@kungfu-tech/buildchain 3.0.9-alpha.8 → 4.0.0-alpha.0

package/packages/core/kfd-adopter-manifest.js

@@ -21,7 +21,7 @@ export const KFD_LEGACY_SUPPORT_MATRIX_CONTRACT = "kungfu-kfd-support-matrix";
 
 const BUILDCHAIN_ADOPTER_ID = "kungfu-systems/buildchain";
 const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
-const SHA_PATTERN = /^[0-9a-f]{40}$/, SOURCE_REPOSITORY_PATTERN = /^[^@\s]+$/;
+const SHA_PATTERN = /^[0-9a-f]{40}$/;
 const REQUIRED_DECISIONS = Object.freeze(["KFD-1", "KFD-2", "KFD-3", "KFD-4", "KFD-5", "KFD-7"]);
 const PRODUCT_GATE_STANDARDS = Object.freeze(["kfd-4", "kfd-5", "kfd-7"]);
 const PRODUCT_GATE_SET = new Set(PRODUCT_GATE_STANDARDS);
@@ -77,27 +77,29 @@ function verifyPublishedManifest(manifest, packageOptions, issues) {
   }
 }
 
-function adopterExpectation({ expectedAdopterId = BUILDCHAIN_ADOPTER_ID, expectedSourceRepository = "" } = {}) { const adopterId = text(expectedAdopterId) || BUILDCHAIN_ADOPTER_ID; return { adopterId, sourceRepository: text(expectedSourceRepository) || adopterId }; }
-
-function manifestSource(manifest) { const coordinate = text(manifest?.adopter?.artifact?.coordinate), match = /^([^@\s]+)@([0-9a-f]{40})$/.exec(coordinate); return { coordinate, repository: match?.[1] || "", sha: match?.[2] || "" }; }
+function manifestSourceSha(manifest) {
+  const match = /^kungfu-systems\/buildchain@([0-9a-f]{40})$/.exec(text(manifest?.adopter?.artifact?.coordinate));
+  return match?.[1] || "";
+}
 
-function validateManifestIdentity(manifest, packageArtifactRoot, expectation, expectedSourceSha, issues) {
-  if (manifest?.adopter?.id !== expectation.adopterId) issues.push(issue("adopter-identity", "manifest.adopter.id", `manifest adopter must be ${expectation.adopterId}`));
+function validateManifestIdentity(manifest, packageArtifactRoot, expectedSourceSha, issues) {
+  if (manifest?.adopter?.id !== BUILDCHAIN_ADOPTER_ID) {
+    issues.push(issue("adopter-identity", "manifest.adopter.id", `manifest adopter must be ${BUILDCHAIN_ADOPTER_ID}`));
+  }
   const pinned = manifest?.kfdCut?.package;
   if (pinned?.name !== kfdPackageJson.name
     || pinned?.version !== kfdPackageJson.version
     || pinned?.artifactRoot !== packageArtifactRoot) {
     issues.push(issue("adopter-package-cut", "manifest.kfdCut.package", "manifest must bind the exact installed KFD package cut"));
   }
-  const source = manifestSource(manifest);
-  if (!SOURCE_REPOSITORY_PATTERN.test(expectation.sourceRepository) || manifest?.adopter?.artifact?.kind !== "git-commit" || !source.sha || !ROOT_PATTERN.test(text(manifest?.adopter?.artifact?.root))) {
-    issues.push(issue("adopter-source", "manifest.adopter.artifact", "adopter authority must bind one exact repository, git commit, and artifact root"));
-  } else if (source.repository !== expectation.sourceRepository) {
-    issues.push(issue("adopter-source", "manifest.adopter.artifact.coordinate", `manifest source repository must be ${expectation.sourceRepository}`));
-  } else if (expectedSourceSha && source.sha !== expectedSourceSha) {
+  const sourceSha = manifestSourceSha(manifest);
+  if (manifest?.adopter?.artifact?.kind !== "git-commit" || !sourceSha
+    || !ROOT_PATTERN.test(text(manifest?.adopter?.artifact?.root))) {
+    issues.push(issue("adopter-source", "manifest.adopter.artifact", "Buildchain adopter authority must bind one exact git commit and artifact root"));
+  } else if (expectedSourceSha && sourceSha !== expectedSourceSha) {
     issues.push(issue("adopter-source", "manifest.adopter.artifact.coordinate", "manifest source does not match the requested release source"));
   }
-  return source;
+  return sourceSha;
 }
 
 function validateRequiredDecisions(decisions, issues) {
@@ -129,7 +131,7 @@ function collectProductGates(gateResults, decisions, verificationCut, issues) {
   for (const [index, gate] of gateResults.entries()) {
     const validation = validateKfdProductGateResult(gate, verificationCut);
     if (!validation.valid) {
-      issues.push(issue("adopter-gate-invalid", `gateResults[${index}]`, "adopter product gate is invalid", {
+      issues.push(issue("adopter-gate-invalid", `gateResults[${index}]`, "Buildchain product gate is invalid", {
         gateIssues: validation.issues,
       }));
     }
@@ -139,16 +141,15 @@ function collectProductGates(gateResults, decisions, verificationCut, issues) {
     if (gates.has(gate?.standard)) {
       issues.push(issue("adopter-gate-duplicate", `gateResults[${index}].standard`, `${gate.standard} gate is duplicated`));
     }
-    if (gate?.source?.repository !== verificationCut.expectedSourceRepository) issues.push(issue("adopter-gate-source", `gateResults[${index}].source.repository`, "product gate repository must match the adopter source repository"));
     gates.set(gate?.standard, gate);
   }
   for (const standard of PRODUCT_GATE_STANDARDS) {
     const gate = gates.get(standard);
     const id = standard.toUpperCase();
     if (!gate) {
-      issues.push(issue("adopter-gate-missing", `gateResults.${standard}`, `${id} requires its exact adopter product gate`));
+      issues.push(issue("adopter-gate-missing", `gateResults.${standard}`, `${id} requires its existing Buildchain product gate`));
     } else if (!(decisions.get(id)?.verificationEvidence || []).some((entry) => entry?.root === gate.gateRoot)) {
-      issues.push(issue("adopter-gate-unbound", `manifest.decisions.${id}.verificationEvidence`, `${id} must bind the exact adopter gate root`));
+      issues.push(issue("adopter-gate-unbound", `manifest.decisions.${id}.verificationEvidence`, `${id} must bind the exact Buildchain gate root`));
     }
   }
   return gates;
@@ -158,12 +159,12 @@ function projectedProductGates(gates) {
   return PRODUCT_GATE_STANDARDS.map((standard) => {
     const gate = gates.get(standard);
     return gate
-      ? { standard, sourceRepository: gate.source.repository, sourceSha: gate.source.sha, gateRoot: gate.gateRoot, status: gate.status }
-      : { standard, sourceRepository: "", sourceSha: "", gateRoot: "", status: "missing" };
+      ? { standard, sourceSha: gate.source.sha, gateRoot: gate.gateRoot, status: gate.status }
+      : { standard, sourceSha: "", gateRoot: "", status: "missing" };
   });
 }
 
-function createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, source, checkedAt, maxAgeSeconds, issues }) {
+function createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, sourceSha, checkedAt, maxAgeSeconds, issues }) {
   const gate = {
     schemaVersion: 1,
     contract: KFD_ADOPTER_MANIFEST_GATE_CONTRACT,
@@ -173,8 +174,10 @@ function createGateDocument({ manifest, bundle, gates, authorityPath, packageArt
       contract: text(manifest?.contract),
       manifestRoot: bundle?.roots?.manifestRoot || "",
     },
-    adopter: { id: text(manifest?.adopter?.id) },
-    source: { repository: source.repository, coordinate: source.coordinate, sha: source.sha, artifactRoot: text(manifest?.adopter?.artifact?.root) },
+    source: {
+      sha: sourceSha,
+      artifactRoot: text(manifest?.adopter?.artifact?.root),
+    },
     verificationCut: { checkedAt, maxAgeSeconds },
     standardPackage: {
       name: kfdPackageJson.name,
@@ -208,28 +211,28 @@ export function createKfdAdopterManifestGate({
   packageArtifactRoot = "",
   gateResults = [],
   authorityPath = ".buildchain/kfd/adopter-manifest.json",
-  expectedAdopterId = BUILDCHAIN_ADOPTER_ID, expectedSourceRepository = "", expectedSourceSha = "",
+  expectedSourceSha = "",
   checkedAt = new Date().toISOString(),
   maxAgeSeconds = 86400,
 } = {}) {
-  const issues = [], expectation = adopterExpectation({ expectedAdopterId, expectedSourceRepository });
+  const issues = [];
   const bundle = verifyPublishedManifest(manifest, {
     packageArtifactRoot,
     verifiedAt: checkedAt,
     maxAgeSeconds,
   }, issues);
   const decisions = new Map((manifest?.decisions || []).map((row) => [row.id, row]));
-  let source = manifestSource(manifest);
+  let sourceSha = manifestSourceSha(manifest);
   if (bundle) {
-    source = validateManifestIdentity(manifest, packageArtifactRoot, expectation, expectedSourceSha, issues);
+    sourceSha = validateManifestIdentity(manifest, packageArtifactRoot, expectedSourceSha, issues);
     validateRequiredDecisions(decisions, issues);
     validateWarrantWitness(decisions, issues);
   }
-  const gates = collectProductGates(gateResults, decisions, { expectedSourceRepository: expectation.sourceRepository, expectedSourceSha: source.sha || expectedSourceSha, checkedAt }, issues);
-  return createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, source, checkedAt, maxAgeSeconds, issues });
+  const gates = collectProductGates(gateResults, decisions, { expectedSourceSha: sourceSha || expectedSourceSha, checkedAt }, issues);
+  return createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, sourceSha, checkedAt, maxAgeSeconds, issues });
 }
 
-function validateGateDocument(gate, expectation, issues) {
+function validateGateDocument(gate, issues) {
   const copy = structuredClone(gate);
   const root = copy.gateRoot;
   delete copy.gateRoot;
@@ -241,13 +244,12 @@ function validateGateDocument(gate, expectation, issues) {
     || !ROOT_PATTERN.test(text(gate?.authority?.manifestRoot))) {
     issues.push(issue("adopter-gate-authority", "authority", "adopter gate must bind the standard manifest contract and root"));
   }
-  if (gate?.adopter?.id !== expectation.adopterId) issues.push(issue("adopter-gate-identity", "adopter.id", `adopter gate must bind ${expectation.adopterId}`));
   if (gate?.standardPackage?.name !== kfdPackageJson.name || gate?.standardPackage?.version !== kfdPackageJson.version
     || ![gate?.standardPackage?.artifactRoot, gate?.standardPackage?.registryRoot, gate?.standardPackage?.verifierSetRoot].every((value) => ROOT_PATTERN.test(text(value)))) {
     issues.push(issue("adopter-gate-package", "standardPackage", "adopter gate uses stale KFD package metadata"));
   }
-  if (gate?.source?.repository !== expectation.sourceRepository || gate?.source?.coordinate !== `${expectation.sourceRepository}@${gate?.source?.sha || ""}` || !SHA_PATTERN.test(text(gate?.source?.sha)) || !ROOT_PATTERN.test(text(gate?.source?.artifactRoot))) {
-    issues.push(issue("adopter-gate-source", "source", "adopter gate must bind the expected repository, exact source commit, coordinate, and artifact root"));
+  if (!SHA_PATTERN.test(text(gate?.source?.sha)) || !ROOT_PATTERN.test(text(gate?.source?.artifactRoot))) {
+    issues.push(issue("adopter-gate-source", "source", "adopter gate must bind one exact Buildchain source commit and artifact root"));
   }
   if (gate?.decisionWitness?.rootAlgorithm !== "sha256-buildchain-stable-json-v1"
     || !ROOT_PATTERN.test(text(gate?.decisionWitness?.root))
@@ -257,7 +259,7 @@ function validateGateDocument(gate, expectation, issues) {
   }
 }
 
-function validateProjectedGates(gate, expectation, expectedSourceSha, issues) {
+function validateProjectedGates(gate, expectedSourceSha, issues) {
   const seenStandards = new Set();
   for (const [index, productGate] of (gate.gateResults || []).entries()) {
     if (!PRODUCT_GATE_SET.has(productGate?.standard) || productGate?.status !== "passed" || !ROOT_PATTERN.test(text(productGate?.gateRoot))) {
@@ -265,7 +267,7 @@ function validateProjectedGates(gate, expectation, expectedSourceSha, issues) {
     }
     if (seenStandards.has(productGate?.standard)) issues.push(issue("adopter-gate-result-set", `gateResults[${index}]`, "product gate standards must be unique"));
     seenStandards.add(productGate?.standard);
-    if (productGate?.sourceRepository !== gate?.source?.repository || productGate?.sourceRepository !== expectation.sourceRepository || productGate?.sourceSha !== gate?.source?.sha || (expectedSourceSha && productGate?.sourceSha !== expectedSourceSha)) {
+    if (productGate?.sourceSha !== gate?.source?.sha || (expectedSourceSha && productGate?.sourceSha !== expectedSourceSha)) {
       issues.push(issue("adopter-gate-source", `gateResults[${index}].sourceSha`, "product gate source must match the release source"));
     }
   }
@@ -275,15 +277,15 @@ function validateProjectedGates(gate, expectation, expectedSourceSha, issues) {
 }
 
 export function validateKfdAdopterManifestGate(gate, {
-  expectedAdopterId = BUILDCHAIN_ADOPTER_ID, expectedSourceRepository = "", expectedSourceSha = "",
+  expectedSourceSha = "",
   checkedAt = gate?.checkedAt || new Date().toISOString(),
 } = {}) {
-  const issues = [], expectation = adopterExpectation({ expectedAdopterId, expectedSourceRepository });
+  const issues = [];
   if (!gate || gate.schemaVersion !== 1 || gate.contract !== KFD_ADOPTER_MANIFEST_GATE_CONTRACT) {
     return { valid: false, issues: [issue("adopter-gate-contract", "", `gate must use ${KFD_ADOPTER_MANIFEST_GATE_CONTRACT} v1`)] };
   }
-  validateGateDocument(gate, expectation, issues);
-  validateProjectedGates(gate, expectation, expectedSourceSha, issues);
+  validateGateDocument(gate, issues);
+  validateProjectedGates(gate, expectedSourceSha, issues);
   if (gate.checkedAt !== checkedAt || gate?.verificationCut?.checkedAt !== checkedAt || !Number.isFinite(Date.parse(checkedAt))
     || !Number.isSafeInteger(gate?.verificationCut?.maxAgeSeconds) || gate.verificationCut.maxAgeSeconds < 0) {
     issues.push(issue("adopter-gate-time", "verificationCut", "adopter gate verification cut does not match the requested cut"));
@@ -298,7 +300,7 @@ function legacyStatus(row) {
   return row.state;
 }
 
-function legacyRow(row, gates, adopterId) {
+function legacyRow(row, gates) {
   const key = row.id.toLowerCase();
   const productGate = gates.get(key);
   return {
@@ -316,7 +318,7 @@ function legacyRow(row, gates, adopterId) {
     releaseQualification: { shippedSupport: false },
     claimClass: "standard-adopter-manifest-projection",
     knownLimitations: [...row.gaps],
-    owner: adopterId,
+    owner: BUILDCHAIN_ADOPTER_ID,
     nextGate: "Release Passport artifact binding and independent release decision",
     declaration: { state: row.state, usage: row.usage, root: kfdProductGateDigest(decisionWitnessRow(row)) },
   };
@@ -324,7 +326,7 @@ function legacyRow(row, gates, adopterId) {
 
 export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate } = {}) {
   const validation = validateKfdAdopterManifestGate(manifestGate, {
-    expectedAdopterId: manifestGate?.adopter?.id, expectedSourceRepository: manifestGate?.source?.repository, expectedSourceSha: manifestGate?.source?.sha,
+    expectedSourceSha: manifestGate?.source?.sha,
     checkedAt: manifestGate?.checkedAt,
   });
   if (!validation.valid || manifest?.contract !== "kfd.adopter-conformance-manifest/v1") {
@@ -336,9 +338,9 @@ export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate
     verifiedAt: manifestGate.verificationCut.checkedAt,
     maxAgeSeconds: manifestGate.verificationCut.maxAgeSeconds,
   }, authorityIssues);
-  const source = validateManifestIdentity(manifest, manifestGate.standardPackage.artifactRoot, { adopterId: manifestGate.adopter.id, sourceRepository: manifestGate.source.repository }, manifestGate.source.sha, authorityIssues);
+  const sourceSha = validateManifestIdentity(manifest, manifestGate.standardPackage.artifactRoot, manifestGate.source.sha, authorityIssues);
   const decisionRoot = kfdProductGateDigest(manifest.decisions.map(decisionWitnessRow));
-  if (!bundle || source.sha !== manifestGate.source.sha || source.repository !== manifestGate.source.repository || source.coordinate !== manifestGate.source.coordinate || manifest.adopter.artifact.root !== manifestGate.source.artifactRoot
+  if (!bundle || sourceSha !== manifestGate.source.sha || manifest.adopter.artifact.root !== manifestGate.source.artifactRoot
     || bundle.roots.manifestRoot !== manifestGate.authority.manifestRoot
     || bundle.roots.verificationReportRoot !== manifestGate.manifestVerificationReportRoot
     || bundle.bundleRoot !== manifestGate.manifestBundleRoot
@@ -362,8 +364,7 @@ export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate
       path: manifestGate.authority.path,
       contract: manifest.contract,
       root: manifestGate.authority.manifestRoot,
-      gateRoot: manifestGate.gateRoot, adopterId: manifestGate.adopter.id,
-      sourceRepository: manifestGate.source.repository, sourceSha: manifestGate.source.sha,
+      gateRoot: manifestGate.gateRoot,
     },
     upstream: {
       package: manifestGate.standardPackage.name,
@@ -373,7 +374,7 @@ export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate
       verifierSetRoot: manifestGate.standardPackage.verifierSetRoot,
       standardsSha256: standardsFileDigest(),
     },
-    rows: manifest.decisions.map((row) => legacyRow(row, gates, manifestGate.adopter.id)),
+    rows: manifest.decisions.map((row) => legacyRow(row, gates)),
   };
 }
 

package/packages/core/kfd-gate.js

@@ -944,49 +944,26 @@ export function normalizeKfd1ContractWorldWitness(witness, { metadata = resolveK
   };
 }
 
-function indexArtifactSearchRoots({ roots = [], artifactPaths = [] } = {}) {
-  const wanted = [...new Set(artifactPaths.filter(Boolean))];
-  const indexed = new Map();
-  const stack = roots.filter((root) => root && fs.existsSync(root) && fs.statSync(root).isDirectory());
-  while (stack.length > 0) {
-    const current = stack.pop();
-    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
-      const candidate = path.join(current, entry.name);
-      if (entry.isDirectory()) { stack.push(candidate); continue; }
-      if (!entry.isFile()) continue;
-      const normalized = candidate.replace(/\\/g, "/");
-      for (const artifactPath of wanted) {
-        if (normalized === artifactPath || normalized.endsWith(`/${artifactPath}`)) {
-          const candidates = indexed.get(artifactPath) || [];
-          candidates.push(candidate);
-          indexed.set(artifactPath, candidates);
-        }
-      }
-    }
-  }
-  return indexed;
-}
-
-function resolveArtifactFile({ cwd, artifactRoot, artifactIndex = new Map(), artifacts = [], artifactPath, expectedSha256 = "" }) {
-  const candidates = artifactIndex.size > 0
-    ? [...(artifactIndex.get(artifactPath) || []), artifactRoot ? path.resolve(artifactRoot, artifactPath) : "", path.resolve(cwd, artifactPath)]
-    : [path.resolve(cwd, artifactPath), artifactRoot ? path.resolve(artifactRoot, artifactPath) : ""];
+function resolveArtifactFile({ cwd, artifactRoot, artifacts = [], artifactPath }) {
+  const candidates = [
+    path.resolve(cwd, artifactPath),
+    artifactRoot ? path.resolve(artifactRoot, artifactPath) : "",
+  ].filter(Boolean);
   for (const artifact of artifacts) {
     const sourcePath = artifact.sourcePath || artifact.path || "";
-    if (!sourcePath) continue;
+    if (!sourcePath) {
+      continue;
+    }
     const normalizedSource = sourcePath.replace(/\\/g, "/");
-    if (normalizedSource === artifactPath || normalizedSource.endsWith(`/${artifactPath}`)) candidates.push(path.resolve(sourcePath));
+    if (normalizedSource === artifactPath || normalizedSource.endsWith(`/${artifactPath}`)) {
+      candidates.push(path.resolve(sourcePath));
+    }
     const name = artifact.name || artifact.filename || "";
-    if (name && name === artifactPath) candidates.push(path.resolve(sourcePath));
-  }
-  const existing = [...new Set(candidates)].filter(
-    (candidate) => candidate && fs.existsSync(candidate) && fs.statSync(candidate).isFile(),
-  );
-  if (expectedSha256) {
-    const exact = existing.find((candidate) => sha256File(candidate) === expectedSha256);
-    if (exact) return exact;
+    if (name && name === artifactPath) {
+      candidates.push(path.resolve(sourcePath));
+    }
   }
-  return existing[0] || "";
+  return candidates.find((candidate) => candidate && fs.existsSync(candidate) && fs.statSync(candidate).isFile()) || "";
 }
 
 function resolveSourceFile({ cwd, sourcePath }) {
@@ -1000,7 +977,6 @@ function resolveSourceFile({ cwd, sourcePath }) {
 export function createKfd1ReleaseGateEvidence({
   cwd = process.cwd(),
   artifactRoot = "",
-  artifactSearchRoots = [],
   artifacts = [],
   witnesses = [],
   verifiedAt = new Date().toISOString(),
@@ -1010,10 +986,6 @@ export function createKfd1ReleaseGateEvidence({
   if (normalizedWitnesses.length === 0) {
     return undefined;
   }
-  const artifactIndex = indexArtifactSearchRoots({
-    roots: artifactSearchRoots,
-    artifactPaths: normalizedWitnesses.flatMap((witness) => witness.surfaces.map((surface) => surface.artifactPath)),
-  });
   const worlds = normalizedWitnesses.map((witness) => {
     const preBuildWitnessSha256 = sha256Json(witness);
     const sourceResults = witness.surfaces.map((surface) => {
@@ -1053,10 +1025,8 @@ export function createKfd1ReleaseGateEvidence({
       const filePath = resolveArtifactFile({
         cwd,
         artifactRoot,
-        artifactIndex,
         artifacts,
         artifactPath: surface.artifactPath,
-        expectedSha256: surface.expectedSha256,
       });
       if (!filePath) {
         return {

package/packages/core/paper-agent-entry.js

@@ -12,8 +12,6 @@ import {
   stableJson,
   workCheck,
 } from "./paper-repository.js";
-import { mergePublicationRehearsalAgentInstructions } from "./publication-rehearsal-projection.js";
-import { mergeNextDevelopmentAgentInstructions } from "./next-development-projection.js";
 
 export const PAPER_AGENT_ENTRY_CONTRACT = "kungfu-buildchain-paper-agent-entry";
 export const PAPER_AGENT_ENTRY_SCHEMA_VERSION = 1;
@@ -99,9 +97,9 @@ export function createPaperAgentEntry({
 }) {
   const version = String(buildchainVersion || "").trim();
   const sourceSha = String(buildchainSha || "").trim();
-  if (!/^3\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
     throw new Error(
-      "paper agent entry requires an exact Buildchain v3 version",
+      "paper agent entry requires an exact Buildchain semantic version",
     );
   }
   if (!GIT_SHA_PATTERN.test(sourceSha)) {
@@ -169,13 +167,9 @@ export function paperAgentEntryFiles({
     [PAPER_PATHS.agentEntry, jsonText(entry)],
     [
       PAPER_PATHS.agentInstructions,
-      mergeNextDevelopmentAgentInstructions(
-        mergePublicationRehearsalAgentInstructions(
-          mergePaperAgentEntryInstructions(currentAgents, {
-            developmentRef: resolvedDevelopmentRef,
-          }),
-        ),
-      ),
+      mergePaperAgentEntryInstructions(currentAgents, {
+        developmentRef: resolvedDevelopmentRef,
+      }),
     ],
   ]);
 }
@@ -211,11 +205,8 @@ function ciContext({ env, developmentRef }) {
     sourceBranch.startsWith(versionStatePrefix) &&
     /^[0-9a-f]{12}$/i.test(sourceBranch.slice(versionStatePrefix.length));
   const branchOk = pullRequest
-    ? (PAPER_WORK_BRANCH_PATTERN.test(sourceBranch) &&
-        targetBranch === developmentRef) ||
-      (channelIndex > 0 &&
-        sourceBranch === channelBranches[channelIndex - 1]) ||
-      generatedVersionState
+    ? (PAPER_WORK_BRANCH_PATTERN.test(sourceBranch) && targetBranch === developmentRef) ||
+      (channelIndex > 0 && sourceBranch === channelBranches[channelIndex - 1]) || generatedVersionState
     : channelBranches.includes(refName);
   return {
     mode: "ci",

package/packages/core/paper-fleet.js

@@ -106,8 +106,8 @@ function paperFleetEntry({
     ),
     workCheck(
       "package.buildchain-v3",
-      dependency === buildchainVersion && /^3\./.test(dependency),
-      "package.json pins the exact Buildchain v3 runtime.",
+      dependency === buildchainVersion && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(dependency),
+      "package.json pins the exact Buildchain semantic runtime.",
       "buildchain paper migrate --write --json",
     ),
     workCheck(

package/packages/core/paper-repository.js

@@ -1,8 +1,8 @@
-import { spawnSync } from "node:child_process";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { loadBuildchainConfig } from "./buildchain-config.js";
+import { spawnSyncCommand } from "./spawn-command.js";
 
 export const PAPER_PATHS = Object.freeze({
   config: ".buildchain/buildchain.toml",
@@ -13,7 +13,6 @@ export const PAPER_PATHS = Object.freeze({
   buildWorkflow: ".github/workflows/build.yml",
   verifyWorkflow: ".github/workflows/verify.yml",
   releaseWorkflow: ".github/workflows/paper-release.yml",
-  rehearsalWorkflow: ".github/workflows/publication-rehearsal.yml",
   pnpmWorkspace: "pnpm-workspace.yaml",
   reproducibilityReceipt:
     ".buildchain/publication/reproducibility-receipt.json",
@@ -78,7 +77,7 @@ export function commandResult(
   args,
   { cwd, env = process.env, timeout = 15000 } = {},
 ) {
-  const result = spawnSync(command, args, {
+  const result = spawnSyncCommand(command, args, {
     cwd,
     env,
     encoding: "utf8",

package/packages/core/paper-scaffold-content.js

@@ -1,10 +1,3 @@
-import {
-  PUBLICATION_REHEARSAL_CAPSULE_CONTRACT,
-  PUBLICATION_REHEARSAL_COMMAND,
-  RELEASE_LOCAL_CONSTRUCTIBILITY_ADR,
-  RELEASE_LOCAL_CONSTRUCTIBILITY_INVARIANT,
-} from "./publication-rehearsal-runtime.js";
-
 function jsonText(value) {
   return `${JSON.stringify(value, null, 2)}\n`;
 }
@@ -54,14 +47,13 @@ export function paperPackageScripts(current = {}) {
     "paper:work:start": "buildchain paper work start",
     "paper:work:submit": "buildchain paper work submit",
     "paper:status": "buildchain paper status --json",
-    "publication:rehearse": PUBLICATION_REHEARSAL_COMMAND,
   };
 }
 
 export function managedPaperPackageJson(current, buildchainVersion) {
-  if (!/^3\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(buildchainVersion)) {
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(buildchainVersion)) {
     throw new Error(
-      "paper repositories require an exact Buildchain v3 version",
+      "paper repositories require an exact Buildchain semantic version",
     );
   }
   const packageManager = current.packageManager || "pnpm@11.7.0";
@@ -114,7 +106,6 @@ pnpm paper:preflight
 pnpm paper:agent:verify
 pnpm paper:work:start -- <topic>
 pnpm paper:work:submit
-pnpm publication:rehearse
 make pdf
 \`\`\`
 
@@ -123,11 +114,6 @@ artifact generation, sealed publication, npm Trusted Publishing, and recovery;
 this repository owns the paper source and review history.
 
 See [docs/MAP.md](docs/MAP.md) for the repository map.
-
-Publication qualification follows the Buildchain
-\`${RELEASE_LOCAL_CONSTRUCTIBILITY_ADR}\` invariant:
-${RELEASE_LOCAL_CONSTRUCTIBILITY_INVARIANT} The capsule contract is
-\`${PUBLICATION_REHEARSAL_CAPSULE_CONTRACT}\`.
 `;
 }
 
@@ -143,17 +129,10 @@ export function scaffoldMap() {
 - \`.github/workflows/build.yml\`: thin read-only build and reproducibility caller.
 - \`.github/workflows/verify.yml\`: thin required check that enforces the Paper entry and acceptance policy.
 - \`.github/workflows/paper-release.yml\`: thin protected sealed-release caller.
-- \`.github/workflows/publication-rehearsal.yml\`: thin hosted adapter over the same local capsule runtime.
 
 The repository does not own npm transaction logic, publication authority,
 release-state recovery, or site deployment mechanics. Those remain Buildchain,
 npm/GitHub, and downstream site responsibilities respectively.
-
-The exact local pre-publication command is:
-
-\`\`\`sh
-${PUBLICATION_REHEARSAL_COMMAND}
-\`\`\`
 `;
 }