@kungfu-tech/buildchain 3.0.7-alpha.0 → 3.0.7

package/dist/site/public-surface-audit.json

@@ -4,10 +4,10 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 114,
-    "workflowCount": 65,
+    "workflowCount": 69,
     "actionCount": 7,
-    "sitePageCount": 69,
-    "docCommandRefCount": 922,
+    "sitePageCount": 70,
+    "docCommandRefCount": 924,
     "failureCount": 0
   },
   "enumerated": {
@@ -1988,6 +1988,7 @@
         "path": ".github/workflows/dev-pr-auto-merge.yml",
         "reusable": true,
         "inputs": [
+          "active-lease-context",
           "affected-paths-json",
           "allowed-head-prefixes",
           "assignment-root",
@@ -2003,6 +2004,7 @@
           "dry-run",
           "expected-head-sha",
           "expected-pr-number",
+          "handoff-workflow-id",
           "initiative-root",
           "landing-mode",
           "max-merges",
@@ -2017,11 +2019,13 @@
           "shard-evidence-roots-json",
           "source-identity-root",
           "source-patch-root",
+          "source-workflow-id",
+          "source-workflow-run-id",
           "target-branch",
           "toolchain-root",
           "warrant-lease-seconds"
         ],
-        "inputCount": 32,
+        "inputCount": 36,
         "secrets": [
           "github-token"
         ],
@@ -2075,6 +2079,78 @@
         ],
         "outputCount": 7
       },
+      {
+        "id": "engineering-housekeeper-daily",
+        "path": ".github/workflows/engineering-housekeeper-daily.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "engineering-housekeeper-monthly",
+        "path": ".github/workflows/engineering-housekeeper-monthly.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "engineering-housekeeper-weekly",
+        "path": ".github/workflows/engineering-housekeeper-weekly.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "engineering-housekeeper",
+        "path": ".github/workflows/engineering-housekeeper.yml",
+        "reusable": true,
+        "inputs": [
+          "apply-enabled",
+          "artifact-prefix",
+          "artifact-retention-days",
+          "buildchain-ref",
+          "buildchain-repository",
+          "max-actions",
+          "mode",
+          "protected-patterns",
+          "repository",
+          "retained-patterns",
+          "stale-days",
+          "stale-pull-request-label",
+          "target-branch"
+        ],
+        "inputCount": 13,
+        "secrets": [
+          "github_app_id",
+          "github_app_private_key",
+          "github_token"
+        ],
+        "secretCount": 3,
+        "outputs": [
+          "action-count",
+          "branch-receipt-root",
+          "outcome",
+          "plan-artifact",
+          "plan-root",
+          "pull-request-receipt-root",
+          "receipt-artifact",
+          "report-artifact",
+          "report-receipt-root"
+        ],
+        "outputCount": 9
+      },
       {
         "id": "github-artifact-attestation",
         "path": ".github/workflows/github-artifact-attestation.yml",
@@ -2844,6 +2920,7 @@
           "publish-package-set-order",
           "publish-rematerialize-on-resume",
           "publish-required-artifacts-json",
+          "publish-required-artifacts-path",
           "publish-sealed-bundle-manifest",
           "publish-sealed-bundle-root",
           "publish-source-locked",
@@ -2895,7 +2972,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 79
+        "inputCount": 80
       },
       {
         "id": "release-tail",
@@ -3130,6 +3207,10 @@
         "id": "manual:dev-qualification-patrol",
         "category": "manual"
       },
+      {
+        "id": "manual:engineering-housekeeper",
+        "category": "manual"
+      },
       {
         "id": "manual:getting-started",
         "category": "manual"
@@ -4175,6 +4256,16 @@
         "path": "docs/dev-delivery-warrant.md",
         "command": "buildchain dev proof integration"
       },
+      {
+        "id": "dev",
+        "path": "docs/dev-delivery-warrant.md",
+        "command": "buildchain dev warrant shadow-plan"
+      },
+      {
+        "id": "dev",
+        "path": "docs/dev-delivery-warrant.md",
+        "command": "buildchain dev warrant shadow-qualify"
+      },
       {
         "id": "dev",
         "path": "docs/release-governance.md",
@@ -7897,8 +7988,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "e7b90e95dabcffb3fecb8e84cec48d7a99261c5e90732aff0ebc174b01c4e35c",
-    "workflowRegistryDigest": "47cfb7dbfcdc13f9830c3bc10457cb4c794c4953a584afcf6996b94ed0a6adba",
-    "pageRegistryDigest": "f9d958e6261b25997c2c65c24f3cea8e846ef55091dfa1dbf39a69c6786a30c7"
+    "workflowRegistryDigest": "ddf86974ae3c900948598aca2d28309681cd5c910f3fcd6fc75fd74a06bebdfa",
+    "pageRegistryDigest": "504454df002494e1bc5cdf37679c28a3914f2df43cf4a70524019d2d97b6c320"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -440,6 +440,58 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/engineering-housekeeper-daily.yml",
+      "authorityClass": "governance-write",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/engineering-housekeeper-daily.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
+    {
+      "workflowPath": ".github/workflows/engineering-housekeeper-monthly.yml",
+      "authorityClass": "governance-write",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/engineering-housekeeper-monthly.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
+    {
+      "workflowPath": ".github/workflows/engineering-housekeeper-weekly.yml",
+      "authorityClass": "governance-write",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/engineering-housekeeper-weekly.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
+    {
+      "workflowPath": ".github/workflows/engineering-housekeeper.yml",
+      "authorityClass": "governance-write",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/engineering-housekeeper.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/github-artifact-attestation.yml",
       "authorityClass": "evidence-publication",
@@ -962,6 +1014,34 @@
       ],
       "classified": true
     },
+    {
+      "path": ".github/workflows/engineering-housekeeper-daily.yml",
+      "signals": [
+        "write-permission"
+      ],
+      "classified": true
+    },
+    {
+      "path": ".github/workflows/engineering-housekeeper-monthly.yml",
+      "signals": [
+        "write-permission"
+      ],
+      "classified": true
+    },
+    {
+      "path": ".github/workflows/engineering-housekeeper-weekly.yml",
+      "signals": [
+        "write-permission"
+      ],
+      "classified": true
+    },
+    {
+      "path": ".github/workflows/engineering-housekeeper.yml",
+      "signals": [
+        "write-permission"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/github-artifact-attestation.yml",
       "signals": [
@@ -1109,5 +1189,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "1600e39eb978298c3204b3250c479f8451dfe62f552405c7db2ad2142cd93f63"
+  "registryDigest": "074111987b82f532c9c0a7da9c81a7bf36e93c35ab8ec1a51b9321c8f657fdae"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-07T20:20:23.000Z",
-  "publishedAt": "2026-08-07T20:20:23.000Z",
+  "generatedAt": "2026-08-10T08:49:53.000Z",
+  "publishedAt": "2026-08-10T08:49:53.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "f1f1ef71bc3aa1488876dbb98533fa98cecc4d9a",
+  "sourceRevision": "828d10df56a6b091a4f117340ff8ca19be5a6a90",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.7-alpha.0",
+    "version": "3.0.7",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -46,6 +46,8 @@
       "./publication-control-plane-audit": "./packages/core/publication-control-plane-audit.js",
       "./buildchain-publication-authority": "./packages/core/buildchain-publication-authority.js",
       "./github-governance-authority": "./packages/core/github-governance-authority.js",
+      "./engineering-housekeeper": "./packages/core/engineering-housekeeper.js",
+      "./engineering-housekeeper-github": "./packages/core/engineering-housekeeper-github.js",
       "./kfd-gate": "./packages/core/kfd-gate.js",
       "./release-candidate": "./packages/core/release-candidate.js",
       "./release-candidate-recovery": "./packages/core/release-candidate-recovery.js",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-07T20:20:23.000Z",
-  "publishedAt": "2026-08-07T20:20:23.000Z",
+  "generatedAt": "2026-08-10T08:49:53.000Z",
+  "publishedAt": "2026-08-10T08:49:53.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "f1f1ef71bc3aa1488876dbb98533fa98cecc4d9a",
+  "sourceRevision": "828d10df56a6b091a4f117340ff8ca19be5a6a90",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.7-alpha.0",
+    "version": "3.0.7",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:768042c2b38dd261803f49a141898fe80ce3e19b2a948abda2867e47c56c0b5c"
+      "digest": "sha256:08cfae94c78776694736e81142e2d64480fdc3e67341b415340c03d3539531e7"
     },
     {
       "id": "getting-started",
@@ -69,7 +69,7 @@
       "path": "docs/auditable-demo.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:c49e734fdfe3b74d317e23a523e198f1194b2c7cd16cca87e8e3a3ffc7bf589f"
+      "digest": "sha256:43989b951667f5dd3bf352209ffe551add4f83d5d551f960aeb787b2220aa665"
     },
     {
       "id": "install",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:6dd79b998f63cf996e5c76b4fe0c654d12ca603cd5db1277ef3347f489b96ef0"
+      "digest": "sha256:ed843753964193ecb59610a54f0f23d76578228ebe6d31d1d6edce526729910c"
     },
     {
       "id": "build-facts",
@@ -269,7 +269,7 @@
       "path": "docs/lifecycle-protocol.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:4b7a8efe1d22751ded069f46a23490db70cda9e9e14641acab600ab781245b19"
+      "digest": "sha256:9fdab92b63eae0085d460a4ec78511fbb63999a311cd7693c669705bd9897eb2"
     },
     {
       "id": "reusable-build-surface",
@@ -277,7 +277,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:7bc04f658d7e298872756278c60143d8edf5dfb841d0b0d3ea62af8028735b54"
+      "digest": "sha256:4741dc7661d40e14df8203d88a709b9becb08edc4313f5ad308c7e80bf672085"
     },
     {
       "id": "publish-transaction",
@@ -301,7 +301,7 @@
       "path": "docs/release-tail-provider-plane.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:72f4267de80bb9c57859c78e5624a6d963d452d60412543347d98d6753218d61"
+      "digest": "sha256:12f291124f51520b4f64c21d7fb249e89928b607a30bc00ba81eb1fc5acea5bd"
     },
     {
       "id": "publication-rehearsal",
@@ -317,7 +317,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:34fb81d1dd9f913cbed6ee76ac9f0bdb095669e55c1bee67389601fd494470cf"
+      "digest": "sha256:b37d4de1f1cf9155c0e3f42c8c20a0280a263f50173eb0cad2c5f1961954822e"
     },
     {
       "id": "release-flow",

package/dist/site/workflow-registry.json

@@ -1827,6 +1827,7 @@
       "path": ".github/workflows/dev-pr-auto-merge.yml",
       "reusable": true,
       "inputs": [
+        "active-lease-context",
         "affected-paths-json",
         "allowed-head-prefixes",
         "assignment-root",
@@ -1842,6 +1843,7 @@
         "dry-run",
         "expected-head-sha",
         "expected-pr-number",
+        "handoff-workflow-id",
         "initiative-root",
         "landing-mode",
         "max-merges",
@@ -1856,11 +1858,13 @@
         "shard-evidence-roots-json",
         "source-identity-root",
         "source-patch-root",
+        "source-workflow-id",
+        "source-workflow-run-id",
         "target-branch",
         "toolchain-root",
         "warrant-lease-seconds"
       ],
-      "inputCount": 32,
+      "inputCount": 36,
       "secrets": [
         "github-token"
       ],
@@ -1934,6 +1938,118 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "engineering-housekeeper-daily",
+      "path": ".github/workflows/engineering-housekeeper-daily.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "preview",
+      "owner": "buildchain-workflows",
+      "maturity": "preview",
+      "introducedVersion": "3.0.7",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only."
+    },
+    {
+      "id": "engineering-housekeeper-monthly",
+      "path": ".github/workflows/engineering-housekeeper-monthly.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "preview",
+      "owner": "buildchain-workflows",
+      "maturity": "preview",
+      "introducedVersion": "3.0.7",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only."
+    },
+    {
+      "id": "engineering-housekeeper-weekly",
+      "path": ".github/workflows/engineering-housekeeper-weekly.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "preview",
+      "owner": "buildchain-workflows",
+      "maturity": "preview",
+      "introducedVersion": "3.0.7",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only."
+    },
+    {
+      "id": "engineering-housekeeper",
+      "path": ".github/workflows/engineering-housekeeper.yml",
+      "reusable": true,
+      "inputs": [
+        "apply-enabled",
+        "artifact-prefix",
+        "artifact-retention-days",
+        "buildchain-ref",
+        "buildchain-repository",
+        "max-actions",
+        "mode",
+        "protected-patterns",
+        "repository",
+        "retained-patterns",
+        "stale-days",
+        "stale-pull-request-label",
+        "target-branch"
+      ],
+      "inputCount": 13,
+      "secrets": [
+        "github_app_id",
+        "github_app_private_key",
+        "github_token"
+      ],
+      "secretCount": 3,
+      "outputs": [
+        "action-count",
+        "branch-receipt-root",
+        "outcome",
+        "plan-artifact",
+        "plan-root",
+        "pull-request-receipt-root",
+        "receipt-artifact",
+        "report-artifact",
+        "report-receipt-root"
+      ],
+      "outputCount": 9,
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "preview",
+      "owner": "buildchain-workflows",
+      "maturity": "preview",
+      "introducedVersion": "3.0.7",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only."
+    },
     {
       "id": "github-artifact-attestation",
       "path": ".github/workflows/github-artifact-attestation.yml",
@@ -2932,6 +3048,7 @@
         "publish-package-set-order",
         "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
+        "publish-required-artifacts-path",
         "publish-sealed-bundle-manifest",
         "publish-sealed-bundle-root",
         "publish-source-locked",
@@ -2983,7 +3100,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 79,
+      "inputCount": 80,
       "capabilityGroup": "release-passport-trust",
       "status": "active",
       "owner": "buildchain-actions",

package/docs/MAP.md

@@ -115,6 +115,7 @@ replace them.
 | How does the durable fair Dev Delivery Warrant Queue prevent slow-candidate starvation?                                                       | [`dev-delivery-warrant.md`](dev-delivery-warrant.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | use/verify | preview |
 | How do I coalesce rapid Dev changes, preserve release runner priority, and retry only transient failed jobs? | [`dev-qualification-patrol.md`](dev-qualification-patrol.md) | use/verify | preview |
 | How do I run daily, weekly, or monthly repository patrols? | [`release-governance.md`](release-governance.md#buildchain-patrol) | use | stable |
+| How do I report or safely apply branch and pull-request engineering hygiene? | [`engineering-housekeeper.md`](engineering-housekeeper.md) | use/verify | preview |
 | How does Buildchain decide patch, minor, and major release lines? | [`versioning.md`](versioning.md) | why | stable |
 | What exact branch/tag state machine runs on alpha, release, and major gate? | [`release-flow.md`](release-flow.md) | verify | stable |
 | What did Buildchain migrate or retire from old action repositories? | [`migration-inventory.md`](migration-inventory.md) | verify | stable |

package/docs/auditable-demo.md

@@ -47,7 +47,7 @@ literal argv steps. Steps in one demo share a disposable workspace; separate
 demos and the two rendition captures do not. Commands are never accepted as a
 shell string. An omitted or explicit `standard` duration class remains bounded
 to 60 seconds. A reviewed `execution.durationClass: long-form` declaration may
-raise the scenario and literal step ceilings to 180 seconds; it does not change
+raise the scenario and literal step ceilings to 360 seconds; it does not change
 the default. Both classes retain 4 MiB per step, a clean Home/XDG environment,
 no inherited credentials, and a network-disabled read-only container with
 bounded tmpfs.
@@ -155,7 +155,7 @@ scene.json
 
 It may additionally emit one declared `terminal-capture.json` using
 `kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds by
-default or 180 seconds only when its scene explicitly declares `long-form`,
+default or 360 seconds only when its scene explicitly declares `long-form`,
 fixed 80-200 by 24-80 terminal cells, 10,000 events, and 4 MiB of canonical
 base64 bytes. It must contain a qualified completion sentinel and an explicitly
 empty authority-grant list. Existing three-file adapters remain valid.