@kungfu-tech/buildchain 4.0.1-alpha.5 → 4.0.1-alpha.55

package/docs/publish-transaction.md

@@ -97,6 +97,13 @@ state for `vX.Y.Z-alpha.N` and cannot resume it with the same transaction
 identity, alpha version selection must advance to the next prerelease instead
 of reusing or overwriting that failed transaction slot.
 
+The immutable `publish-gate/{alpha,release}/.../<version>` source lock also
+reserves its exact version when a failure happens before durable transaction
+state can be created. A later candidate with a different source SHA advances to
+the next version; it never rebinds or overwrites the earlier source lock. The
+same source SHA reuses its own lock so authority planning and mutation stay on
+one exact version.
+
 `release-candidate-promote.yml` can establish or restore this state from an
 older successful candidate run through the documented fresh-event recovery
 inputs. The recovery receipt and sealed bundle are verified before the action
@@ -251,10 +258,10 @@ Example reused OCI evidence entry (the pre-publish requirement may omit
 
 Buildchain distinguishes two npm release modes:
 
-| Mode | Use | Auth | npm operation |
-| --- | --- | --- | --- |
-| `publish-final-version` | normal alpha or stable publication | `trusted-publishing` | `npm publish --tag <alpha|vX.Y-alpha|latest>` |
-| `promote-existing-version` | same-version alpha-to-latest recovery | `npm-token` | `npm dist-tag add <pkg>@<version> latest` |
+| Mode                       | Use                                   | Auth                 | npm operation                                   |
+| -------------------------- | ------------------------------------- | -------------------- | ----------------------------------------------- |
+| `publish-final-version`    | normal alpha or stable publication    | `trusted-publishing` | `npm publish --tag <alpha\|vX.Y-alpha\|latest>` |
+| `promote-existing-version` | same-version alpha-to-latest recovery | `npm-token`          | `npm dist-tag add <pkg>@<version> latest`       |
 
 The normal libnode path is `publish-final-version`: publish an alpha package set
 such as `22.22.3-kf.3-alpha.0` with the `alpha` dist-tag, then publish a

package/docs/release-candidate.md

@@ -234,6 +234,13 @@ restored sealed bundle, and a conflicting payload digest fails closed. Ordinary
 duplicate publication without a complete recovery receipt retains the stricter
 same-name/same-digest rule for all assets.
 
+If that explicit complete recovery finds that the public Release Passport is
+absent, it may restore the complete locally verified evidence closure. Before
+the first upload, Buildchain rejects undeclared remote assets and compares every
+same-name remote asset byte-for-byte; any unknown name or digest conflict fails
+closed without mutation. Ordinary duplicate publication cannot enter this
+repair path.
+
 After a transaction finalizes, the target branch can legitimately advance from
 the original promotion SHA. Repeating explicit recovery accepts that movement
 only when the caller supplies the exact durable transaction identity, the

package/docs/release-tail-provider-plane.md

@@ -38,6 +38,36 @@ inspects, verifies, and diagnoses bounded v3 compatibility using the same core
 transaction format. The reusable workflow checks out an exact Buildchain ref
 and invokes the packaged Action; callers cannot inject an execution command.
 
+The reusable workflow is permission-neutral: it inherits the calling job's
+GitHub token permissions and never elevates them. A rehearsal caller can remain
+`contents: read` and must pass `execute: false`. An effectful production caller
+owns and declares its provider authority explicitly:
+
+<!-- release-tail-production-caller-contract -->
+
+```yaml
+name: Production release tail
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release-tail:
+    permissions:
+      contents: write
+    uses: kungfu-systems/buildchain/.github/workflows/release-tail.yml@<exact-buildchain-sha>
+    with:
+      buildchain-ref: <exact-buildchain-sha>
+      declaration-path: .buildchain/release-tail/declaration.json
+      provider-bindings-path: .buildchain/release-tail/provider-bindings.json
+      execute: true
+```
+
+Omitting caller write authority cannot be repaired by the reusable workflow;
+GitHub rejects or constrains the call before provider execution. `execute:
+false` remains a plan/rehearsal boundary and does not authorize production
+mutation even when a caller token has broader ambient permissions.
+
 ## Inputs and secrets
 
 The declaration follows

package/docs/v4-adopter-delivery.md

@@ -0,0 +1,152 @@
+---
+status: preview
+period: 2026-08-27
+theme: buildchain-v4-adopter-delivery
+doc_type: product-manual
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-08-27
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-27
+  visible_context: Exact protected v3 adopter-delivery cut, v4 pure contract core, published npm archive bytes, public consumer policy, complete v3 capability inventory, and rooted cross-platform qualification reports.
+  invisible_context_boundary: No credentials, provider mutations, signing operations, publication operations, or release authority were used.
+---
+
+# V4 Public Adopter Delivery
+
+Buildchain v4 carries the v3 adopter-delivery capability through a public,
+protocol-neutral boundary. Consumers select an exact protocol driver and
+artifact profile, retain the rooted gate result, and independently recompute
+that readback. Buildchain does not interpret a protocol owned by another
+project and a passing result never grants runtime, provider, signing,
+publication, or release authority.
+
+The parity source is the read-only protected cut
+`dev/v3/v3.0@6b96bdad8d9f8ccf9275f27d9370a226a9c78465`. Work began from the
+minimal v4 absorption base
+`dev/v4/v4.0@e5611377efc03178f8687d99968cfdfa3ce2825b` and absorbed the
+verified protected-base advances through
+`dev/v4/v4.0@e0342713c7447960c13bd73377282b2e93f4853d` before delivery. These
+identities, the v3 vector-suite root, and the KFD package cut are committed in
+[`v4-adopter-delivery-parity.json`](../architecture/v4-adopter-delivery-parity.json)
+and exposed by the public Node API.
+
+## Public contract
+
+The JSON input schema is
+[`v4-adopter-delivery-v1.schema.json`](../contracts/v4-adopter-delivery-v1.schema.json).
+An input names both selectors and the exact request identities. A selector
+whose implementation identity differs from the request fails closed. The
+public selectors are `json-assertion`, `kfd-category`, and `legacy-kfd`, with
+`git-commit` and `package` artifact profiles.
+
+Applications can also import the lower-level driver interface from
+`@kungfu-tech/buildchain/adopter-delivery-gate` and define an isolated driver.
+The v4 convenience runtime, exact source declaration, readback verification,
+N-1 lineage check, and published archive loader are exported from
+`@kungfu-tech/buildchain/v4-adopter-delivery`.
+
+## CLI
+
+All four operations are offline after the declared archive bytes exist:
+
+```sh
+buildchain adopter-delivery run \
+  --input contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json \
+  --output .buildchain/adopter-delivery/readback.json
+
+buildchain adopter-delivery verify \
+  --input contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json \
+  --readback .buildchain/adopter-delivery/readback.json
+
+buildchain adopter-delivery bootstrap \
+  --input contracts/fixtures/v4-adopter-delivery-v1/bootstrap-positive.json
+
+buildchain adopter-delivery archive \
+  --input contracts/fixtures/v4-adopter-delivery-v1/archive-template.json
+```
+
+`verify` requires the complete rooted readback and recomputes it. Missing or
+substituted readback, unknown selector, unknown driver, protocol-version
+mismatch, archive-byte or package-identity mismatch, and altered bootstrap
+lineage all fail closed.
+
+## N-1 and published archives
+
+N-1 bootstrap is distinct from the candidate. The lineage wrapper requires
+the exact v3 authority commit, exact v4 absorption base, and exact public
+Buildchain archive root. The retained v3 bootstrap also requires protected and
+published N-1 authority, rejects self-authorization, binds the candidate gate
+artifact, and requires merged Warrant-shaped evidence. Protocol, profile, or
+gate changes require independently reviewed transition evidence.
+
+Published authority loading verifies compressed bytes before extraction,
+rejects unsafe paths and links, verifies extracted package identity, verifies
+KFD's semantic package root, and imports only declared public delivery modules.
+The caller must supply an independently retained authority readback root. The
+fixture binds `@kungfu-tech/buildchain@3.0.9-alpha.16` and
+`@kungfu-tech/kfd@1.0.0-alpha.65`; a package version is not treated as proof of
+the Git source cut.
+
+## Config and reusable workflow
+
+Consumer configuration is closed and repository-relative:
+
+```toml
+[adopter_delivery]
+contract = "kungfu-buildchain-v4-adopter-delivery/v1"
+input_path = "contracts/adopter-delivery/input.json"
+readback_path = ".buildchain/adopter-delivery/readback.json"
+bootstrap_path = "contracts/adopter-delivery/bootstrap.json"
+archive_path = "contracts/adopter-delivery/archives.json"
+result_path = ".buildchain/adopter-delivery/result.json"
+driver_selector = "kfd-category"
+artifact_profile_selector = "package"
+```
+
+The public reusable workflow is
+`kungfu-systems/buildchain/.github/workflows/v4-adopter-delivery.yml@v4` for
+stable use and `@v4-alpha` during prerelease evaluation. It resolves the exact
+called-workflow SHA, enforces floating selector plus dual-lock consumer
+admission, and runs the same CLI on Linux, macOS, and Windows. Buildchain
+dogfoods it through the thin
+[`v4-adopter-delivery-dogfood.yml`](../.github/workflows/v4-adopter-delivery-dogfood.yml)
+caller, which contains no steps or local orchestration and persists only the
+floating `@v4-alpha` selector.
+
+The reusable workflow downloads exact public N-1 npm archives and uses the
+committed byte roots, semantic identity, and authority readback root. It has
+only `contents: read`; no provider credential or production writer is accepted
+or synthesized.
+
+## Cross-platform capability qualification
+
+The reusable workflow also produces a rooted report on `linux-x64`,
+`macos-arm64`, and `windows-x64`. Each report binds `job.workflow_sha`, the
+consumer source SHA, and the complete 4,648-row v3-to-v4 inventory. Source-only
+capabilities retain their raw category counts with an `exact-source-route`
+applicability; they are not mislabeled as operating-system executions.
+
+The executable boundary is exercised rather than inferred: a public run must
+pass, a substituted readback must fail, retry must reproduce the original root,
+terminal verification and N-1 bootstrap must pass, and the independent
+`ledger-specification-driver` clean-room test must pass without a KFD package.
+The workflow then reconciles one exact report from each platform. Final family
+qualification combines the Buildchain self-dogfood and `agent-hub-demo`
+matrices through the exported
+`@kungfu-tech/buildchain/v4-cross-platform-adopter-qualification` aggregator.
+The report and aggregate explicitly grant no production, provider, release, or
+stable-publication authority.
+
+## Offline vectors
+
+[`offline-vectors.json`](../contracts/fixtures/v4-adopter-delivery-v1/offline-vectors.json)
+indexes positive driver, N-1, and archive cases plus negative selector, driver,
+archive identity, bootstrap lineage, protocol version, and tampered readback
+cases. Tests synthesize archives locally so extraction and identity failures do
+not depend on the network.

package/docs/v4-declarative-release-tail-migration.md

@@ -0,0 +1,43 @@
+---
+status: active
+period: ongoing
+theme: buildchain-v4-declarative-release-tail
+doc_type: migration-guide
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-08-26
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-26
+  invisible_context: unavailable
+---
+
+# Migrate a release-candidate promotion to the v4 Provider Plane
+
+Persist the public workflow call at the floating major ref and keep the matching contract lock in the consumer repository:
+
+```yaml
+jobs:
+  promote:
+    uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4
+    with:
+      buildchain-contract-lock-path: .buildchain/contract-lock.json
+      declarative-release-tail: true
+```
+
+The Build/Verify workflow now uploads these candidate-owned inputs together:
+
+- `release-candidate-passport.json`
+- `release-candidate-stage-capsules.json`
+- `release-candidate-publication-qualification.json`
+- the typed payload and manifest artifacts bound by those documents
+
+Remove all v4 values for `publish-command`, `publication-gate-command`, `publication-consumer-qualification-command`, `publication-commit-command`, `release-activation-command`, `release-passport-evidence-command`, KFD/invariant command inputs, and every other `command`, `cmd`, `script`, `shell`, or `run` field. v4 admission rejects them before publication planning. Do not replace them with a wrapper script or a standalone workflow; declare provider evidence and let the reusable workflow execute the fixed Provider Plane.
+
+On interruption, rerun with the same candidate and transaction state. Buildchain verifies the candidate/source/artifact/policy roots and continues from the first missing standardized receipt. Never delete the state file to make a failed capability replay from the beginning.
+
+v3 workflow calls retain their existing command-compatible behavior. Migrating a v3 consumer is an explicit contract change, not an automatic reinterpretation.

package/docs/v4-publication-rehearsal.md

@@ -0,0 +1,130 @@
+---
+status: preview
+period: 2026-08-16
+theme: buildchain-v4-publication-rehearsal
+doc_type: product-manual
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-08-16
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-16
+  visible_context: Exact v3 rehearsal runtime, v4 release-tail core, Stage Capsule contracts, public workflow and offline vectors.
+  invisible_context_boundary: No credentials, private provider state, signed URLs or production publication receipts were read.
+---
+
+# V4 Publication Rehearsal Capsule
+
+The v4 Publication Rehearsal Capsule is the content-addressed input for
+testing publication behavior without acquiring production publication
+authority. It is deliberately not a Stage Capsule. A Stage Capsule retains a
+pure platform-stage build checkpoint; a Publication Rehearsal Capsule binds a
+release candidate and asks the production release-tail planner and executor to
+simulate, replay, or observe provider-facing publication behavior.
+
+The rooted parity matrix is
+[`architecture/v4-publication-rehearsal-parity.json`](../architecture/v4-publication-rehearsal-parity.json),
+and the public schema is
+[`v4-publication-rehearsal-capsule-v1.schema.json`](../contracts/v4-publication-rehearsal-capsule-v1.schema.json).
+
+## Bound identity
+
+One capsule commits to all of these values:
+
+- its own canonical capsule root;
+- the exact source repository, Git revision, and source root;
+- the sorted candidate file inventory and candidate root;
+- the exact candidate manifest and Buildchain config paths and roots;
+- the canonical data-only provider bindings and `providerBindingsRoot`;
+- the effect-disabled provider policy and its exact capability/adapter set;
+- expected provider observations and their root;
+- the initial transaction produced by the production release-tail planner;
+- `buildchain.release-tail/v1` as the shared core version.
+
+Changing any one of those values, or changing a candidate byte, fails closed.
+Candidate paths must remain regular non-symlink files below an explicit
+absolute root. Every artifact, provider document, and released-evidence input
+named by the bindings must also appear in the rooted file inventory. The
+evidence output may be absent, but its path and every existing ancestor must
+remain below that root without symlinks.
+
+## Modes and authority
+
+`simulate` uses in-memory adapters and makes no provider call. `replay` feeds a
+recorded response sequence through the same production transaction executor.
+`provider` requires a capsule-bound
+`buildchain-v4-publication-rehearsal-authority/v1` receipt plus the declared
+provider adapters. The authority binds `providerBindingsRoot` directly as well
+as through `capsuleRoot`, so request bytes cannot be replaced while retaining
+authority. It is rehearsal-only: its
+`productionAuthority` field is always `false`, and it binds a separately
+supplied live `authorizationRoot` rather than minting authority from the
+capsule alone.
+
+Every provider readback and apply request is retained in the rooted transcript.
+The resulting evidence always contains `productionAuthority: false` and
+`releasePassport: null`. It therefore cannot publish by itself, authorize a
+production release tail, or stand in for a Release Passport, protected
+readback, or Delivery Warrant.
+
+## CLI and Node API
+
+Local simulation and replay use the public `release-tail` command:
+
+```sh
+buildchain release-tail rehearse \
+  --capsule "$PWD/contracts/fixtures/v4-publication-rehearsal-v1/capsule.json" \
+  --candidate-root "$PWD/contracts/fixtures/v4-publication-rehearsal-v1/candidate" \
+  --mode simulate \
+  --state "$PWD/.buildchain/publication-rehearsal/state.json" \
+  --evidence "$PWD/.buildchain/publication-rehearsal/evidence.json"
+```
+
+Applications import `@kungfu-tech/buildchain/v4-publication-rehearsal` to
+create and verify capsules, create provider-rehearsal authority, and execute
+all three modes. The API delegates planning, transaction initialization, and
+execution to the same `release-tail-provider-plane` functions used by the
+production Action.
+
+## Config and public workflow
+
+The consumer config is closed and effect-disabled:
+
+```toml
+[publication_rehearsal]
+contract = "buildchain-v4-publication-rehearsal-capsule/v1"
+capsule_path = "contracts/fixtures/v4-publication-rehearsal-v1/capsule.json"
+candidate_root = "contracts/fixtures/v4-publication-rehearsal-v1/candidate"
+state_path = ".buildchain/publication-rehearsal/state.json"
+evidence_path = ".buildchain/publication-rehearsal/evidence.json"
+effect_default = "disabled"
+```
+
+The public reusable
+[`release-tail.yml`](../.github/workflows/release-tail.yml) accepts the same
+capsule, candidate root, mode, state and evidence paths. Before publication,
+Buildchain dogfoods that public surface through a thin same-commit local reusable
+call with the exact PR-head or dispatch SHA as its runtime. The reusable is
+permission-neutral and the self-dogfood caller stays `contents: read`, passes
+`execute: false`, and therefore cannot inherit or synthesize production write
+authority. Effectful production callers must explicitly declare their own
+provider permission. Durable external consumers remain on the floating
+`@v4-alpha` contract. Provider mode additionally requires the exact authority
+path. Provider bindings come from the capsule; an optional external bindings
+input is accepted only when its canonical exact root and payload equal the
+capsule binding. Ordinary calls default to `simulate`.
+
+## Offline portability vectors
+
+[`offline-vectors.json`](../contracts/fixtures/v4-publication-rehearsal-v1/offline-vectors.json)
+records Linux, macOS and Windows projections. Their capsule, transaction,
+state, and evidence roots are byte-identical. Regenerate or verify them with:
+
+```sh
+node scripts/v4-publication-rehearsal-fixture.mjs
+node scripts/v4-publication-rehearsal-fixture.mjs --check
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.1-alpha.5",
+  "version": "4.0.1-alpha.55",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -25,6 +25,7 @@
     "./buildchain-contract": "./packages/core/buildchain-contract.js",
     "./compatibility-fact-authority": "./packages/core/buildchain-compatibility-proof.js",
     "./candidate-timeline": "./packages/core/candidate-timeline.js",
+    "./ci-lane-change-budget": "./packages/core/ci-lane-change-budget.js",
     "./channel-candidate": "./packages/core/channel-candidate.js",
     "./cache-evidence": "./packages/core/cache-evidence.js",
     "./controller-evidence": "./packages/core/controller-evidence.js",
@@ -46,6 +47,21 @@
     "./v4-runtime-ref-resume-authority": "./packages/core/v4-runtime-ref-resume-authority.js",
     "./v4-tail-reseal": "./packages/core/v4-tail-reseal.js",
     "./v4-tail-reseal-receipt": "./packages/core/v4-tail-reseal-receipt.js",
+    "./v4-publication-rehearsal": "./packages/core/v4-publication-rehearsal.js",
+    "./publication-rehearsal-runtime": "./packages/core/publication-rehearsal-runtime.js",
+    "./publication-rehearsal-projection": "./packages/core/publication-rehearsal-projection.js",
+    "./v4-publication-qualification": "./packages/core/v4-publication-qualification.js",
+    "./adopter-delivery-gate": "./packages/core/adopter-delivery-gate.js",
+    "./kfd-adopter-category-driver": "./packages/core/kfd-adopter-category-driver.js",
+    "./buildchain-delivery-infrastructure": "./packages/core/buildchain-delivery-infrastructure.js",
+    "./buildchain-delivery-bootstrap": "./packages/core/buildchain-delivery-bootstrap.js",
+    "./buildchain-delivery-self-dogfood": "./packages/core/buildchain-delivery-self-dogfood.js",
+    "./published-delivery-authority": "./packages/core/published-delivery-authority.js",
+    "./legacy-kfd-adopter-driver": "./packages/core/legacy-kfd-adopter-driver.js",
+    "./adopter-delivery-passport": "./packages/core/adopter-delivery-passport.js",
+    "./adopter-delivery-vectors": "./packages/core/adopter-delivery-vectors.js",
+    "./v4-adopter-delivery": "./packages/core/v4-adopter-delivery.js",
+    "./v4-cross-platform-adopter-qualification": "./packages/core/v4-cross-platform-adopter-qualification.js",
     "./logging": "./packages/core/logging.js",
     "./portable-dev-cache": "./packages/core/portable-dev-cache.js",
     "./publication-artifact": "./packages/core/publication-artifact.js",
@@ -99,6 +115,10 @@
     "./site/schemas/kfd-support-projection-v1.schema.json": "./dist/site/schemas/kfd-support-projection-v1.schema.json",
     "./site/schemas/dev-delivery-authority-v2.schema.json": "./dist/site/schemas/dev-delivery-authority-v2.schema.json",
     "./site/schemas/v4-compatibility-facts-v1.schema.json": "./dist/site/schemas/v4-compatibility-facts-v1.schema.json",
+    "./site/schemas/v4-publication-rehearsal-capsule-v1.schema.json": "./dist/site/schemas/v4-publication-rehearsal-capsule-v1.schema.json",
+    "./site/schemas/v4-adopter-delivery-v1.schema.json": "./dist/site/schemas/v4-adopter-delivery-v1.schema.json",
+    "./site/schemas/release-tail-capabilities-v1.schema.json": "./dist/site/schemas/release-tail-capabilities-v1.schema.json",
+    "./site/schemas/v4-publication-qualification-v1.schema.json": "./dist/site/schemas/v4-publication-qualification-v1.schema.json",
     "./site/buildchain-contract.json": "./dist/site/buildchain-contract.json",
     "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
     "./site/release-provenance.json": "./dist/site/release-provenance.json",
@@ -136,10 +156,10 @@
   "scripts": {
     "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/v4-delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery-authority-candidate.js packages/core/dev-delivery-authority-evidence.js packages/core/dev-delivery-authority-landing.js packages/core/dev-delivery-authority-observation.js packages/core/dev-delivery-authority-qualification.js packages/core/dev-delivery-authority-settlement.js packages/core/dev-delivery-authority-state.js packages/core/dev-delivery-execution-failure.js packages/core/dev-delivery-execution-transfer.js packages/core/dev-delivery-landing-readback.js packages/core/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery-landing-testing-port.js packages/core/dev-delivery-native-execution.js packages/core/dev-delivery-native-proof.js packages/core/dev-delivery-process-boundary.js packages/core/dev-delivery-warrant-qualification.js packages/core/dev-delivery-warrant-state.js scripts/dev-delivery-authority-command-adapters.mjs scripts/dev-delivery-authority-provider.mjs scripts/dev-delivery-authority.mjs scripts/dev-delivery-native-run.mjs scripts/dev-delivery-process-boundary.mjs scripts/dev-delivery-two-phase-resume.mjs scripts/dev-delivery-two-phase.mjs scripts/dev-delivery-warrant-options.mjs scripts/dev-delivery-warrant-store.mjs templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:static && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
-    "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs bin/internal/compatibility-facts-cli.mjs packages/core/v4-canonical-contracts.js packages/core/kungfu-temporal-fact.js packages/core/buildchain-compatibility-fact.js packages/core/buildchain-compatibility-authority.js packages/core/buildchain-compatibility-proof.js packages/core/v4-floating-consumer-evidence.js packages/core/v4-floating-consumer-policy.js packages/core/v4-floating-consumer-release-passport.js packages/core/v4-runtime-ref-resume-authority.js packages/core/v4-tail-reseal-contract.js packages/core/v4-tail-reseal-github.js packages/core/v4-tail-reseal-receipt.js packages/core/v4-tail-reseal.js packages/core/v4-runtime-selector-persistence.js packages/core/v4-provider-operation-journal.js packages/core/v4-provider-readback-idempotency.js packages/core/v4-release-activation-shadow.js packages/core/v4-stable-publication-fence.js packages/core/v4-partial-mutation-recovery-qualification.js packages/core/v4-stage-capsule.js packages/core/v4-stage-capsule-store.js packages/core/v4-stage-capsule-local-store.js packages/core/v4-platform-stage-checkpoints.js packages/core/v4-stage-capsule-resume-planner.js packages/core/v4-stage-capsule-qualification.js packages/core/v4-stage-capsule-qualification-campaign.js packages/core/v4-delivery-warrant-fixture-runner.js packages/core/v4-delivery-warrant-read-candidate.js packages/core/v4-delivery-warrant-semantic-diff-gate.js packages/core/v4-delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/dev-pr-prequeue-guard.mjs scripts/check-v4-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/v4-bridge-bootstrap.mjs scripts/v4-bridge-evidence.mjs scripts/v4-consumer-policy.mjs scripts/v4-host-adapter.mjs scripts/v4-platform-stage-checkpoint-rehearsal.mjs scripts/v4-stage-capsule-resume-rehearsal.mjs scripts/v4-stage-capsule-qualification.mjs scripts/v4-tail-reseal-macos-rehearsal.mjs scripts/v4-tail-reseal.mjs scripts/v4-warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs tests/v4-bridge.test.mjs tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs tests/v4-warrant-shadow-plan.test.mjs",
+    "check": "pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-v4-runtime-semantic-closure.mjs && node scripts/check-v3-v4-capability-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-publication-rehearsal-fixture.mjs --check && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs bin/internal/compatibility-facts-cli.mjs packages/core/v4-canonical-contracts.js packages/core/kungfu-temporal-fact.js packages/core/buildchain-compatibility-fact.js packages/core/buildchain-compatibility-authority.js packages/core/buildchain-compatibility-proof.js packages/core/v4-floating-consumer-evidence.js packages/core/v4-floating-consumer-policy.js packages/core/v4-floating-consumer-release-passport.js packages/core/v4-runtime-ref-resume-authority.js packages/core/v4-tail-reseal-contract.js packages/core/v4-tail-reseal-github.js packages/core/v4-tail-reseal-receipt.js packages/core/v4-tail-reseal.js packages/core/v4-runtime-selector-persistence.js packages/core/v4-provider-operation-journal.js packages/core/v4-provider-readback-idempotency.js packages/core/v4-release-activation-shadow.js packages/core/v4-stable-publication-fence.js packages/core/v4-partial-mutation-recovery-qualification.js packages/core/v4-stage-capsule.js packages/core/v4-stage-capsule-store.js packages/core/v4-stage-capsule-local-store.js packages/core/v4-platform-stage-checkpoints.js packages/core/v4-stage-capsule-resume-planner.js packages/core/v4-stage-capsule-qualification.js packages/core/v4-stage-capsule-qualification-campaign.js packages/core/v4-delivery-warrant-fixture-runner.js packages/core/v4-delivery-warrant-read-candidate.js packages/core/v4-delivery-warrant-semantic-diff-gate.js packages/core/v4-delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-v4-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/dev-pr-prequeue-guard.mjs scripts/check-v4-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/v4-bridge-bootstrap.mjs scripts/v4-bridge-evidence.mjs scripts/v4-consumer-policy.mjs scripts/v4-host-adapter.mjs scripts/v4-platform-stage-checkpoint-rehearsal.mjs scripts/v4-stage-capsule-resume-rehearsal.mjs scripts/v4-stage-capsule-qualification.mjs scripts/v4-tail-reseal-macos-rehearsal.mjs scripts/v4-tail-reseal.mjs scripts/v4-warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs tests/v4-bridge.test.mjs tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-runtime-semantic-closure.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs tests/v4-warrant-shadow-plan.test.mjs",
     "check:v4-bridge": "cargo fmt --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml",
-    "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
+    "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-publication-rehearsal.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
     "check:workflows": "bash scripts/check-workflows.sh",
     "generate:reference": "node scripts/generate-public-reference.mjs",
     "check:reference": "node scripts/generate-public-reference.mjs --check",