@kungfu-tech/buildchain 4.0.1-alpha.2 → 4.0.1-alpha.21

package/architecture/v3-core-mechanism-inventory.json

@@ -69,6 +69,11 @@
         "root": "packages/core",
         "pattern": "^release-activation-transaction\\.js$"
       },
+      {
+        "mechanismId": "next-development-controller",
+        "root": "packages/core",
+        "pattern": "^next-development-(?:transition|controller|candidate-reservation)\\.js$"
+      },
       {
         "mechanismId": "publication-authority",
         "root": "packages/core",
@@ -130,6 +135,90 @@
     "orphanPolicy": "Every state-bearing mechanism must own source, tests, public surfaces, durable-store disposition, recovery, and v4 migration disposition; missing or ambiguous ownership fails validation."
   },
   "mechanisms": [
+    {
+      "id": "next-development-controller",
+      "owner": "Buildchain protected development version plane",
+      "writers": [
+        "completed Alpha terminal-success schedulers",
+        "packages/core/next-development-controller.js"
+      ],
+      "schemas": [
+        "kungfu-buildchain-next-development-transition/v1",
+        "kungfu-buildchain-next-development-controller/v1"
+      ],
+      "stores": [
+        "atomic child store keyed by repository and completed-Alpha root",
+        "compare-and-swap rooted controller checkpoints"
+      ],
+      "states": [
+        "planned",
+        "waiting-anchor",
+        "materialized",
+        "pr-pending",
+        "merged",
+        "verified"
+      ],
+      "events": [
+        "schedule",
+        "bind-reviewed-anchor",
+        "materialize-current-dev",
+        "open-protected-version-pr",
+        "record-merge",
+        "verify-protected-dev-readback"
+      ],
+      "transitions": [
+        "one completed Alpha creates or reuses one deterministic durable child",
+        "stale Dev material is superseded before protected delivery",
+        "merged reaches verified only after exact source and derived root readback"
+      ],
+      "recovery": [
+        "fresh runners load the durable child and resume the last rooted checkpoint",
+        "idempotent materialization operation keys reuse effects after lost responses"
+      ],
+      "effects": [
+        "declared source and derived version material",
+        "protected Dev version pull request"
+      ],
+      "retry": [
+        "Dev movement supersedes only the stale materialization attempt",
+        "readback mismatch remains merged and retries observation without rebuilding"
+      ],
+      "invalidation": [
+        "completed Alpha identity drift",
+        "undeclared changed path",
+        "durable compare-and-swap conflict",
+        "protected Dev version or root disagreement"
+      ],
+      "providerReadback": [
+        "latest protected Dev SHA",
+        "protected version PR status",
+        "protected Dev ancestry, target version, source roots, and derived roots"
+      ],
+      "publicSurfaces": [
+        "cli:next-development",
+        "export:./next-development-transition",
+        "export:./next-development-controller",
+        "export:./next-development-projection"
+      ],
+      "compatibilityCallers": [
+        "v4 completed-Alpha schedulers through the atomic store and executor interfaces"
+      ],
+      "sourcePaths": [
+        "packages/core/next-development-transition.js",
+        "packages/core/next-development-controller.js",
+        "packages/core/next-development-candidate-reservation.js"
+      ],
+      "testPaths": [
+        "tests/next-development-transition.test.mjs",
+        "tests/next-development-controller.test.mjs",
+        "tests/dev-alpha-candidate-patrol.test.mjs",
+        "tests/next-development-self-dogfood.test.mjs"
+      ],
+      "migrationDisposition": "v4-authoritative-with-public-consumer-lifecycle-proof",
+      "unresolved": [
+        "provider-specific durable-store retention and workflow wake policy remain caller-owned integration choices"
+      ]
+    },
     {
       "id": "dev-delivery-warrant",
       "owner": "Buildchain Dev delivery control plane",
@@ -204,7 +293,9 @@
       "sourcePaths": [
         "packages/core/dev-delivery-proof.js",
         "packages/core/dev-delivery-warrant-cancellation.js",
+        "packages/core/dev-delivery-warrant-qualification.js",
         "packages/core/dev-delivery-warrant-settlement.js",
+        "packages/core/dev-delivery-warrant-state.js",
         "packages/core/dev-delivery-warrant.js",
         "packages/core/release-blocker-priority.js",
         "scripts/dev-delivery-proof.mjs",

package/architecture/v4-adopter-delivery-parity.json

@@ -3,14 +3,16 @@
   "contract": "kungfu-buildchain-v4-adopter-delivery-parity-plan",
   "sourceAuthority": {
     "branch": "dev/v3/v3.0",
-    "commit": "c3f58d76391c1c6ceddfc900a68e91c7ab82a575",
-    "vectorSuiteRoot": "sha256:cf329805d928a9883cbafbdfdf21ef66c6a0889ed8dfe14356b4e0d25d6738f9",
-    "kfdPackage": "@kungfu-tech/kfd@1.0.0-alpha.62"
+    "commit": "6b96bdad8d9f8ccf9275f27d9370a226a9c78465",
+    "vectorSuiteRoot": "sha256:c978707556406ffda4ef4192032332c01c2da1cebb6ad8c4f0edfc65d5cef0c7",
+    "kfdPackage": "@kungfu-tech/kfd@1.0.0-alpha.65"
   },
   "target": {
     "branch": "dev/v4/v4.0",
-    "baseline": "3079091f770ce9fdca950e106259e34e5171f763",
+    "initialBaseline": "e5611377efc03178f8687d99968cfdfa3ce2825b",
+    "baseline": "e0342713c7447960c13bd73377282b2e93f4853d",
     "mode": "effect-disabled",
+    "surface": "public-protocol-neutral-adopter-delivery",
     "productionWriterAuthority": false
   },
   "vectors": [
@@ -37,11 +39,36 @@
     {
       "id": "fault-driver-throw",
       "mode": "gate-core-parity"
+    },
+    {
+      "id": "positive-n-minus-one-bootstrap",
+      "mode": "public-bootstrap-lineage"
+    },
+    {
+      "id": "positive-published-archive",
+      "mode": "public-archive-authority"
+    },
+    {
+      "id": "negative-archive-identity",
+      "mode": "public-archive-authority"
+    },
+    {
+      "id": "negative-bootstrap-lineage",
+      "mode": "public-bootstrap-lineage"
+    },
+    {
+      "id": "negative-protocol-version",
+      "mode": "public-driver-selection"
+    },
+    {
+      "id": "tamper-readback",
+      "mode": "public-exact-readback"
     }
   ],
   "nonClaims": [
     "The Rust projection has no provider, credential, release, signing or production-writer authority.",
     "KFD semantics are evaluated only by exact published KFD bytes before the effect-disabled carrier projection.",
-    "Release Passport evidence substitution remains on the protected v3 boundary and is not reimplemented as a v4 writer."
+    "Release Passport evidence substitution remains on the protected v3 boundary and is not reimplemented as a v4 writer.",
+    "The public CLI, Node API, schema, configuration and reusable workflow retain provider, signing, publication and release authority as explicit non-claims."
   ]
 }

package/architecture/v4-capability-state-machine-manifest.json

@@ -83,6 +83,18 @@
     }
   },
   "capabilities": [
+    {
+      "id": "next-development-controller",
+      "owner": "Buildchain protected development version plane",
+      "sourceInventoryId": "next-development-controller",
+      "surfaces": [
+        "cli:next-development",
+        "export:./next-development-transition",
+        "export:./next-development-controller",
+        "export:./next-development-projection"
+      ],
+      "migrationPhase": "legacy-retired"
+    },
     {
       "id": "dev-delivery-warrant",
       "owner": "Buildchain Dev delivery control plane",
@@ -198,6 +210,67 @@
     }
   ],
   "stateMachines": [
+    {
+      "id": "next-development-controller",
+      "capabilityId": "next-development-controller",
+      "owner": "Buildchain protected development version plane",
+      "writer": {
+        "runtime": "typescript-v4",
+        "authoritative": true,
+        "secondWriterBudget": 0
+      },
+      "schemas": [
+        "kungfu-buildchain-next-development-transition/v1",
+        "kungfu-buildchain-next-development-controller/v1"
+      ],
+      "store": "atomic child store with compare-and-swap rooted checkpoints",
+      "states": [
+        "planned",
+        "waiting-anchor",
+        "materialized",
+        "pr-pending",
+        "merged",
+        "verified"
+      ],
+      "events": [
+        "schedule",
+        "bind-reviewed-anchor",
+        "materialize-current-dev",
+        "open-protected-version-pr",
+        "record-merge",
+        "verify-protected-dev-readback"
+      ],
+      "invariants": [
+        "completed Alpha remains terminal and immutable",
+        "one deterministic child exists per completed-Alpha root",
+        "verified requires exact protected Dev version and root readback"
+      ],
+      "effects": [
+        "write declared version source and derived material",
+        "request one protected Dev version pull request"
+      ],
+      "adapters": [
+        "atomic durable child store",
+        "version-state materialization adapter",
+        "protected Dev pull-request and readback adapter"
+      ],
+      "tests": [
+        "tests/next-development-transition.test.mjs",
+        "tests/next-development-controller.test.mjs",
+        "tests/next-development-self-dogfood.test.mjs",
+        "tests/dev-alpha-candidate-patrol.test.mjs"
+      ],
+      "recovery": [
+        "fresh runners resume the last rooted checkpoint and reuse idempotent materialization operations",
+        "moved protected Dev supersedes only stale preparation and readback mismatch retries observation"
+      ],
+      "migrationPhase": "legacy-retired",
+      "budgets": {
+        "undeclaredStates": 0,
+        "undeclaredEvents": 0,
+        "unboundedRetries": 0
+      }
+    },
     {
       "id": "dev-delivery-warrant",
       "capabilityId": "dev-delivery-warrant",

package/architecture/v4-compatibility-facts-parity.json

@@ -0,0 +1,77 @@
+{
+  "schema": "buildchain.v4.compatibility-facts-parity/v1",
+  "source": {
+    "branch": "dev/v3/v3.0",
+    "commit": "6b96bdad8d9f8ccf9275f27d9370a226a9c78465",
+    "factRegistry": "packages/core/buildchain-compatibility-facts.json"
+  },
+  "target": {
+    "branch": "dev/v4/v4.0",
+    "commit": "60e61d0a17bdf41262454a3499aae430248036fc",
+    "schema": "contracts/v4-compatibility-facts-v1.schema.json"
+  },
+  "rootProtocol": "kungfu.fact-root.canonical/v2",
+  "matrixRoot": "sha256:be099fcb4ecc5ec0bf24e86853246d12210b2f6d082e928ce90a40b00345f262",
+  "matrix": [
+    {
+      "invariant": "immutable-directional-relation",
+      "v3": "source-to-target Fact",
+      "v4": "source-to-target Fact",
+      "parity": "exact"
+    },
+    {
+      "invariant": "operation-scope",
+      "v3": "accept-contract-lock",
+      "v4": "accept-contract-lock",
+      "parity": "exact"
+    },
+    {
+      "invariant": "time-awareness",
+      "v3": "validFromCutRoot plus Cut ancestry",
+      "v4": "validFromCutRoot plus Cut ancestry",
+      "parity": "exact"
+    },
+    {
+      "invariant": "append-only-current-truth",
+      "v3": "supersede and revoke records",
+      "v4": "supersede and revoke records",
+      "parity": "exact"
+    },
+    {
+      "invariant": "explicit-path",
+      "v3": "direct default and explicit bounded composition",
+      "v4": "direct default and explicit bounded composition",
+      "parity": "exact"
+    },
+    {
+      "invariant": "negative-receipts",
+      "v3": "rooted accepted or rejected path receipt",
+      "v4": "byte-identical Rust and TypeScript receipt",
+      "parity": "safety-equivalent"
+    },
+    {
+      "invariant": "legacy-digest-projection",
+      "v3": "compatibleBreakingDigests derived from proofs and Facts",
+      "v4": "exact-target current Facts derive digest arrays",
+      "parity": "safety-equivalent"
+    },
+    {
+      "invariant": "legacy-proof-projection",
+      "v3": "v1 proof roots retained",
+      "v4": "v1 proof roots retained as non-authoritative lineage",
+      "parity": "exact"
+    },
+    {
+      "invariant": "release-passport",
+      "v3": "Fact lineage available to verification receipt",
+      "v4": "Fact, Cut, proof and path roots attach as non-release-authority evidence",
+      "parity": "safety-equivalent"
+    },
+    {
+      "invariant": "unknown-state",
+      "v3": "fail closed",
+      "v4": "missing ambiguous expired revoked wrong-direction wrong-Cut disconnected and corrupt fail closed",
+      "parity": "exact"
+    }
+  ]
+}

package/architecture/v4-delivery-authority-parity.json

@@ -0,0 +1,250 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-delivery-authority-parity",
+  "sourceAuthority": {
+    "decision": "architecture/decisions/0003-two-phase-delivery-warrant.md",
+    "reference": "docs/dev-delivery-warrant.md",
+    "contract": "kungfu-buildchain-dev-delivery-warrant-queue",
+    "schemaVersion": 1
+  },
+  "target": {
+    "branch": "dev/v4/v4.0",
+    "singleFlightContract": "kungfu-buildchain-dev-delivery-warrant-queue",
+    "boundedAuthorityContract": "kungfu-buildchain-dev-delivery-authority",
+    "boundedAuthoritySchemaVersion": 2
+  },
+  "allowedDispositions": [
+    "implemented",
+    "superseded-equivalent",
+    "missing-before-closeout"
+  ],
+  "invariants": [
+    {
+      "id": "DA-01",
+      "claim": "Native delivery receives provisional authority before expensive execution and cannot use that phase as merge admission.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-warrant.js",
+        "scripts/dev-delivery-two-phase.mjs"
+      ],
+      "verificationEvidence": [
+        "tests/dev-delivery-two-phase.test.mjs",
+        "tests/dev-delivery-two-phase-run.test.mjs"
+      ],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-01"
+    },
+    {
+      "id": "DA-02",
+      "claim": "The provisional Warrant heartbeats one exact token and generation, and stale or expired owners cannot renew or qualify.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-warrant.js",
+        "scripts/dev-delivery-native-run.mjs"
+      ],
+      "verificationEvidence": [
+        "tests/dev-delivery-two-phase.test.mjs",
+        "tests/dev-delivery-native-run.test.mjs"
+      ],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-02"
+    },
+    {
+      "id": "DA-03",
+      "claim": "Native proof binds semantic source, exact source head, qualified base, affected closure, dependency and toolchain roots, environment, heartbeat receipt, and shard evidence; PR-controlled native code and its complete readable process ancestry receive no controller or provider write credentials, the recursively enumerated transfer is an exact regular-file-only closed set staged separately from candidate evidence, an independent hosted heartbeat runner chains durable state and receipt roots through native and seal completion, and only a live-readback-proven distinct GitHub-hosted finalizer job and runner may verify the latest state, revalidate bytes, recompute canonical failure evidence, qualify, or settle the exact bound failure.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-native-proof.js",
+        "packages/core/dev-delivery-execution-failure.js",
+        "packages/core/dev-delivery-execution-transfer.js",
+        "packages/core/dev-delivery-process-boundary.js",
+        "packages/core/dev-delivery-provider-heartbeat.js",
+        "scripts/dev-delivery-native-run.mjs",
+        "scripts/dev-delivery-process-boundary.mjs",
+        "scripts/dev-delivery-provider-heartbeat.mjs",
+        ".github/workflows/dev-pr-auto-merge.yml"
+      ],
+      "verificationEvidence": [
+        "tests/dev-delivery-two-phase.test.mjs",
+        "tests/dev-delivery-native-run.test.mjs",
+        "tests/dev-delivery-process-boundary.test.mjs",
+        "tests/dev-delivery-process-boundary-negative.test.mjs",
+        "tests/dev-delivery-provider-heartbeat.test.mjs",
+        "tests/build-surface.test.mjs"
+      ],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-03"
+    },
+    {
+      "id": "DA-04",
+      "claim": "Interruption resumes only from a live qualified fence or a proof whose complete attributed base delta remains disjoint; ambiguity or overlap revalidates.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-native-proof.js",
+        "scripts/dev-delivery-two-phase-resume.mjs"
+      ],
+      "verificationEvidence": [
+        "tests/dev-delivery-two-phase.test.mjs",
+        "tests/dev-delivery-two-phase-run.test.mjs"
+      ],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-04"
+    },
+    {
+      "id": "DA-05",
+      "claim": "Native success upgrades the same fence atomically to qualified authority and records exact proof and reuse roots without minting a second token.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-native-proof.js",
+        "packages/core/dev-delivery-warrant.js"
+      ],
+      "verificationEvidence": ["tests/dev-delivery-two-phase.test.mjs"],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-05"
+    },
+    {
+      "id": "DA-06",
+      "claim": "Expiry does not imply worker termination; an expired provisional holder remains exclusive until exact fenced terminal settlement, and duplicate settlement is idempotent.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-warrant.js",
+        "packages/core/dev-delivery-warrant-settlement.js"
+      ],
+      "verificationEvidence": [
+        "tests/dev-delivery-warrant.test.mjs",
+        "tests/dev-delivery-two-phase.test.mjs"
+      ],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-06"
+    },
+    {
+      "id": "DA-07",
+      "claim": "GitHub merge_group and the protected Project Cut remain final integration authority; a Warrant alone never mutates branch protection or proves landing.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-proof.js",
+        "scripts/dev-pr-delivery-warrant.mjs",
+        ".github/workflows/dev-pr-auto-merge.yml"
+      ],
+      "verificationEvidence": [
+        "tests/dev-delivery-warrant.test.mjs",
+        "tests/dev-pr-auto-merge.test.mjs"
+      ],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-07"
+    },
+    {
+      "id": "DA-08",
+      "claim": "Bounded mode issues no more than the configured Qualification Leases and only across disjoint rooted safety domains; unknown or overlapping domains serialize.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-authority-qualification.js",
+        "packages/core/dev-delivery-authority-state.js"
+      ],
+      "verificationEvidence": ["tests/dev-delivery-authority.test.mjs"],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-08"
+    },
+    {
+      "id": "DA-09",
+      "claim": "Qualification authority cannot admit merge_group; a new Landing requires complete verified-native qualification, its public admission API derives provider identity only from live GitHub readback, and exactly one exclusive Landing Warrant binds the candidate, source head, token, generation, state root, protected base, merge-group head, and verified provider attempt.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-authority-landing.js",
+        "packages/core/dev-delivery-landing-admission-core.js",
+        "packages/core/dev-delivery-authority-qualification.js",
+        "contracts/dev-delivery-authority-v2.schema.json"
+      ],
+      "verificationEvidence": ["tests/dev-delivery-authority.test.mjs"],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-09"
+    },
+    {
+      "id": "DA-10",
+      "claim": "Landing is fair under bounded overtaking, including strict FIFO at zero, and never exposes more than one landing writer under contention.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-authority-qualification.js",
+        "packages/core/dev-delivery-authority-landing.js"
+      ],
+      "verificationEvidence": ["tests/dev-delivery-authority.test.mjs"],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-10"
+    },
+    {
+      "id": "DA-11",
+      "claim": "Every Landing admission derives the provider attempt through non-injectable live GitHub readback, and every admitted heartbeat carries that exact persisted attempt and renews only through the public GitHub workflow run-attempt and job readback; qualification expiry releases only qualification capacity, while every Landing Warrant remains exclusive until an independent terminal verifier reads the immutable historical attempt endpoint and returns fresh rooted evidence bound to state, fence, generation, candidate, admitted source head, provider run, provider job, and protected-base containment without depending on a mutable run projection, referenced-workflow inference, or the synchronized current PR head; runtime sealing enforces the published repository, protected-base, numeric identity, completed-state, run-conclusion, job-conclusion, pull-request-state, merged-flag, containment, and outcome schema, and every resulting settlement is deterministic and idempotent.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-authority-qualification.js",
+        "packages/core/dev-delivery-authority-landing.js",
+        "packages/core/dev-delivery-landing-admission-core.js",
+        "packages/core/dev-delivery-landing-readback.js"
+      ],
+      "verificationEvidence": ["tests/dev-delivery-authority.test.mjs"],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-11"
+    },
+    {
+      "id": "DA-12",
+      "claim": "Expected-old state roots and non-force Git ref advancement serialize admission and prevent partial or competing writes from becoming two durable authorities.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "scripts/dev-delivery-authority.mjs",
+        "scripts/dev-delivery-warrant.mjs"
+      ],
+      "verificationEvidence": [
+        "tests/dev-delivery-authority.test.mjs",
+        "tests/dev-delivery-warrant-command.test.mjs"
+      ],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-12"
+    },
+    {
+      "id": "DA-13",
+      "claim": "One-shot v1 migration preserves the rooted legacy state and exact active fence while representing phase-less and qualified v1 compatibility honestly; compatibility-only evidence cannot acquire v2 native proof authority or mint a new Landing Warrant.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-authority-state.js",
+        "scripts/dev-delivery-authority.mjs"
+      ],
+      "verificationEvidence": ["tests/dev-delivery-authority.test.mjs"],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-13"
+    },
+    {
+      "id": "DA-14",
+      "claim": "Historical v1 queue bytes and native proofs remain readable, phase-less active-owner handoff uses exact legacy-safe bindings without a native command contract, and unbound or compatibility-only legacy proof cannot acquire new exact reuse or Landing authority.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "packages/core/dev-delivery-warrant.js",
+        "packages/core/dev-delivery-native-proof.js",
+        ".github/workflows/dev-pr-auto-merge.yml"
+      ],
+      "verificationEvidence": [
+        "tests/dev-delivery-authority.test.mjs",
+        "tests/dev-delivery-two-phase.test.mjs"
+      ],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-14"
+    },
+    {
+      "id": "DA-15",
+      "claim": "The supported CLI, Node exports including independent Landing terminal readback, schema, documentation, generated references, and byte-exact generated site schema expose bounded v2 authority consistently, while the native template and Buildchain public v4-alpha caller truthfully remain single-flight v1 and do not advertise v2 Landing execution; matching stable and alpha contract locks preserve that explicit boundary.",
+      "disposition": "implemented",
+      "implementationEvidence": [
+        "bin/buildchain.mjs",
+        "package.json",
+        "packages/core/dev-delivery-landing-readback.js",
+        "packages/core/dev-delivery-contract-surface.js",
+        "contracts/dev-delivery-authority-v2.schema.json",
+        "docs/dev-delivery-warrant.md",
+        "docs/dev-delivery-qualification-landing-adr.md",
+        "templates/native-dev-delivery.yml",
+        ".github/workflows/buildchain-dev-delivery.yml",
+        ".buildchain/contract-lock.json",
+        ".buildchain/alpha-contract-lock.json"
+      ],
+      "verificationEvidence": [
+        "tests/dev-delivery-authority.test.mjs",
+        "tests/dev-pr-auto-merge.test.mjs",
+        "tests/build-surface.test.mjs"
+      ],
+      "behavioralProof": "tests/v4-delivery-authority-parity.test.mjs#DA-15"
+    },
+    {
+      "id": "DA-16",
+      "claim": "Independent review, protected merge into dev/v4/v4.0, and exact post-merge readback are required external closeout evidence and are not established by local tests.",
+      "disposition": "missing-before-closeout",
+      "implementationEvidence": [],
+      "verificationEvidence": []
+    }
+  ],
+  "matrixRoot": "sha256:5be5abf70b982374f32a1400d4ec7c830017a0473d03165e831a506c94c8b881"
+}