@kungfu-tech/buildchain 4.0.2-alpha.37 → 4.0.2-alpha.39

package/dist/site/public-surface-audit.json

@@ -4,9 +4,9 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 117,
-    "workflowCount": 117,
+    "workflowCount": 114,
     "actionCount": 8,
-    "sitePageCount": 86,
+    "sitePageCount": 87,
     "docCommandRefCount": 1050,
     "failureCount": 0
   },
@@ -5026,69 +5026,6 @@
           "terminal-receipt-root"
         ],
         "outputCount": 5
-      },
-      {
-        "id": "v4-adopter-delivery",
-        "path": ".github/workflows/v4-adopter-delivery.yml",
-        "reusable": true,
-        "inputs": [
-          "archive-path",
-          "bootstrap-path",
-          "consumer",
-          "consumer-ref",
-          "consumer-repository",
-          "input-path",
-          "invocation-source-path",
-          "node-version",
-          "universal-request-json"
-        ],
-        "inputCount": 9,
-        "secrets": [],
-        "secretCount": 0,
-        "outputs": [],
-        "outputCount": 0
-      },
-      {
-        "id": "v4-stage-capsule-canary",
-        "path": ".github/workflows/v4-stage-capsule-canary.yml",
-        "reusable": true,
-        "inputs": [
-          "build-artifact-path",
-          "consumer",
-          "go-version",
-          "install-artifact-path",
-          "node-version",
-          "universal-request-json",
-          "verify-artifact-path"
-        ],
-        "inputCount": 7,
-        "secrets": [],
-        "secretCount": 0,
-        "outputs": [],
-        "outputCount": 0
-      },
-      {
-        "id": "v4-tail-reseal",
-        "path": ".github/workflows/v4-tail-reseal.yml",
-        "reusable": true,
-        "inputs": [
-          "artifact-retention-days",
-          "consumer-policy-receipt-json",
-          "macos-finalization-command",
-          "request-json",
-          "universal-request-json"
-        ],
-        "inputCount": 5,
-        "secrets": [
-          "BUILDCHAIN_EVIDENCE_READ_TOKEN",
-          "BUILDCHAIN_SIGNING_TOKEN"
-        ],
-        "secretCount": 2,
-        "outputs": [
-          "release-candidate-passport-json",
-          "tail-reseal-receipt-root"
-        ],
-        "outputCount": 2
       }
     ],
     "actionInputs": [
@@ -5725,6 +5662,10 @@
         "id": "manual:workflow-catalog",
         "category": "manual"
       },
+      {
+        "id": "manual:workflow-path-migration",
+        "category": "manual"
+      },
       {
         "id": "overview:home",
         "category": "overview"
@@ -10988,8 +10929,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "e0eab4b5ef25b06616a69afc2301a124c87c2fe50409579c33fc276a34a18eb6",
-    "pageRegistryDigest": "b364becac376349506fff141bbaf1749d6ed14c68ca42435706bec57d5ea1ae0"
+    "workflowRegistryDigest": "da65c24d1ca58d393cff163356f09261a9cd3392080caa49690c65b3786f0e74",
+    "pageRegistryDigest": "094908397a02731893e7dd90ad6d3d50e2af07de51ec62c617249e82691fe828"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -2019,22 +2019,7 @@
         "oidc"
       ],
       "classified": true
-    },
-    {
-      "path": ".github/workflows/v4-adopter-delivery.yml",
-      "signals": [],
-      "classified": false
-    },
-    {
-      "path": ".github/workflows/v4-stage-capsule-canary.yml",
-      "signals": [],
-      "classified": false
-    },
-    {
-      "path": ".github/workflows/v4-tail-reseal.yml",
-      "signals": [],
-      "classified": false
     }
   ],
-  "registryDigest": "e6b298f281da2f4bd79d44d4a106dabf8294194d4f68dd28eee13d35eaf05d11"
+  "registryDigest": "894cce314366698d41a3ab20172a0b7a05f03f2167667eae51793537b832c811"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-05T16:51:37.000Z",
-  "publishedAt": "2026-09-05T16:51:37.000Z",
+  "generatedAt": "2026-09-06T03:37:46.000Z",
+  "publishedAt": "2026-09-06T03:37:46.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "d30bd48d2b84b757e9436652962eb4ff2d8d86c5",
+  "sourceRevision": "54a23658004304d6eec29107ba6f843fa7dc0867",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.37",
+    "version": "4.0.2-alpha.39",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-05T16:51:37.000Z",
-  "publishedAt": "2026-09-05T16:51:37.000Z",
+  "generatedAt": "2026-09-06T03:37:46.000Z",
+  "publishedAt": "2026-09-06T03:37:46.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "d30bd48d2b84b757e9436652962eb4ff2d8d86c5",
+  "sourceRevision": "54a23658004304d6eec29107ba6f843fa7dc0867",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.37",
+    "version": "4.0.2-alpha.39",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -85,7 +85,7 @@
       "path": "docs/release-passport.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:4ce3c2edb095d7a103b3b1d22033b4ac3709ce709f8990b21995d491898bd051"
+      "digest": "sha256:f87853f9f72b3c365e3f4bc492d78e28441be81f6836a59ac66463adf8e2b4a8"
     },
     {
       "id": "github-artifact-attestation",
@@ -141,7 +141,7 @@
       "path": "docs/next-development-transition.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:1e92b92b24888df1668cbffe60c9455336ee1285dbbc78d4a8d62c2919a0b9db"
+      "digest": "sha256:36f514efc9a7c1c6da59e93126e1512529c5c2349ea987516ef13f1e592be454"
     },
     {
       "id": "release-propagation",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:cc63793fb6b1dfeb7d362d2d29e139f89fa871cc57ff7ed7fe196bbba6e2ee63"
+      "digest": "sha256:1ff8052860e97ca5c34ba2afcfcfa839d3eb45907fa5da0f67148063962fe7a4"
     },
     {
       "id": "build-facts",
@@ -269,7 +269,7 @@
       "path": "docs/kfd-support.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:4efc8fb6f94293b75606aa0631dfa122edccc970c2cfc00c7e35f81817ea8335"
+      "digest": "sha256:e13f0e58a1bd4699ce8d443c0d316d37c9db807e03917bb2a5f8ebd11cdd7153"
     },
     {
       "id": "kfd-agent-hub",
@@ -301,7 +301,7 @@
       "path": "docs/v4-adopter-delivery.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:cf9beccd0ad6ecbd021c2d5273ab91e54cc3ab225b7b8f33f240ac6d6bd23a48"
+      "digest": "sha256:1afe656ccb66bb63c73956413bb2d3551d3ba39c3f6e50389e7695877dac87a2"
     },
     {
       "id": "publish-transaction",

package/dist/site/workflow-registry.json

@@ -2746,7 +2746,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.37",
+      "introducedVersion": "4.0.2-alpha.39",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -3943,7 +3943,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.37",
+      "introducedVersion": "4.0.2-alpha.39",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5970,7 +5970,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.37",
+      "introducedVersion": "4.0.2-alpha.39",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6001,7 +6001,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.37",
+      "introducedVersion": "4.0.2-alpha.39",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6032,7 +6032,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.37",
+      "introducedVersion": "4.0.2-alpha.39",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6628,126 +6628,6 @@
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
-    },
-    {
-      "id": "v4-adopter-delivery",
-      "path": ".github/workflows/v4-adopter-delivery.yml",
-      "reusable": true,
-      "inputs": [
-        "archive-path",
-        "bootstrap-path",
-        "consumer",
-        "consumer-ref",
-        "consumer-repository",
-        "input-path",
-        "invocation-source-path",
-        "node-version",
-        "universal-request-json"
-      ],
-      "inputCount": 9,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "v4-adopter-delivery",
-        "role": "public",
-        "category": "build",
-        "purpose": "adopter-qualification",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-build-adopter-qualification.yml",
-        "compatibilityAlias": true
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "pre-3.0.2-alpha.4",
-      "compatibilityPromise": "preserved-through-the-v3-major-line",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
-      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
-    },
-    {
-      "id": "v4-stage-capsule-canary",
-      "path": ".github/workflows/v4-stage-capsule-canary.yml",
-      "reusable": true,
-      "inputs": [
-        "build-artifact-path",
-        "consumer",
-        "go-version",
-        "install-artifact-path",
-        "node-version",
-        "universal-request-json",
-        "verify-artifact-path"
-      ],
-      "inputCount": 7,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "v4-stage-capsule-canary",
-        "role": "public",
-        "category": "build",
-        "purpose": "stage-capsule-canary",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-build-stage-capsule-canary.yml",
-        "compatibilityAlias": true
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "pre-3.0.2-alpha.4",
-      "compatibilityPromise": "preserved-through-the-v3-major-line",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
-      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
-    },
-    {
-      "id": "v4-tail-reseal",
-      "path": ".github/workflows/v4-tail-reseal.yml",
-      "reusable": true,
-      "inputs": [
-        "artifact-retention-days",
-        "consumer-policy-receipt-json",
-        "macos-finalization-command",
-        "request-json",
-        "universal-request-json"
-      ],
-      "inputCount": 5,
-      "secrets": [
-        "BUILDCHAIN_EVIDENCE_READ_TOKEN",
-        "BUILDCHAIN_SIGNING_TOKEN"
-      ],
-      "secretCount": 2,
-      "outputs": [
-        "release-candidate-passport-json",
-        "tail-reseal-receipt-root"
-      ],
-      "outputCount": 2,
-      "taxonomy": {
-        "id": "v4-tail-reseal",
-        "role": "public",
-        "category": "ops",
-        "purpose": "tail-reseal",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-tail-reseal.yml",
-        "compatibilityAlias": true
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "pre-3.0.2-alpha.4",
-      "compatibilityPromise": "preserved-through-the-v3-major-line",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
-      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     }
   ],
   "actionSource": "actions/*/action.yml reverse input enumeration",

package/docs/kfd-support.md

@@ -1,3 +1,22 @@
+---
+status: active
+period: ongoing
+theme: generic-kfd-adopter-binding
+doc_type: reference
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-06
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-06
+  visible_context: Buildchain v3 implementation and v4 source and regression tests.
+  invisible_context_boundary: No credentials or private runtime evidence inspected.
+---
+
 # KFD Support
 
 Buildchain implements KFD support as release evidence and product capability
@@ -77,8 +96,13 @@ KFD records and evidence by SHA-256. The result uses
 `buildchain kfd support project` derives a compatibility projection from the
 standard adopter manifest and its exact passing gate. The adopter manifest is
 the sole KFD-1..13 declaration authority; the command rejects stale package,
-source, witness, registry, verifier-set, and KFD-4/5/7 gate roots. The emitted
-matrix is not an independent declaration and cannot widen adopter claims.
+source, witness, registry, verifier-set, and KFD-4/5/7 gate roots. Gate creation
+accepts an explicit `expectedAdopterId`, `expectedSourceRepository`, and
+`expectedSourceSha`; omitting the first two preserves the Buildchain
+self-release default. The gate, every product-gate projection, the legacy
+matrix, Release Passport, and artifact evidence all retain that exact
+adopter/repository/source closure. The emitted matrix is not an independent
+declaration and cannot widen adopter claims.
 
 ## KFD-1
 

package/docs/next-development-transition.md

@@ -77,7 +77,7 @@ invalid.
 ## Public self-dogfood and adoption
 
 `.github/workflows/self-build-public-consumer-dogfood.yml` remains the exact thin
-consumer of the public `v4-stage-capsule-canary.yml@v4-alpha` contract. Its
+consumer of the public `public-build-stage-capsule-canary.yml@v4-alpha` contract. Its
 declared `lifecycle.verify` runs `pnpm run check`, so the same public path
 executes pure recovery tests that inject a transient durable-state write
 failure, restore the adapter operation on a fresh runner, supersede stale work