@kungfu-tech/buildchain 4.0.2-alpha.5 → 4.0.2-alpha.50

package/architecture/v4-release-topology.json

@@ -14,54 +14,54 @@
       ".github/workflows/.declarative-auditable-demo.yml",
       ".github/workflows/.publication-authority.yml",
       ".github/workflows/.release-candidate-promote.yml",
-      ".github/workflows/.release-elastic-beanstalk.yml",
-      ".github/workflows/.release-new-version.yml",
-      ".github/workflows/.sam-release.yml",
       ".github/workflows/.web-surface.yml",
-      ".github/workflows/.wheel-release.yml",
-      ".github/workflows/auditable-demo.yml",
-      ".github/workflows/binary-release-assets.yml",
-      ".github/workflows/build-surface-fixture.yml",
+      ".github/workflows/self-build-demo-dogfood.yml",
+      ".github/workflows/self-release-binary-assets.yml",
+      ".github/workflows/self-build-fixture.yml",
       ".github/workflows/build.yml",
-      ".github/workflows/buildchain-alpha-self-dogfood.yml",
-      ".github/workflows/buildchain-dev-delivery.yml",
-      ".github/workflows/buildchain-ref-promotion-recovery.yml",
-      ".github/workflows/buildchain-ref-promotion.yml",
-      ".github/workflows/buildchain-patrol-daily.yml",
-      ".github/workflows/buildchain-patrol-monthly.yml",
-      ".github/workflows/buildchain-patrol-weekly.yml",
-      ".github/workflows/buildchain-stable-candidate-patrol.yml",
+      ".github/workflows/self-build-alpha-dogfood.yml",
+      ".github/workflows/self-ops-dev-delivery.yml",
+      ".github/workflows/self-ops-promotion-recovery.yml",
+      ".github/workflows/self-release-promote.yml",
+      ".github/workflows/self-ops-patrol-daily.yml",
+      ".github/workflows/self-ops-patrol-monthly.yml",
+      ".github/workflows/self-ops-patrol-weekly.yml",
+      ".github/workflows/self-ops-stable-candidate-patrol.yml",
       ".github/workflows/dev-alpha-candidate-patrol.yml",
       ".github/workflows/dev-pr-auto-merge.yml",
       ".github/workflows/github-artifact-attestation.yml",
-      ".github/workflows/npm-publish.yml",
+      ".github/workflows/self-release-npm-dry-run.yml",
       ".github/workflows/paper-release-sealed.yml",
       ".github/workflows/paper-release.yml",
       ".github/workflows/patrol-observed-evidence.yml",
       ".github/workflows/release-candidate-promote.yml",
-      ".github/workflows/release-line-bootstrap.yml",
-      ".github/workflows/release-new-version.yml",
+      ".github/workflows/self-release-line-open.yml",
+      ".github/workflows/self-release-new-version-compat.yml",
       ".github/workflows/release-propagation.yml",
       ".github/workflows/release-tail.yml",
       ".github/workflows/stable-candidate-patrol.yml",
-      ".github/workflows/v4-publication-rehearsal-dogfood.yml",
-      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+      ".github/workflows/self-release-rehearsal-dogfood.yml",
+      ".github/workflows/self-release-tail-dogfood.yml",
+      ".github/workflows/self-release-next-development.yml",
+      ".github/workflows/public-release-oci-compose-preview.yml"
     ],
     "unknownTopologyPolicy": "fail-closed"
   },
   "semanticScope": {
     "workflowPaths": [
       ".github/workflows/.release-candidate-promote.yml",
-      ".github/workflows/buildchain-ref-promotion-recovery.yml",
-      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/self-ops-promotion-recovery.yml",
+      ".github/workflows/self-release-promote.yml",
       ".github/workflows/release-candidate-promote.yml",
-      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+      ".github/workflows/self-release-tail-dogfood.yml"
     ],
     "excludedMechanisms": [
       "Paper product release",
       "npm dry-run",
       "v3 rollback workflows",
-      "retired compatibility workflows"
+      "retired compatibility workflows",
+      "Post-publication protected development review: no package, tag or Release mutation; independently inventoried in closedWorld and privilegedExecutableClosure.",
+      "Post-publication OCI Compose preview activation is measured separately in postPublicationScope; it consumes completed publication and qualification, copies one manifest to the sealed alias, and cannot materialize versions or release refs."
     ]
   },
   "authorityClosure": {
@@ -70,9 +70,13 @@
       "actions/promote-buildchain-ref/v4-provider-plane.js",
       "actions/release-tail/index.js",
       "actions/v4-release-candidate-promote/index.js",
+      "actions/v4-release-candidate-promote/oci-provider.js",
+      "actions/v4-release-candidate-promote/product-provider-adapters.js",
+      "actions/v4-release-candidate-promote/product-provider-github-adapters.js",
       "actions/v4-release-candidate-promote/product-provider.js",
       "packages/core/buildchain-agent-manuals.js",
       "packages/core/index.js",
+      "packages/core/oci-compose-qualification.js",
       "packages/core/publication-rehearsal-runtime.js",
       "packages/core/release-tail-provider-adapters.js",
       "packages/core/release-tail-provider-plane.js",
@@ -80,15 +84,21 @@
       "packages/core/v4-publication-rehearsal.js"
     ],
     "runtimeSelectors": [
+      ".github/workflows/.build-engine.yml",
       ".github/workflows/.build.yml",
       ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/.release-promote.yml",
       ".github/workflows/.web-surface.yml",
-      ".github/workflows/buildchain-ref-promotion-recovery.yml",
-      ".github/workflows/buildchain-ref-promotion.yml",
       ".github/workflows/paper-release.yml",
+      ".github/workflows/public-build-publication.yml",
+      ".github/workflows/public-ops-tail-reseal.yml",
+      ".github/workflows/public-release-paper.yml",
+      ".github/workflows/public-release-promote.yml",
+      ".github/workflows/public-release-web.yml",
       ".github/workflows/publication-artifact.yml",
       ".github/workflows/release-candidate-promote.yml",
-      ".github/workflows/v4-tail-reseal.yml",
+      ".github/workflows/self-ops-promotion-recovery.yml",
+      ".github/workflows/self-release-promote.yml",
       "packages/core/buildchain-contract.js",
       "packages/core/v4-runtime-ref-resume-authority.js",
       "packages/core/v4-runtime-selector-persistence.js",
@@ -107,11 +117,119 @@
     "runtimeEngines": ["actions/v4-release-candidate-promote/index.js"],
     "terminalProjections": [
       ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/.release-promote.yml",
       "actions/v4-release-candidate-promote/index.js",
-      "packages/core/v4-release-invocation.js"
+      "packages/core/v4-release-invocation.js",
+      "scripts/v4-publication-settlement.mjs",
+      "scripts/v4-universal-workflow-engine.mjs"
+    ],
+    "privilegedExecutableClosure": {
+      "entrypoints": [
+        "actions/v4-release-candidate-promote/index.js",
+        "scripts/binary-publication-evidence.mjs",
+        "scripts/next-development-review.mjs",
+        "scripts/oci-compose-preview.mjs",
+        "scripts/v4-publication-settlement.mjs"
+      ],
+      "modules": [
+        "actions/promote-buildchain-ref/github-release.js",
+        "actions/promote-buildchain-ref/internal/version-state.js",
+        "actions/promote-buildchain-ref/reuse-complete-release.js",
+        "actions/promote-buildchain-ref/v4-provider-plane.js",
+        "actions/v4-release-candidate-promote/index.js",
+        "actions/v4-release-candidate-promote/next-development-queue.js",
+        "actions/v4-release-candidate-promote/oci-provider.js",
+        "actions/v4-release-candidate-promote/oci-registry-client.js",
+        "actions/v4-release-candidate-promote/product-provider-adapters.js",
+        "actions/v4-release-candidate-promote/product-provider-github-adapters.js",
+        "actions/v4-release-candidate-promote/product-provider.js",
+        "actions/v4-release-candidate-promote/publication-completion.js",
+        "packages/core/adopter-delivery-gate.js",
+        "packages/core/adopter-delivery-json.js",
+        "packages/core/adopter-delivery-passport.js",
+        "packages/core/artifact-verification-envelope.js",
+        "packages/core/buildchain-channel-identity.js",
+        "packages/core/buildchain-compatibility-authority.js",
+        "packages/core/buildchain-compatibility-fact.js",
+        "packages/core/buildchain-compatibility-facts.json",
+        "packages/core/buildchain-compatibility-proof.js",
+        "packages/core/buildchain-config.js",
+        "packages/core/buildchain-contract.js",
+        "packages/core/buildchain-layout.js",
+        "packages/core/controller-evidence.js",
+        "packages/core/dev-delivery-common.js",
+        "packages/core/dev-delivery-contract-surface.js",
+        "packages/core/github-artifact-attestation.js",
+        "packages/core/kfd-adopter-manifest.js",
+        "packages/core/kfd-gate.js",
+        "packages/core/kfd-product-gates.js",
+        "packages/core/kungfu-temporal-fact.js",
+        "packages/core/next-development-transition.js",
+        "packages/core/oci-compose-qualification.js",
+        "packages/core/oci-publication-bundle.js",
+        "packages/core/oci-publication-graph.js",
+        "packages/core/package-manager.js",
+        "packages/core/public-surface-audit.js",
+        "packages/core/public-surface-cli.js",
+        "packages/core/publication-artifact-candidate.js",
+        "packages/core/publication-authority.js",
+        "packages/core/publication-sealed-bundle.js",
+        "packages/core/publish-transaction.js",
+        "packages/core/release-candidate-recovery.js",
+        "packages/core/release-candidate.js",
+        "packages/core/release-passport-contract.js",
+        "packages/core/release-passport.js",
+        "packages/core/release-tail-product-capabilities.js",
+        "packages/core/release-tail-provider-adapters.js",
+        "packages/core/release-tail-provider-plane.js",
+        "packages/core/spawn-command.js",
+        "packages/core/surface-manifest.js",
+        "packages/core/v4-canonical-contracts.js",
+        "packages/core/v4-domain-wasm-artifact.js",
+        "packages/core/v4-domain-wasm.js",
+        "packages/core/v4-floating-consumer-evidence.js",
+        "packages/core/v4-floating-consumer-policy.js",
+        "packages/core/v4-floating-consumer-release-passport.js",
+        "packages/core/v4-product-publication.js",
+        "packages/core/v4-protected-publication-source.js",
+        "packages/core/v4-publication-qualification.js",
+        "packages/core/v4-release-invocation.js",
+        "packages/core/v4-runtime-ref-resume-authority.js",
+        "packages/core/v4-runtime-selector-persistence.js",
+        "packages/core/web-surface-publication-candidate.js",
+        "packages/core/workflow-yaml-contract.js",
+        "scripts/binary-publication-evidence.mjs",
+        "scripts/ensure-github-release.mjs",
+        "scripts/next-development-review.mjs",
+        "scripts/oci-compose-preview.mjs",
+        "scripts/release-asset-client.mjs",
+        "scripts/v4-publication-settlement.mjs",
+        "scripts/verify-version-state-delta.mjs"
+      ],
+      "root": "sha256:d2273ef843f1b186102ae6e6a1c2046483eafa25760c5e58f8d6f4e10827f161"
+    },
+    "rustWasmAuthority": {
+      "loader": "packages/core/v4-domain-wasm.js",
+      "metadata": "packages/core/v4-domain-wasm-artifact.js",
+      "artifact": "packages/core/buildchain-v4-domain.wasm",
+      "artifactRoot": "sha256:76600d4a9cfba5ac318c9b3be69e2a4e304faee714d2e72b1fba288f945c09f0",
+      "distributedArtifacts": [
+        "actions/promote-buildchain-ref/dist/buildchain-v4-domain.wasm",
+        "actions/release-tail/dist/buildchain-v4-domain.wasm",
+        "actions/v4-release-candidate-promote/dist/buildchain-v4-domain.wasm"
+      ],
+      "byteIdenticalDistributions": true,
+      "fallbackWriterCount": 0
+    },
+    "legacyEngineModules": [
+      "actions/promote-buildchain-ref/internal/durable-transaction-operations.js",
+      "actions/promote-buildchain-ref/internal/promote-alpha-channel.js",
+      "actions/promote-buildchain-ref/internal/promote-major-channel.js",
+      "actions/promote-buildchain-ref/internal/promote-release-channel.js",
+      "actions/promote-buildchain-ref/lib.js"
     ],
     "freshEntry": ".github/workflows/release-candidate-promote.yml",
-    "recoveryEntry": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+    "recoveryEntry": ".github/workflows/self-ops-promotion-recovery.yml",
     "forbiddenLegacyEnginePatterns": [
       "legacy-promote",
       "v4-declarative-promote",
@@ -173,14 +291,14 @@
         "path": ".github/workflows/.release-candidate-promote.yml",
         "triggers": ["workflow_call"],
         "jobs": [
-          "apply|runner|-|write|write|artifactDownload,artifactUpload|contents-write,oidc-write,promotion-runtime",
+          "apply|runner|-|inherited|inherited|artifactDownload,artifactUpload|contents-write,oidc-write,promotion-runtime",
           "qualify|runner|-|read|-|artifactUpload,jobOutput|-",
           "settle|runner|-|read|-|artifactDownload,artifactUpload,jobOutput|-"
         ],
         "reusableEdges": []
       },
       {
-        "path": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+        "path": ".github/workflows/self-ops-promotion-recovery.yml",
         "triggers": ["workflow_dispatch"],
         "jobs": [
           "resume|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write"
@@ -190,9 +308,10 @@
         ]
       },
       {
-        "path": ".github/workflows/buildchain-ref-promotion.yml",
+        "path": ".github/workflows/self-release-promote.yml",
         "triggers": ["workflow_dispatch", "workflow_run:completed"],
         "jobs": [
+          "classify-workflow-run|runner|-|read|-|-|-",
           "promote|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
           "reject-invalid-candidate-recovery|runner|-|read|-|-|-",
           "reject-invalid-durable-recovery|runner|-|read|-|-|-",
@@ -207,7 +326,7 @@
         "triggers": ["workflow_call"],
         "jobs": [
           "consumer-admission|runner|-|read|-|artifactUpload|-",
-          "invoke|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
+          "invoke|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|-|-|-|-",
           "resolve-promotion|runner|-|read|-|jobOutput|-"
         ],
         "reusableEdges": [
@@ -215,7 +334,7 @@
         ]
       },
       {
-        "path": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
+        "path": ".github/workflows/self-release-tail-dogfood.yml",
         "triggers": ["workflow_dispatch"],
         "jobs": [
           "publish|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|-|-|-|-"
@@ -226,12 +345,12 @@
       }
     ],
     "metrics": {
-      "workflowCount": 37,
-      "jobCount": 92,
+      "workflowCount": 35,
+      "jobCount": 91,
       "reusableEdgeCount": 23,
-      "mutationRelevantNodeCount": 74,
+      "mutationRelevantNodeCount": 76,
       "contentsWriteJobCount": 14,
-      "oidcWriteJobCount": 16
+      "oidcWriteJobCount": 15
     },
     "semanticMetrics": {
       "workflowCount": 5,
@@ -239,5 +358,46 @@
       "contentsWriteJobCount": 1,
       "oidcWriteJobCount": 1
     }
+  },
+  "postPublicationScope": {
+    "workflowPaths": [
+      ".github/workflows/public-release-oci-compose-preview.yml"
+    ],
+    "authority": "exact-publication-plus-source-bound-qualification-and-expected-old-digest",
+    "observedTopology": {
+      "jobRecordFields": [
+        "id",
+        "kind",
+        "uses",
+        "contentsPermission",
+        "oidcPermission",
+        "carriers",
+        "mutationSignals"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/public-release-oci-compose-preview.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "promote|runner|-|write|-|artifactDownload,artifactUpload,jobOutput|contents-write"
+          ],
+          "reusableEdges": []
+        }
+      ],
+      "metrics": {
+        "workflowCount": 1,
+        "jobCount": 1,
+        "reusableEdgeCount": 0,
+        "mutationRelevantNodeCount": 1,
+        "contentsWriteJobCount": 1,
+        "oidcWriteJobCount": 0
+      },
+      "semanticMetrics": {
+        "workflowCount": 1,
+        "mutationRelevantNodeCount": 1,
+        "contentsWriteJobCount": 1,
+        "oidcWriteJobCount": 0
+      }
+    }
   }
 }

package/architecture/v4-rust-wasm-production-authority.json

@@ -0,0 +1,58 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-rust-wasm-production-authority/v1",
+  "mode": "production",
+  "sourceAuthority": {
+    "crate": "crates/buildchain-v4-contracts",
+    "toolchain": "crates/buildchain-v4-contracts/rust-toolchain.toml",
+    "build": "scripts/build-v4-domain-wasm.mjs",
+    "reproducibilityCheck": "pnpm run check:v4-wasm"
+  },
+  "runtimeAuthority": {
+    "loader": "packages/core/v4-domain-wasm.js",
+    "metadata": "packages/core/v4-domain-wasm-artifact.js",
+    "artifact": "packages/core/buildchain-v4-domain.wasm",
+    "abiVersion": 1,
+    "fallbackWriterCount": 0,
+    "failurePolicy": "fail-closed"
+  },
+  "rustOwnedSemantics": [
+    "source-verification-evidence-identity-and-reuse",
+    "canonical-json-and-content-roots",
+    "release-invocation-plan-transaction-and-receipt",
+    "product-publication-plan-and-version-intent",
+    "provider-operation-journal-and-readback-fold",
+    "release-activation-plan-and-fold",
+    "stable-publication-fence",
+    "partial-mutation-recovery-plan",
+    "release-tail-plan-transaction-retry-readback-and-receipt"
+  ],
+  "nodeOwnedEffects": [
+    "provider-sdk-calls",
+    "filesystem-io",
+    "credential-and-environment-access",
+    "workflow-input-and-output-transport",
+    "provider-error-classification"
+  ],
+  "distribution": {
+    "npmPackage": "packages/core/buildchain-v4-domain.wasm",
+    "actionArtifacts": [
+      "actions/promote-buildchain-ref/dist/buildchain-v4-domain.wasm",
+      "actions/release-tail/dist/buildchain-v4-domain.wasm",
+      "actions/v4-release-candidate-promote/dist/buildchain-v4-domain.wasm"
+    ],
+    "artifactBinding": "sha256-metadata-before-instantiation",
+    "runtimeCompilation": false
+  },
+  "qualification": {
+    "platforms": ["linux-x64", "macos-arm64", "windows-x64"],
+    "productionRuntime": "node-24",
+    "checks": [
+      "tracked-artifact-reproducibility",
+      "abi-and-digest-binding",
+      "clean-process-loading-without-rust",
+      "missing-or-tampered-artifact-fails-closed",
+      "action-artifact-byte-identity"
+    ]
+  }
+}

package/architecture/v4-stable-publication-fence.json

@@ -10,7 +10,7 @@
     "productionWriterCount": 1,
     "fenceAuthority": "rust-v4-core",
     "fenceWriterCount": 1,
-    "typescript": "byte-equivalent-provider-adapter",
+    "typescript": "wasm-calling-provider-adapter",
     "candidateSelfQualification": false,
     "productionWriteChange": true
   },
@@ -29,7 +29,10 @@
   "publicationTargets": ["stable-ref", "npm-tag", "oci-tag", "github-release"],
   "implementations": {
     "rustDomain": "crates/buildchain-v4-contracts/src/stable_publication_fence.rs",
-    "typescript": "packages/core/v4-stable-publication-fence.js"
+    "typescript": "packages/core/v4-stable-publication-fence.js",
+    "wasmRuntime": "packages/core/v4-domain-wasm.js",
+    "wasmArtifact": "packages/core/buildchain-v4-domain.wasm",
+    "artifactMetadata": "packages/core/v4-domain-wasm-artifact.js"
   },
   "roots": [
     "stable-publication-candidate",

package/architecture/v4-stage-capsule-qualification.json

@@ -24,8 +24,8 @@
     ]
   },
   "publicConsumerDogfood": {
-    "callerWorkflow": ".github/workflows/v4-public-consumer-dogfood.yml",
-    "reusableWorkflow": "kungfu-systems/buildchain/.github/workflows/v4-stage-capsule-canary.yml",
+    "callerWorkflow": ".github/workflows/self-build-public-consumer-dogfood.yml",
+    "reusableWorkflow": "kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml",
     "validationRef": "v4-alpha",
     "invocation": "workflow_call",
     "runtimeBinding": "job.workflow_sha",

package/architecture/v4-tail-reseal-parity.json

@@ -10,7 +10,7 @@
   },
   "target": {
     "branch": "dev/v4/v4.0",
-    "publicReusableWorkflow": "kungfu-systems/buildchain/.github/workflows/v4-tail-reseal.yml@v4-alpha",
+    "publicReusableWorkflow": "kungfu-systems/buildchain/.github/workflows/public-ops-tail-reseal.yml@v4-alpha",
     "requestSchema": "contracts/v4-tail-reseal-v1.schema.json",
     "planner": "packages/core/v4-tail-reseal.js",
     "admission": "packages/core/v4-tail-reseal-github.js",
@@ -57,7 +57,7 @@
       "disposition": "implemented",
       "implementationEvidence": [
         "scripts/v4-tail-reseal.mjs",
-        ".github/workflows/v4-tail-reseal.yml"
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
       "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
     },
@@ -84,7 +84,7 @@
       "disposition": "implemented",
       "implementationEvidence": [
         "packages/core/v4-tail-reseal.js",
-        ".github/workflows/v4-tail-reseal.yml"
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
       "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
     },
@@ -111,7 +111,7 @@
       "disposition": "implemented",
       "implementationEvidence": [
         "packages/core/v4-tail-reseal-receipt.js",
-        ".github/workflows/v4-tail-reseal.yml"
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
       "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
     },
@@ -119,7 +119,9 @@
       "id": "TR-10",
       "claim": "The reusable workflow resolves job.workflow_sha as runtime evidence and exposes no persisted SHA, variable indirection or private self-dogfood path.",
       "disposition": "implemented",
-      "implementationEvidence": [".github/workflows/v4-tail-reseal.yml"],
+      "implementationEvidence": [
+        ".github/workflows/public-ops-tail-reseal.yml"
+      ],
       "verificationEvidence": ["tests/v4-tail-reseal-parity.test.mjs"]
     },
     {
@@ -146,5 +148,5 @@
       "verificationEvidence": []
     }
   ],
-  "matrixRoot": "sha256:126ec51c12a9dedeb9b9e187202781e3895856af1927b399ba3902f3940750ad"
+  "matrixRoot": "sha256:dc8d99f2e90473abde7a04c02300e7bfd0b48a2ff187e99fae0bc090ff2a855d"
 }