@kungfu-tech/buildchain 4.1.3-alpha.4 → 4.1.3-alpha.6

package/packages/core/workflow/pipeline/host.js

@@ -24,6 +24,24 @@ import { resumePipelineNotifications } from "./notifications.js";
 import { projectPipelineStatus } from "./web-status.js";
 import { inspectRecoveryPublication } from "../../publication/pipeline/recovery-inspection.js";
 
+export function pipelineQueue({ queueToken, ...options }) {
+  const reader = new GitHubClient(options);
+  return {
+    getMergeQueueState: (branch) => reader.getMergeQueueState(branch),
+    enqueuePullRequest: async (input) => {
+      // GITHUB_TOKEN enqueue suppresses the merge_group workflow it requires.
+      if (!queueToken || queueToken === options.token)
+        throw new Error(
+          "Channel enqueue requires a distinct App or automation credential",
+        );
+      return new GitHubClient({
+        ...options,
+        token: queueToken,
+      }).enqueuePullRequest(input);
+    },
+  };
+}
+
 export async function pipelineHost(core, env, jobName) {
   const token = core.getInput("token", { required: true });
   const repository = env.GITHUB_REPOSITORY;
@@ -84,7 +102,11 @@ export async function pipelineHost(core, env, jobName) {
     source,
     workers: githubPipelineWorker(request),
     policy: githubPipelinePolicy(request, repository),
-    queue: new GitHubClient({ repository: { owner, repo }, token }),
+    queue: pipelineQueue({
+      repository: { owner, repo },
+      token,
+      queueToken: core.getInput("queue-token"),
+    }),
     integration: githubPipelineIntegration(request, repository, source, runs),
     groupRecord: (context) => recordPipelineGroup(context, host),
     channel: (session, admission, inputs) =>

package/packages/core/workflow/pipeline/integration-status.js

@@ -0,0 +1,113 @@
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+// The landing job already owns statuses:write. Keep its exact admission alive
+// through the actual queue result so later channel PRs need not borrow the
+// temporary queue branch's Actions check suite.
+async function observeProtectedQueue(current, ports) {
+  const { repository, request, queue } = ports;
+  const now = ports.now || Date.now;
+  const pause =
+    ports.pause || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const deadline = now() + 120 * 60 * 1000;
+  const number = current.intent.source.pullRequest;
+  const branch = current.intent.source.targetBranch;
+  let queueExitAt;
+  while (true) {
+    const pr = await request(`/repos/${repository}/pulls/${number}`);
+    if (
+      pr.head?.sha !== current.generation.source.commit ||
+      pr.head?.repo?.full_name !== repository ||
+      pr.base?.repo?.full_name !== repository ||
+      pr.base?.ref !== branch
+    )
+      throw new Error("Integrated status lost its exact admitted PR source");
+    if (pr.merged) return { pr, deadline, now, pause };
+    if (now() >= deadline)
+      throw new Error(
+        "Protected queue did not complete the admitted integration",
+      );
+    const pending = await queue(branch);
+    if (
+      pr.state !== "open" ||
+      !pending.enabled ||
+      !pending.entries.some(
+        (entry) =>
+          entry.pullRequestNumber === number &&
+          entry.pullRequestHeadSha === current.generation.source.commit,
+      )
+    ) {
+      // Queue removal can precede the PR endpoint's merged readback. Bound
+      // convergence without treating absence or a closed PR as merge evidence.
+      queueExitAt ??= now();
+      if (now() - queueExitAt >= 30_000)
+        throw new Error("Admitted PR left its protected merge queue");
+    } else queueExitAt = undefined;
+    await pause(10000);
+  }
+}
+
+async function observeIntegrationWorkflow(merged, ports) {
+  const { pr, deadline, now, pause } = merged;
+  if (!/^[0-9a-f]{40}$/u.test(pr.merge_commit_sha || ""))
+    throw new Error("Merged PR has no exact integration commit");
+  while (true) {
+    const result = await ports.request(
+      `/repos/${ports.repository}/actions/runs?event=merge_group&head_sha=${pr.merge_commit_sha}&per_page=100`,
+    );
+    if (!Array.isArray(result.workflow_runs) || result.total_count > 100)
+      throw new Error("Integration workflow inventory exceeds its bound");
+    const runs = result.workflow_runs.filter(
+      (run) =>
+        run.path?.split("@")[0] === ".github/workflows/buildchain.yml" &&
+        run.event === "merge_group" &&
+        run.head_sha === pr.merge_commit_sha,
+    );
+    if (
+      runs.some(
+        (run) => run.status === "completed" && run.conclusion === "success",
+      )
+    )
+      return;
+    if (!runs.some((run) => run.status !== "completed") || now() >= deadline)
+      throw new Error("Merged integration has no successful queue workflow");
+    await pause(10000);
+  }
+}
+
+function validateIntegratedStatus(proof, current, repository) {
+  const { root, ...body } = proof;
+  if (
+    recordDigest(body) !== root ||
+    proof.repository !== repository ||
+    proof.pullRequest !== current.intent.source.pullRequest ||
+    proof.sourceHead !== current.generation.source.commit ||
+    proof.branch !== current.intent.source.targetBranch ||
+    proof.build.source.commit !== proof.mergeCommit ||
+    proof.build.source.repository !== repository ||
+    proof.build.outcome !== "success" ||
+    proof.run.conclusion !== "success" ||
+    proof.run.status !== "completed" ||
+    proof.run.event !== "merge_group" ||
+    proof.run.head_sha !== proof.mergeCommit
+  )
+    throw new Error("Integrated status differs from its verified queue result");
+}
+
+export async function publishIntegratedPipelineStatus(current, ports) {
+  const merged = await observeProtectedQueue(current, ports);
+  await observeIntegrationWorkflow(merged, ports);
+  const { repository, integration, status } = ports;
+  const proof = await integration.observe(current);
+  validateIntegratedStatus(proof, current, repository);
+  const { root } = proof;
+  await status(`/repos/${repository}/statuses/${proof.mergeCommit}`, {
+    method: "POST",
+    body: {
+      context: "check",
+      state: "success",
+      description: `Qualified protected integration: ${root}`.slice(0, 140),
+      target_url: `https://github.com/${repository}/actions/runs/${proof.run.id}/attempts/${proof.run.run_attempt}`,
+    },
+  });
+  return proof;
+}

package/packages/core/workflow/pipeline/record-action.js

@@ -0,0 +1,27 @@
+import { pipelineHost } from "./host.js";
+import { recordPipelineBuild } from "./build-control.js";
+import { publishRecorderStatus } from "./recorder-status.js";
+import {
+  RECOVERY_BUILD_CONTEXT,
+  recordRecoveryBuild,
+} from "./recovery-build-control.js";
+
+export async function recordPipelineBuildAction(core, env) {
+  const host = await pipelineHost(core, env, "Record product build");
+  host.publishBuildStatus = (context, readback) =>
+    publishRecorderStatus(context, readback, host);
+  const context = JSON.parse(core.getInput("context", { required: true }));
+  if (context.schema === "buildchain.pipeline-group-build-context/v1")
+    return host.groupRecord(context);
+  const result =
+    context.schema === RECOVERY_BUILD_CONTEXT
+      ? await recordRecoveryBuild(context, host)
+      : await recordPipelineBuild(context, host);
+  if (result.outcome !== "success")
+    throw new Error("Product build did not succeed");
+  core.info(
+    result.wakePending
+      ? "Build retained; next event will retry delivery wake"
+      : "Build retained and attempt woken",
+  );
+}

package/packages/core/workflow/pipeline/recorder-status.js

@@ -0,0 +1,69 @@
+import { createHash } from "node:crypto";
+import { parse } from "yaml";
+import { publishPipelineBuildStatus } from "./guard-build.js";
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+// A repaired runtime may execute through an older immutable published entry.
+// Read the real recorder job's permission, rather than assuming the runtime's
+// current workflow is the one GitHub scheduled. API failures are never ignored.
+export async function publishRecorderStatus(context, readback, host) {
+  const { root, ...body } = readback;
+  if (
+    context.runId !== host.runId ||
+    context.runAttempt !== host.runAttempt ||
+    readback.runId !== host.runId ||
+    readback.runAttempt !== host.runAttempt ||
+    recordDigest(context.source) !== recordDigest(readback.source) ||
+    root !== recordDigest(body)
+  )
+    throw new Error("Recorder status changed its current source or execution");
+  const { run } = await host.runs.read(host.runId, host.runAttempt);
+  const path = ".github/workflows/.ops-pipeline-execute.yml";
+  const entries = (run.referenced_workflows || []).filter((entry) =>
+    entry.path?.startsWith(`kungfu-systems/buildchain/${path}@`),
+  );
+  if (entries.length !== 1 || !/^[0-9a-f]{40}$/u.test(entries[0].sha || ""))
+    throw new Error("Recorder has no exact published execution workflow");
+  const file = await host.request(
+    `/repos/kungfu-systems/buildchain/contents/${path}?ref=${entries[0].sha}`,
+  );
+  if (
+    file.type !== "file" ||
+    file.encoding !== "base64" ||
+    !Number.isSafeInteger(file.size) ||
+    file.size < 1 ||
+    file.size > 64000 ||
+    typeof file.content !== "string" ||
+    file.content.length > 128000
+  )
+    throw new Error(
+      "Recorder execution workflow is unavailable or exceeds its bound",
+    );
+  const bytes = Buffer.from(file.content, "base64");
+  const blob = createHash("sha1")
+    .update(`blob ${bytes.length}\0`)
+    .update(bytes)
+    .digest("hex");
+  if (bytes.length !== file.size || blob !== file.sha)
+    throw new Error("Recorder execution workflow bytes changed");
+  const job = parse(bytes.toString("utf8")).jobs?.["record-build"];
+  if (job?.name !== "Record product build")
+    throw new Error("Recorder execution workflow changed its job identity");
+  if (job.permissions?.statuses !== "write") return { published: false };
+  if (readback.outcome !== "success") return { published: false };
+  await publishPipelineBuildStatus(
+    {
+      "expected-head-sha": context.source.commit,
+      "source-workflow-run-id": String(readback.runId),
+    },
+    {
+      sourceHead: context.source.commit,
+      outcome: readback.outcome,
+      run: { id: readback.runId, run_attempt: readback.runAttempt },
+      readback,
+    },
+    host.request,
+    host.repository,
+  );
+  return { published: true };
+}

package/packages/core/workflow/workflow-taxonomy.mjs

@@ -20,7 +20,8 @@ const PROTECTED = [
   "scripts/generate-workflow-taxonomy.mjs",
   "scripts/check-workflows.sh",
   "tests/workflow-taxonomy.test.mjs",
-  ".github/workflows/self-build-verify.yml",
+  ".github/workflows/buildchain.yml",
+  ".github/workflows/buildchain-recover.yml",
   "package.json",
   ".buildchain/buildchain.toml",
 ];
@@ -63,12 +64,13 @@ function validateEntries(policy, errors) {
     if (
       entry.path &&
       !(
-        (entry.id === ".build" || entry.id === "build") &&
-        entry.path === `.github/workflows/${entry.id}.yml`
+        [".build", "build", "buildchain", "buildchain-recover"].includes(
+          entry.id,
+        ) && entry.path === `.github/workflows/${entry.id}.yml`
       )
     )
       errors.push(
-        `${entry.id}: explicit path is reserved for the build facade and backbone`,
+        `${entry.id}: explicit path is reserved for build APIs and the generated consumer pair`,
       );
     const file = workflowPath(entry);
     if (!WORKFLOW.test(file) || paths.has(file))
@@ -191,35 +193,53 @@ function validateGateIntegration(root, errors) {
     )
   )
     errors.push("required check chain does not enforce check:workflows");
-  const { parse: parseToml } = createRequire(import.meta.url)("smol-toml");
-  const config = parseToml(read(".buildchain/buildchain.toml"));
+  const require = createRequire(import.meta.url);
+  const { parse: parseYaml } = require("yaml");
+  const { compileConsumerPlan } = require("../consumer/contract/plan.js");
+  const { consumerWorkflows } = require("../consumer/contract/entries.js");
+  const config = compileConsumerPlan(read(".buildchain/buildchain.toml"));
+  for (const platform of ["linux-x64", "macos-arm64", "windows-x64"])
+    if (
+      !config.products.some(
+        (product) =>
+          product.platforms.includes(platform) &&
+          product.verify.includes("corepack pnpm@11.7.0 run check") &&
+          product.verify.includes("node scripts/verify-product-platform.mjs"),
+      )
+    )
+      errors.push(
+        `${platform}: declared product verification must execute the full required check and checkpoint recovery`,
+      );
+  const caller = parseYaml(read(".github/workflows/buildchain.yml"));
+  const channel = caller.jobs?.buildchain?.uses?.split("@").at(-1);
+  const configPath = caller.jobs?.buildchain?.with?.["config-path"];
+  for (const [file, expected] of Object.entries(
+    consumerWorkflows(channel, configPath),
+  ))
+    if (read(file) !== expected)
+      errors.push(`${file}: required generated pipeline caller drift`);
+  const execution = parseYaml(
+    read(".github/workflows/.ops-pipeline-execute.yml"),
+  );
+  const build = execution.jobs?.build;
+  const record = execution.jobs?.["record-build"];
   if (
-    !config.lifecycle?.verify?.commands?.includes(
-      "corepack pnpm@11.7.0 run check",
+    build?.permissions?.contents !== "read" ||
+    Object.values(build?.permissions || {}).includes("write") ||
+    !build?.steps?.some(
+      (step) =>
+        step.uses === "./.buildchain/runtime/actions/workflow/pipeline/build",
+    ) ||
+    ![record?.needs].flat().includes("build") ||
+    !record?.steps?.some(
+      (step) =>
+        step.uses ===
+        "./.buildchain/runtime/actions/workflow/pipeline/record-build",
     )
   )
     errors.push(
-      "declared verify lifecycle must execute the full required check",
+      "required product execution and independent source qualification boundary is missing",
     );
-  const verify = read(".github/workflows/self-build-verify.yml");
-  const document = parseWorkflowDocument(verify);
-  for (const trigger of ["pull_request", "merge_group", "push"]) {
-    if (!document.triggers.some((item) => item.split(":")[0] === trigger))
-      errors.push(`required Verify workflow lacks ${trigger}`);
-  }
-  const checkJob = verify.match(/^  check:\n([\s\S]*?)(?=^  [\w-]+:|(?![\s\S]))/mu)?.[1] || "";
-  const verifyNode = "./.buildchain/runtime/actions/build/verification/repository";
-  const verifyAction = read("actions/build/verification/repository/action.yml");
-  const sourceAction = read("actions/build/verification/qualify-source/action.yml");
-  const sourceVerification = read("packages/core/build/verification/source.js");
-  const sourceLifecycle = read("packages/core/build/source/lifecycle.js");
-  if (!parseYamlUses(checkJob).some(call => call.value === verifyNode) ||
-      !parseYamlUses(verifyAction).some(call => call.value === "./.buildchain/runtime/actions/build/verification/qualify-source") ||
-      !/using: node24/u.test(sourceAction) ||
-      !/qualify = qualifySourceLifecycle/u.test(sourceVerification) ||
-      !/mode: "verify"/u.test(sourceVerification) ||
-      !/lifecycle\(\{[\s\S]*stageName,[\s\S]*required: true/u.test(sourceLifecycle))
-    errors.push("required Verify lifecycle integration is missing");
   const owners = read(".github/CODEOWNERS")
     .split(/\r?\n/u)
     .map((line) => line.trim());
@@ -306,7 +326,7 @@ export function renderWorkflowCatalog(policy) {
     "",
     "Public workflows own the consumer API. Component workflows own reusable multi-job topology. Self workflows own Buildchain repository automation. Actions own execution steps; JS adapters and Rust/WASM own implementation.",
     "",
-    "Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and `self-<category>-<purpose>.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.",
+    "Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and the generated self callers `buildchain.yml` and `buildchain-recover.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.",
     "",
     "Register ownership before adding a workflow. `pnpm run check:workflows` validates source, calls, required CI integration and independent review ownership. `pnpm run generate:workflows` regenerates this catalog.",
     "",
@@ -330,22 +350,22 @@ export function renderWorkflowCatalog(policy) {
 }
 
 function validateEntryOwnership(entry, errors) {
-    for (const field of ["summary", "owner", "rationale"])
-      if (typeof entry[field] !== "string" || !entry[field].trim())
-        errors.push(`${entry.id}: missing ${field}`);
-    if (!["active", "preview"].includes(entry.status))
-      errors.push(`${entry.id}: unsupported lifecycle status`);
-    for (const field of ["compatibility", "migration", "retiredAlias"])
-      if (field in entry)
-        errors.push(
-          `${entry.id}: ${field} is not an executable architecture contract`,
-        );
-    if (
-      !["reusable", "dispatch-service", "repository"].includes(entry.invocation)
-    )
-      errors.push(`${entry.id}: invalid invocation`);
-    if ((entry.role === "self") !== (entry.invocation === "repository"))
-      errors.push(`${entry.id}: role and invocation disagree`);
-    if (entry.role === "component" && entry.invocation !== "reusable")
-      errors.push(`${entry.id}: component must be reusable`);
+  for (const field of ["summary", "owner", "rationale"])
+    if (typeof entry[field] !== "string" || !entry[field].trim())
+      errors.push(`${entry.id}: missing ${field}`);
+  if (!["active", "preview"].includes(entry.status))
+    errors.push(`${entry.id}: unsupported lifecycle status`);
+  for (const field of ["compatibility", "migration", "retiredAlias"])
+    if (field in entry)
+      errors.push(
+        `${entry.id}: ${field} is not an executable architecture contract`,
+      );
+  if (
+    !["reusable", "dispatch-service", "repository"].includes(entry.invocation)
+  )
+    errors.push(`${entry.id}: invalid invocation`);
+  if ((entry.role === "self") !== (entry.invocation === "repository"))
+    errors.push(`${entry.id}: role and invocation disagree`);
+  if (entry.role === "component" && entry.invocation !== "reusable")
+    errors.push(`${entry.id}: component must be reusable`);
 }

package/scripts/check-inventory.mjs

@@ -1,3 +1,4 @@
+import { checkSelfConsumerContract } from "./check-self-consumer-contract.mjs";
 import { assertBinaryInventory } from "./inventory/binary.mjs";
 import YAML from "yaml";
 import { actionInventory } from "../packages/core/contracts/action-inventory.js";
@@ -145,41 +146,29 @@ const requiredPaths = [
   ".buildchain/alpha-contract-lock.json",
   ".buildchain/release-impact.json",
   ".github/actionlint.yaml",
-  ".github/workflows/self-ops-runner-smoke.yml",
-  ".github/workflows/self-release-promote.yml",
-  ".github/workflows/self-release-line-open.yml",
   ".github/workflows/public-ops-release-governance.yml",
   ".github/workflows/public-ops-dev-auto-merge.yml",
-  ".github/workflows/self-ops-dev-delivery.yml",
   ".github/workflows/public-ops-patrol.yml",
   ".github/workflows/public-ops-patrol-daily.yml",
   ".github/workflows/public-ops-patrol-weekly.yml",
   ".github/workflows/public-ops-patrol-monthly.yml",
   ".github/workflows/public-ops-observed-evidence.yml",
-  ".github/workflows/self-ops-patrol-daily.yml",
-  ".github/workflows/self-ops-patrol-weekly.yml",
-  ".github/workflows/self-ops-patrol-monthly.yml",
-  ".github/workflows/self-build-alpha-dogfood.yml",
-  ".github/workflows/self-build-stable-dogfood.yml",
   ".github/workflows/public-release-promote.yml",
   ".github/workflows/.release-promote.yml",
   ".github/workflows/public-release-propagation.yml",
-  ".github/workflows/self-release-npm-dry-run.yml",
   ".github/workflows/public-release-paper.yml",
-  ".github/workflows/self-build-binary-distribution.yml",
   ".github/workflows/.release-binary-assets.yml",
-  ".github/workflows/self-release-binary-assets.yml",
-  ".github/workflows/self-build-verify.yml",
   ".github/workflows/.build.yml",
   ".github/workflows/.build-gate-profile.yml",
   ".github/workflows/.build-demo-adapter.yml",
   ".github/workflows/public-build-demo.yml",
-  ".github/workflows/self-build-demo-dogfood.yml",
   ".github/workflows/build.yml",
-  ".github/workflows/self-build-fixture.yml",
   "fixtures/libnode-shaped/buildchain.toml",
   "fixtures/libnode-shaped/.github/workflows/build.yml",
-  "fixtures/libnode-shaped/package.json"
+  "fixtures/libnode-shaped/package.json",
+  ".github/workflows/buildchain.yml",
+  ".github/workflows/buildchain-recover.yml",
+  "scripts/check-self-consumer-contract.mjs",
 ];
 
 for (const rel of requiredPaths) {
@@ -277,14 +266,7 @@ for (const channel of ["alpha-contract-lock.json", "contract-lock.json"]) {
   if (lock.buildchain.ref !== ref)
     throw new Error(`${channel}: invalid accepted runtime selector`);
 }
-for (const [channel, ref] of [["alpha", `v${selfDogfoodMajor}-alpha`], ["stable", `v${selfDogfoodMajor}`]]) {
-  const workflow = fs.readFileSync(path.join(root, `.github/workflows/self-build-${channel}-dogfood.yml`), "utf8");
-  if (!workflow.includes(`/.github/workflows/build.yml@${ref}`) || /steps:|buildchain-channel:|runner-preset:|working-directory:/u.test(workflow)) throw new Error(`${channel} self-dogfood must remain a thin public TOML build caller`);
-  if (!workflow.includes(`group: buildchain-${channel}-self-dogfood-`) || !workflow.includes("cancel-in-progress: false")) throw new Error(`${channel} self-dogfood must serialize its own runs`);
-  const expectedInputs = [];
-  const call = parseWorkflowCallJobs(workflow).find((job) => job.id === `${channel}-consumer`);
-  if (JSON.stringify(Object.keys(call.with || {})) !== JSON.stringify(expectedInputs)) throw new Error(`${channel} self-dogfood input contract drift`);
-}
+checkSelfConsumerContract(root);
 const reusableBuildWorkflow = fs.readFileSync(
   path.join(root, ".github/workflows/.build.yml"),
   "utf8",
@@ -310,10 +292,6 @@ const channelPromotionWorkflow = fs.readFileSync(
   path.join(root, ".github/workflows/public-release-promote.yml"),
   "utf8",
 );
-const boundedAlphaRecoveryWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/self-ops-promotion-recovery.yml"),
-  "utf8",
-);
 assertPromotionInventory(root);
 for (const workflow of [channelBuildWorkflow, reusableBuildWorkflow]) {
   const block = workflow.split("    inputs:\n")[1].split("    secrets:\n")[0];
@@ -957,11 +935,6 @@ for (const requiredSnippet of [
 if (commonJsSourcePattern.test(standaloneBinaryScript)) {
   throw new Error("scripts/build-standalone-binary.mjs must use ESM syntax");
 }
-const npmPublishWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-release-npm-dry-run.yml"), "utf8");
-const buildchainRefPromotionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-release-promote.yml"), "utf8");
-const binaryDistributionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-build-binary-distribution.yml"), "utf8");
-const binaryReleaseAssetsWorkflow = fs.readFileSync(path.join(root, ".github/workflows/.release-binary-assets.yml"), "utf8");
-const selfHostedRunnerSmokeWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-ops-runner-smoke.yml"), "utf8");
 const npmDryRunScript = fs.readFileSync(path.join(root, "packages/core/publication/npm/preview.js"), "utf8").replace(/\s+/gu, " ");
 const npmPublishTransactionScript = ["transaction", "environment"].map(name => fs.readFileSync(path.join(root, `packages/core/publication/npm/${name}.js`), "utf8")).join("\n");
 const rootPackageJson = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
@@ -977,29 +950,6 @@ if (!["patch", "minor", "major"].includes(selfReleaseImpact.classification)) {
 if (!Array.isArray(selfReleaseImpact.surfaceImpacts) || selfReleaseImpact.surfaceImpacts.length === 0) {
   throw new Error("Buildchain self release impact requires a summary and surfaceImpacts[]");
 }
-for (const requiredSnippet of [
-  "runs-on: ubuntu-24.04",
-  "workflow_dispatch:",
-  "Dry-run npm publish",
-]) {
-  if (!npmPublishWorkflow.includes(requiredSnippet)) {
-    throw new Error(`npm publish workflow missing required snippet: ${requiredSnippet}`);
-  }
-}
-for (const forbiddenSnippet of [
-  "tags:",
-  "Publish exact release tag",
-  "npm publish --access public --tag",
-]) {
-  if (npmPublishWorkflow.includes(forbiddenSnippet)) {
-    throw new Error(`npm publish dry-run workflow must not contain real publish snippet: ${forbiddenSnippet}`);
-  }
-}
-const selfPromotion = inspectWorkflowJob(".github/workflows/self-release-promote.yml", "classify-workflow-run", root);
-if (![...selfPromotion.modules.values()].some(source => source.includes("selectFinalizedProductPublicationVersion")))
-  throw new Error("self promotion must classify finalization from rooted product state");
-if (buildchainRefPromotionWorkflow.includes("workflow_run.display_title"))
-  throw new Error("self promotion must not classify finalization from a display title");
 const workflowDir = path.join(root, ".github/workflows");
 for (const workflowFile of fs.readdirSync(workflowDir).filter((entry) => entry.endsWith(".yml"))) {
   const workflowPath = path.join(workflowDir, workflowFile);
@@ -1054,14 +1004,6 @@ for (const requiredSnippet of [
     throw new Error(`promote-buildchain-ref index missing semver GitHub Release implementation: ${requiredSnippet}`);
   }
 }
-for (const forbiddenSnippet of [
-  "run: node packages/core/release/commands/release-candidate-resolver.mjs",
-  "uses: ./actions/release/promotion/ref",
-]) {
-  if (buildchainRefPromotionWorkflow.includes(forbiddenSnippet)) {
-    throw new Error(`buildchain ref promotion workflow must use the declarative wrapper, found manual snippet: ${forbiddenSnippet}`);
-  }
-}
 for (const requiredSnippet of [
   "distTag || (pkg.version.includes(\"-\") ? \"alpha\" : \"latest\")",
   "\"publish\", \"--dry-run\", \"--access\", \"public\"",
@@ -1089,13 +1031,8 @@ for (const requiredSnippet of [
 if (commonJsSourcePattern.test(npmPublishTransactionScript)) {
   throw new Error("packages/core/publication/commands/npm-publish-transaction.mjs must use ESM syntax");
 }
-if (/runs-on:\s*self-hosted/.test(npmPublishWorkflow)) {
-  throw new Error("npm publish workflow must use GitHub-hosted runners for trusted publishing");
-}
 assertBinaryInventory(root);
-if (!inspectWorkflowJob(".github/workflows/self-ops-runner-smoke.yml", "smoke", root).modules.get("packages/core/build/verification/runner.js")?.includes('runnerKind: "self-hosted"')) {
-  throw new Error("self-hosted smoke must identify its actual runner kind");
-}
+
 
 const inventory = JSON.parse(
   fs.readFileSync(path.join(root, "tests/buildchain-inventory.json"), "utf8")

package/scripts/check-pipeline-publication-topology.mjs

@@ -13,6 +13,8 @@ export function assertPipelinePublicationTopology(
     ".github/workflows/public-ops-recover.yml",
     ".github/workflows/.ops-pipeline-execute.yml",
     ".github/workflows/.release-pipeline-version.yml",
+    ".github/workflows/buildchain.yml",
+    ".github/workflows/buildchain-recover.yml",
   ]);
   const pipelineTopology = discoverReleaseTopology(
     pipeline.workflowPaths,