@kungfu-tech/buildchain 4.0.1-alpha.5 → 4.0.1-alpha.8

package/docs/release-tail-provider-plane.md

@@ -38,6 +38,36 @@ inspects, verifies, and diagnoses bounded v3 compatibility using the same core
 transaction format. The reusable workflow checks out an exact Buildchain ref
 and invokes the packaged Action; callers cannot inject an execution command.
 
+The reusable workflow is permission-neutral: it inherits the calling job's
+GitHub token permissions and never elevates them. A rehearsal caller can remain
+`contents: read` and must pass `execute: false`. An effectful production caller
+owns and declares its provider authority explicitly:
+
+<!-- release-tail-production-caller-contract -->
+
+```yaml
+name: Production release tail
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release-tail:
+    permissions:
+      contents: write
+    uses: kungfu-systems/buildchain/.github/workflows/release-tail.yml@<exact-buildchain-sha>
+    with:
+      buildchain-ref: <exact-buildchain-sha>
+      declaration-path: .buildchain/release-tail/declaration.json
+      provider-bindings-path: .buildchain/release-tail/provider-bindings.json
+      execute: true
+```
+
+Omitting caller write authority cannot be repaired by the reusable workflow;
+GitHub rejects or constrains the call before provider execution. `execute:
+false` remains a plan/rehearsal boundary and does not authorize production
+mutation even when a caller token has broader ambient permissions.
+
 ## Inputs and secrets
 
 The declaration follows

package/docs/v4-adopter-delivery.md

@@ -0,0 +1,133 @@
+---
+status: preview
+period: 2026-08-16
+theme: buildchain-v4-adopter-delivery
+doc_type: product-manual
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-08-16
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-16
+  visible_context: Exact protected v3 adopter-delivery cut, v4 pure contract core, published npm archive bytes, and public consumer policy.
+  invisible_context_boundary: No credentials, provider mutations, signing operations, publication operations, or release authority were used.
+---
+
+# V4 Public Adopter Delivery
+
+Buildchain v4 carries the v3 adopter-delivery capability through a public,
+protocol-neutral boundary. Consumers select an exact protocol driver and
+artifact profile, retain the rooted gate result, and independently recompute
+that readback. Buildchain does not interpret a protocol owned by another
+project and a passing result never grants runtime, provider, signing,
+publication, or release authority.
+
+The parity source is the read-only protected cut
+`dev/v3/v3.0@6b96bdad8d9f8ccf9275f27d9370a226a9c78465`. Work began from the
+minimal v4 absorption base
+`dev/v4/v4.0@e5611377efc03178f8687d99968cfdfa3ce2825b` and absorbed the
+verified protected-base advances through
+`dev/v4/v4.0@e0342713c7447960c13bd73377282b2e93f4853d` before delivery. These
+identities, the v3 vector-suite root, and the KFD package cut are committed in
+[`v4-adopter-delivery-parity.json`](../architecture/v4-adopter-delivery-parity.json)
+and exposed by the public Node API.
+
+## Public contract
+
+The JSON input schema is
+[`v4-adopter-delivery-v1.schema.json`](../contracts/v4-adopter-delivery-v1.schema.json).
+An input names both selectors and the exact request identities. A selector
+whose implementation identity differs from the request fails closed. The
+public selectors are `json-assertion`, `kfd-category`, and `legacy-kfd`, with
+`git-commit` and `package` artifact profiles.
+
+Applications can also import the lower-level driver interface from
+`@kungfu-tech/buildchain/adopter-delivery-gate` and define an isolated driver.
+The v4 convenience runtime, exact source declaration, readback verification,
+N-1 lineage check, and published archive loader are exported from
+`@kungfu-tech/buildchain/v4-adopter-delivery`.
+
+## CLI
+
+All four operations are offline after the declared archive bytes exist:
+
+```sh
+buildchain adopter-delivery run \
+  --input contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json \
+  --output .buildchain/adopter-delivery/readback.json
+
+buildchain adopter-delivery verify \
+  --input contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json \
+  --readback .buildchain/adopter-delivery/readback.json
+
+buildchain adopter-delivery bootstrap \
+  --input contracts/fixtures/v4-adopter-delivery-v1/bootstrap-positive.json
+
+buildchain adopter-delivery archive \
+  --input contracts/fixtures/v4-adopter-delivery-v1/archive-template.json
+```
+
+`verify` requires the complete rooted readback and recomputes it. Missing or
+substituted readback, unknown selector, unknown driver, protocol-version
+mismatch, archive-byte or package-identity mismatch, and altered bootstrap
+lineage all fail closed.
+
+## N-1 and published archives
+
+N-1 bootstrap is distinct from the candidate. The lineage wrapper requires
+the exact v3 authority commit, exact v4 absorption base, and exact public
+Buildchain archive root. The retained v3 bootstrap also requires protected and
+published N-1 authority, rejects self-authorization, binds the candidate gate
+artifact, and requires merged Warrant-shaped evidence. Protocol, profile, or
+gate changes require independently reviewed transition evidence.
+
+Published authority loading verifies compressed bytes before extraction,
+rejects unsafe paths and links, verifies extracted package identity, verifies
+KFD's semantic package root, and imports only declared public delivery modules.
+The caller must supply an independently retained authority readback root. The
+fixture binds `@kungfu-tech/buildchain@3.0.9-alpha.16` and
+`@kungfu-tech/kfd@1.0.0-alpha.65`; a package version is not treated as proof of
+the Git source cut.
+
+## Config and reusable workflow
+
+Consumer configuration is closed and repository-relative:
+
+```toml
+[adopter_delivery]
+contract = "kungfu-buildchain-v4-adopter-delivery/v1"
+input_path = "contracts/adopter-delivery/input.json"
+readback_path = ".buildchain/adopter-delivery/readback.json"
+bootstrap_path = "contracts/adopter-delivery/bootstrap.json"
+archive_path = "contracts/adopter-delivery/archives.json"
+result_path = ".buildchain/adopter-delivery/result.json"
+driver_selector = "kfd-category"
+artifact_profile_selector = "package"
+```
+
+The public reusable workflow is
+`kungfu-systems/buildchain/.github/workflows/v4-adopter-delivery.yml@v4` for
+stable use and `@v4-alpha` during prerelease evaluation. It resolves the exact
+called-workflow SHA, enforces floating selector plus dual-lock consumer
+admission, and runs the same CLI on Linux, macOS, and Windows. Buildchain
+dogfoods it through the thin
+[`v4-adopter-delivery-dogfood.yml`](../.github/workflows/v4-adopter-delivery-dogfood.yml)
+caller, which contains no steps or local orchestration and persists only the
+floating `@v4-alpha` selector.
+
+The reusable workflow downloads exact public N-1 npm archives and uses the
+committed byte roots, semantic identity, and authority readback root. It has
+only `contents: read`; no provider credential or production writer is accepted
+or synthesized.
+
+## Offline vectors
+
+[`offline-vectors.json`](../contracts/fixtures/v4-adopter-delivery-v1/offline-vectors.json)
+indexes positive driver, N-1, and archive cases plus negative selector, driver,
+archive identity, bootstrap lineage, protocol version, and tampered readback
+cases. Tests synthesize archives locally so extraction and identity failures do
+not depend on the network.

package/docs/v4-publication-rehearsal.md

@@ -0,0 +1,130 @@
+---
+status: preview
+period: 2026-08-16
+theme: buildchain-v4-publication-rehearsal
+doc_type: product-manual
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-08-16
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-16
+  visible_context: Exact v3 rehearsal runtime, v4 release-tail core, Stage Capsule contracts, public workflow and offline vectors.
+  invisible_context_boundary: No credentials, private provider state, signed URLs or production publication receipts were read.
+---
+
+# V4 Publication Rehearsal Capsule
+
+The v4 Publication Rehearsal Capsule is the content-addressed input for
+testing publication behavior without acquiring production publication
+authority. It is deliberately not a Stage Capsule. A Stage Capsule retains a
+pure platform-stage build checkpoint; a Publication Rehearsal Capsule binds a
+release candidate and asks the production release-tail planner and executor to
+simulate, replay, or observe provider-facing publication behavior.
+
+The rooted parity matrix is
+[`architecture/v4-publication-rehearsal-parity.json`](../architecture/v4-publication-rehearsal-parity.json),
+and the public schema is
+[`v4-publication-rehearsal-capsule-v1.schema.json`](../contracts/v4-publication-rehearsal-capsule-v1.schema.json).
+
+## Bound identity
+
+One capsule commits to all of these values:
+
+- its own canonical capsule root;
+- the exact source repository, Git revision, and source root;
+- the sorted candidate file inventory and candidate root;
+- the exact candidate manifest and Buildchain config paths and roots;
+- the canonical data-only provider bindings and `providerBindingsRoot`;
+- the effect-disabled provider policy and its exact capability/adapter set;
+- expected provider observations and their root;
+- the initial transaction produced by the production release-tail planner;
+- `buildchain.release-tail/v1` as the shared core version.
+
+Changing any one of those values, or changing a candidate byte, fails closed.
+Candidate paths must remain regular non-symlink files below an explicit
+absolute root. Every artifact, provider document, and released-evidence input
+named by the bindings must also appear in the rooted file inventory. The
+evidence output may be absent, but its path and every existing ancestor must
+remain below that root without symlinks.
+
+## Modes and authority
+
+`simulate` uses in-memory adapters and makes no provider call. `replay` feeds a
+recorded response sequence through the same production transaction executor.
+`provider` requires a capsule-bound
+`buildchain-v4-publication-rehearsal-authority/v1` receipt plus the declared
+provider adapters. The authority binds `providerBindingsRoot` directly as well
+as through `capsuleRoot`, so request bytes cannot be replaced while retaining
+authority. It is rehearsal-only: its
+`productionAuthority` field is always `false`, and it binds a separately
+supplied live `authorizationRoot` rather than minting authority from the
+capsule alone.
+
+Every provider readback and apply request is retained in the rooted transcript.
+The resulting evidence always contains `productionAuthority: false` and
+`releasePassport: null`. It therefore cannot publish by itself, authorize a
+production release tail, or stand in for a Release Passport, protected
+readback, or Delivery Warrant.
+
+## CLI and Node API
+
+Local simulation and replay use the public `release-tail` command:
+
+```sh
+buildchain release-tail rehearse \
+  --capsule "$PWD/contracts/fixtures/v4-publication-rehearsal-v1/capsule.json" \
+  --candidate-root "$PWD/contracts/fixtures/v4-publication-rehearsal-v1/candidate" \
+  --mode simulate \
+  --state "$PWD/.buildchain/publication-rehearsal/state.json" \
+  --evidence "$PWD/.buildchain/publication-rehearsal/evidence.json"
+```
+
+Applications import `@kungfu-tech/buildchain/v4-publication-rehearsal` to
+create and verify capsules, create provider-rehearsal authority, and execute
+all three modes. The API delegates planning, transaction initialization, and
+execution to the same `release-tail-provider-plane` functions used by the
+production Action.
+
+## Config and public workflow
+
+The consumer config is closed and effect-disabled:
+
+```toml
+[publication_rehearsal]
+contract = "buildchain-v4-publication-rehearsal-capsule/v1"
+capsule_path = "contracts/fixtures/v4-publication-rehearsal-v1/capsule.json"
+candidate_root = "contracts/fixtures/v4-publication-rehearsal-v1/candidate"
+state_path = ".buildchain/publication-rehearsal/state.json"
+evidence_path = ".buildchain/publication-rehearsal/evidence.json"
+effect_default = "disabled"
+```
+
+The public reusable
+[`release-tail.yml`](../.github/workflows/release-tail.yml) accepts the same
+capsule, candidate root, mode, state and evidence paths. Before publication,
+Buildchain dogfoods that public surface through a thin same-commit local reusable
+call with the exact PR-head or dispatch SHA as its runtime. The reusable is
+permission-neutral and the self-dogfood caller stays `contents: read`, passes
+`execute: false`, and therefore cannot inherit or synthesize production write
+authority. Effectful production callers must explicitly declare their own
+provider permission. Durable external consumers remain on the floating
+`@v4-alpha` contract. Provider mode additionally requires the exact authority
+path. Provider bindings come from the capsule; an optional external bindings
+input is accepted only when its canonical exact root and payload equal the
+capsule binding. Ordinary calls default to `simulate`.
+
+## Offline portability vectors
+
+[`offline-vectors.json`](../contracts/fixtures/v4-publication-rehearsal-v1/offline-vectors.json)
+records Linux, macOS and Windows projections. Their capsule, transaction,
+state, and evidence roots are byte-identical. Regenerate or verify them with:
+
+```sh
+node scripts/v4-publication-rehearsal-fixture.mjs
+node scripts/v4-publication-rehearsal-fixture.mjs --check
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.1-alpha.5",
+  "version": "4.0.1-alpha.8",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -25,6 +25,7 @@
     "./buildchain-contract": "./packages/core/buildchain-contract.js",
     "./compatibility-fact-authority": "./packages/core/buildchain-compatibility-proof.js",
     "./candidate-timeline": "./packages/core/candidate-timeline.js",
+    "./ci-lane-change-budget": "./packages/core/ci-lane-change-budget.js",
     "./channel-candidate": "./packages/core/channel-candidate.js",
     "./cache-evidence": "./packages/core/cache-evidence.js",
     "./controller-evidence": "./packages/core/controller-evidence.js",
@@ -46,6 +47,17 @@
     "./v4-runtime-ref-resume-authority": "./packages/core/v4-runtime-ref-resume-authority.js",
     "./v4-tail-reseal": "./packages/core/v4-tail-reseal.js",
     "./v4-tail-reseal-receipt": "./packages/core/v4-tail-reseal-receipt.js",
+    "./v4-publication-rehearsal": "./packages/core/v4-publication-rehearsal.js",
+    "./adopter-delivery-gate": "./packages/core/adopter-delivery-gate.js",
+    "./kfd-adopter-category-driver": "./packages/core/kfd-adopter-category-driver.js",
+    "./buildchain-delivery-infrastructure": "./packages/core/buildchain-delivery-infrastructure.js",
+    "./buildchain-delivery-bootstrap": "./packages/core/buildchain-delivery-bootstrap.js",
+    "./buildchain-delivery-self-dogfood": "./packages/core/buildchain-delivery-self-dogfood.js",
+    "./published-delivery-authority": "./packages/core/published-delivery-authority.js",
+    "./legacy-kfd-adopter-driver": "./packages/core/legacy-kfd-adopter-driver.js",
+    "./adopter-delivery-passport": "./packages/core/adopter-delivery-passport.js",
+    "./adopter-delivery-vectors": "./packages/core/adopter-delivery-vectors.js",
+    "./v4-adopter-delivery": "./packages/core/v4-adopter-delivery.js",
     "./logging": "./packages/core/logging.js",
     "./portable-dev-cache": "./packages/core/portable-dev-cache.js",
     "./publication-artifact": "./packages/core/publication-artifact.js",
@@ -99,6 +111,9 @@
     "./site/schemas/kfd-support-projection-v1.schema.json": "./dist/site/schemas/kfd-support-projection-v1.schema.json",
     "./site/schemas/dev-delivery-authority-v2.schema.json": "./dist/site/schemas/dev-delivery-authority-v2.schema.json",
     "./site/schemas/v4-compatibility-facts-v1.schema.json": "./dist/site/schemas/v4-compatibility-facts-v1.schema.json",
+    "./site/schemas/v4-publication-rehearsal-capsule-v1.schema.json": "./dist/site/schemas/v4-publication-rehearsal-capsule-v1.schema.json",
+    "./site/schemas/v4-adopter-delivery-v1.schema.json": "./dist/site/schemas/v4-adopter-delivery-v1.schema.json",
+    "./site/schemas/release-tail-capabilities-v1.schema.json": "./dist/site/schemas/release-tail-capabilities-v1.schema.json",
     "./site/buildchain-contract.json": "./dist/site/buildchain-contract.json",
     "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
     "./site/release-provenance.json": "./dist/site/release-provenance.json",
@@ -136,10 +151,10 @@
   "scripts": {
     "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/v4-delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery-authority-candidate.js packages/core/dev-delivery-authority-evidence.js packages/core/dev-delivery-authority-landing.js packages/core/dev-delivery-authority-observation.js packages/core/dev-delivery-authority-qualification.js packages/core/dev-delivery-authority-settlement.js packages/core/dev-delivery-authority-state.js packages/core/dev-delivery-execution-failure.js packages/core/dev-delivery-execution-transfer.js packages/core/dev-delivery-landing-readback.js packages/core/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery-landing-testing-port.js packages/core/dev-delivery-native-execution.js packages/core/dev-delivery-native-proof.js packages/core/dev-delivery-process-boundary.js packages/core/dev-delivery-warrant-qualification.js packages/core/dev-delivery-warrant-state.js scripts/dev-delivery-authority-command-adapters.mjs scripts/dev-delivery-authority-provider.mjs scripts/dev-delivery-authority.mjs scripts/dev-delivery-native-run.mjs scripts/dev-delivery-process-boundary.mjs scripts/dev-delivery-two-phase-resume.mjs scripts/dev-delivery-two-phase.mjs scripts/dev-delivery-warrant-options.mjs scripts/dev-delivery-warrant-store.mjs templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:static && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check": "pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-publication-rehearsal-fixture.mjs --check && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs bin/internal/compatibility-facts-cli.mjs packages/core/v4-canonical-contracts.js packages/core/kungfu-temporal-fact.js packages/core/buildchain-compatibility-fact.js packages/core/buildchain-compatibility-authority.js packages/core/buildchain-compatibility-proof.js packages/core/v4-floating-consumer-evidence.js packages/core/v4-floating-consumer-policy.js packages/core/v4-floating-consumer-release-passport.js packages/core/v4-runtime-ref-resume-authority.js packages/core/v4-tail-reseal-contract.js packages/core/v4-tail-reseal-github.js packages/core/v4-tail-reseal-receipt.js packages/core/v4-tail-reseal.js packages/core/v4-runtime-selector-persistence.js packages/core/v4-provider-operation-journal.js packages/core/v4-provider-readback-idempotency.js packages/core/v4-release-activation-shadow.js packages/core/v4-stable-publication-fence.js packages/core/v4-partial-mutation-recovery-qualification.js packages/core/v4-stage-capsule.js packages/core/v4-stage-capsule-store.js packages/core/v4-stage-capsule-local-store.js packages/core/v4-platform-stage-checkpoints.js packages/core/v4-stage-capsule-resume-planner.js packages/core/v4-stage-capsule-qualification.js packages/core/v4-stage-capsule-qualification-campaign.js packages/core/v4-delivery-warrant-fixture-runner.js packages/core/v4-delivery-warrant-read-candidate.js packages/core/v4-delivery-warrant-semantic-diff-gate.js packages/core/v4-delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/dev-pr-prequeue-guard.mjs scripts/check-v4-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/v4-bridge-bootstrap.mjs scripts/v4-bridge-evidence.mjs scripts/v4-consumer-policy.mjs scripts/v4-host-adapter.mjs scripts/v4-platform-stage-checkpoint-rehearsal.mjs scripts/v4-stage-capsule-resume-rehearsal.mjs scripts/v4-stage-capsule-qualification.mjs scripts/v4-tail-reseal-macos-rehearsal.mjs scripts/v4-tail-reseal.mjs scripts/v4-warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs tests/v4-bridge.test.mjs tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs tests/v4-warrant-shadow-plan.test.mjs",
     "check:v4-bridge": "cargo fmt --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml",
-    "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
+    "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-publication-rehearsal.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
     "check:workflows": "bash scripts/check-workflows.sh",
     "generate:reference": "node scripts/generate-public-reference.mjs",
     "check:reference": "node scripts/generate-public-reference.mjs --check",

package/packages/core/adopter-delivery-passport.js

@@ -0,0 +1,259 @@
+import {
+  ADOPTER_DELIVERY_GATE_RESULT_CONTRACT,
+  adopterDeliveryGateDigest,
+} from "./adopter-delivery-gate.js";
+
+export const ADOPTER_DELIVERY_PASSPORT_BINDING_CONTRACT =
+  "kungfu-buildchain-adopter-delivery-passport-binding";
+
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
+
+function issue(code, message, details = {}) {
+  return { code, message, details };
+}
+
+function validateRootedJson(value, rootField, code, label) {
+  const root = value?.[rootField];
+  if (!ROOT_PATTERN.test(root ?? "")) {
+    return [issue(code, `${label} must be a canonical sha256 root`)];
+  }
+  try {
+    const preimage = structuredClone(value);
+    delete preimage[rootField];
+    return adopterDeliveryGateDigest(preimage) === root
+      ? []
+      : [issue(code, `${label} does not match its exact JSON closure`)];
+  } catch {
+    return [issue(code, `${label} requires finite acyclic JSON`)];
+  }
+}
+
+function validateGateIdentity(result) {
+  const issues = [];
+  if (
+    result.schemaVersion !== 1 ||
+    result.contract !== ADOPTER_DELIVERY_GATE_RESULT_CONTRACT
+  ) {
+    issues.push(
+      issue(
+        "adopterDelivery.gateResult.contract",
+        "adopter delivery gate result contract is unsupported",
+      ),
+    );
+  }
+  if (
+    !result.project ||
+    !result.artifact ||
+    !result.protocol ||
+    !result.artifactProfile
+  ) {
+    issues.push(
+      issue(
+        "adopterDelivery.gateResult.closure",
+        "gate result must retain project, artifact, protocol, and artifact-profile bindings",
+      ),
+    );
+  }
+  if (!ROOT_PATTERN.test(result.artifact?.root ?? "")) {
+    issues.push(
+      issue(
+        "adopterDelivery.gateResult.artifact.root",
+        "delivery artifact root must be a canonical sha256 root",
+      ),
+    );
+  }
+  if (result.qualifying !== false || result.selfCertified !== false) {
+    issues.push(
+      issue(
+        "adopterDelivery.gateResult.nonClaims",
+        "delivery evidence must remain non-qualifying and non-self-certifying",
+      ),
+    );
+  }
+  return issues;
+}
+
+function validatePassedGate(result) {
+  if (result.status !== "passed") {
+    return result.status === "failed"
+      ? []
+      : [
+          issue(
+            "adopterDelivery.gateResult.status",
+            "gate status must be passed or failed",
+          ),
+        ];
+  }
+  const passed =
+    result.protocol?.loaded === true &&
+    ROOT_PATTERN.test(result.protocol?.reportRoot ?? "") &&
+    result.artifactProfile?.loaded === true &&
+    result.artifactProfile?.valid === true &&
+    result.semanticReport !== null &&
+    (result.issues?.length ?? -1) === 0;
+  return passed
+    ? []
+    : [
+        issue(
+          "adopterDelivery.gateResult.status",
+          "a passed gate must retain successful exact driver and artifact-profile evidence",
+        ),
+      ];
+}
+
+export function validateAdopterDeliveryGateResult(result) {
+  if (!result || typeof result !== "object" || Array.isArray(result)) {
+    return {
+      valid: false,
+      passed: false,
+      issues: [
+        issue(
+          "adopterDelivery.gateResult",
+          "adopter delivery gate result must be an object",
+        ),
+      ],
+    };
+  }
+  const issues = [
+    ...validateGateIdentity(result),
+    ...validateRootedJson(
+      result,
+      "gateRoot",
+      "adopterDelivery.gateResult.gateRoot",
+      "adopter delivery gate root",
+    ),
+    ...validatePassedGate(result),
+  ];
+  const valid = issues.length === 0;
+  return { valid, passed: valid && result.status === "passed", issues };
+}
+
+export function createAdopterDeliveryPassportBinding(gateResult) {
+  const normalized = structuredClone(gateResult);
+  const validation = validateAdopterDeliveryGateResult(normalized);
+  const binding = {
+    schemaVersion: 1,
+    contract: ADOPTER_DELIVERY_PASSPORT_BINDING_CONTRACT,
+    valid: validation.passed,
+    qualifying: false,
+    selfCertified: false,
+    gateResult: normalized,
+    validationIssues: validation.issues,
+    nonClaims: [
+      "A passing adopter delivery gate does not grant runtime permission or release authority.",
+      "The selected protocol driver retains semantic authority; Buildchain only binds its exact result into delivery evidence.",
+    ],
+  };
+  binding.bindingRoot = adopterDeliveryGateDigest(binding);
+  return binding;
+}
+
+export function normalizeAdopterDeliveryPassportBinding(value) {
+  if (!value) return undefined;
+  return value.contract === ADOPTER_DELIVERY_PASSPORT_BINDING_CONTRACT
+    ? structuredClone(value)
+    : createAdopterDeliveryPassportBinding(value);
+}
+
+export function validateAdopterDeliveryPassportBinding(
+  binding,
+  { expectedProjectRepository = "" } = {},
+) {
+  if (!binding || typeof binding !== "object" || Array.isArray(binding)) {
+    return [
+      issue(
+        "adopterDelivery.binding",
+        "adopter delivery passport binding must be an object",
+      ),
+    ];
+  }
+  const gateValidation = validateAdopterDeliveryGateResult(binding.gateResult);
+  const issues = [
+    ...validateRootedJson(
+      binding,
+      "bindingRoot",
+      "adopterDelivery.binding.bindingRoot",
+      "adopter delivery binding root",
+    ),
+    ...gateValidation.issues,
+  ];
+  if (
+    binding.schemaVersion !== 1 ||
+    binding.contract !== ADOPTER_DELIVERY_PASSPORT_BINDING_CONTRACT
+  ) {
+    issues.push(
+      issue(
+        "adopterDelivery.binding.contract",
+        "adopter delivery passport binding contract is unsupported",
+      ),
+    );
+  }
+  if (
+    binding.valid !== gateValidation.passed ||
+    binding.qualifying !== false ||
+    binding.selfCertified !== false
+  ) {
+    issues.push(
+      issue(
+        "adopterDelivery.binding.status",
+        "binding status must preserve a passing non-authoritative gate result",
+      ),
+    );
+  }
+  if (!gateValidation.passed) {
+    issues.push(
+      issue(
+        "adopterDelivery.status",
+        "release passport requires a passed adopter delivery gate",
+      ),
+    );
+  }
+  if (
+    expectedProjectRepository &&
+    binding.gateResult?.project?.adopterId !== expectedProjectRepository
+  ) {
+    issues.push(
+      issue(
+        "adopterDelivery.project",
+        "delivery project must match the release passport product repository",
+      ),
+    );
+  }
+  return issues;
+}
+
+function sameJson(left, right) {
+  try {
+    return adopterDeliveryGateDigest(left) === adopterDeliveryGateDigest(right);
+  } catch {
+    return false;
+  }
+}
+
+export function validateAdopterDeliveryReleaseEvidence({
+  binding,
+  artifactBinding,
+  expectedProjectRepository = "",
+} = {}) {
+  if (!binding && !artifactBinding) return [];
+  if (!binding) {
+    return [
+      issue(
+        "adopterDelivery.passport",
+        "artifact evidence cannot introduce delivery authority absent from the passport",
+      ),
+    ];
+  }
+  const issues = validateAdopterDeliveryPassportBinding(binding, {
+    expectedProjectRepository,
+  });
+  if (!artifactBinding || !sameJson(artifactBinding, binding)) {
+    issues.push(
+      issue(
+        "adopterDelivery.artifactEvidence",
+        "passport and artifact evidence must bind the same exact delivery result",
+      ),
+    );
+  }
+  return issues;
+}