@kungfu-tech/buildchain 4.0.1-alpha.9 → 4.0.1

package/packages/core/v4-floating-consumer-release-passport.js

@@ -4,9 +4,11 @@ import {
   v4FloatingConsumerDocumentRoot,
   verifyV4FloatingConsumerPolicyCertification,
 } from "./v4-floating-consumer-evidence.js";
-
+import {
+  verifyV4RuntimeAuthorizationReceipt,
+  verifyV4RuntimeResumeLineage,
+} from "./v4-runtime-ref-resume-authority.js";
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
-
 export function isV4PromotionRouting(value = undefined) {
   return [
     value?.router?.ref,
@@ -14,7 +16,6 @@ export function isV4PromotionRouting(value = undefined) {
     value?.runtime?.requestedRef,
   ].some((ref) => /^v4(?:-alpha)?$/u.test(String(ref || "")));
 }
-
 function resolveInside(root, relative, label) {
   const resolvedRoot = path.resolve(root);
   const file = path.resolve(resolvedRoot, relative);
@@ -23,7 +24,6 @@ function resolveInside(root, relative, label) {
   }
   return file;
 }
-
 function resolveCallerLock(root, relative, label) {
   const file = resolveInside(root, relative, `${label} contract lock`);
   if (!fs.existsSync(file)) {
@@ -76,27 +76,31 @@ function normalizeCertification(value, expected) {
   }
   return { certificationRoot: verification.certificationRoot, certification };
 }
-
 export function resolveV4ConsumerPolicyCertificationIdentity({
   release = {},
   routing = {},
   runtimeResume = undefined,
   sourceSha = "",
 } = {}) {
-  const builtSourceSha =
-    release?.builtSourceSha || release?.built_source_sha || "";
+  const certification =
+    release?.certification?.certification || release?.certification;
+  const certifiedSourceSha = certification?.caller?.sourceSha || "";
+  const treeEquivalentSources = [
+    release?.builtSourceSha || release?.built_source_sha,
+    release?.promotionChannelSha || release?.promotion_channel_sha,
+  ];
+  const buildSha = runtimeResume?.lineage?.attempts?.build?.runtimeSha;
+  const certifiedSha = certification?.invocation?.resolvedRuntimeSha || "";
   return {
     sourceSha:
-      release?.treeEquivalent === true && builtSourceSha
-        ? builtSourceSha
+      certifiedSourceSha === sourceSha ||
+      (release?.treeEquivalent === true &&
+        treeEquivalentSources.includes(certifiedSourceSha))
+        ? certifiedSourceSha
         : sourceSha,
-    runtimeSha:
-      runtimeResume?.lineage?.attempts?.build?.runtimeSha ||
-      routing?.runtime?.resolvedSha ||
-      "",
+    runtimeSha: buildSha || certifiedSha || routing?.runtime?.resolvedSha || "",
   };
 }
-
 export function requireV4ConsumerPolicyCertification({
   value,
   repository,
@@ -134,7 +138,7 @@ export function releasePassportCertificationVerificationOptions({
 }) {
   const authority = evidence?.certification?.authority || {};
   const identity = resolveV4ConsumerPolicyCertificationIdentity({
-    release: passport?.release,
+    release: { ...passport?.release, certification: evidence?.certification },
     routing,
     runtimeResume: passport?.v4RuntimeResume,
     sourceSha: passport?.release?.sourceSha || "",
@@ -151,3 +155,118 @@ export function releasePassportCertificationVerificationOptions({
     alphaLockPath: authority.contractLocks?.alpha?.path || "",
   };
 }
+export function normalizePromotionRouting(value = undefined) {
+  if (value === undefined) return undefined;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("release.promotionRouting must be a JSON object");
+  }
+  if (value.contract !== "buildchain.promotion-routing/v1") {
+    throw new Error(
+      "release.promotionRouting contract must be buildchain.promotion-routing/v1",
+    );
+  }
+  for (const [label, field] of [
+    ["router.ref", value.router?.ref],
+    ["router.sha", value.router?.sha],
+    ["shell.ref", value.shell?.ref],
+    ["shell.sha", value.shell?.sha],
+    ["runtime.requestedRef", value.runtime?.requestedRef],
+    ["runtime.resolvedSha", value.runtime?.resolvedSha],
+    ["contractLock.path", value.contractLock?.path],
+    ["contractLock.digest", value.contractLock?.digest],
+    ["publication.channel", value.publication?.channel],
+    ["publication.targetRef", value.publication?.targetRef],
+  ]) {
+    if (!String(field || "").trim())
+      throw new Error(`release.promotionRouting.${label} is required`);
+  }
+  for (const [label, sha] of [
+    ["router.sha", value.router.sha],
+    ["shell.sha", value.shell.sha],
+    ["runtime.resolvedSha", value.runtime.resolvedSha],
+  ]) {
+    if (!/^[0-9a-f]{40}$/i.test(String(sha))) {
+      throw new Error(
+        `release.promotionRouting.${label} must be a 40-character Git SHA`,
+      );
+    }
+  }
+  if (!/^sha256:[0-9a-f]{64}$/i.test(String(value.contractLock.digest))) {
+    throw new Error(
+      "release.promotionRouting.contractLock.digest must be a sha256 digest",
+    );
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+
+export function normalizePromotionEvidence({
+  release = {},
+  v4ConsumerPolicyCertification: certification,
+  v4ConsumerPolicyCertificationRoot: certificationRoot,
+  v4RuntimeResumeEvidence,
+  repository,
+  sourceSha,
+  cwd,
+}) {
+  const routing = normalizePromotionRouting(release.promotionRouting);
+  const identity = resolveV4ConsumerPolicyCertificationIdentity({
+    release: { ...release, certification },
+    routing,
+    runtimeResume: v4RuntimeResumeEvidence,
+    sourceSha,
+  });
+  return {
+    routing,
+    consumerPolicy: requireV4ConsumerPolicyCertification({
+      value: certification,
+      repository,
+      sourceSha: identity.sourceSha,
+      runtimeSha: identity.runtimeSha,
+      routing,
+      cwd,
+      certificationRoot,
+    }),
+  };
+}
+
+export function normalizeV4RuntimeResumeEvidence(value, expected = {}) {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("v4RuntimeResumeEvidence must be a JSON object");
+  }
+  const authorizationVerification = verifyV4RuntimeAuthorizationReceipt({
+    receipt: value.authorization,
+    receiptRoot: value.authorizationRoot,
+    repository: expected.repository,
+    sourceSha: expected.sourceSha,
+    runtimeSha: expected.resumeRuntimeSha,
+    consumerPolicyReceiptRoot: expected.consumerPolicyReceiptRoot,
+  });
+  if (!authorizationVerification.ok) {
+    throw new Error(
+      `v4 runtime authorization invalid: ${authorizationVerification.failures.join(", ")}`,
+    );
+  }
+  const lineageVerification = verifyV4RuntimeResumeLineage({
+    lineage: value.lineage,
+    lineageRoot: value.lineageRoot,
+    repository: expected.repository,
+    sourceSha: expected.sourceSha,
+    resumeRuntimeSha: expected.resumeRuntimeSha,
+    consumerPolicyReceiptRoot: expected.consumerPolicyReceiptRoot,
+  });
+  if (!lineageVerification.ok) {
+    throw new Error(
+      `v4 runtime resume lineage invalid: ${lineageVerification.failures.join(", ")}`,
+    );
+  }
+  if (value.lineage?.authorizationRoot !== value.authorizationRoot) {
+    throw new Error("v4 runtime resume lineage authorization root mismatch");
+  }
+  return {
+    authorizationRoot: value.authorizationRoot,
+    authorization: structuredClone(value.authorization),
+    lineageRoot: value.lineageRoot,
+    lineage: structuredClone(value.lineage),
+  };
+}

package/packages/core/v4-publication-qualification.js

@@ -0,0 +1,222 @@
+import crypto from "node:crypto";
+
+export const V4_PUBLICATION_QUALIFICATION_SCHEMA =
+  "kungfu.buildchain.v4-publication-qualification/v1";
+
+const ROOT = /^sha256:[0-9a-f]{64}$/u;
+const SHA = /^[0-9a-f]{40}$/u;
+const FORBIDDEN_EXECUTION_KEYS = new Set([
+  "cmd",
+  "command",
+  "eval",
+  "executable",
+  "javascript",
+  "run",
+  "script",
+  "shell",
+]);
+
+export class V4PublicationQualificationError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "V4PublicationQualificationError";
+    this.code = code;
+  }
+}
+
+function fail(code, message) {
+  throw new V4PublicationQualificationError(code, message);
+}
+
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+      .join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+export function v4PublicationQualificationRoot(value) {
+  return `sha256:${crypto.createHash("sha256").update(canonical(value)).digest("hex")}`;
+}
+
+export function assertNoV4ExecutionFields(value, location = "$") {
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) =>
+      assertNoV4ExecutionFields(entry, `${location}[${index}]`),
+    );
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [key, entry] of Object.entries(value)) {
+    if (FORBIDDEN_EXECUTION_KEYS.has(key.toLowerCase())) {
+      fail(
+        "execution-field-forbidden",
+        `v4 declarative publication forbids ${location}.${key}`,
+      );
+    }
+    assertNoV4ExecutionFields(entry, `${location}.${key}`);
+  }
+}
+
+function exactRoot(value, label) {
+  const root = String(value || "").toLowerCase();
+  if (!ROOT.test(root))
+    fail("schema-invalid", `${label} must be a sha256 root`);
+  return root;
+}
+
+function exactSha(value, label) {
+  const sha = String(value || "").toLowerCase();
+  if (!SHA.test(sha))
+    fail("schema-invalid", `${label} must be an exact Git SHA`);
+  return sha;
+}
+
+function normalizedArtifacts(artifacts) {
+  if (!Array.isArray(artifacts) || artifacts.length === 0) {
+    fail(
+      "schema-invalid",
+      "publication qualification requires typed artifacts",
+    );
+  }
+  const normalized = artifacts
+    .map((artifact) => {
+      const value = {
+        role: String(artifact?.role || ""),
+        platform: String(artifact?.platform || ""),
+        artifactRoot: exactRoot(artifact?.artifactRoot, "artifactRoot"),
+        manifestRoot: exactRoot(artifact?.manifestRoot, "manifestRoot"),
+      };
+      if (!value.role || !value.platform)
+        fail("schema-invalid", "artifact role and platform are required");
+      return value;
+    })
+    .sort((left, right) =>
+      `${left.role}\0${left.platform}`.localeCompare(
+        `${right.role}\0${right.platform}`,
+      ),
+    );
+  if (
+    new Set(normalized.map(({ role, platform }) => `${role}\0${platform}`))
+      .size !== normalized.length
+  ) {
+    fail("schema-invalid", "artifact role/platform bindings must be unique");
+  }
+  return normalized;
+}
+
+export function createV4PublicationQualificationReceipt({
+  repository,
+  candidateRoot,
+  sourceSha,
+  sourceRoot,
+  policyDigest,
+  artifacts,
+  issuedAt,
+  expiresAt,
+}) {
+  const body = {
+    schema: V4_PUBLICATION_QUALIFICATION_SCHEMA,
+    repository: String(repository || ""),
+    candidateRoot: exactRoot(candidateRoot, "candidateRoot"),
+    sourceSha: exactSha(sourceSha, "sourceSha"),
+    sourceRoot: exactRoot(sourceRoot, "sourceRoot"),
+    policyDigest: exactRoot(policyDigest, "policyDigest"),
+    artifacts: normalizedArtifacts(artifacts),
+    issuedAt: String(issuedAt || ""),
+    expiresAt: String(expiresAt || ""),
+  };
+  if (!/^[^/\s]+\/[^/\s]+$/u.test(body.repository))
+    fail("schema-invalid", "repository must be owner/repo");
+  const issued = Date.parse(body.issuedAt);
+  const expires = Date.parse(body.expiresAt);
+  if (
+    !Number.isFinite(issued) ||
+    !Number.isFinite(expires) ||
+    expires <= issued
+  )
+    fail("schema-invalid", "qualification freshness interval is invalid");
+  assertNoV4ExecutionFields(body);
+  const artifactRoot = v4PublicationQualificationRoot(body.artifacts);
+  const receipt = { ...body, artifactRoot };
+  return {
+    ...receipt,
+    receiptRoot: v4PublicationQualificationRoot(receipt),
+  };
+}
+
+export function validateV4PublicationQualificationReceipt(
+  receipt,
+  {
+    repository,
+    candidateRoot,
+    sourceSha,
+    sourceRoot,
+    artifactRoot,
+    policyDigest,
+    evaluatedAt = new Date().toISOString(),
+  } = {},
+) {
+  if (!receipt)
+    fail("qualification-missing", "qualification receipt is required");
+  assertNoV4ExecutionFields(receipt);
+  const recreated = createV4PublicationQualificationReceipt(receipt);
+  if (
+    receipt.artifactRoot !== recreated.artifactRoot ||
+    receipt.receiptRoot !== recreated.receiptRoot
+  ) {
+    fail(
+      "qualification-tampered",
+      "qualification receipt root does not verify",
+    );
+  }
+  if (repository && receipt.repository !== repository)
+    fail("repository-mismatch", "qualification repository does not match");
+  if (candidateRoot && receipt.candidateRoot !== candidateRoot)
+    fail("candidate-mismatch", "qualification candidate root does not match");
+  if (sourceSha && receipt.sourceSha !== sourceSha)
+    fail("source-mismatch", "qualification source SHA does not match");
+  if (sourceRoot && receipt.sourceRoot !== sourceRoot)
+    fail("source-mismatch", "qualification source root does not match");
+  if (artifactRoot && receipt.artifactRoot !== artifactRoot)
+    fail("artifact-mismatch", "qualification artifact root does not match");
+  if (policyDigest && receipt.policyDigest !== policyDigest)
+    fail("policy-mismatch", "qualification policy digest does not match");
+  const evaluated = Date.parse(evaluatedAt);
+  if (!Number.isFinite(evaluated))
+    fail("schema-invalid", "evaluatedAt is invalid");
+  if (
+    evaluated < Date.parse(receipt.issuedAt) ||
+    evaluated >= Date.parse(receipt.expiresAt)
+  )
+    fail(
+      "qualification-stale",
+      "qualification receipt is outside its freshness window",
+    );
+  return Object.freeze({
+    ok: true,
+    receiptRoot: receipt.receiptRoot,
+    artifactRoot: receipt.artifactRoot,
+  });
+}
+
+export function assertV4DeclarativePromotionInputs(inputs) {
+  const forbidden = Object.entries(inputs || {}).filter(
+    ([name, value]) =>
+      /(command|cmd|script|shell|run)$/iu.test(name) &&
+      String(value || "").trim() !== "",
+  );
+  if (forbidden.length > 0) {
+    fail(
+      "legacy-command-input-forbidden",
+      `v4 declarative publication rejects: ${forbidden
+        .map(([name]) => name)
+        .sort()
+        .join(", ")}`,
+    );
+  }
+}

package/scripts/artifact-signing-controller-core.mjs

@@ -374,6 +374,7 @@ export function assertArtifactSigningControlRequestContext(
 export function artifactSigningControlRequestOutputs(request) {
   const value = validateArtifactSigningControlRequest(request);
   return {
+    "source-run-attempt": String(value.source.runAttempt),
     "request-count": String(value.request.count),
     "request-artifact": value.request.artifact,
     "request-root": value.request.root,
@@ -384,7 +385,6 @@ export function artifactSigningControlRequestOutputs(request) {
     "runtime-sha": value.runtime.sha,
   };
 }
-
 export function normalizeControllerStatus(value) {
   const normalized = required(value, "authority status");
   if (

package/scripts/audit-publication-control-plane.mjs

@@ -11,10 +11,9 @@ import {
 
 const GITHUB_JSON_MAX_BUFFER = 16 * 1024 * 1024;
 
-function flag(name, fallback = "") {
-  const index = process.argv.indexOf(`--${name}`);
-  return index === -1 ? fallback : String(process.argv[index + 1] || "");
-}
+const flag = (name, fallback = "") => process.argv.includes(`--${name}`)
+  ? String(process.argv[process.argv.indexOf(`--${name}`) + 1] || "")
+  : fallback;
 
 function commandJson(command, args, label, { publicReadFallback = false } = {}) {
   const options = {
@@ -42,13 +41,9 @@ function commandJson(command, args, label, { publicReadFallback = false } = {})
   }
 }
 
-function githubJson(apiPath, label, { publicReadFallback = false } = {}) {
-  return commandJson("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], label, { publicReadFallback });
-}
+const githubJson = (apiPath, label, { publicReadFallback = false } = {}) => commandJson("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], label, { publicReadFallback });
 
-function githubPublicJson(apiPath, label) {
-  return githubJson(apiPath, label, { publicReadFallback: true });
-}
+const githubPublicJson = (apiPath, label) => githubJson(apiPath, label, { publicReadFallback: true });
 
 function githubJsonOptional(apiPath, label, fallback, fallbackPattern = /404|not found/i) {
   const result = spawnSyncCommand("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], {
@@ -68,9 +63,7 @@ function githubJsonOptional(apiPath, label, fallback, fallbackPattern = /404|not
   }
 }
 
-function githubJsonReadLimited(apiPath, label, fallback) {
-  return githubJsonOptional(apiPath, label, fallback, /401|403|404|unauthorized|forbidden|not found/i);
-}
+const githubJsonReadLimited = (apiPath, label, fallback) => githubJsonOptional(apiPath, label, fallback, /401|403|404|unauthorized|forbidden|not found/i);
 
 function rulesetIncludesBranch(ruleset, branch, defaultBranch) {
   const includes = ruleset.conditions?.ref_name?.include || [];
@@ -102,7 +95,7 @@ function normalizeRulesetBranchPolicy(rulesets, branch, defaultBranch) {
   };
 }
 
-function jobBlock(workflowText, jobId) {
+function jobBlock(workflowText, jobId, delegated = false) {
   const lines = String(workflowText).split(/\r?\n/);
   const jobsIndex = lines.findIndex((line) => /^jobs:\s*$/.test(line));
   if (jobsIndex === -1) return "";
@@ -115,14 +108,21 @@ function jobBlock(workflowText, jobId) {
       break;
     }
   }
-  return lines.slice(start, end).join("\n");
+  const block = lines.slice(start, end).join("\n");
+  if (delegated) return block;
+  const declarations = [...block.matchAll(/^ {4}# buildchain-publication-authority-job:\s*([A-Za-z0-9_-]+)\s*$/gm)];
+  if (declarations.length > 1 || declarations[0]?.[1] === jobId) throw new Error(`publication authority job delegation is invalid: ${jobId}`);
+  if (!declarations.length) return block;
+  const delegatedJobId = declarations[0][1];
+  const delegatedBlock = jobBlock(workflowText, delegatedJobId, true);
+  if (!delegatedBlock) throw new Error(`delegated publication workflow job is missing: ${delegatedJobId}`);
+  return delegatedBlock;
 }
 
 function first(value, keys) {
   for (const key of keys) {
-    const parts = key.split(".");
     let current = value;
-    for (const part of parts) current = current && typeof current === "object" ? current[part] : undefined;
+    for (const part of key.split(".")) current = current && typeof current === "object" ? current[part] : undefined;
     if (current !== undefined && current !== null && current !== "") return current;
   }
   return undefined;

package/scripts/buildchain-cli-help.mjs

@@ -51,6 +51,8 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain release-tail compat --hooks-json <json-or-path> [--output <path>]
   buildchain release-tail rehearse --capsule <absolute-path>
                                       --candidate-root <absolute-path>
+                                      [--capsule-root <absolute-path>]
+                                      [--environment-json <empty-json-or-path>]
                                       --mode <simulate|replay>
                                       --state <absolute-path>
                                       --evidence <absolute-path>
@@ -70,6 +72,7 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain release <inspect|recover|finalize|abort> ...
   buildchain transaction inspect ...
   buildchain collect github-release --tag <tag> [--repository <owner/repo>]
+                                    [--adopter-delivery-json <legacy-json-or-path>]
                                     [--assets-dir <dir>] [--assets-json <json-or-path>]
                                     [--release-json <json-or-path>] [--package-set-json <json-or-path>]
                                     [--product-name <name>]

package/scripts/check-internal-architecture.mjs

@@ -100,8 +100,8 @@ function dependencyCycles(graph) {
 }
 
 function assertIndexShape(index) {
-  if (index?.schemaVersion !== 1) {
-    throw new Error("internal architecture index schemaVersion must be 1");
+  if (index?.schemaVersion !== 2) {
+    throw new Error("internal architecture index schemaVersion must be 2");
   }
   for (const field of [
     "coverageRoots",
@@ -209,7 +209,27 @@ function evaluateCapabilities(root, index) {
     if (!Array.isArray(capability.tests) || capability.tests.length === 0) {
       issues.push(`${capability.id}: test mapping is empty`);
     }
-    for (const field of ["implementation", "tests", "contracts"]) {
+    if (!Array.isArray(capability.generatedOutputs)) {
+      issues.push(`${capability.id}: generated output mapping is missing`);
+    }
+    if (
+      !Array.isArray(capability.validationCommands) ||
+      capability.validationCommands.length === 0
+    ) {
+      issues.push(`${capability.id}: validation command mapping is empty`);
+    } else if (
+      capability.validationCommands.some(
+        (command) => !String(command || "").trim(),
+      )
+    ) {
+      issues.push(`${capability.id}: validation command is empty`);
+    }
+    for (const field of [
+      "implementation",
+      "tests",
+      "contracts",
+      "generatedOutputs",
+    ]) {
       for (const relativePath of capability[field] || []) {
         if (!fs.existsSync(path.resolve(root, relativePath))) {
           issues.push(

package/scripts/check-inventory.mjs

@@ -285,6 +285,10 @@ const channelPromotionWorkflow = fs.readFileSync(
   path.join(root, ".github/workflows/release-candidate-promote.yml"),
   "utf8",
 );
+const boundedAlphaRecoveryWorkflow = fs.readFileSync(
+  path.join(root, ".github/workflows/buildchain-ref-promotion-recovery.yml"),
+  "utf8",
+);
 const promotionShellRouting = parsePromotionShellRouting(
   fs.readFileSync(path.join(root, ".buildchain/promotion-shell-routing.json"), "utf8"),
   { major: Number(selfDogfoodMajor) },
@@ -295,6 +299,20 @@ if (channelPromotionWorkflow !== generateChannelPromotionWorkflow(advancedPromot
 })) {
   throw new Error("generated channel promotion workflow is stale");
 }
+for (const requiredSnippet of [
+  "uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@alpha/v4/v4.0",
+  "promotion-shell-ref: ${{ needs.consumer-admission.outputs.shell-call-ref }}",
+  "declarative-release-tail: true",
+]) {
+  if (!boundedAlphaRecoveryWorkflow.includes(requiredSnippet)) {
+    throw new Error(`bounded alpha recovery missing bootstrap contract: ${requiredSnippet}`);
+  }
+}
+for (const workflowSource of [boundedAlphaRecoveryWorkflow, channelPromotionWorkflow]) {
+  if (workflowSource.includes("channel-finalization-recovery")) {
+    throw new Error("Buildchain-only alpha bootstrap must not add a public or recovery workflow input");
+  }
+}
 for (const requiredSnippet of [
   "buildchain-channel:",
   `/${promotionShellRouting.alpha.workflowPath}@${promotionShellRouting.alpha.callRef}`,
@@ -759,8 +777,8 @@ const registeredActionIds = (workflowRegistry.actions || []).map((entry) => entr
 const readmeActionIndex = fs.readFileSync(path.join(root, "README.md"), "utf8");
 const mapActionIndex = fs.readFileSync(path.join(root, "docs/MAP.md"), "utf8");
 const retrospectiveActionIndex = fs.readFileSync(path.join(root, ".github/retrospectives/2026-07-10-buildchain-consolidation.md"), "utf8");
-if (registeredActionIds.length !== 7) {
-  throw new Error(`workflow-registry.json must expose the seven current action entries, got ${registeredActionIds.length}`);
+if (registeredActionIds.length !== 8) {
+  throw new Error(`workflow-registry.json must expose the eight current action entries, got ${registeredActionIds.length}`);
 }
 for (const actionId of registeredActionIds) {
   if (!readmeActionIndex.includes(`actions/${actionId}`) || !mapActionIndex.includes(`actions/${actionId}`)) {
@@ -1021,16 +1039,16 @@ for (const forbiddenSnippet of [
 for (const requiredSnippet of [
   "id-token: write",
   "actions: write",
-  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha",
+  "uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha",
   "github.event.workflow_run.event == 'push'",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
   "resume-candidate-run-id:",
   "resume-expected-source-tree:",
-  "resume-buildchain-runtime-sha:",
+  "resume-buildchain-runtime-ref:",
   "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4",
   "release-passport-buildchain-self-kfd: true",
-  "buildchain-channel: alpha",
+  "declarative-release-tail: true",
   "release-passport-impact-json: .buildchain/release-impact.json",
 ]) {
   if (!buildchainRefPromotionWorkflow.includes(requiredSnippet)) {