@kungfu-tech/buildchain 4.0.2-alpha.4 → 4.0.2-alpha.41

package/architecture/release-tail-contract-inventory.json

@@ -427,7 +427,7 @@
       "repository": "kungfu-systems/buildchain",
       "sourceCommit": "7c8956e8babb521d3e743d40108f115a59a40427",
       "sourceTree": "7e24ca6bafe98b571d94c3bcf07a9d38b31092c5",
-      "workflow": ".github/workflows/buildchain-ref-promotion.yml",
+      "workflow": ".github/workflows/self-release-promote.yml",
       "runtimeRef": "local exact checkout",
       "executableSurfaceIds": []
     },
@@ -454,7 +454,7 @@
       "repository": "kungfu-systems/kungfu",
       "sourceCommit": "445ec32d6bf53dd5ff502d685792406ad38dd4f5",
       "sourceTree": "4963b2f9deb0245f7277cea7224ab0d062a0cc54",
-      "workflow": ".github/workflows/release-new-version.yml",
+      "workflow": ".github/workflows/self-release-new-version-compat.yml",
       "runtimeRef": "train/v3/v3.0/resume-candidate-run",
       "executableSurfaceIds": [
         "publication-admission-commands",
@@ -470,7 +470,7 @@
       "repository": "kungfu-systems/libnode",
       "sourceCommit": "4bef69b88a441f22024fa9f3d7bfd76a89963e8a",
       "sourceTree": "6c4dec7fd70cbdcfbc9ada19e66271654eb393af",
-      "workflow": ".github/workflows/release-new-version.yml",
+      "workflow": ".github/workflows/self-release-new-version-compat.yml",
       "runtimeRef": "v3-alpha",
       "executableSurfaceIds": ["release-passport-producer-commands"]
     },
@@ -479,7 +479,7 @@
       "repository": "kungfu-systems/kfd",
       "sourceCommit": "e82fe11acecdbebfd0c42778c7a1bd6fdc54ab81",
       "sourceTree": "fe0ad4f4b98889c7c246fe16958e118ff79b193b",
-      "workflow": ".github/workflows/buildchain-ref-promotion.yml",
+      "workflow": ".github/workflows/self-release-promote.yml",
       "runtimeRef": "v3-alpha",
       "executableSurfaceIds": []
     },
@@ -488,7 +488,7 @@
       "repository": "kungfu-systems/paper-kungfu-product-white-paper",
       "sourceCommit": "82dd748d6b0edf18d0074262cc8d8ac803e45c7e",
       "sourceTree": "a918f8840608931fdf88d007e20bc4f70ab7eb54",
-      "workflow": ".github/workflows/buildchain-ref-promotion.yml",
+      "workflow": ".github/workflows/self-release-promote.yml",
       "runtimeRef": "v3",
       "executableSurfaceIds": []
     }
@@ -497,7 +497,7 @@
     {
       "repository": "kungfu-systems/agent-hub-demo",
       "sourceCommit": "633111450867919d5063298308cdbfcbd77a8d2e",
-      "workflow": ".github/workflows/buildchain-ref-promotion.yml",
+      "workflow": ".github/workflows/self-release-promote.yml",
       "runtimeRef": "v2",
       "reason": "outside the Buildchain v3 contract inventory"
     }

package/architecture/v4-architecture-constitution.md

@@ -43,8 +43,8 @@ ledger.
 Dependencies point inward only:
 
 ```text
-workflows -> TypeScript adapters -> libnode host -> Rust domain -> contracts
-legacy compatibility -> TypeScript adapters / contracts
+workflows -> Node provider/IO adapters -> tracked Rust/WASM domain -> contracts
+legacy compatibility -> Node facades / contracts
 ```
 
 Contracts contain serialization and compatibility facts, not provider SDK
@@ -55,12 +55,12 @@ or Rust domain are hard-zero violations. Cycles are forbidden.
 ## 3. Single-writer rule
 
 Every state machine has exactly one authoritative writer. The v4 cutover marks
-the TypeScript v4 control and provider plane authoritative and the legacy v3
-writer retired. Rust v4 owns the deterministic release-activation, journal,
-stable-fence, and recovery domain semantics while the TypeScript v4 adapter
-remains byte-equivalent at that boundary. A second writer, permanent dual
-write, cross-machine mutable file, or implicit compatibility authority has a
-hard-zero budget.
+the Rust/WASM domain authoritative and the legacy v3 and duplicate TypeScript
+semantic writers retired. Node owns provider and IO effects and exposes
+compatibility facades, but every deterministic release plan, fold, root, retry,
+and receipt decision crosses the checked WASM ABI. A second writer, permanent
+dual write, semantic fallback, cross-machine mutable file, or implicit
+compatibility authority has a hard-zero budget.
 
 ## 4. Explicit complexity budgets
 
@@ -85,10 +85,14 @@ second hand-maintained architecture list is authoritative.
 ## 6. Production cutover boundary
 
 The v4 line owns Delivery Warrant, Release Transaction, activation,
-publication, propagation, and release-tail state. This does not introduce a
-daemon, a service database, provider SDKs in contracts or Rust domain code, or
-a second writer. The retained `release/v3/v3.0` coordinate is rollback evidence
-only and cannot regain production authority without a new reviewed cutover.
+publication, propagation, and release-tail state. Its production domain is the
+tracked artifact governed by
+[`v4-rust-wasm-production-authority.json`](v4-rust-wasm-production-authority.json):
+Node verifies the artifact digest and ABI before use and fails closed without a
+JavaScript semantic fallback. This does not introduce a daemon, a service
+database, provider SDKs in contracts or Rust domain code, or a second writer.
+The retained `release/v3/v3.0` coordinate is rollback evidence only and cannot
+regain production authority without a new reviewed cutover.
 
 ## 7. Wave 0 host boundary
 
@@ -133,9 +137,8 @@ The executable provider operation journal contract is
 [`v4-provider-operation-journal-contract.json`](v4-provider-operation-journal-contract.json).
 It freezes one closed schema authority and one Rust v4 state-fold authority
 for append-only intent, attempt, rooted observation, confirmation, and
-reconciliation records. The TypeScript v4 plane performs provider adaptation
-and conformance projection against the same fixtures; v4 is the sole
-production writer.
+reconciliation records. The Node v4 plane performs provider adaptation and
+calls the tracked Rust/WASM authority; it contains no second state fold.
 
 Logical operation identity excludes attempt ordinals and mutable provider or
 runner facts. Every retry preserves `operationRoot`, while every attempt and
@@ -161,9 +164,9 @@ The executable release activation boundary is
 [`v4-release-activation-shadow-domain.json`](v4-release-activation-shadow-domain.json).
 It consumes an explicit qualification root, dependency graph, compensation
 boundaries, provider-operation identities, and append-only journal facts to
-derive one deterministic activation plan and resume state. Rust is the sole v4
-plan-and-fold authority; TypeScript must remain byte-equivalent against
-the same closed schema and fixture.
+derive one deterministic activation plan and resume state. Rust/WASM is the
+sole v4 plan-and-fold authority; the Node facade delegates through the checked
+ABI and retains only provider adaptation.
 
 Confirmed operations are never eligible for replay. Attempting, observed, and
 confirmable operations require provider-neutral readback before any retry,
@@ -203,8 +206,8 @@ Every nonterminal operation maps deterministically to `retry`, `wait`,
 `terminal-noop` facts and never re-enter the next-operation set. Missing,
 expired, corrupt, conflicting, cross-boundary, or attempt-budget-exhausted
 evidence fails closed at an exact Stage Capsule or provider-operation
-checkpoint. The Rust domain is the sole v4 planner and TypeScript is a
-byte-equivalent projection. Both are pure: they perform zero provider,
+checkpoint. The Rust/WASM domain is the sole v4 planner and the Node facade
+delegates to it. The planner is pure: it performs zero provider,
 filesystem, network, credential, ref, package, image, or release mutation.
 Their exact plan is the only recovery authority consumed by the TypeScript v4
 provider adapter.

package/architecture/v4-cross-platform-adopter-qualification.json

@@ -4,7 +4,7 @@
   "inventoryAuthority": "architecture/v3-v4-live-capability-inventory.json",
   "implementation": "packages/core/v4-cross-platform-adopter-qualification.js",
   "runner": "scripts/v4-cross-platform-adopter-qualification.mjs",
-  "publicWorkflow": ".github/workflows/v4-adopter-delivery.yml",
+  "publicWorkflow": ".github/workflows/public-build-adopter-qualification.yml",
   "sourceBinding": {
     "runtime": "job.workflow_sha",
     "consumer": "exact checked-out consumer commit",

package/architecture/v4-delivery-authority-parity.json

@@ -227,7 +227,7 @@
         "docs/dev-delivery-warrant.md",
         "docs/dev-delivery-qualification-landing-adr.md",
         "templates/native-dev-delivery.yml",
-        ".github/workflows/buildchain-dev-delivery.yml",
+        ".github/workflows/self-ops-dev-delivery.yml",
         ".buildchain/contract-lock.json",
         ".buildchain/alpha-contract-lock.json"
       ],
@@ -246,5 +246,5 @@
       "verificationEvidence": []
     }
   ],
-  "matrixRoot": "sha256:5be5abf70b982374f32a1400d4ec7c830017a0473d03165e831a506c94c8b881"
+  "matrixRoot": "sha256:85fc624f09abb2014601a9857dbcd07a59750b6dd6d77ab240ed037d3169ac69"
 }

package/architecture/v4-delivery-warrant-shadow-bootstrap-plan.json

@@ -9,7 +9,7 @@
     "legacyCore": "packages/core/dev-delivery-warrant.js",
     "legacyStore": "scripts/dev-delivery-warrant.mjs",
     "legacyWorkflows": [
-      ".github/workflows/buildchain-dev-delivery.yml",
+      ".github/workflows/self-ops-dev-delivery.yml",
       ".github/workflows/dev-delivery-warrant-close.yml",
       ".github/workflows/dev-delivery-warrant-cancel.yml"
     ]

package/architecture/v4-floating-consumer-policy.json

@@ -10,7 +10,7 @@
       ".github/workflows/.build.yml",
       ".github/workflows/publication-artifact.yml",
       ".github/workflows/release-candidate-promote.yml",
-      ".github/workflows/v4-stage-capsule-canary.yml"
+      ".github/workflows/public-build-stage-capsule-canary.yml"
     ]
   },
   "contractLocks": {
@@ -38,7 +38,7 @@
     "persistedSelectorOverride": false,
     "protectedAlphaRecoveryBootstrap": {
       "selector": "alpha/v4/v4.0",
-      "sourcePath": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+      "sourcePath": ".github/workflows/self-ops-promotion-recovery.yml",
       "workflow": ".github/workflows/.release-candidate-promote.yml",
       "repository": "kungfu-systems/buildchain"
     },

package/architecture/v4-next-development-parity.json

@@ -11,8 +11,8 @@
   "target": {
     "branch": "dev/v4/v4.0",
     "implementationBaseline": "36ad1dc03a9d2785aca938a7a369e4b96707fa32",
-    "publicConsumerCaller": ".github/workflows/v4-public-consumer-dogfood.yml",
-    "publicConsumerReusable": "kungfu-systems/buildchain/.github/workflows/v4-stage-capsule-canary.yml@v4-alpha"
+    "publicConsumerCaller": ".github/workflows/self-build-public-consumer-dogfood.yml",
+    "publicConsumerReusable": "kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml@v4-alpha"
   },
   "earlierContinuityDelta": {
     "assignment": "2026-08-11-buildchain-next-development-version-continuity",
@@ -152,8 +152,8 @@
       "claim": "V4 recovery proof runs as pure tests through the standard lifecycle.verify reached by the exact thin public consumer caller, while existing hosted dual-channel evidence keeps public v4-alpha and v4 routes.",
       "disposition": "implemented",
       "implementationEvidence": [
-        ".github/workflows/v4-public-consumer-dogfood.yml",
-        ".github/workflows/buildchain-alpha-self-dogfood.yml",
+        ".github/workflows/self-build-public-consumer-dogfood.yml",
+        ".github/workflows/self-build-alpha-dogfood.yml",
         ".buildchain/buildchain.toml",
         "scripts/next-development-self-dogfood.mjs",
         "scripts/next-development-self-dogfood-harness.mjs"
@@ -188,5 +188,5 @@
       "verificationEvidence": []
     }
   ],
-  "matrixRoot": "sha256:0f0d69dd338cad33dc61870675cbedb8664e019e403f73a1ddcf8471d69df405"
+  "matrixRoot": "sha256:6affa0278532cfc96d3af04d113d7c509ec18df3a86d86945a2a5e7418d7c83e"
 }

package/architecture/v4-partial-mutation-recovery-qualification.json

@@ -39,7 +39,10 @@
   ],
   "implementations": {
     "rustDomain": "crates/buildchain-v4-contracts/src/partial_mutation_recovery.rs",
-    "typescript": "packages/core/v4-partial-mutation-recovery-qualification.js"
+    "typescript": "packages/core/v4-partial-mutation-recovery-qualification.js",
+    "wasmRuntime": "packages/core/v4-domain-wasm.js",
+    "wasmArtifact": "packages/core/buildchain-v4-domain.wasm",
+    "artifactMetadata": "packages/core/v4-domain-wasm-artifact.js"
   },
   "roots": [
     "partial-mutation-recovery-checkpoint",

package/architecture/v4-platform-stage-checkpoints.json

@@ -81,7 +81,7 @@
     }
   ],
   "projections": {
-    "protectedWorkflow": ".github/workflows/verify.yml",
+    "protectedWorkflow": ".github/workflows/self-build-verify.yml",
     "generatedTemplate": "scripts/init-repo.mjs",
     "agentGuidance": "AGENTS.md",
     "manual": "docs/v4-stage-capsule.md"

package/architecture/v4-provider-operation-journal-contract.json

@@ -9,7 +9,7 @@
     "productionWriterCount": 1,
     "stateFoldAuthority": "rust-v4-core",
     "stateFoldWriterCount": 1,
-    "typescript": "provider-adapter-and-conformance-plane",
+    "typescript": "wasm-calling-provider-adapter-and-conformance-plane",
     "productionWriteChange": true
   },
   "implementations": {
@@ -17,7 +17,10 @@
     "rustFold": "crates/buildchain-v4-contracts/src/provider_operation_journal/fold.rs",
     "rustReadback": "crates/buildchain-v4-contracts/src/provider_readback_idempotency.rs",
     "typescript": "packages/core/v4-provider-operation-journal.js",
-    "typescriptReadback": "packages/core/v4-provider-readback-idempotency.js"
+    "typescriptReadback": "packages/core/v4-provider-readback-idempotency.js",
+    "wasmRuntime": "packages/core/v4-domain-wasm.js",
+    "wasmArtifact": "packages/core/buildchain-v4-domain.wasm",
+    "artifactMetadata": "packages/core/v4-domain-wasm-artifact.js"
   },
   "activationDomain": {
     "architecture": "architecture/v4-release-activation-shadow-domain.json",

package/architecture/v4-publication-facade-patches.json

@@ -0,0 +1,64 @@
+{
+  "schemaVersion": 1,
+  "sourceRevision": "a41c00a0c0b2dbd57c238cd9b326b167a1d27ca8",
+  "purpose": "Retain completed v4 publication receipt independently of next-development and preserve immutable binary publication assets. Scope publication checks to governed Paper repositories without changing generic report lifecycle contracts.",
+  "facades": [
+    {
+      "workflow": ".github/workflows/.binary-release-assets.yml",
+      "beforeSha256": "5dfaea0f9cf83500706f423eca08f43594fe3653fa139da359041e88fae49266",
+      "afterSha256": "06831b3ec8db28fbf96ffa8907fd58c1a77dd09e8d4fe02100a98febe10dba34",
+      "replacements": [
+        {
+          "before": "          fs.writeFileSync(\".buildchain/publication-authority/capability.json\", `${JSON.stringify(capability, null, 2)}\\n`);\n          NODE\n\n      - name: Upload GitHub Release assets\n        env:\n          GH_TOKEN: ${{ github.token }}\n          RELEASE_TAG: ${{ inputs.release-tag }}\n",
+          "after": "          fs.writeFileSync(\".buildchain/publication-authority/capability.json\", `${JSON.stringify(capability, null, 2)}\\n`);\n          NODE\n\n      - uses: actions/setup-node@v6.4.0\n        if: ${{ startsWith(inputs.release-tag, 'v4.') }}\n        with:\n          node-version: \"24\"\n\n      - name: Install exact publication runtime dependencies\n        if: ${{ startsWith(inputs.release-tag, 'v4.') }}\n        run: corepack pnpm@11.7.0 install --frozen-lockfile --ignore-scripts\n\n      - name: Upload immutable GitHub Release assets and verify readback\n        if: ${{ startsWith(inputs.release-tag, 'v4.') }}\n        env:\n          GH_TOKEN: ${{ github.token }}\n          RELEASE_TAG: ${{ inputs.release-tag }}\n        run: node scripts/binary-publication-evidence.mjs publish\n\n      - name: Retain binary publication readback\n        if: ${{ startsWith(inputs.release-tag, 'v4.') }}\n        uses: actions/upload-artifact@v7.0.1\n        with:\n          name: binary-publication-readback-${{ inputs.release-tag }}\n          path: .buildchain/binary-publication/readback.json\n          include-hidden-files: true\n          if-no-files-found: error\n\n      - name: Upload GitHub Release assets\n        if: ${{ !startsWith(inputs.release-tag, 'v4.') }}\n        env:\n          GH_TOKEN: ${{ github.token }}\n          RELEASE_TAG: ${{ inputs.release-tag }}\n"
+        }
+      ]
+    },
+    {
+      "workflow": ".github/workflows/.release-candidate-promote.yml",
+      "beforeSha256": "177b3c50685405e5ed2bf1ac893469fdb3a27e7b03d55025611b2985028cd8cf",
+      "afterSha256": "9c7f3586a3444cdad34d2a61be3cb9b0ae271fb56f9e371d9c37940e6b317780",
+      "replacements": [
+        {
+          "before": "      release-candidate-artifact: ${{ needs.qualify.outputs.candidate-artifact }}\n      release-candidate-action: canonical-release-invocation\n      release-candidate-outcome: success\n      promotion-outcome: success\n      finalization-needed: \"false\"\n      release-tail-transaction-state: ${{ steps.provider.outputs.transaction-state || steps.resume.outputs.transaction-state }}\n      release-tail-declaration-root: ${{ steps.provider.outputs.declaration-root || steps.resume.outputs.declaration-root }}\n      release-tail-transaction-root: ${{ steps.provider.outputs.transaction-root || steps.resume.outputs.transaction-root }}\n",
+          "after": "      release-candidate-artifact: ${{ needs.qualify.outputs.candidate-artifact }}\n      release-candidate-action: canonical-release-invocation\n      release-candidate-outcome: success\n      promotion-outcome: ${{ steps.publication-settlement.outputs.status == 'complete' && 'success' || 'failure' }}\n      finalization-needed: ${{ steps.publication-settlement.outputs.status != 'complete' }}\n      release-tail-transaction-state: ${{ steps.provider.outputs.transaction-state || steps.resume.outputs.transaction-state }}\n      release-tail-declaration-root: ${{ steps.provider.outputs.declaration-root || steps.resume.outputs.declaration-root }}\n      release-tail-transaction-root: ${{ steps.provider.outputs.transaction-root || steps.resume.outputs.transaction-root }}\n"
+        },
+        {
+          "before": "      release-tail-receipt-roots-json: ${{ steps.provider.outputs.receipt-roots-json || steps.resume.outputs.receipt-roots-json }}\n      release-invocation-root: ${{ steps.provider.outputs.release-invocation-root || steps.resume.outputs.release-invocation-root }}\n      release-transaction-root: ${{ steps.provider.outputs.release-transaction-root || steps.resume.outputs.release-transaction-root }}\n      release-receipt-root: ${{ steps.provider.outputs.release-receipt-root || steps.resume.outputs.release-receipt-root }}\n    steps:\n      - name: Checkout the admitted protected channel state\n        uses: actions/checkout@v7.0.0\n",
+          "after": "      release-tail-receipt-roots-json: ${{ steps.provider.outputs.receipt-roots-json || steps.resume.outputs.receipt-roots-json }}\n      release-invocation-root: ${{ steps.provider.outputs.release-invocation-root || steps.resume.outputs.release-invocation-root }}\n      release-transaction-root: ${{ steps.provider.outputs.release-transaction-root || steps.resume.outputs.release-transaction-root }}\n      release-receipt-root: ${{ steps.publication-settlement.outputs.receipt-root || steps.provider.outputs.release-receipt-root || steps.resume.outputs.release-receipt-root }}\n    steps:\n      - name: Checkout the admitted protected channel state\n        uses: actions/checkout@v7.0.0\n"
+        },
+        {
+          "before": "        uses: ./.buildchain/runtime/actions/v4-release-candidate-promote\n        with: *provider-inputs\n\n      - name: Retain canonical APPLY and ReleaseReceipt evidence\n        if: ${{ always() }}\n        uses: actions/upload-artifact@v7.0.1\n",
+          "after": "        uses: ./.buildchain/runtime/actions/v4-release-candidate-promote\n        with: *provider-inputs\n\n      - name: Retain completed publication independently of next-development\n        id: publication-settlement\n        if: ${{ always() && hashFiles('.buildchain/release-tail/release-receipt.json') != '' }}\n        env:\n          GH_TOKEN: ${{ github.token }}\n          CANDIDATE_SHA: ${{ needs.qualify.outputs.requested-sha }}\n          APPLY_OUTCOME: ${{ (steps.resume.outcome == 'success' || steps.resume.outcome == 'failure') && steps.resume.outcome || steps.provider.outcome }}\n        run: node .buildchain/runtime/scripts/v4-publication-settlement.mjs .buildchain\n\n      - name: Retain canonical APPLY and ReleaseReceipt evidence\n        if: ${{ always() }}\n        uses: actions/upload-artifact@v7.0.1\n"
+        },
+        {
+          "before": "      controller-receipt-status: ${{ steps.verify.outputs.status || steps.projection-state.outputs.status }}\n    steps:\n      - name: Checkout the admitted receipt verifier\n        if: ${{ needs.apply.result == 'success' }}\n        uses: actions/checkout@v7.0.0\n        with:\n          repository: kungfu-systems/buildchain\n",
+          "after": "      controller-receipt-status: ${{ steps.verify.outputs.status || steps.projection-state.outputs.status }}\n    steps:\n      - name: Checkout the admitted receipt verifier\n        if: ${{ needs.qualify.outputs.action == 'promote' && !inputs.dry-run }}\n        uses: actions/checkout@v7.0.0\n        with:\n          repository: kungfu-systems/buildchain\n"
+        },
+        {
+          "before": "          persist-credentials: false\n\n      - name: Restore canonical APPLY evidence\n        if: ${{ needs.apply.result == 'success' }}\n        uses: actions/download-artifact@v7.0.0\n        with:\n          name: buildchain-v4-release-apply-${{ needs.qualify.outputs.requested-sha }}\n",
+          "after": "          persist-credentials: false\n\n      - name: Restore canonical APPLY evidence\n        if: ${{ needs.qualify.outputs.action == 'promote' && !inputs.dry-run }}\n        uses: actions/download-artifact@v7.0.0\n        with:\n          name: buildchain-v4-release-apply-${{ needs.qualify.outputs.requested-sha }}\n"
+        },
+        {
+          "before": "\n      - name: Verify the single terminal receipt\n        id: verify\n        if: ${{ needs.apply.result == 'success' }}\n        shell: bash\n        run: |\n          node --input-type=module <<'NODE'\n          import fs from \"node:fs\";\n          import {\n            createV4ReleaseInvocation,\n            createV4ReleaseReceipt,\n            createV4ReleaseTransaction,\n          } from \"./.buildchain/runtime/packages/core/v4-release-invocation.js\";\n          const base = \".buildchain/evidence/release-tail\";\n          const invocation = JSON.parse(fs.readFileSync(`${base}/release-invocation.json`, \"utf8\"));\n          const transaction = JSON.parse(fs.readFileSync(`${base}/release-transaction.json`, \"utf8\"));\n          const storedReceipt = JSON.parse(fs.readFileSync(`${base}/release-receipt.json`, \"utf8\"));\n          const invocationProjection = createV4ReleaseInvocation(invocation);\n          const transactionProjection = createV4ReleaseTransaction({\n            invocationRoot: transaction.invocationRoot,\n            publisherRoot: transaction.publisherRoot,\n            runtimeRoot: transaction.runtimeRoot,\n            providerRoot: transaction.providerRoot,\n            parentRoot: transaction.parentRoot,\n          });\n          const { receiptRoot, ...receipt } = storedReceipt;\n          const receiptProjection = createV4ReleaseReceipt(receipt);\n          if (transaction.invocationRoot !== invocationProjection.roots.invocationRoot ||\n              transaction.transactionRoot !== transactionProjection.transactionRoot ||\n              receipt.transactionRoot !== transactionProjection.transactionRoot ||\n              receiptProjection.receiptRoot !== receiptRoot || receipt.outcome !== \"complete\") {\n            throw new Error(\"terminal ReleaseReceipt lineage does not verify\");\n          }\n          fs.appendFileSync(process.env.GITHUB_OUTPUT,\n            `receipt-json=${JSON.stringify(storedReceipt)}\\nreceipt-root=${receiptRoot}\\nstatus=complete\\n`);\n          NODE\n\n      - name: Record non-terminal projection state\n        id: projection-state\n        if: ${{ needs.apply.result != 'success' }}\n        shell: bash\n        run: |\n          echo \"status=${{ inputs.dry-run && 'dry-run' || needs.qualify.outputs.action == 'noop' && 'noop' || 'blocked' }}\" >> \"$GITHUB_OUTPUT\"\n",
+          "after": "\n      - name: Verify the single terminal receipt\n        id: verify\n        env:\n          CANDIDATE_SHA: ${{ needs.qualify.outputs.requested-sha }}\n        if: ${{ needs.qualify.outputs.action == 'promote' && !inputs.dry-run }}\n        shell: bash\n        run: |\n          node --input-type=module <<'NODE'\n          import fs from \"node:fs\";\n          const { readApplyDocuments, verifyPublicationSettlement } = await import(\"./.buildchain/runtime/scripts/v4-publication-settlement.mjs\");\n          const documents = readApplyDocuments(\".buildchain/evidence\");\n          verifyPublicationSettlement(documents, {\n            repository: process.env.GITHUB_REPOSITORY,\n            candidateSha: process.env.CANDIDATE_SHA,\n            tag: documents.invocation.target.tag,\n            sourceSha: documents.product.publication.releaseSha,\n          });\n          const storedReceipt = documents.receipt;\n          const receiptRoot = storedReceipt.receiptRoot;\n          fs.appendFileSync(process.env.GITHUB_OUTPUT,\n            `receipt-json=${JSON.stringify(storedReceipt)}\\nreceipt-root=${receiptRoot}\\nstatus=complete\\n`);\n          NODE\n\n      - name: Record non-terminal projection state\n        id: projection-state\n        if: ${{ always() && steps.verify.outcome != 'success' }}\n        shell: bash\n        run: |\n          echo \"status=${{ inputs.dry-run && 'dry-run' || needs.qualify.outputs.action == 'noop' && 'noop' || 'blocked' }}\" >> \"$GITHUB_OUTPUT\"\n"
+        },
+        {
+          "before": "            .buildchain/evidence/release-tail/release-invocation.json\n            .buildchain/evidence/release-tail/release-transaction.json\n            .buildchain/evidence/release-tail/release-receipt.json\n          if-no-files-found: error\n",
+          "after": "            .buildchain/evidence/release-tail/release-invocation.json\n            .buildchain/evidence/release-tail/release-transaction.json\n            .buildchain/evidence/release-tail/release-receipt.json\n            .buildchain/evidence/release-tail/delivery-summary.json\n            .buildchain/evidence/release-tail/buildchain-publication-settlement.json\n          if-no-files-found: error\n"
+        }
+      ]
+    },
+    {
+      "workflow": ".github/workflows/check.yml",
+      "beforeSha256": "44797c1b64e54806e19cf401300a27e587d6a2f0730ee7509eb84aefb9b60f74",
+      "afterSha256": "fbf3549e4f4987733f53ff362bf49d2001d56ae5842bbd1ed343c0fba40d9429",
+      "replacements": [
+        {
+          "before": "          config=\"${BUILDCHAIN_WORKING_DIRECTORY}/.buildchain/buildchain.toml\"\n          if [ -f \"$config\" ] && grep -Eq '^[[:space:]]*type[[:space:]]*=[[:space:]]*\"publication-artifact\"[[:space:]]*$' \"$config\"; then\n            node .buildchain/runtime/bin/buildchain.mjs paper preflight \\\n              --cwd \"$BUILDCHAIN_WORKING_DIRECTORY\" \\\n              --offline \\\n              --ci \\\n              --json\n          else\n            echo \"Buildchain Paper policy: not applicable\"\n          fi\n",
+          "after": "          node --input-type=module <<'NODE'\n          import fs from \"node:fs\";\n          import path from \"node:path\";\n          import { loadBuildchainConfig } from \"./.buildchain/runtime/packages/core/buildchain-config.js\";\n          import { spawnSyncCommand } from \"./.buildchain/runtime/packages/core/spawn-command.js\";\n          const cwd = path.resolve(process.env.BUILDCHAIN_WORKING_DIRECTORY || \".\");\n          // Validate before deciding applicability; malformed config never skips policy.\n          const config = loadBuildchainConfig(cwd)?.config;\n          const governedPaper = fs.existsSync(path.join(cwd, \".buildchain/paper\"))\n            || config?.publish?.kind === \"npm-paper-package\"\n            || (config?.project?.type === \"publication-artifact\"\n              && (!config.publication || config.publication.kind === \"paper\"));\n          if (governedPaper) {\n            const result = spawnSyncCommand(process.execPath, [\n              \".buildchain/runtime/bin/buildchain.mjs\", \"paper\", \"preflight\",\n              \"--cwd\", cwd, \"--offline\", \"--ci\", \"--json\",\n            ], { stdio: \"inherit\" });\n            if (result.error) throw result.error;\n            process.exitCode = result.status ?? 1;\n          } else {\n            console.log(\"Buildchain Paper policy: not applicable\");\n          }\n          NODE\n"
+        }
+      ]
+    }
+  ]
+}

package/architecture/v4-release-activation-shadow-domain.json

@@ -10,14 +10,17 @@
     "productionWriterCount": 1,
     "planAndFoldAuthority": "rust-v4-core",
     "planAndFoldWriterCount": 1,
-    "typescript": "byte-equivalent-provider-adapter",
+    "typescript": "wasm-calling-provider-adapter",
     "productionWriteChange": true
   },
   "implementations": {
     "rustDomain": "crates/buildchain-v4-contracts/src/release_activation_shadow.rs",
     "rustModel": "crates/buildchain-v4-contracts/src/release_activation_shadow/model.rs",
     "rustJournalMaterializer": "crates/buildchain-v4-contracts/src/release_activation_shadow/journal.rs",
-    "typescript": "packages/core/v4-release-activation-shadow.js"
+    "typescript": "packages/core/v4-release-activation-shadow.js",
+    "wasmRuntime": "packages/core/v4-domain-wasm.js",
+    "wasmArtifact": "packages/core/buildchain-v4-domain.wasm",
+    "artifactMetadata": "packages/core/v4-domain-wasm-artifact.js"
   },
   "roots": [
     "release-activation-step",