@kungfu-tech/buildchain 3.0.3 → 3.0.4-alpha.0

package/packages/core/paper.js

@@ -31,8 +31,33 @@ import {
   sha256Text,
   stableJson,
 } from "./paper-repository.js";
+import {
+  PAPER_AGENT_ENTRY_CONTRACT,
+  collectPaperAgentEntry,
+  paperAgentEntryFiles,
+} from "./paper-agent-entry.js";
+import {
+  managedPaperPackageJson,
+  scaffoldMainTex,
+  scaffoldMakefile,
+  scaffoldMap,
+  scaffoldPackageJson,
+  scaffoldReadme,
+} from "./paper-scaffold-content.js";
 
 export { PAPER_PATHS, resolvePaperRepository } from "./paper-repository.js";
+export {
+  PAPER_AGENT_ENTRY_CONTRACT,
+  PAPER_AGENT_ENTRY_SCHEMA_VERSION,
+  PAPER_AGENT_ENTRY_SECTION_END,
+  PAPER_AGENT_ENTRY_SECTION_START,
+  collectPaperAgentEntry,
+  createPaperAgentEntry,
+  mergePaperAgentEntryInstructions,
+  paperAgentEntryFiles,
+  paperAgentEntryInstructions,
+  resolvePaperBuildchainSha,
+} from "./paper-agent-entry.js";
 export {
   PAPER_WORK_START_PLAN_CONTRACT,
   PAPER_WORK_SUBMIT_PLAN_CONTRACT,
@@ -79,9 +104,12 @@ export const PAPER_STATE_ORDER = Object.freeze([
 
 const PAPER_SCAFFOLD_PATHS = Object.freeze([
   PAPER_PATHS.config,
+  PAPER_PATHS.agentEntry,
+  PAPER_PATHS.agentInstructions,
   PAPER_PATHS.contractLock,
   PAPER_PATHS.versionPin,
   PAPER_PATHS.buildWorkflow,
+  PAPER_PATHS.verifyWorkflow,
   PAPER_PATHS.releaseWorkflow,
   PAPER_PATHS.provisioningAuthority,
   "Makefile",
@@ -227,18 +255,6 @@ function tomlString(value) {
   return JSON.stringify(String(value || ""));
 }
 
-function texEscape(value) {
-  return String(value || "")
-    .replaceAll("\\", "\\textbackslash{}")
-    .replaceAll("&", "\\&")
-    .replaceAll("%", "\\%")
-    .replaceAll("$", "\\$")
-    .replaceAll("#", "\\#")
-    .replaceAll("_", "\\_")
-    .replaceAll("{", "\\{")
-    .replaceAll("}", "\\}");
-}
-
 function joinUrl(base, suffix = "") {
   const normalizedBase = String(base || "")
     .trim()
@@ -334,6 +350,31 @@ jobs:
 `;
 }
 
+function scaffoldVerifyWorkflow(buildchainSha) {
+  return `name: Verify
+
+on:
+  pull_request:
+  push:
+    branches:
+      - "dev/v*/v*"
+      - "alpha/v*/v*"
+      - "release/v*/v*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: kungfu-systems/buildchain/.github/workflows/check.yml@${buildchainSha}
+    with:
+      buildchain-ref: ${buildchainSha}
+      require-version-state: true
+      upload-artifacts: true
+`;
+}
+
 function scaffoldReleaseWorkflow(
   buildchainSha,
   { artifactPaths = "_build/main.pdf", releasePassportProductName = "" } = {},
@@ -413,7 +454,10 @@ export function createPaperProvisioningAuthority({
   buildchainSha,
   contractLock,
   buildWorkflow,
+  verifyWorkflow,
   releaseWorkflow,
+  agentEntry,
+  agentInstructions,
   environment = "",
 }) {
   const policy = paperProvisioningPolicy();
@@ -439,6 +483,12 @@ export function createPaperProvisioningAuthority({
         reusablePath: ".github/workflows/publication-artifact.yml",
         reusableRef: buildchainSha,
       },
+      verify: {
+        path: PAPER_PATHS.verifyWorkflow,
+        sourceDigest: sha256Text(verifyWorkflow),
+        reusablePath: ".github/workflows/check.yml",
+        reusableRef: buildchainSha,
+      },
       release: {
         path: PAPER_PATHS.releaseWorkflow,
         sourceDigest: sha256Text(releaseWorkflow),
@@ -446,6 +496,13 @@ export function createPaperProvisioningAuthority({
         reusableRef: buildchainSha,
       },
     },
+    agentEntry: {
+      contract: PAPER_AGENT_ENTRY_CONTRACT,
+      policyPath: PAPER_PATHS.agentEntry,
+      policyDigest: sha256Text(agentEntry),
+      instructionsPath: PAPER_PATHS.agentInstructions,
+      instructionsDigest: sha256Text(agentInstructions),
+    },
     admission: {
       contractLockPath: PAPER_PATHS.contractLock,
       contractLockDigest: sha256Text(contractLock),
@@ -469,150 +526,6 @@ export function createPaperProvisioningAuthority({
   };
 }
 
-function scaffoldMakefile() {
-  const image = `${DEFAULT_TOOLCHAIN_IMAGE}@${DEFAULT_TOOLCHAIN_DIGEST}`;
-  return `.PHONY: check pdf clean
-
-BUILDER_IMAGE := ${image}
-SOURCE_DATE_EPOCH ?= 0
-
-check:
-\t@test -f paper/main.tex
-\t@test -f paper/references.bib
-\t@git diff --check
-
-pdf:
-\t@mkdir -p _build
-\tdocker run --rm --network=none \\
-\t\t-e SOURCE_DATE_EPOCH="$(SOURCE_DATE_EPOCH)" \\
-\t\t-e TZ=UTC -e LANG=C.UTF-8 -e LC_ALL=C.UTF-8 -e HOME=/tmp \\
-\t\t-v "$(CURDIR):/workspace" -w /workspace \\
-\t\t"$(BUILDER_IMAGE)" bash -lc '${DEFAULT_TOOLCHAIN_COMMAND}'
-
-clean:
-\trm -rf _build
-`;
-}
-
-function paperPackageScripts(current = {}) {
-  return {
-    ...current,
-    "buildchain:paper": "buildchain paper",
-    "paper:preflight": "buildchain paper preflight --json",
-    "paper:work:start": "buildchain paper work start",
-    "paper:work:submit": "buildchain paper work submit",
-    "paper:status": "buildchain paper status --json",
-  };
-}
-
-function managedPaperPackageJson(current, buildchainVersion) {
-  if (!/^3\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(buildchainVersion)) {
-    throw new Error(
-      "paper repositories require an exact Buildchain v3 version",
-    );
-  }
-  const packageManager = current.packageManager || "pnpm@11.7.0";
-  if (!packageManager.startsWith("pnpm@")) {
-    throw new Error("paper repositories require a pnpm packageManager");
-  }
-  return {
-    ...current,
-    private: true,
-    scripts: paperPackageScripts(current.scripts),
-    devDependencies: {
-      ...(current.devDependencies || {}),
-      "@kungfu-tech/buildchain": buildchainVersion,
-    },
-    packageManager,
-  };
-}
-
-function scaffoldPackageJson({
-  name,
-  packageName,
-  repository,
-  buildchainVersion,
-}) {
-  return jsonText({
-    ...managedPaperPackageJson(
-      {
-        name: packageName,
-        description: `${name} publication source repository.`,
-        repository: {
-          type: "git",
-          url: `git+https://github.com/${repository}.git`,
-        },
-        license: "Apache-2.0",
-      },
-      buildchainVersion,
-    ),
-  });
-}
-
-function scaffoldReadme({ title, packageName }) {
-  return `# ${title}
-
-This repository is a Buildchain-governed publication artifact source.
-
-## Local workflow
-
-\`\`\`sh
-pnpm paper:preflight
-pnpm paper:work:start -- <topic>
-pnpm paper:work:submit
-make pdf
-\`\`\`
-
-The public package identity is \`${packageName}\`. Buildchain owns reproducible
-artifact generation, sealed publication, npm Trusted Publishing, and recovery;
-this repository owns the paper source and review history.
-
-See [docs/MAP.md](docs/MAP.md) for the repository map.
-`;
-}
-
-function scaffoldMap() {
-  return `# Repository Map
-
-- \`paper/main.tex\`: paper source entrypoint.
-- \`paper/references.bib\`: bibliography source.
-- \`.buildchain/buildchain.toml\`: publication identity, toolchain, package, and lifecycle contract.
-- \`.buildchain/contract-lock.json\`: accepted Buildchain runtime contract.
-- \`.github/workflows/build.yml\`: thin read-only build and reproducibility caller.
-- \`.github/workflows/paper-release.yml\`: thin protected sealed-release caller.
-
-The repository does not own npm transaction logic, publication authority,
-release-state recovery, or site deployment mechanics. Those remain Buildchain,
-npm/GitHub, and downstream site responsibilities respectively.
-`;
-}
-
-function scaffoldMainTex(title) {
-  return `\\documentclass[11pt]{article}
-\\usepackage[T1]{fontenc}
-\\usepackage{lmodern}
-\\usepackage{hyperref}
-
-\\title{${texEscape(title)}}
-\\author{}
-\\date{}
-
-\\begin{document}
-\\maketitle
-
-\\begin{abstract}
-Replace this paragraph with the paper abstract.
-\\end{abstract}
-
-\\section{Introduction}
-Replace this section with the reviewed paper content.
-
-\\bibliographystyle{plain}
-\\bibliography{paper/references}
-\\end{document}
-`;
-}
-
 function scaffoldFiles({
   buildchainRoot,
   buildchainVersion,
@@ -647,6 +560,15 @@ function scaffoldFiles({
     artifactPaths: "_build/main.pdf",
     releasePassportProductName: title,
   });
+  const verifyWorkflow = scaffoldVerifyWorkflow(buildchainSha);
+  const agentEntry = paperAgentEntryFiles({
+    cwd,
+    buildchainVersion,
+    buildchainSha,
+    developmentRef: `dev/v${parsePaperVersion(version).major}/v${
+      parsePaperVersion(version).major
+    }.${parsePaperVersion(version).minor}`,
+  });
   const provisioningAuthority = createPaperProvisioningAuthority({
     repository,
     packageName,
@@ -654,7 +576,10 @@ function scaffoldFiles({
     buildchainSha,
     contractLock: contractLockText,
     buildWorkflow,
+    verifyWorkflow,
     releaseWorkflow,
+    agentEntry: agentEntry.get(PAPER_PATHS.agentEntry),
+    agentInstructions: agentEntry.get(PAPER_PATHS.agentInstructions),
   });
   const licenseText = runtimeLicenseText(buildchainRoot);
   return new Map([
@@ -671,9 +596,18 @@ function scaffoldFiles({
     [PAPER_PATHS.contractLock, contractLockText],
     [PAPER_PATHS.versionPin, `${buildchainVersion}\n`],
     [PAPER_PATHS.buildWorkflow, buildWorkflow],
+    [PAPER_PATHS.verifyWorkflow, verifyWorkflow],
     [PAPER_PATHS.releaseWorkflow, releaseWorkflow],
     [PAPER_PATHS.provisioningAuthority, jsonText(provisioningAuthority)],
-    ["Makefile", scaffoldMakefile()],
+    ...agentEntry,
+    [
+      "Makefile",
+      scaffoldMakefile({
+        image: DEFAULT_TOOLCHAIN_IMAGE,
+        digest: DEFAULT_TOOLCHAIN_DIGEST,
+        command: DEFAULT_TOOLCHAIN_COMMAND,
+      }),
+    ],
     [
       "package.json",
       scaffoldPackageJson({
@@ -957,6 +891,12 @@ function migrationFiles({
     artifactPaths: config.publication.artifactPaths.join(","),
     releasePassportProductName: config.publication.title,
   });
+  const verifyWorkflow = scaffoldVerifyWorkflow(runtimeSha);
+  const agentEntry = paperAgentEntryFiles({
+    cwd,
+    buildchainVersion: runtimeIdentity.version,
+    buildchainSha: runtimeSha,
+  });
   const provisioningAuthority = createPaperProvisioningAuthority({
     repository,
     packageName,
@@ -964,7 +904,10 @@ function migrationFiles({
     buildchainSha: runtimeSha,
     contractLock: contractLockText,
     buildWorkflow,
+    verifyWorkflow,
     releaseWorkflow,
+    agentEntry: agentEntry.get(PAPER_PATHS.agentEntry),
+    agentInstructions: agentEntry.get(PAPER_PATHS.agentInstructions),
   });
   const currentPackage = readJson(path.resolve(cwd, "package.json"));
   if (!currentPackage.exists || currentPackage.error || !currentPackage.value) {
@@ -978,21 +921,12 @@ function migrationFiles({
     [PAPER_PATHS.contractLock, contractLockText],
     [PAPER_PATHS.versionPin, `${runtimeIdentity.version}\n`],
     [PAPER_PATHS.buildWorkflow, buildWorkflow],
+    [PAPER_PATHS.verifyWorkflow, verifyWorkflow],
     [PAPER_PATHS.releaseWorkflow, releaseWorkflow],
     [PAPER_PATHS.provisioningAuthority, jsonText(provisioningAuthority)],
+    ...agentEntry,
     ["package.json", jsonText(packageJson)],
   ]);
-  const verifyWorkflowPath = path.resolve(cwd, PAPER_PATHS.verifyWorkflow);
-  if (fs.existsSync(verifyWorkflowPath)) {
-    const currentVerifyWorkflow = fs.readFileSync(verifyWorkflowPath, "utf8");
-    const migratedVerifyWorkflow = currentVerifyWorkflow.replace(
-      /(uses:\s*kungfu-systems\/buildchain\/\.github\/workflows\/check\.yml@)[^\s]+/g,
-      `$1${runtimeSha}`,
-    );
-    if (migratedVerifyWorkflow !== currentVerifyWorkflow) {
-      files.set(PAPER_PATHS.verifyWorkflow, migratedVerifyWorkflow);
-    }
-  }
   return files;
 }
 
@@ -1687,7 +1621,27 @@ function validatePaperProvisioningAuthority(cwd) {
       "paper release policy permits avoidable bookkeeping pull requests",
     );
   }
-  for (const workflow of [value.workflows?.build, value.workflows?.release]) {
+  if (value.agentEntry?.contract !== PAPER_AGENT_ENTRY_CONTRACT) {
+    errors.push("paper agent-entry authority contract mismatch");
+  }
+  for (const [entryPath, expectedDigest] of [
+    [value.agentEntry?.policyPath, value.agentEntry?.policyDigest],
+    [value.agentEntry?.instructionsPath, value.agentEntry?.instructionsDigest],
+  ]) {
+    if (!entryPath || !SHA256_PATTERN.test(String(expectedDigest || ""))) {
+      errors.push("paper agent-entry authority is incomplete");
+      continue;
+    }
+    const absolute = path.resolve(cwd, entryPath);
+    if (!fs.existsSync(absolute) || sha256File(absolute) !== expectedDigest) {
+      errors.push(`paper agent-entry source digest mismatch: ${entryPath}`);
+    }
+  }
+  for (const workflow of [
+    value.workflows?.build,
+    value.workflows?.verify,
+    value.workflows?.release,
+  ]) {
     if (!workflow?.path || !workflow?.sourceDigest) {
       errors.push("paper workflow authority is incomplete");
       continue;
@@ -1707,7 +1661,10 @@ function validatePaperProvisioningAuthority(cwd) {
         `paper workflow reusable source is not exact: ${workflow.path}`,
       );
     }
-    if (!text.includes(`buildchain-ref: ${value.runtime.resolvedSha}`)) {
+    if (
+      workflow.reusablePath !== ".github/workflows/check.yml" &&
+      !text.includes(`buildchain-ref: ${value.runtime.resolvedSha}`)
+    ) {
       errors.push(
         `paper workflow runtime input is not exact: ${workflow.path}`,
       );
@@ -2094,6 +2051,7 @@ export function collectPaperPreflight({
   buildchainSha = "",
   registry = NPM_REGISTRY,
   offline = false,
+  agentEntryMode = "contract",
 } = {}) {
   const resolvedCwd = path.resolve(cwd);
   const status = collectPaperStatus({ cwd: resolvedCwd });
@@ -2114,6 +2072,11 @@ export function collectPaperPreflight({
     buildchainRef: provisioning.value?.runtime?.ref || buildchainRef,
     buildchainSha,
   });
+  const agentEntry = collectPaperAgentEntry({
+    cwd: resolvedCwd,
+    buildchainSha: runtime.resolvedSha,
+    mode: agentEntryMode,
+  });
   const lockPath = path.resolve(resolvedCwd, PAPER_PATHS.contractLock);
   let lockEvaluation = {
     status: "missing-lock",
@@ -2220,6 +2183,11 @@ export function collectPaperPreflight({
     configResult.loaded?.config?.publication,
   );
   const checks = [
+    ...agentEntry.checks.map((entry) => ({
+      ...entry,
+      blocking: true,
+      scope: "local",
+    })),
     {
       id: "provisioning.authority",
       status: provisioning.valid ? "pass" : "fail",
@@ -2486,6 +2454,7 @@ export function collectPaperPreflight({
       policyDigest: provisioning.value?.policy?.policyDigest || "",
       errors: provisioning.errors,
     },
+    agentEntry,
     repositoryPermissions,
     repositoryActions,
     generatedWriteAuthority,

package/scripts/buildchain-cli-help.mjs

@@ -199,6 +199,7 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain paper work submit [--cwd <dir>] [--title <title>] [--body <body>] [--execute] [--json]
   buildchain paper fleet audit [--root <dir>] [--offline] [--json]
   buildchain paper fleet update [--root <dir>] [--write] [--json]
+  buildchain paper agent verify [--cwd <dir>] [--offline] [--json]
   buildchain paper preflight [--cwd <dir>] [--offline] [--json]
   buildchain paper bootstrap npm [--cwd <dir>] [--execute]
                                   [--confirm-public-package <name>] [--json]

package/scripts/paper-agent-cli.mjs

@@ -0,0 +1,35 @@
+import { collectPaperPreflight } from "../packages/core/paper.js";
+
+function readFlag(args, name, fallback = "") {
+  const index = args.indexOf(`--${name}`);
+  if (index === -1) return fallback;
+  return args[index + 1] || "";
+}
+
+export function runPaperAgentCli({
+  command,
+  subcommand,
+  args,
+  cwd,
+  buildchainRoot,
+  buildchainVersion,
+  buildchainRef,
+  buildchainSha,
+}) {
+  if (command !== "agent" || subcommand !== "verify") {
+    return { handled: false, result: null };
+  }
+  return {
+    handled: true,
+    result: collectPaperPreflight({
+      cwd,
+      buildchainRoot,
+      buildchainVersion,
+      buildchainRef: readFlag(args, "buildchain-ref", buildchainRef),
+      buildchainSha,
+      registry: readFlag(args, "registry", "https://registry.npmjs.org/"),
+      offline: args.includes("--offline"),
+      agentEntryMode: "local",
+    }),
+  };
+}

package/scripts/paper-work-fleet-cli.mjs

@@ -368,12 +368,13 @@ function githubGovernance(cwd, repository) {
   }
 }
 
-function runWorkStart({ args, cwd }) {
+function runWorkStart({ args, cwd, buildchainSha }) {
   const topic = args[0]?.startsWith("--") ? "" : args[0] || "";
   const plan = createPaperWorkStartPlan({
     cwd,
     topic,
     branch: readFlag(args, "branch"),
+    buildchainSha,
   });
   return args.includes("--execute") ? executePaperWorkStart(plan) : plan;
 }
@@ -382,7 +383,11 @@ function runScaffold(options) {
   const plan = planPaperScaffold({
     cwd: options.cwd,
     buildchainRoot: options.buildchainRoot,
-    buildchainVersion: options.buildchainVersion,
+    buildchainVersion: readFlag(
+      options.args,
+      "buildchain-version",
+      options.buildchainVersion,
+    ),
     buildchainRef: readFlag(
       options.args,
       "buildchain-ref",
@@ -405,7 +410,11 @@ function runMigration(options) {
   const plan = planPaperMigration({
     cwd: options.cwd,
     buildchainRoot: options.buildchainRoot,
-    buildchainVersion: options.buildchainVersion,
+    buildchainVersion: readFlag(
+      options.args,
+      "buildchain-version",
+      options.buildchainVersion,
+    ),
     buildchainSha: options.buildchainSha,
   });
   return options.args.some((entry) => ["--write", "--execute"].includes(entry))
@@ -413,7 +422,7 @@ function runMigration(options) {
     : plan;
 }
 
-function runWorkSubmit({ args, cwd }) {
+function runWorkSubmit({ args, cwd, buildchainSha }) {
   const repository = collectPaperStatus({ cwd }).identity.repository;
   const branch = commandResult("git", ["branch", "--show-current"], {
     cwd,
@@ -426,6 +435,7 @@ function runWorkSubmit({ args, cwd }) {
     cwd,
     pullRequests: observation.rows,
     pullRequestObservation: observation,
+    buildchainSha,
   });
   return args.includes("--execute") ? executeWorkSubmit(plan, args) : plan;
 }

package/scripts/paper.mjs

@@ -13,6 +13,7 @@ import {
   PAPER_SCAFFOLD_CONTRACT,
   PAPER_STATUS_CONTRACT,
   collectPaperPreflight,
+  resolvePaperBuildchainSha,
   collectPaperStatus,
   createPaperAlphaPlan,
   createPaperBuildPlan,
@@ -24,6 +25,7 @@ import {
   printPaperWorkFleetSummary,
   runPaperWorkFleetCli,
 } from "./paper-work-fleet-cli.mjs";
+import { runPaperAgentCli } from "./paper-agent-cli.mjs";
 
 function usage() {
   return `Usage:
@@ -38,6 +40,7 @@ function usage() {
                                [--execute] [--json]
   buildchain paper fleet audit [--root <dir>] [--offline] [--json]
   buildchain paper fleet update [--root <dir>] [--write] [--json]
+  buildchain paper agent verify [--cwd <dir>] [--offline] [--json]
   buildchain paper preflight [--cwd <dir>] [--offline] [--json]
   buildchain paper bootstrap npm [--cwd <dir>] [--package <name>]
                                   [--repository <owner/repo>] [--workflow <filename>]
@@ -455,6 +458,7 @@ export async function runPaperCli(
     buildchainSha = "",
   } = {},
 ) {
+  buildchainSha = resolvePaperBuildchainSha(buildchainRoot, buildchainSha);
   const [command = "", maybeSubcommand = "", ...rest] = args;
   const json = hasFlag(args, "json");
   try {
@@ -476,8 +480,12 @@ export async function runPaperCli(
       buildchainRef,
       buildchainSha,
     });
+    // prettier-ignore
+    const paperAgent = runPaperAgentCli({ command, subcommand: maybeSubcommand, args: effectiveArgs, cwd, buildchainRoot, buildchainVersion, buildchainRef, buildchainSha });
     let result;
-    if (workFleet.handled) {
+    if (paperAgent.handled) {
+      result = paperAgent.result;
+    } else if (workFleet.handled) {
       result = workFleet.result;
     } else if (command === "preflight") {
       result = collectPaperPreflight({
@@ -492,6 +500,11 @@ export async function runPaperCli(
           "https://registry.npmjs.org/",
         ),
         offline: hasFlag(effectiveArgs, "offline"),
+        agentEntryMode: hasFlag(effectiveArgs, "ci")
+          ? "ci"
+          : hasFlag(effectiveArgs, "agent-entry")
+            ? "local"
+            : "contract",
       });
     } else if (command === "bootstrap" && maybeSubcommand === "npm") {
       result = executePaperNpmBootstrap({
@@ -577,7 +590,7 @@ export async function runPaperCli(
         : plan;
     } else {
       throw new Error(
-        "usage: buildchain paper <scaffold|migrate|work start|work submit|fleet audit|fleet update|preflight|bootstrap npm|build|alpha|status|resume> ...",
+        "usage: buildchain paper <scaffold|migrate|work start|work submit|fleet audit|fleet update|agent verify|preflight|bootstrap npm|build|alpha|status|resume> ...",
       );
     }
     printResult(result, json);

package/scripts/site-capability-metadata.mjs

@@ -97,6 +97,7 @@ export function cliCommandMeta(id) {
     "portable-cache-receipt": { group: "observability-diagnostics", purpose: "Seal exact, compatible, miss, or corrupt provider evidence against one cache plan." },
     "npm-dry-run": { group: "release-passport-trust", purpose: "Verify npm publish shape before a release transaction." },
     paper: { group: "reusable-build", purpose: "Inspect the unified paper repository and publication command families." },
+    "paper-agent": { group: "getting-started", purpose: "Verify the mandatory managed Paper agent entry contract on an existing work branch." },
     "paper-alpha": { group: "release-passport-trust", purpose: "Plan or open the protected dev-to-alpha paper publication PR without direct publication." },
     "paper-bootstrap-npm": { group: "release-passport-trust", purpose: "Dry-run or explicitly bootstrap the public npm package and bind GitHub Trusted Publishing." },
     "paper-build": { group: "reusable-build", purpose: "Plan or execute the existing two-clean-build reproducibility gate for a paper." },
@@ -199,4 +200,3 @@ export function nodeApiMeta(exportName) {
   }
   return { capabilityGroup: capabilityGroup(meta.group), summary: meta.summary, audience: ["developer", "agent"], maturity: "stable" };
 }
-