@kungfu-tech/buildchain 4.1.3-alpha.8 → 4.1.3

package/dist/site/public-surface-audit.json

@@ -10814,8 +10814,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "e43fdb0289df88871f3f0febbe04dcb9311a252a2b1df9b3a83a2d10c9d4a70f",
-    "workflowRegistryDigest": "380c2eb00655d9a8928765aa836dd37b99543d492daadc50fb9c8faf94bb9469",
-    "pageRegistryDigest": "80d9a72bc3833c1f9ec4ad39f3dbab4ebce9b51c795d390a3526acf904054eb7"
+    "workflowRegistryDigest": "b64f87652d2377f6f1cd192bb3e0983f6885af60f3522915649f6a2dc40610fc",
+    "pageRegistryDigest": "1e79a71c8f1d094ad1291b2d8b4bc983633245dcc104ae5ef7bae755fb733209"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.1.3-alpha.8",
+    "version": "4.1.3",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.1.3-alpha.8",
+    "version": "4.1.3",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:176c523f579e4b2221f2e323c35d4a5a803d522b8e4f9eeb252a25481688c09a"
+      "digest": "sha256:5c00176bff01621ea48e2d35fbea8c34810963eda6a7413a1819ca3fae529f6c"
     },
     {
       "id": "build-facts",

package/dist/site/workflow-registry.json

@@ -1263,7 +1263,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.1.3-alpha.8",
+      "introducedVersion": "4.1.3",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",

package/docs/node-api-reference.md

@@ -2351,18 +2351,18 @@ Target: `./packages/core/release/next-development-transition.js`. Public symbols
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `advanceNextDevelopmentTransition` | function: function advanceNextDevelopmentTransition(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { advanceNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:343` |
-| `bindNextDevelopmentAnchor` | function: function bindNextDevelopmentAnchor(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { bindNextDevelopmentAnchor } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:304` |
-| `createNextDevelopmentTransition` | function: function createNextDevelopmentTransition(input = {}) | input = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:252` |
-| `materializeNextDevelopmentTransition` | function: function materializeNextDevelopmentTransition({ cwd = process.cwd(), request, write = false, } = {}) | { cwd = process.cwd(), request, write = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { materializeNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:471` |
-| `NEXT_DEVELOPMENT_ADR` | constant: const NEXT_DEVELOPMENT_ADR | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_ADR } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:20` |
-| `NEXT_DEVELOPMENT_INVARIANT` | constant: const NEXT_DEVELOPMENT_INVARIANT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_INVARIANT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:22` |
-| `NEXT_DEVELOPMENT_REQUEST_CONTRACT` | constant: const NEXT_DEVELOPMENT_REQUEST_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_REQUEST_CONTRACT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:18` |
-| `NEXT_DEVELOPMENT_STATES` | constant: const NEXT_DEVELOPMENT_STATES | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_STATES } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:24` |
-| `NEXT_DEVELOPMENT_TRANSITION_CONTRACT` | constant: const NEXT_DEVELOPMENT_TRANSITION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_TRANSITION_CONTRACT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:16` |
-| `NEXT_DEVELOPMENT_VERSION_MODELS` | constant: const NEXT_DEVELOPMENT_VERSION_MODELS | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_VERSION_MODELS } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:32` |
-| `nextDevelopmentRoot` | function: function nextDevelopmentRoot(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { nextDevelopmentRoot } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:63` |
-| `recordNextDevelopmentMaterialization` | function: function recordNextDevelopmentMaterialization(record, { materialization, evidenceRoot, recordedAt } = {}) | record, { materialization, evidenceRoot, recordedAt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordNextDevelopmentMaterialization } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:415` |
+| `advanceNextDevelopmentTransition` | function: function advanceNextDevelopmentTransition(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { advanceNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:344` |
+| `bindNextDevelopmentAnchor` | function: function bindNextDevelopmentAnchor(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { bindNextDevelopmentAnchor } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:305` |
+| `createNextDevelopmentTransition` | function: function createNextDevelopmentTransition(input = {}) | input = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:253` |
+| `materializeNextDevelopmentTransition` | function: function materializeNextDevelopmentTransition({ cwd = process.cwd(), request, write = false, } = {}) | { cwd = process.cwd(), request, write = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { materializeNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:472` |
+| `NEXT_DEVELOPMENT_ADR` | constant: const NEXT_DEVELOPMENT_ADR | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_ADR } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:21` |
+| `NEXT_DEVELOPMENT_INVARIANT` | constant: const NEXT_DEVELOPMENT_INVARIANT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_INVARIANT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:23` |
+| `NEXT_DEVELOPMENT_REQUEST_CONTRACT` | constant: const NEXT_DEVELOPMENT_REQUEST_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_REQUEST_CONTRACT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:19` |
+| `NEXT_DEVELOPMENT_STATES` | constant: const NEXT_DEVELOPMENT_STATES | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_STATES } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:25` |
+| `NEXT_DEVELOPMENT_TRANSITION_CONTRACT` | constant: const NEXT_DEVELOPMENT_TRANSITION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_TRANSITION_CONTRACT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:17` |
+| `NEXT_DEVELOPMENT_VERSION_MODELS` | constant: const NEXT_DEVELOPMENT_VERSION_MODELS | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_VERSION_MODELS } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:33` |
+| `nextDevelopmentRoot` | function: function nextDevelopmentRoot(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { nextDevelopmentRoot } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:64` |
+| `recordNextDevelopmentMaterialization` | function: function recordNextDevelopmentMaterialization(record, { materialization, evidenceRoot, recordedAt } = {}) | record, { materialization, evidenceRoot, recordedAt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordNextDevelopmentMaterialization } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:416` |
 | `validateNextDevelopmentTransition` | function: function validateNextDevelopmentTransition(record) | record | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/release/next-development-transition.js:728` |
 
 ## `@kungfu-tech/buildchain/next-development-controller`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.1.3-alpha.8",
+  "version": "4.1.3",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/providers/github/pipeline-release-evidence.js

@@ -1,5 +1,4 @@
-import { createHash } from "node:crypto";
-import { recordDigest } from "../../release/discussion/envelope.js";
+import { readReleaseEvidenceAssets } from "./release-evidence-assets.js";
 
 const NAMES = [
   "plan",
@@ -9,103 +8,23 @@ const NAMES = [
   "attestation",
   "release",
 ];
-const LIMIT = 8 * 1024 * 1024;
-
-async function inventory(request, prefix) {
-  const assets = [],
-    ids = new Set(),
-    names = new Set();
-  for (let page = 1; page <= 20; page++) {
-    const values = await request(`${prefix}/assets?per_page=100&page=${page}`);
-    if (!Array.isArray(values) || values.length > 100)
-      throw new Error("Published evidence asset inventory is incomplete");
-    for (const value of values) {
-      if (
-        !Number.isSafeInteger(value.id) ||
-        value.id < 1 ||
-        typeof value.name !== "string" ||
-        !value.name ||
-        ids.has(value.id) ||
-        names.has(value.name)
-      )
-        throw new Error("Published evidence asset inventory is ambiguous");
-      ids.add(value.id);
-      names.add(value.name);
-      assets.push(value);
-    }
-    if (values.length < 100) return assets;
-  }
-  throw new Error(
-    "Published evidence inventory exceeds its complete-read bound",
-  );
-}
-
-function selectedAssets(assets) {
-  return NAMES.map((id) => {
-    const name = `buildchain.${id}.json`;
-    const asset = assets.find((value) => value.name === name);
-    if (!asset) return { name, missing: true };
-    if (
-      asset.state !== "uploaded" ||
-      !Number.isSafeInteger(asset.size) ||
-      asset.size < 1 ||
-      asset.size > LIMIT ||
-      !/^sha256:[0-9a-f]{64}$/u.test(asset.digest || "")
-    )
-      throw new Error("Published evidence asset lacks bounded immutable bytes");
-    return { id: asset.id, name, size: asset.size, digest: asset.digest };
-  });
-}
-
-// Download only fixed evidence names from the exact already-observed release.
-// There is no caller-supplied URL, artifact selector or provider write here.
 export async function readPipelineReleaseEvidence(host, candidate) {
-  const repository = host.repository;
-  if (
-    !/^[\w.-]+\/[\w.-]+$/u.test(repository || "") ||
-    !Number.isSafeInteger(candidate.id) ||
-    candidate.id < 1
-  )
-    throw new Error("Published evidence requires exact release coordinates");
-  const prefix = `/repos/${repository}/releases/${candidate.id}`;
-  const selected = selectedAssets(await inventory(host.request, prefix));
-  const missing = selected
-    .filter((value) => value.missing)
-    .map(({ name }) => name);
-  if (missing.length) return { status: "missing", missing };
-  const [owner, repo] = repository.split("/");
+  const result = await readReleaseEvidenceAssets(
+    host,
+    candidate,
+    NAMES.map((id) => `buildchain.${id}.json`),
+  );
+  if (result.status !== "present") return result;
   const values = {};
-  let bundle;
-  for (const asset of selected) {
-    const result = await host.github.rest.repos.getReleaseAsset({
-      owner,
-      repo,
-      asset_id: asset.id,
-      headers: { accept: "application/octet-stream" },
-    });
-    const bytes = Buffer.from(result.data);
-    if (
-      bytes.length !== asset.size ||
-      bytes.length > LIMIT ||
-      `sha256:${createHash("sha256").update(bytes).digest("hex")}` !==
-        asset.digest
-    )
-      throw new Error(
-        "Published evidence download differs from provider bytes",
-      );
-    const id = asset.name.slice("buildchain.".length, -".json".length);
-    if (id === "attestation") bundle = bytes;
-    else
-      values[id] = JSON.parse(
-        new TextDecoder("utf-8", { fatal: true }).decode(bytes),
-      );
-  }
-  if (
-    recordDigest(selectedAssets(await inventory(host.request, prefix))) !==
-    recordDigest(selected)
-  )
-    throw new Error(
-      "Published evidence assets changed during provider readback",
+  for (const id of NAMES.filter((name) => name !== "attestation"))
+    values[id] = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(
+        result.values[`buildchain.${id}.json`],
+      ),
     );
-  return { status: "present", values, bundle, assets: selected };
+  return {
+    ...result,
+    values,
+    bundle: result.values["buildchain.attestation.json"],
+  };
 }

package/packages/core/providers/github/pipeline-stable-baseline.js

@@ -0,0 +1,86 @@
+import { recordDigest } from "../../release/discussion/envelope.js";
+import {
+  SETTLEMENT_ASSET,
+  verifyPublicationSettlement,
+} from "../../publication/settlement/transaction.js";
+import { readReleaseEvidenceAssets } from "./release-evidence-assets.js";
+
+// Earlier publications materialized the floating entry after the exact tag.
+// Only their completed immutable settlement can bind those two commits.
+export async function readPipelineStableBaseline(plan, host, release, prior) {
+  if ((prior?.commit || null) === plan.previousChannelCommit) return null;
+  if (!release || !prior || !plan.previousChannelCommit)
+    throw new Error(
+      "Stable comparison differs from the retained published channel",
+    );
+  const evidence = await readReleaseEvidenceAssets(host, release, [
+    SETTLEMENT_ASSET,
+    "buildchain.release.json",
+  ]);
+  if (evidence.status !== "present")
+    throw new Error(
+      "Stable channel differs without a completed publication settlement",
+    );
+  const read = (name) =>
+    JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(evidence.values[name]),
+    );
+  const settlement = read(SETTLEMENT_ASSET),
+    publicPassport = read("buildchain.release.json"),
+    repository = plan.source.repository,
+    tag = release.tag,
+    sourceSha = prior.commit;
+  if (
+    settlement.schemaVersion !== 1 ||
+    settlement.contract !== "buildchain-v4-publication-settlement/v1" ||
+    settlement.release?.tag !== tag ||
+    settlement.release?.sourceSha !== sourceSha ||
+    settlement.release?.channel !== "stable"
+  )
+    throw new Error(
+      "Stable baseline settlement has different release coordinates",
+    );
+  const verified = verifyPublicationSettlement(settlement.documents, {
+    repository,
+    tag,
+    sourceSha,
+    publicPassport,
+  });
+  const { product, providerState, productState, invocation, passport } =
+    settlement.documents;
+  const ref = `refs/tags/v${plan.version.split(".")[0]}`,
+    updates = product.updates.filter((value) => value.ref === ref);
+  const subject = {
+    repository,
+    sourceSha,
+    tag,
+    version: tag.slice(1),
+    channel: "stable",
+  };
+  if (
+    invocation.target.channel !== "stable" ||
+    passport.release.channel !== "stable" ||
+    product.promotedSha !== plan.previousChannelCommit ||
+    updates.length !== 1 ||
+    updates[0].action !== "converged-release-tag" ||
+    updates[0].sha !== plan.previousChannelCommit ||
+    recordDigest(productState.subject) !== recordDigest(subject) ||
+    recordDigest(providerState.subject) !==
+      recordDigest({
+        ...subject,
+        sourceSha: plan.previousChannelCommit,
+      })
+  )
+    throw new Error(
+      "Stable baseline settlement does not bind the retained floating channel",
+    );
+  return {
+    releaseId: release.id,
+    tag,
+    sourceSha,
+    channelRef: ref,
+    channelCommit: plan.previousChannelCommit,
+    receiptRoot: verified.receiptRoot,
+    assets: evidence.assets,
+  };
+}

package/packages/core/providers/github/pipeline-stable-source.js

@@ -5,6 +5,7 @@ import { compareDevelopmentVersions } from "../../publication/publication-develo
 import { githubPipelineSource } from "./pipeline-source.js";
 import { githubPipelineVersion } from "./pipeline-version.js";
 import { normalInputs } from "../../consumer/contract/entries.js";
+import { readPipelineStableBaseline } from "./pipeline-stable-baseline.js";
 
 const SHA = /^[0-9a-f]{40}$/u;
 const STABLE = /^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u;
@@ -295,10 +296,12 @@ export async function readPipelineStableSource(plan, host) {
   const prior = selected.comparison
     ? await exactTag(get, selected.comparison.tag)
     : null;
-  if ((prior?.commit || null) !== plan.previousChannelCommit)
-    throw new Error(
-      "Stable comparison differs from the retained published channel",
-    );
+  const baseline = await readPipelineStableBaseline(
+    plan,
+    { ...host, request },
+    selected.comparison,
+    prior,
+  );
   const current = await treeFiles(get, pointer.commit);
   if (current.tree !== candidate.identity.tree)
     throw new Error(
@@ -335,6 +338,20 @@ export async function readPipelineStableSource(plan, host) {
     prior,
     latest,
   });
+  if (
+    baseline &&
+    recordDigest(
+      await readPipelineStableBaseline(
+        plan,
+        { ...host, request },
+        selected.comparison,
+        prior,
+      ),
+    ) !== recordDigest(baseline)
+  )
+    throw new Error(
+      "Stable baseline evidence changed during provider readback",
+    );
   const body = {
     schema: "buildchain.pipeline-stable-source/v1",
     planRoot: plan.root,
@@ -347,6 +364,7 @@ export async function readPipelineStableSource(plan, host) {
     comparisonStable: selected.comparison
       ? { ...selected.comparison, sha: prior.commit, tree: previous.tree }
       : null,
+    ...(baseline ? { comparisonChannel: baseline } : {}),
     impact,
     changedPaths: changedPaths(previous.files, current.files),
   };

package/packages/core/providers/github/release-evidence-assets.js

@@ -0,0 +1,97 @@
+import { createHash } from "node:crypto";
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+const LIMIT = 8 * 1024 * 1024;
+
+async function inventory(request, prefix) {
+  const assets = [],
+    ids = new Set(),
+    names = new Set();
+  for (let page = 1; page <= 20; page++) {
+    const values = await request(`${prefix}/assets?per_page=100&page=${page}`);
+    if (!Array.isArray(values) || values.length > 100)
+      throw new Error("Published evidence asset inventory is incomplete");
+    for (const value of values) {
+      if (
+        !Number.isSafeInteger(value.id) ||
+        value.id < 1 ||
+        typeof value.name !== "string" ||
+        !value.name ||
+        ids.has(value.id) ||
+        names.has(value.name)
+      )
+        throw new Error("Published evidence asset inventory is ambiguous");
+      ids.add(value.id);
+      names.add(value.name);
+      assets.push(value);
+    }
+    if (values.length < 100) return assets;
+  }
+  throw new Error(
+    "Published evidence inventory exceeds its complete-read bound",
+  );
+}
+
+function selectedAssets(assets, names) {
+  return names.map((name) => {
+    const asset = assets.find((value) => value.name === name);
+    if (!asset) return { name, missing: true };
+    if (
+      asset.state !== "uploaded" ||
+      !Number.isSafeInteger(asset.size) ||
+      asset.size < 1 ||
+      asset.size > LIMIT ||
+      !/^sha256:[0-9a-f]{64}$/u.test(asset.digest || "")
+    )
+      throw new Error("Published evidence asset lacks bounded immutable bytes");
+    return { id: asset.id, name, size: asset.size, digest: asset.digest };
+  });
+}
+
+// Download only fixed evidence names from the exact already-observed release.
+// There is no caller-supplied URL, artifact selector or provider write here.
+export async function readReleaseEvidenceAssets(host, candidate, names) {
+  const repository = host.repository;
+  if (
+    !/^[\w.-]+\/[\w.-]+$/u.test(repository || "") ||
+    !Number.isSafeInteger(candidate.id) ||
+    candidate.id < 1
+  )
+    throw new Error("Published evidence requires exact release coordinates");
+  const prefix = `/repos/${repository}/releases/${candidate.id}`;
+  const selected = selectedAssets(await inventory(host.request, prefix), names);
+  const missing = selected
+    .filter((value) => value.missing)
+    .map(({ name }) => name);
+  if (missing.length) return { status: "missing", missing };
+  const [owner, repo] = repository.split("/");
+  const values = {};
+  for (const asset of selected) {
+    const result = await host.github.rest.repos.getReleaseAsset({
+      owner,
+      repo,
+      asset_id: asset.id,
+      headers: { accept: "application/octet-stream" },
+    });
+    const bytes = Buffer.from(result.data);
+    if (
+      bytes.length !== asset.size ||
+      bytes.length > LIMIT ||
+      `sha256:${createHash("sha256").update(bytes).digest("hex")}` !==
+        asset.digest
+    )
+      throw new Error(
+        "Published evidence download differs from provider bytes",
+      );
+    values[asset.name] = bytes;
+  }
+  if (
+    recordDigest(
+      selectedAssets(await inventory(host.request, prefix), names),
+    ) !== recordDigest(selected)
+  )
+    throw new Error(
+      "Published evidence assets changed during provider readback",
+    );
+  return { status: "present", values, assets: selected };
+}

package/packages/core/publication/pipeline/journal.js

@@ -106,5 +106,17 @@ export function pipelinePublicationJournal(session, host) {
     });
     return value;
   }
-  return { fence, materials, record };
+  async function recordImport(value, phase) {
+    publicationImportedValues(value);
+    const observed = await fence();
+    const id = "publication/recovery-import";
+    const eventKey = `publication:${id}:${recordDigest(value)}`;
+    const prior = observed.history
+      .at(-1)
+      .events.find((event) => event.payload.eventKey === eventKey);
+    // Import is one atomic append, not a new result for each resumed phase.
+    // Replay still verifies the original event, state and retained bytes.
+    return record(id, value, { phase: prior?.node || phase });
+  }
+  return { fence, materials, record, recordImport };
 }

package/packages/core/publication/pipeline/recovery-import.js

@@ -76,5 +76,5 @@ export async function importRecoveredPublication(
   publicationImportedValues(bundle);
   // One journal append publishes the complete import and derived source/plan.
   // An interruption cannot expose a new plan beside an old materialization.
-  await journal.record("publication/recovery-import", bundle, { phase });
+  await journal.recordImport(bundle, phase);
 }

package/packages/core/publication/pipeline/stable-entry.js

@@ -114,7 +114,11 @@ async function inspectEntryRun(listed, plan, source, host) {
   const consumer = await pipelineEntryRun(run, plan, source, host);
   if (!consumer) return null;
   if (
-    !jobs.some((job) => /(?:^| \/ )Build product \([^)]+\)$/u.test(job.name)) &&
+    !jobs.some(
+      (job) =>
+        job.conclusion !== "skipped" &&
+        /(?:^| \/ )Build product \([^)]+\)$/u.test(job.name),
+    ) &&
     run.conclusion === "success"
   )
     return null;

package/packages/core/release/next-development-transition.js

@@ -3,6 +3,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { isDeepStrictEqual } from "node:util";
 
 import {
   discoverConfiguredDerivedVersionMaterial,
@@ -606,7 +607,7 @@ function assertStaticTransition(record, recreated) {
       throw new Error(`next-development ${field} drifted`);
   }
   for (const field of ["adapter", "declaredPaths", "effectBounds", "target"]) {
-    if (JSON.stringify(record[field]) !== JSON.stringify(recreated[field])) {
+    if (!isDeepStrictEqual(record[field], recreated[field])) {
       const label = field === "effectBounds" ? "effect bounds" : field;
       throw new Error(`next-development ${label} drifted`);
     }
@@ -638,20 +639,19 @@ function assertStaticTransition(record, recreated) {
 }
 
 function assertMaterialization(record) {
-  if (record.materialization !== null) {
-    const { materializationRoot, ...body } = record.materialization;
-    if (materializationRoot !== nextDevelopmentRoot(body)) {
-      throw new Error("next-development materialization root drifted");
-    }
-    const materializedPaths = (record.materialization.paths || []).map(
-      (entry) => entry.path,
-    );
-    if (
-      JSON.stringify(materializedPaths) !==
-      JSON.stringify(record.adapter.sourcePaths)
-    ) {
-      throw new Error("next-development materialization escaped source paths");
-    }
+  if (record.materialization === null) return;
+  const { materializationRoot, ...body } = record.materialization;
+  if (materializationRoot !== nextDevelopmentRoot(body))
+    throw new Error("next-development materialization root drifted");
+  const { paths = [] } = record.materialization;
+  const materializedPaths = paths.map(({ path }) => path);
+  // Reference adapters cover sources; transaction adapters cover all outputs.
+  if (
+    ![record.adapter.sourcePaths, record.adapter.allowedChangePaths].some(
+      (expected) => isDeepStrictEqual(materializedPaths, expected),
+    )
+  ) {
+    throw new Error("next-development materialization paths drifted");
   }
 }