@kungfu-tech/buildchain 4.1.3-alpha.9 → 4.1.4-alpha.0

package/packages/core/publication/cli/dispatch.mjs

@@ -2,22 +2,11 @@ import { npmPublishDryRun } from "../npm/preview.js";
 import { runPublicationArtifactCli } from "../commands/publication-artifact.mjs";
 import { runPublicationPackageCli } from "../commands/publication-package.mjs";
 import { runPublicationReproducibilityCli } from "../commands/publication-reproducibility.mjs";
-import {
-  BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT,
-  formatDiagnosticsSummaryTable,
-  startProcessSampler,
-  summarizeDiagnosticsArtifacts,
-  summarizeProcessSamples,
-  validateAnchoredPackageRelease,
-} from "../../observability/diagnostics.js";
+import { validateAnchoredPackageRelease } from "../../observability/diagnostics.js";
 import {
   printJson,
   readBooleanFlag,
   readFlag,
-  readJsonInput,
-  readRepeatedFlag,
-  readRepeatedJsonInputs,
-  writeJsonFile,
 } from "../../contracts/cli/options.mjs";
 import { runScript } from "../../workflow/cli/process.mjs";
 

package/packages/core/publication/pipeline/actions.js

@@ -11,9 +11,13 @@ import {
 import { applyPipelinePublication } from "./apply.js";
 import { settlePipelinePublication } from "./settle.js";
 import { githubJsonClient } from "../../providers/github/json-client.js";
+import {
+  readPipelineContext,
+  writePipelineContext,
+} from "../../providers/github/pipeline-context-artifacts.js";
 
-const contextInput = (core) =>
-  JSON.parse(core.getInput("context", { required: true }));
+const contextInput = (core, env) =>
+  readPipelineContext(core.getInput("context", { required: true }), env);
 const directory = (env) =>
   path.join(env.GITHUB_WORKSPACE, ".buildchain/publication");
 
@@ -26,7 +30,10 @@ export async function preparePipelinePublicationAction(core, env) {
   );
   core.setOutput("operation", result.operation);
   core.setOutput("stable-wait", result.wait ? JSON.stringify(result.wait) : "");
-  core.setOutput("context", JSON.stringify(result.context || {}));
+  core.setOutput(
+    "context",
+    await writePipelineContext(result.context || {}, env),
+  );
   core.setOutput(
     "matrix",
     JSON.stringify({ include: result.context?.platforms || [] }),
@@ -34,7 +41,7 @@ export async function preparePipelinePublicationAction(core, env) {
 }
 
 export async function buildPipelinePublicationAction(core, env) {
-  const context = contextInput(core);
+  const context = await contextInput(core, env);
   const platform = core.getInput("platform", { required: true });
   const cwd = path.join(env.GITHUB_WORKSPACE, ".buildchain/product");
   await buildPipelineSource({
@@ -59,7 +66,7 @@ export async function buildPipelinePublicationAction(core, env) {
 export async function preparePipelineQualificationAction(core, env) {
   const host = await pipelineHost(core, env, "Qualify and sign products");
   const prepared = await preparePipelineQualification(
-    contextInput(core),
+    await contextInput(core, env),
     host,
     directory(env),
   );
@@ -71,7 +78,7 @@ export async function preparePipelineQualificationAction(core, env) {
 export async function sealPipelineQualificationAction(core, env) {
   const host = await pipelineHost(core, env, "Qualify and sign products");
   await sealPipelineQualification(
-    contextInput(core),
+    await contextInput(core, env),
     host,
     directory(env),
     core.getInput("bundle-path", { required: true }),
@@ -81,7 +88,7 @@ export async function sealPipelineQualificationAction(core, env) {
 export async function applyPipelinePublicationAction(core, env) {
   const host = await pipelineHost(core, env, "Apply qualified publication");
   const result = await applyPipelinePublication(
-    contextInput(core),
+    await contextInput(core, env),
     host,
     directory(env),
     env,
@@ -98,7 +105,7 @@ export async function settlePipelinePublicationAction(core, env) {
       userAgent: "buildchain-next-development",
     });
   const result = await settlePipelinePublication(
-    contextInput(core),
+    await contextInput(core, env),
     host,
     directory(env),
     env,
@@ -106,7 +113,7 @@ export async function settlePipelinePublicationAction(core, env) {
   core.info(result.reason);
   core.setOutput(
     "version-context",
-    JSON.stringify(result.versionContext || {}),
+    await writePipelineContext(result.versionContext || {}, env),
   );
   core.setOutput("operation", result.versionContext ? "regenerate" : "wait");
   core.setOutput(

package/packages/core/publication/pipeline/apply.js

@@ -8,7 +8,11 @@ import {
 } from "../../release/release-invocation.js";
 import { githubPipelineProductRelease } from "../../providers/github/pipeline-product-release.js";
 import { pipelineNpmProvider } from "../npm/pipeline-provider.js";
-import { publicationContext, uniquePublicationMaterial } from "./context.js";
+import {
+  publicationContext,
+  uniquePublicationMaterial,
+  completedPublicationRecovery,
+} from "./context.js";
 import { restorePipelineProducts } from "./sealed-products.js";
 import {
   pipelineReleaseDocuments,
@@ -34,16 +38,14 @@ export async function applyPipelinePublication(
   } = {},
 ) {
   const { journal, archive } = await publicationContext(context, host);
-  const wait = await preparePipelineStableQualification(
-    context.plan,
-    host,
-    journal,
-    {
+  const completed = await completedPublicationRecovery(context, journal);
+  const wait =
+    !completed &&
+    (await preparePipelineStableQualification(context.plan, host, journal, {
       attempt: context.attempt,
       generation: context.generation,
       phase: "publish",
-    },
-  );
+    }));
   if (wait) return { operation: "wait", wait };
   const retained = await uniquePublicationMaterial(
     journal,
@@ -113,7 +115,13 @@ export async function applyPipelinePublication(
   const provider = {
     observe: (effect) => providerFor(effect).observe(effect),
     matches: (effect, value) => providerFor(effect).matches(effect, value),
-    apply: (effect) => providerFor(effect).apply(effect),
+    apply: (effect) => {
+      if (completed)
+        throw new Error(
+          "Completed publication recovery cannot perform new provider effects",
+        );
+      return providerFor(effect).apply(effect);
+    },
   };
   const receipts = await journal.materials("publication/effect/");
   const effects = pipelinePublicationEffects({

package/packages/core/publication/pipeline/context.js

@@ -1,6 +1,7 @@
 import { recordDigest } from "../../release/discussion/envelope.js";
 import { resumePipelineSession } from "../../workflow/pipeline/session.js";
 import { pipelinePublicationJournal } from "./journal.js";
+import { createReleaseReceipt } from "../../release/release-invocation.js";
 
 export async function publicationContext(context, host) {
   if (
@@ -37,3 +38,31 @@ export async function uniquePublicationMaterial(journal, prefix) {
     );
   return values[0];
 }
+
+export async function completedPublicationRecovery(context, journal) {
+  if (!context.recovery?.preserveTransaction) return null;
+  const values = await journal.materials("publication/predecessor-complete/");
+  if (!values.length) return null;
+  const complete = values[0];
+  const retained = await uniquePublicationMaterial(
+    journal,
+    "publication/qualified/",
+  );
+  const receipt = complete.release?.receipt;
+  if (
+    values.length !== 1 ||
+    complete.schema !== "buildchain.pipeline-publication-complete/v1" ||
+    !Number.isFinite(Date.parse(complete.completedAt)) ||
+    receipt?.outcome !== "complete" ||
+    retained.qualified.planRoot !== context.plan.root ||
+    receipt.transactionRoot !==
+      retained.documents.transaction.transactionRoot ||
+    receipt.releasePassportRoot !== retained.documents.passport.passportRoot ||
+    recordDigest(createReleaseReceipt(receipt)) !==
+      recordDigest(complete.release)
+  )
+    throw new Error(
+      "Completed publication recovery changed its retained signed transaction",
+    );
+  return complete;
+}

package/packages/core/publication/pipeline/journal.js

@@ -106,5 +106,17 @@ export function pipelinePublicationJournal(session, host) {
     });
     return value;
   }
-  return { fence, materials, record };
+  async function recordImport(value, phase) {
+    publicationImportedValues(value);
+    const observed = await fence();
+    const id = "publication/recovery-import";
+    const eventKey = `publication:${id}:${recordDigest(value)}`;
+    const prior = observed.history
+      .at(-1)
+      .events.find((event) => event.payload.eventKey === eventKey);
+    // Import is one atomic append, not a new result for each resumed phase.
+    // Replay still verifies the original event, state and retained bytes.
+    return record(id, value, { phase: prior?.node || phase });
+  }
+  return { fence, materials, record, recordImport };
 }

package/packages/core/publication/pipeline/prepare.js

@@ -5,6 +5,7 @@ import { githubPipelineVersion } from "../../providers/github/pipeline-version.j
 import { createPipelinePublicationPlan } from "./source-plan.js";
 import { preparePipelineStableQualification } from "./stable-wait.js";
 import { prepareRecoveredPublication } from "./recovery-prepare.js";
+import { completedPublicationRecovery } from "./context.js";
 import {
   preparePipelineVersionContext,
   retainedPipelineVersionRegeneration,
@@ -48,12 +49,20 @@ export async function preparePipelinePublication(attempt, publisherSha, host) {
     );
     await journal.record("publication/plan", plan);
   }
-  const wait = await preparePipelineStableQualification(plan, host, journal, {
-    attempt,
-    generation: observed.generation,
-    phase,
-  });
-  if (wait) return { operation: "wait", wait };
+  // Native phase order admits follow-ups only after publication succeeded.
+  // Later PR events must not reopen the completed publication's Alpha gate.
+  const completed = await completedPublicationRecovery(
+    { plan, recovery },
+    journal,
+  );
+  if (phase === "publish" && !completed) {
+    const wait = await preparePipelineStableQualification(plan, host, journal, {
+      attempt,
+      generation: observed.generation,
+      phase,
+    });
+    if (wait) return { operation: "wait", wait };
+  }
   if (
     !recovery &&
     (plan.publisher.workflowSha !== publisherSha ||

package/packages/core/publication/pipeline/recovery-import.js

@@ -76,5 +76,5 @@ export async function importRecoveredPublication(
   publicationImportedValues(bundle);
   // One journal append publishes the complete import and derived source/plan.
   // An interruption cannot expose a new plan beside an old materialization.
-  await journal.record("publication/recovery-import", bundle, { phase });
+  await journal.recordImport(bundle, phase);
 }

package/packages/core/publication/pipeline/recovery-materials.js

@@ -68,7 +68,69 @@ export async function readRecoveryPublicationMaterials(session, host) {
     throw new Error(
       "Expanded publication recovery inventory exceeds its bound",
     );
-  return result;
+  return signedRecoveryMaterials(result);
+}
+
+function signedRecoveryMaterials(materials) {
+  const plans = materials.filter((item) =>
+    item.id.startsWith("publication/plan/"),
+  );
+  if (new Set(plans.map((item) => item.value.root)).size < 2) return materials;
+  const retained = recoveryPublicationMaterial(
+    materials,
+    "publication/qualified/",
+  );
+  if (!retained?.signing) return materials;
+  const plan = publicationLineageMaterial(
+    materials,
+    "buildchain.pipeline-publication-plan/v1",
+    (value) => value.root === retained.qualified.planRoot,
+  );
+  const materialization = publicationLineageMaterial(
+    materials,
+    "buildchain.pipeline-version-materialization/v1",
+    (value) => value.root === retained.signing.materializationRoot,
+  );
+  const planIdentity = ({
+    root,
+    publisher: { workflowSha, ...publisher },
+    ...body
+  }) => recordDigest({ ...body, publisher });
+  const sourceIdentity = ({ root, planRoot, ...body }) => recordDigest(body);
+  for (const item of plans)
+    if (planIdentity(item.value) !== planIdentity(plan))
+      throw new Error(
+        "Conflicting recovery plans changed more than the publisher entry",
+      );
+  // Preserve every original reference and member ID. Only a signed lineage
+  // can classify the otherwise identical, unsigned rederivation as history.
+  return materials.map((item) => {
+    let name;
+    if (
+      item.id.startsWith("publication/plan/") &&
+      item.value.root !== plan.root
+    )
+      name = "plan";
+    if (
+      item.id.startsWith("publication/materialization/") &&
+      item.value.root !== materialization.root
+    ) {
+      if (sourceIdentity(item.value) !== sourceIdentity(materialization))
+        throw new Error(
+          "Conflicting recovery materializations changed retained source",
+        );
+      name = "materialization";
+    }
+    return name
+      ? {
+          ...item,
+          id: item.id.replace(
+            `publication/${name}/`,
+            `publication/predecessor-${name}/`,
+          ),
+        }
+      : item;
+  });
 }
 
 export function recoveryPublicationMaterial(

package/packages/core/publication/pipeline/recovery-prepare.js

@@ -54,20 +54,32 @@ export async function prepareRecoveredPublication(
       tree: runtime.tree.sha,
     },
   };
-  await importRecoveredPublication(
-    publication,
-    execution,
-    recoveryPlan.root,
-    journal,
-    phase,
-  );
+  const qualified = await journal.materials("publication/qualified/");
+  if (qualified.length > 1)
+    throw new Error("Recovered publication has conflicting qualifications");
+  if (qualified.length) {
+    const plans = await journal.materials("publication/plan/");
+    if (plans.length !== 1 || plans[0].root !== qualified[0].qualified.planRoot)
+      throw new Error("Recovered qualification lacks its one retained plan");
+  }
+  // A prepared recovery may already have signed and published its derived
+  // plan. Later workers retain that plan even when the floating entry moves.
+  if (!qualified.length)
+    await importRecoveredPublication(
+      publication,
+      execution,
+      recoveryPlan.root,
+      journal,
+      phase,
+    );
+  const mode = qualified.length ? "qualified" : publication.mode;
   return {
     planRoot: recoveryPlan.root,
     predecessor: recoveryPlan.predecessor,
     originalPlanRoot: plan.root,
-    mode: publication.mode,
+    mode,
     build: publication.build || null,
-    preserveTransaction: publication.mode === "qualified",
+    preserveTransaction: mode === "qualified",
     execution,
   };
 }

package/packages/core/publication/pipeline/stable-entry.js

@@ -113,12 +113,21 @@ async function inspectEntryRun(listed, plan, source, host) {
   const { run, jobs } = await host.runs.read(listed.id, listed.run_attempt);
   const consumer = await pipelineEntryRun(run, plan, source, host);
   if (!consumer) return null;
+  const productJobs = jobs.filter((job) =>
+    /(?:^| \/ )Build product \([^)]+\)$/u.test(job.name),
+  );
+  const check = await pipelineEntryCheck(run, host);
+  // Controller-only PR notifications are not new product qualifications. A
+  // failed controller must not displace an earlier actual build. Conversely,
+  // any admitted native receipt or product job (even cancelled/skipped setup)
+  // keeps the execution in scope and must qualify its original full evidence.
   if (
-    !jobs.some((job) => /(?:^| \/ )Build product \([^)]+\)$/u.test(job.name)) &&
-    run.conclusion === "success"
+    !check &&
+    (!productJobs.length ||
+      (run.conclusion === "success" &&
+        productJobs.every((job) => job.conclusion === "skipped")))
   )
     return null;
-  const check = await pipelineEntryCheck(run, host);
   if (!check)
     return {
       status: "missing",

package/packages/core/publication/pipeline/stable-products.js

@@ -17,7 +17,6 @@ function assertPublishedPlan(stablePlan, source, values) {
   const { plan, qualification: qualified, release } = values;
   verifyPipelinePublicationPlan(plan);
   if (
-    plan.evidenceVersion !== 1 ||
     plan.channel !== "alpha" ||
     plan.version !== stablePlan.candidateVersion ||
     plan.tag !== source.candidate.tag ||
@@ -32,17 +31,6 @@ function assertPublishedPlan(stablePlan, source, values) {
     throw new Error(
       "Published product evidence differs from the exact Alpha contract or source",
     );
-  if (
-    plan.publisher.repository !== "kungfu-systems/buildchain" ||
-    plan.publisher.workflow !==
-      ".github/workflows/.release-pipeline-products.yml" ||
-    plan.publisher.job !== "apply" ||
-    !/^[0-9a-f]{40}$/u.test(plan.publisher.workflowSha || "") ||
-    plan.runtime.repository !== "kungfu-systems/buildchain"
-  )
-    throw new Error(
-      "Published product evidence requires the central publisher",
-    );
   const issued = Date.parse(qualified.qualification?.issuedAt);
   if (
     !Number.isFinite(issued) ||
@@ -200,7 +188,11 @@ function completionTime(jobs, qualified, candidate) {
   return new Date(Math.max(...values)).toISOString();
 }
 
-function verifyPublishedDocuments(values, bundle, directory, host, execute) {
+export function verifyPublishedDocuments(
+  values,
+  bundle,
+  { directory, token, execute },
+) {
   const {
     plan,
     qualification: qualified,
@@ -208,6 +200,18 @@ function verifyPublishedDocuments(values, bundle, directory, host, execute) {
     release,
     invocation,
   } = values;
+  if (
+    plan.evidenceVersion !== 1 ||
+    plan.publisher.repository !== "kungfu-systems/buildchain" ||
+    plan.publisher.workflow !==
+      ".github/workflows/.release-pipeline-products.yml" ||
+    plan.publisher.job !== "apply" ||
+    !/^[0-9a-f]{40}$/u.test(plan.publisher.workflowSha || "") ||
+    plan.runtime.repository !== "kungfu-systems/buildchain"
+  )
+    throw new Error(
+      "Published product evidence requires the central publisher",
+    );
   const materialization = release.versionMaterialization;
   const signing = verifyPipelineSigning({
     plan,
@@ -218,7 +222,7 @@ function verifyPublishedDocuments(values, bundle, directory, host, execute) {
       bundle,
     ),
     directory: path.join(directory, "signature"),
-    token: host.token,
+    token,
     // Historical evidence is checked at issue time. It never supplies fresh
     // Stable publisher admission or extends the original receipt's lifetime.
     evaluatedAt: qualified.qualification.issuedAt,
@@ -274,13 +278,11 @@ export async function readPipelineStableProducts(
     path.join(fs.realpathSync(os.tmpdir()), "buildchain-stable-products-"),
   );
   try {
-    const signing = verifyPublishedDocuments(
-      evidence.values,
-      evidence.bundle,
+    const signing = verifyPublishedDocuments(evidence.values, evidence.bundle, {
       directory,
-      host,
+      token: host.token,
       execute,
-    );
+    });
     await reobservePublicationBuild(qualified.build, qualified.source, host);
     const signer = await signingRun(plan, qualified, host);
     const completedAt = completionTime(

package/packages/core/publication/pipeline/version-actions.js

@@ -6,14 +6,18 @@ import { buildPipelineVersionMaterial } from "./version-build.js";
 import { qualifyPipelineVersionContext } from "./version-context.js";
 import { preparePipelinePublication } from "./prepare.js";
 import { settlePipelinePublication } from "./settle.js";
+import {
+  readPipelineContext,
+  writePipelineContext,
+} from "../../providers/github/pipeline-context-artifacts.js";
 
-const contextInput = (core) =>
-  JSON.parse(core.getInput("context", { required: true }));
+const contextInput = (core, env) =>
+  readPipelineContext(core.getInput("context", { required: true }), env);
 const directory = (env) =>
   path.join(env.GITHUB_WORKSPACE, ".buildchain/version-material");
 
 export async function buildPipelineVersionAction(core, env) {
-  const context = contextInput(core);
+  const context = await contextInput(core, env);
   if (
     context.schema !== "buildchain.pipeline-version-context/v1" ||
     context.runId !== Number(env.GITHUB_RUN_ID) ||
@@ -36,7 +40,7 @@ export async function buildPipelineVersionAction(core, env) {
 }
 
 export async function materializePipelinePublicationAction(core, env) {
-  const context = contextInput(core);
+  const context = await contextInput(core, env);
   const operation = core.getInput("operation", { required: true });
   let result = { operation, context };
   if (operation === "regenerate") {
@@ -58,7 +62,12 @@ export async function materializePipelinePublicationAction(core, env) {
   }
   core.setOutput("operation", result.operation);
   core.setOutput("stable-wait", result.wait ? JSON.stringify(result.wait) : "");
-  core.setOutput("context", JSON.stringify(result.context || {}));
+  core.setOutput(
+    "context",
+    operation === "regenerate"
+      ? await writePipelineContext(result.context || {}, env)
+      : core.getInput("context", { required: true }),
+  );
   core.setOutput(
     "matrix",
     JSON.stringify({ include: result.context?.platforms || [] }),
@@ -66,7 +75,7 @@ export async function materializePipelinePublicationAction(core, env) {
 }
 
 export async function materializePipelineDevelopmentAction(core, env) {
-  const context = contextInput(core);
+  const context = await contextInput(core, env);
   if (context.preparation.purpose !== "development")
     throw new Error(
       "Development materialization received a different version purpose",

package/packages/core/publication/publication-rehearsal-projection.js

@@ -9,8 +9,6 @@ export const PUBLICATION_REHEARSAL_AGENT_SECTION_START =
   "<!-- buildchain:publication-rehearsal:start -->";
 export const PUBLICATION_REHEARSAL_AGENT_SECTION_END =
   "<!-- buildchain:publication-rehearsal:end -->";
-export const PUBLICATION_REHEARSAL_WORKFLOW_PATH =
-  ".github/workflows/publication-rehearsal.yml";
 
 export function publicationRehearsalToml() {
   return `[publication_rehearsal]\ncontract = ${JSON.stringify(PUBLICATION_REHEARSAL_CAPSULE_CONTRACT)}\nadr = ${JSON.stringify(RELEASE_LOCAL_CONSTRUCTIBILITY_ADR)}\ninvariant = ${JSON.stringify(RELEASE_LOCAL_CONSTRUCTIBILITY_INVARIANT)}\ncommand = ${JSON.stringify(PUBLICATION_REHEARSAL_COMMAND)}\ncapsule = ".buildchain/publication-rehearsal/capsule.json"\ncandidate_root = ".buildchain/publication-rehearsal/candidate"\nstate = ".buildchain/publication-rehearsal/state.json"\nevidence = ".buildchain/publication-rehearsal/evidence.json"\n`;
@@ -95,10 +93,3 @@ export function mergePublicationRehearsalAgentInstructions(current = "") {
     end + PUBLICATION_REHEARSAL_AGENT_SECTION_END.length,
   )}`;
 }
-
-export function publicationRehearsalWorkflow(buildchainRef) {
-  const ref = String(buildchainRef || "").trim();
-  if (!/^v4(?:-alpha)?$/u.test(ref))
-    throw new Error("publication rehearsal workflow requires a floating public entry");
-  return `name: Publication Rehearsal\n\non:\n  workflow_dispatch:\n    inputs:\n      capsule-path:\n        description: "Source-bound v4 publication rehearsal capsule"\n        required: true\n        default: ".buildchain/publication-rehearsal/capsule.json"\n      candidate-root:\n        description: "Repository-relative candidate root"\n        required: true\n        default: ".buildchain/publication-rehearsal/candidate"\n\npermissions:\n  contents: read\n\njobs:\n  rehearsal:\n    uses: kungfu-systems/buildchain/.github/workflows/public-release-tail.yml@${ref}\n    with:\n      rehearsal-capsule-path: \${{ inputs.capsule-path }}\n      candidate-root: \${{ inputs.candidate-root }}\n      rehearsal-mode: simulate\n      state-path: ".buildchain/publication-rehearsal/state.json"\n      rehearsal-evidence-path: ".buildchain/publication-rehearsal/evidence.json"\n`;
-}

package/packages/core/release/cli/dispatch.mjs

@@ -1,10 +1,7 @@
 import { runReleasePropagationCli } from "../commands/release-propagation.mjs";
 import { runReleaseTailCli } from "../commands/release-tail.mjs";
 import { runTailResealCli } from "../commands/tail-reseal.mjs";
-import {
-  TRUST_RELEASE_COMMANDS,
-  dispatchTrustReleaseCommand,
-} from "./trust-release.mjs";
+import { dispatchTrustReleaseCommand } from "./trust-release.mjs";
 import { packageVersion } from "../../contracts/cli/context.mjs";
 import { runScript } from "../../workflow/cli/process.mjs";
 

package/packages/core/release/cli/inspection-handlers.mjs

@@ -1,44 +1,12 @@
-import fs from "node:fs";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { verifyInfraContractEvidenceBundle } from "../../providers/commands/infra-contract-core.mjs";
-import { verifyBuildchainLogEvents } from "../../observability/logging.js";
-import {
-  explainReleaseLineDryRun,
-  formatReleaseLineDryRun,
-} from "../release-line-dry-run.js";
-import {
-  planReleaseLineBootstrap,
-  writeReleaseLineBootstrapVersionState,
-} from "../release-line-bootstrap.js";
-import { collectGitHubReleasePassport } from "../passport/collection.js";
-import { explainReleasePassport, verifyReleasePassport } from "../release-passport.js";
-import {
-  createPublicationAdmission,
-  createRunnerProvenance,
-  verifyPublicationAdmission,
-} from "../../publication/publication-authority.js";
-import {
-  createGitHubArtifactAttestationPolicy,
-  createGitHubArtifactAttestationVerificationPlan,
-  verifyGitHubArtifactAttestationEvidence,
-} from "../../build/github-artifact-attestation.js";
+import { explainReleasePassport } from "../release-passport.js";
 import {
   explainArtifactPassport,
   verifyArtifactPassport,
 } from "../../build/artifact-passport.js";
 import {
-  projectArtifactVerificationEnvelopeToKfx,
-  verifyArtifactVerificationEnvelope,
-} from "../../build/artifact-verification-envelope.js";
-import {
-  artifactEnvelopeOptions,
   printJson,
   readBooleanFlag,
   readFlag,
-  readJsonInput,
-  readRepeatedFlag,
-  writeJsonFile,
 } from "../../contracts/cli/options.mjs";
 
 async function handleAuditCommand({ args, runScript, packageVersion }) {

package/packages/core/release/cli/release-handlers.mjs

@@ -1,8 +1,4 @@
-import fs from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { verifyInfraContractEvidenceBundle } from "../../providers/commands/infra-contract-core.mjs";
-import { verifyBuildchainLogEvents } from "../../observability/logging.js";
 import {
   explainReleaseLineDryRun,
   formatReleaseLineDryRun,
@@ -12,25 +8,12 @@ import {
   writeReleaseLineBootstrapVersionState,
 } from "../release-line-bootstrap.js";
 import { collectGitHubReleasePassport } from "../passport/collection.js";
-import { explainReleasePassport, verifyReleasePassport } from "../release-passport.js";
 import {
   createPublicationAdmission,
   createRunnerProvenance,
-  verifyPublicationAdmission,
 } from "../../publication/publication-authority.js";
-import {
-  createGitHubArtifactAttestationPolicy,
-  createGitHubArtifactAttestationVerificationPlan,
-  verifyGitHubArtifactAttestationEvidence,
-} from "../../build/github-artifact-attestation.js";
-import {
-  explainArtifactPassport,
-  verifyArtifactPassport,
-} from "../../build/artifact-passport.js";
-import {
-  projectArtifactVerificationEnvelopeToKfx,
-  verifyArtifactVerificationEnvelope,
-} from "../../build/artifact-verification-envelope.js";
+import { createGitHubArtifactAttestationPolicy } from "../../build/github-artifact-attestation.js";
+import { projectArtifactVerificationEnvelopeToKfx } from "../../build/artifact-verification-envelope.js";
 import {
   artifactEnvelopeOptions,
   printJson,