectExecutionRuntime,
 } from "./selection.js";
+import { selectAttemptRecoveryRuntime } from "./attempt.js";
 
 export async function selectExecutionRuntimeAction(
   core,
   env,
-  { providerFactory = runtimeEntryProvider, githubFactory = getOctokit } = {},
+  {
+    providerFactory = runtimeEntryProvider,
+    githubFactory = getOctokit,
+    pipelineLookup,
+  } = {},
 ) {
   const retained = core.getInput("selection");
   const transport = retained
     ? preparedRuntimeSelection(JSON.parse(retained))
     : undefined;
   const github = githubFactory(core.getInput("token", { required: true }));
-  let source = {
-    repository: core.getInput("source-repository") || env.GITHUB_REPOSITORY,
-    sha: core.getInput("source-sha") || env.GITHUB_SHA,
-    ref: env.GITHUB_REF,
-  };
-  const resumeRunId = core.getInput("resume-run-id");
-  if (resumeRunId) {
-    const reader = providerFactory(github, {
-      sourceRepository: source.repository,
-      sourceSha: source.sha,
-      actor: env.GITHUB_ACTOR,
-      eventName: env.GITHUB_EVENT_NAME,
-    });
-    await reader.authorize({ origin: "runtime-parameter" });
-    source = await resolveRecoverySource(
-      {
-        repository: source.repository,
-        runId: resumeRunId,
-        currentRunId: env.GITHUB_RUN_ID,
-        workflow: env.GITHUB_WORKFLOW_REF?.slice(source.repository.length + 1),
-      },
-      reader.readRun,
-    );
-  }
+  const {
+    source: resolvedSource,
+    continuation,
+    resumeRunId,
+    pipelineAttempt,
+  } = await resolveRuntimeActionSource(core, env, {
+    providerFactory,
+    github,
+    pipelineLookup,
+  });
+  let source = resolvedSource;
   const provider = providerFactory(github, {
     sourceRepository: source.repository,
     sourceSha: source.sha,
@@ -91,6 +84,15 @@ export async function selectExecutionRuntimeAction(
       selection.source?.sha !== source.sha
     )
       throw new Error("Runtime transport changed the admitted consumer source");
+  } else if (continuation?.recovery && (!runtimeRef || pipelineAttempt)) {
+    if (runtimeRef)
+      throw new Error(
+        "An admitted recovery runtime can change only through a new recovery attempt",
+      );
+    selection = await selectAttemptRecoveryRuntime(
+      continuation.recovery,
+      provider,
+    );
   } else {
     selection = await selectExecutionRuntime(
       {

package/packages/core/runtime/entry/attempt.js

@@ -0,0 +1,25 @@
+import { validateRuntime } from "../../release/discussion/envelope.js";
+import { selectExecutionRuntime } from "./selection.js";
+
+// This input is read from the canonical current attempt, never from workflow
+// inputs. Continuation retains its admitted repair without reopening an override.
+export async function selectAttemptRecoveryRuntime(recovery, provider) {
+  validateRuntime(recovery.runtime);
+  if (
+    !/^attempt-[0-9a-f]{64}$/u.test(recovery.attempt || "") ||
+    !/^sha256:[0-9a-f]{64}$/u.test(recovery.recordRoot || "") ||
+    recovery.runtime.repository !== "kungfu-systems/buildchain"
+  )
+    throw new Error(
+      "Attempt runtime continuation requires its canonical recovery admission",
+    );
+  const selected = await selectExecutionRuntime(
+    { runtimeRef: recovery.runtime.sha },
+    {
+      ...provider,
+      authorize: (input) =>
+        provider.authorize({ ...input, origin: "attempt-recovery" }),
+    },
+  );
+  return { ...selected, origin: "attempt-recovery", recovery };
+}

package/packages/core/runtime/entry/selection.js

@@ -1,3 +1,6 @@
+import { consumerContractLock } from "../../consumer/contract/identity.js";
+import { canonicalJson } from "../../release/discussion/envelope.js";
+
 const exactSha = /^[a-f0-9]{40}$/iu;
 const repository = "kungfu-systems/buildchain";
 const trainRef =
@@ -28,6 +31,14 @@ export function runtimeSelector({ runtimeRef = "", lock, workflowSha }) {
     return { ref: runtimeRef, origin: "runtime-parameter" };
   }
   if (lock) {
+    if (lock.schema === "buildchain.consumer-contract-lock/v2") {
+      const validated = consumerContractLock(lock);
+      if (canonicalJson(validated) !== canonicalJson(lock))
+        throw new Error(
+          "Minimal consumer contract lock contains unsupported fields",
+        );
+      return { ref: validated.runtime.sha, origin: "consumer-contract-lock" };
+    }
     if (lock.contract !== "kungfu-buildchain-contract-lock")
       throw new Error("Unsupported Buildchain contract lock");
     const sha = commit(lock.buildchain?.resolvedSha, "Contract lock runtime");
@@ -92,6 +103,9 @@ export async function selectExecutionRuntime(
     ...(selected.origin === "contract-lock"
       ? { contract: { digest: request.lock.buildchain.contractDigest } }
       : {}),
+    ...(selected.origin === "consumer-contract-lock"
+      ? { contract: { consumerConfigDigest: request.lock.configDigest } }
+      : {}),
     class:
       selected.origin === "contract-lock" &&
       request.lock.buildchain.ref === "v4-alpha"

package/packages/core/runtime/entry/source.js

@@ -0,0 +1,62 @@
+import { resolveRecoverySource } from "./recovery.js";
+import {
+  pipelineRuntimeContinuation,
+  pipelineRecoveryContinuation,
+} from "../../workflow/pipeline/runtime-source.js";
+
+export async function resolveRuntimeActionSource(
+  core,
+  env,
+  { providerFactory, github, pipelineLookup },
+) {
+  let source = {
+    repository: core.getInput("source-repository") || env.GITHUB_REPOSITORY,
+    sha: core.getInput("source-sha") || env.GITHUB_SHA,
+    ref: env.GITHUB_REF,
+  };
+  const pipelineAttempt = core.getInput("pipeline-attempt");
+  const recoveryAttempt = core.getInput("recovery-attempt");
+  const resumeRunId = core.getInput("resume-run-id");
+  if (
+    [pipelineAttempt, recoveryAttempt, resumeRunId].filter(Boolean).length > 1
+  )
+    throw new Error("Runtime source selectors are mutually exclusive");
+  let continuation;
+  if (recoveryAttempt) {
+    continuation = await pipelineRecoveryContinuation(
+      recoveryAttempt,
+      source.repository,
+      core.getInput("token", { required: true }),
+      pipelineLookup,
+    );
+    source = continuation.source;
+  }
+  if (pipelineAttempt) {
+    continuation = await pipelineRuntimeContinuation(
+      pipelineAttempt,
+      source.repository,
+      core.getInput("token", { required: true }),
+      pipelineLookup,
+    );
+    source = continuation.source;
+  }
+  if (resumeRunId) {
+    const reader = providerFactory(github, {
+      sourceRepository: source.repository,
+      sourceSha: source.sha,
+      actor: env.GITHUB_ACTOR,
+      eventName: env.GITHUB_EVENT_NAME,
+    });
+    await reader.authorize({ origin: "runtime-parameter" });
+    source = await resolveRecoverySource(
+      {
+        repository: source.repository,
+        runId: resumeRunId,
+        currentRunId: env.GITHUB_RUN_ID,
+        workflow: env.GITHUB_WORKFLOW_REF?.slice(source.repository.length + 1),
+      },
+      reader.readRun,
+    );
+  }
+  return { source, continuation, resumeRunId, pipelineAttempt };
+}

package/packages/core/workflow/attempt/identity.js

@@ -0,0 +1,170 @@
+import {
+  createIntent,
+  recordDigest,
+} from "../../release/discussion/envelope.js";
+import {
+  object,
+  text,
+  list,
+  choice,
+  unique,
+  relativePath,
+} from "../../consumer/contract/shape.js";
+import { CONSUMER_CONTRACT } from "../../consumer/contract/plan.js";
+
+export const PIPELINE_PHASES = [
+  "admission",
+  "build",
+  "review",
+  "warrant",
+  "merge",
+  "publish",
+  "distribution",
+  "next-development",
+];
+export const SOURCE_GENERATION = "buildchain.source-generation/v1";
+export const BUSINESS_ATTEMPT = "buildchain.business-attempt/v1";
+const ROOT = /^sha256:[0-9a-f]{64}$/u;
+
+export function pipelineIntent({
+  repository,
+  repositoryId,
+  pullRequest,
+  targetBranch,
+  phases,
+  runtime,
+}) {
+  text(repository, "repository", /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u);
+  text(repositoryId, "repositoryId");
+  if (!Number.isSafeInteger(pullRequest) || pullRequest < 1)
+    throw new Error("Invalid PR intent number");
+  text(
+    targetBranch,
+    "targetBranch",
+    /^(?:dev|alpha|release|publish-gate)\/[A-Za-z0-9/._-]+$/u,
+  );
+  list(phases, "phases", (phase, field) =>
+    choice(phase, PIPELINE_PHASES, field),
+  );
+  unique(phases, "phases");
+  if (
+    phases.some(
+      (phase, i) =>
+        i &&
+        PIPELINE_PHASES.indexOf(phase) <=
+          PIPELINE_PHASES.indexOf(phases[i - 1]),
+    )
+  )
+    throw new Error("Intent phases must follow pipeline order");
+  if (phases[0] !== "admission")
+    throw new Error("Intent must begin with admission");
+  return createIntent({
+    repository,
+    key: `pr-${pullRequest}:${targetBranch}`,
+    expectedNodes: phases,
+    runtime,
+    source: { kind: "pipeline", repositoryId, pullRequest, targetBranch },
+  });
+}
+
+export function validateConsumerSource(source, repository) {
+  object(
+    source,
+    [
+      "schema",
+      "repository",
+      "commit",
+      "tree",
+      "configPath",
+      "configBlob",
+      "configDigest",
+      "contract",
+    ],
+    [],
+    "source",
+  );
+  if (
+    source.schema !== "buildchain.consumer-source/v1" ||
+    source.contract !== CONSUMER_CONTRACT ||
+    source.repository !== repository
+  )
+    throw new Error("Generation requires the admitted consumer source");
+  for (const key of ["commit", "tree", "configBlob"])
+    text(source[key], `source.${key}`, /^[0-9a-f]{40}$/u);
+  relativePath(source.configPath, "source.configPath");
+  text(source.configDigest, "source.configDigest", ROOT);
+  return source;
+}
+
+export function sourceGeneration(intent, source, baseCommit) {
+  validateConsumerSource(source, intent.repository);
+  text(baseCommit, "baseCommit", /^[0-9a-f]{40}$/u);
+  const value = {
+    schema: SOURCE_GENERATION,
+    intent: intent.id,
+    source: structuredClone(source),
+    baseCommit,
+  };
+  return { ...value, id: recordDigest(value) };
+}
+
+export function validateGeneration(value, intent) {
+  object(
+    value,
+    ["schema", "intent", "source", "baseCommit", "id"],
+    [],
+    "generation",
+  );
+  const expected = sourceGeneration(intent, value.source, value.baseCommit);
+  if (recordDigest(value) !== recordDigest(expected))
+    throw new Error("Generation identity mismatch");
+  return value;
+}
+
+export function businessAttempt({
+  intent,
+  generation,
+  predecessor = "",
+  requestKey,
+}) {
+  validateGeneration(generation, intent);
+  text(requestKey, "requestKey");
+  if (requestKey.length > 240)
+    throw new Error("Attempt request key exceeds its bound");
+  if (predecessor) text(predecessor, "predecessor", /^attempt-[0-9a-f]{64}$/u);
+  const value = {
+    schema: BUSINESS_ATTEMPT,
+    intent: intent.id,
+    generation: generation.id,
+    predecessor,
+    requestKey,
+  };
+  return { ...value, id: `attempt-${recordDigest(value).slice(7)}` };
+}
+
+export function validateAttempt(value, intent, generation) {
+  object(
+    value,
+    ["schema", "intent", "generation", "predecessor", "requestKey", "id"],
+    [],
+    "attempt",
+  );
+  const expected = businessAttempt({
+    intent,
+    generation,
+    predecessor: value.predecessor,
+    requestKey: value.requestKey,
+  });
+  if (recordDigest(value) !== recordDigest(expected))
+    throw new Error("Business attempt identity mismatch");
+  return value;
+}
+
+export function providerWriter(value, repository) {
+  object(value, ["repository", "runId", "runAttempt", "jobId"], [], "writer");
+  if (value.repository !== repository)
+    throw new Error("Writer belongs to a different repository");
+  for (const key of ["runId", "runAttempt", "jobId"])
+    text(value[key], `writer.${key}`, /^[1-9][0-9]*$/u);
+  return `${value.runId}:${value.runAttempt}:${value.jobId}`;
+}