@kungfu-tech/buildchain 4.1.3-alpha.2 → 4.1.3-alpha.4

package/packages/core/release/stable-release-gate.js

@@ -184,8 +184,19 @@ export function evaluateStableReleaseGate({
     "version-bound impact declares a summary and at least one surface",
     { summary: string(impact?.summary), surfaceIds: surfaceImpacts.map((entry) => string(entry?.id)).filter(Boolean) },
   ));
+  checks.push(check(
+    string(impact?.release?.version) === candidateTag.replace(/^v/, ""),
+    "stable.impact_version",
+    "product impact belongs to the exact candidate version",
+    { expectedVersion: candidateTag.replace(/^v/, ""), observedVersion: string(impact?.release?.version) },
+  ));
 
   const canaryById = new Map(canaries.map((canary) => [string(canary?.id), canary]));
+  checks.push(check(
+    canaryById.size === canaries.length,
+    "canary.evidence_inventory",
+    "each canary has one unambiguous observation",
+  ));
   const canaryCompletionTimes = [];
   for (const required of policy.requiredCanaries) {
     const evidence = canaryById.get(required.id);

package/packages/core/workflow/attempt/identity.js

@@ -67,7 +67,7 @@ export function pipelineIntent({
   });
 }
 
-export function sourceGeneration(intent, source, baseCommit) {
+export function validateConsumerSource(source, repository) {
   object(
     source,
     [
@@ -86,13 +86,18 @@ export function sourceGeneration(intent, source, baseCommit) {
   if (
     source.schema !== "buildchain.consumer-source/v1" ||
     source.contract !== CONSUMER_CONTRACT ||
-    source.repository !== intent.repository
+    source.repository !== repository
   )
     throw new Error("Generation requires the admitted consumer source");
   for (const key of ["commit", "tree", "configBlob"])
     text(source[key], `source.${key}`, /^[0-9a-f]{40}$/u);
   relativePath(source.configPath, "source.configPath");
   text(source.configDigest, "source.configDigest", ROOT);
+  return source;
+}
+
+export function sourceGeneration(intent, source, baseCommit) {
+  validateConsumerSource(source, intent.repository);
   text(baseCommit, "baseCommit", /^[0-9a-f]{40}$/u);
   const value = {
     schema: SOURCE_GENERATION,

package/packages/core/workflow/pipeline/actions.js

@@ -6,6 +6,7 @@ import { pipelineHost } from "./host.js";
 import { controlPipeline } from "./controller.js";
 import { buildPipelineSource } from "./build.js";
 import { recordPipelineBuild } from "./build-control.js";
+import { wakePipelineStableWait } from "../../publication/pipeline/stable-wait.js";
 import {
   RECOVERY_BUILD_CONTEXT,
   recordRecoveryBuild,
@@ -57,6 +58,18 @@ export async function recordPipelineBuildAction(core, env) {
 }
 
 export async function wakePipelineAction(core, env) {
-  const host = await pipelineHost(core, env, "Record delivery attempt");
+  const waiting = core.getInput("stable-wait");
+  const host = await pipelineHost(
+    core,
+    env,
+    waiting ? "Recheck stable publication" : "Record delivery attempt",
+  );
+  if (waiting) {
+    const wait = JSON.parse(waiting);
+    if (wait.attempt !== core.getInput("attempt", { required: true }))
+      throw new Error("Stable wake changed its exact business attempt");
+    core.info(JSON.stringify(await wakePipelineStableWait(wait, host)));
+    return;
+  }
   await host.wake(core.getInput("attempt", { required: true }));
 }

package/packages/core/workflow/pipeline/build-result.js

@@ -37,6 +37,14 @@ export async function retainPipelineBuildResult(
   session,
   host,
 ) {
+  if (
+    readback.outcome === "success" &&
+    session.intent.expectedNodes.includes("publish")
+  )
+    await host.qualifyChannel(
+      context.source,
+      session.intent.source.targetBranch,
+    );
   const reference = await resultReference(context, readback, session, host);
   await session.progress.progress({
     attempt: context.attempt,

package/packages/core/workflow/pipeline/build.js

@@ -1,12 +1,57 @@
 import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { bindConsumerSource } from "../../consumer/contract/identity.js";
 import { recordDigest } from "../../release/discussion/envelope.js";
 import { consumerCommandSession } from "../../runtime/consumer-shell.js";
 import { createNativeChildEnvironment } from "../../dev-delivery/native/execution.js";
 
-function sourceCheckout(cwd, expected) {
+function inspectTrackedBytes(cwd, tree) {
+  const root = fs.realpathSync(cwd);
+  const entries = execFileSync(
+    "git",
+    ["-C", root, "ls-tree", "-r", "-z", tree],
+    {
+      encoding: "utf8",
+      maxBuffer: 16 * 1024 * 1024,
+    },
+  )
+    .split("\0")
+    .filter(Boolean);
+  for (const entry of entries) {
+    const match =
+      /^(100644|100755|120000) blob ([0-9a-f]{40})\t([\s\S]+)$/u.exec(entry);
+    if (!match) throw new Error("Build source requires resolved tracked files");
+    const [, mode, blob, file] = match;
+    const absolute = path.join(root, file);
+    if (fs.realpathSync(path.dirname(absolute)) !== path.dirname(absolute))
+      throw new Error(`Build source parent became a symbolic link: ${file}`);
+    const stat = fs.lstatSync(absolute);
+    const link = mode === "120000";
+    if (link ? !stat.isSymbolicLink() : !stat.isFile())
+      throw new Error(`Build tracked source kind changed: ${file}`);
+    if (
+      !link &&
+      process.platform !== "win32" &&
+      Boolean(stat.mode & 0o111) !== (mode === "100755")
+    )
+      throw new Error(`Build tracked source executable mode changed: ${file}`);
+    const bytes = link
+      ? fs.readlinkSync(absolute, { encoding: "buffer" })
+      : fs.readFileSync(absolute);
+    const actual = createHash("sha1")
+      .update(`blob ${bytes.length}\0`)
+      .update(bytes)
+      .digest("hex");
+    if (actual !== blob)
+      throw new Error(
+        `Build tracked source bytes differ from the admitted tree: ${file}`,
+      );
+  }
+}
+
+export function inspectPipelineSource(cwd, expected) {
   const git = (...args) =>
     execFileSync("git", ["-C", cwd, ...args], {
       encoding: "utf8",
@@ -36,6 +81,8 @@ function sourceCheckout(cwd, expected) {
     throw new Error(
       "Build source has tracked modifications at its verification boundary",
     );
+  // Index flags and local Git filters cannot qualify different product bytes.
+  inspectTrackedBytes(cwd, expected.tree);
   return plan;
 }
 
@@ -54,7 +101,7 @@ function productDirectory(cwd, product) {
 // jobs must bind provider completion and exact artifacts before granting reuse.
 export async function buildPipelineSource(
   { cwd, source, platform, environment = process.env },
-  { inspect = sourceCheckout, session = consumerCommandSession } = {},
+  { inspect = inspectPipelineSource, session = consumerCommandSession } = {},
 ) {
   const plan = inspect(cwd, source);
   const result = await buildPipelineProducts(

package/packages/core/workflow/pipeline/channel-control.js

@@ -68,6 +68,10 @@ export async function controlPipelineChannel(session, admission, inputs, host) {
   }
   if (host.terminalOnly)
     return { operation: "wait", reason: "terminal-event-cannot-execute" };
+  const qualification = await host.qualifyChannel(
+    live.source,
+    live.targetBranch,
+  );
   const build = await pipelineBuildEvidence(session, host);
   if (!build) return { operation: "build", admission };
   if (build.run.status !== "completed" || build.run.conclusion !== "success")
@@ -97,7 +101,12 @@ export async function controlPipelineChannel(session, admission, inputs, host) {
     session,
     "merge",
     "waiting",
-    { schema: "buildchain.pipeline-channel-enqueue/v1", policy, queue },
+    {
+      schema: "buildchain.pipeline-channel-enqueue/v1",
+      qualification,
+      policy,
+      queue,
+    },
     host,
   );
   const again = await host.source.observeIntent(

package/packages/core/workflow/pipeline/channel-source.js

@@ -0,0 +1,53 @@
+import { recordDigest } from "../../release/discussion/envelope.js";
+import { selectProductPublicationIntent } from "../../release/product-publication.js";
+import { pipelineExpectedProducts } from "../../publication/pipeline/plan.js";
+import { githubPipelineVersion } from "../../providers/github/pipeline-version.js";
+
+// This read-only qualification must precede both required checks and queue
+// admission. Publication repeats the Rust-owned decision after protected merge.
+export async function qualifyPipelineChannelSource(source, branch, host) {
+  if (branch.startsWith("dev/")) return null;
+  const admitted = await host.source.source(source.commit, source.configPath);
+  if (recordDigest(admitted.identity) !== recordDigest(source))
+    throw new Error("Channel qualification source identity drift");
+  const { plan } = admitted;
+  const routes = plan.channels.filter(
+    (route) => route.to === branch && route.operation !== "develop",
+  );
+  if (routes.length !== 1)
+    throw new Error("Channel qualification requires one publication route");
+  const route = routes[0];
+  const from = `${route.operation === "alpha" ? "dev" : "alpha"}/${branch.split("/").slice(1).join("/")}`;
+  if (["alpha", "stable"].includes(route.operation) && route.from !== from)
+    throw new Error("Channel source and target version lines must match");
+  const version = await githubPipelineVersion(
+    host.request,
+    host.repository,
+  ).inspect(source, plan.version);
+  const selection = selectProductPublicationIntent({
+    channel: route.operation === "alpha" ? "alpha" : "stable",
+    targetRef: branch,
+    sourceSha: source.commit,
+    sourceTimestamp: version.sourceTimestamp,
+    repository: source.repository,
+    artifactKind: "custom",
+    requiredArtifactsRoot: recordDigest(pipelineExpectedProducts(plan)),
+    candidateVersion: version.version,
+    observedVersions: [],
+  });
+  if (
+    plan.version.strategy === "anchored" &&
+    selection.version !== version.version
+  )
+    throw new Error("Anchored channel source requires a materialized version");
+  const body = {
+    schema: "buildchain.pipeline-channel-source-qualification/v1",
+    source,
+    route,
+    contractRoot: recordDigest(plan),
+    version: version.version,
+    versionFilesRoot: recordDigest(version.files),
+    selection,
+  };
+  return { ...body, root: recordDigest(body) };
+}

package/packages/core/workflow/pipeline/group-control.js

@@ -36,6 +36,8 @@ export async function recordPipelineGroup(context, host) {
     context.source,
     context.platforms.map((platform) => platform.platform),
   );
+  if (readback.outcome === "success")
+    await host.qualifyChannel(context.source, context.branch);
   await host.request(`/repos/${host.repository}/check-runs`, {
     method: "POST",
     body: {

package/packages/core/workflow/pipeline/host.js

@@ -17,6 +17,7 @@ import { GitHubClient } from "../../dev-delivery/admission/github-client.js";
 import { githubPipelineIntegration } from "../../providers/github/pipeline-integration.js";
 import { recordPipelineGroup } from "./group-control.js";
 import { controlPipelineChannel } from "./channel-control.js";
+import { qualifyPipelineChannelSource } from "./channel-source.js";
 import { settlePipeline } from "./settlement.js";
 import { pipelineProjection } from "./projection.js";
 import { resumePipelineNotifications } from "./notifications.js";
@@ -48,6 +49,24 @@ export async function pipelineHost(core, env, jobName) {
   const writer = await runs.writer(runId, runAttempt, jobName);
   const source = githubPipelineSource(request, repository);
   const [owner, repo] = repository.split("/");
+  const archives = new Map();
+  function archive(session) {
+    if (!archives.has(session.intent.id))
+      archives.set(
+        session.intent.id,
+        discussionMaterials({
+          octokit: github,
+          repository,
+          intentId: session.intent.id,
+          // Storage is partitioned by verified provider job, not attempt authority.
+          // Journal references still select exact immutable asset IDs and digests.
+          partition: `${writer.runId}-${writer.runAttempt}-${writer.jobId}`,
+          authorityDescription:
+            "The canonical Buildchain intent Git journal owns transaction state.",
+        }),
+      );
+    return archives.get(session.intent.id);
+  }
   const host = {
     repository,
     token,
@@ -70,6 +89,8 @@ export async function pipelineHost(core, env, jobName) {
     groupRecord: (context) => recordPipelineGroup(context, host),
     channel: (session, admission, inputs) =>
       controlPipelineChannel(session, admission, inputs, host),
+    qualifyChannel: (source, branch) =>
+      qualifyPipelineChannelSource(source, branch, host),
     settle: (session, fresh, delivery) =>
       settlePipeline(session, fresh, delivery, host),
     project: (session) =>
@@ -81,24 +102,11 @@ export async function pipelineHost(core, env, jobName) {
     recoverPublication: (session, admitted) =>
       inspectRecoveryPublication(session, admitted, host),
     materialStore: (session) =>
-      pipelineMaterials(
-        discussionMaterials({
-          octokit: github,
-          repository,
-          intentId: session.intent.id,
-          authorityDescription:
-            "The canonical Buildchain intent Git journal owns transaction state.",
-        }),
-        { repository, attempt: session.observed.history.at(-1).identity },
-      ),
-    productArchive: (session) =>
-      discussionMaterials({
-        octokit: github,
+      pipelineMaterials(archive(session), {
         repository,
-        intentId: session.intent.id,
-        authorityDescription:
-          "The canonical Buildchain intent Git journal owns transaction state.",
+        attempt: session.observed.history.at(-1).identity,
       }),
+    productArchive: archive,
     wake: async (attempt) => {
       await index.resolve(attempt);
       await request(`/repos/${repository}/dispatches`, {

package/packages/core/workflow/pipeline/selection.js

@@ -10,8 +10,12 @@ async function successorSelection(
   inputs,
   host,
 ) {
+  const failedBuild =
+    session.observed.status === "failure" &&
+    session.observed.phases.build?.payload.state === "failure";
   if (
-    !["superseded", "cancelled"].includes(session.observed.status) ||
+    (!failedBuild &&
+      !["superseded", "cancelled"].includes(session.observed.status)) ||
     event.terminalOnly ||
     admission.live.state !== "open" ||
     admission.live.targetBranch !== session.intent.source.targetBranch
@@ -27,9 +31,10 @@ async function successorSelection(
       .id !== session.observed.generation;
   if (
     !changed &&
-    !["reopened", "enqueued", "ready_for_review", "labeled"].includes(
-      payload.action,
-    )
+    (failedBuild ||
+      !["reopened", "enqueued", "ready_for_review", "labeled"].includes(
+        payload.action,
+      ))
   )
     return { session, admission };
   await host.notifyTerminal?.(session);

package/scripts/check-pipeline-publication-topology.mjs

@@ -12,6 +12,7 @@ export function assertPipelinePublicationTopology(
     ".github/workflows/public-ops-pipeline.yml",
     ".github/workflows/public-ops-recover.yml",
     ".github/workflows/.ops-pipeline-execute.yml",
+    ".github/workflows/.release-pipeline-version.yml",
   ]);
   const pipelineTopology = discoverReleaseTopology(
     pipeline.workflowPaths,
@@ -33,4 +34,15 @@ export function assertPipelinePublicationTopology(
         module,
       ),
     );
+  const version = ".github/workflows/.release-pipeline-version.yml";
+  assert.ok(
+    inspectWorkflowJob(version, "build", root).modules.has(
+      "packages/core/publication/pipeline/version-build.js",
+    ),
+  );
+  assert.ok(
+    inspectWorkflowJob(version, "materialize", root).modules.has(
+      "packages/core/publication/pipeline/version-context.js",
+    ),
+  );
 }

package/scripts/check-release-topology.mjs

@@ -30,6 +30,7 @@ const PRIVILEGED_ENTRYPOINTS = [
   "packages/core/publication/oci/preview-actions.js",
   "packages/core/publication/settlement/actions.js",
   "packages/core/publication/pipeline/actions.js",
+  "packages/core/publication/pipeline/version-actions.js",
 ];
 
 export function localModuleSpecifiers(source) {

package/scripts/generate-site-bundle.mjs

@@ -1343,7 +1343,7 @@ function buildSiteBundle() {
     "badge-endpoint-registry.json": badgeEndpointRegistry,
     "publication-registry.json": publicationRegistry,
     "buildchain-contract.json": createBuildchainContractWorld({ root, controllerRegistry }),
-    "kfd-upstream-aggregate.json": collectKfdUpstreamFacts({ cwd: root, includeOwn: false }),
+    "kfd-upstream-aggregate.json": collectKfdUpstreamFacts({ cwd: root, components: readJson("architecture/product-upstreams.json"), includeOwn: false }),
     "kfd-claims.json": createBuildchainKfdClaimRegistry({ root }),
     "product-mechanism.json": productMechanism,
     "release-provenance.json": releaseProvenance,

package/scripts/verify-standalone-product.mjs

@@ -0,0 +1,42 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  platformTriple,
+  packageVersion,
+  sourceSha,
+} from "../packages/core/build/standalone/identity.js";
+
+const cwd = process.cwd();
+const manifest = JSON.parse(
+  fs.readFileSync(
+    path.join(cwd, "dist/binary", `buildchain-${platformTriple()}.json`),
+    "utf8",
+  ),
+);
+const version = packageVersion(cwd);
+assert.equal(manifest.version, version);
+assert.equal(manifest.sourceSha, sourceSha(cwd));
+assert.equal(manifest.platform, platformTriple());
+const binary = path.join(
+  cwd,
+  "dist/binary",
+  process.platform === "win32" ? "buildchain.exe" : "buildchain",
+);
+assert.equal(
+  createHash("sha256").update(fs.readFileSync(binary)).digest("hex"),
+  manifest.sha256,
+);
+assert.equal(
+  execFileSync(binary, ["--version"], { encoding: "utf8" }).trim(),
+  version,
+);
+assert.match(
+  execFileSync(binary, ["help"], { encoding: "utf8" }),
+  /^Usage:\s+buildchain --help/mu,
+);
+process.stdout.write(
+  `Verified standalone product ${platformTriple()} at ${version}\n`,
+);