@kungfu-tech/buildchain 4.0.2-alpha.5 → 4.0.2-alpha.50

package/scripts/check-maintainability.mjs

@@ -19,6 +19,8 @@ import {
   evaluateTestBudgets,
   evaluateWorkflowBudgets,
 } from "./maintainability-governance.mjs";
+import { governUniversalFacadeWorkflowMetrics } from "./universal-facade-maintainability.mjs";
+import { evaluatePublicSurface } from "./maintainability-public-surface.mjs";
 
 function collectHotspots(
   root,
@@ -162,116 +164,6 @@ function selectedFunction(metrics, file, name) {
   return metrics.files[file]?.functions.find((entry) => entry.name === name);
 }
 
-function readJsonAtRevision(root, revision, file) {
-  return JSON.parse(gitOutput(root, ["show", `${revision}:${file}`]));
-}
-
-function publicSurfaceContract(entry, kind) {
-  if (kind === "cli") return { id: entry.id, usage: entry.usage };
-  if (kind === "node")
-    return {
-      export: entry.export,
-      specifier: entry.specifier,
-      target: entry.target,
-    };
-  return {
-    id: entry.id,
-    path: entry.path,
-    reusable: entry.reusable,
-    inputs: entry.inputs || [],
-    secrets: entry.secrets || [],
-    outputs: entry.outputs || [],
-  };
-}
-
-function evaluatePublicSurface({ root, revision, policy }) {
-  const issues = [];
-  const lifecycleFields = policy.publicSurfacePolicy.requiredLifecycleFields;
-  const capabilityGroups = new Set(
-    readJson(root, "dist/site/capability-registry.json").groups.map(
-      (entry) => entry.id,
-    ),
-  );
-  const definitions = [
-    {
-      file: "dist/site/cli-registry.json",
-      collection: "commands",
-      kind: "cli",
-      key: "id",
-    },
-    {
-      file: "dist/site/node-api-registry.json",
-      collection: "exports",
-      kind: "node",
-      key: "export",
-    },
-    {
-      file: "dist/site/workflow-registry.json",
-      collection: "workflows",
-      kind: "workflow",
-      key: "id",
-    },
-    {
-      file: "dist/site/workflow-registry.json",
-      collection: "actions",
-      kind: "action",
-      key: "id",
-    },
-  ];
-  for (const definition of definitions) {
-    const current =
-      readJson(root, definition.file)[definition.collection] || [];
-    const baseline =
-      readJsonAtRevision(root, revision, definition.file)[
-        definition.collection
-      ] || [];
-    const baselineByKey = new Map(
-      baseline.map((entry) => [entry[definition.key], entry]),
-    );
-    for (const entry of current) {
-      const label = `${definition.kind}:${entry[definition.key]}`;
-      for (const field of lifecycleFields) {
-        if (
-          !Object.prototype.hasOwnProperty.call(entry, field) ||
-          typeof entry[field] !== "string"
-        ) {
-          issues.push(`${label}: lifecycle field ${field} is missing`);
-        }
-      }
-      if (!capabilityGroups.has(entry.capabilityGroup)) {
-        issues.push(
-          `${label}: capability group ${entry.capabilityGroup || "<empty>"} is not registered`,
-        );
-      }
-      const previous = baselineByKey.get(entry[definition.key]);
-      const currentContract = publicSurfaceContract(entry, definition.kind);
-      if (
-        previous &&
-        JSON.stringify(currentContract) !==
-          JSON.stringify(publicSurfaceContract(previous, definition.kind))
-      ) {
-        const approval = policy.approvedPublicSurfaceTransitions?.[label];
-        const approved =
-          approval?.fromRevision === revision &&
-          String(approval?.rationale || "").trim() &&
-          JSON.stringify(approval?.contract) ===
-            JSON.stringify(currentContract);
-        if (!approved) {
-          issues.push(
-            `${label}: existing public contract drifted from ${revision}`,
-          );
-        }
-      }
-      if (!previous && !entry.nonDuplicationRationale) {
-        issues.push(
-          `${label}: new public surface requires a non-duplication rationale`,
-        );
-      }
-    }
-  }
-  return issues;
-}
-
 function evaluateAddedFunctionBudgets({
   file,
   metrics,
@@ -497,12 +389,18 @@ function checkMaintainability({ root = process.cwd() } = {}) {
     root,
     extendedCoverageRevision,
   );
+  const { governed: governedCurrent, migration: facadeMigration } =
+    governUniversalFacadeWorkflowMetrics({
+      root,
+      current,
+      workflowMetricsAtRevision,
+    });
   const issues = evaluateExceptionGovernance({ policy });
   issues.push(...evaluateExceptionBudget({ policy }));
   const hotspots = collectHotspots(root, current, 20, debt.hotspots || []);
   issues.push(
     ...evaluateDebtAuthority({
-      current,
+      current: governedCurrent,
       policy,
       debt,
       capabilityIds: new Set(
@@ -518,14 +416,19 @@ function checkMaintainability({ root = process.cwd() } = {}) {
   );
   issues.push(
     ...evaluateWorkflowBudgets({
-      current,
+      current: governedCurrent,
       baselineFiles: baselineWorkflows,
       policy,
     }),
   );
   issues.push(...evaluateRepositoryBudgets({ current, policy }));
   issues.push(
-    ...evaluatePublicSurface({ root, revision: enforcementRevision, policy }),
+    ...evaluatePublicSurface({
+      root,
+      revision: enforcementRevision,
+      policy,
+      migration: facadeMigration,
+    }),
   );
   if (issues.length > 0) {
     throw new Error(`maintainability check failed:\n- ${issues.join("\n- ")}`);

package/scripts/check-v4-floating-consumer-policy-contract.mjs

@@ -80,7 +80,7 @@ function assertPersistedSelectors() {
       const selector = match[2];
       const protectedBootstrap =
         relative ===
-          ".github/workflows/buildchain-ref-promotion-recovery.yml" &&
+          ".github/workflows/self-ops-promotion-recovery.yml" &&
         match[1] === ".github/workflows/.release-candidate-promote.yml" &&
         selector === "alpha/v4/v4.0";
       const isV4 =
@@ -148,7 +148,7 @@ export function checkV4FloatingConsumerPolicyContract() {
     "Resolve controller identities",
     "Install Buildchain runtime dependencies",
   ]);
-  const stageCanary = read(".github/workflows/v4-stage-capsule-canary.yml");
+  const stageCanary = read(".github/workflows/public-build-stage-capsule-canary.yml");
   if (
     !stageCanary.includes("consumer-admission:") ||
     !stageCanary.includes("needs: consumer-admission")

package/scripts/check-v4-public-dogfood-contract.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 import fs from "node:fs";
+import { readWorkflowTaxonomy, workflowPath } from "./workflow-taxonomy.mjs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -8,8 +9,8 @@ const DEFAULT_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
   "..",
 );
-const CALLER_PATH = ".github/workflows/v4-public-consumer-dogfood.yml";
-const REUSABLE_PATH = ".github/workflows/v4-stage-capsule-canary.yml";
+const CALLER_PATH = ".github/workflows/self-build-public-consumer-dogfood.yml";
+const REUSABLE_PATH = ".github/workflows/public-build-stage-capsule-canary.yml";
 export const V4_PUBLIC_DOGFOOD_ALPHA_REF = "v4-alpha";
 const PRIVATE_CONSUMER = ["buildchain", "self", "dogfood"].join("-");
 const PRIVATE_SHADOW = ["kungfu", "shadow"].join("-");
@@ -26,7 +27,7 @@ permissions:
 
 jobs:
   dogfood:
-    uses: kungfu-systems/buildchain/.github/workflows/v4-stage-capsule-canary.yml@${validationRef}
+    uses: kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml@${validationRef}
     with:
       consumer: buildchain
       node-version: "24"
@@ -93,10 +94,19 @@ function assertReusableWorkflow(root) {
 
 function assertWorkflowInventory(root) {
   const workflowRoot = path.join(root, ".github/workflows");
+  const taxonomy = readWorkflowTaxonomy(root);
   for (const entry of fs.readdirSync(workflowRoot, { withFileTypes: true })) {
     if (!entry.isFile() || !/\.ya?ml$/u.test(entry.name)) continue;
-    const relative = `.github/workflows/${entry.name}`;
+    let relative = `.github/workflows/${entry.name}`;
     const text = read(root, relative);
+    const canonical = taxonomy?.entries.find(
+      (item) => workflowPath(item) === relative && item.compatibility,
+    );
+    if (canonical) {
+      if (read(root, canonical.compatibility.path) !== text)
+        fail(`${relative} differs from its public compatibility identity`);
+      relative = canonical.compatibility.path;
+    }
     if (
       relative !== REUSABLE_PATH &&
       text.includes("scripts/v4-stage-capsule-qualification.mjs")
@@ -104,7 +114,7 @@ function assertWorkflowInventory(root) {
       fail(`${relative} invokes the private qualification script directly`);
     if (
       relative !== CALLER_PATH &&
-      text.includes(".github/workflows/v4-stage-capsule-canary.yml@")
+      text.includes(".github/workflows/public-build-stage-capsule-canary.yml@")
     )
       fail(`${relative} creates a second v4 dogfood caller`);
     if (relative !== REUSABLE_PATH && relative !== CALLER_PATH)
@@ -113,11 +123,13 @@ function assertWorkflowInventory(root) {
 }
 
 function assertProtectedVerify(root) {
-  const verify = read(root, ".github/workflows/verify.yml");
+  const verify = read(root, ".github/workflows/self-build-verify.yml");
   for (const required of [
     "needs: stage-capsule-checkpoints",
-    "name: Enforce public consumer-only v4 dogfood",
-    "run: node scripts/check-v4-public-dogfood-contract.mjs",
+    "name: Run declared verify lifecycle (full source tests and generated artifact checks)",
+    "node .buildchain/runtime/bin/buildchain.mjs lifecycle run verify",
+    "run: node scripts/source-verification-evidence.mjs plan",
+    "run: node scripts/source-verification-evidence.mjs seal",
   ])
     if (!verify.includes(required))
       fail(`Verify is missing protected gate ${required}`);
@@ -150,7 +162,7 @@ function assertArchitecture(root) {
     !dogfood ||
     dogfood.callerWorkflow !== CALLER_PATH ||
     dogfood.reusableWorkflow !==
-      "kungfu-systems/buildchain/.github/workflows/v4-stage-capsule-canary.yml" ||
+      "kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml" ||
     dogfood.runtimeBinding !== "job.workflow_sha" ||
     dogfood.consumerSourceBinding !== "github.sha" ||
     JSON.stringify(dogfood.executableStages) !==
@@ -193,6 +205,7 @@ function assertConsumerLifecycle(root) {
     '[lifecycle.install]\ncommand = "corepack enable pnpm && corepack pnpm@11.7.0 install --frozen-lockfile"',
     '[lifecycle.build]\ncommand = "corepack pnpm@11.7.0 run build && corepack pnpm@11.7.0 run generate:site"',
     "[lifecycle.verify]\ncommands = [",
+    '"corepack pnpm@11.7.0 run check",',
   ])
     if (!lifecycle.includes(declaration))
       fail(

package/scripts/check-v4-release-topology.mjs

@@ -1,9 +1,12 @@
 #!/usr/bin/env node
 
 import assert from "node:assert/strict";
+import crypto from "node:crypto";
 import fs from "node:fs";
+import ts from "typescript";
+import { workflowCompatibilityIdentity } from "./workflow-taxonomy.mjs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 import {
   parseWorkflowDocument,
@@ -17,6 +20,101 @@ function read(relative) {
   return fs.readFileSync(path.join(root, relative), "utf8");
 }
 
+const LOCAL_MODULE_EXTENSIONS = ["", ".js", ".mjs", ".cjs"];
+const PRIVILEGED_ENTRYPOINTS = [
+  "actions/v4-release-candidate-promote/index.js",
+  "scripts/binary-publication-evidence.mjs",
+  "scripts/next-development-review.mjs",
+  "scripts/oci-compose-preview.mjs",
+  "scripts/v4-publication-settlement.mjs",
+];
+
+export function localModuleSpecifiers(source) {
+  const specifiers = [];
+  const visit = (node) => {
+    let value;
+    if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node))
+      value = node.moduleSpecifier;
+    else if (
+      ts.isCallExpression(node) &&
+      node.expression.kind === ts.SyntaxKind.ImportKeyword
+    )
+      value = node.arguments[0];
+    if (value && ts.isStringLiteral(value) && value.text.startsWith("."))
+      specifiers.push(value.text);
+    ts.forEachChild(node, visit);
+  };
+  visit(
+    ts.createSourceFile(
+      "module.mjs",
+      source,
+      ts.ScriptTarget.Latest,
+      true,
+      ts.ScriptKind.JS,
+    ),
+  );
+  return [...new Set(specifiers)].sort();
+}
+
+function resolveLocalModule(importer, specifier) {
+  const unresolved = path.posix.normalize(
+    path.posix.join(path.posix.dirname(importer), specifier),
+  );
+  assert.ok(
+    !unresolved.startsWith("../") && !path.posix.isAbsolute(unresolved),
+    `local module import escapes the repository: ${importer} -> ${specifier}`,
+  );
+  const candidates = [
+    ...LOCAL_MODULE_EXTENSIONS.map((extension) => `${unresolved}${extension}`),
+    ...LOCAL_MODULE_EXTENSIONS.slice(1).map((extension) =>
+      path.posix.join(unresolved, `index${extension}`),
+    ),
+  ];
+  const matches = candidates.filter((relative) => {
+    const absolute = path.join(root, relative);
+    return fs.existsSync(absolute) && fs.statSync(absolute).isFile();
+  });
+  assert.equal(
+    matches.length,
+    1,
+    `local module import must resolve exactly once: ${importer} -> ${specifier}`,
+  );
+  return matches[0];
+}
+
+export function discoverStaticModuleClosure(entrypoints) {
+  const pending = [...entrypoints];
+  const visited = new Set();
+  while (pending.length > 0) {
+    const relative = pending.pop();
+    if (visited.has(relative)) continue;
+    assert.ok(
+      fs.statSync(path.join(root, relative)).isFile(),
+      `privileged entry is not a file: ${relative}`,
+    );
+    visited.add(relative);
+    for (const specifier of localModuleSpecifiers(read(relative))) {
+      const dependency = resolveLocalModule(relative, specifier);
+      if (!visited.has(dependency)) pending.push(dependency);
+    }
+  }
+  return [...visited].sort();
+}
+
+function rootedPathSet(paths) {
+  return `sha256:${crypto
+    .createHash("sha256")
+    .update(JSON.stringify([...paths].sort()))
+    .digest("hex")}`;
+}
+
+function fileSha256(relative) {
+  return `sha256:${crypto
+    .createHash("sha256")
+    .update(fs.readFileSync(path.join(root, relative)))
+    .digest("hex")}`;
+}
+
 function productionFiles(relative, extensions) {
   const absolute = path.join(root, relative);
   if (!fs.existsSync(absolute)) return [];
@@ -61,6 +159,23 @@ export function discoverV4ReleaseAuthorityClosure() {
     [".yml", ".yaml", ".js", ".mjs", ".cjs"],
     /(?:createV4ReleaseReceipt|release-receipt\.json|V4_RELEASE_RECEIPT_CONTRACT)/u,
   );
+  const privilegedModules = discoverStaticModuleClosure(PRIVILEGED_ENTRYPOINTS);
+  const rustWasmArtifact = "packages/core/buildchain-v4-domain.wasm";
+  const rustWasmDistributions = [
+    "actions/promote-buildchain-ref/dist/buildchain-v4-domain.wasm",
+    "actions/release-tail/dist/buildchain-v4-domain.wasm",
+    "actions/v4-release-candidate-promote/dist/buildchain-v4-domain.wasm",
+  ];
+  const legacyEngineModules = productionFiles(
+    "actions/promote-buildchain-ref",
+    [".js", ".mjs", ".cjs"],
+  )
+    .filter((relative) =>
+      /(?:^|\/)(?:lib|promote-(?:alpha|release|major)-channel|durable-transaction-operations)\.js$/u.test(
+        relative,
+      ),
+    )
+    .sort();
   return {
     providerAdapters: [
       ...new Set([
@@ -71,6 +186,23 @@ export function discoverV4ReleaseAuthorityClosure() {
     runtimeSelectors,
     runtimeEngines: ["actions/v4-release-candidate-promote/index.js"],
     terminalProjections,
+    privilegedExecutableClosure: {
+      entrypoints: PRIVILEGED_ENTRYPOINTS,
+      modules: privilegedModules,
+      root: rootedPathSet(privilegedModules),
+    },
+    rustWasmAuthority: {
+      loader: "packages/core/v4-domain-wasm.js",
+      metadata: "packages/core/v4-domain-wasm-artifact.js",
+      artifact: rustWasmArtifact,
+      artifactRoot: fileSha256(rustWasmArtifact),
+      distributedArtifacts: rustWasmDistributions,
+      byteIdenticalDistributions: rustWasmDistributions.every(
+        (relative) => fileSha256(relative) === fileSha256(rustWasmArtifact),
+      ),
+      fallbackWriterCount: 0,
+    },
+    legacyEngineModules,
   };
 }
 
@@ -97,33 +229,46 @@ function permission(block, name) {
 function workflowSnapshot(relative) {
   const source = read(relative);
   const document = parseWorkflowDocument(source);
-  const jobs = document.jobs.map((job) => {
-    const block = jobBlock(source, job.id);
-    const uses = job.uses || null;
-    return {
-      id: job.id,
-      kind: uses ? "reusable-call" : "runner",
-      uses,
-      permissions: {
-        contents: permission(block, "contents"),
-        idToken: permission(block, "id-token"),
-      },
-      carriers: {
-        artifactDownload: /uses:\s+actions\/download-artifact@/u.test(block),
-        artifactUpload: /uses:\s+actions\/upload-artifact@/u.test(block),
-        jobOutput: /GITHUB_OUTPUT/u.test(block),
-      },
-      mutationSignals: [
-        /contents:\s*write/u.test(block) && "contents-write",
-        /id-token:\s*write/u.test(block) && "oidc-write",
-        /(?:promote-buildchain-ref|v4-release-candidate-promote)/u.test(
-          block,
-        ) && "promotion-runtime",
-        /(?:git push|npm publish|gh release (?:create|upload))/u.test(block) &&
-          "direct-publication-command",
-      ].filter(Boolean),
-    };
-  });
+  const jobs = document.jobs
+    .filter((job) => job.id !== "universal-bootstrap")
+    .map((job) => {
+      const block = jobBlock(source, job.id);
+      const uses = job.uses || null;
+      // A built-in publisher still requires mutation authority when the caller supplies its envelope.
+      const inheritedPublisher =
+        !/^    permissions:/mu.test(block) &&
+        /uses:.*actions\/v4-release-candidate-promote/u.test(block);
+      return {
+        id: job.id,
+        kind: uses ? "reusable-call" : "runner",
+        uses,
+        permissions: {
+          contents:
+            permission(block, "contents") ||
+            (inheritedPublisher ? "inherited" : null),
+          idToken:
+            permission(block, "id-token") ||
+            (inheritedPublisher ? "inherited" : null),
+        },
+        carriers: {
+          artifactDownload: /uses:\s+actions\/download-artifact@/u.test(block),
+          artifactUpload: /uses:\s+actions\/upload-artifact@/u.test(block),
+          jobOutput: /GITHUB_OUTPUT/u.test(block),
+        },
+        mutationSignals: [
+          (/contents:\s*write/u.test(block) || inheritedPublisher) &&
+            "contents-write",
+          (/id-token:\s*write/u.test(block) || inheritedPublisher) &&
+            "oidc-write",
+          /(?:promote-buildchain-ref|v4-release-candidate-promote)/u.test(
+            block,
+          ) && "promotion-runtime",
+          /(?:git push|npm publish|gh release (?:create|upload))/u.test(
+            block,
+          ) && "direct-publication-command",
+        ].filter(Boolean),
+      };
+    });
   return {
     path: relative,
     triggers: document.triggers,
@@ -131,6 +276,7 @@ function workflowSnapshot(relative) {
     reusableEdges: parseYamlUses(source)
       .map(({ value }) => value)
       .filter((value) => /\.github\/workflows\//u.test(value))
+      .filter((value) => !/\/bootstrap\.yml(?:@v4)?$/u.test(value))
       .sort(),
   };
 }
@@ -230,7 +376,12 @@ export function findUnknownV4ReleaseTopology(
 ) {
   const declared = new Set(workflowPaths);
   return allWorkflowPaths
-    .filter((relative) => !declared.has(relative))
+    .filter(
+      (relative) =>
+        !declared.has(
+          workflowCompatibilityIdentity(root, relative, readWorkflow(relative)),
+        ),
+    )
     .filter((relative) => {
       const source = readWorkflow(relative);
       const usesReleaseAuthority = parseYamlUses(source).some(({ value }) =>
@@ -274,6 +425,7 @@ function assertAuthorityClosure(ledger) {
     "runtimeSelectors",
     "runtimeEngines",
     "terminalProjections",
+    "legacyEngineModules",
   ]) {
     assert.ok(
       Array.isArray(closure[className]) && closure[className].length > 0,
@@ -292,6 +444,24 @@ function assertAuthorityClosure(ledger) {
       discovered[className],
       `authority closure class drifted: ${className}`,
     );
+  assert.deepEqual(
+    closure.privilegedExecutableClosure,
+    discovered.privilegedExecutableClosure,
+    "privileged executable transitive closure drifted",
+  );
+  assert.match(
+    closure.privilegedExecutableClosure.root,
+    /^sha256:[0-9a-f]{64}$/u,
+  );
+  const reachableLegacyEngines = closure.legacyEngineModules.filter(
+    (relative) =>
+      closure.privilegedExecutableClosure.modules.includes(relative),
+  );
+  assert.deepEqual(
+    reachableLegacyEngines,
+    [],
+    `legacy release engines remain reachable from APPLY: ${reachableLegacyEngines.join(", ")}`,
+  );
   assert.deepEqual(closure.runtimeEngines, [
     "actions/v4-release-candidate-promote/index.js",
   ]);
@@ -301,11 +471,11 @@ function assertAuthorityClosure(ledger) {
   );
   assert.equal(
     closure.recoveryEntry,
-    ".github/workflows/buildchain-ref-promotion-recovery.yml",
+    ".github/workflows/self-ops-promotion-recovery.yml",
   );
   const engineSurface = [
     ".github/workflows/.release-candidate-promote.yml",
-    ...closure.runtimeEngines,
+    ...closure.privilegedExecutableClosure.modules,
   ]
     .map(read)
     .join("\n");
@@ -333,6 +503,17 @@ export function checkV4ReleaseTopology() {
   assert.equal(ledger.contract, "kungfu-buildchain-v4-release-topology/v1");
   assertClosedWorld(ledger.closedWorld.workflowPaths);
   assertAuthorityClosure(ledger);
+  const preview = ledger.postPublicationScope;
+  assert.deepEqual(preview.workflowPaths, [
+    ".github/workflows/public-release-oci-compose-preview.yml",
+  ]);
+  const previewTopology = discoverV4ReleaseTopology(
+    preview.workflowPaths,
+    preview.workflowPaths,
+  );
+  assert.equal(previewTopology.semanticMetrics.contentsWriteJobCount, 1);
+  assert.equal(previewTopology.semanticMetrics.oidcWriteJobCount, 0);
+  assert.deepEqual(preview.observedTopology, previewTopology);
   const actual = discoverV4ReleaseTopology(
     ledger.closedWorld.workflowPaths,
     ledger.semanticScope.workflowPaths,
@@ -361,23 +542,28 @@ export function checkV4ReleaseTopology() {
   return actual;
 }
 
-if (process.argv.includes("--print-closure")) {
-  process.stdout.write(
-    `${JSON.stringify(discoverV4ReleaseAuthorityClosure(), null, 2)}\n`,
-  );
-} else if (process.argv.includes("--print")) {
-  const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
-  process.stdout.write(
-    `${JSON.stringify(
-      discoverV4ReleaseTopology(
-        ledger.closedWorld.workflowPaths,
-        ledger.semanticScope.workflowPaths,
-      ),
-      null,
-      2,
-    )}\n`,
-  );
-} else {
-  checkV4ReleaseTopology();
-  process.stdout.write("v4 release topology: ok\n");
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  if (process.argv.includes("--print-closure")) {
+    process.stdout.write(
+      `${JSON.stringify(discoverV4ReleaseAuthorityClosure(), null, 2)}\n`,
+    );
+  } else if (process.argv.includes("--print")) {
+    const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
+    process.stdout.write(
+      `${JSON.stringify(
+        discoverV4ReleaseTopology(
+          ledger.closedWorld.workflowPaths,
+          ledger.semanticScope.workflowPaths,
+        ),
+        null,
+        2,
+      )}\n`,
+    );
+  } else {
+    checkV4ReleaseTopology();
+    process.stdout.write("v4 release topology: ok\n");
+  }
 }

package/scripts/check-v4-runtime-semantic-closure.mjs

@@ -35,7 +35,10 @@ function publicSurfaceIds(root) {
   return new Set([
     ...Object.keys(packageJson.exports || {}).map((id) => `export:${id}`),
     ...(cli.commands || []).map((entry) => `cli:${entry.id}`),
-    ...(workflows.workflows || []).map((entry) => `workflow:${entry.id}`),
+    ...(workflows.workflows || []).flatMap((entry) => [
+      `workflow:${entry.id}`,
+      ...(entry.taxonomy ? [`workflow:${entry.taxonomy.id}`] : []),
+    ]),
     ...(workflows.actions || []).map((entry) => `action:${entry.id}`),
   ]);
 }