@kungfu-tech/buildchain 4.1.3-alpha.1 → 4.1.3-alpha.2

package/packages/core/publication/pipeline/sealed-products.js

@@ -0,0 +1,79 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { recordDigest } from "../../release/discussion/envelope.js";
+import {
+  publicationFile,
+  publicationPath,
+  writeImmutablePublicationFile,
+} from "./files.js";
+
+export async function retainPipelineProducts(archive, qualified, bundles) {
+  const retained = [];
+  for (const artifact of qualified.artifacts) {
+    const bundle = bundles.find(
+      ({ manifest }) => manifest.root === artifact.manifestRoot,
+    );
+    if (!bundle)
+      throw new Error("Qualified product has no exact source manifest");
+    const file = publicationFile(
+      publicationPath(bundle.directory, artifact.file),
+    );
+    if (file.digest !== artifact.digest || file.size !== artifact.size)
+      throw new Error("Qualified product changed before durable retention");
+    const handle = await archive.put(file.bytes, {
+      name: `${artifact.digest.slice(7)}-${path.basename(artifact.file)}`,
+      mediaType: "application/octet-stream",
+    });
+    await verifiedBytes(archive, handle, artifact);
+    retained.push({ id: artifact.id, handle });
+  }
+  const body = {
+    schema: "buildchain.pipeline-sealed-products/v1",
+    qualificationRoot: qualified.root,
+    products: retained,
+  };
+  return { ...body, root: recordDigest(body) };
+}
+
+async function verifiedBytes(archive, handle, artifact) {
+  if (handle.digest !== artifact.digest || handle.size !== artifact.size)
+    throw new Error("Retained product handle does not bind qualified bytes");
+  const bytes = Buffer.from(await archive.read(handle));
+  if (
+    bytes.length !== artifact.size ||
+    `sha256:${createHash("sha256").update(bytes).digest("hex")}` !==
+      artifact.digest
+  )
+    throw new Error("Retained product readback differs from qualified bytes");
+  return bytes;
+}
+
+export async function restorePipelineProducts(
+  archive,
+  qualified,
+  sealed,
+  directory,
+) {
+  const { root, ...body } = sealed;
+  if (
+    root !== recordDigest(body) ||
+    sealed.qualificationRoot !== qualified.root ||
+    recordDigest(sealed.products.map(({ id }) => id)) !==
+      recordDigest(qualified.artifacts.map(({ id }) => id))
+  )
+    throw new Error(
+      "Retained products must cover the exact qualification inventory",
+    );
+  fs.mkdirSync(directory, { recursive: true });
+  for (const artifact of qualified.artifacts) {
+    const { handle } = sealed.products.find(({ id }) => id === artifact.id);
+    const bytes = await verifiedBytes(archive, handle, artifact);
+    const target = path.resolve(directory, artifact.file);
+    if (!target.startsWith(`${path.resolve(directory)}${path.sep}`))
+      throw new Error("Retained product path escapes its directory");
+    writeImmutablePublicationFile(target, bytes);
+    publicationPath(directory, artifact.file);
+  }
+  return directory;
+}

package/packages/core/publication/pipeline/settle.js

@@ -0,0 +1,43 @@
+import fs from "node:fs";
+import { publicationContext, uniquePublicationMaterial } from "./context.js";
+import { distributePipelineProducts } from "./distribution.js";
+import { nextPipelineDevelopment } from "./next-development.js";
+
+export async function settlePipelinePublication(
+  context,
+  host,
+  directory,
+  environment,
+) {
+  const { session, journal } = await publicationContext(context, host);
+  if (session.observed.phases.publish?.payload.state !== "success")
+    throw new Error(
+      "Publication must retain success before distribution and next-development",
+    );
+  fs.mkdirSync(directory, { recursive: true });
+  const retained = await uniquePublicationMaterial(
+    journal,
+    "publication/qualified/",
+  );
+  if (session.observed.phases.distribution?.payload.state !== "success") {
+    const receipt = await distributePipelineProducts(
+      context,
+      host,
+      journal,
+      retained,
+      environment,
+      directory,
+    );
+    await journal.record("publication/distribution-complete", receipt, {
+      phase: "distribution",
+      state: "success",
+    });
+  }
+  const next = await nextPipelineDevelopment(context, host, journal);
+  await journal.record("publication/next-development-result", next, {
+    phase: "next-development",
+    state: next.state,
+  });
+  await host.project(session);
+  return next;
+}

package/packages/core/publication/pipeline/signing.js

@@ -0,0 +1,140 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import {
+  canonicalJson,
+  recordDigest,
+} from "../../release/discussion/envelope.js";
+import { verifyPipelineQualification } from "./documents.js";
+import { writeImmutablePublicationFile } from "./files.js";
+
+export const PIPELINE_PRODUCT_PREDICATE =
+  "https://buildchain.libkungfu.dev/attestations/pipeline-products/v1";
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+
+export function preparePipelineSigning({
+  plan,
+  materialization,
+  qualified,
+  directory,
+  evaluatedAt,
+}) {
+  verifyPipelineQualification({
+    plan,
+    materialization,
+    qualified,
+    evaluatedAt,
+  });
+  const predicate = {
+    schema: "buildchain.pipeline-product-attestation/v1",
+    planRoot: plan.root,
+    materializationRoot: materialization.root,
+    qualificationRoot: qualified.root,
+    source: qualified.source,
+    protectedSource: plan.source,
+    publisher: plan.publisher,
+    runtime: plan.runtime,
+    provider: {
+      runId: qualified.build.runId,
+      runAttempt: qualified.build.runAttempt,
+      source: qualified.build.providerSource,
+    },
+  };
+  const subjectBytes = Buffer.from(`${canonicalJson(qualified)}\n`);
+  const subjectPath = writeImmutablePublicationFile(
+    path.join(directory, "qualified-products.json"),
+    subjectBytes,
+  );
+  const predicatePath = writeImmutablePublicationFile(
+    path.join(directory, "predicate.json"),
+    `${canonicalJson(predicate)}\n`,
+  );
+  return {
+    subjectPath,
+    predicatePath,
+    predicate,
+    subjectDigest: digest(subjectBytes),
+    predicateType: PIPELINE_PRODUCT_PREDICATE,
+  };
+}
+
+export function verifyPipelineSigning({
+  plan,
+  materialization,
+  qualified,
+  bundlePath,
+  directory,
+  token,
+  execute = execFileSync,
+  evaluatedAt,
+}) {
+  const prepared = preparePipelineSigning({
+    plan,
+    materialization,
+    qualified,
+    directory,
+    evaluatedAt,
+  });
+  const output = execute(
+    "gh",
+    [
+      "attestation",
+      "verify",
+      prepared.subjectPath,
+      "--repo",
+      qualified.source.repository,
+      "--signer-workflow",
+      `${plan.publisher.repository}/${plan.publisher.workflow}`,
+      "--signer-digest",
+      plan.publisher.workflowSha,
+      "--source-digest",
+      qualified.build.providerSource,
+      "--predicate-type",
+      PIPELINE_PRODUCT_PREDICATE,
+      "--bundle",
+      bundlePath,
+      "--deny-self-hosted-runners",
+      "--format",
+      "json",
+    ],
+    {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      maxBuffer: 16 * 1024 * 1024,
+      env: { ...process.env, GH_TOKEN: token },
+    },
+  );
+  const results = JSON.parse(output);
+  const statements = Array.isArray(results)
+    ? results
+        .map((result) => result.verificationResult?.statement)
+        .filter(Boolean)
+    : [];
+  if (
+    statements.length !== 1 ||
+    statements[0].predicateType !== prepared.predicateType ||
+    recordDigest(statements[0].predicate) !==
+      recordDigest(prepared.predicate) ||
+    statements[0].subject?.length !== 1 ||
+    statements[0].subject[0].digest?.sha256 !== prepared.subjectDigest
+  )
+    throw new Error(
+      "Cryptographically verified attestation does not bind the exact publication predicate and subject",
+    );
+  if (digest(fs.readFileSync(prepared.subjectPath)) !== prepared.subjectDigest)
+    throw new Error("Signed publication subject changed during verification");
+  const bundleBytes = fs.readFileSync(bundlePath);
+  return {
+    schema: "buildchain.pipeline-product-signing/v1",
+    verified: true,
+    planRoot: plan.root,
+    materializationRoot: materialization.root,
+    qualificationRoot: qualified.root,
+    subjectDigest: `sha256:${prepared.subjectDigest}`,
+    predicateRoot: recordDigest(prepared.predicate),
+    bundleDigest: `sha256:${digest(bundleBytes)}`,
+    signer: plan.publisher,
+    providerSource: qualified.build.providerSource,
+  };
+}

package/packages/core/publication/pipeline/source-plan.js

@@ -0,0 +1,83 @@
+import { planPipelinePublication } from "./plan.js";
+
+export async function createPipelinePublicationPlan(
+  session,
+  publisherSha,
+  host,
+  version,
+) {
+  const observed = session.observed;
+  const attempt = observed.attempt;
+  const integration = await host.integration.observe({
+    ...observed.history.at(-1),
+    intent: session.intent,
+  });
+  const source = await host.source.source(
+    integration.mergeCommit,
+    observed.history.at(-1).generation.source.configPath,
+  );
+  const route = source.plan.channels.find(
+    (entry) =>
+      entry.to === session.intent.source.targetBranch &&
+      entry.operation !== "develop",
+  );
+  if (!route)
+    throw new Error(
+      "Protected source does not declare this publication channel",
+    );
+  const input = await version.inspect(source.identity, source.plan.version);
+  const runtimeCommit = await host.request(
+    `/repos/${host.runtime.repository}/git/commits/${host.runtime.sha}`,
+  );
+  if (
+    runtimeCommit.sha !== host.runtime.sha ||
+    !/^[0-9a-f]{40}$/u.test(runtimeCommit.tree?.sha || "")
+  )
+    throw new Error("Publication runtime has no exact source tree");
+  const definition = {
+    repository: "kungfu-systems/buildchain",
+    workflow: ".github/workflows/.release-pipeline-products.yml",
+    workflowSha: publisherSha,
+    job: "apply",
+  };
+  const parameters = {
+    attempt,
+    generation: observed.generation,
+    source: source.identity,
+    intentSource: observed.history.at(-1).generation.source,
+    runtime: {
+      repository: host.runtime.repository,
+      commit: runtimeCommit.sha,
+      tree: runtimeCommit.tree.sha,
+    },
+    publisher: definition,
+    contract: source.plan,
+    route,
+    version: input.version,
+    sourceTimestamp: input.sourceTimestamp,
+  };
+  let plan = planPipelinePublication(parameters);
+  const tag = await host.request(
+    `/repos/${host.repository}/git/ref/tags/${encodeURIComponent(plan.tag)}`,
+    { allow404: true },
+  );
+  const channel = `v${plan.version.split(".")[0]}${plan.channel === "alpha" ? "-alpha" : ""}`;
+  const previous = await host.request(
+    `/repos/${host.repository}/git/ref/tags/${channel}`,
+    { allow404: true },
+  );
+  if (
+    previous &&
+    (previous.object?.type !== "commit" ||
+      !/^[0-9a-f]{40}$/u.test(previous.object.sha))
+  )
+    throw new Error(
+      "Publication channel requires an exact lightweight commit ref",
+    );
+  plan = planPipelinePublication({
+    ...parameters,
+    expectedTagSha: tag?.object?.sha || null,
+    previousChannelCommit: previous?.object?.sha || null,
+  });
+  return plan;
+}

package/packages/core/publication/pipeline/version.js

@@ -0,0 +1,81 @@
+import { parse, stringify } from "smol-toml";
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+function document(file, bytes) {
+  const text = Buffer.isBuffer(bytes) ? bytes.toString("utf8") : bytes;
+  return file.format === "json" ? JSON.parse(text) : parse(text);
+}
+
+function field(value, key) {
+  const names = key.split(".");
+  let parent = value;
+  for (const name of names.slice(0, -1)) {
+    if (
+      ["__proto__", "prototype", "constructor"].includes(name) ||
+      !Object.hasOwn(parent, name) ||
+      !parent[name] ||
+      typeof parent[name] !== "object"
+    )
+      throw new Error(
+        "Version field does not resolve to an owned document key",
+      );
+    parent = parent[name];
+  }
+  const name = names.at(-1);
+  if (
+    ["__proto__", "prototype", "constructor"].includes(name) ||
+    !Object.hasOwn(parent, name) ||
+    typeof parent[name] !== "string"
+  )
+    throw new Error("Version field must be an existing string");
+  return { parent, name };
+}
+
+export function readPipelineVersion(policy, files) {
+  const versions = policy.files.map((file) => {
+    if (!Object.hasOwn(files, file.path))
+      throw new Error(`Missing declared version file: ${file.path}`);
+    const { parent, name } = field(document(file, files[file.path]), file.key);
+    return parent[name];
+  });
+  if (!versions.length || new Set(versions).size !== 1)
+    throw new Error(
+      "All declared version fields must identify the same candidate version",
+    );
+  return versions[0];
+}
+
+export function materializePipelineVersion(policy, files, version) {
+  const before = readPipelineVersion(policy, files);
+  if (policy.strategy === "anchored" && before !== version)
+    throw new Error("Buildchain cannot rewrite anchored version authority");
+  const documents = new Map();
+  for (const file of policy.files) {
+    if (!documents.has(file.path))
+      documents.set(file.path, {
+        file,
+        value: document(file, files[file.path]),
+      });
+    const entry = documents.get(file.path);
+    if (entry.file.format !== file.format)
+      throw new Error("One version document cannot have conflicting formats");
+    const { parent, name } = field(entry.value, file.key);
+    parent[name] = version;
+  }
+  const changes = [...documents].flatMap(([filePath, { file, value }]) => {
+    if (before === version) return [];
+    const content =
+      file.format === "json"
+        ? `${JSON.stringify(value, null, 2)}\n`
+        : stringify(value);
+    return [
+      {
+        path: filePath,
+        before: recordDigest(String(files[filePath])),
+        content,
+        after: recordDigest(content),
+      },
+    ];
+  });
+  return { before, version, changes };
+}

package/packages/core/publication/publication-reproducibility.js

@@ -1,3 +1,4 @@
+import { readNpmPackResult } from "./npm/pack-result.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
@@ -564,8 +565,7 @@ function packPublication({ buildRoot, packageDir, source, toolchain }) {
       label: "npm pack reproducibility candidate",
     },
   );
-  const parsed = JSON.parse(output);
-  const result = Array.isArray(parsed) ? parsed[0] : parsed;
+  const result = readNpmPackResult(output);
   if (!result?.filename || !result?.integrity || !result?.shasum) {
     throw new Error(
       "npm pack reproducibility candidate did not report filename, integrity, and shasum",

package/packages/core/release/promote-candidate/product-provider-adapters.js

@@ -1,3 +1,5 @@
+import { parseNpmView } from "../../publication/npm/registry.js";
+import { readNpmPackResult } from "../../publication/npm/pack-result.js";
 import { createOciPublicationAdapter } from "./oci-provider.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
@@ -306,8 +308,7 @@ function createPackedPackage(context) {
         { cwd: context.cwd, encoding: "utf8" },
         "npm pack",
       );
-      const payload = JSON.parse(String(result.stdout || "[]"));
-      const pack = Array.isArray(payload) ? payload[0] : payload;
+      const pack = readNpmPackResult(String(result.stdout || "[]"));
       if (
         pack?.name !== context.intent.packageName ||
         pack?.version !== context.intent.version ||
@@ -363,7 +364,7 @@ async function npmReadback(context, packedPackage, effect) {
         "npm-readback-failed",
       );
     }
-    const integrity = JSON.parse(String(result.stdout || '""'));
+    const { integrity } = parseNpmView(result.stdout);
     if (integrity !== expected.integrity) return conflict("npm-integrity-conflict");
     return observed(effect, {
       kind: "npm-package",

package/packages/core/release/promote-ref/internal/npm-existing-evidence.js

@@ -1,3 +1,4 @@
+import { parseNpmView } from "../../../publication/npm/registry.js";
 import { npmPackageSpec } from "./publish-contract.js";
 import { execNpmSync } from "./npm-distribution.js";
 import fs from "node:fs";
@@ -14,7 +15,7 @@ export function readExistingNpmIntegrity({ cwd, artifact }) {
     if (!output) {
       throw new Error("empty dist.integrity");
     }
-    return JSON.parse(output);
+    return parseNpmView(output).integrity;
   } catch (error) {
     const message = error.stderr?.toString?.().trim() || error.message;
     throw new Error(

package/packages/core/release/promote-ref/internal/publish-command.js

@@ -1,3 +1,4 @@
+import { readNpmPackResult } from "../../../publication/npm/pack-result.js";
 import { npmPublishTransaction } from "../../../publication/npm/transaction.js";
 import { npmPublicationEnvironment } from "../../../publication/npm/environment.js";
 import {
@@ -15,10 +16,21 @@ import {
   updateVersionStateContents,
 } from "../../version-state.js";
 import { publishTransactionEnvironment } from "./transaction-context.js";
-export function runPublishCommand({ cwd, command, provider, loadedConfig, env }) {
+export function runPublishCommand({
+  cwd,
+  command,
+  provider,
+  loadedConfig,
+  env,
+}) {
   if (provider) {
-    if (provider.kind !== "npm" || !provider.directory || command) throw new Error("Invalid or ambiguous declarative publication provider");
-    npmPublishTransaction({ cwd: path.resolve(cwd, provider.directory), publication: npmPublicationEnvironment(env), env: { ...process.env, ...env } });
+    if (provider.kind !== "npm" || !provider.directory || command)
+      throw new Error("Invalid or ambiguous declarative publication provider");
+    npmPublishTransaction({
+      cwd: path.resolve(cwd, provider.directory),
+      publication: npmPublicationEnvironment(env),
+      env: { ...process.env, ...env },
+    });
     return "provider:npm";
   }
   const lifecyclePublish = getLifecycleStage(loadedConfig, "publish");
@@ -64,7 +76,7 @@ export function rematerializedNpmPackEnvironment({
     path.join(os.tmpdir(), "buildchain-rematerialized-npm-"),
   );
   try {
-    const packed = JSON.parse(
+    const result = readNpmPackResult(
       execNpmSync(
         [
           "pack",
@@ -82,7 +94,6 @@ export function rematerializedNpmPackEnvironment({
         },
       ),
     );
-    const result = Array.isArray(packed) ? packed[0] : packed;
     if (!result?.filename)
       throw new Error("rematerialized npm pack did not return a filename");
     if (result.name !== pkg.name || result.version !== version) {

package/packages/core/runtime/domain-wasm-artifact.js

@@ -2,6 +2,6 @@
 export const DOMAIN_WASM_ABI_VERSION = 1;
 export const DOMAIN_WASM_RUSTC = "rustc 1.96.0 (ac68faa20 2026-05-25)";
 export const DOMAIN_WASM_SOURCE_SHA256 =
-  "83550684878224e6820594a44fc48f805c5ed1b3182ac32ebeb51b74cfd20a7f";
+  "9275a02bbc3daac66cac3021384bcaaf43bd52ed9af56b4f1ac67f1cbc69fb71";
 export const DOMAIN_WASM_SHA256 =
-  "504e23c9241f43611813f0fbd213b7a694946328b00e23d22f6ba678e7b0c841";
+  "d42ab5ae8d42253d40ab49057e460285a848925cece176c4d68e63e90ca86c72";

package/packages/core/runtime/entry/actions.js

@@ -1,45 +1,38 @@
 import { resolveRecoverySource } from "./recovery.js";
 import { getOctokit } from "@actions/github";
 import { runtimeEntryProvider } from "./github.js";
+import { resolveRuntimeActionSource } from "./source.js";
 import {
   preparedRuntimeSelection,
   selectExecutionRuntime,
 } from "./selection.js";
+import { selectAttemptRecoveryRuntime } from "./attempt.js";
 
 export async function selectExecutionRuntimeAction(
   core,
   env,
-  { providerFactory = runtimeEntryProvider, githubFactory = getOctokit } = {},
+  {
+    providerFactory = runtimeEntryProvider,
+    githubFactory = getOctokit,
+    pipelineLookup,
+  } = {},
 ) {
   const retained = core.getInput("selection");
   const transport = retained
     ? preparedRuntimeSelection(JSON.parse(retained))
     : undefined;
   const github = githubFactory(core.getInput("token", { required: true }));
-  let source = {
-    repository: core.getInput("source-repository") || env.GITHUB_REPOSITORY,
-    sha: core.getInput("source-sha") || env.GITHUB_SHA,
-    ref: env.GITHUB_REF,
-  };
-  const resumeRunId = core.getInput("resume-run-id");
-  if (resumeRunId) {
-    const reader = providerFactory(github, {
-      sourceRepository: source.repository,
-      sourceSha: source.sha,
-      actor: env.GITHUB_ACTOR,
-      eventName: env.GITHUB_EVENT_NAME,
-    });
-    await reader.authorize({ origin: "runtime-parameter" });
-    source = await resolveRecoverySource(
-      {
-        repository: source.repository,
-        runId: resumeRunId,
-        currentRunId: env.GITHUB_RUN_ID,
-        workflow: env.GITHUB_WORKFLOW_REF?.slice(source.repository.length + 1),
-      },
-      reader.readRun,
-    );
-  }
+  const {
+    source: resolvedSource,
+    continuation,
+    resumeRunId,
+    pipelineAttempt,
+  } = await resolveRuntimeActionSource(core, env, {
+    providerFactory,
+    github,
+    pipelineLookup,
+  });
+  let source = resolvedSource;
   const provider = providerFactory(github, {
     sourceRepository: source.repository,
     sourceSha: source.sha,
@@ -91,6 +84,15 @@ export async function selectExecutionRuntimeAction(
       selection.source?.sha !== source.sha
     )
       throw new Error("Runtime transport changed the admitted consumer source");
+  } else if (continuation?.recovery && (!runtimeRef || pipelineAttempt)) {
+    if (runtimeRef)
+      throw new Error(
+        "An admitted recovery runtime can change only through a new recovery attempt",
+      );
+    selection = await selectAttemptRecoveryRuntime(
+      continuation.recovery,
+      provider,
+    );
   } else {
     selection = await selectExecutionRuntime(
       {

package/packages/core/runtime/entry/attempt.js

@@ -0,0 +1,25 @@
+import { validateRuntime } from "../../release/discussion/envelope.js";
+import { selectExecutionRuntime } from "./selection.js";
+
+// This input is read from the canonical current attempt, never from workflow
+// inputs. Continuation retains its admitted repair without reopening an override.
+export async function selectAttemptRecoveryRuntime(recovery, provider) {
+  validateRuntime(recovery.runtime);
+  if (
+    !/^attempt-[0-9a-f]{64}$/u.test(recovery.attempt || "") ||
+    !/^sha256:[0-9a-f]{64}$/u.test(recovery.recordRoot || "") ||
+    recovery.runtime.repository !== "kungfu-systems/buildchain"
+  )
+    throw new Error(
+      "Attempt runtime continuation requires its canonical recovery admission",
+    );
+  const selected = await selectExecutionRuntime(
+    { runtimeRef: recovery.runtime.sha },
+    {
+      ...provider,
+      authorize: (input) =>
+        provider.authorize({ ...input, origin: "attempt-recovery" }),
+    },
+  );
+  return { ...selected, origin: "attempt-recovery", recovery };
+}

package/packages/core/runtime/entry/selection.js

@@ -1,3 +1,6 @@
+import { consumerContractLock } from "../../consumer/contract/identity.js";
+import { canonicalJson } from "../../release/discussion/envelope.js";
+
 const exactSha = /^[a-f0-9]{40}$/iu;
 const repository = "kungfu-systems/buildchain";
 const trainRef =
@@ -28,6 +31,14 @@ export function runtimeSelector({ runtimeRef = "", lock, workflowSha }) {
     return { ref: runtimeRef, origin: "runtime-parameter" };
   }
   if (lock) {
+    if (lock.schema === "buildchain.consumer-contract-lock/v2") {
+      const validated = consumerContractLock(lock);
+      if (canonicalJson(validated) !== canonicalJson(lock))
+        throw new Error(
+          "Minimal consumer contract lock contains unsupported fields",
+        );
+      return { ref: validated.runtime.sha, origin: "consumer-contract-lock" };
+    }
     if (lock.contract !== "kungfu-buildchain-contract-lock")
       throw new Error("Unsupported Buildchain contract lock");
     const sha = commit(lock.buildchain?.resolvedSha, "Contract lock runtime");
@@ -92,6 +103,9 @@ export async function selectExecutionRuntime(
     ...(selected.origin === "contract-lock"
       ? { contract: { digest: request.lock.buildchain.contractDigest } }
       : {}),
+    ...(selected.origin === "consumer-contract-lock"
+      ? { contract: { consumerConfigDigest: request.lock.configDigest } }
+      : {}),
     class:
       selected.origin === "contract-lock" &&
       request.lock.buildchain.ref === "v4-alpha"