@kungfu-tech/buildchain 3.0.5 → 3.0.6-alpha.0

package/dist/site/workflow-registry.json

@@ -126,6 +126,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "checkout-history-mode",
         "compiler-cache-platforms-json",
         "compiler-cache-provider",
         "compiler-cache-required",
@@ -147,6 +148,8 @@
         "linux-container-preset",
         "node-version",
         "platforms-json",
+        "pre-upload-transport-smoke-artifact-root",
+        "pre-upload-transport-smoke-scenario-path",
         "process-sample-interval-ms",
         "process-summary-path",
         "publish-anchor-request-json",
@@ -175,7 +178,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 82,
+      "inputCount": 85,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -268,6 +271,48 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": ".declarative-auditable-demo",
+      "path": ".github/workflows/.declarative-auditable-demo.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-retention-days",
+        "binary-artifact-digest",
+        "binary-artifact-name",
+        "buildchain-repository",
+        "materialize",
+        "materialize-base-ref",
+        "media-profile",
+        "render-media",
+        "renderer-image",
+        "scenario-path",
+        "source-ref"
+      ],
+      "inputCount": 11,
+      "secrets": [
+        "DEMO_UPDATE_TOKEN"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "capture-artifact-digest",
+        "capture-artifact-name",
+        "evidence-artifact-digest",
+        "evidence-artifact-name",
+        "publication-pr-url",
+        "source-sha"
+      ],
+      "outputCount": 6,
+      "surface": "declarative-auditable-demo",
+      "capabilityGroup": "api-cli-reference",
+      "status": "preview",
+      "owner": "buildchain-workflows",
+      "maturity": "preview",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": ".gate-profile",
       "path": ".github/workflows/.gate-profile.yml",
@@ -1050,6 +1095,27 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "auditable-demo",
+      "path": ".github/workflows/auditable-demo.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "binary-distribution",
       "path": ".github/workflows/binary-distribution.yml",
@@ -1155,6 +1221,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "checkout-history-mode",
         "compiler-cache-platforms-json",
         "compiler-cache-provider",
         "compiler-cache-required",
@@ -1176,6 +1243,8 @@
         "linux-container-preset",
         "node-version",
         "platforms-json",
+        "pre-upload-transport-smoke-artifact-root",
+        "pre-upload-transport-smoke-scenario-path",
         "process-sample-interval-ms",
         "process-summary-path",
         "publish-anchor-request-json",
@@ -1204,7 +1273,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 85,
+      "inputCount": 88,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1534,12 +1603,14 @@
       "reusable": true,
       "inputs": [
         "alpha-workflow-path",
+        "auto-merge",
         "buildchain-ref",
         "buildchain-repository",
         "create-pull-request",
         "dev-workflow-path",
         "dry-run",
         "max-age-seconds",
+        "merge-method",
         "pull-request-body-prefix",
         "pull-request-body-prefix-renderer",
         "reactivation-authorized",
@@ -1547,7 +1618,7 @@
         "source-branch",
         "target-branch"
       ],
-      "inputCount": 13,
+      "inputCount": 15,
       "secrets": [
         "promotion-token"
       ],
@@ -1641,6 +1712,48 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "dev-qualification-patrol",
+      "path": ".github/workflows/dev-qualification-patrol.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "buildchain-repository",
+        "dev-workflow-path",
+        "dispatch-inputs-json",
+        "dry-run",
+        "max-attempts",
+        "mutation-authorized",
+        "preflight-workflow-path",
+        "priority-workflows-json",
+        "source-branch"
+      ],
+      "inputCount": 10,
+      "secrets": [
+        "qualification-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "action",
+        "active-run-id",
+        "decision-root",
+        "pending-sha",
+        "reason",
+        "source-sha",
+        "state"
+      ],
+      "outputCount": 7,
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "github-artifact-attestation",
       "path": ".github/workflows/github-artifact-attestation.yml",
@@ -2424,6 +2537,7 @@
         "hold",
         "hold-reason",
         "ledger-ref",
+        "merge-method",
         "minimum-soak-seconds",
         "release-now",
         "required-checks",
@@ -2431,7 +2545,7 @@
         "revoked-versions",
         "target-branch"
       ],
-      "inputCount": 15,
+      "inputCount": 16,
       "secrets": [
         "approval-token",
         "promotion-token"

package/docs/MAP.md

@@ -84,7 +84,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Git/source/version/module/product build facts | `dist/site/node-api-registry.json`, `dist/site/cli-registry.json`, `kungfu-buildchain-module-build-facts`, `kungfu-buildchain-product-build-facts` | [`build-facts.md`](build-facts.md) |
 | GitHub Release passport/evidence publication | `dist/site/release-model.json`, `dist/site/artifact-schemas.json` | [`release-governance.md`](release-governance.md), [`release-candidate.md`](release-candidate.md) |
 | GitHub ownership, effective protection, plan capability, and managed-zone governance receipts | `dist/site/node-api-registry.json`, `dist/site/cli-registry.json`, `kungfu-buildchain-github-governance-receipt` | [`github-governance-authority.md`](github-governance-authority.md) |
-| release propagation for package/publication/site chains | `dist/site/release-model.json` | [`release-propagation.md`](release-propagation.md) |
+| release propagation and the unified Paper/KFD/Buildchain/Core Site agent entry | `dist/site/release-model.json`, `dist/site/cli-registry.json`, `dist/site/node-api-registry.json` | [`release-propagation.md`](release-propagation.md) |
 | publication artifact manifests, immutable archive registries, source bundles, and paper repository workflows | `dist/site/publication-registry.json`, `dist/site/workflow-registry.json`, `dist/site/node-api-registry.json`, `kungfu-buildchain-publication-artifact-manifest`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md) |
 | Generated badge bundles, README badge blocks, and badge facts | `dist/site/node-api-registry.json`, `dist/site/manual-registry.json`, `kungfu-buildchain-badge-bundle-facts`, `kungfu-buildchain-readme-badge-facts` | [`readme-badges.md`](readme-badges.md) |
 | Homebrew tap distribution indexes | `dist/site/node-api-registry.json`, `dist/site/buildchain-contract.json` | [`homebrew.md`](homebrew.md) |
@@ -111,6 +111,7 @@ replace them.
 | Why does Buildchain use branch-driven release governance? | [`release-governance.md`](release-governance.md) | why | stable |
 | How do protected dev branches and scheduled ready-PR merging work? | [`release-governance.md`](release-governance.md#protected-dev-branches) | use | stable |
 | How do slow required checks land reliably on a busy dev channel? | [`release-governance.md`](release-governance.md#protected-dev-branches) + [`cli.md`](cli.md#commands) | use | preview |
+| How do I coalesce rapid Dev changes, preserve release runner priority, and retry only transient failed jobs? | [`dev-qualification-patrol.md`](dev-qualification-patrol.md) | use/verify | preview |
 | How do I run daily, weekly, or monthly repository patrols? | [`release-governance.md`](release-governance.md#buildchain-patrol) | use | stable |
 | How does Buildchain decide patch, minor, and major release lines? | [`versioning.md`](versioning.md) | why | stable |
 | What exact branch/tag state machine runs on alpha, release, and major gate? | [`release-flow.md`](release-flow.md) | verify | stable |
@@ -176,6 +177,8 @@ replace them.
 - **protected dev branches / scheduled ready-PR merge / daily-weekly-monthly patrol** ->
   [`release-governance.md`](release-governance.md#protected-dev-branches) and
   [`release-governance.md`](release-governance.md#buildchain-patrol).
+- **Dev qualification coalescing / release-priority runners / failed-job retry** ->
+  [`dev-qualification-patrol.md`](dev-qualification-patrol.md).
 - **pnpm / npm / yarn / package-manager adapters** ->
   [`lifecycle-protocol.md`](lifecycle-protocol.md).
 - **pip / Conan / CMake / custom commands** -> [`lifecycle-protocol.md`](lifecycle-protocol.md)

package/docs/auditable-demo.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-07-31
+last_reviewed: 2026-08-02
 ai_provenance:
   model_family: GPT-5
   product: Codex
-  generated_at: 2026-07-31
+  generated_at: 2026-08-02
   invisible_context_boundary: No hidden model build, parameter count, or private corpus is asserted.
 ---
 
@@ -30,6 +30,84 @@ The public reusable workflow is
 does not know how a Kungfu, library, service, or application artifact should be
 interpreted. The consumer owns a small checked-in executable adapter.
 
+For standalone binary CLIs, the higher-level first-class surface is
+`.github/workflows/.declarative-auditable-demo.yml`. A consumer checks in only
+`.buildchain/auditable-demo.json`, builds and uploads its exact same-run binary
+plus metadata, and passes the producer-owned artifact name and digest to that
+workflow. Buildchain then owns capture, Gate adaptation, independent native
+1080p and 720p rendering, Release Passport construction, content-addressed
+materialization, and the protected README update pull request. No
+product-specific capture, adapter, passport, or materializer is required.
+
+## Declarative Standalone Binary Scenarios
+
+The schema is `contracts/auditable-demo-scenario-v1.schema.json`. One scenario
+can declare up to eight demos, and each demo can contain up to twelve ordered
+literal argv steps. Steps in one demo share a disposable workspace; separate
+demos and the two rendition captures do not. Commands are never accepted as a
+shell string. An omitted or explicit `standard` duration class remains bounded
+to 60 seconds. A reviewed `execution.durationClass: long-form` declaration may
+raise the scenario and literal step ceilings to 180 seconds; it does not change
+the default. Both classes retain 4 MiB per step, a clean Home/XDG environment,
+no inherited credentials, and a network-disabled read-only container with
+bounded tmpfs.
+
+The uploaded metadata must bind the executable SHA-256, declare an empty
+runtime dependency set, and provide a bounded `executableFiles` array of exact
+artifact-relative paths and SHA-256 digests. GitHub Artifact transport does not
+retain Unix executable modes, so Buildchain restores mode `0755` only for this
+digest-verified executable closure and verifies the same closure again inside
+the network-disabled capture boundary. It never recursively changes artifact
+modes. This metadata controls assembly only and grants no execution,
+publication, or identity authority. Capture rejects an artifact name or upload
+digest that does not resolve to exactly one live artifact from the current workflow run.
+
+Consumers may also declare one bounded, non-interactive `transportSmoke` argv
+in the same scenario and opt the reusable build into
+`pre-upload-transport-smoke-scenario-path`. Before any GitHub Artifact or S3
+relay upload, Buildchain copies the exact distribution directory, removes Unix
+execute bits to simulate transport, restores only the digest-bound executable
+closure, and runs that real binary with a clean Home/XDG environment. A missing
+launcher, runtime, or embedded interpreter therefore fails before the expensive
+upload begins. This is a transport diagnostic with no authority grants; the
+later network-disabled capture and Gate remain the qualification authority.
+It retains ANSI terminal bytes with the real PTY read timestamps, verifies
+declared stdout and JSON file facts, enforces the total deadline while a step is
+running, and removes the disposable workspace before emitting evidence.
+
+Both manual validation and alpha or release refreshes call the same reusable
+workflow. Manual callers select Gate-only or full rendering and can explicitly
+request a materialization PR. Release callers select full rendering and the
+same materializer automatically; there is no separate release-only recording
+implementation. Publication requires a dedicated update token and target
+branch. The token is an explicit bounded capability, while actor identity,
+first-party/System classification, KFD compliance, Product System metadata,
+package metadata, registry history, scans, and generated evidence grant no
+authority.
+
+```yaml
+jobs:
+  demo:
+    needs: exact-binary
+    uses: kungfu-systems/buildchain/.github/workflows/.declarative-auditable-demo.yml@BUILDCHAIN_EXACT_SHA
+    with:
+      source-ref: ${{ github.sha }}
+      binary-artifact-name: ${{ needs.exact-binary.outputs.artifact-name }}
+      binary-artifact-digest: ${{ needs.exact-binary.outputs.artifact-digest }}
+      scenario-path: .buildchain/auditable-demo.json
+      renderer-image: ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:RENDERER_DIGEST
+      render-media: true
+      media-profile: responsive-web-delivery-v1
+      materialize: true
+      materialize-base-ref: dev/v1/v1.0
+    secrets:
+      DEMO_UPDATE_TOKEN: ${{ secrets.DEMO_UPDATE_TOKEN }}
+```
+
+Buildchain recursively consumes this surface in
+`.github/workflows/auditable-demo.yml` using its own exact standalone binary
+and the beginner bootstrap scenario in `.buildchain/auditable-demo.json`.
+
 ## Authority Boundary
 
 The retained build output is authoritative. The adapter reads that exact
@@ -42,9 +120,10 @@ scene.json
 ```
 
 It may additionally emit one declared `terminal-capture.json` using
-`kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds,
+`kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds by
+default or 180 seconds only when its scene explicitly declares `long-form`,
 fixed 80-200 by 24-80 terminal cells, 10,000 events, and 4 MiB of canonical
-base64 bytes. It must contain a passed completion sentinel and an explicitly
+base64 bytes. It must contain a qualified completion sentinel and an explicitly
 empty authority-grant list. Existing three-file adapters remain valid.
 
 The completion sentinel names a consumer-owned versioned schema, the exact
@@ -151,6 +230,7 @@ shell fragments, arbitrary profile paths, or transcoding instructions.
 | `archive-v1` | Default compatibility contract. Retains the exact renderer outputs and classifies GIF as README compatibility evidence without making a browser-delivery claim. |
 | `web-delivery-v1` | Independently qualifies H.264 MP4 and VP9 WebM playback sources, forbids audio, requires exact scene dimensions and bounded duration/frame-rate drift, checks per-rendition byte ceilings, and proves MP4 `moov` precedes `mdat`. PNG remains the lossless evidence poster. |
 | `responsive-web-delivery-v1` | Extends `web-delivery-v1` with exact 1280x720 H.264 MP4 and VP9 WebM responsive sources plus a 1280x720 README GIF while keeping the primary MP4/WebM and evidence poster at the source scene dimensions. Every declared downscale must preserve the scene aspect ratio and may never upscale. |
+| `responsive-long-form-web-delivery-v1` | Extends the responsive profile for explicitly admitted long-form scenes. Its measured-baseline multipliers raise only the GIF ceiling to 8 MiB and the four video ceilings to 4 MiB; all codec, native-resolution, no-audio, duration, and authority checks remain unchanged. |
 | `site-hero-v1` | Extends `web-delivery-v1` and additionally requires a qualified WebP browser poster. The current Build Images v1 renderer does not emit that member, so selecting this profile fails closed until the producer adds it. |
 
 For web-delivery profiles, Buildchain runs its own fixed `ffprobe` invocation
@@ -185,8 +265,10 @@ Initial byte ceilings are derived from the checked-in
 `auditable-demo-web-delivery-v1` fixture rendered by Build Images
 `v1.3.0-alpha.16` at its exact source SHA and image digest. GIF, MP4, WebM, and
 PNG ceilings are the next power of two above sixteen times the measured member
-bytes. The not-yet-produced WebP poster uses eight times the measured lossless
-PNG as its conservative proxy. The path-scoped qualification workflow
+bytes. The explicit responsive long-form profile derives its 4 MiB video and
+8 MiB GIF ceilings from the same observed bytes at a bounded 128-times
+multiplier; it does not change another profile. The not-yet-produced WebP poster
+uses eight times the measured lossless PNG as its conservative proxy. The path-scoped qualification workflow
 regenerates the content-addressed evidence and fails on any byte or fact drift.
 Its matrix retains the original 1280x720 web-delivery baseline on the renderer
 that produced it and separately measures the responsive profile against a
@@ -242,7 +324,8 @@ build should always call the reusable workflow. Selection policy changes only
 
 Use `web-delivery-v1` only when the rendered bundle is intended to become a
 qualified web-delivery source. Use `site-hero-v1` when an optimized browser
-poster is also required. Profile qualification does not prove browser playback,
+poster is also required. Select `responsive-long-form-web-delivery-v1` only
+with an explicit long-form scenario. Profile qualification does not prove browser playback,
 responsive layout, reduced-motion behavior, accessibility, or production
 deployment; those remain site responsibilities.
 

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -8,7 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-07-30
+last_reviewed: 2026-08-02
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-01
+  invisible_information: No hidden model checkpoint, parameters, or private training data were available.
 ---
 
 # AWS US elastic runner burst plane
@@ -138,14 +143,16 @@ The source-bound evidence and deterministic phase receipt are:
 
 The Windows phase uses the explicit `aws-us-ec2-windows-jit` runner preset.
 Its caller supplies one bounded label under
-`aws-us-ec2-windows-jit-<qualification-id>`, and Buildchain resolves exactly
-one Windows x64 native lane. The reusable trust gate still runs on a
-GitHub-hosted runner before the JIT label can select EC2.
+`aws-us-ec2-windows-jit-<campaign-id>-<qualification-id>`, and Buildchain
+resolves exactly one Windows x64 native lane. The reusable trust gate still
+runs on a GitHub-hosted runner before the JIT label can select EC2.
 
 The provider creates repository-level GitHub JIT configuration for
 `kungfu-systems/kungfu`. Its `labels` request must contain all four scheduling
 labels: `self-hosted`, `Windows`, `X64`, and the card-scoped
-`aws-us-ec2-windows-jit-<qualification-id>` label. GitHub's JIT endpoint does
+`aws-us-ec2-windows-jit-<campaign-id>-<qualification-id>` label. The workflow
+display title also carries both identities, allowing the launch controller to
+verify the queued run against its campaign plan. GitHub's JIT endpoint does
 not infer the default OS and architecture labels when they are omitted. The
 encoded configuration is never placed in EC2 user data, a tag, a command log,
 or an artifact. The operator writes it to a card-scoped SSM SecureString under
@@ -168,21 +175,123 @@ Each runner uses:
   security-group rule, no key pair, and no warm Auto Scaling capacity.
 
 Runner diagnostics and a redacted lifecycle record are uploaded to the
-provider's encrypted, private evidence bucket. The runner process exits after
-one job, Windows shuts down, and EC2's instance-initiated shutdown behavior is
-set to `terminate`. A five-minute reaper terminates card-owned stopped or
+provider's encrypted, private evidence bucket under the exact campaign, run,
+attempt, and instance identity. The runner process exits after one job, Windows
+shuts down, and EC2's instance-initiated shutdown behavior is set to
+`terminate`. A five-minute reaper terminates card-owned stopped or
 three-hour-old instances and deletes only their dedicated JIT parameter.
 
 At the 2026-07-29 AWS Price List rate of USD 1.45 per Windows
-`c7i.4xlarge` hour, six accepted three-hour instances reserve USD 26.10. The
-two-instance race envelope reserves another USD 8.70, producing a USD 34.80
-worst case below the dedicated USD 40 budget. Budget notifications at 80% and
-95% invoke the same card-scoped global kill switch.
+`c7i.4xlarge` hour, each accepted instance reserves its complete three-hour
+USD 4.35 fail-closed lifetime before `RunInstances`. A DynamoDB transaction
+binds the exact campaign and source, creates an idempotent run ledger entry,
+and atomically refuses a sixth accepted instance. Five accepted instances
+therefore reserve at most USD 21.75. The campaign also persists the
+operator-observed spend from earlier Windows work, and refuses to arm unless
+that baseline, all five reservations, and one USD 4.35 fail-closed race
+allowance remain below the USD 80 phase cap.
+
+The campaign starts unarmed and expires within 24 hours. Its `CONTROL` record
+can be created only once: a killed or expired campaign cannot be re-armed by
+the campaign tool. A budget notification or any instance lifetime violation
+persists `KILLED` before cleanup, so later workflow dispatches fail before a
+paid launch. Reservations are never refunded: a controller crash, ambiguous
+launch, or successful launch all remain charged to the campaign, favoring a
+false stop over an accidental budget overrun.
+
+Each stack owns a stack-scoped reaper log group, so an independent retained
+one-shot campaign stack can be created without colliding with another
+campaign's audit log resource.
+
+The tag-filtered AWS Budget is defense in depth, not the authoritative launch
+gate. It is disabled by default because a linked account cannot activate a
+cost-allocation tag. Set `EnableTagFilteredBudget=true` only after the AWS
+Organizations management account has activated `kungfu:provider` and a Cost
+Explorer readback proves that `windows-ec2-jit` spend is visible. The DynamoDB
+reservation cap remains mandatory in either mode.
+
+Qualification requires one runner-profile smoke and three trusted exact-source
+full Windows jobs all bound to the same campaign, independent cancellation and
+timeout cleanup exercises, and zero repository runner, EC2 instance,
+disposable volume, min capacity, and desired capacity within 15 minutes of the
+final job.
+
+### Phase 2 campaign controller
+
+`scripts/aws-windows-jit-campaign.mjs` is the one-shot operator boundary.
+Without a mutation mode it emits the arm plan. `arm-campaign` requires the
+campaign id, exact source SHA, state table, observed prior phase spend, and a
+bounded one-to-five accepted-instance ceiling to be repeated as confirmations,
+then creates `CONTROL` and `CAMPAIGN#<id>` with
+`attribute_not_exists`
+conditions. DynamoDB therefore refuses a second campaign in the same retained
+state table. The operator can always use `kill-campaign`; there is deliberately
+no clear or re-arm operation.
+
+Every `scripts/aws-windows-jit-controller.mjs --execute` call must provide the
+same `--campaign-id`, `--confirm-campaign-id`, `--state-table`, and
+`--confirm-state-table`. After the GitHub, AMI, active-instance, SSM, and EC2
+DryRun checks pass, the controller
+atomically reserves one run. Duplicate run-attempt-qualification identities,
+source mismatch, expiry, `KILLED`, the sixth accepted instance, or a
+reservation that would exceed the baseline-adjusted USD 80 phase ceiling all
+fail closed before `RunInstances`.
+
+Example dry-run and arm boundary (do not execute without a new campaign budget
+decision):
 
-Qualification requires one runner-profile smoke, three trusted exact-source
-full Windows jobs, independent cancellation and timeout cleanup exercises, and
-zero repository runner, EC2 instance, disposable volume, min capacity, and
-desired capacity within 15 minutes of the final job.
+```bash
+windows_campaign=win-REPLACE_WITH_CAMPAIGN_ID
+windows_source=REPLACE_WITH_EXACT_40_CHARACTER_SHA
+windows_state_table=REPLACE_WITH_CAMPAIGN_STATE_TABLE
+windows_expires_at=REPLACE_WITH_ISO_TIMESTAMP_WITHIN_24_HOURS
+windows_phase_spend_baseline_usd=REPLACE_WITH_OBSERVED_PRIOR_WINDOWS_SPEND
+windows_max_accepted_instances=REPLACE_WITH_INTEGER_FROM_1_THROUGH_5
+
+node scripts/aws-windows-jit-campaign.mjs plan-arm \
+  --campaign-id "$windows_campaign" \
+  --source-sha "$windows_source" \
+  --state-table "$windows_state_table" \
+  --expires-at "$windows_expires_at" \
+  --phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
+  --max-accepted-instances "$windows_max_accepted_instances"
+
+node scripts/aws-windows-jit-campaign.mjs arm-campaign \
+  --campaign-id "$windows_campaign" \
+  --confirm-campaign-id "$windows_campaign" \
+  --source-sha "$windows_source" \
+  --confirm-source-sha "$windows_source" \
+  --state-table "$windows_state_table" \
+  --confirm-state-table "$windows_state_table" \
+  --expires-at "$windows_expires_at" \
+  --phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
+  --confirm-phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
+  --max-accepted-instances "$windows_max_accepted_instances" \
+  --confirm-max-accepted-instances "$windows_max_accepted_instances"
+```
+
+Arming creates a permanent one-shot control record and admits only the
+explicitly confirmed number of paid instances, never more than five. Its
+rollback is fail-closed, not deletion: `kill-campaign` first
+persists `KILLED`, then publishes to the dedicated SNS topic so the reaper
+terminates active card-owned instances and removes their JIT parameters. The
+command is idempotent, but the operator must read back DynamoDB, EC2, SSM, and
+GitHub runners before treating cleanup as complete:
+
+```bash
+windows_kill_topic=REPLACE_WITH_DEDICATED_KILL_SWITCH_TOPIC_ARN
+
+node scripts/aws-windows-jit-campaign.mjs kill-campaign \
+  --campaign-id "$windows_campaign" \
+  --confirm-campaign-id "$windows_campaign" \
+  --source-sha "$windows_source" \
+  --confirm-source-sha "$windows_source" \
+  --state-table "$windows_state_table" \
+  --confirm-state-table "$windows_state_table" \
+  --kill-switch-topic "$windows_kill_topic" \
+  --confirm-kill-switch-topic "$windows_kill_topic" \
+  --reason operator-kill
+```
 
 ## Phase 3 contract
 
@@ -226,6 +335,32 @@ host, including at least one full run, plus proof that:
 - AWS has no active campaign instance or allocated campaign host;
 - actual incremental spend remained below USD 25.
 
+### Phase 3 lifecycle controller
+
+`scripts/aws-macos-jit-controller.mjs` is the operator boundary for the paid
+campaign. It has three explicit mutation modes:
+
+- `launch-campaign` binds the exact repository source, AMI, availability zone,
+  tagged Dedicated Host, and reusable instance. It rejects pre-existing Mac
+  capacity and requires successful `AllocateHosts` and `RunInstances` DryRuns
+  before either real call.
+- `run-job` binds one queued exact-source GitHub job to the existing campaign
+  host and instance. It writes the repository JIT configuration through a
+  mode-0600 temporary file into a distinct SSM SecureString, sends only the
+  credential-free bootstrap through SSM, and removes the parameter plus runner
+  registration if command delivery fails.
+- `close-campaign` refuses execution before the provider's 24-hour minimum,
+  verifies the encrypted delete-on-termination root volume, removes scoped JIT
+  residue, terminates the exact instance, and requires a `ReleaseHosts` DryRun
+  before release. If Apple host scrubbing is still in progress, it reports
+  `release-pending`; the ten-minute card-scoped reaper remains the bounded
+  retry path.
+
+Every execute mode requires the exact source SHA and campaign id to be repeated
+through `--confirm-source-sha` and `--confirm-campaign-id`. `run-job` also
+requires `--confirm-run-id`. Omitting `--execute` emits a deterministic plan
+without changing AWS or GitHub state.
+
 ## Provider lifecycle
 
 The three infrastructure templates live under

package/docs/cli-reference.md

@@ -1668,6 +1668,28 @@ buildchain release-governance reconcile --repository <owner/repo> --branch <dev|
 buildchain release-propagation
 ```
 
+### `buildchain release-propagation entry`
+
+- Help: `buildchain release-propagation entry --help`
+- Canonical id: `release-propagation`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
+```
+
+### `buildchain release-propagation pickup`
+
+- Help: `buildchain release-propagation pickup --help`
+- Canonical id: `release-propagation`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
+```
+
 ### `buildchain release-propagation plan`
 
 - Help: `buildchain release-propagation plan --help`
@@ -1676,7 +1698,18 @@ buildchain release-propagation
 - Syntax:
 
 ```text
-buildchain release-propagation <plan|write-lock> ...
+buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
+```
+
+### `buildchain release-propagation work`
+
+- Help: `buildchain release-propagation work --help`
+- Canonical id: `release-propagation`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
 ```
 
 ### `buildchain release-propagation write-lock`
@@ -1687,7 +1720,7 @@ buildchain release-propagation <plan|write-lock> ...
 - Syntax:
 
 ```text
-buildchain release-propagation <plan|write-lock> ...
+buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
 ```
 
 ## `sample`