@kungfu-tech/buildchain 4.0.2-alpha.4 → 4.0.2-alpha.40

package/docs/MAP.md

@@ -37,6 +37,7 @@ running artifact), *use* (consume / extend) - and a **status**:
 | First-time repository adopter | [Golden Path](getting-started.md) | [Lifecycle Protocol](lifecycle-protocol.md) only when the generated defaults need changes |
 | CLI operator or agent | [Generated CLI Reference](cli-reference.md) | [CLI guide](cli.md) for concepts and worked examples |
 | Node toolkit developer | [Generated Node API Reference](node-api-reference.md) | [Core package guide](../packages/core/README.md) for recipes |
+| Workflow contributor | [Workflow Catalog](workflow-catalog.md) | [Contribution rules](../CONTRIBUTING.md#workflow-organization) and the [exact registry](../architecture/workflow-taxonomy.json) |
 | Build/release operator | [Reusable Build Surface](reusable-build-surface.md) | [Release Flow](release-flow.md) and [Release Passport](release-passport.md) |
 | Product/trust reviewer | [Product Mechanism](product-mechanism.md) | [Release Passport](release-passport.md) and [KFD Support](kfd-support.md) |
 

package/docs/auditable-demo.md

@@ -139,7 +139,7 @@ jobs:
 ```
 
 Buildchain recursively consumes this surface in
-`.github/workflows/auditable-demo.yml` using its own exact standalone binary
+`.github/workflows/self-build-demo-dogfood.yml` using its own exact standalone binary
 and the beginner bootstrap scenario in `.buildchain/auditable-demo.json`.
 
 ## Authority Boundary

package/docs/cli.md

@@ -1044,7 +1044,7 @@ and package identity. See [`v4-adopter-delivery.md`](v4-adopter-delivery.md).
 ## npm Publish Gate
 
 Buildchain's own npm package is published from
-`.github/workflows/buildchain-ref-promotion.yml`, inside the same publish
+`.github/workflows/self-release-promote.yml`, inside the same publish
 transaction that promotes release refs:
 
 - `v4.0.3-alpha.0` publishes to npm with dist-tag `alpha`.
@@ -1070,9 +1070,9 @@ Before the first real release, configure npm Trusted Publishing for:
 
 - package: `@kungfu-tech/buildchain`
 - repository: `kungfu-systems/buildchain`
-- workflow: `.github/workflows/buildchain-ref-promotion.yml`
+- workflow: `.github/workflows/self-release-promote.yml`
 
 No npm package is published by manual dispatch or ordinary branch builds.
-Manual dispatch on `.github/workflows/npm-publish.yml` remains dry-run only, so
+Manual dispatch on `.github/workflows/self-release-npm-dry-run.yml` remains dry-run only, so
 maintainers can verify package contents and npm publish shape before opening or
 merging the release PR.

package/docs/dev-delivery-warrant.md

@@ -506,7 +506,7 @@ shows the same exact PR head is already queued again, so an earlier queue event
 cannot close a newer active Warrant generation.
 
 Buildchain uses the same contract for its own protected dev line through
-`buildchain-dev-delivery.yml`. The manual caller requires the exact PR head and
+`self-ops-dev-delivery.yml`. The manual caller requires the exact PR head and
 semantic source roots, accepts an optional reusable native proof, keeps both
 the durable public selector and explicit runtime input on `v4-alpha`, selects
 `delivery-warrant-mode: required`, and targets GitHub Merge Queue. It does not

package/docs/engineering-housekeeper.md

@@ -158,9 +158,9 @@ to plans, reports, receipts, summaries, or artifacts.
 
 Buildchain dogfoods the reusable contract through three thin callers:
 
-- `engineering-housekeeper-daily.yml` uses a 30-day window and a 10-action cap;
-- `engineering-housekeeper-weekly.yml` uses a 45-day window and a 20-action cap;
-- `engineering-housekeeper-monthly.yml` uses a 60-day window and a 50-action cap.
+- `self-ops-housekeeping-daily.yml` uses a 30-day window and a 10-action cap;
+- `self-ops-housekeeping-weekly.yml` uses a 45-day window and a 20-action cap;
+- `self-ops-housekeeping-monthly.yml` uses a 60-day window and a 50-action cap.
 
 All three schedules run unattended apply with repository-wide mainline
 discovery. They delete only exact merged heads from the positive temporary

package/docs/kfd-support.md

@@ -1,3 +1,22 @@
+---
+status: active
+period: ongoing
+theme: generic-kfd-adopter-binding
+doc_type: reference
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-06
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-06
+  visible_context: Buildchain v3 implementation and v4 source and regression tests.
+  invisible_context_boundary: No credentials or private runtime evidence inspected.
+---
+
 # KFD Support
 
 Buildchain implements KFD support as release evidence and product capability
@@ -77,8 +96,13 @@ KFD records and evidence by SHA-256. The result uses
 `buildchain kfd support project` derives a compatibility projection from the
 standard adopter manifest and its exact passing gate. The adopter manifest is
 the sole KFD-1..13 declaration authority; the command rejects stale package,
-source, witness, registry, verifier-set, and KFD-4/5/7 gate roots. The emitted
-matrix is not an independent declaration and cannot widen adopter claims.
+source, witness, registry, verifier-set, and KFD-4/5/7 gate roots. Gate creation
+accepts an explicit `expectedAdopterId`, `expectedSourceRepository`, and
+`expectedSourceSha`; omitting the first two preserves the Buildchain
+self-release default. The gate, every product-gate projection, the legacy
+matrix, Release Passport, and artifact evidence all retain that exact
+adopter/repository/source closure. The emitted matrix is not an independent
+declaration and cannot widen adopter claims.
 
 ## KFD-1
 

package/docs/next-development-transition.md

@@ -76,8 +76,8 @@ invalid.
 
 ## Public self-dogfood and adoption
 
-`.github/workflows/v4-public-consumer-dogfood.yml` remains the exact thin
-consumer of the public `v4-stage-capsule-canary.yml@v4-alpha` contract. Its
+`.github/workflows/self-build-public-consumer-dogfood.yml` remains the exact thin
+consumer of the public `public-build-stage-capsule-canary.yml@v4-alpha` contract. Its
 declared `lifecycle.verify` runs `pnpm run check`, so the same public path
 executes pure recovery tests that inject a transient durable-state write
 failure, restore the adapter operation on a fresh runner, supersede stale work