@kungfu-tech/buildchain 3.0.9-alpha.8 → 4.0.0-alpha.0

package/docs/v4-delivery-warrant-read-candidate.md

@@ -0,0 +1,73 @@
+---
+status: draft
+period: ongoing
+theme: buildchain-v4-delivery-warrant
+doc_type: contract-guide
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: unreviewed
+last_reviewed: 2026-08-08
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-08
+  invisible_context: not asserted
+---
+
+# Delivery Warrant v4 read candidate
+
+The v4 read candidate is an explicit, reversible observation path. TypeScript
+v3 remains the sole production writer, queue store owner, rollback authority,
+and provider adapter. Rust receives canonical state bytes, validates the pure v4
+state contract, and returns a read-only projection with effects disabled.
+
+The normal `observe` path defaults to `--read-mode v3`. No mutation command
+consults the read switch. A caller may select v4 only by supplying all of the
+following:
+
+- a retained, self-root-verifying semantic-diff report;
+- the exact expected report root;
+- the report's exact TypeScript revision, Rust revision, and validator version;
+- a caller-owned evidence output.
+
+The candidate fails closed on a blocked, expired, missing, or drifted
+qualification; source mismatch; unsupported host capability; crash; timeout;
+cancellation; malformed response; state/root disagreement; or evidence
+retention failure. It never silently falls back inside a v4 request. Rollback
+is the explicit caller change back to `--read-mode v3`, which avoids dual read
+authority and leaves the v3 queue untouched.
+
+## Source-checkout invocation
+
+The preview candidate runs against the checked-out Rust contract host:
+
+```sh
+buildchain dev warrant observe \
+  --repository owner/repository --branch dev/v4/v4.0 \
+  --read-mode v4 \
+  --read-qualification semantic-diff-report.json \
+  --read-qualification-root sha256:<root> \
+  --read-typescript-revision <sha> \
+  --read-rust-revision <sha> \
+  --read-validator-version semantic-diff-gate-v1 \
+  --read-evidence-output .buildchain/dev-delivery/v4-read-evidence.json
+```
+
+The returned command result keeps the existing v3 observation schema for
+caller compatibility and adds `readCandidate` evidence that fixes
+`writerAuthority=typescript-v3`, `rustAuthority=read-only`,
+`rustEffects=disabled`, `rollbackMode=v3`, both state roots, the qualification
+root, and the retained evidence receipt root.
+
+Focused verification:
+
+```sh
+node --test tests/v4-delivery-warrant-read-candidate.test.mjs
+pnpm run check:v4-contracts
+```
+
+This candidate does not authorize a v4 write cutover. Protected-window parity,
+independent review, and the rollback drill remain required exit evidence for
+the read stage.

package/docs/v4-delivery-warrant-semantic-diff.md

@@ -0,0 +1,75 @@
+---
+status: draft
+period: ongoing
+theme: buildchain-v4-delivery-warrant
+doc_type: contract-guide
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: unreviewed
+last_reviewed: 2026-08-08
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-08
+  invisible_context: not asserted
+---
+
+# Delivery Warrant v4 semantic diff gate
+
+The semantic diff gate qualifies paired TypeScript and Rust shadow projections
+without moving production authority. TypeScript v3 remains the sole writer,
+the Rust host remains effect-disabled, and every report fixes
+`v4WriteAuthorized` to `false`.
+
+## Qualification contract
+
+Every case supplies identical public-safe retained bytes to the JavaScript
+fixture runner and Rust shadow host. The report binds:
+
+- exact TypeScript and Rust source revisions;
+- trace schema, report schema, runner, and validator identities;
+- input, JavaScript projection, Rust projection, difference, evidence, and
+  retention roots, including a root over each retained full shadow observation;
+- golden, bounded property, lease/fence, CAS, duplicate, cancellation,
+  response-loss, provider-conflict, and captured-replay coverage;
+- bounded fault-probe receipts proving that changes to decisions, successor
+  roots, generation, fencing, effects, observations, or receipts are detected.
+
+An unexplained difference, missing observation, incomplete coverage,
+undetected fault probe, source-binding mismatch, or retention failure blocks
+the gate with a zero retry budget. A compatibility exclusion is accepted only
+when its exact difference root, reason code, independent review root, and
+disposition root all verify.
+
+The gate requires every full public-safe shadow observation and the final
+qualification report to be retained for 90 days. Missing either retention
+receipt blocks qualification. It does not accept private payloads, invoke
+provider effects, modify v3 authority, or provide a v4 write cutover receipt.
+
+## Run the gate
+
+Call `runV4DeliveryWarrantSemanticDiffGate` with exact source revisions,
+explicit observation time, schema and runner roots, public-safe retained cases,
+bounded fault probes, an observation retention sink, and a report retention
+sink. The returned report is canonical JSON data suitable for a caller-owned
+retained evidence file.
+
+The checked-in focused suite exercises that API against the real Rust host:
+
+```sh
+node --test tests/v4-delivery-warrant-fixture-runner.test.mjs
+```
+
+A qualified report makes only the next
+read-candidate stage eligible; it never authorizes v4 writes.
+The reversible caller contract and its fail-closed qualification binding are
+documented in
+[`v4-delivery-warrant-read-candidate.md`](v4-delivery-warrant-read-candidate.md).
+
+Focused verification:
+
+```sh
+pnpm run check:v4-contracts
+```

package/docs/v4-production-release.md

@@ -0,0 +1,63 @@
+---
+status: active
+period: ongoing
+theme: buildchain-v4-production-release
+doc_type: runbook
+source_level: repository-contracts + protected-provider-readback
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-08-13
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-13
+  invisible_context: Provider credentials and private provider state were not read.
+---
+
+# Buildchain v4 production release
+
+Buildchain v4 is the production release authority for the `v4.0` line. The
+protected source path is:
+
+```text
+dev/v4/v4.0 -> alpha/v4/v4.0 -> release/v4/v4.0
+```
+
+Public consumers use `v4-alpha` for the current prerelease channel and `v4`
+for stable. Reproducible consumers may pin an exact 40-character commit or an
+exact immutable release tag such as `v4.0.0`.
+
+The release transaction is fail-closed. The v4 provider-operation journal,
+activation plan, stable publication fence, and partial-mutation recovery plan
+bind the exact source, qualification, policy, provider readback, protected
+ancestry, and target roots. Confirmed operations are never replayed; uncertain
+operations require provider readback before retry; stable publication requires
+an N-1 or independently sealed qualification.
+
+## Provider readback
+
+A stable release is complete only when all of these coordinates agree:
+
+- `release/v4/v4.0`, `v4`, `v4.0`, and the exact `v4.0.x` tag;
+- the GitHub Release tag and attached Release Passport evidence;
+- npm `@kungfu-tech/buildchain@4.0.x`, its `gitHead`, and the `latest` tag;
+- the protected source and release transaction roots.
+
+The alpha channel applies the same rule to `alpha/v4/v4.0`, `v4-alpha`, the
+exact alpha tag, and npm's `alpha` tag.
+
+## Non-destructive rollback
+
+Rollback never rewrites an exact tag, release, package version, Passport, or
+provider journal. Stop forward promotion, pin consumers to the last verified
+exact v4 SHA or exact stable tag, and use the retained `release/v3/v3.0`
+coordinate only as an explicit compatibility rollback reference. Restoring v3
+as production authority requires a new reviewed cutover; it is not an implicit
+fallback.
+
+Before any retry, compare the current provider state with the retained
+transaction and operation roots. Resume only missing eligible operations.
+Conflicting state remains `repair-required` or terminal and must not be
+converted into success by moving a floating ref.

package/docs/v4-stage-capsule.md

@@ -0,0 +1,193 @@
+---
+status: draft
+period: ongoing
+theme: buildchain-v4-stage-capsule
+doc_type: contract-guide
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: unreviewed
+last_reviewed: 2026-08-10
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-10
+  invisible_context: not asserted
+---
+
+# Buildchain v4 Stage Capsule
+
+## Platform checkpoint projection
+
+`architecture/v4-platform-stage-checkpoints.json` is the single declaration
+for the macOS arm64, Linux x64, and Windows x64 shadow checkpoint lanes. It
+defines the allowed platform/stage pairs and the exact declared inputs,
+outputs, environment names, toolchains, and portable restore paths.
+
+The protected `Verify` workflow runs each platform on its real hosted runner.
+After a declared successful stage, the TypeScript v3 writer emits the canonical
+Capsule and immutable local-store receipt. A separate Node process restores the
+declared output layout into an empty directory and verifies every blob and
+manifest root. A failed stage emits no Capsule; a later failure does not remove
+earlier successful stage Capsules.
+
+This is shadow evidence only. It records per-platform/stage overhead and asserts
+that production bytes did not change. It does not skip production stages, read
+ambient runner state, include provider credentials, perform signing or
+publication, or grant provider/cache presence qualification authority. The
+generated consumer workflow and Agent guidance point back to the same
+declaration; undeclared fields fail closed.
+
+A Stage Capsule is the immutable, per-platform evidence contract for one build
+stage. It does not store artifacts, plan resume, publish provider state, or move
+production write authority. TypeScript v3 remains the sole writer; Rust is a
+pure validation and root-projection implementation.
+
+## Three separate roots
+
+The contract deliberately keeps three facts separate:
+
+1. `identityRoot` binds source, platform, stage, toolchain, runtime, policy,
+   declared inputs, transformation, output manifest, qualification, and any
+   explicitly declared rooted observations.
+2. `capsuleRoot` binds that immutable identity and the retention promise.
+3. `availabilityRoot` binds a caller-supplied observation of current
+   availability, content, qualification, and rooted transport locators.
+
+Changing platform, stage, policy, transformation, or a declared input changes
+the identity root. Changing an observation time or transport locator changes
+only the availability root. A provider run ID, provider artifact ID, runner
+path, credential, ambient clock, raw network observation, mutable tag, or cache
+hit is not a schema field and therefore cannot silently become identity.
+Provider evidence participates only as an explicitly named observation root.
+
+## Retention and reuse
+
+A retention promise is not proof that bytes currently exist. Reuse is a pure
+decision over an explicit evaluation clock and a current availability
+observation. It is eligible only when the capsule, output-manifest, and
+qualification roots all match, the observation is `available`, and the
+retention promise has not expired. `missing`, `expired`, `corrupt`, and
+`root-mismatch` always fail closed. Transport locators are rooted observations,
+not artifact authority.
+
+The sole schema authority is
+[`v4-stage-capsule-v1.schema.json`](../contracts/v4-stage-capsule-v1.schema.json).
+The shared fixture is consumed by both implementations. The next Wave 2 cards
+may add checkpoints, resume planning, and reconciliation, but must not weaken
+or duplicate this contract.
+
+## Content-addressed reference store
+
+The storage successor adds one closed output-manifest and store contract suite
+without changing Capsule identity. Raw blob bytes use lowercase SHA-256 roots;
+the canonical output manifest binds byte roots, sizes, and sorted names, and its
+`manifestRoot` must equal the Capsule `outputManifestRoot`. The local reference
+store writes immutable `blobs`, `capsules`, `manifests`, and `records` families
+under exact roots. A fresh process can restore by `capsuleRoot`, then re-verifies
+the Capsule, manifest, every byte root, retention state, availability, transport
+observation, and qualification root before returning bytes.
+
+Repeated put and restore are idempotent. A different physical store directory
+does not change Capsule or manifest identity. `missing`, `expired`, `partial`,
+`corrupt`, `quarantined`, and `root-mismatch` are deterministic fail-closed
+classifications; there is no cache fallback. Retention promise, evaluated
+retention state, current availability, rooted transport locator, qualification,
+and operation receipt are different roots with caller-supplied clocks.
+
+GitHub Artifact and S3-compatible adapters expose only `effect-disabled` and
+`fixture-backed` modes in this slice. They accept rooted locators, never raw
+credentials or signed URLs, and cannot perform a provider upload or restore.
+The executable architecture ceiling is
+[`v4-stage-capsule-store-contract.json`](../architecture/v4-stage-capsule-store-contract.json),
+and the shared Rust/JavaScript fixture is
+[`shared.json`](../contracts/fixtures/v4-stage-capsule-store-v1/shared.json).
+
+Focused verification:
+
+```sh
+pnpm run check:v4-contracts
+```
+
+## Deterministic resume planning
+
+`architecture/v4-stage-capsule-resume-planner.json` closes the Wave 2 resume
+planner. Its request is an explicit topological stage graph with targets,
+expected Capsule identity and retention, current Capsule/availability
+observations, an evaluation clock, and separately declared provider or
+release-tail effects. The Rust domain core and TypeScript projection consume
+the same request without filesystem, network, environment, or ambient-clock
+access and produce the same ordered decisions and `planRoot`.
+
+An eligible completed dependency becomes an exact-root restore; a missing or
+invalid target becomes a rebuild, and only that target's dependency closure is
+scheduled. Source, platform, toolchain, runtime, policy, declared-input,
+transformation, output-manifest, and retention changes carry rooted causal
+invalidation fields. Cross-platform reuse, corrupt or partial content, root
+mismatch, and insufficient qualification reject reuse fail closed.
+
+Effects never participate in Capsule reuse. They remain ordered declarations
+with required provider readback and planner mutation disabled. This planner is
+shadow-only: it does not skip a v3 production stage or move v3 authority.
+
+## Three-platform qualification and Wave reconciliation
+
+`architecture/v4-stage-capsule-qualification.json` closes the Wave 2
+qualification boundary. Buildchain and external repositories use the same
+Buildchain-owned public reusable workflow,
+`.github/workflows/v4-stage-capsule-canary.yml`. Buildchain's caller is the thin
+`.github/workflows/v4-public-consumer-dogfood.yml`; it has no steps, copied
+orchestration, local action, direct qualification invocation, or private
+consumer profile. Candidate recursion is resolved only by publishing the exact
+candidate at `train/v4/v4.0/<capability>` and calling that fully qualified
+public ref. After successful qualification and protected merge, the caller can
+be pinned to the exact protected commit. An internal exception is never a
+permitted recursion mechanism.
+
+The called workflow checks out that same commit as its runtime, reads the consumer's
+tracked `.buildchain/buildchain.toml`, and executes only `install`, `build`,
+and `verify` on GitHub-hosted Linux x64, macOS arm64, and Windows x64 runners.
+Each stage binds its declared command, dependency edge, exact consumer source,
+platform, lifecycle manifest, summary, and real output roots into the campaign
+profile. `publish` is explicitly classified as a provider mutation and is not
+executed. The caller supplies only its stable consumer name and the real output
+paths; it does not copy the campaign orchestration.
+
+The external seed retains `install` and `build` before an intentional late
+`verify` failure. A clean process reads the retained store, restores only the
+exact `build` root, rebuilds `verify`, and compares the result with the fresh
+three-stage aggregate. Runtime-ref, source, command/profile, manifest, summary,
+output, platform, and Capsule-root drift all stop with typed diagnostics.
+
+Qualification compares the declared artifact-manifest and aggregate content
+roots from a fresh full build with the roots assembled from retained and rebuilt
+Capsules. It fails closed on missing, expired, corrupt, partial, cross-platform,
+cross-stage, source/toolchain/policy drift, stale-writer, and root-mismatch
+campaigns. The rooted report records retained bytes, restore overhead, planner
+accuracy, false reuse, and false rebuild counts. Every invocation declares one
+exact public consumer identity and requires its Linux, macOS, and Windows
+reports before emitting a qualification root. Buildchain declares `buildchain`
+and receives no additional profile or authority.
+
+The post-merge reconciliation interface accepts that qualification root only
+with all five Wave 2 children in native terminal state, exact source and
+protected merge revisions, independent review roots, Delivery Warrant roots,
+native gate roots, and an empty protected-delivery queue. It emits evidence; it
+does not rewrite child authority. `--stage-capsule-mode v3` is the explicit
+non-destructive rollback switch. No migration, retained-state deletion,
+production reuse, provider effect, release effect, or v3 behavior change is
+authorized by this qualification.
+
+Focused local rehearsal:
+
+```sh
+node scripts/v4-stage-capsule-qualification.mjs campaign \
+  --work-root /tmp/buildchain-v4-stage-qualification \
+  --platform linux-x64 \
+  --consumer buildchain \
+  --runtime-ref <exact-buildchain-commit> \
+  --consumer-source-revision <exact-consumer-commit> \
+  --consumer-root . \
+  --lifecycle-evidence-root .buildchain/artifacts/v4-stage-capsule-canary
+```

package/docs/versioning.md

@@ -79,9 +79,9 @@ repository changes are patch".
 
 | Date       | Action       | Line    | Faces                                                                                                                                                                        | Class    | Rationale                                                                                                                                                                                                                                                                                                                              | PR    |
 | ---------- | ------------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
-| 2026-08-11 | extend-minor | `v3.0`  | provisional-delivery-warrant, qualified-delivery-warrant, native-qualification-proof, native-proof-reuse-decision, generated-native-delivery-workflow                         | additive | Reserve protected-dev order after exact source acceptance and approval, then require an atomic native-proof-bound qualification before merge-queue admission. Reuse is limited to stable semantic source, closure, dependencies, and toolchain with a fully attributed disjoint base delta; overlap and uncertainty fail closed to revalidation. |       |
-| 2026-08-11 | extend-minor | `v3.0`  | release-blocker-repair-contract, release-blocker-priority-claim, release-train-node-export, dev-delivery-warrant-node-export, next-development-transition, next-development-projection | additive | Add rooted successor candidate generations on a frozen Release Cut, exact semantic patch identity across cut and Dev landings, publication blocking through conflict or mismatch, a narrow non-preemptive Warrant blocker lane, and a separate rooted transition that preserves completed Alpha success while the following development version is materialized. |       |
-| 2026-08-10 | extend-minor | `v3.0`  | release-cut-contract, release-train-state-machine, release-train-node-export                                                                                                 | additive | Add a provider-neutral rooted Release Cut and idempotent Release Train state contract that freezes candidate, tree, Alpha base, runtime, generation, and authority while treating later Dev movement as observation rather than implicit supersession.                                                                                 |       |
+| 2026-08-11 | extend-minor | `v4.0`  | release-blocker-repair-contract, release-blocker-priority-claim, release-train-node-export, dev-delivery-warrant-node-export                                                 | additive | Forward-port rooted successor candidate generations, exact semantic patch identity across cut and Dev landings, publication blocking through conflict or mismatch, and the narrow non-preemptive Warrant blocker lane already protected and self-dogfood-proven on v3.                                                               |       |
+| 2026-08-10 | extend-minor | `v4.0`  | release-cut-contract, release-train-state-machine, release-train-node-export                                                                                                | additive | Forward-port the provider-neutral rooted Release Cut and idempotent Release Train state contract already proven on v3; candidate, tree, Alpha base, runtime, generation, and authority stay frozen while later Dev movement remains an observation rather than implicit supersession.                                                   |       |
+| 2026-08-08 | extend-minor | `v4.0`  | dev-delivery-warrant-read-candidate, rust-state-projection, dev-delivery-cli                                                                                                 | additive | Add an opt-in, qualification-bound read projection behind `observe --read-mode v4`; v3 remains the sole writer and default reader, mutation commands ignore the switch, failures stop, and rollback is the explicit caller change back to v3.                                                                                          |       |
 | 2026-08-05 | extend-minor | `v3.0`  | auditable-demo-scenario, auditable-demo-capture, auditable-demo-adapter                                                                                                      | additive | Add an opt-in deterministic readable-playback declaration that preserves captured terminal payloads and order while normalizing only presentation timing; omitted playback continues to use observed PTY timestamps, and existing composition modes remain unchanged.                                                                  |       |
 | 2026-08-04 | extend-minor | `v3.0`  | dev-delivery-warrant-queue, source-qualification-proof, integration-delivery-proof, dev-delivery-cli, reusable-dev-delivery-workflows                                        | additive | Add durable fair and fenced protected-dev scheduling plus split source/integration proof contracts. Existing PR admission remains available through explicit `off` and `shadow` rollout modes; no existing command, export, or release flow is removed.                                                                                |       |
 | 2026-08-01 | extend-minor | `v3.0`  | cli-reference-registry, node-api-symbol-registry, golden-path-manual                                                                                                         | additive | Add generated, drift-checked CLI and Node API reference registries to the public site bundle, plus a package-tested first-user Golden Path; existing command execution and import semantics remain unchanged.                                                                                                                          |       |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.9-alpha.8",
+  "version": "4.0.0-alpha.0",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -57,9 +57,6 @@
     "./release-candidate": "./packages/core/release-candidate.js",
     "./release-candidate-recovery": "./packages/core/release-candidate-recovery.js",
     "./release-train": "./packages/core/release-train.js",
-    "./next-development-transition": "./packages/core/next-development-transition.js",
-    "./next-development-controller": "./packages/core/next-development-controller.js",
-    "./next-development-projection": "./packages/core/next-development-projection.js",
     "./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",
     "./release-passport": "./packages/core/release-passport.js",
     "./release-passport-contract": "./packages/core/release-passport-contract.js",
@@ -68,8 +65,6 @@
     "./release-tail-provider-plane": "./packages/core/release-tail-provider-plane.js",
     "./release-tail-provider-adapters": "./packages/core/release-tail-provider-adapters.js",
     "./release-tail-compatibility": "./packages/core/release-tail-compatibility.js",
-    "./publication-rehearsal-runtime": "./packages/core/publication-rehearsal-runtime.js",
-    "./publication-rehearsal-projection": "./packages/core/publication-rehearsal-projection.js",
     "./surface-manifest": "./packages/core/surface-manifest.js",
     "./buildchain-kfd-claims": "./packages/core/buildchain-kfd-claims.js",
     "./site/buildchain-site.json": "./dist/site/buildchain-site.json",
@@ -92,6 +87,7 @@
     "./site/schemas/release-passport-v1.schema.json": "./dist/site/schemas/release-passport-v1.schema.json",
     "./site/schemas/kfd-agent-hub-adoption.schema.json": "./dist/site/schemas/kfd-agent-hub-adoption.schema.json",
     "./site/schemas/kfd-product-gate-input-v1.schema.json": "./dist/site/schemas/kfd-product-gate-input-v1.schema.json",
+    "./site/schemas/kfd-support-projection-v1.schema.json": "./dist/site/schemas/kfd-support-projection-v1.schema.json",
     "./site/buildchain-contract.json": "./dist/site/buildchain-contract.json",
     "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
     "./site/release-provenance.json": "./dist/site/release-provenance.json",
@@ -100,9 +96,13 @@
   },
   "files": [
     "AGENTS.md",
+    "architecture/",
     "bin/",
     "CONTRIBUTING.md",
     "contracts/",
+    "crates/buildchain-v4-bridge/Cargo.lock",
+    "crates/buildchain-v4-bridge/Cargo.toml",
+    "crates/buildchain-v4-bridge/src/",
     "LICENSE-POLICY.md",
     "scripts/*.mjs",
     "packages/core/",
@@ -111,8 +111,7 @@
     "SECURITY.md",
     "docs/*.md",
     "actions/*/README.md",
-    "fixtures/*/README.md",
-    "templates/"
+    "fixtures/*/README.md"
   ],
   "engines": {
     "node": ">=22.14.0"
@@ -124,30 +123,33 @@
   "packageManager": "pnpm@11.7.0",
   "scripts": {
     "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:static && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-architecture.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
-    "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-capabilities-v1.schema.json contracts/release-tail-provider-bindings-v1.schema.json contracts/publication-rehearsal-capsule-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json bin/internal/command-registry.mjs scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/maintainability-metrics.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs",
+    "check": "pnpm run check:static && node scripts/check-v4-public-dogfood-contract.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs packages/core/v4-canonical-contracts.js packages/core/v4-provider-operation-journal.js packages/core/v4-provider-readback-idempotency.js packages/core/v4-release-activation-shadow.js packages/core/v4-stable-publication-fence.js packages/core/v4-partial-mutation-recovery-qualification.js packages/core/v4-stage-capsule.js packages/core/v4-stage-capsule-store.js packages/core/v4-stage-capsule-local-store.js packages/core/v4-platform-stage-checkpoints.js packages/core/v4-stage-capsule-resume-planner.js packages/core/v4-stage-capsule-qualification.js packages/core/v4-stage-capsule-qualification-campaign.js packages/core/v4-delivery-warrant-fixture-runner.js packages/core/v4-delivery-warrant-read-candidate.js packages/core/v4-delivery-warrant-semantic-diff-gate.js packages/core/v4-delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/check-v4-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/v4-bridge-bootstrap.mjs scripts/v4-bridge-evidence.mjs scripts/v4-host-adapter.mjs scripts/v4-platform-stage-checkpoint-rehearsal.mjs scripts/v4-stage-capsule-resume-rehearsal.mjs scripts/v4-stage-capsule-qualification.mjs scripts/v4-warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs tests/v4-bridge.test.mjs tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs tests/v4-warrant-shadow-plan.test.mjs",
+    "check:v4-bridge": "cargo fmt --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml",
+    "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
     "check:workflows": "bash scripts/check-workflows.sh",
     "generate:reference": "node scripts/generate-public-reference.mjs",
     "check:reference": "node scripts/generate-public-reference.mjs --check",
-    "generate:next-development": "node scripts/generate-next-development-guidance.mjs",
-    "check:next-development": "node scripts/generate-next-development-guidance.mjs --check",
-    "generate:site": "pnpm run generate:next-development && pnpm run generate:reference && node scripts/generate-site-bundle.mjs",
-    "check:site": "pnpm run check:next-development && pnpm run check:reference && node scripts/generate-site-bundle.mjs --check",
+    "generate:site": "pnpm run generate:reference && node scripts/generate-site-bundle.mjs",
+    "check:site": "pnpm run check:reference && node scripts/generate-site-bundle.mjs --check",
     "check:golden-path": "node scripts/verify-golden-path.mjs",
     "test:unit": "node --test tests/*.test.mjs",
     "build": "pnpm -r --filter \"./actions/**\" build",
     "binary:build": "node scripts/build-standalone-binary.mjs",
     "package": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
-    "pack:check": "npm pack --dry-run --json --registry=https://registry.npmjs.org/"
+    "pack:check": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
+    "bridge:v4:build": "node scripts/v4-bridge-bootstrap.mjs build",
+    "bridge:v4:run": "node scripts/v4-bridge-bootstrap.mjs run",
+    "bridge:v4:evidence": "node scripts/v4-bridge-evidence.mjs"
   },
   "devDependencies": {
+    "ajv": "8.17.1",
     "prettier": "^3.9.0",
     "tsup": "^8.5.0",
     "typescript": "^5.9.0"
   },
   "dependencies": {
-    "@kungfu-tech/kfd": "1.0.0-alpha.60",
-    "ajv": "8.20.0",
+    "@kungfu-tech/kfd": "1.0.0-alpha.62",
     "smol-toml": "1.7.0"
   }
 }