@kungfu-tech/buildchain 4.0.2-alpha.8 → 4.0.2

package/docs/workflow-catalog.md

@@ -0,0 +1,154 @@
+---
+status: active
+period: ongoing
+theme: workflow-taxonomy
+doc_type: technical-reference
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-05
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-05
+  visible_context: Repository workflow source and the approved naming scheme
+  invisible_context_boundary: No credentials or unpublished provider configuration inspected
+---
+
+# Workflow catalog
+
+Generated from `architecture/workflow-taxonomy.json`; edit that source, then run
+`pnpm run generate:workflows`. Every YAML file, including compatibility paths,
+is checked by the existing required workflow check.
+
+## Naming and ownership
+
+`public-<build|release|ops>-<purpose>.yml` is a consumer entry;
+`.<build|release|ops>-<purpose>.yml` is an advanced component;
+`self-<build|release|ops>-<purpose>.yml` is Buildchain's own automation.
+Public is a product role, not GitHub access control. Dispatch services are
+marked separately from reusable workflows. Keep workflow names, job IDs,
+permissions, and trigger semantics stable during path migration.
+
+## Channel rollout
+
+Canonical names become callable on a channel only after that channel publishes
+them. Existing `@v4`/`@v4-alpha` consumers keep their exact registered legacy
+paths until provider readback proves canonical availability. New examples below
+describe the target surface, not a claim that both channels already publish it.
+Compatibility files are generated byte-identical projections, not independently
+editable implementations. They retain full jobs to preserve called-workflow
+identity, permission envelopes, and required check names without extra nesting.
+
+The controller registry records the actual source path separately from a migrated
+repository controller contractPath. This preserves the established logical
+contract identity while exposing its current execution source. New workflows
+do not acquire historical identities. Public controllers retain their real
+compatibility paths while those paths remain supported.
+
+## Adding or changing a workflow
+
+Register a stable identity, role, category, purpose, owner, lifecycle status,
+invocation and concrete summary before creating its derived path. A new entry
+must explain its scope in review. New aliases cannot be invented: compatibility
+must name an exact migration source with a reason and removal condition.
+The policy, generator, checker, tests, required CI chain and CODEOWNERS require
+independent `kungfu-origin` review. No wildcard compatibility admission is allowed.
+Workflow filenames cannot contain version tokens such as `v4` or `v5`.
+Retired aliases cannot be recreated or called; see [path migration](workflow-path-migration.md).
+
+A role, category or implementation edit must preserve or deliberately update
+all related declarations. Run `pnpm run generate:workflows` and
+`pnpm run check:workflows`; the full `pnpm run check` remains required.
+
+## public
+
+| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
+| --- | --- | --- | --- | --- | --- |
+| [public-build-adopter-qualification.yml](../.github/workflows/public-build-adopter-qualification.yml) | build | reusable | active | V4 Adopter Delivery | — |
+| [public-build-candidate.yml](../.github/workflows/public-build-candidate.yml) | build | reusable | active | Buildchain Channel Build | `build.yml` |
+| [public-build-check.yml](../.github/workflows/public-build-check.yml) | build | reusable | active | Buildchain Check | `check.yml` |
+| [public-build-demo.yml](../.github/workflows/public-build-demo.yml) | build | reusable | active | Buildchain Declarative Binary Auditable Demo | `.declarative-auditable-demo.yml` |
+| [public-build-publication.yml](../.github/workflows/public-build-publication.yml) | build | reusable | active | Buildchain Publication Artifact | `publication-artifact.yml` |
+| [public-build-stage-capsule-canary.yml](../.github/workflows/public-build-stage-capsule-canary.yml) | build | reusable | active | V4 Stage Capsule Canary | — |
+| [public-ops-alpha-candidate-patrol.yml](../.github/workflows/public-ops-alpha-candidate-patrol.yml) | ops | reusable | active | Buildchain Dev to Alpha Candidate Patrol | `dev-alpha-candidate-patrol.yml` |
+| [public-ops-bootstrap-recovery.yml](../.github/workflows/public-ops-bootstrap-recovery.yml) | ops | reusable | active | Universal Buildchain Bootstrap Recovery | `universal-bootstrap-recovery.yml` |
+| [public-ops-bootstrap.yml](../.github/workflows/public-ops-bootstrap.yml) | ops | reusable | active | Buildchain Universal Bootstrap | `bootstrap.yml` |
+| [public-ops-dev-auto-merge.yml](../.github/workflows/public-ops-dev-auto-merge.yml) | ops | reusable | active | Dev PR Auto Merge | `dev-pr-auto-merge.yml` |
+| [public-ops-dev-qualification-patrol.yml](../.github/workflows/public-ops-dev-qualification-patrol.yml) | ops | reusable | active | Buildchain Dev Qualification Patrol | `dev-qualification-patrol.yml` |
+| [public-ops-housekeeping.yml](../.github/workflows/public-ops-housekeeping.yml) | ops | reusable | active | Engineering Housekeeper | `engineering-housekeeper.yml` |
+| [public-ops-observed-evidence.yml](../.github/workflows/public-ops-observed-evidence.yml) | ops | reusable | active | Patrol Observed Evidence | `patrol-observed-evidence.yml` |
+| [public-ops-patrol-daily.yml](../.github/workflows/public-ops-patrol-daily.yml) | ops | reusable | active | Buildchain Patrol Daily | `patrol-daily.yml` |
+| [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly | `patrol-monthly.yml` |
+| [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly | `patrol-weekly.yml` |
+| [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol | `buildchain-patrol.yml` |
+| [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile | `release-governance-reconcile.yml` |
+| [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol | `stable-candidate-patrol.yml` |
+| [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal | — |
+| [public-ops-warrant-cancel.yml](../.github/workflows/public-ops-warrant-cancel.yml) | ops | reusable | active | Dev Delivery Warrant Queued Candidate Cancel | `dev-delivery-warrant-cancel.yml` |
+| [public-ops-warrant-close.yml](../.github/workflows/public-ops-warrant-close.yml) | ops | reusable | active | Dev Delivery Warrant Close | `dev-delivery-warrant-close.yml` |
+| [public-release-artifact-attestation.yml](../.github/workflows/public-release-artifact-attestation.yml) | release | reusable | active | Buildchain GitHub Artifact Attestation | `github-artifact-attestation.yml` |
+| [public-release-paper-sealed.yml](../.github/workflows/public-release-paper-sealed.yml) | release | reusable | active | Buildchain Sealed Paper Release | `paper-release-sealed.yml` |
+| [public-release-paper.yml](../.github/workflows/public-release-paper.yml) | release | reusable | active | Buildchain Paper Release | `paper-release.yml` |
+| [public-release-promote.yml](../.github/workflows/public-release-promote.yml) | release | reusable | active | Release Candidate Promote | `release-candidate-promote.yml` |
+| [public-release-propagation.yml](../.github/workflows/public-release-propagation.yml) | release | reusable | active | Release Propagation | `release-propagation.yml` |
+| [public-release-signing-authority.yml](../.github/workflows/public-release-signing-authority.yml) | release | dispatch-service | active | Buildchain Artifact Signing Authority | `artifact-signing-authority.yml` |
+| [public-release-tail.yml](../.github/workflows/public-release-tail.yml) | release | reusable | active | Declarative Release Tail | `release-tail.yml` |
+| [public-release-web.yml](../.github/workflows/public-release-web.yml) | release | reusable | active | Buildchain Web Surface | `.web-surface.yml` |
+
+## component
+
+| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
+| --- | --- | --- | --- | --- | --- |
+| [.build-demo-adapter.yml](../.github/workflows/.build-demo-adapter.yml) | build | reusable | active | Buildchain Auditable Demo | `.auditable-demo.yml` |
+| [.build-engine.yml](../.github/workflows/.build-engine.yml) | build | reusable | active | Buildchain Build | `.build.yml` |
+| [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile | `.gate-profile.yml` |
+| [.build-release-verify-compat.yml](../.github/workflows/.build-release-verify-compat.yml) | build | reusable | compatibility | release verify | `.release-verify.yml` |
+| [.build-sam-verify-compat.yml](../.github/workflows/.build-sam-verify-compat.yml) | build | reusable | compatibility | sam verify | `.sam-verify.yml` |
+| [.build-wheel-verify-compat.yml](../.github/workflows/.build-wheel-verify-compat.yml) | build | reusable | compatibility | wheel verify | `.wheel-verify.yml` |
+| [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git | `.sync-remote-git.yml` |
+| [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority | `.publication-authority.yml` |
+| [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets | `.binary-release-assets.yml` |
+| [.release-minor-bump-compat.yml](../.github/workflows/.release-minor-bump-compat.yml) | release | reusable | compatibility | bump minor version | `.bump-minor-version.yml` |
+| [.release-page-sync-retired.yml](../.github/workflows/.release-page-sync-retired.yml) | release | reusable | retired | sync release page | `.sync-release-page.yml` |
+| [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced | `.release-candidate-promote.yml` |
+
+## self
+
+| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
+| --- | --- | --- | --- | --- | --- |
+| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood | — |
+| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood | — |
+| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution | — |
+| [self-build-candidate-lab.yml](../.github/workflows/self-build-candidate-lab.yml) | build | repository | active | Candidate Lab | — |
+| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood | — |
+| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification | — |
+| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture | — |
+| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood | — |
+| [self-build-release-verify-compat.yml](../.github/workflows/self-build-release-verify-compat.yml) | build | repository | compatibility | Release - Verify | — |
+| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification | — |
+| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify | — |
+| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood | — |
+| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery | — |
+| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit | — |
+| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily | — |
+| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly | — |
+| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly | — |
+| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance | — |
+| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily | — |
+| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly | — |
+| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly | — |
+| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery | — |
+| [self-ops-recovery-failure-dogfood.yml](../.github/workflows/self-ops-recovery-failure-dogfood.yml) | ops | repository | active | Buildchain Candidate Recovery Dogfood Startup Failure | — |
+| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke | — |
+| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol | — |
+| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets | — |
+| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap | — |
+| [self-release-new-version-compat.yml](../.github/workflows/self-release-new-version-compat.yml) | release | repository | compatibility | Release - New Version | — |
+| [self-release-next-development.yml](../.github/workflows/self-release-next-development.yml) | release | repository | active | Next Development Review | — |
+| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package | — |
+| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion | — |
+| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood | — |
+| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood | — |

package/docs/workflow-path-migration.md

@@ -0,0 +1,109 @@
+---
+status: draft
+period: ongoing
+theme: workflow-path-migration
+doc_type: migration-guide
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-06
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-05
+  visible_context: Exact GitHub channel refs and workflow files on 23 organization default branches
+  invisible_context_boundary: Other branches, private or unlisted consumers and future floating ref updates were not established by this audit
+---
+
+# Version-prefixed workflow path migration
+
+This source change retires three filenames. Their reusable capabilities, inputs,
+outputs, jobs and permission envelopes remain at the canonical paths below.
+Keep the existing channel selector and dual contract-lock policy when migrating.
+
+| Retired path | Canonical path |
+| --- | --- |
+| `v4-adopter-delivery.yml` | `public-build-adopter-qualification.yml` |
+| `v4-stage-capsule-canary.yml` | `public-build-stage-capsule-canary.yml` |
+| `v4-tail-reseal.yml` | `public-ops-tail-reseal.yml` |
+
+All paths are beneath `.github/workflows/`. The taxonomy gate rejects version
+segments in filenames and calls to version-prefixed Buildchain workflows. An
+explicit retirement record keeps the original migration identity for historical
+metrics and frozen facade source; generators resolve that identity to the
+canonical implementation and cannot recreate the removed file.
+
+## Development merge and channel rollout
+
+The development change retires these filenames on `dev/v4/v4.0`, updates the
+Buildchain-owned callers, and enforces the canonical paths through generators
+and required checks. Its delivery boundary is the protected development merge.
+External-repository migration and stable publication are separate follow-up
+work and do not block this development merge.
+
+The published channel boundary still requires the following rollout order:
+
+1. Publish and verify the canonical entries on every affected channel while the
+   old entries remain available. The admission identity must match the actual
+   invoked canonical workflow, rather than its previous filename.
+2. Migrate consumers on their existing floating channels, refresh locks through
+   the supported contract acceptance path if required, and verify real consumer
+   runs. Stable callers remain on stable; alpha callers remain on alpha.
+3. Before publishing the retirement into a channel, recheck its live consumers
+   and resolve any remaining old-path calls. A protected development merge does
+   not by itself establish this channel readiness.
+
+## Initial consumer readback
+
+On 2026-09-05, all workflow files from 23 accessible `kungfu-systems` repository
+_default branches_ were read at their returned Git revisions. Five calls were
+found in three repositories. This is a bounded inventory, not evidence that
+unknown or non-default-branch consumers do not exist.
+
+| Repository and observed revision | Caller | Existing selector |
+| --- | --- | --- |
+| Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-adopter-dogfood.yml` | `v4-alpha` |
+| Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-public-consumer-dogfood.yml` | `v4-alpha` |
+| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-adopter-delivery-qualification.yml` | `v4-alpha` |
+| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-stage-capsule-canary.yml` | `v4` |
+| taolu `6dcccdc3bd2c8b1801c7f6decea08ae7877aac2b` | `verify.yml` | `v4-alpha` |
+
+The initial published channel readback was `v4` at
+`da5e2db8384313e899eace87aea0a1a8e28c0aa8` and `v4-alpha` at
+`dd87f43f7122b41c4ce7f1f6d1888521cc7f892f`. Neither contained the three canonical
+filenames at that initial readback. The later evidence below records progress
+without changing the scope or revisions of that initial inventory.
+
+## Rollout evidence as of 2026-09-06
+
+The canonical invocation-identity preparation was merged in
+[Buildchain PR 3508](https://github.com/kungfu-systems/buildchain/pull/3508).
+All three canonical paths are available in the immutable `v4.0.2-alpha.35`
+release (`feab078f5d7c9927a3525154003e321700e8ca30`) and the later
+`v4.0.2-alpha.37` release (`f5fa1a4a3e8d83eccee79c077e5f48417760c9df`).
+The floating `v4-alpha` readback selects alpha.37.
+
+[Taolu PR 30](https://github.com/kungfu-systems/taolu/pull/30) migrated its
+Stage Capsule call on `@v4-alpha`, preserving the existing dual locks.
+Its exact source `b3f4c12578d733ff44165ff1acafe131251b8907` passed
+[consumer Verify](https://github.com/kungfu-systems/taolu/actions/runs/33975786413)
+on all declared platforms and
+[native delivery](https://github.com/kungfu-systems/taolu/actions/runs/34005576362).
+The protected dev landing is `7e15123733110ad8ce484241934bbf0ef99fbb45`.
+
+The stable `v4` readback remains
+`da5e2db8384313e899eace87aea0a1a8e28c0aa8`, which does not contain the canonical
+paths. Stable publication and the agent-hub-demo migration remain **pending**
+outside this development change's completion boundary. The alpha.35
+[Build Surface Fixture](https://github.com/kungfu-systems/buildchain/actions/runs/34005360217)
+passed, but this individual result does not establish complete stable
+qualification or authorize moving the stable channel.
+
+## Recovery
+
+Before channel retirement, revert consumer changes to the still-available old
+paths if verification fails. After retirement, restore the exact previous
+provider implementation through a reviewed corrective commit and normal
+publication; do not rewrite immutable release tags or bypass admission checks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.8",
+  "version": "4.0.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -156,16 +156,18 @@
   "scripts": {
     "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/v4-delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery-authority-candidate.js packages/core/dev-delivery-authority-evidence.js packages/core/dev-delivery-authority-landing.js packages/core/dev-delivery-authority-observation.js packages/core/dev-delivery-authority-qualification.js packages/core/dev-delivery-authority-settlement.js packages/core/dev-delivery-authority-state.js packages/core/dev-delivery-execution-failure.js packages/core/dev-delivery-execution-transfer.js packages/core/dev-delivery-landing-readback.js packages/core/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery-landing-testing-port.js packages/core/dev-delivery-native-execution.js packages/core/dev-delivery-native-proof.js packages/core/dev-delivery-process-boundary.js packages/core/dev-delivery-warrant-qualification.js packages/core/dev-delivery-warrant-state.js scripts/dev-delivery-authority-command-adapters.mjs scripts/dev-delivery-authority-provider.mjs scripts/dev-delivery-authority.mjs scripts/dev-delivery-native-run.mjs scripts/dev-delivery-process-boundary.mjs scripts/dev-delivery-two-phase-resume.mjs scripts/dev-delivery-two-phase.mjs scripts/dev-delivery-warrant-options.mjs scripts/dev-delivery-warrant-store.mjs templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && node scripts/check-v4-release-topology.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-v4-runtime-semantic-closure.mjs && node scripts/check-v3-v4-capability-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-publication-rehearsal-fixture.mjs --check && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check": "pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-v4-public-dogfood-contract.mjs && node scripts/check-v4-floating-consumer-policy-contract.mjs && node scripts/check-v4-release-topology.mjs && node scripts/check-v4-universal-workflow-bootstrap.mjs && pnpm run check:v4-bridge && pnpm run check:v4-contracts:rust && pnpm run check:v4-wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-v4-runtime-semantic-closure.mjs && node scripts/check-v3-v4-capability-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-publication-rehearsal-fixture.mjs --check && node scripts/v4-architecture.mjs validate && node scripts/v4-warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs bin/internal/compatibility-facts-cli.mjs packages/core/v4-canonical-contracts.js packages/core/kungfu-temporal-fact.js packages/core/buildchain-compatibility-fact.js packages/core/buildchain-compatibility-authority.js packages/core/buildchain-compatibility-proof.js packages/core/v4-floating-consumer-evidence.js packages/core/v4-floating-consumer-policy.js packages/core/v4-floating-consumer-release-passport.js packages/core/v4-runtime-ref-resume-authority.js packages/core/v4-tail-reseal-contract.js packages/core/v4-tail-reseal-github.js packages/core/v4-tail-reseal-receipt.js packages/core/v4-tail-reseal.js packages/core/v4-runtime-selector-persistence.js packages/core/v4-provider-operation-journal.js packages/core/v4-provider-readback-idempotency.js packages/core/v4-release-activation-shadow.js packages/core/v4-stable-publication-fence.js packages/core/v4-partial-mutation-recovery-qualification.js packages/core/v4-stage-capsule.js packages/core/v4-stage-capsule-store.js packages/core/v4-stage-capsule-local-store.js packages/core/v4-platform-stage-checkpoints.js packages/core/v4-stage-capsule-resume-planner.js packages/core/v4-stage-capsule-qualification.js packages/core/v4-stage-capsule-qualification-campaign.js packages/core/v4-delivery-warrant-fixture-runner.js packages/core/v4-delivery-warrant-read-candidate.js packages/core/v4-delivery-warrant-semantic-diff-gate.js packages/core/v4-delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-v4-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/dev-pr-prequeue-guard.mjs scripts/check-v4-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/v4-bridge-bootstrap.mjs scripts/v4-bridge-evidence.mjs scripts/v4-consumer-policy.mjs scripts/v4-host-adapter.mjs scripts/v4-platform-stage-checkpoint-rehearsal.mjs scripts/v4-stage-capsule-resume-rehearsal.mjs scripts/v4-stage-capsule-qualification.mjs scripts/v4-tail-reseal-macos-rehearsal.mjs scripts/v4-tail-reseal.mjs scripts/v4-warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs tests/v4-bridge.test.mjs tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-runtime-semantic-closure.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs tests/v4-warrant-shadow-plan.test.mjs",
     "check:v4-bridge": "cargo fmt --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-bridge/Cargo.toml",
-    "check:v4-contracts": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-publication-rehearsal.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
-    "check:workflows": "bash scripts/check-workflows.sh",
+    "check:v4-contracts": "pnpm run check:v4-contracts:rust && node --test tests/v4-canonical-contracts.test.mjs tests/v4-delivery-warrant-fixture-runner.test.mjs tests/v4-delivery-warrant-read-candidate.test.mjs tests/v4-domain-wasm.test.mjs tests/v4-floating-consumer-policy-contract.test.mjs tests/v4-floating-consumer-policy.test.mjs tests/v4-runtime-ref-resume-authority.test.mjs tests/v4-tail-reseal.test.mjs tests/v4-tail-reseal-parity.test.mjs tests/v4-compatibility-facts.test.mjs tests/v4-publication-rehearsal.test.mjs tests/v4-platform-stage-checkpoints.test.mjs tests/v4-provider-operation-journal.test.mjs tests/v4-provider-readback-idempotency.test.mjs tests/v4-public-dogfood-contract.test.mjs tests/v4-release-activation-shadow.test.mjs tests/v4-stable-publication-fence.test.mjs tests/v4-partial-mutation-recovery-qualification.test.mjs tests/v4-stage-capsule.test.mjs tests/v4-stage-capsule-store.test.mjs tests/v4-stage-capsule-resume-planner.test.mjs tests/v4-stage-capsule-qualification.test.mjs",
+    "build:v4-wasm": "node scripts/build-v4-domain-wasm.mjs",
+    "check:v4-wasm": "prettier --check packages/core/v4-domain-wasm.js packages/core/v4-domain-wasm-artifact.js scripts/build-v4-domain-wasm.mjs scripts/copy-v4-domain-wasm.mjs tests/v4-domain-wasm.test.mjs && node scripts/build-v4-domain-wasm.mjs --check",
+    "check:workflows": "node scripts/check-workflow-taxonomy.mjs && bash scripts/check-workflows.sh",
     "generate:reference": "node scripts/generate-public-reference.mjs",
     "check:reference": "node scripts/generate-public-reference.mjs --check",
     "generate:next-development": "node scripts/generate-next-development-guidance.mjs",
     "check:next-development": "node scripts/generate-next-development-guidance.mjs --check",
-    "generate:site": "pnpm run generate:next-development && pnpm run generate:reference && node scripts/generate-site-bundle.mjs",
+    "generate:site": "pnpm run generate:workflows && pnpm run generate:next-development && pnpm run generate:reference && node scripts/generate-site-bundle.mjs",
     "check:site": "pnpm run check:next-development && pnpm run check:reference && node scripts/generate-site-bundle.mjs --check",
     "check:golden-path": "node scripts/verify-golden-path.mjs",
     "test:unit": "node --test tests/*.test.mjs",
@@ -175,7 +177,9 @@
     "pack:check": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
     "bridge:v4:build": "node scripts/v4-bridge-bootstrap.mjs build",
     "bridge:v4:run": "node scripts/v4-bridge-bootstrap.mjs run",
-    "bridge:v4:evidence": "node scripts/v4-bridge-evidence.mjs"
+    "bridge:v4:evidence": "node scripts/v4-bridge-evidence.mjs",
+    "check:v4-contracts:rust": "cargo fmt --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-v4-contracts/Cargo.toml",
+    "generate:workflows": "node scripts/generate-workflow-taxonomy.mjs"
   },
   "devDependencies": {
     "ajv": "8.17.1",

package/packages/core/artifact-verification-envelope.js

@@ -417,7 +417,7 @@ function kfdBindingBody({ manifest, manifestGate, legacyProjection, paths }) {
       gatePath: paths.gate,
       gateRoot: manifestGate.gateRoot,
     },
-    source: jsonClone(manifestGate.source),
+    adopter: jsonClone(manifestGate.adopter), source: jsonClone(manifestGate.source),
     standardPackage: jsonClone(manifestGate.standardPackage),
     witness: {
       decisionRoot: manifestGate.decisionWitness.root,
@@ -445,10 +445,10 @@ export function createKfdAdopterReleaseBinding({
   manifestPath = "kfd-adopter-manifest.json",
   gatePath = "kfd-adopter-manifest-gate.json",
   legacyProjectionPath = "kfd-support.json",
-  expectedSourceSha = "",
+  expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "",
 } = {}) {
   const gate = validateKfdAdopterManifestGate(manifestGate, {
-    expectedSourceSha,
+    expectedAdopterId, expectedSourceRepository, expectedSourceSha,
     checkedAt: manifestGate?.checkedAt,
   });
   const legacy = validateKfdLegacySupportMatrixProjection(legacyProjection, { manifest, manifestGate });
@@ -468,7 +468,7 @@ export function validateKfdAdopterReleaseBinding(binding, {
   manifest,
   manifestGate,
   legacyProjection,
-  expectedSourceSha = "",
+  expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "",
 } = {}) {
   const issues = [];
   if (!binding || binding.schemaVersion !== 1 || binding.contract !== KFD_ADOPTER_RELEASE_BINDING_CONTRACT) {
@@ -488,7 +488,7 @@ export function validateKfdAdopterReleaseBinding(binding, {
       manifestPath: binding.authority?.manifestPath,
       gatePath: binding.authority?.gatePath,
       legacyProjectionPath: binding.legacyProjection?.path,
-      expectedSourceSha,
+      expectedAdopterId, expectedSourceRepository, expectedSourceSha,
     });
     if (stableJson(binding) !== stableJson(expected)) {
       issues.push({ code: "adopter-release-binding-drift", path: "", message: "release binding differs from the exact manifest, gate, or legacy projection closure" });

package/packages/core/buildchain-contract.js

@@ -833,7 +833,7 @@ export function createBuildchainContractWorld({
       breakingDefaults: {
         evidenceContract: "buildchain.controller-evidence/v1",
         descriptorVersion: descriptor.version,
-        workflowPath: descriptor.workflow.path,
+        workflowPath: descriptor.workflow.contractPath || descriptor.workflow.path,
         requiredStages: descriptor.expected.stages.filter((stage) => stage.required).map((stage) => stage.id),
         capabilities: descriptor.expected.capabilities,
         evidenceRequirements: descriptor.expected.evidence,

package/packages/core/buildchain-kfd-claims.js

@@ -58,7 +58,7 @@ const WORKFLOW_AND_ACTION_FILES = Object.freeze([
   ".github/workflows/.build.yml",
   ".github/workflows/.release-candidate-promote.yml",
   ".github/workflows/release-candidate-promote.yml",
-  ".github/workflows/buildchain-ref-promotion.yml",
+  ".github/workflows/self-release-promote.yml",
   ".github/workflows/github-artifact-attestation.yml",
   "actions/github-artifact-attestation/action.yml",
   "actions/github-artifact-attestation/index.js",
@@ -446,7 +446,7 @@ export function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}
     {
       name: "Buildchain standalone binary distribution",
       artifactPath: "dist/binary",
-      evidencePath: ".github/workflows/binary-distribution.yml",
+      evidencePath: ".github/workflows/self-build-binary-distribution.yml",
       distribution: normalizeKfd3DistributionDeclaration({
         registrar: "shifu",
         tasks: ["binary:build"],

package/packages/core/buildchain-publication-authority.js

@@ -10,41 +10,40 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/.release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/.publication-authority.yml", "evidence-publication"],
   [".github/workflows/.release-verify.yml", "governance-write"],
-  [".github/workflows/.sam-release.yml", "retired-deny"],
   [".github/workflows/.sam-verify.yml", "retired-deny"],
   [".github/workflows/.sync-remote-git.yml", "governance-write"],
   [".github/workflows/.web-surface.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/.wheel-release.yml", "retired-deny"],
   [".github/workflows/.wheel-verify.yml", "retired-deny"],
   [".github/workflows/.binary-release-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
-  [".github/workflows/binary-distribution.yml", "evidence-publication"],
-  [".github/workflows/binary-release-assets.yml", "governance-write"],
+  [".github/workflows/self-build-binary-distribution.yml", "evidence-publication"],
+  [".github/workflows/self-release-binary-assets.yml", "governance-write"],
   [".github/workflows/artifact-signing-authority.yml", "evidence-publication"],
-  [".github/workflows/auditable-demo.yml", "governance-write"],
-  [".github/workflows/build-surface-fixture.yml", "non-publication-oidc"],
+  [".github/workflows/self-build-demo-dogfood.yml", "governance-write"],
+  [".github/workflows/self-build-fixture.yml", "non-publication-oidc"],
   [".github/workflows/build.yml", "non-publication-oidc"],
-  [".github/workflows/buildchain-alpha-self-dogfood.yml", "non-publication-oidc"],
-  [".github/workflows/buildchain-dev-delivery.yml", "governance-write"],
-  [".github/workflows/buildchain-patrol-daily.yml", "governance-write"],
-  [".github/workflows/buildchain-patrol-monthly.yml", "governance-write"],
-  [".github/workflows/buildchain-patrol-weekly.yml", "governance-write"],
+  [".github/workflows/bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/self-build-alpha-dogfood.yml", "non-publication-oidc"],
+  [".github/workflows/self-ops-dev-delivery.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-daily.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-monthly.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-weekly.yml", "governance-write"],
   [".github/workflows/buildchain-patrol.yml", "governance-write"],
-  [".github/workflows/buildchain-ref-promotion-recovery.yml", "governance-write"],
-  [".github/workflows/buildchain-ref-promotion.yml", "governance-write"],
-  [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
+  [".github/workflows/self-ops-promotion-recovery.yml", "governance-write"],
+  [".github/workflows/self-release-promote.yml", "governance-write"],
+  [".github/workflows/self-ops-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-qualification-patrol.yml", "governance-write"],
   [".github/workflows/dev-alpha-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-delivery-warrant-close.yml", "governance-write"],
   [".github/workflows/dev-delivery-warrant-cancel.yml", "governance-write"],
-  [".github/workflows/dev-merge-queue-governance.yml", "governance-write"],
+  [".github/workflows/self-ops-merge-queue.yml", "governance-write"],
   [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
-  [".github/workflows/engineering-housekeeper-daily.yml", "governance-write"],
-  [".github/workflows/engineering-housekeeper-monthly.yml", "governance-write"],
-  [".github/workflows/engineering-housekeeper-weekly.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-daily.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-monthly.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-weekly.yml", "governance-write"],
   [".github/workflows/engineering-housekeeper.yml", "governance-write"],
-  [".github/workflows/github-governance-audit.yml", "governance-write"],
+  [".github/workflows/self-ops-governance-audit.yml", "governance-write"],
   [".github/workflows/github-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/npm-publish.yml", "dry-run-only"],
+  [".github/workflows/self-release-npm-dry-run.yml", "dry-run-only"],
   [".github/workflows/paper-release-sealed.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/paper-release.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/patrol-daily.yml", "governance-write"],
@@ -53,16 +52,18 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/patrol-weekly.yml", "governance-write"],
   [".github/workflows/publication-artifact.yml", "evidence-publication"],
   [".github/workflows/release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
-  [".github/workflows/release-line-bootstrap.yml", "governance-write"],
+  [".github/workflows/self-release-line-open.yml", "governance-write"],
   [".github/workflows/release-propagation.yml", "governance-write"],
   [".github/workflows/release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
-  [".github/workflows/release-verify.yml", "governance-write"],
+  [".github/workflows/self-build-release-verify-compat.yml", "governance-write"],
   [".github/workflows/stable-candidate-patrol.yml", "governance-write"],
-  [".github/workflows/v4-declarative-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
+  [".github/workflows/universal-bootstrap-recovery.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/self-ops-bootstrap-dogfood.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/self-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
 ]);
 
-export function buildchainPublicationAuthorityDescriptors() {
-  return DESCRIPTORS.map(([
+export function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) {
+  const descriptors = DESCRIPTORS.map(([
     workflowPath,
     authorityClass,
     publicationCapable = false,
@@ -84,6 +85,21 @@ export function buildchainPublicationAuthorityDescriptors() {
     environmentMode,
     runnerPolicy: publicationCapable ? "qualified-measured" : "unqualified",
   }));
+  const taxonomyPath = path.join(root, "architecture/workflow-taxonomy.json");
+  if (!fs.existsSync(taxonomyPath)) return descriptors;
+  const taxonomy = JSON.parse(fs.readFileSync(taxonomyPath, "utf8"));
+  for (const entry of taxonomy.entries) {
+    if (!entry.compatibility) continue;
+    const previous = descriptors.find((item) => item.workflowPath === entry.compatibility.path);
+    if (!previous) continue;
+    const prefix = entry.role === "component" ? "." : `${entry.role}-`;
+    const workflowPath = `.github/workflows/${prefix}${entry.category}-${entry.purpose}.yml`;
+    if (fs.readFileSync(path.join(root, workflowPath), "utf8") !== fs.readFileSync(path.join(root, entry.compatibility.path), "utf8")) {
+      throw new Error(`publication authority alias differs from canonical workflow: ${workflowPath}`);
+    }
+    descriptors.push({ ...previous, workflowPath, publisherWorkflowPath: previous.publisherWorkflowPath === previous.workflowPath ? workflowPath : previous.publisherWorkflowPath });
+  }
+  return descriptors;
 }
 export function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) {
   const workflowsDir = path.join(root, ".github", "workflows");
@@ -94,7 +110,7 @@ export function createBuildchainPublicationAuthorityRegistry({ root = process.cw
       text: fs.readFileSync(path.join(workflowsDir, name), "utf8"),
     }));
   return createPublicationAuthorityRegistry({
-    descriptors: buildchainPublicationAuthorityDescriptors(),
+    descriptors: buildchainPublicationAuthorityDescriptors({ root }),
     workflows,
   });
 }

package/packages/core/ci-lane-change-budget.js

@@ -10,6 +10,7 @@ const AUTHORITY_CLASSES = new Set([
   "post-merge-advisory",
   "diagnostic",
   "evidence",
+  "governed-delegation",
   "release",
 ]);
 const TRIGGER_CLASSES = new Set([
@@ -196,7 +197,19 @@ export function evaluateCiLaneChangeBudget({
   }
   const declarations = new Map();
   const diagnostics = [];
-  for (const declaration of policy.declarations || []) {
+  const familyDeclarations = (policy.declarationFamilies || []).flatMap(
+    ({ laneIds, ...declaration }) => {
+      if (!Array.isArray(laneIds) || laneIds.length === 0)
+        throw new Error("CI lane declaration family requires laneIds");
+      if (new Set(laneIds).size !== laneIds.length)
+        throw new Error("CI lane declaration family laneIds must be unique");
+      return laneIds.map((laneId) => ({ ...declaration, laneId }));
+    },
+  );
+  for (const declaration of [
+    ...(policy.declarations || []),
+    ...familyDeclarations,
+  ]) {
     const laneId = String(declaration?.laneId || "").trim();
     if (!laneId) throw new Error("CI lane declaration laneId is required");
     if (declarations.has(laneId))

package/packages/core/controller-evidence.js

@@ -196,6 +196,9 @@ function descriptorDigest(descriptor) {
 
 export function createControllerRegistry({ workflows = [] } = {}) {
   const workflowById = new Map(workflows.map((entry) => [entry.id, entry]));
+  for (const entry of workflows) {
+    if (entry.taxonomy && !entry.taxonomy.compatibilityAlias && !workflowById.has(entry.taxonomy.id)) workflowById.set(entry.taxonomy.id, entry);
+  }
   const controllers = CONTROLLER_SPECS.map((spec) => {
     const workflow = workflowById.get(spec.workflowId);
     if (!workflow) throw new Error(`controller ${spec.id} requires workflow descriptor ${spec.workflowId}`);
@@ -215,7 +218,7 @@ export function createControllerRegistry({ workflows = [] } = {}) {
       contract: BUILDCHAIN_CONTROLLER_DESCRIPTOR_CONTRACT,
       id: spec.id,
       version: spec.version,
-      workflow: { id: workflow.id, path: workflow.path },
+      workflow: { id: workflow.id, path: workflow.path, ...(workflow.taxonomy?.contractPath ? { contractPath: workflow.taxonomy.contractPath } : {}) },
       inputs,
       expected: {
         stages: spec.stages.map((id) => ({ id, required: !optionalStages.has(id) })),