@kungfu-tech/buildchain 4.0.2-alpha.34 → 4.0.2-alpha.35

package/docs/MAP.md

@@ -37,6 +37,7 @@ running artifact), *use* (consume / extend) - and a **status**:
 | First-time repository adopter | [Golden Path](getting-started.md) | [Lifecycle Protocol](lifecycle-protocol.md) only when the generated defaults need changes |
 | CLI operator or agent | [Generated CLI Reference](cli-reference.md) | [CLI guide](cli.md) for concepts and worked examples |
 | Node toolkit developer | [Generated Node API Reference](node-api-reference.md) | [Core package guide](../packages/core/README.md) for recipes |
+| Workflow contributor | [Workflow Catalog](workflow-catalog.md) | [Contribution rules](../CONTRIBUTING.md#workflow-organization) and the [exact registry](../architecture/workflow-taxonomy.json) |
 | Build/release operator | [Reusable Build Surface](reusable-build-surface.md) | [Release Flow](release-flow.md) and [Release Passport](release-passport.md) |
 | Product/trust reviewer | [Product Mechanism](product-mechanism.md) | [Release Passport](release-passport.md) and [KFD Support](kfd-support.md) |
 

package/docs/auditable-demo.md

@@ -139,7 +139,7 @@ jobs:
 ```
 
 Buildchain recursively consumes this surface in
-`.github/workflows/auditable-demo.yml` using its own exact standalone binary
+`.github/workflows/self-build-demo-dogfood.yml` using its own exact standalone binary
 and the beginner bootstrap scenario in `.buildchain/auditable-demo.json`.
 
 ## Authority Boundary

package/docs/cli.md

@@ -1044,7 +1044,7 @@ and package identity. See [`v4-adopter-delivery.md`](v4-adopter-delivery.md).
 ## npm Publish Gate
 
 Buildchain's own npm package is published from
-`.github/workflows/buildchain-ref-promotion.yml`, inside the same publish
+`.github/workflows/self-release-promote.yml`, inside the same publish
 transaction that promotes release refs:
 
 - `v4.0.3-alpha.0` publishes to npm with dist-tag `alpha`.
@@ -1070,9 +1070,9 @@ Before the first real release, configure npm Trusted Publishing for:
 
 - package: `@kungfu-tech/buildchain`
 - repository: `kungfu-systems/buildchain`
-- workflow: `.github/workflows/buildchain-ref-promotion.yml`
+- workflow: `.github/workflows/self-release-promote.yml`
 
 No npm package is published by manual dispatch or ordinary branch builds.
-Manual dispatch on `.github/workflows/npm-publish.yml` remains dry-run only, so
+Manual dispatch on `.github/workflows/self-release-npm-dry-run.yml` remains dry-run only, so
 maintainers can verify package contents and npm publish shape before opening or
 merging the release PR.

package/docs/dev-delivery-warrant.md

@@ -506,7 +506,7 @@ shows the same exact PR head is already queued again, so an earlier queue event
 cannot close a newer active Warrant generation.
 
 Buildchain uses the same contract for its own protected dev line through
-`buildchain-dev-delivery.yml`. The manual caller requires the exact PR head and
+`self-ops-dev-delivery.yml`. The manual caller requires the exact PR head and
 semantic source roots, accepts an optional reusable native proof, keeps both
 the durable public selector and explicit runtime input on `v4-alpha`, selects
 `delivery-warrant-mode: required`, and targets GitHub Merge Queue. It does not

package/docs/engineering-housekeeper.md

@@ -158,9 +158,9 @@ to plans, reports, receipts, summaries, or artifacts.
 
 Buildchain dogfoods the reusable contract through three thin callers:
 
-- `engineering-housekeeper-daily.yml` uses a 30-day window and a 10-action cap;
-- `engineering-housekeeper-weekly.yml` uses a 45-day window and a 20-action cap;
-- `engineering-housekeeper-monthly.yml` uses a 60-day window and a 50-action cap.
+- `self-ops-housekeeping-daily.yml` uses a 30-day window and a 10-action cap;
+- `self-ops-housekeeping-weekly.yml` uses a 45-day window and a 20-action cap;
+- `self-ops-housekeeping-monthly.yml` uses a 60-day window and a 50-action cap.
 
 All three schedules run unattended apply with repository-wide mainline
 discovery. They delete only exact merged heads from the positive temporary

package/docs/next-development-transition.md

@@ -76,7 +76,7 @@ invalid.
 
 ## Public self-dogfood and adoption
 
-`.github/workflows/v4-public-consumer-dogfood.yml` remains the exact thin
+`.github/workflows/self-build-public-consumer-dogfood.yml` remains the exact thin
 consumer of the public `v4-stage-capsule-canary.yml@v4-alpha` contract. Its
 declared `lifecycle.verify` runs `pnpm run check`, so the same public path
 executes pure recovery tests that inject a transient durable-state write

package/docs/node-api-reference.md

@@ -31,7 +31,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `abortReleaseActivationTransaction` | function: function abortReleaseActivationTransaction(transaction, reason) | transaction, reason | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { abortReleaseActivationTransaction } from "@kungfu-tech/buildchain";` | `packages/core/release-activation-transaction.js:277` |
 | `AGENT_INDEX_CONTRACT` | constant: const AGENT_INDEX_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { AGENT_INDEX_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-passport.js:54` |
 | `aggregateBuildFacts` | function: function aggregateBuildFacts({ cwd = process.cwd(), productId = "", moduleFacts = [], artifacts = [], now = nowIso(), } = {}) | { cwd = process.cwd(), productId = "", moduleFacts = [], artifacts = [], now = nowIso(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | subprocess | `import { aggregateBuildFacts } from "@kungfu-tech/buildchain";` | `packages/core/build-facts.js:466` |
-| `aggregateControllerReceipts` | function: function aggregateControllerReceipts({ plans = [], receipts = [] } = {}) | { plans = [], receipts = [] } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { aggregateControllerReceipts } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:449` |
+| `aggregateControllerReceipts` | function: function aggregateControllerReceipts({ plans = [], receipts = [] } = {}) | { plans = [], receipts = [] } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { aggregateControllerReceipts } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:452` |
 | `ANCHORED_VERSION_MATERIAL_CONTRACT` | constant: const ANCHORED_VERSION_MATERIAL_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { ANCHORED_VERSION_MATERIAL_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/anchored-version-material.js:15` |
 | `appendBuildchainLogEvent` | function: function appendBuildchainLogEvent(filePath, event) | filePath, event | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write | `import { appendBuildchainLogEvent } from "@kungfu-tech/buildchain";` | `packages/core/logging.js:67` |
 | `applyGitHubHousekeeperPlan` | function: async function applyGitHubHousekeeperPlan({ client, plan, dryRun = true, priorReceipt, appliedAt = new Date().toISOString(), staleDays = DEFAULT_STALE_DAYS, maxActions = DEFAULT_MAX_ACTIONS, }) | { client, plan, dryRun = true, priorReceipt, appliedAt = new Date().toISOString(), staleDays = DEFAULT_STALE_DAYS, maxActions = DEFAULT_MAX_ACTIONS, } | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { applyGitHubHousekeeperPlan } from "@kungfu-tech/buildchain";` | `packages/core/engineering-housekeeper-github.js:615` |
@@ -117,7 +117,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain";` | `packages/core/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:65` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:65` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain";` | `packages/core/build-facts.js:45` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:199` |
@@ -188,15 +188,15 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain";` | `packages/core/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:89` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:104` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain";` | `packages/core/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/cache-evidence.js:169` |
 | `createCandidateTimeline` | function: function createCandidateTimeline({ candidate = {}, events = [], generatedAt, } = {}) | { candidate = {}, events = [], generatedAt, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createCandidateTimeline } from "@kungfu-tech/buildchain";` | `packages/core/candidate-timeline.js:381` |
 | `createConsumerPublicationDecision` | function: function createConsumerPublicationDecision({ capability, gateAggregate, decision, predicateId, predicateDigest, evidence = {}, now = new Date(), } = {}) | { capability, gateAggregate, decision, predicateId, predicateDigest, evidence = {}, now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createConsumerPublicationDecision } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:991` |
-| `createControllerPlan` | function: function createControllerPlan({ descriptor, source = {}, runtime = {}, inputs = {} } = {}) | { descriptor, source = {}, runtime = {}, inputs = {} } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerPlan } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:287` |
-| `createControllerReceipt` | function: function createControllerReceipt({ plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {}) | { plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceipt } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:363` |
-| `createControllerReceiptReference` | function: function createControllerReceiptReference(receipt) | receipt | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceiptReference } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:491` |
+| `createControllerPlan` | function: function createControllerPlan({ descriptor, source = {}, runtime = {}, inputs = {} } = {}) | { descriptor, source = {}, runtime = {}, inputs = {} } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerPlan } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:290` |
+| `createControllerReceipt` | function: function createControllerReceipt({ plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {}) | { plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceipt } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:366` |
+| `createControllerReceiptReference` | function: function createControllerReceiptReference(receipt) | receipt | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceiptReference } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:494` |
 | `createControllerRegistry` | function: function createControllerRegistry({ workflows = [] } = {}) | { workflows = [] } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerRegistry } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:197` |
 | `createDiagnosticsArtifact` | function: function createDiagnosticsArtifact({ cwd = process.cwd(), logPath = "", artifactPaths = [], cacheDirs = [], lifecycleObservability = undefined, processSamples = [], processSummary = undefined, requestedParallelism = 0, sourceCheckout = undefined, compilerCachePreparation = undefined, links = {}, } = {}) | { cwd = process.cwd(), logPath = "", artifactPaths = [], cacheDirs = [], lifecycleObservability = undefined, processSamples = [], processSummary = undefined, requestedParallelism = 0, sourceCheckout = undefined, compilerCachePreparation = undefined, links = {}, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createDiagnosticsArtifact } from "@kungfu-tech/buildchain";` | `packages/core/diagnostics.js:1408` |
 | `createEngineeringHousekeeperPlan` | function: function createEngineeringHousekeeperPlan({ repository, target, branches = [], pullRequests = [], policy = {}, observedAt, }) | { repository, target, branches = [], pullRequests = [], policy = {}, observedAt, } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createEngineeringHousekeeperPlan } from "@kungfu-tech/buildchain";` | `packages/core/engineering-housekeeper.js:170` |
@@ -393,7 +393,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `normalizeBuildchainConfig` | function: function normalizeBuildchainConfig(config) | config | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeBuildchainConfig } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-config.js:206` |
 | `normalizeBuildchainLogEvent` | function: function normalizeBuildchainLogEvent(input = {}, defaults = {}) | input = {}, defaults = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { normalizeBuildchainLogEvent } from "@kungfu-tech/buildchain";` | `packages/core/logging.js:45` |
 | `normalizeCandidateTimelineEvent` | function: function normalizeCandidateTimelineEvent(input = {}) | input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeCandidateTimelineEvent } from "@kungfu-tech/buildchain";` | `packages/core/candidate-timeline.js:74` |
-| `normalizeControllerReceiptReferences` | function: function normalizeControllerReceiptReferences({ receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | { receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeControllerReceiptReferences } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:532` |
+| `normalizeControllerReceiptReferences` | function: function normalizeControllerReceiptReferences({ receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | { receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeControllerReceiptReferences } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:535` |
 | `normalizeGitHubArtifactAttestationPolicy` | function: function normalizeGitHubArtifactAttestationPolicy(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeGitHubArtifactAttestationPolicy } from "@kungfu-tech/buildchain";` | `packages/core/github-artifact-attestation.js:158` |
 | `normalizeGithubBranchProtectionSnapshot` | function: function normalizeGithubBranchProtectionSnapshot(protection = {}) | protection = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { normalizeGithubBranchProtectionSnapshot } from "@kungfu-tech/buildchain";` | `packages/core/github-governance-authority.js:1028` |
 | `normalizeGithubRulesetSnapshot` | function: function normalizeGithubRulesetSnapshot(ruleset = {}) | ruleset = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { normalizeGithubRulesetSnapshot } from "@kungfu-tech/buildchain";` | `packages/core/github-governance-authority.js:1098` |
@@ -606,9 +606,9 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `validateArtifactSigningRequest` | function: function validateArtifactSigningRequest(request) | request | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateArtifactSigningRequest } from "@kungfu-tech/buildchain";` | `packages/core/artifact-signing.js:352` |
 | `validateArtifactSigningResult` | function: function validateArtifactSigningResult(result, { request, receipt } = {}) | result, { request, receipt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateArtifactSigningResult } from "@kungfu-tech/buildchain";` | `packages/core/artifact-signing-result.js:147` |
 | `validateBuildchainConfig` | function: function validateBuildchainConfig(cwd = process.cwd(), { requireConfig = true, requireVersionState = false, requireLifecycleStages = [], } = {}) | cwd = process.cwd(), { requireConfig = true, requireVersionState = false, requireLifecycleStages = [], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateBuildchainConfig } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-config.js:1691` |
-| `validateControllerPlan` | function: function validateControllerPlan(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerPlan } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:325` |
-| `validateControllerReceipt` | function: function validateControllerReceipt(receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {}) | receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceipt } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:423` |
-| `validateControllerReceiptReference` | function: function validateControllerReceiptReference(reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceiptReference } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:505` |
+| `validateControllerPlan` | function: function validateControllerPlan(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerPlan } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:328` |
+| `validateControllerReceipt` | function: function validateControllerReceipt(receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {}) | receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceipt } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:426` |
+| `validateControllerReceiptReference` | function: function validateControllerReceiptReference(reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceiptReference } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:508` |
 | `validateKfd1ReleaseGateEvidence` | function: function validateKfd1ReleaseGateEvidence(section, { metadata = resolveKfd1Metadata() } = {}) | section, { metadata = resolveKfd1Metadata() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateKfd1ReleaseGateEvidence } from "@kungfu-tech/buildchain";` | `packages/core/kfd-gate.js:1337` |
 | `validateKfd2ProductClaimsRegistry` | function: function validateKfd2ProductClaimsRegistry(registry = {}) | registry = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateKfd2ProductClaimsRegistry } from "@kungfu-tech/buildchain";` | `packages/core/kfd2-product-claims.js:152` |
 | `validateKfd3CollaborationInterfaceReleaseGateEvidence` | function: function validateKfd3CollaborationInterfaceReleaseGateEvidence(section, { metadata = resolveKfd3Metadata() } = {}) | section, { metadata = resolveKfd3Metadata() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateKfd3CollaborationInterfaceReleaseGateEvidence } from "@kungfu-tech/buildchain";` | `packages/core/kfd-gate.js:1470` |
@@ -720,7 +720,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `abortReleaseActivationTransaction` | function: function abortReleaseActivationTransaction(transaction, reason) | transaction, reason | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { abortReleaseActivationTransaction } from "@kungfu-tech/buildchain/core";` | `packages/core/release-activation-transaction.js:277` |
 | `AGENT_INDEX_CONTRACT` | constant: const AGENT_INDEX_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { AGENT_INDEX_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-passport.js:54` |
 | `aggregateBuildFacts` | function: function aggregateBuildFacts({ cwd = process.cwd(), productId = "", moduleFacts = [], artifacts = [], now = nowIso(), } = {}) | { cwd = process.cwd(), productId = "", moduleFacts = [], artifacts = [], now = nowIso(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | subprocess | `import { aggregateBuildFacts } from "@kungfu-tech/buildchain/core";` | `packages/core/build-facts.js:466` |
-| `aggregateControllerReceipts` | function: function aggregateControllerReceipts({ plans = [], receipts = [] } = {}) | { plans = [], receipts = [] } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { aggregateControllerReceipts } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:449` |
+| `aggregateControllerReceipts` | function: function aggregateControllerReceipts({ plans = [], receipts = [] } = {}) | { plans = [], receipts = [] } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { aggregateControllerReceipts } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:452` |
 | `ANCHORED_VERSION_MATERIAL_CONTRACT` | constant: const ANCHORED_VERSION_MATERIAL_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { ANCHORED_VERSION_MATERIAL_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/anchored-version-material.js:15` |
 | `appendBuildchainLogEvent` | function: function appendBuildchainLogEvent(filePath, event) | filePath, event | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write | `import { appendBuildchainLogEvent } from "@kungfu-tech/buildchain/core";` | `packages/core/logging.js:67` |
 | `applyGitHubHousekeeperPlan` | function: async function applyGitHubHousekeeperPlan({ client, plan, dryRun = true, priorReceipt, appliedAt = new Date().toISOString(), staleDays = DEFAULT_STALE_DAYS, maxActions = DEFAULT_MAX_ACTIONS, }) | { client, plan, dryRun = true, priorReceipt, appliedAt = new Date().toISOString(), staleDays = DEFAULT_STALE_DAYS, maxActions = DEFAULT_MAX_ACTIONS, } | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { applyGitHubHousekeeperPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/engineering-housekeeper-github.js:615` |
@@ -806,7 +806,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:65` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:65` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/build-facts.js:45` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:199` |
@@ -877,15 +877,15 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain/core";` | `packages/core/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:89` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:104` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain/core";` | `packages/core/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/cache-evidence.js:169` |
 | `createCandidateTimeline` | function: function createCandidateTimeline({ candidate = {}, events = [], generatedAt, } = {}) | { candidate = {}, events = [], generatedAt, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createCandidateTimeline } from "@kungfu-tech/buildchain/core";` | `packages/core/candidate-timeline.js:381` |
 | `createConsumerPublicationDecision` | function: function createConsumerPublicationDecision({ capability, gateAggregate, decision, predicateId, predicateDigest, evidence = {}, now = new Date(), } = {}) | { capability, gateAggregate, decision, predicateId, predicateDigest, evidence = {}, now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createConsumerPublicationDecision } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:991` |
-| `createControllerPlan` | function: function createControllerPlan({ descriptor, source = {}, runtime = {}, inputs = {} } = {}) | { descriptor, source = {}, runtime = {}, inputs = {} } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:287` |
-| `createControllerReceipt` | function: function createControllerReceipt({ plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {}) | { plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:363` |
-| `createControllerReceiptReference` | function: function createControllerReceiptReference(receipt) | receipt | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceiptReference } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:491` |
+| `createControllerPlan` | function: function createControllerPlan({ descriptor, source = {}, runtime = {}, inputs = {} } = {}) | { descriptor, source = {}, runtime = {}, inputs = {} } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:290` |
+| `createControllerReceipt` | function: function createControllerReceipt({ plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {}) | { plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:366` |
+| `createControllerReceiptReference` | function: function createControllerReceiptReference(receipt) | receipt | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceiptReference } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:494` |
 | `createControllerRegistry` | function: function createControllerRegistry({ workflows = [] } = {}) | { workflows = [] } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:197` |
 | `createDiagnosticsArtifact` | function: function createDiagnosticsArtifact({ cwd = process.cwd(), logPath = "", artifactPaths = [], cacheDirs = [], lifecycleObservability = undefined, processSamples = [], processSummary = undefined, requestedParallelism = 0, sourceCheckout = undefined, compilerCachePreparation = undefined, links = {}, } = {}) | { cwd = process.cwd(), logPath = "", artifactPaths = [], cacheDirs = [], lifecycleObservability = undefined, processSamples = [], processSummary = undefined, requestedParallelism = 0, sourceCheckout = undefined, compilerCachePreparation = undefined, links = {}, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createDiagnosticsArtifact } from "@kungfu-tech/buildchain/core";` | `packages/core/diagnostics.js:1408` |
 | `createEngineeringHousekeeperPlan` | function: function createEngineeringHousekeeperPlan({ repository, target, branches = [], pullRequests = [], policy = {}, observedAt, }) | { repository, target, branches = [], pullRequests = [], policy = {}, observedAt, } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createEngineeringHousekeeperPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/engineering-housekeeper.js:170` |
@@ -1082,7 +1082,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `normalizeBuildchainConfig` | function: function normalizeBuildchainConfig(config) | config | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeBuildchainConfig } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-config.js:206` |
 | `normalizeBuildchainLogEvent` | function: function normalizeBuildchainLogEvent(input = {}, defaults = {}) | input = {}, defaults = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { normalizeBuildchainLogEvent } from "@kungfu-tech/buildchain/core";` | `packages/core/logging.js:45` |
 | `normalizeCandidateTimelineEvent` | function: function normalizeCandidateTimelineEvent(input = {}) | input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeCandidateTimelineEvent } from "@kungfu-tech/buildchain/core";` | `packages/core/candidate-timeline.js:74` |
-| `normalizeControllerReceiptReferences` | function: function normalizeControllerReceiptReferences({ receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | { receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeControllerReceiptReferences } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:532` |
+| `normalizeControllerReceiptReferences` | function: function normalizeControllerReceiptReferences({ receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | { receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeControllerReceiptReferences } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:535` |
 | `normalizeGitHubArtifactAttestationPolicy` | function: function normalizeGitHubArtifactAttestationPolicy(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeGitHubArtifactAttestationPolicy } from "@kungfu-tech/buildchain/core";` | `packages/core/github-artifact-attestation.js:158` |
 | `normalizeGithubBranchProtectionSnapshot` | function: function normalizeGithubBranchProtectionSnapshot(protection = {}) | protection = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { normalizeGithubBranchProtectionSnapshot } from "@kungfu-tech/buildchain/core";` | `packages/core/github-governance-authority.js:1028` |
 | `normalizeGithubRulesetSnapshot` | function: function normalizeGithubRulesetSnapshot(ruleset = {}) | ruleset = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { normalizeGithubRulesetSnapshot } from "@kungfu-tech/buildchain/core";` | `packages/core/github-governance-authority.js:1098` |
@@ -1295,9 +1295,9 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `validateArtifactSigningRequest` | function: function validateArtifactSigningRequest(request) | request | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateArtifactSigningRequest } from "@kungfu-tech/buildchain/core";` | `packages/core/artifact-signing.js:352` |
 | `validateArtifactSigningResult` | function: function validateArtifactSigningResult(result, { request, receipt } = {}) | result, { request, receipt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateArtifactSigningResult } from "@kungfu-tech/buildchain/core";` | `packages/core/artifact-signing-result.js:147` |
 | `validateBuildchainConfig` | function: function validateBuildchainConfig(cwd = process.cwd(), { requireConfig = true, requireVersionState = false, requireLifecycleStages = [], } = {}) | cwd = process.cwd(), { requireConfig = true, requireVersionState = false, requireLifecycleStages = [], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateBuildchainConfig } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-config.js:1691` |
-| `validateControllerPlan` | function: function validateControllerPlan(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:325` |
-| `validateControllerReceipt` | function: function validateControllerReceipt(receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {}) | receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:423` |
-| `validateControllerReceiptReference` | function: function validateControllerReceiptReference(reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceiptReference } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:505` |
+| `validateControllerPlan` | function: function validateControllerPlan(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:328` |
+| `validateControllerReceipt` | function: function validateControllerReceipt(receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {}) | receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:426` |
+| `validateControllerReceiptReference` | function: function validateControllerReceiptReference(reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceiptReference } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:508` |
 | `validateKfd1ReleaseGateEvidence` | function: function validateKfd1ReleaseGateEvidence(section, { metadata = resolveKfd1Metadata() } = {}) | section, { metadata = resolveKfd1Metadata() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateKfd1ReleaseGateEvidence } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd-gate.js:1337` |
 | `validateKfd2ProductClaimsRegistry` | function: function validateKfd2ProductClaimsRegistry(registry = {}) | registry = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateKfd2ProductClaimsRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd2-product-claims.js:152` |
 | `validateKfd3CollaborationInterfaceReleaseGateEvidence` | function: function validateKfd3CollaborationInterfaceReleaseGateEvidence(section, { metadata = resolveKfd3Metadata() } = {}) | section, { metadata = resolveKfd3Metadata() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateKfd3CollaborationInterfaceReleaseGateEvidence } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd-gate.js:1470` |
@@ -1592,20 +1592,20 @@ Target: `./packages/core/controller-evidence.js`. Public symbols: 14.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `aggregateControllerReceipts` | function: function aggregateControllerReceipts({ plans = [], receipts = [] } = {}) | { plans = [], receipts = [] } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { aggregateControllerReceipts } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:449` |
+| `aggregateControllerReceipts` | function: function aggregateControllerReceipts({ plans = [], receipts = [] } = {}) | { plans = [], receipts = [] } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { aggregateControllerReceipts } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:452` |
 | `BUILDCHAIN_CONTROLLER_AGGREGATE_CONTRACT` | constant: const BUILDCHAIN_CONTROLLER_AGGREGATE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_CONTROLLER_AGGREGATE_CONTRACT } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:6` |
 | `BUILDCHAIN_CONTROLLER_DESCRIPTOR_CONTRACT` | constant: const BUILDCHAIN_CONTROLLER_DESCRIPTOR_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_CONTROLLER_DESCRIPTOR_CONTRACT } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:4` |
 | `BUILDCHAIN_CONTROLLER_EVIDENCE_CONTRACT` | constant: const BUILDCHAIN_CONTROLLER_EVIDENCE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_CONTROLLER_EVIDENCE_CONTRACT } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:3` |
 | `BUILDCHAIN_CONTROLLER_REGISTRY_CONTRACT` | constant: const BUILDCHAIN_CONTROLLER_REGISTRY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_CONTROLLER_REGISTRY_CONTRACT } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:5` |
 | `controllerEvidenceDigest` | function: function controllerEvidenceDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { controllerEvidenceDigest } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:151` |
-| `createControllerPlan` | function: function createControllerPlan({ descriptor, source = {}, runtime = {}, inputs = {} } = {}) | { descriptor, source = {}, runtime = {}, inputs = {} } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerPlan } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:287` |
-| `createControllerReceipt` | function: function createControllerReceipt({ plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {}) | { plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceipt } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:363` |
-| `createControllerReceiptReference` | function: function createControllerReceiptReference(receipt) | receipt | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceiptReference } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:491` |
+| `createControllerPlan` | function: function createControllerPlan({ descriptor, source = {}, runtime = {}, inputs = {} } = {}) | { descriptor, source = {}, runtime = {}, inputs = {} } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerPlan } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:290` |
+| `createControllerReceipt` | function: function createControllerReceipt({ plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {}) | { plan, stages = [], evidence = [], reason = undefined, artifact = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceipt } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:366` |
+| `createControllerReceiptReference` | function: function createControllerReceiptReference(receipt) | receipt | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerReceiptReference } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:494` |
 | `createControllerRegistry` | function: function createControllerRegistry({ workflows = [] } = {}) | { workflows = [] } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createControllerRegistry } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:197` |
-| `normalizeControllerReceiptReferences` | function: function normalizeControllerReceiptReferences({ receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | { receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeControllerReceiptReferences } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:532` |
-| `validateControllerPlan` | function: function validateControllerPlan(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerPlan } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:325` |
-| `validateControllerReceipt` | function: function validateControllerReceipt(receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {}) | receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceipt } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:423` |
-| `validateControllerReceiptReference` | function: function validateControllerReceiptReference(reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceiptReference } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:505` |
+| `normalizeControllerReceiptReferences` | function: function normalizeControllerReceiptReferences({ receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | { receipts = [], references = [], expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeControllerReceiptReferences } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:535` |
+| `validateControllerPlan` | function: function validateControllerPlan(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerPlan } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:328` |
+| `validateControllerReceipt` | function: function validateControllerReceipt(receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {}) | receipt, { plan = undefined, expectedSourceSha = "", expectedRuntimeSha = "", expectedPlanDigest = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceipt } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:426` |
+| `validateControllerReceiptReference` | function: function validateControllerReceiptReference(reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {}) | reference, { expectedSourceSha = "", acceptedSourceShas = [], expectedRuntimeSha = "", requirePassed = false, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateControllerReceiptReference } from "@kungfu-tech/buildchain/controller-evidence";` | `packages/core/controller-evidence.js:508` |
 
 ## `@kungfu-tech/buildchain/diagnostics`
 
@@ -2422,8 +2422,8 @@ Target: `./packages/core/buildchain-publication-authority.js`. Public symbols: 2
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:65` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:89` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:65` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:104` |
 
 ## `@kungfu-tech/buildchain/github-governance-authority`
 

package/docs/publication-authority.md

@@ -227,7 +227,7 @@ buildchain audit publication-control-plane \
   --source-sha <exact-merged-branch-sha> \
   --workflow .github/workflows/release-candidate-promote.yml \
   --workflow-ref <exact-buildchain-sha> \
-  --publisher-workflow .github/workflows/buildchain-ref-promotion.yml \
+  --publisher-workflow .github/workflows/self-release-promote.yml \
   --job promote \
   --environment none
 
@@ -236,7 +236,7 @@ buildchain audit publication-control-plane \
   --repository kungfu-systems/buildchain \
   --branch dev/v3/v3.0 \
   --workflow .github/workflows/release-candidate-promote.yml \
-  --publisher-workflow .github/workflows/buildchain-ref-promotion.yml \
+  --publisher-workflow .github/workflows/self-release-promote.yml \
   --job promote \
   --environment none \
   --npm-trust-json sanitized-npm-trust.json

package/docs/release-candidate.md

@@ -265,7 +265,7 @@ in the release passport.
 
 Standalone binary publication is a separate consumer capability. The promotion
 wrapper does not assume that an npm-only repository provides
-`.github/workflows/binary-distribution.yml`. Repositories that own that workflow
+`.github/workflows/self-build-binary-distribution.yml`. Repositories that own that workflow
 opt in with `standalone-binary-distribution: true`; Buildchain's self-promotion
 does so explicitly. Once enabled, a missing or invalid binary workflow remains a
 hard failure rather than being silently skipped.
@@ -303,7 +303,7 @@ short-lived admission JSON in repository-specific workflow code:
 ```yaml
       publication-auto-admission: true
       publication-auto-no-gate: true
-      publication-publisher-workflow-path: .github/workflows/buildchain-ref-promotion.yml
+      publication-publisher-workflow-path: .github/workflows/self-release-promote.yml
       publication-product: Example Product
       publication-target: npm:@example/product
       publication-package-name: "@example/product"
@@ -339,7 +339,7 @@ an npm package identity:
 ```yaml
       publication-auto-admission: true
       publication-auto-no-gate: true
-      publication-publisher-workflow-path: .github/workflows/buildchain-ref-promotion.yml
+      publication-publisher-workflow-path: .github/workflows/self-release-promote.yml
       publication-product: Example Binary
       publication-target: github-release:example/example-binary
       publication-package-name: ""

package/docs/release-flow.md

@@ -8,17 +8,17 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-07-31
+last_reviewed: 2026-09-05
 ai_provenance:
-  model_family: GPT-5
+  model_family: GPT-6
   product: Codex
-  generated_at: 2026-07-31
+  generated_at: 2026-09-05
   invisible_context: not asserted
 ---
 
 # Release Flow Diagrams
 
-This document describes the Buildchain v4 branch, tag, and version-state flow.
+This document describes v4 alpha publication and the legacy v3 release flow.
 See [Release governance](release-governance.md) for the design rationale.
 
 ## Architecture
@@ -142,7 +142,21 @@ published. Queue reconciliation runs after branch protection and before the
 default-branch switch, so a failed governance apply leaves the old active line
 in place and the idempotently created new refs can be retried.
 
-## Alpha Promotion
+## V4 Alpha Publication
+
+The protected `dev/v4/v4.0 -> alpha/v4/v4.0` channel PR admits the source.
+Publication creates the immutable `v4.0.Z-alpha.N` tag and advances the eligible
+floating alpha refs to that published source. Its completed receipt and original
+Release Passport remain the publication authority.
+
+A separate protected next-development PR prepares `4.0.Z-alpha.(N+1)` on
+`dev/v4/v4.0`. Preparing that version does not publish another exact tag or move
+the alpha refs. A review, queue, or transient API failure in that PR leaves
+publication complete and next-development incomplete; recovery resumes the
+missing tail. Binary distribution has its own evidence and completion state.
+See [What each verification proves](#what-each-verification-proves).
+
+## Legacy V3 Alpha Promotion
 
 ```mermaid
 sequenceDiagram
@@ -180,7 +194,7 @@ dev/vX/vX.Y
 
 all point at the generated alpha version-state commit.
 
-## Release Promotion
+## Legacy V3 Release Promotion
 
 ```mermaid
 sequenceDiagram
@@ -234,7 +248,7 @@ dev/vX/vX.Y
 
 point at the next alpha version-state commit.
 
-## State Machine
+## Legacy V3 State Machine
 
 ```mermaid
 stateDiagram-v2
@@ -249,28 +263,28 @@ stateDiagram-v2
 
 The same minor line can loop through this state machine many times.
 
-## Version Examples
+## Legacy V3 Version Examples
 
-Assume `v4.0.2-alpha.1` has been tested and a maintainer merges
-`alpha/v4/v4.0 -> release/v4/v4.0`.
+Assume `v3.0.2-alpha.1` has been tested and a maintainer merges
+`alpha/v3/v3.0 -> release/v3/v3.0`.
 
 Buildchain should produce:
 
 ```text
-v4.0.2                  exact production tag
-v4.0                    floating minor tag
-v4                      floating major tag when v4.0 is the selected major line
-release/v4/v4.0         production channel branch
+v3.0.2                  exact production tag
+v3.0                    floating minor tag
+v3                      floating major tag when v3.0 is the selected major line
+release/v3/v3.0         production channel branch
 ```
 
 It should also prepare:
 
 ```text
-v4.0.3-alpha.0          exact next alpha tag
-v4.0-alpha              floating alpha tag
-v4-alpha                floating major alpha tag when v4.0 is the highest published alpha minor
-alpha/v4/v4.0           alpha channel branch
-dev/v4/v4.0             development channel branch
+v3.0.3-alpha.0          exact next alpha tag
+v3.0-alpha              floating alpha tag
+v3-alpha                floating major alpha tag when v3.0 is the highest published alpha minor
+alpha/v3/v3.0           alpha channel branch
+dev/v3/v3.0             development channel branch
 ```
 
 This is expected behavior. A production release closes one patch and opens the
@@ -333,3 +347,37 @@ the current target ref contains or corresponds to the recorded
 `release_material_sha`. It must then tolerate exact tags, dev refs, or alpha
 refs that have already moved and continue filling any missing floating tags
 before writing the transaction state as `complete`.
+
+## What each verification proves
+
+| Evidence | Meaning and reuse boundary |
+| --- | --- |
+| Full source execution | `pnpm run check` runs source tests, Rust gates, policy checks and generated artifact checks. Each Node test file runs once; the focused `check:v4-contracts` command still includes its 22 contract test files. |
+| Merge queue proof | A successful full merge-group run seals its exact source SHA/tree, workflow, check definition, WASM runtime, toolchain versions, dependency locks, hosted image and platform. The proof expires after six hours and is verified against the completed GitHub run attempt and artifact archive digest. |
+| Push reuse | A Dev push may reuse that exact full execution. Its summary links the original run and proof; it does not claim to have rerun tests. Missing, failed, expired, ambiguous, tampered or unavailable evidence executes the full check. |
+| Version-state projection | Requires an authenticated full-source proof for the exact base and an ancestor-bound delta containing only declared version files and derived material. The base generator reconstructs every tracked byte, including derived digests. Any source, workflow, lock, configuration, file-mode or unexplained output change executes the full check. Projection results cannot issue a new full-source proof. |
+| Generated version-state check | `Version-state projection / <context>` describes generated material. It never uses a protected full-source check's name on v4. Required PR lineage, review and merge queue gates remain independent. |
+| Candidate qualification | Validates the sealed candidate, admitted runtime, source lock and publication authority. Source test reuse grants no provider mutation authority. |
+| Provider readback and settlement | Verifies actual tags, npm integrity, release assets and native receipt roots. Publication, next-development and binary distribution are reported separately. |
+
+The protected `check` context keeps its stable name while step names and summaries
+identify full execution, exact proof reuse, or generated projection. The two
+consumer-policy checks execute inside the root check, without duplicate Verify
+pre-steps. The root check uses the Rust-only contract command before its complete
+Node suite, removing 22 repeated test-file executions without removing tests.
+
+The public v4 consumer remains a thin floating-channel caller with both locks.
+Linux, macOS and Windows each execute the declared lifecycle, clean-process
+restore and runtime/source binding. Their platform and called-runtime identities
+differ from the source Verify lane, so a Linux source proof cannot replace them.
+The Stage Capsule checkpoint matrix also retains all three platforms. Shared
+platform-independent logic lives in the root check and public runtime; there is
+no Buildchain-only dogfood exception or persisted candidate runtime selector.
+
+A local Linux sample on 2026-09-05 measured the original full check at
+`a41c00a0c0b2dbd57c238cd9b326b167a1d27ca8` at 148.772 seconds and the updated check
+at 126.731 seconds, both exit 0. The original plan executed 226 Node test files
+plus 22 duplicate selections; the updated plan executes all 231 files once,
+including the new negative and recovery tests (2,047 tests). These are individual
+local measurements with existing tool caches; hosted queue/push reuse is proved
+separately by the exact run attempt and evidence roots in each job summary.

package/docs/release-governance.md

@@ -77,8 +77,8 @@ line.
 
 Buildchain implements the same governance loop with:
 
-- `.github/workflows/release-verify.yml` for PR verification;
-- `.github/workflows/buildchain-ref-promotion.yml` for post-verify ref
+- `.github/workflows/self-build-release-verify-compat.yml` for PR verification;
+- `.github/workflows/self-release-promote.yml` for post-verify ref
   promotion; this workflow dogfoods the declarative
   `release-candidate-promote.yml` wrapper and does not hand-wire resolver,
   artifact download, publish-gate, or promote action steps;
@@ -246,7 +246,7 @@ while exact tags and SHAs remain the reproducible audit choice.
 ### Buildchain Alpha Self-Dogfood
 
 Buildchain continuously consumes its own current major alpha through
-`.github/workflows/buildchain-alpha-self-dogfood.yml`. Both lanes call the
+`.github/workflows/self-build-alpha-dogfood.yml`. Both lanes call the
 released channel router at `build.yml@v3-alpha`. The auto lane must resolve
 `v3-alpha`; the explicit stable lane must resolve `v3`. Both execute the same
 declared install, build, and verify fixture, proving that a single consumer
@@ -295,7 +295,7 @@ resolution and evidence comparison.
 
 This is a post-publication consumer canary, not a release bootstrap. Source
 verification still runs the current commit, and
-`buildchain-ref-promotion.yml` still passes the verified exact SHA into the
+`self-release-promote.yml` still passes the verified exact SHA into the
 promotion workflow. Patrol, dev-merge, repair, and promotion defaults remain on
 stable or exact refs so a broken alpha cannot prevent Buildchain from publishing
 its fix. When Buildchain opens a new major, inventory validation requires this
@@ -526,7 +526,7 @@ The repository policy can be declared once instead of repeated as CLI flags:
 ```toml
 [governance.dev.merge_queue]
 mode = "inherit"
-required_workflows = [".github/workflows/verify.yml"]
+required_workflows = [".github/workflows/self-build-verify.yml"]
 ```
 
 `enabled` explicitly requires Buildchain to create or update an exact-branch
@@ -632,7 +632,7 @@ binds the caller commit/tree and both workflow digests.
 ```sh
 node .buildchain/workflow-contract-runtime/scripts/workflow-call-contract.mjs check \
   --caller-root . \
-  --caller-workflow .github/workflows/release-new-version.yml \
+  --caller-workflow .github/workflows/self-release-new-version-compat.yml \
   --caller-repository kungfu-systems/example \
   --job promote \
   --callee-root .buildchain/workflow-contract-runtime \
@@ -1009,8 +1009,8 @@ v3.0.1-alpha.0
 When debugging or extending release behavior, read in this order:
 
 1. `docs/release-flow.md`
-2. `.github/workflows/release-verify.yml`
-3. `.github/workflows/buildchain-ref-promotion.yml`
+2. `.github/workflows/self-build-release-verify-compat.yml`
+3. `.github/workflows/self-release-promote.yml`
 4. `.github/workflows/release-candidate-promote.yml`
 5. `.github/workflows/.release-candidate-promote.yml`
 6. `actions/promote-buildchain-ref/README.md`

package/docs/v4-adopter-delivery.md

@@ -115,7 +115,7 @@ stable use and `@v4-alpha` during prerelease evaluation. It resolves the exact
 called-workflow SHA, enforces floating selector plus dual-lock consumer
 admission, and runs the same CLI on Linux, macOS, and Windows. Buildchain
 dogfoods it through the thin
-[`v4-adopter-delivery-dogfood.yml`](../.github/workflows/v4-adopter-delivery-dogfood.yml)
+[`self-build-adopter-dogfood.yml`](../.github/workflows/self-build-adopter-dogfood.yml)
 caller, which contains no steps or local orchestration and persists only the
 floating `@v4-alpha` selector.