@kungfu-tech/buildchain 4.0.2-alpha.36 → 4.0.2-alpha.38

package/dist/site/page-registry.json

@@ -8,7 +8,7 @@
     "rendererOwner": "site repository",
     "rule": "Site repositories render these markdown pages and metadata; they do not maintain separate Buildchain product copy."
   },
-  "pageCount": 86,
+  "pageCount": 87,
   "categories": [
     "action",
     "api",
@@ -2980,7 +2980,7 @@
       ],
       "maturity": "preview",
       "sourcePath": "docs/next-development-transition.md",
-      "digest": "sha256:1e92b92b24888df1668cbffe60c9455336ee1285dbbc78d4a8d62c2919a0b9db",
+      "digest": "sha256:36f514efc9a7c1c6da59e93126e1512529c5c2349ea987516ef13f1e592be454",
       "headings": [
         {
           "level": 1,
@@ -3013,7 +3013,7 @@
           "anchor": "local-adapter"
         }
       ],
-      "markdown": "---\nstatus: preview\nperiod: ongoing\ntheme: next-development-transition\ndoc_type: generated-contract-guidance\nsource_level: generated-from-node-contract\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: self-reviewed\nlast_reviewed: 2026-08-11\n---\n\n# Next-development Transition\n\nThis document is generated from\n`packages/core/next-development-transition.js` and\n`packages/core/next-development-controller.js` and\n`packages/core/next-development-projection.js`. Edit those sources and run\n`node scripts/generate-next-development-guidance.mjs`; direct edits fail the\nprojection drift check.\n\n## Contract\n\n- Contract: `kungfu-buildchain-next-development-transition/v1`\n- Durable controller: `kungfu-buildchain-next-development-controller/v1`\n- ADR: [ADR 0002](../architecture/decisions/0002-next-development-transition.md)\n- States: `planned`, `waiting-anchor`, `materialized`, `pr-pending`, `merged`, `verified`\n- Legal version models: `semver/auto` and `anchored/manual`\n- Invariant: A completed Alpha remains successful and its refs remain immutable while the next-development transition is incomplete.\n\nAn Alpha publication is terminal success independently of this transition.\nThe idempotency key is a deterministic hash of the completed-Alpha root,\nrepository, legal model, and sorted declared paths. Incomplete Dev preparation\ntherefore cannot relabel Alpha N as failed, and replay cannot select a different\nAlpha or path set.\n\n## Durable controller\n\n`scheduleNextDevelopmentController` atomically creates one child for the\nrepository and completed-Alpha root. Identical wakes reuse it. The store\nboundary requires read, create-if-absent, and compare-and-swap operations; the\ncontroller root fences every checkpoint. Materialization uses an operation key\nderived from the child, exact current protected Dev SHA, and reviewed target,\nso a fresh runner can recover an already-created commit instead of rebuilding\nthe Alpha candidate or depending on the original runner workspace.\n\nBefore opening the protected version PR, the controller reads Dev again. A\nmoved head makes the prepared attempt `superseded`; the following wake\nregenerates only declared version material from that latest SHA. After merge,\n`verified` remains unreachable until protected Dev readback contains the\nprepared commit and its target version, source roots, and derived roots exactly\nmatch the checkpoint. The executor surface contains no Alpha publication, tag,\nrelease, or package operation.\n\nAlpha finalization no longer treats a non-fast-forward Dev update as successful\nbookkeeping. It requires an exact checkout of the current Dev head, regenerates\nthe declared version lifecycle there, and uses a non-force merge or reusable\nprotected version PR. Candidate Patrol ignores both the generated preparation\ncommit and its two-parent integration commit. Before a later product candidate\ncan settle, Patrol reads every prepared version path at the candidate SHA and\nrequires the exact reserved blob identities; missing or stale state blocks\nbefore a Release Cut or heavy candidate build.\n\n## Version models\n\n`semver/auto` increments the Alpha sequence on the same semantic patch. For\nexample, completed `1.4.2-alpha.7` plans `1.4.2-alpha.8`. It must not accept an anchor or an\noperator-selected target.\n\n`anchored/manual` enters `waiting-anchor` until the caller provides both a\nsemantic target and the exact digest of the configured anchor manifest. The\nadapter verifies the manifest already present in the checkout; it never invents\nor edits upstream anchor facts. `semver/manual` and `anchored/auto` are\ninvalid.\n\n## Public self-dogfood and adoption\n\n`.github/workflows/self-build-public-consumer-dogfood.yml` remains the exact thin\nconsumer of the public `v4-stage-capsule-canary.yml@v4-alpha` contract. Its\ndeclared `lifecycle.verify` runs `pnpm run check`, so the same public path\nexecutes pure recovery tests that inject a transient durable-state write\nfailure, restore the adapter operation on a fresh runner, supersede stale work\nwhen protected Dev moves, preserve `pr-pending` during protected-PR delay, and\nprove both legal version models. No caller-local qualification job, action,\nor private self-dogfood route is added.\n\nThe existing dual-channel self-consumer separately retains exact hosted\n`build.yml@v4-alpha` and `build.yml@v4` runtime evidence. Consumers adopt\nthe proved contract through the floating v4 coordinates; exact resolved SHAs\nremain audit evidence and never become durable selectors.\n\n## Local adapter\n\nFrom a normal Buildchain checkout:\n\n```sh\nnode scripts/next-development-transition.mjs materialize --cwd . --input <request.json>\n```\n\nThe command prints a rooted plan and performs no write by default. `--write`\nmay change only regular, non-symlink source files listed by `version.files`\nin the loaded Buildchain config. The rooted adapter contract separately names\n`version.derived_files` as allowed changes, `version.manifest` as read-only,\n`BUILDCHAIN_VERSION` as the target input, `lifecycle.version-state` as the\nderived-material stage, and `lifecycle.verify` as the truth gate. The\nreference writer fails closed when derived files exist because transaction\nexecution is outside this contract slice. It performs no Git operation, ref\nupdate, network request, provider call, lifecycle command, or anchor edit.\n\nPreparing development state creates no tag, Release, public package, or\ncandidate. Those public effects remain outside the local adapter contract.\n\nThe request schema is\n`contracts/next-development-request-v1.schema.json`; the durable record schema\nis `contracts/next-development-transition-v1.schema.json`. Positive and\nnegative examples live under\n`contracts/fixtures/next-development-transition-v1/`."
+      "markdown": "---\nstatus: preview\nperiod: ongoing\ntheme: next-development-transition\ndoc_type: generated-contract-guidance\nsource_level: generated-from-node-contract\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: self-reviewed\nlast_reviewed: 2026-08-11\n---\n\n# Next-development Transition\n\nThis document is generated from\n`packages/core/next-development-transition.js` and\n`packages/core/next-development-controller.js` and\n`packages/core/next-development-projection.js`. Edit those sources and run\n`node scripts/generate-next-development-guidance.mjs`; direct edits fail the\nprojection drift check.\n\n## Contract\n\n- Contract: `kungfu-buildchain-next-development-transition/v1`\n- Durable controller: `kungfu-buildchain-next-development-controller/v1`\n- ADR: [ADR 0002](../architecture/decisions/0002-next-development-transition.md)\n- States: `planned`, `waiting-anchor`, `materialized`, `pr-pending`, `merged`, `verified`\n- Legal version models: `semver/auto` and `anchored/manual`\n- Invariant: A completed Alpha remains successful and its refs remain immutable while the next-development transition is incomplete.\n\nAn Alpha publication is terminal success independently of this transition.\nThe idempotency key is a deterministic hash of the completed-Alpha root,\nrepository, legal model, and sorted declared paths. Incomplete Dev preparation\ntherefore cannot relabel Alpha N as failed, and replay cannot select a different\nAlpha or path set.\n\n## Durable controller\n\n`scheduleNextDevelopmentController` atomically creates one child for the\nrepository and completed-Alpha root. Identical wakes reuse it. The store\nboundary requires read, create-if-absent, and compare-and-swap operations; the\ncontroller root fences every checkpoint. Materialization uses an operation key\nderived from the child, exact current protected Dev SHA, and reviewed target,\nso a fresh runner can recover an already-created commit instead of rebuilding\nthe Alpha candidate or depending on the original runner workspace.\n\nBefore opening the protected version PR, the controller reads Dev again. A\nmoved head makes the prepared attempt `superseded`; the following wake\nregenerates only declared version material from that latest SHA. After merge,\n`verified` remains unreachable until protected Dev readback contains the\nprepared commit and its target version, source roots, and derived roots exactly\nmatch the checkpoint. The executor surface contains no Alpha publication, tag,\nrelease, or package operation.\n\nAlpha finalization no longer treats a non-fast-forward Dev update as successful\nbookkeeping. It requires an exact checkout of the current Dev head, regenerates\nthe declared version lifecycle there, and uses a non-force merge or reusable\nprotected version PR. Candidate Patrol ignores both the generated preparation\ncommit and its two-parent integration commit. Before a later product candidate\ncan settle, Patrol reads every prepared version path at the candidate SHA and\nrequires the exact reserved blob identities; missing or stale state blocks\nbefore a Release Cut or heavy candidate build.\n\n## Version models\n\n`semver/auto` increments the Alpha sequence on the same semantic patch. For\nexample, completed `1.4.2-alpha.7` plans `1.4.2-alpha.8`. It must not accept an anchor or an\noperator-selected target.\n\n`anchored/manual` enters `waiting-anchor` until the caller provides both a\nsemantic target and the exact digest of the configured anchor manifest. The\nadapter verifies the manifest already present in the checkout; it never invents\nor edits upstream anchor facts. `semver/manual` and `anchored/auto` are\ninvalid.\n\n## Public self-dogfood and adoption\n\n`.github/workflows/self-build-public-consumer-dogfood.yml` remains the exact thin\nconsumer of the public `public-build-stage-capsule-canary.yml@v4-alpha` contract. Its\ndeclared `lifecycle.verify` runs `pnpm run check`, so the same public path\nexecutes pure recovery tests that inject a transient durable-state write\nfailure, restore the adapter operation on a fresh runner, supersede stale work\nwhen protected Dev moves, preserve `pr-pending` during protected-PR delay, and\nprove both legal version models. No caller-local qualification job, action,\nor private self-dogfood route is added.\n\nThe existing dual-channel self-consumer separately retains exact hosted\n`build.yml@v4-alpha` and `build.yml@v4` runtime evidence. Consumers adopt\nthe proved contract through the floating v4 coordinates; exact resolved SHAs\nremain audit evidence and never become durable selectors.\n\n## Local adapter\n\nFrom a normal Buildchain checkout:\n\n```sh\nnode scripts/next-development-transition.mjs materialize --cwd . --input <request.json>\n```\n\nThe command prints a rooted plan and performs no write by default. `--write`\nmay change only regular, non-symlink source files listed by `version.files`\nin the loaded Buildchain config. The rooted adapter contract separately names\n`version.derived_files` as allowed changes, `version.manifest` as read-only,\n`BUILDCHAIN_VERSION` as the target input, `lifecycle.version-state` as the\nderived-material stage, and `lifecycle.verify` as the truth gate. The\nreference writer fails closed when derived files exist because transaction\nexecution is outside this contract slice. It performs no Git operation, ref\nupdate, network request, provider call, lifecycle command, or anchor edit.\n\nPreparing development state creates no tag, Release, public package, or\ncandidate. Those public effects remain outside the local adapter contract.\n\nThe request schema is\n`contracts/next-development-request-v1.schema.json`; the durable record schema\nis `contracts/next-development-transition-v1.schema.json`. Positive and\nnegative examples live under\n`contracts/fixtures/next-development-transition-v1/`."
     },
     {
       "id": "manual:node-api-reference",
@@ -4736,7 +4736,7 @@
       ],
       "maturity": "preview",
       "sourcePath": "docs/v4-adopter-delivery.md",
-      "digest": "sha256:cf9beccd0ad6ecbd021c2d5273ab91e54cc3ab225b7b8f33f240ac6d6bd23a48",
+      "digest": "sha256:1afe656ccb66bb63c73956413bb2d3551d3ba39c3f6e50389e7695877dac87a2",
       "headings": [
         {
           "level": 1,
@@ -4774,7 +4774,7 @@
           "anchor": "offline-vectors"
         }
       ],
-      "markdown": "---\nstatus: preview\nperiod: 2026-08-27\ntheme: buildchain-v4-adopter-delivery\ndoc_type: product-manual\nsource_level: local-files\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: self-reviewed\nlast_reviewed: 2026-08-27\nai_provenance:\n  model_family: GPT-5\n  product: Codex\n  generated_at: 2026-08-27\n  visible_context: Exact protected v3 adopter-delivery cut, v4 pure contract core, published npm archive bytes, public consumer policy, complete v3 capability inventory, and rooted cross-platform qualification reports.\n  invisible_context_boundary: No credentials, provider mutations, signing operations, publication operations, or release authority were used.\n---\n\n# V4 Public Adopter Delivery\n\nBuildchain v4 carries the v3 adopter-delivery capability through a public,\nprotocol-neutral boundary. Consumers select an exact protocol driver and\nartifact profile, retain the rooted gate result, and independently recompute\nthat readback. Buildchain does not interpret a protocol owned by another\nproject and a passing result never grants runtime, provider, signing,\npublication, or release authority.\n\nThe parity source is the read-only protected cut\n`dev/v3/v3.0@6b96bdad8d9f8ccf9275f27d9370a226a9c78465`. Work began from the\nminimal v4 absorption base\n`dev/v4/v4.0@e5611377efc03178f8687d99968cfdfa3ce2825b` and absorbed the\nverified protected-base advances through\n`dev/v4/v4.0@e0342713c7447960c13bd73377282b2e93f4853d` before delivery. These\nidentities, the v3 vector-suite root, and the KFD package cut are committed in\n[`v4-adopter-delivery-parity.json`](../architecture/v4-adopter-delivery-parity.json)\nand exposed by the public Node API.\n\n## Public contract\n\nThe JSON input schema is\n[`v4-adopter-delivery-v1.schema.json`](../contracts/v4-adopter-delivery-v1.schema.json).\nAn input names both selectors and the exact request identities. A selector\nwhose implementation identity differs from the request fails closed. The\npublic selectors are `json-assertion`, `kfd-category`, and `legacy-kfd`, with\n`git-commit` and `package` artifact profiles.\n\nApplications can also import the lower-level driver interface from\n`@kungfu-tech/buildchain/adopter-delivery-gate` and define an isolated driver.\nThe v4 convenience runtime, exact source declaration, readback verification,\nN-1 lineage check, and published archive loader are exported from\n`@kungfu-tech/buildchain/v4-adopter-delivery`.\n\n## CLI\n\nAll four operations are offline after the declared archive bytes exist:\n\n```sh\nbuildchain adopter-delivery run \\\n  --input contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json \\\n  --output .buildchain/adopter-delivery/readback.json\n\nbuildchain adopter-delivery verify \\\n  --input contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json \\\n  --readback .buildchain/adopter-delivery/readback.json\n\nbuildchain adopter-delivery bootstrap \\\n  --input contracts/fixtures/v4-adopter-delivery-v1/bootstrap-positive.json\n\nbuildchain adopter-delivery archive \\\n  --input contracts/fixtures/v4-adopter-delivery-v1/archive-template.json\n```\n\n`verify` requires the complete rooted readback and recomputes it. Missing or\nsubstituted readback, unknown selector, unknown driver, protocol-version\nmismatch, archive-byte or package-identity mismatch, and altered bootstrap\nlineage all fail closed.\n\n## N-1 and published archives\n\nN-1 bootstrap is distinct from the candidate. The lineage wrapper requires\nthe exact v3 authority commit, exact v4 absorption base, and exact public\nBuildchain archive root. The retained v3 bootstrap also requires protected and\npublished N-1 authority, rejects self-authorization, binds the candidate gate\nartifact, and requires merged Warrant-shaped evidence. Protocol, profile, or\ngate changes require independently reviewed transition evidence.\n\nPublished authority loading verifies compressed bytes before extraction,\nrejects unsafe paths and links, verifies extracted package identity, verifies\nKFD's semantic package root, and imports only declared public delivery modules.\nThe caller must supply an independently retained authority readback root. The\nfixture binds `@kungfu-tech/buildchain@3.0.9-alpha.16` and\n`@kungfu-tech/kfd@1.0.0-alpha.65`; a package version is not treated as proof of\nthe Git source cut.\n\n## Config and reusable workflow\n\nConsumer configuration is closed and repository-relative:\n\n```toml\n[adopter_delivery]\ncontract = \"kungfu-buildchain-v4-adopter-delivery/v1\"\ninput_path = \"contracts/adopter-delivery/input.json\"\nreadback_path = \".buildchain/adopter-delivery/readback.json\"\nbootstrap_path = \"contracts/adopter-delivery/bootstrap.json\"\narchive_path = \"contracts/adopter-delivery/archives.json\"\nresult_path = \".buildchain/adopter-delivery/result.json\"\ndriver_selector = \"kfd-category\"\nartifact_profile_selector = \"package\"\n```\n\nThe public reusable workflow is\n`kungfu-systems/buildchain/.github/workflows/v4-adopter-delivery.yml@v4` for\nstable use and `@v4-alpha` during prerelease evaluation. It resolves the exact\ncalled-workflow SHA, enforces floating selector plus dual-lock consumer\nadmission, and runs the same CLI on Linux, macOS, and Windows. Buildchain\ndogfoods it through the thin\n[`self-build-adopter-dogfood.yml`](../.github/workflows/self-build-adopter-dogfood.yml)\ncaller, which contains no steps or local orchestration and persists only the\nfloating `@v4-alpha` selector.\n\nThe reusable workflow downloads exact public N-1 npm archives and uses the\ncommitted byte roots, semantic identity, and authority readback root. It has\nonly `contents: read`; no provider credential or production writer is accepted\nor synthesized.\n\n## Cross-platform capability qualification\n\nThe reusable workflow also produces a rooted report on `linux-x64`,\n`macos-arm64`, and `windows-x64`. Each report binds `job.workflow_sha`, the\nconsumer source SHA, and the complete 4,648-row v3-to-v4 inventory. Source-only\ncapabilities retain their raw category counts with an `exact-source-route`\napplicability; they are not mislabeled as operating-system executions.\n\nThe executable boundary is exercised rather than inferred: a public run must\npass, a substituted readback must fail, retry must reproduce the original root,\nterminal verification and N-1 bootstrap must pass, and the independent\n`ledger-specification-driver` clean-room test must pass without a KFD package.\nThe workflow then reconciles one exact report from each platform. Final family\nqualification combines the Buildchain self-dogfood and `agent-hub-demo`\nmatrices through the exported\n`@kungfu-tech/buildchain/v4-cross-platform-adopter-qualification` aggregator.\nThe report and aggregate explicitly grant no production, provider, release, or\nstable-publication authority.\n\n## Offline vectors\n\n[`offline-vectors.json`](../contracts/fixtures/v4-adopter-delivery-v1/offline-vectors.json)\nindexes positive driver, N-1, and archive cases plus negative selector, driver,\narchive identity, bootstrap lineage, protocol version, and tampered readback\ncases. Tests synthesize archives locally so extraction and identity failures do\nnot depend on the network."
+      "markdown": "---\nstatus: preview\nperiod: 2026-08-27\ntheme: buildchain-v4-adopter-delivery\ndoc_type: product-manual\nsource_level: local-files\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: self-reviewed\nlast_reviewed: 2026-08-27\nai_provenance:\n  model_family: GPT-5\n  product: Codex\n  generated_at: 2026-08-27\n  visible_context: Exact protected v3 adopter-delivery cut, v4 pure contract core, published npm archive bytes, public consumer policy, complete v3 capability inventory, and rooted cross-platform qualification reports.\n  invisible_context_boundary: No credentials, provider mutations, signing operations, publication operations, or release authority were used.\n---\n\n# V4 Public Adopter Delivery\n\nBuildchain v4 carries the v3 adopter-delivery capability through a public,\nprotocol-neutral boundary. Consumers select an exact protocol driver and\nartifact profile, retain the rooted gate result, and independently recompute\nthat readback. Buildchain does not interpret a protocol owned by another\nproject and a passing result never grants runtime, provider, signing,\npublication, or release authority.\n\nThe parity source is the read-only protected cut\n`dev/v3/v3.0@6b96bdad8d9f8ccf9275f27d9370a226a9c78465`. Work began from the\nminimal v4 absorption base\n`dev/v4/v4.0@e5611377efc03178f8687d99968cfdfa3ce2825b` and absorbed the\nverified protected-base advances through\n`dev/v4/v4.0@e0342713c7447960c13bd73377282b2e93f4853d` before delivery. These\nidentities, the v3 vector-suite root, and the KFD package cut are committed in\n[`v4-adopter-delivery-parity.json`](../architecture/v4-adopter-delivery-parity.json)\nand exposed by the public Node API.\n\n## Public contract\n\nThe JSON input schema is\n[`v4-adopter-delivery-v1.schema.json`](../contracts/v4-adopter-delivery-v1.schema.json).\nAn input names both selectors and the exact request identities. A selector\nwhose implementation identity differs from the request fails closed. The\npublic selectors are `json-assertion`, `kfd-category`, and `legacy-kfd`, with\n`git-commit` and `package` artifact profiles.\n\nApplications can also import the lower-level driver interface from\n`@kungfu-tech/buildchain/adopter-delivery-gate` and define an isolated driver.\nThe v4 convenience runtime, exact source declaration, readback verification,\nN-1 lineage check, and published archive loader are exported from\n`@kungfu-tech/buildchain/v4-adopter-delivery`.\n\n## CLI\n\nAll four operations are offline after the declared archive bytes exist:\n\n```sh\nbuildchain adopter-delivery run \\\n  --input contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json \\\n  --output .buildchain/adopter-delivery/readback.json\n\nbuildchain adopter-delivery verify \\\n  --input contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json \\\n  --readback .buildchain/adopter-delivery/readback.json\n\nbuildchain adopter-delivery bootstrap \\\n  --input contracts/fixtures/v4-adopter-delivery-v1/bootstrap-positive.json\n\nbuildchain adopter-delivery archive \\\n  --input contracts/fixtures/v4-adopter-delivery-v1/archive-template.json\n```\n\n`verify` requires the complete rooted readback and recomputes it. Missing or\nsubstituted readback, unknown selector, unknown driver, protocol-version\nmismatch, archive-byte or package-identity mismatch, and altered bootstrap\nlineage all fail closed.\n\n## N-1 and published archives\n\nN-1 bootstrap is distinct from the candidate. The lineage wrapper requires\nthe exact v3 authority commit, exact v4 absorption base, and exact public\nBuildchain archive root. The retained v3 bootstrap also requires protected and\npublished N-1 authority, rejects self-authorization, binds the candidate gate\nartifact, and requires merged Warrant-shaped evidence. Protocol, profile, or\ngate changes require independently reviewed transition evidence.\n\nPublished authority loading verifies compressed bytes before extraction,\nrejects unsafe paths and links, verifies extracted package identity, verifies\nKFD's semantic package root, and imports only declared public delivery modules.\nThe caller must supply an independently retained authority readback root. The\nfixture binds `@kungfu-tech/buildchain@3.0.9-alpha.16` and\n`@kungfu-tech/kfd@1.0.0-alpha.65`; a package version is not treated as proof of\nthe Git source cut.\n\n## Config and reusable workflow\n\nConsumer configuration is closed and repository-relative:\n\n```toml\n[adopter_delivery]\ncontract = \"kungfu-buildchain-v4-adopter-delivery/v1\"\ninput_path = \"contracts/adopter-delivery/input.json\"\nreadback_path = \".buildchain/adopter-delivery/readback.json\"\nbootstrap_path = \"contracts/adopter-delivery/bootstrap.json\"\narchive_path = \"contracts/adopter-delivery/archives.json\"\nresult_path = \".buildchain/adopter-delivery/result.json\"\ndriver_selector = \"kfd-category\"\nartifact_profile_selector = \"package\"\n```\n\nThe public reusable workflow is\n`kungfu-systems/buildchain/.github/workflows/public-build-adopter-qualification.yml@v4` for\nstable use and `@v4-alpha` during prerelease evaluation. It resolves the exact\ncalled-workflow SHA, enforces floating selector plus dual-lock consumer\nadmission, and runs the same CLI on Linux, macOS, and Windows. Buildchain\ndogfoods it through the thin\n[`self-build-adopter-dogfood.yml`](../.github/workflows/self-build-adopter-dogfood.yml)\ncaller, which contains no steps or local orchestration and persists only the\nfloating `@v4-alpha` selector.\n\nThe reusable workflow downloads exact public N-1 npm archives and uses the\ncommitted byte roots, semantic identity, and authority readback root. It has\nonly `contents: read`; no provider credential or production writer is accepted\nor synthesized.\n\n## Cross-platform capability qualification\n\nThe reusable workflow also produces a rooted report on `linux-x64`,\n`macos-arm64`, and `windows-x64`. Each report binds `job.workflow_sha`, the\nconsumer source SHA, and the complete 4,648-row v3-to-v4 inventory. Source-only\ncapabilities retain their raw category counts with an `exact-source-route`\napplicability; they are not mislabeled as operating-system executions.\n\nThe executable boundary is exercised rather than inferred: a public run must\npass, a substituted readback must fail, retry must reproduce the original root,\nterminal verification and N-1 bootstrap must pass, and the independent\n`ledger-specification-driver` clean-room test must pass without a KFD package.\nThe workflow then reconciles one exact report from each platform. Final family\nqualification combines the Buildchain self-dogfood and `agent-hub-demo`\nmatrices through the exported\n`@kungfu-tech/buildchain/v4-cross-platform-adopter-qualification` aggregator.\nThe report and aggregate explicitly grant no production, provider, release, or\nstable-publication authority.\n\n## Offline vectors\n\n[`offline-vectors.json`](../contracts/fixtures/v4-adopter-delivery-v1/offline-vectors.json)\nindexes positive driver, N-1, and archive cases plus negative selector, driver,\narchive identity, bootstrap lineage, protocol version, and tampered readback\ncases. Tests synthesize archives locally so extraction and identity failures do\nnot depend on the network."
     },
     {
       "id": "manual:v4-canonical-contracts",
@@ -5115,7 +5115,7 @@
       ],
       "maturity": "stable",
       "sourcePath": "docs/v4-stage-capsule.md",
-      "digest": "sha256:0f819b962f661bcaccc38edf2f80235bc709e24dfe0d58bca406b909b47292d3",
+      "digest": "sha256:ded085c619ef98b8205e7a12f92a04c9fbf536b130e856979fb314ffad2f4d4b",
       "headings": [
         {
           "level": 1,
@@ -5153,7 +5153,7 @@
           "anchor": "three-platform-qualification-and-wave-reconciliation"
         }
       ],
-      "markdown": "---\nstatus: draft\nperiod: ongoing\ntheme: buildchain-v4-stage-capsule\ndoc_type: contract-guide\nsource_level: local-files\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: unreviewed\nlast_reviewed: 2026-08-10\nai_provenance:\n  model_family: GPT-5\n  product: Codex\n  generated_at: 2026-08-10\n  invisible_context: not asserted\n---\n\n# Buildchain v4 Stage Capsule\n\n## Platform checkpoint projection\n\n`architecture/v4-platform-stage-checkpoints.json` is the single declaration\nfor the macOS arm64, Linux x64, and Windows x64 shadow checkpoint lanes. It\ndefines the allowed platform/stage pairs and the exact declared inputs,\noutputs, environment names, toolchains, and portable restore paths.\n\nThe protected `Verify` workflow runs each platform on its real hosted runner.\nAfter a declared successful stage, the TypeScript v3 writer emits the canonical\nCapsule and immutable local-store receipt. A separate Node process restores the\ndeclared output layout into an empty directory and verifies every blob and\nmanifest root. A failed stage emits no Capsule; a later failure does not remove\nearlier successful stage Capsules.\n\nThis is shadow evidence only. It records per-platform/stage overhead and asserts\nthat production bytes did not change. It does not skip production stages, read\nambient runner state, include provider credentials, perform signing or\npublication, or grant provider/cache presence qualification authority. The\ngenerated consumer workflow and Agent guidance point back to the same\ndeclaration; undeclared fields fail closed.\n\nA Stage Capsule is the immutable, per-platform evidence contract for one build\nstage. It does not store artifacts, plan resume, publish provider state, or move\nproduction write authority. TypeScript v3 remains the sole writer; Rust is a\npure validation and root-projection implementation.\n\n## Three separate roots\n\nThe contract deliberately keeps three facts separate:\n\n1. `identityRoot` binds source, platform, stage, toolchain, runtime, policy,\n   declared inputs, transformation, output manifest, qualification, and any\n   explicitly declared rooted observations.\n2. `capsuleRoot` binds that immutable identity and the retention promise.\n3. `availabilityRoot` binds a caller-supplied observation of current\n   availability, content, qualification, and rooted transport locators.\n\nChanging platform, stage, policy, transformation, or a declared input changes\nthe identity root. Changing an observation time or transport locator changes\nonly the availability root. A provider run ID, provider artifact ID, runner\npath, credential, ambient clock, raw network observation, mutable tag, or cache\nhit is not a schema field and therefore cannot silently become identity.\nProvider evidence participates only as an explicitly named observation root.\n\n## Retention and reuse\n\nA retention promise is not proof that bytes currently exist. Reuse is a pure\ndecision over an explicit evaluation clock and a current availability\nobservation. It is eligible only when the capsule, output-manifest, and\nqualification roots all match, the observation is `available`, and the\nretention promise has not expired. `missing`, `expired`, `corrupt`, and\n`root-mismatch` always fail closed. Transport locators are rooted observations,\nnot artifact authority.\n\nThe sole schema authority is\n[`v4-stage-capsule-v1.schema.json`](../contracts/v4-stage-capsule-v1.schema.json).\nThe shared fixture is consumed by both implementations. The next Wave 2 cards\nmay add checkpoints, resume planning, and reconciliation, but must not weaken\nor duplicate this contract.\n\n## Content-addressed reference store\n\nThe storage successor adds one closed output-manifest and store contract suite\nwithout changing Capsule identity. Raw blob bytes use lowercase SHA-256 roots;\nthe canonical output manifest binds byte roots, sizes, and sorted names, and its\n`manifestRoot` must equal the Capsule `outputManifestRoot`. The local reference\nstore writes immutable `blobs`, `capsules`, `manifests`, and `records` families\nunder exact roots. A fresh process can restore by `capsuleRoot`, then re-verifies\nthe Capsule, manifest, every byte root, retention state, availability, transport\nobservation, and qualification root before returning bytes.\n\nRepeated put and restore are idempotent. A different physical store directory\ndoes not change Capsule or manifest identity. `missing`, `expired`, `partial`,\n`corrupt`, `quarantined`, and `root-mismatch` are deterministic fail-closed\nclassifications; there is no cache fallback. Retention promise, evaluated\nretention state, current availability, rooted transport locator, qualification,\nand operation receipt are different roots with caller-supplied clocks.\n\nGitHub Artifact and S3-compatible adapters expose only `effect-disabled` and\n`fixture-backed` modes in this slice. They accept rooted locators, never raw\ncredentials or signed URLs, and cannot perform a provider upload or restore.\nThe executable architecture ceiling is\n[`v4-stage-capsule-store-contract.json`](../architecture/v4-stage-capsule-store-contract.json),\nand the shared Rust/JavaScript fixture is\n[`shared.json`](../contracts/fixtures/v4-stage-capsule-store-v1/shared.json).\n\nFocused verification:\n\n```sh\npnpm run check:v4-contracts\n```\n\n## Deterministic resume planning\n\n`architecture/v4-stage-capsule-resume-planner.json` closes the Wave 2 resume\nplanner. Its request is an explicit topological stage graph with targets,\nexpected Capsule identity and retention, current Capsule/availability\nobservations, an evaluation clock, and separately declared provider or\nrelease-tail effects. The Rust domain core and TypeScript projection consume\nthe same request without filesystem, network, environment, or ambient-clock\naccess and produce the same ordered decisions and `planRoot`.\n\nAn eligible completed dependency becomes an exact-root restore; a missing or\ninvalid target becomes a rebuild, and only that target's dependency closure is\nscheduled. Source, platform, toolchain, runtime, policy, declared-input,\ntransformation, output-manifest, and retention changes carry rooted causal\ninvalidation fields. Cross-platform reuse, corrupt or partial content, root\nmismatch, and insufficient qualification reject reuse fail closed.\n\nEffects never participate in Capsule reuse. They remain ordered declarations\nwith required provider readback and planner mutation disabled. This planner is\nshadow-only: it does not skip a v3 production stage or move v3 authority.\n\n## Three-platform qualification and Wave reconciliation\n\n`architecture/v4-stage-capsule-qualification.json` closes the Wave 2\nqualification boundary. Buildchain and external repositories use the same\nBuildchain-owned public reusable workflow,\n`.github/workflows/v4-stage-capsule-canary.yml`. Buildchain's caller is the thin\n`.github/workflows/self-build-public-consumer-dogfood.yml`; it has no steps, copied\norchestration, local action, direct qualification invocation, or private\nconsumer profile. Candidate recursion is resolved only by publishing the exact\ncandidate at `train/v4/v4.0/<capability>` and calling that fully qualified\npublic ref. After successful qualification and protected merge, the caller can\nbe pinned to the exact protected commit. An internal exception is never a\npermitted recursion mechanism.\n\nThe called workflow checks out that same commit as its runtime, reads the consumer's\ntracked `.buildchain/buildchain.toml`, and executes only `install`, `build`,\nand `verify` on GitHub-hosted Linux x64, macOS arm64, and Windows x64 runners.\nEach stage binds its declared command, dependency edge, exact consumer source,\nplatform, lifecycle manifest, summary, and real output roots into the campaign\nprofile. `publish` is explicitly classified as a provider mutation and is not\nexecuted. The caller supplies only its stable consumer name and the real output\npaths; it does not copy the campaign orchestration.\n\nThe external seed retains `install` and `build` before an intentional late\n`verify` failure. A clean process reads the retained store, restores only the\nexact `build` root, rebuilds `verify`, and compares the result with the fresh\nthree-stage aggregate. Runtime-ref, source, command/profile, manifest, summary,\noutput, platform, and Capsule-root drift all stop with typed diagnostics.\n\nQualification compares the declared artifact-manifest and aggregate content\nroots from a fresh full build with the roots assembled from retained and rebuilt\nCapsules. It fails closed on missing, expired, corrupt, partial, cross-platform,\ncross-stage, source/toolchain/policy drift, stale-writer, and root-mismatch\ncampaigns. The rooted report records retained bytes, restore overhead, planner\naccuracy, false reuse, and false rebuild counts. Every invocation declares one\nexact public consumer identity and requires its Linux, macOS, and Windows\nreports before emitting a qualification root. Buildchain declares `buildchain`\nand receives no additional profile or authority.\n\nThe post-merge reconciliation interface accepts that qualification root only\nwith all five Wave 2 children in native terminal state, exact source and\nprotected merge revisions, independent review roots, Delivery Warrant roots,\nnative gate roots, and an empty protected-delivery queue. It emits evidence; it\ndoes not rewrite child authority. `--stage-capsule-mode v3` is the explicit\nnon-destructive rollback switch. No migration, retained-state deletion,\nproduction reuse, provider effect, release effect, or v3 behavior change is\nauthorized by this qualification.\n\nFocused local rehearsal:\n\n```sh\nnode scripts/v4-stage-capsule-qualification.mjs campaign \\\n  --work-root /tmp/buildchain-v4-stage-qualification \\\n  --platform linux-x64 \\\n  --consumer buildchain \\\n  --runtime-ref <exact-buildchain-commit> \\\n  --consumer-source-revision <exact-consumer-commit> \\\n  --consumer-root . \\\n  --lifecycle-evidence-root .buildchain/artifacts/v4-stage-capsule-canary\n```"
+      "markdown": "---\nstatus: draft\nperiod: ongoing\ntheme: buildchain-v4-stage-capsule\ndoc_type: contract-guide\nsource_level: local-files\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: unreviewed\nlast_reviewed: 2026-08-10\nai_provenance:\n  model_family: GPT-5\n  product: Codex\n  generated_at: 2026-08-10\n  invisible_context: not asserted\n---\n\n# Buildchain v4 Stage Capsule\n\n## Platform checkpoint projection\n\n`architecture/v4-platform-stage-checkpoints.json` is the single declaration\nfor the macOS arm64, Linux x64, and Windows x64 shadow checkpoint lanes. It\ndefines the allowed platform/stage pairs and the exact declared inputs,\noutputs, environment names, toolchains, and portable restore paths.\n\nThe protected `Verify` workflow runs each platform on its real hosted runner.\nAfter a declared successful stage, the TypeScript v3 writer emits the canonical\nCapsule and immutable local-store receipt. A separate Node process restores the\ndeclared output layout into an empty directory and verifies every blob and\nmanifest root. A failed stage emits no Capsule; a later failure does not remove\nearlier successful stage Capsules.\n\nThis is shadow evidence only. It records per-platform/stage overhead and asserts\nthat production bytes did not change. It does not skip production stages, read\nambient runner state, include provider credentials, perform signing or\npublication, or grant provider/cache presence qualification authority. The\ngenerated consumer workflow and Agent guidance point back to the same\ndeclaration; undeclared fields fail closed.\n\nA Stage Capsule is the immutable, per-platform evidence contract for one build\nstage. It does not store artifacts, plan resume, publish provider state, or move\nproduction write authority. TypeScript v3 remains the sole writer; Rust is a\npure validation and root-projection implementation.\n\n## Three separate roots\n\nThe contract deliberately keeps three facts separate:\n\n1. `identityRoot` binds source, platform, stage, toolchain, runtime, policy,\n   declared inputs, transformation, output manifest, qualification, and any\n   explicitly declared rooted observations.\n2. `capsuleRoot` binds that immutable identity and the retention promise.\n3. `availabilityRoot` binds a caller-supplied observation of current\n   availability, content, qualification, and rooted transport locators.\n\nChanging platform, stage, policy, transformation, or a declared input changes\nthe identity root. Changing an observation time or transport locator changes\nonly the availability root. A provider run ID, provider artifact ID, runner\npath, credential, ambient clock, raw network observation, mutable tag, or cache\nhit is not a schema field and therefore cannot silently become identity.\nProvider evidence participates only as an explicitly named observation root.\n\n## Retention and reuse\n\nA retention promise is not proof that bytes currently exist. Reuse is a pure\ndecision over an explicit evaluation clock and a current availability\nobservation. It is eligible only when the capsule, output-manifest, and\nqualification roots all match, the observation is `available`, and the\nretention promise has not expired. `missing`, `expired`, `corrupt`, and\n`root-mismatch` always fail closed. Transport locators are rooted observations,\nnot artifact authority.\n\nThe sole schema authority is\n[`v4-stage-capsule-v1.schema.json`](../contracts/v4-stage-capsule-v1.schema.json).\nThe shared fixture is consumed by both implementations. The next Wave 2 cards\nmay add checkpoints, resume planning, and reconciliation, but must not weaken\nor duplicate this contract.\n\n## Content-addressed reference store\n\nThe storage successor adds one closed output-manifest and store contract suite\nwithout changing Capsule identity. Raw blob bytes use lowercase SHA-256 roots;\nthe canonical output manifest binds byte roots, sizes, and sorted names, and its\n`manifestRoot` must equal the Capsule `outputManifestRoot`. The local reference\nstore writes immutable `blobs`, `capsules`, `manifests`, and `records` families\nunder exact roots. A fresh process can restore by `capsuleRoot`, then re-verifies\nthe Capsule, manifest, every byte root, retention state, availability, transport\nobservation, and qualification root before returning bytes.\n\nRepeated put and restore are idempotent. A different physical store directory\ndoes not change Capsule or manifest identity. `missing`, `expired`, `partial`,\n`corrupt`, `quarantined`, and `root-mismatch` are deterministic fail-closed\nclassifications; there is no cache fallback. Retention promise, evaluated\nretention state, current availability, rooted transport locator, qualification,\nand operation receipt are different roots with caller-supplied clocks.\n\nGitHub Artifact and S3-compatible adapters expose only `effect-disabled` and\n`fixture-backed` modes in this slice. They accept rooted locators, never raw\ncredentials or signed URLs, and cannot perform a provider upload or restore.\nThe executable architecture ceiling is\n[`v4-stage-capsule-store-contract.json`](../architecture/v4-stage-capsule-store-contract.json),\nand the shared Rust/JavaScript fixture is\n[`shared.json`](../contracts/fixtures/v4-stage-capsule-store-v1/shared.json).\n\nFocused verification:\n\n```sh\npnpm run check:v4-contracts\n```\n\n## Deterministic resume planning\n\n`architecture/v4-stage-capsule-resume-planner.json` closes the Wave 2 resume\nplanner. Its request is an explicit topological stage graph with targets,\nexpected Capsule identity and retention, current Capsule/availability\nobservations, an evaluation clock, and separately declared provider or\nrelease-tail effects. The Rust domain core and TypeScript projection consume\nthe same request without filesystem, network, environment, or ambient-clock\naccess and produce the same ordered decisions and `planRoot`.\n\nAn eligible completed dependency becomes an exact-root restore; a missing or\ninvalid target becomes a rebuild, and only that target's dependency closure is\nscheduled. Source, platform, toolchain, runtime, policy, declared-input,\ntransformation, output-manifest, and retention changes carry rooted causal\ninvalidation fields. Cross-platform reuse, corrupt or partial content, root\nmismatch, and insufficient qualification reject reuse fail closed.\n\nEffects never participate in Capsule reuse. They remain ordered declarations\nwith required provider readback and planner mutation disabled. This planner is\nshadow-only: it does not skip a v3 production stage or move v3 authority.\n\n## Three-platform qualification and Wave reconciliation\n\n`architecture/v4-stage-capsule-qualification.json` closes the Wave 2\nqualification boundary. Buildchain and external repositories use the same\nBuildchain-owned public reusable workflow,\n`.github/workflows/public-build-stage-capsule-canary.yml`. Buildchain's caller is the thin\n`.github/workflows/self-build-public-consumer-dogfood.yml`; it has no steps, copied\norchestration, local action, direct qualification invocation, or private\nconsumer profile. Candidate recursion is resolved only by publishing the exact\ncandidate at `train/v4/v4.0/<capability>` and calling that fully qualified\npublic ref. After successful qualification and protected merge, the caller can\nbe pinned to the exact protected commit. An internal exception is never a\npermitted recursion mechanism.\n\nThe called workflow checks out that same commit as its runtime, reads the consumer's\ntracked `.buildchain/buildchain.toml`, and executes only `install`, `build`,\nand `verify` on GitHub-hosted Linux x64, macOS arm64, and Windows x64 runners.\nEach stage binds its declared command, dependency edge, exact consumer source,\nplatform, lifecycle manifest, summary, and real output roots into the campaign\nprofile. `publish` is explicitly classified as a provider mutation and is not\nexecuted. The caller supplies only its stable consumer name and the real output\npaths; it does not copy the campaign orchestration.\n\nThe external seed retains `install` and `build` before an intentional late\n`verify` failure. A clean process reads the retained store, restores only the\nexact `build` root, rebuilds `verify`, and compares the result with the fresh\nthree-stage aggregate. Runtime-ref, source, command/profile, manifest, summary,\noutput, platform, and Capsule-root drift all stop with typed diagnostics.\n\nQualification compares the declared artifact-manifest and aggregate content\nroots from a fresh full build with the roots assembled from retained and rebuilt\nCapsules. It fails closed on missing, expired, corrupt, partial, cross-platform,\ncross-stage, source/toolchain/policy drift, stale-writer, and root-mismatch\ncampaigns. The rooted report records retained bytes, restore overhead, planner\naccuracy, false reuse, and false rebuild counts. Every invocation declares one\nexact public consumer identity and requires its Linux, macOS, and Windows\nreports before emitting a qualification root. Buildchain declares `buildchain`\nand receives no additional profile or authority.\n\nThe post-merge reconciliation interface accepts that qualification root only\nwith all five Wave 2 children in native terminal state, exact source and\nprotected merge revisions, independent review roots, Delivery Warrant roots,\nnative gate roots, and an empty protected-delivery queue. It emits evidence; it\ndoes not rewrite child authority. `--stage-capsule-mode v3` is the explicit\nnon-destructive rollback switch. No migration, retained-state deletion,\nproduction reuse, provider effect, release effect, or v3 behavior change is\nauthorized by this qualification.\n\nFocused local rehearsal:\n\n```sh\nnode scripts/v4-stage-capsule-qualification.mjs campaign \\\n  --work-root /tmp/buildchain-v4-stage-qualification \\\n  --platform linux-x64 \\\n  --consumer buildchain \\\n  --runtime-ref <exact-buildchain-commit> \\\n  --consumer-source-revision <exact-consumer-commit> \\\n  --consumer-root . \\\n  --lifecycle-evidence-root .buildchain/artifacts/v4-stage-capsule-canary\n```"
     },
     {
       "id": "manual:v4-tail-reseal",
@@ -5166,7 +5166,7 @@
       ],
       "maturity": "stable",
       "sourcePath": "docs/v4-tail-reseal.md",
-      "digest": "sha256:953e44c0159e342133dbd58cd69f447dde9a787528b78486ff0bc791b795e9b1",
+      "digest": "sha256:18408576d4790e1eb8304eb1f26d85a4ba4c4d3a5cfb1077d03d80d569e69c1c",
       "headings": [
         {
           "level": 1,
@@ -5189,7 +5189,7 @@
           "anchor": "reusable-workflow"
         }
       ],
-      "markdown": "# V4 retained-candidate tail reseal\n\nBuildchain v4 can recover one narrowly defined late Alpha failure without\nrebuilding a qualified four-platform candidate. The recovery is not a cache hit\nand does not give Stage Capsule any provider authority. It is a fresh governed\nrun that proves all retained bytes first, then executes only the explicitly\nfenced macOS signing-finalization tail.\n\nThe authoritative request schema is\n[`contracts/v4-tail-reseal-v1.schema.json`](../contracts/v4-tail-reseal-v1.schema.json).\nIt binds the failed run and source tree, four payload and manifest archive\ndigests, four content roots, Stage Capsule roots and reuse decisions, Warrant\nlineage, retention, credential authority, signing delegation/result, release\ntail transaction, idempotency key, and independent provider readbacks. Any\nmismatch rejects reuse and requires a normal candidate build.\n\n## Authority boundary\n\n- `install`, `build`, `verify`, `package`, and the ordinary platform matrix are\n  skipped only when all 16 per-platform Stage Capsule decisions prove exact\n  reuse. Capsule reuse has no external effects.\n- Only `macos-arm64:signing-finalization` may change payload bytes. The public\n  workflow verifies the retained macOS bytes before the effect and verifies the\n  resealed bytes plus signing and release-tail readbacks afterward.\n- The signing token exists only in the macOS credential-island step. It is not\n  stored in a Capsule, request, artifact, log, Passport, or receipt.\n- A successful run emits the existing\n  `kungfu-buildchain-release-candidate-passport` contract. Tail reseal does not\n  create a second candidate or release artifact class.\n- Durable callers use `@v4-alpha` during Alpha evaluation or `@v4` after stable\n  promotion. Exact SHAs are runtime evidence from `job.workflow_sha`, never a\n  persisted selector.\n\n## CLI and Node API\n\nPlan locally from the deterministic data contract:\n\n```sh\nbuildchain tail-reseal plan \\\n  --request .buildchain/tail-reseal/request.json \\\n  --output .buildchain/tail-reseal/plan.json\n```\n\n`tail-reseal admit` performs the provider readback of the exact failed run,\njobs, retained GitHub artifact archives, and signing-authority result. Each\nfresh platform runner then uses `verify-platform --mode retained`. Only the\nmacOS runner may follow with `--mode resealed --provider-readback-root ...`.\nAfter the ordinary Release Candidate Passport is generated, `tail-reseal seal`\nbinds all four readbacks and the protected Warrant readback into the final\nreceipt.\n\nThe Node exports are `@kungfu-tech/buildchain/v4-tail-reseal` for request and\nplan logic and `@kungfu-tech/buildchain/v4-tail-reseal-receipt` for terminal\nreceipt creation and verification.\n\n## Reusable workflow\n\nConsumers invoke\n`kungfu-systems/buildchain/.github/workflows/v4-tail-reseal.yml@v4-alpha` from a\ntrusted, same-repository workflow. The caller supplies the rooted request, the\noriginal candidate consumer-policy receipt, a reviewed macOS finalization\ncommand, and the explicitly named signing secret. The command must write:\n\n- `.buildchain/tail-reseal/signing-provider-readback.json`\n- `.buildchain/tail-reseal/release-tail-provider-readback.json`\n\nTheir byte digests must equal the roots fixed in the request. The workflow\ndownloads the signing result by exact authority repository, run, artifact name,\nand archive digest; no credential or provider effect is replayed from a Stage\nCapsule.\n\nThe v3-to-v4 invariant mapping is recorded in\n[`architecture/v4-tail-reseal-parity.json`](../architecture/v4-tail-reseal-parity.json)."
+      "markdown": "# V4 retained-candidate tail reseal\n\nBuildchain v4 can recover one narrowly defined late Alpha failure without\nrebuilding a qualified four-platform candidate. The recovery is not a cache hit\nand does not give Stage Capsule any provider authority. It is a fresh governed\nrun that proves all retained bytes first, then executes only the explicitly\nfenced macOS signing-finalization tail.\n\nThe authoritative request schema is\n[`contracts/v4-tail-reseal-v1.schema.json`](../contracts/v4-tail-reseal-v1.schema.json).\nIt binds the failed run and source tree, four payload and manifest archive\ndigests, four content roots, Stage Capsule roots and reuse decisions, Warrant\nlineage, retention, credential authority, signing delegation/result, release\ntail transaction, idempotency key, and independent provider readbacks. Any\nmismatch rejects reuse and requires a normal candidate build.\n\n## Authority boundary\n\n- `install`, `build`, `verify`, `package`, and the ordinary platform matrix are\n  skipped only when all 16 per-platform Stage Capsule decisions prove exact\n  reuse. Capsule reuse has no external effects.\n- Only `macos-arm64:signing-finalization` may change payload bytes. The public\n  workflow verifies the retained macOS bytes before the effect and verifies the\n  resealed bytes plus signing and release-tail readbacks afterward.\n- The signing token exists only in the macOS credential-island step. It is not\n  stored in a Capsule, request, artifact, log, Passport, or receipt.\n- A successful run emits the existing\n  `kungfu-buildchain-release-candidate-passport` contract. Tail reseal does not\n  create a second candidate or release artifact class.\n- Durable callers use `@v4-alpha` during Alpha evaluation or `@v4` after stable\n  promotion. Exact SHAs are runtime evidence from `job.workflow_sha`, never a\n  persisted selector.\n\n## CLI and Node API\n\nPlan locally from the deterministic data contract:\n\n```sh\nbuildchain tail-reseal plan \\\n  --request .buildchain/tail-reseal/request.json \\\n  --output .buildchain/tail-reseal/plan.json\n```\n\n`tail-reseal admit` performs the provider readback of the exact failed run,\njobs, retained GitHub artifact archives, and signing-authority result. Each\nfresh platform runner then uses `verify-platform --mode retained`. Only the\nmacOS runner may follow with `--mode resealed --provider-readback-root ...`.\nAfter the ordinary Release Candidate Passport is generated, `tail-reseal seal`\nbinds all four readbacks and the protected Warrant readback into the final\nreceipt.\n\nThe Node exports are `@kungfu-tech/buildchain/v4-tail-reseal` for request and\nplan logic and `@kungfu-tech/buildchain/v4-tail-reseal-receipt` for terminal\nreceipt creation and verification.\n\n## Reusable workflow\n\nConsumers invoke\n`kungfu-systems/buildchain/.github/workflows/public-ops-tail-reseal.yml@v4-alpha` from a\ntrusted, same-repository workflow. The caller supplies the rooted request, the\noriginal candidate consumer-policy receipt, a reviewed macOS finalization\ncommand, and the explicitly named signing secret. The command must write:\n\n- `.buildchain/tail-reseal/signing-provider-readback.json`\n- `.buildchain/tail-reseal/release-tail-provider-readback.json`\n\nTheir byte digests must equal the roots fixed in the request. The workflow\ndownloads the signing result by exact authority repository, run, artifact name,\nand archive digest; no credential or provider effect is replayed from a Stage\nCapsule.\n\nThe v3-to-v4 invariant mapping is recorded in\n[`architecture/v4-tail-reseal-parity.json`](../architecture/v4-tail-reseal-parity.json)."
     },
     {
       "id": "manual:versioning",
@@ -5375,7 +5375,7 @@
       ],
       "maturity": "stable",
       "sourcePath": "docs/workflow-catalog.md",
-      "digest": "sha256:84b15bda46df9ab7d2c1b1e728a2c6fbd2a82b7feac5d3fcf86b6f00442b81ba",
+      "digest": "sha256:9df59b9e315512c070a86b7b65650cb6da11fa3878b0e272254a736d9b670eb5",
       "headings": [
         {
           "level": 1,
@@ -5413,7 +5413,48 @@
           "anchor": "self"
         }
       ],
-      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: workflow-taxonomy\ndoc_type: technical-reference\nsource_level: local-files\nconfidence: high\nsensitivity: public\nevidence_grade: B\nreview_state: unreviewed\nlast_reviewed: 2026-09-05\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-05\n  visible_context: Repository workflow source and the approved naming scheme\n  invisible_context_boundary: No credentials or unpublished provider configuration inspected\n---\n\n# Workflow catalog\n\nGenerated from `architecture/workflow-taxonomy.json`; edit that source, then run\n`pnpm run generate:workflows`. Every YAML file, including compatibility paths,\nis checked by the existing required workflow check.\n\n## Naming and ownership\n\n`public-<build|release|ops>-<purpose>.yml` is a consumer entry;\n`.<build|release|ops>-<purpose>.yml` is an advanced component;\n`self-<build|release|ops>-<purpose>.yml` is Buildchain's own automation.\nPublic is a product role, not GitHub access control. Dispatch services are\nmarked separately from reusable workflows. Keep workflow names, job IDs,\npermissions, and trigger semantics stable during path migration.\n\n## Channel rollout\n\nCanonical names become callable on a channel only after that channel publishes\nthem. Existing `@v4`/`@v4-alpha` consumers keep their exact registered legacy\npaths until provider readback proves canonical availability. New examples below\ndescribe the target surface, not a claim that both channels already publish it.\nCompatibility files are generated byte-identical projections, not independently\neditable implementations. They retain full jobs to preserve called-workflow\nidentity, permission envelopes, and required check names without extra nesting.\n\nThe controller registry records the actual source path separately from a migrated\nrepository controller contractPath. This preserves the established logical\ncontract identity while exposing its current execution source. New workflows\ndo not acquire historical identities. Public controllers retain their real\ncompatibility paths while those paths remain supported.\n\n## Adding or changing a workflow\n\nRegister a stable identity, role, category, purpose, owner, lifecycle status,\ninvocation and concrete summary before creating its derived path. A new entry\nmust explain its scope in review. New aliases cannot be invented: compatibility\nmust name an exact migration source with a reason and removal condition.\nThe policy, generator, checker, tests, required CI chain and CODEOWNERS require\nindependent `kungfu-origin` review. No wildcard compatibility admission is allowed.\n\nA role, category or implementation edit must preserve or deliberately update\nall related declarations. Run `pnpm run generate:workflows` and\n`pnpm run check:workflows`; the full `pnpm run check` remains required.\n\n## public\n\n| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |\n| --- | --- | --- | --- | --- | --- |\n| [public-build-adopter-qualification.yml](../.github/workflows/public-build-adopter-qualification.yml) | build | reusable | active | V4 Adopter Delivery | `v4-adopter-delivery.yml` |\n| [public-build-candidate.yml](../.github/workflows/public-build-candidate.yml) | build | reusable | active | Buildchain Channel Build | `build.yml` |\n| [public-build-check.yml](../.github/workflows/public-build-check.yml) | build | reusable | active | Buildchain Check | `check.yml` |\n| [public-build-demo.yml](../.github/workflows/public-build-demo.yml) | build | reusable | active | Buildchain Declarative Binary Auditable Demo | `.declarative-auditable-demo.yml` |\n| [public-build-publication.yml](../.github/workflows/public-build-publication.yml) | build | reusable | active | Buildchain Publication Artifact | `publication-artifact.yml` |\n| [public-build-stage-capsule-canary.yml](../.github/workflows/public-build-stage-capsule-canary.yml) | build | reusable | active | V4 Stage Capsule Canary | `v4-stage-capsule-canary.yml` |\n| [public-ops-alpha-candidate-patrol.yml](../.github/workflows/public-ops-alpha-candidate-patrol.yml) | ops | reusable | active | Buildchain Dev to Alpha Candidate Patrol | `dev-alpha-candidate-patrol.yml` |\n| [public-ops-bootstrap-recovery.yml](../.github/workflows/public-ops-bootstrap-recovery.yml) | ops | reusable | active | Universal Buildchain Bootstrap Recovery | `universal-bootstrap-recovery.yml` |\n| [public-ops-bootstrap.yml](../.github/workflows/public-ops-bootstrap.yml) | ops | reusable | active | Buildchain Universal Bootstrap | `bootstrap.yml` |\n| [public-ops-dev-auto-merge.yml](../.github/workflows/public-ops-dev-auto-merge.yml) | ops | reusable | active | Dev PR Auto Merge | `dev-pr-auto-merge.yml` |\n| [public-ops-dev-qualification-patrol.yml](../.github/workflows/public-ops-dev-qualification-patrol.yml) | ops | reusable | active | Buildchain Dev Qualification Patrol | `dev-qualification-patrol.yml` |\n| [public-ops-housekeeping.yml](../.github/workflows/public-ops-housekeeping.yml) | ops | reusable | active | Engineering Housekeeper | `engineering-housekeeper.yml` |\n| [public-ops-observed-evidence.yml](../.github/workflows/public-ops-observed-evidence.yml) | ops | reusable | active | Patrol Observed Evidence | `patrol-observed-evidence.yml` |\n| [public-ops-patrol-daily.yml](../.github/workflows/public-ops-patrol-daily.yml) | ops | reusable | active | Buildchain Patrol Daily | `patrol-daily.yml` |\n| [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly | `patrol-monthly.yml` |\n| [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly | `patrol-weekly.yml` |\n| [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol | `buildchain-patrol.yml` |\n| [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile | `release-governance-reconcile.yml` |\n| [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol | `stable-candidate-patrol.yml` |\n| [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal | `v4-tail-reseal.yml` |\n| [public-ops-warrant-cancel.yml](../.github/workflows/public-ops-warrant-cancel.yml) | ops | reusable | active | Dev Delivery Warrant Queued Candidate Cancel | `dev-delivery-warrant-cancel.yml` |\n| [public-ops-warrant-close.yml](../.github/workflows/public-ops-warrant-close.yml) | ops | reusable | active | Dev Delivery Warrant Close | `dev-delivery-warrant-close.yml` |\n| [public-release-artifact-attestation.yml](../.github/workflows/public-release-artifact-attestation.yml) | release | reusable | active | Buildchain GitHub Artifact Attestation | `github-artifact-attestation.yml` |\n| [public-release-paper-sealed.yml](../.github/workflows/public-release-paper-sealed.yml) | release | reusable | active | Buildchain Sealed Paper Release | `paper-release-sealed.yml` |\n| [public-release-paper.yml](../.github/workflows/public-release-paper.yml) | release | reusable | active | Buildchain Paper Release | `paper-release.yml` |\n| [public-release-promote.yml](../.github/workflows/public-release-promote.yml) | release | reusable | active | Release Candidate Promote | `release-candidate-promote.yml` |\n| [public-release-propagation.yml](../.github/workflows/public-release-propagation.yml) | release | reusable | active | Release Propagation | `release-propagation.yml` |\n| [public-release-signing-authority.yml](../.github/workflows/public-release-signing-authority.yml) | release | dispatch-service | active | Buildchain Artifact Signing Authority | `artifact-signing-authority.yml` |\n| [public-release-tail.yml](../.github/workflows/public-release-tail.yml) | release | reusable | active | Declarative Release Tail | `release-tail.yml` |\n| [public-release-web.yml](../.github/workflows/public-release-web.yml) | release | reusable | active | Buildchain Web Surface | `.web-surface.yml` |\n\n## component\n\n| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |\n| --- | --- | --- | --- | --- | --- |\n| [.build-demo-adapter.yml](../.github/workflows/.build-demo-adapter.yml) | build | reusable | active | Buildchain Auditable Demo | `.auditable-demo.yml` |\n| [.build-engine.yml](../.github/workflows/.build-engine.yml) | build | reusable | active | Buildchain Build | `.build.yml` |\n| [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile | `.gate-profile.yml` |\n| [.build-release-verify-compat.yml](../.github/workflows/.build-release-verify-compat.yml) | build | reusable | compatibility | release verify | `.release-verify.yml` |\n| [.build-sam-verify-compat.yml](../.github/workflows/.build-sam-verify-compat.yml) | build | reusable | compatibility | sam verify | `.sam-verify.yml` |\n| [.build-wheel-verify-compat.yml](../.github/workflows/.build-wheel-verify-compat.yml) | build | reusable | compatibility | wheel verify | `.wheel-verify.yml` |\n| [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git | `.sync-remote-git.yml` |\n| [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority | `.publication-authority.yml` |\n| [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets | `.binary-release-assets.yml` |\n| [.release-minor-bump-compat.yml](../.github/workflows/.release-minor-bump-compat.yml) | release | reusable | compatibility | bump minor version | `.bump-minor-version.yml` |\n| [.release-page-sync-retired.yml](../.github/workflows/.release-page-sync-retired.yml) | release | reusable | retired | sync release page | `.sync-release-page.yml` |\n| [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced | `.release-candidate-promote.yml` |\n\n## self\n\n| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |\n| --- | --- | --- | --- | --- | --- |\n| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood | — |\n| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood | — |\n| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution | — |\n| [self-build-candidate-lab.yml](../.github/workflows/self-build-candidate-lab.yml) | build | repository | active | Candidate Lab | — |\n| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood | — |\n| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification | — |\n| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture | — |\n| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood | — |\n| [self-build-release-verify-compat.yml](../.github/workflows/self-build-release-verify-compat.yml) | build | repository | compatibility | Release - Verify | — |\n| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification | — |\n| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify | — |\n| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood | — |\n| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery | — |\n| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit | — |\n| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily | — |\n| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly | — |\n| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly | — |\n| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance | — |\n| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily | — |\n| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly | — |\n| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly | — |\n| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery | — |\n| [self-ops-recovery-failure-dogfood.yml](../.github/workflows/self-ops-recovery-failure-dogfood.yml) | ops | repository | active | Buildchain Candidate Recovery Dogfood Startup Failure | — |\n| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke | — |\n| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol | — |\n| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets | — |\n| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap | — |\n| [self-release-new-version-compat.yml](../.github/workflows/self-release-new-version-compat.yml) | release | repository | compatibility | Release - New Version | — |\n| [self-release-next-development.yml](../.github/workflows/self-release-next-development.yml) | release | repository | active | Next Development Review | — |\n| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package | — |\n| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion | — |\n| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood | — |\n| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood | — |"
+      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: workflow-taxonomy\ndoc_type: technical-reference\nsource_level: local-files\nconfidence: high\nsensitivity: public\nevidence_grade: B\nreview_state: unreviewed\nlast_reviewed: 2026-09-05\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-05\n  visible_context: Repository workflow source and the approved naming scheme\n  invisible_context_boundary: No credentials or unpublished provider configuration inspected\n---\n\n# Workflow catalog\n\nGenerated from `architecture/workflow-taxonomy.json`; edit that source, then run\n`pnpm run generate:workflows`. Every YAML file, including compatibility paths,\nis checked by the existing required workflow check.\n\n## Naming and ownership\n\n`public-<build|release|ops>-<purpose>.yml` is a consumer entry;\n`.<build|release|ops>-<purpose>.yml` is an advanced component;\n`self-<build|release|ops>-<purpose>.yml` is Buildchain's own automation.\nPublic is a product role, not GitHub access control. Dispatch services are\nmarked separately from reusable workflows. Keep workflow names, job IDs,\npermissions, and trigger semantics stable during path migration.\n\n## Channel rollout\n\nCanonical names become callable on a channel only after that channel publishes\nthem. Existing `@v4`/`@v4-alpha` consumers keep their exact registered legacy\npaths until provider readback proves canonical availability. New examples below\ndescribe the target surface, not a claim that both channels already publish it.\nCompatibility files are generated byte-identical projections, not independently\neditable implementations. They retain full jobs to preserve called-workflow\nidentity, permission envelopes, and required check names without extra nesting.\n\nThe controller registry records the actual source path separately from a migrated\nrepository controller contractPath. This preserves the established logical\ncontract identity while exposing its current execution source. New workflows\ndo not acquire historical identities. Public controllers retain their real\ncompatibility paths while those paths remain supported.\n\n## Adding or changing a workflow\n\nRegister a stable identity, role, category, purpose, owner, lifecycle status,\ninvocation and concrete summary before creating its derived path. A new entry\nmust explain its scope in review. New aliases cannot be invented: compatibility\nmust name an exact migration source with a reason and removal condition.\nThe policy, generator, checker, tests, required CI chain and CODEOWNERS require\nindependent `kungfu-origin` review. No wildcard compatibility admission is allowed.\nWorkflow filenames cannot contain version tokens such as `v4` or `v5`.\nRetired aliases cannot be recreated or called; see [path migration](workflow-path-migration.md).\n\nA role, category or implementation edit must preserve or deliberately update\nall related declarations. Run `pnpm run generate:workflows` and\n`pnpm run check:workflows`; the full `pnpm run check` remains required.\n\n## public\n\n| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |\n| --- | --- | --- | --- | --- | --- |\n| [public-build-adopter-qualification.yml](../.github/workflows/public-build-adopter-qualification.yml) | build | reusable | active | V4 Adopter Delivery | — |\n| [public-build-candidate.yml](../.github/workflows/public-build-candidate.yml) | build | reusable | active | Buildchain Channel Build | `build.yml` |\n| [public-build-check.yml](../.github/workflows/public-build-check.yml) | build | reusable | active | Buildchain Check | `check.yml` |\n| [public-build-demo.yml](../.github/workflows/public-build-demo.yml) | build | reusable | active | Buildchain Declarative Binary Auditable Demo | `.declarative-auditable-demo.yml` |\n| [public-build-publication.yml](../.github/workflows/public-build-publication.yml) | build | reusable | active | Buildchain Publication Artifact | `publication-artifact.yml` |\n| [public-build-stage-capsule-canary.yml](../.github/workflows/public-build-stage-capsule-canary.yml) | build | reusable | active | V4 Stage Capsule Canary | — |\n| [public-ops-alpha-candidate-patrol.yml](../.github/workflows/public-ops-alpha-candidate-patrol.yml) | ops | reusable | active | Buildchain Dev to Alpha Candidate Patrol | `dev-alpha-candidate-patrol.yml` |\n| [public-ops-bootstrap-recovery.yml](../.github/workflows/public-ops-bootstrap-recovery.yml) | ops | reusable | active | Universal Buildchain Bootstrap Recovery | `universal-bootstrap-recovery.yml` |\n| [public-ops-bootstrap.yml](../.github/workflows/public-ops-bootstrap.yml) | ops | reusable | active | Buildchain Universal Bootstrap | `bootstrap.yml` |\n| [public-ops-dev-auto-merge.yml](../.github/workflows/public-ops-dev-auto-merge.yml) | ops | reusable | active | Dev PR Auto Merge | `dev-pr-auto-merge.yml` |\n| [public-ops-dev-qualification-patrol.yml](../.github/workflows/public-ops-dev-qualification-patrol.yml) | ops | reusable | active | Buildchain Dev Qualification Patrol | `dev-qualification-patrol.yml` |\n| [public-ops-housekeeping.yml](../.github/workflows/public-ops-housekeeping.yml) | ops | reusable | active | Engineering Housekeeper | `engineering-housekeeper.yml` |\n| [public-ops-observed-evidence.yml](../.github/workflows/public-ops-observed-evidence.yml) | ops | reusable | active | Patrol Observed Evidence | `patrol-observed-evidence.yml` |\n| [public-ops-patrol-daily.yml](../.github/workflows/public-ops-patrol-daily.yml) | ops | reusable | active | Buildchain Patrol Daily | `patrol-daily.yml` |\n| [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly | `patrol-monthly.yml` |\n| [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly | `patrol-weekly.yml` |\n| [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol | `buildchain-patrol.yml` |\n| [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile | `release-governance-reconcile.yml` |\n| [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol | `stable-candidate-patrol.yml` |\n| [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal | — |\n| [public-ops-warrant-cancel.yml](../.github/workflows/public-ops-warrant-cancel.yml) | ops | reusable | active | Dev Delivery Warrant Queued Candidate Cancel | `dev-delivery-warrant-cancel.yml` |\n| [public-ops-warrant-close.yml](../.github/workflows/public-ops-warrant-close.yml) | ops | reusable | active | Dev Delivery Warrant Close | `dev-delivery-warrant-close.yml` |\n| [public-release-artifact-attestation.yml](../.github/workflows/public-release-artifact-attestation.yml) | release | reusable | active | Buildchain GitHub Artifact Attestation | `github-artifact-attestation.yml` |\n| [public-release-paper-sealed.yml](../.github/workflows/public-release-paper-sealed.yml) | release | reusable | active | Buildchain Sealed Paper Release | `paper-release-sealed.yml` |\n| [public-release-paper.yml](../.github/workflows/public-release-paper.yml) | release | reusable | active | Buildchain Paper Release | `paper-release.yml` |\n| [public-release-promote.yml](../.github/workflows/public-release-promote.yml) | release | reusable | active | Release Candidate Promote | `release-candidate-promote.yml` |\n| [public-release-propagation.yml](../.github/workflows/public-release-propagation.yml) | release | reusable | active | Release Propagation | `release-propagation.yml` |\n| [public-release-signing-authority.yml](../.github/workflows/public-release-signing-authority.yml) | release | dispatch-service | active | Buildchain Artifact Signing Authority | `artifact-signing-authority.yml` |\n| [public-release-tail.yml](../.github/workflows/public-release-tail.yml) | release | reusable | active | Declarative Release Tail | `release-tail.yml` |\n| [public-release-web.yml](../.github/workflows/public-release-web.yml) | release | reusable | active | Buildchain Web Surface | `.web-surface.yml` |\n\n## component\n\n| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |\n| --- | --- | --- | --- | --- | --- |\n| [.build-demo-adapter.yml](../.github/workflows/.build-demo-adapter.yml) | build | reusable | active | Buildchain Auditable Demo | `.auditable-demo.yml` |\n| [.build-engine.yml](../.github/workflows/.build-engine.yml) | build | reusable | active | Buildchain Build | `.build.yml` |\n| [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile | `.gate-profile.yml` |\n| [.build-release-verify-compat.yml](../.github/workflows/.build-release-verify-compat.yml) | build | reusable | compatibility | release verify | `.release-verify.yml` |\n| [.build-sam-verify-compat.yml](../.github/workflows/.build-sam-verify-compat.yml) | build | reusable | compatibility | sam verify | `.sam-verify.yml` |\n| [.build-wheel-verify-compat.yml](../.github/workflows/.build-wheel-verify-compat.yml) | build | reusable | compatibility | wheel verify | `.wheel-verify.yml` |\n| [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git | `.sync-remote-git.yml` |\n| [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority | `.publication-authority.yml` |\n| [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets | `.binary-release-assets.yml` |\n| [.release-minor-bump-compat.yml](../.github/workflows/.release-minor-bump-compat.yml) | release | reusable | compatibility | bump minor version | `.bump-minor-version.yml` |\n| [.release-page-sync-retired.yml](../.github/workflows/.release-page-sync-retired.yml) | release | reusable | retired | sync release page | `.sync-release-page.yml` |\n| [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced | `.release-candidate-promote.yml` |\n\n## self\n\n| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |\n| --- | --- | --- | --- | --- | --- |\n| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood | — |\n| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood | — |\n| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution | — |\n| [self-build-candidate-lab.yml](../.github/workflows/self-build-candidate-lab.yml) | build | repository | active | Candidate Lab | — |\n| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood | — |\n| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification | — |\n| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture | — |\n| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood | — |\n| [self-build-release-verify-compat.yml](../.github/workflows/self-build-release-verify-compat.yml) | build | repository | compatibility | Release - Verify | — |\n| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification | — |\n| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify | — |\n| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood | — |\n| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery | — |\n| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit | — |\n| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily | — |\n| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly | — |\n| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly | — |\n| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance | — |\n| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily | — |\n| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly | — |\n| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly | — |\n| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery | — |\n| [self-ops-recovery-failure-dogfood.yml](../.github/workflows/self-ops-recovery-failure-dogfood.yml) | ops | repository | active | Buildchain Candidate Recovery Dogfood Startup Failure | — |\n| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke | — |\n| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol | — |\n| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets | — |\n| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap | — |\n| [self-release-new-version-compat.yml](../.github/workflows/self-release-new-version-compat.yml) | release | repository | compatibility | Release - New Version | — |\n| [self-release-next-development.yml](../.github/workflows/self-release-next-development.yml) | release | repository | active | Next Development Review | — |\n| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package | — |\n| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion | — |\n| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood | — |\n| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood | — |"
+    },
+    {
+      "id": "manual:workflow-path-migration",
+      "title": "Version-prefixed workflow path migration",
+      "route": "/docs/workflow-path-migration",
+      "category": "manual",
+      "capabilityGroup": "getting-started",
+      "audience": [
+        "agent"
+      ],
+      "maturity": "stable",
+      "sourcePath": "docs/workflow-path-migration.md",
+      "digest": "sha256:b05e3cab36f1ea6551a20267ddbece6e7ca6d42e13c9109a82b99e4aac43eb83",
+      "headings": [
+        {
+          "level": 1,
+          "title": "Version-prefixed workflow path migration",
+          "anchor": "version-prefixed-workflow-path-migration"
+        },
+        {
+          "level": 2,
+          "title": "Development merge and channel rollout",
+          "anchor": "development-merge-and-channel-rollout"
+        },
+        {
+          "level": 2,
+          "title": "Initial consumer readback",
+          "anchor": "initial-consumer-readback"
+        },
+        {
+          "level": 2,
+          "title": "Rollout evidence as of 2026-09-06",
+          "anchor": "rollout-evidence-as-of-2026-09-06"
+        },
+        {
+          "level": 2,
+          "title": "Recovery",
+          "anchor": "recovery"
+        }
+      ],
+      "markdown": "---\nstatus: draft\nperiod: ongoing\ntheme: workflow-path-migration\ndoc_type: migration-guide\nsource_level: local-files\nconfidence: high\nsensitivity: public\nevidence_grade: B\nreview_state: unreviewed\nlast_reviewed: 2026-09-06\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-05\n  visible_context: Exact GitHub channel refs and workflow files on 23 organization default branches\n  invisible_context_boundary: Other branches, private or unlisted consumers and future floating ref updates were not established by this audit\n---\n\n# Version-prefixed workflow path migration\n\nThis source change retires three filenames. Their reusable capabilities, inputs,\noutputs, jobs and permission envelopes remain at the canonical paths below.\nKeep the existing channel selector and dual contract-lock policy when migrating.\n\n| Retired path | Canonical path |\n| --- | --- |\n| `v4-adopter-delivery.yml` | `public-build-adopter-qualification.yml` |\n| `v4-stage-capsule-canary.yml` | `public-build-stage-capsule-canary.yml` |\n| `v4-tail-reseal.yml` | `public-ops-tail-reseal.yml` |\n\nAll paths are beneath `.github/workflows/`. The taxonomy gate rejects version\nsegments in filenames and calls to version-prefixed Buildchain workflows. An\nexplicit retirement record keeps the original migration identity for historical\nmetrics and frozen facade source; generators resolve that identity to the\ncanonical implementation and cannot recreate the removed file.\n\n## Development merge and channel rollout\n\nThe development change retires these filenames on `dev/v4/v4.0`, updates the\nBuildchain-owned callers, and enforces the canonical paths through generators\nand required checks. Its delivery boundary is the protected development merge.\nExternal-repository migration and stable publication are separate follow-up\nwork and do not block this development merge.\n\nThe published channel boundary still requires the following rollout order:\n\n1. Publish and verify the canonical entries on every affected channel while the\n   old entries remain available. The admission identity must match the actual\n   invoked canonical workflow, rather than its previous filename.\n2. Migrate consumers on their existing floating channels, refresh locks through\n   the supported contract acceptance path if required, and verify real consumer\n   runs. Stable callers remain on stable; alpha callers remain on alpha.\n3. Before publishing the retirement into a channel, recheck its live consumers\n   and resolve any remaining old-path calls. A protected development merge does\n   not by itself establish this channel readiness.\n\n## Initial consumer readback\n\nOn 2026-09-05, all workflow files from 23 accessible `kungfu-systems` repository\n_default branches_ were read at their returned Git revisions. Five calls were\nfound in three repositories. This is a bounded inventory, not evidence that\nunknown or non-default-branch consumers do not exist.\n\n| Repository and observed revision | Caller | Existing selector |\n| --- | --- | --- |\n| Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-adopter-dogfood.yml` | `v4-alpha` |\n| Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-public-consumer-dogfood.yml` | `v4-alpha` |\n| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-adopter-delivery-qualification.yml` | `v4-alpha` |\n| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-stage-capsule-canary.yml` | `v4` |\n| taolu `6dcccdc3bd2c8b1801c7f6decea08ae7877aac2b` | `verify.yml` | `v4-alpha` |\n\nThe initial published channel readback was `v4` at\n`da5e2db8384313e899eace87aea0a1a8e28c0aa8` and `v4-alpha` at\n`dd87f43f7122b41c4ce7f1f6d1888521cc7f892f`. Neither contained the three canonical\nfilenames at that initial readback. The later evidence below records progress\nwithout changing the scope or revisions of that initial inventory.\n\n## Rollout evidence as of 2026-09-06\n\nThe canonical invocation-identity preparation was merged in\n[Buildchain PR 3508](https://github.com/kungfu-systems/buildchain/pull/3508).\nAll three canonical paths are available in the immutable `v4.0.2-alpha.35`\nrelease (`feab078f5d7c9927a3525154003e321700e8ca30`) and the later\n`v4.0.2-alpha.37` release (`f5fa1a4a3e8d83eccee79c077e5f48417760c9df`).\nThe floating `v4-alpha` readback selects alpha.37.\n\n[Taolu PR 30](https://github.com/kungfu-systems/taolu/pull/30) migrated its\nStage Capsule call on `@v4-alpha`, preserving the existing dual locks.\nIts exact source `b3f4c12578d733ff44165ff1acafe131251b8907` passed\n[consumer Verify](https://github.com/kungfu-systems/taolu/actions/runs/33975786413)\non all declared platforms and\n[native delivery](https://github.com/kungfu-systems/taolu/actions/runs/34005576362).\nThe protected dev landing is `7e15123733110ad8ce484241934bbf0ef99fbb45`.\n\nThe stable `v4` readback remains\n`da5e2db8384313e899eace87aea0a1a8e28c0aa8`, which does not contain the canonical\npaths. Stable publication and the agent-hub-demo migration remain **pending**\noutside this development change's completion boundary. The alpha.35\n[Build Surface Fixture](https://github.com/kungfu-systems/buildchain/actions/runs/34005360217)\npassed, but this individual result does not establish complete stable\nqualification or authorize moving the stable channel.\n\n## Recovery\n\nBefore channel retirement, revert consumer changes to the still-available old\npaths if verification fails. After retirement, restore the exact previous\nprovider implementation through a reviewed corrective commit and normal\npublication; do not rewrite immutable release tags or bypass admission checks."
     },
     {
       "id": "fixture:infra-contract-aws-cdk-shaped",

package/dist/site/public-surface-audit.json

@@ -4,9 +4,9 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 117,
-    "workflowCount": 117,
+    "workflowCount": 114,
     "actionCount": 8,
-    "sitePageCount": 86,
+    "sitePageCount": 87,
     "docCommandRefCount": 1050,
     "failureCount": 0
   },
@@ -5026,69 +5026,6 @@
           "terminal-receipt-root"
         ],
         "outputCount": 5
-      },
-      {
-        "id": "v4-adopter-delivery",
-        "path": ".github/workflows/v4-adopter-delivery.yml",
-        "reusable": true,
-        "inputs": [
-          "archive-path",
-          "bootstrap-path",
-          "consumer",
-          "consumer-ref",
-          "consumer-repository",
-          "input-path",
-          "invocation-source-path",
-          "node-version",
-          "universal-request-json"
-        ],
-        "inputCount": 9,
-        "secrets": [],
-        "secretCount": 0,
-        "outputs": [],
-        "outputCount": 0
-      },
-      {
-        "id": "v4-stage-capsule-canary",
-        "path": ".github/workflows/v4-stage-capsule-canary.yml",
-        "reusable": true,
-        "inputs": [
-          "build-artifact-path",
-          "consumer",
-          "go-version",
-          "install-artifact-path",
-          "node-version",
-          "universal-request-json",
-          "verify-artifact-path"
-        ],
-        "inputCount": 7,
-        "secrets": [],
-        "secretCount": 0,
-        "outputs": [],
-        "outputCount": 0
-      },
-      {
-        "id": "v4-tail-reseal",
-        "path": ".github/workflows/v4-tail-reseal.yml",
-        "reusable": true,
-        "inputs": [
-          "artifact-retention-days",
-          "consumer-policy-receipt-json",
-          "macos-finalization-command",
-          "request-json",
-          "universal-request-json"
-        ],
-        "inputCount": 5,
-        "secrets": [
-          "BUILDCHAIN_EVIDENCE_READ_TOKEN",
-          "BUILDCHAIN_SIGNING_TOKEN"
-        ],
-        "secretCount": 2,
-        "outputs": [
-          "release-candidate-passport-json",
-          "tail-reseal-receipt-root"
-        ],
-        "outputCount": 2
       }
     ],
     "actionInputs": [
@@ -5725,6 +5662,10 @@
         "id": "manual:workflow-catalog",
         "category": "manual"
       },
+      {
+        "id": "manual:workflow-path-migration",
+        "category": "manual"
+      },
       {
         "id": "overview:home",
         "category": "overview"
@@ -10988,8 +10929,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "c2211bd7f743a77687654b34c3e29c0031fd640f80556a602d50795b09d4c905",
-    "pageRegistryDigest": "b364becac376349506fff141bbaf1749d6ed14c68ca42435706bec57d5ea1ae0"
+    "workflowRegistryDigest": "7bc1cf4fdb316e7a3960d9c31497fc8cc94f259757f254252d8d57fae1bb2123",
+    "pageRegistryDigest": "47b76aeb046a43e89646696afd9a5438df6c2484f1afba14d363ca85eec2196f"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -2019,22 +2019,7 @@
         "oidc"
       ],
       "classified": true
-    },
-    {
-      "path": ".github/workflows/v4-adopter-delivery.yml",
-      "signals": [],
-      "classified": false
-    },
-    {
-      "path": ".github/workflows/v4-stage-capsule-canary.yml",
-      "signals": [],
-      "classified": false
-    },
-    {
-      "path": ".github/workflows/v4-tail-reseal.yml",
-      "signals": [],
-      "classified": false
     }
   ],
-  "registryDigest": "e6b298f281da2f4bd79d44d4a106dabf8294194d4f68dd28eee13d35eaf05d11"
+  "registryDigest": "894cce314366698d41a3ab20172a0b7a05f03f2167667eae51793537b832c811"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-05T13:36:53.000Z",
-  "publishedAt": "2026-09-05T13:36:53.000Z",
+  "generatedAt": "2026-09-05T17:08:37.000Z",
+  "publishedAt": "2026-09-05T17:08:37.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "70ec70ed62a826c7a6d9c29b61cd416b09b8629f",
+  "sourceRevision": "876f93958d39cc31f6404c8541a8f3a153ab0a67",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.36",
+    "version": "4.0.2-alpha.38",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-05T13:36:53.000Z",
-  "publishedAt": "2026-09-05T13:36:53.000Z",
+  "generatedAt": "2026-09-05T17:08:37.000Z",
+  "publishedAt": "2026-09-05T17:08:37.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "70ec70ed62a826c7a6d9c29b61cd416b09b8629f",
+  "sourceRevision": "876f93958d39cc31f6404c8541a8f3a153ab0a67",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.36",
+    "version": "4.0.2-alpha.38",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -141,7 +141,7 @@
       "path": "docs/next-development-transition.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:1e92b92b24888df1668cbffe60c9455336ee1285dbbc78d4a8d62c2919a0b9db"
+      "digest": "sha256:36f514efc9a7c1c6da59e93126e1512529c5c2349ea987516ef13f1e592be454"
     },
     {
       "id": "release-propagation",
@@ -301,7 +301,7 @@
       "path": "docs/v4-adopter-delivery.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:cf9beccd0ad6ecbd021c2d5273ab91e54cc3ab225b7b8f33f240ac6d6bd23a48"
+      "digest": "sha256:1afe656ccb66bb63c73956413bb2d3551d3ba39c3f6e50389e7695877dac87a2"
     },
     {
       "id": "publish-transaction",