npm - @kungfu-tech/buildchain - Versions diffs - 4.0.2-alpha.5 → 4.0.2-alpha.50 - Mend

@kungfu-tech/buildchain 4.0.2-alpha.5 → 4.0.2-alpha.50

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (171) hide show

package/AGENTS.md +10 -1
package/CONTRIBUTING.md +24 -0
package/README.md +2 -2
package/actions/promote-buildchain-ref/README.md +1 -1
package/actions/v4-release-candidate-promote/README.md +28 -0
package/architecture/agent-change-map.md +70 -9
package/architecture/ci-lane-change-budget.json +384 -0
package/architecture/internal-capabilities.json +56 -9
package/architecture/maintainability-debt.json +162 -107
package/architecture/maintainability-policy.json +34 -30
package/architecture/release-tail-contract-inventory.json +6 -6
package/architecture/v4-architecture-constitution.md +23 -20
package/architecture/v4-cross-platform-adopter-qualification.json +1 -1
package/architecture/v4-delivery-authority-parity.json +2 -2
package/architecture/v4-delivery-warrant-shadow-bootstrap-plan.json +1 -1
package/architecture/v4-floating-consumer-policy.json +2 -2
package/architecture/v4-next-development-parity.json +5 -5
package/architecture/v4-partial-mutation-recovery-qualification.json +4 -1
package/architecture/v4-platform-stage-checkpoints.json +1 -1
package/architecture/v4-provider-operation-journal-contract.json +5 -2
package/architecture/v4-publication-facade-patches.json +64 -0
package/architecture/v4-release-activation-shadow-domain.json +5 -2
package/architecture/v4-release-topology.json +198 -38
package/architecture/v4-rust-wasm-production-authority.json +58 -0
package/architecture/v4-stable-publication-fence.json +5 -2
package/architecture/v4-stage-capsule-qualification.json +2 -2
package/architecture/v4-tail-reseal-parity.json +8 -6
package/architecture/v4-universal-workflow-bootstrap.json +176 -0
package/architecture/v4-universal-workflow-fault-campaign.json +72 -0
package/architecture/v4-universal-workflow-train-admission.json +40 -0
package/architecture/workflow-taxonomy.json +1462 -0
package/bin/buildchain.mjs +7 -7
package/contracts/buildchain-v2-residuals-v1.json +57 -48
package/contracts/dev-delivery-authority-v2.schema.json +16 -2
package/contracts/fixtures/v4-tail-reseal-v1/valid.json +1 -1
package/contracts/v4-canonical-contracts-v1.schema.json +1 -0
package/dist/site/buildchain-contract.json +93 -48
package/dist/site/buildchain-site.json +276 -72
package/dist/site/capability-registry.json +5 -5
package/dist/site/controller-registry.json +50 -13
package/dist/site/kfd-claims.json +2610 -983
package/dist/site/kfd-upstream-aggregate.json +1 -1
package/dist/site/manual-registry.json +14 -14
package/dist/site/node-api-registry.json +273 -127
package/dist/site/page-registry.json +257 -53
package/dist/site/public-surface-audit.json +3239 -1232
package/dist/site/publication-authority-registry.json +1135 -363
package/dist/site/publication-registry.json +4 -4
package/dist/site/release-provenance.json +2 -1
package/dist/site/schemas/dev-delivery-authority-v2.schema.json +16 -2
package/dist/site/site-manifest.json +18 -18
package/dist/site/workflow-registry.json +5097 -1659
package/docs/MAP.md +2 -0
package/docs/auditable-demo.md +1 -1
package/docs/cli.md +21 -8
package/docs/dev-delivery-warrant.md +1 -1
package/docs/engineering-housekeeper.md +3 -3
package/docs/kfd-support.md +26 -2
package/docs/next-development-transition.md +2 -2
package/docs/node-api-reference.md +216 -205
package/docs/oci-publication.md +160 -0
package/docs/publication-authority.md +2 -2
package/docs/publish-transaction.md +36 -3
package/docs/release-candidate.md +3 -3
package/docs/release-flow.md +67 -19
package/docs/release-governance.md +8 -8
package/docs/release-passport.md +27 -2
package/docs/reusable-build-surface.md +16 -0
package/docs/v4-adopter-delivery.md +2 -2
package/docs/v4-production-release.md +71 -8
package/docs/v4-rust-wasm-production-authority.md +58 -0
package/docs/v4-stage-capsule.md +2 -2
package/docs/v4-tail-reseal.md +1 -1
package/docs/workflow-catalog.md +155 -0
package/docs/workflow-path-migration.md +109 -0
package/package.json +12 -7
package/packages/core/artifact-verification-envelope.js +5 -5
package/packages/core/buildchain-contract.js +1 -1
package/packages/core/buildchain-kfd-claims.js +2 -2
package/packages/core/buildchain-publication-authority.js +43 -26
package/packages/core/buildchain-v4-domain.wasm +0 -0
package/packages/core/ci-lane-change-budget.js +14 -1
package/packages/core/controller-evidence.js +4 -1
package/packages/core/dev-delivery-candidate-identity.js +40 -6
package/packages/core/dev-delivery-warrant-state.js +3 -4
package/packages/core/dev-delivery-warrant.js +12 -2
package/packages/core/github-governance-authority.js +4 -4
package/packages/core/kfd-adopter-manifest.js +46 -47
package/packages/core/next-development-projection.js +2 -2
package/packages/core/next-development-transition.js +5 -6
package/packages/core/oci-compose-qualification.js +140 -0
package/packages/core/oci-publication-bundle.js +281 -0
package/packages/core/oci-publication-graph.js +206 -0
package/packages/core/paper-agent-entry.js +30 -4
package/packages/core/paper-fleet.js +1 -1
package/packages/core/paper-runtime-channels.js +348 -0
package/packages/core/paper-scaffold-content.js +10 -0
package/packages/core/paper.js +37 -71
package/packages/core/publication-sealed-bundle.js +78 -13
package/packages/core/release-line-dry-run.js +1 -1
package/packages/core/release-passport-contract.js +5 -5
package/packages/core/release-passport.js +5 -4
package/packages/core/release-tail-product-capabilities.js +38 -0
package/packages/core/release-tail-provider-plane.js +68 -1048
package/packages/core/v4-canonical-contracts.js +15 -75
package/packages/core/v4-domain-wasm-artifact.js +7 -0
package/packages/core/v4-domain-wasm.js +216 -0
package/packages/core/v4-floating-consumer-evidence.js +1 -1
package/packages/core/v4-floating-consumer-policy.js +1 -1
package/packages/core/v4-partial-mutation-recovery-qualification.js +9 -386
package/packages/core/v4-product-publication.js +59 -0
package/packages/core/v4-protected-publication-source.js +19 -21
package/packages/core/v4-provider-operation-journal.js +18 -487
package/packages/core/v4-provider-readback-idempotency.js +12 -97
package/packages/core/v4-release-activation-shadow.js +13 -500
package/packages/core/v4-release-invocation.js +28 -389
package/packages/core/v4-stable-publication-fence.js +13 -342
package/packages/core/v4-universal-workflow-bootstrap.js +586 -0
package/scripts/binary-publication-evidence.mjs +135 -0
package/scripts/build-contract-core.mjs +1 -14
package/scripts/build-v4-domain-wasm.mjs +189 -0
package/scripts/check-action-bundles.mjs +12 -2
package/scripts/check-ci-lane-change-budget.mjs +4 -1
package/scripts/check-core-mechanism-inventory.mjs +4 -3
package/scripts/check-inventory.mjs +35 -44
package/scripts/check-maintainability.mjs +16 -113
package/scripts/check-v4-floating-consumer-policy-contract.mjs +2 -2
package/scripts/check-v4-public-dogfood-contract.mjs +22 -9
package/scripts/check-v4-release-topology.mjs +236 -50
package/scripts/check-v4-runtime-semantic-closure.mjs +4 -1
package/scripts/check-v4-universal-workflow-bootstrap.mjs +266 -0
package/scripts/check-workflow-taxonomy.mjs +6 -0
package/scripts/copy-v4-domain-wasm.mjs +14 -0
package/scripts/dev-delivery-authority-command-adapters.mjs +1 -1
package/scripts/dev-delivery-authority.mjs +8 -8
package/scripts/dev-delivery-source-proof-reuse.mjs +2 -1
package/scripts/dev-delivery-warrant-options.mjs +14 -9
package/scripts/dev-delivery-warrant-store.mjs +73 -7
package/scripts/dev-delivery-warrant-transition.mjs +109 -0
package/scripts/dev-delivery-warrant.mjs +76 -99
package/scripts/dev-pr-auto-merge.mjs +15 -15
package/scripts/generate-channel-build-workflow.mjs +7 -2
package/scripts/generate-channel-promotion-workflow.mjs +10 -25
package/scripts/generate-site-bundle.mjs +11 -11
package/scripts/generate-v4-universal-workflow-facades.mjs +497 -0
package/scripts/generate-workflow-taxonomy.mjs +25 -0
package/scripts/github-output.mjs +31 -0
package/scripts/maintainability-metrics.mjs +16 -5
package/scripts/maintainability-public-surface.mjs +115 -0
package/scripts/next-development-review.mjs +307 -0
package/scripts/oci-compose-preview.mjs +250 -0
package/scripts/paper-work-fleet-cli.mjs +2 -0
package/scripts/publication-candidate-kind.mjs +93 -0
package/scripts/publication-candidate-sealer.mjs +16 -1
package/scripts/release-asset-client.mjs +91 -0
package/scripts/release-candidate-resolver.mjs +23 -35
package/scripts/resume-from-candidate-run.mjs +11 -18
package/scripts/site-capability-metadata.mjs +1 -0
package/scripts/source-verification-evidence.mjs +344 -0
package/scripts/stable-candidate-qualification.mjs +1 -1
package/scripts/universal-facade-maintainability.mjs +91 -0
package/scripts/v4-product-publication-intent.mjs +129 -0
package/scripts/v4-publication-settlement.mjs +211 -0
package/scripts/v4-universal-workflow-backflow.mjs +212 -0
package/scripts/v4-universal-workflow-engine.mjs +620 -0
package/scripts/v4-universal-workflow-self-dogfood.mjs +205 -0
package/scripts/verify-version-state-delta.mjs +173 -0
package/scripts/workflow-taxonomy.mjs +507 -0
package/templates/native-dev-delivery.yml +4 -7
package/templates/universal-buildchain-bootstrap-recovery.yml +282 -0
package/templates/universal-buildchain-bootstrap.yml +28 -0

package/dist/site/kfd-claims.json CHANGED Viewed

@@ -21,12 +21,12 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "2e9068e7dba92d6771db3d3ec1a7e88e59622fde9e53b0acfa016ee53f40f762",
+    "sha256": "233f353cc1de6036c90eab889ea673c1887903829810cfa0a7d844e196340c16",
     "summary": {
       "cliCommandCount": 117,
-      "workflowCount": 77,
+      "workflowCount": 115,
       "actionCount": 8,
-      "sitePageCount": 84,
+      "sitePageCount": 88,
       "docCommandRefCount": 1050,
       "failureCount": 0
     },
@@ -246,12 +246,12 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "2e9068e7dba92d6771db3d3ec1a7e88e59622fde9e53b0acfa016ee53f40f762",
+      "sha256": "233f353cc1de6036c90eab889ea673c1887903829810cfa0a7d844e196340c16",
       "summary": {
         "cliCommandCount": 117,
-        "workflowCount": 77,
+        "workflowCount": 115,
         "actionCount": 8,
-        "sitePageCount": 84,
+        "sitePageCount": 88,
         "docCommandRefCount": 1050,
         "failureCount": 0
       },
@@ -2215,6 +2215,18 @@
           "participantFacing": true,
           "public": true,
           "packageExport": "./buildchain-kfd-claims"
+        },
+        {
+          "id": "export:./oci-publication",
+          "name": "@kungfu-tech/buildchain/oci-publication",
+          "kind": "package-export",
+          "sourcePath": "packages/core/oci-publication-bundle.js",
+          "evidencePath": "packages/core/oci-publication-bundle.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./oci-publication"
         }
       ],
       "siteConsumptionContracts": [
@@ -3854,7 +3866,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 11,
+          "inputCount": 12,
           "inputs": [
             "adapter-arguments-json",
             "adapter-path",
@@ -3866,7 +3878,8 @@
             "require-trusted-event",
             "source-artifact-digest",
             "source-artifact-name",
-            "source-ref"
+            "source-ref",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
@@ -3880,7 +3893,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 15,
+          "inputCount": 16,
           "inputs": [
             "auto-admission",
             "buildchain-ref",
@@ -3896,21 +3909,49 @@
             "publication-version",
             "release-tag",
             "source-sha",
-            "target-ref"
+            "target-ref",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.build",
-          "name": "workflow:.build",
+          "id": "workflow:.build-demo-adapter",
+          "name": "workflow:.build-demo-adapter",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.build.yml",
-          "evidencePath": ".github/workflows/.build.yml",
+          "sourcePath": ".github/workflows/.build-demo-adapter.yml",
+          "evidencePath": ".github/workflows/.build-demo-adapter.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 12,
+          "inputs": [
+            "adapter-arguments-json",
+            "adapter-path",
+            "artifact-retention-days",
+            "buildchain-repository",
+            "media-profile",
+            "render-media",
+            "renderer-image",
+            "require-trusted-event",
+            "source-artifact-digest",
+            "source-artifact-name",
+            "source-ref",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.build-engine",
+          "name": "workflow:.build-engine",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.build-engine.yml",
+          "evidencePath": ".github/workflows/.build-engine.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 93,
+          "inputCount": 94,
           "inputs": [
             "artifact-compression-level",
             "artifact-finalization-command",
@@ -4001,6 +4042,7 @@
             "setup-rust",
             "shifu-cache-profile-digest",
             "shifu-cache-profile-ref",
+            "universal-request-json",
             "untrusted-policy",
             "verify-command",
             "verify-substage-evidence-path",
@@ -4009,57 +4051,16 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.bump-minor-version",
-          "name": "workflow:.bump-minor-version",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.bump-minor-version.yml",
-          "evidencePath": ".github/workflows/.bump-minor-version.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.declarative-auditable-demo",
-          "name": "workflow:.declarative-auditable-demo",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.declarative-auditable-demo.yml",
-          "evidencePath": ".github/workflows/.declarative-auditable-demo.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 12,
-          "inputs": [
-            "artifact-retention-days",
-            "binary-artifact-digest",
-            "binary-artifact-name",
-            "buildchain-repository",
-            "materialize",
-            "materialize-base-ref",
-            "media-profile",
-            "render-failure-advisory",
-            "render-media",
-            "renderer-image",
-            "scenario-path",
-            "source-ref"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.gate-profile",
-          "name": "workflow:.gate-profile",
+          "id": "workflow:.build-gate-profile",
+          "name": "workflow:.build-gate-profile",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.gate-profile.yml",
-          "evidencePath": ".github/workflows/.gate-profile.yml",
+          "sourcePath": ".github/workflows/.build-gate-profile.yml",
+          "evidencePath": ".github/workflows/.build-gate-profile.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 30,
+          "inputCount": 31,
           "inputs": [
             "artifact-name",
             "artifact-retention-days",
@@ -4089,607 +4090,1654 @@
             "shifu-cache-profile-digest",
             "shifu-cache-profile-ref",
             "source-ref",
+            "universal-request-json",
             "untrusted-policy",
             "working-directory"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.publication-authority",
-          "name": "workflow:.publication-authority",
+          "id": "workflow:.build-release-verify-compat",
+          "name": "workflow:.build-release-verify-compat",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.publication-authority.yml",
-          "evidencePath": ".github/workflows/.publication-authority.yml",
+          "sourcePath": ".github/workflows/.build-release-verify-compat.yml",
+          "evidencePath": ".github/workflows/.build-release-verify-compat.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 37,
+          "inputCount": 42,
           "inputs": [
-            "admission-json",
-            "authority-workflow-path",
-            "auto-admission",
-            "auto-admission-kind",
-            "auto-no-gate",
+            "auto-approve-enabled",
+            "aws-ci-region",
+            "aws-user-region",
+            "bucket-staging-ci",
+            "bucket-staging-user",
+            "build-container-enabled",
+            "build-runner-linux",
+            "build-runner-linux-labels",
+            "build-runner-macos",
+            "build-runner-macos-labels",
+            "build-runner-windows",
+            "build-runner-windows-labels",
+            "build-timeout-minutes",
             "buildchain-ref",
             "buildchain-repository",
-            "consumer-gate-command",
-            "consumer-gate-controller-sha",
-            "consumer-gate-evidence-source-sha",
-            "consumer-gate-evidence-source-tree",
-            "consumer-predicate-digest",
-            "consumer-predicate-id",
-            "consumer-qualification-required",
-            "control-plane-audit-json",
-            "dry-run",
-            "evidence-controller-artifact",
-            "evidence-manifest-pattern",
-            "evidence-passport-artifact",
-            "evidence-payload-pattern",
-            "evidence-publication-artifact",
-            "evidence-repository",
-            "evidence-run-id",
-            "evidence-summary-artifact",
-            "expected-json",
-            "gate-aggregate-json",
-            "github-governance-receipt-json",
-            "package-name",
-            "product",
-            "publication-target",
-            "publication-version",
-            "publisher-workflow-path",
-            "required-status-check",
-            "runner-provenance-json",
-            "source-sha",
-            "target-ref",
-            "used-nonces-json"
+            "builder-container",
+            "code-signing-macos",
+            "code-signing-windows",
+            "collaborator-automation-enabled",
+            "enable-linux",
+            "enable-macos",
+            "enable-windows",
+            "find-dependencies",
+            "java-version",
+            "manager",
+            "max-build-attempts",
+            "max-preview-links",
+            "node-version",
+            "pipenv-version",
+            "poetry-version",
+            "prebuild",
+            "preview-files",
+            "publish-aws-ci",
+            "publish-aws-user",
+            "publish-github-npm",
+            "publish-versioning",
+            "python-version",
+            "setup-env-timeout-minutes",
+            "setup-python-enabled",
+            "universal-request-json",
+            "use-pipenv",
+            "use-poetry"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-candidate-promote",
-          "name": "workflow:.release-candidate-promote",
+          "id": "workflow:.build-sam-verify-compat",
+          "name": "workflow:.build-sam-verify-compat",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-candidate-promote.yml",
-          "evidencePath": ".github/workflows/.release-candidate-promote.yml",
+          "sourcePath": ".github/workflows/.build-sam-verify-compat.yml",
+          "evidencePath": ".github/workflows/.build-sam-verify-compat.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 121,
+          "inputCount": 5,
           "inputs": [
-            "allow-repository",
+            "aws-region",
+            "aws-role",
+            "aws-root",
+            "manager",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.build-wheel-verify-compat",
+          "name": "workflow:.build-wheel-verify-compat",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.build-wheel-verify-compat.yml",
+          "evidencePath": ".github/workflows/.build-wheel-verify-compat.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 6,
+          "inputs": [
+            "aws-user-region",
+            "bucket-release",
+            "max-preview-links",
+            "node-version",
+            "preview-files",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.build",
+          "name": "workflow:.build",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.build.yml",
+          "evidencePath": ".github/workflows/.build.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 94,
+          "inputs": [
+            "artifact-compression-level",
+            "artifact-finalization-command",
+            "artifact-finalization-on-platform",
             "artifact-name",
-            "artifact-patterns",
-            "branch-protection-bypass-apps",
-            "branch-protection-bypass-teams",
-            "branch-protection-bypass-users",
-            "buildchain-alpha-contract-lock-path",
+            "artifact-name-template",
+            "artifact-paths",
+            "artifact-relay-s3-bucket",
+            "artifact-relay-s3-download-role-arn",
+            "artifact-relay-s3-oidc-audience",
+            "artifact-relay-s3-prefix",
+            "artifact-relay-s3-region",
+            "artifact-relay-s3-role-arn",
+            "artifact-relay-s3-upload-role-arn",
+            "artifact-retention-days",
+            "artifact-signing-request-upload-no-proxy",
+            "artifact-transfer-mode",
+            "aws-codebuild-project",
+            "aws-ec2-macos-runner-label",
+            "aws-ec2-windows-runner-label",
+            "build-command",
             "buildchain-contract-compatibility-policy",
             "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-expected-channel",
+            "buildchain-contract-expected-major",
             "buildchain-contract-lock-path",
             "buildchain-expected-channel",
             "buildchain-expected-major",
             "buildchain-ref",
             "buildchain-repository",
-            "buildchain-stable-contract-lock-path",
-            "channel",
-            "declarative-release-tail",
-            "dry-run",
-            "github-artifact-attestation-environment",
-            "github-artifact-attestation-policy-json",
-            "github-artifact-attestation-retention-days",
-            "github-governance-receipt-json",
-            "github-release",
-            "github-release-notes",
-            "github-release-payload-patterns",
-            "github-release-title",
-            "package-manager",
-            "promotion-contract-lock-digest",
-            "promotion-contract-lock-path",
-            "promotion-override-used",
-            "promotion-publication-channel",
-            "promotion-router-ref",
-            "promotion-router-sha",
-            "promotion-runtime-authorization-json",
-            "promotion-runtime-authorization-root",
-            "promotion-runtime-ref",
-            "promotion-runtime-sha",
-            "promotion-shell-ref",
-            "promotion-shell-sha",
-            "promotion-target-ref",
-            "provider-failure-after-capability",
-            "publication-admission-json",
-            "publication-authority-workflow-path",
-            "publication-auto-admission",
-            "publication-auto-no-gate",
-            "publication-commit-command",
-            "publication-commit-evidence-path",
-            "publication-consumer-predicate-id",
-            "publication-consumer-qualification-command",
-            "publication-consumer-qualification-controller-sha",
-            "publication-control-plane-audit-json",
-            "publication-expected-json",
-            "publication-gate-aggregate-json",
-            "publication-gate-command",
-            "publication-gate-controller-sha",
-            "publication-package-name",
-            "publication-product",
-            "publication-publisher-workflow-path",
-            "publication-runner-provenance-json",
-            "publication-target",
-            "publication-used-nonces-json",
-            "publication-used-qualification-nonces-json",
-            "publish-artifact-kind",
-            "publish-command",
-            "publish-dist-tag",
-            "publish-mode",
-            "publish-package-main",
-            "publish-package-set-order",
-            "publish-rematerialize-on-resume",
-            "publish-required-artifacts-json",
-            "publish-target",
-            "publish-transaction-override",
-            "release-activation-command",
-            "release-activation-receipt-set-path",
-            "release-candidate-family-assignment-id",
-            "release-candidate-family-evidence-required",
-            "release-candidate-family-evidence-root",
-            "release-candidate-family-initiative-id",
-            "release-candidate-wait-seconds",
-            "release-candidate-workflow-file",
-            "release-candidate-workflow-name",
-            "release-passport",
-            "release-passport-adopter-delivery-json",
-            "release-passport-attachment-command",
-            "release-passport-buildchain-self-kfd",
-            "release-passport-evidence-command",
-            "release-passport-evidence-jsons",
-            "release-passport-evidence-path",
-            "release-passport-impact-json",
-            "release-passport-invariant-passport-command",
-            "release-passport-invariant-passport-jsons",
-            "release-passport-kfd-1-witness-jsons",
-            "release-passport-kfd-2-claim-jsons",
-            "release-passport-kfd-3-artifact-verify-command",
-            "release-passport-kfd-3-artifact-witness-jsons",
-            "release-passport-kfd-3-prebuild-witness-jsons",
-            "release-passport-kfd-adopter-manifest-gate-json",
-            "release-passport-kfd-adopter-manifest-json",
-            "release-passport-kfd-product-gate-jsons",
-            "release-passport-kfd-support-matrix-json",
-            "release-passport-output-dir",
-            "release-passport-platform-manifest-paths",
-            "release-passport-product-name",
-            "release-passport-v4-runtime-resume-evidence-json",
-            "release-propagation-config-path",
-            "required-artifact-count",
-            "required-status-check",
-            "resume-buildchain-runtime-sha",
-            "resume-candidate-repository",
-            "resume-candidate-run-id",
-            "resume-expected-candidate-root",
-            "resume-expected-candidate-runtime-sha",
-            "resume-expected-source-tree",
-            "resume-expected-workflow-file",
-            "resume-expected-workflow-name",
-            "resume-transaction-id",
+            "buildchain-visible-workflow",
+            "cache-dependency-lock-root",
+            "cache-policy-root",
+            "cache-toolchain-root",
+            "cargo-registry-index",
+            "checkout-cache-fallback",
+            "checkout-cache-fetch-attempts",
+            "checkout-cache-github-timeout-seconds",
+            "checkout-cache-mirror-url-template",
+            "checkout-cache-mode",
+            "checkout-cache-reference-repository-template",
+            "checkout-cache-timeout-seconds",
+            "checkout-history-mode",
+            "compiler-cache-platforms-json",
+            "compiler-cache-provider",
+            "compiler-cache-required",
+            "control-runner-json",
+            "credential-island-caller-owned",
+            "credential-island-environment",
+            "credential-island-macos-app-path",
+            "credential-island-macos-platform-id",
+            "expected-artifacts-json",
+            "fail-fast",
+            "gate-profile-aggregate-json",
+            "github-artifact-attestation-platform-id",
+            "github-artifact-attestation-signer-sha",
+            "github-artifact-attestation-subject-path",
+            "install-command",
+            "kfd-agent-hub",
+            "lifecycle-timeout-minutes",
+            "linux-container-image",
+            "linux-container-preset",
+            "node-version",
+            "platforms-json",
+            "pre-upload-transport-smoke-artifact-root",
+            "pre-upload-transport-smoke-scenario-path",
+            "process-sample-interval-ms",
+            "process-summary-path",
+            "publish-anchor-request-json",
+            "publish-channel",
+            "publish-refs-json",
+            "publish-registry",
+            "publish-source-ref",
+            "release-candidate",
+            "release-candidate-family-evidence-json",
+            "requested-parallelism",
+            "require-build",
+            "require-install",
+            "require-trusted-event",
+            "require-verify",
             "runner-preset",
-            "standalone-binary-distribution",
-            "target-ref",
-            "target-sha",
-            "trusted-publishing"
+            "rust-toolchain",
+            "rustup-dist-server",
+            "rustup-update-root",
+            "sample-process-tree",
+            "self-hosted-offline-fallback",
+            "setup-node",
+            "setup-rust",
+            "shifu-cache-profile-digest",
+            "shifu-cache-profile-ref",
+            "universal-request-json",
+            "untrusted-policy",
+            "verify-command",
+            "verify-substage-evidence-path",
+            "working-directory"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-docker",
-          "name": "workflow:.release-docker",
+          "id": "workflow:.bump-minor-version",
+          "name": "workflow:.bump-minor-version",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-docker.yml",
-          "evidencePath": ".github/workflows/.release-docker.yml",
+          "sourcePath": ".github/workflows/.bump-minor-version.yml",
+          "evidencePath": ".github/workflows/.bump-minor-version.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
           "inputCount": 1,
           "inputs": [
-            "image-name"
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-elastic-beanstalk",
-          "name": "workflow:.release-elastic-beanstalk",
+          "id": "workflow:.declarative-auditable-demo",
+          "name": "workflow:.declarative-auditable-demo",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-elastic-beanstalk.yml",
-          "evidencePath": ".github/workflows/.release-elastic-beanstalk.yml",
+          "sourcePath": ".github/workflows/.declarative-auditable-demo.yml",
+          "evidencePath": ".github/workflows/.declarative-auditable-demo.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 3,
+          "inputCount": 13,
           "inputs": [
-            "aws-region",
-            "eb-application-name",
-            "eb-environment-name"
+            "artifact-retention-days",
+            "binary-artifact-digest",
+            "binary-artifact-name",
+            "buildchain-repository",
+            "materialize",
+            "materialize-base-ref",
+            "media-profile",
+            "render-failure-advisory",
+            "render-media",
+            "renderer-image",
+            "scenario-path",
+            "source-ref",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-new-version",
-          "name": "workflow:.release-new-version",
+          "id": "workflow:.gate-profile",
+          "name": "workflow:.gate-profile",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-new-version.yml",
-          "evidencePath": ".github/workflows/.release-new-version.yml",
+          "sourcePath": ".github/workflows/.gate-profile.yml",
+          "evidencePath": ".github/workflows/.gate-profile.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 27,
+          "inputCount": 31,
           "inputs": [
-            "action-bump-version-path",
-            "action-bump-version-ref",
-            "action-bump-version-repository",
-            "aws-ci-region",
-            "aws-user-region",
-            "bucket-release-ci",
-            "bucket-release-user",
-            "bucket-staging-ci",
-            "bucket-staging-user",
-            "clean-release-ci",
-            "clean-release-user",
-            "close-issues",
-            "cloudfront-id-ci",
-            "cloudfront-id-user",
-            "cloudfront-paths-ci",
-            "cloudfront-paths-user",
-            "create-release-note",
-            "max-preview-links",
-            "need-qa-automated",
+            "artifact-name",
+            "artifact-retention-days",
+            "buildchain-ref",
+            "buildchain-repository",
+            "cargo-registry-index",
+            "checkout-cache-fallback",
+            "checkout-cache-fetch-attempts",
+            "checkout-cache-github-timeout-seconds",
+            "checkout-cache-mirror-url-template",
+            "checkout-cache-mode",
+            "checkout-cache-reference-repository-template",
+            "checkout-cache-timeout-seconds",
+            "gate-command-json",
+            "gate-environment-json",
+            "gate-plan-command-json",
+            "gate-profile",
+            "gate-registry",
+            "include-advisory",
             "node-version",
-            "protect-dev-branches",
-            "publish-aws-ci",
-            "publish-aws-user",
-            "publish-github-npm",
-            "publish-npmjs",
-            "publish-release-note",
-            "sync-extensions-version"
+            "platforms-json",
+            "require-trusted-event",
+            "runner-preset",
+            "rust-toolchain",
+            "rustup-dist-server",
+            "rustup-update-root",
+            "shifu-cache-profile-digest",
+            "shifu-cache-profile-ref",
+            "source-ref",
+            "universal-request-json",
+            "untrusted-policy",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.ops-git-sync",
+          "name": "workflow:.ops-git-sync",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.ops-git-sync.yml",
+          "evidencePath": ".github/workflows/.ops-git-sync.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "force",
+            "remote-host",
+            "remote-path",
+            "remote-repo",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.publication-authority",
+          "name": "workflow:.publication-authority",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.publication-authority.yml",
+          "evidencePath": ".github/workflows/.publication-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 38,
+          "inputs": [
+            "admission-json",
+            "authority-workflow-path",
+            "auto-admission",
+            "auto-admission-kind",
+            "auto-no-gate",
+            "buildchain-ref",
+            "buildchain-repository",
+            "consumer-gate-command",
+            "consumer-gate-controller-sha",
+            "consumer-gate-evidence-source-sha",
+            "consumer-gate-evidence-source-tree",
+            "consumer-predicate-digest",
+            "consumer-predicate-id",
+            "consumer-qualification-required",
+            "control-plane-audit-json",
+            "dry-run",
+            "evidence-controller-artifact",
+            "evidence-manifest-pattern",
+            "evidence-passport-artifact",
+            "evidence-payload-pattern",
+            "evidence-publication-artifact",
+            "evidence-repository",
+            "evidence-run-id",
+            "evidence-summary-artifact",
+            "expected-json",
+            "gate-aggregate-json",
+            "github-governance-receipt-json",
+            "package-name",
+            "product",
+            "publication-target",
+            "publication-version",
+            "publisher-workflow-path",
+            "required-status-check",
+            "runner-provenance-json",
+            "source-sha",
+            "target-ref",
+            "universal-request-json",
+            "used-nonces-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-authority",
+          "name": "workflow:.release-authority",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-authority.yml",
+          "evidencePath": ".github/workflows/.release-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 38,
+          "inputs": [
+            "admission-json",
+            "authority-workflow-path",
+            "auto-admission",
+            "auto-admission-kind",
+            "auto-no-gate",
+            "buildchain-ref",
+            "buildchain-repository",
+            "consumer-gate-command",
+            "consumer-gate-controller-sha",
+            "consumer-gate-evidence-source-sha",
+            "consumer-gate-evidence-source-tree",
+            "consumer-predicate-digest",
+            "consumer-predicate-id",
+            "consumer-qualification-required",
+            "control-plane-audit-json",
+            "dry-run",
+            "evidence-controller-artifact",
+            "evidence-manifest-pattern",
+            "evidence-passport-artifact",
+            "evidence-payload-pattern",
+            "evidence-publication-artifact",
+            "evidence-repository",
+            "evidence-run-id",
+            "evidence-summary-artifact",
+            "expected-json",
+            "gate-aggregate-json",
+            "github-governance-receipt-json",
+            "package-name",
+            "product",
+            "publication-target",
+            "publication-version",
+            "publisher-workflow-path",
+            "required-status-check",
+            "runner-provenance-json",
+            "source-sha",
+            "target-ref",
+            "universal-request-json",
+            "used-nonces-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-binary-assets",
+          "name": "workflow:.release-binary-assets",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-binary-assets.yml",
+          "evidencePath": ".github/workflows/.release-binary-assets.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 16,
+          "inputs": [
+            "auto-admission",
+            "buildchain-ref",
+            "buildchain-repository",
+            "evidence-run-id",
+            "github-governance-receipt-json",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "publication-version",
+            "release-tag",
+            "source-sha",
+            "target-ref",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-candidate-promote",
+          "name": "workflow:.release-candidate-promote",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-candidate-promote.yml",
+          "evidencePath": ".github/workflows/.release-candidate-promote.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 122,
+          "inputs": [
+            "allow-repository",
+            "artifact-name",
+            "artifact-patterns",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
+            "buildchain-expected-channel",
+            "buildchain-expected-major",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "channel",
+            "declarative-release-tail",
+            "dry-run",
+            "github-artifact-attestation-environment",
+            "github-artifact-attestation-policy-json",
+            "github-artifact-attestation-retention-days",
+            "github-governance-receipt-json",
+            "github-release",
+            "github-release-notes",
+            "github-release-payload-patterns",
+            "github-release-title",
+            "package-manager",
+            "promotion-contract-lock-digest",
+            "promotion-contract-lock-path",
+            "promotion-override-used",
+            "promotion-publication-channel",
+            "promotion-router-ref",
+            "promotion-router-sha",
+            "promotion-runtime-authorization-json",
+            "promotion-runtime-authorization-root",
+            "promotion-runtime-ref",
+            "promotion-runtime-sha",
+            "promotion-shell-ref",
+            "promotion-shell-sha",
+            "promotion-target-ref",
+            "provider-failure-after-capability",
+            "publication-admission-json",
+            "publication-authority-workflow-path",
+            "publication-auto-admission",
+            "publication-auto-no-gate",
+            "publication-commit-command",
+            "publication-commit-evidence-path",
+            "publication-consumer-predicate-id",
+            "publication-consumer-qualification-command",
+            "publication-consumer-qualification-controller-sha",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-gate-command",
+            "publication-gate-controller-sha",
+            "publication-package-name",
+            "publication-product",
+            "publication-publisher-workflow-path",
+            "publication-runner-provenance-json",
+            "publication-target",
+            "publication-used-nonces-json",
+            "publication-used-qualification-nonces-json",
+            "publish-artifact-kind",
+            "publish-command",
+            "publish-dist-tag",
+            "publish-mode",
+            "publish-package-main",
+            "publish-package-set-order",
+            "publish-rematerialize-on-resume",
+            "publish-required-artifacts-json",
+            "publish-target",
+            "publish-transaction-override",
+            "release-activation-command",
+            "release-activation-receipt-set-path",
+            "release-candidate-family-assignment-id",
+            "release-candidate-family-evidence-required",
+            "release-candidate-family-evidence-root",
+            "release-candidate-family-initiative-id",
+            "release-candidate-wait-seconds",
+            "release-candidate-workflow-file",
+            "release-candidate-workflow-name",
+            "release-passport",
+            "release-passport-adopter-delivery-json",
+            "release-passport-attachment-command",
+            "release-passport-buildchain-self-kfd",
+            "release-passport-evidence-command",
+            "release-passport-evidence-jsons",
+            "release-passport-evidence-path",
+            "release-passport-impact-json",
+            "release-passport-invariant-passport-command",
+            "release-passport-invariant-passport-jsons",
+            "release-passport-kfd-1-witness-jsons",
+            "release-passport-kfd-2-claim-jsons",
+            "release-passport-kfd-3-artifact-verify-command",
+            "release-passport-kfd-3-artifact-witness-jsons",
+            "release-passport-kfd-3-prebuild-witness-jsons",
+            "release-passport-kfd-adopter-manifest-gate-json",
+            "release-passport-kfd-adopter-manifest-json",
+            "release-passport-kfd-product-gate-jsons",
+            "release-passport-kfd-support-matrix-json",
+            "release-passport-output-dir",
+            "release-passport-platform-manifest-paths",
+            "release-passport-product-name",
+            "release-passport-v4-runtime-resume-evidence-json",
+            "release-propagation-config-path",
+            "required-artifact-count",
+            "required-status-check",
+            "resume-buildchain-runtime-sha",
+            "resume-candidate-repository",
+            "resume-candidate-run-id",
+            "resume-expected-candidate-root",
+            "resume-expected-candidate-runtime-sha",
+            "resume-expected-source-tree",
+            "resume-expected-workflow-file",
+            "resume-expected-workflow-name",
+            "resume-transaction-id",
+            "runner-preset",
+            "standalone-binary-distribution",
+            "target-ref",
+            "target-sha",
+            "trusted-publishing",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-minor-bump-compat",
+          "name": "workflow:.release-minor-bump-compat",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-minor-bump-compat.yml",
+          "evidencePath": ".github/workflows/.release-minor-bump-compat.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 1,
+          "inputs": [
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-page-sync-retired",
+          "name": "workflow:.release-page-sync-retired",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-page-sync-retired.yml",
+          "evidencePath": ".github/workflows/.release-page-sync-retired.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "aws-region",
+            "aws-role-arn",
+            "base-id",
+            "bucket-release",
+            "cloudfront-id",
+            "exclude",
+            "lower-edge",
+            "product",
+            "product-name",
+            "release-path",
+            "release-url",
+            "repo",
+            "universal-request-json",
+            "upper-edge"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-promote",
+          "name": "workflow:.release-promote",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-promote.yml",
+          "evidencePath": ".github/workflows/.release-promote.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 122,
+          "inputs": [
+            "allow-repository",
+            "artifact-name",
+            "artifact-patterns",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
+            "buildchain-expected-channel",
+            "buildchain-expected-major",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "channel",
+            "declarative-release-tail",
+            "dry-run",
+            "github-artifact-attestation-environment",
+            "github-artifact-attestation-policy-json",
+            "github-artifact-attestation-retention-days",
+            "github-governance-receipt-json",
+            "github-release",
+            "github-release-notes",
+            "github-release-payload-patterns",
+            "github-release-title",
+            "package-manager",
+            "promotion-contract-lock-digest",
+            "promotion-contract-lock-path",
+            "promotion-override-used",
+            "promotion-publication-channel",
+            "promotion-router-ref",
+            "promotion-router-sha",
+            "promotion-runtime-authorization-json",
+            "promotion-runtime-authorization-root",
+            "promotion-runtime-ref",
+            "promotion-runtime-sha",
+            "promotion-shell-ref",
+            "promotion-shell-sha",
+            "promotion-target-ref",
+            "provider-failure-after-capability",
+            "publication-admission-json",
+            "publication-authority-workflow-path",
+            "publication-auto-admission",
+            "publication-auto-no-gate",
+            "publication-commit-command",
+            "publication-commit-evidence-path",
+            "publication-consumer-predicate-id",
+            "publication-consumer-qualification-command",
+            "publication-consumer-qualification-controller-sha",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-gate-command",
+            "publication-gate-controller-sha",
+            "publication-package-name",
+            "publication-product",
+            "publication-publisher-workflow-path",
+            "publication-runner-provenance-json",
+            "publication-target",
+            "publication-used-nonces-json",
+            "publication-used-qualification-nonces-json",
+            "publish-artifact-kind",
+            "publish-command",
+            "publish-dist-tag",
+            "publish-mode",
+            "publish-package-main",
+            "publish-package-set-order",
+            "publish-rematerialize-on-resume",
+            "publish-required-artifacts-json",
+            "publish-target",
+            "publish-transaction-override",
+            "release-activation-command",
+            "release-activation-receipt-set-path",
+            "release-candidate-family-assignment-id",
+            "release-candidate-family-evidence-required",
+            "release-candidate-family-evidence-root",
+            "release-candidate-family-initiative-id",
+            "release-candidate-wait-seconds",
+            "release-candidate-workflow-file",
+            "release-candidate-workflow-name",
+            "release-passport",
+            "release-passport-adopter-delivery-json",
+            "release-passport-attachment-command",
+            "release-passport-buildchain-self-kfd",
+            "release-passport-evidence-command",
+            "release-passport-evidence-jsons",
+            "release-passport-evidence-path",
+            "release-passport-impact-json",
+            "release-passport-invariant-passport-command",
+            "release-passport-invariant-passport-jsons",
+            "release-passport-kfd-1-witness-jsons",
+            "release-passport-kfd-2-claim-jsons",
+            "release-passport-kfd-3-artifact-verify-command",
+            "release-passport-kfd-3-artifact-witness-jsons",
+            "release-passport-kfd-3-prebuild-witness-jsons",
+            "release-passport-kfd-adopter-manifest-gate-json",
+            "release-passport-kfd-adopter-manifest-json",
+            "release-passport-kfd-product-gate-jsons",
+            "release-passport-kfd-support-matrix-json",
+            "release-passport-output-dir",
+            "release-passport-platform-manifest-paths",
+            "release-passport-product-name",
+            "release-passport-v4-runtime-resume-evidence-json",
+            "release-propagation-config-path",
+            "required-artifact-count",
+            "required-status-check",
+            "resume-buildchain-runtime-sha",
+            "resume-candidate-repository",
+            "resume-candidate-run-id",
+            "resume-expected-candidate-root",
+            "resume-expected-candidate-runtime-sha",
+            "resume-expected-source-tree",
+            "resume-expected-workflow-file",
+            "resume-expected-workflow-name",
+            "resume-transaction-id",
+            "runner-preset",
+            "standalone-binary-distribution",
+            "target-ref",
+            "target-sha",
+            "trusted-publishing",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-verify",
+          "name": "workflow:.release-verify",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-verify.yml",
+          "evidencePath": ".github/workflows/.release-verify.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 42,
+          "inputs": [
+            "auto-approve-enabled",
+            "aws-ci-region",
+            "aws-user-region",
+            "bucket-staging-ci",
+            "bucket-staging-user",
+            "build-container-enabled",
+            "build-runner-linux",
+            "build-runner-linux-labels",
+            "build-runner-macos",
+            "build-runner-macos-labels",
+            "build-runner-windows",
+            "build-runner-windows-labels",
+            "build-timeout-minutes",
+            "buildchain-ref",
+            "buildchain-repository",
+            "builder-container",
+            "code-signing-macos",
+            "code-signing-windows",
+            "collaborator-automation-enabled",
+            "enable-linux",
+            "enable-macos",
+            "enable-windows",
+            "find-dependencies",
+            "java-version",
+            "manager",
+            "max-build-attempts",
+            "max-preview-links",
+            "node-version",
+            "pipenv-version",
+            "poetry-version",
+            "prebuild",
+            "preview-files",
+            "publish-aws-ci",
+            "publish-aws-user",
+            "publish-github-npm",
+            "publish-versioning",
+            "python-version",
+            "setup-env-timeout-minutes",
+            "setup-python-enabled",
+            "universal-request-json",
+            "use-pipenv",
+            "use-poetry"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.sam-verify",
+          "name": "workflow:.sam-verify",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.sam-verify.yml",
+          "evidencePath": ".github/workflows/.sam-verify.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "aws-region",
+            "aws-role",
+            "aws-root",
+            "manager",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.sync-release-page",
+          "name": "workflow:.sync-release-page",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.sync-release-page.yml",
+          "evidencePath": ".github/workflows/.sync-release-page.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "aws-region",
+            "aws-role-arn",
+            "base-id",
+            "bucket-release",
+            "cloudfront-id",
+            "exclude",
+            "lower-edge",
+            "product",
+            "product-name",
+            "release-path",
+            "release-url",
+            "repo",
+            "universal-request-json",
+            "upper-edge"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.sync-remote-git",
+          "name": "workflow:.sync-remote-git",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.sync-remote-git.yml",
+          "evidencePath": ".github/workflows/.sync-remote-git.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "force",
+            "remote-host",
+            "remote-path",
+            "remote-repo",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.web-surface",
+          "name": "workflow:.web-surface",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.web-surface.yml",
+          "evidencePath": ".github/workflows/.web-surface.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 44,
+          "inputs": [
+            "artifact-path",
+            "aws-region",
+            "build-command",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-expected-channel",
+            "buildchain-contract-expected-major",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "fail-on-release-pr-error",
+            "github-governance-receipt-json",
+            "node-version",
+            "preview-apply",
+            "preview-aws-role-arn",
+            "preview-cleanup-apply",
+            "preview-comment",
+            "preview-environment",
+            "production-apply",
+            "production-approved",
+            "production-aws-role-arn",
+            "production-environment",
+            "production-release-app-client-id",
+            "production-release-app-id",
+            "production-release-branch-channel",
+            "production-release-head-prefix",
+            "production-release-label",
+            "production-release-on-main",
+            "production-release-pr-mode",
+            "production-release-pr-token",
+            "production-source-sha",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "release-feedback-actor-privacy",
+            "staging-apply",
+            "staging-aws-role-arn",
+            "staging-environment",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.wheel-verify",
+          "name": "workflow:.wheel-verify",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.wheel-verify.yml",
+          "evidencePath": ".github/workflows/.wheel-verify.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 6,
+          "inputs": [
+            "aws-user-region",
+            "bucket-release",
+            "max-preview-links",
+            "node-version",
+            "preview-files",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:artifact-signing-authority",
+          "name": "workflow:artifact-signing-authority",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/artifact-signing-authority.yml",
+          "evidencePath": ".github/workflows/artifact-signing-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:bootstrap",
+          "name": "workflow:bootstrap",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/bootstrap.yml",
+          "evidencePath": ".github/workflows/bootstrap.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 1,
+          "inputs": [
+            "request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:build",
+          "name": "workflow:build",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/build.yml",
+          "evidencePath": ".github/workflows/build.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 97,
+          "inputs": [
+            "artifact-compression-level",
+            "artifact-finalization-command",
+            "artifact-finalization-on-platform",
+            "artifact-name",
+            "artifact-name-template",
+            "artifact-paths",
+            "artifact-relay-s3-bucket",
+            "artifact-relay-s3-download-role-arn",
+            "artifact-relay-s3-oidc-audience",
+            "artifact-relay-s3-prefix",
+            "artifact-relay-s3-region",
+            "artifact-relay-s3-role-arn",
+            "artifact-relay-s3-upload-role-arn",
+            "artifact-retention-days",
+            "artifact-signing-request-upload-no-proxy",
+            "artifact-transfer-mode",
+            "aws-codebuild-project",
+            "aws-ec2-macos-runner-label",
+            "aws-ec2-windows-runner-label",
+            "build-command",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-channel",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-expected-channel",
+            "buildchain-contract-expected-major",
+            "buildchain-contract-lock-path",
+            "buildchain-expected-channel",
+            "buildchain-expected-major",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "buildchain-visible-workflow",
+            "cache-dependency-lock-root",
+            "cache-policy-root",
+            "cache-toolchain-root",
+            "cargo-registry-index",
+            "checkout-cache-fallback",
+            "checkout-cache-fetch-attempts",
+            "checkout-cache-github-timeout-seconds",
+            "checkout-cache-mirror-url-template",
+            "checkout-cache-mode",
+            "checkout-cache-reference-repository-template",
+            "checkout-cache-timeout-seconds",
+            "checkout-history-mode",
+            "compiler-cache-platforms-json",
+            "compiler-cache-provider",
+            "compiler-cache-required",
+            "control-runner-json",
+            "credential-island-caller-owned",
+            "credential-island-environment",
+            "credential-island-macos-app-path",
+            "credential-island-macos-platform-id",
+            "expected-artifacts-json",
+            "fail-fast",
+            "gate-profile-aggregate-json",
+            "github-artifact-attestation-platform-id",
+            "github-artifact-attestation-signer-sha",
+            "github-artifact-attestation-subject-path",
+            "install-command",
+            "kfd-agent-hub",
+            "lifecycle-timeout-minutes",
+            "linux-container-image",
+            "linux-container-preset",
+            "node-version",
+            "platforms-json",
+            "pre-upload-transport-smoke-artifact-root",
+            "pre-upload-transport-smoke-scenario-path",
+            "process-sample-interval-ms",
+            "process-summary-path",
+            "publish-anchor-request-json",
+            "publish-channel",
+            "publish-refs-json",
+            "publish-registry",
+            "publish-source-ref",
+            "release-candidate",
+            "release-candidate-family-evidence-json",
+            "requested-parallelism",
+            "require-build",
+            "require-install",
+            "require-trusted-event",
+            "require-verify",
+            "runner-preset",
+            "rust-toolchain",
+            "rustup-dist-server",
+            "rustup-update-root",
+            "sample-process-tree",
+            "self-hosted-offline-fallback",
+            "setup-node",
+            "setup-rust",
+            "shifu-cache-profile-digest",
+            "shifu-cache-profile-ref",
+            "universal-request-json",
+            "untrusted-policy",
+            "verify-command",
+            "verify-substage-evidence-path",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:buildchain-patrol",
+          "name": "workflow:buildchain-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/buildchain-patrol.yml",
+          "evidencePath": ".github/workflows/buildchain-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 17,
+          "inputs": [
+            "allowed-head-prefixes",
+            "block-labels",
+            "buildchain-ref",
+            "buildchain-repository",
+            "cadence",
+            "capabilities",
+            "dry-run",
+            "landing-mode",
+            "max-actions",
+            "merge-method",
+            "mode",
+            "ready-label",
+            "require-approval",
+            "required-status-checks",
+            "same-repository-only",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:check",
+          "name": "workflow:check",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/check.yml",
+          "evidencePath": ".github/workflows/check.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "mode",
+            "node-version",
+            "require-version-state",
+            "source-proof-closure-paths-json",
+            "source-proof-dependency-paths-json",
+            "source-proof-policy-paths-json",
+            "source-proof-required-contexts-json",
+            "source-proof-reuse",
+            "universal-request-json",
+            "upload-artifacts",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:dev-alpha-candidate-patrol",
+          "name": "workflow:dev-alpha-candidate-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/dev-alpha-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/dev-alpha-candidate-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 16,
+          "inputs": [
+            "alpha-workflow-path",
+            "auto-merge",
+            "buildchain-ref",
+            "buildchain-repository",
+            "create-pull-request",
+            "dev-workflow-path",
+            "dry-run",
+            "max-age-seconds",
+            "merge-method",
+            "pull-request-body-prefix",
+            "pull-request-body-prefix-renderer",
+            "reactivation-authorized",
+            "settlement-authorized",
+            "source-branch",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:dev-delivery-warrant-cancel",
+          "name": "workflow:dev-delivery-warrant-cancel",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/dev-delivery-warrant-cancel.yml",
+          "evidencePath": ".github/workflows/dev-delivery-warrant-cancel.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "event-action",
+            "expected-candidate-id",
+            "expected-old-state-root",
+            "expected-pr-number",
+            "expected-source-head-sha",
+            "observed-source-head-sha",
+            "outcome",
+            "reason",
+            "target-branch",
+            "terminal-evidence-root",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:dev-delivery-warrant-close",
+          "name": "workflow:dev-delivery-warrant-close",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/dev-delivery-warrant-close.yml",
+          "evidencePath": ".github/workflows/dev-delivery-warrant-close.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "current-base-sha",
+            "expected-head-sha",
+            "expected-pr-number",
+            "merge-group-head-sha",
+            "merge-group-tree-sha",
+            "outcome",
+            "reason",
+            "replay-tree-sha",
+            "required-context-roots-json",
+            "target-branch",
+            "terminal-evidence-root",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-verify",
-          "name": "workflow:.release-verify",
+          "id": "workflow:dev-pr-auto-merge",
+          "name": "workflow:dev-pr-auto-merge",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-verify.yml",
-          "evidencePath": ".github/workflows/.release-verify.yml",
+          "sourcePath": ".github/workflows/dev-pr-auto-merge.yml",
+          "evidencePath": ".github/workflows/dev-pr-auto-merge.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 41,
+          "inputCount": 45,
           "inputs": [
-            "auto-approve-enabled",
-            "aws-ci-region",
-            "aws-user-region",
-            "bucket-staging-ci",
-            "bucket-staging-user",
-            "build-container-enabled",
-            "build-runner-linux",
-            "build-runner-linux-labels",
-            "build-runner-macos",
-            "build-runner-macos-labels",
-            "build-runner-windows",
-            "build-runner-windows-labels",
-            "build-timeout-minutes",
+            "active-lease-context",
+            "affected-paths-json",
+            "allowed-head-prefixes",
+            "assignment-root",
+            "block-labels",
             "buildchain-ref",
             "buildchain-repository",
-            "builder-container",
-            "code-signing-macos",
-            "code-signing-windows",
-            "collaborator-automation-enabled",
-            "enable-linux",
-            "enable-macos",
-            "enable-windows",
-            "find-dependencies",
-            "java-version",
-            "manager",
-            "max-build-attempts",
-            "max-preview-links",
-            "node-version",
-            "pipenv-version",
-            "poetry-version",
-            "prebuild",
-            "preview-files",
-            "publish-aws-ci",
-            "publish-aws-user",
-            "publish-github-npm",
-            "publish-versioning",
-            "python-version",
-            "setup-env-timeout-minutes",
-            "setup-python-enabled",
-            "use-pipenv",
-            "use-poetry"
+            "closure-root",
+            "defer-landing",
+            "delivery-class",
+            "delivery-priority",
+            "delivery-warrant-mode",
+            "dependency-root",
+            "diagnostic-context",
+            "dry-run",
+            "environment-root",
+            "expected-head-sha",
+            "expected-pr-number",
+            "handoff-workflow-id",
+            "initiative-root",
+            "landing-mode",
+            "legacy-active-owner-binding-json",
+            "max-merges",
+            "merge-method",
+            "native-command",
+            "native-command-root",
+            "native-heartbeat-seconds",
+            "native-proof-json",
+            "plan-root",
+            "project-cut-proof-json",
+            "queue-admission-context",
+            "ready-label",
+            "release-blocker-priority-json",
+            "require-approval",
+            "required-status-checks",
+            "same-repository-only",
+            "shard-evidence-roots-json",
+            "source-identity-root",
+            "source-patch-root",
+            "source-workflow-id",
+            "source-workflow-run-id",
+            "target-branch",
+            "toolchain-root",
+            "universal-request-json",
+            "warrant-lease-seconds"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.sam-release",
-          "name": "workflow:.sam-release",
+          "id": "workflow:dev-qualification-patrol",
+          "name": "workflow:dev-qualification-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.sam-release.yml",
-          "evidencePath": ".github/workflows/.sam-release.yml",
+          "sourcePath": ".github/workflows/dev-qualification-patrol.yml",
+          "evidencePath": ".github/workflows/dev-qualification-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 4,
+          "inputCount": 11,
           "inputs": [
-            "aws-region",
-            "aws-role",
-            "aws-root",
-            "bucket-release"
+            "buildchain-ref",
+            "buildchain-repository",
+            "dev-workflow-path",
+            "dispatch-inputs-json",
+            "dry-run",
+            "max-attempts",
+            "mutation-authorized",
+            "preflight-workflow-path",
+            "priority-workflows-json",
+            "source-branch",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.sam-verify",
-          "name": "workflow:.sam-verify",
+          "id": "workflow:engineering-housekeeper",
+          "name": "workflow:engineering-housekeeper",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.sam-verify.yml",
-          "evidencePath": ".github/workflows/.sam-verify.yml",
+          "sourcePath": ".github/workflows/engineering-housekeeper.yml",
+          "evidencePath": ".github/workflows/engineering-housekeeper.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 4,
+          "inputCount": 15,
           "inputs": [
-            "aws-region",
-            "aws-role",
-            "aws-root",
-            "manager"
+            "apply-enabled",
+            "artifact-prefix",
+            "artifact-retention-days",
+            "buildchain-ref",
+            "buildchain-repository",
+            "max-actions",
+            "mode",
+            "protected-patterns",
+            "repository",
+            "retained-patterns",
+            "stale-days",
+            "stale-pull-request-label",
+            "target-branch",
+            "temporary-branch-patterns",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.sync-release-page",
-          "name": "workflow:.sync-release-page",
+          "id": "workflow:github-artifact-attestation",
+          "name": "workflow:github-artifact-attestation",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.sync-release-page.yml",
-          "evidencePath": ".github/workflows/.sync-release-page.yml",
+          "sourcePath": ".github/workflows/github-artifact-attestation.yml",
+          "evidencePath": ".github/workflows/github-artifact-attestation.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 13,
+          "inputCount": 14,
           "inputs": [
-            "aws-region",
-            "aws-role-arn",
-            "base-id",
-            "bucket-release",
-            "cloudfront-id",
-            "exclude",
-            "lower-edge",
-            "product",
-            "product-name",
-            "release-path",
-            "release-url",
-            "repo",
-            "upper-edge"
+            "buildchain-ref",
+            "environment",
+            "evidence-artifact-name",
+            "evidence-run-id",
+            "platform-manifest-artifact-name",
+            "platform-manifest-relative-path",
+            "policy-json",
+            "release-passport-artifact-name",
+            "release-passport-relative-path",
+            "retention-days",
+            "source-sha",
+            "subject-artifact-name",
+            "subject-relative-path",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.sync-remote-git",
-          "name": "workflow:.sync-remote-git",
+          "id": "workflow:paper-release-sealed",
+          "name": "workflow:paper-release-sealed",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.sync-remote-git.yml",
-          "evidencePath": ".github/workflows/.sync-remote-git.yml",
+          "sourcePath": ".github/workflows/paper-release-sealed.yml",
+          "evidencePath": ".github/workflows/paper-release-sealed.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 4,
+          "inputCount": 27,
           "inputs": [
-            "force",
-            "remote-host",
-            "remote-path",
-            "remote-repo"
+            "artifact-name",
+            "artifact-paths",
+            "artifact-retention-days",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "github-governance-receipt-json",
+            "github-release",
+            "github-release-notes",
+            "github-release-title",
+            "package-name",
+            "publish-dist-tag",
+            "publisher-workflow-path",
+            "release-passport-impact-json",
+            "release-passport-output-dir",
+            "release-passport-product-name",
+            "required-status-check",
+            "target-ref",
+            "target-sha",
+            "toolchain-type",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.web-surface",
-          "name": "workflow:.web-surface",
+          "id": "workflow:paper-release",
+          "name": "workflow:paper-release",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.web-surface.yml",
-          "evidencePath": ".github/workflows/.web-surface.yml",
+          "sourcePath": ".github/workflows/paper-release.yml",
+          "evidencePath": ".github/workflows/paper-release.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 43,
+          "inputCount": 39,
           "inputs": [
-            "artifact-path",
-            "aws-region",
+            "artifact-name",
+            "artifact-retention-days",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
             "build-command",
             "buildchain-contract-compatibility-policy",
             "buildchain-contract-drift-issue-mode",
-            "buildchain-contract-expected-channel",
-            "buildchain-contract-expected-major",
             "buildchain-contract-lock-path",
             "buildchain-ref",
             "buildchain-repository",
-            "fail-on-release-pr-error",
+            "dry-run",
             "github-governance-receipt-json",
-            "node-version",
-            "preview-apply",
-            "preview-aws-role-arn",
-            "preview-cleanup-apply",
-            "preview-comment",
-            "preview-environment",
-            "production-apply",
-            "production-approved",
-            "production-aws-role-arn",
-            "production-environment",
-            "production-release-app-client-id",
-            "production-release-app-id",
-            "production-release-branch-channel",
-            "production-release-head-prefix",
-            "production-release-label",
-            "production-release-on-main",
-            "production-release-pr-mode",
-            "production-release-pr-token",
-            "production-source-sha",
+            "github-release",
+            "github-release-notes",
+            "github-release-title",
+            "node-version",
+            "package-name",
             "publication-admission-json",
             "publication-control-plane-audit-json",
             "publication-expected-json",
-            "publication-gate-aggregate-json",
             "publication-runner-provenance-json",
             "publication-used-nonces-json",
-            "release-feedback-actor-privacy",
-            "staging-apply",
-            "staging-aws-role-arn",
-            "staging-environment",
+            "publish-dist-tag",
+            "publish-package-set-order",
+            "release-passport-impact-json",
+            "release-passport-output-dir",
+            "release-passport-product-name",
+            "required-status-check",
+            "setup-node",
+            "target-ref",
+            "target-sha",
+            "toolchain-command",
+            "toolchain-digest",
+            "toolchain-image",
+            "toolchain-type",
+            "universal-request-json",
             "verify-command",
             "working-directory"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.wheel-release",
-          "name": "workflow:.wheel-release",
+          "id": "workflow:patrol-daily",
+          "name": "workflow:patrol-daily",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.wheel-release.yml",
-          "evidencePath": ".github/workflows/.wheel-release.yml",
+          "sourcePath": ".github/workflows/patrol-daily.yml",
+          "evidencePath": ".github/workflows/patrol-daily.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 3,
+          "inputCount": 14,
           "inputs": [
-            "aws-region",
-            "aws-user-region",
-            "bucket-release"
+            "allowed-head-prefixes",
+            "block-labels",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "landing-mode",
+            "max-actions",
+            "merge-method",
+            "ready-label",
+            "require-approval",
+            "required-status-checks",
+            "same-repository-only",
+            "target-branch",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.wheel-verify",
-          "name": "workflow:.wheel-verify",
+          "id": "workflow:patrol-monthly",
+          "name": "workflow:patrol-monthly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.wheel-verify.yml",
-          "evidencePath": ".github/workflows/.wheel-verify.yml",
+          "sourcePath": ".github/workflows/patrol-monthly.yml",
+          "evidencePath": ".github/workflows/patrol-monthly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
           "inputCount": 5,
           "inputs": [
-            "aws-user-region",
-            "bucket-release",
-            "max-preview-links",
-            "node-version",
-            "preview-files"
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "target-branch",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:artifact-signing-authority",
-          "name": "workflow:artifact-signing-authority",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/artifact-signing-authority.yml",
-          "evidencePath": ".github/workflows/artifact-signing-authority.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:auditable-demo-media-profile-qualification",
-          "name": "workflow:auditable-demo-media-profile-qualification",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/auditable-demo-media-profile-qualification.yml",
-          "evidencePath": ".github/workflows/auditable-demo-media-profile-qualification.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:auditable-demo",
-          "name": "workflow:auditable-demo",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/auditable-demo.yml",
-          "evidencePath": ".github/workflows/auditable-demo.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:binary-distribution",
-          "name": "workflow:binary-distribution",
+          "id": "workflow:patrol-observed-evidence",
+          "name": "workflow:patrol-observed-evidence",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/binary-distribution.yml",
-          "evidencePath": ".github/workflows/binary-distribution.yml",
+          "sourcePath": ".github/workflows/patrol-observed-evidence.yml",
+          "evidencePath": ".github/workflows/patrol-observed-evidence.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 13,
+          "inputs": [
+            "artifact-path",
+            "build-command",
+            "buildchain-ref",
+            "cloudfront-distribution",
+            "evidence-source-path",
+            "evidence-source-ref",
+            "evidence-source-repository",
+            "manifest-path",
+            "production-aws-role-arn",
+            "production-bucket",
+            "production-environment",
+            "universal-request-json",
+            "verify-command"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:binary-release-assets",
-          "name": "workflow:binary-release-assets",
+          "id": "workflow:patrol-weekly",
+          "name": "workflow:patrol-weekly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/binary-release-assets.yml",
-          "evidencePath": ".github/workflows/binary-release-assets.yml",
+          "sourcePath": ".github/workflows/patrol-weekly.yml",
+          "evidencePath": ".github/workflows/patrol-weekly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 5,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "target-branch",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:build-surface-fixture",
-          "name": "workflow:build-surface-fixture",
+          "id": "workflow:public-build-adopter-qualification",
+          "name": "workflow:public-build-adopter-qualification",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/build-surface-fixture.yml",
-          "evidencePath": ".github/workflows/build-surface-fixture.yml",
+          "sourcePath": ".github/workflows/public-build-adopter-qualification.yml",
+          "evidencePath": ".github/workflows/public-build-adopter-qualification.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 9,
+          "inputs": [
+            "archive-path",
+            "bootstrap-path",
+            "consumer",
+            "consumer-ref",
+            "consumer-repository",
+            "input-path",
+            "invocation-source-path",
+            "node-version",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:build",
-          "name": "workflow:build",
+          "id": "workflow:public-build-candidate",
+          "name": "workflow:public-build-candidate",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/build.yml",
-          "evidencePath": ".github/workflows/build.yml",
+          "sourcePath": ".github/workflows/public-build-candidate.yml",
+          "evidencePath": ".github/workflows/public-build-candidate.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 96,
+          "inputCount": 97,
           "inputs": [
             "artifact-compression-level",
             "artifact-finalization-command",
@@ -4783,6 +5831,7 @@
             "setup-rust",
             "shifu-cache-profile-digest",
             "shifu-cache-profile-ref",
+            "universal-request-json",
             "untrusted-policy",
             "verify-command",
             "verify-substage-evidence-path",
@@ -4791,482 +5840,570 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-alpha-self-dogfood",
-          "name": "workflow:buildchain-alpha-self-dogfood",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-alpha-self-dogfood.yml",
-          "evidencePath": ".github/workflows/buildchain-alpha-self-dogfood.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:buildchain-candidate-recovery-dogfood-failure",
-          "name": "workflow:buildchain-candidate-recovery-dogfood-failure",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml",
-          "evidencePath": ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:buildchain-dev-delivery",
-          "name": "workflow:buildchain-dev-delivery",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-dev-delivery.yml",
-          "evidencePath": ".github/workflows/buildchain-dev-delivery.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:buildchain-patrol-daily",
-          "name": "workflow:buildchain-patrol-daily",
+          "id": "workflow:public-build-check",
+          "name": "workflow:public-build-check",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-patrol-daily.yml",
-          "evidencePath": ".github/workflows/buildchain-patrol-daily.yml",
+          "sourcePath": ".github/workflows/public-build-check.yml",
+          "evidencePath": ".github/workflows/public-build-check.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 13,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "mode",
+            "node-version",
+            "require-version-state",
+            "source-proof-closure-paths-json",
+            "source-proof-dependency-paths-json",
+            "source-proof-policy-paths-json",
+            "source-proof-required-contexts-json",
+            "source-proof-reuse",
+            "universal-request-json",
+            "upload-artifacts",
+            "working-directory"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-patrol-monthly",
-          "name": "workflow:buildchain-patrol-monthly",
+          "id": "workflow:public-build-demo",
+          "name": "workflow:public-build-demo",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-patrol-monthly.yml",
-          "evidencePath": ".github/workflows/buildchain-patrol-monthly.yml",
+          "sourcePath": ".github/workflows/public-build-demo.yml",
+          "evidencePath": ".github/workflows/public-build-demo.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 13,
+          "inputs": [
+            "artifact-retention-days",
+            "binary-artifact-digest",
+            "binary-artifact-name",
+            "buildchain-repository",
+            "materialize",
+            "materialize-base-ref",
+            "media-profile",
+            "render-failure-advisory",
+            "render-media",
+            "renderer-image",
+            "scenario-path",
+            "source-ref",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-patrol-weekly",
-          "name": "workflow:buildchain-patrol-weekly",
+          "id": "workflow:public-build-publication",
+          "name": "workflow:public-build-publication",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-patrol-weekly.yml",
-          "evidencePath": ".github/workflows/buildchain-patrol-weekly.yml",
+          "sourcePath": ".github/workflows/public-build-publication.yml",
+          "evidencePath": ".github/workflows/public-build-publication.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 24,
+          "inputs": [
+            "artifact-name",
+            "artifact-paths",
+            "artifact-retention-days",
+            "build-command",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "node-version",
+            "package-name",
+            "prepare-paper-package",
+            "publish-dist-tag",
+            "setup-node",
+            "target-ref",
+            "toolchain-command",
+            "toolchain-digest",
+            "toolchain-image",
+            "toolchain-type",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-patrol",
-          "name": "workflow:buildchain-patrol",
+          "id": "workflow:public-build-stage-capsule-canary",
+          "name": "workflow:public-build-stage-capsule-canary",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-patrol.yml",
-          "evidencePath": ".github/workflows/buildchain-patrol.yml",
+          "sourcePath": ".github/workflows/public-build-stage-capsule-canary.yml",
+          "evidencePath": ".github/workflows/public-build-stage-capsule-canary.yml",
           "availability": "shipped",
           "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 16,
-          "inputs": [
-            "allowed-head-prefixes",
-            "block-labels",
-            "buildchain-ref",
-            "buildchain-repository",
-            "cadence",
-            "capabilities",
-            "dry-run",
-            "landing-mode",
-            "max-actions",
-            "merge-method",
-            "mode",
-            "ready-label",
-            "require-approval",
-            "required-status-checks",
-            "same-repository-only",
-            "target-branch"
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 7,
+          "inputs": [
+            "build-artifact-path",
+            "consumer",
+            "go-version",
+            "install-artifact-path",
+            "node-version",
+            "universal-request-json",
+            "verify-artifact-path"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-ref-promotion-recovery",
-          "name": "workflow:buildchain-ref-promotion-recovery",
+          "id": "workflow:public-ops-alpha-candidate-patrol",
+          "name": "workflow:public-ops-alpha-candidate-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-ref-promotion-recovery.yml",
-          "evidencePath": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+          "sourcePath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 16,
+          "inputs": [
+            "alpha-workflow-path",
+            "auto-merge",
+            "buildchain-ref",
+            "buildchain-repository",
+            "create-pull-request",
+            "dev-workflow-path",
+            "dry-run",
+            "max-age-seconds",
+            "merge-method",
+            "pull-request-body-prefix",
+            "pull-request-body-prefix-renderer",
+            "reactivation-authorized",
+            "settlement-authorized",
+            "source-branch",
+            "target-branch",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-ref-promotion",
-          "name": "workflow:buildchain-ref-promotion",
+          "id": "workflow:public-ops-bootstrap-recovery",
+          "name": "workflow:public-ops-bootstrap-recovery",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-ref-promotion.yml",
-          "evidencePath": ".github/workflows/buildchain-ref-promotion.yml",
+          "sourcePath": ".github/workflows/public-ops-bootstrap-recovery.yml",
+          "evidencePath": ".github/workflows/public-ops-bootstrap-recovery.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 1,
+          "inputs": [
+            "request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-stable-candidate-patrol",
-          "name": "workflow:buildchain-stable-candidate-patrol",
+          "id": "workflow:public-ops-bootstrap",
+          "name": "workflow:public-ops-bootstrap",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-stable-candidate-patrol.yml",
-          "evidencePath": ".github/workflows/buildchain-stable-candidate-patrol.yml",
+          "sourcePath": ".github/workflows/public-ops-bootstrap.yml",
+          "evidencePath": ".github/workflows/public-ops-bootstrap.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 1,
+          "inputs": [
+            "request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-stable-candidate-qualification",
-          "name": "workflow:buildchain-stable-candidate-qualification",
+          "id": "workflow:public-ops-dev-auto-merge",
+          "name": "workflow:public-ops-dev-auto-merge",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-stable-candidate-qualification.yml",
-          "evidencePath": ".github/workflows/buildchain-stable-candidate-qualification.yml",
+          "sourcePath": ".github/workflows/public-ops-dev-auto-merge.yml",
+          "evidencePath": ".github/workflows/public-ops-dev-auto-merge.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 45,
+          "inputs": [
+            "active-lease-context",
+            "affected-paths-json",
+            "allowed-head-prefixes",
+            "assignment-root",
+            "block-labels",
+            "buildchain-ref",
+            "buildchain-repository",
+            "closure-root",
+            "defer-landing",
+            "delivery-class",
+            "delivery-priority",
+            "delivery-warrant-mode",
+            "dependency-root",
+            "diagnostic-context",
+            "dry-run",
+            "environment-root",
+            "expected-head-sha",
+            "expected-pr-number",
+            "handoff-workflow-id",
+            "initiative-root",
+            "landing-mode",
+            "legacy-active-owner-binding-json",
+            "max-merges",
+            "merge-method",
+            "native-command",
+            "native-command-root",
+            "native-heartbeat-seconds",
+            "native-proof-json",
+            "plan-root",
+            "project-cut-proof-json",
+            "queue-admission-context",
+            "ready-label",
+            "release-blocker-priority-json",
+            "require-approval",
+            "required-status-checks",
+            "same-repository-only",
+            "shard-evidence-roots-json",
+            "source-identity-root",
+            "source-patch-root",
+            "source-workflow-id",
+            "source-workflow-run-id",
+            "target-branch",
+            "toolchain-root",
+            "universal-request-json",
+            "warrant-lease-seconds"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:candidate-lab",
-          "name": "workflow:candidate-lab",
+          "id": "workflow:public-ops-dev-qualification-patrol",
+          "name": "workflow:public-ops-dev-qualification-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/candidate-lab.yml",
-          "evidencePath": ".github/workflows/candidate-lab.yml",
+          "sourcePath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 11,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "dev-workflow-path",
+            "dispatch-inputs-json",
+            "dry-run",
+            "max-attempts",
+            "mutation-authorized",
+            "preflight-workflow-path",
+            "priority-workflows-json",
+            "source-branch",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:check",
-          "name": "workflow:check",
+          "id": "workflow:public-ops-housekeeping",
+          "name": "workflow:public-ops-housekeeping",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/check.yml",
-          "evidencePath": ".github/workflows/check.yml",
+          "sourcePath": ".github/workflows/public-ops-housekeeping.yml",
+          "evidencePath": ".github/workflows/public-ops-housekeeping.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 12,
+          "inputCount": 15,
           "inputs": [
+            "apply-enabled",
+            "artifact-prefix",
+            "artifact-retention-days",
             "buildchain-ref",
             "buildchain-repository",
+            "max-actions",
             "mode",
-            "node-version",
-            "require-version-state",
-            "source-proof-closure-paths-json",
-            "source-proof-dependency-paths-json",
-            "source-proof-policy-paths-json",
-            "source-proof-required-contexts-json",
-            "source-proof-reuse",
-            "upload-artifacts",
-            "working-directory"
+            "protected-patterns",
+            "repository",
+            "retained-patterns",
+            "stale-days",
+            "stale-pull-request-label",
+            "target-branch",
+            "temporary-branch-patterns",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:dev-alpha-candidate-patrol",
-          "name": "workflow:dev-alpha-candidate-patrol",
+          "id": "workflow:public-ops-observed-evidence",
+          "name": "workflow:public-ops-observed-evidence",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-alpha-candidate-patrol.yml",
-          "evidencePath": ".github/workflows/dev-alpha-candidate-patrol.yml",
+          "sourcePath": ".github/workflows/public-ops-observed-evidence.yml",
+          "evidencePath": ".github/workflows/public-ops-observed-evidence.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 15,
+          "inputCount": 13,
           "inputs": [
-            "alpha-workflow-path",
-            "auto-merge",
+            "artifact-path",
+            "build-command",
             "buildchain-ref",
-            "buildchain-repository",
-            "create-pull-request",
-            "dev-workflow-path",
-            "dry-run",
-            "max-age-seconds",
-            "merge-method",
-            "pull-request-body-prefix",
-            "pull-request-body-prefix-renderer",
-            "reactivation-authorized",
-            "settlement-authorized",
-            "source-branch",
-            "target-branch"
+            "cloudfront-distribution",
+            "evidence-source-path",
+            "evidence-source-ref",
+            "evidence-source-repository",
+            "manifest-path",
+            "production-aws-role-arn",
+            "production-bucket",
+            "production-environment",
+            "universal-request-json",
+            "verify-command"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:dev-delivery-warrant-cancel",
-          "name": "workflow:dev-delivery-warrant-cancel",
+          "id": "workflow:public-ops-patrol-daily",
+          "name": "workflow:public-ops-patrol-daily",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-delivery-warrant-cancel.yml",
-          "evidencePath": ".github/workflows/dev-delivery-warrant-cancel.yml",
+          "sourcePath": ".github/workflows/public-ops-patrol-daily.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol-daily.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 12,
+          "inputCount": 14,
           "inputs": [
+            "allowed-head-prefixes",
+            "block-labels",
             "buildchain-ref",
             "buildchain-repository",
-            "event-action",
-            "expected-candidate-id",
-            "expected-old-state-root",
-            "expected-pr-number",
-            "expected-source-head-sha",
-            "observed-source-head-sha",
-            "outcome",
-            "reason",
+            "dry-run",
+            "landing-mode",
+            "max-actions",
+            "merge-method",
+            "ready-label",
+            "require-approval",
+            "required-status-checks",
+            "same-repository-only",
             "target-branch",
-            "terminal-evidence-root"
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:dev-delivery-warrant-close",
-          "name": "workflow:dev-delivery-warrant-close",
+          "id": "workflow:public-ops-patrol-monthly",
+          "name": "workflow:public-ops-patrol-monthly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-delivery-warrant-close.yml",
-          "evidencePath": ".github/workflows/dev-delivery-warrant-close.yml",
+          "sourcePath": ".github/workflows/public-ops-patrol-monthly.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol-monthly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 13,
+          "inputCount": 5,
           "inputs": [
             "buildchain-ref",
             "buildchain-repository",
-            "current-base-sha",
-            "expected-head-sha",
-            "expected-pr-number",
-            "merge-group-head-sha",
-            "merge-group-tree-sha",
-            "outcome",
-            "reason",
-            "replay-tree-sha",
-            "required-context-roots-json",
+            "dry-run",
             "target-branch",
-            "terminal-evidence-root"
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:dev-merge-queue-governance",
-          "name": "workflow:dev-merge-queue-governance",
+          "id": "workflow:public-ops-patrol-weekly",
+          "name": "workflow:public-ops-patrol-weekly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-merge-queue-governance.yml",
-          "evidencePath": ".github/workflows/dev-merge-queue-governance.yml",
+          "sourcePath": ".github/workflows/public-ops-patrol-weekly.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol-weekly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 5,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "target-branch",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:dev-pr-auto-merge",
-          "name": "workflow:dev-pr-auto-merge",
+          "id": "workflow:public-ops-patrol",
+          "name": "workflow:public-ops-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-pr-auto-merge.yml",
-          "evidencePath": ".github/workflows/dev-pr-auto-merge.yml",
+          "sourcePath": ".github/workflows/public-ops-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 44,
+          "inputCount": 17,
           "inputs": [
-            "active-lease-context",
-            "affected-paths-json",
             "allowed-head-prefixes",
-            "assignment-root",
             "block-labels",
             "buildchain-ref",
             "buildchain-repository",
-            "closure-root",
-            "defer-landing",
-            "delivery-class",
-            "delivery-priority",
-            "delivery-warrant-mode",
-            "dependency-root",
-            "diagnostic-context",
+            "cadence",
+            "capabilities",
             "dry-run",
-            "environment-root",
-            "expected-head-sha",
-            "expected-pr-number",
-            "handoff-workflow-id",
-            "initiative-root",
             "landing-mode",
-            "legacy-active-owner-binding-json",
-            "max-merges",
+            "max-actions",
             "merge-method",
-            "native-command",
-            "native-command-root",
-            "native-heartbeat-seconds",
-            "native-proof-json",
-            "plan-root",
-            "project-cut-proof-json",
-            "queue-admission-context",
+            "mode",
             "ready-label",
-            "release-blocker-priority-json",
             "require-approval",
             "required-status-checks",
             "same-repository-only",
-            "shard-evidence-roots-json",
-            "source-identity-root",
-            "source-patch-root",
-            "source-workflow-id",
-            "source-workflow-run-id",
             "target-branch",
-            "toolchain-root",
-            "warrant-lease-seconds"
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:dev-qualification-patrol",
-          "name": "workflow:dev-qualification-patrol",
+          "id": "workflow:public-ops-release-governance",
+          "name": "workflow:public-ops-release-governance",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/dev-qualification-patrol.yml",
-          "evidencePath": ".github/workflows/dev-qualification-patrol.yml",
+          "sourcePath": ".github/workflows/public-ops-release-governance.yml",
+          "evidencePath": ".github/workflows/public-ops-release-governance.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 10,
+          "inputCount": 5,
           "inputs": [
+            "apply",
+            "branch",
             "buildchain-ref",
-            "buildchain-repository",
-            "dev-workflow-path",
-            "dispatch-inputs-json",
-            "dry-run",
-            "max-attempts",
-            "mutation-authorized",
-            "preflight-workflow-path",
-            "priority-workflows-json",
-            "source-branch"
+            "candidate-sha",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:engineering-housekeeper-daily",
-          "name": "workflow:engineering-housekeeper-daily",
+          "id": "workflow:public-ops-stable-candidate-patrol",
+          "name": "workflow:public-ops-stable-candidate-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/engineering-housekeeper-daily.yml",
-          "evidencePath": ".github/workflows/engineering-housekeeper-daily.yml",
+          "sourcePath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 17,
+          "inputs": [
+            "auto-approve",
+            "auto-merge",
+            "auto-promote",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "hold",
+            "hold-reason",
+            "ledger-ref",
+            "merge-method",
+            "minimum-soak-seconds",
+            "release-now",
+            "required-checks",
+            "revoke-reason",
+            "revoked-versions",
+            "target-branch",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:engineering-housekeeper-monthly",
-          "name": "workflow:engineering-housekeeper-monthly",
+          "id": "workflow:public-ops-tail-reseal",
+          "name": "workflow:public-ops-tail-reseal",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/engineering-housekeeper-monthly.yml",
-          "evidencePath": ".github/workflows/engineering-housekeeper-monthly.yml",
+          "sourcePath": ".github/workflows/public-ops-tail-reseal.yml",
+          "evidencePath": ".github/workflows/public-ops-tail-reseal.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 5,
+          "inputs": [
+            "artifact-retention-days",
+            "consumer-policy-receipt-json",
+            "macos-finalization-command",
+            "request-json",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:engineering-housekeeper-weekly",
-          "name": "workflow:engineering-housekeeper-weekly",
+          "id": "workflow:public-ops-warrant-cancel",
+          "name": "workflow:public-ops-warrant-cancel",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/engineering-housekeeper-weekly.yml",
-          "evidencePath": ".github/workflows/engineering-housekeeper-weekly.yml",
+          "sourcePath": ".github/workflows/public-ops-warrant-cancel.yml",
+          "evidencePath": ".github/workflows/public-ops-warrant-cancel.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 13,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "event-action",
+            "expected-candidate-id",
+            "expected-old-state-root",
+            "expected-pr-number",
+            "expected-source-head-sha",
+            "observed-source-head-sha",
+            "outcome",
+            "reason",
+            "target-branch",
+            "terminal-evidence-root",
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:engineering-housekeeper",
-          "name": "workflow:engineering-housekeeper",
+          "id": "workflow:public-ops-warrant-close",
+          "name": "workflow:public-ops-warrant-close",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/engineering-housekeeper.yml",
-          "evidencePath": ".github/workflows/engineering-housekeeper.yml",
+          "sourcePath": ".github/workflows/public-ops-warrant-close.yml",
+          "evidencePath": ".github/workflows/public-ops-warrant-close.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
           "inputCount": 14,
           "inputs": [
-            "apply-enabled",
-            "artifact-prefix",
-            "artifact-retention-days",
             "buildchain-ref",
             "buildchain-repository",
-            "max-actions",
-            "mode",
-            "protected-patterns",
-            "repository",
-            "retained-patterns",
-            "stale-days",
-            "stale-pull-request-label",
+            "current-base-sha",
+            "expected-head-sha",
+            "expected-pr-number",
+            "merge-group-head-sha",
+            "merge-group-tree-sha",
+            "outcome",
+            "reason",
+            "replay-tree-sha",
+            "required-context-roots-json",
             "target-branch",
-            "temporary-branch-patterns"
+            "terminal-evidence-root",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:github-artifact-attestation",
-          "name": "workflow:github-artifact-attestation",
+          "id": "workflow:public-release-artifact-attestation",
+          "name": "workflow:public-release-artifact-attestation",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/github-artifact-attestation.yml",
-          "evidencePath": ".github/workflows/github-artifact-attestation.yml",
+          "sourcePath": ".github/workflows/public-release-artifact-attestation.yml",
+          "evidencePath": ".github/workflows/public-release-artifact-attestation.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 13,
+          "inputCount": 14,
           "inputs": [
             "buildchain-ref",
             "environment",
@@ -5280,49 +6417,38 @@
             "retention-days",
             "source-sha",
             "subject-artifact-name",
-            "subject-relative-path"
+            "subject-relative-path",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:github-governance-audit",
-          "name": "workflow:github-governance-audit",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/github-governance-audit.yml",
-          "evidencePath": ".github/workflows/github-governance-audit.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:npm-publish",
-          "name": "workflow:npm-publish",
+          "id": "workflow:public-release-oci-compose-preview",
+          "name": "workflow:public-release-oci-compose-preview",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/npm-publish.yml",
-          "evidencePath": ".github/workflows/npm-publish.yml",
+          "sourcePath": ".github/workflows/public-release-oci-compose-preview.yml",
+          "evidencePath": ".github/workflows/public-release-oci-compose-preview.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 0,
-          "inputs": [],
+          "inputCount": 1,
+          "inputs": [
+            "universal-request-json"
+          ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:paper-release-sealed",
-          "name": "workflow:paper-release-sealed",
+          "id": "workflow:public-release-paper-sealed",
+          "name": "workflow:public-release-paper-sealed",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/paper-release-sealed.yml",
-          "evidencePath": ".github/workflows/paper-release-sealed.yml",
+          "sourcePath": ".github/workflows/public-release-paper-sealed.yml",
+          "evidencePath": ".github/workflows/public-release-paper-sealed.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 26,
+          "inputCount": 27,
           "inputs": [
             "artifact-name",
             "artifact-paths",
@@ -5348,22 +6474,23 @@
             "target-ref",
             "target-sha",
             "toolchain-type",
+            "universal-request-json",
             "verify-command",
             "working-directory"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:paper-release",
-          "name": "workflow:paper-release",
+          "id": "workflow:public-release-paper",
+          "name": "workflow:public-release-paper",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/paper-release.yml",
-          "evidencePath": ".github/workflows/paper-release.yml",
+          "sourcePath": ".github/workflows/public-release-paper.yml",
+          "evidencePath": ".github/workflows/public-release-paper.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 38,
+          "inputCount": 39,
           "inputs": [
             "artifact-name",
             "artifact-retention-days",
@@ -5401,101 +6528,269 @@
             "toolchain-digest",
             "toolchain-image",
             "toolchain-type",
+            "universal-request-json",
             "verify-command",
             "working-directory"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:patrol-daily",
-          "name": "workflow:patrol-daily",
+          "id": "workflow:public-release-promote",
+          "name": "workflow:public-release-promote",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/patrol-daily.yml",
-          "evidencePath": ".github/workflows/patrol-daily.yml",
+          "sourcePath": ".github/workflows/public-release-promote.yml",
+          "evidencePath": ".github/workflows/public-release-promote.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 13,
+          "inputCount": 107,
           "inputs": [
-            "allowed-head-prefixes",
-            "block-labels",
+            "allow-repository",
+            "artifact-name",
+            "artifact-patterns",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-channel",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
             "buildchain-ref",
             "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "channel",
+            "declarative-release-tail",
             "dry-run",
-            "landing-mode",
-            "max-actions",
-            "merge-method",
-            "ready-label",
-            "require-approval",
-            "required-status-checks",
-            "same-repository-only",
-            "target-branch"
+            "github-artifact-attestation-environment",
+            "github-artifact-attestation-policy-json",
+            "github-artifact-attestation-retention-days",
+            "github-governance-receipt-json",
+            "github-release",
+            "github-release-notes",
+            "github-release-payload-patterns",
+            "github-release-title",
+            "package-manager",
+            "provider-failure-after-capability",
+            "publication-admission-json",
+            "publication-auto-admission",
+            "publication-auto-no-gate",
+            "publication-commit-command",
+            "publication-commit-evidence-path",
+            "publication-consumer-predicate-id",
+            "publication-consumer-qualification-command",
+            "publication-consumer-qualification-controller-sha",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-gate-command",
+            "publication-gate-controller-sha",
+            "publication-package-name",
+            "publication-product",
+            "publication-publisher-workflow-path",
+            "publication-runner-provenance-json",
+            "publication-target",
+            "publication-used-nonces-json",
+            "publication-used-qualification-nonces-json",
+            "publish-artifact-kind",
+            "publish-command",
+            "publish-dist-tag",
+            "publish-mode",
+            "publish-package-main",
+            "publish-package-set-order",
+            "publish-rematerialize-on-resume",
+            "publish-required-artifacts-json",
+            "publish-target",
+            "publish-transaction-override",
+            "release-activation-command",
+            "release-activation-receipt-set-path",
+            "release-candidate-family-assignment-id",
+            "release-candidate-family-evidence-required",
+            "release-candidate-family-evidence-root",
+            "release-candidate-family-initiative-id",
+            "release-candidate-wait-seconds",
+            "release-candidate-workflow-file",
+            "release-candidate-workflow-name",
+            "release-passport",
+            "release-passport-adopter-delivery-json",
+            "release-passport-attachment-command",
+            "release-passport-buildchain-self-kfd",
+            "release-passport-evidence-command",
+            "release-passport-evidence-jsons",
+            "release-passport-evidence-path",
+            "release-passport-impact-json",
+            "release-passport-invariant-passport-command",
+            "release-passport-invariant-passport-jsons",
+            "release-passport-kfd-1-witness-jsons",
+            "release-passport-kfd-2-claim-jsons",
+            "release-passport-kfd-3-artifact-verify-command",
+            "release-passport-kfd-3-artifact-witness-jsons",
+            "release-passport-kfd-3-prebuild-witness-jsons",
+            "release-passport-kfd-adopter-manifest-gate-json",
+            "release-passport-kfd-adopter-manifest-json",
+            "release-passport-kfd-product-gate-jsons",
+            "release-passport-kfd-support-matrix-json",
+            "release-passport-output-dir",
+            "release-passport-platform-manifest-paths",
+            "release-passport-product-name",
+            "release-passport-v4-runtime-resume-evidence-json",
+            "release-propagation-config-path",
+            "required-artifact-count",
+            "required-status-check",
+            "resume-buildchain-runtime-sha",
+            "resume-candidate-repository",
+            "resume-candidate-run-id",
+            "resume-expected-candidate-root",
+            "resume-expected-candidate-runtime-sha",
+            "resume-expected-source-tree",
+            "resume-expected-workflow-file",
+            "resume-expected-workflow-name",
+            "resume-transaction-id",
+            "runner-preset",
+            "standalone-binary-distribution",
+            "target-ref",
+            "target-sha",
+            "trusted-publishing",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:patrol-monthly",
-          "name": "workflow:patrol-monthly",
+          "id": "workflow:public-release-propagation",
+          "name": "workflow:public-release-propagation",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/patrol-monthly.yml",
-          "evidencePath": ".github/workflows/patrol-monthly.yml",
+          "sourcePath": ".github/workflows/public-release-propagation.yml",
+          "evidencePath": ".github/workflows/public-release-propagation.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 4,
+          "inputCount": 20,
           "inputs": [
+            "agent-work-context-json",
+            "agent-work-mode",
             "buildchain-ref",
             "buildchain-repository",
+            "downstream-base-ref",
+            "downstream-branch",
+            "downstream-prepare-command",
+            "downstream-repository",
+            "downstream-target",
+            "downstream-update-command",
+            "downstream-verify-command",
             "dry-run",
-            "target-branch"
+            "graph-json",
+            "lock-path",
+            "pr-body",
+            "pr-title",
+            "refresh-managed-readme-badges",
+            "source-node",
+            "universal-request-json",
+            "upstream-release-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:patrol-observed-evidence",
-          "name": "workflow:patrol-observed-evidence",
+          "id": "workflow:public-release-signing-authority",
+          "name": "workflow:public-release-signing-authority",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/patrol-observed-evidence.yml",
-          "evidencePath": ".github/workflows/patrol-observed-evidence.yml",
+          "sourcePath": ".github/workflows/public-release-signing-authority.yml",
+          "evidencePath": ".github/workflows/public-release-signing-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-release-tail",
+          "name": "workflow:public-release-tail",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-release-tail.yml",
+          "evidencePath": ".github/workflows/public-release-tail.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 12,
+          "inputCount": 15,
           "inputs": [
-            "artifact-path",
-            "build-command",
             "buildchain-ref",
-            "cloudfront-distribution",
-            "evidence-source-path",
-            "evidence-source-ref",
-            "evidence-source-repository",
-            "manifest-path",
-            "production-aws-role-arn",
-            "production-bucket",
-            "production-environment",
-            "verify-command"
+            "candidate-root",
+            "capsule-contract",
+            "capsule-path",
+            "capsule-root",
+            "declaration-path",
+            "evidence-path",
+            "execute",
+            "provider-bindings-path",
+            "rehearsal-authority-path",
+            "rehearsal-capsule-path",
+            "rehearsal-evidence-path",
+            "rehearsal-mode",
+            "state-path",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:patrol-weekly",
-          "name": "workflow:patrol-weekly",
+          "id": "workflow:public-release-web",
+          "name": "workflow:public-release-web",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/patrol-weekly.yml",
-          "evidencePath": ".github/workflows/patrol-weekly.yml",
+          "sourcePath": ".github/workflows/public-release-web.yml",
+          "evidencePath": ".github/workflows/public-release-web.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 4,
+          "inputCount": 44,
           "inputs": [
+            "artifact-path",
+            "aws-region",
+            "build-command",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-expected-channel",
+            "buildchain-contract-expected-major",
+            "buildchain-contract-lock-path",
             "buildchain-ref",
             "buildchain-repository",
-            "dry-run",
-            "target-branch"
+            "fail-on-release-pr-error",
+            "github-governance-receipt-json",
+            "node-version",
+            "preview-apply",
+            "preview-aws-role-arn",
+            "preview-cleanup-apply",
+            "preview-comment",
+            "preview-environment",
+            "production-apply",
+            "production-approved",
+            "production-aws-role-arn",
+            "production-environment",
+            "production-release-app-client-id",
+            "production-release-app-id",
+            "production-release-branch-channel",
+            "production-release-head-prefix",
+            "production-release-label",
+            "production-release-on-main",
+            "production-release-pr-mode",
+            "production-release-pr-token",
+            "production-source-sha",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "release-feedback-actor-privacy",
+            "staging-apply",
+            "staging-aws-role-arn",
+            "staging-environment",
+            "universal-request-json",
+            "verify-command",
+            "working-directory"
           ],
           "reverseAuditSource": ".github/workflows"
         },
@@ -5509,7 +6804,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 23,
+          "inputCount": 24,
           "inputs": [
             "artifact-name",
             "artifact-paths",
@@ -5532,6 +6827,7 @@
             "toolchain-digest",
             "toolchain-image",
             "toolchain-type",
+            "universal-request-json",
             "verify-command",
             "working-directory"
           ],
@@ -5547,7 +6843,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 106,
+          "inputCount": 107,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -5654,35 +6950,270 @@
             "standalone-binary-distribution",
             "target-ref",
             "target-sha",
-            "trusted-publishing"
+            "trusted-publishing",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:release-governance-reconcile",
+          "name": "workflow:release-governance-reconcile",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/release-governance-reconcile.yml",
+          "evidencePath": ".github/workflows/release-governance-reconcile.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "apply",
+            "branch",
+            "buildchain-ref",
+            "candidate-sha",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:release-propagation",
+          "name": "workflow:release-propagation",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/release-propagation.yml",
+          "evidencePath": ".github/workflows/release-propagation.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 20,
+          "inputs": [
+            "agent-work-context-json",
+            "agent-work-mode",
+            "buildchain-ref",
+            "buildchain-repository",
+            "downstream-base-ref",
+            "downstream-branch",
+            "downstream-prepare-command",
+            "downstream-repository",
+            "downstream-target",
+            "downstream-update-command",
+            "downstream-verify-command",
+            "dry-run",
+            "graph-json",
+            "lock-path",
+            "pr-body",
+            "pr-title",
+            "refresh-managed-readme-badges",
+            "source-node",
+            "universal-request-json",
+            "upstream-release-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:release-tail",
+          "name": "workflow:release-tail",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/release-tail.yml",
+          "evidencePath": ".github/workflows/release-tail.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 15,
+          "inputs": [
+            "buildchain-ref",
+            "candidate-root",
+            "capsule-contract",
+            "capsule-path",
+            "capsule-root",
+            "declaration-path",
+            "evidence-path",
+            "execute",
+            "provider-bindings-path",
+            "rehearsal-authority-path",
+            "rehearsal-capsule-path",
+            "rehearsal-evidence-path",
+            "rehearsal-mode",
+            "state-path",
+            "universal-request-json"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-governance-reconcile",
-          "name": "workflow:release-governance-reconcile",
+          "id": "workflow:self-build-adopter-dogfood",
+          "name": "workflow:self-build-adopter-dogfood",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-build-adopter-dogfood.yml",
+          "evidencePath": ".github/workflows/self-build-adopter-dogfood.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-build-alpha-dogfood",
+          "name": "workflow:self-build-alpha-dogfood",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-build-alpha-dogfood.yml",
+          "evidencePath": ".github/workflows/self-build-alpha-dogfood.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-build-binary-distribution",
+          "name": "workflow:self-build-binary-distribution",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-build-binary-distribution.yml",
+          "evidencePath": ".github/workflows/self-build-binary-distribution.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-build-candidate-lab",
+          "name": "workflow:self-build-candidate-lab",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-build-candidate-lab.yml",
+          "evidencePath": ".github/workflows/self-build-candidate-lab.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-build-demo-dogfood",
+          "name": "workflow:self-build-demo-dogfood",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-build-demo-dogfood.yml",
+          "evidencePath": ".github/workflows/self-build-demo-dogfood.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-build-demo-media-qualification",
+          "name": "workflow:self-build-demo-media-qualification",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-build-demo-media-qualification.yml",
+          "evidencePath": ".github/workflows/self-build-demo-media-qualification.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-build-fixture",
+          "name": "workflow:self-build-fixture",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-build-fixture.yml",
+          "evidencePath": ".github/workflows/self-build-fixture.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-build-public-consumer-dogfood",
+          "name": "workflow:self-build-public-consumer-dogfood",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-build-public-consumer-dogfood.yml",
+          "evidencePath": ".github/workflows/self-build-public-consumer-dogfood.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-build-release-verify-compat",
+          "name": "workflow:self-build-release-verify-compat",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-build-release-verify-compat.yml",
+          "evidencePath": ".github/workflows/self-build-release-verify-compat.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-build-stable-candidate-qualification",
+          "name": "workflow:self-build-stable-candidate-qualification",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-build-stable-candidate-qualification.yml",
+          "evidencePath": ".github/workflows/self-build-stable-candidate-qualification.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-build-verify",
+          "name": "workflow:self-build-verify",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-build-verify.yml",
+          "evidencePath": ".github/workflows/self-build-verify.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-ops-bootstrap-dogfood",
+          "name": "workflow:self-ops-bootstrap-dogfood",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-governance-reconcile.yml",
-          "evidencePath": ".github/workflows/release-governance-reconcile.yml",
+          "sourcePath": ".github/workflows/self-ops-bootstrap-dogfood.yml",
+          "evidencePath": ".github/workflows/self-ops-bootstrap-dogfood.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 4,
-          "inputs": [
-            "apply",
-            "branch",
-            "buildchain-ref",
-            "candidate-sha"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-line-bootstrap",
-          "name": "workflow:release-line-bootstrap",
+          "id": "workflow:self-ops-dev-delivery",
+          "name": "workflow:self-ops-dev-delivery",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-line-bootstrap.yml",
-          "evidencePath": ".github/workflows/release-line-bootstrap.yml",
+          "sourcePath": ".github/workflows/self-ops-dev-delivery.yml",
+          "evidencePath": ".github/workflows/self-ops-dev-delivery.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5692,11 +7223,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-new-version",
-          "name": "workflow:release-new-version",
+          "id": "workflow:self-ops-governance-audit",
+          "name": "workflow:self-ops-governance-audit",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-new-version.yml",
-          "evidencePath": ".github/workflows/release-new-version.yml",
+          "sourcePath": ".github/workflows/self-ops-governance-audit.yml",
+          "evidencePath": ".github/workflows/self-ops-governance-audit.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5706,74 +7237,39 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-propagation",
-          "name": "workflow:release-propagation",
+          "id": "workflow:self-ops-housekeeping-daily",
+          "name": "workflow:self-ops-housekeeping-daily",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-propagation.yml",
-          "evidencePath": ".github/workflows/release-propagation.yml",
+          "sourcePath": ".github/workflows/self-ops-housekeeping-daily.yml",
+          "evidencePath": ".github/workflows/self-ops-housekeeping-daily.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 19,
-          "inputs": [
-            "agent-work-context-json",
-            "agent-work-mode",
-            "buildchain-ref",
-            "buildchain-repository",
-            "downstream-base-ref",
-            "downstream-branch",
-            "downstream-prepare-command",
-            "downstream-repository",
-            "downstream-target",
-            "downstream-update-command",
-            "downstream-verify-command",
-            "dry-run",
-            "graph-json",
-            "lock-path",
-            "pr-body",
-            "pr-title",
-            "refresh-managed-readme-badges",
-            "source-node",
-            "upstream-release-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-tail",
-          "name": "workflow:release-tail",
+          "id": "workflow:self-ops-housekeeping-monthly",
+          "name": "workflow:self-ops-housekeeping-monthly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-tail.yml",
-          "evidencePath": ".github/workflows/release-tail.yml",
+          "sourcePath": ".github/workflows/self-ops-housekeeping-monthly.yml",
+          "evidencePath": ".github/workflows/self-ops-housekeeping-monthly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 14,
-          "inputs": [
-            "buildchain-ref",
-            "candidate-root",
-            "capsule-contract",
-            "capsule-path",
-            "capsule-root",
-            "declaration-path",
-            "evidence-path",
-            "execute",
-            "provider-bindings-path",
-            "rehearsal-authority-path",
-            "rehearsal-capsule-path",
-            "rehearsal-evidence-path",
-            "rehearsal-mode",
-            "state-path"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:release-verify",
-          "name": "workflow:release-verify",
+          "id": "workflow:self-ops-housekeeping-weekly",
+          "name": "workflow:self-ops-housekeeping-weekly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/release-verify.yml",
-          "evidencePath": ".github/workflows/release-verify.yml",
+          "sourcePath": ".github/workflows/self-ops-housekeeping-weekly.yml",
+          "evidencePath": ".github/workflows/self-ops-housekeeping-weekly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5783,11 +7279,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:schedule-purge-artifacts",
-          "name": "workflow:schedule-purge-artifacts",
+          "id": "workflow:self-ops-merge-queue",
+          "name": "workflow:self-ops-merge-queue",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/schedule-purge-artifacts.yml",
-          "evidencePath": ".github/workflows/schedule-purge-artifacts.yml",
+          "sourcePath": ".github/workflows/self-ops-merge-queue.yml",
+          "evidencePath": ".github/workflows/self-ops-merge-queue.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5797,11 +7293,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:self-hosted-runner-smoke",
-          "name": "workflow:self-hosted-runner-smoke",
+          "id": "workflow:self-ops-patrol-daily",
+          "name": "workflow:self-ops-patrol-daily",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/self-hosted-runner-smoke.yml",
-          "evidencePath": ".github/workflows/self-hosted-runner-smoke.yml",
+          "sourcePath": ".github/workflows/self-ops-patrol-daily.yml",
+          "evidencePath": ".github/workflows/self-ops-patrol-daily.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5811,42 +7307,25 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:stable-candidate-patrol",
-          "name": "workflow:stable-candidate-patrol",
+          "id": "workflow:self-ops-patrol-monthly",
+          "name": "workflow:self-ops-patrol-monthly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/stable-candidate-patrol.yml",
-          "evidencePath": ".github/workflows/stable-candidate-patrol.yml",
+          "sourcePath": ".github/workflows/self-ops-patrol-monthly.yml",
+          "evidencePath": ".github/workflows/self-ops-patrol-monthly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 16,
-          "inputs": [
-            "auto-approve",
-            "auto-merge",
-            "auto-promote",
-            "buildchain-ref",
-            "buildchain-repository",
-            "dry-run",
-            "hold",
-            "hold-reason",
-            "ledger-ref",
-            "merge-method",
-            "minimum-soak-seconds",
-            "release-now",
-            "required-checks",
-            "revoke-reason",
-            "revoked-versions",
-            "target-branch"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:v4-adopter-delivery-dogfood",
-          "name": "workflow:v4-adopter-delivery-dogfood",
+          "id": "workflow:self-ops-patrol-weekly",
+          "name": "workflow:self-ops-patrol-weekly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/v4-adopter-delivery-dogfood.yml",
-          "evidencePath": ".github/workflows/v4-adopter-delivery-dogfood.yml",
+          "sourcePath": ".github/workflows/self-ops-patrol-weekly.yml",
+          "evidencePath": ".github/workflows/self-ops-patrol-weekly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5856,34 +7335,25 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:v4-adopter-delivery",
-          "name": "workflow:v4-adopter-delivery",
+          "id": "workflow:self-ops-promotion-recovery",
+          "name": "workflow:self-ops-promotion-recovery",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/v4-adopter-delivery.yml",
-          "evidencePath": ".github/workflows/v4-adopter-delivery.yml",
+          "sourcePath": ".github/workflows/self-ops-promotion-recovery.yml",
+          "evidencePath": ".github/workflows/self-ops-promotion-recovery.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 8,
-          "inputs": [
-            "archive-path",
-            "bootstrap-path",
-            "consumer",
-            "consumer-ref",
-            "consumer-repository",
-            "input-path",
-            "invocation-source-path",
-            "node-version"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:v4-declarative-release-tail-dogfood",
-          "name": "workflow:v4-declarative-release-tail-dogfood",
+          "id": "workflow:self-ops-recovery-failure-dogfood",
+          "name": "workflow:self-ops-recovery-failure-dogfood",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
-          "evidencePath": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
+          "sourcePath": ".github/workflows/self-ops-recovery-failure-dogfood.yml",
+          "evidencePath": ".github/workflows/self-ops-recovery-failure-dogfood.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5893,11 +7363,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:v4-public-consumer-dogfood",
-          "name": "workflow:v4-public-consumer-dogfood",
+          "id": "workflow:self-ops-runner-smoke",
+          "name": "workflow:self-ops-runner-smoke",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/v4-public-consumer-dogfood.yml",
-          "evidencePath": ".github/workflows/v4-public-consumer-dogfood.yml",
+          "sourcePath": ".github/workflows/self-ops-runner-smoke.yml",
+          "evidencePath": ".github/workflows/self-ops-runner-smoke.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5907,11 +7377,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:v4-publication-rehearsal-dogfood",
-          "name": "workflow:v4-publication-rehearsal-dogfood",
+          "id": "workflow:self-ops-stable-candidate-patrol",
+          "name": "workflow:self-ops-stable-candidate-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/v4-publication-rehearsal-dogfood.yml",
-          "evidencePath": ".github/workflows/v4-publication-rehearsal-dogfood.yml",
+          "sourcePath": ".github/workflows/self-ops-stable-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/self-ops-stable-candidate-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5921,51 +7391,109 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:v4-stage-capsule-canary",
-          "name": "workflow:v4-stage-capsule-canary",
+          "id": "workflow:self-release-binary-assets",
+          "name": "workflow:self-release-binary-assets",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/v4-stage-capsule-canary.yml",
-          "evidencePath": ".github/workflows/v4-stage-capsule-canary.yml",
+          "sourcePath": ".github/workflows/self-release-binary-assets.yml",
+          "evidencePath": ".github/workflows/self-release-binary-assets.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 6,
-          "inputs": [
-            "build-artifact-path",
-            "consumer",
-            "go-version",
-            "install-artifact-path",
-            "node-version",
-            "verify-artifact-path"
-          ],
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:v4-tail-reseal",
-          "name": "workflow:v4-tail-reseal",
+          "id": "workflow:self-release-line-open",
+          "name": "workflow:self-release-line-open",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/v4-tail-reseal.yml",
-          "evidencePath": ".github/workflows/v4-tail-reseal.yml",
+          "sourcePath": ".github/workflows/self-release-line-open.yml",
+          "evidencePath": ".github/workflows/self-release-line-open.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 4,
-          "inputs": [
-            "artifact-retention-days",
-            "consumer-policy-receipt-json",
-            "macos-finalization-command",
-            "request-json"
-          ],
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-release-new-version-compat",
+          "name": "workflow:self-release-new-version-compat",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-release-new-version-compat.yml",
+          "evidencePath": ".github/workflows/self-release-new-version-compat.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-release-next-development",
+          "name": "workflow:self-release-next-development",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-release-next-development.yml",
+          "evidencePath": ".github/workflows/self-release-next-development.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-release-npm-dry-run",
+          "name": "workflow:self-release-npm-dry-run",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-release-npm-dry-run.yml",
+          "evidencePath": ".github/workflows/self-release-npm-dry-run.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-release-promote",
+          "name": "workflow:self-release-promote",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-release-promote.yml",
+          "evidencePath": ".github/workflows/self-release-promote.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:self-release-rehearsal-dogfood",
+          "name": "workflow:self-release-rehearsal-dogfood",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/self-release-rehearsal-dogfood.yml",
+          "evidencePath": ".github/workflows/self-release-rehearsal-dogfood.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:verify",
-          "name": "workflow:verify",
+          "id": "workflow:self-release-tail-dogfood",
+          "name": "workflow:self-release-tail-dogfood",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/verify.yml",
-          "evidencePath": ".github/workflows/verify.yml",
+          "sourcePath": ".github/workflows/self-release-tail-dogfood.yml",
+          "evidencePath": ".github/workflows/self-release-tail-dogfood.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -5974,6 +7502,54 @@
           "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:stable-candidate-patrol",
+          "name": "workflow:stable-candidate-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/stable-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/stable-candidate-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 17,
+          "inputs": [
+            "auto-approve",
+            "auto-merge",
+            "auto-promote",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "hold",
+            "hold-reason",
+            "ledger-ref",
+            "merge-method",
+            "minimum-soak-seconds",
+            "release-now",
+            "required-checks",
+            "revoke-reason",
+            "revoked-versions",
+            "target-branch",
+            "universal-request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:universal-bootstrap-recovery",
+          "name": "workflow:universal-bootstrap-recovery",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/universal-bootstrap-recovery.yml",
+          "evidencePath": ".github/workflows/universal-bootstrap-recovery.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 1,
+          "inputs": [
+            "request-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "action:github-artifact-attestation",
           "name": "action:github-artifact-attestation",
@@ -6275,14 +7851,16 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 28,
+          "inputCount": 31,
           "inputs": [
             "artifact-paths",
             "candidate-build-summary-path",
             "candidate-passport-path",
             "failure-after-capability",
             "mutation-token",
+            "product-publication-intent-path",
             "publication-qualification-path",
+            "publish-artifact-kind",
             "publish-auth",
             "publish-command",
             "publish-dist-tag",
@@ -6295,6 +7873,7 @@
             "repository",
             "required-artifacts-path",
             "required-status-check",
+            "resume-transaction-id",
             "runtime-commit",
             "runtime-tree",
             "sealed-bundle-manifest",
@@ -6914,6 +8493,18 @@
           "public": true,
           "reverseAuditSource": "dist/site/page-registry.json"
         },
+        {
+          "id": "site-page:manual:oci-publication",
+          "name": "site-page:manual:oci-publication",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:manual:ownership",
           "name": "site-page:manual:ownership",
@@ -7274,6 +8865,18 @@
           "public": true,
           "reverseAuditSource": "dist/site/page-registry.json"
         },
+        {
+          "id": "site-page:manual:v4-rust-wasm-production-authority",
+          "name": "site-page:manual:v4-rust-wasm-production-authority",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:manual:v4-stage-capsule",
           "name": "site-page:manual:v4-stage-capsule",
@@ -7322,6 +8925,30 @@
           "public": true,
           "reverseAuditSource": "dist/site/page-registry.json"
         },
+        {
+          "id": "site-page:manual:workflow-catalog",
+          "name": "site-page:manual:workflow-catalog",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
+        {
+          "id": "site-page:manual:workflow-path-migration",
+          "name": "site-page:manual:workflow-path-migration",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:overview:home",
           "name": "site-page:overview:home",
@@ -7371,11 +8998,11 @@
         "public": true
       },
       {
-        "id": "control:.github/workflows/buildchain-ref-promotion.yml",
-        "name": "control:.github/workflows/buildchain-ref-promotion.yml",
+        "id": "control:.github/workflows/self-release-promote.yml",
+        "name": "control:.github/workflows/self-release-promote.yml",
         "kind": "workflow",
-        "sourcePath": ".github/workflows/buildchain-ref-promotion.yml",
-        "evidencePath": ".github/workflows/buildchain-ref-promotion.yml",
+        "sourcePath": ".github/workflows/self-release-promote.yml",
+        "evidencePath": ".github/workflows/self-release-promote.yml",
         "availability": "shipped",
         "visibility": "public",
         "participantFacing": true,
@@ -7474,7 +9101,7 @@
         "name": "Buildchain standalone binary distribution",
         "kind": "binary-distribution",
         "sourcePath": "scripts/build-standalone-binary.mjs",
-        "evidencePath": ".github/workflows/binary-distribution.yml",
+        "evidencePath": ".github/workflows/self-build-binary-distribution.yml",
         "availability": "shipped",
         "visibility": "public",
         "participantFacing": true,
@@ -7505,6 +9132,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 481
+    "publicSurfaceCount": 524
   }
 }