@kungfu-tech/buildchain 3.0.9-alpha.9 → 4.0.0-alpha.0

package/dist/site/workflow-registry.json

@@ -93,6 +93,8 @@
       "reusable": true,
       "inputs": [
         "artifact-compression-level",
+        "artifact-finalization-command",
+        "artifact-finalization-on-platform",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -113,6 +115,8 @@
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
         "buildchain-contract-lock-path",
+        "buildchain-expected-channel",
+        "buildchain-expected-major",
         "buildchain-ref",
         "buildchain-repository",
         "cache-dependency-lock-root",
@@ -179,7 +183,7 @@
         "verify-substage-evidence-path",
         "working-directory"
       ],
-      "inputCount": 86,
+      "inputCount": 90,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -465,6 +469,8 @@
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
         "buildchain-contract-lock-path",
+        "buildchain-expected-channel",
+        "buildchain-expected-major",
         "buildchain-ref",
         "buildchain-repository",
         "channel",
@@ -568,7 +574,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 111,
+      "inputCount": 113,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1217,6 +1223,8 @@
       "reusable": true,
       "inputs": [
         "artifact-compression-level",
+        "artifact-finalization-command",
+        "artifact-finalization-on-platform",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -1239,6 +1247,8 @@
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
         "buildchain-contract-lock-path",
+        "buildchain-expected-channel",
+        "buildchain-expected-major",
         "buildchain-ref",
         "buildchain-repository",
         "buildchain-stable-contract-lock-path",
@@ -1306,7 +1316,7 @@
         "verify-substage-evidence-path",
         "working-directory"
       ],
-      "inputCount": 89,
+      "inputCount": 93,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1836,7 +1846,6 @@
       "path": ".github/workflows/dev-pr-auto-merge.yml",
       "reusable": true,
       "inputs": [
-        "active-lease-context",
         "affected-paths-json",
         "allowed-head-prefixes",
         "assignment-root",
@@ -1850,17 +1859,12 @@
         "dependency-root",
         "diagnostic-context",
         "dry-run",
-        "environment-root",
         "expected-head-sha",
         "expected-pr-number",
-        "handoff-workflow-id",
         "initiative-root",
         "landing-mode",
         "max-merges",
         "merge-method",
-        "native-command",
-        "native-heartbeat-seconds",
-        "native-proof-json",
         "plan-root",
         "project-cut-proof-json",
         "queue-admission-context",
@@ -1871,13 +1875,11 @@
         "shard-evidence-roots-json",
         "source-identity-root",
         "source-patch-root",
-        "source-workflow-id",
-        "source-workflow-run-id",
         "target-branch",
         "toolchain-root",
         "warrant-lease-seconds"
       ],
-      "inputCount": 40,
+      "inputCount": 32,
       "secrets": [
         "github-token"
       ],
@@ -1890,17 +1892,14 @@
         "evaluated-count",
         "final-base-sha",
         "merged-count",
-        "native-proof-root",
-        "native-reuse-decision-root",
         "project-cut-proof-root",
-        "qualified-warrant-receipt-root",
         "skipped-count",
         "source-proof-root",
         "warrant-receipt-root",
         "warrant-state-commit",
         "warrant-state-root"
       ],
-      "outputCount": 16,
+      "outputCount": 13,
       "surface": "dev-governance",
       "capabilityGroup": "governance-versioning",
       "status": "active",
@@ -1969,7 +1968,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.9",
+      "introducedVersion": "4.0.0-alpha.0",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1990,7 +1989,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.9",
+      "introducedVersion": "4.0.0-alpha.0",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2011,7 +2010,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.9",
+      "introducedVersion": "4.0.0-alpha.0",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2061,7 +2060,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.9",
+      "introducedVersion": "4.0.0-alpha.0",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2802,25 +2801,22 @@
       "reusable": true,
       "inputs": [
         "buildchain-ref",
-        "capsule-contract",
-        "capsule-path",
-        "capsule-root",
-        "evidence-path",
+        "declaration-path",
+        "execute",
+        "provider-bindings-path",
         "state-path"
       ],
-      "inputCount": 6,
+      "inputCount": 5,
       "secrets": [
         "http-token"
       ],
       "secretCount": 1,
       "outputs": [
-        "binding-root",
-        "evidence-root",
         "state-root",
         "transaction-root",
         "transaction-state"
       ],
-      "outputCount": 5,
+      "outputCount": 3,
       "surface": "release-tail-provider-plane",
       "capabilityGroup": "release-passport-trust",
       "status": "active",
@@ -2943,6 +2939,55 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "v4-public-consumer-dogfood",
+      "path": ".github/workflows/v4-public-consumer-dogfood.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
+    {
+      "id": "v4-stage-capsule-canary",
+      "path": ".github/workflows/v4-stage-capsule-canary.yml",
+      "reusable": true,
+      "inputs": [
+        "build-artifact-path",
+        "consumer",
+        "go-version",
+        "install-artifact-path",
+        "node-version",
+        "verify-artifact-path"
+      ],
+      "inputCount": 6,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "verify",
       "path": ".github/workflows/verify.yml",
@@ -3051,7 +3096,6 @@
         "github-release-artifact-paths",
         "github-release-notes",
         "github-release-title",
-        "plan-before-target-advance",
         "promote-only-release-candidate",
         "publication-capability-json",
         "publication-gate-aggregate-json",
@@ -3119,7 +3163,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 81,
+      "inputCount": 80,
       "capabilityGroup": "release-passport-trust",
       "status": "active",
       "owner": "buildchain-actions",
@@ -3134,15 +3178,14 @@
       "id": "release-tail",
       "path": "actions/release-tail/action.yml",
       "inputs": [
-        "capsule",
-        "capsule-contract",
-        "capsule-root",
-        "evidence-path",
+        "declaration",
+        "execute",
         "github-token",
         "http-token",
+        "provider-bindings",
         "state-path"
       ],
-      "inputCount": 7,
+      "inputCount": 6,
       "capabilityGroup": "release-passport-trust",
       "status": "active",
       "owner": "buildchain-actions",

package/docs/MAP.md

@@ -59,14 +59,14 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Capability group | Primary facts | Primary manuals |
 | --- | --- | --- |
 | Getting Started | `capability-registry.json`, `product-mechanism.json` | [`getting-started.md`](getting-started.md), [`install.md`](install.md), [`product-mechanism.md`](product-mechanism.md), [`cli.md`](cli.md) |
-| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`github-artifact-attestation.md`](github-artifact-attestation.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`release-train.md`](release-train.md), [`publish-transaction.md`](publish-transaction.md), [`release-tail-contract.md`](release-tail-contract.md), [`publication-rehearsal.md`](publication-rehearsal.md), [`binary-distribution.md`](binary-distribution.md) |
+| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`github-artifact-attestation.md`](github-artifact-attestation.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`release-train.md`](release-train.md), [`publish-transaction.md`](publish-transaction.md), [`release-tail-contract.md`](release-tail-contract.md), [`binary-distribution.md`](binary-distribution.md) |
 | Reusable Build and Lifecycle | `workflow-registry.json`, `controller-registry.json`, `release-model.json` | [`reusable-build-surface.md`](reusable-build-surface.md), [`controller-evidence.md`](controller-evidence.md), [`shifu-gate-profiles.md`](shifu-gate-profiles.md), [`lifecycle-protocol.md`](lifecycle-protocol.md) |
 | KFD Trust and Surface Closure | `kfd-claims.json`, `public-surface-audit.json`, `cli-registry.json`, `node-api-registry.json` | [`kfd-support.md`](kfd-support.md), [`release-passport.md`](release-passport.md) |
 | Site Bundle, Web Surfaces, and Propagation | `buildchain-site.json`, `site-manifest.json`, `page-registry.json`, `release-model.json` | [`site-bundle-contract.md`](site-bundle-contract.md), [`web-surface-deployments.md`](web-surface-deployments.md), [`release-propagation.md`](release-propagation.md) |
 | Publication Artifacts | `publication-registry.json`, `workflow-registry.json`, `node-api-registry.json`, `manual-registry.json`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md), [`reusable-build-surface.md`](reusable-build-surface.md) |
 | Distribution Indexes and Badges | `badge-endpoint-registry.json`, `node-api-registry.json`, `manual-registry.json` | [`readme-badges.md`](readme-badges.md), [`homebrew.md`](homebrew.md) |
 | Build Facts, Observability, and Diagnostics | `cli-registry.json`, `node-api-registry.json`, lifecycle artifacts | [`build-facts.md`](build-facts.md), [`toolkit-observability.md`](toolkit-observability.md), [`consumer-issue-reporting.md`](consumer-issue-reporting.md) |
-| Governance, Versioning, and Runtime Drift | `buildchain-contract.json`, `workflow-registry.json`, `release-model.json` | [`github-governance-authority.md`](github-governance-authority.md), [`release-governance.md`](release-governance.md), [`release-flow.md`](release-flow.md), [`next-development-transition.md`](next-development-transition.md), [`versioning.md`](versioning.md), [`runtime-train-validation.md`](runtime-train-validation.md), [`cli.md`](cli.md) |
+| Governance, Versioning, and Runtime Drift | `buildchain-contract.json`, `workflow-registry.json`, `release-model.json` | [`github-governance-authority.md`](github-governance-authority.md), [`release-governance.md`](release-governance.md), [`release-flow.md`](release-flow.md), [`versioning.md`](versioning.md), [`runtime-train-validation.md`](runtime-train-validation.md), [`cli.md`](cli.md) |
 | CLI and Node API Reference | `cli-registry.json`, `node-api-registry.json`, `workflow-registry.json`, `manual-registry.json` | [`cli-reference.md`](cli-reference.md), [`node-api-reference.md`](node-api-reference.md), [`cli.md`](cli.md), [`../packages/core/README.md`](../packages/core/README.md) |
 
 | Capability | Machine-readable entry | Manual entry |
@@ -107,10 +107,15 @@ replace them.
 | How do I install a standalone binary or npm package? | [`install.md`](install.md) | use | stable |
 | How do I run or look up the `buildchain` CLI? | [`cli-reference.md`](cli-reference.md) + [`cli.md`](cli.md) | use | stable |
 | How do I import Buildchain toolkit APIs from JavaScript build code? | [`node-api-reference.md`](node-api-reference.md) + [`../packages/core/README.md`](../packages/core/README.md) | use | stable |
-| How are bounded Qualification Leases separated from exclusive merge-group Landing authority? | [`dev-delivery-qualification-landing-adr.md`](dev-delivery-qualification-landing-adr.md) + [`dev-delivery-warrant.md`](dev-delivery-warrant.md) | govern | accepted |
 | How do I initialize a new repository? | [`getting-started.md`](getting-started.md) + [`lifecycle-protocol.md`](lifecycle-protocol.md) | use | stable |
 | Why does Buildchain use branch-driven release governance? | [`release-governance.md`](release-governance.md) | why | stable |
 | What freezes the v4 dependency direction, writer authority, complexity budgets, exceptions, and N-1 qualification? | [`../architecture/v4-architecture-constitution.md`](../architecture/v4-architecture-constitution.md) | why/verify | preview |
+| How will Delivery Warrant move from the v3 writer through shadow, v4 read, single-writer cutover, and legacy removal? | [`../architecture/v4-delivery-warrant-shadow-bootstrap-plan.md`](../architecture/v4-delivery-warrant-shadow-bootstrap-plan.md) | why/verify | preview |
+| What exact canonical bytes, roots, clocks, event, receipt, and typed-fault contracts do Rust and JavaScript share in v4? | [`v4-canonical-contracts.md`](v4-canonical-contracts.md) | use/verify | preview |
+| How is one per-platform v4 build stage identified, retained, observed, and reused without provider identity or a second writer? | [`v4-stage-capsule.md`](v4-stage-capsule.md) | use/verify | preview |
+| How does a late platform failure deterministically reuse qualified Stage Capsules and rebuild only invalid or missing dependencies? | [`v4-stage-capsule.md`](v4-stage-capsule.md#deterministic-resume-planning) | use/verify | preview |
+| How do Rust and JavaScript read the same retained Delivery Warrant traces and emit one semantic projection? | [`v4-canonical-contracts.md`](v4-canonical-contracts.md#shared-delivery-warrant-fixture-runner) | use/verify | preview |
+| How does an explicit caller try the qualified v4 read projection and roll back without moving v3 writer authority? | [`v4-delivery-warrant-read-candidate.md`](v4-delivery-warrant-read-candidate.md) | use/verify | preview |
 | How do protected dev branches and scheduled ready-PR merging work? | [`release-governance.md`](release-governance.md#protected-dev-branches) | use | stable |
 | How do slow required checks land reliably on a busy dev channel? | [`release-governance.md`](release-governance.md#protected-dev-branches) + [`cli.md`](cli.md#commands) | use | preview |
 | How does the durable fair Dev Delivery Warrant Queue prevent slow-candidate starvation?                                                       | [`dev-delivery-warrant.md`](dev-delivery-warrant.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | use/verify | preview |
@@ -119,13 +124,11 @@ replace them.
 | How do I report or safely apply branch and pull-request engineering hygiene? | [`engineering-housekeeper.md`](engineering-housekeeper.md) | use/verify | preview |
 | How does Buildchain decide patch, minor, and major release lines? | [`versioning.md`](versioning.md) | why | stable |
 | What exact branch/tag state machine runs on alpha, release, and major gate? | [`release-flow.md`](release-flow.md) | verify | stable |
-| How does a completed Alpha remain successful while the following development version is prepared? | [`next-development-transition.md`](next-development-transition.md), [`../architecture/decisions/0002-next-development-transition.md`](../architecture/decisions/0002-next-development-transition.md) | verify/use | preview |
 | What did Buildchain migrate or retire from old action repositories? | [`migration-inventory.md`](migration-inventory.md) | verify | stable |
 | What is the active action and workflow source of truth? | [`ownership.md`](ownership.md) | verify | stable |
 | How do I declare version files and custom lifecycle commands? | [`lifecycle-protocol.md`](lifecycle-protocol.md) | use | stable |
 | How does publish evidence, recovery, and finalization work? | [`publish-transaction.md`](publish-transaction.md) | verify | stable |
 | How are consumer-owned release-tail commands inventoried and replaced by declarative capabilities? | [`release-tail-contract.md`](release-tail-contract.md) | verify | draft |
-| How do I reproduce publication semantics locally without GitHub runner state? | [`publication-rehearsal.md`](publication-rehearsal.md), [`../architecture/decisions/0001-release-local-constructibility.md`](../architecture/decisions/0001-release-local-constructibility.md) | use/verify | preview |
 | How do I collect and verify module/product build facts from Git source, version files, and outputs? | [`build-facts.md`](build-facts.md) + [`cli.md`](cli.md) | use/verify | stable |
 | How do I publish or verify release passport artifacts? | [`release-passport.md`](release-passport.md) | use | stable |
 | How do I keylessly attest Linux release artifacts with GitHub and bind them to a Release Passport? | [`github-artifact-attestation.md`](github-artifact-attestation.md) | verify/use | preview |

package/docs/auditable-demo.md

@@ -47,7 +47,7 @@ literal argv steps. Steps in one demo share a disposable workspace; separate
 demos and the two rendition captures do not. Commands are never accepted as a
 shell string. An omitted or explicit `standard` duration class remains bounded
 to 60 seconds. A reviewed `execution.durationClass: long-form` declaration may
-raise the scenario and literal step ceilings to 360 seconds; it does not change
+raise the scenario and literal step ceilings to 180 seconds; it does not change
 the default. Both classes retain 4 MiB per step, a clean Home/XDG environment,
 no inherited credentials, and a network-disabled read-only container with
 bounded tmpfs.
@@ -155,7 +155,7 @@ scene.json
 
 It may additionally emit one declared `terminal-capture.json` using
 `kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds by
-default or 360 seconds only when its scene explicitly declares `long-form`,
+default or 180 seconds only when its scene explicitly declares `long-form`,
 fixed 80-200 by 24-80 terminal cells, 10,000 events, and 4 MiB of canonical
 base64 bytes. It must contain a qualified completion sentinel and an explicitly
 empty authority-grant list. Existing three-file adapters remain valid.

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -343,11 +343,6 @@ JIT SecureString under `/kungfu/burst/macos/`, then runs GitHub Actions Runner
 2.336.0 for exactly one job. The runner archive is pinned to the official
 macOS ARM64 SHA256. No GitHub, signing, notarization, publication, SSH, or
 static AWS credential is admitted to the instance.
-The provider provenance step explicitly disables artifact-signing request
-sealing for these qualification jobs, so consumer signing declarations cannot
-turn a runner-profile smoke or full qualification into a signing-authority
-dispatch. All other Buildchain lanes retain the default fail-closed signing
-declaration behavior.
 
 The instance uses the exact retained Amazon EC2 macOS AMI, IMDSv2, an encrypted
 delete-on-termination root volume, no inbound security-group rule, and the
@@ -357,21 +352,13 @@ job must exercise the full native lifecycle.
 
 AWS imposes a 24-hour minimum Dedicated Host allocation. The contract therefore
 keeps the one host for at least 24 hours even if all three jobs finish earlier.
-At the recorded USD 0.65 hourly rate, the minimum commitment is USD 15.60. A
-30-hour fail-closed ceiling is USD 19.50, below the dedicated
+At the recorded USD 0.6498 hourly rate, the minimum commitment rounds to USD
+15.60. A 30-hour fail-closed ceiling rounds to USD 19.49, below the dedicated
 USD 25 budget. A ten-minute reaper terminates an expired campaign instance and
 retries host release after the minimum allocation and Apple scrub constraints
 allow it. Budget notifications at 80% and 95% invoke the same card-scoped kill
 switch.
 
-The launch controller defaults to `us-east-1` and admits only `us-east-2` as a
-capacity fallback. The regions use mutually exclusive control-plane stacks and
-one shared USD 25 Budget covering Virginia `HostUsage:mac2` and the AWS catalog
-identity `USE2-HostUsage:mac2` for Ohio. A requested region, availability zone,
-stack, and Budget must agree before allocation, and the controller checks both
-regions against one global Host and instance ceiling; no other region is
-accepted.
-
 Qualification requires three trusted exact-source one-job JIT runs on the one
 host, including at least one full run, plus proof that:
 
@@ -385,47 +372,17 @@ host, including at least one full run, plus proof that:
 ### Phase 3 lifecycle controller
 
 `scripts/aws-macos-jit-controller.mjs` is the operator boundary for the paid
-campaign. It has five explicit mutation modes:
+campaign. It has three explicit mutation modes:
 
 - `launch-campaign` binds the exact repository source, AMI, availability zone,
-  tagged Dedicated Host, and reusable instance. Before paid allocation it
-  verifies the exact AWS account, disabled GitHub workflow, complete control
-  plane stack, AWS-dimension-filtered USD 25 Budget, 80% and 95% SNS
-  subscribers, and zero pre-existing Mac capacity. Because AWS does not expose
-  a DryRun parameter for `AllocateHosts`, it requires an allowed IAM policy
-  simulation for the exact tagged allocation before the real call, then a
-  successful `RunInstances` DryRun before launching the instance.
-- `rehydrate-instance` creates a replacement instance on the one already-paid,
-  empty campaign host after an interrupted or failed instance lifecycle. It
-  rechecks the exact account, disabled workflow, Budget, source, host identity
-  and allocation time, zero runner residue, zero active JIT instances, and no
-  other active Mac host in either admitted region. It then requires a
-  successful same-host `RunInstances` DryRun and never calls `AllocateHosts`.
+  tagged Dedicated Host, and reusable instance. It rejects pre-existing Mac
+  capacity and requires successful `AllocateHosts` and `RunInstances` DryRuns
+  before either real call.
 - `run-job` binds one queued exact-source GitHub job to the existing campaign
   host and instance. It writes the repository JIT configuration through a
   mode-0600 temporary file into a distinct SSM SecureString, sends only the
   credential-free bootstrap through SSM, and removes the parameter plus runner
   registration if command delivery fails.
-- `rebind-campaign` repairs the source of an allocated but unused campaign
-  without buying another host. It requires the workflow to remain manually
-  disabled, the replacement source to be a strict descendant on the same
-  campaign ref, and every prior matching run to contain zero jobs and zero
-  artifacts. It also requires no registered JIT runner, SSM parameter, or
-  bootstrap evidence and verifies the one exact host, instance, and encrypted
-  volume. The operation updates only those resources' source tags and the
-  existing GitHub ref, emits a zero-allocation receipt, and compensates back to
-  the prior source if the ref update or readback fails. It never calls
-  `AllocateHosts`, `RunInstances`, or workflow dispatch.
-- `rebind-campaign-after-failure` advances that same host and instance only
-  after the operator confirms the complete prior run-id inventory. Every named
-  run must be terminal with conclusion `failure`, all of its jobs must be
-  complete, and both GitHub artifacts and S3 bootstrap evidence must still be
-  present. The replacement source must remain a strict descendant on the same
-  ref, the workflow must be disabled, the next-source evidence prefix must be
-  empty, and runner plus SSM residue must be zero. The old evidence is retained
-  and included in the rebind receipt; the operation changes only the existing
-  source ref and resource tags, with the same compensated rollback and zero
-  allocation boundary as an unused-campaign rebind.
 - `close-campaign` refuses execution before the provider's 24-hour minimum,
   verifies the encrypted delete-on-termination root volume, removes scoped JIT
   residue, terminates the exact instance, and requires a `ReleaseHosts` DryRun
@@ -435,17 +392,8 @@ campaign. It has five explicit mutation modes:
 
 Every execute mode requires the exact source SHA and campaign id to be repeated
 through `--confirm-source-sha` and `--confirm-campaign-id`. `run-job` also
-requires `--confirm-run-id`; `launch-campaign` additionally requires the
-expected workload account through `--account-id`. `rebind-campaign`
-additionally repeats the prior source, host, and instance identities and
-requires `--confirm-zero-allocation`. `rehydrate-instance` additionally repeats
-the existing host and replaced instance identities and requires
-`--confirm-no-host-allocation`. Omitting `--execute` emits a deterministic plan
+requires `--confirm-run-id`. Omitting `--execute` emits a deterministic plan
 without changing AWS or GitHub state.
-`rebind-campaign-after-failure` additionally requires matching
-`--terminal-failure-run-ids-json` and
-`--confirm-terminal-failure-run-ids-json` arrays so an unobserved or newly
-created run fails closed before any tag or ref mutation.
 
 ## Provider lifecycle