@kungfu-tech/buildchain 3.0.6-alpha.1 → 3.0.6-alpha.3

package/docs/publication-authority.md

@@ -167,6 +167,17 @@ release-PR or trusted-manual paths.
 
 ## Consumer qualification handoff
 
+For managed release candidates, a consumer whose Gate can only be decided
+after the exact candidate bytes exist may provide `publication-gate-command`.
+The sealed authority downloads and recomputes the RC evidence first, checks out
+the exact admitted consumer source without credentials, and runs that command
+with read-only evidence paths. The command must write one complete qualifying
+Shifu aggregate to `BUILDCHAIN_PUBLICATION_GATE_RESULT_PATH`. Buildchain then
+checks the aggregate digest and source binding before assembling the admission;
+the later consumer predicate and provider action still revalidate the same
+complete aggregate. A precomputed aggregate, the command, and an explicit
+no-Gate decision are mutually exclusive.
+
 Consumers may explicitly opt in to a final, consumer-owned qualification
 predicate. Buildchain then transports the complete Gate aggregate alongside the
 sealed capability instead of reducing it to a summary. The capability binds the

package/docs/publish-transaction.md

@@ -8,7 +8,7 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-07-31
+last_reviewed: 2026-08-06
 ai_provenance:
   model_family: GPT-5
   product: Codex
@@ -97,6 +97,15 @@ state for `vX.Y.Z-alpha.N` and cannot resume it with the same transaction
 identity, alpha version selection must advance to the next prerelease instead
 of reusing or overwriting that failed transaction slot.
 
+`release-candidate-promote.yml` can establish or restore this state from an
+older successful candidate run through the documented fresh-event recovery
+inputs. The recovery receipt and sealed bundle are verified before the action
+reads or creates transaction state. If `resume-transaction-id` is supplied,
+the restored durable/local transaction must already exist with that exact id;
+a missing or different id fails before provider mutation. An absent transaction
+is created only when no expected existing identity was requested. See
+[Release Candidate: Resume from an existing candidate run](release-candidate.md#resume-from-an-existing-candidate-run).
+
 ## Lifecycle
 
 Repositories declare publish work in `.buildchain/buildchain.toml`:

package/docs/release-candidate.md

@@ -117,19 +117,96 @@ and resolves each remaining floating shell/runtime ref exactly once. Every
 later checkout and delegated promotion receives those immutable SHAs, so a
 channel tag moving during the run cannot mix two Buildchain revisions.
 
-If a promote-only run failed after its consumer commit was already merged and
-its PR-stage artifacts were built, rerun the complete failed workflow after the
-fixed Buildchain channel is published:
+## Resume from an existing candidate run
 
-```bash
-gh run rerun <run-id> --repo <owner>/<consumer>
+Do not rely on `gh run rerun` after a reusable-workflow startup or router
+failure. GitHub documents two different rerun behaviors: a full rerun may use a
+called workflow from the currently specified ref, while a failed-job rerun uses
+the same called-workflow commit as the original attempt. Neither operation is a
+supported way to create a job graph that GitHub failed to resolve at startup.
+See GitHub's [reusable workflow rerun behavior](https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#behavior-of-reusable-workflows-when-re-running-jobs)
+and [workflow rerun identity rules](https://docs.github.com/en/actions/how-tos/manage-workflow-runs/re-run-workflows-and-jobs).
+
+The supported recovery boundary is a new `workflow_dispatch` (or another new
+caller event) that invokes `release-candidate-promote.yml` and supplies the old
+candidate run explicitly:
+
+```yaml
+name: Resume release candidate
+on:
+  workflow_dispatch:
+    inputs:
+      candidate-run-id: { required: true, type: string }
+      target-sha: { required: true, type: string }
+      expected-tree: { required: true, type: string }
+      candidate-runtime-sha: { required: true, type: string }
+      buildchain-runtime-sha: { required: true, type: string }
+
+jobs:
+  resume:
+    uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@<exact-current-buildchain-sha>
+    permissions:
+      actions: write
+      checks: write
+      contents: write
+      id-token: write
+      pull-requests: write
+    secrets: inherit
+    with:
+      buildchain-ref: ${{ inputs.buildchain-runtime-sha }}
+      channel: alpha
+      target-ref: alpha/v3/v3.0
+      target-sha: ${{ inputs.target-sha }}
+      artifact-name: product
+      artifact-patterns: product-package-*
+      release-candidate-workflow-file: build.yml
+      release-candidate-workflow-name: Build
+      resume-candidate-repository: ${{ github.repository }}
+      resume-candidate-run-id: ${{ inputs.candidate-run-id }}
+      resume-expected-workflow-file: build.yml
+      resume-expected-workflow-name: Build
+      resume-expected-source-tree: ${{ inputs.expected-tree }}
+      resume-expected-candidate-runtime-sha: ${{ inputs.candidate-runtime-sha }}
+      resume-buildchain-runtime-sha: ${{ inputs.buildchain-runtime-sha }}
+      publish-transaction-override: true
 ```
 
-Use a complete rerun, not `--failed`, so GitHub resolves the reusable workflow
-again. The release-candidate resolver reuses the existing candidate artifacts,
-and the durable publication transaction makes the recovery idempotent; do not
-open a replacement consumer PR or rebuild the native matrix solely for this
-router failure.
+`resume-expected-candidate-root` may replace `resume-expected-source-tree`, or
+callers may provide both. `resume-transaction-id` is optional; when supplied it
+must identify an already durable transaction before any provider mutation.
+
+Recovery downloads and checks the successful `pull_request` run, active
+workflow file and name, same-repository merged PR, trusted repository
+association, target ancestry, promotion tree, Passport candidate root,
+build-summary root, controller receipts, platform matrix, artifact archive
+size/digest, every manifest file, and every product payload byte. Tree equality
+alone is never admission. A different promotion commit is allowed only when all
+of those identities still agree.
+
+The recovery path conditionally skips consumer dependency installation and all
+product `install`, `build`, `verify`, and platform-matrix jobs. It restores the
+downloaded bytes as a content-addressed sealed bundle, so npm publication uses
+the original `.tgz`; it may regenerate only Buildchain-owned receipts,
+attestations, signatures, Release Passport data, publication, and readback.
+
+Success emits `kungfu-buildchain-release-candidate-recovery/v1` with
+`action: reused`, the original run/source/tree, candidate and artifact roots,
+the skipped stages, current tooling SHA, transaction identity/state, and an
+exact receipt root. The receipt is uploaded as an Actions artifact and staged
+with immutable GitHub Release Passport assets.
+
+Missing or expired artifacts, archive or payload digest drift, tree/root,
+repository/workflow/channel/target mismatch, untrusted run/PR provenance,
+incomplete controller evidence, and transaction conflict fail closed with an
+error code and next action. Buildchain never converts recovery failure into a
+hidden full rebuild. A repository owner must choose a new candidate build
+explicitly.
+
+When a durable transaction is absent, recovery seals one from the verified
+candidate. Existing `sealed`, `publishing`, `package-published`, `finalizing`,
+and `complete` transactions use the normal idempotent state machine. Matching
+registry and GitHub bytes are preserved, only missing publication work is
+performed, and conflicting public digests enter `repair_required`.
 
 By default, the wrapper forwards GitHub Release publication to the underlying
 `promote-buildchain-ref` semver model. Once the release transaction is complete,
@@ -192,12 +269,29 @@ short-lived admission JSON in repository-specific workflow code:
 ```
 
 `publication-auto-no-gate` is an explicit consumer decision, not a default. A
-consumer with a Shifu Gate registry supplies `publication-gate-aggregate-json`
-instead. Buildchain still requires caller-owned RC evidence, an exact authority
+consumer with a Shifu Gate registry either supplies
+`publication-gate-aggregate-json`, or supplies a source-controlled
+`publication-gate-command` that writes the aggregate to
+`BUILDCHAIN_PUBLICATION_GATE_RESULT_PATH`. The command runs from the exact
+consumer source in the credential-free sealed-authority job, after Buildchain
+has downloaded the exact RC passport, summary, controller receipt, manifests,
+and payload bytes. It can read those inputs through
+`BUILDCHAIN_PUBLICATION_EVIDENCE_ROOT`; it receives no publication token, OIDC
+permission, or provider write permission. Buildchain validates the aggregate
+digest and exact source binding before it seals a capability. Exactly one of
+the supplied aggregate, consumer command, or explicit no-Gate decision is
+allowed. Buildchain still requires caller-owned RC evidence, an exact authority
 runtime and source SHA, a repository-local publisher workflow, matching npm
 target/package identity or exact caller-bound GitHub Release target, and a
 qualifying control-plane audit.
 
+Promotion resolves the complete PR-stage workflow, not only the first required
+status job that becomes green. `release-candidate-wait-seconds` bounds that
+wait and defaults to three hours so long native builds can finish controller,
+publication-tail, and retained-evidence jobs without racing a merged promotion.
+An incomplete or failed workflow still fails closed; the longer bound does not
+turn a partial required-check result into candidate evidence.
+
 GitHub-Release-only consumers use the same managed admission without inventing
 an npm package identity:
 

package/docs/release-governance.md

@@ -487,6 +487,15 @@ same slow checks. Buildchain supports GitHub merge queues for that channel
 shape. The queue validates the projected merged result and serializes the final
 ref update, so concurrent channel movement no longer invalidates the candidate.
 
+GitHub Merge Queue does not by itself decide which candidate may spend a long
+native proof before enqueue. Repositories with that workload use the
+[Dev Delivery Warrant Queue](dev-delivery-warrant.md) as the durable,
+FIFO-aging scheduling and fencing authority before native queue admission. A
+selected Warrant owns one complete delivery attempt and later candidates remain
+visibly queued; GitHub still owns the exact `merge_group` proof and final ref
+mutation. Workflow concurrency remains only a process critical section and is
+not fairness or ownership authority.
+
 Every required workflow must handle both `pull_request` and `merge_group`
 before the queue is enabled. Queue runs do not provide
 `github.event.pull_request`; required workflows must use the checked-out
@@ -545,6 +554,33 @@ inputs: target dev branch, required status/check names, ready and block labels,
 allowed work-branch prefixes, review requirements, maximum merges per run,
 merge method, and dry-run mode.
 
+Agent delivery uses the targeted Buildchain command instead of relying on a
+scheduled scan:
+
+```sh
+buildchain dev pr-admit \
+  --repository kungfu-systems/example \
+  --branch dev/v3/v3.0 \
+  --pull-request 123 \
+  --expected-head 0123456789abcdef0123456789abcdef01234567
+```
+
+The default is a mutation-free plan. After reviewing it, add `--execute` to
+establish the configured readiness label for only that PR and exact head, read
+the state back, and attempt native queue admission. Repeating execute is
+idempotent: an exact matching queue entry is adopted, not submitted again. A
+stale head or base, fork, draft, block label, missing approval, failed check,
+active predecessor, or rejected enqueue exits nonzero. Execute mode also
+creates or updates an exact-head PR comment and named commit status containing
+the current state, reason, receipt root, and copyable next action. The JSON
+receipt remains the complete content-addressed evidence.
+
+GitHub auto-merge is observed but is never readiness or admission authority.
+Approval plus green checks plus auto-merge enabled does not qualify a PR that
+lacks explicit Buildchain delivery intent. The targeted workflow interface
+exposes the same contract through `expected-pr-number` and
+`expected-head-sha`; cadence patrol runs leave those inputs empty.
+
 The workflow defaults are conservative. A PR is skipped unless it targets the
 configured dev line, is not a draft, has the ready label, has no block label,
 comes from the same repository, uses an allowed work-branch prefix, has a
@@ -565,6 +601,15 @@ admission runs; GitHub still owns the atomic queue and protected-ref update.
 Repositories may explicitly select `landing-mode: direct` only when the target
 branch has no native queue. Queue presence always disables the direct path.
 
+For slow candidates on a frequently advancing dev line, the optional
+[Dev Delivery Warrant Queue](dev-delivery-warrant.md) adds durable FIFO plus
+aging scheduling before native queue admission. It separates reusable source
+qualification from exact merge-group integration, uses expected-old Git-ref
+updates and fenced leases, and keeps the PR head unchanged when only dev moves.
+The reusable caller supports `off`, read-only `shadow`, and fail-closed
+`required` rollout modes. GitHub Merge Queue remains the final protected-ref
+authority in every mode.
+
 The canonical consumer required check context is `check / check`, matching the
 reusable workflow call plus its `check` job. Buildchain's own `Verify` workflow
 emits the repository-local context `check`, so Buildchain self-promotion,
@@ -687,6 +732,13 @@ The cadence names describe patrol intensity, not release cadence:
 - monthly patrol is for structural drift checks that should not block ordinary
   development velocity.
 
+Every cadence result is typed `runKind: cadence-patrol` with
+`qualification: false`. A run with no open candidates reports
+`no-op-no-candidates`; a run where every candidate is skipped reports
+`no-op-all-skipped`. Either no-op can keep maintenance green, but neither is a
+delivery qualification, a targeted admission receipt, or evidence that an
+expected PR entered the merge queue.
+
 Stable Candidate Patrol is separate from those maintenance cadences because its
 caller-owned cron is a release-intent window. Its candidate ledger and selection
 remain generic; registry-specific side effects still run through the normal

package/docs/reusable-build-surface.md

@@ -774,6 +774,9 @@ Direct GitHub Artifact payloads default to compression level `0`. Buildchain
 artifacts are commonly already-compressed archives; storing them without a
 second compression pass shortens the upload window while preserving the same
 artifact name, run/id/digest binding, retention, and no-overwrite behavior.
+Direct build and signed-finalization payload uploads include hidden files under
+the caller-declared artifact paths, matching the relay path so manifest-bound
+dotfiles are not silently removed in transit.
 Callers may select `1` through `9` for payloads that materially benefit from
 compression. Manifests and diagnostics retain their existing small-artifact
 behavior.
@@ -792,7 +795,14 @@ jobs:
       artifact-relay-s3-prefix: ${{ vars.BUILDCHAIN_ARTIFACT_RELAY_S3_PREFIX }}
 ```
 
-In relay mode, each self-hosted platform job uploads the heavy payload files to
+The mode is a policy for platforms that run outside GitHub. GitHub-hosted
+platforms always upload directly with `actions/upload-artifact`, even when a
+mixed matrix requests `s3-to-github-artifacts`; they never send their payloads
+through S3 or the replay job. Buildchain recognizes its hosted presets and the
+standard hosted runner labels. Custom matrices with non-standard hosted labels
+must declare `"githubHosted": true` on those platform rows.
+
+For remaining relay-mode platforms, each job uploads the heavy payload files to
 S3 and uploads only a small `relay-manifest.json` to GitHub. A GitHub-hosted
 `relay-artifacts` job then assumes the configured download role, downloads the
 payloads from S3, verifies every file by SHA256, and re-uploads the normal

package/docs/shifu-gate-profiles.md

@@ -135,7 +135,18 @@ a shell string.
 
 Projects may also pass non-sensitive scalar environment through
 `gate-environment-json`; Buildchain validates the JSON shape and forwards it
-without interpreting names or values. Cache profile references use the same
+without interpreting names or values. A custom `platforms-json` entry may add
+an `environment` object when a value is platform-specific; those scalars
+override the shared environment only for that matrix job. For example, a
+GitHub-hosted Linux lane can select an installed compiler without leaking the
+same setting into macOS or Windows:
+
+```yaml
+platforms-json: >-
+  [{"id":"linux-x64","name":"Linux x64","platform":"linux","runner":"[\"ubuntu-24.04\"]","capabilities":["node","native-toolchain"],"environment":{"CC":"gcc-14","CXX":"g++-14"}}]
+```
+
+Cache profile references use the same
 opaque `shifu-cache-profile-ref` and `shifu-cache-profile-digest` inputs as the
 reusable build. Do not place tokens, credentials, or other secrets in workflow
 inputs or Gate receipts.

package/docs/versioning.md

@@ -79,6 +79,8 @@ repository changes are patch".
 
 | Date       | Action       | Line    | Faces                                                                                                                                                                        | Class    | Rationale                                                                                                                                                                                                                                                                                                                              | PR    |
 | ---------- | ------------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
+| 2026-08-05 | extend-minor | `v3.0`  | auditable-demo-scenario, auditable-demo-capture, auditable-demo-adapter                                                                                                      | additive | Add an opt-in deterministic readable-playback declaration that preserves captured terminal payloads and order while normalizing only presentation timing; omitted playback continues to use observed PTY timestamps, and existing composition modes remain unchanged.                                                                 |       |
+| 2026-08-04 | extend-minor | `v3.0`  | dev-delivery-warrant-queue, source-qualification-proof, integration-delivery-proof, dev-delivery-cli, reusable-dev-delivery-workflows                                        | additive | Add durable fair and fenced protected-dev scheduling plus split source/integration proof contracts. Existing PR admission remains available through explicit `off` and `shadow` rollout modes; no existing command, export, or release flow is removed.                                                                                |       |
 | 2026-08-01 | extend-minor | `v3.0`  | cli-reference-registry, node-api-symbol-registry, golden-path-manual                                                                                                         | additive | Add generated, drift-checked CLI and Node API reference registries to the public site bundle, plus a package-tested first-user Golden Path; existing command execution and import semantics remain unchanged.                                                                                                                          |       |
 | 2026-07-31 | extend-minor | `v3.0`  | auditable-demo-workflow, auditable-demo-media-profile, auditable-demo-media-receipt                                                                                          | additive | Add an opt-in responsive profile that binds source-resolution and exact 1280x720 MP4/WebM/GIF renditions to one Gate and receipt while rejecting upscales, aspect-ratio drift, and profile changes between Gate-only and full-render paths.                                                                                            |       |
 | 2026-07-31 | extend-minor | `v3.0`  | release-candidate-family-evidence, release-passport-evidence-attachment, promotion-action, release-passport-cli                                                              | additive | Restore all-ref v2 parity for optional Initiative-family candidate binding and typed product-owned release evidence attachments while retaining Kungfu native Family State authority and the newer v3 post-activation released-evidence stage.                                                                                         | #2089 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.6-alpha.1",
+  "version": "3.0.6-alpha.3",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -28,6 +28,7 @@
     "./cache-evidence": "./packages/core/cache-evidence.js",
     "./controller-evidence": "./packages/core/controller-evidence.js",
     "./diagnostics": "./packages/core/diagnostics.js",
+    "./dev-delivery-warrant": "./packages/core/dev-delivery-warrant.js",
     "./homebrew": "./packages/core/homebrew.js",
     "./issue-reporting": "./packages/core/issue-reporting.js",
     "./kfd": "./packages/core/kfd.js",
@@ -50,6 +51,7 @@
     "./github-governance-authority": "./packages/core/github-governance-authority.js",
     "./kfd-gate": "./packages/core/kfd-gate.js",
     "./release-candidate": "./packages/core/release-candidate.js",
+    "./release-candidate-recovery": "./packages/core/release-candidate-recovery.js",
     "./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",
     "./release-passport": "./packages/core/release-passport.js",
     "./release-passport-contract": "./packages/core/release-passport-contract.js",

package/packages/core/buildchain-contract.js

@@ -210,7 +210,7 @@ export function createBuildchainContractWorld({
       path: ".github/workflows/release-candidate-promote.yml",
       publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/release-candidate-promote.yml@${majorLine}`,
       requiredInputs: ["channel"],
-      requiredOutputs: ["promoted-sha", "built-source-sha", "release-candidate-artifact"],
+      requiredOutputs: ["promoted-sha", "built-source-sha", "release-candidate-artifact", "release-candidate-action"],
       breakingDefaults: {
         channelDefault: "auto",
         alphaShellDefault: `${majorLine}-alpha`,
@@ -225,6 +225,15 @@ export function createBuildchainContractWorld({
         "buildchain-stable-contract-lock-path",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-expected-source-tree",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-buildchain-runtime-sha",
+        "resume-transaction-id",
         "publish-required-artifacts-json",
         "release-passport-kfd-1-witness-jsons",
         "release-passport-kfd-2-claim-jsons",
@@ -267,11 +276,17 @@ export function createBuildchainContractWorld({
         "train and exact-SHA runtime overrides remain limited to trusted workflow_dispatch actors",
         "promotion reuses PR-stage release-candidate artifacts",
         "promotion does not run the heavy native build matrix",
+        "a fresh workflow event can recover an exact successful candidate run after startup or router failure",
+        "recovery validates repository, workflow, PR, ancestry, tree, candidate roots, controller evidence, manifests, archive digests, and payload bytes before mutation",
+        "recovery emits action reused and never silently falls back to a full build",
         "built source and promotion channel SHA are recorded separately",
         "contract drift is checked before release-candidate resolution and publish",
         "publish-gate source locks are created by the wrapper and enforced by promote-buildchain-ref before publish side effects",
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes",
       ],
+      compatibleBreakingDigests: [
+        "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
+      ],
     }),
     surface(root, {
       id: "advanced-release-candidate-promote",
@@ -279,7 +294,7 @@ export function createBuildchainContractWorld({
       path: ".github/workflows/.release-candidate-promote.yml",
       publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.release-candidate-promote.yml@${majorLine}`,
       requiredInputs: ["channel"],
-      requiredOutputs: ["promoted-sha", "built-source-sha", "release-candidate-artifact"],
+      requiredOutputs: ["promoted-sha", "built-source-sha", "release-candidate-artifact", "release-candidate-action"],
       breakingDefaults: {
         promoteOnlyReleaseCandidate: true,
         requiredStatusCheck: "check / check",
@@ -298,10 +313,23 @@ export function createBuildchainContractWorld({
         "promotion-publication-channel",
         "promotion-target-ref",
         "promotion-override-used",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-expected-source-tree",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-buildchain-runtime-sha",
+        "resume-transaction-id",
       ],
       guarantees: [
         "advanced promotion verifies routed shell, runtime, lock, publication channel, and target bindings before candidate resolution",
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix",
+        "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph",
+      ],
+      compatibleBreakingDigests: [
+        "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
       ],
     }),
     surface(root, {

package/packages/core/buildchain-publication-authority.js

@@ -24,6 +24,7 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/build-surface-fixture.yml", "non-publication-oidc"],
   [".github/workflows/build.yml", "non-publication-oidc"],
   [".github/workflows/buildchain-alpha-self-dogfood.yml", "non-publication-oidc"],
+  [".github/workflows/buildchain-dev-delivery.yml", "governance-write"],
   [".github/workflows/buildchain-patrol-daily.yml", "governance-write"],
   [".github/workflows/buildchain-patrol-monthly.yml", "governance-write"],
   [".github/workflows/buildchain-patrol-weekly.yml", "governance-write"],
@@ -32,6 +33,8 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-qualification-patrol.yml", "governance-write"],
   [".github/workflows/dev-alpha-candidate-patrol.yml", "governance-write"],
+  [".github/workflows/dev-delivery-warrant-close.yml", "governance-write"],
+  [".github/workflows/dev-delivery-warrant-cancel.yml", "governance-write"],
   [".github/workflows/dev-merge-queue-governance.yml", "governance-write"],
   [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
   [".github/workflows/github-governance-audit.yml", "governance-write"],
@@ -75,7 +78,6 @@ export function buildchainPublicationAuthorityDescriptors() {
     runnerPolicy: publicationCapable ? "qualified-measured" : "unqualified",
   }));
 }
-
 export function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) {
   const workflowsDir = path.join(root, ".github", "workflows");
   const workflows = fs.readdirSync(workflowsDir)

package/packages/core/channel-candidate.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import crypto from "node:crypto";
+import { normalizeChannelCandidateSelection } from "./channel-promotion-baseline.js";
 
 export const CHANNEL_CANDIDATE_DECISION_SCHEMA =
   "kungfu-buildchain-channel-candidate-decision/v1";
@@ -95,27 +96,7 @@ export function decideChannelCandidate(input) {
     throw new Error("sourceBranch and targetBranch must differ");
   const sourceSha = sha(input.sourceSha, "sourceSha");
   const targetSha = sha(input.targetSha, "targetSha");
-  const selection = input.selection
-    ? {
-        mode: required(input.selection.mode, "selection.mode"),
-        observedSourceHeadSha: sha(
-          input.selection.observedSourceHeadSha,
-          "selection.observedSourceHeadSha",
-        ),
-        skippedNewerCommitCount: Number(
-          input.selection.skippedNewerCommitCount || 0,
-        ),
-      }
-    : undefined;
-  if (
-    selection &&
-    (!Number.isSafeInteger(selection.skippedNewerCommitCount) ||
-      selection.skippedNewerCommitCount < 0)
-  ) {
-    throw new Error(
-      "selection.skippedNewerCommitCount must be a non-negative integer",
-    );
-  }
+  const selection = normalizeChannelCandidateSelection(input.selection);
   const now = required(input.now || new Date().toISOString(), "now");
   const maxAgeSeconds = Number(input.maxAgeSeconds ?? 7 * 24 * 60 * 60);
   if (!Number.isSafeInteger(maxAgeSeconds) || maxAgeSeconds <= 0) {