@kungfu-tech/buildchain 4.0.2-alpha.0 → 4.0.2-alpha.11

package/architecture/agent-change-map.md

@@ -77,7 +77,6 @@ Safe change route: Reduce one owned responsibility behind the stable facade, run
 - sources: `scripts/locked-source-checkout.mjs`
 - sources: `scripts/maintainability-domain-metrics.mjs`
 - sources: `scripts/paper.mjs`
-- sources: `scripts/publication-commit-evidence.mjs`
 - sources: `scripts/reconcile-github-governance.mjs`
 - sources: `scripts/release-candidate-resolver.mjs`
 - sources: `scripts/release-line-policy.mjs`
@@ -124,7 +123,6 @@ Safe change route: Reduce one owned responsibility behind the stable facade, run
 - tests: `tests/release-passport.test.mjs`
 - tests: `tests/release-propagation.test.mjs`
 - tests: `tests/v4-delivery-authority-parity.test.mjs`
-- tests: `tests/v4-floating-consumer-policy-contract.test.mjs`
 - tests: `tests/v4-floating-consumer-policy.test.mjs`
 - tests: `tests/v4-publication-rehearsal.test.mjs`
 - tests: `tests/web-surface.test.mjs`
@@ -152,8 +150,11 @@ Safe change route: Reduce one owned responsibility behind the stable facade, run
 
 ### Current top twenty maintenance hotspots
 
+- `.github/workflows/bootstrap.yml`
+- `scripts/check-v4-universal-workflow-bootstrap.mjs`
 - `tests/v3-v4-capability-inventory.test.mjs`
 - `tests/v4-floating-consumer-policy-contract.test.mjs`
+- `tests/v4-publication-qualification.test.mjs`
 - `.github/workflows/v4-adopter-delivery.yml`
 - `.github/workflows/buildchain-ref-promotion.yml`
 - `tests/release-candidate-recovery.test.mjs`
@@ -166,21 +167,26 @@ Safe change route: Reduce one owned responsibility behind the stable facade, run
 - `scripts/check-v3-v4-capability-inventory.mjs`
 - `.github/workflows/release-candidate-promote.yml`
 - `actions/promote-buildchain-ref/lib.js`
+- `actions/v4-release-candidate-promote/index.js`
+- `actions/v4-release-candidate-promote/product-provider.js`
 - `scripts/check-inventory.mjs`
 - `tests/promote-buildchain-ref.test.mjs`
 - `tests/promotion-channel-router.test.mjs`
+- `tests/v4-release-topology.test.mjs`
 - `scripts/site-capability-metadata.mjs`
 - `tests/v4-floating-consumer-policy.test.mjs`
+- `tests/v4-declarative-promotion-mode.test.mjs`
 - `scripts/buildchain-cli-help.mjs`
 - `scripts/check-v4-floating-consumer-policy-contract.mjs`
 - `tests/dev-delivery-warrant.test.mjs`
+- `packages/core/dev-delivery-warrant-state.js`
 - `actions/promote-buildchain-ref/internal/version-state.js`
-- `packages/core/v4-floating-consumer-policy.js`
 - `packages/core/v4-floating-consumer-release-passport.js`
 - `packages/core/release-passport.js`
 - `tests/promote-buildchain-ref-governance.test.mjs`
-- `tests/v4-declarative-promotion-mode.test.mjs`
 - `scripts/buildchain-cli-help.mjs`
+- `scripts/check-maintainability.mjs`
+- `tests/maintainability.test.mjs`
 
 ## cli-command-registry
 
@@ -381,6 +387,7 @@ Owner: Buildchain action maintainers
 
 ### Implementation
 
+- `actions/promote-buildchain-ref/internal/contained-published-version-state.js`
 - `actions/promote-buildchain-ref/internal/promote-alpha-channel.js`
 - `actions/promote-buildchain-ref/internal/promote-major-channel.js`
 - `actions/promote-buildchain-ref/internal/promote-release-channel.js`
@@ -392,6 +399,7 @@ Owner: Buildchain action maintainers
 
 ### Tests
 
+- `tests/promote-buildchain-ref-contained-published-version-state.test.mjs`
 - `tests/promote-buildchain-ref.test.mjs`
 - `tests/promote-buildchain-ref-recovery.test.mjs`
 - `tests/promote-buildchain-ref-governance.test.mjs`
@@ -403,7 +411,7 @@ Owner: Buildchain action maintainers
 
 ### Minimal validation
 
-- `node --test tests/promote-buildchain-ref.test.mjs tests/promote-buildchain-ref-recovery.test.mjs tests/promote-buildchain-ref-governance.test.mjs tests/promotion-responsibilities.test.mjs`
+- `node --test tests/promote-buildchain-ref-contained-published-version-state.test.mjs tests/promote-buildchain-ref.test.mjs tests/promote-buildchain-ref-recovery.test.mjs tests/promote-buildchain-ref-governance.test.mjs tests/promotion-responsibilities.test.mjs`
 
 ## promotion-github-transaction-store
 
@@ -893,6 +901,7 @@ Owner: Buildchain protected delivery maintainers
 
 - `packages/core/dev-delivery-warrant.js`
 - `packages/core/dev-delivery-warrant-state.js`
+- `packages/core/dev-delivery-warrant-native-compatibility.js`
 - `packages/core/dev-delivery-warrant-qualification.js`
 - `packages/core/dev-delivery-warrant-legacy-recovery.js`
 - `packages/core/dev-delivery-native-proof.js`
@@ -989,6 +998,44 @@ Owner: Buildchain publication rehearsal maintainers
 
 - `node --test tests/v4-publication-rehearsal.test.mjs`
 
+## v4-universal-workflow-bootstrap
+
+Owner: Buildchain workflow maintainers
+
+### Implementation
+
+- `packages/core/v4-universal-workflow-bootstrap.js`
+- `scripts/check-v4-universal-workflow-bootstrap.mjs`
+- `scripts/generate-v4-universal-workflow-facades.mjs`
+- `scripts/v4-universal-workflow-backflow.mjs`
+- `scripts/v4-universal-workflow-engine.mjs`
+- `scripts/v4-universal-workflow-self-dogfood.mjs`
+
+### Contracts
+
+- `architecture/v4-universal-workflow-bootstrap.json`
+- `architecture/v4-universal-workflow-fault-campaign.json`
+- `architecture/v4-universal-workflow-train-admission.json`
+- `.github/workflows/bootstrap.yml`
+- `.github/workflows/universal-bootstrap-dogfood.yml`
+- `templates/universal-buildchain-bootstrap-recovery.yml`
+
+### Tests
+
+- `tests/v4-universal-workflow-backflow.test.mjs`
+- `tests/v4-universal-workflow-bootstrap.test.mjs`
+- `tests/v4-universal-workflow-fault-campaign.test.mjs`
+- `tests/v4-universal-workflow-self-dogfood.test.mjs`
+
+### Generated outputs
+
+- `.github/workflows/universal-bootstrap-recovery.yml`
+
+### Minimal validation
+
+- `node scripts/check-v4-universal-workflow-bootstrap.mjs`
+- `node --test tests/v4-universal-workflow-bootstrap.test.mjs tests/v4-universal-workflow-backflow.test.mjs tests/v4-universal-workflow-fault-campaign.test.mjs tests/v4-universal-workflow-self-dogfood.test.mjs`
+
 ## web-surface-delivery
 
 Owner: Buildchain web-surface maintainers

package/architecture/ci-lane-change-budget.json

@@ -185,37 +185,122 @@
   },
   "declarations": [
     {
-      "laneId": ".github/workflows/.release-candidate-promote.yml#legacy-promote",
+      "laneId": ".github/workflows/.release-candidate-promote.yml#qualify",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "serialized",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 30,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "protected release qualification latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "QUALIFY is the read-only exact-runtime and sealed-candidate admission boundary."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.release-candidate-promote.yml#apply",
       "authorityClass": "release",
       "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "serialized",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 30,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "protected release APPLY latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "APPLY is the sole contents-write and provider-mutation OIDC authority boundary."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.release-candidate-promote.yml#settle",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "serialized",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 10,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "terminal receipt projection latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "SETTLE verifies and projects the already durable terminal ReleaseReceipt without mutation authority."
+      }
+    },
+    {
+      "laneId": ".github/workflows/buildchain-ref-promotion-recovery.yml#resume",
+      "authorityClass": "release",
+      "triggerClass": "manual",
       "concurrencyPolicy": {
         "mode": "none",
         "cancelInProgress": false
       },
-      "expectedRunnerMinutes": 45,
+      "expectedRunnerMinutes": 35,
       "cancellationBehavior": "finish-started",
       "sloImpact": {
         "mergeCritical": false,
-        "metric": "protected release completion latency",
+        "metric": "manual recovery adapter latency",
         "expectedContributionSeconds": 0,
-        "rationale": "This is the existing v3 promotion lane under an explicit legacy identity, not an added execution path."
+        "rationale": "The recovery surface is a one-way adapter into the same canonical publisher."
       }
     },
     {
-      "laneId": ".github/workflows/.release-candidate-promote.yml#v4-declarative-promote",
+      "laneId": ".github/workflows/buildchain-ref-promotion.yml#promote",
+      "authorityClass": "release",
+      "triggerClass": "mixed",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 35,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "Buildchain alpha promotion adapter latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The Buildchain-owned alpha entry delegates to the single v4 publisher."
+      }
+    },
+    {
+      "laneId": ".github/workflows/buildchain-ref-promotion.yml#universal-bootstrap",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "mixed",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "canonical exact-candidate self-promotion latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The canonical publisher delegates one closed request to the exact reviewed candidate and keeps the compatibility path mutually exclusive."
+      }
+    },
+    {
+      "laneId": ".github/workflows/release-candidate-promote.yml#invoke",
       "authorityClass": "release",
       "triggerClass": "reusable",
       "concurrencyPolicy": {
         "mode": "none",
         "cancelInProgress": false
       },
-      "expectedRunnerMinutes": 30,
+      "expectedRunnerMinutes": 35,
       "cancellationBehavior": "finish-started",
       "sloImpact": {
         "mergeCritical": false,
-        "metric": "protected release completion latency",
+        "metric": "public promotion adapter latency",
         "expectedContributionSeconds": 0,
-        "rationale": "The v4 provider lane replaces consumer tail execution only for release invocations and is outside merge-critical CI."
+        "rationale": "The public compatibility surface resolves discovery facts and invokes one fixed v4 publisher."
       }
     },
     {
@@ -251,6 +336,321 @@
         "expectedContributionSeconds": 0,
         "rationale": "The lane only reconciles already-produced rooted platform reports and grants no provider, release, or stable publication authority."
       }
+    },
+    {
+      "laneId": ".github/workflows/bootstrap.yml#admit",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 10,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "exact-candidate admission latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/bootstrap.yml#execute",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "exact-candidate execution latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/bootstrap.yml#settle",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 10,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "universal terminal settlement latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/universal-bootstrap-recovery.yml#recovery-admit",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 10,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "consumer-owned exact-candidate admission latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/universal-bootstrap-recovery.yml#recovery-execute",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "consumer-owned exact-candidate execution latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/universal-bootstrap-recovery.yml#recovery-settle",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 10,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "consumer-owned terminal settlement latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/universal-bootstrap-dogfood.yml#prepare",
+      "authorityClass": "evidence",
+      "triggerClass": "mixed",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 10,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "Train-first self-dogfood admission latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/universal-bootstrap-dogfood.yml#primary-conformance",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "mixed",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "Train-first exact-candidate self-dogfood latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/universal-bootstrap-dogfood.yml#recovery-conformance",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "mixed",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "Train-first exact-candidate self-dogfood latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/universal-bootstrap-dogfood.yml#primary-alpha",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "mixed",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "Train-first exact-candidate self-dogfood latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/universal-bootstrap-dogfood.yml#recovery-alpha",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "mixed",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "Train-first exact-candidate self-dogfood latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/universal-bootstrap-dogfood.yml#primary-stable",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "mixed",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "Train-first exact-candidate self-dogfood latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/universal-bootstrap-dogfood.yml#recovery-stable",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "mixed",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "Train-first exact-candidate self-dogfood latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    },
+    {
+      "laneId": ".github/workflows/universal-bootstrap-dogfood.yml#reconcile",
+      "authorityClass": "evidence",
+      "triggerClass": "mixed",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 10,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "primary and recovery equivalence latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      }
+    }
+  ],
+  "declarationFamilies": [
+    {
+      "authorityClass": "governed-delegation",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "opt-in exact-candidate execution latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      },
+      "laneIds": [
+        ".github/workflows/.auditable-demo.yml#universal-bootstrap",
+        ".github/workflows/.binary-release-assets.yml#universal-bootstrap",
+        ".github/workflows/.build.yml#universal-bootstrap",
+        ".github/workflows/.bump-minor-version.yml#universal-bootstrap",
+        ".github/workflows/.declarative-auditable-demo.yml#universal-bootstrap",
+        ".github/workflows/.gate-profile.yml#universal-bootstrap",
+        ".github/workflows/.publication-authority.yml#universal-bootstrap",
+        ".github/workflows/.release-candidate-promote.yml#universal-bootstrap",
+        ".github/workflows/.release-verify.yml#universal-bootstrap",
+        ".github/workflows/.sam-verify.yml#universal-bootstrap",
+        ".github/workflows/.sync-release-page.yml#universal-bootstrap",
+        ".github/workflows/.sync-remote-git.yml#universal-bootstrap",
+        ".github/workflows/.web-surface.yml#universal-bootstrap",
+        ".github/workflows/.wheel-verify.yml#universal-bootstrap",
+        ".github/workflows/build.yml#universal-bootstrap",
+        ".github/workflows/buildchain-patrol.yml#universal-bootstrap",
+        ".github/workflows/check.yml#universal-bootstrap",
+        ".github/workflows/dev-alpha-candidate-patrol.yml#universal-bootstrap",
+        ".github/workflows/dev-delivery-warrant-cancel.yml#universal-bootstrap",
+        ".github/workflows/dev-delivery-warrant-close.yml#universal-bootstrap",
+        ".github/workflows/dev-pr-auto-merge.yml#universal-bootstrap",
+        ".github/workflows/dev-qualification-patrol.yml#universal-bootstrap",
+        ".github/workflows/engineering-housekeeper.yml#universal-bootstrap",
+        ".github/workflows/github-artifact-attestation.yml#universal-bootstrap",
+        ".github/workflows/paper-release-sealed.yml#universal-bootstrap",
+        ".github/workflows/paper-release.yml#universal-bootstrap",
+        ".github/workflows/patrol-daily.yml#universal-bootstrap",
+        ".github/workflows/patrol-monthly.yml#universal-bootstrap",
+        ".github/workflows/patrol-observed-evidence.yml#universal-bootstrap",
+        ".github/workflows/patrol-weekly.yml#universal-bootstrap",
+        ".github/workflows/publication-artifact.yml#universal-bootstrap",
+        ".github/workflows/release-candidate-promote.yml#universal-bootstrap",
+        ".github/workflows/release-propagation.yml#universal-bootstrap",
+        ".github/workflows/release-tail.yml#universal-bootstrap",
+        ".github/workflows/stable-candidate-patrol.yml#universal-bootstrap",
+        ".github/workflows/v4-stage-capsule-canary.yml#universal-bootstrap",
+        ".github/workflows/v4-tail-reseal.yml#universal-bootstrap"
+      ]
+    },
+    {
+      "authorityClass": "governed-delegation",
+      "triggerClass": "mixed",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "mixed-trigger exact-candidate execution latency",
+        "expectedContributionSeconds": 0,
+        "rationale": "The opt-in universal path preserves the default compatibility lane and executes only an exact admitted runtime."
+      },
+      "laneIds": [
+        ".github/workflows/release-governance-reconcile.yml#universal-bootstrap",
+        ".github/workflows/v4-adopter-delivery.yml#universal-bootstrap"
+      ]
     }
   ]
 }