@kungfu-tech/buildchain 4.0.1-alpha.2 → 4.0.1-alpha.3

package/architecture/decisions/0003-two-phase-delivery-warrant.md

@@ -0,0 +1,152 @@
+---
+status: accepted
+period: 2026-08-11
+theme: two-phase-delivery-warrant
+doc_type: architecture-decision-record
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-08-15
+---
+
+# ADR 0003: Delivery Order Is Reserved Before Native Qualification
+
+## Status
+
+Accepted. This decision is normative for the v3 Delivery Warrant state machine,
+reusable delivery workflows, and generated native consumer workflows.
+
+## Context
+
+A slow native pull request can pass source acceptance, obtain approval, and then
+spend long enough in platform qualification for the protected dev base to move
+many times. Requiring all native shards to finish before the pull request owns
+a delivery turn permits a stream of later fast candidates to overtake it.
+Freezing dev or disabling protection would avoid the race only by stopping
+unrelated work or removing the authority that must be proven.
+
+Native evidence also has two identities that must not be conflated. Semantic
+source, affected closure, dependency graph, and toolchain determine whether a
+native result remains valid. The current dev commit and replay tree determine
+the final integration composition. A dev-only documentation change should not
+invalidate semantic native evidence, while a change inside the affected closure
+must never be silently reused.
+
+## Decision
+
+Delivery Warrant ownership has two phases:
+
+```text
+queued -> provisional --native proof accepted--> qualified -> GitHub merge queue
+              |                  |
+              +--failure--------+--> terminal release -> wake next candidate
+              +--expiry------------> recovered queue entry with a new fence
+```
+
+Source acceptance, the ready label, current approval, and required source checks
+are established before selection. Selection issues a `provisional` Warrant with
+one TTL, heartbeat protocol, lease generation, and fencing token. It reserves
+the next protected-dev delivery turn but is not merge-queue authority. Later
+pull requests may run source and CI work and remain visible in the durable FIFO
+plus aging queue; none may enter the protected merge queue while another exact
+candidate owns the active Warrant.
+
+Native success upgrades the same fenced generation atomically to `qualified`.
+The transition binds a Native Qualification Proof and a rooted reuse decision.
+Only a qualified Warrant may authorize enqueue. The upgrade does not mint a new
+fence and cannot change the PR head or semantic source roots.
+
+Native Qualification Proof v3 binds semantic source identity, semantic patch,
+qualification plan, affected closure, dependency graph, toolchain, execution
+environment contract, covered paths, exact shard evidence roots, the dev base
+used for qualification, and the exact native execution receipt. That receipt
+contains the normalized repository, protected base, source head, qualified
+base, toolchain root, and environment root binding established before the
+native process starts. The proof repeats and roots that binding, and includes
+the receipt root in its shard evidence. Its
+timestamp is observational rather than part of proof identity. Reuse on another
+base requires an attributed base delta. Identical base is accepted directly; a
+descendant base with no overlap against the affected closure reuses the proof;
+overlap requires affected or full native revalidation; unknown ancestry,
+truncated attribution, semantic change, closure change, dependency change, or
+toolchain change requires full revalidation.
+
+The reusable controller composes the exact PR head with the observed protected
+base before running native work, heartbeats while the command is active, and
+checks base drift after completion. It may perform one automatic revalidation
+on the latest base. Continued overlapping drift fails closed. Native failure,
+cancel, semantic head movement, unrecoverable composition conflict, or exhausted
+revalidation closes only the current fence. The controller then emits a rooted
+`buildchain-dev-delivery-wake` repository event for the next queued candidate.
+Cancellation that prevents cleanup is covered by TTL recovery; the stale worker
+cannot renew or qualify after a new fence is minted.
+
+PR-controlled native execution is a credentialless candidate job on a
+GitHub-hosted runner. Its child process and complete `/proc` ancestry receive no
+controller or provider write credential. The ancestry sentinel treats unreadable
+process state as failure and detects generic auth, credential, key, password,
+secret, and token variable names. Only a dependent credentialed finalizer on a
+provider-readback-proven distinct GitHub-hosted job and runner may independently
+verify the content-addressed proof/state transfer, reread the same live fence,
+PR head, and protected base, and qualify or settle the attempt. A successful
+candidate exit is evidence input, not authority to mutate provider state or a
+completion signal by itself. Persistent self-hosted runners are unsupported
+because job ordering alone cannot prove detached-descendant cleanup.
+
+GitHub `merge_group` checks and the protected dev ref remain final integration
+authority. No transition disables a check, changes branch protection, force
+updates the Warrant ref, or freezes dev.
+
+Required native delivery validates the environment root before candidate
+submission, Warrant selection, checkout/composition, or native process spawn.
+An empty or malformed root is therefore an admission failure, not a terminal
+failure after native capacity has been spent. `off`, `shadow`, and
+`non-native-fast` compatibility does not turn the reusable workflow input into
+an unconditional requirement.
+
+## Compatibility
+
+Existing v1 queue documents remain readable. An historical active Warrant that
+does not contain `phase` is interpreted as the former already-qualified shape
+without rewriting its state root. Newly selected Warrants always contain
+`phase: provisional`. Existing `off` and `shadow` workflow modes remain
+available; `required` now enforces the two-phase upgrade. Native Qualification
+Proof v1 and v2 documents remain verifiable as historical evidence, but their
+execution receipts do not bind the environment root. They cannot gain v3 exact
+reuse authority and must be replaced by an explicit native revalidation.
+
+In bounded authority mode, every newly issued Landing Warrant requires the
+complete verified-native qualification shape, including the qualification
+contract, execution binding, execution receipt, command, source proof, and native
+proof roots. A migrated `legacy-compatibility-only` qualification may preserve
+the exact already-active historical Landing fence for safe handoff, but it can
+never mint a new Landing Warrant or acquire native proof authority.
+
+Elapsed lease time is not provider-stop evidence. Cleanup of an expired Landing
+fence requires a separate independent provider terminal verifier whose rooted
+readback matches the exact state root, candidate, source head, fencing token,
+generation, provider run, and provider job and is fresh for that Warrant
+generation. Caller-asserted, forged, mismatched, nonterminal, or stale readback
+cannot release the exclusive slot.
+
+## Consequences
+
+- Slow approved candidates stop starving without serializing development or CI.
+- A provisional receipt is intentionally insufficient for merge admission.
+- Base-only replay churn can reuse native evidence when closure attribution is
+  complete and disjoint.
+- Overlap and uncertainty spend more native compute but cannot create an
+  unproven protected-dev landing.
+- Consumers need a promotion token that can advance the Warrant state ref and
+  emit the wake event, plus a native command or an exact reusable proof.
+- Invalid required-native environment inputs fail before they can allocate a
+  Warrant or native runner time.
+- Legacy unbound native evidence remains readable but intentionally spends a
+  new validation run before qualification.
+- Candidate execution remains credentialless; credentialed readback,
+  qualification, and settlement happen only in a distinct, live-evidenced fresh
+  GitHub-hosted finalizer job after candidate job completion.
+- Expired Landing cleanup is rooted in exact independent provider readback, not
+  a timeout or the controller's own assertion.

package/architecture/internal-capabilities.json

@@ -59,6 +59,38 @@
     "packages/core/v4-stage-capsule-qualification.js",
     "packages/core/v4-stage-capsule-qualification-campaign.js",
     "scripts/v4-stage-capsule-qualification.mjs",
+    "packages/core/dev-delivery-warrant.js",
+    "packages/core/dev-delivery-warrant-state.js",
+    "packages/core/dev-delivery-warrant-qualification.js",
+    "packages/core/dev-delivery-native-proof.js",
+    "packages/core/dev-delivery-native-execution.js",
+    "packages/core/dev-delivery-execution-failure.js",
+    "packages/core/dev-delivery-execution-transfer.js",
+    "packages/core/dev-delivery-process-boundary.js",
+    "packages/core/dev-delivery-contract-surface.js",
+    "packages/core/dev-delivery-authority-candidate.js",
+    "packages/core/dev-delivery-authority-evidence.js",
+    "packages/core/dev-delivery-authority-state.js",
+    "packages/core/dev-delivery-authority-qualification.js",
+    "packages/core/dev-delivery-authority-landing.js",
+    "packages/core/dev-delivery-landing-admission-core.js",
+    "packages/core/dev-delivery-authority-settlement.js",
+    "packages/core/dev-delivery-landing-readback.js",
+    "packages/core/dev-delivery-landing-terminal-evidence.js",
+    "packages/core/dev-delivery-landing-testing-port.js",
+    "packages/core/dev-delivery-provider-attempt.js",
+    "packages/core/dev-delivery-provider-heartbeat.js",
+    "scripts/dev-delivery-warrant.mjs",
+    "scripts/dev-delivery-warrant-options.mjs",
+    "scripts/dev-delivery-warrant-store.mjs",
+    "scripts/dev-delivery-authority.mjs",
+    "scripts/dev-delivery-authority-command-adapters.mjs",
+    "scripts/dev-delivery-authority-provider.mjs",
+    "scripts/dev-delivery-native-run.mjs",
+    "scripts/dev-delivery-process-boundary.mjs",
+    "scripts/dev-delivery-provider-heartbeat.mjs",
+    "scripts/dev-delivery-two-phase-resume.mjs",
+    "scripts/dev-delivery-two-phase.mjs",
     "crates/buildchain-v4-contracts/src/stage_capsule.rs",
     "crates/buildchain-v4-contracts/src/stage_capsule_store.rs",
     "crates/buildchain-v4-contracts/src/provider_operation_journal.rs",
@@ -418,6 +450,68 @@
         "docs/release-tail-provider-plane.md"
       ]
     },
+    {
+      "id": "v4-delivery-authority",
+      "owner": "Buildchain protected delivery maintainers",
+      "implementation": [
+        "packages/core/dev-delivery-warrant.js",
+        "packages/core/dev-delivery-warrant-state.js",
+        "packages/core/dev-delivery-warrant-qualification.js",
+        "packages/core/dev-delivery-native-proof.js",
+        "packages/core/dev-delivery-native-execution.js",
+        "packages/core/dev-delivery-execution-failure.js",
+        "packages/core/dev-delivery-execution-transfer.js",
+        "packages/core/dev-delivery-process-boundary.js",
+        "packages/core/dev-delivery-contract-surface.js",
+        "packages/core/dev-delivery-authority-candidate.js",
+        "packages/core/dev-delivery-authority-evidence.js",
+        "packages/core/dev-delivery-authority-state.js",
+        "packages/core/dev-delivery-authority-qualification.js",
+        "packages/core/dev-delivery-authority-landing.js",
+        "packages/core/dev-delivery-landing-admission-core.js",
+        "packages/core/dev-delivery-authority-settlement.js",
+        "packages/core/dev-delivery-landing-readback.js",
+        "packages/core/dev-delivery-landing-terminal-evidence.js",
+        "packages/core/dev-delivery-landing-testing-port.js",
+        "packages/core/dev-delivery-provider-attempt.js",
+        "packages/core/dev-delivery-provider-heartbeat.js",
+        "scripts/dev-delivery-warrant.mjs",
+        "scripts/dev-delivery-warrant-options.mjs",
+        "scripts/dev-delivery-warrant-store.mjs",
+        "scripts/dev-delivery-authority.mjs",
+        "scripts/dev-delivery-authority-command-adapters.mjs",
+        "scripts/dev-delivery-authority-provider.mjs",
+        "scripts/dev-delivery-native-run.mjs",
+        "scripts/dev-delivery-process-boundary.mjs",
+        "scripts/dev-delivery-provider-heartbeat.mjs",
+        "scripts/dev-delivery-two-phase-resume.mjs",
+        "scripts/dev-delivery-two-phase.mjs"
+      ],
+      "tests": [
+        "tests/dev-delivery-warrant.test.mjs",
+        "tests/dev-delivery-warrant-command.test.mjs",
+        "tests/dev-delivery-two-phase.test.mjs",
+        "tests/dev-delivery-two-phase-run.test.mjs",
+        "tests/dev-delivery-native-run.test.mjs",
+        "tests/dev-delivery-process-boundary.test.mjs",
+        "tests/dev-delivery-process-boundary-negative.test.mjs",
+        "tests/dev-delivery-provider-heartbeat.test.mjs",
+        "tests/dev-delivery-authority.test.mjs",
+        "tests/build-surface.test.mjs",
+        "tests/v4-delivery-authority-parity.test.mjs"
+      ],
+      "contracts": [
+        "architecture/v4-delivery-authority-parity.json",
+        "architecture/decisions/0003-two-phase-delivery-warrant.md",
+        "contracts/dev-delivery-authority-v2.schema.json",
+        "dist/site/schemas/dev-delivery-authority-v2.schema.json",
+        ".github/workflows/dev-pr-auto-merge.yml",
+        ".github/workflows/buildchain-dev-delivery.yml",
+        "templates/native-dev-delivery.yml",
+        "docs/dev-delivery-warrant.md",
+        "docs/dev-delivery-qualification-landing-adr.md"
+      ]
+    },
     {
       "id": "v4-architecture-governance",
       "owner": "Buildchain architecture maintainers",

package/architecture/maintainability-policy.json

@@ -5,12 +5,12 @@
   "enforcementRevision": "5308189b09bcb5a1314195412f2807a40d678838",
   "repositoryBudgets": {
     "baselineRevision": "c70e6ac28431888b24fefc218246cc69f8dde85a",
-    "maxHandMaintainedSourceFiles": 353,
-    "maxHandMaintainedSourceLines": 136936,
+    "maxHandMaintainedSourceFiles": 384,
+    "maxHandMaintainedSourceLines": 146550,
     "maxWorkflowFiles": 71,
-    "maxWorkflowLines": 24190,
-    "latestTransition": "The v4 promotion surface now admits one rooted transient exact-runtime authorization, rejects persisted selector authority, and carries fresh-attempt Stage Capsule reuse lineage into the final Release Passport.",
-    "rationale": "The existing dev queue Warrant admission, adopter compatibility port, and exact source-proof reuse remain included unchanged. Two bounded runtime-resume modules, one provider authorization adapter, rooted schema and fixtures, workflow admission gates, action and Passport plumbing, capability metadata, and negative tests account for this transition's exact growth. Exact SHAs remain transient, failed jobs are never rerun, unaffected sealed platform capsules are reused by identity, and v3 behavior remains unchanged. These exact 353-file, 136936-source-line and 24190-workflow-line ceilings cannot grow implicitly."
+    "maxWorkflowLines": 25259,
+    "latestTransition": "Delivery authority now migrates a rechecked live v1 ref with the configured v2 policy, rejects GitHub artifact runtime credentials in candidate ancestry, binds containment comparison to the exact protected-base head, and keeps v2 migration promises out of the v1 workflow contract.",
+    "rationale": "Bounded modules separate candidate, evidence, native proof and execution, canonical failure verification, closed-set execution transfer, process-boundary verification, Warrant state and qualification, authority state, qualification, Landing acquisition, verified-attempt admission, Landing settlement and fence validation, provider attempt and heartbeat readback, sealed terminal evidence, hosted heartbeat, resume, store, options, command-specific adapters, and CLI orchestration responsibilities. The protected delivery workflow gives candidate and seal jobs no provider write credential, recursively rejects transfer drift, scopes every transfer artifact to the exact provider run attempt, chains every durable heartbeat state and receipt root on a distinct hosted runner domain, and permits qualification or exact failure settlement only after the finalizer verifies live jobs and the latest durable authority state. Public Landing admission and heartbeat always perform non-injectable fresh exact-attempt provider readback, and heartbeat-loss coordination never invokes GitHub's run-scoped cancellation API where a successor rerun could race. V2 mutation cannot initialize a second empty authority beside a legacy ref: migration reads and roots the canonical live v1 ref, rechecks it, applies the explicit configured v2 policy, and atomically replaces its bytes through one expected-old non-force update, so old v1 controllers fail closed while the prior commit remains immutable history. Candidate ancestry classifies the GitHub artifact runtime token as credential authority. Every Landing settlement, including an unexpired fence, requires product-owned terminal readback. Terminal cleanup reads the immutable historical attempt, derives workflow and hosted Landing job identity from live run data, reads the exact protected ref head and compares containment against that immutable SHA, and seals merged only when the admitted merge-group head is contained by that protected base; a later different-head merge settles the old attempt as dequeued. Terminal normalization preserves transfer, finalizer boundary, native and seal job, admitted provider attempt, protected-base head, containment result, and terminal readback coordinates. The public reusable workflow truthfully retains its single-flight v1 authority without advertising v2 migration, while bounded v2 remains a separate opt-in CLI, Node API, and schema contract; the tracked self-caller stays on public v4-alpha with matching stable and alpha locks, and transient train selection is dispatch-only. These exact 384-file, 146550-source-line and 25259-workflow-line ceilings cannot grow implicitly."
   },
   "sourceBudgets": {
     "newFileLines": 600,
@@ -27,6 +27,10 @@
       "maxLines": 399,
       "rationale": "The bounded guard keeps latest-base delta attribution, rooted source-proof reuse classification, synthetic merge composition readback, stable pre-enqueue failures, and the final base, head, queue, and Warrant compare-and-swap outside the legacy Dev PR controller; it cannot mutate the frozen source head or authorize landing by itself, and this exact file ceiling cannot grow implicitly."
     },
+    "scripts/dev-delivery-authority.mjs": {
+      "maxLines": 635,
+      "rationale": "The explicit authority CLI keeps plan-only and execute transitions, provider-attempt coordinates, expected-old durable state writes, terminal provider readback, and machine-readable output in one compatibility entrypoint while the state-machine implementations remain extracted; this exact file ceiling cannot grow implicitly."
+    },
     "scripts/v4-architecture.mjs": {
       "maxLines": 610,
       "rationale": "The v4 architecture validator adds only the bounded production-authority, fallback, rollback, writer-runtime, and legacy-retirement checks required for the final release cutover. This exact reviewed ceiling cannot grow implicitly."
@@ -43,6 +47,14 @@
       "maxLines": 605,
       "rationale": "The v4 parity port preserves the reviewed v3 release-blocker claim handoff, root-preserving candidate refresh, deterministic queued ranking and receipt propagation while retaining all prior fencing, lease and terminal semantics; this exact reviewed ceiling cannot grow implicitly."
     },
+    "packages/core/dev-delivery-authority-landing.js": {
+      "maxLines": 615,
+      "rationale": "The bounded Landing authority module keeps exclusive acquisition, fenced heartbeat, exact merge-group provider-attempt admission, independent expired-provider readback, terminal settlement, and deterministic wake transitions in one audited state-machine seam; this exact file ceiling cannot grow implicitly."
+    },
+    "packages/core/dev-delivery-landing-admission-core.js": {
+      "maxLines": 119,
+      "rationale": "The internal transition persists only a provider attempt already derived by the public live GitHub readback boundary, keeping caller-supplied evidence outside the package export graph while preserving deterministic duplicate admission; this exact file ceiling cannot grow implicitly."
+    },
     "packages/core/release-blocker-priority.js": {
       "maxLines": 193,
       "rationale": "The v4 parity adapter preserves the reviewed v3 exact dual-landing priority claim, repair-contract parsing and unrelated-work rejection outside the durable Warrant state machine; this exact reviewed ceiling cannot grow implicitly."
@@ -97,10 +109,10 @@
       "rationale": "Responsibility-owned validators preserve issue ordering, byte-stable reports, upstream release evidence, consumer-policy certification, and the new rooted runtime A+B resume lineage. The optional attachment is normalized and independently reverified before inclusion; these exact post-integration ceilings cannot grow implicitly."
     },
     "packages/core/buildchain-contract.js": {
-      "maxLines": 1095,
+      "maxLines": 1096,
       "maxFunctionLines": 681,
       "maxFunctionComplexity": 30,
-      "rationale": "The existing v4 contract evaluator invokes the shared shell-runtime-lock binding before every compatibility or early-success path while preserving the prior contract-world, Release Train, and drift behavior. Its public advanced-workflow projection now declares the two optional expected lane inputs consumed by that unchanged evaluator. This exact public-contract wiring ceiling cannot grow implicitly."
+      "rationale": "The existing v4 contract evaluator invokes the shared shell-runtime-lock binding before every compatibility or early-success path while preserving the prior contract-world, Release Train, and drift behavior. Its public projection now includes the bounded dev-delivery workflow surface and declares the optional expected lane inputs consumed by the unchanged evaluator. This exact public-contract wiring ceiling cannot grow implicitly."
     },
     "packages/core/github-governance-authority.js": {
       "maxLines": 1368,
@@ -419,22 +431,32 @@
           "dependency-root",
           "diagnostic-context",
           "dry-run",
+          "environment-root",
           "expected-head-sha",
           "expected-pr-number",
+          "handoff-workflow-id",
           "initiative-root",
           "landing-mode",
+          "legacy-active-owner-binding-json",
           "max-merges",
           "merge-method",
+          "native-command",
+          "native-command-root",
+          "native-heartbeat-seconds",
+          "native-proof-json",
           "plan-root",
           "project-cut-proof-json",
           "queue-admission-context",
           "ready-label",
+          "release-blocker-priority-json",
           "require-approval",
           "required-status-checks",
           "same-repository-only",
           "shard-evidence-roots-json",
           "source-identity-root",
           "source-patch-root",
+          "source-workflow-id",
+          "source-workflow-run-id",
           "target-branch",
           "toolchain-root",
           "warrant-lease-seconds"
@@ -448,7 +470,13 @@
           "evaluated-count",
           "final-base-sha",
           "merged-count",
+          "native-execution-transfer-root",
+          "native-proof-root",
+          "native-reuse-decision-root",
           "project-cut-proof-root",
+          "provider-finalizer-boundary-root",
+          "provider-heartbeat-receipt-root",
+          "qualified-warrant-receipt-root",
           "skipped-count",
           "source-proof-root",
           "warrant-receipt-root",
@@ -456,7 +484,7 @@
           "warrant-state-root"
         ]
       },
-      "rationale": "Extend targeted exact-head admission with an optional rooted Project Cut replay proof and the exact active-lease status context needed to read back the same fenced Warrant before enqueue, while independent approval, required checks, native queue admission, and exact integration proof remain authoritative."
+      "rationale": "Add required-mode two-phase native qualification under one provisional fence, exact environment and heartbeat receipt binding, deterministic proof reuse, qualified-Warrant readback, and bounded successor handoff. The execution-transfer and provider-finalizer boundary outputs expose the exact content root and live distinct-job runner readback without exposing credential bytes. The additive legacy-active-owner binding carries exact phase-less state, fence, and generation without requiring a native command contract. Existing off and shadow modes remain explicit, and GitHub merge_group plus the exact Project Cut remain final landing authority."
     },
     "workflow:stable-candidate-patrol": {
       "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838",
@@ -1381,6 +1409,45 @@
     }
   },
   "approvedExtractedDebt": {
+    "packages/core/dev-delivery-authority-candidate.js#normalizeDevDeliveryAuthorityCandidate": {
+      "maxLines": 150,
+      "maxComplexity": 26,
+      "rationale": "The extracted candidate normalizer keeps exact identity, source, proof, Warrant, lease, native-command, priority, and terminal-state validation in one fail-closed audit surface; this exact bounded complexity cannot grow implicitly."
+    },
+    "packages/core/dev-delivery-native-proof.js#validateActiveDevDeliveryWarrant": {
+      "maxLines": 95,
+      "maxComplexity": 29,
+      "rationale": "The extracted active-Warrant validator preserves exact repository, branch, candidate, source, environment, fence, generation, lease, command, and qualification invariants in one auditable proof boundary; this exact bounded complexity cannot grow implicitly."
+    },
+    "packages/core/dev-delivery-execution-transfer.js#verifyNativeExecutionTransfer": {
+      "maxComplexity": 36,
+      "rationale": "The transfer verifier keeps the closed success and failure manifests, normalized job and Warrant bindings, byte digests, proof declarations, and failed-settlement fence in one exact artifact boundary; this reviewed complexity ceiling cannot grow implicitly."
+    },
+    "packages/core/dev-delivery-process-boundary.js#createProviderFinalizerBoundary": {
+      "maxLines": 191,
+      "maxComplexity": 33,
+      "rationale": "The provider boundary verifier keeps distinct job and runner identity, hosted labels, strict timestamps, live PR and protected-ref readback, and the rooted finalizer receipt in one fail-closed audit surface; this reviewed complexity ceiling cannot grow implicitly."
+    },
+    "scripts/dev-delivery-authority.mjs#runDevDeliveryAuthorityCommand": {
+      "maxLines": 151,
+      "maxComplexity": 26,
+      "rationale": "The authority command dispatcher keeps each explicit plan or execute mutation, exact expected-old state write, schema-safe output, and provider terminal-readback verifier injection in one audited command boundary; this exact complexity cannot grow implicitly."
+    },
+    "scripts/dev-delivery-authority.mjs#devDeliveryAuthorityCliOptions": {
+      "maxLines": 220,
+      "maxComplexity": 11,
+      "rationale": "The authority CLI parser keeps the complete explicit flag-to-environment compatibility mapping, including exact provider run and job coordinates for independent expired-Landing readback, in one declarative function while execution remains separately owned; this exact extracted mapping ceiling cannot grow implicitly."
+    },
+    "scripts/dev-delivery-two-phase.mjs#runTwoPhaseDelivery": {
+      "maxLines": 204,
+      "maxComplexity": 35,
+      "rationale": "The two-phase coordinator keeps provisional selection, credentialless native-only execution, post-exit credentialed proof reuse and qualification, heartbeat, landing handoff, and fail-closed cleanup under one fenced transaction; this exact bounded orchestration ceiling cannot grow implicitly."
+    },
+    "scripts/dev-delivery-warrant-options.mjs#devDeliveryCliOptions": {
+      "maxLines": 257,
+      "maxComplexity": 11,
+      "rationale": "The extracted compatibility parser preserves the complete Warrant flag and environment mapping byte-for-byte while storage and command execution remain separately owned; this exact mapping ceiling cannot grow implicitly."
+    },
     "scripts/v4-warrant-shadow-plan.mjs#validatePlan": {
       "maxLines": 182,
       "maxComplexity": 26,

package/architecture/v3-core-mechanism-inventory.json

@@ -204,7 +204,9 @@
       "sourcePaths": [
         "packages/core/dev-delivery-proof.js",
         "packages/core/dev-delivery-warrant-cancellation.js",
+        "packages/core/dev-delivery-warrant-qualification.js",
         "packages/core/dev-delivery-warrant-settlement.js",
+        "packages/core/dev-delivery-warrant-state.js",
         "packages/core/dev-delivery-warrant.js",
         "packages/core/release-blocker-priority.js",
         "scripts/dev-delivery-proof.mjs",