@kungfu-tech/buildchain 3.0.9-alpha.9 → 4.0.0-alpha.0

package/scripts/buildchain-cli-help.mjs

@@ -24,6 +24,7 @@ export const BUILDCHAIN_USAGE = `Usage:
                       [--require-lifecycle-stages <comma-list>]
   buildchain lifecycle run <stage> [--cwd <dir>] [--required]
                              [--artifact-name <name>] [--artifact-path <path>]...
+                             [--platform-id <id>] [--platform-name <name>]
                              [--manifest-path <path>] [--summary-path <path>]
                              [--process-summary <json>]
   buildchain npm dry-run [--cwd <dir>] [--expected-tag <tag>] [--registry <url>]
@@ -43,9 +44,6 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain release-tail init --declaration <json-or-path> [--state <path>]
   buildchain release-tail <status|verify> [--state <path>] [--output <path>]
   buildchain release-tail compat --hooks-json <json-or-path> [--output <path>]
-  buildchain release-tail rehearse --capsule <path> --capsule-root <absolute-path>
-                                    --mode <simulate|replay> --state <path>
-                                    --evidence <path> [--environment-json <json-or-path>]
   buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...
   buildchain release <inspect|recover|finalize|abort> ...
   buildchain transaction inspect ...
@@ -129,18 +127,11 @@ export const BUILDCHAIN_USAGE = `Usage:
                              [--from-config | --workflow <required-workflow.yml>...] [--cwd <dir>]
                              [--check-response-timeout-minutes <n>]
                              [--max-entries-to-build <n>] [--apply]
-  buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|cancel-queued|observe>
+  buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|observe>
                              --repository <owner/repo> --branch <dev/vN/vN.M>
                              [--execute] [--output <file>] [--json]
-  buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe>
-                             --repository <owner/repo> --branch <dev/vN/vN.M>
-                             [--execute] [--output <file>] [--json]
-  buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration>
+  buildchain dev proof <source|verify-source|classify|replay|integration|verify-integration>
                              [--output <file>] [--json]
-  buildchain dev two-phase --repository <owner/repo> --branch <dev/vN/vN.M>
-                             --pull-request <n> --expected-head <sha>
-                             --warrant-result <file> [--native-proof <file>]
-                             [--native-command <command>]
   buildchain log <info|warn|error> --event <name> [--phase <phase>]
                  [--component <name>] [--source <name>] [--attribute key=value]...
                  [--path <jsonl>] [--json]
@@ -251,15 +242,15 @@ Examples:
   buildchain validate --require-version-state --require-lifecycle-stages build,verify
   buildchain lifecycle run build --artifact-path dist --artifact-name "{repo}-{version}-{platform}"
   buildchain npm dry-run --json
-  buildchain release --dry-run --target-ref alpha/v3/v3.0
-  buildchain release line open --major 3 --minor 1 --source-ref release/v3/v3.0 --json
+  buildchain release --dry-run --target-ref alpha/v4/v4.0
+  buildchain release line open --major 4 --minor 1 --source-ref release/v4/v4.0 --json
   buildchain span --event native.build -- cmake --build build
-  buildchain collect github-release --tag v3.0.0 --assets-dir dist --output-dir .buildchain/release-passport
+  buildchain collect github-release --tag v4.0.0 --assets-dir dist --output-dir .buildchain/release-passport
   buildchain create publication-admission --input-json admission-input.json --output admission.json
   buildchain create runner-provenance --input-json runner-input.json --output runner.json
   buildchain verify release-passport .buildchain/release-passport/buildchain.release.json
   buildchain verify publication-admission admission.json --registry-json publication-authority-registry.json --runner-json runner.json --control-plane-audit-json control-plane.json --expected-json expected.json --json
-  buildchain audit publication-control-plane --repository kungfu-systems/buildchain --branch release/v3/v3.0
+  buildchain audit publication-control-plane --repository kungfu-systems/buildchain --branch release/v4/v4.0
   buildchain verify artifact ./dist/buildchain-x86_64-unknown-linux-gnu.tar.gz --passport .buildchain/release-passport/buildchain.release.json
   buildchain verify artifact-envelope .buildchain/kfx/artifact-verification-envelope.json --json
   buildchain project kfx-admission .buildchain/kfx/artifact-verification-envelope.json --json

package/scripts/buildchain-contract-lock.mjs

@@ -116,9 +116,6 @@ export function checkBuildchainContractLock({
     evaluation.channelBinding ? `- Bound channel: \`${evaluation.channelBinding.channel || "(unknown)"}\`` : "",
     `- Contract digest: \`${current.contractDigest}\``,
     `- Compatibility digest: \`${current.compatibilityDigest}\``,
-    `- Compatibility proof registry: \`${current.compatibilityProofRegistryRoot || "(legacy)"}\``,
-    `- Verification receipt: \`${evaluation.receiptRoot || "(not-required)"}\``,
-    evaluation.usedProofRoots?.length ? `- Used compatibility proofs: ${evaluation.usedProofRoots.map((root) => `\`${root}\``).join(", ")}` : "",
     evaluation.reasons?.length ? `- Reasons: ${evaluation.reasons.join("; ")}` : "",
     shouldIssue ? `- Drift issue body: \`${issueBodyPath}\`` : "",
   ].filter(Boolean).join("\n"));
@@ -130,9 +127,6 @@ export function checkBuildchainContractLock({
     "contract-lock-issue-body-file": shouldIssue ? issueBodyPath : "",
     "contract-digest": current.contractDigest,
     "contract-compatibility-digest": current.compatibilityDigest,
-    "contract-compatibility-proof-registry-root": current.compatibilityProofRegistryRoot || "",
-    "contract-compatibility-verification-receipt-root": evaluation.receiptRoot || "",
-    "contract-compatibility-proof-roots": (evaluation.usedProofRoots || []).join(","),
     "accepted-contract-digest": evaluation.accepted?.contractDigest || "",
     "accepted-buildchain-sha": evaluation.accepted?.resolvedSha || "",
     "current-buildchain-sha": runtimeSha || "",

package/scripts/check-action-bundles.mjs

@@ -1,7 +1,7 @@
 import { readdirSync, readFileSync } from "node:fs";
-import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { spawnSyncCommand } from "../packages/core/spawn-command.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const actionsRoot = path.join(root, "actions");
@@ -21,9 +21,8 @@ const bundlePaths = readdirSync(actionsRoot, { withFileTypes: true })
 const before = new Map(
   bundlePaths.map((bundlePath) => [bundlePath, readFileSync(bundlePath)]),
 );
-const pnpm = process.platform === "win32" ? "pnpm.cmd" : "pnpm";
-const build = spawnSync(
-  pnpm,
+const build = spawnSyncCommand(
+  "pnpm",
   ["-r", "--filter", "./actions/**", "build"],
   { cwd: root, stdio: "inherit" },
 );

package/scripts/check-internal-architecture.mjs

@@ -5,7 +5,8 @@ import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 
-const implementationExtensions = new Set([".js", ".mjs", ".cjs", ".sh"]);
+const implementationExtensions = new Set([".js", ".mjs", ".cjs", ".rs", ".sh"]);
+const repositorySourceExtensions = new Set([".js", ".mjs", ".cjs", ".rs"]);
 const importPattern =
   /(?:\bimport\s*(?:\([^)]*?\)|[^"'\n]*?\s+from\s+)?|\bexport\s+[^"'\n]*?\s+from\s+)(["'])([^"'\n]+)\1/g;
 
@@ -116,7 +117,7 @@ function assertIndexShape(index) {
   }
 }
 
-function repositoryJavaScriptFiles(root) {
+function repositorySourceFiles(root) {
   return execFileSync(
     "git",
     ["ls-files", "-z", "--cached", "--others", "--exclude-standard"],
@@ -128,10 +129,10 @@ function repositoryJavaScriptFiles(root) {
     .split("\0")
     .filter(Boolean)
     .filter((file) => fs.existsSync(path.resolve(root, file)))
-    .filter((file) => [".js", ".mjs", ".cjs"].includes(path.extname(file)))
+    .filter((file) => repositorySourceExtensions.has(path.extname(file)))
+    .filter((file) => !file.startsWith(".tmp-"))
     .filter((file) => !file.startsWith("tests/"))
     .filter((file) => !/(?:^|\/)tests?\//u.test(file))
-    .filter((file) => !file.startsWith(".buildchain/"))
     .filter((file) => !/^actions\/[^/]+\/dist\//u.test(file))
     .sort();
 }
@@ -307,7 +308,7 @@ function checkInternalArchitecture({
 } = {}) {
   assertIndexShape(index);
   const issues = [];
-  const repositorySources = repositoryJavaScriptFiles(root);
+  const repositorySources = repositorySourceFiles(root);
   const ownership = evaluateSourceOwnership(index, repositorySources);
   const capabilities = evaluateCapabilities(root, index);
   issues.push(...ownership.issues, ...capabilities.issues);
@@ -361,5 +362,5 @@ export {
   checkInternalArchitecture,
   dependencyCycles,
   relativeImports,
-  repositoryJavaScriptFiles,
+  repositorySourceFiles,
 };

package/scripts/check-inventory.mjs

@@ -8,6 +8,7 @@ import { evaluateBuildchainContractLock } from "../packages/core/buildchain-cont
 import {
   canAdmitSelfDogfoodLockEvaluation,
   contractForSelfDogfoodEvaluation,
+  hasQualifiedSelfDogfoodBootstrapAuthority,
   resolveSelfDogfoodMajor,
 } from "../packages/core/self-dogfood-version.js";
 import { generateChannelBuildWorkflow } from "./generate-channel-build-workflow.mjs";
@@ -53,10 +54,6 @@ const requiredPaths = [
   "packages/core/homebrew.js",
   "packages/core/artifact-verification-envelope.js",
   "packages/core/anchored-version-material.js",
-  "packages/core/next-development-transition.js",
-  "packages/core/next-development-controller.js",
-  "packages/core/next-development-candidate-reservation.js",
-  "packages/core/next-development-projection.js",
   "packages/core/build-facts.js",
   "packages/core/publication-package.js",
   "packages/core/publication-reproducibility.js",
@@ -79,8 +76,6 @@ const requiredPaths = [
   "docs/auditable-demo.md",
   "contracts/auditable-demo-scenario-v1.schema.json",
   "contracts/release-candidate-recovery-v1.schema.json",
-  "contracts/next-development-request-v1.schema.json",
-  "contracts/next-development-transition-v1.schema.json",
   "contracts/auditable-demo-media-profiles-v1.json",
   "contracts/evidence/auditable-demo-web-delivery-v1.json",
   "contracts/evidence/auditable-demo-responsive-web-delivery-v1.json",
@@ -92,15 +87,10 @@ const requiredPaths = [
   "contracts/fixtures/auditable-demo-responsive-web-delivery-v1/public-projection.json",
   "contracts/fixtures/auditable-demo-responsive-web-delivery-v1/scene.json",
   "docs/release-propagation.md",
-  "docs/next-development-transition.md",
   "docs/site-bundle-contract.md",
   "docs/toolkit-observability.md",
   "docs/versioning.md",
   "scripts/release-line-dry-run.mjs",
-  "scripts/next-development-transition.mjs",
-  "scripts/next-development-self-dogfood.mjs",
-  "scripts/next-development-self-dogfood-harness.mjs",
-  "scripts/generate-next-development-guidance.mjs",
   "scripts/reconcile-release-governance.mjs",
   "scripts/buildchain-channel-router.mjs",
   "scripts/generate-channel-build-workflow.mjs",
@@ -206,10 +196,19 @@ const selfDogfoodAlphaLock = JSON.parse(
 const currentBuildchainContract = JSON.parse(
   fs.readFileSync(path.join(root, "dist/site/buildchain-contract.json"), "utf8"),
 );
+const selfDogfoodBootstrapAuthority = JSON.parse(
+  fs.readFileSync(path.join(root, "architecture/v4-bootstrap-authority.json"), "utf8"),
+);
 const selfDogfoodMajorResolution = resolveSelfDogfoodMajor({
   packageVersion: rootPackage.version,
   alphaRef: selfDogfoodAlphaLock.buildchain?.ref,
-  majorBootstrap: process.env.BUILDCHAIN_MAJOR_VERSION_BOOTSTRAP === "true",
+  majorBootstrap:
+    process.env.BUILDCHAIN_MAJOR_VERSION_BOOTSTRAP === "true" ||
+    hasQualifiedSelfDogfoodBootstrapAuthority({
+      packageVersion: rootPackage.version,
+      alphaRef: selfDogfoodAlphaLock.buildchain?.ref,
+      authority: selfDogfoodBootstrapAuthority,
+    }),
 });
 const selfDogfoodMajor = String(selfDogfoodMajorResolution.workflowMajor);
 if (!/^[0-9a-f]{40}$/.test(selfDogfoodAlphaLock.buildchain?.resolvedSha || "")) {
@@ -294,7 +293,7 @@ for (const requiredSnippet of [
   "authorize-promotion-runtime-override.cjs",
   "BUILDCHAIN_ROUTER_REPOSITORY: ${{ inputs.buildchain-repository }}",
   "BUILDCHAIN_RESUME_RUNTIME_SHA: ${{ inputs.resume-buildchain-runtime-sha }}",
-  "if [[ \"${ref}\" =~ ^[0-9A-Fa-f]{40}$ ]]; then", "sha=\"${ref,,}\"", "git ls-remote",
+  "git ls-remote",
   "Recovery router ref does not match resume-buildchain-runtime-sha",
 ]) {
   if (!channelPromotionWorkflow.includes(requiredSnippet)) {
@@ -315,7 +314,9 @@ if (!promotionOverrideAuthorization.includes("promotion runtime override is only
 }
 for (const requiredSnippet of [
   "buildchain-channel:",
-  "uses: kungfu-systems/buildchain/.github/workflows/.build.yml@v3-alpha", "uses: kungfu-systems/buildchain/.github/workflows/.build.yml@v3\n",
+  "uses: ./.github/workflows/.build.yml",
+  "needs.resolve-channel.outputs.runtime-override != 'true' && needs.resolve-channel.outputs.channel == 'alpha'",
+  "needs.resolve-channel.outputs.runtime-override != 'true' && needs.resolve-channel.outputs.channel == 'stable'",
   "needs.resolve-channel.outputs.buildchain-ref",
   "needs.resolve-channel.outputs.contract-lock-path",
 ]) {
@@ -323,6 +324,12 @@ for (const requiredSnippet of [
     throw new Error(`channel build workflow missing routing contract: ${requiredSnippet}`);
   }
 }
+if ((channelBuildWorkflow.match(/uses: \.\/\.github\/workflows\/\.build\.yml/g) || []).length !== 3) {
+  throw new Error("channel build workflow must bind override, alpha, and stable to the exact caller workflow shell");
+}
+if (channelBuildWorkflow.includes("uses: kungfu-systems/buildchain/.github/workflows/.build.yml@")) {
+  throw new Error("channel build workflow must not statically fetch another channel shell before its ref exists");
+}
 for (const requiredSnippet of [
   "group: buildchain-release-promotion-${{ github.repository }}",
   "cancel-in-progress: false",
@@ -904,7 +911,7 @@ for (const requiredSnippet of [
 for (const [docName, docSource] of Object.entries({ "docs/cli.md": cliDoc, "docs/install.md": installDoc })) {
   for (const requiredSnippet of [
     "minimumReleaseAgeExclude",
-    "@kungfu-tech/buildchain@3.0.0",
+    "@kungfu-tech/buildchain@4.0.0",
     "package/version-specific",
   ]) {
     if (!docSource.includes(requiredSnippet)) {
@@ -1003,7 +1010,7 @@ for (const forbiddenSnippet of [
 for (const requiredSnippet of [
   "id-token: write",
   "actions: write",
-  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@cc6c32845ab5779009aeb48cc34efe65e229fe30\n",
+  "uses: ./.github/workflows/.release-candidate-promote.yml",
   "github.event.workflow_run.event == 'push'",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
@@ -1049,11 +1056,9 @@ for (const requiredSnippet of [
   "github-release-notes: ${{ inputs.github-release-notes }}",
   "publication-commit-command:",
   "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY:",
-  "BUILDCHAIN_PUBLICATION_COMMIT_CANDIDATE_SOURCE_SHA: ${{ steps.rc.outputs.release-candidate-source-sha || needs.preflight.outputs.requested-sha }}",
   "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY:",
   "Commit consumer publication authority last",
   "node .buildchain/runtime/scripts/publication-commit-evidence.mjs",
-  '--candidate-source-sha "${BUILDCHAIN_PUBLICATION_COMMIT_CANDIDATE_SOURCE_SHA}"',
   "require-publish-source-lock: \"true\"",
   "publish-source-ref: ${{ steps.publish-gate.outputs.ref }}",
   "publish-source-sha: ${{ steps.publish-gate.outputs.sha }}",
@@ -1153,8 +1158,8 @@ for (const requiredSnippet of [
   }
 }
 for (const forbiddenSnippet of [
-  "uses: ./.github/workflows/.release-candidate-promote.yml",
-  "uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@",
+  "run: node scripts/release-candidate-resolver.mjs",
+  "uses: ./actions/promote-buildchain-ref",
 ]) {
   if (buildchainRefPromotionWorkflow.includes(forbiddenSnippet)) {
     throw new Error(`buildchain ref promotion workflow must use the declarative wrapper, found manual snippet: ${forbiddenSnippet}`);
@@ -1256,12 +1261,12 @@ if (inventory.release !== "buildchain-v2") {
   throw new Error("inventory release must be buildchain-v2");
 }
 
-if (inventory.stableRefs?.actions !== "kungfu-systems/buildchain/actions/<name>@v3") {
-  throw new Error("inventory stable action ref must point at @v3");
+if (inventory.stableRefs?.actions !== "kungfu-systems/buildchain/actions/<name>@v4") {
+  throw new Error("inventory stable action ref must point at @v4");
 }
 
-if (inventory.stableRefs?.workflows !== "kungfu-systems/buildchain/.github/workflows/<workflow>.yml@v3") {
-  throw new Error("inventory stable workflow ref must point at @v3");
+if (inventory.stableRefs?.workflows !== "kungfu-systems/buildchain/.github/workflows/<workflow>.yml@v4") {
+  throw new Error("inventory stable workflow ref must point at @v4");
 }
 if (inventory.safety?.releasePassport?.line !== "v2.2") {
   throw new Error("release passport inventory must be registered as a v2.2 surface");
@@ -1297,7 +1302,7 @@ if (!badgeEndpointRegistry.badges?.some((entry) => entry.id === "buildchain-rele
   throw new Error("badge endpoint registry must include Buildchain Release Passport badge");
 }
 
-for (const siteFile of ["buildchain-site.json", "site-manifest.json", "badge-endpoint-registry.json", "publication-registry.json", "page-registry.json", "capability-registry.json", "cli-registry.json", "manual-registry.json", "node-api-registry.json", "workflow-registry.json", "controller-registry.json", "public-surface-audit.json", "release-model.json", "release-passport-check-manifest.json", "schemas/release-passport-v1.schema.json", "schemas/publication-rehearsal-capsule-v1.schema.json", "schemas/release-tail-capabilities-v1.schema.json", "schemas/release-tail-provider-bindings-v1.schema.json", "buildchain-contract.json"]) {
+for (const siteFile of ["buildchain-site.json", "site-manifest.json", "badge-endpoint-registry.json", "publication-registry.json", "page-registry.json", "capability-registry.json", "cli-registry.json", "manual-registry.json", "node-api-registry.json", "workflow-registry.json", "controller-registry.json", "public-surface-audit.json", "release-model.json", "release-passport-check-manifest.json", "schemas/release-passport-v1.schema.json", "buildchain-contract.json"]) {
   if (!fs.existsSync(path.join(root, "dist", "site", siteFile))) {
     throw new Error(`site bundle missing ${siteFile}`);
   }

package/scripts/check-v4-public-dogfood-contract.mjs

@@ -0,0 +1,270 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const DEFAULT_ROOT = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "..",
+);
+const CALLER_PATH = ".github/workflows/v4-public-consumer-dogfood.yml";
+const REUSABLE_PATH = ".github/workflows/v4-stage-capsule-canary.yml";
+export const V4_PUBLIC_DOGFOOD_TRAIN_REF =
+  "train/v4/v4.0/public-consumer-self-dogfood";
+const EXACT_SHA = /^[0-9a-f]{40}$/u;
+const PRIVATE_CONSUMER = ["buildchain", "self", "dogfood"].join("-");
+const PRIVATE_SHADOW = ["kungfu", "shadow"].join("-");
+
+export function expectedV4PublicDogfoodWorkflow(validationRef) {
+  return `name: V4 Public Consumer Dogfood
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  dogfood:
+    uses: kungfu-systems/buildchain/.github/workflows/v4-stage-capsule-canary.yml@${validationRef}
+    with:
+      consumer: buildchain
+      node-version: "24"
+      go-version: "1.25.x"
+      install-artifact-path: node_modules/.modules.yaml
+      build-artifact-path: actions/run-lifecycle/dist/index.js
+      verify-artifact-path: dist/site
+`;
+}
+
+function fail(message) {
+  throw new Error(`v4-public-dogfood-contract: ${message}`);
+}
+
+function read(root, relative) {
+  const file = path.join(root, relative);
+  if (!fs.existsSync(file)) fail(`${relative} is missing`);
+  return fs.readFileSync(file, "utf8");
+}
+
+function exactJson(root, relative) {
+  try {
+    return JSON.parse(read(root, relative));
+  } catch (error) {
+    fail(`${relative} is not valid JSON: ${error.message}`);
+  }
+}
+
+function assertNoPrivateMarkers(relative, text) {
+  for (const marker of [
+    PRIVATE_CONSUMER,
+    PRIVATE_SHADOW,
+    "selfDogfood",
+    "kungfuShadow",
+  ])
+    if (text.includes(marker))
+      fail(`${relative} retains private marker ${marker}`);
+}
+
+function assertReusableWorkflow(root) {
+  const reusable = read(root, REUSABLE_PATH);
+  for (const binding of [
+    "workflow_call:",
+    "BUILDCHAIN_WORKFLOW_SHA: ${{ job.workflow_sha }}",
+    "CONSUMER_SOURCE_SHA: ${{ github.sha }}",
+    "- uses: actions/setup-go@v6.5.0",
+    "if: inputs.go-version != ''",
+  ])
+    if (!reusable.includes(binding))
+      fail(`${REUSABLE_PATH} is missing exact binding ${binding}`);
+  for (const stage of ["install", "build", "verify"])
+    if (!reusable.includes(`lifecycle run ${stage}`))
+      fail(`${REUSABLE_PATH} does not execute lifecycle.${stage}`);
+  for (const forbidden of [
+    "lifecycle run publish",
+    "self-hosted",
+    "secrets: inherit",
+  ])
+    if (reusable.toLowerCase().includes(forbidden))
+      fail(`${REUSABLE_PATH} contains forbidden authority ${forbidden}`);
+  if (/\baws\b/iu.test(reusable))
+    fail(`${REUSABLE_PATH} contains forbidden AWS authority`);
+}
+
+function assertWorkflowInventory(root) {
+  const workflowRoot = path.join(root, ".github/workflows");
+  for (const entry of fs.readdirSync(workflowRoot, { withFileTypes: true })) {
+    if (!entry.isFile() || !/\.ya?ml$/u.test(entry.name)) continue;
+    const relative = `.github/workflows/${entry.name}`;
+    const text = read(root, relative);
+    if (
+      relative !== REUSABLE_PATH &&
+      text.includes("scripts/v4-stage-capsule-qualification.mjs")
+    )
+      fail(`${relative} invokes the private qualification script directly`);
+    if (
+      relative !== CALLER_PATH &&
+      text.includes(".github/workflows/v4-stage-capsule-canary.yml@")
+    )
+      fail(`${relative} creates a second v4 dogfood caller`);
+    if (relative !== REUSABLE_PATH && relative !== CALLER_PATH)
+      assertNoPrivateMarkers(relative, text);
+  }
+}
+
+function assertProtectedVerify(root) {
+  const verify = read(root, ".github/workflows/verify.yml");
+  for (const required of [
+    "needs: stage-capsule-checkpoints",
+    "name: Enforce public consumer-only v4 dogfood",
+    "run: node scripts/check-v4-public-dogfood-contract.mjs",
+  ])
+    if (!verify.includes(required))
+      fail(`Verify is missing protected gate ${required}`);
+  for (const forbidden of [
+    "stage-capsule-qualification:",
+    "stage-capsule-qualification-reconciliation:",
+    "scripts/v4-stage-capsule-qualification.mjs",
+  ])
+    if (verify.includes(forbidden))
+      fail(`Verify retains private dogfood path ${forbidden}`);
+}
+
+function assertArchitecture(root) {
+  const architecture = exactJson(
+    root,
+    "architecture/v4-stage-capsule-qualification.json",
+  );
+  const dogfood = architecture.publicConsumerDogfood;
+  const validationRef = dogfood?.validationRef;
+  if (
+    validationRef !== V4_PUBLIC_DOGFOOD_TRAIN_REF &&
+    !EXACT_SHA.test(String(validationRef))
+  )
+    fail(
+      "architecture validationRef must be the exact public train or a protected commit SHA",
+    );
+  const caller = read(root, CALLER_PATH);
+  if (caller !== expectedV4PublicDogfoodWorkflow(validationRef))
+    fail(`${CALLER_PATH} must remain the exact thin public consumer caller`);
+  if (JSON.stringify(architecture.campaign?.consumers) !== '["buildchain"]')
+    fail(
+      "architecture must qualify only the public Buildchain consumer identity",
+    );
+  if (
+    !dogfood ||
+    dogfood.callerWorkflow !== CALLER_PATH ||
+    dogfood.reusableWorkflow !==
+      "kungfu-systems/buildchain/.github/workflows/v4-stage-capsule-canary.yml" ||
+    dogfood.runtimeBinding !== "job.workflow_sha" ||
+    dogfood.consumerSourceBinding !== "github.sha" ||
+    JSON.stringify(dogfood.executableStages) !==
+      '["install","build","verify"]' ||
+    JSON.stringify(dogfood.excludedStages) !==
+      '{"version-state":"source-mutation","publish":"provider-mutation"}' ||
+    dogfood.consumerOrchestrationCopied !== false ||
+    dogfood.relativeOrSelfInvocationAllowed !== false ||
+    dogfood.directQualificationInvocationAllowed !== false ||
+    dogfood.candidateBranchOverrideAllowed !== false ||
+    dogfood.recursionRecovery !== "public-train-ref-only"
+  )
+    fail(
+      "architecture publicConsumerDogfood contract is incomplete or widened",
+    );
+  for (const key of ["selfDogfood", "kungfuShadow", "externalConsumerCanary"])
+    if (Object.hasOwn(architecture, key))
+      fail(`architecture retains duplicate ${key}`);
+  if (
+    architecture.mode !== "shadow-only" ||
+    architecture.productionAuthority !== "v3" ||
+    [
+      "providerEffects",
+      "productionWrites",
+      "productionReuse",
+      "releaseEffects",
+      "credentials",
+      "aws",
+      "selfHostedRunners",
+      "v3BehaviorChange",
+    ].some((key) => architecture.authority?.[key] !== false)
+  )
+    fail("architecture authority ceiling changed");
+  return validationRef;
+}
+
+function assertConsumerLifecycle(root) {
+  const lifecycle = read(root, ".buildchain/buildchain.toml");
+  for (const declaration of [
+    '[lifecycle.install]\ncommand = "corepack enable pnpm && corepack pnpm@11.7.0 install --frozen-lockfile"',
+    '[lifecycle.build]\ncommand = "corepack pnpm@11.7.0 run build && corepack pnpm@11.7.0 run generate:site"',
+    "[lifecycle.verify]\ncommands = [",
+  ])
+    if (!lifecycle.includes(declaration))
+      fail(
+        `tracked consumer lifecycle is missing ${declaration.split("\n")[0]}`,
+      );
+  const attributes = read(root, ".gitattributes");
+  if (!attributes.split("\n").includes("* text=auto eol=lf"))
+    fail("consumer checkout is missing the cross-platform LF contract");
+}
+
+function assertPolicySources(root) {
+  for (const relative of [
+    "packages/core/v4-stage-capsule-qualification.js",
+    "packages/core/v4-stage-capsule-qualification-campaign.js",
+    "scripts/v4-stage-capsule-qualification.mjs",
+    "architecture/v4-stage-capsule-qualification.json",
+    "docs/v4-stage-capsule.md",
+  ])
+    assertNoPrivateMarkers(relative, read(root, relative));
+
+  const agents = read(root, "AGENTS.md");
+  for (const invariant of [
+    "same public reusable-workflow contract as every other consumer",
+    "No agent may add or restore a relative/self reusable-workflow call",
+    "never solve recursion with an internal exception",
+    "scripts/check-v4-public-dogfood-contract.mjs",
+  ])
+    if (!agents.includes(invariant))
+      fail(`AGENTS.md is missing invariant: ${invariant}`);
+
+  const packageJson = exactJson(root, "package.json");
+  if (
+    !String(packageJson.scripts?.check || "").includes(
+      "node scripts/check-v4-public-dogfood-contract.mjs",
+    )
+  )
+    fail("pnpm run check does not include the public dogfood gate");
+}
+
+export function checkV4PublicDogfoodContract(root = DEFAULT_ROOT) {
+  assertReusableWorkflow(root);
+  assertWorkflowInventory(root);
+  assertProtectedVerify(root);
+  const validationRef = assertArchitecture(root);
+  assertConsumerLifecycle(root);
+  assertPolicySources(root);
+
+  return {
+    schema: "buildchain-v4-public-dogfood-contract-check/v1",
+    ok: true,
+    caller: CALLER_PATH,
+    reusable: REUSABLE_PATH,
+    validationRef,
+    productionAuthority: "v3",
+  };
+}
+
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+  try {
+    process.stdout.write(`${JSON.stringify(checkV4PublicDogfoodContract())}\n`);
+  } catch (error) {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  }
+}

package/scripts/create-release-bundle.mjs

@@ -112,10 +112,14 @@ export function createReleaseEvidenceBundle({
 
   fs.mkdirSync(resolvedOutputDir, { recursive: true });
   const archivePath = path.join(resolvedOutputDir, `${BUNDLE_BASE}.tar.gz`);
-  const tar = spawnSync("tar", ["-czf", archivePath, "-C", tempDir, BUNDLE_BASE], {
-    cwd,
-    stdio: "inherit",
-  });
+  const tar = spawnSync(
+    "tar",
+    ["-czf", path.basename(archivePath), "-C", tempDir, BUNDLE_BASE],
+    {
+      cwd: resolvedOutputDir,
+      stdio: "inherit",
+    },
+  );
   if (tar.error) {
     throw tar.error;
   }

package/scripts/dev-alpha-candidate-patrol.mjs

@@ -20,7 +20,6 @@ import {
   candidateFromDecision,
   selectLatestQualifiedSource,
 } from "../packages/core/dev-alpha-candidate-selection.js";
-import { readGitHubNextDevelopmentVersionReservation } from "../packages/core/next-development-candidate-reservation.js";
 
 export { reconcileActiveReleaseTrain, selectLatestQualifiedSource };
 
@@ -618,7 +617,6 @@ export async function runDevAlphaCandidatePatrol(
     comparison,
     workflowEvidence,
     skippedNewerCommitCount,
-    versionReservation,
     qualificationError,
   } = await resolvePatrolSourceInputs({
     client,
@@ -648,7 +646,6 @@ export async function runDevAlphaCandidatePatrol(
           observedSourceHeadSha,
           skippedNewerCommitCount,
           ...(targetBaseline ? { targetBaseline } : {}),
-          ...(versionReservation ? { versionReservation } : {}),
         },
         workflowEvidence,
         requiredWorkflowPaths,
@@ -995,20 +992,6 @@ export function createGitHubChannelCandidateClient({
         targetBranch,
         parseCandidate: managedCandidateFromPullRequest,
       }),
-    async readNextDevelopmentVersionReservation({
-      reservationSha,
-      candidateSha,
-      targetVersion,
-    }) {
-      return readGitHubNextDevelopmentVersionReservation({
-        api,
-        owner,
-        repo,
-        reservationSha,
-        candidateSha,
-        targetVersion,
-      });
-    },
     async listCompletedWorkflowRuns(workflowPathValue, sourceBranch) {
       const runs = [];
       for (let page = 1; page <= 10; page += 1) {
@@ -1032,11 +1015,7 @@ export function createGitHubChannelCandidateClient({
         for (const commit of rows) {
           const commitSha = text(commit.sha);
           if (commitSha === targetSha) return commits;
-          commits.push({
-            sha: commitSha,
-            message: text(commit.commit?.message),
-            parents: (commit.parents || []).map((parent) => text(parent.sha)),
-          });
+          commits.push(commitSha);
         }
         if (rows.length < 100) return commits;
       }