@kungfu-tech/buildchain 4.1.3 → 4.1.4

package/scripts/next-development-self-dogfood-harness.mjs

@@ -164,7 +164,7 @@ export function validateSelfDogfoodRoute(route) {
     targetRepository !== "kungfu-systems/buildchain" ||
     route.runtimeRef !== "v4-alpha" ||
     route.publicWorkflow !==
-      `${targetRepository}/.github/workflows/build.yml@v4-alpha` ||
+      `${targetRepository}/.github/workflows/.build-candidate.yml@v4-alpha` ||
     route.protectedDevBranch !== PROTECTED_DEV_BRANCH ||
     JSON.stringify(route.hostedReadbackPaths) !==
       JSON.stringify(HOSTED_READBACK_PATHS)

package/scripts/next-development-self-dogfood.mjs

@@ -66,7 +66,7 @@ export function validateSelfDogfoodCheckpoint(checkpoint) {
   if (
     checkpoint.route.runtimeRef !== "v4-alpha" ||
     checkpoint.route.publicWorkflow !==
-      `${targetRepository}/.github/workflows/build.yml@v4-alpha` ||
+      `${targetRepository}/.github/workflows/.build-candidate.yml@v4-alpha` ||
     targetRepository !== "kungfu-systems/buildchain"
   ) {
     throw new Error("checkpoint requires the public owner/repo v4-alpha route");
@@ -122,7 +122,7 @@ export async function createSelfDogfoodCheckpoint({
   const routeRepository = repository(targetRepository);
   const route = {
     repository: routeRepository,
-    publicWorkflow: `${routeRepository}/.github/workflows/build.yml@v4-alpha`,
+    publicWorkflow: `${routeRepository}/.github/workflows/.build-candidate.yml@v4-alpha`,
     runtimeRef: required(runtimeRef, "runtimeRef"),
     runtimeSha: exactSha(runtimeSha, "runtimeSha"),
     contractRoot: exactRoot(contractRoot, "contractRoot"),
@@ -239,7 +239,7 @@ export function validateSelfDogfoodEvidence(evidence) {
   validateAdapterEvidence(evidence.adapter, semver, anchored);
   if (
     evidence.adoption?.coordinate !==
-      "kungfu-systems/buildchain/.github/workflows/build.yml@v4" ||
+      "kungfu-systems/buildchain/.github/workflows/.build-candidate.yml@v4" ||
     evidence.adoption?.exactShaProductionPin !== false
   ) {
     throw new Error("Kungfu adoption must use the floating v4 coordinate");
@@ -367,7 +367,7 @@ export async function resumeSelfDogfoodCheckpoint(
       },
     },
     adoption: {
-      coordinate: "kungfu-systems/buildchain/.github/workflows/build.yml@v4",
+      coordinate: "kungfu-systems/buildchain/.github/workflows/.build-candidate.yml@v4",
       runtimeRef: "v4",
       exactShaProductionPin: false,
     },

package/scripts/site-capability-metadata.mjs

@@ -134,14 +134,10 @@ export function cliCommandMeta(id) {
     "npm-dry-run": { group: "release-passport-trust", purpose: "Verify npm publish shape before a release transaction." },
     paper: { group: "reusable-build", purpose: "Inspect the unified paper repository and publication command families." },
     "paper-agent": { group: "getting-started", purpose: "Verify the mandatory managed Paper agent entry contract on an existing work branch." },
-    "paper-alpha": { group: "release-passport-trust", purpose: "Plan or open the protected dev-to-alpha paper publication PR without direct publication." },
-    "paper-bootstrap-npm": { group: "release-passport-trust", purpose: "Dry-run or explicitly bootstrap the public npm package and bind GitHub Trusted Publishing." },
-    "paper-build": { group: "reusable-build", purpose: "Plan or execute the existing two-clean-build reproducibility gate for a paper." },
-    "paper-fleet-audit": { group: "governance-versioning", purpose: "Discover Paper repositories and emit one deterministic v3 dependency, control-surface, and governance audit." },
+    "paper-fleet-audit": { group: "governance-versioning", purpose: "Discover Paper repositories and audit current consumer configuration, dependencies, and governance." },
     "paper-fleet-update": { group: "governance-versioning", purpose: "Plan or write a bounded v3 migration across isolated Paper work branches." },
     "paper-migrate": { group: "getting-started", purpose: "Plan or write the bounded Buildchain-owned control-file migration for an existing paper repository." },
-    "paper-preflight": { group: "reusable-build", purpose: "Report exact source, runtime, permission, npm trust, deterministic build, and release-state readiness." },
-    "paper-resume": { group: "release-passport-trust", purpose: "Plan or dispatch recovery of the exact existing sealed paper release transaction." },
+    "paper-preflight": { group: "reusable-build", purpose: "Validate the schema-2 consumer configuration and inspect retained legacy evidence without inferring hosted publication." },
     "paper-scaffold": { group: "getting-started", purpose: "Plan or write an idempotent, no-overwrite, release-ready paper repository scaffold." },
     "paper-status": { group: "reusable-build", purpose: "Report explicit evidence for every paper lifecycle state without unsupported inference." },
     "paper-work-start": { group: "getting-started", purpose: "Create a safe Paper work branch from the exact canonical remote development SHA." },

package/scripts/source-metric-lineage.mjs

@@ -1,17 +1,72 @@
-import { execFileSync } from 'node:child_process';
+import { execFileSync } from "node:child_process";
 
 // Measurement identity follows Git's observed renames. This does not resolve a
 // runtime path or keep a removed entrypoint callable.
-export function projectRenamedMetrics({ root, revision, metrics, currentPaths }) {
-  const records = execFileSync('git', ['diff', '--name-status', '-z', '--find-renames=50%', '--diff-filter=R', revision],
-    { cwd: root, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }).split('\0');
-  const projected = { ...metrics }, renames = [];
+export function projectRenamedMetrics({
+  root,
+  revision,
+  metrics,
+  currentPaths,
+}) {
+  const records = execFileSync(
+    "git",
+    [
+      "diff",
+      "--name-status",
+      "-z",
+      "--find-renames=50%",
+      "--diff-filter=R",
+      revision,
+    ],
+    { cwd: root, encoding: "utf8", maxBuffer: 16 * 1024 * 1024 },
+  ).split("\0");
+  const projected = { ...metrics },
+    renames = [];
   for (let index = 0; index < records.length && records[index]; index += 3) {
     const [status, source, target] = records.slice(index, index + 3);
-    if (!/^R\d+$/.test(status) || !source || !target) throw Error('Invalid Git metric lineage');
-    if (!metrics[source] || metrics[target] || !currentPaths.has(target)) continue;
+    if (!/^R\d+$/.test(status) || !source || !target)
+      throw Error("Invalid Git metric lineage");
+    if (!metrics[source] || metrics[target] || !currentPaths.has(target))
+      continue;
     projected[target] = { ...metrics[source], file: target };
     renames.push({ source, target, similarity: Number(status.slice(1)) });
   }
   return { metrics: projected, renames };
 }
+
+// Workflow taxonomy IDs survive role/path changes and are available at both
+// exact cuts even in a shallow checkout. Preserve their original measured budget.
+export function projectWorkflowMetrics({
+  metrics,
+  before,
+  after,
+  currentPaths,
+}) {
+  for (const entries of [before, after])
+    for (const key of ["id", "path"])
+      if (
+        new Set(entries.map((entry) => entry[key])).size !== entries.length ||
+        entries.some((entry) => typeof entry[key] !== "string" || !entry[key])
+      )
+        throw Error(
+          "Workflow measurement identities must be unique and explicit",
+        );
+  const originals = new Map(before.map((entry) => [entry.id, entry.path]));
+  const projected = { ...metrics },
+    renames = [];
+  for (const { id, path: target } of after) {
+    const source = originals.get(id);
+    if (
+      !source ||
+      source === target ||
+      !metrics[source] ||
+      metrics[target] ||
+      !currentPaths.has(target) ||
+      currentPaths.has(source)
+    )
+      continue;
+    projected[target] = { ...metrics[source], file: target };
+    renames.push({ id, source, target });
+  }
+  return { metrics: projected, renames };
+}

package/scripts/verify-golden-path.mjs

@@ -56,7 +56,12 @@ export function verifyGoldenPath() {
           name: "buildchain-golden-path-consumer",
           version: "0.1.0",
           private: true,
-          scripts: { build: 'node -e ""', check: 'node -e ""' },
+          scripts: {
+            build:
+              "node -e \"require('fs').mkdirSync('dist',{recursive:true});require('fs').writeFileSync('dist/index.js','export const value = 1;')\"",
+            check:
+              "node -e \"require('assert').ok(require('fs').statSync('dist/index.js').size > 0)\"",
+          },
         },
         null,
         2,
@@ -88,34 +93,19 @@ export function verifyGoldenPath() {
       { cwd: consumer, json: true },
     );
     const workflow = fs.readFileSync(
-      path.join(consumer, ".github", "workflows", "build.yml"),
+      path.join(consumer, ".github", "workflows", "buildchain.yml"),
       "utf8",
     );
-    const releaseDryRun = run(
-      buildchain,
-      ["release", "--dry-run", "--target-ref", "alpha/v4/v4.0", "--json"],
-      { cwd: consumer, json: true },
-    );
-    const passportPath = path.join(
-      consumer,
-      ".buildchain",
-      "golden-path",
-      "buildchain.release.json",
-    );
-    fs.mkdirSync(path.dirname(passportPath), { recursive: true });
-    run(
-      process.execPath,
-      [
-        "--input-type=module",
-        "--eval",
-        `import fs from "node:fs"; import { createReleasePassport } from "@kungfu-tech/buildchain"; const value=createReleasePassport({repository:"example/consumer",tag:"v0.1.0-alpha.0",sourceSha:"a".repeat(40),assets:[{name:"consumer.tgz",sha256:"b".repeat(64)}]}); fs.writeFileSync(${JSON.stringify(passportPath)}, JSON.stringify(value,null,2)+"\\n");`,
-      ],
-      { cwd: consumer },
-    );
-    const inspection = run(
-      buildchain,
-      ["inspect", "release", "--passport", passportPath, "--json"],
-      { cwd: consumer, json: true },
+    run("git", ["init", "-q"], { cwd: consumer });
+    const doctor = run(buildchain, ["doctor", "--json"], {
+      cwd: consumer,
+      json: true,
+    });
+    run("npm", ["run", "build"], { cwd: consumer });
+    run("npm", ["run", "check"], { cwd: consumer });
+    const recovery = fs.readFileSync(
+      path.join(consumer, ".github/workflows/buildchain-recover.yml"),
+      "utf8",
     );
 
     assert(
@@ -133,7 +123,7 @@ export function verifyGoldenPath() {
       "Golden Path validation did not retain the required lifecycle stages",
     );
     assert(
-      /uses:\s+kungfu-systems\/buildchain\/\.github\/workflows\/build\.yml@v4/.test(
+      /uses:\s+kungfu-systems\/buildchain\/\.github\/workflows\/public-ops-pipeline\.yml@v4/.test(
         workflow,
       ),
       "Golden Path workflow is not a thin v4 reusable-workflow caller",
@@ -142,13 +132,18 @@ export function verifyGoldenPath() {
       !/\n\s+(?:inputs|with|steps):/.test(workflow),
       "Golden Path ordinary caller must have zero inputs and delegate its steps",
     );
+    assert(doctor.ok, "Golden Path doctor rejected the initialized consumer");
+    assert(
+      validation.config.schema === 2 && validation.products[0].type === "npm",
+      "Golden Path did not validate the schema-2 product",
+    );
     assert(
-      releaseDryRun && typeof releaseDryRun === "object",
-      "Golden Path release dry-run did not return JSON",
+      /public-ops-recover\.yml@v4/.test(recovery),
+      "Golden Path recovery entry is not the shared caller",
     );
     assert(
-      inspection && typeof inspection === "object",
-      "Golden Path Release Passport inspection did not return JSON",
+      Object.keys(validation.consumer || {}).length > 0,
+      "Golden Path validation did not inspect caller wiring",
     );
     return {
       contract: "kungfu-buildchain-golden-path-verification/v1",
@@ -156,9 +151,10 @@ export function verifyGoldenPath() {
       version,
       projectType: initialized.type,
       validationPath: validation.config?.path,
-      reusableWorkflow: ".github/workflows/build.yml",
-      releaseDryRun: true,
-      releasePassportInspection: true,
+      reusableWorkflows: validation.consumer.workflows,
+      productBuildAndVerification: true,
+      doctor: doctor.ok,
+      providerEffects: false,
     };
   } finally {
     fs.rmSync(temporary, { recursive: true, force: true });

package/templates/native-dev-delivery.yml

@@ -93,7 +93,7 @@ permissions:
   statuses: write
 jobs:
   deliver:
-    uses: kungfu-systems/buildchain/.github/workflows/public-ops-dev-auto-merge.yml@v4-alpha
+    uses: kungfu-systems/buildchain/.github/workflows/.ops-dev-auto-merge.yml@v4-alpha
     with:
       runtime-ref: ${{ inputs.runtime-ref || '' }}
       target-branch: ${{ github.event.client_payload.candidate.targetBranch || inputs.target-branch }}

package/templates/universal-buildchain-bootstrap.yml

@@ -30,7 +30,7 @@ permissions:
 
 jobs:
   bootstrap:
-    uses: kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4
+    uses: kungfu-systems/buildchain/.github/workflows/.ops-bootstrap.yml@v4
     with:
       request-json: ${{ inputs.request-json }}
       runtime-ref: ${{ inputs.runtime-ref }}

package/packages/core/paper/operations/bootstrap.js

@@ -1,75 +0,0 @@
-import { readNpmPackResult } from "../../publication/npm/pack-result.js";
-import path from "node:path";
-import fs from "node:fs";
-import { jsonText, extractUrls, safeParseJson, toPosix } from "./files.js";
-import {
-  NPM_REGISTRY,
-  DEFAULT_BOOTSTRAP_VERSION,
-  PAPER_NPM_BOOTSTRAP_CONTRACT,
-} from "./identity.js";
-import { executePaperNpmBootstrap as executePaperNpmBootstrapOperation } from "../paper-npm-bootstrap.js";
-import {
-  PAPER_PATHS,
-  commandResult,
-  normalizeRepository,
-  paperConfig,
-  resolvePaperRepository,
-} from "../paper-repository.js";
-import os from "node:os";
-import {
-  expectedPaperTrustedPublisher,
-  validatePaperProvisioningAuthority,
-} from "./provisioning-validation.js";
-import {
-  liveNpmAuthObservation,
-  liveNpmPackageObservation,
-  liveNpmTrustObservation,
-} from "./npm-observation.js";
-import { normalizePackageName } from "./runtime.js";
-export function writePaperReceipt(cwd, relativePath, value) {
-  const target = path.resolve(cwd, relativePath);
-  fs.mkdirSync(path.dirname(target), { recursive: true });
-  fs.writeFileSync(target, jsonText(value));
-  return relativePath;
-}
-export function bootstrapPackageShape({ packageName, version }) {
-  return {
-    name: packageName,
-    version,
-    private: false,
-    license: "Apache-2.0",
-    description: "Bootstrap package for npm Trusted Publishing setup.",
-    publishConfig: {
-      access: "public",
-      registry: NPM_REGISTRY,
-    },
-  };
-}
-export function executePaperNpmBootstrap(options = {}) {
-  return executePaperNpmBootstrapOperation(options, {
-    DEFAULT_BOOTSTRAP_VERSION,
-    NPM_REGISTRY,
-    PAPER_NPM_BOOTSTRAP_CONTRACT,
-    PAPER_PATHS,
-    bootstrapPackageShape,
-    commandResult,
-    expectedPaperTrustedPublisher,
-    extractUrls,
-    fs,
-    jsonText,
-    liveNpmAuthObservation,
-    liveNpmPackageObservation,
-    liveNpmTrustObservation,
-    normalizePackageName,
-    normalizeRepository,
-    os,
-    paperConfig,
-    path,
-    resolvePaperRepository,
-    safeParseJson,
-    readNpmPackResult,
-    toPosix,
-    validatePaperProvisioningAuthority,
-    writePaperReceipt,
-  });
-}

package/packages/core/paper/operations/plans.js

@@ -1,213 +0,0 @@
-import path from "node:path";
-import {
-  paperConfig,
-  gitValue,
-  PAPER_PATHS,
-  parsePaperVersion,
-  resolvePaperRepository,
-} from "../paper-repository.js";
-import {
-  PAPER_BUILD_PLAN_CONTRACT,
-  GIT_SHA_PATTERN,
-  PAPER_ALPHA_PLAN_CONTRACT,
-  PAPER_RESUME_PLAN_CONTRACT,
-} from "./identity.js";
-import { collectPaperStatus } from "./status.js";
-export function createPaperBuildPlan({
-  cwd = process.cwd(),
-  sourceSha = "",
-  pullToolchain = true,
-} = {}) {
-  const resolvedCwd = path.resolve(cwd);
-  const configResult = paperConfig(resolvedCwd);
-  if (configResult.error) throw new Error(configResult.error);
-  const resolvedSha = sourceSha || gitValue(resolvedCwd, ["rev-parse", "HEAD"]);
-  return {
-    schemaVersion: 1,
-    contract: PAPER_BUILD_PLAN_CONTRACT,
-    ok: GIT_SHA_PATTERN.test(resolvedSha),
-    cwd: resolvedCwd,
-    dryRun: true,
-    sourceSha: resolvedSha,
-    toolchain: configResult.loaded.config.publication.toolchain,
-    pullToolchain,
-    output: PAPER_PATHS.reproducibilityReceipt,
-    promotion: "first-byte-identical-clean-build",
-    delegatesTo: "buildchain publication-artifact reproducibility --promote",
-    nextActions: [
-      {
-        id: "execute-build",
-        command: "buildchain paper build --execute --json",
-        description:
-          "Run two independent clean builds and promote only byte-identical qualifying outputs.",
-      },
-    ],
-  };
-}
-export function resolvePaperChannelRef(cwd, ref) {
-  const candidates = [
-    {
-      observedRef: `refs/remotes/origin/${ref}`,
-      observation: "origin-tracking-ref",
-    },
-    {
-      observedRef: `refs/heads/${ref}`,
-      observation: "local-branch-ref",
-    },
-  ];
-  for (const candidate of candidates) {
-    const sha = gitValue(cwd, [
-      "rev-parse",
-      "--verify",
-      `${candidate.observedRef}^{commit}`,
-    ]);
-    if (GIT_SHA_PATTERN.test(sha)) {
-      return {
-        sha,
-        ...candidate,
-      };
-    }
-  }
-  return {
-    sha: "",
-    observedRef: "",
-    observation: "unresolved",
-  };
-}
-export function createPaperAlphaPlan({
-  cwd = process.cwd(),
-  sourceRef = "",
-  targetRef = "",
-} = {}) {
-  const resolvedCwd = path.resolve(cwd);
-  const configResult = paperConfig(resolvedCwd);
-  if (configResult.error) throw new Error(configResult.error);
-  const publication = configResult.loaded.config.publication;
-  const parsed = parsePaperVersion(publication.version);
-  const line = `v${parsed.major}.${parsed.minor}`;
-  const source = sourceRef || `dev/v${parsed.major}/${line}`;
-  const target = targetRef || `alpha/v${parsed.major}/${line}`;
-  const repository = resolvePaperRepository(resolvedCwd);
-  const sourceObservation = resolvePaperChannelRef(resolvedCwd, source);
-  const targetObservation = resolvePaperChannelRef(resolvedCwd, target);
-  const currentBranch = gitValue(resolvedCwd, ["branch", "--show-current"]);
-  return {
-    schemaVersion: 1,
-    contract: PAPER_ALPHA_PLAN_CONTRACT,
-    ok: Boolean(repository && source && target && source !== target),
-    cwd: resolvedCwd,
-    dryRun: true,
-    repository,
-    package: configResult.loaded.config.publish?.package || "",
-    publicationVersion: parsed.version,
-    channel: "alpha",
-    source: {
-      ref: source,
-      ...sourceObservation,
-    },
-    target: {
-      ref: target,
-      ...targetObservation,
-    },
-    currentBranch,
-    mutation: {
-      kind: "github-protected-channel-pr",
-      directPublish: false,
-      directMerge: false,
-      command: `gh pr create --repo ${repository || "<owner/repo>"} --base ${target} --head ${source}`,
-    },
-    gates: [
-      "source is the protected dev channel for the configured semver line",
-      "target is the protected alpha channel",
-      "the paper release workflow seals exact bytes and uses npm OIDC",
-      "this command opens a PR but never merges it or publishes directly",
-    ],
-    nextActions: [
-      {
-        id: "open-alpha-pr",
-        command: "buildchain paper alpha --execute --json",
-        description: "Open or reuse the protected dev-to-alpha publication PR.",
-      },
-    ],
-  };
-}
-export function createPaperResumePlan({
-  cwd = process.cwd(),
-  runtimeRef = "",
-} = {}) {
-  const resolvedCwd = path.resolve(cwd);
-  const status = collectPaperStatus({ cwd: resolvedCwd });
-  const transaction = status.transaction;
-  if (!transaction) {
-    return {
-      schemaVersion: 1,
-      contract: PAPER_RESUME_PLAN_CONTRACT,
-      ok: false,
-      cwd: resolvedCwd,
-      dryRun: true,
-      resumable: false,
-      reason: "no-release-transaction",
-      transaction: null,
-      nextActions: [
-        {
-          id: "start-alpha",
-          command: "buildchain paper alpha --json",
-          description:
-            "No transaction exists; plan the protected Alpha publication first.",
-        },
-      ],
-    };
-  }
-  if (
-    ["alpha-complete", "release-complete"].includes(
-      transaction.publicationState,
-    )
-  ) {
-    return {
-      schemaVersion: 1,
-      contract: PAPER_RESUME_PLAN_CONTRACT,
-      ok: true,
-      cwd: resolvedCwd,
-      dryRun: true,
-      resumable: false,
-      reason: "transaction-complete",
-      transaction,
-      nextActions: [],
-    };
-  }
-  const targetRef = transaction.targetRef;
-  const command = [
-    "gh workflow run .github/workflows/public-release-paper.yml",
-    targetRef ? `--ref ${targetRef}` : "",
-    runtimeRef ? `-f runtime-ref=${runtimeRef}` : "",
-  ]
-    .filter(Boolean)
-    .join(" ");
-  return {
-    schemaVersion: 1,
-    contract: PAPER_RESUME_PLAN_CONTRACT,
-    ok: Boolean(targetRef),
-    cwd: resolvedCwd,
-    dryRun: true,
-    resumable: Boolean(targetRef),
-    reason: targetRef
-      ? "rerun-sealed-paper-release"
-      : "transaction-target-ref-missing",
-    transaction,
-    mutation: {
-      kind: "github-workflow-dispatch",
-      directPublish: false,
-      command,
-    },
-    nextActions: targetRef
-      ? [
-          {
-            id: "dispatch-resume",
-            command: "buildchain paper resume --execute --json",
-            description:
-              "Dispatch the thin repository workflow against the exact transaction target ref.",
-          },
-        ]
-      : [],
-  };
-}

package/packages/core/paper/operations/provisioning.js

@@ -1,113 +0,0 @@
-import { PAPER_PATHS, sha256Text, stableJson } from "../paper-repository.js";
-import { PAPER_AGENT_ENTRY_CONTRACT } from "../paper-agent-entry.js";
-import path from "node:path";
-import {
-  PAPER_PROVISIONING_CONTRACT,
-  NPM_REGISTRY,
-  DEFAULT_BOOTSTRAP_VERSION,
-} from "./identity.js";
-export function paperProvisioningPolicy() {
-  return {
-    repositoryActions: {
-      defaultWorkflowPermissions: "read",
-      canApprovePullRequestReviews: false,
-    },
-    generatedWrites: {
-      preferredAuthority: "github-app",
-      compatibilityAuthority: "narrow-token",
-      githubTokenFallback: false,
-      permissions: ["checks:write", "contents:write", "pull-requests:write"],
-      tokenPersistence: "runtime-only",
-    },
-    release: {
-      protectedReviewRequired: true,
-      versionState: "not-required",
-      identityOnlyPullRequests: false,
-      manualVersionStateRepairPullRequests: false,
-    },
-    roles: {
-      actor: "repository-development-role",
-      pusher: "repository-development-role",
-      reviewer: "independent-review-role",
-      generatedWriteAuthority: "github-app-or-narrow-token",
-    },
-  };
-}
-export function createPaperProvisioningAuthority({
-  repository,
-  packageName,
-  buildchainVersion,
-  buildchainSha,
-  contractLock,
-  buildWorkflow,
-  verifyWorkflow,
-  releaseWorkflow,
-  agentEntry,
-  agentInstructions,
-  environment = "",
-}) {
-  const policy = paperProvisioningPolicy();
-  const payload = {
-    schemaVersion: 1,
-    contract: PAPER_PROVISIONING_CONTRACT,
-    repository,
-    package: {
-      name: packageName,
-      registry: NPM_REGISTRY,
-      bootstrapVersion: DEFAULT_BOOTSTRAP_VERSION,
-    },
-    runtime: {
-      repository: "kungfu-systems/buildchain",
-      version: buildchainVersion,
-      ref: buildchainSha,
-      resolvedSha: buildchainSha,
-    },
-    workflows: {
-      build: {
-        path: PAPER_PATHS.buildWorkflow,
-        sourceDigest: sha256Text(buildWorkflow),
-        reusablePath: ".github/workflows/public-build-publication.yml",
-        reusableRef: buildchainSha,
-      },
-      verify: {
-        path: PAPER_PATHS.verifyWorkflow,
-        sourceDigest: sha256Text(verifyWorkflow),
-        reusablePath: ".github/workflows/public-build-check.yml",
-        reusableRef: buildchainSha,
-      },
-      release: {
-        path: PAPER_PATHS.releaseWorkflow,
-        sourceDigest: sha256Text(releaseWorkflow),
-        reusablePath: ".github/workflows/public-release-paper.yml",
-        reusableRef: buildchainSha,
-      },
-    },
-    agentEntry: {
-      contract: PAPER_AGENT_ENTRY_CONTRACT,
-      policyPath: PAPER_PATHS.agentEntry,
-      policyDigest: sha256Text(agentEntry),
-      instructionsPath: PAPER_PATHS.agentInstructions,
-      instructionsDigest: sha256Text(agentInstructions),
-    },
-    admission: {
-      contractLockPath: PAPER_PATHS.contractLock,
-      contractLockDigest: sha256Text(contractLock),
-      acceptedRef: buildchainSha,
-      acceptedSha: buildchainSha,
-    },
-    trustedPublisher: {
-      type: "github",
-      repository,
-      workflow: path.posix.basename(PAPER_PATHS.releaseWorkflow),
-      environment,
-    },
-    policy: {
-      ...policy,
-      policyDigest: sha256Text(stableJson(policy)),
-    },
-  };
-  return {
-    ...payload,
-    authorityDigest: sha256Text(stableJson(payload)),
-  };
-}