@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/architecture/{v4-tail-reseal-parity.json → tail-reseal-parity.json}

@@ -10,11 +10,11 @@
   },
   "target": {
     "branch": "dev/v4/v4.0",
-    "publicReusableWorkflow": "kungfu-systems/buildchain/.github/workflows/v4-tail-reseal.yml@v4-alpha",
+    "publicReusableWorkflow": "kungfu-systems/buildchain/.github/workflows/public-ops-tail-reseal.yml@v4-alpha",
     "requestSchema": "contracts/v4-tail-reseal-v1.schema.json",
-    "planner": "packages/core/v4-tail-reseal.js",
-    "admission": "packages/core/v4-tail-reseal-github.js",
-    "receipt": "packages/core/v4-tail-reseal-receipt.js",
+    "planner": "packages/core/tail-reseal.js",
+    "admission": "packages/core/tail-reseal-github.js",
+    "receipt": "packages/core/tail-reseal-receipt.js",
     "cli": "buildchain tail-reseal"
   },
   "authority": {
@@ -35,8 +35,8 @@
       "id": "TR-01",
       "claim": "The exact captured v3 retained-candidate script, workflow and tests are rooted as parity authority.",
       "disposition": "implemented",
-      "implementationEvidence": ["architecture/v4-tail-reseal-parity.json"],
-      "verificationEvidence": ["tests/v4-tail-reseal-parity.test.mjs"]
+      "implementationEvidence": ["architecture/tail-reseal-parity.json"],
+      "verificationEvidence": ["tests/tail-reseal-parity.test.mjs"]
     },
     {
       "id": "TR-02",
@@ -44,11 +44,11 @@
       "disposition": "implemented",
       "implementationEvidence": [
         "contracts/v4-tail-reseal-v1.schema.json",
-        "packages/core/v4-tail-reseal-github.js"
+        "packages/core/tail-reseal-github.js"
       ],
       "verificationEvidence": [
         "contracts/fixtures/v4-tail-reseal-v1/valid.json",
-        "tests/v4-tail-reseal.test.mjs"
+        "tests/tail-reseal.test.mjs"
       ]
     },
     {
@@ -56,71 +56,73 @@
       "claim": "A fresh runner downloads retained archives and verifies every manifest and payload byte before any tail effect.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "scripts/v4-tail-reseal.mjs",
-        ".github/workflows/v4-tail-reseal.yml"
+        "scripts/tail-reseal.mjs",
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
-      "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
+      "verificationEvidence": ["tests/tail-reseal.test.mjs"]
     },
     {
       "id": "TR-04",
       "claim": "Install, build, verify, package and platform-matrix remain explicitly skipped under effect-free Stage Capsule reuse.",
       "disposition": "implemented",
-      "implementationEvidence": ["packages/core/v4-tail-reseal.js"],
-      "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
+      "implementationEvidence": ["packages/core/tail-reseal.js"],
+      "verificationEvidence": ["tests/tail-reseal.test.mjs"]
     },
     {
       "id": "TR-05",
       "claim": "Only macOS signing-finalization may change bytes; every other platform stays byte-identical and provider-effect-free.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/v4-tail-reseal-receipt.js",
-        "scripts/v4-tail-reseal.mjs"
+        "packages/core/tail-reseal-receipt.js",
+        "scripts/tail-reseal.mjs"
       ],
-      "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
+      "verificationEvidence": ["tests/tail-reseal.test.mjs"]
     },
     {
       "id": "TR-06",
       "claim": "The macOS effect is fenced by exact Warrant lineage, credential authority, release-tail transaction and idempotency key.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/v4-tail-reseal.js",
-        ".github/workflows/v4-tail-reseal.yml"
+        "packages/core/tail-reseal.js",
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
-      "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
+      "verificationEvidence": ["tests/tail-reseal.test.mjs"]
     },
     {
       "id": "TR-07",
       "claim": "Source, platform, archive, manifest, signer, Warrant, credential, retention and prior-failure drift fails closed.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/v4-tail-reseal.js",
-        "packages/core/v4-tail-reseal-github.js"
+        "packages/core/tail-reseal.js",
+        "packages/core/tail-reseal-github.js"
       ],
-      "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
+      "verificationEvidence": ["tests/tail-reseal.test.mjs"]
     },
     {
       "id": "TR-08",
       "claim": "Expired retention or credential leases invalidate reuse and require a normal candidate rebuild.",
       "disposition": "implemented",
-      "implementationEvidence": ["packages/core/v4-tail-reseal.js"],
-      "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
+      "implementationEvidence": ["packages/core/tail-reseal.js"],
+      "verificationEvidence": ["tests/tail-reseal.test.mjs"]
     },
     {
       "id": "TR-09",
       "claim": "Successful reseal emits the ordinary v4 Release Candidate Passport with its original floating-consumer policy receipt.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/v4-tail-reseal-receipt.js",
-        ".github/workflows/v4-tail-reseal.yml"
+        "packages/core/tail-reseal-receipt.js",
+        ".github/workflows/public-ops-tail-reseal.yml"
       ],
-      "verificationEvidence": ["tests/v4-tail-reseal.test.mjs"]
+      "verificationEvidence": ["tests/tail-reseal.test.mjs"]
     },
     {
       "id": "TR-10",
       "claim": "The reusable workflow resolves job.workflow_sha as runtime evidence and exposes no persisted SHA, variable indirection or private self-dogfood path.",
       "disposition": "implemented",
-      "implementationEvidence": [".github/workflows/v4-tail-reseal.yml"],
-      "verificationEvidence": ["tests/v4-tail-reseal-parity.test.mjs"]
+      "implementationEvidence": [
+        ".github/workflows/public-ops-tail-reseal.yml"
+      ],
+      "verificationEvidence": ["tests/tail-reseal-parity.test.mjs"]
     },
     {
       "id": "TR-11",
@@ -129,13 +131,13 @@
       "implementationEvidence": [
         "package.json",
         "bin/buildchain.mjs",
-        "scripts/v4-tail-reseal.mjs",
+        "scripts/tail-reseal.mjs",
         "docs/v4-tail-reseal.md"
       ],
       "verificationEvidence": [
         "tests/command-registry.test.mjs",
-        "tests/v4-tail-reseal.test.mjs",
-        "tests/v4-tail-reseal-parity.test.mjs"
+        "tests/tail-reseal.test.mjs",
+        "tests/tail-reseal-parity.test.mjs"
       ]
     },
     {
@@ -146,5 +148,5 @@
       "verificationEvidence": []
     }
   ],
-  "matrixRoot": "sha256:126ec51c12a9dedeb9b9e187202781e3895856af1927b399ba3902f3940750ad"
+  "matrixRoot": "sha256:f27988a8b5e954ad50eb773e64349559cbfb122d2e180c4845fd940ee1246e97"
 }

package/architecture/universal-workflow-bootstrap.json

@@ -0,0 +1,176 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-bootstrap/v1",
+  "status": "migration-active",
+  "bootstrap": {
+    "publicWorkflow": ".github/workflows/bootstrap.yml",
+    "requestSchema": "kungfu-buildchain-v4-universal-workflow-request/v1",
+    "admissionSchema": "kungfu-buildchain-v4-universal-workflow-admission/v1",
+    "terminalReceiptSchema": "kungfu-buildchain-v4-universal-workflow-terminal-receipt/v1",
+    "candidateRepository": "kungfu-systems/buildchain",
+    "candidateEnginePath": "scripts/universal-workflow-engine.mjs",
+    "consumerTemplate": "templates/universal-buildchain-bootstrap.yml",
+    "consumerRecoveryTemplate": "templates/universal-buildchain-bootstrap-recovery.yml",
+    "consumerRecoveryWorkflow": ".github/workflows/universal-bootstrap-recovery.yml",
+    "consumerRecoveryMode": "separate-pre-positioned-consumer-owned-shell",
+    "recoveryDependsOnPublishedBuildchain": false,
+    "selfDogfoodWorkflow": ".github/workflows/self-ops-bootstrap-dogfood.yml",
+    "faultCampaign": "architecture/universal-workflow-fault-campaign.json",
+    "discoveryRefExecutionAuthority": false,
+    "exactShaExecutionAuthority": true,
+    "consumerSourceMutationPerIncident": false,
+    "consumerAdmission": "verified-caller-exact-repository-workflow-and-source",
+    "reviewRuntimeBinding": "reviewed-head-or-protected-alpha-merge-to-exact-runtime",
+    "buildchainReleasePromotionPerIncident": false,
+    "selfDogfoodUsesPublicContract": true
+  },
+  "capabilityAdapters": [
+    {
+      "id": "bootstrap-conformance",
+      "execution": "exact-candidate-engine",
+      "payloadSchema": "kungfu-buildchain-v4-universal-bootstrap-conformance/v1",
+      "providerEffects": false
+    },
+    {
+      "id": "release-candidate-promote",
+      "execution": "exact-candidate-action-and-provider-readback",
+      "payloadSchema": "kungfu-buildchain-v4-universal-release-promotion/v1",
+      "providerEffects": true
+    },
+    {
+      "id": "release-invocation",
+      "execution": "exact-candidate-canonical-projection",
+      "payloadSchema": "kungfu-buildchain-v4-release-invocation/v1",
+      "providerEffects": false
+    }
+  ],
+  "complexityBudget": {
+    "bootstrapAbis": 1,
+    "requestEnvelopes": 1,
+    "candidateResolvers": 1,
+    "candidateEngines": 1,
+    "terminalReceiptAuthorities": 1,
+    "perWorkflowBootstrapImplementations": 0,
+    "buildchainOnlySelfReleasePaths": 0,
+    "perIncidentConsumerEdits": 0
+  },
+  "permissionCeiling": {
+    "actions": "write",
+    "artifact-metadata": "write",
+    "attestations": "write",
+    "checks": "write",
+    "contents": "write",
+    "deployments": "write",
+    "id-token": "write",
+    "issues": "write",
+    "packages": "write",
+    "pages": "write",
+    "pull-requests": "write",
+    "security-events": "write",
+    "statuses": "write"
+  },
+  "inventoryWorkflows": [
+    ".github/workflows/.auditable-demo.yml",
+    ".github/workflows/.binary-release-assets.yml",
+    ".github/workflows/.build.yml",
+    ".github/workflows/.bump-minor-version.yml",
+    ".github/workflows/.declarative-auditable-demo.yml",
+    ".github/workflows/.gate-profile.yml",
+    ".github/workflows/.publication-authority.yml",
+    ".github/workflows/.release-candidate-promote.yml",
+    ".github/workflows/.release-verify.yml",
+    ".github/workflows/.sam-verify.yml",
+    ".github/workflows/.sync-release-page.yml",
+    ".github/workflows/.sync-remote-git.yml",
+    ".github/workflows/.web-surface.yml",
+    ".github/workflows/.wheel-verify.yml",
+    ".github/workflows/bootstrap.yml",
+    ".github/workflows/build.yml",
+    ".github/workflows/buildchain-patrol.yml",
+    ".github/workflows/check.yml",
+    ".github/workflows/dev-alpha-candidate-patrol.yml",
+    ".github/workflows/dev-delivery-warrant-cancel.yml",
+    ".github/workflows/dev-delivery-warrant-close.yml",
+    ".github/workflows/dev-pr-auto-merge.yml",
+    ".github/workflows/dev-qualification-patrol.yml",
+    ".github/workflows/engineering-housekeeper.yml",
+    ".github/workflows/github-artifact-attestation.yml",
+    ".github/workflows/paper-release-sealed.yml",
+    ".github/workflows/paper-release.yml",
+    ".github/workflows/patrol-daily.yml",
+    ".github/workflows/patrol-monthly.yml",
+    ".github/workflows/patrol-observed-evidence.yml",
+    ".github/workflows/patrol-weekly.yml",
+    ".github/workflows/public-release-oci-compose-preview.yml",
+    ".github/workflows/publication-artifact.yml",
+    ".github/workflows/release-candidate-promote.yml",
+    ".github/workflows/release-governance-reconcile.yml",
+    ".github/workflows/release-propagation.yml",
+    ".github/workflows/release-tail.yml",
+    ".github/workflows/stable-candidate-patrol.yml",
+    ".github/workflows/universal-bootstrap-recovery.yml",
+    ".github/workflows/v4-adopter-delivery.yml",
+    ".github/workflows/v4-stage-capsule-canary.yml",
+    ".github/workflows/v4-tail-reseal.yml"
+  ],
+  "retiredWorkflowSurfaces": [],
+  "bootstrapGovernedWorkflows": [
+    ".github/workflows/.auditable-demo.yml",
+    ".github/workflows/.binary-release-assets.yml",
+    ".github/workflows/.build.yml",
+    ".github/workflows/.bump-minor-version.yml",
+    ".github/workflows/.declarative-auditable-demo.yml",
+    ".github/workflows/.gate-profile.yml",
+    ".github/workflows/.publication-authority.yml",
+    ".github/workflows/.release-candidate-promote.yml",
+    ".github/workflows/.release-verify.yml",
+    ".github/workflows/.sam-verify.yml",
+    ".github/workflows/.sync-release-page.yml",
+    ".github/workflows/.sync-remote-git.yml",
+    ".github/workflows/.web-surface.yml",
+    ".github/workflows/.wheel-verify.yml",
+    ".github/workflows/bootstrap.yml",
+    ".github/workflows/build.yml",
+    ".github/workflows/buildchain-patrol.yml",
+    ".github/workflows/check.yml",
+    ".github/workflows/dev-alpha-candidate-patrol.yml",
+    ".github/workflows/dev-delivery-warrant-cancel.yml",
+    ".github/workflows/dev-delivery-warrant-close.yml",
+    ".github/workflows/dev-pr-auto-merge.yml",
+    ".github/workflows/dev-qualification-patrol.yml",
+    ".github/workflows/engineering-housekeeper.yml",
+    ".github/workflows/github-artifact-attestation.yml",
+    ".github/workflows/paper-release-sealed.yml",
+    ".github/workflows/paper-release.yml",
+    ".github/workflows/patrol-daily.yml",
+    ".github/workflows/patrol-monthly.yml",
+    ".github/workflows/patrol-observed-evidence.yml",
+    ".github/workflows/patrol-weekly.yml",
+    ".github/workflows/public-release-oci-compose-preview.yml",
+    ".github/workflows/publication-artifact.yml",
+    ".github/workflows/release-candidate-promote.yml",
+    ".github/workflows/release-governance-reconcile.yml",
+    ".github/workflows/release-propagation.yml",
+    ".github/workflows/release-tail.yml",
+    ".github/workflows/stable-candidate-patrol.yml",
+    ".github/workflows/v4-adopter-delivery.yml",
+    ".github/workflows/v4-stage-capsule-canary.yml",
+    ".github/workflows/v4-tail-reseal.yml"
+  ],
+  "migration": {
+    "compatibilityFacadeGenerator": "scripts/generate-universal-workflow-facades.mjs",
+    "facadeSourceRevision": "06a2d9f7d5753c5c9b2bf0e7f0e3220fc18cc183",
+    "channelGeneratedFacades": [
+      ".github/workflows/build.yml",
+      ".github/workflows/release-candidate-promote.yml"
+    ],
+    "staticBootstrap": "implemented",
+    "candidateEngine": "bounded-capability-adapters",
+    "compatibilityFacades": "generated-dual-path",
+    "externalConsumerDogfood": "public-consumer-three-platform-runtime-and-non-circular-recovery-hosted-proof-passed",
+    "buildchainSelfDogfood": "train-primary-and-consumer-recovery-three-pair-hosted-proof-passed",
+    "oldPathRetirement": "pending-protected-dev-integration",
+    "postMigrationWorkflows": [
+      ".github/workflows/public-release-oci-compose-preview.yml"
+    ]
+  }
+}

package/architecture/universal-workflow-fault-campaign.json

@@ -0,0 +1,72 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-fault-campaign/v1",
+  "independentFaultsOnly": true,
+  "simultaneousPrimaryAndRecoveryFailureClaimed": false,
+  "externalBoundary": {
+    "id": "github-workflow-parser-or-service-unavailable",
+    "classification": "irreducible-external-availability",
+    "recovered": false
+  },
+  "faults": [
+    {
+      "id": "primary-facade",
+      "injectionTarget": "templates/universal-buildchain-bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "typed-input-adapter",
+      "injectionTarget": "packages/core/universal-workflow-bootstrap.js",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/universal-workflow-engine.mjs"
+    },
+    {
+      "id": "route-selector",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "ordinary-candidate-loader",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "router",
+      "injectionTarget": "packages/core/release-invocation.js",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/universal-workflow-engine.mjs"
+    },
+    {
+      "id": "action",
+      "injectionTarget": "actions/release-candidate-promote/action.yml",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "actions/release-candidate-promote/dist/index.js"
+    },
+    {
+      "id": "cli-runtime",
+      "injectionTarget": "scripts/universal-workflow-engine.mjs",
+      "recoveryRoute": "exact-train-candidate",
+      "recoveryTarget": "scripts/universal-workflow-engine.mjs"
+    },
+    {
+      "id": "recovery-logic",
+      "injectionTarget": "templates/universal-buildchain-bootstrap-recovery.yml",
+      "recoveryRoute": "primary-bootstrap-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap.yml"
+    },
+    {
+      "id": "result-projection",
+      "injectionTarget": ".github/workflows/bootstrap.yml",
+      "recoveryRoute": "pre-positioned-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    },
+    {
+      "id": "self-dogfood-caller",
+      "injectionTarget": ".github/workflows/self-ops-bootstrap-dogfood.yml",
+      "recoveryRoute": "consumer-equivalent-recovery-shell",
+      "recoveryTarget": "templates/universal-buildchain-bootstrap-recovery.yml"
+    }
+  ]
+}

package/architecture/universal-workflow-train-admission.json

@@ -0,0 +1,40 @@
+{
+  "schema": "kungfu-buildchain-v4-universal-workflow-admission-policy/v1",
+  "sourceRepository": "kungfu-systems/buildchain",
+  "consumerAdmission": "verified-caller",
+  "allowedCapabilities": [
+    "bootstrap-conformance",
+    "release-candidate-promote",
+    "release-invocation"
+  ],
+  "permissionCeiling": {
+    "actions": "write",
+    "artifact-metadata": "write",
+    "attestations": "write",
+    "checks": "write",
+    "contents": "write",
+    "deployments": "write",
+    "id-token": "write",
+    "issues": "write",
+    "packages": "write",
+    "pages": "write",
+    "pull-requests": "write",
+    "security-events": "write",
+    "statuses": "write"
+  },
+  "contractRoots": [
+    "sha256:19034e431506e219bec09851b0adb0e5ee6d1798528d2369f3f60b3f1bf2a8bf",
+    "sha256:20d48eff5e9eac02d552a1cbdb76f01e2b5addec798260ab43c0102ebf630f4b",
+    "sha256:348955860bd0c5f5486c48be2e6c8553b50afa0be96699eff1b3dba914e7f80d",
+    "sha256:5e922ecc5f5b7b17a67ccd73be1eb73ae9db886a9da439dbef942b5e2d80062b",
+    "sha256:b5d0050d17f2302e337dbbc9ad9bc07012d41b575cbca59123af5ae9df157579",
+    "sha256:bab725233283c317972f383bcdd7c72725a1b46d96aa732e117f042b4bd313e9",
+    "sha256:bbc0b1317f612b81ba3e462eab5a5ed2e0549ced6918fdc9b58b3dd14dc3db19"
+  ],
+  "targetRef": "dev/v4/v4.0",
+  "allowedReviewers": ["kungfu-origin"],
+  "minimumApprovals": 1,
+  "requiredChecks": ["check"],
+  "validFrom": "2026-08-30T00:00:00.000Z",
+  "expiresAt": "2026-09-15T00:00:00.000Z"
+}