@kungfu-tech/buildchain 4.1.3-alpha.9 → 4.1.4-alpha.0

package/packages/core/paper/paper-work.js

@@ -1,14 +1,12 @@
 import path from "node:path";
 import { collectPaperAgentEntry } from "./paper-agent-entry.js";
 import {
-  PAPER_PATHS,
   PAPER_WORK_BRANCH_PATTERN,
   gitResult,
   gitValue,
   normalizedWorkBranch,
   paperDevelopmentRef,
   paperWorkSource,
-  readJson,
   remoteBranchObservation,
   rootedPlan,
   workCheck,
@@ -30,12 +28,7 @@ function failedActions(checks) {
 }
 
 function agentEntryForWork(cwd, buildchainSha) {
-  const policy = readJson(path.resolve(cwd, PAPER_PATHS.agentEntry)).value;
-  return collectPaperAgentEntry({
-    cwd,
-    buildchainSha: buildchainSha || policy?.runtime?.sourceSha || "",
-    mode: "contract",
-  });
+  return collectPaperAgentEntry({ cwd, buildchainSha, mode: "contract" });
 }
 
 export function createPaperWorkStartPlan({
@@ -74,7 +67,7 @@ export function createPaperWorkStartPlan({
     workCheck(
       "agent-entry.current",
       agentEntry.ok,
-      "The mandatory Buildchain Paper agent-entry contract is current.",
+      "The Paper product configuration and shared consumer wiring are current.",
       "buildchain paper migrate --write --json",
     ),
     workCheck(
@@ -252,7 +245,7 @@ export function createPaperWorkSubmitPlan({
     workCheck(
       "agent-entry.current",
       agentEntry.ok,
-      "The mandatory Buildchain Paper agent-entry contract is current.",
+      "The Paper product configuration and shared consumer wiring are current.",
       "buildchain paper migrate --write --json",
     ),
     workCheck(

package/packages/core/paper/paper.js

@@ -1,3 +1,4 @@
+import { paperConsumerStatus } from "./consumer-status.js";
 import path from "node:path";
 import {
   paperConfig,
@@ -44,15 +45,52 @@ import {
   paperPreflightNextActions,
 } from "./operations/preflight-checks.js";
 export function collectPaperSourcePolicy({ cwd = process.cwd() } = {}) {
+  const consumer = paperConsumerStatus(cwd);
+  if (consumer) return consumer;
   const agentEntry = collectPaperAgentEntry({ cwd, mode: "ci" });
   const provisioning = validatePaperProvisioningAuthority(cwd);
-  const checks = [...agentEntry.checks, { id: "provisioning.authority", status: provisioning.valid ? "pass" : "fail", message: provisioning.errors.join("; ") }];
-  try { validateBuildchainConfig(cwd, { requireLifecycleStages: ["verify"] }); }
-  catch (error) { checks.push({ id: "config.publication", status: "fail", message: error.message }); }
-  return { ok: checks.every(check => check.status === "pass" || check.status === "skip"), checks };
+  const checks = [
+    ...agentEntry.checks,
+    {
+      id: "provisioning.authority",
+      status: provisioning.valid ? "pass" : "fail",
+      message: provisioning.errors.join("; "),
+    },
+  ];
+  try {
+    validateBuildchainConfig(cwd, { requireLifecycleStages: ["verify"] });
+  } catch (error) {
+    checks.push({
+      id: "config.publication",
+      status: "fail",
+      message: error.message,
+    });
+  }
+  return {
+    ok: checks.every(
+      (check) => check.status === "pass" || check.status === "skip",
+    ),
+    checks,
+  };
+}
+
+export function collectPaperPreflight(options = {}) {
+  const consumer = paperConsumerStatus(
+    path.resolve(options.cwd || process.cwd()),
+  );
+  if (!consumer) return collectLegacyPaperPreflight(options);
+  const result =
+    options.agentEntryMode && options.agentEntryMode !== "contract"
+      ? collectPaperAgentEntry({
+          cwd: consumer.cwd,
+          mode: options.agentEntryMode,
+          env: options.env,
+        })
+      : consumer;
+  return { ...result, contract: PAPER_PREFLIGHT_CONTRACT };
 }
 
-export function collectPaperPreflight({
+function collectLegacyPaperPreflight({
   cwd = process.cwd(),
   buildchainRoot = process.cwd(),
   buildchainVersion = "",

package/packages/core/providers/github/artifact-attestation.js

@@ -10,7 +10,7 @@ export function verifyArtifactAttestationSigner(request, execute = command) {
       "--repo",
       request.repository,
       "--signer-workflow",
-      "kungfu-systems/buildchain/.github/workflows/public-release-artifact-attestation.yml",
+      "kungfu-systems/buildchain/.github/workflows/.release-artifact-attestation.yml",
       "--signer-digest",
       request.signerDigest,
       "--source-digest",

package/packages/core/providers/github/pipeline-context-artifacts.js

@@ -0,0 +1,172 @@
+import fs from "node:fs";
+import path from "node:path";
+import artifact from "@actions/artifact";
+import {
+  canonicalJson,
+  recordDigest,
+} from "../../release/discussion/envelope.js";
+import { publicationPath } from "../../publication/pipeline/files.js";
+
+const INLINE_LIMIT = 32 * 1024;
+const MATERIAL_LIMIT = 16 * 1024 * 1024;
+const REFERENCE = "buildchain.pipeline-context-reference/v1";
+const SCHEMAS = [
+  "buildchain.pipeline-publication-context/v1",
+  "buildchain.pipeline-version-context/v1",
+];
+const DIGEST = /^sha256:[0-9a-f]{64}$/u;
+
+function execution(env) {
+  const result = {
+    repository: env.GITHUB_REPOSITORY,
+    runId: Number(env.GITHUB_RUN_ID),
+    runAttempt: Number(env.GITHUB_RUN_ATTEMPT),
+  };
+  if (
+    !/^[\w.-]+\/[\w.-]+$/u.test(result.repository || "") ||
+    !Number.isSafeInteger(result.runId) ||
+    result.runId < 1 ||
+    !Number.isSafeInteger(result.runAttempt) ||
+    result.runAttempt < 1
+  )
+    throw new Error("Context transfer requires its exact provider execution");
+  return result;
+}
+
+function projection(value, env) {
+  const current = execution(env);
+  if (
+    !SCHEMAS.includes(value.schema) ||
+    value.runId !== current.runId ||
+    value.runAttempt !== current.runAttempt
+  )
+    throw new Error("Context transfer belongs to another provider execution");
+  const source =
+    value.schema === SCHEMAS[0]
+      ? value.materialization?.source
+      : value.preparation?.source;
+  if (
+    source?.repository !== current.repository ||
+    !/^[0-9a-f]{40}$/u.test(source?.commit || "")
+  )
+    throw new Error("Context transfer requires an exact repository source");
+  return {
+    schema: REFERENCE,
+    contextSchema: value.schema,
+    ...current,
+    contextRoot: recordDigest(value),
+    ...(value.schema === SCHEMAS[0]
+      ? { materialization: { source } }
+      : { preparation: { source } }),
+  };
+}
+
+function workspace(env) {
+  const directory = path.join(
+    env.GITHUB_WORKSPACE,
+    ".buildchain/context-material",
+  );
+  fs.mkdirSync(directory, { recursive: true });
+  return fs.mkdtempSync(path.join(directory, "transfer-"));
+}
+
+// Only an immutable reference and the checkout projection cross job outputs.
+// The original context remains unchanged in the authoritative attempt journal.
+export async function writePipelineContext(value, env, client = artifact) {
+  const serialized = canonicalJson(value);
+  const bytes = Buffer.byteLength(serialized);
+  if (bytes <= INLINE_LIMIT) return serialized;
+  if (bytes > MATERIAL_LIMIT)
+    throw new Error("Pipeline context exceeds its retained material bound");
+  const selected = projection(value, env);
+  const directory = workspace(env);
+  try {
+    const file = path.join(directory, "context.json");
+    fs.writeFileSync(file, serialized, { flag: "wx" });
+    const uploaded = await client.uploadArtifact(
+      `buildchain-context-${selected.runAttempt}-${selected.contextRoot.slice(7)}`,
+      [file],
+      directory,
+      { retentionDays: 30, compressionLevel: 0 },
+    );
+    const digest = `sha256:${String(uploaded.digest || "").replace(/^sha256:/u, "")}`;
+    if (
+      !Number.isSafeInteger(uploaded.id) ||
+      uploaded.id < 1 ||
+      !DIGEST.test(digest)
+    )
+      throw new Error("Context upload omitted immutable provider coordinates");
+    const encoded = canonicalJson({
+      ...selected,
+      bytes,
+      artifact: { id: uploaded.id, digest },
+    });
+    if (Buffer.byteLength(encoded) > INLINE_LIMIT)
+      throw new Error(
+        "Context checkout projection exceeds the job output bound",
+      );
+    return encoded;
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+}
+
+function validateReference(value, env) {
+  const current = execution(env);
+  if (
+    !SCHEMAS.includes(value.contextSchema) ||
+    value.repository !== current.repository ||
+    value.runId !== current.runId ||
+    value.runAttempt !== current.runAttempt ||
+    !DIGEST.test(value.contextRoot || "") ||
+    !Number.isSafeInteger(value.bytes) ||
+    value.bytes <= INLINE_LIMIT ||
+    value.bytes > MATERIAL_LIMIT ||
+    !Number.isSafeInteger(value.artifact?.id) ||
+    value.artifact.id < 1 ||
+    !DIGEST.test(value.artifact?.digest || "")
+  )
+    throw new Error(
+      "Context reference changed its execution or material boundary",
+    );
+}
+
+export async function readPipelineContext(encoded, env, client = artifact) {
+  if (Buffer.byteLength(encoded) > INLINE_LIMIT)
+    throw new Error("Pipeline context must use bounded job output transport");
+  const reference = JSON.parse(encoded);
+  if (reference.schema !== REFERENCE) return reference;
+  validateReference(reference, env);
+  const directory = workspace(env);
+  try {
+    // No findBy or repository token: the artifact SDK scopes this read to the
+    // current workflow execution, including credentialless product build jobs.
+    const downloaded = await client.downloadArtifact(reference.artifact.id, {
+      path: directory,
+      expectedHash: reference.artifact.digest,
+    });
+    if (
+      downloaded.digestMismatch ||
+      canonicalJson(fs.readdirSync(directory)) !== '["context.json"]'
+    )
+      throw new Error("Context artifact changed its archive or file inventory");
+    const file = publicationPath(directory, "context.json");
+    if (fs.statSync(file).size !== reference.bytes)
+      throw new Error("Context artifact changed its retained byte length");
+    const value = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(fs.readFileSync(file)),
+    );
+    const expected = {
+      ...projection(value, env),
+      bytes: reference.bytes,
+      artifact: reference.artifact,
+    };
+    if (recordDigest(expected) !== recordDigest(reference))
+      throw new Error(
+        "Context artifact differs from its exact checkout projection or root",
+      );
+    return value;
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+}

package/packages/core/providers/github/pipeline-release-evidence.js

@@ -1,5 +1,4 @@
-import { createHash } from "node:crypto";
-import { recordDigest } from "../../release/discussion/envelope.js";
+import { readReleaseEvidenceAssets } from "./release-evidence-assets.js";
 
 const NAMES = [
   "plan",
@@ -9,103 +8,23 @@ const NAMES = [
   "attestation",
   "release",
 ];
-const LIMIT = 8 * 1024 * 1024;
-
-async function inventory(request, prefix) {
-  const assets = [],
-    ids = new Set(),
-    names = new Set();
-  for (let page = 1; page <= 20; page++) {
-    const values = await request(`${prefix}/assets?per_page=100&page=${page}`);
-    if (!Array.isArray(values) || values.length > 100)
-      throw new Error("Published evidence asset inventory is incomplete");
-    for (const value of values) {
-      if (
-        !Number.isSafeInteger(value.id) ||
-        value.id < 1 ||
-        typeof value.name !== "string" ||
-        !value.name ||
-        ids.has(value.id) ||
-        names.has(value.name)
-      )
-        throw new Error("Published evidence asset inventory is ambiguous");
-      ids.add(value.id);
-      names.add(value.name);
-      assets.push(value);
-    }
-    if (values.length < 100) return assets;
-  }
-  throw new Error(
-    "Published evidence inventory exceeds its complete-read bound",
-  );
-}
-
-function selectedAssets(assets) {
-  return NAMES.map((id) => {
-    const name = `buildchain.${id}.json`;
-    const asset = assets.find((value) => value.name === name);
-    if (!asset) return { name, missing: true };
-    if (
-      asset.state !== "uploaded" ||
-      !Number.isSafeInteger(asset.size) ||
-      asset.size < 1 ||
-      asset.size > LIMIT ||
-      !/^sha256:[0-9a-f]{64}$/u.test(asset.digest || "")
-    )
-      throw new Error("Published evidence asset lacks bounded immutable bytes");
-    return { id: asset.id, name, size: asset.size, digest: asset.digest };
-  });
-}
-
-// Download only fixed evidence names from the exact already-observed release.
-// There is no caller-supplied URL, artifact selector or provider write here.
 export async function readPipelineReleaseEvidence(host, candidate) {
-  const repository = host.repository;
-  if (
-    !/^[\w.-]+\/[\w.-]+$/u.test(repository || "") ||
-    !Number.isSafeInteger(candidate.id) ||
-    candidate.id < 1
-  )
-    throw new Error("Published evidence requires exact release coordinates");
-  const prefix = `/repos/${repository}/releases/${candidate.id}`;
-  const selected = selectedAssets(await inventory(host.request, prefix));
-  const missing = selected
-    .filter((value) => value.missing)
-    .map(({ name }) => name);
-  if (missing.length) return { status: "missing", missing };
-  const [owner, repo] = repository.split("/");
+  const result = await readReleaseEvidenceAssets(
+    host,
+    candidate,
+    NAMES.map((id) => `buildchain.${id}.json`),
+  );
+  if (result.status !== "present") return result;
   const values = {};
-  let bundle;
-  for (const asset of selected) {
-    const result = await host.github.rest.repos.getReleaseAsset({
-      owner,
-      repo,
-      asset_id: asset.id,
-      headers: { accept: "application/octet-stream" },
-    });
-    const bytes = Buffer.from(result.data);
-    if (
-      bytes.length !== asset.size ||
-      bytes.length > LIMIT ||
-      `sha256:${createHash("sha256").update(bytes).digest("hex")}` !==
-        asset.digest
-    )
-      throw new Error(
-        "Published evidence download differs from provider bytes",
-      );
-    const id = asset.name.slice("buildchain.".length, -".json".length);
-    if (id === "attestation") bundle = bytes;
-    else
-      values[id] = JSON.parse(
-        new TextDecoder("utf-8", { fatal: true }).decode(bytes),
-      );
-  }
-  if (
-    recordDigest(selectedAssets(await inventory(host.request, prefix))) !==
-    recordDigest(selected)
-  )
-    throw new Error(
-      "Published evidence assets changed during provider readback",
+  for (const id of NAMES.filter((name) => name !== "attestation"))
+    values[id] = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(
+        result.values[`buildchain.${id}.json`],
+      ),
     );
-  return { status: "present", values, bundle, assets: selected };
+  return {
+    ...result,
+    values,
+    bundle: result.values["buildchain.attestation.json"],
+  };
 }

package/packages/core/providers/github/pipeline-stable-baseline.js

@@ -0,0 +1,86 @@
+import { recordDigest } from "../../release/discussion/envelope.js";
+import {
+  SETTLEMENT_ASSET,
+  verifyPublicationSettlement,
+} from "../../publication/settlement/transaction.js";
+import { readReleaseEvidenceAssets } from "./release-evidence-assets.js";
+
+// Earlier publications materialized the floating entry after the exact tag.
+// Only their completed immutable settlement can bind those two commits.
+export async function readPipelineStableBaseline(plan, host, release, prior) {
+  if ((prior?.commit || null) === plan.previousChannelCommit) return null;
+  if (!release || !prior || !plan.previousChannelCommit)
+    throw new Error(
+      "Stable comparison differs from the retained published channel",
+    );
+  const evidence = await readReleaseEvidenceAssets(host, release, [
+    SETTLEMENT_ASSET,
+    "buildchain.release.json",
+  ]);
+  if (evidence.status !== "present")
+    throw new Error(
+      "Stable channel differs without a completed publication settlement",
+    );
+  const read = (name) =>
+    JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(evidence.values[name]),
+    );
+  const settlement = read(SETTLEMENT_ASSET),
+    publicPassport = read("buildchain.release.json"),
+    repository = plan.source.repository,
+    tag = release.tag,
+    sourceSha = prior.commit;
+  if (
+    settlement.schemaVersion !== 1 ||
+    settlement.contract !== "buildchain-v4-publication-settlement/v1" ||
+    settlement.release?.tag !== tag ||
+    settlement.release?.sourceSha !== sourceSha ||
+    settlement.release?.channel !== "stable"
+  )
+    throw new Error(
+      "Stable baseline settlement has different release coordinates",
+    );
+  const verified = verifyPublicationSettlement(settlement.documents, {
+    repository,
+    tag,
+    sourceSha,
+    publicPassport,
+  });
+  const { product, providerState, productState, invocation, passport } =
+    settlement.documents;
+  const ref = `refs/tags/v${plan.version.split(".")[0]}`,
+    updates = product.updates.filter((value) => value.ref === ref);
+  const subject = {
+    repository,
+    sourceSha,
+    tag,
+    version: tag.slice(1),
+    channel: "stable",
+  };
+  if (
+    invocation.target.channel !== "stable" ||
+    passport.release.channel !== "stable" ||
+    product.promotedSha !== plan.previousChannelCommit ||
+    updates.length !== 1 ||
+    updates[0].action !== "converged-release-tag" ||
+    updates[0].sha !== plan.previousChannelCommit ||
+    recordDigest(productState.subject) !== recordDigest(subject) ||
+    recordDigest(providerState.subject) !==
+      recordDigest({
+        ...subject,
+        sourceSha: plan.previousChannelCommit,
+      })
+  )
+    throw new Error(
+      "Stable baseline settlement does not bind the retained floating channel",
+    );
+  return {
+    releaseId: release.id,
+    tag,
+    sourceSha,
+    channelRef: ref,
+    channelCommit: plan.previousChannelCommit,
+    receiptRoot: verified.receiptRoot,
+    assets: evidence.assets,
+  };
+}

package/packages/core/providers/github/pipeline-stable-source.js

@@ -5,6 +5,7 @@ import { compareDevelopmentVersions } from "../../publication/publication-develo
 import { githubPipelineSource } from "./pipeline-source.js";
 import { githubPipelineVersion } from "./pipeline-version.js";
 import { normalInputs } from "../../consumer/contract/entries.js";
+import { readPipelineStableBaseline } from "./pipeline-stable-baseline.js";
 
 const SHA = /^[0-9a-f]{40}$/u;
 const STABLE = /^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u;
@@ -295,10 +296,12 @@ export async function readPipelineStableSource(plan, host) {
   const prior = selected.comparison
     ? await exactTag(get, selected.comparison.tag)
     : null;
-  if ((prior?.commit || null) !== plan.previousChannelCommit)
-    throw new Error(
-      "Stable comparison differs from the retained published channel",
-    );
+  const baseline = await readPipelineStableBaseline(
+    plan,
+    { ...host, request },
+    selected.comparison,
+    prior,
+  );
   const current = await treeFiles(get, pointer.commit);
   if (current.tree !== candidate.identity.tree)
     throw new Error(
@@ -335,6 +338,20 @@ export async function readPipelineStableSource(plan, host) {
     prior,
     latest,
   });
+  if (
+    baseline &&
+    recordDigest(
+      await readPipelineStableBaseline(
+        plan,
+        { ...host, request },
+        selected.comparison,
+        prior,
+      ),
+    ) !== recordDigest(baseline)
+  )
+    throw new Error(
+      "Stable baseline evidence changed during provider readback",
+    );
   const body = {
     schema: "buildchain.pipeline-stable-source/v1",
     planRoot: plan.root,
@@ -347,6 +364,7 @@ export async function readPipelineStableSource(plan, host) {
     comparisonStable: selected.comparison
       ? { ...selected.comparison, sha: prior.commit, tree: previous.tree }
       : null,
+    ...(baseline ? { comparisonChannel: baseline } : {}),
     impact,
     changedPaths: changedPaths(previous.files, current.files),
   };

package/packages/core/providers/github/release-evidence-assets.js

@@ -0,0 +1,97 @@
+import { createHash } from "node:crypto";
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+const LIMIT = 8 * 1024 * 1024;
+
+async function inventory(request, prefix) {
+  const assets = [],
+    ids = new Set(),
+    names = new Set();
+  for (let page = 1; page <= 20; page++) {
+    const values = await request(`${prefix}/assets?per_page=100&page=${page}`);
+    if (!Array.isArray(values) || values.length > 100)
+      throw new Error("Published evidence asset inventory is incomplete");
+    for (const value of values) {
+      if (
+        !Number.isSafeInteger(value.id) ||
+        value.id < 1 ||
+        typeof value.name !== "string" ||
+        !value.name ||
+        ids.has(value.id) ||
+        names.has(value.name)
+      )
+        throw new Error("Published evidence asset inventory is ambiguous");
+      ids.add(value.id);
+      names.add(value.name);
+      assets.push(value);
+    }
+    if (values.length < 100) return assets;
+  }
+  throw new Error(
+    "Published evidence inventory exceeds its complete-read bound",
+  );
+}
+
+function selectedAssets(assets, names) {
+  return names.map((name) => {
+    const asset = assets.find((value) => value.name === name);
+    if (!asset) return { name, missing: true };
+    if (
+      asset.state !== "uploaded" ||
+      !Number.isSafeInteger(asset.size) ||
+      asset.size < 1 ||
+      asset.size > LIMIT ||
+      !/^sha256:[0-9a-f]{64}$/u.test(asset.digest || "")
+    )
+      throw new Error("Published evidence asset lacks bounded immutable bytes");
+    return { id: asset.id, name, size: asset.size, digest: asset.digest };
+  });
+}
+
+// Download only fixed evidence names from the exact already-observed release.
+// There is no caller-supplied URL, artifact selector or provider write here.
+export async function readReleaseEvidenceAssets(host, candidate, names) {
+  const repository = host.repository;
+  if (
+    !/^[\w.-]+\/[\w.-]+$/u.test(repository || "") ||
+    !Number.isSafeInteger(candidate.id) ||
+    candidate.id < 1
+  )
+    throw new Error("Published evidence requires exact release coordinates");
+  const prefix = `/repos/${repository}/releases/${candidate.id}`;
+  const selected = selectedAssets(await inventory(host.request, prefix), names);
+  const missing = selected
+    .filter((value) => value.missing)
+    .map(({ name }) => name);
+  if (missing.length) return { status: "missing", missing };
+  const [owner, repo] = repository.split("/");
+  const values = {};
+  for (const asset of selected) {
+    const result = await host.github.rest.repos.getReleaseAsset({
+      owner,
+      repo,
+      asset_id: asset.id,
+      headers: { accept: "application/octet-stream" },
+    });
+    const bytes = Buffer.from(result.data);
+    if (
+      bytes.length !== asset.size ||
+      bytes.length > LIMIT ||
+      `sha256:${createHash("sha256").update(bytes).digest("hex")}` !==
+        asset.digest
+    )
+      throw new Error(
+        "Published evidence download differs from provider bytes",
+      );
+    values[asset.name] = bytes;
+  }
+  if (
+    recordDigest(
+      selectedAssets(await inventory(host.request, prefix), names),
+    ) !== recordDigest(selected)
+  )
+    throw new Error(
+      "Published evidence assets changed during provider readback",
+    );
+  return { status: "present", values, assets: selected };
+}

package/packages/core/publication/authority/control-plane.js

@@ -1,8 +1,8 @@
 export function publicationControlPlaneRequest(request) {
   const kind = request.autoAdmissionKind;
   const defaults = {
-    "release-candidate": ".github/workflows/public-release-promote.yml",
-    "publication-artifact": ".github/workflows/public-release-paper.yml",
+    "release-candidate": ".github/workflows/.release-candidate-promote.yml",
+    "publication-artifact": ".github/workflows/.release-paper.yml",
     "binary-release-assets": ".github/workflows/.release-binary-assets.yml",
   };
   if (!defaults[kind])

package/packages/core/publication/authority/seal.js

@@ -26,7 +26,7 @@ export function sealManagedPublicationAdmission({
     );
   const suffix = binary ? ":binary-release-assets" : paper ? ":paper" : "";
   const defaults = {
-    "release-candidate": ".github/workflows/public-release-promote.yml",
+    "release-candidate": ".github/workflows/.release-candidate-promote.yml",
     "publication-artifact": ".github/workflows/public-release-paper-sealed.yml",
     "binary-release-assets": ".github/workflows/.release-binary-assets.yml",
   };