@kungfu-tech/buildchain 4.0.1-alpha.9 → 4.0.1

package/dist/site/workflow-registry.json

@@ -114,6 +114,8 @@
         "build-command",
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
+        "buildchain-contract-expected-channel",
+        "buildchain-contract-expected-major",
         "buildchain-contract-lock-path",
         "buildchain-expected-channel",
         "buildchain-expected-major",
@@ -184,7 +186,7 @@
         "verify-substage-evidence-path",
         "working-directory"
       ],
-      "inputCount": 91,
+      "inputCount": 93,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -396,6 +398,7 @@
       "reusable": true,
       "inputs": [
         "admission-json",
+        "authority-job-id",
         "authority-workflow-path",
         "auto-admission",
         "auto-admission-kind",
@@ -433,7 +436,7 @@
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 37,
+      "inputCount": 38,
       "secrets": [
         "BUILDCHAIN_GOVERNANCE_READ_TOKEN",
         "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
@@ -503,6 +506,7 @@
         "promotion-shell-ref",
         "promotion-shell-sha",
         "promotion-target-ref",
+        "provider-failure-after-capability",
         "publication-admission-json",
         "publication-authority-workflow-path",
         "publication-auto-admission",
@@ -544,6 +548,7 @@
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
+        "release-passport-adopter-delivery-json",
         "release-passport-attachment-command",
         "release-passport-buildchain-self-kfd",
         "release-passport-evidence-command",
@@ -557,6 +562,7 @@
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-kfd-3-artifact-witness-jsons",
         "release-passport-kfd-3-prebuild-witness-jsons",
+        "release-passport-kfd-adopter-manifest-gate-json",
         "release-passport-kfd-adopter-manifest-json",
         "release-passport-kfd-product-gate-jsons",
         "release-passport-kfd-support-matrix-json",
@@ -582,7 +588,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 118,
+      "inputCount": 121,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -961,6 +967,8 @@
         "build-command",
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
+        "buildchain-contract-expected-channel",
+        "buildchain-contract-expected-major",
         "buildchain-contract-lock-path",
         "buildchain-ref",
         "buildchain-repository",
@@ -998,7 +1006,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 41,
+      "inputCount": 43,
       "secrets": [
         "production-release-app-private-key"
       ],
@@ -1254,6 +1262,8 @@
         "buildchain-channel",
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
+        "buildchain-contract-expected-channel",
+        "buildchain-contract-expected-major",
         "buildchain-contract-lock-path",
         "buildchain-expected-channel",
         "buildchain-expected-major",
@@ -1325,7 +1335,7 @@
         "verify-substage-evidence-path",
         "working-directory"
       ],
-      "inputCount": 94,
+      "inputCount": 96,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1848,9 +1858,10 @@
       "outputs": [
         "close-receipt-root",
         "final-state-root",
-        "integration-proof-root"
+        "integration-proof-root",
+        "successor-wake-json"
       ],
-      "outputCount": 3,
+      "outputCount": 4,
       "surface": "repository-workflow",
       "capabilityGroup": "governance-versioning",
       "status": "active",
@@ -1896,6 +1907,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "closure-root",
+        "defer-landing",
         "delivery-class",
         "delivery-priority",
         "delivery-warrant-mode",
@@ -1932,7 +1944,7 @@
         "toolchain-root",
         "warrant-lease-seconds"
       ],
-      "inputCount": 43,
+      "inputCount": 44,
       "secrets": [
         "github-token"
       ],
@@ -2027,7 +2039,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.9",
+      "introducedVersion": "4.0.1",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2048,7 +2060,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.9",
+      "introducedVersion": "4.0.1",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2069,7 +2081,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.9",
+      "introducedVersion": "4.0.1",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2119,7 +2131,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.9",
+      "introducedVersion": "4.0.1",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2583,6 +2595,7 @@
         "github-release-payload-patterns",
         "github-release-title",
         "package-manager",
+        "provider-failure-after-capability",
         "publication-admission-json",
         "publication-auto-admission",
         "publication-auto-no-gate",
@@ -2623,6 +2636,7 @@
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
+        "release-passport-adopter-delivery-json",
         "release-passport-attachment-command",
         "release-passport-buildchain-self-kfd",
         "release-passport-evidence-command",
@@ -2636,6 +2650,7 @@
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-kfd-3-artifact-witness-jsons",
         "release-passport-kfd-3-prebuild-witness-jsons",
+        "release-passport-kfd-adopter-manifest-gate-json",
         "release-passport-kfd-adopter-manifest-json",
         "release-passport-kfd-product-gate-jsons",
         "release-passport-kfd-support-matrix-json",
@@ -2661,7 +2676,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 103,
+      "inputCount": 106,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2864,7 +2879,11 @@
       "inputs": [
         "buildchain-ref",
         "candidate-root",
+        "capsule-contract",
+        "capsule-path",
+        "capsule-root",
         "declaration-path",
+        "evidence-path",
         "execute",
         "provider-bindings-path",
         "rehearsal-authority-path",
@@ -2873,18 +2892,20 @@
         "rehearsal-mode",
         "state-path"
       ],
-      "inputCount": 10,
+      "inputCount": 14,
       "secrets": [
         "http-token"
       ],
       "secretCount": 1,
       "outputs": [
+        "binding-root",
+        "evidence-root",
         "rehearsal-evidence-root",
         "state-root",
         "transaction-root",
         "transaction-state"
       ],
-      "outputCount": 4,
+      "outputCount": 6,
       "surface": "release-tail-provider-plane",
       "capabilityGroup": "release-passport-trust",
       "status": "active",
@@ -3036,10 +3057,34 @@
         "archive-path",
         "bootstrap-path",
         "consumer",
+        "consumer-ref",
+        "consumer-repository",
         "input-path",
+        "invocation-source-path",
         "node-version"
       ],
-      "inputCount": 5,
+      "inputCount": 8,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
+    {
+      "id": "v4-declarative-release-tail-dogfood",
+      "path": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
       "secrets": [],
       "secretCount": 0,
       "outputs": [],
@@ -3265,6 +3310,7 @@
         "github-release-artifact-paths",
         "github-release-notes",
         "github-release-title",
+        "plan-before-target-advance",
         "promote-only-release-candidate",
         "publication-capability-json",
         "publication-gate-aggregate-json",
@@ -3298,6 +3344,7 @@
         "release-candidate-version",
         "release-material-sha",
         "release-passport",
+        "release-passport-adopter-delivery-json",
         "release-passport-attachment-command",
         "release-passport-build-summary-path",
         "release-passport-buildchain-self-kfd",
@@ -3312,6 +3359,7 @@
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-kfd-3-artifact-witness-jsons",
         "release-passport-kfd-3-prebuild-witness-jsons",
+        "release-passport-kfd-adopter-manifest-gate-json",
         "release-passport-kfd-adopter-manifest-json",
         "release-passport-kfd-product-gate-jsons",
         "release-passport-kfd-support-matrix-json",
@@ -3336,7 +3384,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 84,
+      "inputCount": 87,
       "capabilityGroup": "release-passport-trust",
       "status": "active",
       "owner": "buildchain-actions",
@@ -3352,7 +3400,11 @@
       "path": "actions/release-tail/action.yml",
       "inputs": [
         "candidate-root",
+        "capsule",
+        "capsule-contract",
+        "capsule-root",
         "declaration",
+        "evidence-path",
         "execute",
         "github-token",
         "http-token",
@@ -3363,7 +3415,7 @@
         "rehearsal-mode",
         "state-path"
       ],
-      "inputCount": 11,
+      "inputCount": 15,
       "capabilityGroup": "release-passport-trust",
       "status": "active",
       "owner": "buildchain-actions",
@@ -3471,6 +3523,30 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary."
     },
+    {
+      "id": "v4-release-candidate-promote",
+      "path": "actions/v4-release-candidate-promote/action.yml",
+      "inputs": [
+        "artifact-paths",
+        "candidate-passport-path",
+        "failure-after-capability",
+        "publication-qualification-path",
+        "repository",
+        "stage-capsules-path",
+        "state-path",
+        "token"
+      ],
+      "inputCount": 8,
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-actions",
+      "maturity": "stable",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary."
+    },
     {
       "id": "validate-config",
       "path": "actions/validate-config/action.yml",

package/docs/MAP.md

@@ -171,7 +171,7 @@ replace them.
 | How do I deploy a site/app preview, staging, or production surface? | [`web-surface-deployments.md`](web-surface-deployments.md) | use | stable |
 | How do I publish observed infrastructure contracts for downstream consumers? | [`infra-contract.md`](infra-contract.md) | use | preview |
 | How do I operate a repeatable, disabled-by-default, budget-fail-closed AWS Windows JIT campaign? | [`aws-us-elastic-runner-burst-plane.md`](aws-us-elastic-runner-burst-plane.md#phase-2-operator-workflow) | use/verify | preview |
-| How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md), [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md), [`../actions/github-artifact-attestation/README.md`](../actions/github-artifact-attestation/README.md), [`../actions/macos-credential-island/README.md`](../actions/macos-credential-island/README.md), [`../actions/release-tail/README.md`](../actions/release-tail/README.md); `dist/site/workflow-registry.json#actions` is authoritative for the seven-entry inventory. | use | stable |
+| How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md), [`../actions/v4-release-candidate-promote/README.md`](../actions/v4-release-candidate-promote/README.md), [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md), [`../actions/github-artifact-attestation/README.md`](../actions/github-artifact-attestation/README.md), [`../actions/macos-credential-island/README.md`](../actions/macos-credential-island/README.md), [`../actions/release-tail/README.md`](../actions/release-tail/README.md); `dist/site/workflow-registry.json#actions` is authoritative for the eight-entry inventory. | use | stable |
 | How can a consumer workflow report a Buildchain-owned failure back to Buildchain? | [`consumer-issue-reporting.md`](consumer-issue-reporting.md) + [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md) | use | stable |
 | What do the fixture repositories demonstrate? | [`../fixtures/libnode-shaped/README.md`](../fixtures/libnode-shaped/README.md), [`../fixtures/publish-transaction-shaped/README.md`](../fixtures/publish-transaction-shaped/README.md), [`../fixtures/web-surface-shaped/README.md`](../fixtures/web-surface-shaped/README.md), [`../fixtures/publication-artifact-shaped/README.md`](../fixtures/publication-artifact-shaped/README.md) | verify | stable |
 | What license and contribution terms apply? | [`../LICENSE`](../LICENSE) + [`../LICENSE-POLICY.md`](../LICENSE-POLICY.md) | use | stable |

package/docs/cli-reference.md

@@ -260,11 +260,11 @@ buildchain collect
 
 - Help: `buildchain collect github-release --help`
 - Canonical id: `collect-github-release`
-- Options: `--anchor-manifest-json`, `--assets-dir`, `--assets-json`, `--base-passport-json`, `--build-facts-json`, `--build-summary-json`, `--dist-tag-evidence-json`, `--github-artifact-attestation-policy-json`, `--impact-json`, `--invariant-passport-cmd`, `--invariant-passport-json`, `--json`, `--kfd-1-witness-json`, `--kfd-2-claim-json`, `--kfd-3-artifact-verify-cmd`, `--kfd-3-artifact-witness-json`, `--kfd-3-prebuild-witness-json`, `--kfd-adopter-manifest-json`, `--kfd-agent-hub-evidence-json`, `--kfd-product-gate-json`, `--kfd-support-matrix-json`, `--output-dir`, `--package-set-json`, `--platform-manifest-json`, `--product-name`, `--publish-evidence-json`, `--publish-json`, `--release-evidence-json`, `--release-extra-json`, `--release-json`, `--repository`, `--require-base-kfd`, `--tag`, `--transaction-json`, `--trusted-publishing-json`
+- Options: `--adopter-delivery-json`, `--anchor-manifest-json`, `--assets-dir`, `--assets-json`, `--base-passport-json`, `--build-facts-json`, `--build-summary-json`, `--dist-tag-evidence-json`, `--github-artifact-attestation-policy-json`, `--impact-json`, `--invariant-passport-cmd`, `--invariant-passport-json`, `--json`, `--kfd-1-witness-json`, `--kfd-2-claim-json`, `--kfd-3-artifact-verify-cmd`, `--kfd-3-artifact-witness-json`, `--kfd-3-prebuild-witness-json`, `--kfd-adopter-manifest-json`, `--kfd-agent-hub-evidence-json`, `--kfd-product-gate-json`, `--kfd-support-matrix-json`, `--output-dir`, `--package-set-json`, `--platform-manifest-json`, `--product-name`, `--publish-evidence-json`, `--publish-json`, `--release-evidence-json`, `--release-extra-json`, `--release-json`, `--repository`, `--require-base-kfd`, `--tag`, `--transaction-json`, `--trusted-publishing-json`
 - Syntax:
 
 ```text
-buildchain collect github-release --tag <tag> [--repository <owner/repo>] [--assets-dir <dir>] [--assets-json <json-or-path>] [--release-json <json-or-path>] [--package-set-json <json-or-path>] [--product-name <name>] [--publish-evidence-json <json-or-path>] [--trusted-publishing-json <json-or-path>] [--transaction-json <json-or-path>] [--anchor-manifest-json <json-or-path>] [--impact-json <json-or-path>] [--build-summary-json <json-or-path>] [--build-facts-json <json-or-path>]... [--platform-manifest-json <json-or-path>]... [--dist-tag-evidence-json <json-or-path>] [--kfd-1-witness-json <json-or-path>]... [--kfd-2-claim-json <json-or-path>]... [--kfd-3-prebuild-witness-json <json-or-path>]... [--kfd-3-artifact-witness-json <json-or-path>]... [--kfd-3-artifact-verify-cmd <command>] [--kfd-adopter-manifest-json <json-or-path>] [--kfd-support-matrix-json <json-or-path>] [--kfd-product-gate-json <json-or-path>]... [--invariant-passport-json <json-or-path>]... [--invariant-passport-cmd <command>] [--release-evidence-json <json-or-path>]... [--github-artifact-attestation-policy-json <json-or-path>]... [--kfd-agent-hub-evidence-json <json-or-path>] [--base-passport-json <json-or-path>] [--require-base-kfd] [--release-extra-json <json-or-path>] [--publish-json <json-or-path>] [--output-dir <dir>] [--json]
+buildchain collect github-release --tag <tag> [--repository <owner/repo>] [--adopter-delivery-json <legacy-json-or-path>] [--assets-dir <dir>] [--assets-json <json-or-path>] [--release-json <json-or-path>] [--package-set-json <json-or-path>] [--product-name <name>] [--publish-evidence-json <json-or-path>] [--trusted-publishing-json <json-or-path>] [--transaction-json <json-or-path>] [--anchor-manifest-json <json-or-path>] [--impact-json <json-or-path>] [--build-summary-json <json-or-path>] [--build-facts-json <json-or-path>]... [--platform-manifest-json <json-or-path>]... [--dist-tag-evidence-json <json-or-path>] [--kfd-1-witness-json <json-or-path>]... [--kfd-2-claim-json <json-or-path>]... [--kfd-3-prebuild-witness-json <json-or-path>]... [--kfd-3-artifact-witness-json <json-or-path>]... [--kfd-3-artifact-verify-cmd <command>] [--kfd-adopter-manifest-json <json-or-path>] [--kfd-support-matrix-json <json-or-path>] [--kfd-product-gate-json <json-or-path>]... [--invariant-passport-json <json-or-path>]... [--invariant-passport-cmd <command>] [--release-evidence-json <json-or-path>]... [--github-artifact-attestation-policy-json <json-or-path>]... [--kfd-agent-hub-evidence-json <json-or-path>] [--base-passport-json <json-or-path>] [--require-base-kfd] [--release-extra-json <json-or-path>] [--publish-json <json-or-path>] [--output-dir <dir>] [--json]
 ```
 
 ## `create`
@@ -2307,11 +2307,11 @@ buildchain release-tail plan --declaration <json-or-path> [--output <path>]
 
 - Help: `buildchain release-tail rehearse --help`
 - Canonical id: `release-tail`
-- Options: `--candidate-root`, `--capsule`, `--evidence`, `--mode`, `--state`
+- Options: `--candidate-root`, `--capsule`, `--capsule-root`, `--environment-json`, `--evidence`, `--mode`, `--state`
 - Syntax:
 
 ```text
-buildchain release-tail rehearse --capsule <absolute-path> --candidate-root <absolute-path> --mode <simulate|replay> --state <absolute-path> --evidence <absolute-path>
+buildchain release-tail rehearse --capsule <absolute-path> --candidate-root <absolute-path> [--capsule-root <absolute-path>] [--environment-json <empty-json-or-path>] --mode <simulate|replay> --state <absolute-path> --evidence <absolute-path>
 ```
 
 ### `buildchain release-tail status`

package/docs/dev-delivery-warrant.md

@@ -60,15 +60,18 @@ state, event, or evidence drift fails closed.
 
 The reusable terminal controller classifies authoritative completion,
 cancellation, supersession, native failure, and transient dequeue separately.
-`dequeued` alone never clears an active Warrant: a fresh holder continues with
-the same generation and token, while an expired holder waits for proof that its
-fenced worker stopped. Queued work may still settle as dequeued because it never
-started native execution. The controller uses one `settle` operation for active,
-queued, already-terminal, and never-admitted pull requests. An active Warrant
-still requires its exact fence and evidence. A matching queued cancellation is
-persisted normally. A duplicate terminal event or a pull request that never
-entered Warrant authority returns a rooted explicit no-op instead of failing
-the workflow or inventing queue state.
+`dequeued` retains only a provisional Warrant whose native worker may still be
+running: a fresh holder continues with the same generation and token, while an
+expired holder waits for proof that its fenced worker stopped. A qualified or
+historical phase-less holder has no unproven native worker to fence, so its exact
+dequeue closes atomically and persists the rooted queued-successor wake. Queued
+work may also settle as dequeued because it never started native execution. The
+controller uses one `settle` operation for active, queued, already-terminal,
+and never-admitted pull requests. An active Warrant still requires its exact
+fence and evidence. A matching queued cancellation is persisted normally. A
+duplicate terminal event replays the persisted wake, while a pull request that
+never entered Warrant authority returns a rooted explicit no-op instead of
+failing the workflow or inventing queue state.
 
 The supported priority classes are `ordinary`, `expedited`, and `emergency`.
 The queue does not infer an emergency: callers must choose it explicitly under