@kungfu-tech/buildchain 4.0.2-alpha.34 → 4.0.2-alpha.35

package/docs/v4-production-release.md

@@ -7,12 +7,12 @@ source_level: repository-contracts + protected-provider-readback
 confidence: high
 sensitivity: public
 evidence_grade: A
-review_state: self-reviewed
-last_reviewed: 2026-08-13
+review_state: unreviewed
+last_reviewed: 2026-09-05
 ai_provenance:
-  model_family: GPT-5
+  model_family: GPT-6
   product: Codex
-  generated_at: 2026-08-13
+  generated_at: 2026-09-05
   invisible_context: Provider credentials and private provider state were not read.
 ---
 
@@ -26,8 +26,9 @@ dev/v4/v4.0 -> alpha/v4/v4.0 -> release/v4/v4.0
 ```
 
 Public consumers use `v4-alpha` for the current prerelease channel and `v4`
-for stable. Reproducible consumers may pin an exact 40-character commit or an
-exact immutable release tag such as `v4.0.0`.
+for stable, with matching stable and alpha contract locks. Exact commits and
+immutable release tags identify retained evidence and explicitly admitted runtime
+inputs; tracked v4 reusable-workflow selectors remain `@v4` or `@v4-alpha`.
 
 The release transaction is fail-closed. The v4 provider-operation journal,
 activation plan, stable publication fence, and partial-mutation recovery plan
@@ -51,8 +52,9 @@ exact alpha tag, and npm's `alpha` tag.
 ## Non-destructive rollback
 
 Rollback never rewrites an exact tag, release, package version, Passport, or
-provider journal. Stop forward promotion, pin consumers to the last verified
-exact v4 SHA or exact stable tag, and use the retained `release/v3/v3.0`
+provider journal. Stop forward promotion and select the last verified exact
+v4 runtime through an admitted, non-persistent recovery input; keep tracked v4
+workflow selectors on their locked floating channel. Use `release/v3/v3.0`
 coordinate only as an explicit compatibility rollback reference. Restoring v3
 as production authority requires a new reviewed cutover; it is not an implicit
 fallback.
@@ -61,3 +63,38 @@ Before any retry, compare the current provider state with the retained
 transaction and operation roots. Resume only missing eligible operations.
 Conflicting state remains `repair-required` or terminal and must not be
 converted into success by moving a floating ref.
+
+## Publication settlement and binary recovery
+
+Publication, next-development advancement, and binary distribution have separate
+results. A completed native ReleaseReceipt remains publication evidence when the
+later generated Dev PR is still pending or its enqueue call fails. SETTLE verifies
+the immutable invocation, transaction, both provider states, receipt and Passport
+roots even when APPLY fails after publication. It has no provider write permission.
+
+APPLY retains that exact chain in the existing GitHub Release as
+`buildchain-publication-settlement.json`; it reads the exact tag and original
+`buildchain.release.json` before adding the packet. The APPLY artifact also retains
+`delivery-summary.json`, which reports publication and next-development separately.
+A green workflow label cannot substitute for this receipt verification.
+
+Binary Distribution reads this settlement and the original publication Passport.
+Tag creation can precede settlement, so it waits at most 40 observations, 15 seconds
+apart, for missing evidence. A mismatched source, tag, Passport or receipt fails
+immediately. It no longer requires a legacy `buildchain/release-state/*` ref for v4.
+
+The sealed binary publisher retains the publication Passport and writes its own
+Passport as `buildchain.binary.release.json`. All v4 asset collisions are checked
+before uploads: identical bytes are preserved, absent assets are added, and
+conflicting bytes are rejected. Each publication authorization is retained as
+`buildchain.binary.capability-<sha256>.json`, so a fresh recovery capability does
+not overwrite an earlier grant. Existing assets are never clobbered. Recovery uses
+the same exact successful Binary Distribution evidence run through
+`self-release-binary-assets.yml`; it does not rebuild already admitted archives or
+create another npm version. Read back all three platform archives, checksums,
+both Passports and the settlement packet before declaring distribution complete.
+
+The native publication receipt authorizes no stable promotion and makes no claim
+that a pending next-development PR has merged. Inspect the exact PR head, protected
+base and merge result independently. A retry of the publication phase must first
+read retained provider facts and resume only missing operations.

package/docs/v4-stage-capsule.md

@@ -137,7 +137,7 @@ shadow-only: it does not skip a v3 production stage or move v3 authority.
 qualification boundary. Buildchain and external repositories use the same
 Buildchain-owned public reusable workflow,
 `.github/workflows/v4-stage-capsule-canary.yml`. Buildchain's caller is the thin
-`.github/workflows/v4-public-consumer-dogfood.yml`; it has no steps, copied
+`.github/workflows/self-build-public-consumer-dogfood.yml`; it has no steps, copied
 orchestration, local action, direct qualification invocation, or private
 consumer profile. Candidate recursion is resolved only by publishing the exact
 candidate at `train/v4/v4.0/<capability>` and calling that fully qualified

package/docs/workflow-catalog.md

@@ -0,0 +1,151 @@
+---
+status: active
+period: ongoing
+theme: workflow-taxonomy
+doc_type: technical-reference
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-05
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-05
+  visible_context: Repository workflow source and the approved naming scheme
+  invisible_context_boundary: No credentials or unpublished provider configuration inspected
+---
+
+# Workflow catalog
+
+Generated from `architecture/workflow-taxonomy.json`; edit that source, then run
+`pnpm run generate:workflows`. Every YAML file, including compatibility paths,
+is checked by the existing required workflow check.
+
+## Naming and ownership
+
+`public-<build|release|ops>-<purpose>.yml` is a consumer entry;
+`.<build|release|ops>-<purpose>.yml` is an advanced component;
+`self-<build|release|ops>-<purpose>.yml` is Buildchain's own automation.
+Public is a product role, not GitHub access control. Dispatch services are
+marked separately from reusable workflows. Keep workflow names, job IDs,
+permissions, and trigger semantics stable during path migration.
+
+## Channel rollout
+
+Canonical names become callable on a channel only after that channel publishes
+them. Existing `@v4`/`@v4-alpha` consumers keep their exact registered legacy
+paths until provider readback proves canonical availability. New examples below
+describe the target surface, not a claim that both channels already publish it.
+Compatibility files are generated byte-identical projections, not independently
+editable implementations. They retain full jobs to preserve called-workflow
+identity, permission envelopes, and required check names without extra nesting.
+
+The controller registry records the actual source path separately from a migrated
+repository controller contractPath. This preserves the established logical
+contract identity while exposing its current execution source. New workflows
+do not acquire historical identities. Public controllers retain their real
+compatibility paths while those paths remain supported.
+
+## Adding or changing a workflow
+
+Register a stable identity, role, category, purpose, owner, lifecycle status,
+invocation and concrete summary before creating its derived path. A new entry
+must explain its scope in review. New aliases cannot be invented: compatibility
+must name an exact migration source with a reason and removal condition.
+The policy, generator, checker, tests, required CI chain and CODEOWNERS require
+independent `kungfu-origin` review. No wildcard compatibility admission is allowed.
+
+A role, category or implementation edit must preserve or deliberately update
+all related declarations. Run `pnpm run generate:workflows` and
+`pnpm run check:workflows`; the full `pnpm run check` remains required.
+
+## public
+
+| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
+| --- | --- | --- | --- | --- | --- |
+| [public-build-adopter-qualification.yml](../.github/workflows/public-build-adopter-qualification.yml) | build | reusable | active | V4 Adopter Delivery | `v4-adopter-delivery.yml` |
+| [public-build-candidate.yml](../.github/workflows/public-build-candidate.yml) | build | reusable | active | Buildchain Channel Build | `build.yml` |
+| [public-build-check.yml](../.github/workflows/public-build-check.yml) | build | reusable | active | Buildchain Check | `check.yml` |
+| [public-build-demo.yml](../.github/workflows/public-build-demo.yml) | build | reusable | active | Buildchain Declarative Binary Auditable Demo | `.declarative-auditable-demo.yml` |
+| [public-build-publication.yml](../.github/workflows/public-build-publication.yml) | build | reusable | active | Buildchain Publication Artifact | `publication-artifact.yml` |
+| [public-build-stage-capsule-canary.yml](../.github/workflows/public-build-stage-capsule-canary.yml) | build | reusable | active | V4 Stage Capsule Canary | `v4-stage-capsule-canary.yml` |
+| [public-ops-alpha-candidate-patrol.yml](../.github/workflows/public-ops-alpha-candidate-patrol.yml) | ops | reusable | active | Buildchain Dev to Alpha Candidate Patrol | `dev-alpha-candidate-patrol.yml` |
+| [public-ops-bootstrap-recovery.yml](../.github/workflows/public-ops-bootstrap-recovery.yml) | ops | reusable | active | Universal Buildchain Bootstrap Recovery | `universal-bootstrap-recovery.yml` |
+| [public-ops-bootstrap.yml](../.github/workflows/public-ops-bootstrap.yml) | ops | reusable | active | Buildchain Universal Bootstrap | `bootstrap.yml` |
+| [public-ops-dev-auto-merge.yml](../.github/workflows/public-ops-dev-auto-merge.yml) | ops | reusable | active | Dev PR Auto Merge | `dev-pr-auto-merge.yml` |
+| [public-ops-dev-qualification-patrol.yml](../.github/workflows/public-ops-dev-qualification-patrol.yml) | ops | reusable | active | Buildchain Dev Qualification Patrol | `dev-qualification-patrol.yml` |
+| [public-ops-housekeeping.yml](../.github/workflows/public-ops-housekeeping.yml) | ops | reusable | active | Engineering Housekeeper | `engineering-housekeeper.yml` |
+| [public-ops-observed-evidence.yml](../.github/workflows/public-ops-observed-evidence.yml) | ops | reusable | active | Patrol Observed Evidence | `patrol-observed-evidence.yml` |
+| [public-ops-patrol-daily.yml](../.github/workflows/public-ops-patrol-daily.yml) | ops | reusable | active | Buildchain Patrol Daily | `patrol-daily.yml` |
+| [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly | `patrol-monthly.yml` |
+| [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly | `patrol-weekly.yml` |
+| [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol | `buildchain-patrol.yml` |
+| [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile | `release-governance-reconcile.yml` |
+| [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol | `stable-candidate-patrol.yml` |
+| [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal | `v4-tail-reseal.yml` |
+| [public-ops-warrant-cancel.yml](../.github/workflows/public-ops-warrant-cancel.yml) | ops | reusable | active | Dev Delivery Warrant Queued Candidate Cancel | `dev-delivery-warrant-cancel.yml` |
+| [public-ops-warrant-close.yml](../.github/workflows/public-ops-warrant-close.yml) | ops | reusable | active | Dev Delivery Warrant Close | `dev-delivery-warrant-close.yml` |
+| [public-release-artifact-attestation.yml](../.github/workflows/public-release-artifact-attestation.yml) | release | reusable | active | Buildchain GitHub Artifact Attestation | `github-artifact-attestation.yml` |
+| [public-release-paper-sealed.yml](../.github/workflows/public-release-paper-sealed.yml) | release | reusable | active | Buildchain Sealed Paper Release | `paper-release-sealed.yml` |
+| [public-release-paper.yml](../.github/workflows/public-release-paper.yml) | release | reusable | active | Buildchain Paper Release | `paper-release.yml` |
+| [public-release-promote.yml](../.github/workflows/public-release-promote.yml) | release | reusable | active | Release Candidate Promote | `release-candidate-promote.yml` |
+| [public-release-propagation.yml](../.github/workflows/public-release-propagation.yml) | release | reusable | active | Release Propagation | `release-propagation.yml` |
+| [public-release-signing-authority.yml](../.github/workflows/public-release-signing-authority.yml) | release | dispatch-service | active | Buildchain Artifact Signing Authority | `artifact-signing-authority.yml` |
+| [public-release-tail.yml](../.github/workflows/public-release-tail.yml) | release | reusable | active | Declarative Release Tail | `release-tail.yml` |
+| [public-release-web.yml](../.github/workflows/public-release-web.yml) | release | reusable | active | Buildchain Web Surface | `.web-surface.yml` |
+
+## component
+
+| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
+| --- | --- | --- | --- | --- | --- |
+| [.build-demo-adapter.yml](../.github/workflows/.build-demo-adapter.yml) | build | reusable | active | Buildchain Auditable Demo | `.auditable-demo.yml` |
+| [.build-engine.yml](../.github/workflows/.build-engine.yml) | build | reusable | active | Buildchain Build | `.build.yml` |
+| [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile | `.gate-profile.yml` |
+| [.build-release-verify-compat.yml](../.github/workflows/.build-release-verify-compat.yml) | build | reusable | compatibility | release verify | `.release-verify.yml` |
+| [.build-sam-verify-compat.yml](../.github/workflows/.build-sam-verify-compat.yml) | build | reusable | compatibility | sam verify | `.sam-verify.yml` |
+| [.build-wheel-verify-compat.yml](../.github/workflows/.build-wheel-verify-compat.yml) | build | reusable | compatibility | wheel verify | `.wheel-verify.yml` |
+| [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git | `.sync-remote-git.yml` |
+| [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority | `.publication-authority.yml` |
+| [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets | `.binary-release-assets.yml` |
+| [.release-minor-bump-compat.yml](../.github/workflows/.release-minor-bump-compat.yml) | release | reusable | compatibility | bump minor version | `.bump-minor-version.yml` |
+| [.release-page-sync-retired.yml](../.github/workflows/.release-page-sync-retired.yml) | release | reusable | retired | sync release page | `.sync-release-page.yml` |
+| [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced | `.release-candidate-promote.yml` |
+
+## self
+
+| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
+| --- | --- | --- | --- | --- | --- |
+| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood | — |
+| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood | — |
+| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution | — |
+| [self-build-candidate-lab.yml](../.github/workflows/self-build-candidate-lab.yml) | build | repository | active | Candidate Lab | — |
+| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood | — |
+| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification | — |
+| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture | — |
+| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood | — |
+| [self-build-release-verify-compat.yml](../.github/workflows/self-build-release-verify-compat.yml) | build | repository | compatibility | Release - Verify | — |
+| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification | — |
+| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify | — |
+| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood | — |
+| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery | — |
+| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit | — |
+| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily | — |
+| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly | — |
+| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly | — |
+| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance | — |
+| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily | — |
+| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly | — |
+| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly | — |
+| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery | — |
+| [self-ops-recovery-failure-dogfood.yml](../.github/workflows/self-ops-recovery-failure-dogfood.yml) | ops | repository | active | Buildchain Candidate Recovery Dogfood Startup Failure | — |
+| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke | — |
+| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol | — |
+| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets | — |
+| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap | — |
+| [self-release-new-version-compat.yml](../.github/workflows/self-release-new-version-compat.yml) | release | repository | compatibility | Release - New Version | — |
+| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package | — |
+| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion | — |
+| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood | — |
+| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood | — |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.34",
+  "version": "4.0.2-alpha.35",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -156,18 +156,18 @@
   "scripts": {
     "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/v4-delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery-authority-candidate.js packages/core/dev-delivery-authority-evidence.js packages/core/dev-delivery-authority-landing.js packages/core/dev-delivery-authority-observation.js packages/core/dev-delivery-authority-qualification.js packages/core/dev-delivery-authority-settlement.js packages/core/dev-delivery-authority-state.js packages/core/dev-delivery-execution-failure.js packages/core/dev-delivery-execution-transfer.js packages/core/dev-delivery-landing-readback.js packages/core/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery-landing-testing-port.js packages/core/dev-delivery-native-execution.js packages/core/dev-delivery-native-proof.js packages/core/dev-delivery-process-boundary.js packages/core/dev-delivery-warrant-qualification.js packages/core/dev-delivery-warrant-state.js scripts/dev-delivery-authority-command-adapters.mjs scripts/dev-delivery-authority-provider.mjs scripts/dev-delivery-authority.mjs scripts/dev-delivery-native-run.mjs scripts/dev-delivery-process-boundary.mjs scripts/dev-delivery-two-phase-resume.mjs scripts/dev-delivery-two-phase.mjs scripts/dev-delivery-warrant-options.mjs scripts/dev-delivery-warrant-store.mjs templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && node scripts/check-v4-release-topology.mjs && node scripts/check-v4-universal-workflow-bootstrap.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && pnpm run check:v4-wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-v4-runtime-semantic-closure.mjs && node scripts/check-v3-v4-capability-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-publication-rehearsal-fixture.mjs --check && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check": "pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && node scripts/check-v4-release-topology.mjs && node scripts/check-v4-universal-workflow-bootstrap.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts:rust && pnpm run check:v4-wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-v4-runtime-semantic-closure.mjs && node scripts/check-v3-v4-capability-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-publication-rehearsal-fixture.mjs --check && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs bin/internal/compatibility-facts-cli.mjs packages/core/v4-canonical-contracts.js packages/core/kungfu-temporal-fact.js packages/core/buildchain-compatibility-fact.js packages/core/buildchain-compatibility-authority.js packages/core/buildchain-compatibility-proof.js packages/core/v4-floating-consumer-evidence.js packages/core/v4-floating-consumer-policy.js packages/core/v4-floating-consumer-release-passport.js packages/core/v4-runtime-ref-resume-authority.js packages/core/v4-tail-reseal-contract.js packages/core/v4-tail-reseal-github.js packages/core/v4-tail-reseal-receipt.js packages/core/v4-tail-reseal.js packages/core/v4-runtime-selector-persistence.js packages/core/v4-provider-operation-journal.js packages/core/v4-provider-readback-idempotency.js packages/core/v4-release-activation-shadow.js packages/core/v4-stable-publication-fence.js packages/core/v4-partial-mutation-recovery-qualification.js packages/core/v4-stage-capsule.js packages/core/v4-stage-capsule-store.js packages/core/v4-stage-capsule-local-store.js packages/core/v4-platform-stage-checkpoints.js packages/core/v4-stage-capsule-resume-planner.js packages/core/v4-stage-capsule-qualification.js packages/core/v4-stage-capsule-qualification-campaign.js packages/core/v4-delivery-warrant-fixture-runner.js packages/core/v4-delivery-warrant-read-candidate.js packages/core/v4-delivery-warrant-semantic-diff-gate.js packages/core/v4-delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-v4-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/dev-pr-prequeue-guard.mjs scripts/check-v4-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/v4-bridge-bootstrap.mjs scripts/v4-bridge-evidence.mjs scripts/v4-consumer-policy.mjs scripts/v4-host-adapter.mjs scripts/v4-platform-stage-checkpoint-rehearsal.mjs scripts/v4-stage-capsule-resume-rehearsal.mjs scripts/v4-stage-capsule-qualification.mjs scripts/v4-tail-reseal-macos-rehearsal.mjs scripts/v4-tail-reseal.mjs scripts/v4-warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs tests/v4-bridge.test.mjs tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-runtime-semantic-closure.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs tests/v4-warrant-shadow-plan.test.mjs",
     "check:v4-bridge": "cargo fmt --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml",
-    "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-domain-wasm.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-publication-rehearsal.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
+    "check:v4-contracts": "pnpm run check:v4-contracts:rust && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-domain-wasm.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-publication-rehearsal.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
     "build:v4-wasm": "node scripts/build-v4-domain-wasm.mjs",
     "check:v4-wasm": "prettier --check packages/core/v4-domain-wasm.js packages/core/v4-domain-wasm-artifact.js scripts/build-v4-domain-wasm.mjs scripts/copy-v4-domain-wasm.mjs tests/v4-domain-wasm.test.mjs && node scripts/build-v4-domain-wasm.mjs --check",
-    "check:workflows": "bash scripts/check-workflows.sh",
+    "check:workflows": "node scripts/check-workflow-taxonomy.mjs && bash scripts/check-workflows.sh",
     "generate:reference": "node scripts/generate-public-reference.mjs",
     "check:reference": "node scripts/generate-public-reference.mjs --check",
     "generate:next-development": "node scripts/generate-next-development-guidance.mjs",
     "check:next-development": "node scripts/generate-next-development-guidance.mjs --check",
-    "generate:site": "pnpm run generate:next-development && pnpm run generate:reference && node scripts/generate-site-bundle.mjs",
+    "generate:site": "pnpm run generate:workflows && pnpm run generate:next-development && pnpm run generate:reference && node scripts/generate-site-bundle.mjs",
     "check:site": "pnpm run check:next-development && pnpm run check:reference && node scripts/generate-site-bundle.mjs --check",
     "check:golden-path": "node scripts/verify-golden-path.mjs",
     "test:unit": "node --test tests/*.test.mjs",
@@ -177,7 +177,9 @@
     "pack:check": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
     "bridge:v4:build": "node scripts/v4-bridge-bootstrap.mjs build",
     "bridge:v4:run": "node scripts/v4-bridge-bootstrap.mjs run",
-    "bridge:v4:evidence": "node scripts/v4-bridge-evidence.mjs"
+    "bridge:v4:evidence": "node scripts/v4-bridge-evidence.mjs",
+    "check:v4-contracts:rust": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml",
+    "generate:workflows": "node scripts/generate-workflow-taxonomy.mjs"
   },
   "devDependencies": {
     "ajv": "8.17.1",

package/packages/core/buildchain-contract.js

@@ -833,7 +833,7 @@ export function createBuildchainContractWorld({
       breakingDefaults: {
         evidenceContract: "buildchain.controller-evidence/v1",
         descriptorVersion: descriptor.version,
-        workflowPath: descriptor.workflow.path,
+        workflowPath: descriptor.workflow.contractPath || descriptor.workflow.path,
         requiredStages: descriptor.expected.stages.filter((stage) => stage.required).map((stage) => stage.id),
         capabilities: descriptor.expected.capabilities,
         evidenceRequirements: descriptor.expected.evidence,

package/packages/core/buildchain-kfd-claims.js

@@ -58,7 +58,7 @@ const WORKFLOW_AND_ACTION_FILES = Object.freeze([
   ".github/workflows/.build.yml",
   ".github/workflows/.release-candidate-promote.yml",
   ".github/workflows/release-candidate-promote.yml",
-  ".github/workflows/buildchain-ref-promotion.yml",
+  ".github/workflows/self-release-promote.yml",
   ".github/workflows/github-artifact-attestation.yml",
   "actions/github-artifact-attestation/action.yml",
   "actions/github-artifact-attestation/index.js",
@@ -446,7 +446,7 @@ export function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}
     {
       name: "Buildchain standalone binary distribution",
       artifactPath: "dist/binary",
-      evidencePath: ".github/workflows/binary-distribution.yml",
+      evidencePath: ".github/workflows/self-build-binary-distribution.yml",
       distribution: normalizeKfd3DistributionDeclaration({
         registrar: "shifu",
         tasks: ["binary:build"],

package/packages/core/buildchain-publication-authority.js

@@ -15,35 +15,35 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/.web-surface.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
   [".github/workflows/.wheel-verify.yml", "retired-deny"],
   [".github/workflows/.binary-release-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
-  [".github/workflows/binary-distribution.yml", "evidence-publication"],
-  [".github/workflows/binary-release-assets.yml", "governance-write"],
+  [".github/workflows/self-build-binary-distribution.yml", "evidence-publication"],
+  [".github/workflows/self-release-binary-assets.yml", "governance-write"],
   [".github/workflows/artifact-signing-authority.yml", "evidence-publication"],
-  [".github/workflows/auditable-demo.yml", "governance-write"],
-  [".github/workflows/build-surface-fixture.yml", "non-publication-oidc"],
+  [".github/workflows/self-build-demo-dogfood.yml", "governance-write"],
+  [".github/workflows/self-build-fixture.yml", "non-publication-oidc"],
   [".github/workflows/build.yml", "non-publication-oidc"],
   [".github/workflows/bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/buildchain-alpha-self-dogfood.yml", "non-publication-oidc"],
-  [".github/workflows/buildchain-dev-delivery.yml", "governance-write"],
-  [".github/workflows/buildchain-patrol-daily.yml", "governance-write"],
-  [".github/workflows/buildchain-patrol-monthly.yml", "governance-write"],
-  [".github/workflows/buildchain-patrol-weekly.yml", "governance-write"],
+  [".github/workflows/self-build-alpha-dogfood.yml", "non-publication-oidc"],
+  [".github/workflows/self-ops-dev-delivery.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-daily.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-monthly.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-weekly.yml", "governance-write"],
   [".github/workflows/buildchain-patrol.yml", "governance-write"],
-  [".github/workflows/buildchain-ref-promotion-recovery.yml", "governance-write"],
-  [".github/workflows/buildchain-ref-promotion.yml", "governance-write"],
-  [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
+  [".github/workflows/self-ops-promotion-recovery.yml", "governance-write"],
+  [".github/workflows/self-release-promote.yml", "governance-write"],
+  [".github/workflows/self-ops-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-qualification-patrol.yml", "governance-write"],
   [".github/workflows/dev-alpha-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-delivery-warrant-close.yml", "governance-write"],
   [".github/workflows/dev-delivery-warrant-cancel.yml", "governance-write"],
-  [".github/workflows/dev-merge-queue-governance.yml", "governance-write"],
+  [".github/workflows/self-ops-merge-queue.yml", "governance-write"],
   [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
-  [".github/workflows/engineering-housekeeper-daily.yml", "governance-write"],
-  [".github/workflows/engineering-housekeeper-monthly.yml", "governance-write"],
-  [".github/workflows/engineering-housekeeper-weekly.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-daily.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-monthly.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-weekly.yml", "governance-write"],
   [".github/workflows/engineering-housekeeper.yml", "governance-write"],
-  [".github/workflows/github-governance-audit.yml", "governance-write"],
+  [".github/workflows/self-ops-governance-audit.yml", "governance-write"],
   [".github/workflows/github-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/npm-publish.yml", "dry-run-only"],
+  [".github/workflows/self-release-npm-dry-run.yml", "dry-run-only"],
   [".github/workflows/paper-release-sealed.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/paper-release.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/patrol-daily.yml", "governance-write"],
@@ -52,18 +52,18 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/patrol-weekly.yml", "governance-write"],
   [".github/workflows/publication-artifact.yml", "evidence-publication"],
   [".github/workflows/release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
-  [".github/workflows/release-line-bootstrap.yml", "governance-write"],
+  [".github/workflows/self-release-line-open.yml", "governance-write"],
   [".github/workflows/release-propagation.yml", "governance-write"],
   [".github/workflows/release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
-  [".github/workflows/release-verify.yml", "governance-write"],
+  [".github/workflows/self-build-release-verify-compat.yml", "governance-write"],
   [".github/workflows/stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/universal-bootstrap-recovery.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/universal-bootstrap-dogfood.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/v4-declarative-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
+  [".github/workflows/self-ops-bootstrap-dogfood.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/self-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
 ]);
 
-export function buildchainPublicationAuthorityDescriptors() {
-  return DESCRIPTORS.map(([
+export function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) {
+  const descriptors = DESCRIPTORS.map(([
     workflowPath,
     authorityClass,
     publicationCapable = false,
@@ -85,6 +85,21 @@ export function buildchainPublicationAuthorityDescriptors() {
     environmentMode,
     runnerPolicy: publicationCapable ? "qualified-measured" : "unqualified",
   }));
+  const taxonomyPath = path.join(root, "architecture/workflow-taxonomy.json");
+  if (!fs.existsSync(taxonomyPath)) return descriptors;
+  const taxonomy = JSON.parse(fs.readFileSync(taxonomyPath, "utf8"));
+  for (const entry of taxonomy.entries) {
+    if (!entry.compatibility) continue;
+    const previous = descriptors.find((item) => item.workflowPath === entry.compatibility.path);
+    if (!previous) continue;
+    const prefix = entry.role === "component" ? "." : `${entry.role}-`;
+    const workflowPath = `.github/workflows/${prefix}${entry.category}-${entry.purpose}.yml`;
+    if (fs.readFileSync(path.join(root, workflowPath), "utf8") !== fs.readFileSync(path.join(root, entry.compatibility.path), "utf8")) {
+      throw new Error(`publication authority alias differs from canonical workflow: ${workflowPath}`);
+    }
+    descriptors.push({ ...previous, workflowPath, publisherWorkflowPath: previous.publisherWorkflowPath === previous.workflowPath ? workflowPath : previous.publisherWorkflowPath });
+  }
+  return descriptors;
 }
 export function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) {
   const workflowsDir = path.join(root, ".github", "workflows");
@@ -95,7 +110,7 @@ export function createBuildchainPublicationAuthorityRegistry({ root = process.cw
       text: fs.readFileSync(path.join(workflowsDir, name), "utf8"),
     }));
   return createPublicationAuthorityRegistry({
-    descriptors: buildchainPublicationAuthorityDescriptors(),
+    descriptors: buildchainPublicationAuthorityDescriptors({ root }),
     workflows,
   });
 }

package/packages/core/controller-evidence.js

@@ -196,6 +196,9 @@ function descriptorDigest(descriptor) {
 
 export function createControllerRegistry({ workflows = [] } = {}) {
   const workflowById = new Map(workflows.map((entry) => [entry.id, entry]));
+  for (const entry of workflows) {
+    if (entry.taxonomy && !entry.taxonomy.compatibilityAlias && !workflowById.has(entry.taxonomy.id)) workflowById.set(entry.taxonomy.id, entry);
+  }
   const controllers = CONTROLLER_SPECS.map((spec) => {
     const workflow = workflowById.get(spec.workflowId);
     if (!workflow) throw new Error(`controller ${spec.id} requires workflow descriptor ${spec.workflowId}`);
@@ -215,7 +218,7 @@ export function createControllerRegistry({ workflows = [] } = {}) {
       contract: BUILDCHAIN_CONTROLLER_DESCRIPTOR_CONTRACT,
       id: spec.id,
       version: spec.version,
-      workflow: { id: workflow.id, path: workflow.path },
+      workflow: { id: workflow.id, path: workflow.path, ...(workflow.taxonomy?.contractPath ? { contractPath: workflow.taxonomy.contractPath } : {}) },
       inputs,
       expected: {
         stages: spec.stages.map((id) => ({ id, required: !optionalStages.has(id) })),

package/packages/core/github-governance-authority.js

@@ -118,12 +118,12 @@ const PROTECTED_AUTHORITY_PATHS = Object.freeze([
   ".github/CODEOWNERS",
   ".github/workflows/.publication-authority.yml",
   ".github/workflows/.release-candidate-promote.yml",
-  ".github/workflows/buildchain-ref-promotion-recovery.yml",
-  ".github/workflows/buildchain-ref-promotion.yml",
-  ".github/workflows/github-governance-audit.yml",
+  ".github/workflows/self-ops-promotion-recovery.yml",
+  ".github/workflows/self-release-promote.yml",
+  ".github/workflows/self-ops-governance-audit.yml",
   ".github/workflows/paper-release-sealed.yml",
   ".github/workflows/paper-release.yml",
-  ".github/workflows/release-line-bootstrap.yml",
+  ".github/workflows/self-release-line-open.yml",
   ".github/workflows/release-candidate-promote.yml",
   "actions/promote-buildchain-ref/action.yml",
   "actions/promote-buildchain-ref/dist/index.js",

package/packages/core/next-development-projection.js

@@ -243,7 +243,7 @@ invalid.
 
 ## Public self-dogfood and adoption
 
-\`.github/workflows/v4-public-consumer-dogfood.yml\` remains the exact thin
+\`.github/workflows/self-build-public-consumer-dogfood.yml\` remains the exact thin
 consumer of the public \`v4-stage-capsule-canary.yml@v4-alpha\` contract. Its
 declared \`lifecycle.verify\` runs \`pnpm run check\`, so the same public path
 executes pure recovery tests that inject a transient durable-state write

package/packages/core/release-line-dry-run.js

@@ -201,7 +201,7 @@ function explainReleaseLineDryRun({
     );
     plan.branchUpdates.push(
       { ref: targetRef, action: "would move to alpha version-state commit" },
-      { ref: `dev/v${rule.major}/v${rule.major}.${rule.minor}`, action: "would align dev with the published alpha state" },
+      { ref: `dev/v${rule.major}/v${rule.major}.${rule.minor}`, action: rule.major === 4 ? "would prepare the next alpha version on dev through a separate protected PR after publication" : "would align dev with the published alpha state" },
     );
     plan.versionState.targetVersions = [exactAlpha.replace(/^next v?/, "").replace(/^v/, "")];
     plan.notes.push("Alpha promotion opens or advances the test channel; it does not move production refs.");

package/packages/core/v4-canonical-contracts.js

@@ -28,6 +28,7 @@ const ROOT_DOMAINS = new Set([
   "stage-capsule-quarantine",
   "stage-capsule-resume-observation",
   "stage-capsule-resume-plan",
+  "source-verification-evidence",
   "stage-capsule-artifact-manifest",
   "stage-capsule-artifact-content",
   "stage-capsule-fault-campaign",

package/packages/core/v4-domain-wasm-artifact.js

@@ -2,6 +2,6 @@
 export const V4_DOMAIN_WASM_ABI_VERSION = 1;
 export const V4_DOMAIN_WASM_RUSTC = "rustc 1.96.0 (ac68faa20 2026-05-25)";
 export const V4_DOMAIN_WASM_SOURCE_SHA256 =
-  "28838018db7d5794f9fe2eb546044c8a7a715f08b20af01b95975a8671d0f78a";
+  "07d45b2767e22007d3d41fa32c8a2dba28d9c88c11a2b28863e82d54be3a2933";
 export const V4_DOMAIN_WASM_SHA256 =
-  "32a808ba9b749d1297c0ce4b7be1586afdae3d849e44f3f7ffb1742e572f5627";
+  "b37c330e9366b7e9cf9dc4b7573b1e9495212dd9520e8b8ec6cdc3fd0ab7cafd";

package/packages/core/v4-floating-consumer-evidence.js

@@ -10,7 +10,7 @@ export const V4_FLOATING_CONSUMER_CERTIFICATION =
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
 const ALPHA_RECOVERY_BOOTSTRAP = Object.freeze({
   repository: "kungfu-systems/buildchain",
-  sourcePath: ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  sourcePath: ".github/workflows/self-ops-promotion-recovery.yml",
   workflow: ".github/workflows/.release-candidate-promote.yml",
   selector: "alpha/v4/v4.0",
 });

package/packages/core/v4-floating-consumer-policy.js

@@ -28,7 +28,7 @@ const BUILDCHAIN_REPOSITORY = "kungfu-systems/buildchain";
 const CHANNELS = Object.freeze({ v4: "stable", "v4-alpha": "alpha" });
 const ALPHA_RECOVERY_BOOTSTRAP = Object.freeze({
   selector: "alpha/v4/v4.0",
-  sourcePath: ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  sourcePath: ".github/workflows/self-ops-promotion-recovery.yml",
   workflow: ".github/workflows/.release-candidate-promote.yml",
 });
 const DEFAULT_STABLE_LOCK_PATH = ".buildchain/contract-lock.json";