@kungfu-tech/buildchain 3.0.9-alpha.8 → 4.0.0-alpha.0

package/scripts/release-tail.mjs

@@ -11,10 +11,6 @@ import {
   writeReleaseTailTransaction,
 } from "../packages/core/release-tail-provider-plane.js";
 import { diagnoseLegacyReleaseTailHooks } from "../packages/core/release-tail-compatibility.js";
-import {
-  executePublicationRehearsal,
-  publicationRehearsalDiagnostic,
-} from "../packages/core/publication-rehearsal-runtime.js";
 
 function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
@@ -38,50 +34,8 @@ function output(value, filePath = "") {
   process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
 
-export async function runReleaseTailCli(args = process.argv.slice(2)) {
+export function runReleaseTailCli(args = process.argv.slice(2)) {
   const [mode = "status", ...options] = args;
-  if (mode === "rehearse") {
-    const capsulePath = flag(options, "capsule");
-    const capsuleRoot = flag(options, "capsule-root");
-    const statePath = flag(options, "state");
-    const evidencePath = flag(options, "evidence");
-    for (const [name, value] of Object.entries({
-      "--capsule": capsulePath,
-      "--capsule-root": capsuleRoot,
-      "--state": statePath,
-      "--evidence": evidencePath,
-    })) {
-      if (!value || !path.isAbsolute(value)) {
-        throw new Error(`${name} must be an explicit absolute path`);
-      }
-    }
-    const capsule = readJson(capsulePath, "--capsule");
-    const rehearsalMode = flag(options, "mode", "simulate");
-    if (!new Set(["simulate", "replay"]).has(rehearsalMode)) {
-      throw new Error("local rehearsal --mode must be simulate or replay");
-    }
-    const environment = flag(options, "environment-json")
-      ? readJson(flag(options, "environment-json"), "--environment-json")
-      : {};
-    let result;
-    try {
-      result = await executePublicationRehearsal({
-        capsule,
-        capsuleRoot,
-        mode: rehearsalMode,
-        environment,
-        checkpoint: (transaction) =>
-          writeReleaseTailTransaction(statePath, transaction),
-      });
-    } catch (error) {
-      const diagnostic = publicationRehearsalDiagnostic(error, { capsule });
-      output(diagnostic, evidencePath);
-      throw error;
-    }
-    writeReleaseTailTransaction(statePath, result.transaction);
-    output(result.evidence, evidencePath);
-    return result;
-  }
   if (mode === "plan") {
     const plan = compileReleaseTailDeclaration(
       readJson(flag(options, "declaration"), "--declaration"),
@@ -141,7 +95,7 @@ export async function runReleaseTailCli(args = process.argv.slice(2)) {
     return report;
   }
   throw new Error(
-    "usage: buildchain release-tail <plan|init|status|verify|compat|rehearse> [--declaration <json-or-path>] [--capsule <path>] [--capsule-root <absolute-path>] [--mode <simulate|replay>] [--state <path>] [--evidence <path>] [--hooks-json <json-or-path>] [--output <path>]",
+    "usage: buildchain release-tail <plan|init|status|verify|compat> [--declaration <json-or-path>] [--state <path>] [--hooks-json <json-or-path>] [--output <path>]",
   );
 }
 
@@ -151,7 +105,7 @@ if (
   import.meta.url === pathToFileURL(process.argv[1]).href
 ) {
   try {
-    await runReleaseTailCli();
+    runReleaseTailCli();
   } catch (error) {
     console.error(`release-tail: ${error.message}`);
     process.exitCode = 1;

package/scripts/resume-from-candidate-run.mjs

@@ -95,18 +95,12 @@ function findFiles(root, predicate) {
   return collectFiles(root).filter((file) => predicate(file.path, file.absolutePath));
 }
 
-export function recoveredArtifactPathsByBasename(downloads, filename) {
-  return downloads.flatMap((download) => download.files
-    .filter((file) => path.basename(file.path) === filename)
-    .map((file) => outputPath(file.absolutePath)));
-}
-
 function readOnlyJson(files, label) {
   if (files.length !== 1) throw new Error(`expected exactly one ${label}, found ${files.length}`);
   return JSON.parse(fs.readFileSync(files[0].absolutePath, "utf8"));
 }
 
-export async function readExistingTransaction({ repoInfo, apiUrl, token, fetchImpl, version }) {
+async function readExistingTransaction({ repoInfo, apiUrl, token, fetchImpl, version }) {
   const stateRef = releaseTransactionStateRef(version);
   const response = await githubJson({
     apiUrl,
@@ -116,31 +110,10 @@ export async function readExistingTransaction({ repoInfo, apiUrl, token, fetchIm
     path: `/repos/${repoInfo.owner}/${repoInfo.repo}/contents/state.json?ref=${encodeURIComponent(stateRef)}`,
   });
   if (!response) return undefined;
-  if (response.type !== "file") {
-    throw new Error(`durable transaction ${stateRef} did not expose a state.json file`);
-  }
-  let encoded = response.encoding === "base64" && response.content
-    ? response
-    : undefined;
-  if (!encoded) {
-    const blobSha = String(response.sha || "").trim();
-    if (!/^[0-9a-f]{40}$/i.test(blobSha)) {
-      throw new Error(`durable transaction ${stateRef} did not expose inline content or an exact blob identity`);
-    }
-    encoded = await githubJson({
-      apiUrl,
-      token,
-      fetchImpl,
-      path: `/repos/${repoInfo.owner}/${repoInfo.repo}/git/blobs/${blobSha}`,
-    });
-    if (String(encoded?.sha || "").trim() !== blobSha) {
-      throw new Error(`durable transaction ${stateRef} blob identity drifted from ${blobSha}`);
-    }
-  }
-  if (encoded?.encoding !== "base64" || !encoded.content) {
-    throw new Error(`durable transaction ${stateRef} did not expose base64 state.json content`);
+  if (response.type !== "file" || response.encoding !== "base64" || !response.content) {
+    throw new Error(`durable transaction ${stateRef} did not expose a base64 state.json file`);
   }
-  return JSON.parse(Buffer.from(String(encoded.content).replace(/\s/g, ""), "base64").toString("utf8"));
+  return JSON.parse(Buffer.from(String(response.content).replace(/\s/g, ""), "base64").toString("utf8"));
 }
 
 function outputPath(filePath) {
@@ -207,7 +180,6 @@ function candidateArtifactNames({ passport, selected, artifacts, artifactPattern
 
 export function normalizePlatformManifests(downloads, passport) {
   const manifests = [];
-  const paths = [];
   const evidenceByArtifact = new Map();
   const platformById = new Map((passport.platformMatrix || []).map((entry) => [String(entry.platformId || ""), entry]));
   const seenPlatformIds = new Set();
@@ -236,7 +208,6 @@ export function normalizePlatformManifests(downloads, passport) {
       manifest.artifactName = expectedPlatform.artifactName;
       seenPlatformIds.add(platformId);
       manifests.push(manifest);
-      paths.push(file.absolutePath);
       addEvidence(manifest.artifactName, download.record.files);
     }
     if (String(download.artifact.name).includes("-diagnostics-")) {
@@ -251,7 +222,7 @@ export function normalizePlatformManifests(downloads, passport) {
     artifactName,
     files: [...files.values()].sort((left, right) => left.path.localeCompare(right.path)),
   }));
-  return { manifests, paths, evidence };
+  return { manifests, evidence };
 }
 
 function normalizeControllerReceipts(downloads, passport) {
@@ -297,53 +268,16 @@ export function createRecoveredPublicationCandidate({
   return { ...payload, candidateDigest: publicationArtifactCandidateDigest(payload) };
 }
 
-export function deduplicateReleaseAssets(files = []) {
-  const assets = new Map();
-  for (const file of files) {
-    const name = path.basename(file.path);
-    const existing = assets.get(name);
-    if (!existing) {
-      assets.set(name, file);
-      continue;
-    }
-    const digest = String(file.sha256 || "").replace(/^sha256:/, "");
-    const existingDigest = String(existing.sha256 || "").replace(/^sha256:/, "");
-    if (digest !== existingDigest || Number(file.size) !== Number(existing.size)) {
-      throw new Error(
-        `recovered GitHub Release asset basename collision: ${name} maps to different sealed bytes`,
-      );
-    }
-    if (
-      String(file.path).length < String(existing.path).length ||
-      (String(file.path).length === String(existing.path).length &&
-        String(file.path).localeCompare(String(existing.path)) < 0)
-    ) {
-      assets.set(name, file);
-    }
-  }
-  return [...assets.values()].sort((left, right) =>
-    path.basename(left.path).localeCompare(path.basename(right.path)),
-  );
-}
-
 export function createRecoveredPublication({ downloads, bundleRoot, repository, passport, candidateRuntimeSha, publishArtifactKind, publishPackageMain, releasePatterns, platformManifests }) {
   const allFiles = downloads.flatMap((download) => download.files.map((file) => ({
     path: path.relative(bundleRoot, file.absolutePath).split(path.sep).join("/"),
     size: file.size,
     sha256: file.sha256.replace(/^sha256:/, ""),
     absolutePath: file.absolutePath,
-    artifactName: String(download.artifact?.name || ""),
   }))).sort((left, right) => left.path.localeCompare(right.path));
   const kind = String(publishArtifactKind || "npm");
   const releaseMatchers = splitPatterns(releasePatterns).map(patternMatcher);
-  const platformArtifactNames = new Set(
-    platformManifests.map((manifest) => String(manifest.artifactName || "")).filter(Boolean),
-  );
-  const releaseAssetFiles = kind !== "npm" && platformArtifactNames.size > 0
-    ? allFiles.filter((file) => platformArtifactNames.has(file.artifactName))
-    : allFiles;
-  const releaseAssets = deduplicateReleaseAssets(releaseAssetFiles.filter((file) =>
-    releaseMatchers.some((matcher) => matcher.test(path.basename(file.path)))));
+  const releaseAssets = allFiles.filter((file) => releaseMatchers.some((matcher) => matcher.test(path.basename(file.path))));
   if (kind !== "npm") {
     createRecoveredPublicationCandidate({ allFiles, repository, passport, candidateRuntimeSha });
     const version = String(passport.target?.version || "").trim();
@@ -433,42 +367,6 @@ async function recoverCandidateEvidence({
   };
 }
 
-export function exposeRecoveredPayloadRoot({ resolvedOutput, bundleRoot }) {
-  const recoveredPayloadRoot = path.join(bundleRoot, "artifacts");
-  if (!fs.existsSync(recoveredPayloadRoot) || !fs.statSync(recoveredPayloadRoot).isDirectory()) {
-    throw new Error(`recovered candidate payload root is missing: ${recoveredPayloadRoot}`);
-  }
-  const compatibilityRoot = path.join(resolvedOutput, "payloads");
-  try {
-    fs.lstatSync(compatibilityRoot);
-    if (fs.realpathSync(compatibilityRoot) !== fs.realpathSync(recoveredPayloadRoot)) {
-      throw new Error(`recovered candidate payload compatibility path is already occupied: ${compatibilityRoot}`);
-    }
-  } catch (error) {
-    if (error?.code !== "ENOENT") throw error;
-    fs.symlinkSync(path.relative(resolvedOutput, recoveredPayloadRoot), compatibilityRoot, "dir");
-  }
-  return compatibilityRoot;
-}
-
-export function exposeRecoveredPassportPath({ resolvedOutput, recoveredPassportPath }) {
-  if (!fs.existsSync(recoveredPassportPath) || !fs.statSync(recoveredPassportPath).isFile()) {
-    throw new Error(`recovered candidate passport is missing: ${recoveredPassportPath}`);
-  }
-  const recoveredPassportRoot = path.dirname(recoveredPassportPath);
-  const compatibilityRoot = path.join(resolvedOutput, "passport");
-  try {
-    fs.lstatSync(compatibilityRoot);
-    if (fs.realpathSync(compatibilityRoot) !== fs.realpathSync(recoveredPassportRoot)) {
-      throw new Error(`recovered candidate passport compatibility path is already occupied: ${compatibilityRoot}`);
-    }
-  } catch (error) {
-    if (error?.code !== "ENOENT") throw error;
-    fs.symlinkSync(path.relative(resolvedOutput, recoveredPassportRoot), compatibilityRoot, "dir");
-  }
-  return path.join(compatibilityRoot, path.basename(recoveredPassportPath));
-}
-
 async function resolveTargetAdvance({ observedTargetSha, targetSha, transactionId, existingTransaction, repoInfo, apiUrl, token, fetchImpl }) {
   if (observedTargetSha === targetSha || !transactionId || existingTransaction?.id !== transactionId) return undefined;
   const comparison = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/compare/${targetSha}...${observedTargetSha}` });
@@ -596,16 +494,7 @@ export async function resumeFromCandidateRun({
     if (publication.manifest) fs.writeFileSync(sealedManifestPath, `${JSON.stringify(publication.manifest, null, 2)}\n`);
     const publishRequiredArtifacts = publication.publishRequiredArtifacts;
     fs.writeFileSync(requiredArtifactsPath, `${JSON.stringify(publishRequiredArtifacts, null, 2)}\n`);
-    const payloadRoot = exposeRecoveredPayloadRoot({ resolvedOutput, bundleRoot });
-    const recoveredPassportPath = initialDownloads[0].files.find(
-      (file) => path.basename(file.path) === "release-candidate-passport.json",
-    ).absolutePath;
-    const passportPath = exposeRecoveredPassportPath({ resolvedOutput, recoveredPassportPath });
     const tarballs = publication.npmArtifacts.map((entry) => outputPath(entry.file.absolutePath));
-    const githubArtifactAttestationPolicies = recoveredArtifactPathsByBasename(
-      downloads,
-      "github-artifact-attestation-policy.json",
-    );
     return {
       enabled: true,
       action: "reused",
@@ -618,11 +507,10 @@ export async function resumeFromCandidateRun({
       receipt: recovery.receipt,
       publishRequiredArtifacts,
       paths: {
-        passport: outputPath(passportPath),
+        passport: outputPath(initialDownloads[0].files.find((file) => path.basename(file.path) === "release-candidate-passport.json").absolutePath),
         buildSummary: outputPath(initialDownloads[1].files.find((file) => path.basename(file.path) === "build-summary.json").absolutePath),
-        payloads: outputPath(payloadRoot),
-        platformManifests: platformManifestEvidence.paths.map(outputPath),
-        githubArtifactAttestationPolicies,
+        payloads: outputPath(path.join(bundleRoot, "artifacts")),
+        platformManifests: downloads.flatMap((download) => download.files.filter((file) => path.basename(file.path) === "manifest.json").map((file) => outputPath(file.absolutePath))),
         npmTarballs: tarballs,
         releaseAssets: publication.releaseAssets.map((asset) => outputPath(asset.absolutePath)),
         publishRequiredArtifacts: outputPath(requiredArtifactsPath),
@@ -672,8 +560,6 @@ export async function resumeFromCandidateRunCli() {
       "release-candidate-payload-artifacts": result.artifacts.payloads.join(","),
       "release-candidate-payload-dir": result.paths.payloads,
       "release-candidate-platform-manifest-paths": result.paths.platformManifests.join(","),
-      "release-candidate-github-artifact-attestation-policy-paths": result.paths.githubArtifactAttestationPolicies.join(","),
-      "release-candidate-github-artifact-attestation-policy-count": String(result.paths.githubArtifactAttestationPolicies.length),
       "release-candidate-npm-tarball-paths": result.paths.npmTarballs.join(","),
       "release-candidate-github-release-artifact-paths": result.paths.releaseAssets.join("\n"),
       "publish-required-artifacts-json": JSON.stringify(result.publishRequiredArtifacts),

package/scripts/run-lifecycle-core.mjs

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { execFileSync, execSync, spawnSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -9,6 +9,7 @@ import {
   normalizeLifecycleStage,
   runLifecycleStage,
 } from "../packages/core/buildchain-config.js";
+import { runProcessTreeCommandSync, runShellCommandSync } from "../packages/core/spawn-command.js";
 import {
   createBuildchainLogger,
   readBuildchainLogEvents,
@@ -201,7 +202,7 @@ function shellCommandArgs(command, shell) {
     return [shell, "-c", command];
   }
   if (process.platform === "win32") {
-    return [process.env.ComSpec || "cmd.exe", "/d", "/s", "/c", command];
+    return [process.env.ComSpec || "cmd.exe", "/d", "/s", "/c", `"${command}"`];
   }
   return [process.env.SHELL || "/bin/sh", "-c", command];
 }
@@ -244,16 +245,14 @@ function executeSampledShellCommand({
     args.push("--requested-parallelism", String(Number(requestedParallelism)));
   }
   args.push("--", ...shellCommandArgs(command, shell));
-  const result = spawnSync(process.execPath, args, {
-    cwd,
-    env,
-    stdio: "inherit",
-    timeout,
-  });
-  if (result.error || result.status !== 0 || result.signal) {
-    const error = result.error || new Error(`sampled lifecycle command failed with status ${result.status ?? ""}`);
-    error.status = result.status ?? error.status ?? 1;
-    error.signal = result.signal || error.signal || "";
+  try {
+    runProcessTreeCommandSync(process.execPath, args, {
+      cwd,
+      env,
+      stdio: "inherit",
+      timeout,
+    });
+  } catch (error) {
     attachProcessSampleFailureEvidence(error, processSummaryPath);
     throw error;
   }
@@ -565,7 +564,7 @@ export function runLifecycle({
           timeout: effectiveCommandTimeoutMinutes ? effectiveCommandTimeoutMinutes * 60_000 : undefined,
         });
       } else {
-        execSync(command, {
+        runShellCommandSync(command, {
           cwd: resolvedCwd,
           env: commandEnv,
           shell: commandShell,

package/scripts/seal-artifact-signing-requests.mjs

@@ -162,10 +162,11 @@ function inferKind(subjectPath, declaredKind) {
   return "binary";
 }
 
-function run(command, args) {
+function run(command, args, options = {}) {
   const result = spawnSync(command, args, {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
+    ...options,
   });
   if (result.error || result.status !== 0) {
     throw (
@@ -205,13 +206,17 @@ function archiveSubject({ subjectPath, outputRoot, id, kind, platform }) {
     format = "ditto-zip";
   } else {
     archivePath = path.join(artifactRoot, "subject.tar");
-    run("tar", [
-      "-cf",
-      archivePath,
-      "-C",
-      path.dirname(subjectPath),
-      path.basename(subjectPath),
-    ]);
+    run(
+      "tar",
+      [
+        "-cf",
+        path.basename(archivePath),
+        "-C",
+        path.dirname(subjectPath),
+        path.basename(subjectPath),
+      ],
+      { cwd: artifactRoot },
+    );
     format = "tar";
   }
   return {
@@ -275,19 +280,16 @@ export function sealArtifactSigningRequests({
   sourceTreeSha = process.env.BUILDCHAIN_SOURCE_TREE_SHA,
   runtimeSha = process.env.BUILDCHAIN_RUNTIME_SHA,
   platformId = process.env.BUILDCHAIN_PLATFORM_ID,
-  requestsEnabled = process.env.BUILDCHAIN_SIGNING_REQUESTS_ENABLED !== "false",
 } = {}) {
   const resolvedWorkspace = path.resolve(workspace);
   const resolvedCwd = path.resolve(resolvedWorkspace, cwd);
   assertInside(resolvedWorkspace, resolvedCwd, "signing working directory");
   const loaded = loadBuildchainConfig(resolvedCwd);
   const declarations = loaded?.config?.signing?.artifacts || [];
-  const selected = requestsEnabled
-    ? declarations.filter(
-        (entry) =>
-          entry.platforms.length === 0 || entry.platforms.includes(platformId),
-      )
-    : [];
+  const selected = declarations.filter(
+    (entry) =>
+      entry.platforms.length === 0 || entry.platforms.includes(platformId),
+  );
   const resolvedOutputRoot = path.resolve(resolvedWorkspace, outputRoot);
   assertInside(resolvedWorkspace, resolvedOutputRoot, "signing request output");
   if (selected.length === 0) {
@@ -379,12 +381,6 @@ export function sealArtifactSigningRequests({
       signature: {
         profile: declaration.profile,
         required: declaration.required,
-        ...(declaration.entitlementsProfile !== "none"
-          ? {
-              entitlementsProfile: declaration.entitlementsProfile,
-              entitlementsPaths: declaration.entitlementsPaths,
-            }
-          : {}),
       },
     });
     const check = validateArtifactSigningRequest(request);

package/scripts/site-capability-metadata.mjs

@@ -84,7 +84,7 @@ export function cliCommandMeta(id) {
     "kfd-7-schema": { group: "kfd-trust", purpose: "Print the default KFD-7 schema exposed by the KFD package standards metadata." },
     "kfd-7-gate": { group: "kfd-trust", purpose: "Evaluate a source-bound KFD-7 Domain Profile, evidence obligations, and independent review." },
     "kfd-7-verify": { group: "kfd-trust", purpose: "Verify a retained KFD-7 product-gate result without widening product support." },
-    "kfd-support": { group: "kfd-trust", purpose: "Project and verify a legacy KFD support matrix from one exact standard adopter manifest authority closure." },
+    "kfd-support": { group: "kfd-trust", purpose: "Project and verify a product-owned KFD-1 through KFD-13 support matrix against KFD-4/5/7 gates." },
     "kfd-aggregate": { group: "kfd-trust", purpose: "Return a product KFD view that combines own KFD status with upstream KFD aggregate facts." },
     "kfd-upstream": { group: "kfd-trust", purpose: "Inspect KFD upstream aggregate command families." },
     "kfd-upstream-check": { group: "kfd-trust", purpose: "Validate a KFD upstream aggregate document and fail closed on missing evidence." },
@@ -139,7 +139,7 @@ export function cliCommandMeta(id) {
     "release-line-open": { group: "governance-versioning", purpose: "Plan or write the initial version-state commit for a new minor release line." },
     "release-governance": { group: "governance-versioning", purpose: "Reconcile a managed branch's Buildchain aggregate check to an already-tested pull request SHA." },
     "release-propagation": { group: "site-and-propagation", purpose: "Route exact Paper, KFD, Buildchain, or Core Site updates through one resumable propagation Work." },
-    "release-tail": { group: "release-passport-trust", purpose: "Plan, initialize, rehearse, resume, and verify one declarative provider-owned release-tail transaction." },
+    "release-tail": { group: "release-passport-trust", purpose: "Plan, initialize, resume, and verify one declarative provider-owned release-tail transaction." },
     "release-transaction": { group: "release-passport-trust", purpose: "Inspect, recover, finalize, or abort durable release transactions." },
     sample: { group: "observability-diagnostics", purpose: "Inspect sampler command families." },
     "sample-process-tree": { group: "observability-diagnostics", purpose: "Sample process-tree diagnostics for a wrapped command." },
@@ -203,17 +203,12 @@ export function nodeApiMeta(exportName) {
     "./release-candidate": { group: "reusable-build", summary: "PR-stage release-candidate artifact, passport, and promote-only resolver APIs." },
     "./release-candidate-recovery": { group: "release-passport-trust", summary: "Fail-closed verification and immutable receipts for reusing a successful sealed candidate run without rebuilding product payloads." },
     "./release-train": { group: "governance-versioning", summary: "Frozen Release Cut identity, rooted Release Train transitions, Dev observations, supersession, replay, and legacy read compatibility APIs." },
-    "./next-development-transition": { group: "governance-versioning", summary: "Provider-neutral completed-Alpha preservation and rooted next-development state, version-model, idempotency, and local materialization APIs." },
-    "./next-development-controller": { group: "governance-versioning", summary: "Durable completed-Alpha child scheduling, fresh-runner checkpoint resume, latest protected-Dev reconciliation, and exact version-root readback APIs." },
-    "./next-development-projection": { group: "governance-versioning", summary: "Canonical generated config, Agent, and manual projections for the next-development transition contract." },
     "./stable-candidate-ledger": { group: "governance-versioning", summary: "Immutable alpha candidate ledger, qualification, revocation, selection, and exact stable source-lock APIs." },
     "./release-propagation": { group: "site-and-propagation", summary: "Release propagation graph, plan, and exact upstream lock APIs." },
     "./release-activation-transaction": { group: "release-passport-trust", summary: "Ordered cross-repository activation, exact receipt-set binding, retry, abort, rollback, and shadow-rehearsal APIs." },
     "./release-tail-provider-plane": { group: "release-passport-trust", summary: "Versioned declarative release-tail parsing, deterministic effect planning, durable transaction execution, readback, retry, and rooted receipt APIs." },
     "./release-tail-provider-adapters": { group: "release-passport-trust", summary: "Buildchain-owned GitHub Release, signed-channel, activation, and released-evidence provider adapters." },
     "./release-tail-compatibility": { group: "release-passport-trust", summary: "Bounded v3 release-hook compatibility diagnostics that reject new executable release-tail inputs." },
-    "./publication-rehearsal-runtime": { group: "release-passport-trust", summary: "Content-addressed local, replay, and provider-recording publication rehearsal over the shared release-tail core." },
-    "./publication-rehearsal-projection": { group: "release-passport-trust", summary: "Canonical generated config, workflow, and Agent projections for release local constructibility." },
     "./release-line-bootstrap": { group: "governance-versioning", summary: "Semver release-line bootstrap planning and version-state APIs." },
     "./buildchain-contract": { group: "governance-versioning", summary: "Runtime contract world and compatibility digest APIs for floating-ref drift checks." },
     "./controller-evidence": { group: "reusable-build", summary: "Project-independent controller descriptors, source/runtime-bound plans, receipts, aggregates, and validation APIs." },

package/scripts/stable-candidate-qualification.mjs

@@ -1,7 +1,5 @@
 #!/usr/bin/env node
 
-import { validateHostedSelfDogfoodEvidence } from "./next-development-self-dogfood.mjs";
-
 const DEFAULTS = {
   buildWorkflowFile: "build-surface-fixture.yml",
   buildWorkflowName: "Build Surface Fixture",
@@ -50,16 +48,18 @@ export function resolveStableCandidateQualificationCandidate({ eventName, inputC
   if (text(eventName) !== "workflow_run") {
     throw new Error(`qualification candidate resolver does not admit event ${eventName || "<empty>"}`);
   }
-  let evidence;
-  try {
-    evidence = validateHostedSelfDogfoodEvidence(selfDogfoodEvidence);
-  } catch (error) {
-    throw new Error(`self-dogfood evidence is not a passing rooted v3-alpha observation: ${error.message}`);
+  const evidence = selfDogfoodEvidence;
+  if (
+    evidence?.contract !== "kungfu-buildchain-alpha-self-dogfood"
+    || evidence?.status !== "passed"
+    || evidence?.observed?.alpha?.ref !== "v4-alpha"
+  ) {
+    throw new Error("self-dogfood evidence is not a passing v4-alpha observation");
   }
-  const observedSha = optionalSha(evidence.observed.alpha.sha, "observed v3-alpha SHA");
-  const expectedSha = optionalSha(evidence.observed.alpha.expectedSha, "expected v3-alpha SHA");
+  const observedSha = optionalSha(evidence.observed.alpha.sha, "observed v4-alpha SHA");
+  const expectedSha = optionalSha(evidence.observed.alpha.expectedSha, "expected v4-alpha SHA");
   if (!observedSha || observedSha !== expectedSha) {
-    throw new Error("self-dogfood evidence does not bind observed and expected v3-alpha SHAs");
+    throw new Error("self-dogfood evidence does not bind observed and expected v4-alpha SHAs");
   }
   return observedSha;
 }

package/scripts/v4-architecture.mjs

@@ -238,6 +238,8 @@ function validateCapabilities(capabilities, inventory, issues) {
     }
     if (!MIGRATION_PHASES.has(capability?.migrationPhase))
       issues.push(`${capability?.id} has invalid migrationPhase`);
+    if (capability?.migrationPhase !== "legacy-retired")
+      issues.push(`${capability?.id} must retire its legacy v3 authority`);
   }
   for (const id of inventoryById.keys()) {
     if (!(capabilities || []).some((entry) => entry.sourceInventoryId === id))
@@ -279,8 +281,12 @@ function validateStateMachines(machines, capabilityIds, issues) {
       `${coordinate}.writer.runtime`,
       issues,
     );
+    if (machine?.writer?.runtime !== "typescript-v4")
+      issues.push(`${machine?.id} writer.runtime must be typescript-v4`);
     if (!MIGRATION_PHASES.has(machine?.migrationPhase))
       issues.push(`${machine?.id} has invalid migrationPhase`);
+    if (machine?.migrationPhase !== "legacy-retired")
+      issues.push(`${machine?.id} must retire its legacy v3 writer`);
     for (const field of [
       "undeclaredStates",
       "undeclaredEvents",
@@ -302,8 +308,12 @@ function validateManifest({ manifest, inventory, bootstrap, ledger }) {
     issues.push("manifest contract is invalid");
   if (manifest?.releaseLine?.branch !== "dev/v4/v4.0")
     issues.push("releaseLine.branch must be dev/v4/v4.0");
-  if (manifest?.releaseLine?.productionFallback !== "dev/v3/v3.0")
-    issues.push("releaseLine.productionFallback must remain dev/v3/v3.0");
+  if (manifest?.releaseLine?.productionAuthority !== "v4-native")
+    issues.push("releaseLine.productionAuthority must be v4-native");
+  if (manifest?.releaseLine?.productionFallback !== null)
+    issues.push("releaseLine.productionFallback must be null after cutover");
+  if (manifest?.releaseLine?.rollbackRef !== "release/v3/v3.0")
+    issues.push("releaseLine.rollbackRef must retain release/v3/v3.0");
   if (
     manifest?.releaseLine?.qualificationMode !==
     "exact-n-minus-one-git-revision"