npm - @kungfu-tech/buildchain - Versions diffs - 4.0.2-alpha.34 → 4.0.2-alpha.35 - Mend

@kungfu-tech/buildchain 4.0.2-alpha.34 → 4.0.2-alpha.35

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (91) hide show

package/AGENTS.md +9 -0
package/CONTRIBUTING.md +24 -0
package/README.md +2 -2
package/actions/promote-buildchain-ref/README.md +1 -1
package/architecture/agent-change-map.md +6 -4
package/architecture/internal-capabilities.json +4 -4
package/architecture/maintainability-debt.json +13 -11
package/architecture/maintainability-policy.json +4 -4
package/architecture/release-tail-contract-inventory.json +6 -6
package/architecture/v4-delivery-authority-parity.json +2 -2
package/architecture/v4-delivery-warrant-shadow-bootstrap-plan.json +1 -1
package/architecture/v4-floating-consumer-policy.json +1 -1
package/architecture/v4-next-development-parity.json +4 -4
package/architecture/v4-platform-stage-checkpoints.json +1 -1
package/architecture/v4-publication-facade-patches.json +53 -0
package/architecture/v4-release-topology.json +46 -29
package/architecture/v4-rust-wasm-production-authority.json +1 -0
package/architecture/v4-stage-capsule-qualification.json +1 -1
package/architecture/v4-universal-workflow-bootstrap.json +1 -1
package/architecture/v4-universal-workflow-fault-campaign.json +1 -1
package/architecture/v4-universal-workflow-train-admission.json +4 -4
package/architecture/workflow-taxonomy.json +1437 -0
package/contracts/buildchain-v2-residuals-v1.json +64 -1
package/contracts/fixtures/v4-tail-reseal-v1/valid.json +1 -1
package/contracts/v4-canonical-contracts-v1.schema.json +1 -0
package/dist/site/buildchain-contract.json +20 -20
package/dist/site/buildchain-site.json +122 -56
package/dist/site/capability-registry.json +4 -4
package/dist/site/controller-registry.json +5 -4
package/dist/site/kfd-claims.json +2617 -964
package/dist/site/kfd-upstream-aggregate.json +1 -1
package/dist/site/manual-registry.json +10 -10
package/dist/site/node-api-registry.json +26 -21
package/dist/site/page-registry.json +107 -41
package/dist/site/public-surface-audit.json +3196 -1128
package/dist/site/publication-authority-registry.json +1179 -417
package/dist/site/publication-registry.json +4 -4
package/dist/site/site-manifest.json +14 -14
package/dist/site/workflow-registry.json +5484 -1924
package/docs/MAP.md +1 -0
package/docs/auditable-demo.md +1 -1
package/docs/cli.md +3 -3
package/docs/dev-delivery-warrant.md +1 -1
package/docs/engineering-housekeeper.md +3 -3
package/docs/next-development-transition.md +1 -1
package/docs/node-api-reference.md +30 -30
package/docs/publication-authority.md +2 -2
package/docs/release-candidate.md +3 -3
package/docs/release-flow.md +67 -19
package/docs/release-governance.md +8 -8
package/docs/v4-adopter-delivery.md +1 -1
package/docs/v4-production-release.md +45 -8
package/docs/v4-stage-capsule.md +1 -1
package/docs/workflow-catalog.md +151 -0
package/package.json +8 -6
package/packages/core/buildchain-contract.js +1 -1
package/packages/core/buildchain-kfd-claims.js +2 -2
package/packages/core/buildchain-publication-authority.js +40 -25
package/packages/core/buildchain-v4-domain.wasm +0 -0
package/packages/core/controller-evidence.js +4 -1
package/packages/core/github-governance-authority.js +4 -4
package/packages/core/next-development-projection.js +1 -1
package/packages/core/release-line-dry-run.js +1 -1
package/packages/core/v4-canonical-contracts.js +1 -0
package/packages/core/v4-domain-wasm-artifact.js +2 -2
package/packages/core/v4-floating-consumer-evidence.js +1 -1
package/packages/core/v4-floating-consumer-policy.js +1 -1
package/scripts/binary-publication-evidence.mjs +135 -0
package/scripts/check-ci-lane-change-budget.mjs +4 -1
package/scripts/check-core-mechanism-inventory.mjs +4 -3
package/scripts/check-inventory.mjs +22 -22
package/scripts/check-v4-floating-consumer-policy-contract.mjs +1 -1
package/scripts/check-v4-public-dogfood-contract.mjs +18 -5
package/scripts/check-v4-release-topology.mjs +5 -2
package/scripts/check-v4-runtime-semantic-closure.mjs +4 -1
package/scripts/check-v4-universal-workflow-bootstrap.mjs +5 -9
package/scripts/check-workflow-taxonomy.mjs +6 -0
package/scripts/generate-channel-build-workflow.mjs +2 -1
package/scripts/generate-channel-promotion-workflow.mjs +4 -3
package/scripts/generate-site-bundle.mjs +11 -11
package/scripts/generate-v4-universal-workflow-facades.mjs +24 -6
package/scripts/generate-workflow-taxonomy.mjs +25 -0
package/scripts/maintainability-metrics.mjs +16 -5
package/scripts/release-asset-client.mjs +90 -0
package/scripts/release-candidate-resolver.mjs +1 -1
package/scripts/source-verification-evidence.mjs +344 -0
package/scripts/stable-candidate-qualification.mjs +1 -1
package/scripts/v4-publication-settlement.mjs +207 -0
package/scripts/v4-universal-workflow-self-dogfood.mjs +1 -1
package/scripts/verify-version-state-delta.mjs +173 -0
package/scripts/workflow-taxonomy.mjs +468 -0

package/dist/site/kfd-claims.json CHANGED Viewed

@@ -21,12 +21,12 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "8a6988a8ae8b0970ab821790ab3629842a966a970cae4c5d6828a10a8c61a7e5",
+    "sha256": "b204ab8cbca8d112938c12e6541faa85256f1a85671574ff3fd8907b11de7dc6",
     "summary": {
       "cliCommandCount": 117,
-      "workflowCount": 74,
+      "workflowCount": 116,
       "actionCount": 8,
-      "sitePageCount": 85,
+      "sitePageCount": 86,
       "docCommandRefCount": 1050,
       "failureCount": 0
     },
@@ -246,12 +246,12 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "8a6988a8ae8b0970ab821790ab3629842a966a970cae4c5d6828a10a8c61a7e5",
+      "sha256": "b204ab8cbca8d112938c12e6541faa85256f1a85671574ff3fd8907b11de7dc6",
       "summary": {
         "cliCommandCount": 117,
-        "workflowCount": 74,
+        "workflowCount": 116,
         "actionCount": 8,
-        "sitePageCount": 85,
+        "sitePageCount": 86,
         "docCommandRefCount": 1050,
         "failureCount": 0
       },
@@ -3902,6 +3902,286 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:.build-demo-adapter",
+          "name": "workflow:.build-demo-adapter",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.build-demo-adapter.yml",
+          "evidencePath": ".github/workflows/.build-demo-adapter.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 12,
+          "inputs": [
+            "adapter-arguments-json",
+            "adapter-path",
+            "artifact-retention-days",
+            "buildchain-repository",
+            "media-profile",
+            "render-media",
+            "renderer-image",
+            "require-trusted-event",
+            "source-artifact-digest",
+            "source-artifact-name",
+            "source-ref",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.build-engine",
+          "name": "workflow:.build-engine",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.build-engine.yml",
+          "evidencePath": ".github/workflows/.build-engine.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 94,
+          "inputs": [
+            "artifact-compression-level",
+            "artifact-finalization-command",
+            "artifact-finalization-on-platform",
+            "artifact-name",
+            "artifact-name-template",
+            "artifact-paths",
+            "artifact-relay-s3-bucket",
+            "artifact-relay-s3-download-role-arn",
+            "artifact-relay-s3-oidc-audience",
+            "artifact-relay-s3-prefix",
+            "artifact-relay-s3-region",
+            "artifact-relay-s3-role-arn",
+            "artifact-relay-s3-upload-role-arn",
+            "artifact-retention-days",
+            "artifact-signing-request-upload-no-proxy",
+            "artifact-transfer-mode",
+            "aws-codebuild-project",
+            "aws-ec2-macos-runner-label",
+            "aws-ec2-windows-runner-label",
+            "build-command",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-expected-channel",
+            "buildchain-contract-expected-major",
+            "buildchain-contract-lock-path",
+            "buildchain-expected-channel",
+            "buildchain-expected-major",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-visible-workflow",
+            "cache-dependency-lock-root",
+            "cache-policy-root",
+            "cache-toolchain-root",
+            "cargo-registry-index",
+            "checkout-cache-fallback",
+            "checkout-cache-fetch-attempts",
+            "checkout-cache-github-timeout-seconds",
+            "checkout-cache-mirror-url-template",
+            "checkout-cache-mode",
+            "checkout-cache-reference-repository-template",
+            "checkout-cache-timeout-seconds",
+            "checkout-history-mode",
+            "compiler-cache-platforms-json",
+            "compiler-cache-provider",
+            "compiler-cache-required",
+            "control-runner-json",
+            "credential-island-caller-owned",
+            "credential-island-environment",
+            "credential-island-macos-app-path",
+            "credential-island-macos-platform-id",
+            "expected-artifacts-json",
+            "fail-fast",
+            "gate-profile-aggregate-json",
+            "github-artifact-attestation-platform-id",
+            "github-artifact-attestation-signer-sha",
+            "github-artifact-attestation-subject-path",
+            "install-command",
+            "kfd-agent-hub",
+            "lifecycle-timeout-minutes",
+            "linux-container-image",
+            "linux-container-preset",
+            "node-version",
+            "platforms-json",
+            "pre-upload-transport-smoke-artifact-root",
+            "pre-upload-transport-smoke-scenario-path",
+            "process-sample-interval-ms",
+            "process-summary-path",
+            "publish-anchor-request-json",
+            "publish-channel",
+            "publish-refs-json",
+            "publish-registry",
+            "publish-source-ref",
+            "release-candidate",
+            "release-candidate-family-evidence-json",
+            "requested-parallelism",
+            "require-build",
+            "require-install",
+            "require-trusted-event",
+            "require-verify",
+            "runner-preset",
+            "rust-toolchain",
+            "rustup-dist-server",
+            "rustup-update-root",
+            "sample-process-tree",
+            "self-hosted-offline-fallback",
+            "setup-node",
+            "setup-rust",
+            "shifu-cache-profile-digest",
+            "shifu-cache-profile-ref",
+            "universal-request-json",
+            "untrusted-policy",
+            "verify-command",
+            "verify-substage-evidence-path",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.build-gate-profile",
+          "name": "workflow:.build-gate-profile",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.build-gate-profile.yml",
+          "evidencePath": ".github/workflows/.build-gate-profile.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 31,
+          "inputs": [
+            "artifact-name",
+            "artifact-retention-days",
+            "buildchain-ref",
+            "buildchain-repository",
+            "cargo-registry-index",
+            "checkout-cache-fallback",
+            "checkout-cache-fetch-attempts",
+            "checkout-cache-github-timeout-seconds",
+            "checkout-cache-mirror-url-template",
+            "checkout-cache-mode",
+            "checkout-cache-reference-repository-template",
+            "checkout-cache-timeout-seconds",
+            "gate-command-json",
+            "gate-environment-json",
+            "gate-plan-command-json",
+            "gate-profile",
+            "gate-registry",
+            "include-advisory",
+            "node-version",
+            "platforms-json",
+            "require-trusted-event",
+            "runner-preset",
+            "rust-toolchain",
+            "rustup-dist-server",
+            "rustup-update-root",
+            "shifu-cache-profile-digest",
+            "shifu-cache-profile-ref",
+            "source-ref",
+            "universal-request-json",
+            "untrusted-policy",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.build-release-verify-compat",
+          "name": "workflow:.build-release-verify-compat",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.build-release-verify-compat.yml",
+          "evidencePath": ".github/workflows/.build-release-verify-compat.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 42,
+          "inputs": [
+            "auto-approve-enabled",
+            "aws-ci-region",
+            "aws-user-region",
+            "bucket-staging-ci",
+            "bucket-staging-user",
+            "build-container-enabled",
+            "build-runner-linux",
+            "build-runner-linux-labels",
+            "build-runner-macos",
+            "build-runner-macos-labels",
+            "build-runner-windows",
+            "build-runner-windows-labels",
+            "build-timeout-minutes",
+            "buildchain-ref",
+            "buildchain-repository",
+            "builder-container",
+            "code-signing-macos",
+            "code-signing-windows",
+            "collaborator-automation-enabled",
+            "enable-linux",
+            "enable-macos",
+            "enable-windows",
+            "find-dependencies",
+            "java-version",
+            "manager",
+            "max-build-attempts",
+            "max-preview-links",
+            "node-version",
+            "pipenv-version",
+            "poetry-version",
+            "prebuild",
+            "preview-files",
+            "publish-aws-ci",
+            "publish-aws-user",
+            "publish-github-npm",
+            "publish-versioning",
+            "python-version",
+            "setup-env-timeout-minutes",
+            "setup-python-enabled",
+            "universal-request-json",
+            "use-pipenv",
+            "use-poetry"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.build-sam-verify-compat",
+          "name": "workflow:.build-sam-verify-compat",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.build-sam-verify-compat.yml",
+          "evidencePath": ".github/workflows/.build-sam-verify-compat.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "aws-region",
+            "aws-role",
+            "aws-root",
+            "manager",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.build-wheel-verify-compat",
+          "name": "workflow:.build-wheel-verify-compat",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.build-wheel-verify-compat.yml",
+          "evidencePath": ".github/workflows/.build-wheel-verify-compat.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 6,
+          "inputs": [
+            "aws-user-region",
+            "bucket-release",
+            "max-preview-links",
+            "node-version",
+            "preview-files",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:.build",
           "name": "workflow:.build",
@@ -4101,6 +4381,26 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:.ops-git-sync",
+          "name": "workflow:.ops-git-sync",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.ops-git-sync.yml",
+          "evidencePath": ".github/workflows/.ops-git-sync.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "force",
+            "remote-host",
+            "remote-path",
+            "remote-repo",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:.publication-authority",
           "name": "workflow:.publication-authority",
@@ -4154,6 +4454,90 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:.release-authority",
+          "name": "workflow:.release-authority",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-authority.yml",
+          "evidencePath": ".github/workflows/.release-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 38,
+          "inputs": [
+            "admission-json",
+            "authority-workflow-path",
+            "auto-admission",
+            "auto-admission-kind",
+            "auto-no-gate",
+            "buildchain-ref",
+            "buildchain-repository",
+            "consumer-gate-command",
+            "consumer-gate-controller-sha",
+            "consumer-gate-evidence-source-sha",
+            "consumer-gate-evidence-source-tree",
+            "consumer-predicate-digest",
+            "consumer-predicate-id",
+            "consumer-qualification-required",
+            "control-plane-audit-json",
+            "dry-run",
+            "evidence-controller-artifact",
+            "evidence-manifest-pattern",
+            "evidence-passport-artifact",
+            "evidence-payload-pattern",
+            "evidence-publication-artifact",
+            "evidence-repository",
+            "evidence-run-id",
+            "evidence-summary-artifact",
+            "expected-json",
+            "gate-aggregate-json",
+            "github-governance-receipt-json",
+            "package-name",
+            "product",
+            "publication-target",
+            "publication-version",
+            "publisher-workflow-path",
+            "required-status-check",
+            "runner-provenance-json",
+            "source-sha",
+            "target-ref",
+            "universal-request-json",
+            "used-nonces-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-binary-assets",
+          "name": "workflow:.release-binary-assets",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-binary-assets.yml",
+          "evidencePath": ".github/workflows/.release-binary-assets.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 16,
+          "inputs": [
+            "auto-admission",
+            "buildchain-ref",
+            "buildchain-repository",
+            "evidence-run-id",
+            "github-governance-receipt-json",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "publication-version",
+            "release-tag",
+            "source-sha",
+            "target-ref",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:.release-candidate-promote",
           "name": "workflow:.release-candidate-promote",
@@ -4292,88 +4676,27 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-verify",
-          "name": "workflow:.release-verify",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-verify.yml",
-          "evidencePath": ".github/workflows/.release-verify.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 42,
-          "inputs": [
-            "auto-approve-enabled",
-            "aws-ci-region",
-            "aws-user-region",
-            "bucket-staging-ci",
-            "bucket-staging-user",
-            "build-container-enabled",
-            "build-runner-linux",
-            "build-runner-linux-labels",
-            "build-runner-macos",
-            "build-runner-macos-labels",
-            "build-runner-windows",
-            "build-runner-windows-labels",
-            "build-timeout-minutes",
-            "buildchain-ref",
-            "buildchain-repository",
-            "builder-container",
-            "code-signing-macos",
-            "code-signing-windows",
-            "collaborator-automation-enabled",
-            "enable-linux",
-            "enable-macos",
-            "enable-windows",
-            "find-dependencies",
-            "java-version",
-            "manager",
-            "max-build-attempts",
-            "max-preview-links",
-            "node-version",
-            "pipenv-version",
-            "poetry-version",
-            "prebuild",
-            "preview-files",
-            "publish-aws-ci",
-            "publish-aws-user",
-            "publish-github-npm",
-            "publish-versioning",
-            "python-version",
-            "setup-env-timeout-minutes",
-            "setup-python-enabled",
-            "universal-request-json",
-            "use-pipenv",
-            "use-poetry"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.sam-verify",
-          "name": "workflow:.sam-verify",
+          "id": "workflow:.release-minor-bump-compat",
+          "name": "workflow:.release-minor-bump-compat",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.sam-verify.yml",
-          "evidencePath": ".github/workflows/.sam-verify.yml",
+          "sourcePath": ".github/workflows/.release-minor-bump-compat.yml",
+          "evidencePath": ".github/workflows/.release-minor-bump-compat.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 5,
+          "inputCount": 1,
           "inputs": [
-            "aws-region",
-            "aws-role",
-            "aws-root",
-            "manager",
             "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.sync-release-page",
-          "name": "workflow:.sync-release-page",
+          "id": "workflow:.release-page-sync-retired",
+          "name": "workflow:.release-page-sync-retired",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.sync-release-page.yml",
-          "evidencePath": ".github/workflows/.sync-release-page.yml",
+          "sourcePath": ".github/workflows/.release-page-sync-retired.yml",
+          "evidencePath": ".github/workflows/.release-page-sync-retired.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4398,197 +4721,354 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.sync-remote-git",
-          "name": "workflow:.sync-remote-git",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.sync-remote-git.yml",
-          "evidencePath": ".github/workflows/.sync-remote-git.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 5,
-          "inputs": [
-            "force",
-            "remote-host",
-            "remote-path",
-            "remote-repo",
-            "universal-request-json"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.web-surface",
-          "name": "workflow:.web-surface",
+          "id": "workflow:.release-promote",
+          "name": "workflow:.release-promote",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.web-surface.yml",
-          "evidencePath": ".github/workflows/.web-surface.yml",
+          "sourcePath": ".github/workflows/.release-promote.yml",
+          "evidencePath": ".github/workflows/.release-promote.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 44,
+          "inputCount": 122,
           "inputs": [
-            "artifact-path",
-            "aws-region",
-            "build-command",
+            "allow-repository",
+            "artifact-name",
+            "artifact-patterns",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "buildchain-alpha-contract-lock-path",
             "buildchain-contract-compatibility-policy",
             "buildchain-contract-drift-issue-mode",
-            "buildchain-contract-expected-channel",
-            "buildchain-contract-expected-major",
             "buildchain-contract-lock-path",
+            "buildchain-expected-channel",
+            "buildchain-expected-major",
             "buildchain-ref",
             "buildchain-repository",
-            "fail-on-release-pr-error",
+            "buildchain-stable-contract-lock-path",
+            "channel",
+            "declarative-release-tail",
+            "dry-run",
+            "github-artifact-attestation-environment",
+            "github-artifact-attestation-policy-json",
+            "github-artifact-attestation-retention-days",
             "github-governance-receipt-json",
-            "node-version",
-            "preview-apply",
-            "preview-aws-role-arn",
-            "preview-cleanup-apply",
-            "preview-comment",
-            "preview-environment",
-            "production-apply",
-            "production-approved",
-            "production-aws-role-arn",
-            "production-environment",
-            "production-release-app-client-id",
-            "production-release-app-id",
-            "production-release-branch-channel",
-            "production-release-head-prefix",
-            "production-release-label",
-            "production-release-on-main",
-            "production-release-pr-mode",
-            "production-release-pr-token",
-            "production-source-sha",
+            "github-release",
+            "github-release-notes",
+            "github-release-payload-patterns",
+            "github-release-title",
+            "package-manager",
+            "promotion-contract-lock-digest",
+            "promotion-contract-lock-path",
+            "promotion-override-used",
+            "promotion-publication-channel",
+            "promotion-router-ref",
+            "promotion-router-sha",
+            "promotion-runtime-authorization-json",
+            "promotion-runtime-authorization-root",
+            "promotion-runtime-ref",
+            "promotion-runtime-sha",
+            "promotion-shell-ref",
+            "promotion-shell-sha",
+            "promotion-target-ref",
+            "provider-failure-after-capability",
             "publication-admission-json",
-            "publication-control-plane-audit-json",
-            "publication-expected-json",
-            "publication-gate-aggregate-json",
-            "publication-runner-provenance-json",
-            "publication-used-nonces-json",
-            "release-feedback-actor-privacy",
-            "staging-apply",
-            "staging-aws-role-arn",
-            "staging-environment",
-            "universal-request-json",
-            "verify-command",
-            "working-directory"
+            "publication-authority-workflow-path",
+            "publication-auto-admission",
+            "publication-auto-no-gate",
+            "publication-commit-command",
+            "publication-commit-evidence-path",
+            "publication-consumer-predicate-id",
+            "publication-consumer-qualification-command",
+            "publication-consumer-qualification-controller-sha",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-gate-command",
+            "publication-gate-controller-sha",
+            "publication-package-name",
+            "publication-product",
+            "publication-publisher-workflow-path",
+            "publication-runner-provenance-json",
+            "publication-target",
+            "publication-used-nonces-json",
+            "publication-used-qualification-nonces-json",
+            "publish-artifact-kind",
+            "publish-command",
+            "publish-dist-tag",
+            "publish-mode",
+            "publish-package-main",
+            "publish-package-set-order",
+            "publish-rematerialize-on-resume",
+            "publish-required-artifacts-json",
+            "publish-target",
+            "publish-transaction-override",
+            "release-activation-command",
+            "release-activation-receipt-set-path",
+            "release-candidate-family-assignment-id",
+            "release-candidate-family-evidence-required",
+            "release-candidate-family-evidence-root",
+            "release-candidate-family-initiative-id",
+            "release-candidate-wait-seconds",
+            "release-candidate-workflow-file",
+            "release-candidate-workflow-name",
+            "release-passport",
+            "release-passport-adopter-delivery-json",
+            "release-passport-attachment-command",
+            "release-passport-buildchain-self-kfd",
+            "release-passport-evidence-command",
+            "release-passport-evidence-jsons",
+            "release-passport-evidence-path",
+            "release-passport-impact-json",
+            "release-passport-invariant-passport-command",
+            "release-passport-invariant-passport-jsons",
+            "release-passport-kfd-1-witness-jsons",
+            "release-passport-kfd-2-claim-jsons",
+            "release-passport-kfd-3-artifact-verify-command",
+            "release-passport-kfd-3-artifact-witness-jsons",
+            "release-passport-kfd-3-prebuild-witness-jsons",
+            "release-passport-kfd-adopter-manifest-gate-json",
+            "release-passport-kfd-adopter-manifest-json",
+            "release-passport-kfd-product-gate-jsons",
+            "release-passport-kfd-support-matrix-json",
+            "release-passport-output-dir",
+            "release-passport-platform-manifest-paths",
+            "release-passport-product-name",
+            "release-passport-v4-runtime-resume-evidence-json",
+            "release-propagation-config-path",
+            "required-artifact-count",
+            "required-status-check",
+            "resume-buildchain-runtime-sha",
+            "resume-candidate-repository",
+            "resume-candidate-run-id",
+            "resume-expected-candidate-root",
+            "resume-expected-candidate-runtime-sha",
+            "resume-expected-source-tree",
+            "resume-expected-workflow-file",
+            "resume-expected-workflow-name",
+            "resume-transaction-id",
+            "runner-preset",
+            "standalone-binary-distribution",
+            "target-ref",
+            "target-sha",
+            "trusted-publishing",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.wheel-verify",
-          "name": "workflow:.wheel-verify",
+          "id": "workflow:.release-verify",
+          "name": "workflow:.release-verify",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.wheel-verify.yml",
-          "evidencePath": ".github/workflows/.wheel-verify.yml",
+          "sourcePath": ".github/workflows/.release-verify.yml",
+          "evidencePath": ".github/workflows/.release-verify.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 6,
+          "inputCount": 42,
           "inputs": [
+            "auto-approve-enabled",
+            "aws-ci-region",
             "aws-user-region",
-            "bucket-release",
+            "bucket-staging-ci",
+            "bucket-staging-user",
+            "build-container-enabled",
+            "build-runner-linux",
+            "build-runner-linux-labels",
+            "build-runner-macos",
+            "build-runner-macos-labels",
+            "build-runner-windows",
+            "build-runner-windows-labels",
+            "build-timeout-minutes",
+            "buildchain-ref",
+            "buildchain-repository",
+            "builder-container",
+            "code-signing-macos",
+            "code-signing-windows",
+            "collaborator-automation-enabled",
+            "enable-linux",
+            "enable-macos",
+            "enable-windows",
+            "find-dependencies",
+            "java-version",
+            "manager",
+            "max-build-attempts",
             "max-preview-links",
             "node-version",
+            "pipenv-version",
+            "poetry-version",
+            "prebuild",
             "preview-files",
-            "universal-request-json"
+            "publish-aws-ci",
+            "publish-aws-user",
+            "publish-github-npm",
+            "publish-versioning",
+            "python-version",
+            "setup-env-timeout-minutes",
+            "setup-python-enabled",
+            "universal-request-json",
+            "use-pipenv",
+            "use-poetry"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:artifact-signing-authority",
-          "name": "workflow:artifact-signing-authority",
+          "id": "workflow:.sam-verify",
+          "name": "workflow:.sam-verify",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/artifact-signing-authority.yml",
-          "evidencePath": ".github/workflows/artifact-signing-authority.yml",
+          "sourcePath": ".github/workflows/.sam-verify.yml",
+          "evidencePath": ".github/workflows/.sam-verify.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 5,
+          "inputs": [
+            "aws-region",
+            "aws-role",
+            "aws-root",
+            "manager",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:auditable-demo-media-profile-qualification",
-          "name": "workflow:auditable-demo-media-profile-qualification",
+          "id": "workflow:.sync-release-page",
+          "name": "workflow:.sync-release-page",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/auditable-demo-media-profile-qualification.yml",
-          "evidencePath": ".github/workflows/auditable-demo-media-profile-qualification.yml",
+          "sourcePath": ".github/workflows/.sync-release-page.yml",
+          "evidencePath": ".github/workflows/.sync-release-page.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 14,
+          "inputs": [
+            "aws-region",
+            "aws-role-arn",
+            "base-id",
+            "bucket-release",
+            "cloudfront-id",
+            "exclude",
+            "lower-edge",
+            "product",
+            "product-name",
+            "release-path",
+            "release-url",
+            "repo",
+            "universal-request-json",
+            "upper-edge"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:auditable-demo",
-          "name": "workflow:auditable-demo",
+          "id": "workflow:.sync-remote-git",
+          "name": "workflow:.sync-remote-git",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/auditable-demo.yml",
-          "evidencePath": ".github/workflows/auditable-demo.yml",
+          "sourcePath": ".github/workflows/.sync-remote-git.yml",
+          "evidencePath": ".github/workflows/.sync-remote-git.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 5,
+          "inputs": [
+            "force",
+            "remote-host",
+            "remote-path",
+            "remote-repo",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:binary-distribution",
-          "name": "workflow:binary-distribution",
+          "id": "workflow:.web-surface",
+          "name": "workflow:.web-surface",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/binary-distribution.yml",
-          "evidencePath": ".github/workflows/binary-distribution.yml",
+          "sourcePath": ".github/workflows/.web-surface.yml",
+          "evidencePath": ".github/workflows/.web-surface.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 44,
+          "inputs": [
+            "artifact-path",
+            "aws-region",
+            "build-command",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-expected-channel",
+            "buildchain-contract-expected-major",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "fail-on-release-pr-error",
+            "github-governance-receipt-json",
+            "node-version",
+            "preview-apply",
+            "preview-aws-role-arn",
+            "preview-cleanup-apply",
+            "preview-comment",
+            "preview-environment",
+            "production-apply",
+            "production-approved",
+            "production-aws-role-arn",
+            "production-environment",
+            "production-release-app-client-id",
+            "production-release-app-id",
+            "production-release-branch-channel",
+            "production-release-head-prefix",
+            "production-release-label",
+            "production-release-on-main",
+            "production-release-pr-mode",
+            "production-release-pr-token",
+            "production-source-sha",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "release-feedback-actor-privacy",
+            "staging-apply",
+            "staging-aws-role-arn",
+            "staging-environment",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:binary-release-assets",
-          "name": "workflow:binary-release-assets",
+          "id": "workflow:.wheel-verify",
+          "name": "workflow:.wheel-verify",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/binary-release-assets.yml",
-          "evidencePath": ".github/workflows/binary-release-assets.yml",
+          "sourcePath": ".github/workflows/.wheel-verify.yml",
+          "evidencePath": ".github/workflows/.wheel-verify.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:bootstrap",
-          "name": "workflow:bootstrap",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/bootstrap.yml",
-          "evidencePath": ".github/workflows/bootstrap.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 1,
+          "inputCount": 6,
           "inputs": [
-            "request-json"
+            "aws-user-region",
+            "bucket-release",
+            "max-preview-links",
+            "node-version",
+            "preview-files",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:build-surface-fixture",
-          "name": "workflow:build-surface-fixture",
+          "id": "workflow:artifact-signing-authority",
+          "name": "workflow:artifact-signing-authority",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/build-surface-fixture.yml",
-          "evidencePath": ".github/workflows/build-surface-fixture.yml",
+          "sourcePath": ".github/workflows/artifact-signing-authority.yml",
+          "evidencePath": ".github/workflows/artifact-signing-authority.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4597,6 +5077,22 @@
           "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:bootstrap",
+          "name": "workflow:bootstrap",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/bootstrap.yml",
+          "evidencePath": ".github/workflows/bootstrap.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 1,
+          "inputs": [
+            "request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:build",
           "name": "workflow:build",
@@ -4710,127 +5206,1818 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-alpha-self-dogfood",
-          "name": "workflow:buildchain-alpha-self-dogfood",
+          "id": "workflow:buildchain-patrol",
+          "name": "workflow:buildchain-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-alpha-self-dogfood.yml",
-          "evidencePath": ".github/workflows/buildchain-alpha-self-dogfood.yml",
+          "sourcePath": ".github/workflows/buildchain-patrol.yml",
+          "evidencePath": ".github/workflows/buildchain-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 17,
+          "inputs": [
+            "allowed-head-prefixes",
+            "block-labels",
+            "buildchain-ref",
+            "buildchain-repository",
+            "cadence",
+            "capabilities",
+            "dry-run",
+            "landing-mode",
+            "max-actions",
+            "merge-method",
+            "mode",
+            "ready-label",
+            "require-approval",
+            "required-status-checks",
+            "same-repository-only",
+            "target-branch",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-candidate-recovery-dogfood-failure",
-          "name": "workflow:buildchain-candidate-recovery-dogfood-failure",
+          "id": "workflow:check",
+          "name": "workflow:check",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml",
-          "evidencePath": ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml",
+          "sourcePath": ".github/workflows/check.yml",
+          "evidencePath": ".github/workflows/check.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 13,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "mode",
+            "node-version",
+            "require-version-state",
+            "source-proof-closure-paths-json",
+            "source-proof-dependency-paths-json",
+            "source-proof-policy-paths-json",
+            "source-proof-required-contexts-json",
+            "source-proof-reuse",
+            "universal-request-json",
+            "upload-artifacts",
+            "working-directory"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-dev-delivery",
-          "name": "workflow:buildchain-dev-delivery",
+          "id": "workflow:dev-alpha-candidate-patrol",
+          "name": "workflow:dev-alpha-candidate-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-dev-delivery.yml",
-          "evidencePath": ".github/workflows/buildchain-dev-delivery.yml",
+          "sourcePath": ".github/workflows/dev-alpha-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/dev-alpha-candidate-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 16,
+          "inputs": [
+            "alpha-workflow-path",
+            "auto-merge",
+            "buildchain-ref",
+            "buildchain-repository",
+            "create-pull-request",
+            "dev-workflow-path",
+            "dry-run",
+            "max-age-seconds",
+            "merge-method",
+            "pull-request-body-prefix",
+            "pull-request-body-prefix-renderer",
+            "reactivation-authorized",
+            "settlement-authorized",
+            "source-branch",
+            "target-branch",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-patrol-daily",
-          "name": "workflow:buildchain-patrol-daily",
+          "id": "workflow:dev-delivery-warrant-cancel",
+          "name": "workflow:dev-delivery-warrant-cancel",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-patrol-daily.yml",
-          "evidencePath": ".github/workflows/buildchain-patrol-daily.yml",
+          "sourcePath": ".github/workflows/dev-delivery-warrant-cancel.yml",
+          "evidencePath": ".github/workflows/dev-delivery-warrant-cancel.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 13,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "event-action",
+            "expected-candidate-id",
+            "expected-old-state-root",
+            "expected-pr-number",
+            "expected-source-head-sha",
+            "observed-source-head-sha",
+            "outcome",
+            "reason",
+            "target-branch",
+            "terminal-evidence-root",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:dev-delivery-warrant-close",
+          "name": "workflow:dev-delivery-warrant-close",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/dev-delivery-warrant-close.yml",
+          "evidencePath": ".github/workflows/dev-delivery-warrant-close.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "current-base-sha",
+            "expected-head-sha",
+            "expected-pr-number",
+            "merge-group-head-sha",
+            "merge-group-tree-sha",
+            "outcome",
+            "reason",
+            "replay-tree-sha",
+            "required-context-roots-json",
+            "target-branch",
+            "terminal-evidence-root",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:dev-pr-auto-merge",
+          "name": "workflow:dev-pr-auto-merge",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/dev-pr-auto-merge.yml",
+          "evidencePath": ".github/workflows/dev-pr-auto-merge.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 45,
+          "inputs": [
+            "active-lease-context",
+            "affected-paths-json",
+            "allowed-head-prefixes",
+            "assignment-root",
+            "block-labels",
+            "buildchain-ref",
+            "buildchain-repository",
+            "closure-root",
+            "defer-landing",
+            "delivery-class",
+            "delivery-priority",
+            "delivery-warrant-mode",
+            "dependency-root",
+            "diagnostic-context",
+            "dry-run",
+            "environment-root",
+            "expected-head-sha",
+            "expected-pr-number",
+            "handoff-workflow-id",
+            "initiative-root",
+            "landing-mode",
+            "legacy-active-owner-binding-json",
+            "max-merges",
+            "merge-method",
+            "native-command",
+            "native-command-root",
+            "native-heartbeat-seconds",
+            "native-proof-json",
+            "plan-root",
+            "project-cut-proof-json",
+            "queue-admission-context",
+            "ready-label",
+            "release-blocker-priority-json",
+            "require-approval",
+            "required-status-checks",
+            "same-repository-only",
+            "shard-evidence-roots-json",
+            "source-identity-root",
+            "source-patch-root",
+            "source-workflow-id",
+            "source-workflow-run-id",
+            "target-branch",
+            "toolchain-root",
+            "universal-request-json",
+            "warrant-lease-seconds"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:dev-qualification-patrol",
+          "name": "workflow:dev-qualification-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/dev-qualification-patrol.yml",
+          "evidencePath": ".github/workflows/dev-qualification-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 11,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "dev-workflow-path",
+            "dispatch-inputs-json",
+            "dry-run",
+            "max-attempts",
+            "mutation-authorized",
+            "preflight-workflow-path",
+            "priority-workflows-json",
+            "source-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:engineering-housekeeper",
+          "name": "workflow:engineering-housekeeper",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/engineering-housekeeper.yml",
+          "evidencePath": ".github/workflows/engineering-housekeeper.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 15,
+          "inputs": [
+            "apply-enabled",
+            "artifact-prefix",
+            "artifact-retention-days",
+            "buildchain-ref",
+            "buildchain-repository",
+            "max-actions",
+            "mode",
+            "protected-patterns",
+            "repository",
+            "retained-patterns",
+            "stale-days",
+            "stale-pull-request-label",
+            "target-branch",
+            "temporary-branch-patterns",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:github-artifact-attestation",
+          "name": "workflow:github-artifact-attestation",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/github-artifact-attestation.yml",
+          "evidencePath": ".github/workflows/github-artifact-attestation.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "buildchain-ref",
+            "environment",
+            "evidence-artifact-name",
+            "evidence-run-id",
+            "platform-manifest-artifact-name",
+            "platform-manifest-relative-path",
+            "policy-json",
+            "release-passport-artifact-name",
+            "release-passport-relative-path",
+            "retention-days",
+            "source-sha",
+            "subject-artifact-name",
+            "subject-relative-path",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:paper-release-sealed",
+          "name": "workflow:paper-release-sealed",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/paper-release-sealed.yml",
+          "evidencePath": ".github/workflows/paper-release-sealed.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 27,
+          "inputs": [
+            "artifact-name",
+            "artifact-paths",
+            "artifact-retention-days",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "github-governance-receipt-json",
+            "github-release",
+            "github-release-notes",
+            "github-release-title",
+            "package-name",
+            "publish-dist-tag",
+            "publisher-workflow-path",
+            "release-passport-impact-json",
+            "release-passport-output-dir",
+            "release-passport-product-name",
+            "required-status-check",
+            "target-ref",
+            "target-sha",
+            "toolchain-type",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:paper-release",
+          "name": "workflow:paper-release",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/paper-release.yml",
+          "evidencePath": ".github/workflows/paper-release.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 39,
+          "inputs": [
+            "artifact-name",
+            "artifact-retention-days",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "build-command",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "github-governance-receipt-json",
+            "github-release",
+            "github-release-notes",
+            "github-release-title",
+            "node-version",
+            "package-name",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "publish-dist-tag",
+            "publish-package-set-order",
+            "release-passport-impact-json",
+            "release-passport-output-dir",
+            "release-passport-product-name",
+            "required-status-check",
+            "setup-node",
+            "target-ref",
+            "target-sha",
+            "toolchain-command",
+            "toolchain-digest",
+            "toolchain-image",
+            "toolchain-type",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:patrol-daily",
+          "name": "workflow:patrol-daily",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/patrol-daily.yml",
+          "evidencePath": ".github/workflows/patrol-daily.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "allowed-head-prefixes",
+            "block-labels",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "landing-mode",
+            "max-actions",
+            "merge-method",
+            "ready-label",
+            "require-approval",
+            "required-status-checks",
+            "same-repository-only",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:patrol-monthly",
+          "name": "workflow:patrol-monthly",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/patrol-monthly.yml",
+          "evidencePath": ".github/workflows/patrol-monthly.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:patrol-observed-evidence",
+          "name": "workflow:patrol-observed-evidence",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/patrol-observed-evidence.yml",
+          "evidencePath": ".github/workflows/patrol-observed-evidence.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "artifact-path",
+            "build-command",
+            "buildchain-ref",
+            "cloudfront-distribution",
+            "evidence-source-path",
+            "evidence-source-ref",
+            "evidence-source-repository",
+            "manifest-path",
+            "production-aws-role-arn",
+            "production-bucket",
+            "production-environment",
+            "universal-request-json",
+            "verify-command"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:patrol-weekly",
+          "name": "workflow:patrol-weekly",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/patrol-weekly.yml",
+          "evidencePath": ".github/workflows/patrol-weekly.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-build-adopter-qualification",
+          "name": "workflow:public-build-adopter-qualification",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-build-adopter-qualification.yml",
+          "evidencePath": ".github/workflows/public-build-adopter-qualification.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 9,
+          "inputs": [
+            "archive-path",
+            "bootstrap-path",
+            "consumer",
+            "consumer-ref",
+            "consumer-repository",
+            "input-path",
+            "invocation-source-path",
+            "node-version",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-build-candidate",
+          "name": "workflow:public-build-candidate",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-build-candidate.yml",
+          "evidencePath": ".github/workflows/public-build-candidate.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 97,
+          "inputs": [
+            "artifact-compression-level",
+            "artifact-finalization-command",
+            "artifact-finalization-on-platform",
+            "artifact-name",
+            "artifact-name-template",
+            "artifact-paths",
+            "artifact-relay-s3-bucket",
+            "artifact-relay-s3-download-role-arn",
+            "artifact-relay-s3-oidc-audience",
+            "artifact-relay-s3-prefix",
+            "artifact-relay-s3-region",
+            "artifact-relay-s3-role-arn",
+            "artifact-relay-s3-upload-role-arn",
+            "artifact-retention-days",
+            "artifact-signing-request-upload-no-proxy",
+            "artifact-transfer-mode",
+            "aws-codebuild-project",
+            "aws-ec2-macos-runner-label",
+            "aws-ec2-windows-runner-label",
+            "build-command",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-channel",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-expected-channel",
+            "buildchain-contract-expected-major",
+            "buildchain-contract-lock-path",
+            "buildchain-expected-channel",
+            "buildchain-expected-major",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "buildchain-visible-workflow",
+            "cache-dependency-lock-root",
+            "cache-policy-root",
+            "cache-toolchain-root",
+            "cargo-registry-index",
+            "checkout-cache-fallback",
+            "checkout-cache-fetch-attempts",
+            "checkout-cache-github-timeout-seconds",
+            "checkout-cache-mirror-url-template",
+            "checkout-cache-mode",
+            "checkout-cache-reference-repository-template",
+            "checkout-cache-timeout-seconds",
+            "checkout-history-mode",
+            "compiler-cache-platforms-json",
+            "compiler-cache-provider",
+            "compiler-cache-required",
+            "control-runner-json",
+            "credential-island-caller-owned",
+            "credential-island-environment",
+            "credential-island-macos-app-path",
+            "credential-island-macos-platform-id",
+            "expected-artifacts-json",
+            "fail-fast",
+            "gate-profile-aggregate-json",
+            "github-artifact-attestation-platform-id",
+            "github-artifact-attestation-signer-sha",
+            "github-artifact-attestation-subject-path",
+            "install-command",
+            "kfd-agent-hub",
+            "lifecycle-timeout-minutes",
+            "linux-container-image",
+            "linux-container-preset",
+            "node-version",
+            "platforms-json",
+            "pre-upload-transport-smoke-artifact-root",
+            "pre-upload-transport-smoke-scenario-path",
+            "process-sample-interval-ms",
+            "process-summary-path",
+            "publish-anchor-request-json",
+            "publish-channel",
+            "publish-refs-json",
+            "publish-registry",
+            "publish-source-ref",
+            "release-candidate",
+            "release-candidate-family-evidence-json",
+            "requested-parallelism",
+            "require-build",
+            "require-install",
+            "require-trusted-event",
+            "require-verify",
+            "runner-preset",
+            "rust-toolchain",
+            "rustup-dist-server",
+            "rustup-update-root",
+            "sample-process-tree",
+            "self-hosted-offline-fallback",
+            "setup-node",
+            "setup-rust",
+            "shifu-cache-profile-digest",
+            "shifu-cache-profile-ref",
+            "universal-request-json",
+            "untrusted-policy",
+            "verify-command",
+            "verify-substage-evidence-path",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-build-check",
+          "name": "workflow:public-build-check",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-build-check.yml",
+          "evidencePath": ".github/workflows/public-build-check.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "mode",
+            "node-version",
+            "require-version-state",
+            "source-proof-closure-paths-json",
+            "source-proof-dependency-paths-json",
+            "source-proof-policy-paths-json",
+            "source-proof-required-contexts-json",
+            "source-proof-reuse",
+            "universal-request-json",
+            "upload-artifacts",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-build-demo",
+          "name": "workflow:public-build-demo",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-build-demo.yml",
+          "evidencePath": ".github/workflows/public-build-demo.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "artifact-retention-days",
+            "binary-artifact-digest",
+            "binary-artifact-name",
+            "buildchain-repository",
+            "materialize",
+            "materialize-base-ref",
+            "media-profile",
+            "render-failure-advisory",
+            "render-media",
+            "renderer-image",
+            "scenario-path",
+            "source-ref",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-build-publication",
+          "name": "workflow:public-build-publication",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-build-publication.yml",
+          "evidencePath": ".github/workflows/public-build-publication.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 24,
+          "inputs": [
+            "artifact-name",
+            "artifact-paths",
+            "artifact-retention-days",
+            "build-command",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "node-version",
+            "package-name",
+            "prepare-paper-package",
+            "publish-dist-tag",
+            "setup-node",
+            "target-ref",
+            "toolchain-command",
+            "toolchain-digest",
+            "toolchain-image",
+            "toolchain-type",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-build-stage-capsule-canary",
+          "name": "workflow:public-build-stage-capsule-canary",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-build-stage-capsule-canary.yml",
+          "evidencePath": ".github/workflows/public-build-stage-capsule-canary.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 7,
+          "inputs": [
+            "build-artifact-path",
+            "consumer",
+            "go-version",
+            "install-artifact-path",
+            "node-version",
+            "universal-request-json",
+            "verify-artifact-path"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-alpha-candidate-patrol",
+          "name": "workflow:public-ops-alpha-candidate-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 16,
+          "inputs": [
+            "alpha-workflow-path",
+            "auto-merge",
+            "buildchain-ref",
+            "buildchain-repository",
+            "create-pull-request",
+            "dev-workflow-path",
+            "dry-run",
+            "max-age-seconds",
+            "merge-method",
+            "pull-request-body-prefix",
+            "pull-request-body-prefix-renderer",
+            "reactivation-authorized",
+            "settlement-authorized",
+            "source-branch",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-bootstrap-recovery",
+          "name": "workflow:public-ops-bootstrap-recovery",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-bootstrap-recovery.yml",
+          "evidencePath": ".github/workflows/public-ops-bootstrap-recovery.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 1,
+          "inputs": [
+            "request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-bootstrap",
+          "name": "workflow:public-ops-bootstrap",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-bootstrap.yml",
+          "evidencePath": ".github/workflows/public-ops-bootstrap.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 1,
+          "inputs": [
+            "request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-dev-auto-merge",
+          "name": "workflow:public-ops-dev-auto-merge",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-dev-auto-merge.yml",
+          "evidencePath": ".github/workflows/public-ops-dev-auto-merge.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 45,
+          "inputs": [
+            "active-lease-context",
+            "affected-paths-json",
+            "allowed-head-prefixes",
+            "assignment-root",
+            "block-labels",
+            "buildchain-ref",
+            "buildchain-repository",
+            "closure-root",
+            "defer-landing",
+            "delivery-class",
+            "delivery-priority",
+            "delivery-warrant-mode",
+            "dependency-root",
+            "diagnostic-context",
+            "dry-run",
+            "environment-root",
+            "expected-head-sha",
+            "expected-pr-number",
+            "handoff-workflow-id",
+            "initiative-root",
+            "landing-mode",
+            "legacy-active-owner-binding-json",
+            "max-merges",
+            "merge-method",
+            "native-command",
+            "native-command-root",
+            "native-heartbeat-seconds",
+            "native-proof-json",
+            "plan-root",
+            "project-cut-proof-json",
+            "queue-admission-context",
+            "ready-label",
+            "release-blocker-priority-json",
+            "require-approval",
+            "required-status-checks",
+            "same-repository-only",
+            "shard-evidence-roots-json",
+            "source-identity-root",
+            "source-patch-root",
+            "source-workflow-id",
+            "source-workflow-run-id",
+            "target-branch",
+            "toolchain-root",
+            "universal-request-json",
+            "warrant-lease-seconds"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-dev-qualification-patrol",
+          "name": "workflow:public-ops-dev-qualification-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 11,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "dev-workflow-path",
+            "dispatch-inputs-json",
+            "dry-run",
+            "max-attempts",
+            "mutation-authorized",
+            "preflight-workflow-path",
+            "priority-workflows-json",
+            "source-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-housekeeping",
+          "name": "workflow:public-ops-housekeeping",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-housekeeping.yml",
+          "evidencePath": ".github/workflows/public-ops-housekeeping.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 15,
+          "inputs": [
+            "apply-enabled",
+            "artifact-prefix",
+            "artifact-retention-days",
+            "buildchain-ref",
+            "buildchain-repository",
+            "max-actions",
+            "mode",
+            "protected-patterns",
+            "repository",
+            "retained-patterns",
+            "stale-days",
+            "stale-pull-request-label",
+            "target-branch",
+            "temporary-branch-patterns",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-observed-evidence",
+          "name": "workflow:public-ops-observed-evidence",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-observed-evidence.yml",
+          "evidencePath": ".github/workflows/public-ops-observed-evidence.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "artifact-path",
+            "build-command",
+            "buildchain-ref",
+            "cloudfront-distribution",
+            "evidence-source-path",
+            "evidence-source-ref",
+            "evidence-source-repository",
+            "manifest-path",
+            "production-aws-role-arn",
+            "production-bucket",
+            "production-environment",
+            "universal-request-json",
+            "verify-command"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-patrol-daily",
+          "name": "workflow:public-ops-patrol-daily",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-patrol-daily.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol-daily.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "allowed-head-prefixes",
+            "block-labels",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "landing-mode",
+            "max-actions",
+            "merge-method",
+            "ready-label",
+            "require-approval",
+            "required-status-checks",
+            "same-repository-only",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-patrol-monthly",
+          "name": "workflow:public-ops-patrol-monthly",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-patrol-monthly.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol-monthly.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-patrol-weekly",
+          "name": "workflow:public-ops-patrol-weekly",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-patrol-weekly.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol-weekly.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-patrol",
+          "name": "workflow:public-ops-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 17,
+          "inputs": [
+            "allowed-head-prefixes",
+            "block-labels",
+            "buildchain-ref",
+            "buildchain-repository",
+            "cadence",
+            "capabilities",
+            "dry-run",
+            "landing-mode",
+            "max-actions",
+            "merge-method",
+            "mode",
+            "ready-label",
+            "require-approval",
+            "required-status-checks",
+            "same-repository-only",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-release-governance",
+          "name": "workflow:public-ops-release-governance",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-release-governance.yml",
+          "evidencePath": ".github/workflows/public-ops-release-governance.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "apply",
+            "branch",
+            "buildchain-ref",
+            "candidate-sha",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-stable-candidate-patrol",
+          "name": "workflow:public-ops-stable-candidate-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 17,
+          "inputs": [
+            "auto-approve",
+            "auto-merge",
+            "auto-promote",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "hold",
+            "hold-reason",
+            "ledger-ref",
+            "merge-method",
+            "minimum-soak-seconds",
+            "release-now",
+            "required-checks",
+            "revoke-reason",
+            "revoked-versions",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-tail-reseal",
+          "name": "workflow:public-ops-tail-reseal",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-tail-reseal.yml",
+          "evidencePath": ".github/workflows/public-ops-tail-reseal.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "artifact-retention-days",
+            "consumer-policy-receipt-json",
+            "macos-finalization-command",
+            "request-json",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-warrant-cancel",
+          "name": "workflow:public-ops-warrant-cancel",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-warrant-cancel.yml",
+          "evidencePath": ".github/workflows/public-ops-warrant-cancel.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "event-action",
+            "expected-candidate-id",
+            "expected-old-state-root",
+            "expected-pr-number",
+            "expected-source-head-sha",
+            "observed-source-head-sha",
+            "outcome",
+            "reason",
+            "target-branch",
+            "terminal-evidence-root",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-warrant-close",
+          "name": "workflow:public-ops-warrant-close",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-warrant-close.yml",
+          "evidencePath": ".github/workflows/public-ops-warrant-close.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "current-base-sha",
+            "expected-head-sha",
+            "expected-pr-number",
+            "merge-group-head-sha",
+            "merge-group-tree-sha",
+            "outcome",
+            "reason",
+            "replay-tree-sha",
+            "required-context-roots-json",
+            "target-branch",
+            "terminal-evidence-root",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-release-artifact-attestation",
+          "name": "workflow:public-release-artifact-attestation",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-release-artifact-attestation.yml",
+          "evidencePath": ".github/workflows/public-release-artifact-attestation.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "buildchain-ref",
+            "environment",
+            "evidence-artifact-name",
+            "evidence-run-id",
+            "platform-manifest-artifact-name",
+            "platform-manifest-relative-path",
+            "policy-json",
+            "release-passport-artifact-name",
+            "release-passport-relative-path",
+            "retention-days",
+            "source-sha",
+            "subject-artifact-name",
+            "subject-relative-path",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-release-paper-sealed",
+          "name": "workflow:public-release-paper-sealed",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-release-paper-sealed.yml",
+          "evidencePath": ".github/workflows/public-release-paper-sealed.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 27,
+          "inputs": [
+            "artifact-name",
+            "artifact-paths",
+            "artifact-retention-days",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "github-governance-receipt-json",
+            "github-release",
+            "github-release-notes",
+            "github-release-title",
+            "package-name",
+            "publish-dist-tag",
+            "publisher-workflow-path",
+            "release-passport-impact-json",
+            "release-passport-output-dir",
+            "release-passport-product-name",
+            "required-status-check",
+            "target-ref",
+            "target-sha",
+            "toolchain-type",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-release-paper",
+          "name": "workflow:public-release-paper",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-release-paper.yml",
+          "evidencePath": ".github/workflows/public-release-paper.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 39,
+          "inputs": [
+            "artifact-name",
+            "artifact-retention-days",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "build-command",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "github-governance-receipt-json",
+            "github-release",
+            "github-release-notes",
+            "github-release-title",
+            "node-version",
+            "package-name",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "publish-dist-tag",
+            "publish-package-set-order",
+            "release-passport-impact-json",
+            "release-passport-output-dir",
+            "release-passport-product-name",
+            "required-status-check",
+            "setup-node",
+            "target-ref",
+            "target-sha",
+            "toolchain-command",
+            "toolchain-digest",
+            "toolchain-image",
+            "toolchain-type",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-release-promote",
+          "name": "workflow:public-release-promote",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-release-promote.yml",
+          "evidencePath": ".github/workflows/public-release-promote.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 107,
+          "inputs": [
+            "allow-repository",
+            "artifact-name",
+            "artifact-patterns",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-channel",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "channel",
+            "declarative-release-tail",
+            "dry-run",
+            "github-artifact-attestation-environment",
+            "github-artifact-attestation-policy-json",
+            "github-artifact-attestation-retention-days",
+            "github-governance-receipt-json",
+            "github-release",
+            "github-release-notes",
+            "github-release-payload-patterns",
+            "github-release-title",
+            "package-manager",
+            "provider-failure-after-capability",
+            "publication-admission-json",
+            "publication-auto-admission",
+            "publication-auto-no-gate",
+            "publication-commit-command",
+            "publication-commit-evidence-path",
+            "publication-consumer-predicate-id",
+            "publication-consumer-qualification-command",
+            "publication-consumer-qualification-controller-sha",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-gate-command",
+            "publication-gate-controller-sha",
+            "publication-package-name",
+            "publication-product",
+            "publication-publisher-workflow-path",
+            "publication-runner-provenance-json",
+            "publication-target",
+            "publication-used-nonces-json",
+            "publication-used-qualification-nonces-json",
+            "publish-artifact-kind",
+            "publish-command",
+            "publish-dist-tag",
+            "publish-mode",
+            "publish-package-main",
+            "publish-package-set-order",
+            "publish-rematerialize-on-resume",
+            "publish-required-artifacts-json",
+            "publish-target",
+            "publish-transaction-override",
+            "release-activation-command",
+            "release-activation-receipt-set-path",
+            "release-candidate-family-assignment-id",
+            "release-candidate-family-evidence-required",
+            "release-candidate-family-evidence-root",
+            "release-candidate-family-initiative-id",
+            "release-candidate-wait-seconds",
+            "release-candidate-workflow-file",
+            "release-candidate-workflow-name",
+            "release-passport",
+            "release-passport-adopter-delivery-json",
+            "release-passport-attachment-command",
+            "release-passport-buildchain-self-kfd",
+            "release-passport-evidence-command",
+            "release-passport-evidence-jsons",
+            "release-passport-evidence-path",
+            "release-passport-impact-json",
+            "release-passport-invariant-passport-command",
+            "release-passport-invariant-passport-jsons",
+            "release-passport-kfd-1-witness-jsons",
+            "release-passport-kfd-2-claim-jsons",
+            "release-passport-kfd-3-artifact-verify-command",
+            "release-passport-kfd-3-artifact-witness-jsons",
+            "release-passport-kfd-3-prebuild-witness-jsons",
+            "release-passport-kfd-adopter-manifest-gate-json",
+            "release-passport-kfd-adopter-manifest-json",
+            "release-passport-kfd-product-gate-jsons",
+            "release-passport-kfd-support-matrix-json",
+            "release-passport-output-dir",
+            "release-passport-platform-manifest-paths",
+            "release-passport-product-name",
+            "release-passport-v4-runtime-resume-evidence-json",
+            "release-propagation-config-path",
+            "required-artifact-count",
+            "required-status-check",
+            "resume-buildchain-runtime-sha",
+            "resume-candidate-repository",
+            "resume-candidate-run-id",
+            "resume-expected-candidate-root",
+            "resume-expected-candidate-runtime-sha",
+            "resume-expected-source-tree",
+            "resume-expected-workflow-file",
+            "resume-expected-workflow-name",
+            "resume-transaction-id",
+            "runner-preset",
+            "standalone-binary-distribution",
+            "target-ref",
+            "target-sha",
+            "trusted-publishing",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-release-propagation",
+          "name": "workflow:public-release-propagation",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-release-propagation.yml",
+          "evidencePath": ".github/workflows/public-release-propagation.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 20,
+          "inputs": [
+            "agent-work-context-json",
+            "agent-work-mode",
+            "buildchain-ref",
+            "buildchain-repository",
+            "downstream-base-ref",
+            "downstream-branch",
+            "downstream-prepare-command",
+            "downstream-repository",
+            "downstream-target",
+            "downstream-update-command",
+            "downstream-verify-command",
+            "dry-run",
+            "graph-json",
+            "lock-path",
+            "pr-body",
+            "pr-title",
+            "refresh-managed-readme-badges",
+            "source-node",
+            "universal-request-json",
+            "upstream-release-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-release-signing-authority",
+          "name": "workflow:public-release-signing-authority",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-release-signing-authority.yml",
+          "evidencePath": ".github/workflows/public-release-signing-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-release-tail",
+          "name": "workflow:public-release-tail",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-release-tail.yml",
+          "evidencePath": ".github/workflows/public-release-tail.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 15,
+          "inputs": [
+            "buildchain-ref",
+            "candidate-root",
+            "capsule-contract",
+            "capsule-path",
+            "capsule-root",
+            "declaration-path",
+            "evidence-path",
+            "execute",
+            "provider-bindings-path",
+            "rehearsal-authority-path",
+            "rehearsal-capsule-path",
+            "rehearsal-evidence-path",
+            "rehearsal-mode",
+            "state-path",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-release-web",
+          "name": "workflow:public-release-web",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-release-web.yml",
+          "evidencePath": ".github/workflows/public-release-web.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 44,
+          "inputs": [
+            "artifact-path",
+            "aws-region",
+            "build-command",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-expected-channel",
+            "buildchain-contract-expected-major",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "fail-on-release-pr-error",
+            "github-governance-receipt-json",
+            "node-version",
+            "preview-apply",
+            "preview-aws-role-arn",
+            "preview-cleanup-apply",
+            "preview-comment",
+            "preview-environment",
+            "production-apply",
+            "production-approved",
+            "production-aws-role-arn",
+            "production-environment",
+            "production-release-app-client-id",
+            "production-release-app-id",
+            "production-release-branch-channel",
+            "production-release-head-prefix",
+            "production-release-label",
+            "production-release-on-main",
+            "production-release-pr-mode",
+            "production-release-pr-token",
+            "production-source-sha",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "release-feedback-actor-privacy",
+            "staging-apply",
+            "staging-aws-role-arn",
+            "staging-environment",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:publication-artifact",
+          "name": "workflow:publication-artifact",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/publication-artifact.yml",
+          "evidencePath": ".github/workflows/publication-artifact.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 24,
+          "inputs": [
+            "artifact-name",
+            "artifact-paths",
+            "artifact-retention-days",
+            "build-command",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "node-version",
+            "package-name",
+            "prepare-paper-package",
+            "publish-dist-tag",
+            "setup-node",
+            "target-ref",
+            "toolchain-command",
+            "toolchain-digest",
+            "toolchain-image",
+            "toolchain-type",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:release-candidate-promote",
+          "name": "workflow:release-candidate-promote",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/release-candidate-promote.yml",
+          "evidencePath": ".github/workflows/release-candidate-promote.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 107,
+          "inputs": [
+            "allow-repository",
+            "artifact-name",
+            "artifact-patterns",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-channel",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "channel",
+            "declarative-release-tail",
+            "dry-run",
+            "github-artifact-attestation-environment",
+            "github-artifact-attestation-policy-json",
+            "github-artifact-attestation-retention-days",
+            "github-governance-receipt-json",
+            "github-release",
+            "github-release-notes",
+            "github-release-payload-patterns",
+            "github-release-title",
+            "package-manager",
+            "provider-failure-after-capability",
+            "publication-admission-json",
+            "publication-auto-admission",
+            "publication-auto-no-gate",
+            "publication-commit-command",
+            "publication-commit-evidence-path",
+            "publication-consumer-predicate-id",
+            "publication-consumer-qualification-command",
+            "publication-consumer-qualification-controller-sha",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-gate-command",
+            "publication-gate-controller-sha",
+            "publication-package-name",
+            "publication-product",
+            "publication-publisher-workflow-path",
+            "publication-runner-provenance-json",
+            "publication-target",
+            "publication-used-nonces-json",
+            "publication-used-qualification-nonces-json",
+            "publish-artifact-kind",
+            "publish-command",
+            "publish-dist-tag",
+            "publish-mode",
+            "publish-package-main",
+            "publish-package-set-order",
+            "publish-rematerialize-on-resume",
+            "publish-required-artifacts-json",
+            "publish-target",
+            "publish-transaction-override",
+            "release-activation-command",
+            "release-activation-receipt-set-path",
+            "release-candidate-family-assignment-id",
+            "release-candidate-family-evidence-required",
+            "release-candidate-family-evidence-root",
+            "release-candidate-family-initiative-id",
+            "release-candidate-wait-seconds",
+            "release-candidate-workflow-file",
+            "release-candidate-workflow-name",
+            "release-passport",
+            "release-passport-adopter-delivery-json",
+            "release-passport-attachment-command",
+            "release-passport-buildchain-self-kfd",
+            "release-passport-evidence-command",
+            "release-passport-evidence-jsons",
+            "release-passport-evidence-path",
+            "release-passport-impact-json",
+            "release-passport-invariant-passport-command",
+            "release-passport-invariant-passport-jsons",
+            "release-passport-kfd-1-witness-jsons",
+            "release-passport-kfd-2-claim-jsons",
+            "release-passport-kfd-3-artifact-verify-command",
+            "release-passport-kfd-3-artifact-witness-jsons",
+            "release-passport-kfd-3-prebuild-witness-jsons",
+            "release-passport-kfd-adopter-manifest-gate-json",
+            "release-passport-kfd-adopter-manifest-json",
+            "release-passport-kfd-product-gate-jsons",
+            "release-passport-kfd-support-matrix-json",
+            "release-passport-output-dir",
+            "release-passport-platform-manifest-paths",
+            "release-passport-product-name",
+            "release-passport-v4-runtime-resume-evidence-json",
+            "release-propagation-config-path",
+            "required-artifact-count",
+            "required-status-check",
+            "resume-buildchain-runtime-sha",
+            "resume-candidate-repository",
+            "resume-candidate-run-id",
+            "resume-expected-candidate-root",
+            "resume-expected-candidate-runtime-sha",
+            "resume-expected-source-tree",
+            "resume-expected-workflow-file",
+            "resume-expected-workflow-name",
+            "resume-transaction-id",
+            "runner-preset",
+            "standalone-binary-distribution",
+            "target-ref",
+            "target-sha",
+            "trusted-publishing",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-patrol-monthly",
-          "name": "workflow:buildchain-patrol-monthly",
+          "id": "workflow:release-governance-reconcile",
+          "name": "workflow:release-governance-reconcile",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-patrol-monthly.yml",
-          "evidencePath": ".github/workflows/buildchain-patrol-monthly.yml",
+          "sourcePath": ".github/workflows/release-governance-reconcile.yml",
+          "evidencePath": ".github/workflows/release-governance-reconcile.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 5,
+          "inputs": [
+            "apply",
+            "branch",
+            "buildchain-ref",
+            "candidate-sha",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-patrol-weekly",
-          "name": "workflow:buildchain-patrol-weekly",
+          "id": "workflow:release-propagation",
+          "name": "workflow:release-propagation",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-patrol-weekly.yml",
-          "evidencePath": ".github/workflows/buildchain-patrol-weekly.yml",
+          "sourcePath": ".github/workflows/release-propagation.yml",
+          "evidencePath": ".github/workflows/release-propagation.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 20,
+          "inputs": [
+            "agent-work-context-json",
+            "agent-work-mode",
+            "buildchain-ref",
+            "buildchain-repository",
+            "downstream-base-ref",
+            "downstream-branch",
+            "downstream-prepare-command",
+            "downstream-repository",
+            "downstream-target",
+            "downstream-update-command",
+            "downstream-verify-command",
+            "dry-run",
+            "graph-json",
+            "lock-path",
+            "pr-body",
+            "pr-title",
+            "refresh-managed-readme-badges",
+            "source-node",
+            "universal-request-json",
+            "upstream-release-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-patrol",
-          "name": "workflow:buildchain-patrol",
+          "id": "workflow:release-tail",
+          "name": "workflow:release-tail",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-patrol.yml",
-          "evidencePath": ".github/workflows/buildchain-patrol.yml",
+          "sourcePath": ".github/workflows/release-tail.yml",
+          "evidencePath": ".github/workflows/release-tail.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 17,
+          "inputCount": 15,
           "inputs": [
-            "allowed-head-prefixes",
-            "block-labels",
             "buildchain-ref",
-            "buildchain-repository",
-            "cadence",
-            "capabilities",
-            "dry-run",
-            "landing-mode",
-            "max-actions",
-            "merge-method",
-            "mode",
-            "ready-label",
-            "require-approval",
-            "required-status-checks",
-            "same-repository-only",
-            "target-branch",
+            "candidate-root",
+            "capsule-contract",
+            "capsule-path",
+            "capsule-root",
+            "declaration-path",
+            "evidence-path",
+            "execute",
+            "provider-bindings-path",
+            "rehearsal-authority-path",
+            "rehearsal-capsule-path",
+            "rehearsal-evidence-path",
+            "rehearsal-mode",
+            "state-path",
             "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-ref-promotion-recovery",
-          "name": "workflow:buildchain-ref-promotion-recovery",
+          "id": "workflow:self-build-adopter-dogfood",
+          "name": "workflow:self-build-adopter-dogfood",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-ref-promotion-recovery.yml",
-          "evidencePath": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+          "sourcePath": ".github/workflows/self-build-adopter-dogfood.yml",
+          "evidencePath": ".github/workflows/self-build-adopter-dogfood.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4840,11 +7027,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-ref-promotion",
-          "name": "workflow:buildchain-ref-promotion",
+          "id": "workflow:self-build-alpha-dogfood",
+          "name": "workflow:self-build-alpha-dogfood",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-ref-promotion.yml",
-          "evidencePath": ".github/workflows/buildchain-ref-promotion.yml",
+          "sourcePath": ".github/workflows/self-build-alpha-dogfood.yml",
+          "evidencePath": ".github/workflows/self-build-alpha-dogfood.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4854,11 +7041,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-stable-candidate-patrol",
-          "name": "workflow:buildchain-stable-candidate-patrol",
+          "id": "workflow:self-build-binary-distribution",
+          "name": "workflow:self-build-binary-distribution",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-stable-candidate-patrol.yml",
-          "evidencePath": ".github/workflows/buildchain-stable-candidate-patrol.yml",
+          "sourcePath": ".github/workflows/self-build-binary-distribution.yml",
+          "evidencePath": ".github/workflows/self-build-binary-distribution.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4868,11 +7055,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-stable-candidate-qualification",
-          "name": "workflow:buildchain-stable-candidate-qualification",
+          "id": "workflow:self-build-candidate-lab",
+          "name": "workflow:self-build-candidate-lab",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-stable-candidate-qualification.yml",
-          "evidencePath": ".github/workflows/buildchain-stable-candidate-qualification.yml",
+          "sourcePath": ".github/workflows/self-build-candidate-lab.yml",
+          "evidencePath": ".github/workflows/self-build-candidate-lab.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4882,11 +7069,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:candidate-lab",
-          "name": "workflow:candidate-lab",
+          "id": "workflow:self-build-demo-dogfood",
+          "name": "workflow:self-build-demo-dogfood",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/candidate-lab.yml",
-          "evidencePath": ".github/workflows/candidate-lab.yml",
+          "sourcePath": ".github/workflows/self-build-demo-dogfood.yml",
+          "evidencePath": ".github/workflows/self-build-demo-dogfood.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4896,127 +7083,39 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:check",
-          "name": "workflow:check",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/check.yml",
-          "evidencePath": ".github/workflows/check.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 13,
-          "inputs": [
-            "buildchain-ref",
-            "buildchain-repository",
-            "mode",
-            "node-version",
-            "require-version-state",
-            "source-proof-closure-paths-json",
-            "source-proof-dependency-paths-json",
-            "source-proof-policy-paths-json",
-            "source-proof-required-contexts-json",
-            "source-proof-reuse",
-            "universal-request-json",
-            "upload-artifacts",
-            "working-directory"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:dev-alpha-candidate-patrol",
-          "name": "workflow:dev-alpha-candidate-patrol",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-alpha-candidate-patrol.yml",
-          "evidencePath": ".github/workflows/dev-alpha-candidate-patrol.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 16,
-          "inputs": [
-            "alpha-workflow-path",
-            "auto-merge",
-            "buildchain-ref",
-            "buildchain-repository",
-            "create-pull-request",
-            "dev-workflow-path",
-            "dry-run",
-            "max-age-seconds",
-            "merge-method",
-            "pull-request-body-prefix",
-            "pull-request-body-prefix-renderer",
-            "reactivation-authorized",
-            "settlement-authorized",
-            "source-branch",
-            "target-branch",
-            "universal-request-json"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:dev-delivery-warrant-cancel",
-          "name": "workflow:dev-delivery-warrant-cancel",
+          "id": "workflow:self-build-demo-media-qualification",
+          "name": "workflow:self-build-demo-media-qualification",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-delivery-warrant-cancel.yml",
-          "evidencePath": ".github/workflows/dev-delivery-warrant-cancel.yml",
+          "sourcePath": ".github/workflows/self-build-demo-media-qualification.yml",
+          "evidencePath": ".github/workflows/self-build-demo-media-qualification.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 13,
-          "inputs": [
-            "buildchain-ref",
-            "buildchain-repository",
-            "event-action",
-            "expected-candidate-id",
-            "expected-old-state-root",
-            "expected-pr-number",
-            "expected-source-head-sha",
-            "observed-source-head-sha",
-            "outcome",
-            "reason",
-            "target-branch",
-            "terminal-evidence-root",
-            "universal-request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:dev-delivery-warrant-close",
-          "name": "workflow:dev-delivery-warrant-close",
+          "id": "workflow:self-build-fixture",
+          "name": "workflow:self-build-fixture",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-delivery-warrant-close.yml",
-          "evidencePath": ".github/workflows/dev-delivery-warrant-close.yml",
+          "sourcePath": ".github/workflows/self-build-fixture.yml",
+          "evidencePath": ".github/workflows/self-build-fixture.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 14,
-          "inputs": [
-            "buildchain-ref",
-            "buildchain-repository",
-            "current-base-sha",
-            "expected-head-sha",
-            "expected-pr-number",
-            "merge-group-head-sha",
-            "merge-group-tree-sha",
-            "outcome",
-            "reason",
-            "replay-tree-sha",
-            "required-context-roots-json",
-            "target-branch",
-            "terminal-evidence-root",
-            "universal-request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:dev-merge-queue-governance",
-          "name": "workflow:dev-merge-queue-governance",
+          "id": "workflow:self-build-public-consumer-dogfood",
+          "name": "workflow:self-build-public-consumer-dogfood",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-merge-queue-governance.yml",
-          "evidencePath": ".github/workflows/dev-merge-queue-governance.yml",
+          "sourcePath": ".github/workflows/self-build-public-consumer-dogfood.yml",
+          "evidencePath": ".github/workflows/self-build-public-consumer-dogfood.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5026,97 +7125,39 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:dev-pr-auto-merge",
-          "name": "workflow:dev-pr-auto-merge",
+          "id": "workflow:self-build-release-verify-compat",
+          "name": "workflow:self-build-release-verify-compat",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-pr-auto-merge.yml",
-          "evidencePath": ".github/workflows/dev-pr-auto-merge.yml",
+          "sourcePath": ".github/workflows/self-build-release-verify-compat.yml",
+          "evidencePath": ".github/workflows/self-build-release-verify-compat.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 45,
-          "inputs": [
-            "active-lease-context",
-            "affected-paths-json",
-            "allowed-head-prefixes",
-            "assignment-root",
-            "block-labels",
-            "buildchain-ref",
-            "buildchain-repository",
-            "closure-root",
-            "defer-landing",
-            "delivery-class",
-            "delivery-priority",
-            "delivery-warrant-mode",
-            "dependency-root",
-            "diagnostic-context",
-            "dry-run",
-            "environment-root",
-            "expected-head-sha",
-            "expected-pr-number",
-            "handoff-workflow-id",
-            "initiative-root",
-            "landing-mode",
-            "legacy-active-owner-binding-json",
-            "max-merges",
-            "merge-method",
-            "native-command",
-            "native-command-root",
-            "native-heartbeat-seconds",
-            "native-proof-json",
-            "plan-root",
-            "project-cut-proof-json",
-            "queue-admission-context",
-            "ready-label",
-            "release-blocker-priority-json",
-            "require-approval",
-            "required-status-checks",
-            "same-repository-only",
-            "shard-evidence-roots-json",
-            "source-identity-root",
-            "source-patch-root",
-            "source-workflow-id",
-            "source-workflow-run-id",
-            "target-branch",
-            "toolchain-root",
-            "universal-request-json",
-            "warrant-lease-seconds"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:dev-qualification-patrol",
-          "name": "workflow:dev-qualification-patrol",
+          "id": "workflow:self-build-stable-candidate-qualification",
+          "name": "workflow:self-build-stable-candidate-qualification",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-qualification-patrol.yml",
-          "evidencePath": ".github/workflows/dev-qualification-patrol.yml",
+          "sourcePath": ".github/workflows/self-build-stable-candidate-qualification.yml",
+          "evidencePath": ".github/workflows/self-build-stable-candidate-qualification.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 11,
-          "inputs": [
-            "buildchain-ref",
-            "buildchain-repository",
-            "dev-workflow-path",
-            "dispatch-inputs-json",
-            "dry-run",
-            "max-attempts",
-            "mutation-authorized",
-            "preflight-workflow-path",
-            "priority-workflows-json",
-            "source-branch",
-            "universal-request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:engineering-housekeeper-daily",
-          "name": "workflow:engineering-housekeeper-daily",
+          "id": "workflow:self-build-verify",
+          "name": "workflow:self-build-verify",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/engineering-housekeeper-daily.yml",
-          "evidencePath": ".github/workflows/engineering-housekeeper-daily.yml",
+          "sourcePath": ".github/workflows/self-build-verify.yml",
+          "evidencePath": ".github/workflows/self-build-verify.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5126,11 +7167,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:engineering-housekeeper-monthly",
-          "name": "workflow:engineering-housekeeper-monthly",
+          "id": "workflow:self-ops-bootstrap-dogfood",
+          "name": "workflow:self-ops-bootstrap-dogfood",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/engineering-housekeeper-monthly.yml",
-          "evidencePath": ".github/workflows/engineering-housekeeper-monthly.yml",
+          "sourcePath": ".github/workflows/self-ops-bootstrap-dogfood.yml",
+          "evidencePath": ".github/workflows/self-ops-bootstrap-dogfood.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5140,11 +7181,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:engineering-housekeeper-weekly",
-          "name": "workflow:engineering-housekeeper-weekly",
+          "id": "workflow:self-ops-dev-delivery",
+          "name": "workflow:self-ops-dev-delivery",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/engineering-housekeeper-weekly.yml",
-          "evidencePath": ".github/workflows/engineering-housekeeper-weekly.yml",
+          "sourcePath": ".github/workflows/self-ops-dev-delivery.yml",
+          "evidencePath": ".github/workflows/self-ops-dev-delivery.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5154,70 +7195,39 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:engineering-housekeeper",
-          "name": "workflow:engineering-housekeeper",
+          "id": "workflow:self-ops-governance-audit",
+          "name": "workflow:self-ops-governance-audit",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/engineering-housekeeper.yml",
-          "evidencePath": ".github/workflows/engineering-housekeeper.yml",
+          "sourcePath": ".github/workflows/self-ops-governance-audit.yml",
+          "evidencePath": ".github/workflows/self-ops-governance-audit.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 15,
-          "inputs": [
-            "apply-enabled",
-            "artifact-prefix",
-            "artifact-retention-days",
-            "buildchain-ref",
-            "buildchain-repository",
-            "max-actions",
-            "mode",
-            "protected-patterns",
-            "repository",
-            "retained-patterns",
-            "stale-days",
-            "stale-pull-request-label",
-            "target-branch",
-            "temporary-branch-patterns",
-            "universal-request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:github-artifact-attestation",
-          "name": "workflow:github-artifact-attestation",
+          "id": "workflow:self-ops-housekeeping-daily",
+          "name": "workflow:self-ops-housekeeping-daily",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/github-artifact-attestation.yml",
-          "evidencePath": ".github/workflows/github-artifact-attestation.yml",
+          "sourcePath": ".github/workflows/self-ops-housekeeping-daily.yml",
+          "evidencePath": ".github/workflows/self-ops-housekeeping-daily.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 14,
-          "inputs": [
-            "buildchain-ref",
-            "environment",
-            "evidence-artifact-name",
-            "evidence-run-id",
-            "platform-manifest-artifact-name",
-            "platform-manifest-relative-path",
-            "policy-json",
-            "release-passport-artifact-name",
-            "release-passport-relative-path",
-            "retention-days",
-            "source-sha",
-            "subject-artifact-name",
-            "subject-relative-path",
-            "universal-request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:github-governance-audit",
-          "name": "workflow:github-governance-audit",
+          "id": "workflow:self-ops-housekeeping-monthly",
+          "name": "workflow:self-ops-housekeeping-monthly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/github-governance-audit.yml",
-          "evidencePath": ".github/workflows/github-governance-audit.yml",
+          "sourcePath": ".github/workflows/self-ops-housekeeping-monthly.yml",
+          "evidencePath": ".github/workflows/self-ops-housekeeping-monthly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5227,11 +7237,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:npm-publish",
-          "name": "workflow:npm-publish",
+          "id": "workflow:self-ops-housekeeping-weekly",
+          "name": "workflow:self-ops-housekeeping-weekly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/npm-publish.yml",
-          "evidencePath": ".github/workflows/npm-publish.yml",
+          "sourcePath": ".github/workflows/self-ops-housekeeping-weekly.yml",
+          "evidencePath": ".github/workflows/self-ops-housekeeping-weekly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5241,385 +7251,137 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:paper-release-sealed",
-          "name": "workflow:paper-release-sealed",
+          "id": "workflow:self-ops-merge-queue",
+          "name": "workflow:self-ops-merge-queue",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/paper-release-sealed.yml",
-          "evidencePath": ".github/workflows/paper-release-sealed.yml",
+          "sourcePath": ".github/workflows/self-ops-merge-queue.yml",
+          "evidencePath": ".github/workflows/self-ops-merge-queue.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 27,
-          "inputs": [
-            "artifact-name",
-            "artifact-paths",
-            "artifact-retention-days",
-            "branch-protection-bypass-apps",
-            "branch-protection-bypass-teams",
-            "branch-protection-bypass-users",
-            "buildchain-contract-lock-path",
-            "buildchain-ref",
-            "buildchain-repository",
-            "dry-run",
-            "github-governance-receipt-json",
-            "github-release",
-            "github-release-notes",
-            "github-release-title",
-            "package-name",
-            "publish-dist-tag",
-            "publisher-workflow-path",
-            "release-passport-impact-json",
-            "release-passport-output-dir",
-            "release-passport-product-name",
-            "required-status-check",
-            "target-ref",
-            "target-sha",
-            "toolchain-type",
-            "universal-request-json",
-            "verify-command",
-            "working-directory"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:paper-release",
-          "name": "workflow:paper-release",
+          "id": "workflow:self-ops-patrol-daily",
+          "name": "workflow:self-ops-patrol-daily",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/paper-release.yml",
-          "evidencePath": ".github/workflows/paper-release.yml",
+          "sourcePath": ".github/workflows/self-ops-patrol-daily.yml",
+          "evidencePath": ".github/workflows/self-ops-patrol-daily.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 39,
-          "inputs": [
-            "artifact-name",
-            "artifact-retention-days",
-            "branch-protection-bypass-apps",
-            "branch-protection-bypass-teams",
-            "branch-protection-bypass-users",
-            "build-command",
-            "buildchain-contract-compatibility-policy",
-            "buildchain-contract-drift-issue-mode",
-            "buildchain-contract-lock-path",
-            "buildchain-ref",
-            "buildchain-repository",
-            "dry-run",
-            "github-governance-receipt-json",
-            "github-release",
-            "github-release-notes",
-            "github-release-title",
-            "node-version",
-            "package-name",
-            "publication-admission-json",
-            "publication-control-plane-audit-json",
-            "publication-expected-json",
-            "publication-runner-provenance-json",
-            "publication-used-nonces-json",
-            "publish-dist-tag",
-            "publish-package-set-order",
-            "release-passport-impact-json",
-            "release-passport-output-dir",
-            "release-passport-product-name",
-            "required-status-check",
-            "setup-node",
-            "target-ref",
-            "target-sha",
-            "toolchain-command",
-            "toolchain-digest",
-            "toolchain-image",
-            "toolchain-type",
-            "universal-request-json",
-            "verify-command",
-            "working-directory"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:patrol-daily",
-          "name": "workflow:patrol-daily",
+          "id": "workflow:self-ops-patrol-monthly",
+          "name": "workflow:self-ops-patrol-monthly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/patrol-daily.yml",
-          "evidencePath": ".github/workflows/patrol-daily.yml",
+          "sourcePath": ".github/workflows/self-ops-patrol-monthly.yml",
+          "evidencePath": ".github/workflows/self-ops-patrol-monthly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 14,
-          "inputs": [
-            "allowed-head-prefixes",
-            "block-labels",
-            "buildchain-ref",
-            "buildchain-repository",
-            "dry-run",
-            "landing-mode",
-            "max-actions",
-            "merge-method",
-            "ready-label",
-            "require-approval",
-            "required-status-checks",
-            "same-repository-only",
-            "target-branch",
-            "universal-request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:patrol-monthly",
-          "name": "workflow:patrol-monthly",
+          "id": "workflow:self-ops-patrol-weekly",
+          "name": "workflow:self-ops-patrol-weekly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/patrol-monthly.yml",
-          "evidencePath": ".github/workflows/patrol-monthly.yml",
+          "sourcePath": ".github/workflows/self-ops-patrol-weekly.yml",
+          "evidencePath": ".github/workflows/self-ops-patrol-weekly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 5,
-          "inputs": [
-            "buildchain-ref",
-            "buildchain-repository",
-            "dry-run",
-            "target-branch",
-            "universal-request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:patrol-observed-evidence",
-          "name": "workflow:patrol-observed-evidence",
+          "id": "workflow:self-ops-promotion-recovery",
+          "name": "workflow:self-ops-promotion-recovery",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/patrol-observed-evidence.yml",
-          "evidencePath": ".github/workflows/patrol-observed-evidence.yml",
+          "sourcePath": ".github/workflows/self-ops-promotion-recovery.yml",
+          "evidencePath": ".github/workflows/self-ops-promotion-recovery.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 13,
-          "inputs": [
-            "artifact-path",
-            "build-command",
-            "buildchain-ref",
-            "cloudfront-distribution",
-            "evidence-source-path",
-            "evidence-source-ref",
-            "evidence-source-repository",
-            "manifest-path",
-            "production-aws-role-arn",
-            "production-bucket",
-            "production-environment",
-            "universal-request-json",
-            "verify-command"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:patrol-weekly",
-          "name": "workflow:patrol-weekly",
+          "id": "workflow:self-ops-recovery-failure-dogfood",
+          "name": "workflow:self-ops-recovery-failure-dogfood",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/patrol-weekly.yml",
-          "evidencePath": ".github/workflows/patrol-weekly.yml",
+          "sourcePath": ".github/workflows/self-ops-recovery-failure-dogfood.yml",
+          "evidencePath": ".github/workflows/self-ops-recovery-failure-dogfood.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 5,
-          "inputs": [
-            "buildchain-ref",
-            "buildchain-repository",
-            "dry-run",
-            "target-branch",
-            "universal-request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:publication-artifact",
-          "name": "workflow:publication-artifact",
+          "id": "workflow:self-ops-runner-smoke",
+          "name": "workflow:self-ops-runner-smoke",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/publication-artifact.yml",
-          "evidencePath": ".github/workflows/publication-artifact.yml",
+          "sourcePath": ".github/workflows/self-ops-runner-smoke.yml",
+          "evidencePath": ".github/workflows/self-ops-runner-smoke.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
-          "public": true,
-          "inputCount": 24,
-          "inputs": [
-            "artifact-name",
-            "artifact-paths",
-            "artifact-retention-days",
-            "build-command",
-            "buildchain-alpha-contract-lock-path",
-            "buildchain-contract-compatibility-policy",
-            "buildchain-contract-drift-issue-mode",
-            "buildchain-contract-lock-path",
-            "buildchain-ref",
-            "buildchain-repository",
-            "buildchain-stable-contract-lock-path",
-            "node-version",
-            "package-name",
-            "prepare-paper-package",
-            "publish-dist-tag",
-            "setup-node",
-            "target-ref",
-            "toolchain-command",
-            "toolchain-digest",
-            "toolchain-image",
-            "toolchain-type",
-            "universal-request-json",
-            "verify-command",
-            "working-directory"
-          ],
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-candidate-promote",
-          "name": "workflow:release-candidate-promote",
+          "id": "workflow:self-ops-stable-candidate-patrol",
+          "name": "workflow:self-ops-stable-candidate-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-candidate-promote.yml",
-          "evidencePath": ".github/workflows/release-candidate-promote.yml",
+          "sourcePath": ".github/workflows/self-ops-stable-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/self-ops-stable-candidate-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 107,
-          "inputs": [
-            "allow-repository",
-            "artifact-name",
-            "artifact-patterns",
-            "branch-protection-bypass-apps",
-            "branch-protection-bypass-teams",
-            "branch-protection-bypass-users",
-            "buildchain-alpha-contract-lock-path",
-            "buildchain-channel",
-            "buildchain-contract-compatibility-policy",
-            "buildchain-contract-drift-issue-mode",
-            "buildchain-contract-lock-path",
-            "buildchain-ref",
-            "buildchain-repository",
-            "buildchain-stable-contract-lock-path",
-            "channel",
-            "declarative-release-tail",
-            "dry-run",
-            "github-artifact-attestation-environment",
-            "github-artifact-attestation-policy-json",
-            "github-artifact-attestation-retention-days",
-            "github-governance-receipt-json",
-            "github-release",
-            "github-release-notes",
-            "github-release-payload-patterns",
-            "github-release-title",
-            "package-manager",
-            "provider-failure-after-capability",
-            "publication-admission-json",
-            "publication-auto-admission",
-            "publication-auto-no-gate",
-            "publication-commit-command",
-            "publication-commit-evidence-path",
-            "publication-consumer-predicate-id",
-            "publication-consumer-qualification-command",
-            "publication-consumer-qualification-controller-sha",
-            "publication-control-plane-audit-json",
-            "publication-expected-json",
-            "publication-gate-aggregate-json",
-            "publication-gate-command",
-            "publication-gate-controller-sha",
-            "publication-package-name",
-            "publication-product",
-            "publication-publisher-workflow-path",
-            "publication-runner-provenance-json",
-            "publication-target",
-            "publication-used-nonces-json",
-            "publication-used-qualification-nonces-json",
-            "publish-artifact-kind",
-            "publish-command",
-            "publish-dist-tag",
-            "publish-mode",
-            "publish-package-main",
-            "publish-package-set-order",
-            "publish-rematerialize-on-resume",
-            "publish-required-artifacts-json",
-            "publish-target",
-            "publish-transaction-override",
-            "release-activation-command",
-            "release-activation-receipt-set-path",
-            "release-candidate-family-assignment-id",
-            "release-candidate-family-evidence-required",
-            "release-candidate-family-evidence-root",
-            "release-candidate-family-initiative-id",
-            "release-candidate-wait-seconds",
-            "release-candidate-workflow-file",
-            "release-candidate-workflow-name",
-            "release-passport",
-            "release-passport-adopter-delivery-json",
-            "release-passport-attachment-command",
-            "release-passport-buildchain-self-kfd",
-            "release-passport-evidence-command",
-            "release-passport-evidence-jsons",
-            "release-passport-evidence-path",
-            "release-passport-impact-json",
-            "release-passport-invariant-passport-command",
-            "release-passport-invariant-passport-jsons",
-            "release-passport-kfd-1-witness-jsons",
-            "release-passport-kfd-2-claim-jsons",
-            "release-passport-kfd-3-artifact-verify-command",
-            "release-passport-kfd-3-artifact-witness-jsons",
-            "release-passport-kfd-3-prebuild-witness-jsons",
-            "release-passport-kfd-adopter-manifest-gate-json",
-            "release-passport-kfd-adopter-manifest-json",
-            "release-passport-kfd-product-gate-jsons",
-            "release-passport-kfd-support-matrix-json",
-            "release-passport-output-dir",
-            "release-passport-platform-manifest-paths",
-            "release-passport-product-name",
-            "release-passport-v4-runtime-resume-evidence-json",
-            "release-propagation-config-path",
-            "required-artifact-count",
-            "required-status-check",
-            "resume-buildchain-runtime-sha",
-            "resume-candidate-repository",
-            "resume-candidate-run-id",
-            "resume-expected-candidate-root",
-            "resume-expected-candidate-runtime-sha",
-            "resume-expected-source-tree",
-            "resume-expected-workflow-file",
-            "resume-expected-workflow-name",
-            "resume-transaction-id",
-            "runner-preset",
-            "standalone-binary-distribution",
-            "target-ref",
-            "target-sha",
-            "trusted-publishing",
-            "universal-request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-governance-reconcile",
-          "name": "workflow:release-governance-reconcile",
+          "id": "workflow:self-release-binary-assets",
+          "name": "workflow:self-release-binary-assets",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-governance-reconcile.yml",
-          "evidencePath": ".github/workflows/release-governance-reconcile.yml",
+          "sourcePath": ".github/workflows/self-release-binary-assets.yml",
+          "evidencePath": ".github/workflows/self-release-binary-assets.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 5,
-          "inputs": [
-            "apply",
-            "branch",
-            "buildchain-ref",
-            "candidate-sha",
-            "universal-request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-line-bootstrap",
-          "name": "workflow:release-line-bootstrap",
+          "id": "workflow:self-release-line-open",
+          "name": "workflow:self-release-line-open",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-line-bootstrap.yml",
-          "evidencePath": ".github/workflows/release-line-bootstrap.yml",
+          "sourcePath": ".github/workflows/self-release-line-open.yml",
+          "evidencePath": ".github/workflows/self-release-line-open.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5629,11 +7391,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-new-version",
-          "name": "workflow:release-new-version",
+          "id": "workflow:self-release-new-version-compat",
+          "name": "workflow:self-release-new-version-compat",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-new-version.yml",
-          "evidencePath": ".github/workflows/release-new-version.yml",
+          "sourcePath": ".github/workflows/self-release-new-version-compat.yml",
+          "evidencePath": ".github/workflows/self-release-new-version-compat.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5643,76 +7405,39 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-propagation",
-          "name": "workflow:release-propagation",
+          "id": "workflow:self-release-npm-dry-run",
+          "name": "workflow:self-release-npm-dry-run",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-propagation.yml",
-          "evidencePath": ".github/workflows/release-propagation.yml",
+          "sourcePath": ".github/workflows/self-release-npm-dry-run.yml",
+          "evidencePath": ".github/workflows/self-release-npm-dry-run.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 20,
-          "inputs": [
-            "agent-work-context-json",
-            "agent-work-mode",
-            "buildchain-ref",
-            "buildchain-repository",
-            "downstream-base-ref",
-            "downstream-branch",
-            "downstream-prepare-command",
-            "downstream-repository",
-            "downstream-target",
-            "downstream-update-command",
-            "downstream-verify-command",
-            "dry-run",
-            "graph-json",
-            "lock-path",
-            "pr-body",
-            "pr-title",
-            "refresh-managed-readme-badges",
-            "source-node",
-            "universal-request-json",
-            "upstream-release-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-tail",
-          "name": "workflow:release-tail",
+          "id": "workflow:self-release-promote",
+          "name": "workflow:self-release-promote",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-tail.yml",
-          "evidencePath": ".github/workflows/release-tail.yml",
+          "sourcePath": ".github/workflows/self-release-promote.yml",
+          "evidencePath": ".github/workflows/self-release-promote.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 15,
-          "inputs": [
-            "buildchain-ref",
-            "candidate-root",
-            "capsule-contract",
-            "capsule-path",
-            "capsule-root",
-            "declaration-path",
-            "evidence-path",
-            "execute",
-            "provider-bindings-path",
-            "rehearsal-authority-path",
-            "rehearsal-capsule-path",
-            "rehearsal-evidence-path",
-            "rehearsal-mode",
-            "state-path",
-            "universal-request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-verify",
-          "name": "workflow:release-verify",
+          "id": "workflow:self-release-rehearsal-dogfood",
+          "name": "workflow:self-release-rehearsal-dogfood",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-verify.yml",
-          "evidencePath": ".github/workflows/release-verify.yml",
+          "sourcePath": ".github/workflows/self-release-rehearsal-dogfood.yml",
+          "evidencePath": ".github/workflows/self-release-rehearsal-dogfood.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5722,11 +7447,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:self-hosted-runner-smoke",
-          "name": "workflow:self-hosted-runner-smoke",
+          "id": "workflow:self-release-tail-dogfood",
+          "name": "workflow:self-release-tail-dogfood",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/self-hosted-runner-smoke.yml",
-          "evidencePath": ".github/workflows/self-hosted-runner-smoke.yml",
+          "sourcePath": ".github/workflows/self-release-tail-dogfood.yml",
+          "evidencePath": ".github/workflows/self-release-tail-dogfood.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5767,20 +7492,6 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
-        {
-          "id": "workflow:universal-bootstrap-dogfood",
-          "name": "workflow:universal-bootstrap-dogfood",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/universal-bootstrap-dogfood.yml",
-          "evidencePath": ".github/workflows/universal-bootstrap-dogfood.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
         {
           "id": "workflow:universal-bootstrap-recovery",
           "name": "workflow:universal-bootstrap-recovery",
@@ -5797,20 +7508,6 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
-        {
-          "id": "workflow:v4-adopter-delivery-dogfood",
-          "name": "workflow:v4-adopter-delivery-dogfood",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/v4-adopter-delivery-dogfood.yml",
-          "evidencePath": ".github/workflows/v4-adopter-delivery-dogfood.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
         {
           "id": "workflow:v4-adopter-delivery",
           "name": "workflow:v4-adopter-delivery",
@@ -5835,48 +7532,6 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
-        {
-          "id": "workflow:v4-declarative-release-tail-dogfood",
-          "name": "workflow:v4-declarative-release-tail-dogfood",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
-          "evidencePath": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:v4-public-consumer-dogfood",
-          "name": "workflow:v4-public-consumer-dogfood",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/v4-public-consumer-dogfood.yml",
-          "evidencePath": ".github/workflows/v4-public-consumer-dogfood.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:v4-publication-rehearsal-dogfood",
-          "name": "workflow:v4-publication-rehearsal-dogfood",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/v4-publication-rehearsal-dogfood.yml",
-          "evidencePath": ".github/workflows/v4-publication-rehearsal-dogfood.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
         {
           "id": "workflow:v4-stage-capsule-canary",
           "name": "workflow:v4-stage-capsule-canary",
@@ -5919,20 +7574,6 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
-        {
-          "id": "workflow:verify",
-          "name": "workflow:verify",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/verify.yml",
-          "evidencePath": ".github/workflows/verify.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
         {
           "id": "action:github-artifact-attestation",
           "name": "action:github-artifact-attestation",
@@ -7296,6 +8937,18 @@
           "public": true,
           "reverseAuditSource": "dist/site/page-registry.json"
         },
+        {
+          "id": "site-page:manual:workflow-catalog",
+          "name": "site-page:manual:workflow-catalog",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:overview:home",
           "name": "site-page:overview:home",
@@ -7345,11 +8998,11 @@
         "public": true
       },
       {
-        "id": "control:.github/workflows/buildchain-ref-promotion.yml",
-        "name": "control:.github/workflows/buildchain-ref-promotion.yml",
+        "id": "control:.github/workflows/self-release-promote.yml",
+        "name": "control:.github/workflows/self-release-promote.yml",
         "kind": "workflow",
-        "sourcePath": ".github/workflows/buildchain-ref-promotion.yml",
-        "evidencePath": ".github/workflows/buildchain-ref-promotion.yml",
+        "sourcePath": ".github/workflows/self-release-promote.yml",
+        "evidencePath": ".github/workflows/self-release-promote.yml",
         "availability": "shipped",
         "visibility": "public",
         "participantFacing": true,
@@ -7448,7 +9101,7 @@
         "name": "Buildchain standalone binary distribution",
         "kind": "binary-distribution",
         "sourcePath": "scripts/build-standalone-binary.mjs",
-        "evidencePath": ".github/workflows/binary-distribution.yml",
+        "evidencePath": ".github/workflows/self-build-binary-distribution.yml",
         "availability": "shipped",
         "visibility": "public",
         "participantFacing": true,
@@ -7479,6 +9132,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 479
+    "publicSurfaceCount": 522
   }
 }