@kungfu-tech/buildchain 4.0.1-alpha.5 → 4.0.1-alpha.55

package/docs/dev-delivery-warrant.md

@@ -8,7 +8,7 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-08-13
+last_reviewed: 2026-08-17
 ai_provenance:
   model_family: GPT-5
   product: Codex
@@ -60,21 +60,45 @@ state, event, or evidence drift fails closed.
 
 The reusable terminal controller classifies authoritative completion,
 cancellation, supersession, native failure, and transient dequeue separately.
-`dequeued` alone never clears an active Warrant: a fresh holder continues with
-the same generation and token, while an expired holder waits for proof that its
-fenced worker stopped. Queued work may still settle as dequeued because it never
-started native execution. The controller uses one `settle` operation for active,
-queued, already-terminal, and never-admitted pull requests. An active Warrant
-still requires its exact fence and evidence. A matching queued cancellation is
-persisted normally. A duplicate terminal event or a pull request that never
-entered Warrant authority returns a rooted explicit no-op instead of failing
-the workflow or inventing queue state.
+`dequeued` retains only a provisional Warrant whose native worker may still be
+running: a fresh holder continues with the same generation and token, while an
+expired holder waits for proof that its fenced worker stopped. A qualified or
+historical phase-less holder has no unproven native worker to fence, so its exact
+dequeue closes atomically and persists the rooted queued-successor wake. Queued
+work may also settle as dequeued because it never started native execution. The
+controller uses one `settle` operation for active, queued, already-terminal,
+and never-admitted pull requests. An active Warrant still requires its exact
+fence and evidence. A matching queued cancellation is persisted normally. A
+duplicate terminal event replays the persisted wake, while a pull request that
+never entered Warrant authority returns a rooted explicit no-op instead of
+failing the workflow or inventing queue state.
 
 The supported priority classes are `ordinary`, `expedited`, and `emergency`.
 The queue does not infer an emergency: callers must choose it explicitly under
 their reviewed policy. Delivery classes are `non-native-fast`,
 `native-proof-required`, `cross-platform`, and `release`.
 
+## CI lane change budget
+
+`architecture/ci-lane-change-budget.json` pins the exact protected-Dev cut
+that predates lane-budget enforcement. `scripts/check-ci-lane-change-budget.mjs`
+compares the current workflow job set with that cut on every repository check.
+Legacy jobs remain readable without invented metadata, while every newly added
+job fails closed until its exact `<workflow>#<job>` lane declares:
+
+- merge or non-merge authority class;
+- trigger class;
+- concurrency scope and `cancel-in-progress` behavior;
+- expected runner-minutes per run;
+- cancellation/settlement behavior; and
+- merge-critical SLO impact, expected contribution, metric, and rationale.
+
+The guard is repository policy only. It does not become another required
+GitHub status, acquire merge-queue authority, or relax Delivery Warrant,
+exact-head, approval, required-check, and protected-ref enforcement. A removed
+lane must also remove its declaration, so stale budget records cannot conceal
+workflow drift.
+
 A release-blocker candidate may additionally carry a rooted priority claim
 created from a settled Release Train dual landing. The claim binds the exact
 Assignment, Initiative, repair, prior and successor cuts, candidate generation,