@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/docs/v4-delivery-warrant-semantic-diff.md

@@ -50,7 +50,7 @@ provider effects, modify v3 authority, or provide a v4 write cutover receipt.
 
 ## Run the gate
 
-Call `runV4DeliveryWarrantSemanticDiffGate` with exact source revisions,
+Call `runDeliveryWarrantSemanticDiffGate` with exact source revisions,
 explicit observation time, schema and runner roots, public-safe retained cases,
 bounded fault probes, an observation retention sink, and a report retention
 sink. The returned report is canonical JSON data suitable for a caller-owned
@@ -59,7 +59,7 @@ retained evidence file.
 The checked-in focused suite exercises that API against the real Rust host:
 
 ```sh
-node --test tests/v4-delivery-warrant-fixture-runner.test.mjs
+node --test tests/delivery-warrant-fixture-runner.test.mjs
 ```
 
 A qualified report makes only the next
@@ -71,5 +71,5 @@ documented in
 Focused verification:
 
 ```sh
-pnpm run check:v4-contracts
+pnpm run check:contracts
 ```

package/docs/v4-production-release.md

@@ -7,12 +7,12 @@ source_level: repository-contracts + protected-provider-readback
 confidence: high
 sensitivity: public
 evidence_grade: A
-review_state: self-reviewed
-last_reviewed: 2026-08-13
+review_state: unreviewed
+last_reviewed: 2026-09-07
 ai_provenance:
-  model_family: GPT-5
+  model_family: GPT-6
   product: Codex
-  generated_at: 2026-08-13
+  generated_at: 2026-09-07
   invisible_context: Provider credentials and private provider state were not read.
 ---
 
@@ -26,8 +26,15 @@ dev/v4/v4.0 -> alpha/v4/v4.0 -> release/v4/v4.0
 ```
 
 Public consumers use `v4-alpha` for the current prerelease channel and `v4`
-for stable. Reproducible consumers may pin an exact 40-character commit or an
-exact immutable release tag such as `v4.0.0`.
+for stable, with matching stable and alpha contract locks. Exact commits and
+immutable release tags identify retained evidence and explicitly admitted runtime
+inputs; tracked v4 reusable-workflow selectors remain `@v4` or `@v4-alpha`.
+
+Before qualifying a new release, run `node scripts/check-universal-workflow-bootstrap.mjs`.
+The required repository check rejects an expired or not-yet-valid candidate admission
+policy before publication. Renew the bounded validity window through protected review;
+keep its capability, permission, reviewer and exact-source requirements unchanged.
+Historical publication receipts remain immutable when a later admission window expires.
 
 The release transaction is fail-closed. The v4 provider-operation journal,
 activation plan, stable publication fence, and partial-mutation recovery plan
@@ -51,8 +58,9 @@ exact alpha tag, and npm's `alpha` tag.
 ## Non-destructive rollback
 
 Rollback never rewrites an exact tag, release, package version, Passport, or
-provider journal. Stop forward promotion, pin consumers to the last verified
-exact v4 SHA or exact stable tag, and use the retained `release/v3/v3.0`
+provider journal. Stop forward promotion and select the last verified exact
+v4 runtime through an admitted, non-persistent recovery input; keep tracked v4
+workflow selectors on their locked floating channel. Use `release/v3/v3.0`
 coordinate only as an explicit compatibility rollback reference. Restoring v3
 as production authority requires a new reviewed cutover; it is not an implicit
 fallback.
@@ -61,3 +69,64 @@ Before any retry, compare the current provider state with the retained
 transaction and operation roots. Resume only missing eligible operations.
 Conflicting state remains `repair-required` or terminal and must not be
 converted into success by moving a floating ref.
+
+## Publication settlement and binary recovery
+
+Publication, next-development advancement, and binary distribution have separate
+results. A completed native ReleaseReceipt remains publication evidence when the
+later generated Dev PR is still pending or its enqueue call fails. SETTLE verifies
+the immutable invocation, transaction, both provider states, receipt and Passport
+roots even when APPLY fails after publication. It has no provider write permission.
+
+APPLY retains that exact chain before waiting for next-development in the existing GitHub Release as
+`buildchain-publication-settlement.json`; it reads the exact tag and original
+`buildchain.release.json` before adding the packet. The APPLY artifact also retains
+`delivery-summary.json`, which reports publication and next-development separately.
+A green workflow label cannot substitute for this receipt verification.
+
+Binary Distribution reads this settlement and the original publication Passport.
+Tag creation can precede settlement, so it waits at most 40 observations, 15 seconds
+apart, for missing evidence. A mismatched source, tag, Passport or receipt fails
+immediately. It no longer requires a legacy `buildchain/release-state/*` ref for v4.
+
+The sealed binary publisher retains the publication Passport and writes its own
+Passport as `buildchain.binary.release.json`. All v4 asset collisions are checked
+before uploads: identical bytes are preserved, absent assets are added, and
+conflicting bytes are rejected. Each publication authorization is retained as
+`buildchain.binary.capability-<sha256>.json`, so a fresh recovery capability does
+not overwrite an earlier grant. Existing assets are never clobbered. Recovery uses
+the same exact successful Binary Distribution evidence run through
+`self-release-binary-assets.yml`; it does not rebuild already admitted archives or
+create another npm version. Read back all three platform archives, checksums,
+both Passports and the settlement packet before declaring distribution complete.
+
+The native publication receipt authorizes no stable promotion and makes no claim
+that a pending next-development PR has merged. Inspect the exact PR head, protected
+base and merge result independently. A retry of the publication phase must first
+read retained provider facts and resume only missing operations.
+
+## Automatic next-development review
+
+`self-release-next-development.yml` observes a successful exact `Verify` PR run
+for a same-repository `chore/next-development/*` branch. It executes only the
+protected default branch runtime. The PR must have one parent equal to the
+current protected Dev head. The protected generator reconstructs every tracked
+byte, permits only the declared immediate alpha version increment, and verifies
+the completed alpha settlement against the exact tag and original Passport.
+The published source tree must equal the protected development base tree.
+
+The verification step receives no approval credential and never executes PR
+code. A separate step uses `BUILDCHAIN_APPROVAL_TOKEN`, verifies that its identity
+is the independent `kungfu-origin` CODEOWNER, rereads the exact PR/run/base, and
+approves only that commit. Existing requests for changes stop automation.
+The exact approval is read back before queue admission with the separate
+`BUILDCHAIN_PROMOTION_TOKEN`. Required checks, CODEOWNER protection and native
+merge-group verification remain enforced. Missing credentials or evidence,
+forks, source changes and base/head drift fail closed.
+
+The producer waits for pending independent review and required checks with a
+bounded retry budget. Publication evidence is already durable during this wait,
+so binaries can proceed independently. The reviewer also enqueues the verified
+head idempotently, allowing a producer interruption to leave a recoverable PR.
+An interrupted producer run remains failed; a successful later release is needed
+to establish an uninterrupted end-to-end publication.

package/docs/v4-publication-rehearsal.md

@@ -27,7 +27,7 @@ release candidate and asks the production release-tail planner and executor to
 simulate, replay, or observe provider-facing publication behavior.
 
 The rooted parity matrix is
-[`architecture/v4-publication-rehearsal-parity.json`](../architecture/v4-publication-rehearsal-parity.json),
+[`architecture/publication-rehearsal-parity.json`](../architecture/publication-rehearsal-parity.json),
 and the public schema is
 [`v4-publication-rehearsal-capsule-v1.schema.json`](../contracts/v4-publication-rehearsal-capsule-v1.schema.json).
 
@@ -125,6 +125,6 @@ records Linux, macOS and Windows projections. Their capsule, transaction,
 state, and evidence roots are byte-identical. Regenerate or verify them with:
 
 ```sh
-node scripts/v4-publication-rehearsal-fixture.mjs
-node scripts/v4-publication-rehearsal-fixture.mjs --check
+node scripts/publication-rehearsal-fixture.mjs
+node scripts/publication-rehearsal-fixture.mjs --check
 ```

package/docs/v4-runtime-ref-resume-authority.md

@@ -60,9 +60,9 @@ construction and verification.
 
 Normative files:
 
-- `architecture/v4-runtime-ref-resume-authority.json`
+- `architecture/runtime-ref-resume-authority.json`
 - `contracts/v4-runtime-ref-resume-authority-v1.schema.json`
-- `packages/core/v4-runtime-ref-resume-authority.js`
+- `packages/core/runtime-ref-resume-authority.js`
 - `scripts/authorize-promotion-runtime-override.cjs`
 
 This contract changes no v3 behavior, grants no provider mutation authority,

package/docs/v4-rust-wasm-production-authority.md

@@ -0,0 +1,58 @@
+---
+status: draft
+period: 2026-09-04
+theme: buildchain-v4-rust-wasm-production-authority
+doc_type: architecture
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-09-04
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-09-04
+  invisible_context: not-claimed
+---
+
+# Buildchain v4 Rust/WASM production authority
+
+Buildchain v4 的确定性发布语义由
+`crates/buildchain-domain-contracts` 编译出的同一份 WebAssembly artifact 执行。Node
+仍是 GitHub Action 和 npm 包的宿主，但只负责 provider SDK、文件系统、凭据、环境变量及
+workflow 输入输出等副作用边界。权威契约见
+`architecture/rust-wasm-production-authority.json`。
+
+## 分发与调用
+
+`packages/core/buildchain-domain.wasm` 与 JavaScript 一起提交和发布。三个生产 Action
+在构建时把完全相同的字节复制到各自 `dist/`；运行时不进入调用方仓库寻找 Rust
+源码，也不要求安装 Rust。`packages/core/domain-wasm.js` 从自身相邻路径同步读取
+artifact，先核验生成元数据中的 SHA-256，再实例化 WebAssembly 并通过封闭 JSON/bytes
+ABI 调用领域操作。
+
+缺失、被篡改、无法实例化、缺少导出、ABI 版本不符、trap 或非法响应都会失败关闭；
+不存在 JavaScript 领域算法回退。公共 JavaScript API 保留为薄 facade，调用者无须改成
+直接操作 WASM 内存。
+
+## 构建和审计
+
+`pnpm run build:wasm` 使用锁定的 Rust 工具链和 `wasm32-unknown-unknown` target 生成
+artifact 与绑定元数据，并把 Cargo 依赖源目录映射到稳定的虚拟路径，禁止主机 Cargo
+registry 路径进入 artifact。`pnpm run check:wasm` 在干净临时 target 目录重新构建并逐字节
+比较已跟踪 artifact。这个检查不是生产运行时的重复编译：生产只加载已提交字节；检查
+用于证明这些字节仍能由当前 Rust 真相源和锁定工具链唯一导出，从而阻止源码、二进制或
+生成元数据静默漂移。
+
+受保护的 Verify 在 Linux 完成可复现构建，并在 Linux x64、macOS arm64 和 Windows x64
+上用 Node 24 直接加载同一提交中的 artifact。Action bundle 检查同时证明三个 `dist/`
+副本与核心 artifact 完全一致。
+
+## 权威边界
+
+Rust/WASM 决定 canonical JSON/content root、release invocation、product publication、
+provider journal/readback fold、activation、stable fence、partial-mutation recovery 与
+release-tail 的计划、状态转换、重试/readback 和 receipt。Node 执行 Rust 返回的明确
+instruction，把 provider observation 或归类后的 provider fault 回送给 Rust，由 Rust
+决定下一状态；Node 不写第二套相同领域规则。

package/docs/v4-stage-capsule.md

@@ -20,7 +20,7 @@ ai_provenance:
 
 ## Platform checkpoint projection
 
-`architecture/v4-platform-stage-checkpoints.json` is the single declaration
+`architecture/platform-stage-checkpoints.json` is the single declaration
 for the macOS arm64, Linux x64, and Windows x64 shadow checkpoint lanes. It
 defines the allowed platform/stage pairs and the exact declared inputs,
 outputs, environment names, toolchains, and portable restore paths.
@@ -100,19 +100,19 @@ GitHub Artifact and S3-compatible adapters expose only `effect-disabled` and
 `fixture-backed` modes in this slice. They accept rooted locators, never raw
 credentials or signed URLs, and cannot perform a provider upload or restore.
 The executable architecture ceiling is
-[`v4-stage-capsule-store-contract.json`](../architecture/v4-stage-capsule-store-contract.json),
+[`stage-capsule-store-contract.json`](../architecture/stage-capsule-store-contract.json),
 and the shared Rust/JavaScript fixture is
 [`shared.json`](../contracts/fixtures/v4-stage-capsule-store-v1/shared.json).
 
 Focused verification:
 
 ```sh
-pnpm run check:v4-contracts
+pnpm run check:contracts
 ```
 
 ## Deterministic resume planning
 
-`architecture/v4-stage-capsule-resume-planner.json` closes the Wave 2 resume
+`architecture/stage-capsule-resume-planner.json` closes the Wave 2 resume
 planner. Its request is an explicit topological stage graph with targets,
 expected Capsule identity and retention, current Capsule/availability
 observations, an evaluation clock, and separately declared provider or
@@ -133,11 +133,11 @@ shadow-only: it does not skip a v3 production stage or move v3 authority.
 
 ## Three-platform qualification and Wave reconciliation
 
-`architecture/v4-stage-capsule-qualification.json` closes the Wave 2
+`architecture/stage-capsule-qualification.json` closes the Wave 2
 qualification boundary. Buildchain and external repositories use the same
 Buildchain-owned public reusable workflow,
-`.github/workflows/v4-stage-capsule-canary.yml`. Buildchain's caller is the thin
-`.github/workflows/v4-public-consumer-dogfood.yml`; it has no steps, copied
+`.github/workflows/public-build-stage-capsule-canary.yml`. Buildchain's caller is the thin
+`.github/workflows/self-build-public-consumer-dogfood.yml`; it has no steps, copied
 orchestration, local action, direct qualification invocation, or private
 consumer profile. Candidate recursion is resolved only by publishing the exact
 candidate at `train/v4/v4.0/<capability>` and calling that fully qualified
@@ -182,12 +182,12 @@ authorized by this qualification.
 Focused local rehearsal:
 
 ```sh
-node scripts/v4-stage-capsule-qualification.mjs campaign \
+node scripts/stage-capsule-qualification.mjs campaign \
   --work-root /tmp/buildchain-v4-stage-qualification \
   --platform linux-x64 \
   --consumer buildchain \
   --runtime-ref <exact-buildchain-commit> \
   --consumer-source-revision <exact-consumer-commit> \
   --consumer-root . \
-  --lifecycle-evidence-root .buildchain/artifacts/v4-stage-capsule-canary
+  --lifecycle-evidence-root .buildchain/artifacts/stage-capsule-canary
 ```

package/docs/v4-tail-reseal.md

@@ -56,7 +56,7 @@ receipt creation and verification.
 ## Reusable workflow
 
 Consumers invoke
-`kungfu-systems/buildchain/.github/workflows/v4-tail-reseal.yml@v4-alpha` from a
+`kungfu-systems/buildchain/.github/workflows/public-ops-tail-reseal.yml@v4-alpha` from a
 trusted, same-repository workflow. The caller supplies the rooted request, the
 original candidate consumer-policy receipt, a reviewed macOS finalization
 command, and the explicitly named signing secret. The command must write:
@@ -70,4 +70,4 @@ and archive digest; no credential or provider effect is replayed from a Stage
 Capsule.
 
 The v3-to-v4 invariant mapping is recorded in
-[`architecture/v4-tail-reseal-parity.json`](../architecture/v4-tail-reseal-parity.json).
+[`architecture/tail-reseal-parity.json`](../architecture/tail-reseal-parity.json).

package/docs/workflow-catalog.md

@@ -0,0 +1,155 @@
+---
+status: active
+period: ongoing
+theme: workflow-taxonomy
+doc_type: technical-reference
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-05
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-05
+  visible_context: Repository workflow source and the approved naming scheme
+  invisible_context_boundary: No credentials or unpublished provider configuration inspected
+---
+
+# Workflow catalog
+
+Generated from `architecture/workflow-taxonomy.json`; edit that source, then run
+`pnpm run generate:workflows`. Every YAML file, including compatibility paths,
+is checked by the existing required workflow check.
+
+## Naming and ownership
+
+`public-<build|release|ops>-<purpose>.yml` is a consumer entry;
+`.<build|release|ops>-<purpose>.yml` is an advanced component;
+`self-<build|release|ops>-<purpose>.yml` is Buildchain's own automation.
+Public is a product role, not GitHub access control. Dispatch services are
+marked separately from reusable workflows. Keep workflow names, job IDs,
+permissions, and trigger semantics stable during path migration.
+
+## Channel rollout
+
+Canonical names become callable on a channel only after that channel publishes
+them. Existing `@v4`/`@v4-alpha` consumers keep their exact registered legacy
+paths until provider readback proves canonical availability. New examples below
+describe the target surface, not a claim that both channels already publish it.
+Compatibility files are generated byte-identical projections, not independently
+editable implementations. They retain full jobs to preserve called-workflow
+identity, permission envelopes, and required check names without extra nesting.
+
+The controller registry records the actual source path separately from a migrated
+repository controller contractPath. This preserves the established logical
+contract identity while exposing its current execution source. New workflows
+do not acquire historical identities. Public controllers retain their real
+compatibility paths while those paths remain supported.
+
+## Adding or changing a workflow
+
+Register a stable identity, role, category, purpose, owner, lifecycle status,
+invocation and concrete summary before creating its derived path. A new entry
+must explain its scope in review. New aliases cannot be invented: compatibility
+must name an exact migration source with a reason and removal condition.
+The policy, generator, checker, tests, required CI chain and CODEOWNERS require
+independent `kungfu-origin` review. No wildcard compatibility admission is allowed.
+Workflow filenames cannot contain version tokens such as `v4` or `v5`.
+Retired aliases cannot be recreated or called; see [path migration](workflow-path-migration.md).
+
+A role, category or implementation edit must preserve or deliberately update
+all related declarations. Run `pnpm run generate:workflows` and
+`pnpm run check:workflows`; the full `pnpm run check` remains required.
+
+## public
+
+| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
+| --- | --- | --- | --- | --- | --- |
+| [public-build-adopter-qualification.yml](../.github/workflows/public-build-adopter-qualification.yml) | build | reusable | active | V4 Adopter Delivery | — |
+| [public-build-candidate.yml](../.github/workflows/public-build-candidate.yml) | build | reusable | active | Buildchain Channel Build | `build.yml` |
+| [public-build-check.yml](../.github/workflows/public-build-check.yml) | build | reusable | active | Buildchain Check | `check.yml` |
+| [public-build-demo.yml](../.github/workflows/public-build-demo.yml) | build | reusable | active | Buildchain Declarative Binary Auditable Demo | `.declarative-auditable-demo.yml` |
+| [public-build-publication.yml](../.github/workflows/public-build-publication.yml) | build | reusable | active | Buildchain Publication Artifact | `publication-artifact.yml` |
+| [public-build-stage-capsule-canary.yml](../.github/workflows/public-build-stage-capsule-canary.yml) | build | reusable | active | V4 Stage Capsule Canary | — |
+| [public-ops-alpha-candidate-patrol.yml](../.github/workflows/public-ops-alpha-candidate-patrol.yml) | ops | reusable | active | Buildchain Dev to Alpha Candidate Patrol | `dev-alpha-candidate-patrol.yml` |
+| [public-ops-bootstrap-recovery.yml](../.github/workflows/public-ops-bootstrap-recovery.yml) | ops | reusable | active | Universal Buildchain Bootstrap Recovery | `universal-bootstrap-recovery.yml` |
+| [public-ops-bootstrap.yml](../.github/workflows/public-ops-bootstrap.yml) | ops | reusable | active | Buildchain Universal Bootstrap | `bootstrap.yml` |
+| [public-ops-dev-auto-merge.yml](../.github/workflows/public-ops-dev-auto-merge.yml) | ops | reusable | active | Dev PR Auto Merge | `dev-pr-auto-merge.yml` |
+| [public-ops-dev-qualification-patrol.yml](../.github/workflows/public-ops-dev-qualification-patrol.yml) | ops | reusable | active | Buildchain Dev Qualification Patrol | `dev-qualification-patrol.yml` |
+| [public-ops-housekeeping.yml](../.github/workflows/public-ops-housekeeping.yml) | ops | reusable | active | Engineering Housekeeper | `engineering-housekeeper.yml` |
+| [public-ops-observed-evidence.yml](../.github/workflows/public-ops-observed-evidence.yml) | ops | reusable | active | Patrol Observed Evidence | `patrol-observed-evidence.yml` |
+| [public-ops-patrol-daily.yml](../.github/workflows/public-ops-patrol-daily.yml) | ops | reusable | active | Buildchain Patrol Daily | `patrol-daily.yml` |
+| [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly | `patrol-monthly.yml` |
+| [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly | `patrol-weekly.yml` |
+| [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol | `buildchain-patrol.yml` |
+| [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile | `release-governance-reconcile.yml` |
+| [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol | `stable-candidate-patrol.yml` |
+| [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal | — |
+| [public-ops-warrant-cancel.yml](../.github/workflows/public-ops-warrant-cancel.yml) | ops | reusable | active | Dev Delivery Warrant Queued Candidate Cancel | `dev-delivery-warrant-cancel.yml` |
+| [public-ops-warrant-close.yml](../.github/workflows/public-ops-warrant-close.yml) | ops | reusable | active | Dev Delivery Warrant Close | `dev-delivery-warrant-close.yml` |
+| [public-release-artifact-attestation.yml](../.github/workflows/public-release-artifact-attestation.yml) | release | reusable | active | Buildchain GitHub Artifact Attestation | `github-artifact-attestation.yml` |
+| [public-release-oci-compose-preview.yml](../.github/workflows/public-release-oci-compose-preview.yml) | release | reusable | active | Buildchain OCI Compose Preview | — |
+| [public-release-paper-sealed.yml](../.github/workflows/public-release-paper-sealed.yml) | release | reusable | active | Buildchain Sealed Paper Release | `paper-release-sealed.yml` |
+| [public-release-paper.yml](../.github/workflows/public-release-paper.yml) | release | reusable | active | Buildchain Paper Release | `paper-release.yml` |
+| [public-release-promote.yml](../.github/workflows/public-release-promote.yml) | release | reusable | active | Release Candidate Promote | `release-candidate-promote.yml` |
+| [public-release-propagation.yml](../.github/workflows/public-release-propagation.yml) | release | reusable | active | Release Propagation | `release-propagation.yml` |
+| [public-release-signing-authority.yml](../.github/workflows/public-release-signing-authority.yml) | release | dispatch-service | active | Buildchain Artifact Signing Authority | `artifact-signing-authority.yml` |
+| [public-release-tail.yml](../.github/workflows/public-release-tail.yml) | release | reusable | active | Declarative Release Tail | `release-tail.yml` |
+| [public-release-web.yml](../.github/workflows/public-release-web.yml) | release | reusable | active | Buildchain Web Surface | `.web-surface.yml` |
+
+## component
+
+| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
+| --- | --- | --- | --- | --- | --- |
+| [.build-demo-adapter.yml](../.github/workflows/.build-demo-adapter.yml) | build | reusable | active | Buildchain Auditable Demo | `.auditable-demo.yml` |
+| [.build-engine.yml](../.github/workflows/.build-engine.yml) | build | reusable | active | Buildchain Build | `.build.yml` |
+| [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile | `.gate-profile.yml` |
+| [.build-release-verify-compat.yml](../.github/workflows/.build-release-verify-compat.yml) | build | reusable | compatibility | release verify | `.release-verify.yml` |
+| [.build-sam-verify-compat.yml](../.github/workflows/.build-sam-verify-compat.yml) | build | reusable | compatibility | sam verify | `.sam-verify.yml` |
+| [.build-wheel-verify-compat.yml](../.github/workflows/.build-wheel-verify-compat.yml) | build | reusable | compatibility | wheel verify | `.wheel-verify.yml` |
+| [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git | `.sync-remote-git.yml` |
+| [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority | `.publication-authority.yml` |
+| [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets | `.binary-release-assets.yml` |
+| [.release-minor-bump-compat.yml](../.github/workflows/.release-minor-bump-compat.yml) | release | reusable | compatibility | bump minor version | `.bump-minor-version.yml` |
+| [.release-page-sync-retired.yml](../.github/workflows/.release-page-sync-retired.yml) | release | reusable | retired | sync release page | `.sync-release-page.yml` |
+| [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced | `.release-candidate-promote.yml` |
+
+## self
+
+| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
+| --- | --- | --- | --- | --- | --- |
+| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood | — |
+| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood | — |
+| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution | — |
+| [self-build-candidate-lab.yml](../.github/workflows/self-build-candidate-lab.yml) | build | repository | active | Candidate Lab | — |
+| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood | — |
+| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification | — |
+| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture | — |
+| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood | — |
+| [self-build-release-verify-compat.yml](../.github/workflows/self-build-release-verify-compat.yml) | build | repository | compatibility | Release - Verify | — |
+| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification | — |
+| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify | — |
+| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood | — |
+| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery | — |
+| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit | — |
+| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily | — |
+| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly | — |
+| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly | — |
+| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance | — |
+| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily | — |
+| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly | — |
+| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly | — |
+| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery | — |
+| [self-ops-recovery-failure-dogfood.yml](../.github/workflows/self-ops-recovery-failure-dogfood.yml) | ops | repository | active | Buildchain Candidate Recovery Dogfood Startup Failure | — |
+| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke | — |
+| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol | — |
+| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets | — |
+| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap | — |
+| [self-release-new-version-compat.yml](../.github/workflows/self-release-new-version-compat.yml) | release | repository | compatibility | Release - New Version | — |
+| [self-release-next-development.yml](../.github/workflows/self-release-next-development.yml) | release | repository | active | Next Development Review | — |
+| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package | — |
+| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion | — |
+| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood | — |
+| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood | — |

package/docs/workflow-path-migration.md

@@ -0,0 +1,109 @@
+---
+status: draft
+period: ongoing
+theme: workflow-path-migration
+doc_type: migration-guide
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-06
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-05
+  visible_context: Exact GitHub channel refs and workflow files on 23 organization default branches
+  invisible_context_boundary: Other branches, private or unlisted consumers and future floating ref updates were not established by this audit
+---
+
+# Version-prefixed workflow path migration
+
+This source change retires three filenames. Their reusable capabilities, inputs,
+outputs, jobs and permission envelopes remain at the canonical paths below.
+Keep the existing channel selector and dual contract-lock policy when migrating.
+
+| Retired path | Canonical path |
+| --- | --- |
+| `v4-adopter-delivery.yml` | `public-build-adopter-qualification.yml` |
+| `v4-stage-capsule-canary.yml` | `public-build-stage-capsule-canary.yml` |
+| `v4-tail-reseal.yml` | `public-ops-tail-reseal.yml` |
+
+All paths are beneath `.github/workflows/`. The taxonomy gate rejects version
+segments in filenames and calls to version-prefixed Buildchain workflows. An
+explicit retirement record keeps the original migration identity for historical
+metrics and frozen facade source; generators resolve that identity to the
+canonical implementation and cannot recreate the removed file.
+
+## Development merge and channel rollout
+
+The development change retires these filenames on `dev/v4/v4.0`, updates the
+Buildchain-owned callers, and enforces the canonical paths through generators
+and required checks. Its delivery boundary is the protected development merge.
+External-repository migration and stable publication are separate follow-up
+work and do not block this development merge.
+
+The published channel boundary still requires the following rollout order:
+
+1. Publish and verify the canonical entries on every affected channel while the
+   old entries remain available. The admission identity must match the actual
+   invoked canonical workflow, rather than its previous filename.
+2. Migrate consumers on their existing floating channels, refresh locks through
+   the supported contract acceptance path if required, and verify real consumer
+   runs. Stable callers remain on stable; alpha callers remain on alpha.
+3. Before publishing the retirement into a channel, recheck its live consumers
+   and resolve any remaining old-path calls. A protected development merge does
+   not by itself establish this channel readiness.
+
+## Initial consumer readback
+
+On 2026-09-05, all workflow files from 23 accessible `kungfu-systems` repository
+_default branches_ were read at their returned Git revisions. Five calls were
+found in three repositories. This is a bounded inventory, not evidence that
+unknown or non-default-branch consumers do not exist.
+
+| Repository and observed revision | Caller | Existing selector |
+| --- | --- | --- |
+| Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-adopter-dogfood.yml` | `v4-alpha` |
+| Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-public-consumer-dogfood.yml` | `v4-alpha` |
+| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-adopter-delivery-qualification.yml` | `v4-alpha` |
+| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-stage-capsule-canary.yml` | `v4` |
+| taolu `6dcccdc3bd2c8b1801c7f6decea08ae7877aac2b` | `verify.yml` | `v4-alpha` |
+
+The initial published channel readback was `v4` at
+`da5e2db8384313e899eace87aea0a1a8e28c0aa8` and `v4-alpha` at
+`dd87f43f7122b41c4ce7f1f6d1888521cc7f892f`. Neither contained the three canonical
+filenames at that initial readback. The later evidence below records progress
+without changing the scope or revisions of that initial inventory.
+
+## Rollout evidence as of 2026-09-06
+
+The canonical invocation-identity preparation was merged in
+[Buildchain PR 3508](https://github.com/kungfu-systems/buildchain/pull/3508).
+All three canonical paths are available in the immutable `v4.0.2-alpha.35`
+release (`feab078f5d7c9927a3525154003e321700e8ca30`) and the later
+`v4.0.2-alpha.37` release (`f5fa1a4a3e8d83eccee79c077e5f48417760c9df`).
+The floating `v4-alpha` readback selects alpha.37.
+
+[Taolu PR 30](https://github.com/kungfu-systems/taolu/pull/30) migrated its
+Stage Capsule call on `@v4-alpha`, preserving the existing dual locks.
+Its exact source `b3f4c12578d733ff44165ff1acafe131251b8907` passed
+[consumer Verify](https://github.com/kungfu-systems/taolu/actions/runs/33975786413)
+on all declared platforms and
+[native delivery](https://github.com/kungfu-systems/taolu/actions/runs/34005576362).
+The protected dev landing is `7e15123733110ad8ce484241934bbf0ef99fbb45`.
+
+The stable `v4` readback remains
+`da5e2db8384313e899eace87aea0a1a8e28c0aa8`, which does not contain the canonical
+paths. Stable publication and the agent-hub-demo migration remain **pending**
+outside this development change's completion boundary. The alpha.35
+[Build Surface Fixture](https://github.com/kungfu-systems/buildchain/actions/runs/34005360217)
+passed, but this individual result does not establish complete stable
+qualification or authorize moving the stable channel.
+
+## Recovery
+
+Before channel retirement, revert consumer changes to the still-available old
+paths if verification fails. After retirement, restore the exact previous
+provider implementation through a reviewed corrective commit and normal
+publication; do not rewrite immutable release tags or bypass admission checks.