@kungfu-tech/buildchain 3.0.9-alpha.1 → 3.0.9-alpha.10

package/docs/MAP.md

@@ -59,14 +59,14 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Capability group | Primary facts | Primary manuals |
 | --- | --- | --- |
 | Getting Started | `capability-registry.json`, `product-mechanism.json` | [`getting-started.md`](getting-started.md), [`install.md`](install.md), [`product-mechanism.md`](product-mechanism.md), [`cli.md`](cli.md) |
-| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`github-artifact-attestation.md`](github-artifact-attestation.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`release-train.md`](release-train.md), [`publish-transaction.md`](publish-transaction.md), [`release-tail-contract.md`](release-tail-contract.md), [`publication-rehearsal.md`](publication-rehearsal.md), [`binary-distribution.md`](binary-distribution.md) |
+| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`adopter-delivery-gate.md`](adopter-delivery-gate.md), [`github-artifact-attestation.md`](github-artifact-attestation.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`release-train.md`](release-train.md), [`publish-transaction.md`](publish-transaction.md), [`release-tail-contract.md`](release-tail-contract.md), [`publication-rehearsal.md`](publication-rehearsal.md), [`binary-distribution.md`](binary-distribution.md) |
 | Reusable Build and Lifecycle | `workflow-registry.json`, `controller-registry.json`, `release-model.json` | [`reusable-build-surface.md`](reusable-build-surface.md), [`controller-evidence.md`](controller-evidence.md), [`shifu-gate-profiles.md`](shifu-gate-profiles.md), [`lifecycle-protocol.md`](lifecycle-protocol.md) |
 | KFD Trust and Surface Closure | `kfd-claims.json`, `public-surface-audit.json`, `cli-registry.json`, `node-api-registry.json` | [`kfd-support.md`](kfd-support.md), [`release-passport.md`](release-passport.md) |
 | Site Bundle, Web Surfaces, and Propagation | `buildchain-site.json`, `site-manifest.json`, `page-registry.json`, `release-model.json` | [`site-bundle-contract.md`](site-bundle-contract.md), [`web-surface-deployments.md`](web-surface-deployments.md), [`release-propagation.md`](release-propagation.md) |
 | Publication Artifacts | `publication-registry.json`, `workflow-registry.json`, `node-api-registry.json`, `manual-registry.json`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md), [`reusable-build-surface.md`](reusable-build-surface.md) |
 | Distribution Indexes and Badges | `badge-endpoint-registry.json`, `node-api-registry.json`, `manual-registry.json` | [`readme-badges.md`](readme-badges.md), [`homebrew.md`](homebrew.md) |
 | Build Facts, Observability, and Diagnostics | `cli-registry.json`, `node-api-registry.json`, lifecycle artifacts | [`build-facts.md`](build-facts.md), [`toolkit-observability.md`](toolkit-observability.md), [`consumer-issue-reporting.md`](consumer-issue-reporting.md) |
-| Governance, Versioning, and Runtime Drift | `buildchain-contract.json`, `workflow-registry.json`, `release-model.json` | [`github-governance-authority.md`](github-governance-authority.md), [`release-governance.md`](release-governance.md), [`release-flow.md`](release-flow.md), [`versioning.md`](versioning.md), [`runtime-train-validation.md`](runtime-train-validation.md), [`cli.md`](cli.md) |
+| Governance, Versioning, and Runtime Drift | `buildchain-contract.json`, `workflow-registry.json`, `release-model.json` | [`github-governance-authority.md`](github-governance-authority.md), [`release-governance.md`](release-governance.md), [`release-flow.md`](release-flow.md), [`next-development-transition.md`](next-development-transition.md), [`versioning.md`](versioning.md), [`runtime-train-validation.md`](runtime-train-validation.md), [`cli.md`](cli.md) |
 | CLI and Node API Reference | `cli-registry.json`, `node-api-registry.json`, `workflow-registry.json`, `manual-registry.json` | [`cli-reference.md`](cli-reference.md), [`node-api-reference.md`](node-api-reference.md), [`cli.md`](cli.md), [`../packages/core/README.md`](../packages/core/README.md) |
 
 | Capability | Machine-readable entry | Manual entry |
@@ -107,6 +107,7 @@ replace them.
 | How do I install a standalone binary or npm package? | [`install.md`](install.md) | use | stable |
 | How do I run or look up the `buildchain` CLI? | [`cli-reference.md`](cli-reference.md) + [`cli.md`](cli.md) | use | stable |
 | How do I import Buildchain toolkit APIs from JavaScript build code? | [`node-api-reference.md`](node-api-reference.md) + [`../packages/core/README.md`](../packages/core/README.md) | use | stable |
+| How are bounded Qualification Leases separated from exclusive merge-group Landing authority? | [`dev-delivery-qualification-landing-adr.md`](dev-delivery-qualification-landing-adr.md) + [`dev-delivery-warrant.md`](dev-delivery-warrant.md) | govern | accepted |
 | How do I initialize a new repository? | [`getting-started.md`](getting-started.md) + [`lifecycle-protocol.md`](lifecycle-protocol.md) | use | stable |
 | Why does Buildchain use branch-driven release governance? | [`release-governance.md`](release-governance.md) | why | stable |
 | What freezes the v4 dependency direction, writer authority, complexity budgets, exceptions, and N-1 qualification? | [`../architecture/v4-architecture-constitution.md`](../architecture/v4-architecture-constitution.md) | why/verify | preview |
@@ -118,6 +119,7 @@ replace them.
 | How do I report or safely apply branch and pull-request engineering hygiene? | [`engineering-housekeeper.md`](engineering-housekeeper.md) | use/verify | preview |
 | How does Buildchain decide patch, minor, and major release lines? | [`versioning.md`](versioning.md) | why | stable |
 | What exact branch/tag state machine runs on alpha, release, and major gate? | [`release-flow.md`](release-flow.md) | verify | stable |
+| How does a completed Alpha remain successful while the following development version is prepared? | [`next-development-transition.md`](next-development-transition.md), [`../architecture/decisions/0002-next-development-transition.md`](../architecture/decisions/0002-next-development-transition.md) | verify/use | preview |
 | What did Buildchain migrate or retire from old action repositories? | [`migration-inventory.md`](migration-inventory.md) | verify | stable |
 | What is the active action and workflow source of truth? | [`ownership.md`](ownership.md) | verify | stable |
 | How do I declare version files and custom lifecycle commands? | [`lifecycle-protocol.md`](lifecycle-protocol.md) | use | stable |
@@ -127,6 +129,7 @@ replace them.
 | How do I collect and verify module/product build facts from Git source, version files, and outputs? | [`build-facts.md`](build-facts.md) + [`cli.md`](cli.md) | use/verify | stable |
 | How do I publish or verify release passport artifacts? | [`release-passport.md`](release-passport.md) | use | stable |
 | How do I keylessly attest Linux release artifacts with GitHub and bind them to a Release Passport? | [`github-artifact-attestation.md`](github-artifact-attestation.md) | verify/use | preview |
+| How do I evaluate one project instance through an exact protocol driver and artifact profile without copying KFD semantics? | [`adopter-delivery-gate.md`](adopter-delivery-gate.md) | use/verify | preview |
 | How do I request detached, Developer ID, or Authenticode signing without consumer credentials? | [`reusable-build-surface.md`](reusable-build-surface.md#artifact-signing-authority) | verify/use | preview |
 | How do I seal exact artifact, identity, lifecycle, and KFD assessment roots for KFX admission? | [`artifact-verification-envelope.md`](artifact-verification-envelope.md) | verify/use | preview |
 | How is product publication authority sealed to an exact workflow, runner, control plane, nonce, and artifact? | [`publication-authority.md`](publication-authority.md) | verify | preview |

package/docs/adopter-delivery-gate.md

@@ -0,0 +1,106 @@
+---
+status: active
+period: ongoing
+theme: adopter-delivery-gate
+doc_type: technical-reference
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-08-12
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-12
+  invisible_context: not asserted
+---
+
+# Adopter Delivery Gate
+
+Buildchain exposes one protocol-neutral delivery gate. A caller registers an
+exact semantic protocol driver and an exact artifact profile, then evaluates a
+rooted project instance request. The core does not branch on project identity
+and does not infer KFD semantics.
+
+```js
+import {
+  createAdopterDeliveryGate,
+  createPackageArtifactProfile,
+} from "@kungfu-tech/buildchain/adopter-delivery-gate";
+import { createKfdAdopterCategoryProtocolDriver } from "@kungfu-tech/buildchain/kfd-adopter-category-driver";
+
+const gate = createAdopterDeliveryGate({
+  drivers: [createKfdAdopterCategoryProtocolDriver()],
+  artifactProfiles: [createPackageArtifactProfile()],
+});
+const result = gate.evaluate(request, {
+  adopterManifest,
+  verifiedAt: "2026-08-12T00:00:00.000Z",
+  maxAgeSeconds: 86400,
+});
+```
+
+The KFD driver consumes only the installed published `@kungfu-tech/kfd`
+category catalog, manifest verifier, resolver and category-instance verifier.
+Caller-supplied catalog overrides are ignored. The legacy driver is a separate
+one-way adapter for the existing standard adopter manifest and support-matrix
+projection; it is not KFD declaration authority.
+
+### Buildchain delivery-infrastructure instance
+
+`@kungfu-tech/buildchain/buildchain-delivery-infrastructure` constructs the
+Buildchain-owned project instance for the published
+`kfd.adopter-category/delivery-infrastructure@1.0.0` profile. Callers provide a
+release-bound full-cut adopter manifest plus exact source, package, release, and
+project evidence coordinates. The constructor derives the selected obligation
+set from published KFD bytes and stamps every evidence item with the same
+project, adopter-manifest, package-cut, and category-selection roots.
+
+The constructor rejects private or unknown requirement IDs instead of silently
+extending the KFD profile. Verification delegates back to the published KFD
+full-manifest and category-instance verifiers. A passing instance is still a
+declaration-only, non-transferable result: it grants no runtime, publication,
+promotion, or certification authority. Buildchain's anti-circular N-1 release
+qualification remains a separate release gate.
+
+### Buildchain anti-circular bootstrap
+
+`@kungfu-tech/buildchain/buildchain-delivery-bootstrap` verifies that one exact
+candidate is supported by a distinct protected and publicly released N-1 cut,
+its passed project gate result, and its merged Delivery Warrant evidence. The
+candidate must name the exact authority version; source or package reuse is
+rejected. Changes to the gate, protocol, or selected profile additionally need
+content-rooted compatibility and independent-review evidence.
+
+The result is evidence only. It always retains `qualifying: false`,
+`selfCertified: false`, and `releaseAuthorized: false`; publication and release
+authority remain with the protected delivery and release mechanisms.
+
+## Fail-closed boundaries
+
+- Driver and artifact-profile selection require an exact `id@version` match.
+- Package, Git commit and custom immutable artifact kinds use explicit profiles.
+- Unknown fields, malformed roots, non-JSON declarations, driver exceptions,
+  ambiguous kinds, stale KFD cuts and substituted evidence fail closed.
+- Every result retains `qualifying: false` and `selfCertified: false`.
+- Category conformance never grants runtime permission, release authorization
+  or independent certification.
+
+## Release Passport binding
+
+Use `@kungfu-tech/buildchain/adopter-delivery-passport` to create and validate
+the exact binding. Release Passport and artifact evidence must contain the same
+rooted gate closure; neither side may introduce or replace delivery evidence.
+
+## Offline vectors
+
+`@kungfu-tech/buildchain/adopter-delivery-vectors` exports the immutable
+`ADOPTER_DELIVERY_VECTOR_SUITE`. Its root binds golden two-driver replay,
+unknown-driver rejection, published-KFD category conflict, evidence
+substitution, stale package cut and driver-fault redaction. Consumers can call
+`validateAdopterDeliveryVectorSuite()` before replay and use
+`getAdopterDeliveryVector()` to select one named case.
+
+The suite records KFD package and vector subpaths as authority coordinates. It
+does not copy KFD category policy into Buildchain.

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -343,6 +343,11 @@ JIT SecureString under `/kungfu/burst/macos/`, then runs GitHub Actions Runner
 2.336.0 for exactly one job. The runner archive is pinned to the official
 macOS ARM64 SHA256. No GitHub, signing, notarization, publication, SSH, or
 static AWS credential is admitted to the instance.
+The provider provenance step explicitly disables artifact-signing request
+sealing for these qualification jobs, so consumer signing declarations cannot
+turn a runner-profile smoke or full qualification into a signing-authority
+dispatch. All other Buildchain lanes retain the default fail-closed signing
+declaration behavior.
 
 The instance uses the exact retained Amazon EC2 macOS AMI, IMDSv2, an encrypted
 delete-on-termination root volume, no inbound security-group rule, and the
@@ -380,7 +385,7 @@ host, including at least one full run, plus proof that:
 ### Phase 3 lifecycle controller
 
 `scripts/aws-macos-jit-controller.mjs` is the operator boundary for the paid
-campaign. It has four explicit mutation modes:
+campaign. It has five explicit mutation modes:
 
 - `launch-campaign` binds the exact repository source, AMI, availability zone,
   tagged Dedicated Host, and reusable instance. Before paid allocation it
@@ -390,6 +395,12 @@ campaign. It has four explicit mutation modes:
   a DryRun parameter for `AllocateHosts`, it requires an allowed IAM policy
   simulation for the exact tagged allocation before the real call, then a
   successful `RunInstances` DryRun before launching the instance.
+- `rehydrate-instance` creates a replacement instance on the one already-paid,
+  empty campaign host after an interrupted or failed instance lifecycle. It
+  rechecks the exact account, disabled workflow, Budget, source, host identity
+  and allocation time, zero runner residue, zero active JIT instances, and no
+  other active Mac host in either admitted region. It then requires a
+  successful same-host `RunInstances` DryRun and never calls `AllocateHosts`.
 - `run-job` binds one queued exact-source GitHub job to the existing campaign
   host and instance. It writes the repository JIT configuration through a
   mode-0600 temporary file into a distinct SSM SecureString, sends only the
@@ -405,6 +416,16 @@ campaign. It has four explicit mutation modes:
   existing GitHub ref, emits a zero-allocation receipt, and compensates back to
   the prior source if the ref update or readback fails. It never calls
   `AllocateHosts`, `RunInstances`, or workflow dispatch.
+- `rebind-campaign-after-failure` advances that same host and instance only
+  after the operator confirms the complete prior run-id inventory. Every named
+  run must be terminal with conclusion `failure`, all of its jobs must be
+  complete, and both GitHub artifacts and S3 bootstrap evidence must still be
+  present. The replacement source must remain a strict descendant on the same
+  ref, the workflow must be disabled, the next-source evidence prefix must be
+  empty, and runner plus SSM residue must be zero. The old evidence is retained
+  and included in the rebind receipt; the operation changes only the existing
+  source ref and resource tags, with the same compensated rollback and zero
+  allocation boundary as an unused-campaign rebind.
 - `close-campaign` refuses execution before the provider's 24-hour minimum,
   verifies the encrypted delete-on-termination root volume, removes scoped JIT
   residue, terminates the exact instance, and requires a `ReleaseHosts` DryRun
@@ -417,8 +438,14 @@ through `--confirm-source-sha` and `--confirm-campaign-id`. `run-job` also
 requires `--confirm-run-id`; `launch-campaign` additionally requires the
 expected workload account through `--account-id`. `rebind-campaign`
 additionally repeats the prior source, host, and instance identities and
-requires `--confirm-zero-allocation`. Omitting `--execute` emits a deterministic
-plan without changing AWS or GitHub state.
+requires `--confirm-zero-allocation`. `rehydrate-instance` additionally repeats
+the existing host and replaced instance identities and requires
+`--confirm-no-host-allocation`. Omitting `--execute` emits a deterministic plan
+without changing AWS or GitHub state.
+`rebind-campaign-after-failure` additionally requires matching
+`--terminal-failure-run-ids-json` and
+`--confirm-terminal-failure-run-ids-json` arrays so an unobserved or newly
+created run fails closed before any tag or ref mutation.
 
 ## Provider lifecycle
 

package/docs/cli-reference.md

@@ -269,6 +269,127 @@ buildchain create runner-provenance --input-json <file-or-json> [--output <file>
 buildchain dev
 ```
 
+### `buildchain dev authority admit-merge-group`
+
+- Help: `buildchain dev authority admit-merge-group --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
+### `buildchain dev authority complete-qualification`
+
+- Help: `buildchain dev authority complete-qualification --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
+### `buildchain dev authority heartbeat-landing`
+
+- Help: `buildchain dev authority heartbeat-landing --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
+### `buildchain dev authority heartbeat-qualification`
+
+- Help: `buildchain dev authority heartbeat-qualification --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
+### `buildchain dev authority lease-landing`
+
+- Help: `buildchain dev authority lease-landing --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
+### `buildchain dev authority lease-qualification`
+
+- Help: `buildchain dev authority lease-qualification --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
+### `buildchain dev authority migrate`
+
+- Help: `buildchain dev authority migrate --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
+### `buildchain dev authority observe`
+
+- Help: `buildchain dev authority observe --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
+### `buildchain dev authority recover`
+
+- Help: `buildchain dev authority recover --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
+### `buildchain dev authority settle`
+
+- Help: `buildchain dev authority settle --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
+### `buildchain dev authority submit`
+
+- Help: `buildchain dev authority submit --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
 ### `buildchain dev merge-queue`
 
 - Help: `buildchain dev merge-queue --help`
@@ -299,7 +420,18 @@ buildchain dev pr-admit --repository <owner/repo> --branch <dev/vN/vN.M> --pull-
 - Syntax:
 
 ```text
-buildchain dev proof <source|verify-source|classify|replay|integration|verify-integration> [--output <file>] [--json]
+buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration> [--output <file>] [--json]
+```
+
+### `buildchain dev proof classify-native`
+
+- Help: `buildchain dev proof classify-native --help`
+- Canonical id: `dev`
+- Options: `--json`, `--output`
+- Syntax:
+
+```text
+buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration> [--output <file>] [--json]
 ```
 
 ### `buildchain dev proof integration`
@@ -310,7 +442,18 @@ buildchain dev proof <source|verify-source|classify|replay|integration|verify-in
 - Syntax:
 
 ```text
-buildchain dev proof <source|verify-source|classify|replay|integration|verify-integration> [--output <file>] [--json]
+buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration> [--output <file>] [--json]
+```
+
+### `buildchain dev proof native`
+
+- Help: `buildchain dev proof native --help`
+- Canonical id: `dev`
+- Options: `--json`, `--output`
+- Syntax:
+
+```text
+buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration> [--output <file>] [--json]
 ```
 
 ### `buildchain dev proof replay`
@@ -321,7 +464,7 @@ buildchain dev proof <source|verify-source|classify|replay|integration|verify-in
 - Syntax:
 
 ```text
-buildchain dev proof <source|verify-source|classify|replay|integration|verify-integration> [--output <file>] [--json]
+buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration> [--output <file>] [--json]
 ```
 
 ### `buildchain dev proof source`
@@ -332,7 +475,7 @@ buildchain dev proof <source|verify-source|classify|replay|integration|verify-in
 - Syntax:
 
 ```text
-buildchain dev proof <source|verify-source|classify|replay|integration|verify-integration> [--output <file>] [--json]
+buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration> [--output <file>] [--json]
 ```
 
 ### `buildchain dev proof verify-integration`
@@ -343,7 +486,29 @@ buildchain dev proof <source|verify-source|classify|replay|integration|verify-in
 - Syntax:
 
 ```text
-buildchain dev proof <source|verify-source|classify|replay|integration|verify-integration> [--output <file>] [--json]
+buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration> [--output <file>] [--json]
+```
+
+### `buildchain dev proof verify-native`
+
+- Help: `buildchain dev proof verify-native --help`
+- Canonical id: `dev`
+- Options: `--json`, `--output`
+- Syntax:
+
+```text
+buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration> [--output <file>] [--json]
+```
+
+### `buildchain dev proof verify-native-reuse`
+
+- Help: `buildchain dev proof verify-native-reuse --help`
+- Canonical id: `dev`
+- Options: `--json`, `--output`
+- Syntax:
+
+```text
+buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration> [--output <file>] [--json]
 ```
 
 ### `buildchain dev proof verify-source`
@@ -354,7 +519,18 @@ buildchain dev proof <source|verify-source|classify|replay|integration|verify-in
 - Syntax:
 
 ```text
-buildchain dev proof <source|verify-source|classify|replay|integration|verify-integration> [--output <file>] [--json]
+buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration> [--output <file>] [--json]
+```
+
+### `buildchain dev two-phase`
+
+- Help: `buildchain dev two-phase --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--expected-head`, `--native-command`, `--native-proof`, `--pull-request`, `--repository`, `--warrant-result`
+- Syntax:
+
+```text
+buildchain dev two-phase --repository <owner/repo> --branch <dev/vN/vN.M> --pull-request <n> --expected-head <sha> --warrant-result <file> [--native-proof <file>] [--native-command <command>]
 ```
 
 ### `buildchain dev warrant cancel-queued`
@@ -365,7 +541,7 @@ buildchain dev proof <source|verify-source|classify|replay|integration|verify-in
 - Syntax:
 
 ```text
-buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
 ```
 
 ### `buildchain dev warrant close`
@@ -376,7 +552,7 @@ buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|obse
 - Syntax:
 
 ```text
-buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
 ```
 
 ### `buildchain dev warrant heartbeat`
@@ -387,7 +563,7 @@ buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|obse
 - Syntax:
 
 ```text
-buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
 ```
 
 ### `buildchain dev warrant observe`
@@ -398,7 +574,18 @@ buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|obse
 - Syntax:
 
 ```text
-buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+```
+
+### `buildchain dev warrant qualify`
+
+- Help: `buildchain dev warrant qualify --help`
+- Canonical id: `dev`
+- Options: `--branch`, `--execute`, `--json`, `--output`, `--repository`
+- Syntax:
+
+```text
+buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
 ```
 
 ### `buildchain dev warrant recover`
@@ -409,7 +596,7 @@ buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|obse
 - Syntax:
 
 ```text
-buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
 ```
 
 ### `buildchain dev warrant select`
@@ -420,7 +607,7 @@ buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|obse
 - Syntax:
 
 ```text
-buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
 ```
 
 ### `buildchain dev warrant submit`
@@ -431,7 +618,7 @@ buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|obse
 - Syntax:
 
 ```text
-buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
+buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|cancel-queued|observe> --repository <owner/repo> --branch <dev/vN/vN.M> [--execute] [--output <file>] [--json]
 ```
 
 ## `diagnostics`

package/docs/dev-alpha-candidate-patrol.md

@@ -59,6 +59,14 @@ controller then compares the selected SHA to the exact Alpha head before it can
 be eligible, so a bounded scan cannot turn a commit outside the promotion
 ancestry into a candidate.
 
+Generated next-development version preparation is not a product candidate. The
+observer skips both the signed `chore(release): prepare ...` commit and its
+two-parent integration commit. When later product work becomes qualified, the
+nearest preparation becomes a reservation: Patrol reads every path changed by
+that preparation at both exact SHAs and requires identical Git blob identities.
+A missing or stale reserved path blocks selection before the Release Cut and
+therefore before any heavy candidate build.
+
 The decision is `kungfu-buildchain-channel-candidate-decision/v1`. It records the
 source and target branches and SHAs, comparison distance, workflow paths, run
 identities and attempts, completion times, URLs, policy, and a canonical decision