@kungfu-tech/buildchain 4.1.3 → 4.1.4

package/packages/core/paper/paper-work.js

@@ -1,14 +1,12 @@
 import path from "node:path";
 import { collectPaperAgentEntry } from "./paper-agent-entry.js";
 import {
-  PAPER_PATHS,
   PAPER_WORK_BRANCH_PATTERN,
   gitResult,
   gitValue,
   normalizedWorkBranch,
   paperDevelopmentRef,
   paperWorkSource,
-  readJson,
   remoteBranchObservation,
   rootedPlan,
   workCheck,
@@ -30,12 +28,7 @@ function failedActions(checks) {
 }
 
 function agentEntryForWork(cwd, buildchainSha) {
-  const policy = readJson(path.resolve(cwd, PAPER_PATHS.agentEntry)).value;
-  return collectPaperAgentEntry({
-    cwd,
-    buildchainSha: buildchainSha || policy?.runtime?.sourceSha || "",
-    mode: "contract",
-  });
+  return collectPaperAgentEntry({ cwd, buildchainSha, mode: "contract" });
 }
 
 export function createPaperWorkStartPlan({
@@ -74,7 +67,7 @@ export function createPaperWorkStartPlan({
     workCheck(
       "agent-entry.current",
       agentEntry.ok,
-      "The mandatory Buildchain Paper agent-entry contract is current.",
+      "The Paper product configuration and shared consumer wiring are current.",
       "buildchain paper migrate --write --json",
     ),
     workCheck(
@@ -252,7 +245,7 @@ export function createPaperWorkSubmitPlan({
     workCheck(
       "agent-entry.current",
       agentEntry.ok,
-      "The mandatory Buildchain Paper agent-entry contract is current.",
+      "The Paper product configuration and shared consumer wiring are current.",
       "buildchain paper migrate --write --json",
     ),
     workCheck(

package/packages/core/paper/paper.js

@@ -1,3 +1,4 @@
+import { paperConsumerStatus } from "./consumer-status.js";
 import path from "node:path";
 import {
   paperConfig,
@@ -44,15 +45,52 @@ import {
   paperPreflightNextActions,
 } from "./operations/preflight-checks.js";
 export function collectPaperSourcePolicy({ cwd = process.cwd() } = {}) {
+  const consumer = paperConsumerStatus(cwd);
+  if (consumer) return consumer;
   const agentEntry = collectPaperAgentEntry({ cwd, mode: "ci" });
   const provisioning = validatePaperProvisioningAuthority(cwd);
-  const checks = [...agentEntry.checks, { id: "provisioning.authority", status: provisioning.valid ? "pass" : "fail", message: provisioning.errors.join("; ") }];
-  try { validateBuildchainConfig(cwd, { requireLifecycleStages: ["verify"] }); }
-  catch (error) { checks.push({ id: "config.publication", status: "fail", message: error.message }); }
-  return { ok: checks.every(check => check.status === "pass" || check.status === "skip"), checks };
+  const checks = [
+    ...agentEntry.checks,
+    {
+      id: "provisioning.authority",
+      status: provisioning.valid ? "pass" : "fail",
+      message: provisioning.errors.join("; "),
+    },
+  ];
+  try {
+    validateBuildchainConfig(cwd, { requireLifecycleStages: ["verify"] });
+  } catch (error) {
+    checks.push({
+      id: "config.publication",
+      status: "fail",
+      message: error.message,
+    });
+  }
+  return {
+    ok: checks.every(
+      (check) => check.status === "pass" || check.status === "skip",
+    ),
+    checks,
+  };
+}
+
+export function collectPaperPreflight(options = {}) {
+  const consumer = paperConsumerStatus(
+    path.resolve(options.cwd || process.cwd()),
+  );
+  if (!consumer) return collectLegacyPaperPreflight(options);
+  const result =
+    options.agentEntryMode && options.agentEntryMode !== "contract"
+      ? collectPaperAgentEntry({
+          cwd: consumer.cwd,
+          mode: options.agentEntryMode,
+          env: options.env,
+        })
+      : consumer;
+  return { ...result, contract: PAPER_PREFLIGHT_CONTRACT };
 }
 
-export function collectPaperPreflight({
+function collectLegacyPaperPreflight({
   cwd = process.cwd(),
   buildchainRoot = process.cwd(),
   buildchainVersion = "",

package/packages/core/providers/github/artifact-attestation.js

@@ -10,7 +10,7 @@ export function verifyArtifactAttestationSigner(request, execute = command) {
       "--repo",
       request.repository,
       "--signer-workflow",
-      "kungfu-systems/buildchain/.github/workflows/public-release-artifact-attestation.yml",
+      "kungfu-systems/buildchain/.github/workflows/.release-artifact-attestation.yml",
       "--signer-digest",
       request.signerDigest,
       "--source-digest",

package/packages/core/providers/github/pipeline-context-artifacts.js

@@ -0,0 +1,172 @@
+import fs from "node:fs";
+import path from "node:path";
+import artifact from "@actions/artifact";
+import {
+  canonicalJson,
+  recordDigest,
+} from "../../release/discussion/envelope.js";
+import { publicationPath } from "../../publication/pipeline/files.js";
+
+const INLINE_LIMIT = 32 * 1024;
+const MATERIAL_LIMIT = 16 * 1024 * 1024;
+const REFERENCE = "buildchain.pipeline-context-reference/v1";
+const SCHEMAS = [
+  "buildchain.pipeline-publication-context/v1",
+  "buildchain.pipeline-version-context/v1",
+];
+const DIGEST = /^sha256:[0-9a-f]{64}$/u;
+
+function execution(env) {
+  const result = {
+    repository: env.GITHUB_REPOSITORY,
+    runId: Number(env.GITHUB_RUN_ID),
+    runAttempt: Number(env.GITHUB_RUN_ATTEMPT),
+  };
+  if (
+    !/^[\w.-]+\/[\w.-]+$/u.test(result.repository || "") ||
+    !Number.isSafeInteger(result.runId) ||
+    result.runId < 1 ||
+    !Number.isSafeInteger(result.runAttempt) ||
+    result.runAttempt < 1
+  )
+    throw new Error("Context transfer requires its exact provider execution");
+  return result;
+}
+
+function projection(value, env) {
+  const current = execution(env);
+  if (
+    !SCHEMAS.includes(value.schema) ||
+    value.runId !== current.runId ||
+    value.runAttempt !== current.runAttempt
+  )
+    throw new Error("Context transfer belongs to another provider execution");
+  const source =
+    value.schema === SCHEMAS[0]
+      ? value.materialization?.source
+      : value.preparation?.source;
+  if (
+    source?.repository !== current.repository ||
+    !/^[0-9a-f]{40}$/u.test(source?.commit || "")
+  )
+    throw new Error("Context transfer requires an exact repository source");
+  return {
+    schema: REFERENCE,
+    contextSchema: value.schema,
+    ...current,
+    contextRoot: recordDigest(value),
+    ...(value.schema === SCHEMAS[0]
+      ? { materialization: { source } }
+      : { preparation: { source } }),
+  };
+}
+
+function workspace(env) {
+  const directory = path.join(
+    env.GITHUB_WORKSPACE,
+    ".buildchain/context-material",
+  );
+  fs.mkdirSync(directory, { recursive: true });
+  return fs.mkdtempSync(path.join(directory, "transfer-"));
+}
+
+// Only an immutable reference and the checkout projection cross job outputs.
+// The original context remains unchanged in the authoritative attempt journal.
+export async function writePipelineContext(value, env, client = artifact) {
+  const serialized = canonicalJson(value);
+  const bytes = Buffer.byteLength(serialized);
+  if (bytes <= INLINE_LIMIT) return serialized;
+  if (bytes > MATERIAL_LIMIT)
+    throw new Error("Pipeline context exceeds its retained material bound");
+  const selected = projection(value, env);
+  const directory = workspace(env);
+  try {
+    const file = path.join(directory, "context.json");
+    fs.writeFileSync(file, serialized, { flag: "wx" });
+    const uploaded = await client.uploadArtifact(
+      `buildchain-context-${selected.runAttempt}-${selected.contextRoot.slice(7)}`,
+      [file],
+      directory,
+      { retentionDays: 30, compressionLevel: 0 },
+    );
+    const digest = `sha256:${String(uploaded.digest || "").replace(/^sha256:/u, "")}`;
+    if (
+      !Number.isSafeInteger(uploaded.id) ||
+      uploaded.id < 1 ||
+      !DIGEST.test(digest)
+    )
+      throw new Error("Context upload omitted immutable provider coordinates");
+    const encoded = canonicalJson({
+      ...selected,
+      bytes,
+      artifact: { id: uploaded.id, digest },
+    });
+    if (Buffer.byteLength(encoded) > INLINE_LIMIT)
+      throw new Error(
+        "Context checkout projection exceeds the job output bound",
+      );
+    return encoded;
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+}
+
+function validateReference(value, env) {
+  const current = execution(env);
+  if (
+    !SCHEMAS.includes(value.contextSchema) ||
+    value.repository !== current.repository ||
+    value.runId !== current.runId ||
+    value.runAttempt !== current.runAttempt ||
+    !DIGEST.test(value.contextRoot || "") ||
+    !Number.isSafeInteger(value.bytes) ||
+    value.bytes <= INLINE_LIMIT ||
+    value.bytes > MATERIAL_LIMIT ||
+    !Number.isSafeInteger(value.artifact?.id) ||
+    value.artifact.id < 1 ||
+    !DIGEST.test(value.artifact?.digest || "")
+  )
+    throw new Error(
+      "Context reference changed its execution or material boundary",
+    );
+}
+
+export async function readPipelineContext(encoded, env, client = artifact) {
+  if (Buffer.byteLength(encoded) > INLINE_LIMIT)
+    throw new Error("Pipeline context must use bounded job output transport");
+  const reference = JSON.parse(encoded);
+  if (reference.schema !== REFERENCE) return reference;
+  validateReference(reference, env);
+  const directory = workspace(env);
+  try {
+    // No findBy or repository token: the artifact SDK scopes this read to the
+    // current workflow execution, including credentialless product build jobs.
+    const downloaded = await client.downloadArtifact(reference.artifact.id, {
+      path: directory,
+      expectedHash: reference.artifact.digest,
+    });
+    if (
+      downloaded.digestMismatch ||
+      canonicalJson(fs.readdirSync(directory)) !== '["context.json"]'
+    )
+      throw new Error("Context artifact changed its archive or file inventory");
+    const file = publicationPath(directory, "context.json");
+    if (fs.statSync(file).size !== reference.bytes)
+      throw new Error("Context artifact changed its retained byte length");
+    const value = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(fs.readFileSync(file)),
+    );
+    const expected = {
+      ...projection(value, env),
+      bytes: reference.bytes,
+      artifact: reference.artifact,
+    };
+    if (recordDigest(expected) !== recordDigest(reference))
+      throw new Error(
+        "Context artifact differs from its exact checkout projection or root",
+      );
+    return value;
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+}

package/packages/core/publication/authority/control-plane.js

@@ -1,8 +1,8 @@
 export function publicationControlPlaneRequest(request) {
   const kind = request.autoAdmissionKind;
   const defaults = {
-    "release-candidate": ".github/workflows/public-release-promote.yml",
-    "publication-artifact": ".github/workflows/public-release-paper.yml",
+    "release-candidate": ".github/workflows/.release-candidate-promote.yml",
+    "publication-artifact": ".github/workflows/.release-paper.yml",
     "binary-release-assets": ".github/workflows/.release-binary-assets.yml",
   };
   if (!defaults[kind])

package/packages/core/publication/authority/seal.js

@@ -26,7 +26,7 @@ export function sealManagedPublicationAdmission({
     );
   const suffix = binary ? ":binary-release-assets" : paper ? ":paper" : "";
   const defaults = {
-    "release-candidate": ".github/workflows/public-release-promote.yml",
+    "release-candidate": ".github/workflows/.release-candidate-promote.yml",
     "publication-artifact": ".github/workflows/public-release-paper-sealed.yml",
     "binary-release-assets": ".github/workflows/.release-binary-assets.yml",
   };

package/packages/core/publication/cli/dispatch.mjs

@@ -2,22 +2,11 @@ import { npmPublishDryRun } from "../npm/preview.js";
 import { runPublicationArtifactCli } from "../commands/publication-artifact.mjs";
 import { runPublicationPackageCli } from "../commands/publication-package.mjs";
 import { runPublicationReproducibilityCli } from "../commands/publication-reproducibility.mjs";
-import {
-  BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT,
-  formatDiagnosticsSummaryTable,
-  startProcessSampler,
-  summarizeDiagnosticsArtifacts,
-  summarizeProcessSamples,
-  validateAnchoredPackageRelease,
-} from "../../observability/diagnostics.js";
+import { validateAnchoredPackageRelease } from "../../observability/diagnostics.js";
 import {
   printJson,
   readBooleanFlag,
   readFlag,
-  readJsonInput,
-  readRepeatedFlag,
-  readRepeatedJsonInputs,
-  writeJsonFile,
 } from "../../contracts/cli/options.mjs";
 import { runScript } from "../../workflow/cli/process.mjs";
 

package/packages/core/publication/pipeline/actions.js

@@ -11,9 +11,13 @@ import {
 import { applyPipelinePublication } from "./apply.js";
 import { settlePipelinePublication } from "./settle.js";
 import { githubJsonClient } from "../../providers/github/json-client.js";
+import {
+  readPipelineContext,
+  writePipelineContext,
+} from "../../providers/github/pipeline-context-artifacts.js";
 
-const contextInput = (core) =>
-  JSON.parse(core.getInput("context", { required: true }));
+const contextInput = (core, env) =>
+  readPipelineContext(core.getInput("context", { required: true }), env);
 const directory = (env) =>
   path.join(env.GITHUB_WORKSPACE, ".buildchain/publication");
 
@@ -26,7 +30,10 @@ export async function preparePipelinePublicationAction(core, env) {
   );
   core.setOutput("operation", result.operation);
   core.setOutput("stable-wait", result.wait ? JSON.stringify(result.wait) : "");
-  core.setOutput("context", JSON.stringify(result.context || {}));
+  core.setOutput(
+    "context",
+    await writePipelineContext(result.context || {}, env),
+  );
   core.setOutput(
     "matrix",
     JSON.stringify({ include: result.context?.platforms || [] }),
@@ -34,7 +41,7 @@ export async function preparePipelinePublicationAction(core, env) {
 }
 
 export async function buildPipelinePublicationAction(core, env) {
-  const context = contextInput(core);
+  const context = await contextInput(core, env);
   const platform = core.getInput("platform", { required: true });
   const cwd = path.join(env.GITHUB_WORKSPACE, ".buildchain/product");
   await buildPipelineSource({
@@ -59,7 +66,7 @@ export async function buildPipelinePublicationAction(core, env) {
 export async function preparePipelineQualificationAction(core, env) {
   const host = await pipelineHost(core, env, "Qualify and sign products");
   const prepared = await preparePipelineQualification(
-    contextInput(core),
+    await contextInput(core, env),
     host,
     directory(env),
   );
@@ -71,7 +78,7 @@ export async function preparePipelineQualificationAction(core, env) {
 export async function sealPipelineQualificationAction(core, env) {
   const host = await pipelineHost(core, env, "Qualify and sign products");
   await sealPipelineQualification(
-    contextInput(core),
+    await contextInput(core, env),
     host,
     directory(env),
     core.getInput("bundle-path", { required: true }),
@@ -81,7 +88,7 @@ export async function sealPipelineQualificationAction(core, env) {
 export async function applyPipelinePublicationAction(core, env) {
   const host = await pipelineHost(core, env, "Apply qualified publication");
   const result = await applyPipelinePublication(
-    contextInput(core),
+    await contextInput(core, env),
     host,
     directory(env),
     env,
@@ -98,7 +105,7 @@ export async function settlePipelinePublicationAction(core, env) {
       userAgent: "buildchain-next-development",
     });
   const result = await settlePipelinePublication(
-    contextInput(core),
+    await contextInput(core, env),
     host,
     directory(env),
     env,
@@ -106,7 +113,7 @@ export async function settlePipelinePublicationAction(core, env) {
   core.info(result.reason);
   core.setOutput(
     "version-context",
-    JSON.stringify(result.versionContext || {}),
+    await writePipelineContext(result.versionContext || {}, env),
   );
   core.setOutput("operation", result.versionContext ? "regenerate" : "wait");
   core.setOutput(

package/packages/core/publication/pipeline/apply.js

@@ -8,7 +8,11 @@ import {
 } from "../../release/release-invocation.js";
 import { githubPipelineProductRelease } from "../../providers/github/pipeline-product-release.js";
 import { pipelineNpmProvider } from "../npm/pipeline-provider.js";
-import { publicationContext, uniquePublicationMaterial } from "./context.js";
+import {
+  publicationContext,
+  uniquePublicationMaterial,
+  completedPublicationRecovery,
+} from "./context.js";
 import { restorePipelineProducts } from "./sealed-products.js";
 import {
   pipelineReleaseDocuments,
@@ -34,16 +38,14 @@ export async function applyPipelinePublication(
   } = {},
 ) {
   const { journal, archive } = await publicationContext(context, host);
-  const wait = await preparePipelineStableQualification(
-    context.plan,
-    host,
-    journal,
-    {
+  const completed = await completedPublicationRecovery(context, journal);
+  const wait =
+    !completed &&
+    (await preparePipelineStableQualification(context.plan, host, journal, {
       attempt: context.attempt,
       generation: context.generation,
       phase: "publish",
-    },
-  );
+    }));
   if (wait) return { operation: "wait", wait };
   const retained = await uniquePublicationMaterial(
     journal,
@@ -113,7 +115,13 @@ export async function applyPipelinePublication(
   const provider = {
     observe: (effect) => providerFor(effect).observe(effect),
     matches: (effect, value) => providerFor(effect).matches(effect, value),
-    apply: (effect) => providerFor(effect).apply(effect),
+    apply: (effect) => {
+      if (completed)
+        throw new Error(
+          "Completed publication recovery cannot perform new provider effects",
+        );
+      return providerFor(effect).apply(effect);
+    },
   };
   const receipts = await journal.materials("publication/effect/");
   const effects = pipelinePublicationEffects({

package/packages/core/publication/pipeline/context.js

@@ -1,6 +1,7 @@
 import { recordDigest } from "../../release/discussion/envelope.js";
 import { resumePipelineSession } from "../../workflow/pipeline/session.js";
 import { pipelinePublicationJournal } from "./journal.js";
+import { createReleaseReceipt } from "../../release/release-invocation.js";
 
 export async function publicationContext(context, host) {
   if (
@@ -37,3 +38,31 @@ export async function uniquePublicationMaterial(journal, prefix) {
     );
   return values[0];
 }
+
+export async function completedPublicationRecovery(context, journal) {
+  if (!context.recovery?.preserveTransaction) return null;
+  const values = await journal.materials("publication/predecessor-complete/");
+  if (!values.length) return null;
+  const complete = values[0];
+  const retained = await uniquePublicationMaterial(
+    journal,
+    "publication/qualified/",
+  );
+  const receipt = complete.release?.receipt;
+  if (
+    values.length !== 1 ||
+    complete.schema !== "buildchain.pipeline-publication-complete/v1" ||
+    !Number.isFinite(Date.parse(complete.completedAt)) ||
+    receipt?.outcome !== "complete" ||
+    retained.qualified.planRoot !== context.plan.root ||
+    receipt.transactionRoot !==
+      retained.documents.transaction.transactionRoot ||
+    receipt.releasePassportRoot !== retained.documents.passport.passportRoot ||
+    recordDigest(createReleaseReceipt(receipt)) !==
+      recordDigest(complete.release)
+  )
+    throw new Error(
+      "Completed publication recovery changed its retained signed transaction",
+    );
+  return complete;
+}

package/packages/core/publication/pipeline/prepare.js

@@ -5,6 +5,7 @@ import { githubPipelineVersion } from "../../providers/github/pipeline-version.j
 import { createPipelinePublicationPlan } from "./source-plan.js";
 import { preparePipelineStableQualification } from "./stable-wait.js";
 import { prepareRecoveredPublication } from "./recovery-prepare.js";
+import { completedPublicationRecovery } from "./context.js";
 import {
   preparePipelineVersionContext,
   retainedPipelineVersionRegeneration,
@@ -48,12 +49,20 @@ export async function preparePipelinePublication(attempt, publisherSha, host) {
     );
     await journal.record("publication/plan", plan);
   }
-  const wait = await preparePipelineStableQualification(plan, host, journal, {
-    attempt,
-    generation: observed.generation,
-    phase,
-  });
-  if (wait) return { operation: "wait", wait };
+  // Native phase order admits follow-ups only after publication succeeded.
+  // Later PR events must not reopen the completed publication's Alpha gate.
+  const completed = await completedPublicationRecovery(
+    { plan, recovery },
+    journal,
+  );
+  if (phase === "publish" && !completed) {
+    const wait = await preparePipelineStableQualification(plan, host, journal, {
+      attempt,
+      generation: observed.generation,
+      phase,
+    });
+    if (wait) return { operation: "wait", wait };
+  }
   if (
     !recovery &&
     (plan.publisher.workflowSha !== publisherSha ||

package/packages/core/publication/pipeline/recovery-materials.js

@@ -68,7 +68,69 @@ export async function readRecoveryPublicationMaterials(session, host) {
     throw new Error(
       "Expanded publication recovery inventory exceeds its bound",
     );
-  return result;
+  return signedRecoveryMaterials(result);
+}
+
+function signedRecoveryMaterials(materials) {
+  const plans = materials.filter((item) =>
+    item.id.startsWith("publication/plan/"),
+  );
+  if (new Set(plans.map((item) => item.value.root)).size < 2) return materials;
+  const retained = recoveryPublicationMaterial(
+    materials,
+    "publication/qualified/",
+  );
+  if (!retained?.signing) return materials;
+  const plan = publicationLineageMaterial(
+    materials,
+    "buildchain.pipeline-publication-plan/v1",
+    (value) => value.root === retained.qualified.planRoot,
+  );
+  const materialization = publicationLineageMaterial(
+    materials,
+    "buildchain.pipeline-version-materialization/v1",
+    (value) => value.root === retained.signing.materializationRoot,
+  );
+  const planIdentity = ({
+    root,
+    publisher: { workflowSha, ...publisher },
+    ...body
+  }) => recordDigest({ ...body, publisher });
+  const sourceIdentity = ({ root, planRoot, ...body }) => recordDigest(body);
+  for (const item of plans)
+    if (planIdentity(item.value) !== planIdentity(plan))
+      throw new Error(
+        "Conflicting recovery plans changed more than the publisher entry",
+      );
+  // Preserve every original reference and member ID. Only a signed lineage
+  // can classify the otherwise identical, unsigned rederivation as history.
+  return materials.map((item) => {
+    let name;
+    if (
+      item.id.startsWith("publication/plan/") &&
+      item.value.root !== plan.root
+    )
+      name = "plan";
+    if (
+      item.id.startsWith("publication/materialization/") &&
+      item.value.root !== materialization.root
+    ) {
+      if (sourceIdentity(item.value) !== sourceIdentity(materialization))
+        throw new Error(
+          "Conflicting recovery materializations changed retained source",
+        );
+      name = "materialization";
+    }
+    return name
+      ? {
+          ...item,
+          id: item.id.replace(
+            `publication/${name}/`,
+            `publication/predecessor-${name}/`,
+          ),
+        }
+      : item;
+  });
 }
 
 export function recoveryPublicationMaterial(

package/packages/core/publication/pipeline/recovery-prepare.js

@@ -54,20 +54,32 @@ export async function prepareRecoveredPublication(
       tree: runtime.tree.sha,
     },
   };
-  await importRecoveredPublication(
-    publication,
-    execution,
-    recoveryPlan.root,
-    journal,
-    phase,
-  );
+  const qualified = await journal.materials("publication/qualified/");
+  if (qualified.length > 1)
+    throw new Error("Recovered publication has conflicting qualifications");
+  if (qualified.length) {
+    const plans = await journal.materials("publication/plan/");
+    if (plans.length !== 1 || plans[0].root !== qualified[0].qualified.planRoot)
+      throw new Error("Recovered qualification lacks its one retained plan");
+  }
+  // A prepared recovery may already have signed and published its derived
+  // plan. Later workers retain that plan even when the floating entry moves.
+  if (!qualified.length)
+    await importRecoveredPublication(
+      publication,
+      execution,
+      recoveryPlan.root,
+      journal,
+      phase,
+    );
+  const mode = qualified.length ? "qualified" : publication.mode;
   return {
     planRoot: recoveryPlan.root,
     predecessor: recoveryPlan.predecessor,
     originalPlanRoot: plan.root,
-    mode: publication.mode,
+    mode,
     build: publication.build || null,
-    preserveTransaction: publication.mode === "qualified",
+    preserveTransaction: mode === "qualified",
     execution,
   };
 }