@kungfu-tech/buildchain 4.0.2-alpha.37 → 4.0.2-alpha.39

package/docs/workflow-path-migration.md

@@ -0,0 +1,109 @@
+---
+status: draft
+period: ongoing
+theme: workflow-path-migration
+doc_type: migration-guide
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-06
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-05
+  visible_context: Exact GitHub channel refs and workflow files on 23 organization default branches
+  invisible_context_boundary: Other branches, private or unlisted consumers and future floating ref updates were not established by this audit
+---
+
+# Version-prefixed workflow path migration
+
+This source change retires three filenames. Their reusable capabilities, inputs,
+outputs, jobs and permission envelopes remain at the canonical paths below.
+Keep the existing channel selector and dual contract-lock policy when migrating.
+
+| Retired path | Canonical path |
+| --- | --- |
+| `v4-adopter-delivery.yml` | `public-build-adopter-qualification.yml` |
+| `v4-stage-capsule-canary.yml` | `public-build-stage-capsule-canary.yml` |
+| `v4-tail-reseal.yml` | `public-ops-tail-reseal.yml` |
+
+All paths are beneath `.github/workflows/`. The taxonomy gate rejects version
+segments in filenames and calls to version-prefixed Buildchain workflows. An
+explicit retirement record keeps the original migration identity for historical
+metrics and frozen facade source; generators resolve that identity to the
+canonical implementation and cannot recreate the removed file.
+
+## Development merge and channel rollout
+
+The development change retires these filenames on `dev/v4/v4.0`, updates the
+Buildchain-owned callers, and enforces the canonical paths through generators
+and required checks. Its delivery boundary is the protected development merge.
+External-repository migration and stable publication are separate follow-up
+work and do not block this development merge.
+
+The published channel boundary still requires the following rollout order:
+
+1. Publish and verify the canonical entries on every affected channel while the
+   old entries remain available. The admission identity must match the actual
+   invoked canonical workflow, rather than its previous filename.
+2. Migrate consumers on their existing floating channels, refresh locks through
+   the supported contract acceptance path if required, and verify real consumer
+   runs. Stable callers remain on stable; alpha callers remain on alpha.
+3. Before publishing the retirement into a channel, recheck its live consumers
+   and resolve any remaining old-path calls. A protected development merge does
+   not by itself establish this channel readiness.
+
+## Initial consumer readback
+
+On 2026-09-05, all workflow files from 23 accessible `kungfu-systems` repository
+_default branches_ were read at their returned Git revisions. Five calls were
+found in three repositories. This is a bounded inventory, not evidence that
+unknown or non-default-branch consumers do not exist.
+
+| Repository and observed revision | Caller | Existing selector |
+| --- | --- | --- |
+| Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-adopter-dogfood.yml` | `v4-alpha` |
+| Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-public-consumer-dogfood.yml` | `v4-alpha` |
+| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-adopter-delivery-qualification.yml` | `v4-alpha` |
+| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-stage-capsule-canary.yml` | `v4` |
+| taolu `6dcccdc3bd2c8b1801c7f6decea08ae7877aac2b` | `verify.yml` | `v4-alpha` |
+
+The initial published channel readback was `v4` at
+`da5e2db8384313e899eace87aea0a1a8e28c0aa8` and `v4-alpha` at
+`dd87f43f7122b41c4ce7f1f6d1888521cc7f892f`. Neither contained the three canonical
+filenames at that initial readback. The later evidence below records progress
+without changing the scope or revisions of that initial inventory.
+
+## Rollout evidence as of 2026-09-06
+
+The canonical invocation-identity preparation was merged in
+[Buildchain PR 3508](https://github.com/kungfu-systems/buildchain/pull/3508).
+All three canonical paths are available in the immutable `v4.0.2-alpha.35`
+release (`feab078f5d7c9927a3525154003e321700e8ca30`) and the later
+`v4.0.2-alpha.37` release (`f5fa1a4a3e8d83eccee79c077e5f48417760c9df`).
+The floating `v4-alpha` readback selects alpha.37.
+
+[Taolu PR 30](https://github.com/kungfu-systems/taolu/pull/30) migrated its
+Stage Capsule call on `@v4-alpha`, preserving the existing dual locks.
+Its exact source `b3f4c12578d733ff44165ff1acafe131251b8907` passed
+[consumer Verify](https://github.com/kungfu-systems/taolu/actions/runs/33975786413)
+on all declared platforms and
+[native delivery](https://github.com/kungfu-systems/taolu/actions/runs/34005576362).
+The protected dev landing is `7e15123733110ad8ce484241934bbf0ef99fbb45`.
+
+The stable `v4` readback remains
+`da5e2db8384313e899eace87aea0a1a8e28c0aa8`, which does not contain the canonical
+paths. Stable publication and the agent-hub-demo migration remain **pending**
+outside this development change's completion boundary. The alpha.35
+[Build Surface Fixture](https://github.com/kungfu-systems/buildchain/actions/runs/34005360217)
+passed, but this individual result does not establish complete stable
+qualification or authorize moving the stable channel.
+
+## Recovery
+
+Before channel retirement, revert consumer changes to the still-available old
+paths if verification fails. After retirement, restore the exact previous
+provider implementation through a reviewed corrective commit and normal
+publication; do not rewrite immutable release tags or bypass admission checks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.37",
+  "version": "4.0.2-alpha.39",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/artifact-verification-envelope.js

@@ -417,7 +417,7 @@ function kfdBindingBody({ manifest, manifestGate, legacyProjection, paths }) {
       gatePath: paths.gate,
       gateRoot: manifestGate.gateRoot,
     },
-    source: jsonClone(manifestGate.source),
+    adopter: jsonClone(manifestGate.adopter), source: jsonClone(manifestGate.source),
     standardPackage: jsonClone(manifestGate.standardPackage),
     witness: {
       decisionRoot: manifestGate.decisionWitness.root,
@@ -445,10 +445,10 @@ export function createKfdAdopterReleaseBinding({
   manifestPath = "kfd-adopter-manifest.json",
   gatePath = "kfd-adopter-manifest-gate.json",
   legacyProjectionPath = "kfd-support.json",
-  expectedSourceSha = "",
+  expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "",
 } = {}) {
   const gate = validateKfdAdopterManifestGate(manifestGate, {
-    expectedSourceSha,
+    expectedAdopterId, expectedSourceRepository, expectedSourceSha,
     checkedAt: manifestGate?.checkedAt,
   });
   const legacy = validateKfdLegacySupportMatrixProjection(legacyProjection, { manifest, manifestGate });
@@ -468,7 +468,7 @@ export function validateKfdAdopterReleaseBinding(binding, {
   manifest,
   manifestGate,
   legacyProjection,
-  expectedSourceSha = "",
+  expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "",
 } = {}) {
   const issues = [];
   if (!binding || binding.schemaVersion !== 1 || binding.contract !== KFD_ADOPTER_RELEASE_BINDING_CONTRACT) {
@@ -488,7 +488,7 @@ export function validateKfdAdopterReleaseBinding(binding, {
       manifestPath: binding.authority?.manifestPath,
       gatePath: binding.authority?.gatePath,
       legacyProjectionPath: binding.legacyProjection?.path,
-      expectedSourceSha,
+      expectedAdopterId, expectedSourceRepository, expectedSourceSha,
     });
     if (stableJson(binding) !== stableJson(expected)) {
       issues.push({ code: "adopter-release-binding-drift", path: "", message: "release binding differs from the exact manifest, gate, or legacy projection closure" });

package/packages/core/kfd-adopter-manifest.js

@@ -21,7 +21,7 @@ export const KFD_LEGACY_SUPPORT_MATRIX_CONTRACT = "kungfu-kfd-support-matrix";
 
 const BUILDCHAIN_ADOPTER_ID = "kungfu-systems/buildchain";
 const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
-const SHA_PATTERN = /^[0-9a-f]{40}$/;
+const SHA_PATTERN = /^[0-9a-f]{40}$/, SOURCE_REPOSITORY_PATTERN = /^[^@\s]+$/;
 const REQUIRED_DECISIONS = Object.freeze(["KFD-1", "KFD-2", "KFD-3", "KFD-4", "KFD-5", "KFD-7"]);
 const PRODUCT_GATE_STANDARDS = Object.freeze(["kfd-4", "kfd-5", "kfd-7"]);
 const PRODUCT_GATE_SET = new Set(PRODUCT_GATE_STANDARDS);
@@ -77,29 +77,27 @@ function verifyPublishedManifest(manifest, packageOptions, issues) {
   }
 }
 
-function manifestSourceSha(manifest) {
-  const match = /^kungfu-systems\/buildchain@([0-9a-f]{40})$/.exec(text(manifest?.adopter?.artifact?.coordinate));
-  return match?.[1] || "";
-}
+function adopterExpectation({ expectedAdopterId = BUILDCHAIN_ADOPTER_ID, expectedSourceRepository = "" } = {}) { const adopterId = text(expectedAdopterId) || BUILDCHAIN_ADOPTER_ID; return { adopterId, sourceRepository: text(expectedSourceRepository) || adopterId }; }
 
-function validateManifestIdentity(manifest, packageArtifactRoot, expectedSourceSha, issues) {
-  if (manifest?.adopter?.id !== BUILDCHAIN_ADOPTER_ID) {
-    issues.push(issue("adopter-identity", "manifest.adopter.id", `manifest adopter must be ${BUILDCHAIN_ADOPTER_ID}`));
-  }
+function manifestSource(manifest) { const coordinate = text(manifest?.adopter?.artifact?.coordinate), match = /^([^@\s]+)@([0-9a-f]{40})$/.exec(coordinate); return { coordinate, repository: match?.[1] || "", sha: match?.[2] || "" }; }
+
+function validateManifestIdentity(manifest, packageArtifactRoot, expectation, expectedSourceSha, issues) {
+  if (manifest?.adopter?.id !== expectation.adopterId) issues.push(issue("adopter-identity", "manifest.adopter.id", `manifest adopter must be ${expectation.adopterId}`));
   const pinned = manifest?.kfdCut?.package;
   if (pinned?.name !== kfdPackageJson.name
     || pinned?.version !== kfdPackageJson.version
     || pinned?.artifactRoot !== packageArtifactRoot) {
     issues.push(issue("adopter-package-cut", "manifest.kfdCut.package", "manifest must bind the exact installed KFD package cut"));
   }
-  const sourceSha = manifestSourceSha(manifest);
-  if (manifest?.adopter?.artifact?.kind !== "git-commit" || !sourceSha
-    || !ROOT_PATTERN.test(text(manifest?.adopter?.artifact?.root))) {
-    issues.push(issue("adopter-source", "manifest.adopter.artifact", "Buildchain adopter authority must bind one exact git commit and artifact root"));
-  } else if (expectedSourceSha && sourceSha !== expectedSourceSha) {
+  const source = manifestSource(manifest);
+  if (!SOURCE_REPOSITORY_PATTERN.test(expectation.sourceRepository) || manifest?.adopter?.artifact?.kind !== "git-commit" || !source.sha || !ROOT_PATTERN.test(text(manifest?.adopter?.artifact?.root))) {
+    issues.push(issue("adopter-source", "manifest.adopter.artifact", "adopter authority must bind one exact repository, git commit, and artifact root"));
+  } else if (source.repository !== expectation.sourceRepository) {
+    issues.push(issue("adopter-source", "manifest.adopter.artifact.coordinate", `manifest source repository must be ${expectation.sourceRepository}`));
+  } else if (expectedSourceSha && source.sha !== expectedSourceSha) {
     issues.push(issue("adopter-source", "manifest.adopter.artifact.coordinate", "manifest source does not match the requested release source"));
   }
-  return sourceSha;
+  return source;
 }
 
 function validateRequiredDecisions(decisions, issues) {
@@ -131,7 +129,7 @@ function collectProductGates(gateResults, decisions, verificationCut, issues) {
   for (const [index, gate] of gateResults.entries()) {
     const validation = validateKfdProductGateResult(gate, verificationCut);
     if (!validation.valid) {
-      issues.push(issue("adopter-gate-invalid", `gateResults[${index}]`, "Buildchain product gate is invalid", {
+      issues.push(issue("adopter-gate-invalid", `gateResults[${index}]`, "adopter product gate is invalid", {
         gateIssues: validation.issues,
       }));
     }
@@ -141,15 +139,16 @@ function collectProductGates(gateResults, decisions, verificationCut, issues) {
     if (gates.has(gate?.standard)) {
       issues.push(issue("adopter-gate-duplicate", `gateResults[${index}].standard`, `${gate.standard} gate is duplicated`));
     }
+    if (gate?.source?.repository !== verificationCut.expectedSourceRepository) issues.push(issue("adopter-gate-source", `gateResults[${index}].source.repository`, "product gate repository must match the adopter source repository"));
     gates.set(gate?.standard, gate);
   }
   for (const standard of PRODUCT_GATE_STANDARDS) {
     const gate = gates.get(standard);
     const id = standard.toUpperCase();
     if (!gate) {
-      issues.push(issue("adopter-gate-missing", `gateResults.${standard}`, `${id} requires its existing Buildchain product gate`));
+      issues.push(issue("adopter-gate-missing", `gateResults.${standard}`, `${id} requires its exact adopter product gate`));
     } else if (!(decisions.get(id)?.verificationEvidence || []).some((entry) => entry?.root === gate.gateRoot)) {
-      issues.push(issue("adopter-gate-unbound", `manifest.decisions.${id}.verificationEvidence`, `${id} must bind the exact Buildchain gate root`));
+      issues.push(issue("adopter-gate-unbound", `manifest.decisions.${id}.verificationEvidence`, `${id} must bind the exact adopter gate root`));
     }
   }
   return gates;
@@ -159,12 +158,12 @@ function projectedProductGates(gates) {
   return PRODUCT_GATE_STANDARDS.map((standard) => {
     const gate = gates.get(standard);
     return gate
-      ? { standard, sourceSha: gate.source.sha, gateRoot: gate.gateRoot, status: gate.status }
-      : { standard, sourceSha: "", gateRoot: "", status: "missing" };
+      ? { standard, sourceRepository: gate.source.repository, sourceSha: gate.source.sha, gateRoot: gate.gateRoot, status: gate.status }
+      : { standard, sourceRepository: "", sourceSha: "", gateRoot: "", status: "missing" };
   });
 }
 
-function createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, sourceSha, checkedAt, maxAgeSeconds, issues }) {
+function createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, source, checkedAt, maxAgeSeconds, issues }) {
   const gate = {
     schemaVersion: 1,
     contract: KFD_ADOPTER_MANIFEST_GATE_CONTRACT,
@@ -174,10 +173,8 @@ function createGateDocument({ manifest, bundle, gates, authorityPath, packageArt
       contract: text(manifest?.contract),
       manifestRoot: bundle?.roots?.manifestRoot || "",
     },
-    source: {
-      sha: sourceSha,
-      artifactRoot: text(manifest?.adopter?.artifact?.root),
-    },
+    adopter: { id: text(manifest?.adopter?.id) },
+    source: { repository: source.repository, coordinate: source.coordinate, sha: source.sha, artifactRoot: text(manifest?.adopter?.artifact?.root) },
     verificationCut: { checkedAt, maxAgeSeconds },
     standardPackage: {
       name: kfdPackageJson.name,
@@ -211,28 +208,28 @@ export function createKfdAdopterManifestGate({
   packageArtifactRoot = "",
   gateResults = [],
   authorityPath = ".buildchain/kfd/adopter-manifest.json",
-  expectedSourceSha = "",
+  expectedAdopterId = BUILDCHAIN_ADOPTER_ID, expectedSourceRepository = "", expectedSourceSha = "",
   checkedAt = new Date().toISOString(),
   maxAgeSeconds = 86400,
 } = {}) {
-  const issues = [];
+  const issues = [], expectation = adopterExpectation({ expectedAdopterId, expectedSourceRepository });
   const bundle = verifyPublishedManifest(manifest, {
     packageArtifactRoot,
     verifiedAt: checkedAt,
     maxAgeSeconds,
   }, issues);
   const decisions = new Map((manifest?.decisions || []).map((row) => [row.id, row]));
-  let sourceSha = manifestSourceSha(manifest);
+  let source = manifestSource(manifest);
   if (bundle) {
-    sourceSha = validateManifestIdentity(manifest, packageArtifactRoot, expectedSourceSha, issues);
+    source = validateManifestIdentity(manifest, packageArtifactRoot, expectation, expectedSourceSha, issues);
     validateRequiredDecisions(decisions, issues);
     validateWarrantWitness(decisions, issues);
   }
-  const gates = collectProductGates(gateResults, decisions, { expectedSourceSha: sourceSha || expectedSourceSha, checkedAt }, issues);
-  return createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, sourceSha, checkedAt, maxAgeSeconds, issues });
+  const gates = collectProductGates(gateResults, decisions, { expectedSourceRepository: expectation.sourceRepository, expectedSourceSha: source.sha || expectedSourceSha, checkedAt }, issues);
+  return createGateDocument({ manifest, bundle, gates, authorityPath, packageArtifactRoot, source, checkedAt, maxAgeSeconds, issues });
 }
 
-function validateGateDocument(gate, issues) {
+function validateGateDocument(gate, expectation, issues) {
   const copy = structuredClone(gate);
   const root = copy.gateRoot;
   delete copy.gateRoot;
@@ -244,12 +241,13 @@ function validateGateDocument(gate, issues) {
     || !ROOT_PATTERN.test(text(gate?.authority?.manifestRoot))) {
     issues.push(issue("adopter-gate-authority", "authority", "adopter gate must bind the standard manifest contract and root"));
   }
+  if (gate?.adopter?.id !== expectation.adopterId) issues.push(issue("adopter-gate-identity", "adopter.id", `adopter gate must bind ${expectation.adopterId}`));
   if (gate?.standardPackage?.name !== kfdPackageJson.name || gate?.standardPackage?.version !== kfdPackageJson.version
     || ![gate?.standardPackage?.artifactRoot, gate?.standardPackage?.registryRoot, gate?.standardPackage?.verifierSetRoot].every((value) => ROOT_PATTERN.test(text(value)))) {
     issues.push(issue("adopter-gate-package", "standardPackage", "adopter gate uses stale KFD package metadata"));
   }
-  if (!SHA_PATTERN.test(text(gate?.source?.sha)) || !ROOT_PATTERN.test(text(gate?.source?.artifactRoot))) {
-    issues.push(issue("adopter-gate-source", "source", "adopter gate must bind one exact Buildchain source commit and artifact root"));
+  if (gate?.source?.repository !== expectation.sourceRepository || gate?.source?.coordinate !== `${expectation.sourceRepository}@${gate?.source?.sha || ""}` || !SHA_PATTERN.test(text(gate?.source?.sha)) || !ROOT_PATTERN.test(text(gate?.source?.artifactRoot))) {
+    issues.push(issue("adopter-gate-source", "source", "adopter gate must bind the expected repository, exact source commit, coordinate, and artifact root"));
   }
   if (gate?.decisionWitness?.rootAlgorithm !== "sha256-buildchain-stable-json-v1"
     || !ROOT_PATTERN.test(text(gate?.decisionWitness?.root))
@@ -259,7 +257,7 @@ function validateGateDocument(gate, issues) {
   }
 }
 
-function validateProjectedGates(gate, expectedSourceSha, issues) {
+function validateProjectedGates(gate, expectation, expectedSourceSha, issues) {
   const seenStandards = new Set();
   for (const [index, productGate] of (gate.gateResults || []).entries()) {
     if (!PRODUCT_GATE_SET.has(productGate?.standard) || productGate?.status !== "passed" || !ROOT_PATTERN.test(text(productGate?.gateRoot))) {
@@ -267,7 +265,7 @@ function validateProjectedGates(gate, expectedSourceSha, issues) {
     }
     if (seenStandards.has(productGate?.standard)) issues.push(issue("adopter-gate-result-set", `gateResults[${index}]`, "product gate standards must be unique"));
     seenStandards.add(productGate?.standard);
-    if (productGate?.sourceSha !== gate?.source?.sha || (expectedSourceSha && productGate?.sourceSha !== expectedSourceSha)) {
+    if (productGate?.sourceRepository !== gate?.source?.repository || productGate?.sourceRepository !== expectation.sourceRepository || productGate?.sourceSha !== gate?.source?.sha || (expectedSourceSha && productGate?.sourceSha !== expectedSourceSha)) {
       issues.push(issue("adopter-gate-source", `gateResults[${index}].sourceSha`, "product gate source must match the release source"));
     }
   }
@@ -277,15 +275,15 @@ function validateProjectedGates(gate, expectedSourceSha, issues) {
 }
 
 export function validateKfdAdopterManifestGate(gate, {
-  expectedSourceSha = "",
+  expectedAdopterId = BUILDCHAIN_ADOPTER_ID, expectedSourceRepository = "", expectedSourceSha = "",
   checkedAt = gate?.checkedAt || new Date().toISOString(),
 } = {}) {
-  const issues = [];
+  const issues = [], expectation = adopterExpectation({ expectedAdopterId, expectedSourceRepository });
   if (!gate || gate.schemaVersion !== 1 || gate.contract !== KFD_ADOPTER_MANIFEST_GATE_CONTRACT) {
     return { valid: false, issues: [issue("adopter-gate-contract", "", `gate must use ${KFD_ADOPTER_MANIFEST_GATE_CONTRACT} v1`)] };
   }
-  validateGateDocument(gate, issues);
-  validateProjectedGates(gate, expectedSourceSha, issues);
+  validateGateDocument(gate, expectation, issues);
+  validateProjectedGates(gate, expectation, expectedSourceSha, issues);
   if (gate.checkedAt !== checkedAt || gate?.verificationCut?.checkedAt !== checkedAt || !Number.isFinite(Date.parse(checkedAt))
     || !Number.isSafeInteger(gate?.verificationCut?.maxAgeSeconds) || gate.verificationCut.maxAgeSeconds < 0) {
     issues.push(issue("adopter-gate-time", "verificationCut", "adopter gate verification cut does not match the requested cut"));
@@ -300,7 +298,7 @@ function legacyStatus(row) {
   return row.state;
 }
 
-function legacyRow(row, gates) {
+function legacyRow(row, gates, adopterId) {
   const key = row.id.toLowerCase();
   const productGate = gates.get(key);
   return {
@@ -318,7 +316,7 @@ function legacyRow(row, gates) {
     releaseQualification: { shippedSupport: false },
     claimClass: "standard-adopter-manifest-projection",
     knownLimitations: [...row.gaps],
-    owner: BUILDCHAIN_ADOPTER_ID,
+    owner: adopterId,
     nextGate: "Release Passport artifact binding and independent release decision",
     declaration: { state: row.state, usage: row.usage, root: kfdProductGateDigest(decisionWitnessRow(row)) },
   };
@@ -326,7 +324,7 @@ function legacyRow(row, gates) {
 
 export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate } = {}) {
   const validation = validateKfdAdopterManifestGate(manifestGate, {
-    expectedSourceSha: manifestGate?.source?.sha,
+    expectedAdopterId: manifestGate?.adopter?.id, expectedSourceRepository: manifestGate?.source?.repository, expectedSourceSha: manifestGate?.source?.sha,
     checkedAt: manifestGate?.checkedAt,
   });
   if (!validation.valid || manifest?.contract !== "kfd.adopter-conformance-manifest/v1") {
@@ -338,9 +336,9 @@ export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate
     verifiedAt: manifestGate.verificationCut.checkedAt,
     maxAgeSeconds: manifestGate.verificationCut.maxAgeSeconds,
   }, authorityIssues);
-  const sourceSha = validateManifestIdentity(manifest, manifestGate.standardPackage.artifactRoot, manifestGate.source.sha, authorityIssues);
+  const source = validateManifestIdentity(manifest, manifestGate.standardPackage.artifactRoot, { adopterId: manifestGate.adopter.id, sourceRepository: manifestGate.source.repository }, manifestGate.source.sha, authorityIssues);
   const decisionRoot = kfdProductGateDigest(manifest.decisions.map(decisionWitnessRow));
-  if (!bundle || sourceSha !== manifestGate.source.sha || manifest.adopter.artifact.root !== manifestGate.source.artifactRoot
+  if (!bundle || source.sha !== manifestGate.source.sha || source.repository !== manifestGate.source.repository || source.coordinate !== manifestGate.source.coordinate || manifest.adopter.artifact.root !== manifestGate.source.artifactRoot
     || bundle.roots.manifestRoot !== manifestGate.authority.manifestRoot
     || bundle.roots.verificationReportRoot !== manifestGate.manifestVerificationReportRoot
     || bundle.bundleRoot !== manifestGate.manifestBundleRoot
@@ -364,7 +362,8 @@ export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate
       path: manifestGate.authority.path,
       contract: manifest.contract,
       root: manifestGate.authority.manifestRoot,
-      gateRoot: manifestGate.gateRoot,
+      gateRoot: manifestGate.gateRoot, adopterId: manifestGate.adopter.id,
+      sourceRepository: manifestGate.source.repository, sourceSha: manifestGate.source.sha,
     },
     upstream: {
       package: manifestGate.standardPackage.name,
@@ -374,7 +373,7 @@ export function createKfdLegacySupportMatrixProjection({ manifest, manifestGate
       verifierSetRoot: manifestGate.standardPackage.verifierSetRoot,
       standardsSha256: standardsFileDigest(),
     },
-    rows: manifest.decisions.map((row) => legacyRow(row, gates)),
+    rows: manifest.decisions.map((row) => legacyRow(row, gates, manifestGate.adopter.id)),
   };
 }
 

package/packages/core/next-development-projection.js

@@ -244,7 +244,7 @@ invalid.
 ## Public self-dogfood and adoption
 
 \`.github/workflows/self-build-public-consumer-dogfood.yml\` remains the exact thin
-consumer of the public \`v4-stage-capsule-canary.yml@v4-alpha\` contract. Its
+consumer of the public \`public-build-stage-capsule-canary.yml@v4-alpha\` contract. Its
 declared \`lifecycle.verify\` runs \`pnpm run check\`, so the same public path
 executes pure recovery tests that inject a transient durable-state write
 failure, restore the adapter operation on a fresh runner, supersede stale work

package/packages/core/release-passport-contract.js

@@ -405,7 +405,7 @@ export function prepareReleasePassportKfdSections({ kfd1, kfd2Claims, kfd3, kfdA
   };
 }
 
-export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], comparisonMatrix, sourceSha = "", checkedAt } = {}) {
+export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], comparisonMatrix, expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", sourceSha = "", checkedAt } = {}) {
   if (!manifest) {
     if (comparisonMatrix || gateResults.length > 0) {
       throw new Error("KFD support and product-gate inputs require --kfd-adopter-manifest-json; --kfd-support-matrix-json is comparison-only");
@@ -414,7 +414,7 @@ export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], c
   }
   const manifestGate = createKfdAdopterManifestGate({
     manifest, packageArtifactRoot: installedKfdPackageArtifactRoot(), gateResults,
-    expectedSourceSha: sourceSha, checkedAt,
+    expectedAdopterId, expectedSourceRepository, expectedSourceSha: sourceSha, checkedAt,
   });
   const legacyProjection = createKfdLegacySupportMatrixProjection({ manifest, manifestGate });
   if (comparisonMatrix) {
@@ -425,18 +425,18 @@ export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], c
   }
   return {
     manifest, manifestGate, legacyProjection,
-    binding: createKfdAdopterReleaseBinding({ manifest, manifestGate, legacyProjection, expectedSourceSha: sourceSha }),
+    binding: createKfdAdopterReleaseBinding({ manifest, manifestGate, legacyProjection, expectedAdopterId, expectedSourceRepository, expectedSourceSha: sourceSha }),
   };
 }
 
-export function validateKfdAdopterReleaseEvidence({ binding, artifactBinding, manifest, manifestGate, legacyProjection, passportLegacyProjection, expectedSourceSha = "" } = {}) {
+export function validateKfdAdopterReleaseEvidence({ binding, artifactBinding, manifest, manifestGate, legacyProjection, passportLegacyProjection, expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "" } = {}) {
   if (!binding) {
     return passportLegacyProjection
       ? [{ code: "kfdSupport.authority", message: "legacy KFD support projection requires the standard adopter manifest binding" }]
       : [];
   }
   const issues = validateKfdAdopterReleaseBinding(binding, {
-    manifest, manifestGate, legacyProjection, expectedSourceSha,
+    manifest, manifestGate, legacyProjection, expectedAdopterId, expectedSourceRepository, expectedSourceSha,
   }).issues.map((entry) => ({ code: `kfdAdopter.${entry.path || entry.code}`, message: entry.message, details: entry }));
   if (!artifactBinding || passportStableJson(artifactBinding) !== passportStableJson(binding)) {
     issues.push({ code: "kfdAdopter.artifactEvidence", message: "release passport and artifact evidence must bind the same exact KFD adopter closure" });

package/packages/core/release-passport.js

@@ -1431,7 +1431,7 @@ export function createReleasePassport(options = {}) {
   };
 }
 
-function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson, productGateJsons, sourceSha, checkedAt }) {
+function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson, productGateJsons, repository, sourceSha, checkedAt }) {
   const manifestMeta = parseJsonInputWithMeta(manifestJson, undefined, { cwd, label: "kfdAdopterManifestJson" });
   const supportMatrixMeta = parseJsonInputWithMeta(supportMatrixJson, undefined, { cwd, label: "kfdSupportMatrixJson" });
   const productGateMetas = (productGateJsons || [])
@@ -1442,7 +1442,7 @@ function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson,
     manifest: manifestMeta.value,
     gateResults: productGateMetas.map((meta) => meta.value),
     comparisonMatrix: supportMatrixMeta.value,
-    sourceSha,
+    expectedAdopterId: repository || "kungfu-systems/buildchain", expectedSourceRepository: repository, sourceSha,
     checkedAt,
   });
 }
@@ -1620,7 +1620,7 @@ export function collectGitHubReleasePassport({
   const productMechanism = defaultProductMechanism({ repository, productName });
   const kfdAdopterEvidence = collectKfdAdopterReleaseInputs({
     cwd, manifestJson: kfdAdopterManifestJson, supportMatrixJson: kfdSupportMatrixJson,
-    productGateJsons: kfdProductGateJsons, sourceSha, checkedAt: resolvedCheckedAt,
+    productGateJsons: kfdProductGateJsons, repository, sourceSha, checkedAt: resolvedCheckedAt,
   });
   const {
     manifest: kfdAdopterManifest,
@@ -2060,7 +2060,8 @@ function validateReleaseEvidenceContracts({
     manifestGate: kfdAdopterManifestGate,
     legacyProjection: kfdSupportEvidence,
     passportLegacyProjection: passport?.kfdSupport,
-    expectedSourceSha: optionalString(passport?.release?.sourceSha),
+    expectedAdopterId: optionalString(passport?.product?.repository) || "kungfu-systems/buildchain",
+    expectedSourceRepository: optionalString(passport?.product?.repository), expectedSourceSha: optionalString(passport?.release?.sourceSha),
   })) {
     issues.push(issue("error", entry.code, entry.message, entry.details));
   }

package/scripts/check-v4-floating-consumer-policy-contract.mjs

@@ -148,7 +148,7 @@ export function checkV4FloatingConsumerPolicyContract() {
     "Resolve controller identities",
     "Install Buildchain runtime dependencies",
   ]);
-  const stageCanary = read(".github/workflows/v4-stage-capsule-canary.yml");
+  const stageCanary = read(".github/workflows/public-build-stage-capsule-canary.yml");
   if (
     !stageCanary.includes("consumer-admission:") ||
     !stageCanary.includes("needs: consumer-admission")

package/scripts/check-v4-public-dogfood-contract.mjs

@@ -10,7 +10,7 @@ const DEFAULT_ROOT = path.resolve(
   "..",
 );
 const CALLER_PATH = ".github/workflows/self-build-public-consumer-dogfood.yml";
-const REUSABLE_PATH = ".github/workflows/v4-stage-capsule-canary.yml";
+const REUSABLE_PATH = ".github/workflows/public-build-stage-capsule-canary.yml";
 export const V4_PUBLIC_DOGFOOD_ALPHA_REF = "v4-alpha";
 const PRIVATE_CONSUMER = ["buildchain", "self", "dogfood"].join("-");
 const PRIVATE_SHADOW = ["kungfu", "shadow"].join("-");
@@ -27,7 +27,7 @@ permissions:
 
 jobs:
   dogfood:
-    uses: kungfu-systems/buildchain/.github/workflows/v4-stage-capsule-canary.yml@${validationRef}
+    uses: kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml@${validationRef}
     with:
       consumer: buildchain
       node-version: "24"
@@ -114,7 +114,7 @@ function assertWorkflowInventory(root) {
       fail(`${relative} invokes the private qualification script directly`);
     if (
       relative !== CALLER_PATH &&
-      text.includes(".github/workflows/v4-stage-capsule-canary.yml@")
+      text.includes(".github/workflows/public-build-stage-capsule-canary.yml@")
     )
       fail(`${relative} creates a second v4 dogfood caller`);
     if (relative !== REUSABLE_PATH && relative !== CALLER_PATH)
@@ -162,7 +162,7 @@ function assertArchitecture(root) {
     !dogfood ||
     dogfood.callerWorkflow !== CALLER_PATH ||
     dogfood.reusableWorkflow !==
-      "kungfu-systems/buildchain/.github/workflows/v4-stage-capsule-canary.yml" ||
+      "kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml" ||
     dogfood.runtimeBinding !== "job.workflow_sha" ||
     dogfood.consumerSourceBinding !== "github.sha" ||
     JSON.stringify(dogfood.executableStages) !==

package/scripts/check-v4-universal-workflow-bootstrap.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { projectWorkflowIdentities } from "./workflow-taxonomy.mjs";
+import { currentWorkflowPath, projectWorkflowIdentities } from "./workflow-taxonomy.mjs";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
@@ -48,7 +48,7 @@ assert.deepEqual(
 );
 for (const relative of contract.inventoryWorkflows)
   assert.ok(
-    fs.statSync(path.join(root, relative)).isFile(),
+    fs.statSync(path.join(root, currentWorkflowPath(root, relative))).isFile(),
     `inventoried workflow is unavailable: ${relative}`,
   );
 assert.deepEqual(
@@ -87,7 +87,7 @@ for (const relative of contract.bootstrapGovernedWorkflows) {
     contract.inventoryWorkflows.includes(relative),
     `Bootstrap-governed workflow is outside the inventory: ${relative}`,
   );
-  const source = fs.readFileSync(path.join(root, relative), "utf8");
+  const source = fs.readFileSync(path.join(root, currentWorkflowPath(root, relative)), "utf8");
   assert.ok(
     relative === contract.bootstrap.publicWorkflow ||
       /uses:\s+(?:\.\/)?\.github\/workflows\/bootstrap\.yml/u.test(source) ||

package/scripts/generate-v4-universal-workflow-facades.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import crypto from "node:crypto";
-import { writeWorkflowSource, rewriteRepositoryWorkflowPaths } from "./workflow-taxonomy.mjs";
+import { currentWorkflowPath, writeWorkflowSource, rewriteRepositoryWorkflowPaths } from "./workflow-taxonomy.mjs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -426,14 +426,15 @@ function main() {
     );
   }
   for (const relative of activeFacadePaths()) {
-    const target = path.join(root, relative);
+    const current = currentWorkflowPath(root, relative);
+    const target = path.join(root, current);
     const source = fresh
       ? frozenFacadeSource(relative)
       : fs.readFileSync(target, "utf8");
     if (check) verify(source, relative);
     else
       writeWorkflowSource(
-        root, relative,
+        root, current,
         migrateV4UniversalWorkflowFacade(source, relative),
       );
   }

package/scripts/v4-universal-workflow-engine.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import crypto from "node:crypto";
 import fs from "node:fs";
+import { currentWorkflowPath } from "./workflow-taxonomy.mjs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import {
@@ -192,7 +193,7 @@ function executeBootstrapConformance(request, admission) {
     fail("candidate Bootstrap conformance does not close execution semantics");
   for (const relative of architecture.bootstrapGovernedWorkflows) {
     const source = fs.readFileSync(
-      new URL(`../${relative}`, import.meta.url),
+      path.join(path.resolve(import.meta.dirname, ".."), currentWorkflowPath(path.resolve(import.meta.dirname, ".."), relative)),
       "utf8",
     );
     if (