@kungfu-tech/buildchain 2.12.0 → 2.12.1-alpha.10

package/dist/site/public-surface-audit.json

@@ -3,11 +3,11 @@
   "contract": "kungfu-buildchain-public-surface-reverse-audit",
   "status": "passed",
   "summary": {
-    "cliCommandCount": 75,
-    "workflowCount": 39,
+    "cliCommandCount": 76,
+    "workflowCount": 42,
     "actionCount": 4,
-    "sitePageCount": 45,
-    "docCommandRefCount": 237,
+    "sitePageCount": 46,
+    "docCommandRefCount": 241,
     "failureCount": 0
   },
   "enumerated": {
@@ -257,6 +257,11 @@
         "source": "bin/buildchain.mjs",
         "usage": "buildchain kfd upstream roles [--json]"
       },
+      {
+        "id": "layout",
+        "source": "bin/buildchain.mjs",
+        "usage": "buildchain layout [--cwd <dir>] [--json]"
+      },
       {
         "id": "lifecycle",
         "source": "bin/buildchain.mjs",
@@ -411,6 +416,7 @@
           "buildchain-contract-lock-path",
           "buildchain-ref",
           "buildchain-repository",
+          "cargo-registry-index",
           "checkout-cache-fallback",
           "checkout-cache-fetch-attempts",
           "checkout-cache-github-timeout-seconds",
@@ -438,13 +444,19 @@
           "require-trusted-event",
           "require-verify",
           "runner-preset",
+          "rust-toolchain",
+          "rustup-dist-server",
+          "rustup-update-root",
           "sample-process-tree",
           "setup-node",
+          "setup-rust",
+          "shifu-cache-profile-digest",
+          "shifu-cache-profile-ref",
           "untrusted-policy",
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 50
+        "inputCount": 57
       },
       {
         "id": ".bump-minor-version",
@@ -709,6 +721,7 @@
           "buildchain-ref",
           "buildchain-repository",
           "buildchain-stable-contract-lock-path",
+          "cargo-registry-index",
           "checkout-cache-fallback",
           "checkout-cache-fetch-attempts",
           "checkout-cache-github-timeout-seconds",
@@ -736,13 +749,19 @@
           "require-trusted-event",
           "require-verify",
           "runner-preset",
+          "rust-toolchain",
+          "rustup-dist-server",
+          "rustup-update-root",
           "sample-process-tree",
           "setup-node",
+          "setup-rust",
+          "shifu-cache-profile-digest",
+          "shifu-cache-profile-ref",
           "untrusted-policy",
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 53
+        "inputCount": 60
       },
       {
         "id": "buildchain-alpha-self-dogfood",
@@ -809,6 +828,25 @@
         ],
         "inputCount": 3
       },
+      {
+        "id": "buildchain-stable-candidate-patrol",
+        "path": ".github/workflows/buildchain-stable-candidate-patrol.yml",
+        "inputs": [
+          "buildchain-ref",
+          "dry-run",
+          "release-now"
+        ],
+        "inputCount": 3
+      },
+      {
+        "id": "buildchain-stable-candidate-qualification",
+        "path": ".github/workflows/buildchain-stable-candidate-qualification.yml",
+        "inputs": [
+          "candidate-sha",
+          "dry-run"
+        ],
+        "inputCount": 2
+      },
       {
         "id": "candidate-lab",
         "path": ".github/workflows/candidate-lab.yml",
@@ -826,12 +864,13 @@
         "inputs": [
           "buildchain-ref",
           "buildchain-repository",
+          "mode",
           "node-version",
           "require-version-state",
           "upload-artifacts",
           "working-directory"
         ],
-        "inputCount": 6
+        "inputCount": 7
       },
       {
         "id": "dev-pr-auto-merge",
@@ -1077,6 +1116,28 @@
         "inputs": [],
         "inputCount": 0
       },
+      {
+        "id": "stable-candidate-patrol",
+        "path": ".github/workflows/stable-candidate-patrol.yml",
+        "inputs": [
+          "auto-approve",
+          "auto-merge",
+          "auto-promote",
+          "buildchain-ref",
+          "buildchain-repository",
+          "dry-run",
+          "hold",
+          "hold-reason",
+          "ledger-ref",
+          "minimum-soak-seconds",
+          "release-now",
+          "required-checks",
+          "revoke-reason",
+          "revoked-versions",
+          "target-branch"
+        ],
+        "inputCount": 15
+      },
       {
         "id": "verify",
         "path": ".github/workflows/verify.yml",
@@ -1396,6 +1457,10 @@
         "id": "manual:site-bundle-contract",
         "category": "manual"
       },
+      {
+        "id": "manual:stable-candidate-patrol",
+        "category": "manual"
+      },
       {
         "id": "manual:toolkit-observability",
         "category": "manual"
@@ -2174,6 +2239,26 @@
         "path": "README.md",
         "command": "buildchain kfd"
       },
+      {
+        "id": "layout",
+        "path": "docs/binary-distribution.md",
+        "command": "buildchain layout --json"
+      },
+      {
+        "id": "layout",
+        "path": "docs/cli.md",
+        "command": "buildchain layout --cwd"
+      },
+      {
+        "id": "layout",
+        "path": "docs/cli.md",
+        "command": "buildchain layout"
+      },
+      {
+        "id": "layout",
+        "path": "docs/kfd-support.md",
+        "command": "buildchain layout --cwd"
+      },
       {
         "id": "lifecycle",
         "path": "docs/cli.md",
@@ -2605,9 +2690,9 @@
     "cliRegistryPath": "dist/site/cli-registry.json",
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
-    "cliRegistryDigest": "3c0729f5351eb82fe26625fa5aabf30903f45f68af2431e02860f85ada468ac9",
-    "workflowRegistryDigest": "2bd177fe6e3cbcd382ba30d90c96f35865ef17fc29e451715696cb076d7da933",
-    "pageRegistryDigest": "b5dd01ba00663f68c579a0a2661707094cb4db99b0ee30dd608e224a517b490e"
+    "cliRegistryDigest": "ab57fec294efb9dde1612787bfd0d532b5bb95298b5da14a2b51a5e71b9c7dcc",
+    "workflowRegistryDigest": "e7e3db196607ac6dbf4058552a84692c86c4e5cbcee7080c6cde9d1b71873daf",
+    "pageRegistryDigest": "8e2240c074e8e7b08761eba80c2650e6e9b94c8a6192266bb1b5b07a8aa08d38"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-11T08:24:47.193Z",
-  "publishedAt": "2026-07-11T08:24:47.193Z",
+  "generatedAt": "2026-07-13T04:23:40.596Z",
+  "publishedAt": "2026-07-13T04:23:40.596Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "b20e9da54c801f6e5e3e7012488a4632ea108ded",
+  "sourceRevision": "6a389143f2635c16f68971b214f70ed1b600a329",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.0",
+    "version": "2.12.1-alpha.10",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -27,6 +27,7 @@
       "./publication-package": "./packages/core/publication-package.js",
       "./kfd-gate": "./packages/core/kfd-gate.js",
       "./release-candidate": "./packages/core/release-candidate.js",
+      "./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",
       "./release-passport": "./packages/core/release-passport.js",
       "./release-propagation": "./packages/core/release-propagation.js",
       "./surface-manifest": "./packages/core/surface-manifest.js",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-11T08:24:47.193Z",
-  "publishedAt": "2026-07-11T08:24:47.193Z",
+  "generatedAt": "2026-07-13T04:23:40.596Z",
+  "publishedAt": "2026-07-13T04:23:40.596Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "b20e9da54c801f6e5e3e7012488a4632ea108ded",
+  "sourceRevision": "6a389143f2635c16f68971b214f70ed1b600a329",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.0",
+    "version": "2.12.1-alpha.10",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:bad18d05d3d03b77bf64d8697fc351d58b1372a355a4f25c6719bf08984a79a2"
+      "digest": "sha256:0735009b21cea9227f2c9b9bcbec1219898f4d211776b60aa030ace65821ec80"
     },
     {
       "id": "install",
@@ -109,7 +109,7 @@
       "path": "docs/binary-distribution.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:36899140a9b2e9ce1565ed41f3d64f73a8829fad3d59a04b9498d9479c85c4be"
+      "digest": "sha256:08be4e97e1940a45a2c0aa2506012255888c23c1cbf8f5362b27c2b21089eb58"
     },
     {
       "id": "consumer-issue-reporting",
@@ -173,7 +173,7 @@
       "path": "docs/cli.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:133a7921163fecda050d772827bd498f35f11b1a3514e303dbfe89bb7a220f5d"
+      "digest": "sha256:3b3ac97c353f7549229f1102cca38236e734ec8d08c219d4a6e5ef2a48fc0e16"
     },
     {
       "id": "build-facts",
@@ -189,7 +189,7 @@
       "path": "docs/kfd-support.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:456eef9dbb71df3842613083054942436e763c6aa5ca3ff8a51c5a4e8cc186e7"
+      "digest": "sha256:ab15de33a1a9e292b6da74c00b8b96b7c46330d0553a454d1de4c24c672fc025"
     },
     {
       "id": "lifecycle-protocol",
@@ -197,7 +197,7 @@
       "path": "docs/lifecycle-protocol.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:60c39693878258d275e9d47983b306faed35d6416297c14570429de73284604c"
+      "digest": "sha256:bef6f703a76667c731dccea6a0385b2196b5a23438ce4bc39894561530975f21"
     },
     {
       "id": "reusable-build-surface",
@@ -205,7 +205,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:dfa37928517a391c2ab214a095954dcb50e84f514cea0a8424619903843d9b8d"
+      "digest": "sha256:fbc74dee3a6f2283ea69a2a9a31945ac82ccaf1d270995539f5d80235ab74614"
     },
     {
       "id": "publish-transaction",
@@ -221,7 +221,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:11f0e3ff3162c7b3f886a38ab0e4b591886e2046937a9d006eda74b72a8cc9ab"
+      "digest": "sha256:3ae2bbc2df394726f350e58be1a71dd0379b99b19cd6ccf15fbe3b843f3890b6"
     },
     {
       "id": "release-flow",

package/dist/site/workflow-registry.json

@@ -25,6 +25,7 @@
         "buildchain-contract-lock-path",
         "buildchain-ref",
         "buildchain-repository",
+        "cargo-registry-index",
         "checkout-cache-fallback",
         "checkout-cache-fetch-attempts",
         "checkout-cache-github-timeout-seconds",
@@ -52,13 +53,19 @@
         "require-trusted-event",
         "require-verify",
         "runner-preset",
+        "rust-toolchain",
+        "rustup-dist-server",
+        "rustup-update-root",
         "sample-process-tree",
         "setup-node",
+        "setup-rust",
+        "shifu-cache-profile-digest",
+        "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 50,
+      "inputCount": 57,
       "surface": "reusable-build",
       "capabilityGroup": "api-cli-reference",
       "status": "active"
@@ -368,6 +375,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "buildchain-stable-contract-lock-path",
+        "cargo-registry-index",
         "checkout-cache-fallback",
         "checkout-cache-fetch-attempts",
         "checkout-cache-github-timeout-seconds",
@@ -395,13 +403,19 @@
         "require-trusted-event",
         "require-verify",
         "runner-preset",
+        "rust-toolchain",
+        "rustup-dist-server",
+        "rustup-update-root",
         "sample-process-tree",
         "setup-node",
+        "setup-rust",
+        "shifu-cache-profile-digest",
+        "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 53,
+      "inputCount": 60,
       "surface": "channel-build-router",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -489,6 +503,31 @@
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },
+    {
+      "id": "buildchain-stable-candidate-patrol",
+      "path": ".github/workflows/buildchain-stable-candidate-patrol.yml",
+      "inputs": [
+        "buildchain-ref",
+        "dry-run",
+        "release-now"
+      ],
+      "inputCount": 3,
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "active"
+    },
+    {
+      "id": "buildchain-stable-candidate-qualification",
+      "path": ".github/workflows/buildchain-stable-candidate-qualification.yml",
+      "inputs": [
+        "candidate-sha",
+        "dry-run"
+      ],
+      "inputCount": 2,
+      "surface": "repository-patrol",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal"
+    },
     {
       "id": "candidate-lab",
       "path": ".github/workflows/candidate-lab.yml",
@@ -509,12 +548,13 @@
       "inputs": [
         "buildchain-ref",
         "buildchain-repository",
+        "mode",
         "node-version",
         "require-version-state",
         "upload-artifacts",
         "working-directory"
       ],
-      "inputCount": 6,
+      "inputCount": 7,
       "surface": "repository-workflow",
       "capabilityGroup": "api-cli-reference",
       "status": "active"
@@ -805,6 +845,31 @@
       "capabilityGroup": "api-cli-reference",
       "status": "compatibility-fixture"
     },
+    {
+      "id": "stable-candidate-patrol",
+      "path": ".github/workflows/stable-candidate-patrol.yml",
+      "inputs": [
+        "auto-approve",
+        "auto-merge",
+        "auto-promote",
+        "buildchain-ref",
+        "buildchain-repository",
+        "dry-run",
+        "hold",
+        "hold-reason",
+        "ledger-ref",
+        "minimum-soak-seconds",
+        "release-now",
+        "required-checks",
+        "revoke-reason",
+        "revoked-versions",
+        "target-branch"
+      ],
+      "inputCount": 15,
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "active"
+    },
     {
       "id": "verify",
       "path": ".github/workflows/verify.yml",

package/docs/MAP.md

@@ -99,6 +99,7 @@ replace them.
 | How do self-hosted runners relay large artifacts through S3 before GitHub artifacts? | [`reusable-build-surface.md`](reusable-build-surface.md#artifact-transfer-relay) | use | stable |
 | How do self-hosted runners reuse local Git checkout caches without weakening source locks? | [`reusable-build-surface.md`](reusable-build-surface.md#locked-source-checkout-cache) | use | stable |
 | How do I validate an unreleased Buildchain runtime train while keeping `@v2`? | [`runtime-train-validation.md`](runtime-train-validation.md) | use | stable |
+| How do I automatically qualify alpha candidates and publish the newest non-revoked qualified candidate at a fixed window? | [`stable-candidate-patrol.md`](stable-candidate-patrol.md) | use | preview |
 | How do I deploy a site/app preview, staging, or production surface? | [`web-surface-deployments.md`](web-surface-deployments.md) | use | stable |
 | How do I publish observed infrastructure contracts for downstream consumers? | [`infra-contract.md`](infra-contract.md) | use | preview |
 | How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md), [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md) | use | stable |
@@ -117,6 +118,8 @@ replace them.
   [`release-flow.md`](release-flow.md).
 - **Buildchain self-dogfood / released alpha canary / stable compatibility lane** ->
   [`release-governance.md`](release-governance.md#buildchain-alpha-self-dogfood).
+- **qualified alpha ledger / scheduled stable selection / hold and revoke** ->
+  [`stable-candidate-patrol.md`](stable-candidate-patrol.md).
 - **v2.1 vs v2.2 / when to open a new minor line** ->
   [`versioning.md`](versioning.md).
 - **dry-run / what would happen if this channel PR merges** -> [`cli.md`](cli.md)

package/docs/binary-distribution.md

@@ -38,6 +38,25 @@ Each archive is accompanied by:
 - `buildchain-release-bundle.tar.gz`;
 - `buildchain-release-bundle.json`.
 
+## KFD-3 Distribution Declaration
+
+Buildchain self-describes this release lane in `dist/site/kfd-claims.json` as
+the KFD-3 surface `distribution:buildchain-standalone`. Its declaration assigns
+registration to Shifu, names `binary:build` as the reproducible task, and lists
+the artifact kind, platform, and path glob for all three archives. Shifu should
+discover the registry through `buildchain layout --json`, not by copying the
+registry path.
+
+The repository-owned task is:
+
+```bash
+pnpm binary:build
+```
+
+The release workflow still builds each target on its declared runner. The local
+task is the stable task identity used by the KFD declaration and local smoke
+checks; it does not replace the three-platform release matrix.
+
 ## Runner Policy
 
 Production binary builds use GitHub-hosted runners:
@@ -69,7 +88,7 @@ offline review, mirroring, or site ingestion.
 ## Local Smoke
 
 ```bash
-node scripts/build-standalone-binary.mjs --version v0.0.0-local --output-dir dist/binary
+pnpm binary:build -- --version v0.0.0-local
 node bin/buildchain.mjs collect github-release \
   --tag v0.0.0-local \
   --assets-dir dist/binary \

package/docs/cli.md

@@ -77,6 +77,7 @@ import { verifyReleasePassport } from "@kungfu-tech/buildchain/release-passport"
 import { createReleasePropagationPlan } from "@kungfu-tech/buildchain/release-propagation";
 import { planReleaseLineBootstrap } from "@kungfu-tech/buildchain/release-line-bootstrap";
 import { collectPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain/public-surface-audit";
+import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain/buildchain-layout";
 import contractWorld from "@kungfu-tech/buildchain/site/buildchain-contract.json" with { type: "json" };
 import capabilityRegistry from "@kungfu-tech/buildchain/site/capability-registry.json" with { type: "json" };
 import manualRegistry from "@kungfu-tech/buildchain/site/manual-registry.json" with { type: "json" };
@@ -90,6 +91,22 @@ floating-ref contract world for a runtime such as `@v2`.
 
 ## Commands
 
+`buildchain layout` is the stable machine question for repository layout. Tools
+such as Shifu should call it instead of copying `.buildchain/` path constants:
+
+```bash
+buildchain layout --cwd /path/to/repository --json
+```
+
+The result identifies the Buildchain version pin, repository root and config,
+the canonical and currently resolved KFD-3 registry paths, and the KFD field
+used to declare Shifu jurisdiction. A repository is in Shifu's distribution
+jurisdiction only when a KFD-3 surface explicitly declares
+`distribution.registrar="shifu"`; the presence of Buildchain configuration is
+not sufficient. The same contract is available through
+`createBuildchainLayoutDiscovery()` from
+`@kungfu-tech/buildchain/buildchain-layout`.
+
 `buildchain init` writes a starter `.buildchain/buildchain.toml` and a reusable workflow
 caller at `.github/workflows/build.yml`.
 

package/docs/kfd-support.md

@@ -279,6 +279,49 @@ detect standard public surfaces, write a small product-owned registry, audit the
 registry against the current artifact/source tree, generate a release-passport
 compatible witness, and query the resulting capability map.
 
+## Shifu Discovery and Distribution Declarations
+
+Buildchain owns the repository-layout question; product tools must not copy its
+internal paths. Shifu and other consumers use this sequence:
+
+1. read the welded `.buildchain-version` pin to select Buildchain;
+2. run `buildchain layout --cwd <repository> --json`;
+3. read the returned `kfd.registries["kfd-3"].path`;
+4. treat a surface as Shifu-managed only when its declaration contains
+   `distribution.registrar="shifu"`.
+
+The layout response uses the
+`kungfu-buildchain-layout-discovery` contract with an explicit schema version.
+Changing or removing its fields is a public contract change. Consumers must not
+fall back to a hard-coded registry location when the command is unavailable or
+returns an unsupported contract.
+
+A Shifu distribution declaration must contain at least one task and one
+artifact. Every artifact declares `kind`, `platform`, and `pathGlob`; an
+optional `sha256` is a lowercase 64-character hexadecimal digest. This makes
+artifact form and platform machine-readable without asking Shifu to infer them
+from filenames:
+
+```json
+{
+  "distribution": {
+    "registrar": "shifu",
+    "tasks": ["binary:build"],
+    "artifacts": [
+      {
+        "kind": "binary",
+        "platform": "linux",
+        "pathGlob": "dist/binary/example-x86_64-unknown-linux-gnu.tar.gz"
+      }
+    ]
+  }
+}
+```
+
+Buildchain validates this shape whenever a KFD-3 registry is read or written.
+Repositories that do not declare the registrar remain outside Shifu's
+distribution jurisdiction.
+
 ## Detected, Declared, Enforced
 
 KFD-3 surface registration uses three states.
@@ -402,7 +445,7 @@ Buildchain dogfoods this model in two ways:
   `buildchain kfd 2 trust-assessment --json` expose and validate the KFD
   package's foundation KFD-2 trust facts against the latest KFD taxonomy;
 - `dist/site/kfd-claims.json` declares Buildchain's own KFD-3 collaboration
-  interface;
+  interface, including a Shifu-owned standalone binary distribution surface;
 - `buildchain kfd 3 query buildchain --json` resolves the packaged
   Buildchain capability map from that site fact source.
 

package/docs/lifecycle-protocol.md

@@ -158,6 +158,9 @@ commands = [
   "pnpm run package",
 ]
 
+[lifecycle.check]
+command = "pnpm run check:source"
+
 [lifecycle.verify]
 shell = "bash"
 script = """
@@ -167,6 +170,15 @@ git diff --check
 """
 ```
 
+`lifecycle.check` is the repository-owned source-acceptance gate. It should
+validate the checked-out source revision without entering the build, artifact,
+or release lifecycle. Consumers can run it on GitHub-hosted Linux through
+`.github/workflows/check.yml@v2` with `mode: source`; the reusable workflow runs
+only `lifecycle.install` and `lifecycle.check`. The default `mode: verify`
+continues to run `lifecycle.install` and `lifecycle.verify` for existing callers.
+The reusable job name remains `check`, and `upload-artifacts: false` disables
+evidence upload without changing the job conclusion used by branch protection.
+
 Shared environment variables can be declared once:
 
 ```toml