@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.2

package/architecture/v4-stable-publication-fence.json

@@ -10,7 +10,7 @@
     "productionWriterCount": 1,
     "fenceAuthority": "rust-v4-core",
     "fenceWriterCount": 1,
-    "typescript": "byte-equivalent-provider-adapter",
+    "typescript": "wasm-calling-provider-adapter",
     "candidateSelfQualification": false,
     "productionWriteChange": true
   },
@@ -29,7 +29,10 @@
   "publicationTargets": ["stable-ref", "npm-tag", "oci-tag", "github-release"],
   "implementations": {
     "rustDomain": "crates/buildchain-v4-contracts/src/stable_publication_fence.rs",
-    "typescript": "packages/core/v4-stable-publication-fence.js"
+    "typescript": "packages/core/v4-stable-publication-fence.js",
+    "wasmRuntime": "packages/core/v4-domain-wasm.js",
+    "wasmArtifact": "packages/core/buildchain-v4-domain.wasm",
+    "artifactMetadata": "packages/core/v4-domain-wasm-artifact.js"
   },
   "roots": [
     "stable-publication-candidate",

package/architecture/v4-stage-capsule-qualification.json

@@ -24,8 +24,8 @@
     ]
   },
   "publicConsumerDogfood": {
-    "callerWorkflow": ".github/workflows/v4-public-consumer-dogfood.yml",
-    "reusableWorkflow": "kungfu-systems/buildchain/.github/workflows/v4-stage-capsule-canary.yml",
+    "callerWorkflow": ".github/workflows/self-build-public-consumer-dogfood.yml",
+    "reusableWorkflow": "kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml",
     "validationRef": "v4-alpha",
     "invocation": "workflow_call",
     "runtimeBinding": "job.workflow_sha",

package/architecture/v4-tail-reseal-parity.json

@@ -10,7 +10,7 @@
   },
   "target": {
     "branch": "dev/v4/v4.0",
-    "publicReusableWorkflow": "kungfu-systems/buildchain/.github/workflows/v4-tail-reseal.yml@v4-alpha",
+    "publicReusableWorkflow": "kungfu-systems/buildchain/.github/workflows/public-ops-tail-reseal.yml@v4-alpha",
     "requestSchema": "contracts/v4-tail-reseal-v1.schema.json",
     "planner": "packages/core/v4-tail-reseal.js",
     "admission": "packages/core/v4-tail-reseal-github.js",
@@ -57,7 +57,7 @@
       "disposition": "implemented",
       "implementationEvidence": [
         "scripts/v4-tail-reseal.mjs",
-        ".github/workflows/v4-tail-reseal.yml"
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
       "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
     },
@@ -84,7 +84,7 @@
       "disposition": "implemented",
       "implementationEvidence": [
         "packages/core/v4-tail-reseal.js",
-        ".github/workflows/v4-tail-reseal.yml"
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
       "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
     },
@@ -111,7 +111,7 @@
       "disposition": "implemented",
       "implementationEvidence": [
         "packages/core/v4-tail-reseal-receipt.js",
-        ".github/workflows/v4-tail-reseal.yml"
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
       "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
     },
@@ -119,7 +119,9 @@
       "id": "TR-10",
       "claim": "The reusable workflow resolves job.workflow_sha as runtime evidence and exposes no persisted SHA, variable indirection or private self-dogfood path.",
       "disposition": "implemented",
-      "implementationEvidence": [".github/workflows/v4-tail-reseal.yml"],
+      "implementationEvidence": [
+        ".github/workflows/public-ops-tail-reseal.yml"
+      ],
       "verificationEvidence": ["tests/v4-tail-reseal-parity.test.mjs"]
     },
     {
@@ -146,5 +148,5 @@
       "verificationEvidence": []
     }
   ],
-  "matrixRoot": "sha256:126ec51c12a9dedeb9b9e187202781e3895856af1927b399ba3902f3940750ad"
+  "matrixRoot": "sha256:dc8d99f2e90473abde7a04c02300e7bfd0b48a2ff187e99fae0bc090ff2a855d"
 }

package/architecture/v4-universal-workflow-bootstrap.json

@@ -0,0 +1,171 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-bootstrap/v1",
+  "status": "migration-active",
+  "bootstrap": {
+    "publicWorkflow": ".github/workflows/bootstrap.yml",
+    "requestSchema": "kungfu-buildchain-v4-universal-workflow-request/v1",
+    "admissionSchema": "kungfu-buildchain-v4-universal-workflow-admission/v1",
+    "terminalReceiptSchema": "kungfu-buildchain-v4-universal-workflow-terminal-receipt/v1",
+    "candidateRepository": "kungfu-systems/buildchain",
+    "candidateEnginePath": "scripts/v4-universal-workflow-engine.mjs",
+    "consumerTemplate": "templates/universal-buildchain-bootstrap.yml",
+    "consumerRecoveryTemplate": "templates/universal-buildchain-bootstrap-recovery.yml",
+    "consumerRecoveryWorkflow": ".github/workflows/universal-bootstrap-recovery.yml",
+    "consumerRecoveryMode": "separate-pre-positioned-consumer-owned-shell",
+    "recoveryDependsOnPublishedBuildchain": false,
+    "selfDogfoodWorkflow": ".github/workflows/self-ops-bootstrap-dogfood.yml",
+    "faultCampaign": "architecture/v4-universal-workflow-fault-campaign.json",
+    "discoveryRefExecutionAuthority": false,
+    "exactShaExecutionAuthority": true,
+    "consumerSourceMutationPerIncident": false,
+    "consumerAdmission": "verified-caller-exact-repository-workflow-and-source",
+    "reviewRuntimeBinding": "reviewed-head-or-protected-alpha-merge-to-exact-runtime",
+    "buildchainReleasePromotionPerIncident": false,
+    "selfDogfoodUsesPublicContract": true
+  },
+  "capabilityAdapters": [
+    {
+      "id": "bootstrap-conformance",
+      "execution": "exact-candidate-engine",
+      "payloadSchema": "kungfu-buildchain-v4-universal-bootstrap-conformance/v1",
+      "providerEffects": false
+    },
+    {
+      "id": "release-candidate-promote",
+      "execution": "exact-candidate-action-and-provider-readback",
+      "payloadSchema": "kungfu-buildchain-v4-universal-release-promotion/v1",
+      "providerEffects": true
+    },
+    {
+      "id": "release-invocation",
+      "execution": "exact-candidate-canonical-projection",
+      "payloadSchema": "kungfu-buildchain-v4-release-invocation/v1",
+      "providerEffects": false
+    }
+  ],
+  "complexityBudget": {
+    "bootstrapAbis": 1,
+    "requestEnvelopes": 1,
+    "candidateResolvers": 1,
+    "candidateEngines": 1,
+    "terminalReceiptAuthorities": 1,
+    "perWorkflowBootstrapImplementations": 0,
+    "buildchainOnlySelfReleasePaths": 0,
+    "perIncidentConsumerEdits": 0
+  },
+  "permissionCeiling": {
+    "actions": "write",
+    "artifact-metadata": "write",
+    "attestations": "write",
+    "checks": "write",
+    "contents": "write",
+    "deployments": "write",
+    "id-token": "write",
+    "issues": "write",
+    "packages": "write",
+    "pages": "write",
+    "pull-requests": "write",
+    "security-events": "write",
+    "statuses": "write"
+  },
+  "inventoryWorkflows": [
+    ".github/workflows/.auditable-demo.yml",
+    ".github/workflows/.binary-release-assets.yml",
+    ".github/workflows/.build.yml",
+    ".github/workflows/.bump-minor-version.yml",
+    ".github/workflows/.declarative-auditable-demo.yml",
+    ".github/workflows/.gate-profile.yml",
+    ".github/workflows/.publication-authority.yml",
+    ".github/workflows/.release-candidate-promote.yml",
+    ".github/workflows/.release-verify.yml",
+    ".github/workflows/.sam-verify.yml",
+    ".github/workflows/.sync-release-page.yml",
+    ".github/workflows/.sync-remote-git.yml",
+    ".github/workflows/.web-surface.yml",
+    ".github/workflows/.wheel-verify.yml",
+    ".github/workflows/bootstrap.yml",
+    ".github/workflows/build.yml",
+    ".github/workflows/buildchain-patrol.yml",
+    ".github/workflows/check.yml",
+    ".github/workflows/dev-alpha-candidate-patrol.yml",
+    ".github/workflows/dev-delivery-warrant-cancel.yml",
+    ".github/workflows/dev-delivery-warrant-close.yml",
+    ".github/workflows/dev-pr-auto-merge.yml",
+    ".github/workflows/dev-qualification-patrol.yml",
+    ".github/workflows/engineering-housekeeper.yml",
+    ".github/workflows/github-artifact-attestation.yml",
+    ".github/workflows/paper-release-sealed.yml",
+    ".github/workflows/paper-release.yml",
+    ".github/workflows/patrol-daily.yml",
+    ".github/workflows/patrol-monthly.yml",
+    ".github/workflows/patrol-observed-evidence.yml",
+    ".github/workflows/patrol-weekly.yml",
+    ".github/workflows/publication-artifact.yml",
+    ".github/workflows/release-candidate-promote.yml",
+    ".github/workflows/release-governance-reconcile.yml",
+    ".github/workflows/release-propagation.yml",
+    ".github/workflows/release-tail.yml",
+    ".github/workflows/stable-candidate-patrol.yml",
+    ".github/workflows/universal-bootstrap-recovery.yml",
+    ".github/workflows/v4-adopter-delivery.yml",
+    ".github/workflows/v4-stage-capsule-canary.yml",
+    ".github/workflows/v4-tail-reseal.yml"
+  ],
+  "retiredWorkflowSurfaces": [],
+  "bootstrapGovernedWorkflows": [
+    ".github/workflows/.auditable-demo.yml",
+    ".github/workflows/.binary-release-assets.yml",
+    ".github/workflows/.build.yml",
+    ".github/workflows/.bump-minor-version.yml",
+    ".github/workflows/.declarative-auditable-demo.yml",
+    ".github/workflows/.gate-profile.yml",
+    ".github/workflows/.publication-authority.yml",
+    ".github/workflows/.release-candidate-promote.yml",
+    ".github/workflows/.release-verify.yml",
+    ".github/workflows/.sam-verify.yml",
+    ".github/workflows/.sync-release-page.yml",
+    ".github/workflows/.sync-remote-git.yml",
+    ".github/workflows/.web-surface.yml",
+    ".github/workflows/.wheel-verify.yml",
+    ".github/workflows/bootstrap.yml",
+    ".github/workflows/build.yml",
+    ".github/workflows/buildchain-patrol.yml",
+    ".github/workflows/check.yml",
+    ".github/workflows/dev-alpha-candidate-patrol.yml",
+    ".github/workflows/dev-delivery-warrant-cancel.yml",
+    ".github/workflows/dev-delivery-warrant-close.yml",
+    ".github/workflows/dev-pr-auto-merge.yml",
+    ".github/workflows/dev-qualification-patrol.yml",
+    ".github/workflows/engineering-housekeeper.yml",
+    ".github/workflows/github-artifact-attestation.yml",
+    ".github/workflows/paper-release-sealed.yml",
+    ".github/workflows/paper-release.yml",
+    ".github/workflows/patrol-daily.yml",
+    ".github/workflows/patrol-monthly.yml",
+    ".github/workflows/patrol-observed-evidence.yml",
+    ".github/workflows/patrol-weekly.yml",
+    ".github/workflows/publication-artifact.yml",
+    ".github/workflows/release-candidate-promote.yml",
+    ".github/workflows/release-governance-reconcile.yml",
+    ".github/workflows/release-propagation.yml",
+    ".github/workflows/release-tail.yml",
+    ".github/workflows/stable-candidate-patrol.yml",
+    ".github/workflows/v4-adopter-delivery.yml",
+    ".github/workflows/v4-stage-capsule-canary.yml",
+    ".github/workflows/v4-tail-reseal.yml"
+  ],
+  "migration": {
+    "compatibilityFacadeGenerator": "scripts/generate-v4-universal-workflow-facades.mjs",
+    "facadeSourceRevision": "06a2d9f7d5753c5c9b2bf0e7f0e3220fc18cc183",
+    "channelGeneratedFacades": [
+      ".github/workflows/build.yml",
+      ".github/workflows/release-candidate-promote.yml"
+    ],
+    "staticBootstrap": "implemented",
+    "candidateEngine": "bounded-capability-adapters",
+    "compatibilityFacades": "generated-dual-path",
+    "externalConsumerDogfood": "public-consumer-three-platform-runtime-and-non-circular-recovery-hosted-proof-passed",
+    "buildchainSelfDogfood": "train-primary-and-consumer-recovery-three-pair-hosted-proof-passed",
+    "oldPathRetirement": "pending-protected-dev-integration"
+  }
+}

package/architecture/v4-universal-workflow-fault-campaign.json

@@ -0,0 +1,72 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-fault-campaign/v1",
+  "independentFaultsOnly": true,
+  "simultaneousPrimaryAndRecoveryFailureClaimed": false,
+  "externalBoundary": {
+    "id": "github-workflow-parser-or-service-unavailable",
+    "classification": "irreducible-external-availability",
+    "recovered": false
+  },
+  "faults": [
+    {
+      "id": "primary-facade",
+      "injectionTarget": "templates/universal-buildchain-bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "typed-input-adapter",
+      "injectionTarget": "packages/core/v4-universal-workflow-bootstrap.js",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
+    },
+    {
+      "id": "route-selector",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "ordinary-candidate-loader",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "router",
+      "injectionTarget": "packages/core/v4-release-invocation.js",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
+    },
+    {
+      "id": "action",
+      "injectionTarget": "actions/v4-release-candidate-promote/action.yml",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "actions/v4-release-candidate-promote/dist/index.js"
+    },
+    {
+      "id": "cli-runtime",
+      "injectionTarget": "scripts/v4-universal-workflow-engine.mjs",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/v4-universal-workflow-engine.mjs"
+    },
+    {
+      "id": "recovery-logic",
+      "injectionTarget": "templates/universal-buildchain-bootstrap-recovery.yml",
+      "recoveryRoute": "primary-bootstrap-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap.yml"
+    },
+    {
+      "id": "result-projection",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "self-dogfood-caller",
+      "injectionTarget": ".github/workflows/self-ops-bootstrap-dogfood.yml",
+      "recoveryRoute": "consumer-equivalent-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    }
+  ]
+}

package/architecture/v4-universal-workflow-train-admission.json

@@ -0,0 +1,40 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-admission-policy/v1",
+  "sourceRepository": "kungfu-systems/buildchain",
+  "consumerAdmission": "verified-caller",
+  "allowedCapabilities": [
+    "bootstrap-conformance",
+    "release-candidate-promote",
+    "release-invocation"
+  ],
+  "permissionCeiling": {
+    "actions": "write",
+    "artifact-metadata": "write",
+    "attestations": "write",
+    "checks": "write",
+    "contents": "write",
+    "deployments": "write",
+    "id-token": "write",
+    "issues": "write",
+    "packages": "write",
+    "pages": "write",
+    "pull-requests": "write",
+    "security-events": "write",
+    "statuses": "write"
+  },
+  "contractRoots": [
+    "sha256:1de4662862d6b519a115613d542891506e0b267a439219c9192ec515347d7b2a",
+    "sha256:38ab6e09aea11256a038c208b5e83dafc19cd740057e0eb90e1b1bd28175b067",
+    "sha256:4e1f0a8ae7b3f7651b16687d7cfab88a9622c5f88e04c82faf66769230ef595d",
+    "sha256:613b0803c29c86f0c6c90a3e0bebd9bcd0ba62dca9eae94afaab3abe869e0a47",
+    "sha256:65a0c2fc3faecaddf5076fff086b5d6e12eb9ba27796efc10aed19f2d93b9457",
+    "sha256:b94023c4abe4216765198adcaefb4825874a4d9053be096d35a53d6821128b52",
+    "sha256:ca0592275354f0690756e3f11accdd23615987827c346618c50c2e8a2807ad4d"
+  ],
+  "targetRef": "dev/v4/v4.0",
+  "allowedReviewers": ["kungfu-origin"],
+  "minimumApprovals": 1,
+  "requiredChecks": ["check"],
+  "validFrom": "2026-08-30T00:00:00.000Z",
+  "expiresAt": "2026-09-07T00:00:00.000Z"
+}