@kungfu-tech/buildchain 3.0.5 → 3.0.6-alpha.1

package/dist/site/workflow-registry.json

@@ -126,6 +126,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "checkout-history-mode",
         "compiler-cache-platforms-json",
         "compiler-cache-provider",
         "compiler-cache-required",
@@ -147,6 +148,8 @@
         "linux-container-preset",
         "node-version",
         "platforms-json",
+        "pre-upload-transport-smoke-artifact-root",
+        "pre-upload-transport-smoke-scenario-path",
         "process-sample-interval-ms",
         "process-summary-path",
         "publish-anchor-request-json",
@@ -175,7 +178,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 82,
+      "inputCount": 85,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -268,6 +271,48 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": ".declarative-auditable-demo",
+      "path": ".github/workflows/.declarative-auditable-demo.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-retention-days",
+        "binary-artifact-digest",
+        "binary-artifact-name",
+        "buildchain-repository",
+        "materialize",
+        "materialize-base-ref",
+        "media-profile",
+        "render-media",
+        "renderer-image",
+        "scenario-path",
+        "source-ref"
+      ],
+      "inputCount": 11,
+      "secrets": [
+        "DEMO_UPDATE_TOKEN"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "capture-artifact-digest",
+        "capture-artifact-name",
+        "evidence-artifact-digest",
+        "evidence-artifact-name",
+        "publication-pr-url",
+        "source-sha"
+      ],
+      "outputCount": 6,
+      "surface": "declarative-auditable-demo",
+      "capabilityGroup": "api-cli-reference",
+      "status": "preview",
+      "owner": "buildchain-workflows",
+      "maturity": "preview",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": ".gate-profile",
       "path": ".github/workflows/.gate-profile.yml",
@@ -1050,6 +1095,27 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "auditable-demo",
+      "path": ".github/workflows/auditable-demo.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "binary-distribution",
       "path": ".github/workflows/binary-distribution.yml",
@@ -1155,6 +1221,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "checkout-history-mode",
         "compiler-cache-platforms-json",
         "compiler-cache-provider",
         "compiler-cache-required",
@@ -1176,6 +1243,8 @@
         "linux-container-preset",
         "node-version",
         "platforms-json",
+        "pre-upload-transport-smoke-artifact-root",
+        "pre-upload-transport-smoke-scenario-path",
         "process-sample-interval-ms",
         "process-summary-path",
         "publish-anchor-request-json",
@@ -1204,7 +1273,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 85,
+      "inputCount": 88,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1534,12 +1603,14 @@
       "reusable": true,
       "inputs": [
         "alpha-workflow-path",
+        "auto-merge",
         "buildchain-ref",
         "buildchain-repository",
         "create-pull-request",
         "dev-workflow-path",
         "dry-run",
         "max-age-seconds",
+        "merge-method",
         "pull-request-body-prefix",
         "pull-request-body-prefix-renderer",
         "reactivation-authorized",
@@ -1547,7 +1618,7 @@
         "source-branch",
         "target-branch"
       ],
-      "inputCount": 13,
+      "inputCount": 15,
       "secrets": [
         "promotion-token"
       ],
@@ -1610,13 +1681,14 @@
         "landing-mode",
         "max-merges",
         "merge-method",
+        "queue-admission-context",
         "ready-label",
         "require-approval",
         "required-status-checks",
         "same-repository-only",
         "target-branch"
       ],
-      "inputCount": 13,
+      "inputCount": 14,
       "secrets": [
         "github-token"
       ],
@@ -1641,6 +1713,48 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "dev-qualification-patrol",
+      "path": ".github/workflows/dev-qualification-patrol.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "buildchain-repository",
+        "dev-workflow-path",
+        "dispatch-inputs-json",
+        "dry-run",
+        "max-attempts",
+        "mutation-authorized",
+        "preflight-workflow-path",
+        "priority-workflows-json",
+        "source-branch"
+      ],
+      "inputCount": 10,
+      "secrets": [
+        "qualification-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "action",
+        "active-run-id",
+        "decision-root",
+        "pending-sha",
+        "reason",
+        "source-sha",
+        "state"
+      ],
+      "outputCount": 7,
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "github-artifact-attestation",
       "path": ".github/workflows/github-artifact-attestation.yml",
@@ -2424,6 +2538,7 @@
         "hold",
         "hold-reason",
         "ledger-ref",
+        "merge-method",
         "minimum-soak-seconds",
         "release-now",
         "required-checks",
@@ -2431,7 +2546,7 @@
         "revoked-versions",
         "target-branch"
       ],
-      "inputCount": 15,
+      "inputCount": 16,
       "secrets": [
         "approval-token",
         "promotion-token"

package/docs/MAP.md

@@ -84,7 +84,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Git/source/version/module/product build facts | `dist/site/node-api-registry.json`, `dist/site/cli-registry.json`, `kungfu-buildchain-module-build-facts`, `kungfu-buildchain-product-build-facts` | [`build-facts.md`](build-facts.md) |
 | GitHub Release passport/evidence publication | `dist/site/release-model.json`, `dist/site/artifact-schemas.json` | [`release-governance.md`](release-governance.md), [`release-candidate.md`](release-candidate.md) |
 | GitHub ownership, effective protection, plan capability, and managed-zone governance receipts | `dist/site/node-api-registry.json`, `dist/site/cli-registry.json`, `kungfu-buildchain-github-governance-receipt` | [`github-governance-authority.md`](github-governance-authority.md) |
-| release propagation for package/publication/site chains | `dist/site/release-model.json` | [`release-propagation.md`](release-propagation.md) |
+| release propagation and the unified Paper/KFD/Buildchain/Core Site agent entry | `dist/site/release-model.json`, `dist/site/cli-registry.json`, `dist/site/node-api-registry.json` | [`release-propagation.md`](release-propagation.md) |
 | publication artifact manifests, immutable archive registries, source bundles, and paper repository workflows | `dist/site/publication-registry.json`, `dist/site/workflow-registry.json`, `dist/site/node-api-registry.json`, `kungfu-buildchain-publication-artifact-manifest`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md) |
 | Generated badge bundles, README badge blocks, and badge facts | `dist/site/node-api-registry.json`, `dist/site/manual-registry.json`, `kungfu-buildchain-badge-bundle-facts`, `kungfu-buildchain-readme-badge-facts` | [`readme-badges.md`](readme-badges.md) |
 | Homebrew tap distribution indexes | `dist/site/node-api-registry.json`, `dist/site/buildchain-contract.json` | [`homebrew.md`](homebrew.md) |
@@ -111,6 +111,7 @@ replace them.
 | Why does Buildchain use branch-driven release governance? | [`release-governance.md`](release-governance.md) | why | stable |
 | How do protected dev branches and scheduled ready-PR merging work? | [`release-governance.md`](release-governance.md#protected-dev-branches) | use | stable |
 | How do slow required checks land reliably on a busy dev channel? | [`release-governance.md`](release-governance.md#protected-dev-branches) + [`cli.md`](cli.md#commands) | use | preview |
+| How do I coalesce rapid Dev changes, preserve release runner priority, and retry only transient failed jobs? | [`dev-qualification-patrol.md`](dev-qualification-patrol.md) | use/verify | preview |
 | How do I run daily, weekly, or monthly repository patrols? | [`release-governance.md`](release-governance.md#buildchain-patrol) | use | stable |
 | How does Buildchain decide patch, minor, and major release lines? | [`versioning.md`](versioning.md) | why | stable |
 | What exact branch/tag state machine runs on alpha, release, and major gate? | [`release-flow.md`](release-flow.md) | verify | stable |
@@ -151,6 +152,7 @@ replace them.
 | How do I automatically qualify alpha candidates and publish the newest non-revoked qualified candidate at a fixed window? | [`stable-candidate-patrol.md`](stable-candidate-patrol.md) | use | preview |
 | How do I deploy a site/app preview, staging, or production surface? | [`web-surface-deployments.md`](web-surface-deployments.md) | use | stable |
 | How do I publish observed infrastructure contracts for downstream consumers? | [`infra-contract.md`](infra-contract.md) | use | preview |
+| How do I operate a repeatable, disabled-by-default, budget-fail-closed AWS Windows JIT campaign? | [`aws-us-elastic-runner-burst-plane.md`](aws-us-elastic-runner-burst-plane.md#phase-2-operator-workflow) | use/verify | preview |
 | How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md), [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md), [`../actions/github-artifact-attestation/README.md`](../actions/github-artifact-attestation/README.md), [`../actions/macos-credential-island/README.md`](../actions/macos-credential-island/README.md); `dist/site/workflow-registry.json#actions` is authoritative for the six-entry inventory. | use | stable |
 | How can a consumer workflow report a Buildchain-owned failure back to Buildchain? | [`consumer-issue-reporting.md`](consumer-issue-reporting.md) + [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md) | use | stable |
 | What do the fixture repositories demonstrate? | [`../fixtures/libnode-shaped/README.md`](../fixtures/libnode-shaped/README.md), [`../fixtures/publish-transaction-shaped/README.md`](../fixtures/publish-transaction-shaped/README.md), [`../fixtures/web-surface-shaped/README.md`](../fixtures/web-surface-shaped/README.md), [`../fixtures/publication-artifact-shaped/README.md`](../fixtures/publication-artifact-shaped/README.md) | verify | stable |
@@ -176,6 +178,8 @@ replace them.
 - **protected dev branches / scheduled ready-PR merge / daily-weekly-monthly patrol** ->
   [`release-governance.md`](release-governance.md#protected-dev-branches) and
   [`release-governance.md`](release-governance.md#buildchain-patrol).
+- **Dev qualification coalescing / release-priority runners / failed-job retry** ->
+  [`dev-qualification-patrol.md`](dev-qualification-patrol.md).
 - **pnpm / npm / yarn / package-manager adapters** ->
   [`lifecycle-protocol.md`](lifecycle-protocol.md).
 - **pip / Conan / CMake / custom commands** -> [`lifecycle-protocol.md`](lifecycle-protocol.md)

package/docs/auditable-demo.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-07-31
+last_reviewed: 2026-08-02
 ai_provenance:
   model_family: GPT-5
   product: Codex
-  generated_at: 2026-07-31
+  generated_at: 2026-08-02
   invisible_context_boundary: No hidden model build, parameter count, or private corpus is asserted.
 ---
 
@@ -30,6 +30,84 @@ The public reusable workflow is
 does not know how a Kungfu, library, service, or application artifact should be
 interpreted. The consumer owns a small checked-in executable adapter.
 
+For standalone binary CLIs, the higher-level first-class surface is
+`.github/workflows/.declarative-auditable-demo.yml`. A consumer checks in only
+`.buildchain/auditable-demo.json`, builds and uploads its exact same-run binary
+plus metadata, and passes the producer-owned artifact name and digest to that
+workflow. Buildchain then owns capture, Gate adaptation, independent native
+1080p and 720p rendering, Release Passport construction, content-addressed
+materialization, and the protected README update pull request. No
+product-specific capture, adapter, passport, or materializer is required.
+
+## Declarative Standalone Binary Scenarios
+
+The schema is `contracts/auditable-demo-scenario-v1.schema.json`. One scenario
+can declare up to eight demos, and each demo can contain up to twelve ordered
+literal argv steps. Steps in one demo share a disposable workspace; separate
+demos and the two rendition captures do not. Commands are never accepted as a
+shell string. An omitted or explicit `standard` duration class remains bounded
+to 60 seconds. A reviewed `execution.durationClass: long-form` declaration may
+raise the scenario and literal step ceilings to 180 seconds; it does not change
+the default. Both classes retain 4 MiB per step, a clean Home/XDG environment,
+no inherited credentials, and a network-disabled read-only container with
+bounded tmpfs.
+
+The uploaded metadata must bind the executable SHA-256, declare an empty
+runtime dependency set, and provide a bounded `executableFiles` array of exact
+artifact-relative paths and SHA-256 digests. GitHub Artifact transport does not
+retain Unix executable modes, so Buildchain restores mode `0755` only for this
+digest-verified executable closure and verifies the same closure again inside
+the network-disabled capture boundary. It never recursively changes artifact
+modes. This metadata controls assembly only and grants no execution,
+publication, or identity authority. Capture rejects an artifact name or upload
+digest that does not resolve to exactly one live artifact from the current workflow run.
+
+Consumers may also declare one bounded, non-interactive `transportSmoke` argv
+in the same scenario and opt the reusable build into
+`pre-upload-transport-smoke-scenario-path`. Before any GitHub Artifact or S3
+relay upload, Buildchain copies the exact distribution directory, removes Unix
+execute bits to simulate transport, restores only the digest-bound executable
+closure, and runs that real binary with a clean Home/XDG environment. A missing
+launcher, runtime, or embedded interpreter therefore fails before the expensive
+upload begins. This is a transport diagnostic with no authority grants; the
+later network-disabled capture and Gate remain the qualification authority.
+It retains ANSI terminal bytes with the real PTY read timestamps, verifies
+declared stdout and JSON file facts, enforces the total deadline while a step is
+running, and removes the disposable workspace before emitting evidence.
+
+Both manual validation and alpha or release refreshes call the same reusable
+workflow. Manual callers select Gate-only or full rendering and can explicitly
+request a materialization PR. Release callers select full rendering and the
+same materializer automatically; there is no separate release-only recording
+implementation. Publication requires a dedicated update token and target
+branch. The token is an explicit bounded capability, while actor identity,
+first-party/System classification, KFD compliance, Product System metadata,
+package metadata, registry history, scans, and generated evidence grant no
+authority.
+
+```yaml
+jobs:
+  demo:
+    needs: exact-binary
+    uses: kungfu-systems/buildchain/.github/workflows/.declarative-auditable-demo.yml@BUILDCHAIN_EXACT_SHA
+    with:
+      source-ref: ${{ github.sha }}
+      binary-artifact-name: ${{ needs.exact-binary.outputs.artifact-name }}
+      binary-artifact-digest: ${{ needs.exact-binary.outputs.artifact-digest }}
+      scenario-path: .buildchain/auditable-demo.json
+      renderer-image: ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:RENDERER_DIGEST
+      render-media: true
+      media-profile: responsive-web-delivery-v1
+      materialize: true
+      materialize-base-ref: dev/v1/v1.0
+    secrets:
+      DEMO_UPDATE_TOKEN: ${{ secrets.DEMO_UPDATE_TOKEN }}
+```
+
+Buildchain recursively consumes this surface in
+`.github/workflows/auditable-demo.yml` using its own exact standalone binary
+and the beginner bootstrap scenario in `.buildchain/auditable-demo.json`.
+
 ## Authority Boundary
 
 The retained build output is authoritative. The adapter reads that exact
@@ -42,9 +120,10 @@ scene.json
 ```
 
 It may additionally emit one declared `terminal-capture.json` using
-`kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds,
+`kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds by
+default or 180 seconds only when its scene explicitly declares `long-form`,
 fixed 80-200 by 24-80 terminal cells, 10,000 events, and 4 MiB of canonical
-base64 bytes. It must contain a passed completion sentinel and an explicitly
+base64 bytes. It must contain a qualified completion sentinel and an explicitly
 empty authority-grant list. Existing three-file adapters remain valid.
 
 The completion sentinel names a consumer-owned versioned schema, the exact
@@ -151,6 +230,7 @@ shell fragments, arbitrary profile paths, or transcoding instructions.
 | `archive-v1` | Default compatibility contract. Retains the exact renderer outputs and classifies GIF as README compatibility evidence without making a browser-delivery claim. |
 | `web-delivery-v1` | Independently qualifies H.264 MP4 and VP9 WebM playback sources, forbids audio, requires exact scene dimensions and bounded duration/frame-rate drift, checks per-rendition byte ceilings, and proves MP4 `moov` precedes `mdat`. PNG remains the lossless evidence poster. |
 | `responsive-web-delivery-v1` | Extends `web-delivery-v1` with exact 1280x720 H.264 MP4 and VP9 WebM responsive sources plus a 1280x720 README GIF while keeping the primary MP4/WebM and evidence poster at the source scene dimensions. Every declared downscale must preserve the scene aspect ratio and may never upscale. |
+| `responsive-long-form-web-delivery-v1` | Extends the responsive profile for explicitly admitted long-form scenes. Its measured-baseline multipliers raise only the GIF ceiling to 8 MiB and the four video ceilings to 4 MiB; all codec, native-resolution, no-audio, duration, and authority checks remain unchanged. |
 | `site-hero-v1` | Extends `web-delivery-v1` and additionally requires a qualified WebP browser poster. The current Build Images v1 renderer does not emit that member, so selecting this profile fails closed until the producer adds it. |
 
 For web-delivery profiles, Buildchain runs its own fixed `ffprobe` invocation
@@ -185,8 +265,10 @@ Initial byte ceilings are derived from the checked-in
 `auditable-demo-web-delivery-v1` fixture rendered by Build Images
 `v1.3.0-alpha.16` at its exact source SHA and image digest. GIF, MP4, WebM, and
 PNG ceilings are the next power of two above sixteen times the measured member
-bytes. The not-yet-produced WebP poster uses eight times the measured lossless
-PNG as its conservative proxy. The path-scoped qualification workflow
+bytes. The explicit responsive long-form profile derives its 4 MiB video and
+8 MiB GIF ceilings from the same observed bytes at a bounded 128-times
+multiplier; it does not change another profile. The not-yet-produced WebP poster
+uses eight times the measured lossless PNG as its conservative proxy. The path-scoped qualification workflow
 regenerates the content-addressed evidence and fails on any byte or fact drift.
 Its matrix retains the original 1280x720 web-delivery baseline on the renderer
 that produced it and separately measures the responsive profile against a
@@ -242,7 +324,8 @@ build should always call the reusable workflow. Selection policy changes only
 
 Use `web-delivery-v1` only when the rendered bundle is intended to become a
 qualified web-delivery source. Use `site-hero-v1` when an optimized browser
-poster is also required. Profile qualification does not prove browser playback,
+poster is also required. Select `responsive-long-form-web-delivery-v1` only
+with an explicit long-form scenario. Profile qualification does not prove browser playback,
 responsive layout, reduced-motion behavior, accessibility, or production
 deployment; those remain site responsibilities.
 

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -8,7 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-07-30
+last_reviewed: 2026-08-03
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-03
+  invisible_information: No hidden model checkpoint, parameters, or private training data were available.
 ---
 
 # AWS US elastic runner burst plane
@@ -138,14 +143,16 @@ The source-bound evidence and deterministic phase receipt are:
 
 The Windows phase uses the explicit `aws-us-ec2-windows-jit` runner preset.
 Its caller supplies one bounded label under
-`aws-us-ec2-windows-jit-<qualification-id>`, and Buildchain resolves exactly
-one Windows x64 native lane. The reusable trust gate still runs on a
-GitHub-hosted runner before the JIT label can select EC2.
+`aws-us-ec2-windows-jit-<campaign-id>-<qualification-id>`, and Buildchain
+resolves exactly one Windows x64 native lane. The reusable trust gate still
+runs on a GitHub-hosted runner before the JIT label can select EC2.
 
 The provider creates repository-level GitHub JIT configuration for
 `kungfu-systems/kungfu`. Its `labels` request must contain all four scheduling
 labels: `self-hosted`, `Windows`, `X64`, and the card-scoped
-`aws-us-ec2-windows-jit-<qualification-id>` label. GitHub's JIT endpoint does
+`aws-us-ec2-windows-jit-<campaign-id>-<qualification-id>` label. The workflow
+display title also carries both identities, allowing the launch controller to
+verify the queued run against its campaign plan. GitHub's JIT endpoint does
 not infer the default OS and architecture labels when they are omitted. The
 encoded configuration is never placed in EC2 user data, a tag, a command log,
 or an artifact. The operator writes it to a card-scoped SSM SecureString under
@@ -168,21 +175,153 @@ Each runner uses:
   security-group rule, no key pair, and no warm Auto Scaling capacity.
 
 Runner diagnostics and a redacted lifecycle record are uploaded to the
-provider's encrypted, private evidence bucket. The runner process exits after
-one job, Windows shuts down, and EC2's instance-initiated shutdown behavior is
-set to `terminate`. A five-minute reaper terminates card-owned stopped or
+provider's encrypted, private evidence bucket under the exact campaign, run,
+attempt, and instance identity. The runner process exits after one job, Windows
+shuts down, and EC2's instance-initiated shutdown behavior is set to
+`terminate`. A five-minute reaper terminates card-owned stopped or
 three-hour-old instances and deletes only their dedicated JIT parameter.
 
 At the 2026-07-29 AWS Price List rate of USD 1.45 per Windows
-`c7i.4xlarge` hour, six accepted three-hour instances reserve USD 26.10. The
-two-instance race envelope reserves another USD 8.70, producing a USD 34.80
-worst case below the dedicated USD 40 budget. Budget notifications at 80% and
-95% invoke the same card-scoped global kill switch.
+`c7i.4xlarge` hour, each accepted instance reserves its complete three-hour
+USD 4.35 fail-closed lifetime before `RunInstances`. A DynamoDB transaction
+binds the exact campaign and source, creates an idempotent run ledger entry,
+and atomically refuses a sixth accepted instance. Five accepted instances
+therefore reserve at most USD 21.75. The campaign also persists the
+operator-observed spend from earlier Windows work, and refuses to arm unless
+that baseline, all five reservations, and one USD 4.35 fail-closed race
+allowance remain below the USD 110 phase cap.
+
+The campaign starts unarmed and expires within 24 hours. Its `CONTROL` record
+can be created only once: a killed or expired campaign cannot be re-armed by
+the campaign tool. A budget notification or any instance lifetime violation
+persists `KILLED` before cleanup, so later workflow dispatches fail before a
+paid launch. Reservations are never refunded: a controller crash, ambiguous
+launch, or successful launch all remain charged to the campaign, favoring a
+false stop over an accidental budget overrun.
+
+The 2026-08-03 timeout-only campaign decision narrows the campaign to two
+accepted instances with one active instance at a time. The second reservation
+is an operator-gated repair retry: it may be used only after the first attempt
+is classified as non-counting and runner, EC2, EBS, SSM, and workflow residue
+have returned to zero. The two-slot ledger is a maximum spend boundary, not an
+authorization to consume both reservations.
+
+Each stack owns a stack-scoped reaper log group, so an independent retained
+one-shot campaign stack can be created without colliding with another
+campaign's audit log resource.
+
+The tag-filtered AWS Budget is defense in depth, not the authoritative launch
+gate. It is owned by the singleton
+`kungfu-buildchain-windows-jit-budget-guard` stack rather than any retained
+campaign stack. This prevents Budget-name collisions and prevents a stale
+campaign reaper from becoming the provider-wide cost authority. The Budget
+filters exactly `user:kungfu:provider$windows-ec2-jit`; its 80% and 95% actual
+notifications persist the provider kill sentinel, terminate every tagged
+Windows JIT instance, and delete scoped JIT parameters. Every launch controller
+refuses to proceed when the sentinel exists or when the Budget identity or tag
+filter does not match.
+
+Budget installation fails closed until the AWS Organizations management
+account activates `kungfu:provider` and Cost Explorer returns
+`windows-ec2-jit` for that key. A linked account cannot activate the tag. Do not
+create an unfiltered fallback Budget or treat a tag-filtered zero as evidence.
+The DynamoDB campaign reservation remains the atomic launch authority because
+Cost Explorer and AWS Budgets can lag provider activity.
+
+Qualification requires one runner-profile smoke and three trusted exact-source
+full Windows jobs all bound to the same campaign, independent cancellation and
+timeout cleanup exercises, and zero repository runner, EC2 instance,
+disposable volume, min capacity, and desired capacity within 15 minutes of the
+final job.
+
+### Phase 2 operator workflow
+
+`pnpm operator:windows-jit` is the reusable lifecycle entrypoint. Its default
+mode is `plan`, which performs no AWS or GitHub call. A plan binds the account,
+region, unique campaign and stack names, source SHA/ref, Cost Explorer window,
+workflow id, network, OIDC provider, expiry, slot ceiling, singleton Budget
+identity, and exact confirmation digest.
+
+The modes are deliberately separated:
+
+- `plan` emits the deterministic mutation boundary and digest.
+- `audit` reads AWS and GitHub only. It verifies the account, disabled workflow,
+  singleton guard stack, exact Budget filter, SNS thresholds/subscribers,
+  provider kill sentinel, campaign stack, and zero EC2/EBS/SSM/JIT/runner
+  residue.
+- `install-budget --execute` deploys or updates only the singleton Budget guard.
+  It refuses to mutate unless the provider tag value is visible, the Windows
+  workflow is disabled, and the account, campaign, source, Budget, and plan
+  digest confirmations match.
+- `prepare --execute` requires the installed Budget guard, absent kill
+  sentinel, fresh Cost Explorer readback filtered by both
+  `kungfu:provider=windows-ec2-jit` and `BoxUsage:c7i.4xlarge`, zero residue, a
+  never-used campaign stack name, and the disabled workflow. The receipt binds
+  the query timestamp and exact filter identity. Preparation deploys the
+  campaign stack and atomically arms the ledger with that provider-spend
+  baseline. It never enables or dispatches the workflow and never creates EC2
+  capacity.
+- `close --execute` disables the workflow first, persists `KILLED`, publishes
+  the campaign kill switch, and reports terminal success only after EC2, EBS,
+  SSM, JIT parameter, and GitHub runner residue is zero. It is safe to rerun
+  while the reaper settles.
+
+All mutating modes require `--execute`, `--confirm-plan-digest`,
+`--confirm-account-id`, `--confirm-campaign-id`, and
+`--confirm-source-sha`. Budget installation and preparation additionally
+require `--confirm-budget-name`. A future paid workload still requires a
+separate exact workflow/run authorization and uses
+`scripts/aws-windows-jit-controller.mjs`; preparation is not paid-launch
+authority.
+
+Start by recording one reproducible plan:
 
-Qualification requires one runner-profile smoke, three trusted exact-source
-full Windows jobs, independent cancellation and timeout cleanup exercises, and
-zero repository runner, EC2 instance, disposable volume, min capacity, and
-desired capacity within 15 minutes of the final job.
+```bash
+pnpm operator:windows-jit plan \
+  --aws-profile us \
+  --account-id 727884401362 \
+  --campaign-id win-REPLACE \
+  --source-sha REPLACE_WITH_EXACT_40_CHARACTER_SHA \
+  --source-ref refs/heads/dev/v4/v4.0 \
+  --observed-at REPLACE_WITH_ISO_TIMESTAMP \
+  --expires-at REPLACE_WITH_ISO_TIMESTAMP_WITHIN_24_HOURS \
+  --cost-start REPLACE_WITH_PHASE_START_DATE \
+  --cost-end REPLACE_WITH_EXCLUSIVE_END_DATE \
+  --max-accepted-instances 1 \
+  --workflow-id 322620360 \
+  --vpc-id REPLACE_WITH_VPC_ID \
+  --subnet-id REPLACE_WITH_SUBNET_ID \
+  --oidc-provider-arn REPLACE_WITH_GITHUB_OIDC_PROVIDER_ARN
+```
+
+Reuse those exact arguments for `audit`, `install-budget`, `prepare`, or
+`close`; never regenerate `--observed-at` between the plan and its confirmed
+mutation. Capture stdout as the operator receipt. Do not put credentials,
+tokens, JIT configuration, or signed URLs in arguments or receipts.
+
+### Lower-level campaign and launch controllers
+
+`scripts/aws-windows-jit-campaign-core.mjs` owns the pure one-shot ledger
+contract used by the operator and launch controller. Arming creates `CONTROL`
+and `CAMPAIGN#<id>` with `attribute_not_exists` conditions, so DynamoDB refuses
+a second campaign in the same retained state table. There is deliberately no
+clear or re-arm operation.
+
+Every `scripts/aws-windows-jit-controller.mjs --execute` call must provide the
+same `--account-id`, `--campaign-id`, `--confirm-campaign-id`, `--state-table`,
+and `--confirm-state-table`. Before GitHub JIT material is created, the
+controller verifies the exact provider Budget/tag filter and proves the global
+Budget kill sentinel absent. After the GitHub, AMI, active-instance, SSM, and
+EC2 DryRun checks pass, the controller
+atomically reserves one run. Duplicate run-attempt-qualification identities,
+source mismatch, expiry, `KILLED`, the sixth accepted instance, or a
+reservation that would exceed the USD 110 ceiling after combining the persisted
+fresh Cost Explorer baseline with all in-flight campaign reservations all fail
+closed in one DynamoDB transaction before `RunInstances`. AWS Budget alarms are
+defense in depth for delayed billing telemetry; the atomic ledger is the
+authoritative launch-time guard. The operator is the only supported mutation
+surface for campaign preparation and closeout; direct imports of the core are
+not operator authority.
 
 ## Phase 3 contract
 
@@ -226,6 +365,32 @@ host, including at least one full run, plus proof that:
 - AWS has no active campaign instance or allocated campaign host;
 - actual incremental spend remained below USD 25.
 
+### Phase 3 lifecycle controller
+
+`scripts/aws-macos-jit-controller.mjs` is the operator boundary for the paid
+campaign. It has three explicit mutation modes:
+
+- `launch-campaign` binds the exact repository source, AMI, availability zone,
+  tagged Dedicated Host, and reusable instance. It rejects pre-existing Mac
+  capacity and requires successful `AllocateHosts` and `RunInstances` DryRuns
+  before either real call.
+- `run-job` binds one queued exact-source GitHub job to the existing campaign
+  host and instance. It writes the repository JIT configuration through a
+  mode-0600 temporary file into a distinct SSM SecureString, sends only the
+  credential-free bootstrap through SSM, and removes the parameter plus runner
+  registration if command delivery fails.
+- `close-campaign` refuses execution before the provider's 24-hour minimum,
+  verifies the encrypted delete-on-termination root volume, removes scoped JIT
+  residue, terminates the exact instance, and requires a `ReleaseHosts` DryRun
+  before release. If Apple host scrubbing is still in progress, it reports
+  `release-pending`; the ten-minute card-scoped reaper remains the bounded
+  retry path.
+
+Every execute mode requires the exact source SHA and campaign id to be repeated
+through `--confirm-source-sha` and `--confirm-campaign-id`. `run-job` also
+requires `--confirm-run-id`. Omitting `--execute` emits a deterministic plan
+without changing AWS or GitHub state.
+
 ## Provider lifecycle
 
 The three infrastructure templates live under