@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/packages/core/buildchain-kfd-claims.js

@@ -58,7 +58,7 @@ const WORKFLOW_AND_ACTION_FILES = Object.freeze([
   ".github/workflows/.build.yml",
   ".github/workflows/.release-candidate-promote.yml",
   ".github/workflows/release-candidate-promote.yml",
-  ".github/workflows/buildchain-ref-promotion.yml",
+  ".github/workflows/self-release-promote.yml",
   ".github/workflows/github-artifact-attestation.yml",
   "actions/github-artifact-attestation/action.yml",
   "actions/github-artifact-attestation/index.js",
@@ -446,7 +446,7 @@ export function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}
     {
       name: "Buildchain standalone binary distribution",
       artifactPath: "dist/binary",
-      evidencePath: ".github/workflows/binary-distribution.yml",
+      evidencePath: ".github/workflows/self-build-binary-distribution.yml",
       distribution: normalizeKfd3DistributionDeclaration({
         registrar: "shifu",
         tasks: ["binary:build"],

package/packages/core/buildchain-publication-authority.js

@@ -4,47 +4,47 @@ import path from "node:path";
 import { createPublicationAuthorityRegistry } from "./publication-authority.js";
 
 const DESCRIPTORS = Object.freeze([
+  [".github/workflows/public-release-oci-compose-preview.yml", "product-publication", true, ["oci-compose-preview"], "caller-secrets", "none", "fixed", "caller-bound"],
   [".github/workflows/.auditable-demo.yml", "non-publication-oidc"],
   [".github/workflows/.declarative-auditable-demo.yml", "governance-write"],
   [".github/workflows/.build.yml", "non-publication-oidc"],
   [".github/workflows/.release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/.publication-authority.yml", "evidence-publication"],
   [".github/workflows/.release-verify.yml", "governance-write"],
-  [".github/workflows/.sam-release.yml", "retired-deny"],
   [".github/workflows/.sam-verify.yml", "retired-deny"],
   [".github/workflows/.sync-remote-git.yml", "governance-write"],
   [".github/workflows/.web-surface.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/.wheel-release.yml", "retired-deny"],
   [".github/workflows/.wheel-verify.yml", "retired-deny"],
   [".github/workflows/.binary-release-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
-  [".github/workflows/binary-distribution.yml", "evidence-publication"],
-  [".github/workflows/binary-release-assets.yml", "governance-write"],
+  [".github/workflows/self-build-binary-distribution.yml", "evidence-publication"],
+  [".github/workflows/self-release-binary-assets.yml", "governance-write"],
   [".github/workflows/artifact-signing-authority.yml", "evidence-publication"],
-  [".github/workflows/auditable-demo.yml", "governance-write"],
-  [".github/workflows/build-surface-fixture.yml", "non-publication-oidc"],
+  [".github/workflows/self-build-demo-dogfood.yml", "governance-write"],
+  [".github/workflows/self-build-fixture.yml", "non-publication-oidc"],
   [".github/workflows/build.yml", "non-publication-oidc"],
-  [".github/workflows/buildchain-alpha-self-dogfood.yml", "non-publication-oidc"],
-  [".github/workflows/buildchain-dev-delivery.yml", "governance-write"],
-  [".github/workflows/buildchain-patrol-daily.yml", "governance-write"],
-  [".github/workflows/buildchain-patrol-monthly.yml", "governance-write"],
-  [".github/workflows/buildchain-patrol-weekly.yml", "governance-write"],
+  [".github/workflows/bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/self-build-alpha-dogfood.yml", "non-publication-oidc"],
+  [".github/workflows/self-ops-dev-delivery.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-daily.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-monthly.yml", "governance-write"],
+  [".github/workflows/self-ops-patrol-weekly.yml", "governance-write"],
   [".github/workflows/buildchain-patrol.yml", "governance-write"],
-  [".github/workflows/buildchain-ref-promotion-recovery.yml", "governance-write"],
-  [".github/workflows/buildchain-ref-promotion.yml", "governance-write"],
-  [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
+  [".github/workflows/self-ops-promotion-recovery.yml", "governance-write"],
+  [".github/workflows/self-release-promote.yml", "governance-write"],
+  [".github/workflows/self-ops-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-qualification-patrol.yml", "governance-write"],
   [".github/workflows/dev-alpha-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-delivery-warrant-close.yml", "governance-write"],
   [".github/workflows/dev-delivery-warrant-cancel.yml", "governance-write"],
-  [".github/workflows/dev-merge-queue-governance.yml", "governance-write"],
+  [".github/workflows/self-ops-merge-queue.yml", "governance-write"],
   [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
-  [".github/workflows/engineering-housekeeper-daily.yml", "governance-write"],
-  [".github/workflows/engineering-housekeeper-monthly.yml", "governance-write"],
-  [".github/workflows/engineering-housekeeper-weekly.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-daily.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-monthly.yml", "governance-write"],
+  [".github/workflows/self-ops-housekeeping-weekly.yml", "governance-write"],
   [".github/workflows/engineering-housekeeper.yml", "governance-write"],
-  [".github/workflows/github-governance-audit.yml", "governance-write"],
+  [".github/workflows/self-ops-governance-audit.yml", "governance-write"],
   [".github/workflows/github-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/npm-publish.yml", "dry-run-only"],
+  [".github/workflows/self-release-npm-dry-run.yml", "dry-run-only"],
   [".github/workflows/paper-release-sealed.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/paper-release.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/patrol-daily.yml", "governance-write"],
@@ -53,16 +53,18 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/patrol-weekly.yml", "governance-write"],
   [".github/workflows/publication-artifact.yml", "evidence-publication"],
   [".github/workflows/release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
-  [".github/workflows/release-line-bootstrap.yml", "governance-write"],
+  [".github/workflows/self-release-line-open.yml", "governance-write"],
   [".github/workflows/release-propagation.yml", "governance-write"],
   [".github/workflows/release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
-  [".github/workflows/release-verify.yml", "governance-write"],
+  [".github/workflows/self-build-release-verify-compat.yml", "governance-write"],
   [".github/workflows/stable-candidate-patrol.yml", "governance-write"],
-  [".github/workflows/v4-declarative-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
+  [".github/workflows/universal-bootstrap-recovery.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/self-ops-bootstrap-dogfood.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
+  [".github/workflows/self-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
 ]);
 
-export function buildchainPublicationAuthorityDescriptors() {
-  return DESCRIPTORS.map(([
+export function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) {
+  const descriptors = DESCRIPTORS.map(([
     workflowPath,
     authorityClass,
     publicationCapable = false,
@@ -84,6 +86,21 @@ export function buildchainPublicationAuthorityDescriptors() {
     environmentMode,
     runnerPolicy: publicationCapable ? "qualified-measured" : "unqualified",
   }));
+  const taxonomyPath = path.join(root, "architecture/workflow-taxonomy.json");
+  if (!fs.existsSync(taxonomyPath)) return descriptors;
+  const taxonomy = JSON.parse(fs.readFileSync(taxonomyPath, "utf8"));
+  for (const entry of taxonomy.entries) {
+    if (!entry.compatibility) continue;
+    const previous = descriptors.find((item) => item.workflowPath === entry.compatibility.path);
+    if (!previous) continue;
+    const prefix = entry.role === "component" ? "." : `${entry.role}-`;
+    const workflowPath = `.github/workflows/${prefix}${entry.category}-${entry.purpose}.yml`;
+    if (fs.readFileSync(path.join(root, workflowPath), "utf8") !== fs.readFileSync(path.join(root, entry.compatibility.path), "utf8")) {
+      throw new Error(`publication authority alias differs from canonical workflow: ${workflowPath}`);
+    }
+    descriptors.push({ ...previous, workflowPath, publisherWorkflowPath: previous.publisherWorkflowPath === previous.workflowPath ? workflowPath : previous.publisherWorkflowPath });
+  }
+  return descriptors;
 }
 export function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) {
   const workflowsDir = path.join(root, ".github", "workflows");
@@ -94,7 +111,7 @@ export function createBuildchainPublicationAuthorityRegistry({ root = process.cw
       text: fs.readFileSync(path.join(workflowsDir, name), "utf8"),
     }));
   return createPublicationAuthorityRegistry({
-    descriptors: buildchainPublicationAuthorityDescriptors(),
+    descriptors: buildchainPublicationAuthorityDescriptors({ root }),
     workflows,
   });
 }

package/packages/core/{v4-canonical-contracts.js → canonical-contracts.js}

@@ -1,9 +1,9 @@
-import crypto from "node:crypto";
+import { DomainWasmFault, invokeDomainWasm } from "./domain-wasm.js";
 
-export const V4_CANONICAL_JSON_CONTRACT = "buildchain-canonical-json/v1";
-export const V4_EVENT_ENVELOPE_CONTRACT = "buildchain-v4-event-envelope/v1";
-export const V4_RECEIPT_ENVELOPE_CONTRACT = "buildchain-v4-receipt-envelope/v1";
-export const V4_CONTRACT_FAULT_CONTRACT = "buildchain-v4-contract-fault/v1";
+export const CANONICAL_JSON_CONTRACT = "buildchain-canonical-json/v1";
+export const EVENT_ENVELOPE_CONTRACT = "buildchain-v4-event-envelope/v1";
+export const RECEIPT_ENVELOPE_CONTRACT = "buildchain-v4-receipt-envelope/v1";
+export const CONTRACT_FAULT_CONTRACT = "buildchain-v4-contract-fault/v1";
 
 const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/u;
 const CLOCK_PATTERN = /^(?!0000)\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
@@ -28,6 +28,7 @@ const ROOT_DOMAINS = new Set([
   "stage-capsule-quarantine",
   "stage-capsule-resume-observation",
   "stage-capsule-resume-plan",
+  "source-verification-evidence",
   "stage-capsule-artifact-manifest",
   "stage-capsule-artifact-content",
   "stage-capsule-fault-campaign",
@@ -57,6 +58,7 @@ const ROOT_DOMAINS = new Set([
   "partial-mutation-recovery-checkpoint",
   "partial-mutation-recovery-plan",
   "v4-product-required-artifacts",
+  "oci-publication-family",
   "v4-product-publication-intent",
   "v4-product-publication-operation",
   "v4-product-publication-plan",
@@ -85,17 +87,17 @@ const FAULT_CLASSES = new Set([
 const RETRY_DECISIONS = new Set(["stop", "reread", "redecide", "reselect"]);
 const RECEIPT_OUTCOMES = new Set(["accepted", "rejected", "noop"]);
 
-export class V4ContractFault extends Error {
+export class ContractFault extends Error {
   constructor(code, path, message) {
     super(message);
-    this.name = "V4ContractFault";
+    this.name = "ContractFault";
     this.code = code;
     this.path = path;
   }
 }
 
 function fault(code, path, message) {
-  throw new V4ContractFault(code, path, message);
+  throw new ContractFault(code, path, message);
 }
 
 function exactKeys(value, keys, path) {
@@ -110,98 +112,32 @@ function exactKeys(value, keys, path) {
     fault("invalid-envelope-shape", path, `${path} keys are not canonical`);
 }
 
-function canonicalize(value, path, active) {
-  if (value === null || typeof value === "boolean") return value;
-  if (typeof value === "string") {
-    for (let index = 0; index < value.length; index += 1) {
-      const code = value.charCodeAt(index);
-      if (code >= 0xd800 && code <= 0xdbff) {
-        const next = value.charCodeAt(index + 1);
-        if (!(next >= 0xdc00 && next <= 0xdfff))
-          fault(
-            "unsupported-string",
-            path,
-            `${path} contains an unpaired surrogate`,
-          );
-        index += 1;
-      } else if (code >= 0xdc00 && code <= 0xdfff) {
-        fault(
-          "unsupported-string",
-          path,
-          `${path} contains an unpaired surrogate`,
-        );
-      }
-    }
-    return value;
-  }
-  if (typeof value === "number") {
-    if (!Number.isSafeInteger(value) || Object.is(value, -0))
-      fault(
-        "unsupported-number",
-        path,
-        `${path} must be a safe base-10 integer and must not be negative zero`,
-      );
-    return value;
-  }
-  if (!value || typeof value !== "object")
-    fault("unsupported-json-value", path, `${path} is not a JSON value`);
-  if (active.has(value))
-    fault("cyclic-json-value", path, `${path} contains a cycle`);
-  active.add(value);
+function wasm(operation, payload) {
   try {
-    if (Array.isArray(value))
-      return Array.from(value, (entry, index) =>
-        canonicalize(entry, `${path}/${index}`, active),
-      );
-    const prototype = Object.getPrototypeOf(value);
-    if (prototype !== Object.prototype && prototype !== null)
-      fault("unsupported-json-value", path, `${path} must be a plain object`);
-    const result = Object.create(null);
-    for (const key of Object.keys(value).sort((left, right) =>
-      left < right ? -1 : left > right ? 1 : 0,
-    )) {
-      if (!ASCII_KEY_PATTERN.test(key))
-        fault(
-          "unsupported-object-key",
-          `${path}/${key}`,
-          "object keys must be non-empty printable ASCII",
-        );
-      result[key] = canonicalize(value[key], `${path}/${key}`, active);
+    return invokeDomainWasm(operation, payload);
+  } catch (error) {
+    if (error instanceof DomainWasmFault) {
+      fault(error.code, error.path, error.message);
     }
-    return result;
-  } finally {
-    active.delete(value);
+    throw error;
   }
 }
 
-export function v4CanonicalBytes(value) {
-  return Buffer.from(
-    `${JSON.stringify(canonicalize(value, "$", new Set()))}\n`,
-    "utf8",
-  );
+export function domainCanonicalBytes(value) {
+  return Buffer.from(wasm("canonical-json", value).canonicalUtf8, "utf8");
 }
 
-export function v4ContentRoot(domain, value) {
-  if (!ROOT_DOMAINS.has(domain))
-    fault(
-      "unsupported-root-domain",
-      "$.domain",
-      `unsupported root domain: ${domain}`,
-    );
-  const hash = crypto.createHash("sha256");
-  hash.update(domain, "ascii");
-  hash.update(Buffer.from([0]));
-  hash.update(v4CanonicalBytes(value));
-  return `sha256:${hash.digest("hex")}`;
+export function domainContentRoot(domain, value) {
+  return wasm("content-root", { domain, value }).root;
 }
 
-export function validateV4Root(value, path = "$.root") {
+export function validateRoot(value, path = "$.root") {
   if (typeof value !== "string" || !ROOT_PATTERN.test(value))
     fault("invalid-root", path, `${path} must be a lowercase sha256 root`);
   return value;
 }
 
-export function validateV4Clock(value, path = "$.clock") {
+export function validateClock(value, path = "$.clock") {
   if (typeof value !== "string" || !CLOCK_PATTERN.test(value))
     fault(
       "invalid-clock",
@@ -214,13 +150,13 @@ export function validateV4Clock(value, path = "$.clock") {
   return value;
 }
 
-export function validateV4ContractFault(value, path = "$.fault") {
+export function validateContractFault(value, path = "$.fault") {
   exactKeys(
     value,
     ["schema", "code", "class", "path", "message", "retry"],
     path,
   );
-  if (value.schema !== V4_CONTRACT_FAULT_CONTRACT)
+  if (value.schema !== CONTRACT_FAULT_CONTRACT)
     fault("invalid-fault", `${path}/schema`, "unsupported fault schema");
   if (!ASCII_TOKEN_PATTERN.test(value.code))
     fault("invalid-fault", `${path}/code`, "fault code must be an ASCII token");
@@ -236,28 +172,28 @@ export function validateV4ContractFault(value, path = "$.fault") {
       `${path}/retry`,
       "fault retry decision is unsupported",
     );
-  v4CanonicalBytes(value);
+  domainCanonicalBytes(value);
   return value;
 }
 
-export function validateV4EventEnvelope(value) {
+export function validateEventEnvelope(value) {
   exactKeys(
     value,
     ["schema", "eventId", "eventType", "occurredAt", "subjectRoot", "payload"],
     "$",
   );
-  if (value.schema !== V4_EVENT_ENVELOPE_CONTRACT)
+  if (value.schema !== EVENT_ENVELOPE_CONTRACT)
     fault("invalid-event", "$/schema", "unsupported event schema");
-  validateV4Root(value.eventId, "$/eventId");
-  validateV4Root(value.subjectRoot, "$/subjectRoot");
-  validateV4Clock(value.occurredAt, "$/occurredAt");
+  validateRoot(value.eventId, "$/eventId");
+  validateRoot(value.subjectRoot, "$/subjectRoot");
+  validateClock(value.occurredAt, "$/occurredAt");
   if (!ASCII_TOKEN_PATTERN.test(value.eventType))
     fault("invalid-event", "$/eventType", "event type must be an ASCII token");
-  v4CanonicalBytes(value.payload);
+  domainCanonicalBytes(value.payload);
   return value;
 }
 
-export function validateV4ReceiptEnvelope(value) {
+export function validateReceiptEnvelope(value) {
   exactKeys(
     value,
     [
@@ -272,7 +208,7 @@ export function validateV4ReceiptEnvelope(value) {
     ],
     "$",
   );
-  if (value.schema !== V4_RECEIPT_ENVELOPE_CONTRACT)
+  if (value.schema !== RECEIPT_ENVELOPE_CONTRACT)
     fault("invalid-receipt", "$/schema", "unsupported receipt schema");
   if (!ASCII_TOKEN_PATTERN.test(value.receiptType))
     fault(
@@ -280,15 +216,15 @@ export function validateV4ReceiptEnvelope(value) {
       "$/receiptType",
       "receipt type must be an ASCII token",
     );
-  validateV4Clock(value.recordedAt, "$/recordedAt");
-  validateV4Root(value.eventRoot, "$/eventRoot");
+  validateClock(value.recordedAt, "$/recordedAt");
+  validateRoot(value.eventRoot, "$/eventRoot");
   if (value.priorStateRoot !== null)
-    validateV4Root(value.priorStateRoot, "$/priorStateRoot");
+    validateRoot(value.priorStateRoot, "$/priorStateRoot");
   if (value.nextStateRoot !== null)
-    validateV4Root(value.nextStateRoot, "$/nextStateRoot");
+    validateRoot(value.nextStateRoot, "$/nextStateRoot");
   if (!RECEIPT_OUTCOMES.has(value.outcome))
     fault("invalid-receipt", "$/outcome", "receipt outcome is unsupported");
-  if (value.fault !== null) validateV4ContractFault(value.fault);
+  if (value.fault !== null) validateContractFault(value.fault);
   if ((value.outcome === "rejected") !== (value.fault !== null))
     fault(
       "invalid-receipt",
@@ -298,6 +234,6 @@ export function validateV4ReceiptEnvelope(value) {
   return value;
 }
 
-export function v4ContractDomains() {
+export function contractDomains() {
   return [...ROOT_DOMAINS];
 }

package/packages/core/ci-lane-change-budget.js

@@ -10,6 +10,7 @@ const AUTHORITY_CLASSES = new Set([
   "post-merge-advisory",
   "diagnostic",
   "evidence",
+  "governed-delegation",
   "release",
 ]);
 const TRIGGER_CLASSES = new Set([
@@ -196,7 +197,19 @@ export function evaluateCiLaneChangeBudget({
   }
   const declarations = new Map();
   const diagnostics = [];
-  for (const declaration of policy.declarations || []) {
+  const familyDeclarations = (policy.declarationFamilies || []).flatMap(
+    ({ laneIds, ...declaration }) => {
+      if (!Array.isArray(laneIds) || laneIds.length === 0)
+        throw new Error("CI lane declaration family requires laneIds");
+      if (new Set(laneIds).size !== laneIds.length)
+        throw new Error("CI lane declaration family laneIds must be unique");
+      return laneIds.map((laneId) => ({ ...declaration, laneId }));
+    },
+  );
+  for (const declaration of [
+    ...(policy.declarations || []),
+    ...familyDeclarations,
+  ]) {
     const laneId = String(declaration?.laneId || "").trim();
     if (!laneId) throw new Error("CI lane declaration laneId is required");
     if (declarations.has(laneId))

package/packages/core/controller-evidence.js

@@ -196,6 +196,9 @@ function descriptorDigest(descriptor) {
 
 export function createControllerRegistry({ workflows = [] } = {}) {
   const workflowById = new Map(workflows.map((entry) => [entry.id, entry]));
+  for (const entry of workflows) {
+    if (entry.taxonomy && !entry.taxonomy.compatibilityAlias && !workflowById.has(entry.taxonomy.id)) workflowById.set(entry.taxonomy.id, entry);
+  }
   const controllers = CONTROLLER_SPECS.map((spec) => {
     const workflow = workflowById.get(spec.workflowId);
     if (!workflow) throw new Error(`controller ${spec.id} requires workflow descriptor ${spec.workflowId}`);
@@ -215,7 +218,7 @@ export function createControllerRegistry({ workflows = [] } = {}) {
       contract: BUILDCHAIN_CONTROLLER_DESCRIPTOR_CONTRACT,
       id: spec.id,
       version: spec.version,
-      workflow: { id: workflow.id, path: workflow.path },
+      workflow: { id: workflow.id, path: workflow.path, ...(workflow.taxonomy?.contractPath ? { contractPath: workflow.taxonomy.contractPath } : {}) },
       inputs,
       expected: {
         stages: spec.stages.map((id) => ({ id, required: !optionalStages.has(id) })),

package/packages/core/{v4-cross-platform-adopter-qualification.js → cross-platform-adopter-qualification.js}

@@ -1,15 +1,15 @@
 import { adopterDeliveryGateDigest } from "./adopter-delivery-json.js";
 
-export const V4_CROSS_PLATFORM_ADOPTER_REPORT_CONTRACT =
+export const CROSS_PLATFORM_ADOPTER_REPORT_CONTRACT =
   "kungfu-buildchain-v4-cross-platform-adopter-report/v1";
-export const V4_CROSS_PLATFORM_ADOPTER_QUALIFICATION_CONTRACT =
+export const CROSS_PLATFORM_ADOPTER_QUALIFICATION_CONTRACT =
   "kungfu-buildchain-v4-cross-platform-adopter-qualification/v1";
-export const V4_CROSS_PLATFORM_ADOPTER_PLATFORMS = Object.freeze([
+export const CROSS_PLATFORM_ADOPTER_PLATFORMS = Object.freeze([
   "linux-x64",
   "macos-arm64",
   "windows-x64",
 ]);
-export const V4_CROSS_PLATFORM_NEUTRAL_DRIVER = "ledger-specification-driver";
+export const CROSS_PLATFORM_NEUTRAL_DRIVER = "ledger-specification-driver";
 
 const SHA = /^[0-9a-f]{40}$/u;
 const ROOT = /^sha256:[0-9a-f]{64}$/u;
@@ -36,7 +36,7 @@ function same(left, right) {
   return adopterDeliveryGateDigest(left) === adopterDeliveryGateDigest(right);
 }
 
-export function summarizeV3V4CapabilityInventory(inventory) {
+export function summarizeBaselineCapabilityInventory(inventory) {
   exactKeys(
     inventory,
     [
@@ -197,7 +197,7 @@ function validateExecutionEvidence(execution) {
       execution.retryRun.readbackRoot &&
     execution.bootstrap?.status === "passed" &&
     ROOT.test(execution.bootstrap?.resultRoot || "") &&
-    execution.neutralDriver?.id === V4_CROSS_PLATFORM_NEUTRAL_DRIVER &&
+    execution.neutralDriver?.id === CROSS_PLATFORM_NEUTRAL_DRIVER &&
     execution.neutralDriver?.status === "passed" &&
     execution.neutralDriver?.kfdDependencyPresent === false;
   if (!complete)
@@ -219,7 +219,7 @@ function validateAuthorityCeiling(authority) {
     fail("qualification report must not grant production or release authority");
 }
 
-export function validateV4CrossPlatformAdopterReport(report) {
+export function validateCrossPlatformAdopterReport(report) {
   exactKeys(
     report,
     [
@@ -237,10 +237,10 @@ export function validateV4CrossPlatformAdopterReport(report) {
   );
   if (
     report.schemaVersion !== 1 ||
-    report.contract !== V4_CROSS_PLATFORM_ADOPTER_REPORT_CONTRACT
+    report.contract !== CROSS_PLATFORM_ADOPTER_REPORT_CONTRACT
   )
     fail("platform report contract is unsupported");
-  if (!V4_CROSS_PLATFORM_ADOPTER_PLATFORMS.includes(report.platform))
+  if (!CROSS_PLATFORM_ADOPTER_PLATFORMS.includes(report.platform))
     fail(`undeclared platform ${report.platform}`);
   if (!CONSUMER.test(report.consumer || ""))
     fail("consumer must be a stable lowercase identity");
@@ -256,18 +256,18 @@ export function validateV4CrossPlatformAdopterReport(report) {
   return structuredClone(report);
 }
 
-export function createV4CrossPlatformAdopterReport(input) {
+export function createCrossPlatformAdopterReport(input) {
   const body = structuredClone(input);
   const report = {
     schemaVersion: 1,
-    contract: V4_CROSS_PLATFORM_ADOPTER_REPORT_CONTRACT,
+    contract: CROSS_PLATFORM_ADOPTER_REPORT_CONTRACT,
     ...body,
   };
   report.reportRoot = adopterDeliveryGateDigest(report);
-  return validateV4CrossPlatformAdopterReport(report);
+  return validateCrossPlatformAdopterReport(report);
 }
 
-export function qualifyV4CrossPlatformAdopters({ reports, consumers }) {
+export function qualifyCrossPlatformAdopters({ reports, consumers }) {
   if (!Array.isArray(reports) || reports.length === 0)
     fail("at least one raw platform report is required");
   if (
@@ -277,9 +277,9 @@ export function qualifyV4CrossPlatformAdopters({ reports, consumers }) {
     new Set(consumers).size !== consumers.length
   )
     fail("required consumers must be unique stable lowercase identities");
-  const normalized = reports.map(validateV4CrossPlatformAdopterReport);
+  const normalized = reports.map(validateCrossPlatformAdopterReport);
   const expectedKeys = consumers.flatMap((consumer) =>
-    V4_CROSS_PLATFORM_ADOPTER_PLATFORMS.map(
+    CROSS_PLATFORM_ADOPTER_PLATFORMS.map(
       (platform) => `${consumer}:${platform}`,
     ),
   );
@@ -310,14 +310,14 @@ export function qualifyV4CrossPlatformAdopters({ reports, consumers }) {
   const orderedReports = expectedKeys.map((key) => reportByKey.get(key));
   const body = {
     schemaVersion: 1,
-    contract: V4_CROSS_PLATFORM_ADOPTER_QUALIFICATION_CONTRACT,
+    contract: CROSS_PLATFORM_ADOPTER_QUALIFICATION_CONTRACT,
     sourceBinding: {
       runtimeSha: reference.runtimeSha,
       inventoryRoot: reference.inventoryRoot,
       sourceCuts: structuredClone(reference.sourceCuts),
     },
     consumers: [...consumers],
-    platforms: [...V4_CROSS_PLATFORM_ADOPTER_PLATFORMS],
+    platforms: [...CROSS_PLATFORM_ADOPTER_PLATFORMS],
     capabilityMatrix: structuredClone(normalized[0].capabilityMatrix),
     reports: orderedReports.map(({ consumer, platform, reportRoot }) => ({
       consumer,
@@ -325,8 +325,8 @@ export function qualifyV4CrossPlatformAdopters({ reports, consumers }) {
       reportRoot,
     })),
     neutralDriver: {
-      id: V4_CROSS_PLATFORM_NEUTRAL_DRIVER,
-      platformCoverage: [...V4_CROSS_PLATFORM_ADOPTER_PLATFORMS],
+      id: CROSS_PLATFORM_NEUTRAL_DRIVER,
+      platformCoverage: [...CROSS_PLATFORM_ADOPTER_PLATFORMS],
       status: "passed",
     },
     authority: {