@kungfu-tech/buildchain 4.0.1-alpha.3 → 4.0.1-alpha.30

package/actions/release-tail/README.md

@@ -11,3 +11,11 @@ not the adapter, compares the observed subject and target roots, owns retry and
 terminal classification, checkpoints state and emits the standardized receipt.
 Tokens remain Action inputs and are never written to the transaction or
 receipt.
+
+When `rehearsal-capsule` is supplied, the same Action switches to the v4
+Publication Rehearsal Capsule boundary. `simulate` and `replay` remain
+effect-disabled. `provider` additionally requires exact capsule-bound
+rehearsal authority, consumes only the capsule-rooted data bindings, and
+records every request/readback while still emitting
+`productionAuthority: false` and no Release Passport. See
+[`docs/v4-publication-rehearsal.md`](../../docs/v4-publication-rehearsal.md).

package/architecture/ci-lane-change-budget.json

@@ -0,0 +1,187 @@
+{
+  "schema": "buildchain.ci-lane-change-budget/v1",
+  "authorityClassification": "repository-policy-enforcement",
+  "baseline": {
+    "gitRevision": "7fdf0b560670df65929ab2ee833c3d6339372d8a",
+    "source": "protected dev/v4/v4.0 before CI lane change-budget enforcement",
+    "laneSetRoot": "sha256:5bed17dc265f424e5d528949231146c633be954b8c3c2535ba18aec6ac1465a4",
+    "lanes": [
+      ".github/workflows/.auditable-demo.yml#gate",
+      ".github/workflows/.auditable-demo.yml#render",
+      ".github/workflows/.binary-release-assets.yml#publication-authority",
+      ".github/workflows/.binary-release-assets.yml#publish",
+      ".github/workflows/.build.yml#anchored-release-preflight",
+      ".github/workflows/.build.yml#artifact-signing-control",
+      ".github/workflows/.build.yml#artifact-transfer",
+      ".github/workflows/.build.yml#build-linux-container",
+      ".github/workflows/.build.yml#build-native",
+      ".github/workflows/.build.yml#controller-plan",
+      ".github/workflows/.build.yml#controller-receipt",
+      ".github/workflows/.build.yml#credential-island-macos",
+      ".github/workflows/.build.yml#finalize-artifact-signing",
+      ".github/workflows/.build.yml#relay-artifacts",
+      ".github/workflows/.build.yml#resolve-contract",
+      ".github/workflows/.build.yml#resolve-source",
+      ".github/workflows/.build.yml#summarize",
+      ".github/workflows/.build.yml#trust-gate",
+      ".github/workflows/.bump-minor-version.yml#bump",
+      ".github/workflows/.declarative-auditable-demo.yml#capture",
+      ".github/workflows/.declarative-auditable-demo.yml#publish",
+      ".github/workflows/.declarative-auditable-demo.yml#qualify",
+      ".github/workflows/.gate-profile.yml#aggregate",
+      ".github/workflows/.gate-profile.yml#plan",
+      ".github/workflows/.gate-profile.yml#run-gates",
+      ".github/workflows/.publication-authority.yml#verify",
+      ".github/workflows/.release-candidate-promote.yml#controller-plan",
+      ".github/workflows/.release-candidate-promote.yml#controller-receipt",
+      ".github/workflows/.release-candidate-promote.yml#github-artifact-attestation",
+      ".github/workflows/.release-candidate-promote.yml#preflight",
+      ".github/workflows/.release-candidate-promote.yml#promote",
+      ".github/workflows/.release-candidate-promote.yml#publication-authority",
+      ".github/workflows/.release-candidate-promote.yml#publication-plan",
+      ".github/workflows/.release-candidate-promote.yml#publication-qualification",
+      ".github/workflows/.release-candidate-promote.yml#publish-github-artifact-attestation-evidence",
+      ".github/workflows/.release-candidate-promote.yml#qualification-plan",
+      ".github/workflows/.release-candidate-promote.yml#release-candidate-preflight",
+      ".github/workflows/.release-docker.yml#retired",
+      ".github/workflows/.release-elastic-beanstalk.yml#retired",
+      ".github/workflows/.release-new-version.yml#retired",
+      ".github/workflows/.release-verify.yml#build",
+      ".github/workflows/.release-verify.yml#build_local",
+      ".github/workflows/.release-verify.yml#prepare",
+      ".github/workflows/.release-verify.yml#verify",
+      ".github/workflows/.sam-release.yml#retired",
+      ".github/workflows/.sam-verify.yml#build",
+      ".github/workflows/.sam-verify.yml#prepare",
+      ".github/workflows/.sam-verify.yml#verify",
+      ".github/workflows/.sync-release-page.yml#sync-release-page",
+      ".github/workflows/.sync-remote-git.yml#sync",
+      ".github/workflows/.web-surface.yml#apply-input-gate",
+      ".github/workflows/.web-surface.yml#controller-plan",
+      ".github/workflows/.web-surface.yml#controller-receipt",
+      ".github/workflows/.web-surface.yml#external-publication-authority",
+      ".github/workflows/.web-surface.yml#open-production-release-pr",
+      ".github/workflows/.web-surface.yml#plan",
+      ".github/workflows/.web-surface.yml#preview-apply",
+      ".github/workflows/.web-surface.yml#preview-cleanup",
+      ".github/workflows/.web-surface.yml#production-apply",
+      ".github/workflows/.web-surface.yml#publication-authority",
+      ".github/workflows/.web-surface.yml#publication-decision",
+      ".github/workflows/.web-surface.yml#release-intent",
+      ".github/workflows/.web-surface.yml#runtime",
+      ".github/workflows/.web-surface.yml#staging-apply",
+      ".github/workflows/.wheel-release.yml#retired",
+      ".github/workflows/.wheel-verify.yml#build",
+      ".github/workflows/.wheel-verify.yml#prepare",
+      ".github/workflows/.wheel-verify.yml#verify",
+      ".github/workflows/artifact-signing-authority.yml#deliver",
+      ".github/workflows/artifact-signing-authority.yml#detached",
+      ".github/workflows/artifact-signing-authority.yml#intake",
+      ".github/workflows/artifact-signing-authority.yml#macos",
+      ".github/workflows/artifact-signing-authority.yml#windows",
+      ".github/workflows/auditable-demo-media-profile-qualification.yml#qualify",
+      ".github/workflows/auditable-demo.yml#dogfood",
+      ".github/workflows/auditable-demo.yml#exact-binary",
+      ".github/workflows/binary-distribution.yml#binary",
+      ".github/workflows/binary-distribution.yml#dispatch-publication",
+      ".github/workflows/binary-distribution.yml#passport",
+      ".github/workflows/binary-distribution.yml#preflight",
+      ".github/workflows/binary-release-assets.yml#publish",
+      ".github/workflows/binary-release-assets.yml#resolve",
+      ".github/workflows/build-surface-fixture.yml#buildchain-package-candidate",
+      ".github/workflows/build-surface-fixture.yml#libnode-shaped",
+      ".github/workflows/build.yml#alpha",
+      ".github/workflows/build.yml#controller-plan",
+      ".github/workflows/build.yml#controller-receipt",
+      ".github/workflows/build.yml#override",
+      ".github/workflows/build.yml#resolve-channel",
+      ".github/workflows/build.yml#stable",
+      ".github/workflows/build.yml#summarize",
+      ".github/workflows/buildchain-alpha-self-dogfood.yml#alpha-consumer",
+      ".github/workflows/buildchain-alpha-self-dogfood.yml#stable-consumer",
+      ".github/workflows/buildchain-alpha-self-dogfood.yml#verify-floating-refs",
+      ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml#deterministic-startup-router-failure",
+      ".github/workflows/buildchain-dev-delivery.yml#deliver",
+      ".github/workflows/buildchain-patrol-daily.yml#patrol",
+      ".github/workflows/buildchain-patrol-monthly.yml#patrol",
+      ".github/workflows/buildchain-patrol-weekly.yml#patrol",
+      ".github/workflows/buildchain-patrol.yml#patrol",
+      ".github/workflows/buildchain-ref-promotion-recovery.yml#consumer-admission",
+      ".github/workflows/buildchain-ref-promotion-recovery.yml#promote-alpha-recovery",
+      ".github/workflows/buildchain-ref-promotion.yml#promote-alpha",
+      ".github/workflows/buildchain-ref-promotion.yml#promote-stable",
+      ".github/workflows/buildchain-ref-promotion.yml#reject-invalid-candidate-recovery",
+      ".github/workflows/buildchain-ref-promotion.yml#reject-invalid-durable-recovery",
+      ".github/workflows/buildchain-ref-promotion.yml#reject-manual-apply",
+      ".github/workflows/buildchain-stable-candidate-patrol.yml#patrol",
+      ".github/workflows/buildchain-stable-candidate-qualification.yml#qualify",
+      ".github/workflows/candidate-lab.yml#lab",
+      ".github/workflows/check.yml#check",
+      ".github/workflows/dev-alpha-candidate-patrol.yml#observe",
+      ".github/workflows/dev-alpha-candidate-patrol.yml#settle",
+      ".github/workflows/dev-delivery-warrant-cancel.yml#cancel",
+      ".github/workflows/dev-delivery-warrant-close.yml#close",
+      ".github/workflows/dev-merge-queue-governance.yml#reconcile",
+      ".github/workflows/dev-pr-auto-merge.yml#admission",
+      ".github/workflows/dev-pr-auto-merge.yml#delivery-heartbeat",
+      ".github/workflows/dev-pr-auto-merge.yml#merge-dev-prs",
+      ".github/workflows/dev-pr-auto-merge.yml#native-execution",
+      ".github/workflows/dev-pr-auto-merge.yml#seal-native-execution",
+      ".github/workflows/dev-qualification-patrol.yml#mutate",
+      ".github/workflows/dev-qualification-patrol.yml#observe",
+      ".github/workflows/engineering-housekeeper-daily.yml#apply",
+      ".github/workflows/engineering-housekeeper-daily.yml#invalid-apply-gate",
+      ".github/workflows/engineering-housekeeper-daily.yml#report",
+      ".github/workflows/engineering-housekeeper-monthly.yml#apply",
+      ".github/workflows/engineering-housekeeper-monthly.yml#invalid-apply-gate",
+      ".github/workflows/engineering-housekeeper-monthly.yml#report",
+      ".github/workflows/engineering-housekeeper-weekly.yml#apply",
+      ".github/workflows/engineering-housekeeper-weekly.yml#invalid-apply-gate",
+      ".github/workflows/engineering-housekeeper-weekly.yml#report",
+      ".github/workflows/engineering-housekeeper.yml#delete-branches",
+      ".github/workflows/engineering-housekeeper.yml#label-pull-requests",
+      ".github/workflows/engineering-housekeeper.yml#plan",
+      ".github/workflows/github-artifact-attestation.yml#attest",
+      ".github/workflows/github-governance-audit.yml#audit",
+      ".github/workflows/npm-publish.yml#dry-run",
+      ".github/workflows/paper-release-sealed.yml#publication-authority",
+      ".github/workflows/paper-release-sealed.yml#publication-candidate",
+      ".github/workflows/paper-release-sealed.yml#publish",
+      ".github/workflows/paper-release.yml#paper-release",
+      ".github/workflows/paper-release.yml#publication-authority",
+      ".github/workflows/patrol-daily.yml#patrol",
+      ".github/workflows/patrol-monthly.yml#patrol",
+      ".github/workflows/patrol-observed-evidence.yml#publish",
+      ".github/workflows/patrol-weekly.yml#patrol",
+      ".github/workflows/publication-artifact.yml#publication",
+      ".github/workflows/release-candidate-promote.yml#alpha",
+      ".github/workflows/release-candidate-promote.yml#consumer-admission",
+      ".github/workflows/release-candidate-promote.yml#resolve-promotion",
+      ".github/workflows/release-candidate-promote.yml#stable",
+      ".github/workflows/release-governance-reconcile.yml#reconcile",
+      ".github/workflows/release-line-bootstrap.yml#bootstrap",
+      ".github/workflows/release-new-version.yml#buildchain-self-release",
+      ".github/workflows/release-propagation.yml#propagate",
+      ".github/workflows/release-tail.yml#release-tail",
+      ".github/workflows/release-verify.yml#try",
+      ".github/workflows/release-verify.yml#verify",
+      ".github/workflows/schedule-purge-artifacts.yml#delete-artifacts",
+      ".github/workflows/self-hosted-runner-smoke.yml#smoke",
+      ".github/workflows/stable-candidate-patrol.yml#patrol",
+      ".github/workflows/v4-adopter-delivery-dogfood.yml#dogfood",
+      ".github/workflows/v4-adopter-delivery.yml#conformance",
+      ".github/workflows/v4-adopter-delivery.yml#consumer-admission",
+      ".github/workflows/v4-public-consumer-dogfood.yml#dogfood",
+      ".github/workflows/v4-publication-rehearsal-dogfood.yml#rehearsal",
+      ".github/workflows/v4-stage-capsule-canary.yml#consumer-admission",
+      ".github/workflows/v4-stage-capsule-canary.yml#qualify",
+      ".github/workflows/v4-stage-capsule-canary.yml#reconcile",
+      ".github/workflows/v4-tail-reseal.yml#plan",
+      ".github/workflows/v4-tail-reseal.yml#platforms",
+      ".github/workflows/v4-tail-reseal.yml#seal",
+      ".github/workflows/verify.yml#check",
+      ".github/workflows/verify.yml#stage-capsule-checkpoints"
+    ]
+  },
+  "declarations": []
+}

package/architecture/decisions/0002-next-development-transition.md

@@ -0,0 +1,101 @@
+---
+status: accepted
+period: 2026-08-11
+theme: next-development-transition
+doc_type: architecture-decision-record
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-08-11
+---
+
+# ADR 0002: Alpha Publication and Next-development Are Separate Transactions
+
+## Status
+
+Accepted. This decision is normative for Buildchain promotion controllers and
+for generated consumer guidance.
+
+## Context
+
+An Alpha publication and preparation of the following development version have
+different trust boundaries. Alpha publication establishes public, immutable
+facts about version N. Preparing N+1 changes repository version material and
+may require a protected pull request or an upstream anchor that does not exist
+when Alpha N completes. Treating both operations as one success condition makes
+a post-publication conflict appear to invalidate a publication that already
+succeeded, and encourages retries to move Alpha refs while repairing Dev.
+
+Buildchain supports two legal version models:
+
+- `semver` with `next = "auto"`, where N+1 increments the Alpha sequence on
+  the same semantic patch; and
+- `anchored` with `next = "manual"`, where no version may be inferred before a
+  declared anchor manifest is materialized and rooted.
+
+The crossed combinations `semver/manual` and `anchored/auto` have no defined
+meaning and are rejected.
+
+## Decision
+
+Alpha publication reaches its own terminal success before a next-development
+transition is created. The transition records the completed Alpha exact tag,
+release commit, tree, publication evidence root, and completion time. A
+deterministic idempotency key covers that completed-Alpha root together with
+the repository, legal version model, and the role-separated adapter path set.
+
+The independent next-development state machine is:
+
+```text
+planned ----------------------> materialized -> pr-pending -> merged -> verified
+   \                              \---------------------------> merged
+    -> waiting-anchor ----------> materialized
+```
+
+`semver/auto` derives its target while planned. `anchored/manual` remains in
+`waiting-anchor` until an exact semantic version and the digest of the declared
+anchor manifest are supplied. `pr-pending` is durable incomplete state, not a
+publication failure. Direct materialization may proceed to `merged` or
+`verified` when repository governance does not require a pull request.
+
+Every non-initial state transition is compare-and-swap guarded and rooted in
+explicit evidence. Replaying an identical request is a no-op. Alpha outcome is
+always `preserved-success`; no transition may write an Alpha branch, exact tag,
+or floating tag. A controller that needs to repair next-development state may
+write only paths declared by `version.files` and `version.derived_files`; the
+configured anchor manifest is declared read-only authority.
+
+## Local adapter boundary
+
+The reference adapter is provider-neutral. It reads the checked-in
+`buildchain.toml`, derives the sorted path allowlist, validates the completed
+Alpha and optional anchor, and plans version-file content. It never invokes Git,
+network clients, lifecycle commands, package registries, or provider APIs.
+Mutation requires explicit `--write`, rejects symlinks and path escapes, and is
+limited to configured `version.files`. The standard repository transaction
+adapter passes the exact target in `BUILDCHAIN_VERSION`, permits changes only
+to `version.files` plus `version.derived_files`, runs
+`lifecycle.version-state` when derived files are declared, and then runs
+`lifecycle.verify`. The reference writer fails closed rather than invoking
+those consumer commands because transaction execution is a separate slice.
+For anchored/manual, the consumer must
+materialize the declared manifest first; the adapter verifies its exact digest
+and does not invent or edit upstream anchor data.
+
+Preparing development state alone creates no Git tag, GitHub Release, public
+package, or release candidate.
+
+## Consequences
+
+- A completed Alpha N remains successful when N+1 waits for an anchor, a
+  protected PR, merge, or verification.
+- Retrying development preparation cannot republish Alpha N or change any
+  Alpha ref.
+- Semver and anchored consumers share one lifecycle while retaining their
+  distinct version authority.
+- Provider adapters may project pull-request identifiers and merge evidence,
+  but those observations do not become part of the local mutation authority.
+- Generated config, Agent instructions, and public documentation are checked
+  against the same constants; projection drift fails repository checks.

package/architecture/internal-capabilities.json

@@ -6,6 +6,10 @@
     "bin/internal",
     "packages/core/release-passport.js",
     "packages/core/buildchain-contract.js",
+    "packages/core/kungfu-temporal-fact.js",
+    "packages/core/buildchain-compatibility-fact.js",
+    "packages/core/buildchain-compatibility-authority.js",
+    "packages/core/buildchain-compatibility-proof.js",
     "packages/core/workflow-call-contract.js",
     "packages/core/workflow-yaml-contract.js",
     "packages/core/paper-fleet.js",
@@ -26,6 +30,9 @@
     "packages/core/release-tail-provider-plane.js",
     "packages/core/release-tail-provider-adapters.js",
     "packages/core/release-tail-compatibility.js",
+    "packages/core/v4-publication-rehearsal-capsule.js",
+    "packages/core/v4-publication-rehearsal-provider-bindings.js",
+    "packages/core/v4-publication-rehearsal.js",
     "actions/release-tail/index.js",
     "scripts/authorize-promotion-runtime-override.cjs",
     "scripts/build-contract-core.mjs",
@@ -50,6 +57,12 @@
     "crates/buildchain-v4-bridge/src/main.rs",
     "packages/core/v4-runtime-ref-resume-authority.js",
     "packages/core/v4-runtime-selector-persistence.js",
+    "packages/core/v4-tail-reseal-contract.js",
+    "packages/core/v4-tail-reseal.js",
+    "packages/core/v4-tail-reseal-github.js",
+    "packages/core/v4-tail-reseal-receipt.js",
+    "scripts/v4-tail-reseal.mjs",
+    "scripts/v4-tail-reseal-macos-rehearsal.mjs",
     "packages/core/v4-provider-operation-journal.js",
     "packages/core/v4-stage-capsule.js",
     "packages/core/v4-stage-capsule-store.js",
@@ -105,8 +118,20 @@
     "crates/buildchain-v4-contracts/src/stable_publication_fence.rs",
     "packages/core/v4-partial-mutation-recovery-qualification.js",
     "crates/buildchain-v4-contracts/src/partial_mutation_recovery.rs",
+    "packages/core/adopter-delivery-gate.js",
+    "packages/core/adopter-delivery-passport.js",
+    "packages/core/adopter-delivery-vectors.js",
+    "packages/core/buildchain-delivery-bootstrap.js",
+    "packages/core/buildchain-delivery-infrastructure.js",
+    "packages/core/buildchain-delivery-self-dogfood.js",
+    "packages/core/kfd-adopter-category-driver.js",
+    "packages/core/legacy-kfd-adopter-driver.js",
+    "packages/core/published-delivery-authority.js",
+    "packages/core/v4-adopter-delivery.js",
     "packages/core/v4-adopter-delivery-parity.js",
-    "crates/buildchain-v4-contracts/src/adopter_delivery.rs"
+    "crates/buildchain-v4-contracts/src/adopter_delivery.rs",
+    "crates/buildchain-v4-contracts/src/compatibility_facts.rs",
+    "crates/buildchain-v4-contracts/src/compatibility_facts"
   ],
   "ownershipRules": [
     {
@@ -450,6 +475,22 @@
         "docs/release-tail-provider-plane.md"
       ]
     },
+    {
+      "id": "v4-publication-rehearsal",
+      "owner": "Buildchain publication rehearsal maintainers",
+      "implementation": [
+        "packages/core/v4-publication-rehearsal-capsule.js",
+        "packages/core/v4-publication-rehearsal-provider-bindings.js",
+        "packages/core/v4-publication-rehearsal.js"
+      ],
+      "tests": ["tests/v4-publication-rehearsal.test.mjs"],
+      "contracts": [
+        "architecture/v4-publication-rehearsal-parity.json",
+        "contracts/v4-publication-rehearsal-capsule-v1.schema.json",
+        ".github/workflows/v4-publication-rehearsal-dogfood.yml",
+        "docs/v4-publication-rehearsal.md"
+      ]
+    },
     {
       "id": "v4-delivery-authority",
       "owner": "Buildchain protected delivery maintainers",
@@ -512,6 +553,65 @@
         "docs/dev-delivery-qualification-landing-adr.md"
       ]
     },
+    {
+      "id": "v4-compatibility-facts",
+      "owner": "Buildchain compatibility authority maintainers",
+      "implementation": [
+        "bin/internal/compatibility-facts-cli.mjs",
+        "packages/core/kungfu-temporal-fact.js",
+        "packages/core/buildchain-compatibility-fact.js",
+        "packages/core/buildchain-compatibility-authority.js",
+        "packages/core/buildchain-compatibility-proof.js",
+        "crates/buildchain-v4-contracts/src/compatibility_facts.rs",
+        "crates/buildchain-v4-contracts/src/compatibility_facts/encoding.rs",
+        "crates/buildchain-v4-contracts/src/compatibility_facts/fixture.rs",
+        "crates/buildchain-v4-contracts/src/compatibility_facts/lifecycle.rs",
+        "crates/buildchain-v4-contracts/src/compatibility_facts/verifier.rs"
+      ],
+      "tests": ["tests/v4-compatibility-facts.test.mjs"],
+      "contracts": [
+        "architecture/v4-compatibility-facts-parity.json",
+        "contracts/v4-compatibility-facts-v1.schema.json",
+        "contracts/fixtures/v4-compatibility-facts-v1/shared.json",
+        "dist/site/schemas/v4-compatibility-facts-v1.schema.json",
+        "docs/v4-compatibility-facts.md"
+      ]
+    },
+    {
+      "id": "v4-adopter-delivery",
+      "owner": "Buildchain adopter delivery maintainers",
+      "implementation": [
+        "bin/internal/adopter-delivery-cli.mjs",
+        "packages/core/adopter-delivery-gate.js",
+        "packages/core/adopter-delivery-passport.js",
+        "packages/core/adopter-delivery-vectors.js",
+        "packages/core/buildchain-delivery-bootstrap.js",
+        "packages/core/buildchain-delivery-infrastructure.js",
+        "packages/core/buildchain-delivery-self-dogfood.js",
+        "packages/core/kfd-adopter-category-driver.js",
+        "packages/core/legacy-kfd-adopter-driver.js",
+        "packages/core/published-delivery-authority.js",
+        "packages/core/v4-adopter-delivery.js",
+        "packages/core/v4-adopter-delivery-parity.js",
+        "crates/buildchain-v4-contracts/src/adopter_delivery.rs"
+      ],
+      "tests": [
+        "tests/v4-adopter-delivery.test.mjs",
+        "tests/v4-adopter-delivery-parity.test.mjs"
+      ],
+      "contracts": [
+        "architecture/v4-adopter-delivery-parity.json",
+        "contracts/v4-adopter-delivery-v1.schema.json",
+        "contracts/fixtures/v4-adopter-delivery-v1/archive-template.json",
+        "contracts/fixtures/v4-adopter-delivery-v1/bootstrap-positive.json",
+        "contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json",
+        "contracts/fixtures/v4-adopter-delivery-v1/gate-unknown-selector.json",
+        "contracts/fixtures/v4-adopter-delivery-v1/offline-vectors.json",
+        ".github/workflows/v4-adopter-delivery.yml",
+        ".github/workflows/v4-adopter-delivery-dogfood.yml",
+        "docs/v4-adopter-delivery.md"
+      ]
+    },
     {
       "id": "v4-architecture-governance",
       "owner": "Buildchain architecture maintainers",
@@ -526,9 +626,14 @@
         "packages/core/v4-release-activation-shadow.js",
         "packages/core/v4-stable-publication-fence.js",
         "packages/core/v4-partial-mutation-recovery-qualification.js",
-        "packages/core/v4-adopter-delivery-parity.js",
         "packages/core/v4-runtime-ref-resume-authority.js",
         "packages/core/v4-runtime-selector-persistence.js",
+        "packages/core/v4-tail-reseal-contract.js",
+        "packages/core/v4-tail-reseal.js",
+        "packages/core/v4-tail-reseal-github.js",
+        "packages/core/v4-tail-reseal-receipt.js",
+        "scripts/v4-tail-reseal.mjs",
+        "scripts/v4-tail-reseal-macos-rehearsal.mjs",
         "packages/core/v4-stage-capsule.js",
         "packages/core/v4-stage-capsule-store.js",
         "packages/core/v4-stage-capsule-local-store.js",
@@ -546,8 +651,7 @@
         "crates/buildchain-v4-contracts/src/release_activation_shadow/model.rs",
         "crates/buildchain-v4-contracts/src/release_activation_shadow/journal.rs",
         "crates/buildchain-v4-contracts/src/stable_publication_fence.rs",
-        "crates/buildchain-v4-contracts/src/partial_mutation_recovery.rs",
-        "crates/buildchain-v4-contracts/src/adopter_delivery.rs"
+        "crates/buildchain-v4-contracts/src/partial_mutation_recovery.rs"
       ],
       "tests": [
         "tests/v4-architecture.test.mjs",
@@ -561,8 +665,9 @@
         "tests/v4-stage-capsule-store.test.mjs",
         "tests/v4-platform-stage-checkpoints.test.mjs",
         "tests/v4-stage-capsule-qualification.test.mjs",
-        "tests/v4-adopter-delivery-parity.test.mjs",
-        "tests/v4-runtime-ref-resume-authority.test.mjs"
+        "tests/v4-runtime-ref-resume-authority.test.mjs",
+        "tests/v4-tail-reseal.test.mjs",
+        "tests/v4-tail-reseal-parity.test.mjs"
       ],
       "contracts": [
         "architecture/v4-architecture-constitution.md",
@@ -579,7 +684,6 @@
         "architecture/v4-stage-capsule-store-contract.json",
         "architecture/v4-platform-stage-checkpoints.json",
         "architecture/v4-stage-capsule-qualification.json",
-        "architecture/v4-adopter-delivery-parity.json",
         "architecture/v4-runtime-ref-resume-authority.json",
         "contracts/v4-host-contract-v1.schema.json",
         "contracts/v4-provider-operation-journal-v1.schema.json",
@@ -597,8 +701,13 @@
         "contracts/fixtures/v4-partial-mutation-recovery-v1/shared.json",
         "contracts/v4-runtime-ref-resume-authority-v1.schema.json",
         "contracts/fixtures/v4-runtime-ref-resume-authority-v1/scenario.json",
+        "architecture/v4-tail-reseal-parity.json",
+        "contracts/v4-tail-reseal-v1.schema.json",
+        "contracts/fixtures/v4-tail-reseal-v1/valid.json",
+        ".github/workflows/v4-tail-reseal.yml",
         "docs/v4-stage-capsule.md",
-        "docs/v4-runtime-ref-resume-authority.md"
+        "docs/v4-runtime-ref-resume-authority.md",
+        "docs/v4-tail-reseal.md"
       ]
     }
   ]