@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (281) hide show
  1. package/AGENTS.md +14 -5
  2. package/CONTRIBUTING.md +58 -0
  3. package/README.md +3 -3
  4. package/actions/promote-buildchain-ref/README.md +1 -1
  5. package/actions/release-candidate-promote/README.md +31 -0
  6. package/architecture/agent-change-map.md +190 -126
  7. package/architecture/{v4-architecture-constitution.md → architecture-constitution.md} +33 -30
  8. package/architecture/{v3-core-mechanism-inventory.md → baseline-core-mechanism-inventory.md} +1 -1
  9. package/architecture/{v4-bootstrap-authority.json → bootstrap-authority.json} +3 -3
  10. package/architecture/{v3-v4-capability-closure.md → capability-parity-closure.md} +3 -3
  11. package/architecture/{v3-v4-live-capability-inventory.json → capability-parity-live-capability-inventory.json} +4 -4
  12. package/architecture/{v4-capability-state-machine-manifest.json → capability-state-machine-manifest.json} +2 -2
  13. package/architecture/{v4-capability-state-machine-manifest.schema.json → capability-state-machine-manifest.schema.json} +2 -2
  14. package/architecture/ci-lane-change-budget.json +384 -0
  15. package/architecture/{v4-cross-platform-adopter-qualification.json → cross-platform-adopter-qualification.json} +4 -4
  16. package/architecture/{v4-delivery-authority-parity.json → delivery-authority-parity.json} +17 -17
  17. package/architecture/{v4-delivery-warrant-shadow-bootstrap-plan.json → delivery-warrant-shadow-bootstrap-plan.json} +4 -4
  18. package/architecture/{v4-delivery-warrant-shadow-bootstrap-plan.md → delivery-warrant-shadow-bootstrap-plan.md} +7 -7
  19. package/architecture/{v4-floating-consumer-policy.json → floating-consumer-policy.json} +2 -2
  20. package/architecture/{v4-floating-consumer-policy.md → floating-consumer-policy.md} +1 -1
  21. package/architecture/implementation-naming.json +1273 -0
  22. package/architecture/internal-capabilities.json +201 -154
  23. package/architecture/maintainability-debt.json +205 -146
  24. package/architecture/maintainability-policy.json +37 -33
  25. package/architecture/{v4-next-development-parity.json → next-development-parity.json} +12 -12
  26. package/architecture/{v4-partial-mutation-recovery-qualification.json → partial-mutation-recovery-qualification.json} +8 -5
  27. package/architecture/{v4-platform-stage-checkpoints.json → platform-stage-checkpoints.json} +3 -3
  28. package/architecture/{v4-provider-operation-journal-contract.json → provider-operation-journal-contract.json} +10 -7
  29. package/architecture/publication-facade-patches.json +64 -0
  30. package/architecture/{v4-publication-rehearsal-parity.json → publication-rehearsal-parity.json} +4 -4
  31. package/architecture/{v4-release-activation-shadow-domain.json → release-activation-shadow-domain.json} +9 -6
  32. package/architecture/release-tail-contract-inventory.json +6 -6
  33. package/architecture/{v4-release-topology.json → release-topology.json} +163 -72
  34. package/architecture/{v4-release-train-parity.json → release-train-parity.json} +2 -2
  35. package/architecture/{v4-runtime-ref-resume-authority.json → runtime-ref-resume-authority.json} +1 -1
  36. package/architecture/{v4-runtime-semantic-closure.json → runtime-semantic-closure.json} +2 -2
  37. package/architecture/{v4-rust-libnode-bridge-evaluation.json → rust-libnode-bridge-evaluation.json} +3 -3
  38. package/architecture/{v4-rust-libnode-bridge-spike.md → rust-libnode-bridge-spike.md} +6 -6
  39. package/architecture/rust-wasm-production-authority.json +58 -0
  40. package/architecture/{v4-stable-publication-fence.json → stable-publication-fence.json} +7 -4
  41. package/architecture/{v4-stage-capsule-contract.json → stage-capsule-contract.json} +1 -1
  42. package/architecture/{v4-stage-capsule-qualification.json → stage-capsule-qualification.json} +8 -8
  43. package/architecture/{v4-stage-capsule-resume-planner.json → stage-capsule-resume-planner.json} +2 -2
  44. package/architecture/{v4-stage-capsule-store-contract.json → stage-capsule-store-contract.json} +4 -4
  45. package/architecture/{v4-tail-reseal-parity.json → tail-reseal-parity.json} +35 -33
  46. package/architecture/universal-workflow-bootstrap.json +176 -0
  47. package/architecture/universal-workflow-fault-campaign.json +72 -0
  48. package/architecture/universal-workflow-train-admission.json +40 -0
  49. package/architecture/workflow-taxonomy.json +1462 -0
  50. package/bin/buildchain.mjs +10 -10
  51. package/bin/internal/adopter-delivery-cli.mjs +9 -9
  52. package/contracts/buildchain-v2-residuals-v1.json +57 -48
  53. package/contracts/dev-delivery-authority-v2.schema.json +16 -2
  54. package/contracts/fixtures/v4-tail-reseal-v1/valid.json +1 -1
  55. package/contracts/v4-canonical-contracts-v1.schema.json +1 -0
  56. package/crates/{buildchain-v4-bridge → buildchain-host-bridge}/Cargo.lock +1 -1
  57. package/crates/{buildchain-v4-bridge → buildchain-host-bridge}/Cargo.toml +1 -1
  58. package/crates/{buildchain-v4-bridge → buildchain-host-bridge}/src/main.rs +3 -3
  59. package/dist/site/buildchain-contract.json +98 -53
  60. package/dist/site/buildchain-site.json +351 -102
  61. package/dist/site/capability-registry.json +7 -7
  62. package/dist/site/controller-registry.json +50 -13
  63. package/dist/site/kfd-claims.json +2773 -1052
  64. package/dist/site/kfd-upstream-aggregate.json +1 -1
  65. package/dist/site/manual-registry.json +14 -14
  66. package/dist/site/node-api-registry.json +13176 -10733
  67. package/dist/site/page-registry.json +332 -83
  68. package/dist/site/public-surface-audit.json +3227 -1222
  69. package/dist/site/publication-authority-registry.json +1135 -363
  70. package/dist/site/publication-registry.json +4 -4
  71. package/dist/site/release-provenance.json +18 -9
  72. package/dist/site/schemas/dev-delivery-authority-v2.schema.json +16 -2
  73. package/dist/site/site-manifest.json +18 -18
  74. package/dist/site/workflow-registry.json +5367 -1931
  75. package/docs/MAP.md +5 -3
  76. package/docs/auditable-demo.md +1 -1
  77. package/docs/cli.md +21 -8
  78. package/docs/dev-delivery-warrant.md +1 -1
  79. package/docs/engineering-housekeeper.md +3 -3
  80. package/docs/kfd-support.md +26 -2
  81. package/docs/next-development-transition.md +26 -3
  82. package/docs/node-api-reference.md +618 -358
  83. package/docs/oci-publication.md +173 -0
  84. package/docs/publication-authority.md +2 -2
  85. package/docs/publish-transaction.md +36 -3
  86. package/docs/release-candidate.md +3 -3
  87. package/docs/release-flow.md +67 -19
  88. package/docs/release-governance.md +8 -8
  89. package/docs/release-passport.md +27 -2
  90. package/docs/reusable-build-surface.md +17 -1
  91. package/docs/v4-adopter-delivery.md +4 -4
  92. package/docs/v4-canonical-contracts.md +7 -7
  93. package/docs/v4-delivery-warrant-read-candidate.md +3 -3
  94. package/docs/v4-delivery-warrant-semantic-diff.md +3 -3
  95. package/docs/v4-production-release.md +77 -8
  96. package/docs/v4-publication-rehearsal.md +3 -3
  97. package/docs/v4-runtime-ref-resume-authority.md +2 -2
  98. package/docs/v4-rust-wasm-production-authority.md +58 -0
  99. package/docs/v4-stage-capsule.md +9 -9
  100. package/docs/v4-tail-reseal.md +2 -2
  101. package/docs/workflow-catalog.md +155 -0
  102. package/docs/workflow-path-migration.md +109 -0
  103. package/package.json +39 -24
  104. package/packages/compatibility/adopter-delivery.js +16 -0
  105. package/packages/compatibility/cross-platform-adopter-qualification.js +12 -0
  106. package/packages/compatibility/floating-consumer-policy.js +14 -0
  107. package/packages/compatibility/publication-qualification.js +11 -0
  108. package/packages/compatibility/publication-rehearsal.js +18 -0
  109. package/packages/compatibility/runtime-ref-resume-authority.js +13 -0
  110. package/packages/compatibility/tail-reseal-receipt.js +7 -0
  111. package/packages/compatibility/tail-reseal.js +11 -0
  112. package/packages/core/{v4-adopter-delivery-parity.js → adopter-delivery-parity.js} +12 -12
  113. package/packages/core/{v4-adopter-delivery.js → adopter-delivery.js} +24 -24
  114. package/packages/core/artifact-verification-envelope.js +5 -5
  115. package/packages/core/buildchain-contract.js +6 -6
  116. package/packages/core/buildchain-domain.wasm +0 -0
  117. package/packages/core/buildchain-kfd-claims.js +2 -2
  118. package/packages/core/buildchain-publication-authority.js +43 -26
  119. package/packages/core/{v4-canonical-contracts.js → canonical-contracts.js} +39 -103
  120. package/packages/core/ci-lane-change-budget.js +14 -1
  121. package/packages/core/controller-evidence.js +4 -1
  122. package/packages/core/{v4-cross-platform-adopter-qualification.js → cross-platform-adopter-qualification.js} +19 -19
  123. package/packages/core/{v4-delivery-warrant-fixture-runner.js → delivery-warrant-fixture-runner.js} +36 -32
  124. package/packages/core/{v4-delivery-warrant-read-candidate.js → delivery-warrant-read-candidate.js} +40 -40
  125. package/packages/core/{v4-delivery-warrant-semantic-diff-gate.js → delivery-warrant-semantic-diff-gate.js} +58 -59
  126. package/packages/core/{v4-delivery-warrant-shadow-adapter.js → delivery-warrant-shadow-adapter.js} +15 -15
  127. package/packages/core/dev-delivery-candidate-identity.js +40 -6
  128. package/packages/core/dev-delivery-execution-transfer.js +6 -6
  129. package/packages/core/dev-delivery-native-proof.js +12 -8
  130. package/packages/core/dev-delivery-warrant-legacy-recovery.js +1 -1
  131. package/packages/core/dev-delivery-warrant-native-compatibility.js +4 -4
  132. package/packages/core/dev-delivery-warrant-state.js +14 -15
  133. package/packages/core/dev-delivery-warrant.js +15 -5
  134. package/packages/core/domain-wasm-artifact.js +7 -0
  135. package/packages/core/domain-wasm.js +216 -0
  136. package/packages/core/{v4-floating-consumer-evidence.js → floating-consumer-evidence.js} +14 -14
  137. package/packages/core/{v4-floating-consumer-policy.js → floating-consumer-policy.js} +28 -30
  138. package/packages/core/{v4-floating-consumer-release-passport.js → floating-consumer-release-passport.js} +25 -25
  139. package/packages/core/github-governance-authority.js +4 -4
  140. package/packages/core/index.js +4 -8
  141. package/packages/core/kfd-adopter-manifest.js +46 -47
  142. package/packages/core/next-development-projection.js +26 -3
  143. package/packages/core/next-development-transition.js +5 -6
  144. package/packages/core/oci-compose-qualification.js +143 -0
  145. package/packages/core/oci-publication-bundle.js +281 -0
  146. package/packages/core/oci-publication-graph.js +206 -0
  147. package/packages/core/paper-agent-entry.js +30 -4
  148. package/packages/core/paper-fleet.js +1 -1
  149. package/packages/core/paper-runtime-channels.js +348 -0
  150. package/packages/core/paper-scaffold-content.js +10 -0
  151. package/packages/core/paper.js +37 -71
  152. package/packages/core/partial-mutation-recovery-qualification.js +18 -0
  153. package/packages/core/{v4-platform-stage-checkpoints.js → platform-stage-checkpoints.js} +37 -37
  154. package/packages/core/product-publication.js +59 -0
  155. package/packages/core/{v4-protected-publication-source.js → protected-publication-source.js} +22 -24
  156. package/packages/core/provider-operation-journal.js +62 -0
  157. package/packages/core/{v4-provider-readback-idempotency.js → provider-readback-idempotency.js} +40 -125
  158. package/packages/core/public-export-compatibility.js +33 -0
  159. package/packages/core/publication-development.js +72 -0
  160. package/packages/core/{v4-publication-qualification.js → publication-qualification.js} +17 -17
  161. package/packages/core/{v4-publication-rehearsal-capsule.js → publication-rehearsal-capsule.js} +23 -23
  162. package/packages/core/publication-rehearsal-projection.js +2 -2
  163. package/packages/core/{v4-publication-rehearsal-provider-bindings.js → publication-rehearsal-provider-bindings.js} +4 -4
  164. package/packages/core/publication-rehearsal-runtime.js +21 -21
  165. package/packages/core/{v4-publication-rehearsal.js → publication-rehearsal.js} +33 -33
  166. package/packages/core/publication-sealed-bundle.js +78 -13
  167. package/packages/core/release-activation-shadow.js +32 -0
  168. package/packages/core/release-candidate.js +6 -6
  169. package/packages/core/release-invocation.js +64 -0
  170. package/packages/core/release-line-dry-run.js +1 -1
  171. package/packages/core/release-passport-contract.js +5 -5
  172. package/packages/core/release-passport.js +41 -40
  173. package/packages/core/release-tail-product-capabilities.js +9 -0
  174. package/packages/core/release-tail-provider-plane.js +68 -1048
  175. package/packages/core/{v4-runtime-ref-resume-authority.js → runtime-ref-resume-authority.js} +36 -40
  176. package/packages/core/{v4-runtime-selector-persistence.js → runtime-selector-persistence.js} +7 -7
  177. package/packages/core/stable-publication-fence.js +28 -0
  178. package/packages/core/{v4-stage-capsule-local-store.js → stage-capsule-local-store.js} +56 -54
  179. package/packages/core/{v4-stage-capsule-qualification-campaign.js → stage-capsule-qualification-campaign.js} +37 -38
  180. package/packages/core/{v4-stage-capsule-qualification.js → stage-capsule-qualification.js} +28 -29
  181. package/packages/core/{v4-stage-capsule-resume-planner.js → stage-capsule-resume-planner.js} +29 -29
  182. package/packages/core/{v4-stage-capsule-store.js → stage-capsule-store.js} +59 -56
  183. package/packages/core/{v4-stage-capsule.js → stage-capsule.js} +45 -45
  184. package/packages/core/{v4-tail-reseal-contract.js → tail-reseal-contract.js} +6 -6
  185. package/packages/core/{v4-tail-reseal-github.js → tail-reseal-github.js} +12 -12
  186. package/packages/core/{v4-tail-reseal-receipt.js → tail-reseal-receipt.js} +22 -22
  187. package/packages/core/{v4-tail-reseal.js → tail-reseal.js} +29 -29
  188. package/packages/core/universal-workflow-bootstrap.js +586 -0
  189. package/scripts/{v4-architecture.mjs → architecture.mjs} +6 -6
  190. package/scripts/binary-publication-evidence.mjs +135 -0
  191. package/scripts/{v4-bridge-bootstrap.mjs → bridge-bootstrap.mjs} +14 -18
  192. package/scripts/{v4-bridge-evidence.mjs → bridge-evidence.mjs} +8 -8
  193. package/scripts/build-contract-core.mjs +1 -14
  194. package/scripts/build-domain-wasm.mjs +177 -0
  195. package/scripts/{v3-v4-capability-catalog.mjs → capability-parity-catalog.mjs} +19 -19
  196. package/scripts/check-action-bundles.mjs +12 -2
  197. package/scripts/{check-v3-v4-capability-inventory.mjs → check-capability-parity-inventory.mjs} +42 -42
  198. package/scripts/check-ci-lane-change-budget.mjs +4 -1
  199. package/scripts/check-core-mechanism-inventory.mjs +8 -4
  200. package/scripts/{check-v4-floating-consumer-policy-contract.mjs → check-floating-consumer-policy-contract.mjs} +10 -10
  201. package/scripts/check-implementation-naming.mjs +135 -0
  202. package/scripts/check-inventory.mjs +39 -47
  203. package/scripts/check-maintainability.mjs +25 -115
  204. package/scripts/{check-v4-public-dogfood-contract.mjs → check-public-dogfood-contract.mjs} +37 -24
  205. package/scripts/{check-v4-release-topology.mjs → check-release-topology.mjs} +131 -52
  206. package/scripts/{check-v4-runtime-semantic-closure.mjs → check-runtime-semantic-closure.mjs} +23 -17
  207. package/scripts/check-universal-workflow-bootstrap.mjs +266 -0
  208. package/scripts/check-workflow-taxonomy.mjs +6 -0
  209. package/scripts/{v4-consumer-policy.mjs → consumer-policy.mjs} +15 -15
  210. package/scripts/copy-domain-wasm.mjs +14 -0
  211. package/scripts/{v4-cross-platform-adopter-qualification.mjs → cross-platform-adopter-qualification.mjs} +9 -9
  212. package/scripts/{v4-declarative-promotion-admission.mjs → declarative-promotion-admission.mjs} +4 -4
  213. package/scripts/dev-delivery-authority-command-adapters.mjs +1 -1
  214. package/scripts/dev-delivery-authority.mjs +8 -8
  215. package/scripts/dev-delivery-source-proof-reuse.mjs +2 -1
  216. package/scripts/dev-delivery-warrant-options.mjs +15 -10
  217. package/scripts/dev-delivery-warrant-store.mjs +98 -13
  218. package/scripts/dev-delivery-warrant-transition.mjs +109 -0
  219. package/scripts/dev-delivery-warrant.mjs +80 -103
  220. package/scripts/dev-pr-auto-merge.mjs +15 -15
  221. package/scripts/dev-pr-delivery-warrant.mjs +1 -1
  222. package/scripts/generate-channel-build-workflow.mjs +7 -2
  223. package/scripts/generate-channel-promotion-workflow.mjs +19 -34
  224. package/scripts/generate-release-candidate-passport.mjs +23 -23
  225. package/scripts/generate-site-bundle.mjs +28 -28
  226. package/scripts/generate-universal-workflow-facades.mjs +498 -0
  227. package/scripts/generate-workflow-taxonomy.mjs +25 -0
  228. package/scripts/github-output.mjs +31 -0
  229. package/scripts/{v4-host-adapter.mjs → host-adapter.mjs} +1 -1
  230. package/scripts/implementation-references.mjs +25 -0
  231. package/scripts/init-repo.mjs +1 -1
  232. package/scripts/maintainability-metrics.mjs +16 -5
  233. package/scripts/maintainability-public-surface.mjs +115 -0
  234. package/scripts/next-development-review.mjs +313 -0
  235. package/scripts/oci-compose-preview.mjs +261 -0
  236. package/scripts/paper-work-fleet-cli.mjs +2 -0
  237. package/scripts/{v4-platform-stage-checkpoint-rehearsal.mjs → platform-stage-checkpoint-rehearsal.mjs} +17 -17
  238. package/scripts/{v4-product-publication-intent.mjs → product-publication-intent.mjs} +28 -13
  239. package/scripts/publication-candidate-kind.mjs +93 -0
  240. package/scripts/publication-candidate-sealer.mjs +16 -1
  241. package/scripts/{v4-publication-rehearsal-fixture.mjs → publication-rehearsal-fixture.mjs} +5 -5
  242. package/scripts/publication-settlement.mjs +211 -0
  243. package/scripts/release-asset-client.mjs +91 -0
  244. package/scripts/{v4-release-candidate-adapter.mjs → release-candidate-adapter.mjs} +4 -4
  245. package/scripts/release-candidate-resolver.mjs +24 -35
  246. package/scripts/release-tail.mjs +5 -5
  247. package/scripts/resume-from-candidate-run.mjs +35 -42
  248. package/scripts/site-capability-metadata.mjs +9 -0
  249. package/scripts/source-verification-evidence.mjs +344 -0
  250. package/scripts/stable-candidate-qualification.mjs +1 -1
  251. package/scripts/{v4-stage-capsule-qualification.mjs → stage-capsule-qualification.mjs} +62 -62
  252. package/scripts/{v4-stage-capsule-resume-rehearsal.mjs → stage-capsule-resume-rehearsal.mjs} +6 -6
  253. package/scripts/{v4-tail-reseal-macos-rehearsal.mjs → tail-reseal-macos-rehearsal.mjs} +9 -9
  254. package/scripts/{v4-tail-reseal.mjs → tail-reseal.mjs} +19 -19
  255. package/scripts/universal-facade-maintainability.mjs +91 -0
  256. package/scripts/universal-workflow-backflow.mjs +212 -0
  257. package/scripts/universal-workflow-engine.mjs +620 -0
  258. package/scripts/universal-workflow-self-dogfood.mjs +205 -0
  259. package/scripts/verify-version-state-delta.mjs +175 -0
  260. package/scripts/{v4-warrant-shadow-plan.mjs → warrant-shadow-plan.mjs} +6 -6
  261. package/scripts/workflow-taxonomy.mjs +507 -0
  262. package/templates/native-dev-delivery.yml +4 -7
  263. package/templates/universal-buildchain-bootstrap-recovery.yml +282 -0
  264. package/templates/universal-buildchain-bootstrap.yml +28 -0
  265. package/actions/v4-release-candidate-promote/README.md +0 -3
  266. package/packages/core/v4-partial-mutation-recovery-qualification.js +0 -395
  267. package/packages/core/v4-product-publication.js +0 -387
  268. package/packages/core/v4-provider-operation-journal.js +0 -531
  269. package/packages/core/v4-release-activation-shadow.js +0 -519
  270. package/packages/core/v4-release-invocation.js +0 -425
  271. package/packages/core/v4-stable-publication-fence.js +0 -357
  272. /package/architecture/{v4-adopter-delivery-parity.json → adopter-delivery-parity.json} +0 -0
  273. /package/architecture/{v3-core-mechanism-inventory.json → baseline-core-mechanism-inventory.json} +0 -0
  274. /package/architecture/{v4-canonical-contract-fixtures.json → canonical-contract-fixtures.json} +0 -0
  275. /package/architecture/{v4-compatibility-facts-parity.json → compatibility-facts-parity.json} +0 -0
  276. /package/architecture/{v4-delivery-warrant-shadow-bootstrap-plan.schema.json → delivery-warrant-shadow-bootstrap-plan.schema.json} +0 -0
  277. /package/architecture/{v4-delivery-warrant-shadow-fixtures.json → delivery-warrant-shadow-fixtures.json} +0 -0
  278. /package/architecture/{v4-delivery-warrant-shadow-fixtures.schema.json → delivery-warrant-shadow-fixtures.schema.json} +0 -0
  279. /package/architecture/{v4-exception-ledger.json → exception-ledger.json} +0 -0
  280. /package/architecture/{v4-exception-ledger.schema.json → exception-ledger.schema.json} +0 -0
  281. /package/architecture/{v4-release-invocation-fixtures.json → release-invocation-fixtures.json} +0 -0
@@ -32,522 +32,743 @@
32
32
  "notes": ""
33
33
  },
34
34
  {
35
- "workflowPath": ".github/workflows/.build.yml",
35
+ "workflowPath": ".github/workflows/.build-demo-adapter.yml",
36
36
  "authorityClass": "non-publication-oidc",
37
37
  "publicationCapable": false,
38
38
  "capabilityIds": [],
39
39
  "credentialMode": "none",
40
40
  "publisherWorkflowMode": "fixed",
41
- "publisherWorkflowPath": ".github/workflows/.build.yml",
41
+ "publisherWorkflowPath": ".github/workflows/.build-demo-adapter.yml",
42
42
  "environment": "",
43
43
  "environmentMode": "fixed",
44
44
  "runnerPolicy": "unqualified",
45
45
  "notes": ""
46
46
  },
47
47
  {
48
- "workflowPath": ".github/workflows/.declarative-auditable-demo.yml",
49
- "authorityClass": "governance-write",
48
+ "workflowPath": ".github/workflows/.build-engine.yml",
49
+ "authorityClass": "non-publication-oidc",
50
50
  "publicationCapable": false,
51
51
  "capabilityIds": [],
52
52
  "credentialMode": "none",
53
53
  "publisherWorkflowMode": "fixed",
54
- "publisherWorkflowPath": ".github/workflows/.declarative-auditable-demo.yml",
54
+ "publisherWorkflowPath": ".github/workflows/.build-engine.yml",
55
55
  "environment": "",
56
56
  "environmentMode": "fixed",
57
57
  "runnerPolicy": "unqualified",
58
58
  "notes": ""
59
59
  },
60
60
  {
61
- "workflowPath": ".github/workflows/.publication-authority.yml",
62
- "authorityClass": "evidence-publication",
61
+ "workflowPath": ".github/workflows/.build-release-verify-compat.yml",
62
+ "authorityClass": "governance-write",
63
63
  "publicationCapable": false,
64
64
  "capabilityIds": [],
65
65
  "credentialMode": "none",
66
66
  "publisherWorkflowMode": "fixed",
67
- "publisherWorkflowPath": ".github/workflows/.publication-authority.yml",
67
+ "publisherWorkflowPath": ".github/workflows/.build-release-verify-compat.yml",
68
68
  "environment": "",
69
69
  "environmentMode": "fixed",
70
70
  "runnerPolicy": "unqualified",
71
71
  "notes": ""
72
72
  },
73
73
  {
74
- "workflowPath": ".github/workflows/.release-candidate-promote.yml",
75
- "authorityClass": "product-publication",
76
- "publicationCapable": true,
77
- "capabilityIds": [
78
- "channel-ref",
79
- "github-release",
80
- "npm-publish"
81
- ],
82
- "credentialMode": "trusted-publishing",
83
- "publisherWorkflowMode": "caller-bound",
84
- "publisherWorkflowPath": ".github/workflows/.release-candidate-promote.yml",
85
- "environment": "none",
86
- "environmentMode": "fixed",
87
- "runnerPolicy": "qualified-measured",
88
- "notes": ""
89
- },
90
- {
91
- "workflowPath": ".github/workflows/.release-verify.yml",
92
- "authorityClass": "governance-write",
74
+ "workflowPath": ".github/workflows/.build-sam-verify-compat.yml",
75
+ "authorityClass": "retired-deny",
93
76
  "publicationCapable": false,
94
77
  "capabilityIds": [],
95
78
  "credentialMode": "none",
96
79
  "publisherWorkflowMode": "fixed",
97
- "publisherWorkflowPath": ".github/workflows/.release-verify.yml",
80
+ "publisherWorkflowPath": ".github/workflows/.build-sam-verify-compat.yml",
98
81
  "environment": "",
99
82
  "environmentMode": "fixed",
100
83
  "runnerPolicy": "unqualified",
101
84
  "notes": ""
102
85
  },
103
86
  {
104
- "workflowPath": ".github/workflows/.sam-release.yml",
87
+ "workflowPath": ".github/workflows/.build-wheel-verify-compat.yml",
105
88
  "authorityClass": "retired-deny",
106
89
  "publicationCapable": false,
107
90
  "capabilityIds": [],
108
91
  "credentialMode": "none",
109
92
  "publisherWorkflowMode": "fixed",
110
- "publisherWorkflowPath": ".github/workflows/.sam-release.yml",
93
+ "publisherWorkflowPath": ".github/workflows/.build-wheel-verify-compat.yml",
111
94
  "environment": "",
112
95
  "environmentMode": "fixed",
113
96
  "runnerPolicy": "unqualified",
114
97
  "notes": ""
115
98
  },
116
99
  {
117
- "workflowPath": ".github/workflows/.sam-verify.yml",
118
- "authorityClass": "retired-deny",
100
+ "workflowPath": ".github/workflows/.build.yml",
101
+ "authorityClass": "non-publication-oidc",
119
102
  "publicationCapable": false,
120
103
  "capabilityIds": [],
121
104
  "credentialMode": "none",
122
105
  "publisherWorkflowMode": "fixed",
123
- "publisherWorkflowPath": ".github/workflows/.sam-verify.yml",
106
+ "publisherWorkflowPath": ".github/workflows/.build.yml",
124
107
  "environment": "",
125
108
  "environmentMode": "fixed",
126
109
  "runnerPolicy": "unqualified",
127
110
  "notes": ""
128
111
  },
129
112
  {
130
- "workflowPath": ".github/workflows/.sync-remote-git.yml",
113
+ "workflowPath": ".github/workflows/.declarative-auditable-demo.yml",
131
114
  "authorityClass": "governance-write",
132
115
  "publicationCapable": false,
133
116
  "capabilityIds": [],
134
117
  "credentialMode": "none",
135
118
  "publisherWorkflowMode": "fixed",
136
- "publisherWorkflowPath": ".github/workflows/.sync-remote-git.yml",
119
+ "publisherWorkflowPath": ".github/workflows/.declarative-auditable-demo.yml",
137
120
  "environment": "",
138
121
  "environmentMode": "fixed",
139
122
  "runnerPolicy": "unqualified",
140
123
  "notes": ""
141
124
  },
142
125
  {
143
- "workflowPath": ".github/workflows/.web-surface.yml",
144
- "authorityClass": "product-publication",
145
- "publicationCapable": true,
146
- "capabilityIds": [
147
- "web-production"
148
- ],
149
- "credentialMode": "oidc",
150
- "publisherWorkflowMode": "caller-bound",
151
- "publisherWorkflowPath": ".github/workflows/.web-surface.yml",
152
- "environment": "consumer-defined",
153
- "environmentMode": "caller-bound",
154
- "runnerPolicy": "qualified-measured",
155
- "notes": ""
156
- },
157
- {
158
- "workflowPath": ".github/workflows/.wheel-release.yml",
159
- "authorityClass": "retired-deny",
126
+ "workflowPath": ".github/workflows/.ops-git-sync.yml",
127
+ "authorityClass": "governance-write",
160
128
  "publicationCapable": false,
161
129
  "capabilityIds": [],
162
130
  "credentialMode": "none",
163
131
  "publisherWorkflowMode": "fixed",
164
- "publisherWorkflowPath": ".github/workflows/.wheel-release.yml",
132
+ "publisherWorkflowPath": ".github/workflows/.ops-git-sync.yml",
165
133
  "environment": "",
166
134
  "environmentMode": "fixed",
167
135
  "runnerPolicy": "unqualified",
168
136
  "notes": ""
169
137
  },
170
138
  {
171
- "workflowPath": ".github/workflows/.wheel-verify.yml",
172
- "authorityClass": "retired-deny",
139
+ "workflowPath": ".github/workflows/.publication-authority.yml",
140
+ "authorityClass": "evidence-publication",
173
141
  "publicationCapable": false,
174
142
  "capabilityIds": [],
175
143
  "credentialMode": "none",
176
144
  "publisherWorkflowMode": "fixed",
177
- "publisherWorkflowPath": ".github/workflows/.wheel-verify.yml",
145
+ "publisherWorkflowPath": ".github/workflows/.publication-authority.yml",
178
146
  "environment": "",
179
147
  "environmentMode": "fixed",
180
148
  "runnerPolicy": "unqualified",
181
149
  "notes": ""
182
150
  },
183
151
  {
184
- "workflowPath": ".github/workflows/artifact-signing-authority.yml",
152
+ "workflowPath": ".github/workflows/.release-authority.yml",
185
153
  "authorityClass": "evidence-publication",
186
154
  "publicationCapable": false,
187
155
  "capabilityIds": [],
188
156
  "credentialMode": "none",
189
157
  "publisherWorkflowMode": "fixed",
190
- "publisherWorkflowPath": ".github/workflows/artifact-signing-authority.yml",
158
+ "publisherWorkflowPath": ".github/workflows/.release-authority.yml",
191
159
  "environment": "",
192
160
  "environmentMode": "fixed",
193
161
  "runnerPolicy": "unqualified",
194
162
  "notes": ""
195
163
  },
196
164
  {
197
- "workflowPath": ".github/workflows/auditable-demo.yml",
165
+ "workflowPath": ".github/workflows/.release-binary-assets.yml",
166
+ "authorityClass": "product-publication",
167
+ "publicationCapable": true,
168
+ "capabilityIds": [
169
+ "github-release"
170
+ ],
171
+ "credentialMode": "github-token",
172
+ "publisherWorkflowMode": "fixed",
173
+ "publisherWorkflowPath": ".github/workflows/.release-binary-assets.yml",
174
+ "environment": "buildchain-release-assets",
175
+ "environmentMode": "fixed",
176
+ "runnerPolicy": "qualified-measured",
177
+ "notes": ""
178
+ },
179
+ {
180
+ "workflowPath": ".github/workflows/.release-candidate-promote.yml",
181
+ "authorityClass": "product-publication",
182
+ "publicationCapable": true,
183
+ "capabilityIds": [
184
+ "channel-ref",
185
+ "github-release",
186
+ "npm-publish"
187
+ ],
188
+ "credentialMode": "trusted-publishing",
189
+ "publisherWorkflowMode": "caller-bound",
190
+ "publisherWorkflowPath": ".github/workflows/.release-candidate-promote.yml",
191
+ "environment": "none",
192
+ "environmentMode": "fixed",
193
+ "runnerPolicy": "qualified-measured",
194
+ "notes": ""
195
+ },
196
+ {
197
+ "workflowPath": ".github/workflows/.release-promote.yml",
198
+ "authorityClass": "product-publication",
199
+ "publicationCapable": true,
200
+ "capabilityIds": [
201
+ "channel-ref",
202
+ "github-release",
203
+ "npm-publish"
204
+ ],
205
+ "credentialMode": "trusted-publishing",
206
+ "publisherWorkflowMode": "caller-bound",
207
+ "publisherWorkflowPath": ".github/workflows/.release-promote.yml",
208
+ "environment": "none",
209
+ "environmentMode": "fixed",
210
+ "runnerPolicy": "qualified-measured",
211
+ "notes": ""
212
+ },
213
+ {
214
+ "workflowPath": ".github/workflows/.release-verify.yml",
198
215
  "authorityClass": "governance-write",
199
216
  "publicationCapable": false,
200
217
  "capabilityIds": [],
201
218
  "credentialMode": "none",
202
219
  "publisherWorkflowMode": "fixed",
203
- "publisherWorkflowPath": ".github/workflows/auditable-demo.yml",
220
+ "publisherWorkflowPath": ".github/workflows/.release-verify.yml",
204
221
  "environment": "",
205
222
  "environmentMode": "fixed",
206
223
  "runnerPolicy": "unqualified",
207
224
  "notes": ""
208
225
  },
209
226
  {
210
- "workflowPath": ".github/workflows/binary-distribution.yml",
211
- "authorityClass": "evidence-publication",
227
+ "workflowPath": ".github/workflows/.sam-verify.yml",
228
+ "authorityClass": "retired-deny",
212
229
  "publicationCapable": false,
213
230
  "capabilityIds": [],
214
231
  "credentialMode": "none",
215
232
  "publisherWorkflowMode": "fixed",
216
- "publisherWorkflowPath": ".github/workflows/binary-distribution.yml",
233
+ "publisherWorkflowPath": ".github/workflows/.sam-verify.yml",
217
234
  "environment": "",
218
235
  "environmentMode": "fixed",
219
236
  "runnerPolicy": "unqualified",
220
237
  "notes": ""
221
238
  },
222
239
  {
223
- "workflowPath": ".github/workflows/binary-release-assets.yml",
240
+ "workflowPath": ".github/workflows/.sync-remote-git.yml",
224
241
  "authorityClass": "governance-write",
225
242
  "publicationCapable": false,
226
243
  "capabilityIds": [],
227
244
  "credentialMode": "none",
228
245
  "publisherWorkflowMode": "fixed",
229
- "publisherWorkflowPath": ".github/workflows/binary-release-assets.yml",
246
+ "publisherWorkflowPath": ".github/workflows/.sync-remote-git.yml",
230
247
  "environment": "",
231
248
  "environmentMode": "fixed",
232
249
  "runnerPolicy": "unqualified",
233
250
  "notes": ""
234
251
  },
235
252
  {
236
- "workflowPath": ".github/workflows/build-surface-fixture.yml",
237
- "authorityClass": "non-publication-oidc",
253
+ "workflowPath": ".github/workflows/.web-surface.yml",
254
+ "authorityClass": "product-publication",
255
+ "publicationCapable": true,
256
+ "capabilityIds": [
257
+ "web-production"
258
+ ],
259
+ "credentialMode": "oidc",
260
+ "publisherWorkflowMode": "caller-bound",
261
+ "publisherWorkflowPath": ".github/workflows/.web-surface.yml",
262
+ "environment": "consumer-defined",
263
+ "environmentMode": "caller-bound",
264
+ "runnerPolicy": "qualified-measured",
265
+ "notes": ""
266
+ },
267
+ {
268
+ "workflowPath": ".github/workflows/.wheel-verify.yml",
269
+ "authorityClass": "retired-deny",
238
270
  "publicationCapable": false,
239
271
  "capabilityIds": [],
240
272
  "credentialMode": "none",
241
273
  "publisherWorkflowMode": "fixed",
242
- "publisherWorkflowPath": ".github/workflows/build-surface-fixture.yml",
274
+ "publisherWorkflowPath": ".github/workflows/.wheel-verify.yml",
243
275
  "environment": "",
244
276
  "environmentMode": "fixed",
245
277
  "runnerPolicy": "unqualified",
246
278
  "notes": ""
247
279
  },
248
280
  {
249
- "workflowPath": ".github/workflows/build.yml",
250
- "authorityClass": "non-publication-oidc",
281
+ "workflowPath": ".github/workflows/artifact-signing-authority.yml",
282
+ "authorityClass": "evidence-publication",
251
283
  "publicationCapable": false,
252
284
  "capabilityIds": [],
253
285
  "credentialMode": "none",
254
286
  "publisherWorkflowMode": "fixed",
255
- "publisherWorkflowPath": ".github/workflows/build.yml",
287
+ "publisherWorkflowPath": ".github/workflows/artifact-signing-authority.yml",
256
288
  "environment": "",
257
289
  "environmentMode": "fixed",
258
290
  "runnerPolicy": "unqualified",
259
291
  "notes": ""
260
292
  },
261
293
  {
262
- "workflowPath": ".github/workflows/buildchain-alpha-self-dogfood.yml",
294
+ "workflowPath": ".github/workflows/bootstrap.yml",
295
+ "authorityClass": "product-publication",
296
+ "publicationCapable": true,
297
+ "capabilityIds": [
298
+ "universal-candidate-execution"
299
+ ],
300
+ "credentialMode": "caller-secrets",
301
+ "publisherWorkflowMode": "caller-bound",
302
+ "publisherWorkflowPath": ".github/workflows/bootstrap.yml",
303
+ "environment": "none",
304
+ "environmentMode": "fixed",
305
+ "runnerPolicy": "qualified-measured",
306
+ "notes": ""
307
+ },
308
+ {
309
+ "workflowPath": ".github/workflows/build.yml",
263
310
  "authorityClass": "non-publication-oidc",
264
311
  "publicationCapable": false,
265
312
  "capabilityIds": [],
266
313
  "credentialMode": "none",
267
314
  "publisherWorkflowMode": "fixed",
268
- "publisherWorkflowPath": ".github/workflows/buildchain-alpha-self-dogfood.yml",
315
+ "publisherWorkflowPath": ".github/workflows/build.yml",
269
316
  "environment": "",
270
317
  "environmentMode": "fixed",
271
318
  "runnerPolicy": "unqualified",
272
319
  "notes": ""
273
320
  },
274
321
  {
275
- "workflowPath": ".github/workflows/buildchain-dev-delivery.yml",
322
+ "workflowPath": ".github/workflows/buildchain-patrol.yml",
276
323
  "authorityClass": "governance-write",
277
324
  "publicationCapable": false,
278
325
  "capabilityIds": [],
279
326
  "credentialMode": "none",
280
327
  "publisherWorkflowMode": "fixed",
281
- "publisherWorkflowPath": ".github/workflows/buildchain-dev-delivery.yml",
328
+ "publisherWorkflowPath": ".github/workflows/buildchain-patrol.yml",
282
329
  "environment": "",
283
330
  "environmentMode": "fixed",
284
331
  "runnerPolicy": "unqualified",
285
332
  "notes": ""
286
333
  },
287
334
  {
288
- "workflowPath": ".github/workflows/buildchain-patrol-daily.yml",
335
+ "workflowPath": ".github/workflows/dev-alpha-candidate-patrol.yml",
289
336
  "authorityClass": "governance-write",
290
337
  "publicationCapable": false,
291
338
  "capabilityIds": [],
292
339
  "credentialMode": "none",
293
340
  "publisherWorkflowMode": "fixed",
294
- "publisherWorkflowPath": ".github/workflows/buildchain-patrol-daily.yml",
341
+ "publisherWorkflowPath": ".github/workflows/dev-alpha-candidate-patrol.yml",
295
342
  "environment": "",
296
343
  "environmentMode": "fixed",
297
344
  "runnerPolicy": "unqualified",
298
345
  "notes": ""
299
346
  },
300
347
  {
301
- "workflowPath": ".github/workflows/buildchain-patrol-monthly.yml",
348
+ "workflowPath": ".github/workflows/dev-delivery-warrant-cancel.yml",
302
349
  "authorityClass": "governance-write",
303
350
  "publicationCapable": false,
304
351
  "capabilityIds": [],
305
352
  "credentialMode": "none",
306
353
  "publisherWorkflowMode": "fixed",
307
- "publisherWorkflowPath": ".github/workflows/buildchain-patrol-monthly.yml",
354
+ "publisherWorkflowPath": ".github/workflows/dev-delivery-warrant-cancel.yml",
308
355
  "environment": "",
309
356
  "environmentMode": "fixed",
310
357
  "runnerPolicy": "unqualified",
311
358
  "notes": ""
312
359
  },
313
360
  {
314
- "workflowPath": ".github/workflows/buildchain-patrol-weekly.yml",
361
+ "workflowPath": ".github/workflows/dev-delivery-warrant-close.yml",
315
362
  "authorityClass": "governance-write",
316
363
  "publicationCapable": false,
317
364
  "capabilityIds": [],
318
365
  "credentialMode": "none",
319
366
  "publisherWorkflowMode": "fixed",
320
- "publisherWorkflowPath": ".github/workflows/buildchain-patrol-weekly.yml",
367
+ "publisherWorkflowPath": ".github/workflows/dev-delivery-warrant-close.yml",
321
368
  "environment": "",
322
369
  "environmentMode": "fixed",
323
370
  "runnerPolicy": "unqualified",
324
371
  "notes": ""
325
372
  },
326
373
  {
327
- "workflowPath": ".github/workflows/buildchain-patrol.yml",
374
+ "workflowPath": ".github/workflows/dev-pr-auto-merge.yml",
328
375
  "authorityClass": "governance-write",
329
376
  "publicationCapable": false,
330
377
  "capabilityIds": [],
331
378
  "credentialMode": "none",
332
379
  "publisherWorkflowMode": "fixed",
333
- "publisherWorkflowPath": ".github/workflows/buildchain-patrol.yml",
380
+ "publisherWorkflowPath": ".github/workflows/dev-pr-auto-merge.yml",
334
381
  "environment": "",
335
382
  "environmentMode": "fixed",
336
383
  "runnerPolicy": "unqualified",
337
384
  "notes": ""
338
385
  },
339
386
  {
340
- "workflowPath": ".github/workflows/buildchain-ref-promotion-recovery.yml",
387
+ "workflowPath": ".github/workflows/dev-qualification-patrol.yml",
341
388
  "authorityClass": "governance-write",
342
389
  "publicationCapable": false,
343
390
  "capabilityIds": [],
344
391
  "credentialMode": "none",
345
392
  "publisherWorkflowMode": "fixed",
346
- "publisherWorkflowPath": ".github/workflows/buildchain-ref-promotion-recovery.yml",
393
+ "publisherWorkflowPath": ".github/workflows/dev-qualification-patrol.yml",
347
394
  "environment": "",
348
395
  "environmentMode": "fixed",
349
396
  "runnerPolicy": "unqualified",
350
397
  "notes": ""
351
398
  },
352
399
  {
353
- "workflowPath": ".github/workflows/buildchain-ref-promotion.yml",
400
+ "workflowPath": ".github/workflows/engineering-housekeeper.yml",
354
401
  "authorityClass": "governance-write",
355
402
  "publicationCapable": false,
356
403
  "capabilityIds": [],
357
404
  "credentialMode": "none",
358
405
  "publisherWorkflowMode": "fixed",
359
- "publisherWorkflowPath": ".github/workflows/buildchain-ref-promotion.yml",
406
+ "publisherWorkflowPath": ".github/workflows/engineering-housekeeper.yml",
360
407
  "environment": "",
361
408
  "environmentMode": "fixed",
362
409
  "runnerPolicy": "unqualified",
363
410
  "notes": ""
364
411
  },
365
412
  {
366
- "workflowPath": ".github/workflows/buildchain-stable-candidate-patrol.yml",
413
+ "workflowPath": ".github/workflows/github-artifact-attestation.yml",
414
+ "authorityClass": "evidence-publication",
415
+ "publicationCapable": true,
416
+ "capabilityIds": [
417
+ "github-artifact-attestation"
418
+ ],
419
+ "credentialMode": "oidc",
420
+ "publisherWorkflowMode": "caller-bound",
421
+ "publisherWorkflowPath": ".github/workflows/github-artifact-attestation.yml",
422
+ "environment": "consumer-defined",
423
+ "environmentMode": "caller-bound",
424
+ "runnerPolicy": "qualified-measured",
425
+ "notes": ""
426
+ },
427
+ {
428
+ "workflowPath": ".github/workflows/paper-release-sealed.yml",
429
+ "authorityClass": "product-publication",
430
+ "publicationCapable": true,
431
+ "capabilityIds": [
432
+ "github-release",
433
+ "npm-publish"
434
+ ],
435
+ "credentialMode": "trusted-publishing",
436
+ "publisherWorkflowMode": "caller-bound",
437
+ "publisherWorkflowPath": ".github/workflows/paper-release-sealed.yml",
438
+ "environment": "none",
439
+ "environmentMode": "fixed",
440
+ "runnerPolicy": "qualified-measured",
441
+ "notes": ""
442
+ },
443
+ {
444
+ "workflowPath": ".github/workflows/paper-release.yml",
445
+ "authorityClass": "product-publication",
446
+ "publicationCapable": true,
447
+ "capabilityIds": [
448
+ "github-release",
449
+ "npm-publish"
450
+ ],
451
+ "credentialMode": "trusted-publishing",
452
+ "publisherWorkflowMode": "caller-bound",
453
+ "publisherWorkflowPath": ".github/workflows/paper-release.yml",
454
+ "environment": "none",
455
+ "environmentMode": "fixed",
456
+ "runnerPolicy": "qualified-measured",
457
+ "notes": ""
458
+ },
459
+ {
460
+ "workflowPath": ".github/workflows/patrol-daily.yml",
367
461
  "authorityClass": "governance-write",
368
462
  "publicationCapable": false,
369
463
  "capabilityIds": [],
370
464
  "credentialMode": "none",
371
465
  "publisherWorkflowMode": "fixed",
372
- "publisherWorkflowPath": ".github/workflows/buildchain-stable-candidate-patrol.yml",
466
+ "publisherWorkflowPath": ".github/workflows/patrol-daily.yml",
373
467
  "environment": "",
374
468
  "environmentMode": "fixed",
375
469
  "runnerPolicy": "unqualified",
376
470
  "notes": ""
377
471
  },
378
472
  {
379
- "workflowPath": ".github/workflows/dev-alpha-candidate-patrol.yml",
473
+ "workflowPath": ".github/workflows/patrol-monthly.yml",
380
474
  "authorityClass": "governance-write",
381
475
  "publicationCapable": false,
382
476
  "capabilityIds": [],
383
477
  "credentialMode": "none",
384
478
  "publisherWorkflowMode": "fixed",
385
- "publisherWorkflowPath": ".github/workflows/dev-alpha-candidate-patrol.yml",
479
+ "publisherWorkflowPath": ".github/workflows/patrol-monthly.yml",
386
480
  "environment": "",
387
481
  "environmentMode": "fixed",
388
482
  "runnerPolicy": "unqualified",
389
483
  "notes": ""
390
484
  },
391
485
  {
392
- "workflowPath": ".github/workflows/dev-delivery-warrant-cancel.yml",
486
+ "workflowPath": ".github/workflows/patrol-observed-evidence.yml",
487
+ "authorityClass": "product-publication",
488
+ "publicationCapable": true,
489
+ "capabilityIds": [
490
+ "observed-evidence-publication"
491
+ ],
492
+ "credentialMode": "oidc",
493
+ "publisherWorkflowMode": "caller-bound",
494
+ "publisherWorkflowPath": ".github/workflows/patrol-observed-evidence.yml",
495
+ "environment": "consumer-defined",
496
+ "environmentMode": "caller-bound",
497
+ "runnerPolicy": "qualified-measured",
498
+ "notes": ""
499
+ },
500
+ {
501
+ "workflowPath": ".github/workflows/patrol-weekly.yml",
393
502
  "authorityClass": "governance-write",
394
503
  "publicationCapable": false,
395
504
  "capabilityIds": [],
396
505
  "credentialMode": "none",
397
506
  "publisherWorkflowMode": "fixed",
398
- "publisherWorkflowPath": ".github/workflows/dev-delivery-warrant-cancel.yml",
507
+ "publisherWorkflowPath": ".github/workflows/patrol-weekly.yml",
399
508
  "environment": "",
400
509
  "environmentMode": "fixed",
401
510
  "runnerPolicy": "unqualified",
402
511
  "notes": ""
403
512
  },
404
513
  {
405
- "workflowPath": ".github/workflows/dev-delivery-warrant-close.yml",
406
- "authorityClass": "governance-write",
514
+ "workflowPath": ".github/workflows/public-build-candidate.yml",
515
+ "authorityClass": "non-publication-oidc",
407
516
  "publicationCapable": false,
408
517
  "capabilityIds": [],
409
518
  "credentialMode": "none",
410
519
  "publisherWorkflowMode": "fixed",
411
- "publisherWorkflowPath": ".github/workflows/dev-delivery-warrant-close.yml",
520
+ "publisherWorkflowPath": ".github/workflows/public-build-candidate.yml",
412
521
  "environment": "",
413
522
  "environmentMode": "fixed",
414
523
  "runnerPolicy": "unqualified",
415
524
  "notes": ""
416
525
  },
417
526
  {
418
- "workflowPath": ".github/workflows/dev-merge-queue-governance.yml",
527
+ "workflowPath": ".github/workflows/public-build-demo.yml",
419
528
  "authorityClass": "governance-write",
420
529
  "publicationCapable": false,
421
530
  "capabilityIds": [],
422
531
  "credentialMode": "none",
423
532
  "publisherWorkflowMode": "fixed",
424
- "publisherWorkflowPath": ".github/workflows/dev-merge-queue-governance.yml",
533
+ "publisherWorkflowPath": ".github/workflows/public-build-demo.yml",
425
534
  "environment": "",
426
535
  "environmentMode": "fixed",
427
536
  "runnerPolicy": "unqualified",
428
537
  "notes": ""
429
538
  },
430
539
  {
431
- "workflowPath": ".github/workflows/dev-pr-auto-merge.yml",
432
- "authorityClass": "governance-write",
540
+ "workflowPath": ".github/workflows/public-build-publication.yml",
541
+ "authorityClass": "evidence-publication",
433
542
  "publicationCapable": false,
434
543
  "capabilityIds": [],
435
544
  "credentialMode": "none",
436
545
  "publisherWorkflowMode": "fixed",
437
- "publisherWorkflowPath": ".github/workflows/dev-pr-auto-merge.yml",
546
+ "publisherWorkflowPath": ".github/workflows/public-build-publication.yml",
438
547
  "environment": "",
439
548
  "environmentMode": "fixed",
440
549
  "runnerPolicy": "unqualified",
441
550
  "notes": ""
442
551
  },
443
552
  {
444
- "workflowPath": ".github/workflows/dev-qualification-patrol.yml",
553
+ "workflowPath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
445
554
  "authorityClass": "governance-write",
446
555
  "publicationCapable": false,
447
556
  "capabilityIds": [],
448
557
  "credentialMode": "none",
449
558
  "publisherWorkflowMode": "fixed",
450
- "publisherWorkflowPath": ".github/workflows/dev-qualification-patrol.yml",
559
+ "publisherWorkflowPath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
451
560
  "environment": "",
452
561
  "environmentMode": "fixed",
453
562
  "runnerPolicy": "unqualified",
454
563
  "notes": ""
455
564
  },
456
565
  {
457
- "workflowPath": ".github/workflows/engineering-housekeeper-daily.yml",
458
- "authorityClass": "governance-write",
459
- "publicationCapable": false,
460
- "capabilityIds": [],
461
- "credentialMode": "none",
462
- "publisherWorkflowMode": "fixed",
463
- "publisherWorkflowPath": ".github/workflows/engineering-housekeeper-daily.yml",
464
- "environment": "",
566
+ "workflowPath": ".github/workflows/public-ops-bootstrap-recovery.yml",
567
+ "authorityClass": "product-publication",
568
+ "publicationCapable": true,
569
+ "capabilityIds": [
570
+ "universal-candidate-execution"
571
+ ],
572
+ "credentialMode": "caller-secrets",
573
+ "publisherWorkflowMode": "caller-bound",
574
+ "publisherWorkflowPath": ".github/workflows/public-ops-bootstrap-recovery.yml",
575
+ "environment": "none",
465
576
  "environmentMode": "fixed",
466
- "runnerPolicy": "unqualified",
577
+ "runnerPolicy": "qualified-measured",
578
+ "notes": ""
579
+ },
580
+ {
581
+ "workflowPath": ".github/workflows/public-ops-bootstrap.yml",
582
+ "authorityClass": "product-publication",
583
+ "publicationCapable": true,
584
+ "capabilityIds": [
585
+ "universal-candidate-execution"
586
+ ],
587
+ "credentialMode": "caller-secrets",
588
+ "publisherWorkflowMode": "caller-bound",
589
+ "publisherWorkflowPath": ".github/workflows/public-ops-bootstrap.yml",
590
+ "environment": "none",
591
+ "environmentMode": "fixed",
592
+ "runnerPolicy": "qualified-measured",
467
593
  "notes": ""
468
594
  },
469
595
  {
470
- "workflowPath": ".github/workflows/engineering-housekeeper-monthly.yml",
596
+ "workflowPath": ".github/workflows/public-ops-dev-auto-merge.yml",
471
597
  "authorityClass": "governance-write",
472
598
  "publicationCapable": false,
473
599
  "capabilityIds": [],
474
600
  "credentialMode": "none",
475
601
  "publisherWorkflowMode": "fixed",
476
- "publisherWorkflowPath": ".github/workflows/engineering-housekeeper-monthly.yml",
602
+ "publisherWorkflowPath": ".github/workflows/public-ops-dev-auto-merge.yml",
477
603
  "environment": "",
478
604
  "environmentMode": "fixed",
479
605
  "runnerPolicy": "unqualified",
480
606
  "notes": ""
481
607
  },
482
608
  {
483
- "workflowPath": ".github/workflows/engineering-housekeeper-weekly.yml",
609
+ "workflowPath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
484
610
  "authorityClass": "governance-write",
485
611
  "publicationCapable": false,
486
612
  "capabilityIds": [],
487
613
  "credentialMode": "none",
488
614
  "publisherWorkflowMode": "fixed",
489
- "publisherWorkflowPath": ".github/workflows/engineering-housekeeper-weekly.yml",
615
+ "publisherWorkflowPath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
490
616
  "environment": "",
491
617
  "environmentMode": "fixed",
492
618
  "runnerPolicy": "unqualified",
493
619
  "notes": ""
494
620
  },
495
621
  {
496
- "workflowPath": ".github/workflows/engineering-housekeeper.yml",
622
+ "workflowPath": ".github/workflows/public-ops-housekeeping.yml",
497
623
  "authorityClass": "governance-write",
498
624
  "publicationCapable": false,
499
625
  "capabilityIds": [],
500
626
  "credentialMode": "none",
501
627
  "publisherWorkflowMode": "fixed",
502
- "publisherWorkflowPath": ".github/workflows/engineering-housekeeper.yml",
628
+ "publisherWorkflowPath": ".github/workflows/public-ops-housekeeping.yml",
503
629
  "environment": "",
504
630
  "environmentMode": "fixed",
505
631
  "runnerPolicy": "unqualified",
506
632
  "notes": ""
507
633
  },
508
634
  {
509
- "workflowPath": ".github/workflows/github-artifact-attestation.yml",
510
- "authorityClass": "evidence-publication",
635
+ "workflowPath": ".github/workflows/public-ops-observed-evidence.yml",
636
+ "authorityClass": "product-publication",
511
637
  "publicationCapable": true,
512
638
  "capabilityIds": [
513
- "github-artifact-attestation"
639
+ "observed-evidence-publication"
514
640
  ],
515
641
  "credentialMode": "oidc",
516
642
  "publisherWorkflowMode": "caller-bound",
517
- "publisherWorkflowPath": ".github/workflows/github-artifact-attestation.yml",
643
+ "publisherWorkflowPath": ".github/workflows/public-ops-observed-evidence.yml",
518
644
  "environment": "consumer-defined",
519
645
  "environmentMode": "caller-bound",
520
646
  "runnerPolicy": "qualified-measured",
521
647
  "notes": ""
522
648
  },
523
649
  {
524
- "workflowPath": ".github/workflows/github-governance-audit.yml",
650
+ "workflowPath": ".github/workflows/public-ops-patrol-daily.yml",
525
651
  "authorityClass": "governance-write",
526
652
  "publicationCapable": false,
527
653
  "capabilityIds": [],
528
654
  "credentialMode": "none",
529
655
  "publisherWorkflowMode": "fixed",
530
- "publisherWorkflowPath": ".github/workflows/github-governance-audit.yml",
656
+ "publisherWorkflowPath": ".github/workflows/public-ops-patrol-daily.yml",
531
657
  "environment": "",
532
658
  "environmentMode": "fixed",
533
659
  "runnerPolicy": "unqualified",
534
660
  "notes": ""
535
661
  },
536
662
  {
537
- "workflowPath": ".github/workflows/npm-publish.yml",
538
- "authorityClass": "dry-run-only",
663
+ "workflowPath": ".github/workflows/public-ops-patrol-monthly.yml",
664
+ "authorityClass": "governance-write",
539
665
  "publicationCapable": false,
540
666
  "capabilityIds": [],
541
667
  "credentialMode": "none",
542
668
  "publisherWorkflowMode": "fixed",
543
- "publisherWorkflowPath": ".github/workflows/npm-publish.yml",
669
+ "publisherWorkflowPath": ".github/workflows/public-ops-patrol-monthly.yml",
544
670
  "environment": "",
545
671
  "environmentMode": "fixed",
546
672
  "runnerPolicy": "unqualified",
547
673
  "notes": ""
548
674
  },
549
675
  {
550
- "workflowPath": ".github/workflows/paper-release-sealed.yml",
676
+ "workflowPath": ".github/workflows/public-ops-patrol-weekly.yml",
677
+ "authorityClass": "governance-write",
678
+ "publicationCapable": false,
679
+ "capabilityIds": [],
680
+ "credentialMode": "none",
681
+ "publisherWorkflowMode": "fixed",
682
+ "publisherWorkflowPath": ".github/workflows/public-ops-patrol-weekly.yml",
683
+ "environment": "",
684
+ "environmentMode": "fixed",
685
+ "runnerPolicy": "unqualified",
686
+ "notes": ""
687
+ },
688
+ {
689
+ "workflowPath": ".github/workflows/public-ops-patrol.yml",
690
+ "authorityClass": "governance-write",
691
+ "publicationCapable": false,
692
+ "capabilityIds": [],
693
+ "credentialMode": "none",
694
+ "publisherWorkflowMode": "fixed",
695
+ "publisherWorkflowPath": ".github/workflows/public-ops-patrol.yml",
696
+ "environment": "",
697
+ "environmentMode": "fixed",
698
+ "runnerPolicy": "unqualified",
699
+ "notes": ""
700
+ },
701
+ {
702
+ "workflowPath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
703
+ "authorityClass": "governance-write",
704
+ "publicationCapable": false,
705
+ "capabilityIds": [],
706
+ "credentialMode": "none",
707
+ "publisherWorkflowMode": "fixed",
708
+ "publisherWorkflowPath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
709
+ "environment": "",
710
+ "environmentMode": "fixed",
711
+ "runnerPolicy": "unqualified",
712
+ "notes": ""
713
+ },
714
+ {
715
+ "workflowPath": ".github/workflows/public-ops-warrant-cancel.yml",
716
+ "authorityClass": "governance-write",
717
+ "publicationCapable": false,
718
+ "capabilityIds": [],
719
+ "credentialMode": "none",
720
+ "publisherWorkflowMode": "fixed",
721
+ "publisherWorkflowPath": ".github/workflows/public-ops-warrant-cancel.yml",
722
+ "environment": "",
723
+ "environmentMode": "fixed",
724
+ "runnerPolicy": "unqualified",
725
+ "notes": ""
726
+ },
727
+ {
728
+ "workflowPath": ".github/workflows/public-ops-warrant-close.yml",
729
+ "authorityClass": "governance-write",
730
+ "publicationCapable": false,
731
+ "capabilityIds": [],
732
+ "credentialMode": "none",
733
+ "publisherWorkflowMode": "fixed",
734
+ "publisherWorkflowPath": ".github/workflows/public-ops-warrant-close.yml",
735
+ "environment": "",
736
+ "environmentMode": "fixed",
737
+ "runnerPolicy": "unqualified",
738
+ "notes": ""
739
+ },
740
+ {
741
+ "workflowPath": ".github/workflows/public-release-artifact-attestation.yml",
742
+ "authorityClass": "evidence-publication",
743
+ "publicationCapable": true,
744
+ "capabilityIds": [
745
+ "github-artifact-attestation"
746
+ ],
747
+ "credentialMode": "oidc",
748
+ "publisherWorkflowMode": "caller-bound",
749
+ "publisherWorkflowPath": ".github/workflows/public-release-artifact-attestation.yml",
750
+ "environment": "consumer-defined",
751
+ "environmentMode": "caller-bound",
752
+ "runnerPolicy": "qualified-measured",
753
+ "notes": ""
754
+ },
755
+ {
756
+ "workflowPath": ".github/workflows/public-release-oci-compose-preview.yml",
757
+ "authorityClass": "product-publication",
758
+ "publicationCapable": true,
759
+ "capabilityIds": [
760
+ "oci-compose-preview"
761
+ ],
762
+ "credentialMode": "caller-secrets",
763
+ "publisherWorkflowMode": "caller-bound",
764
+ "publisherWorkflowPath": ".github/workflows/public-release-oci-compose-preview.yml",
765
+ "environment": "none",
766
+ "environmentMode": "fixed",
767
+ "runnerPolicy": "qualified-measured",
768
+ "notes": ""
769
+ },
770
+ {
771
+ "workflowPath": ".github/workflows/public-release-paper-sealed.yml",
551
772
  "authorityClass": "product-publication",
552
773
  "publicationCapable": true,
553
774
  "capabilityIds": [
@@ -556,14 +777,14 @@
556
777
  ],
557
778
  "credentialMode": "trusted-publishing",
558
779
  "publisherWorkflowMode": "caller-bound",
559
- "publisherWorkflowPath": ".github/workflows/paper-release-sealed.yml",
780
+ "publisherWorkflowPath": ".github/workflows/public-release-paper-sealed.yml",
560
781
  "environment": "none",
561
782
  "environmentMode": "fixed",
562
783
  "runnerPolicy": "qualified-measured",
563
784
  "notes": ""
564
785
  },
565
786
  {
566
- "workflowPath": ".github/workflows/paper-release.yml",
787
+ "workflowPath": ".github/workflows/public-release-paper.yml",
567
788
  "authorityClass": "product-publication",
568
789
  "publicationCapable": true,
569
790
  "capabilityIds": [
@@ -572,64 +793,86 @@
572
793
  ],
573
794
  "credentialMode": "trusted-publishing",
574
795
  "publisherWorkflowMode": "caller-bound",
575
- "publisherWorkflowPath": ".github/workflows/paper-release.yml",
796
+ "publisherWorkflowPath": ".github/workflows/public-release-paper.yml",
576
797
  "environment": "none",
577
798
  "environmentMode": "fixed",
578
799
  "runnerPolicy": "qualified-measured",
579
800
  "notes": ""
580
801
  },
581
802
  {
582
- "workflowPath": ".github/workflows/patrol-daily.yml",
803
+ "workflowPath": ".github/workflows/public-release-promote.yml",
804
+ "authorityClass": "product-publication",
805
+ "publicationCapable": true,
806
+ "capabilityIds": [
807
+ "channel-ref",
808
+ "github-release",
809
+ "npm-publish"
810
+ ],
811
+ "credentialMode": "trusted-publishing",
812
+ "publisherWorkflowMode": "caller-bound",
813
+ "publisherWorkflowPath": ".github/workflows/public-release-promote.yml",
814
+ "environment": "none",
815
+ "environmentMode": "fixed",
816
+ "runnerPolicy": "qualified-measured",
817
+ "notes": ""
818
+ },
819
+ {
820
+ "workflowPath": ".github/workflows/public-release-propagation.yml",
583
821
  "authorityClass": "governance-write",
584
822
  "publicationCapable": false,
585
823
  "capabilityIds": [],
586
824
  "credentialMode": "none",
587
825
  "publisherWorkflowMode": "fixed",
588
- "publisherWorkflowPath": ".github/workflows/patrol-daily.yml",
826
+ "publisherWorkflowPath": ".github/workflows/public-release-propagation.yml",
589
827
  "environment": "",
590
828
  "environmentMode": "fixed",
591
829
  "runnerPolicy": "unqualified",
592
830
  "notes": ""
593
831
  },
594
832
  {
595
- "workflowPath": ".github/workflows/patrol-monthly.yml",
596
- "authorityClass": "governance-write",
833
+ "workflowPath": ".github/workflows/public-release-signing-authority.yml",
834
+ "authorityClass": "evidence-publication",
597
835
  "publicationCapable": false,
598
836
  "capabilityIds": [],
599
837
  "credentialMode": "none",
600
838
  "publisherWorkflowMode": "fixed",
601
- "publisherWorkflowPath": ".github/workflows/patrol-monthly.yml",
839
+ "publisherWorkflowPath": ".github/workflows/public-release-signing-authority.yml",
602
840
  "environment": "",
603
841
  "environmentMode": "fixed",
604
842
  "runnerPolicy": "unqualified",
605
843
  "notes": ""
606
844
  },
607
845
  {
608
- "workflowPath": ".github/workflows/patrol-observed-evidence.yml",
846
+ "workflowPath": ".github/workflows/public-release-tail.yml",
609
847
  "authorityClass": "product-publication",
610
848
  "publicationCapable": true,
611
849
  "capabilityIds": [
612
- "observed-evidence-publication"
850
+ "artifact.publish",
851
+ "release.activate",
852
+ "released-evidence.synthesize",
853
+ "signed-channel.commit"
613
854
  ],
614
- "credentialMode": "oidc",
615
- "publisherWorkflowMode": "caller-bound",
616
- "publisherWorkflowPath": ".github/workflows/patrol-observed-evidence.yml",
617
- "environment": "consumer-defined",
855
+ "credentialMode": "caller-secrets",
856
+ "publisherWorkflowMode": "fixed",
857
+ "publisherWorkflowPath": ".github/workflows/public-release-tail.yml",
858
+ "environment": "caller-bound",
618
859
  "environmentMode": "caller-bound",
619
860
  "runnerPolicy": "qualified-measured",
620
861
  "notes": ""
621
862
  },
622
863
  {
623
- "workflowPath": ".github/workflows/patrol-weekly.yml",
624
- "authorityClass": "governance-write",
625
- "publicationCapable": false,
626
- "capabilityIds": [],
627
- "credentialMode": "none",
628
- "publisherWorkflowMode": "fixed",
629
- "publisherWorkflowPath": ".github/workflows/patrol-weekly.yml",
630
- "environment": "",
631
- "environmentMode": "fixed",
632
- "runnerPolicy": "unqualified",
864
+ "workflowPath": ".github/workflows/public-release-web.yml",
865
+ "authorityClass": "product-publication",
866
+ "publicationCapable": true,
867
+ "capabilityIds": [
868
+ "web-production"
869
+ ],
870
+ "credentialMode": "oidc",
871
+ "publisherWorkflowMode": "caller-bound",
872
+ "publisherWorkflowPath": ".github/workflows/public-release-web.yml",
873
+ "environment": "consumer-defined",
874
+ "environmentMode": "caller-bound",
875
+ "runnerPolicy": "qualified-measured",
633
876
  "notes": ""
634
877
  },
635
878
  {
@@ -662,19 +905,6 @@
662
905
  "runnerPolicy": "qualified-measured",
663
906
  "notes": ""
664
907
  },
665
- {
666
- "workflowPath": ".github/workflows/release-line-bootstrap.yml",
667
- "authorityClass": "governance-write",
668
- "publicationCapable": false,
669
- "capabilityIds": [],
670
- "credentialMode": "none",
671
- "publisherWorkflowMode": "fixed",
672
- "publisherWorkflowPath": ".github/workflows/release-line-bootstrap.yml",
673
- "environment": "",
674
- "environmentMode": "fixed",
675
- "runnerPolicy": "unqualified",
676
- "notes": ""
677
- },
678
908
  {
679
909
  "workflowPath": ".github/workflows/release-propagation.yml",
680
910
  "authorityClass": "governance-write",
@@ -707,69 +937,616 @@
707
937
  "notes": ""
708
938
  },
709
939
  {
710
- "workflowPath": ".github/workflows/release-verify.yml",
940
+ "workflowPath": ".github/workflows/self-build-alpha-dogfood.yml",
941
+ "authorityClass": "non-publication-oidc",
942
+ "publicationCapable": false,
943
+ "capabilityIds": [],
944
+ "credentialMode": "none",
945
+ "publisherWorkflowMode": "fixed",
946
+ "publisherWorkflowPath": ".github/workflows/self-build-alpha-dogfood.yml",
947
+ "environment": "",
948
+ "environmentMode": "fixed",
949
+ "runnerPolicy": "unqualified",
950
+ "notes": ""
951
+ },
952
+ {
953
+ "workflowPath": ".github/workflows/self-build-binary-distribution.yml",
954
+ "authorityClass": "evidence-publication",
955
+ "publicationCapable": false,
956
+ "capabilityIds": [],
957
+ "credentialMode": "none",
958
+ "publisherWorkflowMode": "fixed",
959
+ "publisherWorkflowPath": ".github/workflows/self-build-binary-distribution.yml",
960
+ "environment": "",
961
+ "environmentMode": "fixed",
962
+ "runnerPolicy": "unqualified",
963
+ "notes": ""
964
+ },
965
+ {
966
+ "workflowPath": ".github/workflows/self-build-demo-dogfood.yml",
711
967
  "authorityClass": "governance-write",
712
968
  "publicationCapable": false,
713
969
  "capabilityIds": [],
714
970
  "credentialMode": "none",
715
971
  "publisherWorkflowMode": "fixed",
716
- "publisherWorkflowPath": ".github/workflows/release-verify.yml",
972
+ "publisherWorkflowPath": ".github/workflows/self-build-demo-dogfood.yml",
717
973
  "environment": "",
718
974
  "environmentMode": "fixed",
719
975
  "runnerPolicy": "unqualified",
720
976
  "notes": ""
721
977
  },
722
978
  {
723
- "workflowPath": ".github/workflows/stable-candidate-patrol.yml",
979
+ "workflowPath": ".github/workflows/self-build-fixture.yml",
980
+ "authorityClass": "non-publication-oidc",
981
+ "publicationCapable": false,
982
+ "capabilityIds": [],
983
+ "credentialMode": "none",
984
+ "publisherWorkflowMode": "fixed",
985
+ "publisherWorkflowPath": ".github/workflows/self-build-fixture.yml",
986
+ "environment": "",
987
+ "environmentMode": "fixed",
988
+ "runnerPolicy": "unqualified",
989
+ "notes": ""
990
+ },
991
+ {
992
+ "workflowPath": ".github/workflows/self-build-release-verify-compat.yml",
724
993
  "authorityClass": "governance-write",
725
994
  "publicationCapable": false,
726
995
  "capabilityIds": [],
727
996
  "credentialMode": "none",
728
997
  "publisherWorkflowMode": "fixed",
729
- "publisherWorkflowPath": ".github/workflows/stable-candidate-patrol.yml",
998
+ "publisherWorkflowPath": ".github/workflows/self-build-release-verify-compat.yml",
730
999
  "environment": "",
731
1000
  "environmentMode": "fixed",
732
1001
  "runnerPolicy": "unqualified",
733
1002
  "notes": ""
734
1003
  },
735
1004
  {
736
- "workflowPath": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
1005
+ "workflowPath": ".github/workflows/self-ops-bootstrap-dogfood.yml",
737
1006
  "authorityClass": "product-publication",
738
1007
  "publicationCapable": true,
739
1008
  "capabilityIds": [
740
- "artifact.publish",
741
- "release.activate",
742
- "released-evidence.synthesize",
743
- "signed-channel.commit"
1009
+ "universal-candidate-execution"
744
1010
  ],
745
1011
  "credentialMode": "caller-secrets",
746
- "publisherWorkflowMode": "fixed",
747
- "publisherWorkflowPath": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
1012
+ "publisherWorkflowMode": "caller-bound",
1013
+ "publisherWorkflowPath": ".github/workflows/self-ops-bootstrap-dogfood.yml",
748
1014
  "environment": "none",
749
1015
  "environmentMode": "fixed",
750
1016
  "runnerPolicy": "qualified-measured",
751
1017
  "notes": ""
752
- }
753
- ],
754
- "workflowFacts": [
1018
+ },
1019
+ {
1020
+ "workflowPath": ".github/workflows/self-ops-dev-delivery.yml",
1021
+ "authorityClass": "governance-write",
1022
+ "publicationCapable": false,
1023
+ "capabilityIds": [],
1024
+ "credentialMode": "none",
1025
+ "publisherWorkflowMode": "fixed",
1026
+ "publisherWorkflowPath": ".github/workflows/self-ops-dev-delivery.yml",
1027
+ "environment": "",
1028
+ "environmentMode": "fixed",
1029
+ "runnerPolicy": "unqualified",
1030
+ "notes": ""
1031
+ },
1032
+ {
1033
+ "workflowPath": ".github/workflows/self-ops-governance-audit.yml",
1034
+ "authorityClass": "governance-write",
1035
+ "publicationCapable": false,
1036
+ "capabilityIds": [],
1037
+ "credentialMode": "none",
1038
+ "publisherWorkflowMode": "fixed",
1039
+ "publisherWorkflowPath": ".github/workflows/self-ops-governance-audit.yml",
1040
+ "environment": "",
1041
+ "environmentMode": "fixed",
1042
+ "runnerPolicy": "unqualified",
1043
+ "notes": ""
1044
+ },
1045
+ {
1046
+ "workflowPath": ".github/workflows/self-ops-housekeeping-daily.yml",
1047
+ "authorityClass": "governance-write",
1048
+ "publicationCapable": false,
1049
+ "capabilityIds": [],
1050
+ "credentialMode": "none",
1051
+ "publisherWorkflowMode": "fixed",
1052
+ "publisherWorkflowPath": ".github/workflows/self-ops-housekeeping-daily.yml",
1053
+ "environment": "",
1054
+ "environmentMode": "fixed",
1055
+ "runnerPolicy": "unqualified",
1056
+ "notes": ""
1057
+ },
1058
+ {
1059
+ "workflowPath": ".github/workflows/self-ops-housekeeping-monthly.yml",
1060
+ "authorityClass": "governance-write",
1061
+ "publicationCapable": false,
1062
+ "capabilityIds": [],
1063
+ "credentialMode": "none",
1064
+ "publisherWorkflowMode": "fixed",
1065
+ "publisherWorkflowPath": ".github/workflows/self-ops-housekeeping-monthly.yml",
1066
+ "environment": "",
1067
+ "environmentMode": "fixed",
1068
+ "runnerPolicy": "unqualified",
1069
+ "notes": ""
1070
+ },
1071
+ {
1072
+ "workflowPath": ".github/workflows/self-ops-housekeeping-weekly.yml",
1073
+ "authorityClass": "governance-write",
1074
+ "publicationCapable": false,
1075
+ "capabilityIds": [],
1076
+ "credentialMode": "none",
1077
+ "publisherWorkflowMode": "fixed",
1078
+ "publisherWorkflowPath": ".github/workflows/self-ops-housekeeping-weekly.yml",
1079
+ "environment": "",
1080
+ "environmentMode": "fixed",
1081
+ "runnerPolicy": "unqualified",
1082
+ "notes": ""
1083
+ },
1084
+ {
1085
+ "workflowPath": ".github/workflows/self-ops-merge-queue.yml",
1086
+ "authorityClass": "governance-write",
1087
+ "publicationCapable": false,
1088
+ "capabilityIds": [],
1089
+ "credentialMode": "none",
1090
+ "publisherWorkflowMode": "fixed",
1091
+ "publisherWorkflowPath": ".github/workflows/self-ops-merge-queue.yml",
1092
+ "environment": "",
1093
+ "environmentMode": "fixed",
1094
+ "runnerPolicy": "unqualified",
1095
+ "notes": ""
1096
+ },
1097
+ {
1098
+ "workflowPath": ".github/workflows/self-ops-patrol-daily.yml",
1099
+ "authorityClass": "governance-write",
1100
+ "publicationCapable": false,
1101
+ "capabilityIds": [],
1102
+ "credentialMode": "none",
1103
+ "publisherWorkflowMode": "fixed",
1104
+ "publisherWorkflowPath": ".github/workflows/self-ops-patrol-daily.yml",
1105
+ "environment": "",
1106
+ "environmentMode": "fixed",
1107
+ "runnerPolicy": "unqualified",
1108
+ "notes": ""
1109
+ },
1110
+ {
1111
+ "workflowPath": ".github/workflows/self-ops-patrol-monthly.yml",
1112
+ "authorityClass": "governance-write",
1113
+ "publicationCapable": false,
1114
+ "capabilityIds": [],
1115
+ "credentialMode": "none",
1116
+ "publisherWorkflowMode": "fixed",
1117
+ "publisherWorkflowPath": ".github/workflows/self-ops-patrol-monthly.yml",
1118
+ "environment": "",
1119
+ "environmentMode": "fixed",
1120
+ "runnerPolicy": "unqualified",
1121
+ "notes": ""
1122
+ },
1123
+ {
1124
+ "workflowPath": ".github/workflows/self-ops-patrol-weekly.yml",
1125
+ "authorityClass": "governance-write",
1126
+ "publicationCapable": false,
1127
+ "capabilityIds": [],
1128
+ "credentialMode": "none",
1129
+ "publisherWorkflowMode": "fixed",
1130
+ "publisherWorkflowPath": ".github/workflows/self-ops-patrol-weekly.yml",
1131
+ "environment": "",
1132
+ "environmentMode": "fixed",
1133
+ "runnerPolicy": "unqualified",
1134
+ "notes": ""
1135
+ },
1136
+ {
1137
+ "workflowPath": ".github/workflows/self-ops-promotion-recovery.yml",
1138
+ "authorityClass": "governance-write",
1139
+ "publicationCapable": false,
1140
+ "capabilityIds": [],
1141
+ "credentialMode": "none",
1142
+ "publisherWorkflowMode": "fixed",
1143
+ "publisherWorkflowPath": ".github/workflows/self-ops-promotion-recovery.yml",
1144
+ "environment": "",
1145
+ "environmentMode": "fixed",
1146
+ "runnerPolicy": "unqualified",
1147
+ "notes": ""
1148
+ },
1149
+ {
1150
+ "workflowPath": ".github/workflows/self-ops-stable-candidate-patrol.yml",
1151
+ "authorityClass": "governance-write",
1152
+ "publicationCapable": false,
1153
+ "capabilityIds": [],
1154
+ "credentialMode": "none",
1155
+ "publisherWorkflowMode": "fixed",
1156
+ "publisherWorkflowPath": ".github/workflows/self-ops-stable-candidate-patrol.yml",
1157
+ "environment": "",
1158
+ "environmentMode": "fixed",
1159
+ "runnerPolicy": "unqualified",
1160
+ "notes": ""
1161
+ },
1162
+ {
1163
+ "workflowPath": ".github/workflows/self-release-binary-assets.yml",
1164
+ "authorityClass": "governance-write",
1165
+ "publicationCapable": false,
1166
+ "capabilityIds": [],
1167
+ "credentialMode": "none",
1168
+ "publisherWorkflowMode": "fixed",
1169
+ "publisherWorkflowPath": ".github/workflows/self-release-binary-assets.yml",
1170
+ "environment": "",
1171
+ "environmentMode": "fixed",
1172
+ "runnerPolicy": "unqualified",
1173
+ "notes": ""
1174
+ },
1175
+ {
1176
+ "workflowPath": ".github/workflows/self-release-line-open.yml",
1177
+ "authorityClass": "governance-write",
1178
+ "publicationCapable": false,
1179
+ "capabilityIds": [],
1180
+ "credentialMode": "none",
1181
+ "publisherWorkflowMode": "fixed",
1182
+ "publisherWorkflowPath": ".github/workflows/self-release-line-open.yml",
1183
+ "environment": "",
1184
+ "environmentMode": "fixed",
1185
+ "runnerPolicy": "unqualified",
1186
+ "notes": ""
1187
+ },
1188
+ {
1189
+ "workflowPath": ".github/workflows/self-release-npm-dry-run.yml",
1190
+ "authorityClass": "dry-run-only",
1191
+ "publicationCapable": false,
1192
+ "capabilityIds": [],
1193
+ "credentialMode": "none",
1194
+ "publisherWorkflowMode": "fixed",
1195
+ "publisherWorkflowPath": ".github/workflows/self-release-npm-dry-run.yml",
1196
+ "environment": "",
1197
+ "environmentMode": "fixed",
1198
+ "runnerPolicy": "unqualified",
1199
+ "notes": ""
1200
+ },
1201
+ {
1202
+ "workflowPath": ".github/workflows/self-release-promote.yml",
1203
+ "authorityClass": "governance-write",
1204
+ "publicationCapable": false,
1205
+ "capabilityIds": [],
1206
+ "credentialMode": "none",
1207
+ "publisherWorkflowMode": "fixed",
1208
+ "publisherWorkflowPath": ".github/workflows/self-release-promote.yml",
1209
+ "environment": "",
1210
+ "environmentMode": "fixed",
1211
+ "runnerPolicy": "unqualified",
1212
+ "notes": ""
1213
+ },
1214
+ {
1215
+ "workflowPath": ".github/workflows/self-release-tail-dogfood.yml",
1216
+ "authorityClass": "product-publication",
1217
+ "publicationCapable": true,
1218
+ "capabilityIds": [
1219
+ "artifact.publish",
1220
+ "release.activate",
1221
+ "released-evidence.synthesize",
1222
+ "signed-channel.commit"
1223
+ ],
1224
+ "credentialMode": "caller-secrets",
1225
+ "publisherWorkflowMode": "fixed",
1226
+ "publisherWorkflowPath": ".github/workflows/self-release-tail-dogfood.yml",
1227
+ "environment": "none",
1228
+ "environmentMode": "fixed",
1229
+ "runnerPolicy": "qualified-measured",
1230
+ "notes": ""
1231
+ },
1232
+ {
1233
+ "workflowPath": ".github/workflows/stable-candidate-patrol.yml",
1234
+ "authorityClass": "governance-write",
1235
+ "publicationCapable": false,
1236
+ "capabilityIds": [],
1237
+ "credentialMode": "none",
1238
+ "publisherWorkflowMode": "fixed",
1239
+ "publisherWorkflowPath": ".github/workflows/stable-candidate-patrol.yml",
1240
+ "environment": "",
1241
+ "environmentMode": "fixed",
1242
+ "runnerPolicy": "unqualified",
1243
+ "notes": ""
1244
+ },
1245
+ {
1246
+ "workflowPath": ".github/workflows/universal-bootstrap-recovery.yml",
1247
+ "authorityClass": "product-publication",
1248
+ "publicationCapable": true,
1249
+ "capabilityIds": [
1250
+ "universal-candidate-execution"
1251
+ ],
1252
+ "credentialMode": "caller-secrets",
1253
+ "publisherWorkflowMode": "caller-bound",
1254
+ "publisherWorkflowPath": ".github/workflows/universal-bootstrap-recovery.yml",
1255
+ "environment": "none",
1256
+ "environmentMode": "fixed",
1257
+ "runnerPolicy": "qualified-measured",
1258
+ "notes": ""
1259
+ }
1260
+ ],
1261
+ "workflowFacts": [
1262
+ {
1263
+ "path": ".github/workflows/.auditable-demo.yml",
1264
+ "signals": [],
1265
+ "classified": true
1266
+ },
1267
+ {
1268
+ "path": ".github/workflows/.binary-release-assets.yml",
1269
+ "signals": [
1270
+ "write-permission",
1271
+ "environment",
1272
+ "github-release"
1273
+ ],
1274
+ "classified": true
1275
+ },
1276
+ {
1277
+ "path": ".github/workflows/.build-demo-adapter.yml",
1278
+ "signals": [],
1279
+ "classified": true
1280
+ },
1281
+ {
1282
+ "path": ".github/workflows/.build-engine.yml",
1283
+ "signals": [
1284
+ "write-permission",
1285
+ "oidc",
1286
+ "environment",
1287
+ "cloud-credential"
1288
+ ],
1289
+ "classified": true
1290
+ },
1291
+ {
1292
+ "path": ".github/workflows/.build-gate-profile.yml",
1293
+ "signals": [],
1294
+ "classified": false
1295
+ },
1296
+ {
1297
+ "path": ".github/workflows/.build-release-verify-compat.yml",
1298
+ "signals": [
1299
+ "write-permission",
1300
+ "cloud-credential"
1301
+ ],
1302
+ "classified": true
1303
+ },
1304
+ {
1305
+ "path": ".github/workflows/.build-sam-verify-compat.yml",
1306
+ "signals": [
1307
+ "cloud-credential"
1308
+ ],
1309
+ "classified": true
1310
+ },
1311
+ {
1312
+ "path": ".github/workflows/.build-wheel-verify-compat.yml",
1313
+ "signals": [
1314
+ "cloud-credential"
1315
+ ],
1316
+ "classified": true
1317
+ },
1318
+ {
1319
+ "path": ".github/workflows/.build.yml",
1320
+ "signals": [
1321
+ "write-permission",
1322
+ "oidc",
1323
+ "environment",
1324
+ "cloud-credential"
1325
+ ],
1326
+ "classified": true
1327
+ },
1328
+ {
1329
+ "path": ".github/workflows/.bump-minor-version.yml",
1330
+ "signals": [],
1331
+ "classified": false
1332
+ },
1333
+ {
1334
+ "path": ".github/workflows/.declarative-auditable-demo.yml",
1335
+ "signals": [
1336
+ "write-permission",
1337
+ "git-push"
1338
+ ],
1339
+ "classified": true
1340
+ },
1341
+ {
1342
+ "path": ".github/workflows/.gate-profile.yml",
1343
+ "signals": [],
1344
+ "classified": false
1345
+ },
1346
+ {
1347
+ "path": ".github/workflows/.ops-git-sync.yml",
1348
+ "signals": [
1349
+ "git-push"
1350
+ ],
1351
+ "classified": true
1352
+ },
1353
+ {
1354
+ "path": ".github/workflows/.publication-authority.yml",
1355
+ "signals": [],
1356
+ "classified": true
1357
+ },
1358
+ {
1359
+ "path": ".github/workflows/.release-authority.yml",
1360
+ "signals": [],
1361
+ "classified": true
1362
+ },
1363
+ {
1364
+ "path": ".github/workflows/.release-binary-assets.yml",
1365
+ "signals": [
1366
+ "write-permission",
1367
+ "environment",
1368
+ "github-release"
1369
+ ],
1370
+ "classified": true
1371
+ },
1372
+ {
1373
+ "path": ".github/workflows/.release-candidate-promote.yml",
1374
+ "signals": [],
1375
+ "classified": true
1376
+ },
1377
+ {
1378
+ "path": ".github/workflows/.release-minor-bump-compat.yml",
1379
+ "signals": [],
1380
+ "classified": false
1381
+ },
1382
+ {
1383
+ "path": ".github/workflows/.release-page-sync-retired.yml",
1384
+ "signals": [],
1385
+ "classified": false
1386
+ },
1387
+ {
1388
+ "path": ".github/workflows/.release-promote.yml",
1389
+ "signals": [],
1390
+ "classified": true
1391
+ },
1392
+ {
1393
+ "path": ".github/workflows/.release-verify.yml",
1394
+ "signals": [
1395
+ "write-permission",
1396
+ "cloud-credential"
1397
+ ],
1398
+ "classified": true
1399
+ },
1400
+ {
1401
+ "path": ".github/workflows/.sam-verify.yml",
1402
+ "signals": [
1403
+ "cloud-credential"
1404
+ ],
1405
+ "classified": true
1406
+ },
1407
+ {
1408
+ "path": ".github/workflows/.sync-release-page.yml",
1409
+ "signals": [],
1410
+ "classified": false
1411
+ },
1412
+ {
1413
+ "path": ".github/workflows/.sync-remote-git.yml",
1414
+ "signals": [
1415
+ "git-push"
1416
+ ],
1417
+ "classified": true
1418
+ },
1419
+ {
1420
+ "path": ".github/workflows/.web-surface.yml",
1421
+ "signals": [
1422
+ "write-permission",
1423
+ "oidc",
1424
+ "environment",
1425
+ "cloud-credential"
1426
+ ],
1427
+ "classified": true
1428
+ },
1429
+ {
1430
+ "path": ".github/workflows/.wheel-verify.yml",
1431
+ "signals": [
1432
+ "cloud-credential"
1433
+ ],
1434
+ "classified": true
1435
+ },
1436
+ {
1437
+ "path": ".github/workflows/artifact-signing-authority.yml",
1438
+ "signals": [
1439
+ "environment"
1440
+ ],
1441
+ "classified": true
1442
+ },
1443
+ {
1444
+ "path": ".github/workflows/bootstrap.yml",
1445
+ "signals": [],
1446
+ "classified": true
1447
+ },
1448
+ {
1449
+ "path": ".github/workflows/build.yml",
1450
+ "signals": [
1451
+ "write-permission",
1452
+ "oidc"
1453
+ ],
1454
+ "classified": true
1455
+ },
1456
+ {
1457
+ "path": ".github/workflows/buildchain-patrol.yml",
1458
+ "signals": [
1459
+ "write-permission"
1460
+ ],
1461
+ "classified": true
1462
+ },
1463
+ {
1464
+ "path": ".github/workflows/check.yml",
1465
+ "signals": [],
1466
+ "classified": false
1467
+ },
1468
+ {
1469
+ "path": ".github/workflows/dev-alpha-candidate-patrol.yml",
1470
+ "signals": [
1471
+ "write-permission"
1472
+ ],
1473
+ "classified": true
1474
+ },
1475
+ {
1476
+ "path": ".github/workflows/dev-delivery-warrant-cancel.yml",
1477
+ "signals": [
1478
+ "write-permission"
1479
+ ],
1480
+ "classified": true
1481
+ },
1482
+ {
1483
+ "path": ".github/workflows/dev-delivery-warrant-close.yml",
1484
+ "signals": [
1485
+ "write-permission"
1486
+ ],
1487
+ "classified": true
1488
+ },
1489
+ {
1490
+ "path": ".github/workflows/dev-pr-auto-merge.yml",
1491
+ "signals": [
1492
+ "write-permission"
1493
+ ],
1494
+ "classified": true
1495
+ },
1496
+ {
1497
+ "path": ".github/workflows/dev-qualification-patrol.yml",
1498
+ "signals": [
1499
+ "write-permission"
1500
+ ],
1501
+ "classified": true
1502
+ },
1503
+ {
1504
+ "path": ".github/workflows/engineering-housekeeper.yml",
1505
+ "signals": [],
1506
+ "classified": true
1507
+ },
1508
+ {
1509
+ "path": ".github/workflows/github-artifact-attestation.yml",
1510
+ "signals": [
1511
+ "write-permission",
1512
+ "oidc",
1513
+ "environment"
1514
+ ],
1515
+ "classified": true
1516
+ },
1517
+ {
1518
+ "path": ".github/workflows/paper-release-sealed.yml",
1519
+ "signals": [
1520
+ "write-permission",
1521
+ "oidc"
1522
+ ],
1523
+ "classified": true
1524
+ },
1525
+ {
1526
+ "path": ".github/workflows/paper-release.yml",
1527
+ "signals": [
1528
+ "write-permission",
1529
+ "oidc"
1530
+ ],
1531
+ "classified": true
1532
+ },
755
1533
  {
756
- "path": ".github/workflows/.auditable-demo.yml",
757
- "signals": [],
1534
+ "path": ".github/workflows/patrol-daily.yml",
1535
+ "signals": [
1536
+ "write-permission"
1537
+ ],
758
1538
  "classified": true
759
1539
  },
760
1540
  {
761
- "path": ".github/workflows/.binary-release-assets.yml",
1541
+ "path": ".github/workflows/patrol-monthly.yml",
762
1542
  "signals": [
763
- "write-permission",
764
- "environment",
765
- "github-release"
1543
+ "write-permission"
766
1544
  ],
767
1545
  "classified": true
768
1546
  },
769
1547
  {
770
- "path": ".github/workflows/.build.yml",
1548
+ "path": ".github/workflows/patrol-observed-evidence.yml",
771
1549
  "signals": [
772
- "write-permission",
773
1550
  "oidc",
774
1551
  "environment",
775
1552
  "cloud-credential"
@@ -777,30 +1554,19 @@
777
1554
  "classified": true
778
1555
  },
779
1556
  {
780
- "path": ".github/workflows/.bump-minor-version.yml",
781
- "signals": [],
782
- "classified": false
783
- },
784
- {
785
- "path": ".github/workflows/.declarative-auditable-demo.yml",
1557
+ "path": ".github/workflows/patrol-weekly.yml",
786
1558
  "signals": [
787
- "write-permission",
788
- "git-push"
1559
+ "write-permission"
789
1560
  ],
790
1561
  "classified": true
791
1562
  },
792
1563
  {
793
- "path": ".github/workflows/.gate-profile.yml",
1564
+ "path": ".github/workflows/public-build-adopter-qualification.yml",
794
1565
  "signals": [],
795
1566
  "classified": false
796
1567
  },
797
1568
  {
798
- "path": ".github/workflows/.publication-authority.yml",
799
- "signals": [],
800
- "classified": true
801
- },
802
- {
803
- "path": ".github/workflows/.release-candidate-promote.yml",
1569
+ "path": ".github/workflows/public-build-candidate.yml",
804
1570
  "signals": [
805
1571
  "write-permission",
806
1572
  "oidc"
@@ -808,171 +1574,155 @@
808
1574
  "classified": true
809
1575
  },
810
1576
  {
811
- "path": ".github/workflows/.release-docker.yml",
812
- "signals": [],
813
- "classified": false
814
- },
815
- {
816
- "path": ".github/workflows/.release-elastic-beanstalk.yml",
817
- "signals": [],
818
- "classified": false
819
- },
820
- {
821
- "path": ".github/workflows/.release-new-version.yml",
1577
+ "path": ".github/workflows/public-build-check.yml",
822
1578
  "signals": [],
823
1579
  "classified": false
824
1580
  },
825
1581
  {
826
- "path": ".github/workflows/.release-verify.yml",
1582
+ "path": ".github/workflows/public-build-demo.yml",
827
1583
  "signals": [
828
1584
  "write-permission",
829
- "cloud-credential"
1585
+ "git-push"
830
1586
  ],
831
1587
  "classified": true
832
1588
  },
833
1589
  {
834
- "path": ".github/workflows/.sam-release.yml",
835
- "signals": [],
836
- "classified": true
837
- },
838
- {
839
- "path": ".github/workflows/.sam-verify.yml",
1590
+ "path": ".github/workflows/public-build-publication.yml",
840
1591
  "signals": [
841
- "cloud-credential"
1592
+ "write-permission"
842
1593
  ],
843
1594
  "classified": true
844
1595
  },
845
1596
  {
846
- "path": ".github/workflows/.sync-release-page.yml",
1597
+ "path": ".github/workflows/public-build-stage-capsule-canary.yml",
847
1598
  "signals": [],
848
1599
  "classified": false
849
1600
  },
850
1601
  {
851
- "path": ".github/workflows/.sync-remote-git.yml",
1602
+ "path": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
852
1603
  "signals": [
853
- "git-push"
1604
+ "write-permission"
854
1605
  ],
855
1606
  "classified": true
856
1607
  },
857
1608
  {
858
- "path": ".github/workflows/.web-surface.yml",
1609
+ "path": ".github/workflows/public-ops-bootstrap-recovery.yml",
859
1610
  "signals": [
860
1611
  "write-permission",
861
- "oidc",
862
- "environment",
863
- "cloud-credential"
1612
+ "oidc"
864
1613
  ],
865
1614
  "classified": true
866
1615
  },
867
1616
  {
868
- "path": ".github/workflows/.wheel-release.yml",
1617
+ "path": ".github/workflows/public-ops-bootstrap.yml",
869
1618
  "signals": [],
870
1619
  "classified": true
871
1620
  },
872
1621
  {
873
- "path": ".github/workflows/.wheel-verify.yml",
1622
+ "path": ".github/workflows/public-ops-dev-auto-merge.yml",
874
1623
  "signals": [
875
- "cloud-credential"
1624
+ "write-permission"
876
1625
  ],
877
1626
  "classified": true
878
1627
  },
879
1628
  {
880
- "path": ".github/workflows/artifact-signing-authority.yml",
1629
+ "path": ".github/workflows/public-ops-dev-qualification-patrol.yml",
881
1630
  "signals": [
882
- "environment"
1631
+ "write-permission"
883
1632
  ],
884
1633
  "classified": true
885
1634
  },
886
1635
  {
887
- "path": ".github/workflows/auditable-demo-media-profile-qualification.yml",
1636
+ "path": ".github/workflows/public-ops-housekeeping.yml",
888
1637
  "signals": [],
889
- "classified": false
1638
+ "classified": true
890
1639
  },
891
1640
  {
892
- "path": ".github/workflows/auditable-demo.yml",
1641
+ "path": ".github/workflows/public-ops-observed-evidence.yml",
893
1642
  "signals": [
894
- "write-permission"
1643
+ "oidc",
1644
+ "environment",
1645
+ "cloud-credential"
895
1646
  ],
896
1647
  "classified": true
897
1648
  },
898
1649
  {
899
- "path": ".github/workflows/binary-distribution.yml",
1650
+ "path": ".github/workflows/public-ops-patrol-daily.yml",
900
1651
  "signals": [
901
1652
  "write-permission"
902
1653
  ],
903
1654
  "classified": true
904
1655
  },
905
1656
  {
906
- "path": ".github/workflows/binary-release-assets.yml",
1657
+ "path": ".github/workflows/public-ops-patrol-monthly.yml",
907
1658
  "signals": [
908
- "write-permission",
909
- "github-release"
1659
+ "write-permission"
910
1660
  ],
911
1661
  "classified": true
912
1662
  },
913
1663
  {
914
- "path": ".github/workflows/build-surface-fixture.yml",
915
- "signals": [],
916
- "classified": true
917
- },
918
- {
919
- "path": ".github/workflows/build.yml",
1664
+ "path": ".github/workflows/public-ops-patrol-weekly.yml",
920
1665
  "signals": [
921
- "write-permission",
922
- "oidc"
1666
+ "write-permission"
923
1667
  ],
924
1668
  "classified": true
925
1669
  },
926
1670
  {
927
- "path": ".github/workflows/buildchain-alpha-self-dogfood.yml",
1671
+ "path": ".github/workflows/public-ops-patrol.yml",
928
1672
  "signals": [
929
- "write-permission",
930
- "oidc"
1673
+ "write-permission"
931
1674
  ],
932
1675
  "classified": true
933
1676
  },
934
1677
  {
935
- "path": ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml",
1678
+ "path": ".github/workflows/public-ops-release-governance.yml",
936
1679
  "signals": [],
937
1680
  "classified": false
938
1681
  },
939
1682
  {
940
- "path": ".github/workflows/buildchain-dev-delivery.yml",
1683
+ "path": ".github/workflows/public-ops-stable-candidate-patrol.yml",
941
1684
  "signals": [
942
1685
  "write-permission"
943
1686
  ],
944
1687
  "classified": true
945
1688
  },
946
1689
  {
947
- "path": ".github/workflows/buildchain-patrol-daily.yml",
1690
+ "path": ".github/workflows/public-ops-tail-reseal.yml",
1691
+ "signals": [],
1692
+ "classified": false
1693
+ },
1694
+ {
1695
+ "path": ".github/workflows/public-ops-warrant-cancel.yml",
948
1696
  "signals": [
949
1697
  "write-permission"
950
1698
  ],
951
1699
  "classified": true
952
1700
  },
953
1701
  {
954
- "path": ".github/workflows/buildchain-patrol-monthly.yml",
1702
+ "path": ".github/workflows/public-ops-warrant-close.yml",
955
1703
  "signals": [
956
1704
  "write-permission"
957
1705
  ],
958
1706
  "classified": true
959
1707
  },
960
1708
  {
961
- "path": ".github/workflows/buildchain-patrol-weekly.yml",
1709
+ "path": ".github/workflows/public-release-artifact-attestation.yml",
962
1710
  "signals": [
963
- "write-permission"
1711
+ "write-permission",
1712
+ "oidc",
1713
+ "environment"
964
1714
  ],
965
1715
  "classified": true
966
1716
  },
967
1717
  {
968
- "path": ".github/workflows/buildchain-patrol.yml",
1718
+ "path": ".github/workflows/public-release-oci-compose-preview.yml",
969
1719
  "signals": [
970
1720
  "write-permission"
971
1721
  ],
972
1722
  "classified": true
973
1723
  },
974
1724
  {
975
- "path": ".github/workflows/buildchain-ref-promotion-recovery.yml",
1725
+ "path": ".github/workflows/public-release-paper-sealed.yml",
976
1726
  "signals": [
977
1727
  "write-permission",
978
1728
  "oidc"
@@ -980,7 +1730,7 @@
980
1730
  "classified": true
981
1731
  },
982
1732
  {
983
- "path": ".github/workflows/buildchain-ref-promotion.yml",
1733
+ "path": ".github/workflows/public-release-paper.yml",
984
1734
  "signals": [
985
1735
  "write-permission",
986
1736
  "oidc"
@@ -988,171 +1738,205 @@
988
1738
  "classified": true
989
1739
  },
990
1740
  {
991
- "path": ".github/workflows/buildchain-stable-candidate-patrol.yml",
992
- "signals": [
993
- "write-permission"
994
- ],
1741
+ "path": ".github/workflows/public-release-promote.yml",
1742
+ "signals": [],
995
1743
  "classified": true
996
1744
  },
997
1745
  {
998
- "path": ".github/workflows/buildchain-stable-candidate-qualification.yml",
999
- "signals": [],
1000
- "classified": false
1746
+ "path": ".github/workflows/public-release-propagation.yml",
1747
+ "signals": [
1748
+ "write-permission",
1749
+ "git-push"
1750
+ ],
1751
+ "classified": true
1001
1752
  },
1002
1753
  {
1003
- "path": ".github/workflows/candidate-lab.yml",
1004
- "signals": [],
1005
- "classified": false
1754
+ "path": ".github/workflows/public-release-signing-authority.yml",
1755
+ "signals": [
1756
+ "environment"
1757
+ ],
1758
+ "classified": true
1006
1759
  },
1007
1760
  {
1008
- "path": ".github/workflows/check.yml",
1761
+ "path": ".github/workflows/public-release-tail.yml",
1009
1762
  "signals": [],
1010
- "classified": false
1763
+ "classified": true
1011
1764
  },
1012
1765
  {
1013
- "path": ".github/workflows/dev-alpha-candidate-patrol.yml",
1766
+ "path": ".github/workflows/public-release-web.yml",
1014
1767
  "signals": [
1015
- "write-permission"
1768
+ "write-permission",
1769
+ "oidc",
1770
+ "environment",
1771
+ "cloud-credential"
1016
1772
  ],
1017
1773
  "classified": true
1018
1774
  },
1019
1775
  {
1020
- "path": ".github/workflows/dev-delivery-warrant-cancel.yml",
1776
+ "path": ".github/workflows/publication-artifact.yml",
1021
1777
  "signals": [
1022
1778
  "write-permission"
1023
1779
  ],
1024
1780
  "classified": true
1025
1781
  },
1026
1782
  {
1027
- "path": ".github/workflows/dev-delivery-warrant-close.yml",
1783
+ "path": ".github/workflows/release-candidate-promote.yml",
1784
+ "signals": [],
1785
+ "classified": true
1786
+ },
1787
+ {
1788
+ "path": ".github/workflows/release-governance-reconcile.yml",
1789
+ "signals": [],
1790
+ "classified": false
1791
+ },
1792
+ {
1793
+ "path": ".github/workflows/release-propagation.yml",
1028
1794
  "signals": [
1029
- "write-permission"
1795
+ "write-permission",
1796
+ "git-push"
1030
1797
  ],
1031
1798
  "classified": true
1032
1799
  },
1033
1800
  {
1034
- "path": ".github/workflows/dev-merge-queue-governance.yml",
1801
+ "path": ".github/workflows/release-tail.yml",
1035
1802
  "signals": [],
1036
1803
  "classified": true
1037
1804
  },
1038
1805
  {
1039
- "path": ".github/workflows/dev-pr-auto-merge.yml",
1806
+ "path": ".github/workflows/self-build-adopter-dogfood.yml",
1807
+ "signals": [],
1808
+ "classified": false
1809
+ },
1810
+ {
1811
+ "path": ".github/workflows/self-build-alpha-dogfood.yml",
1040
1812
  "signals": [
1041
- "write-permission"
1813
+ "write-permission",
1814
+ "oidc"
1042
1815
  ],
1043
1816
  "classified": true
1044
1817
  },
1045
1818
  {
1046
- "path": ".github/workflows/dev-qualification-patrol.yml",
1819
+ "path": ".github/workflows/self-build-binary-distribution.yml",
1047
1820
  "signals": [
1048
1821
  "write-permission"
1049
1822
  ],
1050
1823
  "classified": true
1051
1824
  },
1052
1825
  {
1053
- "path": ".github/workflows/engineering-housekeeper-daily.yml",
1826
+ "path": ".github/workflows/self-build-candidate-lab.yml",
1827
+ "signals": [],
1828
+ "classified": false
1829
+ },
1830
+ {
1831
+ "path": ".github/workflows/self-build-demo-dogfood.yml",
1054
1832
  "signals": [
1055
1833
  "write-permission"
1056
1834
  ],
1057
1835
  "classified": true
1058
1836
  },
1059
1837
  {
1060
- "path": ".github/workflows/engineering-housekeeper-monthly.yml",
1061
- "signals": [
1062
- "write-permission"
1063
- ],
1838
+ "path": ".github/workflows/self-build-demo-media-qualification.yml",
1839
+ "signals": [],
1840
+ "classified": false
1841
+ },
1842
+ {
1843
+ "path": ".github/workflows/self-build-fixture.yml",
1844
+ "signals": [],
1064
1845
  "classified": true
1065
1846
  },
1066
1847
  {
1067
- "path": ".github/workflows/engineering-housekeeper-weekly.yml",
1848
+ "path": ".github/workflows/self-build-public-consumer-dogfood.yml",
1849
+ "signals": [],
1850
+ "classified": false
1851
+ },
1852
+ {
1853
+ "path": ".github/workflows/self-build-release-verify-compat.yml",
1068
1854
  "signals": [
1069
1855
  "write-permission"
1070
1856
  ],
1071
1857
  "classified": true
1072
1858
  },
1073
1859
  {
1074
- "path": ".github/workflows/engineering-housekeeper.yml",
1860
+ "path": ".github/workflows/self-build-stable-candidate-qualification.yml",
1075
1861
  "signals": [],
1076
- "classified": true
1862
+ "classified": false
1077
1863
  },
1078
1864
  {
1079
- "path": ".github/workflows/github-artifact-attestation.yml",
1865
+ "path": ".github/workflows/self-build-verify.yml",
1866
+ "signals": [],
1867
+ "classified": false
1868
+ },
1869
+ {
1870
+ "path": ".github/workflows/self-ops-bootstrap-dogfood.yml",
1080
1871
  "signals": [
1081
1872
  "write-permission",
1082
- "oidc",
1083
- "environment"
1873
+ "oidc"
1084
1874
  ],
1085
1875
  "classified": true
1086
1876
  },
1087
1877
  {
1088
- "path": ".github/workflows/github-governance-audit.yml",
1878
+ "path": ".github/workflows/self-ops-dev-delivery.yml",
1089
1879
  "signals": [
1090
1880
  "write-permission"
1091
1881
  ],
1092
1882
  "classified": true
1093
1883
  },
1094
1884
  {
1095
- "path": ".github/workflows/npm-publish.yml",
1885
+ "path": ".github/workflows/self-ops-governance-audit.yml",
1096
1886
  "signals": [
1097
- "npm-publish"
1887
+ "write-permission"
1098
1888
  ],
1099
1889
  "classified": true
1100
1890
  },
1101
1891
  {
1102
- "path": ".github/workflows/paper-release-sealed.yml",
1892
+ "path": ".github/workflows/self-ops-housekeeping-daily.yml",
1103
1893
  "signals": [
1104
- "write-permission",
1105
- "oidc"
1894
+ "write-permission"
1106
1895
  ],
1107
1896
  "classified": true
1108
1897
  },
1109
1898
  {
1110
- "path": ".github/workflows/paper-release.yml",
1899
+ "path": ".github/workflows/self-ops-housekeeping-monthly.yml",
1111
1900
  "signals": [
1112
- "write-permission",
1113
- "oidc"
1901
+ "write-permission"
1114
1902
  ],
1115
1903
  "classified": true
1116
1904
  },
1117
1905
  {
1118
- "path": ".github/workflows/patrol-daily.yml",
1906
+ "path": ".github/workflows/self-ops-housekeeping-weekly.yml",
1119
1907
  "signals": [
1120
1908
  "write-permission"
1121
1909
  ],
1122
1910
  "classified": true
1123
1911
  },
1124
1912
  {
1125
- "path": ".github/workflows/patrol-monthly.yml",
1126
- "signals": [
1127
- "write-permission"
1128
- ],
1913
+ "path": ".github/workflows/self-ops-merge-queue.yml",
1914
+ "signals": [],
1129
1915
  "classified": true
1130
1916
  },
1131
1917
  {
1132
- "path": ".github/workflows/patrol-observed-evidence.yml",
1918
+ "path": ".github/workflows/self-ops-patrol-daily.yml",
1133
1919
  "signals": [
1134
- "oidc",
1135
- "environment",
1136
- "cloud-credential"
1920
+ "write-permission"
1137
1921
  ],
1138
1922
  "classified": true
1139
1923
  },
1140
1924
  {
1141
- "path": ".github/workflows/patrol-weekly.yml",
1925
+ "path": ".github/workflows/self-ops-patrol-monthly.yml",
1142
1926
  "signals": [
1143
1927
  "write-permission"
1144
1928
  ],
1145
1929
  "classified": true
1146
1930
  },
1147
1931
  {
1148
- "path": ".github/workflows/publication-artifact.yml",
1932
+ "path": ".github/workflows/self-ops-patrol-weekly.yml",
1149
1933
  "signals": [
1150
1934
  "write-permission"
1151
1935
  ],
1152
1936
  "classified": true
1153
1937
  },
1154
1938
  {
1155
- "path": ".github/workflows/release-candidate-promote.yml",
1939
+ "path": ".github/workflows/self-ops-promotion-recovery.yml",
1156
1940
  "signals": [
1157
1941
  "write-permission",
1158
1942
  "oidc"
@@ -1160,72 +1944,70 @@
1160
1944
  "classified": true
1161
1945
  },
1162
1946
  {
1163
- "path": ".github/workflows/release-governance-reconcile.yml",
1947
+ "path": ".github/workflows/self-ops-recovery-failure-dogfood.yml",
1164
1948
  "signals": [],
1165
1949
  "classified": false
1166
1950
  },
1167
1951
  {
1168
- "path": ".github/workflows/release-line-bootstrap.yml",
1169
- "signals": [
1170
- "write-permission",
1171
- "git-push"
1172
- ],
1173
- "classified": true
1174
- },
1175
- {
1176
- "path": ".github/workflows/release-new-version.yml",
1952
+ "path": ".github/workflows/self-ops-runner-smoke.yml",
1177
1953
  "signals": [],
1178
1954
  "classified": false
1179
1955
  },
1180
1956
  {
1181
- "path": ".github/workflows/release-propagation.yml",
1957
+ "path": ".github/workflows/self-ops-stable-candidate-patrol.yml",
1182
1958
  "signals": [
1183
- "write-permission",
1184
- "git-push"
1959
+ "write-permission"
1185
1960
  ],
1186
1961
  "classified": true
1187
1962
  },
1188
1963
  {
1189
- "path": ".github/workflows/release-tail.yml",
1190
- "signals": [],
1964
+ "path": ".github/workflows/self-release-binary-assets.yml",
1965
+ "signals": [
1966
+ "write-permission",
1967
+ "github-release"
1968
+ ],
1191
1969
  "classified": true
1192
1970
  },
1193
1971
  {
1194
- "path": ".github/workflows/release-verify.yml",
1972
+ "path": ".github/workflows/self-release-line-open.yml",
1195
1973
  "signals": [
1196
- "write-permission"
1974
+ "write-permission",
1975
+ "git-push"
1197
1976
  ],
1198
1977
  "classified": true
1199
1978
  },
1200
1979
  {
1201
- "path": ".github/workflows/schedule-purge-artifacts.yml",
1980
+ "path": ".github/workflows/self-release-new-version-compat.yml",
1202
1981
  "signals": [],
1203
1982
  "classified": false
1204
1983
  },
1205
1984
  {
1206
- "path": ".github/workflows/self-hosted-runner-smoke.yml",
1985
+ "path": ".github/workflows/self-release-next-development.yml",
1207
1986
  "signals": [],
1208
1987
  "classified": false
1209
1988
  },
1210
1989
  {
1211
- "path": ".github/workflows/stable-candidate-patrol.yml",
1990
+ "path": ".github/workflows/self-release-npm-dry-run.yml",
1212
1991
  "signals": [
1213
- "write-permission"
1992
+ "npm-publish"
1214
1993
  ],
1215
1994
  "classified": true
1216
1995
  },
1217
1996
  {
1218
- "path": ".github/workflows/v4-adopter-delivery-dogfood.yml",
1219
- "signals": [],
1220
- "classified": false
1997
+ "path": ".github/workflows/self-release-promote.yml",
1998
+ "signals": [
1999
+ "write-permission",
2000
+ "oidc"
2001
+ ],
2002
+ "classified": true
1221
2003
  },
1222
2004
  {
1223
- "path": ".github/workflows/v4-adopter-delivery.yml",
2005
+ "path": ".github/workflows/self-release-rehearsal-dogfood.yml",
1224
2006
  "signals": [],
1225
2007
  "classified": false
1226
2008
  },
1227
2009
  {
1228
- "path": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
2010
+ "path": ".github/workflows/self-release-tail-dogfood.yml",
1229
2011
  "signals": [
1230
2012
  "write-permission",
1231
2013
  "oidc",
@@ -1234,30 +2016,20 @@
1234
2016
  "classified": true
1235
2017
  },
1236
2018
  {
1237
- "path": ".github/workflows/v4-public-consumer-dogfood.yml",
1238
- "signals": [],
1239
- "classified": false
1240
- },
1241
- {
1242
- "path": ".github/workflows/v4-publication-rehearsal-dogfood.yml",
1243
- "signals": [],
1244
- "classified": false
1245
- },
1246
- {
1247
- "path": ".github/workflows/v4-stage-capsule-canary.yml",
1248
- "signals": [],
1249
- "classified": false
1250
- },
1251
- {
1252
- "path": ".github/workflows/v4-tail-reseal.yml",
1253
- "signals": [],
1254
- "classified": false
2019
+ "path": ".github/workflows/stable-candidate-patrol.yml",
2020
+ "signals": [
2021
+ "write-permission"
2022
+ ],
2023
+ "classified": true
1255
2024
  },
1256
2025
  {
1257
- "path": ".github/workflows/verify.yml",
1258
- "signals": [],
1259
- "classified": false
2026
+ "path": ".github/workflows/universal-bootstrap-recovery.yml",
2027
+ "signals": [
2028
+ "write-permission",
2029
+ "oidc"
2030
+ ],
2031
+ "classified": true
1260
2032
  }
1261
2033
  ],
1262
- "registryDigest": "123c20ea9806ce8ba7b82545165b30ce08537eee64795c2de11f0cc3546a0844"
2034
+ "registryDigest": "e5eb0d7ee3cce4a25674909154f6bd0bf736d5b93df41c1d435c468aad50c32a"
1263
2035
  }