@kungfu-tech/buildchain 4.1.3 → 4.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (199) hide show
  1. package/AGENTS.md +11 -13
  2. package/CONTRIBUTING.md +32 -9
  3. package/README.md +56 -140
  4. package/actions/release/promotion/ref/README.md +1 -1
  5. package/architecture/action-taxonomy.json +1 -1
  6. package/architecture/agent-change-map.md +32 -45
  7. package/architecture/build-orchestration.json +1 -1
  8. package/architecture/capability-state-machine-manifest.json +5 -5
  9. package/architecture/ci-lane-change-budget.json +92 -92
  10. package/architecture/code-layout.json +2 -12
  11. package/architecture/core-mechanisms.json +38 -39
  12. package/architecture/cross-platform-adopter-qualification.json +1 -1
  13. package/architecture/dev-delivery-orchestration.json +2 -2
  14. package/architecture/floating-consumer-policy.json +3 -3
  15. package/architecture/internal-capabilities.json +27 -28
  16. package/architecture/maintainability-debt.json +60 -94
  17. package/architecture/maintainability-policy.json +7 -13
  18. package/architecture/minimal-consumer-migration.json +43 -5014
  19. package/architecture/platform-stage-checkpoints.json +1 -1
  20. package/architecture/release-tail-contract.json +2 -2
  21. package/architecture/release-topology.json +31 -25
  22. package/architecture/stage-capsule-qualification.json +1 -1
  23. package/architecture/universal-workflow-bootstrap.json +60 -60
  24. package/architecture/universal-workflow-capability-policy.json +3 -3
  25. package/architecture/universal-workflow-fault-campaign.json +7 -7
  26. package/architecture/workflow-taxonomy.json +59 -60
  27. package/contracts/fixtures/v4-tail-reseal-v1/valid.json +1 -1
  28. package/dist/site/buildchain-contract.json +138 -66
  29. package/dist/site/buildchain-site.json +257 -331
  30. package/dist/site/capability-registry.json +4 -4
  31. package/dist/site/cli-registry.json +6 -142
  32. package/dist/site/controller-registry.json +19 -19
  33. package/dist/site/kfd-claims.json +481 -529
  34. package/dist/site/kfd-upstream-aggregate.json +1 -1
  35. package/dist/site/manual-registry.json +22 -22
  36. package/dist/site/node-api-registry.json +82 -339
  37. package/dist/site/page-registry.json +229 -304
  38. package/dist/site/public-surface-audit.json +544 -754
  39. package/dist/site/publication-authority-registry.json +316 -316
  40. package/dist/site/publication-registry.json +1 -1
  41. package/dist/site/site-manifest.json +23 -23
  42. package/dist/site/workflow-registry.json +1071 -1027
  43. package/docs/MAP.md +28 -20
  44. package/docs/auditable-demo.md +17 -49
  45. package/docs/bootstrap-recovery.md +46 -37
  46. package/docs/cli-reference.md +2 -46
  47. package/docs/cli.md +97 -186
  48. package/docs/code-organization.md +7 -5
  49. package/docs/dev-alpha-candidate-patrol.md +19 -42
  50. package/docs/dev-delivery-orchestration.md +15 -11
  51. package/docs/dev-delivery-qualification-landing-adr.md +10 -9
  52. package/docs/dev-delivery-warrant.md +17 -16
  53. package/docs/dev-qualification-patrol.md +25 -20
  54. package/docs/getting-started.md +80 -139
  55. package/docs/github-artifact-attestation.md +31 -81
  56. package/docs/install.md +66 -30
  57. package/docs/lifecycle-protocol.md +19 -57
  58. package/docs/migration-inventory.md +17 -45
  59. package/docs/next-development-transition.md +13 -13
  60. package/docs/node-api-reference.md +122 -138
  61. package/docs/oci-publication.md +13 -10
  62. package/docs/publication-artifacts.md +128 -486
  63. package/docs/publication-authority.md +15 -45
  64. package/docs/publish-transaction.md +13 -11
  65. package/docs/release-candidate.md +126 -355
  66. package/docs/release-discussions.md +36 -67
  67. package/docs/release-flow.md +80 -339
  68. package/docs/release-governance.md +114 -962
  69. package/docs/release-promotion-request.md +45 -43
  70. package/docs/release-propagation.md +13 -27
  71. package/docs/release-tail-provider-plane.md +38 -65
  72. package/docs/reusable-build-surface.md +78 -196
  73. package/docs/runtime-train-validation.md +8 -6
  74. package/docs/stable-candidate-patrol.md +13 -66
  75. package/docs/v4-adopter-delivery.md +15 -15
  76. package/docs/v4-declarative-release-tail-migration.md +19 -17
  77. package/docs/v4-production-release.md +11 -6
  78. package/docs/v4-publication-rehearsal.md +12 -27
  79. package/docs/v4-stage-capsule.md +14 -20
  80. package/docs/v4-tail-reseal.md +34 -20
  81. package/docs/web-surface-deployments.md +26 -264
  82. package/docs/workflow-catalog.md +31 -31
  83. package/docs/workflow-path-migration.md +10 -4
  84. package/package.json +5 -4
  85. package/packages/core/adoption/buildchain-kfd-claims.js +7 -7
  86. package/packages/core/adoption/cli/output.mjs +1 -9
  87. package/packages/core/adoption/cli/product-gate.mjs +1 -15
  88. package/packages/core/adoption/cli/project.mjs +9 -10
  89. package/packages/core/adoption/cli/standards.mjs +1 -14
  90. package/packages/core/adoption/cli/support.mjs +0 -2
  91. package/packages/core/adoption/cli/surface-register.mjs +0 -2
  92. package/packages/core/adoption/commands/init-repo.mjs +77 -485
  93. package/packages/core/adoption/consumer-init.js +279 -0
  94. package/packages/core/adoption/qualification/admission.js +1 -1
  95. package/packages/core/build/cli/cache.mjs +0 -2
  96. package/packages/core/build/cli/facts.mjs +0 -3
  97. package/packages/core/build/cli/homebrew.mjs +0 -4
  98. package/packages/core/build/cli/lifecycle.mjs +0 -3
  99. package/packages/core/build/github-artifact-attestation.js +2 -2
  100. package/packages/core/build/platform-stage-checkpoints.js +1 -1
  101. package/packages/core/build/signing/dispatch.js +1 -1
  102. package/packages/core/consumer/buildchain-config.js +9 -0
  103. package/packages/core/consumer/contract/inspection.js +351 -9
  104. package/packages/core/consumer/contract/javascript-syntax.js +439 -0
  105. package/packages/core/consumer/contract/javascript-values.js +61 -0
  106. package/packages/core/consumer/contract/javascript.js +555 -0
  107. package/packages/core/consumer/contract/local-validation.js +84 -0
  108. package/packages/core/contracts/buildchain-contract.js +39 -8
  109. package/packages/core/contracts/cli/introspection.mjs +1 -9
  110. package/packages/core/contracts/public-surface-cli.js +0 -1
  111. package/packages/core/dev-delivery/dev-delivery-contract-surface.js +2 -2
  112. package/packages/core/governance/buildchain-publication-authority.js +24 -24
  113. package/packages/core/governance/cli/doctor.mjs +58 -42
  114. package/packages/core/governance/commands/architecture.mjs +6 -1
  115. package/packages/core/governance/commands/audit-publication-control-plane.mjs +1 -1
  116. package/packages/core/governance/commands/workflow-friction-report.mjs +1 -1
  117. package/packages/core/governance/github-governance-authority.js +2 -2
  118. package/packages/core/governance/publication/collection.js +1 -1
  119. package/packages/core/index.js +1 -3
  120. package/packages/core/observability/cli/candidate.mjs +0 -2
  121. package/packages/core/observability/cli/context.mjs +0 -5
  122. package/packages/core/observability/cli/diagnostics.mjs +0 -7
  123. package/packages/core/observability/cli/events.mjs +2 -10
  124. package/packages/core/paper/commands/paper-work-fleet-cli.mjs +1 -1
  125. package/packages/core/paper/commands/paper.mjs +33 -422
  126. package/packages/core/paper/consumer-status.js +72 -0
  127. package/packages/core/paper/operations/identity.js +0 -3
  128. package/packages/core/paper/operations/migration.js +460 -0
  129. package/packages/core/paper/operations/preflight-checks.js +8 -68
  130. package/packages/core/paper/operations/scaffold.js +16 -326
  131. package/packages/core/paper/operations/status.js +27 -53
  132. package/packages/core/paper/paper-agent-entry.js +36 -147
  133. package/packages/core/paper/paper-fleet.js +24 -39
  134. package/packages/core/paper/paper-repository.js +16 -0
  135. package/packages/core/paper/paper-runtime-channels.js +1 -1
  136. package/packages/core/paper/paper-scaffold-content.js +153 -162
  137. package/packages/core/paper/paper-work.js +3 -10
  138. package/packages/core/paper/paper.js +43 -5
  139. package/packages/core/providers/github/artifact-attestation.js +1 -1
  140. package/packages/core/providers/github/pipeline-context-artifacts.js +172 -0
  141. package/packages/core/publication/authority/control-plane.js +2 -2
  142. package/packages/core/publication/authority/seal.js +1 -1
  143. package/packages/core/publication/cli/dispatch.mjs +1 -12
  144. package/packages/core/publication/pipeline/actions.js +16 -9
  145. package/packages/core/publication/pipeline/apply.js +17 -9
  146. package/packages/core/publication/pipeline/context.js +29 -0
  147. package/packages/core/publication/pipeline/prepare.js +15 -6
  148. package/packages/core/publication/pipeline/recovery-materials.js +63 -1
  149. package/packages/core/publication/pipeline/recovery-prepare.js +21 -9
  150. package/packages/core/publication/pipeline/stable-entry.js +12 -7
  151. package/packages/core/publication/pipeline/stable-products.js +21 -19
  152. package/packages/core/publication/pipeline/version-actions.js +15 -6
  153. package/packages/core/publication/publication-rehearsal-projection.js +0 -9
  154. package/packages/core/release/cli/dispatch.mjs +1 -4
  155. package/packages/core/release/cli/inspection-handlers.mjs +1 -33
  156. package/packages/core/release/cli/release-handlers.mjs +2 -19
  157. package/packages/core/release/cli/verification-handlers.mjs +4 -25
  158. package/packages/core/release/next-development-projection.js +13 -13
  159. package/packages/core/release/passport/locations.js +13 -8
  160. package/packages/core/release/release-passport.js +70 -5
  161. package/packages/core/web/cli/badges.mjs +0 -4
  162. package/packages/core/web/publication-admission.js +1 -1
  163. package/packages/core/web/publication-capability.js +1 -1
  164. package/packages/core/web/readme-badges.js +1 -1
  165. package/packages/core/workflow/cli/main.mjs +1 -4
  166. package/packages/core/workflow/cli/process.mjs +1 -1
  167. package/packages/core/workflow/commands/buildchain-cli-help.mjs +2 -8
  168. package/packages/core/workflow/engine/conformance.js +1 -1
  169. package/packages/core/workflow/pipeline/build.js +21 -1
  170. package/packages/core/workflow/pipeline/delivery-observation.js +6 -2
  171. package/packages/core/workflow/workflow-taxonomy.mjs +61 -17
  172. package/scripts/check-code-layout.mjs +2 -0
  173. package/scripts/check-core-mechanism-inventory.mjs +29 -13
  174. package/scripts/check-floating-consumer-policy-contract.mjs +3 -3
  175. package/scripts/check-inventory.mjs +27 -27
  176. package/scripts/check-maintainability.mjs +28 -5
  177. package/scripts/check-public-dogfood-contract.mjs +3 -3
  178. package/scripts/check-release-topology.mjs +1 -1
  179. package/scripts/check-self-consumer-contract.mjs +7 -7
  180. package/scripts/check-universal-workflow-bootstrap.mjs +1 -1
  181. package/scripts/generate-channel-promotion-workflow.mjs +1 -1
  182. package/scripts/generate-minimal-consumer-contract.mjs +21 -1
  183. package/scripts/generate-site-bundle.mjs +2 -1
  184. package/scripts/generate-tail-reseal-fixture.mjs +3 -3
  185. package/scripts/inventory/promotion.mjs +1 -1
  186. package/scripts/next-development-self-dogfood-harness.mjs +1 -1
  187. package/scripts/next-development-self-dogfood.mjs +4 -4
  188. package/scripts/site-capability-metadata.mjs +2 -6
  189. package/scripts/source-metric-lineage.mjs +62 -7
  190. package/scripts/verify-golden-path.mjs +31 -35
  191. package/templates/native-dev-delivery.yml +1 -1
  192. package/templates/universal-buildchain-bootstrap.yml +1 -1
  193. package/packages/core/paper/operations/bootstrap.js +0 -75
  194. package/packages/core/paper/operations/plans.js +0 -213
  195. package/packages/core/paper/operations/provisioning.js +0 -113
  196. package/packages/core/paper/operations/scaffold-config.js +0 -77
  197. package/packages/core/paper/operations/scaffold-workflows.js +0 -116
  198. package/packages/core/paper/operations/workspace.js +0 -60
  199. package/packages/core/paper/paper-npm-bootstrap.js +0 -492
@@ -16,6 +16,7 @@ import { evaluateBuildchainContractLock as evaluateFactBackedBuildchainContractL
16
16
  import { createControllerRegistry } from "../observability/controller-evidence.js";
17
17
  import { enumerateWorkflowInputs } from "./public-surface-audit.js";
18
18
  import { devDeliveryWorkflowContractSurface } from "../dev-delivery/dev-delivery-contract-surface.js";
19
+ import { PIPELINE_ENTRY, RECOVERY_ENTRY } from "../consumer/contract/entries.js";
19
20
 
20
21
  export {
21
22
  BUILDCHAIN_CHANNELS,
@@ -101,6 +102,13 @@ function maybeFileDigest(root, relPath) {
101
102
  }
102
103
 
103
104
  function surface(root, value) {
105
+ if (["workflow", "action", "controller"].includes(value.kind))
106
+ value = {
107
+ ...value,
108
+ apiRole: value.kind === "workflow" && [PIPELINE_ENTRY, RECOVERY_ENTRY].includes(value.path)
109
+ ? "public"
110
+ : "implementation",
111
+ };
104
112
  if (value.kind === "workflow" && fs.existsSync(path.join(root, value.path))) {
105
113
  const contract = parseReusableWorkflowInterface(fs.readFileSync(path.join(root, value.path), "utf8"));
106
114
  value = { ...value, requiredInputs: contract.inputs.filter(x => x.required).map(x => x.name), optionalInputs: contract.inputs.filter(x => !x.required).map(x => x.name), requiredOutputs: contract.outputs.map(x => typeof x === "string" ? x : x.name) };
@@ -108,6 +116,7 @@ function surface(root, value) {
108
116
  const breakingModel = {
109
117
  id: value.id,
110
118
  kind: value.kind,
119
+ ...(value.apiRole ? { apiRole: value.apiRole } : {}),
111
120
  contractVersion: value.contractVersion || 1,
112
121
  requiredInputs: value.requiredInputs || [],
113
122
  requiredOutputs: value.requiredOutputs || [],
@@ -134,8 +143,8 @@ function declarativeAuditableDemoSurface(root, pkg, majorLine) {
134
143
  return surface(root, {
135
144
  id: "declarative-auditable-demo",
136
145
  kind: "workflow",
137
- path: ".github/workflows/public-build-demo.yml",
138
- publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/public-build-demo.yml@${majorLine}`,
146
+ path: ".github/workflows/.build-demo.yml",
147
+ publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.build-demo.yml@${majorLine}`,
139
148
  breakingDefaults: {
140
149
  scenarioPathDefault: ".buildchain/auditable-demo.json",
141
150
  renderMediaDefault: false,
@@ -213,6 +222,28 @@ export function createBuildchainContractWorld({
213
222
  ? createControllerRegistry({ workflows: workflowDescriptors })
214
223
  : readJson(path.join(root, "dist/site/controller-registry.json"), { controllers: [] }));
215
224
  const surfaces = [
225
+ surface(root, {
226
+ id: "pipeline",
227
+ kind: "workflow",
228
+ path: PIPELINE_ENTRY,
229
+ publicRef: `kungfu-systems/buildchain/${PIPELINE_ENTRY}@${majorLine}`,
230
+ breakingDefaults: { configurationAuthority: ".buildchain/buildchain.toml", schema: 2 },
231
+ guarantees: [
232
+ "one product-independent generated caller admits normal repository events",
233
+ "the published runtime owns protected delivery, publication and provider readback",
234
+ ],
235
+ }),
236
+ surface(root, {
237
+ id: "attempt-recovery",
238
+ kind: "workflow",
239
+ path: RECOVERY_ENTRY,
240
+ publicRef: `kungfu-systems/buildchain/${RECOVERY_ENTRY}@${majorLine}`,
241
+ breakingDefaults: { selector: "exact-attempt", repairedRuntime: "optional-transient-input" },
242
+ guarantees: [
243
+ "recovery retains original source, materials and immutable publication evidence",
244
+ "consumers cannot replace provider effects, artifacts or source through recovery inputs",
245
+ ],
246
+ }),
216
247
  surface(root, {
217
248
  id: "reusable-build",
218
249
  kind: "workflow",
@@ -234,8 +265,8 @@ export function createBuildchainContractWorld({
234
265
  surface(root, {
235
266
  id: "channel-build-router",
236
267
  kind: "workflow",
237
- path: ".github/workflows/build.yml",
238
- publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/build.yml@${majorLine}`,
268
+ path: ".github/workflows/.build-candidate.yml",
269
+ publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.build-candidate.yml@${majorLine}`,
239
270
  breakingDefaults: {
240
271
  configurationAuthority: "buildchain.toml",
241
272
  runtimeIdentity: "entry-selected-complete-runtime",
@@ -253,8 +284,8 @@ export function createBuildchainContractWorld({
253
284
  surface(root, {
254
285
  id: "release-candidate-promote",
255
286
  kind: "workflow",
256
- path: ".github/workflows/public-release-promote.yml",
257
- publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/public-release-promote.yml@${majorLine}`,
287
+ path: ".github/workflows/.release-candidate-promote.yml",
288
+ publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.release-candidate-promote.yml@${majorLine}`,
258
289
  breakingDefaults: {
259
290
  channelDefault: "auto",
260
291
  runtimeSelectionOwner: "actions/runtime/selection/resolve",
@@ -311,8 +342,8 @@ export function createBuildchainContractWorld({
311
342
  surface(root, {
312
343
  id: "web-surface",
313
344
  kind: "workflow",
314
- path: ".github/workflows/public-release-web.yml",
315
- publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/public-release-web.yml@${majorLine}`,
345
+ path: ".github/workflows/.release-web.yml",
346
+ publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.release-web.yml@${majorLine}`,
316
347
  breakingDefaults: {
317
348
  runtimeSelectionOwner: "actions/runtime/selection/resolve",
318
349
  contractCompatibilityPolicy: "major-compatible",
@@ -1,15 +1,7 @@
1
1
  import { BUILDCHAIN_USAGE } from "../../workflow/commands/buildchain-cli-help.mjs";
2
2
  import { formatCliHelp } from "../cli-reference.js";
3
3
  import { createBuildchainLayoutDiscovery } from "../buildchain-layout.js";
4
- import {
5
- printJson,
6
- readBooleanFlag,
7
- readFlag,
8
- readJsonInput,
9
- readRepeatedFlag,
10
- readRepeatedJsonInputs,
11
- writeJsonFile,
12
- } from "./options.mjs";
4
+ import { printJson, readBooleanFlag, readFlag } from "./options.mjs";
13
5
  import { packageVersion } from "./context.mjs";
14
6
 
15
7
  export async function handleHelpCommand(args) {
@@ -35,7 +35,6 @@ function kfdCommandId(sub, leaf) {
35
35
  }
36
36
 
37
37
  function paperCommandId(sub, leaf) {
38
- if (sub === "bootstrap" && leaf === "npm") return "paper-bootstrap-npm";
39
38
  if (["work", "fleet"].includes(sub) && leaf) return `paper-${sub}-${leaf}`;
40
39
  return sub ? `paper-${sub}` : "paper";
41
40
  }
@@ -2,8 +2,8 @@ export function devDeliveryWorkflowContractSurface(pkg, majorLine) {
2
2
  return {
3
3
  id: "dev-pr-auto-merge",
4
4
  kind: "workflow",
5
- path: ".github/workflows/public-ops-dev-auto-merge.yml",
6
- publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/public-ops-dev-auto-merge.yml@${majorLine}`,
5
+ path: ".github/workflows/.ops-dev-auto-merge.yml",
6
+ publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.ops-dev-auto-merge.yml@${majorLine}`,
7
7
  breakingDefaults: {
8
8
  runtimeSelectorDefault: "consumer-contract-lock-or-entry",
9
9
  authorityMode: "two-phase-delivery-warrant",
@@ -6,45 +6,45 @@ import { createPublicationAuthorityRegistry } from "../publication/publication-a
6
6
  const DESCRIPTORS = Object.freeze([
7
7
  [".github/workflows/buildchain.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
8
8
  [".github/workflows/buildchain-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
9
- [".github/workflows/public-release-oci-compose-preview.yml", "product-publication", true, ["oci-compose-preview"], "caller-secrets", "none", "fixed", "caller-bound"],
9
+ [".github/workflows/.release-oci-compose-preview.yml", "product-publication", true, ["oci-compose-preview"], "caller-secrets", "none", "fixed", "caller-bound"],
10
10
  [".github/workflows/.build-demo-adapter.yml", "non-publication-oidc"],
11
- [".github/workflows/public-build-demo.yml", "governance-write"],
11
+ [".github/workflows/.build-demo.yml", "governance-write"],
12
12
  [".github/workflows/.build.yml", "non-publication-oidc"],
13
13
  [".github/workflows/.release-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
14
14
  [".github/workflows/.release-authority.yml", "evidence-publication"],
15
15
  [".github/workflows/.build-release-verify-compat.yml", "governance-write"],
16
16
  [".github/workflows/.build-sam-verify-compat.yml", "retired-deny"],
17
17
  [".github/workflows/.ops-git-sync.yml", "governance-write"],
18
- [".github/workflows/public-release-web.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
18
+ [".github/workflows/.release-web.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
19
19
  [".github/workflows/.build-wheel-verify-compat.yml", "retired-deny"],
20
20
  [".github/workflows/.release-binary-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
21
- [".github/workflows/public-release-signing-authority.yml", "evidence-publication"],
22
- [".github/workflows/build.yml", "non-publication-oidc"],
23
- [".github/workflows/public-ops-bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
24
- [".github/workflows/public-ops-patrol.yml", "governance-write"],
25
- [".github/workflows/public-ops-dev-qualification-patrol.yml", "governance-write"],
26
- [".github/workflows/public-ops-alpha-candidate-patrol.yml", "governance-write"],
27
- [".github/workflows/public-ops-warrant-close.yml", "governance-write"],
28
- [".github/workflows/public-ops-warrant-cancel.yml", "governance-write"],
29
- [".github/workflows/public-ops-dev-auto-merge.yml", "governance-write"],
21
+ [".github/workflows/.release-signing-authority.yml", "evidence-publication"],
22
+ [".github/workflows/.build-candidate.yml", "non-publication-oidc"],
23
+ [".github/workflows/.ops-bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
24
+ [".github/workflows/.ops-patrol.yml", "governance-write"],
25
+ [".github/workflows/.ops-dev-qualification-patrol.yml", "governance-write"],
26
+ [".github/workflows/.ops-alpha-candidate-patrol.yml", "governance-write"],
27
+ [".github/workflows/.ops-warrant-close.yml", "governance-write"],
28
+ [".github/workflows/.ops-warrant-cancel.yml", "governance-write"],
29
+ [".github/workflows/.ops-dev-auto-merge.yml", "governance-write"],
30
30
  [".github/workflows/public-ops-pipeline.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
31
31
  [".github/workflows/public-ops-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
32
32
  [".github/workflows/.ops-pipeline-execute.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
33
33
  [".github/workflows/.release-pipeline-products.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed"],
34
34
  [".github/workflows/.release-pipeline-version.yml", "governance-write"],
35
35
  [".github/workflows/.ops-pipeline-delivery.yml", "governance-write"],
36
- [".github/workflows/public-ops-housekeeping.yml", "governance-write"],
37
- [".github/workflows/public-release-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
38
- [".github/workflows/public-release-paper.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
39
- [".github/workflows/public-ops-patrol-daily.yml", "governance-write"],
40
- [".github/workflows/public-ops-patrol-monthly.yml", "governance-write"],
41
- [".github/workflows/public-ops-observed-evidence.yml", "product-publication", true, ["observed-evidence-publication"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
42
- [".github/workflows/public-ops-patrol-weekly.yml", "governance-write"],
43
- [".github/workflows/public-build-publication.yml", "evidence-publication"],
44
- [".github/workflows/public-release-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
45
- [".github/workflows/public-release-propagation.yml", "governance-write"],
46
- [".github/workflows/public-release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
47
- [".github/workflows/public-ops-stable-candidate-patrol.yml", "governance-write"],
36
+ [".github/workflows/.ops-housekeeping.yml", "governance-write"],
37
+ [".github/workflows/.release-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
38
+ [".github/workflows/.release-paper.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
39
+ [".github/workflows/.ops-patrol-daily.yml", "governance-write"],
40
+ [".github/workflows/.ops-patrol-monthly.yml", "governance-write"],
41
+ [".github/workflows/.ops-observed-evidence.yml", "product-publication", true, ["observed-evidence-publication"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
42
+ [".github/workflows/.ops-patrol-weekly.yml", "governance-write"],
43
+ [".github/workflows/.build-publication.yml", "evidence-publication"],
44
+ [".github/workflows/.release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
45
+ [".github/workflows/.release-propagation.yml", "governance-write"],
46
+ [".github/workflows/.release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
47
+ [".github/workflows/.ops-stable-candidate-patrol.yml", "governance-write"],
48
48
  ]);
49
49
 
50
50
  export function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) {
@@ -1,24 +1,14 @@
1
- import { spawn, spawnSync } from "node:child_process";
1
+ import { spawnSync } from "node:child_process";
2
2
  import fs from "node:fs";
3
3
  import path from "node:path";
4
4
  import { validateBuildchainConfig } from "../../consumer/buildchain-config.js";
5
+ import { validateConsumerWiring } from "../../consumer/contract/local-validation.js";
5
6
  import { detectPackageManager } from "../../build/package-manager.js";
6
- import {
7
- BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT,
8
- formatDiagnosticsSummaryTable,
9
- startProcessSampler,
10
- summarizeDiagnosticsArtifacts,
11
- summarizeProcessSamples,
12
- validateAnchoredPackageRelease,
13
- } from "../../observability/diagnostics.js";
7
+ import { validateAnchoredPackageRelease } from "../../observability/diagnostics.js";
14
8
  import {
15
9
  printJson,
16
10
  readBooleanFlag,
17
11
  readFlag,
18
- readJsonInput,
19
- readRepeatedFlag,
20
- readRepeatedJsonInputs,
21
- writeJsonFile,
22
12
  } from "../../contracts/cli/options.mjs";
23
13
 
24
14
  export function checkStatus(ok, id, message, details = {}) {
@@ -51,19 +41,25 @@ export function runDoctor({
51
41
  } catch (error) {
52
42
  checks.push(checkStatus(false, "config.valid", error.message));
53
43
  }
54
- try {
55
- const manager = detectPackageManager(resolvedCwd);
56
- checks.push(
57
- checkStatus(
58
- true,
59
- "package-manager.detected",
60
- `package manager: ${manager.name}`,
61
- manager,
62
- ),
63
- );
64
- } catch (error) {
65
- checks.push(checkStatus(false, "package-manager.detected", error.message));
66
- }
44
+ if (
45
+ validation?.config.schema !== 2 ||
46
+ validation.products.some((product) => product.type === "npm")
47
+ )
48
+ try {
49
+ const manager = detectPackageManager(resolvedCwd);
50
+ checks.push(
51
+ checkStatus(
52
+ true,
53
+ "package-manager.detected",
54
+ `package manager: ${manager.name}`,
55
+ manager,
56
+ ),
57
+ );
58
+ } catch (error) {
59
+ checks.push(
60
+ checkStatus(false, "package-manager.detected", error.message),
61
+ );
62
+ }
67
63
  const git = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
68
64
  cwd: resolvedCwd,
69
65
  encoding: "utf8",
@@ -75,23 +71,43 @@ export function runDoctor({
75
71
  "directory is a git repository",
76
72
  ),
77
73
  );
78
- const workflowPath = path.join(
79
- resolvedCwd,
80
- ".github",
81
- "workflows",
82
- "build.yml",
83
- );
84
- checks.push(
85
- checkStatus(
86
- fs.existsSync(workflowPath),
87
- "workflow.build",
88
- "reusable workflow caller exists",
89
- {
90
- path: ".github/workflows/build.yml",
91
- },
92
- ),
93
- );
74
+ if (validation?.config.schema === 2) {
75
+ try {
76
+ const wiring = validateConsumerWiring(
77
+ resolvedCwd,
78
+ validation.config.path,
79
+ );
80
+ checks.push(
81
+ checkStatus(
82
+ true,
83
+ "workflow.consumer-pair",
84
+ "shared consumer callers match the published contract",
85
+ wiring,
86
+ ),
87
+ );
88
+ } catch (error) {
89
+ checks.push(checkStatus(false, "workflow.consumer-pair", error.message));
90
+ }
91
+ } else {
92
+ const workflowPath = path.join(
93
+ resolvedCwd,
94
+ ".github",
95
+ "workflows",
96
+ "build.yml",
97
+ );
98
+ checks.push(
99
+ checkStatus(
100
+ fs.existsSync(workflowPath),
101
+ "workflow.build",
102
+ "reusable workflow caller exists",
103
+ {
104
+ path: ".github/workflows/build.yml",
105
+ },
106
+ ),
107
+ );
108
+ }
94
109
  if (
110
+ validation?.config.schema !== 2 &&
95
111
  validation?.version?.strategy === "anchored" &&
96
112
  validation.version.next === "manual"
97
113
  ) {
@@ -211,7 +211,12 @@ function validateCapabilities(capabilities, inventory, issues) {
211
211
  `${capability.id} owner drifted from the current inventory`,
212
212
  );
213
213
  for (const surface of capability.surfaces || [])
214
- if (!source.publicSurfaces.includes(surface))
214
+ if (
215
+ ![
216
+ ...source.publicSurfaces,
217
+ ...(source.internalSurfaces || []),
218
+ ].includes(surface)
219
+ )
215
220
  issues.push(
216
221
  `${capability.id} has undeclared current surface: ${surface}`,
217
222
  );
@@ -5,7 +5,7 @@ const flag = (name, fallback = "") => process.argv.includes(`--${name}`) ? Strin
5
5
  try {
6
6
  const repository = flag("repository");
7
7
  const workflowRepository = flag("workflow-repository", repository);
8
- const workflowPath = flag("workflow", ".github/workflows/public-release-promote.yml");
8
+ const workflowPath = flag("workflow", ".github/workflows/.release-candidate-promote.yml");
9
9
  const workflowRef = flag("workflow-ref");
10
10
  const publisherWorkflowPath = flag("publisher-workflow", workflowPath);
11
11
  const requiredStatusCheck = flag("required-status-check", "check");
@@ -5,7 +5,7 @@ import { recordBuildchainControlPlaneOutcome } from "../../observability/logging
5
5
  import { pathToFileURL } from "node:url";
6
6
  import { writeGitHubOutputs } from "../../providers/commands/github-output.mjs";
7
7
 
8
- const DEFAULT_BUILD_WORKFLOW_FILE = "build.yml";
8
+ const DEFAULT_BUILD_WORKFLOW_FILE = ".build-candidate.yml";
9
9
  const DEFAULT_BUILD_WORKFLOW_NAME = "Build";
10
10
 
11
11
  class GitHubApiError extends Error {
@@ -120,9 +120,9 @@ const PROTECTED_AUTHORITY_PATHS = Object.freeze([
120
120
  ".github/workflows/self-ops-promotion-recovery.yml",
121
121
  ".github/workflows/self-release-promote.yml",
122
122
  ".github/workflows/self-ops-governance-audit.yml",
123
- ".github/workflows/public-release-paper.yml",
123
+ ".github/workflows/.release-paper.yml",
124
124
  ".github/workflows/self-release-line-open.yml",
125
- ".github/workflows/public-release-promote.yml",
125
+ ".github/workflows/.release-candidate-promote.yml",
126
126
  "actions/release/promotion/ref/action.yml",
127
127
  "actions/release/promotion/ref/dist/index.js",
128
128
  "actions/release/promotion/ref/index.js",
@@ -223,7 +223,7 @@ export function collectPublicationControlPlane(
223
223
  {
224
224
  repository,
225
225
  workflowRepository = repository,
226
- workflowPath = ".github/workflows/public-release-promote.yml",
226
+ workflowPath = ".github/workflows/.release-candidate-promote.yml",
227
227
  workflowRef = "",
228
228
  publisherWorkflowPath = workflowPath,
229
229
  requiredStatusCheck = "check",
@@ -652,12 +652,10 @@ export {
652
652
  verifyPublicationSealedBundle,
653
653
  } from "./publication/publication-sealed-bundle.js";
654
654
 
655
- export { PAPER_ALPHA_PLAN_CONTRACT, PAPER_BUILD_PLAN_CONTRACT, PAPER_MIGRATION_CONTRACT, PAPER_NPM_BOOTSTRAP_CONTRACT, PAPER_PREFLIGHT_CONTRACT, PAPER_RESUME_PLAN_CONTRACT, PAPER_SCAFFOLD_CONTRACT, PAPER_STATE_ORDER, PAPER_STATUS_CONTRACT, PAPER_VISIBILITY_CONTRACT } from "./paper/operations/identity.js";
655
+ export { PAPER_MIGRATION_CONTRACT, PAPER_NPM_BOOTSTRAP_CONTRACT, PAPER_PREFLIGHT_CONTRACT, PAPER_SCAFFOLD_CONTRACT, PAPER_STATE_ORDER, PAPER_STATUS_CONTRACT, PAPER_VISIBILITY_CONTRACT } from "./paper/operations/identity.js";
656
656
  export { PAPER_PATHS, resolvePaperRepository } from "./paper/paper-repository.js";
657
657
  export { collectPaperPreflight } from "./paper/paper.js";
658
658
  export { collectPaperStatus } from "./paper/operations/status.js";
659
- export { createPaperAlphaPlan, createPaperBuildPlan, createPaperResumePlan } from "./paper/operations/plans.js";
660
- export { executePaperNpmBootstrap } from "./paper/operations/bootstrap.js";
661
659
  export { planPaperMigration, planPaperScaffold, writePaperMigration, writePaperScaffold } from "./paper/operations/scaffold.js"; export * from "./paper/paper-work.js"; export * from "./paper/paper-fleet.js";
662
660
 
663
661
  export {
@@ -8,8 +8,6 @@ import {
8
8
  readBooleanFlag,
9
9
  readFlag,
10
10
  readJsonInput,
11
- readRepeatedFlag,
12
- readRepeatedJsonInputs,
13
11
  writeJsonFile,
14
12
  } from "../../contracts/cli/options.mjs";
15
13
 
@@ -1,16 +1,11 @@
1
1
  import {
2
2
  createBuildchainLogger,
3
3
  defaultBuildchainLogPath,
4
- summarizeBuildchainLogEvents,
5
4
  } from "../logging.js";
6
5
  import {
7
- printJson,
8
6
  readBooleanFlag,
9
7
  readFlag,
10
- readJsonInput,
11
8
  readRepeatedFlag,
12
- readRepeatedJsonInputs,
13
- writeJsonFile,
14
9
  } from "../../contracts/cli/options.mjs";
15
10
 
16
11
  export function readAttributes(args) {
@@ -1,18 +1,11 @@
1
1
  import {
2
- BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT,
3
2
  formatDiagnosticsSummaryTable,
4
- startProcessSampler,
5
3
  summarizeDiagnosticsArtifacts,
6
- summarizeProcessSamples,
7
- validateAnchoredPackageRelease,
8
4
  } from "../diagnostics.js";
9
5
  import {
10
6
  printJson,
11
7
  readBooleanFlag,
12
8
  readFlag,
13
- readJsonInput,
14
- readRepeatedFlag,
15
- readRepeatedJsonInputs,
16
9
  writeJsonFile,
17
10
  } from "../../contracts/cli/options.mjs";
18
11
  function readDiagnosticsArtifactInputs(args) {
@@ -1,18 +1,10 @@
1
- import { spawn, spawnSync } from "node:child_process";
1
+ import { spawnSync } from "node:child_process";
2
2
  import crypto from "node:crypto";
3
- import {
4
- createBuildchainLogger,
5
- defaultBuildchainLogPath,
6
- summarizeBuildchainLogEvents,
7
- } from "../logging.js";
3
+ import { summarizeBuildchainLogEvents } from "../logging.js";
8
4
  import {
9
5
  printJson,
10
6
  readBooleanFlag,
11
7
  readFlag,
12
- readJsonInput,
13
- readRepeatedFlag,
14
- readRepeatedJsonInputs,
15
- writeJsonFile,
16
8
  } from "../../contracts/cli/options.mjs";
17
9
  import { cliLogger, defaultCliLogPath, readAttributes } from "./context.mjs";
18
10
 
@@ -376,7 +376,7 @@ function runScaffold(options) {
376
376
  buildchainRef: readFlag(
377
377
  options.args,
378
378
  "buildchain-ref",
379
- options.buildchainRef,
379
+ "v4",
380
380
  ),
381
381
  buildchainSha: options.buildchainSha,
382
382
  name: readFlag(options.args, "name", path.basename(options.cwd)),