@kungfu-tech/buildchain 4.0.2-alpha.2 → 4.0.2-alpha.20

package/docs/node-api-reference.md

@@ -117,7 +117,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain";` | `packages/core/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:64` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:65` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain";` | `packages/core/build-facts.js:45` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:199` |
@@ -188,7 +188,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain";` | `packages/core/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:88` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:89` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain";` | `packages/core/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/cache-evidence.js:169` |
@@ -288,7 +288,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `enumerateSitePages` | function: function enumerateSitePages({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateSitePages } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:106` |
 | `enumerateWorkflowInputs` | function: function enumerateWorkflowInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateWorkflowInputs } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:74` |
 | `evaluateBuildchainContractLock` | function: function evaluateBuildchainContractLock(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateBuildchainContractLock } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-contract.js:1007` |
-| `evaluateCiLaneChangeBudget` | function: function evaluateCiLaneChangeBudget({ policy, workflows, baselineWorkflows = null, } = {}) | { policy, workflows, baselineWorkflows = null, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateCiLaneChangeBudget } from "@kungfu-tech/buildchain";` | `packages/core/ci-lane-change-budget.js:180` |
+| `evaluateCiLaneChangeBudget` | function: function evaluateCiLaneChangeBudget({ policy, workflows, baselineWorkflows = null, } = {}) | { policy, workflows, baselineWorkflows = null, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateCiLaneChangeBudget } from "@kungfu-tech/buildchain";` | `packages/core/ci-lane-change-budget.js:181` |
 | `evaluateCodeownersAuthority` | function: function evaluateCodeownersAuthority({ source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {}) | { source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateCodeownersAuthority } from "@kungfu-tech/buildchain";` | `packages/core/github-governance-authority.js:430` |
 | `evaluateGithubGovernanceSnapshot` | function: function evaluateGithubGovernanceSnapshot({ descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {}) | { descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateGithubGovernanceSnapshot } from "@kungfu-tech/buildchain";` | `packages/core/github-governance-authority.js:697` |
 | `evaluateKfdProductGate` | function: async function evaluateKfdProductGate({ cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateKfdProductGate } from "@kungfu-tech/buildchain";` | `packages/core/kfd-product-gates.js:419` |
@@ -510,7 +510,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `RELEASE_PROPAGATION_STAGE_RECEIPT_CONTRACT` | constant: const RELEASE_PROPAGATION_STAGE_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_STAGE_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work-constants.js:2` |
 | `RELEASE_PROPAGATION_WORK_CONTRACT` | constant: const RELEASE_PROPAGATION_WORK_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_WORK_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work-constants.js:1` |
 | `RELEASE_PROPAGATION_WORK_STAGES` | constant: const RELEASE_PROPAGATION_WORK_STAGES | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_WORK_STAGES } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work-constants.js:4` |
-| `RELEASE_TAIL_CAPABILITY_REGISTRY` | constant: const RELEASE_TAIL_CAPABILITY_REGISTRY | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_CAPABILITY_REGISTRY } from "@kungfu-tech/buildchain";` | `packages/core/release-tail-provider-plane.js:31` |
+| `RELEASE_TAIL_CAPABILITY_REGISTRY` | constant: const RELEASE_TAIL_CAPABILITY_REGISTRY | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_CAPABILITY_REGISTRY } from "@kungfu-tech/buildchain";` | `packages/core/release-tail-provider-plane.js:30` |
 | `RELEASE_TAIL_COMPATIBILITY_CONTRACT` | constant: const RELEASE_TAIL_COMPATIBILITY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_COMPATIBILITY_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-tail-compatibility.js:1` |
 | `RELEASE_TAIL_DECLARATION_CONTRACT` | constant: const RELEASE_TAIL_DECLARATION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_DECLARATION_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-tail-provider-plane.js:5` |
 | `RELEASE_TAIL_EFFECT_SCHEMA` | constant: const RELEASE_TAIL_EFFECT_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_EFFECT_SCHEMA } from "@kungfu-tech/buildchain";` | `packages/core/release-tail-provider-plane.js:10` |
@@ -806,7 +806,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:64` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:65` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/build-facts.js:45` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:199` |
@@ -877,7 +877,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain/core";` | `packages/core/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:88` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:89` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain/core";` | `packages/core/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/cache-evidence.js:169` |
@@ -977,7 +977,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `enumerateSitePages` | function: function enumerateSitePages({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateSitePages } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:106` |
 | `enumerateWorkflowInputs` | function: function enumerateWorkflowInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateWorkflowInputs } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:74` |
 | `evaluateBuildchainContractLock` | function: function evaluateBuildchainContractLock(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateBuildchainContractLock } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-contract.js:1007` |
-| `evaluateCiLaneChangeBudget` | function: function evaluateCiLaneChangeBudget({ policy, workflows, baselineWorkflows = null, } = {}) | { policy, workflows, baselineWorkflows = null, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateCiLaneChangeBudget } from "@kungfu-tech/buildchain/core";` | `packages/core/ci-lane-change-budget.js:180` |
+| `evaluateCiLaneChangeBudget` | function: function evaluateCiLaneChangeBudget({ policy, workflows, baselineWorkflows = null, } = {}) | { policy, workflows, baselineWorkflows = null, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateCiLaneChangeBudget } from "@kungfu-tech/buildchain/core";` | `packages/core/ci-lane-change-budget.js:181` |
 | `evaluateCodeownersAuthority` | function: function evaluateCodeownersAuthority({ source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {}) | { source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateCodeownersAuthority } from "@kungfu-tech/buildchain/core";` | `packages/core/github-governance-authority.js:430` |
 | `evaluateGithubGovernanceSnapshot` | function: function evaluateGithubGovernanceSnapshot({ descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {}) | { descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateGithubGovernanceSnapshot } from "@kungfu-tech/buildchain/core";` | `packages/core/github-governance-authority.js:697` |
 | `evaluateKfdProductGate` | function: async function evaluateKfdProductGate({ cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateKfdProductGate } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd-product-gates.js:419` |
@@ -1199,7 +1199,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `RELEASE_PROPAGATION_STAGE_RECEIPT_CONTRACT` | constant: const RELEASE_PROPAGATION_STAGE_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_STAGE_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work-constants.js:2` |
 | `RELEASE_PROPAGATION_WORK_CONTRACT` | constant: const RELEASE_PROPAGATION_WORK_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_WORK_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work-constants.js:1` |
 | `RELEASE_PROPAGATION_WORK_STAGES` | constant: const RELEASE_PROPAGATION_WORK_STAGES | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_WORK_STAGES } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work-constants.js:4` |
-| `RELEASE_TAIL_CAPABILITY_REGISTRY` | constant: const RELEASE_TAIL_CAPABILITY_REGISTRY | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_CAPABILITY_REGISTRY } from "@kungfu-tech/buildchain/core";` | `packages/core/release-tail-provider-plane.js:31` |
+| `RELEASE_TAIL_CAPABILITY_REGISTRY` | constant: const RELEASE_TAIL_CAPABILITY_REGISTRY | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_CAPABILITY_REGISTRY } from "@kungfu-tech/buildchain/core";` | `packages/core/release-tail-provider-plane.js:30` |
 | `RELEASE_TAIL_COMPATIBILITY_CONTRACT` | constant: const RELEASE_TAIL_COMPATIBILITY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_COMPATIBILITY_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-tail-compatibility.js:1` |
 | `RELEASE_TAIL_DECLARATION_CONTRACT` | constant: const RELEASE_TAIL_DECLARATION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_DECLARATION_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-tail-provider-plane.js:5` |
 | `RELEASE_TAIL_EFFECT_SCHEMA` | constant: const RELEASE_TAIL_EFFECT_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_EFFECT_SCHEMA } from "@kungfu-tech/buildchain/core";` | `packages/core/release-tail-provider-plane.js:10` |
@@ -1560,7 +1560,7 @@ Target: `./packages/core/ci-lane-change-budget.js`. Public symbols: 2.
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | `CI_LANE_CHANGE_BUDGET_CONTRACT` | constant: const CI_LANE_CHANGE_BUDGET_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { CI_LANE_CHANGE_BUDGET_CONTRACT } from "@kungfu-tech/buildchain/ci-lane-change-budget";` | `packages/core/ci-lane-change-budget.js:4` |
-| `evaluateCiLaneChangeBudget` | function: function evaluateCiLaneChangeBudget({ policy, workflows, baselineWorkflows = null, } = {}) | { policy, workflows, baselineWorkflows = null, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateCiLaneChangeBudget } from "@kungfu-tech/buildchain/ci-lane-change-budget";` | `packages/core/ci-lane-change-budget.js:180` |
+| `evaluateCiLaneChangeBudget` | function: function evaluateCiLaneChangeBudget({ policy, workflows, baselineWorkflows = null, } = {}) | { policy, workflows, baselineWorkflows = null, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateCiLaneChangeBudget } from "@kungfu-tech/buildchain/ci-lane-change-budget";` | `packages/core/ci-lane-change-budget.js:181` |
 
 ## `@kungfu-tech/buildchain/channel-candidate`
 
@@ -1688,13 +1688,13 @@ Target: `./packages/core/dev-delivery-authority-landing.js`. Public symbols: 35.
 
 ## `@kungfu-tech/buildchain/dev-delivery-warrant`
 
-Target: `./packages/core/dev-delivery-warrant.js`. Public symbols: 56.
+Target: `./packages/core/dev-delivery-warrant.js`. Public symbols: 59.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `cancelQueuedDevDeliveryCandidate` | function: function cancelQueuedDevDeliveryCandidate(queueInput, input, options) | queueInput, input, options | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { cancelQueuedDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:512` |
+| `cancelQueuedDevDeliveryCandidate` | function: function cancelQueuedDevDeliveryCandidate(queueInput, input, options) | queueInput, input, options | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { cancelQueuedDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:520` |
 | `classifyDevDeliveryDelta` | function: function classifyDevDeliveryDelta({ proof, current = {} } = {}) | { proof, current = {} } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { classifyDevDeliveryDelta } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:109` |
-| `closeDevDeliveryWarrant` | function: function closeDevDeliveryWarrant(queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {}) | queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { closeDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:387` |
+| `closeDevDeliveryWarrant` | function: function closeDevDeliveryWarrant(queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {}) | queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { closeDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:395` |
 | `createDevDeliveryQueue` | value: createDevDeliveryQueue | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { createDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `createIntegrationDeliveryProof` | function: function createIntegrationDeliveryProof(input = {}) | input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createIntegrationDeliveryProof } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:241` |
 | `createNativeCommandContract` | value: createNativeCommandContract | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { createNativeCommandContract } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-native-proof.js:1` |
@@ -1711,6 +1711,7 @@ Target: `./packages/core/dev-delivery-warrant.js`. Public symbols: 56.
 | `DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA` | value: DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `DEV_DELIVERY_CLASSES` | value: DEV_DELIVERY_CLASSES | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_CLASSES } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `DEV_DELIVERY_LEASE_RECEIPT_SCHEMA` | value: DEV_DELIVERY_LEASE_RECEIPT_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_LEASE_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
+| `DEV_DELIVERY_MINIMUM_WRITER_PROTOCOL_ROOT` | value: DEV_DELIVERY_MINIMUM_WRITER_PROTOCOL_ROOT | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_MINIMUM_WRITER_PROTOCOL_ROOT } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `DEV_DELIVERY_PRIORITIES` | value: DEV_DELIVERY_PRIORITIES | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_PRIORITIES } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `DEV_DELIVERY_QUALIFICATION_RECEIPT_SCHEMA` | constant: const DEV_DELIVERY_QUALIFICATION_RECEIPT_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { DEV_DELIVERY_QUALIFICATION_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-native-proof.js:41` |
 | `DEV_DELIVERY_QUEUE_CONTRACT` | value: DEV_DELIVERY_QUEUE_CONTRACT | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_QUEUE_CONTRACT } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
@@ -1719,8 +1720,10 @@ Target: `./packages/core/dev-delivery-warrant.js`. Public symbols: 56.
 | `DEV_DELIVERY_SUBMISSION_RECEIPT_SCHEMA` | value: DEV_DELIVERY_SUBMISSION_RECEIPT_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_SUBMISSION_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `DEV_DELIVERY_TERMINAL_EVIDENCE_CORRECTION_SCHEMA` | value: DEV_DELIVERY_TERMINAL_EVIDENCE_CORRECTION_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_TERMINAL_EVIDENCE_CORRECTION_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `DEV_DELIVERY_WARRANT_SCHEMA` | value: DEV_DELIVERY_WARRANT_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_WARRANT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
+| `DEV_DELIVERY_WRITER_PROTOCOL_FENCE_RECEIPT_SCHEMA` | value: DEV_DELIVERY_WRITER_PROTOCOL_FENCE_RECEIPT_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_WRITER_PROTOCOL_FENCE_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `devDeliveryContentRoot` | function: function devDeliveryContentRoot(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { devDeliveryContentRoot } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-common.js:27` |
-| `heartbeatDevDeliveryWarrant` | function: function heartbeatDevDeliveryWarrant(queueInput, warrant, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, warrant, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { heartbeatDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:258` |
+| `fenceDevDeliveryWriterProtocol` | value: fenceDevDeliveryWriterProtocol | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { fenceDevDeliveryWriterProtocol } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
+| `heartbeatDevDeliveryWarrant` | function: function heartbeatDevDeliveryWarrant(queueInput, warrant, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, warrant, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { heartbeatDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:266` |
 | `INTEGRATION_DELIVERY_PROOF_SCHEMA` | constant: const INTEGRATION_DELIVERY_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { INTEGRATION_DELIVERY_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:6` |
 | `NATIVE_COMMAND_CONTRACT_SCHEMA` | value: NATIVE_COMMAND_CONTRACT_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { NATIVE_COMMAND_CONTRACT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-native-proof.js:1` |
 | `NATIVE_EXECUTION_BINDING_SCHEMA` | value: NATIVE_EXECUTION_BINDING_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { NATIVE_EXECUTION_BINDING_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-native-proof.js:1` |
@@ -1730,15 +1733,15 @@ Target: `./packages/core/dev-delivery-warrant.js`. Public symbols: 56.
 | `NATIVE_QUALIFICATION_PROOF_SCHEMA` | constant: const NATIVE_QUALIFICATION_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { NATIVE_QUALIFICATION_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-native-proof.js:31` |
 | `normalizeDevDeliveryQueue` | value: normalizeDevDeliveryQueue | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { normalizeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
 | `normalizeNativeCommandContract` | value: normalizeNativeCommandContract | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { normalizeNativeCommandContract } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-native-proof.js:1` |
-| `observeDevDeliveryQueue` | function: function observeDevDeliveryQueue(queueInput, { now = new Date().toISOString(), allowLegacyV3Readback = false } = {}) | queueInput, { now = new Date().toISOString(), allowLegacyV3Readback = false } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { observeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:526` |
+| `observeDevDeliveryQueue` | function: function observeDevDeliveryQueue(queueInput, { now = new Date().toISOString(), allowLegacyV3Readback = false } = {}) | queueInput, { now = new Date().toISOString(), allowLegacyV3Readback = false } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { observeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:534` |
 | `PROJECT_CUT_REPLAY_PROOF_SCHEMA` | constant: const PROJECT_CUT_REPLAY_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { PROJECT_CUT_REPLAY_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:5` |
-| `qualifyDevDeliveryWarrant` | constant: const qualifyDevDeliveryWarrant | none | value | Import does not declare a throw contract. | none-on-import | `import { qualifyDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:383` |
+| `qualifyDevDeliveryWarrant` | constant: const qualifyDevDeliveryWarrant | none | value | Import does not declare a throw contract. | none-on-import | `import { qualifyDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:391` |
 | `rankDevDeliveryCandidates` | value: rankDevDeliveryCandidates | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { rankDevDeliveryCandidates } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
-| `reconcileDevDeliveryTerminalEvidence` | constant: const reconcileDevDeliveryTerminalEvidence | none | value | Import does not declare a throw contract. | none-on-import | `import { reconcileDevDeliveryTerminalEvidence } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:521` |
-| `recoverExpiredDevDeliveryWarrant` | function: function recoverExpiredDevDeliveryWarrant(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoverExpiredDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:304` |
+| `reconcileDevDeliveryTerminalEvidence` | constant: const reconcileDevDeliveryTerminalEvidence | none | value | Import does not declare a throw contract. | none-on-import | `import { reconcileDevDeliveryTerminalEvidence } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:529` |
+| `recoverExpiredDevDeliveryWarrant` | function: function recoverExpiredDevDeliveryWarrant(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoverExpiredDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:312` |
 | `RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA` | constant: const RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/release-blocker-priority.js:15` |
-| `selectDevDeliveryWarrant` | function: function selectDevDeliveryWarrant(queueInput, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { selectDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:98` |
-| `settleDevDeliveryTerminalEvent` | constant: const settleDevDeliveryTerminalEvent | none | value | Import does not declare a throw contract. | none-on-import | `import { settleDevDeliveryTerminalEvent } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:515` |
+| `selectDevDeliveryWarrant` | function: function selectDevDeliveryWarrant(queueInput, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { selectDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:106` |
+| `settleDevDeliveryTerminalEvent` | constant: const settleDevDeliveryTerminalEvent | none | value | Import does not declare a throw contract. | none-on-import | `import { settleDevDeliveryTerminalEvent } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:523` |
 | `SOURCE_QUALIFICATION_PROOF_SCHEMA` | constant: const SOURCE_QUALIFICATION_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { SOURCE_QUALIFICATION_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:3` |
 | `SOURCE_QUALIFICATION_PROOF_V2_SCHEMA` | constant: const SOURCE_QUALIFICATION_PROOF_V2_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { SOURCE_QUALIFICATION_PROOF_V2_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:4` |
 | `submitDevDeliveryCandidate` | value: submitDevDeliveryCandidate | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { submitDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
@@ -2419,8 +2422,8 @@ Target: `./packages/core/buildchain-publication-authority.js`. Public symbols: 2
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:64` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:88` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:65` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:89` |
 
 ## `@kungfu-tech/buildchain/github-governance-authority`
 
@@ -2764,7 +2767,7 @@ Target: `./packages/core/release-tail-provider-plane.js`. Public symbols: 20.
 | `executeReleaseTailTransaction` | function: async function executeReleaseTailTransaction(transaction, { adapters, checkpoint: checkpointCallback } = {}) | transaction, { adapters, checkpoint: checkpointCallback } = {} | Promise<unknown> | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { executeReleaseTailTransaction } from "@kungfu-tech/buildchain/release-tail-provider-plane";` | `packages/core/release-tail-provider-plane.js:1016` |
 | `parseReleaseTailDeclaration` | function: function parseReleaseTailDeclaration(input) | input | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { parseReleaseTailDeclaration } from "@kungfu-tech/buildchain/release-tail-provider-plane";` | `packages/core/release-tail-provider-plane.js:491` |
 | `readReleaseTailTransaction` | function: function readReleaseTailTransaction(filePath) | filePath | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { readReleaseTailTransaction } from "@kungfu-tech/buildchain/release-tail-provider-plane";` | `packages/core/release-tail-provider-plane.js:830` |
-| `RELEASE_TAIL_CAPABILITY_REGISTRY` | constant: const RELEASE_TAIL_CAPABILITY_REGISTRY | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_CAPABILITY_REGISTRY } from "@kungfu-tech/buildchain/release-tail-provider-plane";` | `packages/core/release-tail-provider-plane.js:31` |
+| `RELEASE_TAIL_CAPABILITY_REGISTRY` | constant: const RELEASE_TAIL_CAPABILITY_REGISTRY | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_CAPABILITY_REGISTRY } from "@kungfu-tech/buildchain/release-tail-provider-plane";` | `packages/core/release-tail-provider-plane.js:30` |
 | `RELEASE_TAIL_DECLARATION_CONTRACT` | constant: const RELEASE_TAIL_DECLARATION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_DECLARATION_CONTRACT } from "@kungfu-tech/buildchain/release-tail-provider-plane";` | `packages/core/release-tail-provider-plane.js:5` |
 | `RELEASE_TAIL_EFFECT_SCHEMA` | constant: const RELEASE_TAIL_EFFECT_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_EFFECT_SCHEMA } from "@kungfu-tech/buildchain/release-tail-provider-plane";` | `packages/core/release-tail-provider-plane.js:10` |
 | `RELEASE_TAIL_OBSERVATION_SCHEMA` | constant: const RELEASE_TAIL_OBSERVATION_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_OBSERVATION_SCHEMA } from "@kungfu-tech/buildchain/release-tail-provider-plane";` | `packages/core/release-tail-provider-plane.js:12` |

package/docs/reusable-build-surface.md

@@ -132,6 +132,22 @@ See the normative
 and its machine declaration for the exact acceptance boundary. This policy does
 not change v3 behavior.
 
+### Universal Bootstrap verified-caller admission
+
+The v4 Universal Bootstrap does not maintain a repository allowlist. Any
+repository that can call the public reusable workflow may submit the single
+versioned request envelope. Admission still fails closed unless the request's
+consumer repository, caller workflow path, and source SHA exactly match the
+GitHub-observed caller context.
+
+Open consumer admission does not mean open execution authority. The candidate
+must still be an exact Buildchain SHA selected through a governed discovery
+ref, bind the current candidate-owned admission root, have exact-head
+independent review and required checks, request an admitted capability and
+contract-root set, stay within the permission ceiling and validity window, and
+inherit only authority available from the caller. The candidate engine exposes
+bounded capability adapters; it does not accept caller-provided shell or code.
+
 ## Advanced Workflow
 
 Consumers that need direct workflow-shell or runtime control call the advanced

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.2",
+  "version": "4.0.2-alpha.20",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -156,7 +156,7 @@
   "scripts": {
     "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/v4-delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery-authority-candidate.js packages/core/dev-delivery-authority-evidence.js packages/core/dev-delivery-authority-landing.js packages/core/dev-delivery-authority-observation.js packages/core/dev-delivery-authority-qualification.js packages/core/dev-delivery-authority-settlement.js packages/core/dev-delivery-authority-state.js packages/core/dev-delivery-execution-failure.js packages/core/dev-delivery-execution-transfer.js packages/core/dev-delivery-landing-readback.js packages/core/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery-landing-testing-port.js packages/core/dev-delivery-native-execution.js packages/core/dev-delivery-native-proof.js packages/core/dev-delivery-process-boundary.js packages/core/dev-delivery-warrant-qualification.js packages/core/dev-delivery-warrant-state.js scripts/dev-delivery-authority-command-adapters.mjs scripts/dev-delivery-authority-provider.mjs scripts/dev-delivery-authority.mjs scripts/dev-delivery-native-run.mjs scripts/dev-delivery-process-boundary.mjs scripts/dev-delivery-two-phase-resume.mjs scripts/dev-delivery-two-phase.mjs scripts/dev-delivery-warrant-options.mjs scripts/dev-delivery-warrant-store.mjs templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && node scripts/check-v4-release-topology.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-v4-runtime-semantic-closure.mjs && node scripts/check-v3-v4-capability-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-publication-rehearsal-fixture.mjs --check && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check": "pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && node scripts/check-v4-release-topology.mjs && node scripts/check-v4-universal-workflow-bootstrap.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-v4-runtime-semantic-closure.mjs && node scripts/check-v3-v4-capability-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-publication-rehearsal-fixture.mjs --check && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs bin/internal/compatibility-facts-cli.mjs packages/core/v4-canonical-contracts.js packages/core/kungfu-temporal-fact.js packages/core/buildchain-compatibility-fact.js packages/core/buildchain-compatibility-authority.js packages/core/buildchain-compatibility-proof.js packages/core/v4-floating-consumer-evidence.js packages/core/v4-floating-consumer-policy.js packages/core/v4-floating-consumer-release-passport.js packages/core/v4-runtime-ref-resume-authority.js packages/core/v4-tail-reseal-contract.js packages/core/v4-tail-reseal-github.js packages/core/v4-tail-reseal-receipt.js packages/core/v4-tail-reseal.js packages/core/v4-runtime-selector-persistence.js packages/core/v4-provider-operation-journal.js packages/core/v4-provider-readback-idempotency.js packages/core/v4-release-activation-shadow.js packages/core/v4-stable-publication-fence.js packages/core/v4-partial-mutation-recovery-qualification.js packages/core/v4-stage-capsule.js packages/core/v4-stage-capsule-store.js packages/core/v4-stage-capsule-local-store.js packages/core/v4-platform-stage-checkpoints.js packages/core/v4-stage-capsule-resume-planner.js packages/core/v4-stage-capsule-qualification.js packages/core/v4-stage-capsule-qualification-campaign.js packages/core/v4-delivery-warrant-fixture-runner.js packages/core/v4-delivery-warrant-read-candidate.js packages/core/v4-delivery-warrant-semantic-diff-gate.js packages/core/v4-delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-v4-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/dev-pr-prequeue-guard.mjs scripts/check-v4-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/v4-bridge-bootstrap.mjs scripts/v4-bridge-evidence.mjs scripts/v4-consumer-policy.mjs scripts/v4-host-adapter.mjs scripts/v4-platform-stage-checkpoint-rehearsal.mjs scripts/v4-stage-capsule-resume-rehearsal.mjs scripts/v4-stage-capsule-qualification.mjs scripts/v4-tail-reseal-macos-rehearsal.mjs scripts/v4-tail-reseal.mjs scripts/v4-warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs tests/v4-bridge.test.mjs tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-runtime-semantic-closure.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs tests/v4-warrant-shadow-plan.test.mjs",
     "check:v4-bridge": "cargo fmt --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml",
     "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-publication-rehearsal.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",

package/packages/core/buildchain-publication-authority.js

@@ -10,11 +10,9 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/.release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/.publication-authority.yml", "evidence-publication"],
   [".github/workflows/.release-verify.yml", "governance-write"],
-  [".github/workflows/.sam-release.yml", "retired-deny"],
   [".github/workflows/.sam-verify.yml", "retired-deny"],
   [".github/workflows/.sync-remote-git.yml", "governance-write"],
   [".github/workflows/.web-surface.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/.wheel-release.yml", "retired-deny"],
   [".github/workflows/.wheel-verify.yml", "retired-deny"],
   [".github/workflows/.binary-release-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
   [".github/workflows/binary-distribution.yml", "evidence-publication"],
@@ -23,6 +21,7 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/auditable-demo.yml", "governance-write"],
   [".github/workflows/build-surface-fixture.yml", "non-publication-oidc"],
   [".github/workflows/build.yml", "non-publication-oidc"],
+  [".github/workflows/bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
   [".github/workflows/buildchain-alpha-self-dogfood.yml", "non-publication-oidc"],
   [".github/workflows/buildchain-dev-delivery.yml", "governance-write"],
   [".github/workflows/buildchain-patrol-daily.yml", "governance-write"],
@@ -58,6 +57,8 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
   [".github/workflows/release-verify.yml", "governance-write"],
   [".github/workflows/stable-candidate-patrol.yml", "governance-write"],
+  [".github/workflows/universal-bootstrap-recovery.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/universal-bootstrap-dogfood.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
   [".github/workflows/v4-declarative-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
 ]);
 

package/packages/core/ci-lane-change-budget.js

@@ -10,6 +10,7 @@ const AUTHORITY_CLASSES = new Set([
   "post-merge-advisory",
   "diagnostic",
   "evidence",
+  "governed-delegation",
   "release",
 ]);
 const TRIGGER_CLASSES = new Set([
@@ -196,7 +197,19 @@ export function evaluateCiLaneChangeBudget({
   }
   const declarations = new Map();
   const diagnostics = [];
-  for (const declaration of policy.declarations || []) {
+  const familyDeclarations = (policy.declarationFamilies || []).flatMap(
+    ({ laneIds, ...declaration }) => {
+      if (!Array.isArray(laneIds) || laneIds.length === 0)
+        throw new Error("CI lane declaration family requires laneIds");
+      if (new Set(laneIds).size !== laneIds.length)
+        throw new Error("CI lane declaration family laneIds must be unique");
+      return laneIds.map((laneId) => ({ ...declaration, laneId }));
+    },
+  );
+  for (const declaration of [
+    ...(policy.declarations || []),
+    ...familyDeclarations,
+  ]) {
     const laneId = String(declaration?.laneId || "").trim();
     if (!laneId) throw new Error("CI lane declaration laneId is required");
     if (declarations.has(laneId))

package/packages/core/dev-delivery-candidate-identity.js

@@ -38,6 +38,24 @@ export function matchesExactDevDeliveryCandidate(existing, attempted) {
   );
 }
 
+export function reuseExactActiveDevDeliverySourceProof(active, input) {
+  const exact =
+    ["provisional", "qualified"].includes(active?.phase) &&
+    [
+      "pullRequestNumber",
+      "assignmentRoot",
+      "initiativeRoot",
+      "sourceIdentityRoot",
+      "deliveryClass",
+      "priority",
+    ].every((field) => active[field] === input[field]) &&
+    matchesExactDevDeliveryCandidate(active, {
+      ...input,
+      sourceProofRoot: active.sourceProofRoot,
+    });
+  return exact ? { ...input, sourceProofRoot: active.sourceProofRoot } : input;
+}
+
 export function createDevDeliveryCandidateIdentity(
   input,
   expected,

package/packages/core/dev-delivery-execution-transfer.js

@@ -38,7 +38,10 @@ const FAILURE_FILES = [
 ];
 
 const V4_RUNTIME_SELECTOR =
-  /^(?:v4|v4-alpha|train\/v4\/v4\.0\/[a-z0-9][a-z0-9._-]*)$/u;
+  /^(?:[0-9a-f]{40}|v4|v4-alpha|train\/v4\/v4\.0\/[a-z0-9][a-z0-9._-]*)$/u;
+
+const V4_RUNTIME_SELECTOR_DESCRIPTION =
+  "runtime selector must be an exact immutable SHA, v4, v4-alpha, or train/v4/v4.0/<capability>";
 
 function requiredFiles(outcome) {
   if (outcome === "succeeded") return SUCCESS_FILES;
@@ -163,9 +166,7 @@ function runtimeBinding(input = {}) {
     selectionRoot: exactRoot(input.selectionRoot, "runtime selection root"),
   };
   if (!V4_RUNTIME_SELECTOR.test(runtime.selector)) {
-    throw new Error(
-      "runtime selector must be v4, v4-alpha, or train/v4/v4.0/<capability>",
-    );
+    throw new Error(V4_RUNTIME_SELECTOR_DESCRIPTION);
   }
   return runtime;
 }
@@ -207,9 +208,7 @@ function verifiedRuntimeSelection(directory, expected = {}) {
     throw new Error("runtime selection is not exact canonical content");
   }
   if (!V4_RUNTIME_SELECTOR.test(normalized.selector)) {
-    throw new Error(
-      "runtime selector must be v4, v4-alpha, or train/v4/v4.0/<capability>",
-    );
+    throw new Error(V4_RUNTIME_SELECTOR_DESCRIPTION);
   }
   const selectionRoot = sha256Bytes(
     Buffer.from(`${JSON.stringify(normalized, null, 2)}\n`),

package/packages/core/dev-delivery-warrant-legacy-recovery.js

@@ -218,7 +218,8 @@ export function recoverLegacyTerminalDevDeliveryQueue(
       evidenceRoot: entry.evidenceRoot,
     });
   }
-  queue.activeWarrant = null;
+  if (transitions.some((entry) => entry.activeWarrant))
+    queue.activeWarrant = null;
   queue.generation += 1;
   queue.updatedAt = currentTime;
   queue.stateRoot = devDeliveryContentRoot(queue);
@@ -236,7 +237,8 @@ export function recoverLegacyTerminalDevDeliveryQueue(
     nextStateRoot: after.stateRoot,
     requestRoot,
     transitions,
-    nextAction: "Select the next strictly valid queued candidate, if any.",
+    nextAction:
+      "Continue the exact active Warrant, or select the next candidate.",
   };
   return {
     queue: after,

package/packages/core/dev-delivery-warrant-native-compatibility.js

@@ -0,0 +1,33 @@
+export function lacksExactNativeExecutionContract(
+  candidate,
+  allowLegacyV3Readback = false,
+) {
+  const native =
+    candidate.deliveryClass !== "non-native-fast" ||
+    candidate.environmentRoot ||
+    candidate.nativeCommandContract;
+  return Boolean(
+    native &&
+    (!candidate.environmentRoot ||
+      (!candidate.nativeCommandContract && !allowLegacyV3Readback)),
+  );
+}
+
+export function lacksLiveNativeProof(
+  candidate,
+  status,
+  { allowLegacyV3Readback = false, allowLegacyQueuedReadback = false } = {},
+) {
+  return (
+    lacksExactNativeExecutionContract(candidate, allowLegacyV3Readback) &&
+    !(status === "queued" && allowLegacyQueuedReadback) &&
+    !TERMINAL_STATES.has(status)
+  );
+}
+const TERMINAL_STATES = new Set([
+  "merged",
+  "terminal-failure",
+  "dequeued",
+  "cancelled",
+  "superseded",
+]);

package/packages/core/dev-delivery-warrant-state.js

@@ -21,6 +21,10 @@ import {
   normalizeNativeCommandContract,
   validateActiveDevDeliveryWarrant,
 } from "./dev-delivery-native-proof.js";
+import {
+  lacksExactNativeExecutionContract,
+  lacksLiveNativeProof,
+} from "./dev-delivery-warrant-native-compatibility.js";
 import {
   normalizeProviderFailureAuthorityBinding,
   normalizeTerminalEvidenceCorrection,
@@ -36,6 +40,8 @@ export const DEV_DELIVERY_WARRANT_SCHEMA =
   "kungfu.buildchain.dev-delivery-warrant/v1";
 export const DEV_DELIVERY_SUBMISSION_RECEIPT_SCHEMA =
   "kungfu.buildchain.dev-delivery-submission-receipt/v1";
+export const DEV_DELIVERY_MINIMUM_WRITER_PROTOCOL_ROOT =
+  "sha256:54a203cadf0b14d4e3c198a3cc3c177c42813aa1c0cca03e900df714b6ae5563";
 export const DEV_DELIVERY_SELECTION_RECEIPT_SCHEMA =
   "kungfu.buildchain.dev-delivery-selection-receipt/v1";
 export const DEV_DELIVERY_LEASE_RECEIPT_SCHEMA =
@@ -148,7 +154,7 @@ function exactRoots(values, label) {
   return [...new Set(values.map((value) => exactRoot(value, label)))].sort();
 }
 function normalizePolicy(policy = {}) {
-  return {
+  const normalized = {
     agingSeconds: positiveInteger(
       policy.agingSeconds,
       "policy agingSeconds",
@@ -162,22 +168,17 @@ function normalizePolicy(policy = {}) {
     ),
     emergencyPolicy: text(policy.emergencyPolicy || "reviewed-explicit-only"),
   };
+  if (Object.hasOwn(policy, "minimumWriterProtocolRoot")) {
+    const root = exactRoot(
+      policy.minimumWriterProtocolRoot,
+      "policy minimumWriterProtocolRoot",
+    );
+    if (root !== DEV_DELIVERY_MINIMUM_WRITER_PROTOCOL_ROOT)
+      throw new Error("unsupported dev delivery minimum writer protocol");
+    normalized.minimumWriterProtocolRoot = root;
+  }
+  return normalized;
 }
-
-function lacksLiveNativeProof(candidate, status, allowLegacyV3Readback) {
-  const { environmentRoot, nativeCommandContract } = candidate;
-  const native =
-    candidate.deliveryClass !== "non-native-fast" ||
-    environmentRoot ||
-    nativeCommandContract;
-  return (
-    native &&
-    (!environmentRoot ||
-      (!nativeCommandContract && allowLegacyV3Readback !== true)) &&
-    !TERMINAL_STATES.has(status)
-  );
-}
-
 function normalizeCandidate(input, expected) {
   const identity = createDevDeliveryCandidateIdentity(
     input,
@@ -276,7 +277,12 @@ function normalizeCandidate(input, expected) {
       "candidate shardEvidenceRoots",
     );
   }
-  if (lacksLiveNativeProof(candidate, status, expected.allowLegacyV3Readback))
+  if (
+    lacksLiveNativeProof(candidate, status, {
+      allowLegacyV3Readback: expected.allowLegacyV3Readback,
+      allowLegacyQueuedReadback: expected.allowLegacyQueuedNativeReadback,
+    })
+  )
     throw new Error("live native candidate requires exact native proof");
   if (Object.hasOwn(input, "releaseBlockerPriority"))
     candidate.releaseBlockerPriority = normalizeReleaseBlockerPriorityClaim(
@@ -310,7 +316,10 @@ export function createDevDeliveryQueue({
     protectedBase: protectedBase(protectedBaseInput),
     generation: 0,
     fencingCounter: 0,
-    policy: normalizePolicy(policy),
+    policy: {
+      ...normalizePolicy(policy),
+      minimumWriterProtocolRoot: DEV_DELIVERY_MINIMUM_WRITER_PROTOCOL_ROOT,
+    },
     activeWarrant: null,
     candidates: [],
     updatedAt: timestamp(now, "now"),
@@ -346,16 +355,19 @@ export function normalizeDevDeliveryQueue(input, expected = {}) {
     "queue fencingCounter",
   );
   queue.policy = normalizePolicy(queue.policy);
+  const hasExecutionReceipt = !!queue.activeWarrant?.nativeExecutionReceiptRoot;
+  const hasQualificationReceipt =
+    !!queue.activeWarrant?.qualificationReceiptRoot;
   const allowLegacyV3Readback =
     expected.allowLegacyV3Readback === true &&
-    !(queue.candidates || []).some(
-      (candidate) => candidate?.nativeCommandContract,
-    ) &&
-    !queue.activeWarrant?.nativeCommandContract &&
-    !queue.activeWarrant?.nativeExecutionReceiptRoot &&
-    !queue.activeWarrant?.qualificationReceiptRoot;
+    hasExecutionReceipt === hasQualificationReceipt;
+  const candidateExpected = {
+    ...queue,
+    allowLegacyV3Readback,
+    allowLegacyQueuedNativeReadback: true,
+  };
   queue.candidates = (queue.candidates || []).map((candidate) =>
-    normalizeCandidate(candidate, { ...queue, allowLegacyV3Readback }),
+    normalizeCandidate(candidate, candidateExpected),
   );
   validateDevDeliveryCandidateChain(queue.candidates, TERMINAL_STATES);
   queue.updatedAt = timestamp(queue.updatedAt, "queue updatedAt");
@@ -569,7 +581,11 @@ export function rankDevDeliveryCandidates(
   });
   const currentTime = timestamp(now, "now");
   return queue.candidates
-    .filter((candidate) => candidate.status === "queued")
+    .filter(
+      (candidate) =>
+        candidate.status === "queued" &&
+        !lacksExactNativeExecutionContract(candidate),
+    )
     .map((candidate) => ({
       candidate,
       priority: effectivePriority(candidate, queue.policy, currentTime),