@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.0

package/dist/site/public-surface-audit.json

@@ -567,6 +567,7 @@
         "path": ".github/workflows/.build.yml",
         "reusable": true,
         "inputs": [
+          "artifact-compression-level",
           "artifact-name",
           "artifact-name-template",
           "artifact-paths",
@@ -578,6 +579,7 @@
           "artifact-relay-s3-role-arn",
           "artifact-relay-s3-upload-role-arn",
           "artifact-retention-days",
+          "artifact-signing-request-upload-no-proxy",
           "artifact-transfer-mode",
           "build-command",
           "buildchain-contract-compatibility-policy",
@@ -640,7 +642,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 72,
+        "inputCount": 74,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1364,6 +1366,7 @@
         "path": ".github/workflows/build.yml",
         "reusable": true,
         "inputs": [
+          "artifact-compression-level",
           "artifact-name",
           "artifact-name-template",
           "artifact-paths",
@@ -1375,6 +1378,7 @@
           "artifact-relay-s3-role-arn",
           "artifact-relay-s3-upload-role-arn",
           "artifact-retention-days",
+          "artifact-signing-request-upload-no-proxy",
           "artifact-transfer-mode",
           "build-command",
           "buildchain-alpha-contract-lock-path",
@@ -1440,7 +1444,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 75,
+        "inputCount": 77,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1666,11 +1670,12 @@
           "dry-run",
           "max-age-seconds",
           "pull-request-body-prefix",
+          "pull-request-body-prefix-renderer",
           "settlement-authorized",
           "source-branch",
           "target-branch"
         ],
-        "inputCount": 11,
+        "inputCount": 12,
         "secrets": [
           "promotion-token"
         ],
@@ -4260,8 +4265,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "0be723caa314a36a1a36b03522527eb5b13e9b741e6566ff7f6ee06958df02ca",
-    "workflowRegistryDigest": "01792ad09bcdcd3c12d018e6ee9613a09b5a1b87525d6f643a18f963f0d973a1",
-    "pageRegistryDigest": "56583b14046754bc0c02c512602c4e1c4e9ecdf68e6e639fcab8d550c3e082b4"
+    "workflowRegistryDigest": "b89bf8a2a89711fd2033b022bc70dcf92bc1b84ce7697b2c736f098d41fefe92",
+    "pageRegistryDigest": "0f3f8b75b0443b08ed07f8545495b789ac76337dc2639c5112e572e728b0f1dc"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-30T07:24:06.316Z",
-  "publishedAt": "2026-07-30T07:24:06.316Z",
+  "generatedAt": "2026-07-30T09:49:04.119Z",
+  "publishedAt": "2026-07-30T09:49:04.119Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "1aeb9191f607a7223f8ab63c96427b605ecda9be",
+  "sourceRevision": "5770bd104905c6a7ac9fe6b0513ca9e24e5814b4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.2",
+    "version": "3.0.3-alpha.0",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-30T07:24:06.316Z",
-  "publishedAt": "2026-07-30T07:24:06.316Z",
+  "generatedAt": "2026-07-30T09:49:04.119Z",
+  "publishedAt": "2026-07-30T09:49:04.119Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "1aeb9191f607a7223f8ab63c96427b605ecda9be",
+  "sourceRevision": "5770bd104905c6a7ac9fe6b0513ca9e24e5814b4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.2",
+    "version": "3.0.3-alpha.0",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -61,7 +61,7 @@
       "path": "docs/auditable-demo.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:0e8cf2162c2e1f83cfe3a6171e3055f494cab5f03fdcbec3854e1793678e6908"
+      "digest": "sha256:6af21e489bc3d2e9e2d01838926f1fbab6d74d92446d1f9cfc5eb08e090dd3a5"
     },
     {
       "id": "install",
@@ -109,7 +109,7 @@
       "path": "docs/github-governance-authority.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:b8c3d9ad53c2509bbd95804ccc31f6aa89989c3aadf3a2b75d9c73aef168b7e8"
+      "digest": "sha256:304d0246d21bdd0f6a77183ac6839a5d1234d08d98bd5da9728c85a65b1ff7b7"
     },
     {
       "id": "release-candidate",
@@ -157,7 +157,7 @@
       "path": "docs/consumer-issue-reporting.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:96804310360c02f408fee9d540385d875a40d09bef046c3df369228d311a1cdd"
+      "digest": "sha256:20c33ab68e91227837626d1289d6c5540a318c8ff484d9a1f0ebe7dbe8626d02"
     },
     {
       "id": "infra-contract",
@@ -253,7 +253,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ea36ec722f811f5156735aa7471ed080cdc7e87d71c20c300243b226e233e675"
+      "digest": "sha256:4409c8259c3613b51a1db809493e73d9b85a0d16d292a491046fd36770d98fb0"
     },
     {
       "id": "publish-transaction",
@@ -269,7 +269,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:42a45f51db7ea11658431718835e1a430959db2a5cc80fc4651681502fe6fb7c"
+      "digest": "sha256:8c31e6daccd40ea4e7cb08e8fa3eb2f238006e331621aed45eddcb80aee5532f"
     },
     {
       "id": "release-flow",
@@ -293,7 +293,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:4b40cb8675c111b7588297102a61cb241630f2b707a67a0384a6df7527b2c64c"
+      "digest": "sha256:52f58a1a69ea924cb1fae11bb6a8def2b0c66cc4ab08416553cf680c213b5ded"
     },
     {
       "id": "web-surface-deployments",
@@ -301,7 +301,7 @@
       "path": "docs/web-surface-deployments.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ed4ff02dcb6f66118a29084784f25d8008ca472f59005b2e014133524706a9c5"
+      "digest": "sha256:6b907af93c55ffd8274cd83ad87a45dd48eb9a01938cf419aafebb5557be5821"
     }
   ],
   "facts": [

package/dist/site/workflow-registry.json

@@ -77,6 +77,7 @@
       "path": ".github/workflows/.build.yml",
       "reusable": true,
       "inputs": [
+        "artifact-compression-level",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -88,6 +89,7 @@
         "artifact-relay-s3-role-arn",
         "artifact-relay-s3-upload-role-arn",
         "artifact-retention-days",
+        "artifact-signing-request-upload-no-proxy",
         "artifact-transfer-mode",
         "build-command",
         "buildchain-contract-compatibility-policy",
@@ -150,7 +152,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 72,
+      "inputCount": 74,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -937,6 +939,7 @@
       "path": ".github/workflows/build.yml",
       "reusable": true,
       "inputs": [
+        "artifact-compression-level",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -948,6 +951,7 @@
         "artifact-relay-s3-role-arn",
         "artifact-relay-s3-upload-role-arn",
         "artifact-retention-days",
+        "artifact-signing-request-upload-no-proxy",
         "artifact-transfer-mode",
         "build-command",
         "buildchain-alpha-contract-lock-path",
@@ -1013,7 +1017,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 75,
+      "inputCount": 77,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1272,11 +1276,12 @@
         "dry-run",
         "max-age-seconds",
         "pull-request-body-prefix",
+        "pull-request-body-prefix-renderer",
         "settlement-authorized",
         "source-branch",
         "target-branch"
       ],
-      "inputCount": 11,
+      "inputCount": 12,
       "secrets": [
         "promotion-token"
       ],

package/docs/auditable-demo.md

@@ -41,6 +41,18 @@ public-projection.json
 scene.json
 ```
 
+It may additionally emit one declared `terminal-capture.json` using
+`kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds,
+fixed 80-200 by 24-80 terminal cells, 10,000 events, and 4 MiB of canonical
+base64 bytes. It must contain a passed completion sentinel and an explicitly
+empty authority-grant list. Existing three-file adapters remain valid.
+
+Terminal bytes are volatile observations, not Work, Warrant, capability, or
+publication authority. First-party or System identity, KFD compliance, Product
+System metadata, package metadata, scan output, registry history, and
+standalone generation remain non-authoritative unless an exact higher-level
+contract independently admits them.
+
 The adapter must not rebuild or rerun the product. It receives:
 
 ```text
@@ -78,7 +90,8 @@ The Gate:
 - resolves and downloads one exact same-run GitHub Artifact;
 - invokes the checked-in adapter by argv, never as an evaluated shell string;
 - rejects undeclared adapter outputs, symlinks, invalid UTF-8, invalid scene or
-  projection schemas, out-of-range transcript references, and oversized input;
+  projection or terminal-capture schemas, implicit capture grants,
+  out-of-range transcript references, and oversized input;
 - derives a one-second compatibility scene from the consumer projection;
 - anonymously pulls an immutable `image@sha256:digest` renderer;
 - runs it as non-root with `--network none`, a read-only root filesystem, and a
@@ -105,6 +118,11 @@ distribution checksums. A web-delivery profile also retains
 `media-inspection.json`, whose content root is bound into the receipt.
 `render-media: false` does not weaken or skip the Gate.
 
+When the Gate bundle contains a qualified terminal capture, the render job
+passes it read-only to the immutable renderer. The renderer manifest binds the
+capture root and terminal-state-machine version, but raw capture bytes remain
+in the Gate bundle rather than being copied into the public media bundle.
+
 ## Media Qualification Profiles
 
 The single machine-readable source is

package/docs/consumer-issue-reporting.md

@@ -34,7 +34,7 @@ The recommended pattern is:
     summary: "Buildchain reusable build failed before artifact finalization"
     failure-code: reusable-build-failed
     diagnostics-path: .buildchain/artifacts/diagnostics.json
-    buildchain-ref: ${{ inputs.buildchain-ref || 'v2' }}
+    buildchain-ref: ${{ inputs.buildchain-ref || 'v3' }}
 ```
 
 ## Behavior

package/docs/dev-alpha-candidate-patrol.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-07-27
+last_reviewed: 2026-07-29
 ai_provenance:
   model_family: GPT-5
   product: Codex
-  generated_at: 2026-07-27
-  visible_context: Existing Buildchain stable-candidate source locks, Kungfu exact-source Alpha preflight, Dev Patrol, and repository release governance.
+  generated_at: 2026-07-29
+  visible_context: Existing Buildchain source locks, Kungfu exact-source Alpha preflight, Dev Patrol, repository release governance, and the consumer-owned settlement renderer threat model.
   invisible_context_boundary: No credentials, private logs, or private configuration were used.
 ---
 
@@ -77,13 +77,27 @@ exact same-SHA evidence, it may set `settlement-authorized: true` and
 alias for settlement authorization.
 
 Repositories whose promotion policy requires a machine-readable PR declaration
-can pass it through `pull-request-body-prefix`. Buildchain prepends that trusted,
-repository-owned text only when it creates the candidate PR and preserves it
-when later controller observations update the managed state marker. Keep the
-declaration source-controlled in the caller workflow and update it whenever the
-qualified development delta changes its release or architecture settlement.
-Buildchain rejects a prefix that attempts to inject its managed controller
-marker.
+can pass static text through `pull-request-body-prefix`. When the declaration
+depends on the exact qualified delta, use `pull-request-body-prefix-renderer`
+instead. It names a repository-relative Node.js file in the consumer checkout.
+The read-only `observe` job checks out the selected SHA with credentials disabled,
+runs the renderer with a reduced environment, and requires it to write UTF-8 text
+to `BUILDCHAIN_CHANNEL_PATROL_PR_BODY_PREFIX_OUTPUT`. The renderer also receives
+the selected SHA plus source and target branch names. It may derive a declaration
+from the exact checkout and `origin/<target-branch>` without receiving the
+promotion token.
+
+Static and rendered prefixes are mutually exclusive. A renderer failure, path
+escape, source-SHA mismatch, empty or oversized result, invalid UTF-8, or managed
+controller-marker injection fails before the write-permission job can run. The
+rendered bytes are retained with the read-only observation artifact and passed
+to `settle` as a job output, so the candidate PR is created with the correct
+declaration on its first write. Buildchain preserves that repository-owned text
+when later observations update only the managed state marker. Before any write,
+`settle` also requires its fresh observation to select the same SHA that produced
+the rendered bytes. Concurrent qualification progress therefore fails closed
+and is recomputed by the next patrol instead of attaching a declaration to the
+wrong candidate.
 
 The separately permissioned `settle` job re-runs the exact observation before
 any write. With no active managed candidate, it creates one branch named from

package/docs/github-governance-authority.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-07-24
+last_reviewed: 2026-07-30
 ai_provenance:
   model_family: GPT-5
   product: Codex
-  generated_at: 2026-07-24
+  generated_at: 2026-07-30
   limits: Live GitHub state and account recovery remain provider-controlled and must be re-audited.
 ---
 
@@ -75,16 +75,19 @@ protection. Inspecting only one layer is insufficient because an applicable
 bypass or weaker update path in another layer can invalidate the effective
 policy.
 
+When an admitted default development branch uses GitHub merge queue, its
+candidate-source, queue-lease, and final build checks are one exact authority
+set. The queue lease may remain intentionally unbound while workflow-produced
+checks retain their GitHub Actions App binding; strictness must match the live
+queue ruleset.
+
 ## Repository and plan admission
 
-The 2026-07-24 baseline contains 16 managed repositories: 13 public and three
-private. Public repository names are versioned in the descriptor. Private
-repository names are never emitted in public evidence; their identities are
-represented by stable roots derived from the GitHub provider repository ID,
-independent of the governance policy root. This prevents a policy revision from
-changing repository identity or creating a circular admission dependency. A
-newly discovered repository or target ref is non-authoritative until explicitly
-admitted.
+The 2026-07-30 baseline contains 16 managed public repositories. The descriptor
+sets `managedVisibilities` to `public`; private repositories are outside the
+managed-zone inventory and do not produce governance receipts. Public
+repository names are versioned in the descriptor. A newly discovered public
+repository or target ref is non-authoritative until explicitly admitted.
 
 The descriptor also versions every active public merge target. The full audit
 evaluates one receipt per authoritative target rather than assuming the default
@@ -94,19 +97,11 @@ which case it is non-qualifying. Retained historical channels and generated
 per-release publish-gate refs are not silently deleted or promoted to current
 authority; they require an explicit registry revision before they can qualify.
 
-For an admitted private repository, the active target set is the current
-default branch plus existing alpha/release siblings on the same version line.
-Its required-check bindings remain non-qualifying until their sanitized binding
-roots are sealed into the private identity entry after supported native
-protection exists.
-
 Public repositories can qualify on supported Free, Team, or Enterprise
-enforcement. Private repositories and organization-wide rules require Team or
-Enterprise capability. On an unsupported plan they remain explicitly
-`non-authoritative-plan-capability-required` and publication-ineligible. The
-verifier does not replace missing native enforcement with CI or documentation,
-and the implementation never makes a private repository public as a
-workaround.
+enforcement. Organization-wide rules require Team or Enterprise capability.
+The verifier does not reinterpret an excluded private repository as qualifying,
+replace missing native enforcement with CI or documentation, or make a private
+repository public as a workaround.
 
 ## Read-only audit
 
@@ -148,12 +143,10 @@ allow the exact publication transaction audit to resolve required check runs
 and merged pull-request review lineage. Omitting either read permission makes
 the transaction evidence incomplete and therefore non-qualifying.
 
-The output is sanitized. Public repositories retain their public identity.
-Private repositories expose only an identity root, visibility class, target
-ref, sanitized required-check bindings and fact roots, and a qualifying or
-non-qualifying decision. Tokens, cookies, recovery material, private
-CODEOWNERS bytes, raw permission payloads, and credential-bearing URLs are
-never included.
+The output is sanitized. Managed public repositories retain their public
+identity. Excluded private repositories produce no receipt or diagnostic.
+Tokens, cookies, recovery material, private CODEOWNERS bytes, raw permission
+payloads, and credential-bearing URLs are never included.
 
 ## Mutation and rollback boundary
 
@@ -206,8 +199,8 @@ buildchain github-governance rollback \
 
 For an admitted exact target, classic branch protection can also be compiled
 directly from the authority descriptor. This mode preserves both App-bound
-checks and intentionally unbound check contexts such as Kungfu alpha's
-`build`, rather than guessing a provider App identity.
+checks and intentionally unbound check contexts such as Kungfu release's
+legacy `build`, rather than guessing a provider App identity.
 
 ```bash
 buildchain github-governance protection-policy-plan \

package/docs/observed-evidence-patrol.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-07-21
+last_reviewed: 2026-07-30
 ai_provenance:
   model_family: GPT-5
   product: Codex
-  generated_at: 2026-07-21
+  generated_at: 2026-07-30
   invisible_context_boundary: No credentials, private logs, or unpublished evidence values are included.
 ---
 
@@ -30,15 +30,28 @@ binds one `snapshot.id` to two byte-identical JSON files:
   `dogfood-evidence/snapshots/<snapshotId>.json`;
 - a mutable last-known-good alias such as `dogfood-evidence.json`.
 
+The bundle may also declare up to 16 derived mutable projections under
+`publication.projections`. Each projection declares its artifact-relative
+`source`, bounded destination `key`, exact `sha256`, `contentType`, and
+`cacheControl`. This supports static HTML such as `dogfood/index.html` without
+changing the existing immutable/latest JSON contract.
+
 Buildchain verifies both file digests and snapshot identities before receiving
 production authority. Apply then performs this order:
 
 1. conditionally create the immutable key with `If-None-Match: *`;
 2. read the immutable key back and verify its declared SHA-256 metadata;
-3. record the previous latest metadata as the rollback pointer;
-4. atomically replace the latest object;
-5. read latest back and verify the same snapshot and digest;
-6. invalidate only the declared viewer paths.
+3. record preceding version metadata for every declared mutable key;
+4. write and read back each derived projection in manifest order;
+5. atomically replace the latest object;
+6. read latest back and verify the same snapshot and digest;
+7. invalidate only the declared viewer paths.
+
+Projection-enabled publication requires bucket versioning before replacing an
+existing mutable key. If a later projection, latest update, or invalidation
+fails, Buildchain restores preceding object versions in reverse order and
+removes newly introduced declared projection keys. Rollback never lists the
+bucket and never touches keys outside the manifest.
 
 Any generator, schema, digest, immutable-key, provider, or read-after-write
 failure leaves the previous latest object in place. A colliding immutable key
@@ -58,6 +71,8 @@ review gate for steady-state refreshes. Its policy should allow only:
 
 - `s3:GetObject` and `s3:PutObject` on the exact latest key;
 - the same actions on the exact immutable snapshot prefix;
+- for projection-enabled bundles, `s3:GetObjectVersion` and bounded
+  `s3:DeleteObject` on the exact declared mutable keys;
 - `cloudfront:CreateInvalidation` on the one distribution.
 
 It must not receive bucket-wide delete, list, repository write, GitHub PR, or
@@ -76,9 +91,10 @@ fallback.
 
 ## Rollback and recovery
 
-Every receipt records the previous latest snapshot id, digest, ETag, and S3
-version id when available. Rollback regenerates a bundle whose latest file is
-the selected immutable snapshot and republishes it through the same validator;
-operators do not edit or delete immutable history. If CDN invalidation fails
-after latest advances, rerunning the same bundle is idempotent and repairs edge
-convergence.
+Every receipt records the previous latest and projection snapshot ids, digests,
+ETags, and S3 version ids when available. A projection transaction rolls back
+automatically when a later mutable step or CDN invalidation fails. Operators
+can also regenerate a bundle whose latest file is the selected immutable
+snapshot and republish it through the same validator; immutable history is
+never overwritten or deleted. Legacy bundles without projections retain their
+existing idempotent rerun behavior when CDN invalidation alone fails.

package/docs/release-governance.md

@@ -260,6 +260,13 @@ Developer ID, Windows Authenticode, and detached cryptographic signatures share
 the request/receipt model, while each profile retains its honest platform
 semantics and fail-closed verification requirements.
 
+The authority verifies the complete result set on GitHub-hosted infrastructure
+before delivery. The consumer controller also performs final result verification,
+exact-byte import, manifest recomputation, and deterministic-artifact replacement
+on a GitHub-hosted lane. Self-hosted build runners do not download authority
+result payloads, and aggregate/release evidence fails closed until this
+finalization succeeds.
+
 The central `buildchain-artifact-signing` environment reuses the established
 macOS Credential Island names (`BUILDCHAIN_MACOS_CERTIFICATE_*`,
 `BUILDCHAIN_MACOS_NOTARY_API_*`, and
@@ -681,7 +688,7 @@ jobs:
       dry-run: true
 ```
 
-All three wrappers default to the `v2` floating Buildchain runtime. When
+All three wrappers default to the `v3` floating Buildchain runtime. When
 `target-branch` is omitted, the caller's current/default branch selects the
 active semver dev line, so consumers do not pin patrol to a stale minor branch.
 The separate workflow names keep consumer schedules readable and stable while