@kungfu-tech/buildchain 4.0.2-alpha.0 → 4.0.2-alpha.11

package/architecture/v4-release-topology.json

@@ -0,0 +1,317 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-release-topology/v1",
+  "sourceCut": {
+    "branch": "dev/v4/v4.0",
+    "commit": "c3a50c941d018fcc3bec624e19a1298357b7f84a",
+    "tree": "213cdcaded8d90c823ecdafdd9968bceceed9057"
+  },
+  "enforcement": "converged",
+  "closedWorld": {
+    "workflowPaths": [
+      ".github/workflows/.binary-release-assets.yml",
+      ".github/workflows/.build.yml",
+      ".github/workflows/.declarative-auditable-demo.yml",
+      ".github/workflows/.publication-authority.yml",
+      ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/.release-elastic-beanstalk.yml",
+      ".github/workflows/.release-new-version.yml",
+      ".github/workflows/.sam-release.yml",
+      ".github/workflows/.web-surface.yml",
+      ".github/workflows/.wheel-release.yml",
+      ".github/workflows/auditable-demo.yml",
+      ".github/workflows/binary-release-assets.yml",
+      ".github/workflows/build-surface-fixture.yml",
+      ".github/workflows/build.yml",
+      ".github/workflows/buildchain-alpha-self-dogfood.yml",
+      ".github/workflows/buildchain-dev-delivery.yml",
+      ".github/workflows/buildchain-ref-promotion-recovery.yml",
+      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/buildchain-patrol-daily.yml",
+      ".github/workflows/buildchain-patrol-monthly.yml",
+      ".github/workflows/buildchain-patrol-weekly.yml",
+      ".github/workflows/buildchain-stable-candidate-patrol.yml",
+      ".github/workflows/dev-alpha-candidate-patrol.yml",
+      ".github/workflows/dev-pr-auto-merge.yml",
+      ".github/workflows/github-artifact-attestation.yml",
+      ".github/workflows/npm-publish.yml",
+      ".github/workflows/paper-release-sealed.yml",
+      ".github/workflows/paper-release.yml",
+      ".github/workflows/patrol-observed-evidence.yml",
+      ".github/workflows/release-candidate-promote.yml",
+      ".github/workflows/release-line-bootstrap.yml",
+      ".github/workflows/release-new-version.yml",
+      ".github/workflows/release-propagation.yml",
+      ".github/workflows/release-tail.yml",
+      ".github/workflows/stable-candidate-patrol.yml",
+      ".github/workflows/v4-publication-rehearsal-dogfood.yml",
+      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+    ],
+    "unknownTopologyPolicy": "fail-closed"
+  },
+  "semanticScope": {
+    "workflowPaths": [
+      ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/buildchain-ref-promotion-recovery.yml",
+      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/release-candidate-promote.yml",
+      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+    ],
+    "excludedMechanisms": [
+      "Paper product release",
+      "npm dry-run",
+      "v3 rollback workflows",
+      "retired compatibility workflows"
+    ]
+  },
+  "authorityClosure": {
+    "providerAdapters": [
+      "actions/promote-buildchain-ref/github-release.js",
+      "actions/promote-buildchain-ref/v4-provider-plane.js",
+      "actions/release-tail/index.js",
+      "actions/v4-release-candidate-promote/index.js",
+      "actions/v4-release-candidate-promote/product-provider-adapters.js",
+      "actions/v4-release-candidate-promote/product-provider-github-adapters.js",
+      "actions/v4-release-candidate-promote/product-provider.js",
+      "packages/core/buildchain-agent-manuals.js",
+      "packages/core/index.js",
+      "packages/core/publication-rehearsal-runtime.js",
+      "packages/core/release-tail-provider-adapters.js",
+      "packages/core/release-tail-provider-plane.js",
+      "packages/core/v4-product-publication.js",
+      "packages/core/v4-publication-rehearsal-capsule.js",
+      "packages/core/v4-publication-rehearsal.js"
+    ],
+    "runtimeSelectors": [
+      ".github/workflows/.build.yml",
+      ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/.web-surface.yml",
+      ".github/workflows/buildchain-ref-promotion-recovery.yml",
+      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/paper-release.yml",
+      ".github/workflows/publication-artifact.yml",
+      ".github/workflows/release-candidate-promote.yml",
+      ".github/workflows/v4-tail-reseal.yml",
+      "packages/core/buildchain-contract.js",
+      "packages/core/v4-runtime-ref-resume-authority.js",
+      "packages/core/v4-runtime-selector-persistence.js",
+      "scripts/aggregate-build-summary.mjs",
+      "scripts/artifact-signing-controller-core.mjs",
+      "scripts/authorize-promotion-runtime-override.cjs",
+      "scripts/buildchain-contract-lock.mjs",
+      "scripts/check-inventory.mjs",
+      "scripts/generate-channel-promotion-workflow.mjs",
+      "scripts/generate-release-candidate-passport.mjs",
+      "scripts/release-candidate-resolver.mjs",
+      "scripts/resume-from-candidate-run.mjs",
+      "scripts/v4-declarative-promotion-admission.mjs",
+      "scripts/v4-release-candidate-adapter.mjs"
+    ],
+    "runtimeEngines": ["actions/v4-release-candidate-promote/index.js"],
+    "terminalProjections": [
+      ".github/workflows/.release-candidate-promote.yml",
+      "actions/v4-release-candidate-promote/index.js",
+      "packages/core/v4-release-invocation.js",
+      "scripts/v4-universal-workflow-engine.mjs"
+    ],
+    "privilegedExecutableClosure": {
+      "entrypoints": ["actions/v4-release-candidate-promote/index.js"],
+      "modules": [
+        "actions/promote-buildchain-ref/github-release.js",
+        "actions/promote-buildchain-ref/internal/version-state.js",
+        "actions/promote-buildchain-ref/reuse-complete-release.js",
+        "actions/promote-buildchain-ref/v4-provider-plane.js",
+        "actions/v4-release-candidate-promote/index.js",
+        "actions/v4-release-candidate-promote/product-provider-adapters.js",
+        "actions/v4-release-candidate-promote/product-provider-github-adapters.js",
+        "actions/v4-release-candidate-promote/product-provider.js",
+        "packages/core/adopter-delivery-gate.js",
+        "packages/core/adopter-delivery-json.js",
+        "packages/core/adopter-delivery-passport.js",
+        "packages/core/artifact-verification-envelope.js",
+        "packages/core/buildchain-channel-identity.js",
+        "packages/core/buildchain-compatibility-authority.js",
+        "packages/core/buildchain-compatibility-fact.js",
+        "packages/core/buildchain-compatibility-facts.json",
+        "packages/core/buildchain-compatibility-proof.js",
+        "packages/core/buildchain-config.js",
+        "packages/core/buildchain-contract.js",
+        "packages/core/buildchain-layout.js",
+        "packages/core/controller-evidence.js",
+        "packages/core/dev-delivery-common.js",
+        "packages/core/dev-delivery-contract-surface.js",
+        "packages/core/github-artifact-attestation.js",
+        "packages/core/kfd-adopter-manifest.js",
+        "packages/core/kfd-gate.js",
+        "packages/core/kfd-product-gates.js",
+        "packages/core/kungfu-temporal-fact.js",
+        "packages/core/package-manager.js",
+        "packages/core/public-surface-audit.js",
+        "packages/core/public-surface-cli.js",
+        "packages/core/publication-artifact-candidate.js",
+        "packages/core/publication-authority.js",
+        "packages/core/publication-sealed-bundle.js",
+        "packages/core/publish-transaction.js",
+        "packages/core/release-candidate-recovery.js",
+        "packages/core/release-candidate.js",
+        "packages/core/release-passport-contract.js",
+        "packages/core/release-passport.js",
+        "packages/core/release-tail-product-capabilities.js",
+        "packages/core/release-tail-provider-adapters.js",
+        "packages/core/release-tail-provider-plane.js",
+        "packages/core/spawn-command.js",
+        "packages/core/surface-manifest.js",
+        "packages/core/v4-canonical-contracts.js",
+        "packages/core/v4-floating-consumer-evidence.js",
+        "packages/core/v4-floating-consumer-policy.js",
+        "packages/core/v4-floating-consumer-release-passport.js",
+        "packages/core/v4-product-publication.js",
+        "packages/core/v4-protected-publication-source.js",
+        "packages/core/v4-publication-qualification.js",
+        "packages/core/v4-release-invocation.js",
+        "packages/core/v4-runtime-ref-resume-authority.js",
+        "packages/core/v4-runtime-selector-persistence.js",
+        "packages/core/web-surface-publication-candidate.js",
+        "packages/core/workflow-yaml-contract.js",
+        "scripts/ensure-github-release.mjs"
+      ],
+      "root": "sha256:31d13d74b8b3dadbfe4b5061c99f6f6711be6c3b06449114f2708427374f9c85"
+    },
+    "legacyEngineModules": [
+      "actions/promote-buildchain-ref/internal/durable-transaction-operations.js",
+      "actions/promote-buildchain-ref/internal/promote-alpha-channel.js",
+      "actions/promote-buildchain-ref/internal/promote-major-channel.js",
+      "actions/promote-buildchain-ref/internal/promote-release-channel.js",
+      "actions/promote-buildchain-ref/lib.js"
+    ],
+    "freshEntry": ".github/workflows/release-candidate-promote.yml",
+    "recoveryEntry": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+    "forbiddenLegacyEnginePatterns": [
+      "legacy-promote",
+      "v4-declarative-promote",
+      "BUILDCHAIN_DECLARATIVE_PROMOTION",
+      "Select declarative or legacy promotion result"
+    ]
+  },
+  "baselineMetrics": {
+    "workflowCount": 15,
+    "jobCount": 38,
+    "reusableEdgeCount": 11,
+    "mutationRelevantNodeCount": 25,
+    "contentsWriteJobCount": 10,
+    "oidcWriteJobCount": 9,
+    "semanticMutationRelevantNodeCount": 17
+  },
+  "targetBudgets": {
+    "semanticBoundaries": ["QUALIFY", "APPLY", "SETTLE"],
+    "maximumMutationRelevantNodeCount": 8,
+    "contentsWriteJobCount": 1,
+    "oidcWriteJobCount": 1,
+    "publisherIdentityCount": 1,
+    "runtimeIdentityCount": 1,
+    "terminalReceiptAuthorityCount": 1
+  },
+  "authorityClassification": {
+    "publisher": {
+      "current": [
+        ".github/workflows/.release-candidate-promote.yml#legacy-promote",
+        ".github/workflows/.release-candidate-promote.yml#v4-declarative-promote"
+      ],
+      "target": ".github/workflows/.release-candidate-promote.yml#apply"
+    },
+    "runtimeSelectors": {
+      "discoveryOnly": ["v4-alpha", "v4", "alpha/v4/v4.0"],
+      "postAdmissionPolicy": "exact-sha-only"
+    },
+    "engines": {
+      "current": ["legacy-promote", "v4-declarative-promote"],
+      "target": "release-transaction"
+    },
+    "terminalProjections": {
+      "current": ["promote", "controller-receipt", "release-tail receipt"],
+      "target": "ReleaseReceipt"
+    }
+  },
+  "observedTopology": {
+    "jobRecordFields": [
+      "id",
+      "kind",
+      "uses",
+      "contentsPermission",
+      "oidcPermission",
+      "carriers",
+      "mutationSignals"
+    ],
+    "workflows": [
+      {
+        "path": ".github/workflows/.release-candidate-promote.yml",
+        "triggers": ["workflow_call"],
+        "jobs": [
+          "apply|runner|-|write|write|artifactDownload,artifactUpload|contents-write,oidc-write,promotion-runtime",
+          "qualify|runner|-|read|-|artifactUpload,jobOutput|-",
+          "settle|runner|-|read|-|artifactDownload,artifactUpload,jobOutput|-"
+        ],
+        "reusableEdges": []
+      },
+      {
+        "path": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+        "triggers": ["workflow_dispatch"],
+        "jobs": [
+          "resume|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha"
+        ]
+      },
+      {
+        "path": ".github/workflows/buildchain-ref-promotion.yml",
+        "triggers": ["workflow_dispatch", "workflow_run:completed"],
+        "jobs": [
+          "promote|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
+          "reject-invalid-candidate-recovery|runner|-|read|-|-|-",
+          "reject-invalid-durable-recovery|runner|-|read|-|-|-",
+          "reject-manual-apply|runner|-|read|-|-|-"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha"
+        ]
+      },
+      {
+        "path": ".github/workflows/release-candidate-promote.yml",
+        "triggers": ["workflow_call"],
+        "jobs": [
+          "consumer-admission|runner|-|read|-|artifactUpload|-",
+          "invoke|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
+          "resolve-promotion|runner|-|read|-|jobOutput|-"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha"
+        ]
+      },
+      {
+        "path": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
+        "triggers": ["workflow_dispatch"],
+        "jobs": [
+          "publish|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|-|-|-|-"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha"
+        ]
+      }
+    ],
+    "metrics": {
+      "workflowCount": 37,
+      "jobCount": 92,
+      "reusableEdgeCount": 23,
+      "mutationRelevantNodeCount": 74,
+      "contentsWriteJobCount": 14,
+      "oidcWriteJobCount": 16
+    },
+    "semanticMetrics": {
+      "workflowCount": 5,
+      "mutationRelevantNodeCount": 8,
+      "contentsWriteJobCount": 1,
+      "oidcWriteJobCount": 1
+    }
+  }
+}

package/architecture/v4-runtime-semantic-closure.json

@@ -73,7 +73,10 @@
       "stateAuthority": "single-writer-state-machine",
       "legacyFallbackAllowed": false,
       "providerDecisionAuthorityAllowed": false,
-      "implementation": ["packages/core/dev-delivery-warrant.js"],
+      "implementation": [
+        "packages/core/dev-delivery-warrant-native-compatibility.js",
+        "packages/core/dev-delivery-warrant.js"
+      ],
       "invariants": {
         "exactHeadFence": true,
         "immutableRootFence": true,

package/architecture/v4-universal-workflow-bootstrap.json

@@ -0,0 +1,181 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-bootstrap/v1",
+  "status": "migration-active",
+  "bootstrap": {
+    "publicWorkflow": ".github/workflows/bootstrap.yml",
+    "requestSchema": "kungfu-buildchain-v4-universal-workflow-request/v1",
+    "admissionSchema": "kungfu-buildchain-v4-universal-workflow-admission/v1",
+    "terminalReceiptSchema": "kungfu-buildchain-v4-universal-workflow-terminal-receipt/v1",
+    "candidateRepository": "kungfu-systems/buildchain",
+    "candidateEnginePath": "scripts/v4-universal-workflow-engine.mjs",
+    "consumerTemplate": "templates/universal-buildchain-bootstrap.yml",
+    "consumerRecoveryTemplate": "templates/universal-buildchain-bootstrap-recovery.yml",
+    "consumerRecoveryWorkflow": ".github/workflows/universal-bootstrap-recovery.yml",
+    "consumerRecoveryMode": "separate-pre-positioned-consumer-owned-shell",
+    "recoveryDependsOnPublishedBuildchain": false,
+    "selfDogfoodWorkflow": ".github/workflows/universal-bootstrap-dogfood.yml",
+    "faultCampaign": "architecture/v4-universal-workflow-fault-campaign.json",
+    "discoveryRefExecutionAuthority": false,
+    "exactShaExecutionAuthority": true,
+    "consumerSourceMutationPerIncident": false,
+    "consumerAdmission": "verified-caller-exact-repository-workflow-and-source",
+    "buildchainReleasePromotionPerIncident": false,
+    "selfDogfoodUsesPublicContract": true
+  },
+  "capabilityAdapters": [
+    {
+      "id": "bootstrap-conformance",
+      "execution": "exact-candidate-engine",
+      "payloadSchema": "kungfu-buildchain-v4-universal-bootstrap-conformance/v1",
+      "providerEffects": false
+    },
+    {
+      "id": "release-candidate-promote",
+      "execution": "exact-candidate-action-and-provider-readback",
+      "payloadSchema": "kungfu-buildchain-v4-universal-release-promotion/v1",
+      "providerEffects": true
+    },
+    {
+      "id": "release-invocation",
+      "execution": "exact-candidate-canonical-projection",
+      "payloadSchema": "kungfu-buildchain-v4-release-invocation/v1",
+      "providerEffects": false
+    }
+  ],
+  "complexityBudget": {
+    "bootstrapAbis": 1,
+    "requestEnvelopes": 1,
+    "candidateResolvers": 1,
+    "candidateEngines": 1,
+    "terminalReceiptAuthorities": 1,
+    "perWorkflowBootstrapImplementations": 0,
+    "buildchainOnlySelfReleasePaths": 0,
+    "perIncidentConsumerEdits": 0
+  },
+  "permissionCeiling": {
+    "actions": "write",
+    "artifact-metadata": "write",
+    "attestations": "write",
+    "checks": "write",
+    "contents": "write",
+    "deployments": "write",
+    "id-token": "write",
+    "issues": "write",
+    "packages": "write",
+    "pages": "write",
+    "pull-requests": "write",
+    "security-events": "write",
+    "statuses": "write"
+  },
+  "inventoryWorkflows": [
+    ".github/workflows/.auditable-demo.yml",
+    ".github/workflows/.binary-release-assets.yml",
+    ".github/workflows/.build.yml",
+    ".github/workflows/.bump-minor-version.yml",
+    ".github/workflows/.declarative-auditable-demo.yml",
+    ".github/workflows/.gate-profile.yml",
+    ".github/workflows/.publication-authority.yml",
+    ".github/workflows/.release-candidate-promote.yml",
+    ".github/workflows/.release-docker.yml",
+    ".github/workflows/.release-elastic-beanstalk.yml",
+    ".github/workflows/.release-new-version.yml",
+    ".github/workflows/.release-verify.yml",
+    ".github/workflows/.sam-release.yml",
+    ".github/workflows/.sam-verify.yml",
+    ".github/workflows/.sync-release-page.yml",
+    ".github/workflows/.sync-remote-git.yml",
+    ".github/workflows/.web-surface.yml",
+    ".github/workflows/.wheel-release.yml",
+    ".github/workflows/.wheel-verify.yml",
+    ".github/workflows/bootstrap.yml",
+    ".github/workflows/build.yml",
+    ".github/workflows/buildchain-patrol.yml",
+    ".github/workflows/check.yml",
+    ".github/workflows/dev-alpha-candidate-patrol.yml",
+    ".github/workflows/dev-delivery-warrant-cancel.yml",
+    ".github/workflows/dev-delivery-warrant-close.yml",
+    ".github/workflows/dev-pr-auto-merge.yml",
+    ".github/workflows/dev-qualification-patrol.yml",
+    ".github/workflows/engineering-housekeeper.yml",
+    ".github/workflows/github-artifact-attestation.yml",
+    ".github/workflows/paper-release-sealed.yml",
+    ".github/workflows/paper-release.yml",
+    ".github/workflows/patrol-daily.yml",
+    ".github/workflows/patrol-monthly.yml",
+    ".github/workflows/patrol-observed-evidence.yml",
+    ".github/workflows/patrol-weekly.yml",
+    ".github/workflows/publication-artifact.yml",
+    ".github/workflows/release-candidate-promote.yml",
+    ".github/workflows/release-governance-reconcile.yml",
+    ".github/workflows/release-propagation.yml",
+    ".github/workflows/release-tail.yml",
+    ".github/workflows/stable-candidate-patrol.yml",
+    ".github/workflows/universal-bootstrap-recovery.yml",
+    ".github/workflows/v4-adopter-delivery.yml",
+    ".github/workflows/v4-stage-capsule-canary.yml",
+    ".github/workflows/v4-tail-reseal.yml"
+  ],
+  "retiredWorkflowSurfaces": [
+    ".github/workflows/.release-docker.yml",
+    ".github/workflows/.release-elastic-beanstalk.yml",
+    ".github/workflows/.release-new-version.yml",
+    ".github/workflows/.sam-release.yml",
+    ".github/workflows/.wheel-release.yml"
+  ],
+  "bootstrapGovernedWorkflows": [
+    ".github/workflows/.auditable-demo.yml",
+    ".github/workflows/.binary-release-assets.yml",
+    ".github/workflows/.build.yml",
+    ".github/workflows/.bump-minor-version.yml",
+    ".github/workflows/.declarative-auditable-demo.yml",
+    ".github/workflows/.gate-profile.yml",
+    ".github/workflows/.publication-authority.yml",
+    ".github/workflows/.release-candidate-promote.yml",
+    ".github/workflows/.release-verify.yml",
+    ".github/workflows/.sam-verify.yml",
+    ".github/workflows/.sync-release-page.yml",
+    ".github/workflows/.sync-remote-git.yml",
+    ".github/workflows/.web-surface.yml",
+    ".github/workflows/.wheel-verify.yml",
+    ".github/workflows/bootstrap.yml",
+    ".github/workflows/build.yml",
+    ".github/workflows/buildchain-patrol.yml",
+    ".github/workflows/check.yml",
+    ".github/workflows/dev-alpha-candidate-patrol.yml",
+    ".github/workflows/dev-delivery-warrant-cancel.yml",
+    ".github/workflows/dev-delivery-warrant-close.yml",
+    ".github/workflows/dev-pr-auto-merge.yml",
+    ".github/workflows/dev-qualification-patrol.yml",
+    ".github/workflows/engineering-housekeeper.yml",
+    ".github/workflows/github-artifact-attestation.yml",
+    ".github/workflows/paper-release-sealed.yml",
+    ".github/workflows/paper-release.yml",
+    ".github/workflows/patrol-daily.yml",
+    ".github/workflows/patrol-monthly.yml",
+    ".github/workflows/patrol-observed-evidence.yml",
+    ".github/workflows/patrol-weekly.yml",
+    ".github/workflows/publication-artifact.yml",
+    ".github/workflows/release-candidate-promote.yml",
+    ".github/workflows/release-governance-reconcile.yml",
+    ".github/workflows/release-propagation.yml",
+    ".github/workflows/release-tail.yml",
+    ".github/workflows/stable-candidate-patrol.yml",
+    ".github/workflows/v4-adopter-delivery.yml",
+    ".github/workflows/v4-stage-capsule-canary.yml",
+    ".github/workflows/v4-tail-reseal.yml"
+  ],
+  "migration": {
+    "compatibilityFacadeGenerator": "scripts/generate-v4-universal-workflow-facades.mjs",
+    "facadeSourceRevision": "e211a3535b4b3c9a921324ea1a81522a4e271b98",
+    "channelGeneratedFacades": [
+      ".github/workflows/build.yml",
+      ".github/workflows/release-candidate-promote.yml"
+    ],
+    "staticBootstrap": "implemented",
+    "candidateEngine": "bounded-capability-adapters",
+    "compatibilityFacades": "generated-dual-path",
+    "externalConsumerDogfood": "public-consumer-three-platform-runtime-and-non-circular-recovery-hosted-proof-passed",
+    "buildchainSelfDogfood": "train-primary-and-consumer-recovery-three-pair-hosted-proof-passed",
+    "oldPathRetirement": "pending-protected-dev-integration"
+  }
+}

package/architecture/v4-universal-workflow-fault-campaign.json

@@ -0,0 +1,72 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-fault-campaign/v1",
+  "independentFaultsOnly": true,
+  "simultaneousPrimaryAndRecoveryFailureClaimed": false,
+  "externalBoundary": {
+    "id": "github-workflow-parser-or-service-unavailable",
+    "classification": "irreducible-external-availability",
+    "recovered": false
+  },
+  "faults": [
+    {
+      "id": "primary-facade",
+      "injectionTarget": "templates/universal-buildchain-bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "typed-input-adapter",
+      "injectionTarget": "packages/core/v4-universal-workflow-bootstrap.js",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
+    },
+    {
+      "id": "route-selector",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "ordinary-candidate-loader",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "router",
+      "injectionTarget": "packages/core/v4-release-invocation.js",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
+    },
+    {
+      "id": "action",
+      "injectionTarget": "actions/v4-release-candidate-promote/action.yml",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "actions/v4-release-candidate-promote/dist/index.js"
+    },
+    {
+      "id": "cli-runtime",
+      "injectionTarget": "scripts/v4-universal-workflow-engine.mjs",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
+    },
+    {
+      "id": "recovery-logic",
+      "injectionTarget": "templates/universal-buildchain-bootstrap-recovery.yml",
+      "recoveryRoute": "primary-bootstrap-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap.yml"
+    },
+    {
+      "id": "result-projection",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "self-dogfood-caller",
+      "injectionTarget": ".github/workflows/universal-bootstrap-dogfood.yml",
+      "recoveryRoute": "consumer-equivalent-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    }
+  ]
+}

package/architecture/v4-universal-workflow-train-admission.json

@@ -0,0 +1,40 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-admission-policy/v1",
+  "sourceRepository": "kungfu-systems/buildchain",
+  "consumerAdmission": "verified-caller",
+  "allowedCapabilities": [
+    "bootstrap-conformance",
+    "release-candidate-promote",
+    "release-invocation"
+  ],
+  "permissionCeiling": {
+    "actions": "write",
+    "artifact-metadata": "write",
+    "attestations": "write",
+    "checks": "write",
+    "contents": "write",
+    "deployments": "write",
+    "id-token": "write",
+    "issues": "write",
+    "packages": "write",
+    "pages": "write",
+    "pull-requests": "write",
+    "security-events": "write",
+    "statuses": "write"
+  },
+  "contractRoots": [
+    "sha256:3e5ec3bb803169de0b64747cbc1e5bbff536a8409d7ba1a6528f2930bc294a5c",
+    "sha256:60fc0802b7e46cb4460264b8b7359d06b2406d66a9d805d0d076bb692f80b35e",
+    "sha256:65a0c2fc3faecaddf5076fff086b5d6e12eb9ba27796efc10aed19f2d93b9457",
+    "sha256:93cd47a50798199fcb778e90b338542ab58842392da11cc4f8914525e98790be",
+    "sha256:a31570dd0f1a85dae851a9acd3731a60967c474cd09615a11d6d8d10c6f9a78b",
+    "sha256:b6737ed958e8f53f7770b1c214c092591573ad63af41e05797117d9b7b212ed8",
+    "sha256:d6ad9cf661c0ba3825cabdc7185fd122a60fc1929dfc799cda3352650588663f"
+  ],
+  "targetRef": "dev/v4/v4.0",
+  "allowedReviewers": ["kungfu-origin"],
+  "minimumApprovals": 1,
+  "requiredChecks": ["check"],
+  "validFrom": "2026-08-30T00:00:00.000Z",
+  "expiresAt": "2026-09-07T00:00:00.000Z"
+}

package/contracts/buildchain-v2-residuals-v1.json

@@ -16,15 +16,6 @@
       "owner": "buildchain-maintainers",
       "sunsetCondition": "Remove after every known caller migrates to the lifecycle version command."
     },
-    {
-      "path": ".github/workflows/.release-candidate-promote.yml",
-      "token": "actions/create-github-app-token@v2",
-      "expectedOccurrences": 1,
-      "classification": "third-party-action-version",
-      "callerStatus": "active",
-      "owner": "actions/create-github-app-token maintainers",
-      "sunsetCondition": "Upgrade through normal dependency review when a compatible successor is adopted."
-    },
     {
       "path": ".github/workflows/.release-docker.yml",
       "token": "workflows v2 Docker release path is retired",

package/contracts/fixtures/v4-tail-reseal-v1/valid.json

@@ -22,7 +22,7 @@
     "ref": "v4-alpha",
     "sha": "dddddddddddddddddddddddddddddddddddddddd",
     "contractRoot": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
-    "consumerPolicyReceiptRoot": "sha256:e545cb7dc918ba14b02e9a557623edb7aaadeee180b211b8a3164d67af03e789"
+    "consumerPolicyReceiptRoot": "sha256:8d8e55a4ae07a57a2a262e138f55148b05916c364b3d086530e1392c982b886f"
   },
   "warrant": {
     "candidateId": "candidate-alpha-2",