@kungfu-tech/buildchain 4.0.2-alpha.5 → 4.0.2-alpha.50

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (171) hide show
  1. package/AGENTS.md +10 -1
  2. package/CONTRIBUTING.md +24 -0
  3. package/README.md +2 -2
  4. package/actions/promote-buildchain-ref/README.md +1 -1
  5. package/actions/v4-release-candidate-promote/README.md +28 -0
  6. package/architecture/agent-change-map.md +70 -9
  7. package/architecture/ci-lane-change-budget.json +384 -0
  8. package/architecture/internal-capabilities.json +56 -9
  9. package/architecture/maintainability-debt.json +162 -107
  10. package/architecture/maintainability-policy.json +34 -30
  11. package/architecture/release-tail-contract-inventory.json +6 -6
  12. package/architecture/v4-architecture-constitution.md +23 -20
  13. package/architecture/v4-cross-platform-adopter-qualification.json +1 -1
  14. package/architecture/v4-delivery-authority-parity.json +2 -2
  15. package/architecture/v4-delivery-warrant-shadow-bootstrap-plan.json +1 -1
  16. package/architecture/v4-floating-consumer-policy.json +2 -2
  17. package/architecture/v4-next-development-parity.json +5 -5
  18. package/architecture/v4-partial-mutation-recovery-qualification.json +4 -1
  19. package/architecture/v4-platform-stage-checkpoints.json +1 -1
  20. package/architecture/v4-provider-operation-journal-contract.json +5 -2
  21. package/architecture/v4-publication-facade-patches.json +64 -0
  22. package/architecture/v4-release-activation-shadow-domain.json +5 -2
  23. package/architecture/v4-release-topology.json +198 -38
  24. package/architecture/v4-rust-wasm-production-authority.json +58 -0
  25. package/architecture/v4-stable-publication-fence.json +5 -2
  26. package/architecture/v4-stage-capsule-qualification.json +2 -2
  27. package/architecture/v4-tail-reseal-parity.json +8 -6
  28. package/architecture/v4-universal-workflow-bootstrap.json +176 -0
  29. package/architecture/v4-universal-workflow-fault-campaign.json +72 -0
  30. package/architecture/v4-universal-workflow-train-admission.json +40 -0
  31. package/architecture/workflow-taxonomy.json +1462 -0
  32. package/bin/buildchain.mjs +7 -7
  33. package/contracts/buildchain-v2-residuals-v1.json +57 -48
  34. package/contracts/dev-delivery-authority-v2.schema.json +16 -2
  35. package/contracts/fixtures/v4-tail-reseal-v1/valid.json +1 -1
  36. package/contracts/v4-canonical-contracts-v1.schema.json +1 -0
  37. package/dist/site/buildchain-contract.json +93 -48
  38. package/dist/site/buildchain-site.json +276 -72
  39. package/dist/site/capability-registry.json +5 -5
  40. package/dist/site/controller-registry.json +50 -13
  41. package/dist/site/kfd-claims.json +2610 -983
  42. package/dist/site/kfd-upstream-aggregate.json +1 -1
  43. package/dist/site/manual-registry.json +14 -14
  44. package/dist/site/node-api-registry.json +273 -127
  45. package/dist/site/page-registry.json +257 -53
  46. package/dist/site/public-surface-audit.json +3239 -1232
  47. package/dist/site/publication-authority-registry.json +1135 -363
  48. package/dist/site/publication-registry.json +4 -4
  49. package/dist/site/release-provenance.json +2 -1
  50. package/dist/site/schemas/dev-delivery-authority-v2.schema.json +16 -2
  51. package/dist/site/site-manifest.json +18 -18
  52. package/dist/site/workflow-registry.json +5097 -1659
  53. package/docs/MAP.md +2 -0
  54. package/docs/auditable-demo.md +1 -1
  55. package/docs/cli.md +21 -8
  56. package/docs/dev-delivery-warrant.md +1 -1
  57. package/docs/engineering-housekeeper.md +3 -3
  58. package/docs/kfd-support.md +26 -2
  59. package/docs/next-development-transition.md +2 -2
  60. package/docs/node-api-reference.md +216 -205
  61. package/docs/oci-publication.md +160 -0
  62. package/docs/publication-authority.md +2 -2
  63. package/docs/publish-transaction.md +36 -3
  64. package/docs/release-candidate.md +3 -3
  65. package/docs/release-flow.md +67 -19
  66. package/docs/release-governance.md +8 -8
  67. package/docs/release-passport.md +27 -2
  68. package/docs/reusable-build-surface.md +16 -0
  69. package/docs/v4-adopter-delivery.md +2 -2
  70. package/docs/v4-production-release.md +71 -8
  71. package/docs/v4-rust-wasm-production-authority.md +58 -0
  72. package/docs/v4-stage-capsule.md +2 -2
  73. package/docs/v4-tail-reseal.md +1 -1
  74. package/docs/workflow-catalog.md +155 -0
  75. package/docs/workflow-path-migration.md +109 -0
  76. package/package.json +12 -7
  77. package/packages/core/artifact-verification-envelope.js +5 -5
  78. package/packages/core/buildchain-contract.js +1 -1
  79. package/packages/core/buildchain-kfd-claims.js +2 -2
  80. package/packages/core/buildchain-publication-authority.js +43 -26
  81. package/packages/core/buildchain-v4-domain.wasm +0 -0
  82. package/packages/core/ci-lane-change-budget.js +14 -1
  83. package/packages/core/controller-evidence.js +4 -1
  84. package/packages/core/dev-delivery-candidate-identity.js +40 -6
  85. package/packages/core/dev-delivery-warrant-state.js +3 -4
  86. package/packages/core/dev-delivery-warrant.js +12 -2
  87. package/packages/core/github-governance-authority.js +4 -4
  88. package/packages/core/kfd-adopter-manifest.js +46 -47
  89. package/packages/core/next-development-projection.js +2 -2
  90. package/packages/core/next-development-transition.js +5 -6
  91. package/packages/core/oci-compose-qualification.js +140 -0
  92. package/packages/core/oci-publication-bundle.js +281 -0
  93. package/packages/core/oci-publication-graph.js +206 -0
  94. package/packages/core/paper-agent-entry.js +30 -4
  95. package/packages/core/paper-fleet.js +1 -1
  96. package/packages/core/paper-runtime-channels.js +348 -0
  97. package/packages/core/paper-scaffold-content.js +10 -0
  98. package/packages/core/paper.js +37 -71
  99. package/packages/core/publication-sealed-bundle.js +78 -13
  100. package/packages/core/release-line-dry-run.js +1 -1
  101. package/packages/core/release-passport-contract.js +5 -5
  102. package/packages/core/release-passport.js +5 -4
  103. package/packages/core/release-tail-product-capabilities.js +38 -0
  104. package/packages/core/release-tail-provider-plane.js +68 -1048
  105. package/packages/core/v4-canonical-contracts.js +15 -75
  106. package/packages/core/v4-domain-wasm-artifact.js +7 -0
  107. package/packages/core/v4-domain-wasm.js +216 -0
  108. package/packages/core/v4-floating-consumer-evidence.js +1 -1
  109. package/packages/core/v4-floating-consumer-policy.js +1 -1
  110. package/packages/core/v4-partial-mutation-recovery-qualification.js +9 -386
  111. package/packages/core/v4-product-publication.js +59 -0
  112. package/packages/core/v4-protected-publication-source.js +19 -21
  113. package/packages/core/v4-provider-operation-journal.js +18 -487
  114. package/packages/core/v4-provider-readback-idempotency.js +12 -97
  115. package/packages/core/v4-release-activation-shadow.js +13 -500
  116. package/packages/core/v4-release-invocation.js +28 -389
  117. package/packages/core/v4-stable-publication-fence.js +13 -342
  118. package/packages/core/v4-universal-workflow-bootstrap.js +586 -0
  119. package/scripts/binary-publication-evidence.mjs +135 -0
  120. package/scripts/build-contract-core.mjs +1 -14
  121. package/scripts/build-v4-domain-wasm.mjs +189 -0
  122. package/scripts/check-action-bundles.mjs +12 -2
  123. package/scripts/check-ci-lane-change-budget.mjs +4 -1
  124. package/scripts/check-core-mechanism-inventory.mjs +4 -3
  125. package/scripts/check-inventory.mjs +35 -44
  126. package/scripts/check-maintainability.mjs +16 -113
  127. package/scripts/check-v4-floating-consumer-policy-contract.mjs +2 -2
  128. package/scripts/check-v4-public-dogfood-contract.mjs +22 -9
  129. package/scripts/check-v4-release-topology.mjs +236 -50
  130. package/scripts/check-v4-runtime-semantic-closure.mjs +4 -1
  131. package/scripts/check-v4-universal-workflow-bootstrap.mjs +266 -0
  132. package/scripts/check-workflow-taxonomy.mjs +6 -0
  133. package/scripts/copy-v4-domain-wasm.mjs +14 -0
  134. package/scripts/dev-delivery-authority-command-adapters.mjs +1 -1
  135. package/scripts/dev-delivery-authority.mjs +8 -8
  136. package/scripts/dev-delivery-source-proof-reuse.mjs +2 -1
  137. package/scripts/dev-delivery-warrant-options.mjs +14 -9
  138. package/scripts/dev-delivery-warrant-store.mjs +73 -7
  139. package/scripts/dev-delivery-warrant-transition.mjs +109 -0
  140. package/scripts/dev-delivery-warrant.mjs +76 -99
  141. package/scripts/dev-pr-auto-merge.mjs +15 -15
  142. package/scripts/generate-channel-build-workflow.mjs +7 -2
  143. package/scripts/generate-channel-promotion-workflow.mjs +10 -25
  144. package/scripts/generate-site-bundle.mjs +11 -11
  145. package/scripts/generate-v4-universal-workflow-facades.mjs +497 -0
  146. package/scripts/generate-workflow-taxonomy.mjs +25 -0
  147. package/scripts/github-output.mjs +31 -0
  148. package/scripts/maintainability-metrics.mjs +16 -5
  149. package/scripts/maintainability-public-surface.mjs +115 -0
  150. package/scripts/next-development-review.mjs +307 -0
  151. package/scripts/oci-compose-preview.mjs +250 -0
  152. package/scripts/paper-work-fleet-cli.mjs +2 -0
  153. package/scripts/publication-candidate-kind.mjs +93 -0
  154. package/scripts/publication-candidate-sealer.mjs +16 -1
  155. package/scripts/release-asset-client.mjs +91 -0
  156. package/scripts/release-candidate-resolver.mjs +23 -35
  157. package/scripts/resume-from-candidate-run.mjs +11 -18
  158. package/scripts/site-capability-metadata.mjs +1 -0
  159. package/scripts/source-verification-evidence.mjs +344 -0
  160. package/scripts/stable-candidate-qualification.mjs +1 -1
  161. package/scripts/universal-facade-maintainability.mjs +91 -0
  162. package/scripts/v4-product-publication-intent.mjs +129 -0
  163. package/scripts/v4-publication-settlement.mjs +211 -0
  164. package/scripts/v4-universal-workflow-backflow.mjs +212 -0
  165. package/scripts/v4-universal-workflow-engine.mjs +620 -0
  166. package/scripts/v4-universal-workflow-self-dogfood.mjs +205 -0
  167. package/scripts/verify-version-state-delta.mjs +173 -0
  168. package/scripts/workflow-taxonomy.mjs +507 -0
  169. package/templates/native-dev-delivery.yml +4 -7
  170. package/templates/universal-buildchain-bootstrap-recovery.yml +282 -0
  171. package/templates/universal-buildchain-bootstrap.yml +28 -0
package/architecture/v4-universal-workflow-bootstrap.json ADDED
@@ -0,0 +1,176 @@
1
+ {
2
+ "schema": "kungfu-buildchain-v4-universal-workflow-bootstrap/v1",
3
+ "status": "migration-active",
4
+ "bootstrap": {
5
+ "publicWorkflow": ".github/workflows/bootstrap.yml",
6
+ "requestSchema": "kungfu-buildchain-v4-universal-workflow-request/v1",
7
+ "admissionSchema": "kungfu-buildchain-v4-universal-workflow-admission/v1",
8
+ "terminalReceiptSchema": "kungfu-buildchain-v4-universal-workflow-terminal-receipt/v1",
9
+ "candidateRepository": "kungfu-systems/buildchain",
10
+ "candidateEnginePath": "scripts/v4-universal-workflow-engine.mjs",
11
+ "consumerTemplate": "templates/universal-buildchain-bootstrap.yml",
12
+ "consumerRecoveryTemplate": "templates/universal-buildchain-bootstrap-recovery.yml",
13
+ "consumerRecoveryWorkflow": ".github/workflows/universal-bootstrap-recovery.yml",
14
+ "consumerRecoveryMode": "separate-pre-positioned-consumer-owned-shell",
15
+ "recoveryDependsOnPublishedBuildchain": false,
16
+ "selfDogfoodWorkflow": ".github/workflows/self-ops-bootstrap-dogfood.yml",
17
+ "faultCampaign": "architecture/v4-universal-workflow-fault-campaign.json",
18
+ "discoveryRefExecutionAuthority": false,
19
+ "exactShaExecutionAuthority": true,
20
+ "consumerSourceMutationPerIncident": false,
21
+ "consumerAdmission": "verified-caller-exact-repository-workflow-and-source",
22
+ "reviewRuntimeBinding": "reviewed-head-or-protected-alpha-merge-to-exact-runtime",
23
+ "buildchainReleasePromotionPerIncident": false,
24
+ "selfDogfoodUsesPublicContract": true
25
+ },
26
+ "capabilityAdapters": [
27
+ {
28
+ "id": "bootstrap-conformance",
29
+ "execution": "exact-candidate-engine",
30
+ "payloadSchema": "kungfu-buildchain-v4-universal-bootstrap-conformance/v1",
31
+ "providerEffects": false
32
+ },
33
+ {
34
+ "id": "release-candidate-promote",
35
+ "execution": "exact-candidate-action-and-provider-readback",
36
+ "payloadSchema": "kungfu-buildchain-v4-universal-release-promotion/v1",
37
+ "providerEffects": true
38
+ },
39
+ {
40
+ "id": "release-invocation",
41
+ "execution": "exact-candidate-canonical-projection",
42
+ "payloadSchema": "kungfu-buildchain-v4-release-invocation/v1",
43
+ "providerEffects": false
44
+ }
45
+ ],
46
+ "complexityBudget": {
47
+ "bootstrapAbis": 1,
48
+ "requestEnvelopes": 1,
49
+ "candidateResolvers": 1,
50
+ "candidateEngines": 1,
51
+ "terminalReceiptAuthorities": 1,
52
+ "perWorkflowBootstrapImplementations": 0,
53
+ "buildchainOnlySelfReleasePaths": 0,
54
+ "perIncidentConsumerEdits": 0
55
+ },
56
+ "permissionCeiling": {
57
+ "actions": "write",
58
+ "artifact-metadata": "write",
59
+ "attestations": "write",
60
+ "checks": "write",
61
+ "contents": "write",
62
+ "deployments": "write",
63
+ "id-token": "write",
64
+ "issues": "write",
65
+ "packages": "write",
66
+ "pages": "write",
67
+ "pull-requests": "write",
68
+ "security-events": "write",
69
+ "statuses": "write"
70
+ },
71
+ "inventoryWorkflows": [
72
+ ".github/workflows/.auditable-demo.yml",
73
+ ".github/workflows/.binary-release-assets.yml",
74
+ ".github/workflows/.build.yml",
75
+ ".github/workflows/.bump-minor-version.yml",
76
+ ".github/workflows/.declarative-auditable-demo.yml",
77
+ ".github/workflows/.gate-profile.yml",
78
+ ".github/workflows/.publication-authority.yml",
79
+ ".github/workflows/.release-candidate-promote.yml",
80
+ ".github/workflows/.release-verify.yml",
81
+ ".github/workflows/.sam-verify.yml",
82
+ ".github/workflows/.sync-release-page.yml",
83
+ ".github/workflows/.sync-remote-git.yml",
84
+ ".github/workflows/.web-surface.yml",
85
+ ".github/workflows/.wheel-verify.yml",
86
+ ".github/workflows/bootstrap.yml",
87
+ ".github/workflows/build.yml",
88
+ ".github/workflows/buildchain-patrol.yml",
89
+ ".github/workflows/check.yml",
90
+ ".github/workflows/dev-alpha-candidate-patrol.yml",
91
+ ".github/workflows/dev-delivery-warrant-cancel.yml",
92
+ ".github/workflows/dev-delivery-warrant-close.yml",
93
+ ".github/workflows/dev-pr-auto-merge.yml",
94
+ ".github/workflows/dev-qualification-patrol.yml",
95
+ ".github/workflows/engineering-housekeeper.yml",
96
+ ".github/workflows/github-artifact-attestation.yml",
97
+ ".github/workflows/paper-release-sealed.yml",
98
+ ".github/workflows/paper-release.yml",
99
+ ".github/workflows/patrol-daily.yml",
100
+ ".github/workflows/patrol-monthly.yml",
101
+ ".github/workflows/patrol-observed-evidence.yml",
102
+ ".github/workflows/patrol-weekly.yml",
103
+ ".github/workflows/public-release-oci-compose-preview.yml",
104
+ ".github/workflows/publication-artifact.yml",
105
+ ".github/workflows/release-candidate-promote.yml",
106
+ ".github/workflows/release-governance-reconcile.yml",
107
+ ".github/workflows/release-propagation.yml",
108
+ ".github/workflows/release-tail.yml",
109
+ ".github/workflows/stable-candidate-patrol.yml",
110
+ ".github/workflows/universal-bootstrap-recovery.yml",
111
+ ".github/workflows/v4-adopter-delivery.yml",
112
+ ".github/workflows/v4-stage-capsule-canary.yml",
113
+ ".github/workflows/v4-tail-reseal.yml"
114
+ ],
115
+ "retiredWorkflowSurfaces": [],
116
+ "bootstrapGovernedWorkflows": [
117
+ ".github/workflows/.auditable-demo.yml",
118
+ ".github/workflows/.binary-release-assets.yml",
119
+ ".github/workflows/.build.yml",
120
+ ".github/workflows/.bump-minor-version.yml",
121
+ ".github/workflows/.declarative-auditable-demo.yml",
122
+ ".github/workflows/.gate-profile.yml",
123
+ ".github/workflows/.publication-authority.yml",
124
+ ".github/workflows/.release-candidate-promote.yml",
125
+ ".github/workflows/.release-verify.yml",
126
+ ".github/workflows/.sam-verify.yml",
127
+ ".github/workflows/.sync-release-page.yml",
128
+ ".github/workflows/.sync-remote-git.yml",
129
+ ".github/workflows/.web-surface.yml",
130
+ ".github/workflows/.wheel-verify.yml",
131
+ ".github/workflows/bootstrap.yml",
132
+ ".github/workflows/build.yml",
133
+ ".github/workflows/buildchain-patrol.yml",
134
+ ".github/workflows/check.yml",
135
+ ".github/workflows/dev-alpha-candidate-patrol.yml",
136
+ ".github/workflows/dev-delivery-warrant-cancel.yml",
137
+ ".github/workflows/dev-delivery-warrant-close.yml",
138
+ ".github/workflows/dev-pr-auto-merge.yml",
139
+ ".github/workflows/dev-qualification-patrol.yml",
140
+ ".github/workflows/engineering-housekeeper.yml",
141
+ ".github/workflows/github-artifact-attestation.yml",
142
+ ".github/workflows/paper-release-sealed.yml",
143
+ ".github/workflows/paper-release.yml",
144
+ ".github/workflows/patrol-daily.yml",
145
+ ".github/workflows/patrol-monthly.yml",
146
+ ".github/workflows/patrol-observed-evidence.yml",
147
+ ".github/workflows/patrol-weekly.yml",
148
+ ".github/workflows/public-release-oci-compose-preview.yml",
149
+ ".github/workflows/publication-artifact.yml",
150
+ ".github/workflows/release-candidate-promote.yml",
151
+ ".github/workflows/release-governance-reconcile.yml",
152
+ ".github/workflows/release-propagation.yml",
153
+ ".github/workflows/release-tail.yml",
154
+ ".github/workflows/stable-candidate-patrol.yml",
155
+ ".github/workflows/v4-adopter-delivery.yml",
156
+ ".github/workflows/v4-stage-capsule-canary.yml",
157
+ ".github/workflows/v4-tail-reseal.yml"
158
+ ],
159
+ "migration": {
160
+ "compatibilityFacadeGenerator": "scripts/generate-v4-universal-workflow-facades.mjs",
161
+ "facadeSourceRevision": "06a2d9f7d5753c5c9b2bf0e7f0e3220fc18cc183",
162
+ "channelGeneratedFacades": [
163
+ ".github/workflows/build.yml",
164
+ ".github/workflows/release-candidate-promote.yml"
165
+ ],
166
+ "staticBootstrap": "implemented",
167
+ "candidateEngine": "bounded-capability-adapters",
168
+ "compatibilityFacades": "generated-dual-path",
169
+ "externalConsumerDogfood": "public-consumer-three-platform-runtime-and-non-circular-recovery-hosted-proof-passed",
170
+ "buildchainSelfDogfood": "train-primary-and-consumer-recovery-three-pair-hosted-proof-passed",
171
+ "oldPathRetirement": "pending-protected-dev-integration",
172
+ "postMigrationWorkflows": [
173
+ ".github/workflows/public-release-oci-compose-preview.yml"
174
+ ]
175
+ }
176
+ }
package/architecture/v4-universal-workflow-fault-campaign.json ADDED
@@ -0,0 +1,72 @@
1
+ {
2
+ "schema": "kungfu-buildchain-v4-universal-workflow-fault-campaign/v1",
3
+ "independentFaultsOnly": true,
4
+ "simultaneousPrimaryAndRecoveryFailureClaimed": false,
5
+ "externalBoundary": {
6
+ "id": "github-workflow-parser-or-service-unavailable",
7
+ "classification": "irreducible-external-availability",
8
+ "recovered": false
9
+ },
10
+ "faults": [
11
+ {
12
+ "id": "primary-facade",
13
+ "injectionTarget": "templates/universal-buildchain-bootstrap.yml",
14
+ "recoveryRoute": "pre-positioned-recovery-shell",
15
+ "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
16
+ },
17
+ {
18
+ "id": "typed-input-adapter",
19
+ "injectionTarget": "packages/core/v4-universal-workflow-bootstrap.js",
20
+ "recoveryRoute": "exact-train-candidate",
21
+ "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
22
+ },
23
+ {
24
+ "id": "route-selector",
25
+ "injectionTarget": ".github/workflows/bootstrap.yml",
26
+ "recoveryRoute": "pre-positioned-recovery-shell",
27
+ "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
28
+ },
29
+ {
30
+ "id": "ordinary-candidate-loader",
31
+ "injectionTarget": ".github/workflows/bootstrap.yml",
32
+ "recoveryRoute": "pre-positioned-recovery-shell",
33
+ "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
34
+ },
35
+ {
36
+ "id": "router",
37
+ "injectionTarget": "packages/core/v4-release-invocation.js",
38
+ "recoveryRoute": "exact-train-candidate",
39
+ "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
40
+ },
41
+ {
42
+ "id": "action",
43
+ "injectionTarget": "actions/v4-release-candidate-promote/action.yml",
44
+ "recoveryRoute": "exact-train-candidate",
45
+ "recoveryTarget": "actions/v4-release-candidate-promote/dist/index.js"
46
+ },
47
+ {
48
+ "id": "cli-runtime",
49
+ "injectionTarget": "scripts/v4-universal-workflow-engine.mjs",
50
+ "recoveryRoute": "exact-train-candidate",
51
+ "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
52
+ },
53
+ {
54
+ "id": "recovery-logic",
55
+ "injectionTarget": "templates/universal-buildchain-bootstrap-recovery.yml",
56
+ "recoveryRoute": "primary-bootstrap-shell",
57
+ "recoveryTarget": "templates/universal-buildchain-bootstrap.yml"
58
+ },
59
+ {
60
+ "id": "result-projection",
61
+ "injectionTarget": ".github/workflows/bootstrap.yml",
62
+ "recoveryRoute": "pre-positioned-recovery-shell",
63
+ "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
64
+ },
65
+ {
66
+ "id": "self-dogfood-caller",
67
+ "injectionTarget": ".github/workflows/self-ops-bootstrap-dogfood.yml",
68
+ "recoveryRoute": "consumer-equivalent-recovery-shell",
69
+ "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
70
+ }
71
+ ]
72
+ }
package/architecture/v4-universal-workflow-train-admission.json ADDED
@@ -0,0 +1,40 @@
1
+ {
2
+ "schema": "kungfu-buildchain-v4-universal-workflow-admission-policy/v1",
3
+ "sourceRepository": "kungfu-systems/buildchain",
4
+ "consumerAdmission": "verified-caller",
5
+ "allowedCapabilities": [
6
+ "bootstrap-conformance",
7
+ "release-candidate-promote",
8
+ "release-invocation"
9
+ ],
10
+ "permissionCeiling": {
11
+ "actions": "write",
12
+ "artifact-metadata": "write",
13
+ "attestations": "write",
14
+ "checks": "write",
15
+ "contents": "write",
16
+ "deployments": "write",
17
+ "id-token": "write",
18
+ "issues": "write",
19
+ "packages": "write",
20
+ "pages": "write",
21
+ "pull-requests": "write",
22
+ "security-events": "write",
23
+ "statuses": "write"
24
+ },
25
+ "contractRoots": [
26
+ "sha256:2eefbee51f4bed669c970db9688de70f07aa7da81f2eb8d83107c5bbc1377fab",
27
+ "sha256:38ab6e09aea11256a038c208b5e83dafc19cd740057e0eb90e1b1bd28175b067",
28
+ "sha256:4e1f0a8ae7b3f7651b16687d7cfab88a9622c5f88e04c82faf66769230ef595d",
29
+ "sha256:65a0c2fc3faecaddf5076fff086b5d6e12eb9ba27796efc10aed19f2d93b9457",
30
+ "sha256:91179d78d624c7671b11a1aee3b0f976b25583ed5218dd8e7e3980b0d5a0fe33",
31
+ "sha256:b94023c4abe4216765198adcaefb4825874a4d9053be096d35a53d6821128b52",
32
+ "sha256:cfa12208f3f662492254f186eabfb84eeb950c31a58723301e4d09ebe2f17071"
33
+ ],
34
+ "targetRef": "dev/v4/v4.0",
35
+ "allowedReviewers": ["kungfu-origin"],
36
+ "minimumApprovals": 1,
37
+ "requiredChecks": ["check"],
38
+ "validFrom": "2026-08-30T00:00:00.000Z",
39
+ "expiresAt": "2026-09-07T00:00:00.000Z"
40
+ }