@kungfu-tech/buildchain 4.1.3-alpha.1 → 4.1.3-alpha.10

package/packages/core/workflow/pipeline/group-control.js

@@ -0,0 +1,59 @@
+import { recordDigest } from "../../release/discussion/envelope.js";
+import { object } from "../../consumer/contract/shape.js";
+
+export async function recordPipelineGroup(context, host) {
+  object(context, [
+    "schema",
+    "source",
+    "branch",
+    "baseCommit",
+    "runId",
+    "runAttempt",
+    "platforms",
+  ]);
+  if (
+    context.schema !== "buildchain.pipeline-group-build-context/v1" ||
+    context.runId !== host.runId ||
+    context.runAttempt !== host.runAttempt
+  )
+    throw new Error("Merge group callback execution drift");
+  const { run } = await host.runs.read(context.runId, context.runAttempt);
+  if (run.event !== "merge_group" || run.head_sha !== context.source.commit)
+    throw new Error("Merge group build is not the exact provider execution");
+  const queue = await host.queue.getMergeQueueState(context.branch);
+  if (
+    !queue.enabled ||
+    !queue.entries.some(
+      (entry) =>
+        entry.headSha === context.source.commit &&
+        entry.baseSha === context.baseCommit,
+    )
+  )
+    throw new Error("Merge group was removed or changed before verification");
+  const readback = await host.runs.build(
+    context.runId,
+    context.runAttempt,
+    context.source,
+    context.platforms.map((platform) => platform.platform),
+  );
+  if (readback.outcome === "success")
+    await host.qualifyChannel(context.source, context.branch);
+  await host.publishBuildStatus?.(context, readback);
+  await host.request(`/repos/${host.repository}/check-runs`, {
+    method: "POST",
+    body: {
+      name: "check",
+      head_sha: context.source.commit,
+      external_id: `buildchain:merge-group:${recordDigest(context)}`,
+      status: "completed",
+      conclusion: readback.outcome,
+      output: {
+        title: "Buildchain exact merge-group verification",
+        summary: `Provider product jobs: ${readback.root}`,
+      },
+    },
+  });
+  if (readback.outcome !== "success")
+    throw new Error("Merge-group products failed verification");
+  return readback;
+}

package/packages/core/workflow/pipeline/guard-build.js

@@ -0,0 +1,74 @@
+import { githubPipelineRuns } from "../../providers/github/pipeline-runs.js";
+import { readPipelineCaller } from "../../providers/github/pipeline-run-entry.js";
+import { pipelineBuildEvidence } from "./build-evidence.js";
+import { qualifyPipelineSourceRun } from "./delivery-request.js";
+
+export async function guardPipelineBuild(
+  input,
+  observed,
+  {
+    material,
+    source,
+    request,
+    repository,
+    runs = githubPipelineRuns(request, repository),
+  },
+) {
+  const session = { observed, journal: { read: async () => observed } };
+  const build = await pipelineBuildEvidence(session, {
+    runId: 0,
+    runs,
+    source,
+    materialStore: () => material,
+  });
+  if (!build || build.run.id !== Number(input["source-workflow-run-id"]))
+    throw new Error(
+      "Delivery requires its independently qualified exact product build",
+    );
+  const current = { ...observed.history.at(-1), intent: observed.intent };
+  qualifyPipelineSourceRun(build.run, current, build.readback);
+  await readPipelineCaller(
+    build.run,
+    current.generation.source.configPath,
+    request,
+    repository,
+  );
+  return build;
+}
+
+// A commit status is source-bound and survives later workflow suites. Publish
+// only the independently reread build at the protected landing boundary, whose
+// existing Actions credential owns statuses:write. Retained build receipts
+// preserve the original executions and their outcomes.
+export async function publishPipelineBuildStatus(
+  input,
+  build,
+  request,
+  repository,
+) {
+  if (
+    build.readback.source.repository !== repository ||
+    build.readback.source.commit !== input["expected-head-sha"] ||
+    build.sourceHead !== input["expected-head-sha"] ||
+    build.run.id !== Number(input["source-workflow-run-id"]) ||
+    build.readback.runId !== build.run.id ||
+    build.readback.runAttempt !== build.run.run_attempt ||
+    build.outcome !== "success" ||
+    build.readback.outcome !== "success"
+  )
+    throw new Error(
+      "Landing status differs from its qualified exact-source build",
+    );
+  return request(`/repos/${repository}/statuses/${build.sourceHead}`, {
+    method: "POST",
+    body: {
+      context: "check",
+      state: "success",
+      description: `Qualified product build: ${build.readback.root}`.slice(
+        0,
+        140,
+      ),
+      target_url: `https://github.com/${repository}/actions/runs/${build.run.id}/attempts/${build.run.run_attempt}`,
+    },
+  });
+}

package/packages/core/workflow/pipeline/guard.js

@@ -0,0 +1,158 @@
+import { githubJsonClient } from "../../providers/github/json-client.js";
+import { githubAttemptJournal } from "../../providers/github/attempt-journal.js";
+import { githubAttemptIndex } from "../../providers/github/attempt-index.js";
+import { readBusinessAttempt } from "../attempt/reader.js";
+import { assertPipelineExecution } from "./fence.js";
+import { recordDigest } from "../../release/discussion/envelope.js";
+import { githubPipelineSource } from "../../providers/github/pipeline-source.js";
+import { githubPipelinePolicy } from "../../providers/github/pipeline-policy.js";
+import { getOctokit } from "@actions/github";
+import { discussionMaterials } from "../../providers/github/discussions/materials.js";
+import { pipelineMaterials } from "./materials.js";
+import { guardPipelineBuild } from "./guard-build.js";
+
+async function assertRetainedRequest(input, connection, observed) {
+  const current = observed.history.at(-1);
+  const event = [...current.events]
+    .reverse()
+    .find((entry) =>
+      entry.payload.materials.some((material) =>
+        material.id.startsWith("delivery/execution-"),
+      ),
+    );
+  const reference = event?.payload.materials.find((material) =>
+    material.id.startsWith("delivery/execution-"),
+  );
+  if (!reference)
+    throw new Error("Pipeline delivery has no admitted execution request");
+  const archive = discussionMaterials({
+    octokit: getOctokit(connection.token),
+    repository: connection.repository,
+    intentId: observed.intent.id,
+  });
+  const material = pipelineMaterials(archive, {
+    repository: connection.repository,
+    attempt: current.identity,
+  });
+  const execution = await material.read(reference);
+  validatePipelineExecutionRequest(execution, input, observed, {
+    runId: Number(process.env.GITHUB_RUN_ID),
+    runAttempt: Number(process.env.GITHUB_RUN_ATTEMPT),
+  });
+  return material;
+}
+
+export function validatePipelineExecutionRequest(
+  execution,
+  input,
+  observed,
+  coordinates,
+) {
+  if (execution.schema !== "buildchain.pipeline-delivery-execution/v1")
+    throw new Error("Pipeline delivery request schema is unsupported");
+  if (
+    execution.attempt !== observed.attempt ||
+    execution.generation !== observed.generation ||
+    execution.runId !== coordinates.runId ||
+    execution.runAttempt !== coordinates.runAttempt
+  )
+    throw new Error(
+      "Pipeline delivery is not the exact admitted provider execution",
+    );
+  for (const [key, value] of Object.entries(execution.request))
+    if (
+      !Object.hasOwn(input, key) ||
+      recordDigest(input[key]) !== recordDigest(value)
+    )
+      throw new Error(
+        `Pipeline delivery changed its retained request field: ${key}`,
+      );
+}
+
+export async function guardPipelineAdmission(input, connection) {
+  const observed = await guardPipelineDelivery(input, connection);
+  if (!observed) return null;
+  const material = await assertRetainedRequest(input, connection, observed);
+  const request = githubJsonClient({
+    token: connection.token,
+    userAgent: "buildchain-pipeline-admission",
+  });
+  const current = { ...observed.history.at(-1), intent: observed.intent };
+  const source = githubPipelineSource(request, connection.repository);
+  const admission = await source.observeIntent(
+    observed.intent,
+    current.generation,
+    { "config-path": current.generation.source.configPath },
+  );
+  const { live } = admission;
+  if (
+    admission.cleanupOnly ||
+    !live.source ||
+    live.state !== "open" ||
+    live.draft ||
+    !live.ready ||
+    live.baseCommit !== current.generation.baseCommit ||
+    recordDigest(live.source) !== recordDigest(current.generation.source)
+  )
+    throw new Error(
+      "Pipeline source is no longer admitted for a delivery effect",
+    );
+  const policy = await githubPipelinePolicy(
+    request,
+    connection.repository,
+  ).observe(current, admission.protectedPlan.review);
+  if (!policy.review || !policy.checksPassing)
+    throw new Error(
+      "Pipeline protected review or required checks changed before delivery effect",
+    );
+  const build = await guardPipelineBuild(input, observed, {
+    material,
+    source,
+    request,
+    repository: connection.repository,
+  });
+  const fresh = await guardPipelineDelivery(input, connection);
+  await connection.publishBuildStatus?.(build);
+  return fresh;
+}
+
+export async function guardPipelineDelivery(input, connection, lookup) {
+  const attempt = input["pipeline-attempt"];
+  // Existing advanced delivery callers retain their domain authority. The new
+  // normal entry always supplies its internally selected business attempt.
+  if (!attempt) return null;
+  if (!connection.token)
+    throw new Error("Pipeline controller requires its scoped read credential");
+  const request = githubJsonClient({
+    token: connection.token,
+    userAgent: "buildchain-pipeline",
+  });
+  const index =
+    lookup ||
+    githubAttemptIndex(
+      request,
+      githubAttemptJournal(request),
+      connection.repository,
+    );
+  const loaded = await index.resolve(attempt);
+  const observed = readBusinessAttempt(loaded.snapshot);
+  const current = observed.history.at(-1);
+  if (
+    !current ||
+    observed.intent.repository !== connection.repository ||
+    observed.intent.source.targetBranch !== input["target-branch"] ||
+    observed.intent.source.pullRequest !==
+      Number(input["expected-pr-number"]) ||
+    current.generation.source.commit !== input["expected-head-sha"]
+  )
+    throw new Error(
+      "Pipeline delivery request changed its admitted source intent",
+    );
+  assertPipelineExecution(observed, {
+    attempt,
+    intent: observed.intent.id,
+    generation: current.generation.id,
+    sourceRoot: recordDigest(current.generation.source),
+  });
+  return observed;
+}

package/packages/core/workflow/pipeline/host.js

@@ -0,0 +1,144 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { getOctokit } from "@actions/github";
+import { installationRoot } from "../../runtime/installation-root.js";
+import { preparedRuntimeSelection } from "../../runtime/entry/selection.js";
+import { githubJsonClient } from "../../providers/github/json-client.js";
+import { githubAttemptJournal } from "../../providers/github/attempt-journal.js";
+import { githubAttemptIndex } from "../../providers/github/attempt-index.js";
+import { githubPipelineSource } from "../../providers/github/pipeline-source.js";
+import { githubPipelineRuns } from "../../providers/github/pipeline-runs.js";
+import { githubPipelineWorker } from "../../providers/github/pipeline-worker.js";
+import { githubPipelinePolicy } from "../../providers/github/pipeline-policy.js";
+import { discussionMaterials } from "../../providers/github/discussions/materials.js";
+import { pipelineMaterials } from "./materials.js";
+import { GitHubClient } from "../../dev-delivery/admission/github-client.js";
+import { githubPipelineIntegration } from "../../providers/github/pipeline-integration.js";
+import { recordPipelineGroup } from "./group-control.js";
+import { controlPipelineChannel } from "./channel-control.js";
+import { qualifyPipelineChannelSource } from "./channel-source.js";
+import { settlePipeline } from "./settlement.js";
+import { pipelineProjection } from "./projection.js";
+import { resumePipelineNotifications } from "./notifications.js";
+import { projectPipelineStatus } from "./web-status.js";
+import { inspectRecoveryPublication } from "../../publication/pipeline/recovery-inspection.js";
+
+export function pipelineQueue({ queueToken, ...options }) {
+  const reader = new GitHubClient(options);
+  return {
+    getMergeQueueState: (branch) => reader.getMergeQueueState(branch),
+    enqueuePullRequest: async (input) => {
+      // GITHUB_TOKEN enqueue suppresses the merge_group workflow it requires.
+      if (!queueToken || queueToken === options.token)
+        throw new Error(
+          "Channel enqueue requires a distinct App or automation credential",
+        );
+      return new GitHubClient({
+        ...options,
+        token: queueToken,
+      }).enqueuePullRequest(input);
+    },
+  };
+}
+
+export async function pipelineHost(core, env, jobName) {
+  const token = core.getInput("token", { required: true });
+  const repository = env.GITHUB_REPOSITORY;
+  const selection = preparedRuntimeSelection(
+    JSON.parse(env.BUILDCHAIN_RUNTIME_SELECTION),
+  );
+  const runtimeRoot = installationRoot(import.meta.url);
+  const reader = fs.readFileSync(
+    path.join(runtimeRoot, "dist/readers/business-attempt.cjs"),
+  );
+  const runtime = {
+    repository: selection.repository,
+    sha: selection.sha,
+    readerDigest: `sha256:${createHash("sha256").update(reader).digest("hex")}`,
+  };
+  const request = githubJsonClient({ token, userAgent: "buildchain-pipeline" });
+  const github = getOctokit(token);
+  const provider = githubAttemptJournal(request);
+  const index = githubAttemptIndex(request, provider, repository);
+  const runs = githubPipelineRuns(request, repository);
+  const runId = Number(env.GITHUB_RUN_ID),
+    runAttempt = Number(env.GITHUB_RUN_ATTEMPT);
+  const writer = await runs.writer(runId, runAttempt, jobName);
+  const source = githubPipelineSource(request, repository);
+  const [owner, repo] = repository.split("/");
+  const archives = new Map();
+  function archive(session) {
+    if (!archives.has(session.intent.id))
+      archives.set(
+        session.intent.id,
+        discussionMaterials({
+          octokit: github,
+          repository,
+          intentId: session.intent.id,
+          // Storage is partitioned by verified provider job, not attempt authority.
+          // Journal references still select exact immutable asset IDs and digests.
+          partition: `${writer.runId}-${writer.runAttempt}-${writer.jobId}`,
+          authorityDescription:
+            "The canonical Buildchain intent Git journal owns transaction state.",
+        }),
+      );
+    return archives.get(session.intent.id);
+  }
+  const host = {
+    repository,
+    token,
+    github,
+    selection,
+    runtime,
+    runtimeRoot,
+    request,
+    provider,
+    index,
+    runs,
+    runId,
+    runAttempt,
+    writer,
+    source,
+    workers: githubPipelineWorker(request),
+    policy: githubPipelinePolicy(request, repository),
+    queue: pipelineQueue({
+      repository: { owner, repo },
+      token,
+      queueToken: core.getInput("queue-token"),
+    }),
+    integration: githubPipelineIntegration(request, repository, source, runs),
+    groupRecord: (context) => recordPipelineGroup(context, host),
+    channel: (session, admission, inputs) =>
+      controlPipelineChannel(session, admission, inputs, host),
+    qualifyChannel: (source, branch) =>
+      qualifyPipelineChannelSource(source, branch, host),
+    settle: (session, fresh, delivery) =>
+      settlePipeline(session, fresh, delivery, host),
+    project: (session) =>
+      projectPipelineStatus(session, {
+        project: pipelineProjection(github.graphql),
+        core,
+      }),
+    notifyTerminal: (session) => resumePipelineNotifications(session, host),
+    recoverPublication: (session, admitted) =>
+      inspectRecoveryPublication(session, admitted, host),
+    materialStore: (session) =>
+      pipelineMaterials(archive(session), {
+        repository,
+        attempt: session.observed.history.at(-1).identity,
+      }),
+    productArchive: archive,
+    wake: async (attempt) => {
+      await index.resolve(attempt);
+      await request(`/repos/${repository}/dispatches`, {
+        method: "POST",
+        body: {
+          event_type: "buildchain-attempt-wake",
+          client_payload: { attempt },
+        },
+      });
+    },
+  };
+  return host;
+}

package/packages/core/workflow/pipeline/integration-status.js

@@ -0,0 +1,113 @@
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+// The landing job already owns statuses:write. Keep its exact admission alive
+// through the actual queue result so later channel PRs need not borrow the
+// temporary queue branch's Actions check suite.
+async function observeProtectedQueue(current, ports) {
+  const { repository, request, queue } = ports;
+  const now = ports.now || Date.now;
+  const pause =
+    ports.pause || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const deadline = now() + 120 * 60 * 1000;
+  const number = current.intent.source.pullRequest;
+  const branch = current.intent.source.targetBranch;
+  let queueExitAt;
+  while (true) {
+    const pr = await request(`/repos/${repository}/pulls/${number}`);
+    if (
+      pr.head?.sha !== current.generation.source.commit ||
+      pr.head?.repo?.full_name !== repository ||
+      pr.base?.repo?.full_name !== repository ||
+      pr.base?.ref !== branch
+    )
+      throw new Error("Integrated status lost its exact admitted PR source");
+    if (pr.merged) return { pr, deadline, now, pause };
+    if (now() >= deadline)
+      throw new Error(
+        "Protected queue did not complete the admitted integration",
+      );
+    const pending = await queue(branch);
+    if (
+      pr.state !== "open" ||
+      !pending.enabled ||
+      !pending.entries.some(
+        (entry) =>
+          entry.pullRequestNumber === number &&
+          entry.pullRequestHeadSha === current.generation.source.commit,
+      )
+    ) {
+      // Queue removal can precede the PR endpoint's merged readback. Bound
+      // convergence without treating absence or a closed PR as merge evidence.
+      queueExitAt ??= now();
+      if (now() - queueExitAt >= 30_000)
+        throw new Error("Admitted PR left its protected merge queue");
+    } else queueExitAt = undefined;
+    await pause(10000);
+  }
+}
+
+async function observeIntegrationWorkflow(merged, ports) {
+  const { pr, deadline, now, pause } = merged;
+  if (!/^[0-9a-f]{40}$/u.test(pr.merge_commit_sha || ""))
+    throw new Error("Merged PR has no exact integration commit");
+  while (true) {
+    const result = await ports.request(
+      `/repos/${ports.repository}/actions/runs?event=merge_group&head_sha=${pr.merge_commit_sha}&per_page=100`,
+    );
+    if (!Array.isArray(result.workflow_runs) || result.total_count > 100)
+      throw new Error("Integration workflow inventory exceeds its bound");
+    const runs = result.workflow_runs.filter(
+      (run) =>
+        run.path?.split("@")[0] === ".github/workflows/buildchain.yml" &&
+        run.event === "merge_group" &&
+        run.head_sha === pr.merge_commit_sha,
+    );
+    if (
+      runs.some(
+        (run) => run.status === "completed" && run.conclusion === "success",
+      )
+    )
+      return;
+    if (!runs.some((run) => run.status !== "completed") || now() >= deadline)
+      throw new Error("Merged integration has no successful queue workflow");
+    await pause(10000);
+  }
+}
+
+function validateIntegratedStatus(proof, current, repository) {
+  const { root, ...body } = proof;
+  if (
+    recordDigest(body) !== root ||
+    proof.repository !== repository ||
+    proof.pullRequest !== current.intent.source.pullRequest ||
+    proof.sourceHead !== current.generation.source.commit ||
+    proof.branch !== current.intent.source.targetBranch ||
+    proof.build.source.commit !== proof.mergeCommit ||
+    proof.build.source.repository !== repository ||
+    proof.build.outcome !== "success" ||
+    proof.run.conclusion !== "success" ||
+    proof.run.status !== "completed" ||
+    proof.run.event !== "merge_group" ||
+    proof.run.head_sha !== proof.mergeCommit
+  )
+    throw new Error("Integrated status differs from its verified queue result");
+}
+
+export async function publishIntegratedPipelineStatus(current, ports) {
+  const merged = await observeProtectedQueue(current, ports);
+  await observeIntegrationWorkflow(merged, ports);
+  const { repository, integration, status } = ports;
+  const proof = await integration.observe(current);
+  validateIntegratedStatus(proof, current, repository);
+  const { root } = proof;
+  await status(`/repos/${repository}/statuses/${proof.mergeCommit}`, {
+    method: "POST",
+    body: {
+      context: "check",
+      state: "success",
+      description: `Qualified protected integration: ${root}`.slice(0, 140),
+      target_url: `https://github.com/${repository}/actions/runs/${proof.run.id}/attempts/${proof.run.run_attempt}`,
+    },
+  });
+  return proof;
+}

package/packages/core/workflow/pipeline/materials.js

@@ -0,0 +1,58 @@
+import {
+  canonicalJson,
+  recordDigest,
+} from "../../release/discussion/envelope.js";
+import {
+  materialReference,
+  verifyMaterialBytes,
+} from "../attempt/materials.js";
+
+// Receipts are retained before the atomic journal references them. An interrupted
+// upload can leave unreferenced material; it cannot advance attempt authority.
+export function pipelineMaterials(archive, { repository, attempt }) {
+  async function retain(id, receipt, kind = "receipt") {
+    const bytes = Buffer.from(`${canonicalJson(receipt)}\n`);
+    const handle = await archive.put(bytes, {
+      name: `${id.replaceAll("/", "-")}.json`,
+      mediaType: "application/json",
+    });
+    const reference = materialReference(
+      {
+        id,
+        kind,
+        digest: handle.digest,
+        bytes: handle.size,
+        url: `https://api.github.com/repos/${repository}/releases/assets/${handle.id}`,
+        producerAttempt: attempt.id,
+        generation: attempt.generation,
+      },
+      attempt,
+      repository,
+    );
+    verifyMaterialBytes(reference, await archive.read(handle));
+    return reference;
+  }
+  async function read(reference) {
+    materialReference(reference, attempt, repository);
+    const prefix = `https://api.github.com/repos/${repository}/releases/assets/`;
+    if (!reference.url.startsWith(prefix))
+      throw new Error(
+        "Pipeline receipt is not in its retained material archive",
+      );
+    const id = reference.url.slice(prefix.length);
+    if (!/^[1-9][0-9]*$/u.test(id) || !Number.isSafeInteger(Number(id)))
+      throw new Error("Pipeline receipt asset identity is invalid");
+    const bytes = await archive.read({
+      id: Number(id),
+      size: reference.bytes,
+      digest: reference.digest,
+    });
+    verifyMaterialBytes(reference, bytes);
+    const receipt = JSON.parse(bytes.toString("utf8"));
+    // Normalize the supported JSON value domain, rejecting undefined or NaN
+    // from alternate injected archive implementations before returning it.
+    recordDigest(receipt);
+    return receipt;
+  }
+  return { retain, read };
+}

package/packages/core/workflow/pipeline/notifications.js

@@ -0,0 +1,36 @@
+import { wakePipelineCandidate } from "./wake.js";
+import { pipelineCandidate } from "./reconcile.js";
+import { notifyPipelineParent } from "./parent-notification.js";
+
+export async function resumePipelineNotifications(session, host) {
+  await notifyPipelineParent(session, host);
+  const observed = await session.journal.read();
+  const current = { ...observed.history.at(-1), intent: session.intent };
+  const terminal = Object.values(current.phases).filter((phase) =>
+    ["success", "cancelled", "failure"].includes(phase.payload.state),
+  );
+  for (const phase of terminal) {
+    for (const reference of phase.payload.materials.filter((material) =>
+      /^(?:merge\/settlement-|cancellation\/receipt-|failure\/)/u.test(
+        material.id,
+      ),
+    )) {
+      const receipt = await host.materialStore(session).read(reference);
+      const successor =
+        receipt.receipt?.successorWake ||
+        (Array.isArray(receipt.candidates)
+          ? pipelineCandidate(receipt, current)?.terminal?.successorWake
+          : null);
+      if (successor)
+        await wakePipelineCandidate(
+          successor,
+          {
+            repository: host.repository,
+            token: host.token,
+            branch: session.intent.source.targetBranch,
+          },
+          host,
+        );
+    }
+  }
+}

package/packages/core/workflow/pipeline/parent-notification.js

@@ -0,0 +1,27 @@
+import { readBusinessAttempt } from "../attempt/reader.js";
+
+export async function notifyPipelineParent(session, host) {
+  const pr = await host.request(
+    `/repos/${host.repository}/pulls/${session.intent.source.pullRequest}`,
+  );
+  if (!/^feature\/buildchain-next\/[0-9a-f]{64}$/u.test(pr.head?.ref || ""))
+    return;
+  const matches = [
+    ...String(pr.body || "").matchAll(
+      /^Buildchain-Parent-Attempt: (attempt-[0-9a-f]{64})$/gmu,
+    ),
+  ];
+  if (matches.length !== 1) return;
+  const attempt = matches[0][1];
+  const parent = await host.index.resolve(attempt);
+  const state = readBusinessAttempt(parent.snapshot);
+  if (
+    state.attempt !== attempt ||
+    state.status === "complete" ||
+    !state.intent.expectedNodes.includes("next-development")
+  )
+    return;
+  // The body is only a bounded wake selector. Current journal source and exact
+  // generated PR readback are re-admitted before any parent mutation.
+  await host.wake(attempt);
+}