@kungfu-tech/buildchain 4.0.10-alpha.0 → 4.1.0-alpha.1

package/docs/web-surface-deployments.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-07-30
+last_reviewed: 2026-09-11
 ai_provenance:
-  model_family: GPT-5
+  model_family: GPT-6
   product: Codex
-  generated_at: 2026-07-30
+  generated_at: 2026-09-09
   invisible_context_boundary: No credentials, private logs, or unpublished deployment values are included.
 ---
 
@@ -185,11 +185,9 @@ floating ref, such as:
 ```yaml
 jobs:
   web:
-    uses: kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v4
     with:
-      buildchain-contract-lock-path: .buildchain/contract-lock.json
-      buildchain-contract-compatibility-policy: major-compatible
-      buildchain-contract-drift-issue-mode: compatible-and-breaking
+      contract-lock: .buildchain/contract-lock.json
       build-command: pnpm build
       artifact-path: dist
 ```
@@ -205,7 +203,7 @@ caller build command, and applies these rules:
 - breaking drift: fail closed before rendering, deployment planning, deploy
   apply, or release publication.
 
-The caller no longer needs to run `scripts/buildchain-contract-lock.mjs` inside
+The caller no longer needs to run `packages/core/contracts/commands/buildchain-contract-lock.mjs` inside
 its own build command. That check belongs to Buildchain because the actual
 contract world is stored in the Buildchain runtime ref being used.
 
@@ -342,7 +340,7 @@ manifest JSON, but it does not touch AWS, DNS, CloudFront, or deployment
 credentials.
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode deploy-plan \
   --cwd fixtures/web-surface-shaped \
   --source-sha aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
@@ -352,7 +350,7 @@ node scripts/web-surface.mjs \
 For manifest-only output:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode manifest \
   --cwd fixtures/web-surface-shaped \
   --source-sha aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
@@ -389,7 +387,7 @@ Deploy apply syncs the artifact, writes the deployment manifest, and invalidates
 CloudFront when a distribution id is configured:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode deploy-apply \
   --cwd fixtures/web-surface-shaped \
   --channel staging \
@@ -581,7 +579,7 @@ surface hosts. A production plan therefore rejects staging/preview host facts
 before AWS apply:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode deploy-apply \
   --cwd fixtures/web-surface-shaped \
   --plan .buildchain/web-surface-staging-plan.json \
@@ -593,7 +591,7 @@ Cleanup apply deletes preview content, deletes the preview manifest, and
 invalidates CloudFront:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode cleanup-apply \
   --cwd fixtures/web-surface-shaped \
   --event pull-request-closed \
@@ -606,7 +604,7 @@ node scripts/web-surface.mjs \
 Cleanup apply can also execute a saved cleanup plan:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode cleanup-apply \
   --cwd fixtures/web-surface-shaped \
   --plan .buildchain/web-surface-cleanup-plan.json \
@@ -630,7 +628,7 @@ Production promotion is not just `deploy-apply --channel production`. Before a
 live production apply, the reusable workflow runs:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode production-preflight \
   --cwd fixtures/web-surface-shaped \
   --plan .buildchain/web-surface-production-plan.json \
@@ -651,7 +649,7 @@ The production preflight checks that:
 After preview, staging, and production apply, the workflow runs:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode health-check \
   --cwd fixtures/web-surface-shaped \
   --result .buildchain/web-surface-production-apply.json \
@@ -725,7 +723,7 @@ an apply-mode plan, or the explicit `cleanup-apply` executor with preview-only
 credentials:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode cleanup-plan \
   --cwd fixtures/web-surface-shaped \
   --event pull-request-closed \
@@ -741,13 +739,13 @@ auditable no-op when no aliases are requested.
 
 ## Reusable Workflow Shape
 
-Buildchain ships `.github/workflows/.web-surface.yml` for repositories that want
+Buildchain ships `.github/workflows/public-release-web.yml` for repositories that want
 the standard PR review and promotion flow without copying bespoke glue:
 
 ```yaml
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v4
     with:
       build-command: npm run build
       verify-command: npm run check
@@ -760,40 +758,38 @@ The reusable workflow maps GitHub events to Buildchain web-surface semantics:
 | --- | --- |
 | `pull_request` opened / synchronized / reopened | validate, build, verify, and plan `preview` for `pr-N` |
 | `pull_request` closed | plan apply-mode cleanup for the `pr-N` preview alias and manifest |
-| `pull_request` closed for a matching release PR | verify the release intent and exact workflow-shell runtime, then wait for the protected `main` push; do not plan or apply production from `refs/pull/*/merge` |
+| `pull_request` closed for a matching release PR | verify the release intent, then wait for the protected `main` push; do not plan or apply production from `refs/pull/*/merge` |
 | `push` to `main` | validate, build, verify, plan and apply `staging` from the merged `main` SHA, then optionally open a production release PR |
 | `push` to `main` from a matching release PR merge | validate the associated release PR, plan `production`, and enter the configured GitHub Environment gate from the protected mainline ref |
 | `workflow_dispatch` with `production-approved = true` | plan `production` and enter the configured GitHub Environment gate |
 
-The optional `buildchain-ref` input is empty by default. Empty keeps the
-web-surface run on the stable Buildchain runtime selected by the reusable
-workflow ref, normally `@v3`. A trusted maintainer can expose a
-`workflow_dispatch` input and pass it through for one-off train validation.
-See [`runtime-train-validation.md`](runtime-train-validation.md) for the shared
-train protocol and notification template:
+The optional `runtime-ref` parameter selects a transient execution runtime.
+An empty value uses the selected consumer contract lock or entry default.
+All preparation goes through the shared [Runtime entry](runtime-entry.md).
+A maintainer can expose a manual input for train validation or repair:
 
 ```yaml
 on:
   workflow_dispatch:
     inputs:
-      buildchain-ref:
+      runtime-ref:
         description: "Temporary Buildchain runtime ref for trusted manual validation"
         required: false
         default: ""
 
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v4
     with:
-      buildchain-ref: ${{ inputs.buildchain-ref || '' }}
+      runtime-ref: ${{ inputs.runtime-ref || '' }}
       build-command: pnpm run build
       verify-command: pnpm run check
       artifact-path: dist
 ```
 
-Only trusted `workflow_dispatch` runs by repository actors with write,
+Only repository actors with write,
 maintain, or admin permission may use a non-empty runtime override. Train refs
-such as `train/v3/v3.0/site-source-of-truth` are temporary validation refs, not
+such as `train/v4/v4.1/site-source-of-truth` are temporary validation refs, not
 stable production dependencies or pending merge targets. They may remain for a
 retention window after release as a fast-use and rollback channel, with old
 trains handled by periodic Buildchain cleanup. The web-surface deployment
@@ -811,7 +807,7 @@ permissions:
 
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v4
     with:
       build-command: pnpm run build
       verify-command: pnpm run check
@@ -905,7 +901,7 @@ For release-PR publishing, callers opt in explicitly:
 ```yaml
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v4
     with:
       build-command: npm run build
       verify-command: npm run check
@@ -956,17 +952,11 @@ that behind the fallback `github.token`. The handoff JSON and job summary report
 the manual PR creation command. If the repository intentionally uses another
 narrow token, pass it through `production-release-pr-token`.
 
-`production-release-app-id` remains accepted as a deprecated alias for the input
-name, but the value should be the GitHub App client id. GitHub App numeric App
-IDs and client IDs are distinct, and Buildchain passes the value to
-`actions/create-github-app-token` through its non-deprecated `client-id` input so
-new runs do not emit the deprecated `app-id` warning.
-
 If a repository already generates its own narrow token or PAT, it can still pass
 that through `production-release-pr-token`:
 
 ```yaml
-with:
+secrets:
   production-release-pr-token: ${{ secrets.BUILDCHAIN_RELEASE_PR_TOKEN }}
 ```
 
@@ -1051,7 +1041,7 @@ excludes the immutable root from mutable deletion.
 Local verification:
 
 ```sh
-node scripts/installer-publication.mjs \
+node packages/core/publication/commands/installer-publication.mjs \
   --manifest dist/installer-publication.json \
   --artifact-root dist
 ```
@@ -1062,7 +1052,7 @@ with `max-age` no greater than 300 seconds; immutable routes require at least
 one year and the `immutable` directive:
 
 ```sh
-node scripts/installer-publication.mjs \
+node packages/core/publication/commands/installer-publication.mjs \
   --manifest dist/installer-publication.json \
   --public-readback
 ```

package/docs/workflow-catalog.md

@@ -8,149 +8,103 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-05
+last_reviewed: 2026-09-09
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-05
-  visible_context: Repository workflow source and the approved naming scheme
-  invisible_context_boundary: No credentials or unpublished provider configuration inspected
+  generated_at: 2026-09-09
+  visible_context: Canonical Buildchain workflow ownership and source files
+  invisible_context_boundary: No private credentials or unpublished consumer state inspected
 ---
 
 # Workflow catalog
 
-Generated from `architecture/workflow-taxonomy.json`; edit that source, then run
-`pnpm run generate:workflows`. Every YAML file, including compatibility paths,
-is checked by the existing required workflow check.
+Generated from `architecture/workflow-taxonomy.json`. Every workflow has one canonical implementation; alternate paths and historical forwarding aliases are rejected.
 
-## Naming and ownership
+Public workflows own the consumer API. Component workflows own reusable multi-job topology. Self workflows own Buildchain repository automation. Actions own execution steps; JS adapters and Rust/WASM own implementation.
 
-`public-<build|release|ops>-<purpose>.yml` is a consumer entry;
-`.<build|release|ops>-<purpose>.yml` is an advanced component;
-`self-<build|release|ops>-<purpose>.yml` is Buildchain's own automation.
-Public is a product role, not GitHub access control. Dispatch services are
-marked separately from reusable workflows. Keep workflow names, job IDs,
-permissions, and trigger semantics stable during path migration.
+Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and `self-<category>-<purpose>.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.
 
-## Channel rollout
-
-Canonical names become callable on a channel only after that channel publishes
-them. Existing `@v4`/`@v4-alpha` consumers keep their exact registered legacy
-paths until provider readback proves canonical availability. New examples below
-describe the target surface, not a claim that both channels already publish it.
-Compatibility files are generated byte-identical projections, not independently
-editable implementations. They retain full jobs to preserve called-workflow
-identity, permission envelopes, and required check names without extra nesting.
-
-The controller registry records the actual source path separately from a migrated
-repository controller contractPath. This preserves the established logical
-contract identity while exposing its current execution source. New workflows
-do not acquire historical identities. Public controllers retain their real
-compatibility paths while those paths remain supported.
-
-## Adding or changing a workflow
-
-Register a stable identity, role, category, purpose, owner, lifecycle status,
-invocation and concrete summary before creating its derived path. A new entry
-must explain its scope in review. New aliases cannot be invented: compatibility
-must name an exact migration source with a reason and removal condition.
-The policy, generator, checker, tests, required CI chain and CODEOWNERS require
-independent `kungfu-origin` review. No wildcard compatibility admission is allowed.
-Workflow filenames cannot contain version tokens such as `v4` or `v5`.
-Retired aliases cannot be recreated or called; see [path migration](workflow-path-migration.md).
-
-A role, category or implementation edit must preserve or deliberately update
-all related declarations. Run `pnpm run generate:workflows` and
-`pnpm run check:workflows`; the full `pnpm run check` remains required.
+Register ownership before adding a workflow. `pnpm run check:workflows` validates source, calls, required CI integration and independent review ownership. `pnpm run generate:workflows` regenerates this catalog.
 
 ## public
 
-| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
-| --- | --- | --- | --- | --- | --- |
-| [public-build-adopter-qualification.yml](../.github/workflows/public-build-adopter-qualification.yml) | build | reusable | active | V4 Adopter Delivery | — |
-| [public-build-candidate.yml](../.github/workflows/public-build-candidate.yml) | build | reusable | active | Buildchain Channel Build | `build.yml` |
-| [public-build-check.yml](../.github/workflows/public-build-check.yml) | build | reusable | active | Buildchain Check | `check.yml` |
-| [public-build-demo.yml](../.github/workflows/public-build-demo.yml) | build | reusable | active | Buildchain Declarative Binary Auditable Demo | `.declarative-auditable-demo.yml` |
-| [public-build-publication.yml](../.github/workflows/public-build-publication.yml) | build | reusable | active | Buildchain Publication Artifact | `publication-artifact.yml` |
-| [public-build-stage-capsule-canary.yml](../.github/workflows/public-build-stage-capsule-canary.yml) | build | reusable | active | V4 Stage Capsule Canary | — |
-| [public-ops-alpha-candidate-patrol.yml](../.github/workflows/public-ops-alpha-candidate-patrol.yml) | ops | reusable | active | Buildchain Dev to Alpha Candidate Patrol | `dev-alpha-candidate-patrol.yml` |
-| [public-ops-bootstrap-recovery.yml](../.github/workflows/public-ops-bootstrap-recovery.yml) | ops | reusable | active | Universal Buildchain Bootstrap Recovery | `universal-bootstrap-recovery.yml` |
-| [public-ops-bootstrap.yml](../.github/workflows/public-ops-bootstrap.yml) | ops | reusable | active | Buildchain Universal Bootstrap | `bootstrap.yml` |
-| [public-ops-dev-auto-merge.yml](../.github/workflows/public-ops-dev-auto-merge.yml) | ops | reusable | active | Dev PR Auto Merge | `dev-pr-auto-merge.yml` |
-| [public-ops-dev-qualification-patrol.yml](../.github/workflows/public-ops-dev-qualification-patrol.yml) | ops | reusable | active | Buildchain Dev Qualification Patrol | `dev-qualification-patrol.yml` |
-| [public-ops-housekeeping.yml](../.github/workflows/public-ops-housekeeping.yml) | ops | reusable | active | Engineering Housekeeper | `engineering-housekeeper.yml` |
-| [public-ops-observed-evidence.yml](../.github/workflows/public-ops-observed-evidence.yml) | ops | reusable | active | Patrol Observed Evidence | `patrol-observed-evidence.yml` |
-| [public-ops-patrol-daily.yml](../.github/workflows/public-ops-patrol-daily.yml) | ops | reusable | active | Buildchain Patrol Daily | `patrol-daily.yml` |
-| [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly | `patrol-monthly.yml` |
-| [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly | `patrol-weekly.yml` |
-| [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol | `buildchain-patrol.yml` |
-| [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile | `release-governance-reconcile.yml` |
-| [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol | `stable-candidate-patrol.yml` |
-| [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal | — |
-| [public-ops-warrant-cancel.yml](../.github/workflows/public-ops-warrant-cancel.yml) | ops | reusable | active | Dev Delivery Warrant Queued Candidate Cancel | `dev-delivery-warrant-cancel.yml` |
-| [public-ops-warrant-close.yml](../.github/workflows/public-ops-warrant-close.yml) | ops | reusable | active | Dev Delivery Warrant Close | `dev-delivery-warrant-close.yml` |
-| [public-release-artifact-attestation.yml](../.github/workflows/public-release-artifact-attestation.yml) | release | reusable | active | Buildchain GitHub Artifact Attestation | `github-artifact-attestation.yml` |
-| [public-release-oci-compose-preview.yml](../.github/workflows/public-release-oci-compose-preview.yml) | release | reusable | active | Buildchain OCI Compose Preview | — |
-| [public-release-paper-sealed.yml](../.github/workflows/public-release-paper-sealed.yml) | release | reusable | active | Buildchain Sealed Paper Release | `paper-release-sealed.yml` |
-| [public-release-paper.yml](../.github/workflows/public-release-paper.yml) | release | reusable | active | Buildchain Paper Release | `paper-release.yml` |
-| [public-release-promote.yml](../.github/workflows/public-release-promote.yml) | release | reusable | active | Release Candidate Promote | `release-candidate-promote.yml` |
-| [public-release-propagation.yml](../.github/workflows/public-release-propagation.yml) | release | reusable | active | Release Propagation | `release-propagation.yml` |
-| [public-release-signing-authority.yml](../.github/workflows/public-release-signing-authority.yml) | release | dispatch-service | active | Buildchain Artifact Signing Authority | `artifact-signing-authority.yml` |
-| [public-release-tail.yml](../.github/workflows/public-release-tail.yml) | release | reusable | active | Declarative Release Tail | `release-tail.yml` |
-| [public-release-web.yml](../.github/workflows/public-release-web.yml) | release | reusable | active | Buildchain Web Surface | `.web-surface.yml` |
+| Workflow | Category | Invocation | Status | Purpose |
+| --- | --- | --- | --- | --- |
+| [build.yml](../.github/workflows/build.yml) | build | reusable | active | Buildchain Channel Build |
+| [public-build-adopter-qualification.yml](../.github/workflows/public-build-adopter-qualification.yml) | build | reusable | active | V4 Adopter Delivery |
+| [public-build-check.yml](../.github/workflows/public-build-check.yml) | build | reusable | active | Buildchain Check |
+| [public-build-demo.yml](../.github/workflows/public-build-demo.yml) | build | reusable | active | Buildchain Declarative Binary Auditable Demo |
+| [public-build-publication.yml](../.github/workflows/public-build-publication.yml) | build | reusable | active | Buildchain Publication Artifact |
+| [public-build-stage-capsule-canary.yml](../.github/workflows/public-build-stage-capsule-canary.yml) | build | reusable | active | V4 Stage Capsule Canary |
+| [public-ops-alpha-candidate-patrol.yml](../.github/workflows/public-ops-alpha-candidate-patrol.yml) | ops | reusable | active | Buildchain Dev to Alpha Candidate Patrol |
+| [public-ops-bootstrap.yml](../.github/workflows/public-ops-bootstrap.yml) | ops | reusable | active | Buildchain Universal Bootstrap |
+| [public-ops-dev-auto-merge.yml](../.github/workflows/public-ops-dev-auto-merge.yml) | ops | reusable | active | Dev PR Auto Merge |
+| [public-ops-dev-qualification-patrol.yml](../.github/workflows/public-ops-dev-qualification-patrol.yml) | ops | reusable | active | Buildchain Dev Qualification Patrol |
+| [public-ops-housekeeping.yml](../.github/workflows/public-ops-housekeeping.yml) | ops | reusable | active | Engineering Housekeeper |
+| [public-ops-observed-evidence.yml](../.github/workflows/public-ops-observed-evidence.yml) | ops | reusable | active | Patrol Observed Evidence |
+| [public-ops-patrol-daily.yml](../.github/workflows/public-ops-patrol-daily.yml) | ops | reusable | active | Buildchain Patrol Daily |
+| [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly |
+| [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly |
+| [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol |
+| [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile |
+| [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol |
+| [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal |
+| [public-ops-warrant-cancel.yml](../.github/workflows/public-ops-warrant-cancel.yml) | ops | reusable | active | Dev Delivery Warrant Queued Candidate Cancel |
+| [public-ops-warrant-close.yml](../.github/workflows/public-ops-warrant-close.yml) | ops | reusable | active | Dev Delivery Warrant Close |
+| [public-release-artifact-attestation.yml](../.github/workflows/public-release-artifact-attestation.yml) | release | reusable | active | Buildchain GitHub Artifact Attestation |
+| [public-release-oci-compose-preview.yml](../.github/workflows/public-release-oci-compose-preview.yml) | release | reusable | active | Buildchain OCI Compose Preview |
+| [public-release-paper.yml](../.github/workflows/public-release-paper.yml) | release | reusable | active | Buildchain Paper Release |
+| [public-release-promote.yml](../.github/workflows/public-release-promote.yml) | release | reusable | active | Release Candidate Promote |
+| [public-release-propagation.yml](../.github/workflows/public-release-propagation.yml) | release | reusable | active | Release Propagation |
+| [public-release-signing-authority.yml](../.github/workflows/public-release-signing-authority.yml) | release | dispatch-service | active | Buildchain Artifact Signing Authority |
+| [public-release-tail.yml](../.github/workflows/public-release-tail.yml) | release | reusable | active | Declarative Release Tail |
+| [public-release-web.yml](../.github/workflows/public-release-web.yml) | release | reusable | active | Buildchain Web Surface |
 
 ## component
 
-| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
-| --- | --- | --- | --- | --- | --- |
-| [.build-demo-adapter.yml](../.github/workflows/.build-demo-adapter.yml) | build | reusable | active | Buildchain Auditable Demo | `.auditable-demo.yml` |
-| [.build-engine.yml](../.github/workflows/.build-engine.yml) | build | reusable | active | Buildchain Build | `.build.yml` |
-| [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile | `.gate-profile.yml` |
-| [.build-release-verify-compat.yml](../.github/workflows/.build-release-verify-compat.yml) | build | reusable | compatibility | release verify | `.release-verify.yml` |
-| [.build-sam-verify-compat.yml](../.github/workflows/.build-sam-verify-compat.yml) | build | reusable | compatibility | sam verify | `.sam-verify.yml` |
-| [.build-wheel-verify-compat.yml](../.github/workflows/.build-wheel-verify-compat.yml) | build | reusable | compatibility | wheel verify | `.wheel-verify.yml` |
-| [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git | `.sync-remote-git.yml` |
-| [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority | `.publication-authority.yml` |
-| [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets | `.binary-release-assets.yml` |
-| [.release-minor-bump-compat.yml](../.github/workflows/.release-minor-bump-compat.yml) | release | reusable | compatibility | bump minor version | `.bump-minor-version.yml` |
-| [.release-page-sync-retired.yml](../.github/workflows/.release-page-sync-retired.yml) | release | reusable | retired | sync release page | `.sync-release-page.yml` |
-| [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced | `.release-candidate-promote.yml` |
+| Workflow | Category | Invocation | Status | Purpose |
+| --- | --- | --- | --- | --- |
+| [.build-demo-adapter.yml](../.github/workflows/.build-demo-adapter.yml) | build | reusable | active | Buildchain Auditable Demo |
+| [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile |
+| [.build.yml](../.github/workflows/.build.yml) | build | reusable | active | Buildchain Build |
+| [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git |
+| [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority |
+| [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets |
+| [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced |
 
 ## self
 
-| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
-| --- | --- | --- | --- | --- | --- |
-| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood | — |
-| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood | — |
-| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution | — |
-| [self-build-candidate-lab.yml](../.github/workflows/self-build-candidate-lab.yml) | build | repository | active | Candidate Lab | — |
-| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood | — |
-| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification | — |
-| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture | — |
-| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood | — |
-| [self-build-release-verify-compat.yml](../.github/workflows/self-build-release-verify-compat.yml) | build | repository | compatibility | Release - Verify | — |
-| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification | — |
-| [self-build-stable-dogfood.yml](../.github/workflows/self-build-stable-dogfood.yml) | build | repository | active | Buildchain Stable Self-Dogfood | — |
-| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify | — |
-| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood | — |
-| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery | — |
-| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit | — |
-| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily | — |
-| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly | — |
-| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly | — |
-| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance | — |
-| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily | — |
-| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly | — |
-| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly | — |
-| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery | — |
-| [self-ops-recovery-failure-dogfood.yml](../.github/workflows/self-ops-recovery-failure-dogfood.yml) | ops | repository | active | Buildchain Candidate Recovery Dogfood Startup Failure | — |
-| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke | — |
-| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol | — |
-| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets | — |
-| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap | — |
-| [self-release-new-version-compat.yml](../.github/workflows/self-release-new-version-compat.yml) | release | repository | compatibility | Release - New Version | — |
-| [self-release-next-development.yml](../.github/workflows/self-release-next-development.yml) | release | repository | active | Next Development Review | — |
-| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package | — |
-| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion | — |
-| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood | — |
-| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood | — |
+| Workflow | Category | Invocation | Status | Purpose |
+| --- | --- | --- | --- | --- |
+| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood |
+| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood |
+| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution |
+| [self-build-channel-verify.yml](../.github/workflows/self-build-channel-verify.yml) | build | repository | active | Release - Verify |
+| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood |
+| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification |
+| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture |
+| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood |
+| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification |
+| [self-build-stable-dogfood.yml](../.github/workflows/self-build-stable-dogfood.yml) | build | repository | active | Buildchain Stable Self-Dogfood |
+| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify |
+| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood |
+| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery |
+| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit |
+| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily |
+| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly |
+| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly |
+| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance |
+| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily |
+| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly |
+| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly |
+| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery |
+| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke |
+| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol |
+| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets |
+| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap |
+| [self-release-next-development.yml](../.github/workflows/self-release-next-development.yml) | release | repository | active | Next Development Review |
+| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package |
+| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion |
+| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood |
+| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood |

package/docs/workflow-path-migration.md

@@ -66,8 +66,6 @@ unknown or non-default-branch consumers do not exist.
 | --- | --- | --- |
 | Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-adopter-dogfood.yml` | `v4-alpha` |
 | Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-public-consumer-dogfood.yml` | `v4-alpha` |
-| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-adopter-delivery-qualification.yml` | `v4-alpha` |
-| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-stage-capsule-canary.yml` | `v4` |
 | taolu `6dcccdc3bd2c8b1801c7f6decea08ae7877aac2b` | `verify.yml` | `v4-alpha` |
 
 The initial published channel readback was `v4` at
@@ -94,9 +92,7 @@ on all declared platforms and
 The protected dev landing is `7e15123733110ad8ce484241934bbf0ef99fbb45`.
 
 The stable `v4` readback remains
-`da5e2db8384313e899eace87aea0a1a8e28c0aa8`, which does not contain the canonical
-paths. Stable publication and the agent-hub-demo migration remain **pending**
-outside this development change's completion boundary. The alpha.35
+`da5e2db8384313e899eace87aea0a1a8e28c0aa8` in that observation. The alpha.35
 [Build Surface Fixture](https://github.com/kungfu-systems/buildchain/actions/runs/34005360217)
 passed, but this individual result does not establish complete stable
 qualification or authorize moving the stable channel.