@kungfu-tech/buildchain 4.1.6 → 4.1.7

package/packages/core/release/promotion/compatibility.js

@@ -0,0 +1,141 @@
+import fs from "node:fs";
+import {
+  HISTORICAL_PROMOTION_SCHEMA,
+  historicalPromotionContext,
+  historicalEvidenceFileKeys,
+} from "./compatibility-context.js";
+export { HISTORICAL_PROMOTION_SCHEMA } from "./compatibility-context.js";
+import path from "node:path";
+import { installationRoot } from "../../runtime/installation-root.js";
+import { normalizePromotionRequest } from "../promotion-request.js";
+
+const root = installationRoot(import.meta.url);
+const read = (relative) =>
+  JSON.parse(fs.readFileSync(path.join(root, relative), "utf8"));
+let historical, current;
+function loadHistoricalContract() {
+  historical ||= read(
+    "contracts/fixtures/consumer-upgrade/release-v4.0.0.json",
+  );
+  current ||= read("contracts/promotion-request-v1.schema.json");
+}
+const transports = new Set([
+  "request-json",
+  "runtime-ref",
+  "contract-lock",
+  "runtime-selection",
+]);
+const selectors = new Set([
+  "buildchain-channel",
+  "buildchain-repository",
+  "buildchain-ref",
+  "buildchain-contract-lock-path",
+  "buildchain-alpha-contract-lock-path",
+  "buildchain-stable-contract-lock-path",
+]);
+export const HISTORICAL_PROMOTION_ENVELOPE =
+  "buildchain.promotion-compatibility/v1";
+
+function object(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${label} must be an object`);
+  return value;
+}
+
+function normalizeInputs(value) {
+  const inputs = object(value, "Historical promotion inputs");
+  for (const key of Object.keys(inputs)) {
+    const field = historical.inputs[key];
+    if (!field && !transports.has(key))
+      throw new Error(`Unsupported historical promotion input: ${key}`);
+    const type = field?.type || "string";
+    if (
+      typeof inputs[key] !== type ||
+      (type === "number" && !Number.isFinite(inputs[key]))
+    )
+      throw new Error(`Historical promotion ${key} must be ${type}`);
+  }
+  return Object.fromEntries(
+    Object.entries(historical.inputs).map(([key, field]) => [
+      key,
+      inputs[key] ??
+        field.default ??
+        (field.type === "boolean" ? false : field.type === "number" ? 0 : ""),
+    ]),
+  );
+}
+
+// The envelope is emitted only by the retained workflow. Ordinary request JSON
+// remains the existing closed typed API; it cannot opt into a historical contract.
+export function normalizeHistoricalPromotion(value, workflowRef) {
+  const envelope = typeof value === "string" ? JSON.parse(value) : value;
+  if (envelope?.schema !== HISTORICAL_PROMOTION_ENVELOPE)
+    return { request: normalizePromotionRequest(value), historical: "" };
+  loadHistoricalContract();
+  object(envelope, "Historical promotion envelope");
+  if (Object.keys(envelope).some((key) => !["schema", "inputs"].includes(key)))
+    throw new Error("Unsupported historical promotion envelope field");
+  if (
+    workflowRef?.split("@")[0] !==
+    "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml"
+  )
+    throw new Error(
+      "Historical promotion requires its retained workflow identity",
+    );
+  const inputs = normalizeInputs(envelope.inputs);
+  const supplied = envelope.inputs["request-json"];
+  if (supplied) {
+    if (
+      Object.entries(inputs).some(
+        ([key, value]) =>
+          value !== (historical.inputs[key].default ?? "") &&
+          !selectors.has(key),
+      )
+    )
+      throw new Error(
+        "Cannot combine request-json with historical promotion arguments",
+      );
+    const typed = normalizePromotionRequest(supplied);
+    return {
+      request: typed,
+      historical: JSON.stringify({
+        schema: HISTORICAL_PROMOTION_SCHEMA,
+        inputs: Object.fromEntries(
+          historicalEvidenceFileKeys
+            .filter((key) => typed[key])
+            .map((key) => [key, typed[key]]),
+        ),
+      }),
+    };
+  }
+  for (const key of [
+    "branch-protection-bypass-users",
+    "branch-protection-bypass-teams",
+  ])
+    if (inputs[key]) throw new Error(`Historical promotion rejects ${key}`);
+  const request = { schema: "buildchain.promotion-request/v1" };
+  const retained = {};
+  for (const [key, value] of Object.entries(inputs)) {
+    if (Object.hasOwn(current.properties, key)) request[key] = value;
+    else if (!selectors.has(key) && value !== "") retained[key] = value;
+    if (historicalEvidenceFileKeys.includes(key) && value)
+      retained[key] = value;
+  }
+  if (request["publish-mode"] === "publish-final-version") {
+    retained["publish-mode"] = "publish-final-version";
+    request["publish-mode"] = "";
+  }
+  if (request["publish-artifact-kind"] === "binary") {
+    retained["publish-artifact-kind"] = "binary";
+    request["publish-artifact-kind"] = "custom";
+  }
+  return {
+    request: normalizePromotionRequest(request),
+    historical: JSON.stringify(
+      historicalPromotionContext({
+        schema: HISTORICAL_PROMOTION_SCHEMA,
+        inputs: retained,
+      }),
+    ),
+  };
+}

package/packages/core/release/promotion/historical-evidence-action.js

@@ -0,0 +1,17 @@
+import path from "node:path";
+import { verifyPromotionInvocation } from "../promotion-request.js";
+import { qualifyHistoricalEvidence } from "./historical-evidence.js";
+export function historicalEvidenceAction(core, env) {
+  const request = verifyPromotionInvocation(
+    core.getInput("request-json", { required: true }),
+  );
+  const workspace = path.resolve(env.GITHUB_WORKSPACE);
+  const receipt = qualifyHistoricalEvidence({
+    context: request["historical-inputs-json"],
+    sourceDirectory: path.join(workspace, ".buildchain/historical-source"),
+    candidateDirectory: path.join(workspace, ".buildchain/release-candidate"),
+    sourceSha: core.getInput("source-sha", { required: true }),
+    environment: env,
+  });
+  if (receipt) core.setOutput("receipt-root", receipt.receiptRoot);
+}

package/packages/core/release/promotion/historical-evidence-files.js

@@ -0,0 +1,112 @@
+import fs from "node:fs";
+import path from "node:path";
+import {
+  createKfd1ReleaseGateEvidence,
+  normalizeKfd1ContractWorldWitness,
+  createKfd3CollaborationInterfaceReleaseGateEvidence,
+} from "../../adoption/kfd-gate.js";
+import { createKfd2ReleaseTrustPassportAudit } from "../passport/trust-claims.js";
+import { normalizeImpactLedger } from "../passport/impact.js";
+import { historicalEvidenceFileKeys } from "./compatibility-context.js";
+
+function containedFile(root, relative) {
+  const candidate = path.resolve(root, relative);
+  const boundary = `${fs.realpathSync(root)}${path.sep}`;
+  if (!candidate.startsWith(`${path.resolve(root)}${path.sep}`))
+    throw new Error("Historical evidence path escapes its declared directory");
+  if (!fs.existsSync(candidate)) return candidate;
+  if (!fs.realpathSync(candidate).startsWith(boundary))
+    throw new Error(
+      "Historical evidence symlink escapes its declared directory",
+    );
+  if (!fs.statSync(candidate).isFile())
+    throw new Error("Historical evidence requires a regular file");
+  return candidate;
+}
+
+function readValues(input, sourceDirectory) {
+  if (!input) return [];
+  const entries = /^[\s]*[\[{]/u.test(input)
+    ? [input]
+    : input
+        .split(/\r?\n/u)
+        .map((line) => line.trim())
+        .filter(Boolean);
+  return entries.flatMap((entry) => {
+    const value = JSON.parse(
+      /^[\s]*[\[{]/u.test(entry)
+        ? entry
+        : fs.readFileSync(containedFile(sourceDirectory, entry), "utf8"),
+    );
+    return Array.isArray(value) ? value : [value];
+  });
+}
+
+export function historicalEvidenceFiles(inputs, sourceDirectory) {
+  return Object.fromEntries(
+    historicalEvidenceFileKeys
+      .filter((key) => inputs[key])
+      .map((key) => [key, readValues(inputs[key], sourceDirectory)]),
+  );
+}
+
+export function qualifyHistoricalEvidenceFiles({
+  files,
+  results,
+  sourceDirectory,
+  candidateDirectory,
+  verifiedAt,
+}) {
+  const [kfd1Key, kfd2Key, prebuildKey, artifactKey, impactKey] =
+    historicalEvidenceFileKeys;
+  const witnesses = files[kfd1Key] || [];
+  // The maintained KFD-1 resolver can use source surfaces or payload surfaces.
+  // Validate both roots before giving it consumer-declared paths.
+  for (const witness of witnesses.map((value) =>
+    normalizeKfd1ContractWorldWitness(value),
+  ))
+    for (const surface of witness.surfaces || []) {
+      if (surface.sourcePath)
+        containedFile(sourceDirectory, surface.sourcePath);
+      if (surface.artifactPath) {
+        containedFile(sourceDirectory, surface.artifactPath);
+        containedFile(
+          path.join(candidateDirectory, "payloads"),
+          surface.artifactPath,
+        );
+      }
+    }
+  const kfd1 = createKfd1ReleaseGateEvidence({
+    cwd: sourceDirectory,
+    artifactRoot: path.join(candidateDirectory, "payloads"),
+    witnesses,
+    verifiedAt,
+  })?.passportSection;
+  const commandWitness =
+    results["release-passport-kfd-3-artifact-verify-command"];
+  const kfd3 = createKfd3CollaborationInterfaceReleaseGateEvidence({
+    prebuildWitnesses: files[prebuildKey] || [],
+    artifactWitnesses: [
+      ...(files[artifactKey] || []),
+      ...(commandWitness ? [commandWitness] : []),
+    ],
+    verifiedAt,
+  })?.passportSection;
+  const kfd2 = createKfd2ReleaseTrustPassportAudit({
+    explicitClaims: files[kfd2Key] || [],
+    kfd1Section: kfd1,
+    kfd3Section: kfd3,
+    verifiedAt,
+  });
+  const gates = Object.fromEntries(
+    Object.entries({ kfd1, kfd3, kfd2 }).filter(([, value]) => value),
+  );
+  for (const [key, gate] of Object.entries(gates))
+    if (gate.status === "failed")
+      throw new Error(`Historical ${key} release evidence failed`);
+  if (files[impactKey])
+    gates.impact = files[impactKey].map((value) =>
+      normalizeImpactLedger(value),
+    );
+  return JSON.parse(JSON.stringify(gates));
+}

package/packages/core/release/promotion/historical-evidence.js

@@ -0,0 +1,231 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import crypto from "node:crypto";
+import { spawnSync, execFileSync } from "node:child_process";
+import { releaseTailRoot } from "../release-tail-provider-plane.js";
+import {
+  historicalEvidenceFiles,
+  qualifyHistoricalEvidenceFiles,
+} from "./historical-evidence-files.js";
+import {
+  historicalEvidenceFileKeys,
+  historicalPromotionContext,
+} from "./compatibility-context.js";
+import { normalizeKfd3CollaborationInterfaceArtifactWitness } from "../../adoption/kfd-gate.js";
+import { createInvariantPassportGate } from "../passport/invariants.js";
+
+const filename = "buildchain.historical-evidence.json";
+export const historicalEvidenceKeys = [
+  "release-passport-kfd-3-artifact-verify-command",
+  "release-passport-invariant-passport-command",
+];
+function evidenceCommands(value) {
+  const inputs = historicalPromotionContext(value)?.inputs || {};
+  return historicalEvidenceKeys
+    .filter((key) => inputs[key])
+    .map((key) => [key, inputs[key]]);
+}
+function needsEvidence(value) {
+  return (
+    evidenceCommands(value).length ||
+    historicalEvidenceFileKeys.some(
+      (key) => historicalPromotionContext(value)?.inputs[key],
+    )
+  );
+}
+export function historicalEvidencePaths(value, directory) {
+  return needsEvidence(value) ? [path.join(directory, filename)] : [];
+}
+function materialRoot(directory) {
+  if (
+    !fs.lstatSync(directory).isDirectory() ||
+    fs.lstatSync(directory).isSymbolicLink()
+  )
+    throw new Error(
+      "Historical evidence materials require a regular directory",
+    );
+  const files = [];
+  function visit(relative) {
+    for (const name of fs.readdirSync(path.join(directory, relative)).sort()) {
+      const file = path.join(relative, name);
+      if (file === filename) continue;
+      const stat = fs.lstatSync(path.join(directory, file));
+      if (stat.isDirectory()) visit(file);
+      else if (stat.isFile())
+        files.push({
+          path: file.split(path.sep).join("/"),
+          digest: crypto
+            .createHash("sha256")
+            .update(fs.readFileSync(path.join(directory, file)))
+            .digest("hex"),
+        });
+      else
+        throw new Error(
+          "Historical evidence materials must contain only regular files",
+        );
+    }
+  }
+  visit("");
+  return releaseTailRoot(files);
+}
+function runEvidenceCommand(key, command, sourceDirectory, environment) {
+  const result = spawnSync(command, [], {
+    cwd: sourceDirectory,
+    shell: true,
+    encoding: "utf8",
+    env: environment,
+    timeout: 300000,
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  if (result.error || result.status !== 0)
+    throw new Error(
+      `Historical ${key} failed with status ${result.status ?? "unavailable"}`,
+    );
+  let value;
+  try {
+    value = JSON.parse(result.stdout);
+  } catch {
+    throw new Error(`Historical ${key} must emit valid JSON`);
+  }
+  if (key === historicalEvidenceKeys[0])
+    return normalizeKfd3CollaborationInterfaceArtifactWitness(value);
+  return createInvariantPassportGate([{ value }]);
+}
+
+export function qualifyHistoricalEvidence({
+  context,
+  sourceDirectory,
+  candidateDirectory,
+  sourceSha,
+  environment = process.env,
+}) {
+  const commands = evidenceCommands(context);
+  if (!needsEvidence(context)) return null;
+  if (
+    !/^[a-f0-9]{40}$/u.test(sourceSha) ||
+    execFileSync("git", ["-C", sourceDirectory, "rev-parse", "HEAD"], {
+      encoding: "utf8",
+    }).trim() !== sourceSha
+  )
+    throw new Error(
+      "Historical evidence requires the exact qualified candidate checkout",
+    );
+  const files = historicalEvidenceFiles(
+    historicalPromotionContext(context).inputs,
+    sourceDirectory,
+  );
+  const verifiedAt = execFileSync(
+    "git",
+    ["-C", sourceDirectory, "show", "-s", "--format=%cI", sourceSha],
+    { encoding: "utf8" },
+  ).trim();
+  const before = materialRoot(candidateDirectory);
+  const consumerBuildchain = path.join(sourceDirectory, ".buildchain");
+  if (
+    fs.existsSync(consumerBuildchain) &&
+    fs.lstatSync(consumerBuildchain).isSymbolicLink()
+  )
+    throw new Error(
+      "Historical product configuration cannot escape its source checkout",
+    );
+  fs.mkdirSync(consumerBuildchain, { recursive: true });
+  // The old command path remains relative to its product source checkout.
+  const link = path.join(consumerBuildchain, "release-candidate");
+  if (fs.existsSync(link)) {
+    if (
+      !fs.lstatSync(link).isSymbolicLink() ||
+      fs.realpathSync(link) !== fs.realpathSync(candidateDirectory)
+    )
+      throw new Error(
+        "Historical candidate path is occupied by unrelated source content",
+      );
+  } else fs.symlinkSync(path.resolve(candidateDirectory), link, "dir");
+  const home = fs.mkdtempSync(
+    path.join(os.tmpdir(), "buildchain-historical-evidence-"),
+  );
+  const env = Object.fromEntries(
+    ["PATH", "TMPDIR", "SYSTEMROOT", "SystemRoot", "PATHEXT"]
+      .filter((key) => environment[key])
+      .map((key) => [key, environment[key]]),
+  );
+  Object.assign(env, {
+    HOME: home,
+    BUILDCHAIN_RELEASE_CANDIDATE_PAYLOADS: path.join(
+      candidateDirectory,
+      "payloads",
+    ),
+  });
+  let results;
+  try {
+    results = Object.fromEntries(
+      commands.map(([key, command]) => [
+        key,
+        runEvidenceCommand(key, command, sourceDirectory, env),
+      ]),
+    );
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+  if (materialRoot(candidateDirectory) !== before)
+    throw new Error(
+      "Historical evidence command changed qualified publication materials",
+    );
+  for (const passport of results[historicalEvidenceKeys[1]]?.passports || [])
+    if (passport.source.revision !== sourceSha)
+      throw new Error(
+        "Historical invariant passport must bind the qualified source revision",
+      );
+  const gates = qualifyHistoricalEvidenceFiles({
+    files,
+    results,
+    sourceDirectory,
+    candidateDirectory,
+    verifiedAt,
+  });
+  const body = {
+    files,
+    gates,
+    schema: "buildchain.historical-evidence/v1",
+    contextRoot: releaseTailRoot(historicalPromotionContext(context)),
+    sourceSha,
+    materialRoot: before,
+    results,
+  };
+  const receipt = { ...body, receiptRoot: releaseTailRoot(body) };
+  fs.writeFileSync(
+    path.join(candidateDirectory, filename),
+    `${JSON.stringify(receipt, null, 2)}\n`,
+  );
+  return receipt;
+}
+
+export function verifyHistoricalEvidence({
+  context,
+  candidateDirectory,
+  sourceSha,
+}) {
+  if (!needsEvidence(context)) return null;
+  const { receiptRoot, ...body } = JSON.parse(
+    fs.readFileSync(path.join(candidateDirectory, filename), "utf8"),
+  );
+  if (
+    body.schema !== "buildchain.historical-evidence/v1" ||
+    receiptRoot !== releaseTailRoot(body) ||
+    body.contextRoot !== releaseTailRoot(historicalPromotionContext(context)) ||
+    body.sourceSha !== sourceSha ||
+    body.materialRoot !== materialRoot(candidateDirectory)
+  )
+    throw new Error(
+      "Historical evidence does not match the qualified candidate and invocation",
+    );
+  const keys = evidenceCommands(context)
+    .map(([key]) => key)
+    .sort();
+  if (
+    JSON.stringify(Object.keys(body.results || {}).sort()) !==
+    JSON.stringify(keys)
+  )
+    throw new Error("Historical evidence is missing required command results");
+  return { ...body, receiptRoot };
+}

package/packages/core/release/promotion/qualification.js

@@ -1,3 +1,6 @@
+import { historicalEvidencePaths } from "./historical-evidence.js";
+import { assertHistoricalPromotionEffects } from "./compatibility-qualification.js";
+import { historicalReleaseMetadata } from "../github-release-metadata.js";
 import path from "node:path";
 import { assertDeclarativePromotionInputs } from "../../publication/publication-qualification.js";
 import { materializePublicationIntent } from "../candidate/publication-intent.js";
@@ -33,6 +36,7 @@ export async function qualifyPromotion(
   );
   if (intent.action !== "promote") return intent;
   assertDeclarativePromotionInputs(request);
+  assertHistoricalPromotionEffects(request);
   const outputDir = path.join(workspace, ".buildchain/release-candidate"),
     qualified = await candidate({
       request,
@@ -93,6 +97,13 @@ export async function qualifyPromotion(
     "sealed-bundle-manifest": qualified.paths.sealedBundleManifest,
     "recovery-receipt-path": qualified.paths.recoveryReceipt || "",
     "required-artifacts-path": qualified.paths.publishRequiredArtifacts,
-    "release-artifact-paths": (qualified.paths.releaseAssets || []).join("\n"),
+    "release-artifact-paths": [
+      ...(qualified.paths.releaseAssets || []),
+      ...historicalReleaseMetadata(
+        request["historical-inputs-json"],
+        outputDir,
+      ),
+      ...historicalEvidencePaths(request["historical-inputs-json"], outputDir),
+    ].join("\n"),
   };
 }

package/packages/core/release/promotion/routing.js

@@ -1,8 +1,8 @@
 import { resolvePromotionChannel } from "./channel.js";
-import { normalizePromotionRequest } from "../promotion-request.js";
+import { normalizeHistoricalPromotion } from "./compatibility.js";
 
 export async function routePromotion({ context, request: requestValue, workflowRepository, workflowSha, workflowRef, runtime }) {
-  const request = normalizePromotionRequest(requestValue);
+  const { request, historical } = normalizeHistoricalPromotion(requestValue, workflowRef);
   const route = resolvePromotionChannel({
     publicationChannel: request.channel,
     targetRef: request["target-ref"] || context.ref.replace(/^refs\/heads\//u, ""),
@@ -10,6 +10,7 @@ export async function routePromotion({ context, request: requestValue, workflowR
   const entryRef = workflowRef.split("@").at(-1).replace(/^refs\/(?:heads|tags)\//u, "");
   return {
     "request-json": JSON.stringify(request),
+    ...(historical ? { "historical-inputs-json": historical } : {}),
     repository: runtime.repository,
     channel: route.channel,
     "publication-channel": route.publicationChannel,

package/packages/core/release/promotion-request.js

@@ -1,3 +1,9 @@
+import {
+  historicalEvidenceFileKeys,
+  historicalPromotionContext,
+  historicalPublisherPath,
+  HISTORICAL_PUBLISHER,
+} from "./promotion/compatibility-context.js";
 import fs from "node:fs";
 import path from "node:path";
 import { installationRoot } from "../runtime/installation-root.js";
@@ -92,8 +98,11 @@ export function bindPromotionInvocation(requestValue, selection) {
     throw new Error("Promotion override decision is missing");
   projected["promotion-override-used"] = selection["override-used"] === "true";
   projected["buildchain-expected-major"] = "4";
+  const historical = selection["historical-inputs-json"] || "";
+  if (historical) historicalPromotionContext(historical);
+  projected["historical-inputs-json"] = historical;
   projected["publication-authority-workflow-path"] =
-    ".github/workflows/.release-promote.yml";
+    historicalPublisherPath(historical);
   projected.schema = "buildchain.promotion-invocation/v1";
   return normalizePromotionRequest(projected, "invocation");
 }
@@ -101,7 +110,11 @@ export function bindPromotionInvocation(requestValue, selection) {
 export function verifyPromotionInvocation(value) {
   if (typeof value === "string") value = JSON.parse(value);
   const normalized = normalizePromotionRequest(value, "invocation");
-  if (Object.keys(value).length !== Object.keys(normalized).length)
+  const omittedCompatibility = !Object.hasOwn(value, "historical-inputs-json");
+  if (
+    Object.keys(value).length + Number(omittedCompatibility) !==
+    Object.keys(normalized).length
+  )
     throw new Error("Promotion invocation must include all normalized fields");
   if (
     !/^sha256:[0-9a-f]{64}$/.test(normalized["promotion-contract-lock-digest"])
@@ -109,5 +122,21 @@ export function verifyPromotionInvocation(value) {
     throw new Error(
       "Promotion invocation requires its admitted contract lock root",
     );
+  const historical = historicalPromotionContext(
+    normalized["historical-inputs-json"],
+  );
+  if (
+    Boolean(historical) !==
+    (normalized["publication-authority-workflow-path"] === HISTORICAL_PUBLISHER)
+  )
+    throw new Error(
+      "Promotion publisher does not match its admitted interface",
+    );
+  if (historical)
+    for (const key of historicalEvidenceFileKeys)
+      if ((historical.inputs[key] || "") !== normalized[key])
+        throw new Error(
+          `Historical evidence selection does not match invocation: ${key}`,
+        );
   return normalized;
 }

package/packages/core/release/release-tail-provider-adapters.js

@@ -1,3 +1,4 @@
+import { releaseMetadata, releaseMetadataMatches } from "./github-release-metadata.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
@@ -358,6 +359,9 @@ export function createGitHubReleaseAssetsAdapter({
       if (!observed.release) {
         return { outcome: "absent", providerCode: "github-release-absent" };
       }
+      if (!releaseMetadataMatches(releaseMetadata(expected), observed.release)) {
+        return { outcome: "absent", providerCode: "github-release-metadata-incomplete" };
+      }
       const byName = new Map(
         observed.assets.map((asset) => [asset.name, asset]),
       );
@@ -409,6 +413,7 @@ export function createGitHubReleaseAssetsAdapter({
         );
       }
       const observed = await releaseAndAssets(effect);
+      const metadata = releaseMetadata(expected);
       let release = observed.release;
       if (!release) {
         try {
@@ -419,6 +424,7 @@ export function createGitHubReleaseAssetsAdapter({
               tag_name: observed.coordinate.tag,
               target_commitish: effect.subject.sourceSha,
               name: observed.coordinate.tag,
+              ...metadata,
               draft: false,
               prerelease: effect.subject.channel === "alpha",
               make_latest: effect.subject.channel === "alpha" ? "false" : "true",
@@ -441,6 +447,18 @@ export function createGitHubReleaseAssetsAdapter({
           });
         }
       }
+      if (!releaseMetadataMatches(metadata, release)) {
+        try {
+          await octokit.rest.repos.updateRelease({
+            owner: observed.coordinate.owner,
+            repo: observed.coordinate.repo,
+            release_id: release.id,
+            ...metadata,
+          });
+        } catch (error) {
+          throw classifyProviderError(error, "github-release-metadata-transient");
+        }
+      }
       for (const artifact of expected) {
         if (byName.has(artifact.name)) continue;
         try {

package/packages/core/runtime/entry/actions.js

@@ -7,6 +7,7 @@ import {
   selectExecutionRuntime,
 } from "./selection.js";
 import { selectAttemptRecoveryRuntime } from "./attempt.js";
+import { historicalEntrySelection } from "./compatibility.js";
 
 export async function selectExecutionRuntimeAction(
   core,
@@ -41,8 +42,10 @@ export async function selectExecutionRuntimeAction(
   });
   const workflowSha = core.getInput("workflow-sha", { required: true });
   const workflowRef = core.getInput("workflow-ref", { required: true });
+  const historical = historicalEntrySelection(core.getInput("compatibility-inputs"), workflowRef);
   const lockPath =
     core.getInput("contract-lock") ||
+    historical.lockPath ||
     transport?.contract?.path ||
     (/@(?:refs\/tags\/)?v4-alpha$/u.test(workflowRef)
       ? ".buildchain/alpha-contract-lock.json"
@@ -55,7 +58,7 @@ export async function selectExecutionRuntimeAction(
     throw new Error(
       "Contract lock path must be relative to the consumer repository",
     );
-  const runtimeRef = core.getInput("runtime-ref");
+  const runtimeRef = core.getInput("runtime-ref") || historical.runtimeRef || "";
   let selection;
   if (retained) {
     if (runtimeRef || resumeRunId)