@kungfu-tech/buildchain 4.0.2-alpha.4 → 4.0.2-alpha.40

package/architecture/v4-release-topology.json

@@ -14,54 +14,52 @@
       ".github/workflows/.declarative-auditable-demo.yml",
       ".github/workflows/.publication-authority.yml",
       ".github/workflows/.release-candidate-promote.yml",
-      ".github/workflows/.release-elastic-beanstalk.yml",
-      ".github/workflows/.release-new-version.yml",
-      ".github/workflows/.sam-release.yml",
       ".github/workflows/.web-surface.yml",
-      ".github/workflows/.wheel-release.yml",
-      ".github/workflows/auditable-demo.yml",
-      ".github/workflows/binary-release-assets.yml",
-      ".github/workflows/build-surface-fixture.yml",
+      ".github/workflows/self-build-demo-dogfood.yml",
+      ".github/workflows/self-release-binary-assets.yml",
+      ".github/workflows/self-build-fixture.yml",
       ".github/workflows/build.yml",
-      ".github/workflows/buildchain-alpha-self-dogfood.yml",
-      ".github/workflows/buildchain-dev-delivery.yml",
-      ".github/workflows/buildchain-ref-promotion-recovery.yml",
-      ".github/workflows/buildchain-ref-promotion.yml",
-      ".github/workflows/buildchain-patrol-daily.yml",
-      ".github/workflows/buildchain-patrol-monthly.yml",
-      ".github/workflows/buildchain-patrol-weekly.yml",
-      ".github/workflows/buildchain-stable-candidate-patrol.yml",
+      ".github/workflows/self-build-alpha-dogfood.yml",
+      ".github/workflows/self-ops-dev-delivery.yml",
+      ".github/workflows/self-ops-promotion-recovery.yml",
+      ".github/workflows/self-release-promote.yml",
+      ".github/workflows/self-ops-patrol-daily.yml",
+      ".github/workflows/self-ops-patrol-monthly.yml",
+      ".github/workflows/self-ops-patrol-weekly.yml",
+      ".github/workflows/self-ops-stable-candidate-patrol.yml",
       ".github/workflows/dev-alpha-candidate-patrol.yml",
       ".github/workflows/dev-pr-auto-merge.yml",
       ".github/workflows/github-artifact-attestation.yml",
-      ".github/workflows/npm-publish.yml",
+      ".github/workflows/self-release-npm-dry-run.yml",
       ".github/workflows/paper-release-sealed.yml",
       ".github/workflows/paper-release.yml",
       ".github/workflows/patrol-observed-evidence.yml",
       ".github/workflows/release-candidate-promote.yml",
-      ".github/workflows/release-line-bootstrap.yml",
-      ".github/workflows/release-new-version.yml",
+      ".github/workflows/self-release-line-open.yml",
+      ".github/workflows/self-release-new-version-compat.yml",
       ".github/workflows/release-propagation.yml",
       ".github/workflows/release-tail.yml",
       ".github/workflows/stable-candidate-patrol.yml",
-      ".github/workflows/v4-publication-rehearsal-dogfood.yml",
-      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+      ".github/workflows/self-release-rehearsal-dogfood.yml",
+      ".github/workflows/self-release-tail-dogfood.yml",
+      ".github/workflows/self-release-next-development.yml"
     ],
     "unknownTopologyPolicy": "fail-closed"
   },
   "semanticScope": {
     "workflowPaths": [
       ".github/workflows/.release-candidate-promote.yml",
-      ".github/workflows/buildchain-ref-promotion-recovery.yml",
-      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/self-ops-promotion-recovery.yml",
+      ".github/workflows/self-release-promote.yml",
       ".github/workflows/release-candidate-promote.yml",
-      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+      ".github/workflows/self-release-tail-dogfood.yml"
     ],
     "excludedMechanisms": [
       "Paper product release",
       "npm dry-run",
       "v3 rollback workflows",
-      "retired compatibility workflows"
+      "retired compatibility workflows",
+      "Post-publication protected development review: no package, tag or Release mutation; independently inventoried in closedWorld and privilegedExecutableClosure."
     ]
   },
   "authorityClosure": {
@@ -70,6 +68,8 @@
       "actions/promote-buildchain-ref/v4-provider-plane.js",
       "actions/release-tail/index.js",
       "actions/v4-release-candidate-promote/index.js",
+      "actions/v4-release-candidate-promote/product-provider-adapters.js",
+      "actions/v4-release-candidate-promote/product-provider-github-adapters.js",
       "actions/v4-release-candidate-promote/product-provider.js",
       "packages/core/buildchain-agent-manuals.js",
       "packages/core/index.js",
@@ -80,15 +80,21 @@
       "packages/core/v4-publication-rehearsal.js"
     ],
     "runtimeSelectors": [
+      ".github/workflows/.build-engine.yml",
       ".github/workflows/.build.yml",
       ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/.release-promote.yml",
       ".github/workflows/.web-surface.yml",
-      ".github/workflows/buildchain-ref-promotion-recovery.yml",
-      ".github/workflows/buildchain-ref-promotion.yml",
       ".github/workflows/paper-release.yml",
+      ".github/workflows/public-build-publication.yml",
+      ".github/workflows/public-ops-tail-reseal.yml",
+      ".github/workflows/public-release-paper.yml",
+      ".github/workflows/public-release-promote.yml",
+      ".github/workflows/public-release-web.yml",
       ".github/workflows/publication-artifact.yml",
       ".github/workflows/release-candidate-promote.yml",
-      ".github/workflows/v4-tail-reseal.yml",
+      ".github/workflows/self-ops-promotion-recovery.yml",
+      ".github/workflows/self-release-promote.yml",
       "packages/core/buildchain-contract.js",
       "packages/core/v4-runtime-ref-resume-authority.js",
       "packages/core/v4-runtime-selector-persistence.js",
@@ -107,11 +113,112 @@
     "runtimeEngines": ["actions/v4-release-candidate-promote/index.js"],
     "terminalProjections": [
       ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/.release-promote.yml",
       "actions/v4-release-candidate-promote/index.js",
-      "packages/core/v4-release-invocation.js"
+      "packages/core/v4-release-invocation.js",
+      "scripts/v4-publication-settlement.mjs",
+      "scripts/v4-universal-workflow-engine.mjs"
+    ],
+    "privilegedExecutableClosure": {
+      "entrypoints": [
+        "actions/v4-release-candidate-promote/index.js",
+        "scripts/binary-publication-evidence.mjs",
+        "scripts/next-development-review.mjs",
+        "scripts/v4-publication-settlement.mjs"
+      ],
+      "modules": [
+        "actions/promote-buildchain-ref/github-release.js",
+        "actions/promote-buildchain-ref/internal/version-state.js",
+        "actions/promote-buildchain-ref/reuse-complete-release.js",
+        "actions/promote-buildchain-ref/v4-provider-plane.js",
+        "actions/v4-release-candidate-promote/index.js",
+        "actions/v4-release-candidate-promote/next-development-queue.js",
+        "actions/v4-release-candidate-promote/product-provider-adapters.js",
+        "actions/v4-release-candidate-promote/product-provider-github-adapters.js",
+        "actions/v4-release-candidate-promote/product-provider.js",
+        "actions/v4-release-candidate-promote/publication-completion.js",
+        "packages/core/adopter-delivery-gate.js",
+        "packages/core/adopter-delivery-json.js",
+        "packages/core/adopter-delivery-passport.js",
+        "packages/core/artifact-verification-envelope.js",
+        "packages/core/buildchain-channel-identity.js",
+        "packages/core/buildchain-compatibility-authority.js",
+        "packages/core/buildchain-compatibility-fact.js",
+        "packages/core/buildchain-compatibility-facts.json",
+        "packages/core/buildchain-compatibility-proof.js",
+        "packages/core/buildchain-config.js",
+        "packages/core/buildchain-contract.js",
+        "packages/core/buildchain-layout.js",
+        "packages/core/controller-evidence.js",
+        "packages/core/dev-delivery-common.js",
+        "packages/core/dev-delivery-contract-surface.js",
+        "packages/core/github-artifact-attestation.js",
+        "packages/core/kfd-adopter-manifest.js",
+        "packages/core/kfd-gate.js",
+        "packages/core/kfd-product-gates.js",
+        "packages/core/kungfu-temporal-fact.js",
+        "packages/core/next-development-transition.js",
+        "packages/core/package-manager.js",
+        "packages/core/public-surface-audit.js",
+        "packages/core/public-surface-cli.js",
+        "packages/core/publication-artifact-candidate.js",
+        "packages/core/publication-authority.js",
+        "packages/core/publication-sealed-bundle.js",
+        "packages/core/publish-transaction.js",
+        "packages/core/release-candidate-recovery.js",
+        "packages/core/release-candidate.js",
+        "packages/core/release-passport-contract.js",
+        "packages/core/release-passport.js",
+        "packages/core/release-tail-product-capabilities.js",
+        "packages/core/release-tail-provider-adapters.js",
+        "packages/core/release-tail-provider-plane.js",
+        "packages/core/spawn-command.js",
+        "packages/core/surface-manifest.js",
+        "packages/core/v4-canonical-contracts.js",
+        "packages/core/v4-domain-wasm-artifact.js",
+        "packages/core/v4-domain-wasm.js",
+        "packages/core/v4-floating-consumer-evidence.js",
+        "packages/core/v4-floating-consumer-policy.js",
+        "packages/core/v4-floating-consumer-release-passport.js",
+        "packages/core/v4-product-publication.js",
+        "packages/core/v4-protected-publication-source.js",
+        "packages/core/v4-publication-qualification.js",
+        "packages/core/v4-release-invocation.js",
+        "packages/core/v4-runtime-ref-resume-authority.js",
+        "packages/core/v4-runtime-selector-persistence.js",
+        "packages/core/web-surface-publication-candidate.js",
+        "packages/core/workflow-yaml-contract.js",
+        "scripts/binary-publication-evidence.mjs",
+        "scripts/ensure-github-release.mjs",
+        "scripts/next-development-review.mjs",
+        "scripts/release-asset-client.mjs",
+        "scripts/v4-publication-settlement.mjs",
+        "scripts/verify-version-state-delta.mjs"
+      ],
+      "root": "sha256:7a4de4f149edfdcced84267304aab1ccf9997badcaca899b7dc4fbe9288c34cb"
+    },
+    "rustWasmAuthority": {
+      "loader": "packages/core/v4-domain-wasm.js",
+      "metadata": "packages/core/v4-domain-wasm-artifact.js",
+      "artifact": "packages/core/buildchain-v4-domain.wasm",
+      "artifactRoot": "sha256:b37c330e9366b7e9cf9dc4b7573b1e9495212dd9520e8b8ec6cdc3fd0ab7cafd",
+      "distributedArtifacts": [
+        "actions/promote-buildchain-ref/dist/buildchain-v4-domain.wasm",
+        "actions/release-tail/dist/buildchain-v4-domain.wasm",
+        "actions/v4-release-candidate-promote/dist/buildchain-v4-domain.wasm"
+      ],
+      "byteIdenticalDistributions": true,
+      "fallbackWriterCount": 0
+    },
+    "legacyEngineModules": [
+      "actions/promote-buildchain-ref/internal/durable-transaction-operations.js",
+      "actions/promote-buildchain-ref/internal/promote-alpha-channel.js",
+      "actions/promote-buildchain-ref/internal/promote-major-channel.js",
+      "actions/promote-buildchain-ref/internal/promote-release-channel.js",
+      "actions/promote-buildchain-ref/lib.js"
     ],
     "freshEntry": ".github/workflows/release-candidate-promote.yml",
-    "recoveryEntry": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+    "recoveryEntry": ".github/workflows/self-ops-promotion-recovery.yml",
     "forbiddenLegacyEnginePatterns": [
       "legacy-promote",
       "v4-declarative-promote",
@@ -180,7 +287,7 @@
         "reusableEdges": []
       },
       {
-        "path": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+        "path": ".github/workflows/self-ops-promotion-recovery.yml",
         "triggers": ["workflow_dispatch"],
         "jobs": [
           "resume|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write"
@@ -190,9 +297,10 @@
         ]
       },
       {
-        "path": ".github/workflows/buildchain-ref-promotion.yml",
+        "path": ".github/workflows/self-release-promote.yml",
         "triggers": ["workflow_dispatch", "workflow_run:completed"],
         "jobs": [
+          "classify-workflow-run|runner|-|read|-|-|-",
           "promote|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
           "reject-invalid-candidate-recovery|runner|-|read|-|-|-",
           "reject-invalid-durable-recovery|runner|-|read|-|-|-",
@@ -215,7 +323,7 @@
         ]
       },
       {
-        "path": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
+        "path": ".github/workflows/self-release-tail-dogfood.yml",
         "triggers": ["workflow_dispatch"],
         "jobs": [
           "publish|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|-|-|-|-"
@@ -226,10 +334,10 @@
       }
     ],
     "metrics": {
-      "workflowCount": 37,
-      "jobCount": 92,
+      "workflowCount": 34,
+      "jobCount": 90,
       "reusableEdgeCount": 23,
-      "mutationRelevantNodeCount": 74,
+      "mutationRelevantNodeCount": 75,
       "contentsWriteJobCount": 14,
       "oidcWriteJobCount": 16
     },

package/architecture/v4-rust-wasm-production-authority.json

@@ -0,0 +1,58 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-rust-wasm-production-authority/v1",
+  "mode": "production",
+  "sourceAuthority": {
+    "crate": "crates/buildchain-v4-contracts",
+    "toolchain": "crates/buildchain-v4-contracts/rust-toolchain.toml",
+    "build": "scripts/build-v4-domain-wasm.mjs",
+    "reproducibilityCheck": "pnpm run check:v4-wasm"
+  },
+  "runtimeAuthority": {
+    "loader": "packages/core/v4-domain-wasm.js",
+    "metadata": "packages/core/v4-domain-wasm-artifact.js",
+    "artifact": "packages/core/buildchain-v4-domain.wasm",
+    "abiVersion": 1,
+    "fallbackWriterCount": 0,
+    "failurePolicy": "fail-closed"
+  },
+  "rustOwnedSemantics": [
+    "source-verification-evidence-identity-and-reuse",
+    "canonical-json-and-content-roots",
+    "release-invocation-plan-transaction-and-receipt",
+    "product-publication-plan-and-version-intent",
+    "provider-operation-journal-and-readback-fold",
+    "release-activation-plan-and-fold",
+    "stable-publication-fence",
+    "partial-mutation-recovery-plan",
+    "release-tail-plan-transaction-retry-readback-and-receipt"
+  ],
+  "nodeOwnedEffects": [
+    "provider-sdk-calls",
+    "filesystem-io",
+    "credential-and-environment-access",
+    "workflow-input-and-output-transport",
+    "provider-error-classification"
+  ],
+  "distribution": {
+    "npmPackage": "packages/core/buildchain-v4-domain.wasm",
+    "actionArtifacts": [
+      "actions/promote-buildchain-ref/dist/buildchain-v4-domain.wasm",
+      "actions/release-tail/dist/buildchain-v4-domain.wasm",
+      "actions/v4-release-candidate-promote/dist/buildchain-v4-domain.wasm"
+    ],
+    "artifactBinding": "sha256-metadata-before-instantiation",
+    "runtimeCompilation": false
+  },
+  "qualification": {
+    "platforms": ["linux-x64", "macos-arm64", "windows-x64"],
+    "productionRuntime": "node-24",
+    "checks": [
+      "tracked-artifact-reproducibility",
+      "abi-and-digest-binding",
+      "clean-process-loading-without-rust",
+      "missing-or-tampered-artifact-fails-closed",
+      "action-artifact-byte-identity"
+    ]
+  }
+}

package/architecture/v4-stable-publication-fence.json

@@ -10,7 +10,7 @@
     "productionWriterCount": 1,
     "fenceAuthority": "rust-v4-core",
     "fenceWriterCount": 1,
-    "typescript": "byte-equivalent-provider-adapter",
+    "typescript": "wasm-calling-provider-adapter",
     "candidateSelfQualification": false,
     "productionWriteChange": true
   },
@@ -29,7 +29,10 @@
   "publicationTargets": ["stable-ref", "npm-tag", "oci-tag", "github-release"],
   "implementations": {
     "rustDomain": "crates/buildchain-v4-contracts/src/stable_publication_fence.rs",
-    "typescript": "packages/core/v4-stable-publication-fence.js"
+    "typescript": "packages/core/v4-stable-publication-fence.js",
+    "wasmRuntime": "packages/core/v4-domain-wasm.js",
+    "wasmArtifact": "packages/core/buildchain-v4-domain.wasm",
+    "artifactMetadata": "packages/core/v4-domain-wasm-artifact.js"
   },
   "roots": [
     "stable-publication-candidate",

package/architecture/v4-stage-capsule-qualification.json

@@ -24,8 +24,8 @@
     ]
   },
   "publicConsumerDogfood": {
-    "callerWorkflow": ".github/workflows/v4-public-consumer-dogfood.yml",
-    "reusableWorkflow": "kungfu-systems/buildchain/.github/workflows/v4-stage-capsule-canary.yml",
+    "callerWorkflow": ".github/workflows/self-build-public-consumer-dogfood.yml",
+    "reusableWorkflow": "kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml",
     "validationRef": "v4-alpha",
     "invocation": "workflow_call",
     "runtimeBinding": "job.workflow_sha",

package/architecture/v4-tail-reseal-parity.json

@@ -10,7 +10,7 @@
   },
   "target": {
     "branch": "dev/v4/v4.0",
-    "publicReusableWorkflow": "kungfu-systems/buildchain/.github/workflows/v4-tail-reseal.yml@v4-alpha",
+    "publicReusableWorkflow": "kungfu-systems/buildchain/.github/workflows/public-ops-tail-reseal.yml@v4-alpha",
     "requestSchema": "contracts/v4-tail-reseal-v1.schema.json",
     "planner": "packages/core/v4-tail-reseal.js",
     "admission": "packages/core/v4-tail-reseal-github.js",
@@ -57,7 +57,7 @@
       "disposition": "implemented",
       "implementationEvidence": [
         "scripts/v4-tail-reseal.mjs",
-        ".github/workflows/v4-tail-reseal.yml"
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
       "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
     },
@@ -84,7 +84,7 @@
       "disposition": "implemented",
       "implementationEvidence": [
         "packages/core/v4-tail-reseal.js",
-        ".github/workflows/v4-tail-reseal.yml"
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
       "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
     },
@@ -111,7 +111,7 @@
       "disposition": "implemented",
       "implementationEvidence": [
         "packages/core/v4-tail-reseal-receipt.js",
-        ".github/workflows/v4-tail-reseal.yml"
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
       "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
     },
@@ -119,7 +119,9 @@
       "id": "TR-10",
       "claim": "The reusable workflow resolves job.workflow_sha as runtime evidence and exposes no persisted SHA, variable indirection or private self-dogfood path.",
       "disposition": "implemented",
-      "implementationEvidence": [".github/workflows/v4-tail-reseal.yml"],
+      "implementationEvidence": [
+        ".github/workflows/public-ops-tail-reseal.yml"
+      ],
       "verificationEvidence": ["tests/v4-tail-reseal-parity.test.mjs"]
     },
     {
@@ -146,5 +148,5 @@
       "verificationEvidence": []
     }
   ],
-  "matrixRoot": "sha256:126ec51c12a9dedeb9b9e187202781e3895856af1927b399ba3902f3940750ad"
+  "matrixRoot": "sha256:dc8d99f2e90473abde7a04c02300e7bfd0b48a2ff187e99fae0bc090ff2a855d"
 }

package/architecture/v4-universal-workflow-bootstrap.json

@@ -0,0 +1,171 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-bootstrap/v1",
+  "status": "migration-active",
+  "bootstrap": {
+    "publicWorkflow": ".github/workflows/bootstrap.yml",
+    "requestSchema": "kungfu-buildchain-v4-universal-workflow-request/v1",
+    "admissionSchema": "kungfu-buildchain-v4-universal-workflow-admission/v1",
+    "terminalReceiptSchema": "kungfu-buildchain-v4-universal-workflow-terminal-receipt/v1",
+    "candidateRepository": "kungfu-systems/buildchain",
+    "candidateEnginePath": "scripts/v4-universal-workflow-engine.mjs",
+    "consumerTemplate": "templates/universal-buildchain-bootstrap.yml",
+    "consumerRecoveryTemplate": "templates/universal-buildchain-bootstrap-recovery.yml",
+    "consumerRecoveryWorkflow": ".github/workflows/universal-bootstrap-recovery.yml",
+    "consumerRecoveryMode": "separate-pre-positioned-consumer-owned-shell",
+    "recoveryDependsOnPublishedBuildchain": false,
+    "selfDogfoodWorkflow": ".github/workflows/self-ops-bootstrap-dogfood.yml",
+    "faultCampaign": "architecture/v4-universal-workflow-fault-campaign.json",
+    "discoveryRefExecutionAuthority": false,
+    "exactShaExecutionAuthority": true,
+    "consumerSourceMutationPerIncident": false,
+    "consumerAdmission": "verified-caller-exact-repository-workflow-and-source",
+    "reviewRuntimeBinding": "reviewed-head-or-protected-alpha-merge-to-exact-runtime",
+    "buildchainReleasePromotionPerIncident": false,
+    "selfDogfoodUsesPublicContract": true
+  },
+  "capabilityAdapters": [
+    {
+      "id": "bootstrap-conformance",
+      "execution": "exact-candidate-engine",
+      "payloadSchema": "kungfu-buildchain-v4-universal-bootstrap-conformance/v1",
+      "providerEffects": false
+    },
+    {
+      "id": "release-candidate-promote",
+      "execution": "exact-candidate-action-and-provider-readback",
+      "payloadSchema": "kungfu-buildchain-v4-universal-release-promotion/v1",
+      "providerEffects": true
+    },
+    {
+      "id": "release-invocation",
+      "execution": "exact-candidate-canonical-projection",
+      "payloadSchema": "kungfu-buildchain-v4-release-invocation/v1",
+      "providerEffects": false
+    }
+  ],
+  "complexityBudget": {
+    "bootstrapAbis": 1,
+    "requestEnvelopes": 1,
+    "candidateResolvers": 1,
+    "candidateEngines": 1,
+    "terminalReceiptAuthorities": 1,
+    "perWorkflowBootstrapImplementations": 0,
+    "buildchainOnlySelfReleasePaths": 0,
+    "perIncidentConsumerEdits": 0
+  },
+  "permissionCeiling": {
+    "actions": "write",
+    "artifact-metadata": "write",
+    "attestations": "write",
+    "checks": "write",
+    "contents": "write",
+    "deployments": "write",
+    "id-token": "write",
+    "issues": "write",
+    "packages": "write",
+    "pages": "write",
+    "pull-requests": "write",
+    "security-events": "write",
+    "statuses": "write"
+  },
+  "inventoryWorkflows": [
+    ".github/workflows/.auditable-demo.yml",
+    ".github/workflows/.binary-release-assets.yml",
+    ".github/workflows/.build.yml",
+    ".github/workflows/.bump-minor-version.yml",
+    ".github/workflows/.declarative-auditable-demo.yml",
+    ".github/workflows/.gate-profile.yml",
+    ".github/workflows/.publication-authority.yml",
+    ".github/workflows/.release-candidate-promote.yml",
+    ".github/workflows/.release-verify.yml",
+    ".github/workflows/.sam-verify.yml",
+    ".github/workflows/.sync-release-page.yml",
+    ".github/workflows/.sync-remote-git.yml",
+    ".github/workflows/.web-surface.yml",
+    ".github/workflows/.wheel-verify.yml",
+    ".github/workflows/bootstrap.yml",
+    ".github/workflows/build.yml",
+    ".github/workflows/buildchain-patrol.yml",
+    ".github/workflows/check.yml",
+    ".github/workflows/dev-alpha-candidate-patrol.yml",
+    ".github/workflows/dev-delivery-warrant-cancel.yml",
+    ".github/workflows/dev-delivery-warrant-close.yml",
+    ".github/workflows/dev-pr-auto-merge.yml",
+    ".github/workflows/dev-qualification-patrol.yml",
+    ".github/workflows/engineering-housekeeper.yml",
+    ".github/workflows/github-artifact-attestation.yml",
+    ".github/workflows/paper-release-sealed.yml",
+    ".github/workflows/paper-release.yml",
+    ".github/workflows/patrol-daily.yml",
+    ".github/workflows/patrol-monthly.yml",
+    ".github/workflows/patrol-observed-evidence.yml",
+    ".github/workflows/patrol-weekly.yml",
+    ".github/workflows/publication-artifact.yml",
+    ".github/workflows/release-candidate-promote.yml",
+    ".github/workflows/release-governance-reconcile.yml",
+    ".github/workflows/release-propagation.yml",
+    ".github/workflows/release-tail.yml",
+    ".github/workflows/stable-candidate-patrol.yml",
+    ".github/workflows/universal-bootstrap-recovery.yml",
+    ".github/workflows/v4-adopter-delivery.yml",
+    ".github/workflows/v4-stage-capsule-canary.yml",
+    ".github/workflows/v4-tail-reseal.yml"
+  ],
+  "retiredWorkflowSurfaces": [],
+  "bootstrapGovernedWorkflows": [
+    ".github/workflows/.auditable-demo.yml",
+    ".github/workflows/.binary-release-assets.yml",
+    ".github/workflows/.build.yml",
+    ".github/workflows/.bump-minor-version.yml",
+    ".github/workflows/.declarative-auditable-demo.yml",
+    ".github/workflows/.gate-profile.yml",
+    ".github/workflows/.publication-authority.yml",
+    ".github/workflows/.release-candidate-promote.yml",
+    ".github/workflows/.release-verify.yml",
+    ".github/workflows/.sam-verify.yml",
+    ".github/workflows/.sync-release-page.yml",
+    ".github/workflows/.sync-remote-git.yml",
+    ".github/workflows/.web-surface.yml",
+    ".github/workflows/.wheel-verify.yml",
+    ".github/workflows/bootstrap.yml",
+    ".github/workflows/build.yml",
+    ".github/workflows/buildchain-patrol.yml",
+    ".github/workflows/check.yml",
+    ".github/workflows/dev-alpha-candidate-patrol.yml",
+    ".github/workflows/dev-delivery-warrant-cancel.yml",
+    ".github/workflows/dev-delivery-warrant-close.yml",
+    ".github/workflows/dev-pr-auto-merge.yml",
+    ".github/workflows/dev-qualification-patrol.yml",
+    ".github/workflows/engineering-housekeeper.yml",
+    ".github/workflows/github-artifact-attestation.yml",
+    ".github/workflows/paper-release-sealed.yml",
+    ".github/workflows/paper-release.yml",
+    ".github/workflows/patrol-daily.yml",
+    ".github/workflows/patrol-monthly.yml",
+    ".github/workflows/patrol-observed-evidence.yml",
+    ".github/workflows/patrol-weekly.yml",
+    ".github/workflows/publication-artifact.yml",
+    ".github/workflows/release-candidate-promote.yml",
+    ".github/workflows/release-governance-reconcile.yml",
+    ".github/workflows/release-propagation.yml",
+    ".github/workflows/release-tail.yml",
+    ".github/workflows/stable-candidate-patrol.yml",
+    ".github/workflows/v4-adopter-delivery.yml",
+    ".github/workflows/v4-stage-capsule-canary.yml",
+    ".github/workflows/v4-tail-reseal.yml"
+  ],
+  "migration": {
+    "compatibilityFacadeGenerator": "scripts/generate-v4-universal-workflow-facades.mjs",
+    "facadeSourceRevision": "06a2d9f7d5753c5c9b2bf0e7f0e3220fc18cc183",
+    "channelGeneratedFacades": [
+      ".github/workflows/build.yml",
+      ".github/workflows/release-candidate-promote.yml"
+    ],
+    "staticBootstrap": "implemented",
+    "candidateEngine": "bounded-capability-adapters",
+    "compatibilityFacades": "generated-dual-path",
+    "externalConsumerDogfood": "public-consumer-three-platform-runtime-and-non-circular-recovery-hosted-proof-passed",
+    "buildchainSelfDogfood": "train-primary-and-consumer-recovery-three-pair-hosted-proof-passed",
+    "oldPathRetirement": "pending-protected-dev-integration"
+  }
+}