@kungfu-tech/buildchain 4.1.3 → 4.1.4

package/packages/core/paper/commands/paper.mjs

@@ -1,15 +1,18 @@
 #!/usr/bin/env node
-import { spawnSync } from "node:child_process";
+
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { PAPER_ALPHA_PLAN_CONTRACT, PAPER_BUILD_PLAN_CONTRACT, PAPER_MIGRATION_CONTRACT, PAPER_NPM_BOOTSTRAP_CONTRACT, PAPER_PREFLIGHT_CONTRACT, PAPER_RESUME_PLAN_CONTRACT, PAPER_SCAFFOLD_CONTRACT, PAPER_STATUS_CONTRACT } from "../operations/identity.js";
+import {
+  PAPER_MIGRATION_CONTRACT,
+  PAPER_PREFLIGHT_CONTRACT,
+  PAPER_SCAFFOLD_CONTRACT,
+  PAPER_STATUS_CONTRACT,
+} from "../operations/identity.js";
 import { collectPaperPreflight } from "../paper.js";
 import { resolvePaperBuildchainSha } from "../paper-agent-entry.js";
 import { collectPaperStatus } from "../operations/status.js";
-import { createPaperAlphaPlan, createPaperBuildPlan, createPaperResumePlan } from "../operations/plans.js";
-import { executePaperNpmBootstrap } from "../operations/bootstrap.js";
-import { verifyPublicationReproducibility } from "../../publication/publication-reproducibility.js";
+
 import {
   printPaperWorkFleetSummary,
   runPaperWorkFleetCli,
@@ -18,10 +21,10 @@ import { runPaperAgentCli } from "./paper-agent-cli.mjs";
 
 function usage() {
   return `Usage:
-  buildchain paper scaffold --package <name> --repository <owner/repo>
+  buildchain paper scaffold --repository <owner/repo> [--package <name>]
                             [--cwd <dir>] [--name <name>] [--title <title>]
                             [--version <semver>] [--site-base-url <url>]
-                            [--buildchain-ref <ref>] [--write] [--json]
+                            [--write] [--json]
   buildchain paper migrate [--cwd <dir>] [--write] [--json]
   buildchain paper work start <topic> [--cwd <dir>] [--branch <branch>]
                               [--execute] [--json]
@@ -31,29 +34,16 @@ function usage() {
   buildchain paper fleet update [--root <dir>] [--write] [--json]
   buildchain paper agent verify [--cwd <dir>] [--offline] [--json]
   buildchain paper preflight [--cwd <dir>] [--offline] [--json]
-  buildchain paper bootstrap npm [--cwd <dir>] [--package <name>]
-                                  [--repository <owner/repo>] [--workflow <filename>]
-                                  [--bootstrap-version <version>] [--userconfig <path>]
-                                  [--offline] [--execute]
-                                  [--confirm-public-package <name>] [--json]
-  buildchain paper build [--cwd <dir>] [--source-sha <sha>]
-                          [--no-toolchain-pull] [--keep-workspaces]
-                          [--execute] [--json]
-  buildchain paper alpha [--cwd <dir>] [--source-ref <ref>] [--target-ref <ref>]
-                          [--execute] [--json]
   buildchain paper status [--cwd <dir>] [--json]
-  buildchain paper resume [--cwd <dir>] [--runtime-ref <ref>]
-                           [--execute] [--json]
 
 Safety:
   scaffold is a no-overwrite dry-run unless --write is present. migrate only
-  rewrites only Buildchain-owned authority, workflow, lock, version, and package
-  control surfaces. work start/submit refuse dirty, stale, forked, ambiguous,
+  converts Paper product configuration to schema 2 and retires verified legacy
+  controls while preserving source files, runtime locks and historical receipts. work start/submit refuse dirty, stale, forked, ambiguous,
   protected, or non-fast-forward sources. fleet update requires isolated work
   branches and is a dry-run unless --write is present.
-  npm bootstrap, Alpha PR creation, and resume dispatch never mutate externally
-  unless --execute is present. Real npm bootstrap additionally requires the
-  exact --confirm-public-package value.
+  Product build and verification commands belong in TOML. A legal channel PR
+  requests publication; the generated recovery caller accepts an exact attempt.
 `;
 }
 
@@ -71,23 +61,6 @@ function printJson(value) {
   process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
 
-function commandResult(command, args, { cwd, timeout = 60000 } = {}) {
-  const result = spawnSync(command, args, {
-    cwd,
-    env: process.env,
-    encoding: "utf8",
-    timeout,
-    maxBuffer: 2 * 1024 * 1024,
-  });
-  return {
-    ok: result.status === 0,
-    status: result.status ?? 1,
-    stdout: String(result.stdout || "").trim(),
-    stderr: String(result.stderr || "").trim(),
-    error: result.error?.message || "",
-  };
-}
-
 function humanSummary(result) {
   if (result.contract === PAPER_SCAFFOLD_CONTRACT) {
     process.stdout.write(
@@ -106,7 +79,7 @@ function humanSummary(result) {
       `paper migrate: ${result.ok ? "ok" : "blocked"} (${result.dryRun ? "dry-run" : "write"})\n`,
     );
     process.stdout.write(
-      `create=${result.summary.create} update=${result.summary.update} unchanged=${result.summary.unchanged} conflict=${result.summary.conflict}\n`,
+      `create=${result.summary.create} update=${result.summary.update} remove=${result.summary.remove} unchanged=${result.summary.unchanged} conflict=${result.summary.conflict}\n`,
     );
     for (const entry of result.changes) {
       process.stdout.write(`- ${entry.action}: ${entry.path}\n`);
@@ -131,41 +104,7 @@ function humanSummary(result) {
     }
     return;
   }
-  if (result.contract === PAPER_NPM_BOOTSTRAP_CONTRACT) {
-    process.stdout.write(
-      `paper bootstrap npm: ${result.ok ? result.publish.status : result.errorCode || "blocked"}\n`,
-    );
-    process.stdout.write(`package: ${result.package.name}\n`);
-    process.stdout.write(`trust: ${result.trust.status}\n`);
-    for (const url of result.trust.urls || []) {
-      process.stdout.write(`url: ${url}\n`);
-    }
-    return;
-  }
-  if (result.contract === PAPER_BUILD_PLAN_CONTRACT) {
-    process.stdout.write(
-      `paper build: ${result.dryRun ? "dry-run" : result.receipt?.status || "complete"}\n`,
-    );
-    process.stdout.write(`source: ${result.sourceSha}\n`);
-    if (result.receipt?.receiptDigest) {
-      process.stdout.write(`receipt: ${result.receipt.receiptDigest}\n`);
-    }
-    return;
-  }
-  if (result.contract === PAPER_ALPHA_PLAN_CONTRACT) {
-    process.stdout.write(
-      `paper alpha: ${result.dryRun ? "dry-run" : result.pr?.url || "submitted"}\n`,
-    );
-    process.stdout.write(`${result.source.ref} -> ${result.target.ref}\n`);
-    return;
-  }
-  if (result.contract === PAPER_RESUME_PLAN_CONTRACT) {
-    process.stdout.write(`paper resume: ${result.reason}\n`);
-    if (result.mutation?.command) {
-      process.stdout.write(`${result.mutation.command}\n`);
-    }
-    return;
-  }
+
   printPaperWorkFleetSummary(result, printJson);
 }
 
@@ -174,267 +113,6 @@ function printResult(result, json) {
   else humanSummary(result);
 }
 
-function githubPrRows({ cwd, repository, sourceRef, targetRef = "" }) {
-  const targetArgs = targetRef ? ["--base", targetRef] : [];
-  const query = commandResult(
-    "gh",
-    [
-      "pr",
-      "list",
-      "--repo",
-      repository,
-      "--head",
-      sourceRef,
-      ...targetArgs,
-      "--state",
-      "open",
-      "--json",
-      "number,url,headRefName,baseRefName",
-      "--limit",
-      "10",
-    ],
-    { cwd },
-  );
-  if (!query.ok) {
-    return {
-      ok: false,
-      rows: [],
-      errorCode: query.error ? "gh-unavailable" : "github-pr-query-failed",
-    };
-  }
-  try {
-    const rows = JSON.parse(query.stdout || "[]");
-    return { ok: true, rows: Array.isArray(rows) ? rows : [], errorCode: "" };
-  } catch {
-    return { ok: false, rows: [], errorCode: "github-pr-response-invalid" };
-  }
-}
-
-function githubBranchObservation({ cwd, repository, ref }) {
-  const query = commandResult(
-    "gh",
-    [
-      "api",
-      `repos/${repository}/git/ref/heads/${encodeURIComponent(ref)}`,
-      "--jq",
-      ".object.sha",
-    ],
-    { cwd },
-  );
-  const sha = query.stdout.trim();
-  return {
-    ok: query.ok && /^[0-9a-f]{40}$/.test(sha),
-    ref,
-    sha: /^[0-9a-f]{40}$/.test(sha) ? sha : "",
-    observedRef: `refs/heads/${ref}`,
-    observation: "github-api",
-    errorCode: query.ok
-      ? "github-ref-response-invalid"
-      : query.error
-        ? "gh-unavailable"
-        : "github-ref-query-failed",
-  };
-}
-
-function executeAlphaPlan(plan) {
-  if (!plan.ok) {
-    return {
-      ...plan,
-      ok: false,
-      dryRun: false,
-      errorCode: "paper-alpha-plan-invalid",
-    };
-  }
-  const source = githubBranchObservation({
-    cwd: plan.cwd,
-    repository: plan.repository,
-    ref: plan.source.ref,
-  });
-  if (!source.ok) {
-    return {
-      ...plan,
-      ok: false,
-      dryRun: false,
-      errorCode: source.errorCode,
-      nextActions: [
-        {
-          id: "resolve-source-ref",
-          command: "",
-          description:
-            "Resolve the exact protected dev source ref from GitHub before opening an Alpha PR.",
-        },
-      ],
-    };
-  }
-  const target = githubBranchObservation({
-    cwd: plan.cwd,
-    repository: plan.repository,
-    ref: plan.target.ref,
-  });
-  if (!target.ok) {
-    return {
-      ...plan,
-      source,
-      ok: false,
-      dryRun: false,
-      errorCode: target.errorCode,
-      nextActions: [
-        {
-          id: "resolve-target-ref",
-          command: "",
-          description:
-            "Resolve the exact protected Alpha target ref from GitHub before opening an Alpha PR.",
-        },
-      ],
-    };
-  }
-  plan = {
-    ...plan,
-    source,
-    target,
-  };
-  const existing = githubPrRows({
-    cwd: plan.cwd,
-    repository: plan.repository,
-    sourceRef: plan.source.ref,
-    targetRef: plan.target.ref,
-  });
-  if (!existing.ok) {
-    return {
-      ...plan,
-      ok: false,
-      dryRun: false,
-      errorCode: existing.errorCode,
-    };
-  }
-  if (existing.rows.length > 0) {
-    return {
-      ...plan,
-      ok: true,
-      dryRun: false,
-      reused: true,
-      pr: existing.rows[0],
-      nextActions: [
-        {
-          id: "review-alpha-pr",
-          command: "",
-          description:
-            "Complete the repository's independent protected PR review and merge gate.",
-          url: existing.rows[0].url,
-        },
-      ],
-    };
-  }
-  const title = `release(paper): publish ${plan.publicationVersion} alpha`;
-  const body = [
-    "## Summary",
-    "",
-    `Promote \`${plan.source.ref}\` to \`${plan.target.ref}\` through the protected Buildchain paper release flow.`,
-    "",
-    "## Safety",
-    "",
-    "- Build and verification remain credential-free.",
-    "- Exact artifact bytes are sealed before npm OIDC is available.",
-    "- This PR does not bypass review or publish directly.",
-  ].join("\n");
-  const created = commandResult(
-    "gh",
-    [
-      "pr",
-      "create",
-      "--repo",
-      plan.repository,
-      "--base",
-      plan.target.ref,
-      "--head",
-      plan.source.ref,
-      "--title",
-      title,
-      "--body",
-      body,
-    ],
-    { cwd: plan.cwd },
-  );
-  if (!created.ok) {
-    return {
-      ...plan,
-      ok: false,
-      dryRun: false,
-      errorCode: created.error ? "gh-unavailable" : "github-pr-create-failed",
-    };
-  }
-  const url =
-    created.stdout
-      .split(/\s+/)
-      .find((entry) => /^https:\/\/github\.com\//.test(entry)) || "";
-  return {
-    ...plan,
-    ok: true,
-    dryRun: false,
-    reused: false,
-    pr: {
-      url,
-      headRefName: plan.source.ref,
-      baseRefName: plan.target.ref,
-    },
-    nextActions: [
-      {
-        id: "review-alpha-pr",
-        command: "",
-        description:
-          "Complete the repository's independent protected PR review and merge gate.",
-        url,
-      },
-    ],
-  };
-}
-
-function executeResumePlan(plan, runtimeRef) {
-  if (!plan.resumable || !plan.transaction?.targetRef) {
-    return {
-      ...plan,
-      dryRun: false,
-      dispatched: false,
-    };
-  }
-  const args = [
-    "workflow",
-    "run",
-    ".github/workflows/public-release-paper.yml",
-    "--ref",
-    plan.transaction.targetRef,
-  ];
-  if (runtimeRef) {
-    args.push("-f", `runtime-ref=${runtimeRef}`);
-  }
-  const dispatched = commandResult("gh", args, { cwd: plan.cwd });
-  if (!dispatched.ok) {
-    return {
-      ...plan,
-      ok: false,
-      dryRun: false,
-      dispatched: false,
-      errorCode: dispatched.error
-        ? "gh-unavailable"
-        : "github-workflow-dispatch-failed",
-    };
-  }
-  return {
-    ...plan,
-    ok: true,
-    dryRun: false,
-    dispatched: true,
-    nextActions: [
-      {
-        id: "inspect-resumed-transaction",
-        command: "buildchain paper status --json",
-        description:
-          "Wait for the protected workflow, then inspect the same transaction coordinates.",
-      },
-    ],
-  };
-}
-
 export async function runPaperCli(
   args = [],
   {
@@ -447,7 +125,6 @@ export async function runPaperCli(
     buildchainSha = "",
   } = {},
 ) {
-  buildchainSha = resolvePaperBuildchainSha(buildchainRoot, buildchainSha);
   const [command = "", maybeSubcommand = "", ...rest] = args;
   const json = hasFlag(args, "json");
   try {
@@ -455,10 +132,26 @@ export async function runPaperCli(
       process.stdout.write(usage());
       return;
     }
+    if (
+      ![
+        "scaffold",
+        "migrate",
+        "work",
+        "fleet",
+        "agent",
+        "preflight",
+        "status",
+      ].includes(command)
+    )
+      throw new Error(
+        "Unknown Paper command. Use product commands from TOML, a channel PR for publication, or the generated attempt recovery entry.",
+      );
     const effectiveArgs = maybeSubcommand.startsWith("--")
       ? [maybeSubcommand, ...rest]
       : rest;
     const cwd = path.resolve(readFlag(effectiveArgs, "cwd", process.cwd()));
+    if (!["scaffold", "preflight", "status"].includes(command))
+      buildchainSha = resolvePaperBuildchainSha(buildchainRoot, buildchainSha);
     const workFleet = runPaperWorkFleetCli({
       command,
       subcommand: maybeSubcommand,
@@ -495,91 +188,9 @@ export async function runPaperCli(
             ? "local"
             : "contract",
       });
-    } else if (command === "bootstrap" && maybeSubcommand === "npm") {
-      result = executePaperNpmBootstrap({
-        cwd,
-        packageName: readFlag(effectiveArgs, "package", ""),
-        bootstrapVersion: readFlag(
-          effectiveArgs,
-          "bootstrap-version",
-          "0.0.0-bootstrap.0",
-        ),
-        registry: readFlag(
-          effectiveArgs,
-          "registry",
-          "https://registry.npmjs.org/",
-        ),
-        repository: readFlag(effectiveArgs, "repository", ""),
-        workflow: readFlag(effectiveArgs, "workflow", "public-release-paper.yml"),
-        environment: readFlag(effectiveArgs, "environment", ""),
-        execute: hasFlag(effectiveArgs, "execute"),
-        confirmedPackage: readFlag(effectiveArgs, "confirm-public-package", ""),
-        userconfig: readFlag(effectiveArgs, "userconfig", ""),
-        offline: hasFlag(effectiveArgs, "offline"),
-      });
-    } else if (command === "build") {
-      const plan = createPaperBuildPlan({
-        cwd,
-        sourceSha: readFlag(effectiveArgs, "source-sha", ""),
-        pullToolchain: !hasFlag(effectiveArgs, "no-toolchain-pull"),
-      });
-      if (!hasFlag(effectiveArgs, "execute")) {
-        result = plan;
-      } else {
-        const receipt = verifyPublicationReproducibility({
-          cwd,
-          sourceSha: plan.sourceSha,
-          promote: true,
-          keepWorkspaces: hasFlag(effectiveArgs, "keep-workspaces"),
-          pullToolchain: plan.pullToolchain,
-          packageName: readFlag(effectiveArgs, "package", ""),
-        });
-        result = {
-          ...plan,
-          ok: receipt.qualifying === true,
-          dryRun: false,
-          receipt,
-          nextActions: receipt.qualifying
-            ? [
-                {
-                  id: "paper-status",
-                  command: "buildchain paper status --json",
-                  description:
-                    "Inspect the qualifying reproducibility evidence and remaining publication gates.",
-                },
-              ]
-            : [
-                {
-                  id: "repair-reproducibility",
-                  command:
-                    "buildchain paper build --execute --keep-workspaces --json",
-                  description:
-                    "Retain both clean workspaces and inspect the first byte difference.",
-                },
-              ],
-        };
-      }
-    } else if (command === "alpha") {
-      const plan = createPaperAlphaPlan({
-        cwd,
-        sourceRef: readFlag(effectiveArgs, "source-ref", ""),
-        targetRef: readFlag(effectiveArgs, "target-ref", ""),
-      });
-      result = hasFlag(effectiveArgs, "execute")
-        ? executeAlphaPlan(plan)
-        : plan;
-    } else if (command === "resume") {
-      const runtimeRef = readFlag(effectiveArgs, "runtime-ref", "");
-      const plan = createPaperResumePlan({
-        cwd,
-        runtimeRef,
-      });
-      result = hasFlag(effectiveArgs, "execute")
-        ? executeResumePlan(plan, runtimeRef)
-        : plan;
     } else {
       throw new Error(
-        "usage: buildchain paper <scaffold|migrate|work start|work submit|fleet audit|fleet update|agent verify|preflight|bootstrap npm|build|alpha|status|resume> ...",
+        "usage: buildchain paper <scaffold|migrate|work start|work submit|fleet audit|fleet update|agent verify|preflight|status> ...",
       );
     }
     printResult(result, json);

package/packages/core/paper/consumer-status.js

@@ -0,0 +1,72 @@
+import path from "node:path";
+import {
+  loadBuildchainConfig,
+  validateBuildchainConfig,
+} from "../consumer/buildchain-config.js";
+import { validateConsumerWiring } from "../consumer/contract/local-validation.js";
+import {
+  gitValue,
+  readJson,
+  resolvePaperRepository,
+} from "./paper-repository.js";
+
+// Local product/configuration facts only. Hosted attempt state is owned by the pipeline.
+export function paperConsumerStatus(cwd) {
+  const loaded = loadBuildchainConfig(cwd);
+  if (loaded?.config.schema !== 2) return null;
+  const checks = [];
+  let configuration;
+  let wiring;
+  try {
+    configuration = validateBuildchainConfig(cwd, {
+      requireLifecycleStages: ["build", "verify"],
+    });
+    if (!configuration.products.some((product) => product.type === "paper"))
+      throw new Error("The consumer policy has no Paper product");
+    checks.push({
+      id: "config.paper",
+      status: "pass",
+      message: "Schema-2 Paper product commands and artifacts are valid",
+    });
+  } catch (error) {
+    checks.push({ id: "config.paper", status: "fail", message: error.message });
+  }
+  try {
+    wiring = validateConsumerWiring(cwd, loaded.path);
+    checks.push({
+      id: "workflow.consumer-pair",
+      status: "pass",
+      message: "The shared normal and recovery callers match",
+    });
+  } catch (error) {
+    checks.push({
+      id: "workflow.consumer-pair",
+      status: "fail",
+      message: error.message,
+    });
+  }
+  const head = gitValue(cwd, ["rev-parse", "HEAD"]);
+  const sourcePackage = readJson(path.join(cwd, "package.json")).value;
+  return {
+    schemaVersion: 2,
+    ok: checks.every((check) => check.status === "pass"),
+    cwd: path.resolve(cwd),
+    checks,
+    configuration,
+    wiring,
+    source: { head, repository: resolvePaperRepository(cwd) },
+    identity: {
+      project: sourcePackage?.name || "",
+      title: sourcePackage?.description || "",
+      repository: resolvePaperRepository(cwd),
+    },
+    localOnly: true,
+    publication: {
+      status: "not-observed",
+      authority: "published-pipeline-attempt",
+    },
+    nonClaims: [
+      "Local configuration checks do not prove hosted admission, successful builds, publication, or recovery",
+    ],
+  };
+}

package/packages/core/paper/operations/identity.js

@@ -7,9 +7,6 @@ export const PAPER_NPM_BOOTSTRAP_CONTRACT =
   "kungfu-buildchain-paper-npm-bootstrap";
 export const PAPER_PROVISIONING_CONTRACT =
   "kungfu-buildchain-paper-provisioning-authority";
-export const PAPER_BUILD_PLAN_CONTRACT = "kungfu-buildchain-paper-build-plan";
-export const PAPER_ALPHA_PLAN_CONTRACT = "kungfu-buildchain-paper-alpha-plan";
-export const PAPER_RESUME_PLAN_CONTRACT = "kungfu-buildchain-paper-resume-plan";
 export const PAPER_VISIBILITY_CONTRACT = "kungfu-buildchain-paper-visibility";
 export const PAPER_STATE_ORDER = Object.freeze([
   "scaffolded",