@kungfu-tech/buildchain 3.0.9-alpha.4 → 3.0.9-alpha.6

package/docs/release-passport.md

@@ -410,8 +410,14 @@ Pass the standard full-cut declaration with `--kfd-adopter-manifest-json`
 together with three `--kfd-product-gate-json` arguments for KFD-4, KFD-5, and
 KFD-7. The collector invokes the verifier from the exact installed
 `@kungfu-tech/kfd` package, binds the package artifact, registry and verifier
-roots, the exact Buildchain source, the manifest/report/bundle witness roots,
-and the existing product-gate roots. It emits `kfd-adopter-manifest.json`,
+roots, the collector's exact product repository and source, the
+manifest/report/bundle witness roots, and the existing product-gate roots. A
+non-Buildchain adopter is accepted only when its manifest identity, artifact
+coordinate, and all three product-gate repositories match the collector's
+`--repository` value. The lower-level Node API exposes the same boundary as
+`expectedAdopterId`, `expectedSourceRepository`, and `expectedSourceSha`, while
+omitted identity/repository values retain the Buildchain self-release default.
+It emits `kfd-adopter-manifest.json`,
 `kfd-adopter-manifest-gate.json`, and a legacy `kfd-support.json` projection.
 The release passport and `artifact-evidence.json` carry the same rooted
 `kfdAdopter` binding.

package/docs/versioning.md

@@ -79,6 +79,7 @@ repository changes are patch".
 
 | Date       | Action       | Line    | Faces                                                                                                                                                                        | Class    | Rationale                                                                                                                                                                                                                                                                                                                              | PR    |
 | ---------- | ------------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
+| 2026-08-11 | extend-minor | `v3.0`  | provisional-delivery-warrant, qualified-delivery-warrant, native-qualification-proof, native-proof-reuse-decision, generated-native-delivery-workflow                         | additive | Reserve protected-dev order after exact source acceptance and approval, then require an atomic native-proof-bound qualification before merge-queue admission. Reuse is limited to stable semantic source, closure, dependencies, and toolchain with a fully attributed disjoint base delta; overlap and uncertainty fail closed to revalidation. |       |
 | 2026-08-11 | extend-minor | `v3.0`  | release-blocker-repair-contract, release-blocker-priority-claim, release-train-node-export, dev-delivery-warrant-node-export, next-development-transition, next-development-projection | additive | Add rooted successor candidate generations on a frozen Release Cut, exact semantic patch identity across cut and Dev landings, publication blocking through conflict or mismatch, a narrow non-preemptive Warrant blocker lane, and a separate rooted transition that preserves completed Alpha success while the following development version is materialized. |       |
 | 2026-08-10 | extend-minor | `v3.0`  | release-cut-contract, release-train-state-machine, release-train-node-export                                                                                                 | additive | Add a provider-neutral rooted Release Cut and idempotent Release Train state contract that freezes candidate, tree, Alpha base, runtime, generation, and authority while treating later Dev movement as observation rather than implicit supersession.                                                                                 |       |
 | 2026-08-05 | extend-minor | `v3.0`  | auditable-demo-scenario, auditable-demo-capture, auditable-demo-adapter                                                                                                      | additive | Add an opt-in deterministic readable-playback declaration that preserves captured terminal payloads and order while normalizing only presentation timing; omitted playback continues to use observed PTY timestamps, and existing composition modes remain unchanged.                                                                  |       |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.9-alpha.4",
+  "version": "3.0.9-alpha.6",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -111,7 +111,8 @@
     "SECURITY.md",
     "docs/*.md",
     "actions/*/README.md",
-    "fixtures/*/README.md"
+    "fixtures/*/README.md",
+    "templates/"
   ],
   "engines": {
     "node": ">=22.14.0"

package/packages/core/artifact-verification-envelope.js

@@ -417,7 +417,7 @@ function kfdBindingBody({ manifest, manifestGate, legacyProjection, paths }) {
       gatePath: paths.gate,
       gateRoot: manifestGate.gateRoot,
     },
-    source: jsonClone(manifestGate.source),
+    adopter: jsonClone(manifestGate.adopter), source: jsonClone(manifestGate.source),
     standardPackage: jsonClone(manifestGate.standardPackage),
     witness: {
       decisionRoot: manifestGate.decisionWitness.root,
@@ -445,10 +445,10 @@ export function createKfdAdopterReleaseBinding({
   manifestPath = "kfd-adopter-manifest.json",
   gatePath = "kfd-adopter-manifest-gate.json",
   legacyProjectionPath = "kfd-support.json",
-  expectedSourceSha = "",
+  expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "",
 } = {}) {
   const gate = validateKfdAdopterManifestGate(manifestGate, {
-    expectedSourceSha,
+    expectedAdopterId, expectedSourceRepository, expectedSourceSha,
     checkedAt: manifestGate?.checkedAt,
   });
   const legacy = validateKfdLegacySupportMatrixProjection(legacyProjection, { manifest, manifestGate });
@@ -468,7 +468,7 @@ export function validateKfdAdopterReleaseBinding(binding, {
   manifest,
   manifestGate,
   legacyProjection,
-  expectedSourceSha = "",
+  expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "",
 } = {}) {
   const issues = [];
   if (!binding || binding.schemaVersion !== 1 || binding.contract !== KFD_ADOPTER_RELEASE_BINDING_CONTRACT) {
@@ -488,7 +488,7 @@ export function validateKfdAdopterReleaseBinding(binding, {
       manifestPath: binding.authority?.manifestPath,
       gatePath: binding.authority?.gatePath,
       legacyProjectionPath: binding.legacyProjection?.path,
-      expectedSourceSha,
+      expectedAdopterId, expectedSourceRepository, expectedSourceSha,
     });
     if (stableJson(binding) !== stableJson(expected)) {
       issues.push({ code: "adopter-release-binding-drift", path: "", message: "release binding differs from the exact manifest, gate, or legacy projection closure" });

package/packages/core/dev-delivery-native-proof.js

@@ -0,0 +1,333 @@
+import {
+  devDeliveryClone as clone,
+  devDeliveryContentRoot,
+  devDeliveryExactRoot as exactRoot,
+  devDeliveryExactSha as exactSha,
+  devDeliveryProtectedBase as protectedBase,
+  devDeliveryRepository as repository,
+  devDeliveryText as text,
+  devDeliveryTimestamp as timestamp,
+} from "./dev-delivery-common.js";
+
+export const NATIVE_QUALIFICATION_PROOF_SCHEMA =
+  "kungfu.buildchain.native-qualification-proof/v1";
+export const NATIVE_PROOF_REUSE_DECISION_SCHEMA =
+  "kungfu.buildchain.native-proof-reuse-decision/v1";
+export const DEV_DELIVERY_QUALIFICATION_RECEIPT_SCHEMA =
+  "kungfu.buildchain.dev-delivery-qualification-receipt/v1";
+
+const NATIVE_QUALIFICATION_ROOT_SEMANTICS = "semantic-native-identity-v1";
+
+function exactRoots(values, label) {
+  if (!Array.isArray(values) || values.length === 0) {
+    throw new Error(`${label} must contain at least one content root`);
+  }
+  return [...new Set(values.map((value) => exactRoot(value, label)))].sort();
+}
+
+function normalizedPaths(values) {
+  if (!Array.isArray(values)) throw new Error("paths must be a JSON array");
+  return [
+    ...new Set(
+      values
+        .map(text)
+        .map((entry) => entry.replace(/^\.\//u, "").replace(/\/+$/u, ""))
+        .filter(Boolean),
+    ),
+  ].sort();
+}
+
+function proofIdentity(body) {
+  const identity = clone(body);
+  delete identity.qualifiedAt;
+  delete identity.observationRoot;
+  return identity;
+}
+
+function proofObservation(body) {
+  return { qualifiedAt: body.qualifiedAt };
+}
+
+function rooted(body) {
+  return { ...body, decisionRoot: devDeliveryContentRoot(body) };
+}
+
+export function createNativeQualificationProof(input = {}) {
+  const body = {
+    schema: NATIVE_QUALIFICATION_PROOF_SCHEMA,
+    rootSemantics: NATIVE_QUALIFICATION_ROOT_SEMANTICS,
+    repository: repository(input.repository),
+    protectedBase: protectedBase(input.protectedBase),
+    sourceIdentityRoot: exactRoot(
+      input.sourceIdentityRoot,
+      "sourceIdentityRoot",
+    ),
+    sourcePatchRoot: exactRoot(input.sourcePatchRoot, "sourcePatchRoot"),
+    planRoot: exactRoot(input.planRoot, "planRoot"),
+    closureRoot: exactRoot(input.closureRoot, "closureRoot"),
+    dependencyRoot: exactRoot(input.dependencyRoot, "dependencyRoot"),
+    toolchainRoot: exactRoot(input.toolchainRoot, "toolchainRoot"),
+    qualifiedBase: exactSha(input.qualifiedBase, "qualifiedBase"),
+    affectedPaths: normalizedPaths(input.affectedPaths || []),
+    shardEvidenceRoots: exactRoots(
+      input.shardEvidenceRoots,
+      "shardEvidenceRoots",
+    ),
+    qualifiedAt: timestamp(input.qualifiedAt, "qualifiedAt"),
+  };
+  body.observationRoot = devDeliveryContentRoot(proofObservation(body));
+  return {
+    ...body,
+    proofRoot: devDeliveryContentRoot(proofIdentity(body)),
+  };
+}
+
+export function verifyNativeQualificationProof(proofInput, expected = {}) {
+  try {
+    const proof = clone(proofInput || {});
+    if (proof.schema !== NATIVE_QUALIFICATION_PROOF_SCHEMA) {
+      return { ok: false, reason: "unsupported-schema" };
+    }
+    const proofRoot = proof.proofRoot;
+    delete proof.proofRoot;
+    if (proof.rootSemantics !== NATIVE_QUALIFICATION_ROOT_SEMANTICS) {
+      return { ok: false, reason: "unsupported-root-semantics" };
+    }
+    if (devDeliveryContentRoot(proofIdentity(proof)) !== proofRoot) {
+      return { ok: false, reason: "proof-root-drift" };
+    }
+    if (
+      devDeliveryContentRoot(proofObservation(proof)) !== proof.observationRoot
+    ) {
+      return { ok: false, reason: "observation-root-drift" };
+    }
+    for (const [field, value] of Object.entries(expected)) {
+      if (value !== undefined && proof[field] !== value) {
+        return { ok: false, reason: `${field}-mismatch` };
+      }
+    }
+    createNativeQualificationProof(proof);
+    return { ok: true, reason: "exact-native-proof", proofRoot };
+  } catch (error) {
+    return { ok: false, reason: "invalid-proof", error: error.message };
+  }
+}
+
+function pathsOverlap(changedPath, affectedPath) {
+  if (affectedPath === "*" || affectedPath === "**") return true;
+  return (
+    changedPath === affectedPath ||
+    changedPath.startsWith(`${affectedPath}/`) ||
+    affectedPath.startsWith(`${changedPath}/`)
+  );
+}
+
+function nativeReuseBody(proof, current) {
+  const verification = verifyNativeQualificationProof(proof);
+  const currentBase = current.currentBase
+    ? exactSha(current.currentBase, "currentBase")
+    : null;
+  const changedPaths = normalizedPaths(current.changedPaths || []);
+  const base = {
+    schema: NATIVE_PROOF_REUSE_DECISION_SCHEMA,
+    proofRoot: verification.ok ? proof.proofRoot : null,
+    repository: verification.ok ? proof.repository : null,
+    protectedBase: verification.ok ? proof.protectedBase : null,
+    qualifiedBase: verification.ok ? proof.qualifiedBase : null,
+    currentBase,
+    graphKnown: current.graphKnown === true,
+    changedPaths,
+    overlappingPaths: [],
+    reusable: false,
+    action: "rerun-full-native-qualification",
+    reason: verification.reason,
+    requiredValidation: "full-native",
+  };
+  if (!verification.ok) return base;
+
+  const semanticFields = [
+    "sourceIdentityRoot",
+    "sourcePatchRoot",
+    "planRoot",
+    "closureRoot",
+    "dependencyRoot",
+    "toolchainRoot",
+  ];
+  for (const field of semanticFields) {
+    if (!current[field] || current[field] !== proof[field]) {
+      return {
+        ...base,
+        reason: `${field}-changed-or-unknown`,
+      };
+    }
+  }
+  if (!currentBase) {
+    return { ...base, reason: "current-base-unknown" };
+  }
+  if (currentBase === proof.qualifiedBase) {
+    return {
+      ...base,
+      reusable: true,
+      action: "accept-fresh-native-proof",
+      reason: "exact-qualified-base",
+      requiredValidation: "exact-merge-group",
+    };
+  }
+  if (current.graphKnown !== true || !Array.isArray(current.changedPaths)) {
+    return { ...base, reason: "base-delta-attribution-unknown" };
+  }
+  if (proof.affectedPaths.length === 0) {
+    return { ...base, reason: "affected-closure-paths-unknown" };
+  }
+  const overlap = changedPaths.filter((changedPath) =>
+    proof.affectedPaths.some((affectedPath) =>
+      pathsOverlap(changedPath, affectedPath),
+    ),
+  );
+  if (overlap.length > 0) {
+    return {
+      ...base,
+      action: "rerun-affected-native-shards",
+      reason: "base-delta-overlaps-affected-closure",
+      requiredValidation: "incremental-or-full-native",
+      overlappingPaths: overlap,
+    };
+  }
+  return {
+    ...base,
+    reusable: true,
+    action: "reuse-native-proof",
+    reason: "semantic-source-stable-and-base-delta-disjoint",
+    requiredValidation: "exact-merge-group",
+  };
+}
+
+export function createNativeProofReuseDecision({ proof, current = {} } = {}) {
+  return rooted(nativeReuseBody(proof, current));
+}
+
+export function verifyNativeProofReuseDecision(
+  decisionInput,
+  { proof, current = {} } = {},
+) {
+  try {
+    const decision = clone(decisionInput || {});
+    if (decision.schema !== NATIVE_PROOF_REUSE_DECISION_SCHEMA) {
+      return { ok: false, reason: "unsupported-schema" };
+    }
+    const decisionRoot = decision.decisionRoot;
+    delete decision.decisionRoot;
+    if (devDeliveryContentRoot(decision) !== decisionRoot) {
+      return { ok: false, reason: "decision-root-drift" };
+    }
+    const recomputed = nativeReuseBody(proof, current);
+    if (JSON.stringify(decision) !== JSON.stringify(recomputed)) {
+      return { ok: false, reason: "decision-input-drift" };
+    }
+    return {
+      ok: decision.reusable === true,
+      reason: decision.reason,
+      decisionRoot,
+      action: decision.action,
+    };
+  } catch (error) {
+    return { ok: false, reason: "invalid-decision", error: error.message };
+  }
+}
+
+export function createDevDeliveryWarrantQualifier({
+  transition,
+  assertWarrantMutation,
+} = {}) {
+  return function qualifyDevDeliveryWarrant(
+    queueInput,
+    warrant,
+    {
+      nativeProof,
+      reuseDecision,
+      current = {},
+      now = new Date().toISOString(),
+    } = {},
+  ) {
+    const currentTime = timestamp(now, "now");
+    const transaction = transition(
+      queueInput,
+      (queue, before) => {
+        assertWarrantMutation(before, warrant, currentTime);
+        if (before.activeWarrant.phase !== "provisional") {
+          throw new Error(
+            "only a provisional Delivery Warrant can be qualified",
+          );
+        }
+        const active = before.activeWarrant;
+        const proofVerification = verifyNativeQualificationProof(nativeProof, {
+          repository: before.repository,
+          protectedBase: before.protectedBase,
+          sourceIdentityRoot: active.sourceIdentityRoot,
+          sourcePatchRoot: active.sourcePatchRoot,
+          planRoot: active.planRoot,
+          closureRoot: active.closureRoot,
+          dependencyRoot: active.dependencyRoot,
+          toolchainRoot: active.toolchainRoot,
+        });
+        if (!proofVerification.ok) {
+          throw new Error(`native proof rejected: ${proofVerification.reason}`);
+        }
+        const reuseVerification = verifyNativeProofReuseDecision(
+          reuseDecision,
+          {
+            proof: nativeProof,
+            current: {
+              ...current,
+              sourceIdentityRoot: active.sourceIdentityRoot,
+              sourcePatchRoot: active.sourcePatchRoot,
+              planRoot: active.planRoot,
+              closureRoot: active.closureRoot,
+              dependencyRoot: active.dependencyRoot,
+              toolchainRoot: active.toolchainRoot,
+            },
+          },
+        );
+        if (!reuseVerification.ok) {
+          throw new Error(
+            `native proof is not reusable: ${reuseVerification.reason}`,
+          );
+        }
+        queue.activeWarrant.phase = "qualified";
+        queue.activeWarrant.nativeProofRoot = proofVerification.proofRoot;
+        queue.activeWarrant.nativeProofReuseRoot =
+          reuseVerification.decisionRoot;
+        queue.activeWarrant.qualifiedAt = currentTime;
+        queue.activeWarrant.nextAction =
+          "Enter the GitHub merge queue at the exact fenced PR head; merge_group remains final authority.";
+        const candidate = queue.candidates.find(
+          (entry) => entry.candidateId === queue.activeWarrant.candidateId,
+        );
+        candidate.status = "qualified";
+        candidate.updatedAt = currentTime;
+        return { candidate, warrant: queue.activeWarrant };
+      },
+      currentTime,
+    );
+    const receipt = {
+      schema: DEV_DELIVERY_QUALIFICATION_RECEIPT_SCHEMA,
+      action: "qualified-warrant",
+      candidateId: transaction.result.candidate.candidateId,
+      fencingToken: transaction.result.warrant.fencingToken,
+      leaseGeneration: transaction.result.warrant.generation,
+      phase: transaction.result.warrant.phase,
+      nativeProofRoot: transaction.result.warrant.nativeProofRoot,
+      nativeProofReuseRoot: transaction.result.warrant.nativeProofReuseRoot,
+      qualifiedAt: transaction.result.warrant.qualifiedAt,
+      expectedOldStateRoot: transaction.expectedOldStateRoot,
+      nextStateRoot: transaction.after.stateRoot,
+      nextAction: transaction.result.warrant.nextAction,
+    };
+    return {
+      queue: transaction.after,
+      warrant: transaction.result.warrant,
+      receipt,
+      receiptRoot: devDeliveryContentRoot(receipt),
+    };
+  };
+}

package/packages/core/dev-delivery-warrant-settlement.js

@@ -33,7 +33,11 @@ export function createDevDeliveryTerminalSettler({ normalizeQueue, closeWarrant,
     };
     if (!terminalStates.has(identity.outcome)) throw new Error(`outcome must be one of ${[...terminalStates].join(", ")}`);
     const samePullRequest = queue.candidates.filter((entry) => entry.pullRequestNumber === identity.pullRequestNumber);
-    const candidate = samePullRequest.find((entry) => entry.sourceHead === identity.sourceHead) || null;
+    const matchingHead = samePullRequest.filter((entry) => entry.sourceHead === identity.sourceHead);
+    const activeCandidate = queue.activeWarrant
+      ? matchingHead.find((entry) => entry.candidateId === queue.activeWarrant.candidateId)
+      : null;
+    const candidate = activeCandidate || matchingHead.at(-1) || null;
     if (!candidate && samePullRequest.length > 0) throw new Error("terminal event sourceHead does not match the recorded candidate");
 
     if (candidate && terminalStates.has(candidate.status)) {

package/packages/core/dev-delivery-warrant.js

@@ -2,10 +2,12 @@ import { devDeliveryClone as clone, devDeliveryContentRoot, devDeliveryExactRoot
 import { chainedDevDeliveryAttemptInput, createDevDeliveryCandidateIdentity, validateDevDeliveryCandidateChain } from "./dev-delivery-candidate-identity.js";
 import { DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA, createCancelQueuedDevDeliveryCandidate } from "./dev-delivery-warrant-cancellation.js";
 import { DEV_DELIVERY_SETTLEMENT_RECEIPT_SCHEMA, createDevDeliveryTerminalSettler } from "./dev-delivery-warrant-settlement.js";
+import { createDevDeliveryWarrantQualifier } from "./dev-delivery-native-proof.js";
 import { compareReleaseBlockerPriority, normalizeReleaseBlockerPriorityClaim } from "./release-blocker-priority.js";
 export { devDeliveryContentRoot } from "./dev-delivery-common.js";
 export { RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA, createReleaseBlockerPriorityClaim } from "./release-blocker-priority.js";
 export { SOURCE_QUALIFICATION_PROOF_SCHEMA, PROJECT_CUT_REPLAY_PROOF_SCHEMA, INTEGRATION_DELIVERY_PROOF_SCHEMA, classifyDevDeliveryDelta, createIntegrationDeliveryProof, createProjectCutReplayPlan, createProjectCutReplayProof, createSourceQualificationProof, verifyIntegrationDeliveryProof, verifyProjectCutReplayProof, verifySourceQualificationProof } from "./dev-delivery-proof.js";
+export { DEV_DELIVERY_QUALIFICATION_RECEIPT_SCHEMA, NATIVE_QUALIFICATION_PROOF_SCHEMA, NATIVE_PROOF_REUSE_DECISION_SCHEMA, createNativeProofReuseDecision, createNativeQualificationProof, verifyNativeProofReuseDecision, verifyNativeQualificationProof } from "./dev-delivery-native-proof.js";
 export { DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA };
 export const DEV_DELIVERY_QUEUE_CONTRACT = "kungfu-buildchain-dev-delivery-warrant-queue";
 export const DEV_DELIVERY_WARRANT_SCHEMA = "kungfu.buildchain.dev-delivery-warrant/v1";
@@ -59,7 +61,7 @@ function normalizeCandidate(input, expected) {
     throw new Error(`candidateId mismatch for PR #${identity.pullRequestNumber}`);
   }
   const status = text(input.status || "queued");
-  if (!["queued", "selected", "proving", "waiting", "blocked", ...TERMINAL_STATES].includes(status)) {
+  if (!["queued", "selected", "provisional", "proving", "qualified", "waiting", "blocked", ...TERMINAL_STATES].includes(status)) {
     throw new Error(`unsupported candidate status ${status || "<empty>"}`);
   }
   const candidate = {
@@ -80,6 +82,10 @@ function normalizeCandidate(input, expected) {
     status,
     terminal: input.terminal || null,
   };
+  if (Object.hasOwn(input, "affectedPaths")) {
+    if (!Array.isArray(input.affectedPaths)) throw new Error("candidate affectedPaths must be an array");
+    candidate.affectedPaths = [...new Set(input.affectedPaths.map(text).filter(Boolean))].sort();
+  }
   if (Object.hasOwn(input, "releaseBlockerPriority")) candidate.releaseBlockerPriority = normalizeReleaseBlockerPriorityClaim(input.releaseBlockerPriority, candidate, expected);
   return candidate;
 }
@@ -140,12 +146,20 @@ export function normalizeDevDeliveryQueue(input, expected = {}) {
     warrant.generation = positiveInteger(warrant.generation, "Warrant generation");
     warrant.issuedAt = timestamp(warrant.issuedAt, "Warrant issuedAt");
     warrant.expiresAt = timestamp(warrant.expiresAt, "Warrant expiresAt");
-    const activeCandidates = queue.candidates.filter((candidate) => ["selected", "proving", "waiting", "blocked"].includes(candidate.status));
+    const warrantPhase = text(warrant.phase || "qualified");
+    if (!["provisional", "qualified"].includes(warrantPhase)) throw new Error("active Warrant phase is unsupported");
+    if (Object.hasOwn(warrant, "phase")) warrant.phase = warrantPhase;
+    if (warrantPhase === "qualified") {
+      if (warrant.nativeProofRoot) warrant.nativeProofRoot = exactRoot(warrant.nativeProofRoot, "Warrant nativeProofRoot");
+      if (warrant.nativeProofReuseRoot) warrant.nativeProofReuseRoot = exactRoot(warrant.nativeProofReuseRoot, "Warrant nativeProofReuseRoot");
+      if (warrant.qualifiedAt) warrant.qualifiedAt = timestamp(warrant.qualifiedAt, "Warrant qualifiedAt");
+    }
+    const activeCandidates = queue.candidates.filter((candidate) => ["selected", "provisional", "proving", "qualified", "waiting", "blocked"].includes(candidate.status));
     if (activeCandidates.length !== 1 || activeCandidates[0].candidateId !== warrant.candidateId) {
       throw new Error("exactly one active candidate must match the active Warrant");
     }
     if (warrant.releaseBlockerPriority?.claimRoot !== activeCandidates[0].releaseBlockerPriority?.claimRoot) throw new Error("active Warrant release-blocker priority drift");
-  } else if (queue.candidates.some((candidate) => ["selected", "proving", "waiting", "blocked"].includes(candidate.status))) {
+  } else if (queue.candidates.some((candidate) => ["selected", "provisional", "proving", "qualified", "waiting", "blocked"].includes(candidate.status))) {
     throw new Error("active candidate exists without an active Warrant");
   }
   const rooted = withQueueRoot(queue);
@@ -184,6 +198,7 @@ function submissionReceipt({ before, after, candidate, action, now }) {
     closureRoot: candidate.closureRoot,
     dependencyRoot: candidate.dependencyRoot,
     toolchainRoot: candidate.toolchainRoot,
+    ...(Object.hasOwn(candidate, "affectedPaths") ? { affectedPaths: candidate.affectedPaths } : {}),
     sourceWorkflowRunId: candidate.sourceWorkflowRunId,
     ...(Object.hasOwn(candidate, "releaseBlockerPriority") ? { releaseBlockerPriority: candidate.releaseBlockerPriority } : {}),
     deliveryClass: candidate.deliveryClass,
@@ -225,7 +240,7 @@ export function submitDevDeliveryCandidate(queueInput, input, { now = new Date()
           throw new Error(`candidate ${attemptedCandidate.candidateId} is terminal and cannot be resubmitted`);
         }
         const exactProofFields = ["sourcePatchRoot", "sourceProofRoot", "planRoot", "closureRoot", "dependencyRoot", "toolchainRoot"];
-        const exactProofMatches = exactProofFields.every((field) => existing[field] === attemptedCandidate[field]) && existing.releaseBlockerPriority?.claimRoot === attemptedCandidate.releaseBlockerPriority?.claimRoot;
+        const exactProofMatches = exactProofFields.every((field) => existing[field] === attemptedCandidate[field]) && JSON.stringify(existing.affectedPaths || []) === JSON.stringify(attemptedCandidate.affectedPaths || []) && existing.releaseBlockerPriority?.claimRoot === attemptedCandidate.releaseBlockerPriority?.claimRoot;
         if (existing.sourceHead === attemptedCandidate.sourceHead && exactProofMatches) {
           action = "duplicate-noop";
           selected = existing;
@@ -241,6 +256,8 @@ export function submitDevDeliveryCandidate(queueInput, input, { now = new Date()
           const headChanged = existing.sourceHead !== attemptedCandidate.sourceHead;
           existing.sourceHead = attemptedCandidate.sourceHead;
           for (const field of exactProofFields) existing[field] = attemptedCandidate[field];
+          if (Object.hasOwn(attemptedCandidate, "affectedPaths")) existing.affectedPaths = attemptedCandidate.affectedPaths;
+          else delete existing.affectedPaths;
           if (Object.hasOwn(attemptedCandidate, "releaseBlockerPriority")) existing.releaseBlockerPriority = attemptedCandidate.releaseBlockerPriority;
           else delete existing.releaseBlockerPriority;
           existing.updatedAt = currentTime;
@@ -379,15 +396,17 @@ export function selectDevDeliveryWarrant(queueInput, { now = new Date().toISOStr
         closureRoot: candidate.closureRoot,
         dependencyRoot: candidate.dependencyRoot,
         toolchainRoot: candidate.toolchainRoot,
+        ...(Object.hasOwn(candidate, "affectedPaths") ? { affectedPaths: candidate.affectedPaths } : {}),
         sourceWorkflowRunId: candidate.sourceWorkflowRunId,
         ...(Object.hasOwn(candidate, "releaseBlockerPriority") ? { releaseBlockerPriority: candidate.releaseBlockerPriority } : {}),
         deliveryClass: candidate.deliveryClass,
         generation: next.fencingCounter,
+        phase: "provisional",
         expectedOldStateRoot: before.stateRoot,
         issuedAt,
         expiresAt: new Date(Date.parse(issuedAt) + effectiveLeaseSeconds * 1000).toISOString(),
         fencingToken: "",
-        nextAction: "Replay on the exact current dev base, prove required checks, then enqueue the unchanged PR head.",
+        nextAction: "Run or reuse the exact semantic native proof, then atomically qualify this fenced Warrant.",
       };
       warrant.fencingToken = warrantToken(warrant);
       next.activeWarrant = warrant;
@@ -454,7 +473,7 @@ export function heartbeatDevDeliveryWarrant(queueInput, warrant, { now = new Dat
       const effectiveLeaseSeconds = positiveInteger(leaseSeconds, "leaseSeconds", queue.policy.leaseSeconds);
       queue.activeWarrant.expiresAt = new Date(Date.parse(currentTime) + effectiveLeaseSeconds * 1000).toISOString();
       const candidate = queue.candidates.find((entry) => entry.candidateId === queue.activeWarrant.candidateId);
-      candidate.status = "proving";
+      candidate.status = queue.activeWarrant.phase === "qualified" ? "qualified" : "proving";
       candidate.updatedAt = currentTime;
       return { candidate, warrant: queue.activeWarrant };
     },
@@ -478,6 +497,8 @@ export function heartbeatDevDeliveryWarrant(queueInput, warrant, { now = new Dat
   };
 }
 
+const qualifyDevDeliveryWarrantTransition = createDevDeliveryWarrantQualifier({ transition, assertWarrantMutation });
+export function qualifyDevDeliveryWarrant(queueInput, warrant, options) { return qualifyDevDeliveryWarrantTransition(queueInput, warrant, options); }
 export function recoverExpiredDevDeliveryWarrant(queueInput, { now = new Date().toISOString() } = {}) {
   const currentTime = timestamp(now, "now");
   const before = normalizeDevDeliveryQueue(queueInput);
@@ -604,6 +625,19 @@ export function observeDevDeliveryQueue(queueInput, { now = new Date().toISOStri
       queueAgeSeconds: entry.priority.ageSeconds,
       attempts: entry.candidate.attempts,
       recoveries: entry.candidate.recoveries,
+      assignmentRoot: entry.candidate.assignmentRoot,
+      initiativeRoot: entry.candidate.initiativeRoot,
+      sourceIdentityRoot: entry.candidate.sourceIdentityRoot,
+      sourcePatchRoot: entry.candidate.sourcePatchRoot,
+      sourceProofRoot: entry.candidate.sourceProofRoot,
+      planRoot: entry.candidate.planRoot,
+      closureRoot: entry.candidate.closureRoot,
+      dependencyRoot: entry.candidate.dependencyRoot,
+      toolchainRoot: entry.candidate.toolchainRoot,
+      sourceWorkflowRunId: entry.candidate.sourceWorkflowRunId || 0,
+      affectedPaths: entry.candidate.affectedPaths || [],
+      deliveryClass: entry.candidate.deliveryClass,
+      priority: entry.candidate.priority,
       nextAction: index === 0 && !queue.activeWarrant ? "eligible-for-selection" : "wait-for-active-warrant",
     })),
     observedAt: currentTime,