@kungfu-tech/buildchain 3.0.5-alpha.4 → 3.0.5-alpha.6

package/dist/site/public-surface-audit.json

@@ -7031,7 +7031,7 @@
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "0db010925d1c60209c3dac8bc2797537f307ab21bc68084263e79004c5c16ff7",
     "workflowRegistryDigest": "4f1b9a933e117abc5fc4212241c83a35609f23477dac98d6cd37c4b40b57ba29",
-    "pageRegistryDigest": "ae6076b33246fc76a7d9ce4a54ae65b9eb3a11a9772a8ea937e6f5e93bda13d1"
+    "pageRegistryDigest": "1f715d11aca1124de121006046c07387d8d3d6b14fb868f8542626195285ec24"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-02T05:24:51.211Z",
-  "publishedAt": "2026-08-02T05:24:51.211Z",
+  "generatedAt": "2026-08-02T08:34:45.723Z",
+  "publishedAt": "2026-08-02T08:34:45.723Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "0e42df038cdb688330156635bbcad37e362a8345",
+  "sourceRevision": "2b5880a79f169f4a64b193a06a47b990d6585e16",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.4",
+    "version": "3.0.5-alpha.6",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-02T05:24:51.211Z",
-  "publishedAt": "2026-08-02T05:24:51.211Z",
+  "generatedAt": "2026-08-02T08:34:45.723Z",
+  "publishedAt": "2026-08-02T08:34:45.723Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "0e42df038cdb688330156635bbcad37e362a8345",
+  "sourceRevision": "2b5880a79f169f4a64b193a06a47b990d6585e16",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.4",
+    "version": "3.0.5-alpha.6",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:38f051f579fb93dc7d8b4f2c70acd622c020e867394344b5e932568cd8d2ad83"
+      "digest": "sha256:470b65c96353a9f3fac0db7b67bba34058e03bfa7e1a8fc6bec0d6d9f13aa6c4"
     },
     {
       "id": "build-facts",
@@ -293,7 +293,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:96d78f800cd7d43d3a47a11863d4813711e360418ba33a4284688389c7e4b70c"
+      "digest": "sha256:a38eca4d8ada75aed5cb60f2ef23ffe4ba36b1c804ea1ee7f74b3271765b7a1c"
     },
     {
       "id": "release-flow",

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -185,8 +185,11 @@ At the 2026-07-29 AWS Price List rate of USD 1.45 per Windows
 `c7i.4xlarge` hour, each accepted instance reserves its complete three-hour
 USD 4.35 fail-closed lifetime before `RunInstances`. A DynamoDB transaction
 binds the exact campaign and source, creates an idempotent run ledger entry,
-and atomically refuses a seventh accepted instance. Six accepted instances
-therefore reserve at most USD 26.10 under the dedicated USD 40 decision.
+and atomically refuses a sixth accepted instance. Five accepted instances
+therefore reserve at most USD 21.75. The campaign also persists the
+operator-observed spend from earlier Windows work, and refuses to arm unless
+that baseline, all five reservations, and one USD 4.35 fail-closed race
+allowance remain below the USD 80 phase cap.
 
 The campaign starts unarmed and expires within 24 hours. Its `CONTROL` record
 can be created only once: a killed or expired campaign cannot be re-armed by
@@ -196,6 +199,10 @@ paid launch. Reservations are never refunded: a controller crash, ambiguous
 launch, or successful launch all remain charged to the campaign, favoring a
 false stop over an accidental budget overrun.
 
+Each stack owns a stack-scoped reaper log group, so an independent retained
+one-shot campaign stack can be created without colliding with another
+campaign's audit log resource.
+
 The tag-filtered AWS Budget is defense in depth, not the authoritative launch
 gate. It is disabled by default because a linked account cannot activate a
 cost-allocation tag. Set `EnableTagFilteredBudget=true` only after the AWS
@@ -213,8 +220,10 @@ final job.
 
 `scripts/aws-windows-jit-campaign.mjs` is the one-shot operator boundary.
 Without a mutation mode it emits the arm plan. `arm-campaign` requires the
-campaign id, exact source SHA, and state table to be repeated as confirmations,
-then creates `CONTROL` and `CAMPAIGN#<id>` with `attribute_not_exists`
+campaign id, exact source SHA, state table, observed prior phase spend, and a
+bounded one-to-five accepted-instance ceiling to be repeated as confirmations,
+then creates `CONTROL` and `CAMPAIGN#<id>` with
+`attribute_not_exists`
 conditions. DynamoDB therefore refuses a second campaign in the same retained
 state table. The operator can always use `kill-campaign`; there is deliberately
 no clear or re-arm operation.
@@ -224,8 +233,9 @@ same `--campaign-id`, `--confirm-campaign-id`, `--state-table`, and
 `--confirm-state-table`. After the GitHub, AMI, active-instance, SSM, and EC2
 DryRun checks pass, the controller
 atomically reserves one run. Duplicate run-attempt-qualification identities,
-source mismatch, expiry, `KILLED`, the seventh accepted instance, or a
-reservation over the USD 40 ceiling all fail closed before `RunInstances`.
+source mismatch, expiry, `KILLED`, the sixth accepted instance, or a
+reservation that would exceed the baseline-adjusted USD 80 phase ceiling all
+fail closed before `RunInstances`.
 
 Example dry-run and arm boundary (do not execute without a new campaign budget
 decision):
@@ -235,12 +245,16 @@ windows_campaign=win-REPLACE_WITH_CAMPAIGN_ID
 windows_source=REPLACE_WITH_EXACT_40_CHARACTER_SHA
 windows_state_table=REPLACE_WITH_CAMPAIGN_STATE_TABLE
 windows_expires_at=REPLACE_WITH_ISO_TIMESTAMP_WITHIN_24_HOURS
+windows_phase_spend_baseline_usd=REPLACE_WITH_OBSERVED_PRIOR_WINDOWS_SPEND
+windows_max_accepted_instances=REPLACE_WITH_INTEGER_FROM_1_THROUGH_5
 
 node scripts/aws-windows-jit-campaign.mjs plan-arm \
   --campaign-id "$windows_campaign" \
   --source-sha "$windows_source" \
   --state-table "$windows_state_table" \
-  --expires-at "$windows_expires_at"
+  --expires-at "$windows_expires_at" \
+  --phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
+  --max-accepted-instances "$windows_max_accepted_instances"
 
 node scripts/aws-windows-jit-campaign.mjs arm-campaign \
   --campaign-id "$windows_campaign" \
@@ -249,11 +263,16 @@ node scripts/aws-windows-jit-campaign.mjs arm-campaign \
   --confirm-source-sha "$windows_source" \
   --state-table "$windows_state_table" \
   --confirm-state-table "$windows_state_table" \
-  --expires-at "$windows_expires_at"
+  --expires-at "$windows_expires_at" \
+  --phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
+  --confirm-phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
+  --max-accepted-instances "$windows_max_accepted_instances" \
+  --confirm-max-accepted-instances "$windows_max_accepted_instances"
 ```
 
-Arming creates a permanent one-shot control record and admits up to six paid
-instances. Its rollback is fail-closed, not deletion: `kill-campaign` first
+Arming creates a permanent one-shot control record and admits only the
+explicitly confirmed number of paid instances, never more than five. Its
+rollback is fail-closed, not deletion: `kill-campaign` first
 persists `KILLED`, then publishes to the dedicated SNS topic so the reaper
 terminates active card-owned instances and removes their JIT parameters. The
 command is idempotent, but the operator must read back DynamoDB, EC2, SSM, and

package/docs/node-api-reference.md

@@ -49,7 +49,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `artifactSigningEvidenceDigest` | function: function artifactSigningEvidenceDigest(evidence = []) | evidence = [] | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { artifactSigningEvidenceDigest } from "@kungfu-tech/buildchain";` | `packages/core/artifact-signing-result.js:58` |
 | `artifactVerificationEnvelopeDigest` | function: function artifactVerificationEnvelopeDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { artifactVerificationEnvelopeDigest } from "@kungfu-tech/buildchain";` | `packages/core/artifact-verification-envelope.js:50` |
 | `assertPackageManager` | function: function assertPackageManager(manager) | manager | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { assertPackageManager } from "@kungfu-tech/buildchain";` | `packages/core/package-manager.js:49` |
-| `assertPublicSurfaceReverseAudit` | function: function assertPublicSurfaceReverseAudit(report) | report | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { assertPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:292` |
+| `assertPublicSurfaceReverseAudit` | function: function assertPublicSurfaceReverseAudit(report) | report | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { assertPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:261` |
 | `auditKfd3Surfaces` | function: function auditKfd3Surfaces({ cwd = process.cwd(), registryPath = "", kinds = [], artifactPath = "", } = {}) | { cwd = process.cwd(), registryPath = "", kinds = [], artifactPath = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { auditKfd3Surfaces } from "@kungfu-tech/buildchain";` | `packages/core/kfd3-surface-register.js:547` |
 | `BADGE_BUNDLE_DEFAULT_CLAIMS` | constant: const BADGE_BUNDLE_DEFAULT_CLAIMS | none | value | Import does not declare a throw contract. | none-on-import | `import { BADGE_BUNDLE_DEFAULT_CLAIMS } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:17` |
 | `BADGE_BUNDLE_FACTS_CONTRACT` | constant: const BADGE_BUNDLE_FACTS_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BADGE_BUNDLE_FACTS_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:13` |
@@ -107,7 +107,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `BUILDCHAIN_LOG_SUMMARY_CONTRACT` | constant: const BUILDCHAIN_LOG_SUMMARY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_LOG_SUMMARY_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/logging.js:7` |
 | `BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT` | constant: const BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/diagnostics.js:37` |
 | `BUILDCHAIN_PROCESS_SAMPLE_SUMMARY_CONTRACT` | constant: const BUILDCHAIN_PROCESS_SAMPLE_SUMMARY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_PROCESS_SAMPLE_SUMMARY_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/diagnostics.js:39` |
-| `BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT` | constant: const BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:11` |
+| `BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT` | constant: const BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:12` |
 | `BUILDCHAIN_RELEASE_PASSPORT_PATH` | constant: const BUILDCHAIN_RELEASE_PASSPORT_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_RELEASE_PASSPORT_PATH } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:33` |
 | `BUILDCHAIN_RUNTIME_CONTRACT_WORLD` | constant: const BUILDCHAIN_RUNTIME_CONTRACT_WORLD | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_RUNTIME_CONTRACT_WORLD } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-contract.js:7` |
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:5` |
@@ -144,7 +144,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `collectProcessTreeSnapshot` | function: function collectProcessTreeSnapshot({ rootPid = process.pid, cwd = process.cwd(), platform = process.platform, runCommand = defaultDiagnosticCommandRunner, } = {}) | { rootPid = process.pid, cwd = process.cwd(), platform = process.platform, runCommand = defaultDiagnosticCommandRunner, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectProcessTreeSnapshot } from "@kungfu-tech/buildchain";` | `packages/core/diagnostics.js:1029` |
 | `collectPublicationArtifact` | function: function collectPublicationArtifact({ cwd = process.cwd(), sourceSha = "", sourceBundle = true, sourceBundlePath = "", generatedAt = "", manifestPath = "", passportPath = "", } = {}) | { cwd = process.cwd(), sourceSha = "", sourceBundle = true, sourceBundlePath = "", generatedAt = "", manifestPath = "", passportPath = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { collectPublicationArtifact } from "@kungfu-tech/buildchain";` | `packages/core/publication-artifact.js:271` |
 | `collectPublicationPackageFacts` | function: function collectPublicationPackageFacts({ cwd = process.cwd(), packageName = "", outputDir = ".buildchain/publication/npm-package", } = {}) | { cwd = process.cwd(), packageName = "", outputDir = ".buildchain/publication/npm-package", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { collectPublicationPackageFacts } from "@kungfu-tech/buildchain";` | `packages/core/publication-package.js:74` |
-| `collectPublicSurfaceReverseAudit` | function: function collectPublicSurfaceReverseAudit({ root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {}) | { root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:192` |
+| `collectPublicSurfaceReverseAudit` | function: function collectPublicSurfaceReverseAudit({ root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {}) | { root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:161` |
 | `collectReadmeBadgeFacts` | function: async function collectReadmeBadgeFacts({ cwd = process.cwd() } = {}) | { cwd = process.cwd() } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectReadmeBadgeFacts } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:700` |
 | `collectRunnerDiagnostics` | function: function collectRunnerDiagnostics() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectRunnerDiagnostics } from "@kungfu-tech/buildchain";` | `packages/core/diagnostics.js:468` |
 | `collectToolDiagnostics` | function: function collectToolDiagnostics({ cwd = process.cwd(), tools = ["node", "pnpm", "npm", "git", "cmake", "ninja", "ccache", "sccache"] } = {}) | { cwd = process.cwd(), tools = ["node", "pnpm", "npm", "git", "cmake", "ninja", "ccache", "sccache"] } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectToolDiagnostics } from "@kungfu-tech/buildchain";` | `packages/core/diagnostics.js:495` |
@@ -251,11 +251,11 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `discoverConfiguredVersionStateFiles` | function: function discoverConfiguredVersionStateFiles(cwd = process.cwd(), loadedConfig = loadBuildchainConfig(cwd)) | cwd = process.cwd(), loadedConfig = loadBuildchainConfig(cwd) | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { discoverConfiguredVersionStateFiles } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-config.js:1428` |
 | `discoverKfdStandards` | function: function discoverKfdStandards() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { discoverKfdStandards } from "@kungfu-tech/buildchain";` | `packages/core/kfd.js:464` |
 | `discoverPaperFleet` | function: function discoverPaperFleet(root = process.cwd()) | root = process.cwd() | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { discoverPaperFleet } from "@kungfu-tech/buildchain";` | `packages/core/paper-fleet.js:23` |
-| `enumerateActionInputs` | function: function enumerateActionInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateActionInputs } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:122` |
+| `enumerateActionInputs` | function: function enumerateActionInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateActionInputs } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:91` |
 | `enumerateCliCommandsFromBin` | function: function enumerateCliCommandsFromBin({ root = process.cwd(), binPath = "bin/buildchain.mjs", } = {}) | { root = process.cwd(), binPath = "bin/buildchain.mjs", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateCliCommandsFromBin } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-cli.js:93` |
-| `enumerateDocCommandRefs` | function: function enumerateDocCommandRefs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateDocCommandRefs } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:146` |
-| `enumerateSitePages` | function: function enumerateSitePages({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateSitePages } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:137` |
-| `enumerateWorkflowInputs` | function: function enumerateWorkflowInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateWorkflowInputs } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:105` |
+| `enumerateDocCommandRefs` | function: function enumerateDocCommandRefs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateDocCommandRefs } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:115` |
+| `enumerateSitePages` | function: function enumerateSitePages({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateSitePages } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:106` |
+| `enumerateWorkflowInputs` | function: function enumerateWorkflowInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateWorkflowInputs } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:74` |
 | `evaluateBuildchainContractLock` | function: function evaluateBuildchainContractLock({ lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", } = {}) | { lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateBuildchainContractLock } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-contract.js:818` |
 | `evaluateCodeownersAuthority` | function: function evaluateCodeownersAuthority({ source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {}) | { source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateCodeownersAuthority } from "@kungfu-tech/buildchain";` | `packages/core/github-governance-authority.js:425` |
 | `evaluateGithubGovernanceSnapshot` | function: function evaluateGithubGovernanceSnapshot({ descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {}) | { descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateGithubGovernanceSnapshot } from "@kungfu-tech/buildchain";` | `packages/core/github-governance-authority.js:694` |
@@ -480,7 +480,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `resolvePropagationChannel` | function: function resolvePropagationChannel(edge, upstreamChannel) | edge, upstreamChannel | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolvePropagationChannel } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation.js:190` |
 | `resolvePublicationCandidateFile` | function: function resolvePublicationCandidateFile(files = [], candidatePath) | files = [], candidatePath | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { resolvePublicationCandidateFile } from "@kungfu-tech/buildchain";` | `packages/core/publication-artifact-candidate.js:23` |
 | `resolveReleasePassportPath` | function: function resolveReleasePassportPath(cwd = process.cwd()) | cwd = process.cwd() | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolveReleasePassportPath } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:92` |
-| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:514` |
+| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:518` |
 | `revokeStableCandidate` | function: function revokeStableCandidate(ledgerInput, versionInput, { reason, actor = "", now = new Date().toISOString() } = {}) | ledgerInput, versionInput, { reason, actor = "", now = new Date().toISOString() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { revokeStableCandidate } from "@kungfu-tech/buildchain";` | `packages/core/stable-candidate-ledger.js:185` |
 | `rollbackReleaseActivationTransaction` | function: function rollbackReleaseActivationTransaction(transaction, { toSiteSourceSha, reason } = {}) | transaction, { toSiteSourceSha, reason } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { rollbackReleaseActivationTransaction } from "@kungfu-tech/buildchain";` | `packages/core/release-activation-transaction.js:290` |
 | `runLifecycleStage` | function: function runLifecycleStage({ cwd = process.cwd(), loadedConfig, name, stage, env: extraEnv, timeoutMinutes }) | { cwd = process.cwd(), loadedConfig, name, stage, env: extraEnv, timeoutMinutes } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { runLifecycleStage } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-config.js:1380` |
@@ -552,7 +552,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain";` | `packages/core/publication-reproducibility.js:869` |
 | `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:124` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain";` | `packages/core/release-passport.js:2743` |
-| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:482` |
+| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:486` |
 | `WEB_SURFACE_PRODUCTION_DECISION_CONTRACT` | constant: const WEB_SURFACE_PRODUCTION_DECISION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PRODUCTION_DECISION_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/web-surface-publication-candidate.js:7` |
 | `WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT` | constant: const WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/web-surface-publication-candidate.js:5` |
 | `webSurfacePublicationDigest` | function: function webSurfacePublicationDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { webSurfacePublicationDigest } from "@kungfu-tech/buildchain";` | `packages/core/web-surface-publication-candidate.js:21` |
@@ -643,7 +643,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `artifactSigningEvidenceDigest` | function: function artifactSigningEvidenceDigest(evidence = []) | evidence = [] | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { artifactSigningEvidenceDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/artifact-signing-result.js:58` |
 | `artifactVerificationEnvelopeDigest` | function: function artifactVerificationEnvelopeDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { artifactVerificationEnvelopeDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/artifact-verification-envelope.js:50` |
 | `assertPackageManager` | function: function assertPackageManager(manager) | manager | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { assertPackageManager } from "@kungfu-tech/buildchain/core";` | `packages/core/package-manager.js:49` |
-| `assertPublicSurfaceReverseAudit` | function: function assertPublicSurfaceReverseAudit(report) | report | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { assertPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:292` |
+| `assertPublicSurfaceReverseAudit` | function: function assertPublicSurfaceReverseAudit(report) | report | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { assertPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:261` |
 | `auditKfd3Surfaces` | function: function auditKfd3Surfaces({ cwd = process.cwd(), registryPath = "", kinds = [], artifactPath = "", } = {}) | { cwd = process.cwd(), registryPath = "", kinds = [], artifactPath = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { auditKfd3Surfaces } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd3-surface-register.js:547` |
 | `BADGE_BUNDLE_DEFAULT_CLAIMS` | constant: const BADGE_BUNDLE_DEFAULT_CLAIMS | none | value | Import does not declare a throw contract. | none-on-import | `import { BADGE_BUNDLE_DEFAULT_CLAIMS } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:17` |
 | `BADGE_BUNDLE_FACTS_CONTRACT` | constant: const BADGE_BUNDLE_FACTS_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BADGE_BUNDLE_FACTS_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:13` |
@@ -701,7 +701,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `BUILDCHAIN_LOG_SUMMARY_CONTRACT` | constant: const BUILDCHAIN_LOG_SUMMARY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_LOG_SUMMARY_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/logging.js:7` |
 | `BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT` | constant: const BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/diagnostics.js:37` |
 | `BUILDCHAIN_PROCESS_SAMPLE_SUMMARY_CONTRACT` | constant: const BUILDCHAIN_PROCESS_SAMPLE_SUMMARY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_PROCESS_SAMPLE_SUMMARY_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/diagnostics.js:39` |
-| `BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT` | constant: const BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:11` |
+| `BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT` | constant: const BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:12` |
 | `BUILDCHAIN_RELEASE_PASSPORT_PATH` | constant: const BUILDCHAIN_RELEASE_PASSPORT_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_RELEASE_PASSPORT_PATH } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:33` |
 | `BUILDCHAIN_RUNTIME_CONTRACT_WORLD` | constant: const BUILDCHAIN_RUNTIME_CONTRACT_WORLD | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_RUNTIME_CONTRACT_WORLD } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-contract.js:7` |
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:5` |
@@ -738,7 +738,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `collectProcessTreeSnapshot` | function: function collectProcessTreeSnapshot({ rootPid = process.pid, cwd = process.cwd(), platform = process.platform, runCommand = defaultDiagnosticCommandRunner, } = {}) | { rootPid = process.pid, cwd = process.cwd(), platform = process.platform, runCommand = defaultDiagnosticCommandRunner, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectProcessTreeSnapshot } from "@kungfu-tech/buildchain/core";` | `packages/core/diagnostics.js:1029` |
 | `collectPublicationArtifact` | function: function collectPublicationArtifact({ cwd = process.cwd(), sourceSha = "", sourceBundle = true, sourceBundlePath = "", generatedAt = "", manifestPath = "", passportPath = "", } = {}) | { cwd = process.cwd(), sourceSha = "", sourceBundle = true, sourceBundlePath = "", generatedAt = "", manifestPath = "", passportPath = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { collectPublicationArtifact } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-artifact.js:271` |
 | `collectPublicationPackageFacts` | function: function collectPublicationPackageFacts({ cwd = process.cwd(), packageName = "", outputDir = ".buildchain/publication/npm-package", } = {}) | { cwd = process.cwd(), packageName = "", outputDir = ".buildchain/publication/npm-package", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { collectPublicationPackageFacts } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-package.js:74` |
-| `collectPublicSurfaceReverseAudit` | function: function collectPublicSurfaceReverseAudit({ root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {}) | { root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:192` |
+| `collectPublicSurfaceReverseAudit` | function: function collectPublicSurfaceReverseAudit({ root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {}) | { root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:161` |
 | `collectReadmeBadgeFacts` | function: async function collectReadmeBadgeFacts({ cwd = process.cwd() } = {}) | { cwd = process.cwd() } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectReadmeBadgeFacts } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:700` |
 | `collectRunnerDiagnostics` | function: function collectRunnerDiagnostics() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectRunnerDiagnostics } from "@kungfu-tech/buildchain/core";` | `packages/core/diagnostics.js:468` |
 | `collectToolDiagnostics` | function: function collectToolDiagnostics({ cwd = process.cwd(), tools = ["node", "pnpm", "npm", "git", "cmake", "ninja", "ccache", "sccache"] } = {}) | { cwd = process.cwd(), tools = ["node", "pnpm", "npm", "git", "cmake", "ninja", "ccache", "sccache"] } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectToolDiagnostics } from "@kungfu-tech/buildchain/core";` | `packages/core/diagnostics.js:495` |
@@ -845,11 +845,11 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `discoverConfiguredVersionStateFiles` | function: function discoverConfiguredVersionStateFiles(cwd = process.cwd(), loadedConfig = loadBuildchainConfig(cwd)) | cwd = process.cwd(), loadedConfig = loadBuildchainConfig(cwd) | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { discoverConfiguredVersionStateFiles } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-config.js:1428` |
 | `discoverKfdStandards` | function: function discoverKfdStandards() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { discoverKfdStandards } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd.js:464` |
 | `discoverPaperFleet` | function: function discoverPaperFleet(root = process.cwd()) | root = process.cwd() | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { discoverPaperFleet } from "@kungfu-tech/buildchain/core";` | `packages/core/paper-fleet.js:23` |
-| `enumerateActionInputs` | function: function enumerateActionInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateActionInputs } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:122` |
+| `enumerateActionInputs` | function: function enumerateActionInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateActionInputs } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:91` |
 | `enumerateCliCommandsFromBin` | function: function enumerateCliCommandsFromBin({ root = process.cwd(), binPath = "bin/buildchain.mjs", } = {}) | { root = process.cwd(), binPath = "bin/buildchain.mjs", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateCliCommandsFromBin } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-cli.js:93` |
-| `enumerateDocCommandRefs` | function: function enumerateDocCommandRefs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateDocCommandRefs } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:146` |
-| `enumerateSitePages` | function: function enumerateSitePages({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateSitePages } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:137` |
-| `enumerateWorkflowInputs` | function: function enumerateWorkflowInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateWorkflowInputs } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:105` |
+| `enumerateDocCommandRefs` | function: function enumerateDocCommandRefs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateDocCommandRefs } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:115` |
+| `enumerateSitePages` | function: function enumerateSitePages({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateSitePages } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:106` |
+| `enumerateWorkflowInputs` | function: function enumerateWorkflowInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateWorkflowInputs } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:74` |
 | `evaluateBuildchainContractLock` | function: function evaluateBuildchainContractLock({ lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", } = {}) | { lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateBuildchainContractLock } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-contract.js:818` |
 | `evaluateCodeownersAuthority` | function: function evaluateCodeownersAuthority({ source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {}) | { source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateCodeownersAuthority } from "@kungfu-tech/buildchain/core";` | `packages/core/github-governance-authority.js:425` |
 | `evaluateGithubGovernanceSnapshot` | function: function evaluateGithubGovernanceSnapshot({ descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {}) | { descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateGithubGovernanceSnapshot } from "@kungfu-tech/buildchain/core";` | `packages/core/github-governance-authority.js:694` |
@@ -1074,7 +1074,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `resolvePropagationChannel` | function: function resolvePropagationChannel(edge, upstreamChannel) | edge, upstreamChannel | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolvePropagationChannel } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation.js:190` |
 | `resolvePublicationCandidateFile` | function: function resolvePublicationCandidateFile(files = [], candidatePath) | files = [], candidatePath | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { resolvePublicationCandidateFile } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-artifact-candidate.js:23` |
 | `resolveReleasePassportPath` | function: function resolveReleasePassportPath(cwd = process.cwd()) | cwd = process.cwd() | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolveReleasePassportPath } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:92` |
-| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:514` |
+| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:518` |
 | `revokeStableCandidate` | function: function revokeStableCandidate(ledgerInput, versionInput, { reason, actor = "", now = new Date().toISOString() } = {}) | ledgerInput, versionInput, { reason, actor = "", now = new Date().toISOString() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { revokeStableCandidate } from "@kungfu-tech/buildchain/core";` | `packages/core/stable-candidate-ledger.js:185` |
 | `rollbackReleaseActivationTransaction` | function: function rollbackReleaseActivationTransaction(transaction, { toSiteSourceSha, reason } = {}) | transaction, { toSiteSourceSha, reason } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { rollbackReleaseActivationTransaction } from "@kungfu-tech/buildchain/core";` | `packages/core/release-activation-transaction.js:290` |
 | `runLifecycleStage` | function: function runLifecycleStage({ cwd = process.cwd(), loadedConfig, name, stage, env: extraEnv, timeoutMinutes }) | { cwd = process.cwd(), loadedConfig, name, stage, env: extraEnv, timeoutMinutes } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { runLifecycleStage } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-config.js:1380` |
@@ -1146,7 +1146,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-reproducibility.js:869` |
 | `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:124` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain/core";` | `packages/core/release-passport.js:2743` |
-| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:482` |
+| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:486` |
 | `WEB_SURFACE_PRODUCTION_DECISION_CONTRACT` | constant: const WEB_SURFACE_PRODUCTION_DECISION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PRODUCTION_DECISION_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/web-surface-publication-candidate.js:7` |
 | `WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT` | constant: const WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/web-surface-publication-candidate.js:5` |
 | `webSurfacePublicationDigest` | function: function webSurfacePublicationDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { webSurfacePublicationDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/web-surface-publication-candidate.js:21` |
@@ -1568,14 +1568,14 @@ Target: `./packages/core/public-surface-audit.js`. Public symbols: 8.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `assertPublicSurfaceReverseAudit` | function: function assertPublicSurfaceReverseAudit(report) | report | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { assertPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:292` |
-| `BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT` | constant: const BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:11` |
-| `collectPublicSurfaceReverseAudit` | function: function collectPublicSurfaceReverseAudit({ root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {}) | { root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:192` |
-| `enumerateActionInputs` | function: function enumerateActionInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateActionInputs } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:122` |
+| `assertPublicSurfaceReverseAudit` | function: function assertPublicSurfaceReverseAudit(report) | report | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { assertPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:261` |
+| `BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT` | constant: const BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_PUBLIC_SURFACE_AUDIT_CONTRACT } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:12` |
+| `collectPublicSurfaceReverseAudit` | function: function collectPublicSurfaceReverseAudit({ root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {}) | { root = process.cwd(), cliRegistry: suppliedCliRegistry = undefined, workflowRegistry: suppliedWorkflowRegistry = undefined, pageRegistry: suppliedPageRegistry = undefined, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:161` |
+| `enumerateActionInputs` | function: function enumerateActionInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateActionInputs } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:91` |
 | `enumerateCliCommandsFromBin` | function: function enumerateCliCommandsFromBin({ root = process.cwd(), binPath = "bin/buildchain.mjs", } = {}) | { root = process.cwd(), binPath = "bin/buildchain.mjs", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateCliCommandsFromBin } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-cli.js:93` |
-| `enumerateDocCommandRefs` | function: function enumerateDocCommandRefs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateDocCommandRefs } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:146` |
-| `enumerateSitePages` | function: function enumerateSitePages({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateSitePages } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:137` |
-| `enumerateWorkflowInputs` | function: function enumerateWorkflowInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateWorkflowInputs } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:105` |
+| `enumerateDocCommandRefs` | function: function enumerateDocCommandRefs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateDocCommandRefs } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:115` |
+| `enumerateSitePages` | function: function enumerateSitePages({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateSitePages } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:106` |
+| `enumerateWorkflowInputs` | function: function enumerateWorkflowInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateWorkflowInputs } from "@kungfu-tech/buildchain/public-surface-audit";` | `packages/core/public-surface-audit.js:74` |
 
 ## `@kungfu-tech/buildchain/logging`
 
@@ -1911,8 +1911,8 @@ Target: `./packages/core/release-propagation.js`. Public symbols: 25.
 | `RELEASE_PROPAGATION_WORK_STAGES` | constant: const RELEASE_PROPAGATION_WORK_STAGES | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_WORK_STAGES } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-constants.js:4` |
 | `repairReleasePropagationWork` | function: function repairReleasePropagationWork({ work, expectedWorkRoot, receipt } = {}) | { work, expectedWorkRoot, receipt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { repairReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-transitions.js:88` |
 | `resolvePropagationChannel` | function: function resolvePropagationChannel(edge, upstreamChannel) | edge, upstreamChannel | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolvePropagationChannel } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:190` |
-| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:514` |
-| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:482` |
+| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:518` |
+| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:486` |
 | `writeReleasePropagationLock` | function: function writeReleasePropagationLock({ plan, target = "", cwd = process.cwd(), output = "" } = {}) | { plan, target = "", cwd = process.cwd(), output = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { writeReleasePropagationLock } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:316` |
 
 ## `@kungfu-tech/buildchain/release-activation-transaction`

package/docs/release-governance.md

@@ -575,6 +575,38 @@ context shape into the other. Consumer repositories can keep their context
 stable while changing the actual verification command declaratively in
 `buildchain.toml`:
 
+Before a release caller is merged, consumers should also verify its exact
+reusable-workflow call contract. The checker reads the caller and an already
+checked-out exact Buildchain commit; it never resolves a floating ref or starts
+a release. It rejects unknown or missing inputs and secrets, literal type
+drift, insufficient permissions, untrusted event classes, and a caller pin that
+does not equal the checked callee commit. Defaults, workflow bytes, and the
+complete interface are bound into `contractRoot`; the receipt additionally
+binds the caller commit/tree and both workflow digests.
+
+```sh
+node .buildchain/workflow-contract-runtime/scripts/workflow-call-contract.mjs check \
+  --caller-root . \
+  --caller-workflow .github/workflows/release-new-version.yml \
+  --caller-repository kungfu-systems/example \
+  --job promote \
+  --callee-root .buildchain/workflow-contract-runtime \
+  --callee-workflow .github/workflows/release-candidate-promote.yml \
+  --callee-repository kungfu-systems/buildchain \
+  --trusted-event workflow_dispatch \
+  --trusted-event pull_request:closed \
+  --expected-contract-root "$(cat .buildchain/release-call-contract-root)" \
+  --output .buildchain/workflow-call-receipts/release-new-version.json
+```
+
+The checkout at `.buildchain/workflow-contract-runtime` must use the same
+40-character SHA written in the caller's `uses:` edge. To accept an intentional
+contract change, first run without `--expected-contract-root`, review the full
+diagnostic and exact coordinates, then replace only the committed root. The
+ordinary PR check runs this command before any candidate or promotion dispatch.
+Local pre-commit rehearsal may add `--allow-dirty`; that result is marked
+`receiptReusable: false` and cannot replace the clean exact-source receipt.
+
 ```toml
 [lifecycle.install]
 command = "cargo fetch --locked"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.5-alpha.4",
+  "version": "3.0.5-alpha.6",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/public-surface-audit.js

@@ -5,6 +5,7 @@ import {
   commandId,
   enumerateCliCommandsFromBin,
 } from "./public-surface-cli.js";
+import { parseReusableWorkflowInterface } from "./workflow-yaml-contract.js";
 
 export { enumerateCliCommandsFromBin } from "./public-surface-cli.js";
 
@@ -46,38 +47,6 @@ function listDirectories(root, dir) {
     .sort();
 }
 
-function parseYamlWorkflowCall(text) {
-  const lines = text.split(/\r?\n/);
-  const result = { reusable: false, inputs: [], secrets: [], outputs: [] };
-  const workflowCallIndex = lines.findIndex((line) => /^(\s*)workflow_call:\s*$/.test(line));
-  if (workflowCallIndex === -1) return result;
-  result.reusable = true;
-  const workflowCallIndent = lines[workflowCallIndex].match(/^(\s*)/)?.[1].length || 0;
-  let section = "";
-  for (const line of lines.slice(workflowCallIndex + 1)) {
-    const currentIndent = line.match(/^(\s*)/)?.[1].length || 0;
-    if (line.trim() && currentIndent <= workflowCallIndent) break;
-    const sectionMatch = line.match(new RegExp(`^\\s{${workflowCallIndent + 2}}(inputs|secrets|outputs):\\s*$`));
-    if (sectionMatch) {
-      section = sectionMatch[1];
-      continue;
-    }
-    if (line.trim() && currentIndent <= workflowCallIndent + 2) {
-      section = "";
-      continue;
-    }
-    if (!section) continue;
-    const fieldMatch = line.match(new RegExp(`^\\s{${workflowCallIndent + 4}}([A-Za-z0-9_-]+):\\s*$`));
-    if (fieldMatch) result[section].push(fieldMatch[1]);
-  }
-  return {
-    reusable: result.reusable,
-    inputs: uniqueSorted(result.inputs),
-    secrets: uniqueSorted(result.secrets),
-    outputs: uniqueSorted(result.outputs),
-  };
-}
-
 function parseYamlTopLevelInputs(text) {
   const lines = text.split(/\r?\n/);
   const inputs = [];
@@ -104,14 +73,14 @@ function parseYamlTopLevelInputs(text) {
 
 export function enumerateWorkflowInputs({ root = process.cwd() } = {}) {
   return listFiles(root, ".github/workflows", (name) => /\.ya?ml$/.test(name)).map((relPath) => {
-    const contract = parseYamlWorkflowCall(readText(root, relPath));
+    const contract = parseReusableWorkflowInterface(readText(root, relPath));
     return {
       id: relPath.replace(/^\.github\/workflows\//, "").replace(/\.ya?ml$/, ""),
       path: relPath,
       reusable: contract.reusable,
-      inputs: contract.inputs,
+      inputs: contract.inputs.map((entry) => entry.name),
       inputCount: contract.inputs.length,
-      secrets: contract.secrets,
+      secrets: contract.secrets.map((entry) => entry.name),
       secretCount: contract.secrets.length,
       outputs: contract.outputs,
       outputCount: contract.outputs.length,

package/packages/core/release-propagation-work.js

@@ -317,8 +317,12 @@ function verifyWorkRelease(work) {
     downstream.executionProfile,
     "release propagation work downstream.executionProfile",
   );
-  if (!profile
-      || JSON.stringify(profile) !== JSON.stringify(downstream.releaseLock.downstream.executionProfile)) {
+  const lockedProfile = normalizeExecutionProfile(
+    downstream.releaseLock.downstream.executionProfile,
+    "release propagation work releaseLock.downstream.executionProfile",
+  );
+  if (!profile || !lockedProfile
+      || sha256Json(profile) !== sha256Json(lockedProfile)) {
     throw new Error("release propagation work execution profile disagrees with the exact release lock");
   }
   return { downstream, profile };
@@ -400,7 +404,7 @@ function verifyWorkPlanAndState(work, downstream, profile) {
     downstream.branch,
     downstream.baseRef,
   );
-  if (JSON.stringify(plan.commands) !== JSON.stringify(expectedCommands)) {
+  if (sha256Json(plan.commands) !== sha256Json(expectedCommands)) {
     throw new Error("release propagation work commands are not canonical");
   }
   const state = assertExactFields(