@kungfu-tech/buildchain 4.0.2-alpha.2 → 4.0.2-alpha.21

package/architecture/v4-release-topology.json

@@ -3,26 +3,44 @@
   "contract": "kungfu-buildchain-v4-release-topology/v1",
   "sourceCut": {
     "branch": "dev/v4/v4.0",
-    "commit": "30cbbc46870871a0eacbe952935ea753e473ff25",
-    "tree": "b86fea30cb92a32215206f159708a8ea1d10d462"
+    "commit": "c3a50c941d018fcc3bec624e19a1298357b7f84a",
+    "tree": "213cdcaded8d90c823ecdafdd9968bceceed9057"
   },
   "enforcement": "converged",
   "closedWorld": {
     "workflowPaths": [
+      ".github/workflows/.binary-release-assets.yml",
+      ".github/workflows/.build.yml",
+      ".github/workflows/.declarative-auditable-demo.yml",
       ".github/workflows/.publication-authority.yml",
       ".github/workflows/.release-candidate-promote.yml",
-      ".github/workflows/.release-elastic-beanstalk.yml",
-      ".github/workflows/.release-new-version.yml",
-      ".github/workflows/.sam-release.yml",
-      ".github/workflows/.wheel-release.yml",
+      ".github/workflows/.web-surface.yml",
+      ".github/workflows/auditable-demo.yml",
+      ".github/workflows/binary-release-assets.yml",
+      ".github/workflows/build-surface-fixture.yml",
+      ".github/workflows/build.yml",
+      ".github/workflows/buildchain-alpha-self-dogfood.yml",
+      ".github/workflows/buildchain-dev-delivery.yml",
       ".github/workflows/buildchain-ref-promotion-recovery.yml",
       ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/buildchain-patrol-daily.yml",
+      ".github/workflows/buildchain-patrol-monthly.yml",
+      ".github/workflows/buildchain-patrol-weekly.yml",
+      ".github/workflows/buildchain-stable-candidate-patrol.yml",
+      ".github/workflows/dev-alpha-candidate-patrol.yml",
+      ".github/workflows/dev-pr-auto-merge.yml",
+      ".github/workflows/github-artifact-attestation.yml",
       ".github/workflows/npm-publish.yml",
       ".github/workflows/paper-release-sealed.yml",
       ".github/workflows/paper-release.yml",
+      ".github/workflows/patrol-observed-evidence.yml",
       ".github/workflows/release-candidate-promote.yml",
+      ".github/workflows/release-line-bootstrap.yml",
       ".github/workflows/release-new-version.yml",
+      ".github/workflows/release-propagation.yml",
       ".github/workflows/release-tail.yml",
+      ".github/workflows/stable-candidate-patrol.yml",
+      ".github/workflows/v4-publication-rehearsal-dogfood.yml",
       ".github/workflows/v4-declarative-release-tail-dogfood.yml"
     ],
     "unknownTopologyPolicy": "fail-closed"
@@ -42,6 +60,135 @@
       "retired compatibility workflows"
     ]
   },
+  "authorityClosure": {
+    "providerAdapters": [
+      "actions/promote-buildchain-ref/github-release.js",
+      "actions/promote-buildchain-ref/v4-provider-plane.js",
+      "actions/release-tail/index.js",
+      "actions/v4-release-candidate-promote/index.js",
+      "actions/v4-release-candidate-promote/product-provider-adapters.js",
+      "actions/v4-release-candidate-promote/product-provider-github-adapters.js",
+      "actions/v4-release-candidate-promote/product-provider.js",
+      "packages/core/buildchain-agent-manuals.js",
+      "packages/core/index.js",
+      "packages/core/publication-rehearsal-runtime.js",
+      "packages/core/release-tail-provider-adapters.js",
+      "packages/core/release-tail-provider-plane.js",
+      "packages/core/v4-product-publication.js",
+      "packages/core/v4-publication-rehearsal-capsule.js",
+      "packages/core/v4-publication-rehearsal.js"
+    ],
+    "runtimeSelectors": [
+      ".github/workflows/.build.yml",
+      ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/.web-surface.yml",
+      ".github/workflows/buildchain-ref-promotion-recovery.yml",
+      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/paper-release.yml",
+      ".github/workflows/publication-artifact.yml",
+      ".github/workflows/release-candidate-promote.yml",
+      ".github/workflows/v4-tail-reseal.yml",
+      "packages/core/buildchain-contract.js",
+      "packages/core/v4-runtime-ref-resume-authority.js",
+      "packages/core/v4-runtime-selector-persistence.js",
+      "scripts/aggregate-build-summary.mjs",
+      "scripts/artifact-signing-controller-core.mjs",
+      "scripts/authorize-promotion-runtime-override.cjs",
+      "scripts/buildchain-contract-lock.mjs",
+      "scripts/check-inventory.mjs",
+      "scripts/generate-channel-promotion-workflow.mjs",
+      "scripts/generate-release-candidate-passport.mjs",
+      "scripts/release-candidate-resolver.mjs",
+      "scripts/resume-from-candidate-run.mjs",
+      "scripts/v4-declarative-promotion-admission.mjs",
+      "scripts/v4-release-candidate-adapter.mjs"
+    ],
+    "runtimeEngines": ["actions/v4-release-candidate-promote/index.js"],
+    "terminalProjections": [
+      ".github/workflows/.release-candidate-promote.yml",
+      "actions/v4-release-candidate-promote/index.js",
+      "packages/core/v4-release-invocation.js",
+      "scripts/v4-universal-workflow-engine.mjs"
+    ],
+    "privilegedExecutableClosure": {
+      "entrypoints": ["actions/v4-release-candidate-promote/index.js"],
+      "modules": [
+        "actions/promote-buildchain-ref/github-release.js",
+        "actions/promote-buildchain-ref/internal/version-state.js",
+        "actions/promote-buildchain-ref/reuse-complete-release.js",
+        "actions/promote-buildchain-ref/v4-provider-plane.js",
+        "actions/v4-release-candidate-promote/index.js",
+        "actions/v4-release-candidate-promote/product-provider-adapters.js",
+        "actions/v4-release-candidate-promote/product-provider-github-adapters.js",
+        "actions/v4-release-candidate-promote/product-provider.js",
+        "packages/core/adopter-delivery-gate.js",
+        "packages/core/adopter-delivery-json.js",
+        "packages/core/adopter-delivery-passport.js",
+        "packages/core/artifact-verification-envelope.js",
+        "packages/core/buildchain-channel-identity.js",
+        "packages/core/buildchain-compatibility-authority.js",
+        "packages/core/buildchain-compatibility-fact.js",
+        "packages/core/buildchain-compatibility-facts.json",
+        "packages/core/buildchain-compatibility-proof.js",
+        "packages/core/buildchain-config.js",
+        "packages/core/buildchain-contract.js",
+        "packages/core/buildchain-layout.js",
+        "packages/core/controller-evidence.js",
+        "packages/core/dev-delivery-common.js",
+        "packages/core/dev-delivery-contract-surface.js",
+        "packages/core/github-artifact-attestation.js",
+        "packages/core/kfd-adopter-manifest.js",
+        "packages/core/kfd-gate.js",
+        "packages/core/kfd-product-gates.js",
+        "packages/core/kungfu-temporal-fact.js",
+        "packages/core/package-manager.js",
+        "packages/core/public-surface-audit.js",
+        "packages/core/public-surface-cli.js",
+        "packages/core/publication-artifact-candidate.js",
+        "packages/core/publication-authority.js",
+        "packages/core/publication-sealed-bundle.js",
+        "packages/core/publish-transaction.js",
+        "packages/core/release-candidate-recovery.js",
+        "packages/core/release-candidate.js",
+        "packages/core/release-passport-contract.js",
+        "packages/core/release-passport.js",
+        "packages/core/release-tail-product-capabilities.js",
+        "packages/core/release-tail-provider-adapters.js",
+        "packages/core/release-tail-provider-plane.js",
+        "packages/core/spawn-command.js",
+        "packages/core/surface-manifest.js",
+        "packages/core/v4-canonical-contracts.js",
+        "packages/core/v4-floating-consumer-evidence.js",
+        "packages/core/v4-floating-consumer-policy.js",
+        "packages/core/v4-floating-consumer-release-passport.js",
+        "packages/core/v4-product-publication.js",
+        "packages/core/v4-protected-publication-source.js",
+        "packages/core/v4-publication-qualification.js",
+        "packages/core/v4-release-invocation.js",
+        "packages/core/v4-runtime-ref-resume-authority.js",
+        "packages/core/v4-runtime-selector-persistence.js",
+        "packages/core/web-surface-publication-candidate.js",
+        "packages/core/workflow-yaml-contract.js",
+        "scripts/ensure-github-release.mjs"
+      ],
+      "root": "sha256:31d13d74b8b3dadbfe4b5061c99f6f6711be6c3b06449114f2708427374f9c85"
+    },
+    "legacyEngineModules": [
+      "actions/promote-buildchain-ref/internal/durable-transaction-operations.js",
+      "actions/promote-buildchain-ref/internal/promote-alpha-channel.js",
+      "actions/promote-buildchain-ref/internal/promote-major-channel.js",
+      "actions/promote-buildchain-ref/internal/promote-release-channel.js",
+      "actions/promote-buildchain-ref/lib.js"
+    ],
+    "freshEntry": ".github/workflows/release-candidate-promote.yml",
+    "recoveryEntry": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+    "forbiddenLegacyEnginePatterns": [
+      "legacy-promote",
+      "v4-declarative-promote",
+      "BUILDCHAIN_DECLARATIVE_PROMOTION",
+      "Select declarative or legacy promotion result"
+    ]
+  },
   "baselineMetrics": {
     "workflowCount": 15,
     "jobCount": 38,
@@ -92,14 +239,6 @@
       "mutationSignals"
     ],
     "workflows": [
-      {
-        "path": ".github/workflows/.publication-authority.yml",
-        "triggers": ["workflow_call"],
-        "jobs": [
-          "verify|runner|-|read|-|artifactDownload,artifactUpload,jobOutput|-"
-        ],
-        "reusableEdges": []
-      },
       {
         "path": ".github/workflows/.release-candidate-promote.yml",
         "triggers": ["workflow_call"],
@@ -110,30 +249,6 @@
         ],
         "reusableEdges": []
       },
-      {
-        "path": ".github/workflows/.release-elastic-beanstalk.yml",
-        "triggers": ["workflow_call"],
-        "jobs": ["retired|runner|-|-|-|-|-"],
-        "reusableEdges": []
-      },
-      {
-        "path": ".github/workflows/.release-new-version.yml",
-        "triggers": ["workflow_call"],
-        "jobs": ["retired|runner|-|-|-|-|-"],
-        "reusableEdges": []
-      },
-      {
-        "path": ".github/workflows/.sam-release.yml",
-        "triggers": ["workflow_call"],
-        "jobs": ["retired|runner|-|-|-|-|-"],
-        "reusableEdges": []
-      },
-      {
-        "path": ".github/workflows/.wheel-release.yml",
-        "triggers": ["workflow_call"],
-        "jobs": ["retired|runner|-|-|-|-|-"],
-        "reusableEdges": []
-      },
       {
         "path": ".github/workflows/buildchain-ref-promotion-recovery.yml",
         "triggers": ["workflow_dispatch"],
@@ -148,6 +263,7 @@
         "path": ".github/workflows/buildchain-ref-promotion.yml",
         "triggers": ["workflow_dispatch", "workflow_run:completed"],
         "jobs": [
+          "classify-workflow-run|runner|-|read|-|-|-",
           "promote|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
           "reject-invalid-candidate-recovery|runner|-|read|-|-|-",
           "reject-invalid-durable-recovery|runner|-|read|-|-|-",
@@ -157,34 +273,6 @@
           "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha"
         ]
       },
-      {
-        "path": ".github/workflows/npm-publish.yml",
-        "triggers": ["workflow_dispatch"],
-        "jobs": ["dry-run|runner|-|-|-|-|direct-publication-command"],
-        "reusableEdges": []
-      },
-      {
-        "path": ".github/workflows/paper-release-sealed.yml",
-        "triggers": ["workflow_call"],
-        "jobs": [
-          "publication-authority|reusable-call|./.github/workflows/.publication-authority.yml|read|-|-|-",
-          "publication-candidate|reusable-call|./.github/workflows/publication-artifact.yml|read|-|-|-",
-          "publish|runner|-|read|write|artifactDownload,artifactUpload,jobOutput|contents-write,oidc-write,promotion-runtime"
-        ],
-        "reusableEdges": [
-          "./.github/workflows/.publication-authority.yml",
-          "./.github/workflows/publication-artifact.yml"
-        ]
-      },
-      {
-        "path": ".github/workflows/paper-release.yml",
-        "triggers": ["workflow_call"],
-        "jobs": [
-          "paper-release|runner|-|write|write|artifactUpload,jobOutput|contents-write,oidc-write,promotion-runtime",
-          "publication-authority|reusable-call|./.github/workflows/.publication-authority.yml|read|-|-|-"
-        ],
-        "reusableEdges": ["./.github/workflows/.publication-authority.yml"]
-      },
       {
         "path": ".github/workflows/release-candidate-promote.yml",
         "triggers": ["workflow_call"],
@@ -197,18 +285,6 @@
           "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha"
         ]
       },
-      {
-        "path": ".github/workflows/release-new-version.yml",
-        "triggers": ["pull_request:closed"],
-        "jobs": ["buildchain-self-release|runner|-|-|-|-|-"],
-        "reusableEdges": []
-      },
-      {
-        "path": ".github/workflows/release-tail.yml",
-        "triggers": ["workflow_call"],
-        "jobs": ["release-tail|runner|-|-|-|artifactUpload|-"],
-        "reusableEdges": []
-      },
       {
         "path": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
         "triggers": ["workflow_dispatch"],
@@ -221,12 +297,12 @@
       }
     ],
     "metrics": {
-      "workflowCount": 15,
-      "jobCount": 25,
-      "reusableEdgeCount": 7,
-      "mutationRelevantNodeCount": 16,
-      "contentsWriteJobCount": 6,
-      "oidcWriteJobCount": 6
+      "workflowCount": 33,
+      "jobCount": 89,
+      "reusableEdgeCount": 23,
+      "mutationRelevantNodeCount": 74,
+      "contentsWriteJobCount": 14,
+      "oidcWriteJobCount": 16
     },
     "semanticMetrics": {
       "workflowCount": 5,

package/architecture/v4-runtime-semantic-closure.json

@@ -73,7 +73,10 @@
       "stateAuthority": "single-writer-state-machine",
       "legacyFallbackAllowed": false,
       "providerDecisionAuthorityAllowed": false,
-      "implementation": ["packages/core/dev-delivery-warrant.js"],
+      "implementation": [
+        "packages/core/dev-delivery-warrant-native-compatibility.js",
+        "packages/core/dev-delivery-warrant.js"
+      ],
       "invariants": {
         "exactHeadFence": true,
         "immutableRootFence": true,

package/architecture/v4-universal-workflow-bootstrap.json

@@ -0,0 +1,171 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-bootstrap/v1",
+  "status": "migration-active",
+  "bootstrap": {
+    "publicWorkflow": ".github/workflows/bootstrap.yml",
+    "requestSchema": "kungfu-buildchain-v4-universal-workflow-request/v1",
+    "admissionSchema": "kungfu-buildchain-v4-universal-workflow-admission/v1",
+    "terminalReceiptSchema": "kungfu-buildchain-v4-universal-workflow-terminal-receipt/v1",
+    "candidateRepository": "kungfu-systems/buildchain",
+    "candidateEnginePath": "scripts/v4-universal-workflow-engine.mjs",
+    "consumerTemplate": "templates/universal-buildchain-bootstrap.yml",
+    "consumerRecoveryTemplate": "templates/universal-buildchain-bootstrap-recovery.yml",
+    "consumerRecoveryWorkflow": ".github/workflows/universal-bootstrap-recovery.yml",
+    "consumerRecoveryMode": "separate-pre-positioned-consumer-owned-shell",
+    "recoveryDependsOnPublishedBuildchain": false,
+    "selfDogfoodWorkflow": ".github/workflows/universal-bootstrap-dogfood.yml",
+    "faultCampaign": "architecture/v4-universal-workflow-fault-campaign.json",
+    "discoveryRefExecutionAuthority": false,
+    "exactShaExecutionAuthority": true,
+    "consumerSourceMutationPerIncident": false,
+    "consumerAdmission": "verified-caller-exact-repository-workflow-and-source",
+    "reviewRuntimeBinding": "reviewed-head-or-protected-alpha-merge-to-exact-runtime",
+    "buildchainReleasePromotionPerIncident": false,
+    "selfDogfoodUsesPublicContract": true
+  },
+  "capabilityAdapters": [
+    {
+      "id": "bootstrap-conformance",
+      "execution": "exact-candidate-engine",
+      "payloadSchema": "kungfu-buildchain-v4-universal-bootstrap-conformance/v1",
+      "providerEffects": false
+    },
+    {
+      "id": "release-candidate-promote",
+      "execution": "exact-candidate-action-and-provider-readback",
+      "payloadSchema": "kungfu-buildchain-v4-universal-release-promotion/v1",
+      "providerEffects": true
+    },
+    {
+      "id": "release-invocation",
+      "execution": "exact-candidate-canonical-projection",
+      "payloadSchema": "kungfu-buildchain-v4-release-invocation/v1",
+      "providerEffects": false
+    }
+  ],
+  "complexityBudget": {
+    "bootstrapAbis": 1,
+    "requestEnvelopes": 1,
+    "candidateResolvers": 1,
+    "candidateEngines": 1,
+    "terminalReceiptAuthorities": 1,
+    "perWorkflowBootstrapImplementations": 0,
+    "buildchainOnlySelfReleasePaths": 0,
+    "perIncidentConsumerEdits": 0
+  },
+  "permissionCeiling": {
+    "actions": "write",
+    "artifact-metadata": "write",
+    "attestations": "write",
+    "checks": "write",
+    "contents": "write",
+    "deployments": "write",
+    "id-token": "write",
+    "issues": "write",
+    "packages": "write",
+    "pages": "write",
+    "pull-requests": "write",
+    "security-events": "write",
+    "statuses": "write"
+  },
+  "inventoryWorkflows": [
+    ".github/workflows/.auditable-demo.yml",
+    ".github/workflows/.binary-release-assets.yml",
+    ".github/workflows/.build.yml",
+    ".github/workflows/.bump-minor-version.yml",
+    ".github/workflows/.declarative-auditable-demo.yml",
+    ".github/workflows/.gate-profile.yml",
+    ".github/workflows/.publication-authority.yml",
+    ".github/workflows/.release-candidate-promote.yml",
+    ".github/workflows/.release-verify.yml",
+    ".github/workflows/.sam-verify.yml",
+    ".github/workflows/.sync-release-page.yml",
+    ".github/workflows/.sync-remote-git.yml",
+    ".github/workflows/.web-surface.yml",
+    ".github/workflows/.wheel-verify.yml",
+    ".github/workflows/bootstrap.yml",
+    ".github/workflows/build.yml",
+    ".github/workflows/buildchain-patrol.yml",
+    ".github/workflows/check.yml",
+    ".github/workflows/dev-alpha-candidate-patrol.yml",
+    ".github/workflows/dev-delivery-warrant-cancel.yml",
+    ".github/workflows/dev-delivery-warrant-close.yml",
+    ".github/workflows/dev-pr-auto-merge.yml",
+    ".github/workflows/dev-qualification-patrol.yml",
+    ".github/workflows/engineering-housekeeper.yml",
+    ".github/workflows/github-artifact-attestation.yml",
+    ".github/workflows/paper-release-sealed.yml",
+    ".github/workflows/paper-release.yml",
+    ".github/workflows/patrol-daily.yml",
+    ".github/workflows/patrol-monthly.yml",
+    ".github/workflows/patrol-observed-evidence.yml",
+    ".github/workflows/patrol-weekly.yml",
+    ".github/workflows/publication-artifact.yml",
+    ".github/workflows/release-candidate-promote.yml",
+    ".github/workflows/release-governance-reconcile.yml",
+    ".github/workflows/release-propagation.yml",
+    ".github/workflows/release-tail.yml",
+    ".github/workflows/stable-candidate-patrol.yml",
+    ".github/workflows/universal-bootstrap-recovery.yml",
+    ".github/workflows/v4-adopter-delivery.yml",
+    ".github/workflows/v4-stage-capsule-canary.yml",
+    ".github/workflows/v4-tail-reseal.yml"
+  ],
+  "retiredWorkflowSurfaces": [],
+  "bootstrapGovernedWorkflows": [
+    ".github/workflows/.auditable-demo.yml",
+    ".github/workflows/.binary-release-assets.yml",
+    ".github/workflows/.build.yml",
+    ".github/workflows/.bump-minor-version.yml",
+    ".github/workflows/.declarative-auditable-demo.yml",
+    ".github/workflows/.gate-profile.yml",
+    ".github/workflows/.publication-authority.yml",
+    ".github/workflows/.release-candidate-promote.yml",
+    ".github/workflows/.release-verify.yml",
+    ".github/workflows/.sam-verify.yml",
+    ".github/workflows/.sync-release-page.yml",
+    ".github/workflows/.sync-remote-git.yml",
+    ".github/workflows/.web-surface.yml",
+    ".github/workflows/.wheel-verify.yml",
+    ".github/workflows/bootstrap.yml",
+    ".github/workflows/build.yml",
+    ".github/workflows/buildchain-patrol.yml",
+    ".github/workflows/check.yml",
+    ".github/workflows/dev-alpha-candidate-patrol.yml",
+    ".github/workflows/dev-delivery-warrant-cancel.yml",
+    ".github/workflows/dev-delivery-warrant-close.yml",
+    ".github/workflows/dev-pr-auto-merge.yml",
+    ".github/workflows/dev-qualification-patrol.yml",
+    ".github/workflows/engineering-housekeeper.yml",
+    ".github/workflows/github-artifact-attestation.yml",
+    ".github/workflows/paper-release-sealed.yml",
+    ".github/workflows/paper-release.yml",
+    ".github/workflows/patrol-daily.yml",
+    ".github/workflows/patrol-monthly.yml",
+    ".github/workflows/patrol-observed-evidence.yml",
+    ".github/workflows/patrol-weekly.yml",
+    ".github/workflows/publication-artifact.yml",
+    ".github/workflows/release-candidate-promote.yml",
+    ".github/workflows/release-governance-reconcile.yml",
+    ".github/workflows/release-propagation.yml",
+    ".github/workflows/release-tail.yml",
+    ".github/workflows/stable-candidate-patrol.yml",
+    ".github/workflows/v4-adopter-delivery.yml",
+    ".github/workflows/v4-stage-capsule-canary.yml",
+    ".github/workflows/v4-tail-reseal.yml"
+  ],
+  "migration": {
+    "compatibilityFacadeGenerator": "scripts/generate-v4-universal-workflow-facades.mjs",
+    "facadeSourceRevision": "7f9ce215cf05bfd6b190624bfc1de8545065767d",
+    "channelGeneratedFacades": [
+      ".github/workflows/build.yml",
+      ".github/workflows/release-candidate-promote.yml"
+    ],
+    "staticBootstrap": "implemented",
+    "candidateEngine": "bounded-capability-adapters",
+    "compatibilityFacades": "generated-dual-path",
+    "externalConsumerDogfood": "public-consumer-three-platform-runtime-and-non-circular-recovery-hosted-proof-passed",
+    "buildchainSelfDogfood": "train-primary-and-consumer-recovery-three-pair-hosted-proof-passed",
+    "oldPathRetirement": "pending-protected-dev-integration"
+  }
+}

package/architecture/v4-universal-workflow-fault-campaign.json

@@ -0,0 +1,72 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-fault-campaign/v1",
+  "independentFaultsOnly": true,
+  "simultaneousPrimaryAndRecoveryFailureClaimed": false,
+  "externalBoundary": {
+    "id": "github-workflow-parser-or-service-unavailable",
+    "classification": "irreducible-external-availability",
+    "recovered": false
+  },
+  "faults": [
+    {
+      "id": "primary-facade",
+      "injectionTarget": "templates/universal-buildchain-bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "typed-input-adapter",
+      "injectionTarget": "packages/core/v4-universal-workflow-bootstrap.js",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
+    },
+    {
+      "id": "route-selector",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "ordinary-candidate-loader",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "router",
+      "injectionTarget": "packages/core/v4-release-invocation.js",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
+    },
+    {
+      "id": "action",
+      "injectionTarget": "actions/v4-release-candidate-promote/action.yml",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "actions/v4-release-candidate-promote/dist/index.js"
+    },
+    {
+      "id": "cli-runtime",
+      "injectionTarget": "scripts/v4-universal-workflow-engine.mjs",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
+    },
+    {
+      "id": "recovery-logic",
+      "injectionTarget": "templates/universal-buildchain-bootstrap-recovery.yml",
+      "recoveryRoute": "primary-bootstrap-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap.yml"
+    },
+    {
+      "id": "result-projection",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "self-dogfood-caller",
+      "injectionTarget": ".github/workflows/universal-bootstrap-dogfood.yml",
+      "recoveryRoute": "consumer-equivalent-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    }
+  ]
+}

package/architecture/v4-universal-workflow-train-admission.json

@@ -0,0 +1,40 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-admission-policy/v1",
+  "sourceRepository": "kungfu-systems/buildchain",
+  "consumerAdmission": "verified-caller",
+  "allowedCapabilities": [
+    "bootstrap-conformance",
+    "release-candidate-promote",
+    "release-invocation"
+  ],
+  "permissionCeiling": {
+    "actions": "write",
+    "artifact-metadata": "write",
+    "attestations": "write",
+    "checks": "write",
+    "contents": "write",
+    "deployments": "write",
+    "id-token": "write",
+    "issues": "write",
+    "packages": "write",
+    "pages": "write",
+    "pull-requests": "write",
+    "security-events": "write",
+    "statuses": "write"
+  },
+  "contractRoots": [
+    "sha256:4563c954e84d34b73e6683981e1e23dd6b8bb9b9551392b4e393efb624cc980e",
+    "sha256:65a0c2fc3faecaddf5076fff086b5d6e12eb9ba27796efc10aed19f2d93b9457",
+    "sha256:b6737ed958e8f53f7770b1c214c092591573ad63af41e05797117d9b7b212ed8",
+    "sha256:b94023c4abe4216765198adcaefb4825874a4d9053be096d35a53d6821128b52",
+    "sha256:ca0592275354f0690756e3f11accdd23615987827c346618c50c2e8a2807ad4d",
+    "sha256:cf3c5a79de580525953e1fc02b2b2937a1d1a50219b4464510dd5b4725ca9ca5",
+    "sha256:d6ad9cf661c0ba3825cabdc7185fd122a60fc1929dfc799cda3352650588663f"
+  ],
+  "targetRef": "dev/v4/v4.0",
+  "allowedReviewers": ["kungfu-origin"],
+  "minimumApprovals": 1,
+  "requiredChecks": ["check"],
+  "validFrom": "2026-08-30T00:00:00.000Z",
+  "expiresAt": "2026-09-07T00:00:00.000Z"
+}