@kungfu-tech/buildchain 3.0.6-alpha.1 → 3.0.6-alpha.2

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-03T09:35:55.854Z",
-  "publishedAt": "2026-08-03T09:35:55.854Z",
+  "generatedAt": "2026-08-05T21:38:24.130Z",
+  "publishedAt": "2026-08-05T21:38:24.130Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "88a8b532ce69ee3def5926a42c9cd75e4809ae88",
+  "sourceRevision": "931e1a448f3460a29d6b6765c1f1e3e3e26f19cc",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.1",
+    "version": "3.0.6-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -25,6 +25,7 @@
       "./cache-evidence": "./packages/core/cache-evidence.js",
       "./controller-evidence": "./packages/core/controller-evidence.js",
       "./diagnostics": "./packages/core/diagnostics.js",
+      "./dev-delivery-warrant": "./packages/core/dev-delivery-warrant.js",
       "./homebrew": "./packages/core/homebrew.js",
       "./issue-reporting": "./packages/core/issue-reporting.js",
       "./kfd": "./packages/core/kfd.js",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-03T09:35:55.854Z",
-  "publishedAt": "2026-08-03T09:35:55.854Z",
+  "generatedAt": "2026-08-05T21:38:24.130Z",
+  "publishedAt": "2026-08-05T21:38:24.130Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "88a8b532ce69ee3def5926a42c9cd75e4809ae88",
+  "sourceRevision": "931e1a448f3460a29d6b6765c1f1e3e3e26f19cc",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.1",
+    "version": "3.0.6-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:0ea7f59030e5a087e3ff7e9eb591fec8d92c64399799e554aa1fa7ecb6a263ae"
+      "digest": "sha256:d76416d8cd04dcdb560b7d06fef287fa22d6b186a729cb92cd4cf71cebbac1e9"
     },
     {
       "id": "getting-started",
@@ -69,7 +69,7 @@
       "path": "docs/auditable-demo.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:7e1426d8200bd4e7a7e6684c872f47075cd37d0bddbb262ea3263eaad846b540"
+      "digest": "sha256:c49e734fdfe3b74d317e23a523e198f1194b2c7cd16cca87e8e3a3ffc7bf589f"
     },
     {
       "id": "install",
@@ -109,7 +109,7 @@
       "path": "docs/publication-authority.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:6c91ee89d1ed5c0c570806684738916876556b2f1bcbf4be4f73f30ff89e98a4"
+      "digest": "sha256:a1650158943d95b979d164ca98a73d7919fda577d648e4a4a9d04588ec698796"
     },
     {
       "id": "github-governance-authority",
@@ -125,7 +125,7 @@
       "path": "docs/release-candidate.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:fbcffddf1e2c50502186b7ba557e29f96be59a1da6d438aabd4d1f9ce32b5915"
+      "digest": "sha256:48e42e92174b1091e8ff32e876099f092ca12ce886d3382f019f0ccd907f1c9b"
     },
     {
       "id": "release-propagation",
@@ -229,7 +229,7 @@
       "path": "docs/cli-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:73d34a3b46ecfb772b806f0d79754772446fcc13d7f349b508a0c0212e97fcec"
+      "digest": "sha256:2365e125d38e43b68a4af277a91be7aca708a8bf785954ed4589dbd9a5d8db97"
     },
     {
       "id": "node-api-reference",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ae49a589091d1ab91d29f2d6ac52cf2551a9d0b1f78350965b408f40fd219e29"
+      "digest": "sha256:e0e720eeacfa61a1ca235142858f544e18d3f7a000e300a4311e246fe738ff81"
     },
     {
       "id": "build-facts",
@@ -277,7 +277,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:fe06637d604101269b013163be558c1ecc842276e27f2b5abfb6eea39e98feb0"
+      "digest": "sha256:7bc04f658d7e298872756278c60143d8edf5dfb841d0b0d3ea62af8028735b54"
     },
     {
       "id": "publish-transaction",
@@ -293,7 +293,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:fc7f0add1afce775c327d50a1e269a7040865e65ca2441dbeb8d0373c5f8d5aa"
+      "digest": "sha256:481640f398d966dca4f1f2e29a8100f0f479315ee19e65b0e259720f2b61213f"
     },
     {
       "id": "release-flow",
@@ -317,7 +317,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:bdb155e873f9c2ea5cd40bdde057d2c2f90322f0d4575de77fe1670bd040e643"
+      "digest": "sha256:793db9414d11aeb314ff2d37a52481826ca5f636d08eaf93772d37962a51484f"
     },
     {
       "id": "web-surface-deployments",

package/dist/site/workflow-registry.json

@@ -176,9 +176,10 @@
         "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
+        "verify-substage-evidence-path",
         "working-directory"
       ],
-      "inputCount": 85,
+      "inputCount": 86,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -283,12 +284,13 @@
         "materialize",
         "materialize-base-ref",
         "media-profile",
+        "render-failure-advisory",
         "render-media",
         "renderer-image",
         "scenario-path",
         "source-ref"
       ],
-      "inputCount": 11,
+      "inputCount": 12,
       "secrets": [
         "DEMO_UPDATE_TOKEN"
       ],
@@ -299,9 +301,10 @@
         "evidence-artifact-digest",
         "evidence-artifact-name",
         "publication-pr-url",
+        "render-result",
         "source-sha"
       ],
-      "outputCount": 6,
+      "outputCount": 7,
       "surface": "declarative-auditable-demo",
       "capabilityGroup": "api-cli-reference",
       "status": "preview",
@@ -392,6 +395,7 @@
         "auto-no-gate",
         "buildchain-ref",
         "buildchain-repository",
+        "consumer-gate-command",
         "consumer-predicate-digest",
         "consumer-predicate-id",
         "consumer-qualification-required",
@@ -419,7 +423,7 @@
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 33,
+      "inputCount": 34,
       "secrets": [
         "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
       ],
@@ -491,6 +495,7 @@
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
+        "publication-gate-command",
         "publication-package-name",
         "publication-product",
         "publication-publisher-workflow-path",
@@ -514,6 +519,7 @@
         "release-candidate-family-evidence-required",
         "release-candidate-family-evidence-root",
         "release-candidate-family-initiative-id",
+        "release-candidate-wait-seconds",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
@@ -544,7 +550,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 95,
+      "inputCount": 97,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1271,9 +1277,10 @@
         "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
+        "verify-substage-evidence-path",
         "working-directory"
       ],
-      "inputCount": 88,
+      "inputCount": 89,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1367,6 +1374,27 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "buildchain-dev-delivery",
+      "path": ".github/workflows/buildchain-dev-delivery.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "dev-governance",
+      "capabilityGroup": "governance-versioning",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "buildchain-patrol-daily",
       "path": ".github/workflows/buildchain-patrol-daily.yml",
@@ -1647,6 +1675,87 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "dev-delivery-warrant-cancel",
+      "path": ".github/workflows/dev-delivery-warrant-cancel.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "buildchain-repository",
+        "event-action",
+        "expected-candidate-id",
+        "expected-old-state-root",
+        "expected-pr-number",
+        "expected-source-head-sha",
+        "observed-source-head-sha",
+        "outcome",
+        "reason",
+        "target-branch",
+        "terminal-evidence-root"
+      ],
+      "inputCount": 12,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "cancellation-action",
+        "cancellation-receipt-root",
+        "final-state-root"
+      ],
+      "outputCount": 3,
+      "surface": "repository-workflow",
+      "capabilityGroup": "governance-versioning",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
+    {
+      "id": "dev-delivery-warrant-close",
+      "path": ".github/workflows/dev-delivery-warrant-close.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "buildchain-repository",
+        "current-base-sha",
+        "expected-head-sha",
+        "expected-pr-number",
+        "merge-group-head-sha",
+        "merge-group-tree-sha",
+        "outcome",
+        "reason",
+        "replay-tree-sha",
+        "required-context-roots-json",
+        "target-branch",
+        "terminal-evidence-root"
+      ],
+      "inputCount": 13,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "close-receipt-root",
+        "final-state-root",
+        "integration-proof-root"
+      ],
+      "outputCount": 3,
+      "surface": "repository-workflow",
+      "capabilityGroup": "governance-versioning",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "dev-merge-queue-governance",
       "path": ".github/workflows/dev-merge-queue-governance.yml",
@@ -1673,35 +1782,60 @@
       "path": ".github/workflows/dev-pr-auto-merge.yml",
       "reusable": true,
       "inputs": [
+        "affected-paths-json",
         "allowed-head-prefixes",
+        "assignment-root",
         "block-labels",
         "buildchain-ref",
         "buildchain-repository",
+        "closure-root",
+        "delivery-class",
+        "delivery-priority",
+        "delivery-warrant-mode",
+        "dependency-root",
+        "diagnostic-context",
         "dry-run",
+        "expected-head-sha",
+        "expected-pr-number",
+        "initiative-root",
         "landing-mode",
         "max-merges",
         "merge-method",
+        "plan-root",
+        "project-cut-proof-json",
         "queue-admission-context",
         "ready-label",
         "require-approval",
         "required-status-checks",
         "same-repository-only",
-        "target-branch"
-      ],
-      "inputCount": 14,
+        "shard-evidence-roots-json",
+        "source-identity-root",
+        "source-patch-root",
+        "target-branch",
+        "toolchain-root",
+        "warrant-lease-seconds"
+      ],
+      "inputCount": 32,
       "secrets": [
         "github-token"
       ],
       "secretCount": 1,
       "outputs": [
         "action-count",
+        "admission-receipt-root",
+        "admission-state",
         "enqueued-count",
         "evaluated-count",
         "final-base-sha",
         "merged-count",
-        "skipped-count"
+        "project-cut-proof-root",
+        "skipped-count",
+        "source-proof-root",
+        "warrant-receipt-root",
+        "warrant-state-commit",
+        "warrant-state-root"
       ],
-      "outputCount": 6,
+      "outputCount": 13,
       "surface": "dev-governance",
       "capabilityGroup": "governance-versioning",
       "status": "active",
@@ -2220,6 +2354,7 @@
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
+        "publication-gate-command",
         "publication-package-name",
         "publication-product",
         "publication-publisher-workflow-path",
@@ -2243,6 +2378,7 @@
         "release-candidate-family-evidence-required",
         "release-candidate-family-evidence-root",
         "release-candidate-family-initiative-id",
+        "release-candidate-wait-seconds",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
@@ -2273,7 +2409,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 87,
+      "inputCount": 89,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2836,10 +2972,11 @@
         "required",
         "sample-process-tree",
         "stage",
+        "substage-evidence-path",
         "summary-path",
         "timeout-minutes"
       ],
-      "inputCount": 21,
+      "inputCount": 22,
       "capabilityGroup": "reusable-build",
       "status": "active",
       "owner": "buildchain-actions",

package/docs/MAP.md

@@ -111,6 +111,7 @@ replace them.
 | Why does Buildchain use branch-driven release governance? | [`release-governance.md`](release-governance.md) | why | stable |
 | How do protected dev branches and scheduled ready-PR merging work? | [`release-governance.md`](release-governance.md#protected-dev-branches) | use | stable |
 | How do slow required checks land reliably on a busy dev channel? | [`release-governance.md`](release-governance.md#protected-dev-branches) + [`cli.md`](cli.md#commands) | use | preview |
+| How does the durable fair Dev Delivery Warrant Queue prevent slow-candidate starvation?                                                       | [`dev-delivery-warrant.md`](dev-delivery-warrant.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | use/verify | preview |
 | How do I coalesce rapid Dev changes, preserve release runner priority, and retry only transient failed jobs? | [`dev-qualification-patrol.md`](dev-qualification-patrol.md) | use/verify | preview |
 | How do I run daily, weekly, or monthly repository patrols? | [`release-governance.md`](release-governance.md#buildchain-patrol) | use | stable |
 | How does Buildchain decide patch, minor, and major release lines? | [`versioning.md`](versioning.md) | why | stable |

package/docs/auditable-demo.md

@@ -8,7 +8,7 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-08-02
+last_reviewed: 2026-08-05
 ai_provenance:
   model_family: GPT-5
   product: Codex
@@ -52,6 +52,39 @@ the default. Both classes retain 4 MiB per step, a clean Home/XDG environment,
 no inherited credentials, and a network-disabled read-only container with
 bounded tmpfs.
 
+Consumers may optionally add a
+`buildchain.declarative-demo-presentation/v1` presentation. This contract
+binds one consumer-owned proof label, question, summary, and optional
+transition to every demo in declared order. Buildchain verifies that each
+question is the same title used by capture and media; it does not invent or
+reinterpret the product argument.
+
+The presentation also chooses one of two README materialization modes. The
+default, when no presentation is declared, remains the original full generated
+block with commands, renditions, evidence, and claim boundary. `media-only`
+updates only the image inside each existing README marker so consumer-authored
+narrative and transitions survive regeneration. The generated technical
+details move to a separately declared Markdown specification, where stable
+per-demo markers preserve proof order and idempotent updates. The publication
+pull request stages that specification together with the README and
+content-addressed evidence. No presentation field grants publication or Work
+authority.
+
+The optional top-level `compositionMode` is an explicit visual contract.
+Omitting it preserves `presentation-framed`; declaring `terminal-fill` makes
+the bounded PTY replay the complete pixel surface without renderer-owned
+window chrome. Buildchain carries that choice into both native scenes. It does
+not infer full-frame intent from output resolution.
+
+The optional `buildchain.declarative-demo-playback/v1` contract separates
+observed command latency from presentation timing. Its
+`deterministic-readable` mode preserves the captured terminal event payloads
+and their order, records the observed final-event time as non-authoritative
+evidence, and maps event ordinals onto the declared `activeDurationMs` before a
+bounded `finalHoldMs`. Both native renditions therefore replay at the same
+readable pace even when an identical command runs faster or slower. Omitting
+the contract preserves the original PTY timestamp behavior.
+
 The uploaded metadata must bind the executable SHA-256, declare an empty
 runtime dependency set, and provide a bounded `executableFiles` array of exact
 artifact-relative paths and SHA-256 digests. GitHub Artifact transport does not
@@ -97,6 +130,7 @@ jobs:
       scenario-path: .buildchain/auditable-demo.json
       renderer-image: ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:RENDERER_DIGEST
       render-media: true
+      render-failure-advisory: false
       media-profile: responsive-web-delivery-v1
       materialize: true
       materialize-base-ref: dev/v1/v1.0
@@ -193,6 +227,10 @@ The Gate:
   bounded tmpfs;
 - verifies the renderer manifest, media probe, exact input roots, exact output
   member set, and complete checksums;
+- independently verifies the requested composition mode, browser-observed
+  content viewport, PTY rows and columns, and deterministic cell geometry for
+  every frame set; `terminal-fill` is rejected unless the viewport and cell
+  grid resolve to the complete declared frame;
 - uploads a content-addressed qualified bundle plus an independent GitHub
   Artifact id, URL, archive digest, and expiry-bearing source coordinate.
 
@@ -202,9 +240,9 @@ passed gate receipt, and checksums covering every member exactly once.
 
 ## Selective Render
 
-`render-media: true` enables the second job. It downloads the just-uploaded Gate
-bundle by its content-addressed name, recomputes the Gate member root, verifies
-the exact source SHA and renderer digest, and only then renders the complete
+`render-media: true` enables the full-media step only after every declared demo
+has passed the required Gate. It recomputes each Gate member root, verifies the
+exact source SHA and renderer digest, and only then renders the complete
 qualified scene.
 
 The media bundle contains MP4, WebM, GIF, poster, probe, renderer manifest,
@@ -213,10 +251,19 @@ distribution checksums. A web-delivery profile also retains
 `media-inspection.json`, whose content root is bound into the receipt.
 `render-media: false` does not weaken or skip the Gate.
 
+`render-failure-advisory: true` makes only the full-media step advisory. A
+render failure remains visible as a failed step and workflow warning, while the
+required Gate keeps its normal failure semantics. Failed or partial media can
+never open a materialization PR. Use this for an Alpha lane whose binary
+publication must not depend on animation capacity; keep the default `false`
+for explicit media refreshes and other workflows that require complete media.
+
 When the Gate bundle contains a qualified terminal capture, the render job
 passes it read-only to the immutable renderer. The renderer manifest binds the
 capture root and terminal-state-machine version, but raw capture bytes remain
 in the Gate bundle rather than being copied into the public media bundle.
+Missing, malformed, out-of-bounds, non-full-frame, rendition-mismatched, or
+internally drifted composition evidence fails before media finalization.
 
 ## Media Qualification Profiles
 
@@ -225,13 +272,13 @@ The single machine-readable source is
 profile through `media-profile`; they cannot pass ffmpeg commands, codec flags,
 shell fragments, arbitrary profile paths, or transcoding instructions.
 
-| Profile | Meaning |
-| --- | --- |
-| `archive-v1` | Default compatibility contract. Retains the exact renderer outputs and classifies GIF as README compatibility evidence without making a browser-delivery claim. |
-| `web-delivery-v1` | Independently qualifies H.264 MP4 and VP9 WebM playback sources, forbids audio, requires exact scene dimensions and bounded duration/frame-rate drift, checks per-rendition byte ceilings, and proves MP4 `moov` precedes `mdat`. PNG remains the lossless evidence poster. |
-| `responsive-web-delivery-v1` | Extends `web-delivery-v1` with exact 1280x720 H.264 MP4 and VP9 WebM responsive sources plus a 1280x720 README GIF while keeping the primary MP4/WebM and evidence poster at the source scene dimensions. Every declared downscale must preserve the scene aspect ratio and may never upscale. |
-| `responsive-long-form-web-delivery-v1` | Extends the responsive profile for explicitly admitted long-form scenes. Its measured-baseline multipliers raise only the GIF ceiling to 8 MiB and the four video ceilings to 4 MiB; all codec, native-resolution, no-audio, duration, and authority checks remain unchanged. |
-| `site-hero-v1` | Extends `web-delivery-v1` and additionally requires a qualified WebP browser poster. The current Build Images v1 renderer does not emit that member, so selecting this profile fails closed until the producer adds it. |
+| Profile                                | Meaning                                                                                                                                                                                                                                                                                        |
+| -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `archive-v1`                           | Default compatibility contract. Retains the exact renderer outputs and classifies GIF as README compatibility evidence without making a browser-delivery claim.                                                                                                                                |
+| `web-delivery-v1`                      | Independently qualifies H.264 MP4 and VP9 WebM playback sources, forbids audio, requires exact scene dimensions and bounded duration/frame-rate drift, checks per-rendition byte ceilings, and proves MP4 `moov` precedes `mdat`. PNG remains the lossless evidence poster.                    |
+| `responsive-web-delivery-v1`           | Extends `web-delivery-v1` with exact 1280x720 H.264 MP4 and VP9 WebM responsive sources plus a 1280x720 README GIF while keeping the primary MP4/WebM and evidence poster at the source scene dimensions. Every declared downscale must preserve the scene aspect ratio and may never upscale. |
+| `responsive-long-form-web-delivery-v1` | Extends the responsive profile for explicitly admitted long-form scenes. Its measured-baseline multipliers raise only the GIF ceiling to 8 MiB and the four video ceilings to 4 MiB; all codec, native-resolution, no-audio, duration, and authority checks remain unchanged.                  |
+| `site-hero-v1`                         | Extends `web-delivery-v1` and additionally requires a qualified WebP browser poster. The current Build Images v1 renderer does not emit that member, so selecting this profile fails closed until the producer adds it.                                                                        |
 
 For web-delivery profiles, Buildchain runs its own fixed `ffprobe` invocation
 inside the same immutable, network-disabled renderer image. That command is

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -210,21 +210,25 @@ Each stack owns a stack-scoped reaper log group, so an independent retained
 one-shot campaign stack can be created without colliding with another
 campaign's audit log resource.
 
-The tag-filtered AWS Budget is defense in depth, not the authoritative launch
+The account-native AWS Budget is defense in depth, not the authoritative launch
 gate. It is owned by the singleton
 `kungfu-buildchain-windows-jit-budget-guard` stack rather than any retained
 campaign stack. This prevents Budget-name collisions and prevents a stale
 campaign reaper from becoming the provider-wide cost authority. The Budget
-filters exactly `user:kungfu:provider$windows-ec2-jit`; its 80% and 95% actual
-notifications persist the provider kill sentinel, terminate every tagged
-Windows JIT instance, and delete scoped JIT parameters. Every launch controller
-refuses to proceed when the sentinel exists or when the Budget identity or tag
-filter does not match.
-
-Budget installation fails closed until the AWS Organizations management
-account activates `kungfu:provider` and Cost Explorer returns
-`windows-ec2-jit` for that key. A linked account cannot activate the tag. Do not
-create an unfiltered fallback Budget or treat a tag-filtered zero as evidence.
+filters exactly `USAGE_TYPE=BoxUsage:c7i.4xlarge`,
+`OPERATION=RunInstances:0002` (Windows), and `REGION=us-east-1`; its 80% and
+95% actual notifications persist the provider kill sentinel, terminate every
+tagged Windows JIT instance, and delete scoped JIT parameters. Every launch
+controller refuses to proceed when the sentinel exists or when the Budget
+identity or dimension filter does not match.
+
+Budget installation is intentionally deployable by the workload account without
+AWS Organizations management-account access. It fails closed unless Cost
+Explorer exposes all three AWS-owned billing dimensions in the requested phase
+window. The `kungfu:provider=windows-ec2-jit` resource tag remains mandatory for
+ownership, cleanup, and IAM scoping, but it is not a billing filter. Do not
+create an unfiltered fallback Budget or treat an incomplete dimension readback
+as evidence.
 The DynamoDB campaign reservation remains the atomic launch authority because
 Cost Explorer and AWS Budgets can lag provider activity.
 
@@ -250,12 +254,12 @@ The modes are deliberately separated:
   provider kill sentinel, campaign stack, and zero EC2/EBS/SSM/JIT/runner
   residue.
 - `install-budget --execute` deploys or updates only the singleton Budget guard.
-  It refuses to mutate unless the provider tag value is visible, the Windows
-  workflow is disabled, and the account, campaign, source, Budget, and plan
-  digest confirmations match.
+  It refuses to mutate unless all exact Windows billing dimensions are visible,
+  the Windows workflow is disabled, and the account, campaign, source, Budget,
+  and plan digest confirmations match.
 - `prepare --execute` requires the installed Budget guard, absent kill
-  sentinel, fresh Cost Explorer readback filtered by both
-  `kungfu:provider=windows-ec2-jit` and `BoxUsage:c7i.4xlarge`, zero residue, a
+  sentinel, fresh Cost Explorer readback filtered by `BoxUsage:c7i.4xlarge`,
+  `RunInstances:0002`, and `us-east-1`, zero residue, a
   never-used campaign stack name, and the disabled workflow. The receipt binds
   the query timestamp and exact filter identity. Preparation deploys the
   campaign stack and atomically arms the ledger with that provider-spend
@@ -310,9 +314,9 @@ clear or re-arm operation.
 Every `scripts/aws-windows-jit-controller.mjs --execute` call must provide the
 same `--account-id`, `--campaign-id`, `--confirm-campaign-id`, `--state-table`,
 and `--confirm-state-table`. Before GitHub JIT material is created, the
-controller verifies the exact provider Budget/tag filter and proves the global
-Budget kill sentinel absent. After the GitHub, AMI, active-instance, SSM, and
-EC2 DryRun checks pass, the controller
+controller verifies the exact provider Budget/dimension filter and proves the
+global Budget kill sentinel absent. After the GitHub, AMI, active-instance,
+SSM, and EC2 DryRun checks pass, the controller
 atomically reserves one run. Duplicate run-attempt-qualification identities,
 source mismatch, expiry, `KILLED`, the sixth accepted instance, or a
 reservation that would exceed the USD 110 ceiling after combining the persisted