@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/scripts/{check-v3-v4-capability-inventory.mjs → check-capability-parity-inventory.mjs}

@@ -11,16 +11,16 @@ import {
   ensureCapabilityCutLineage,
   git,
   sha256,
-} from "./v3-v4-capability-catalog.mjs";
+} from "./capability-parity-catalog.mjs";
 
-export const V3_V4_CAPABILITY_INVENTORY_CONTRACT =
+export const BASELINE_CAPABILITY_INVENTORY_CONTRACT =
   "kungfu-buildchain-v3-v4-live-capability-inventory";
-export const V3_V4_CAPABILITY_CUTS = Object.freeze({
+export const BASELINE_CAPABILITY_CUTS = Object.freeze({
   priorFamilyV3: "6b96bdad8d9f8ccf9275f27d9370a226a9c78465",
   liveV3: "8493bf140a7f567e76aff3119f3d39ff026afc84",
   liveV4: "97edd5b93eb67e5bf36ad55726e08231b47b70c0",
 });
-const INVENTORY_PATH = "architecture/v3-v4-live-capability-inventory.json";
+const INVENTORY_PATH = "architecture/capability-parity-live-capability-inventory.json";
 const ALLOWED_DISPOSITIONS = new Set([
   "v4-native",
   "compatibility-adapter",
@@ -30,7 +30,7 @@ const ALLOWED_DISPOSITIONS = new Set([
 const ASSIGNMENTS = Object.freeze({
   public: "2026-08-26-buildchain-v4-public-surface-compatibility-closure",
   runtime: "2026-08-26-buildchain-v4-runtime-semantic-closure",
-  adopter: "2026-08-26-buildchain-v4-cross-platform-adopter-qualification",
+  adopter: "2026-08-26-buildchain-cross-platform-adopter-qualification",
   stable: "2026-08-26-buildchain-v4-stable-channel-capability-closure",
   retirement: "2026-08-26-buildchain-v4-v3-retirement-reconciliation",
 });
@@ -93,7 +93,7 @@ function capabilityCutAvailable(root, revision) {
 }
 
 function ensureCapabilityCutsAvailable(root) {
-  const revisions = Object.values(V3_V4_CAPABILITY_CUTS);
+  const revisions = Object.values(BASELINE_CAPABILITY_CUTS);
   const missing = revisions.filter(
     (revision) => !capabilityCutAvailable(root, revision),
   );
@@ -114,7 +114,7 @@ function ensureCapabilityCutsAvailable(root) {
   }
   ensureCapabilityCutLineage({
     root,
-    revision: V3_V4_CAPABILITY_CUTS.liveV4,
+    revision: BASELINE_CAPABILITY_CUTS.liveV4,
     label: "live v4 capability cut",
   });
 }
@@ -233,14 +233,14 @@ function rowFromCatalogEntry(source, targetCatalog) {
   const migratedId = MIGRATION_ROUTES.get(source.id);
   const migrated = migratedId ? targetCatalog.get(migratedId) : undefined;
   let disposition;
-  let v4Route = null;
+  let route = null;
   let residual = null;
   if (direct) {
     disposition = "v4-native";
-    v4Route = { capabilityId: direct.id, evidence: direct.evidence };
+    route = { capabilityId: direct.id, evidence: direct.evidence };
   } else if (migrated) {
     disposition = "executable-migration";
-    v4Route = { capabilityId: migrated.id, evidence: migrated.evidence };
+    route = { capabilityId: migrated.id, evidence: migrated.evidence };
   } else if (PUBLIC_SURFACE_CLOSURE_IDS.has(source.id)) {
     disposition = "owned-missing";
     residual = {
@@ -257,7 +257,7 @@ function rowFromCatalogEntry(source, targetCatalog) {
     disposition,
     ownerAssignment,
     sourceEvidence: source.evidence,
-    v4Route,
+    v4Route: route,
     residual,
     positiveProbe:
       disposition === "owned-missing"
@@ -279,33 +279,33 @@ function sourceCut(root, commit, role) {
   };
 }
 
-export function buildV3V4CapabilityInventory({ root = process.cwd() } = {}) {
+export function buildBaselineCapabilityInventory({ root = process.cwd() } = {}) {
   ensureCapabilityCutsAvailable(root);
   git(root, [
     "merge-base",
     "--is-ancestor",
-    V3_V4_CAPABILITY_CUTS.priorFamilyV3,
-    V3_V4_CAPABILITY_CUTS.liveV3,
+    BASELINE_CAPABILITY_CUTS.priorFamilyV3,
+    BASELINE_CAPABILITY_CUTS.liveV3,
   ]);
-  const v3 = collectRevisionCatalog({
+  const baseline = collectRevisionCatalog({
     root,
-    revision: V3_V4_CAPABILITY_CUTS.liveV3,
-    liveV3Revision: V3_V4_CAPABILITY_CUTS.liveV3,
+    revision: BASELINE_CAPABILITY_CUTS.liveV3,
+    liveV3Revision: BASELINE_CAPABILITY_CUTS.liveV3,
   });
-  const v4 = collectRevisionCatalog({
+  const domain = collectRevisionCatalog({
     root,
-    revision: V3_V4_CAPABILITY_CUTS.liveV4,
-    liveV3Revision: V3_V4_CAPABILITY_CUTS.liveV3,
+    revision: BASELINE_CAPABILITY_CUTS.liveV4,
+    liveV3Revision: BASELINE_CAPABILITY_CUTS.liveV3,
   });
   const rows = [
-    ...[...v3.catalog.values()].map((entry) =>
-      rowFromCatalogEntry(entry, v4.catalog),
+    ...[...baseline.catalog.values()].map((entry) =>
+      rowFromCatalogEntry(entry, domain.catalog),
     ),
     ...collectHistoryRows({
       root,
-      priorRevision: V3_V4_CAPABILITY_CUTS.priorFamilyV3,
-      liveV3Revision: V3_V4_CAPABILITY_CUTS.liveV3,
-      v4Paths: v4.paths,
+      priorRevision: BASELINE_CAPABILITY_CUTS.priorFamilyV3,
+      liveV3Revision: BASELINE_CAPABILITY_CUTS.liveV3,
+      v4Paths: domain.paths,
       migrationPaths: HISTORY_MIGRATION_PATHS,
       ownerAssignment: ASSIGNMENTS.retirement,
     }),
@@ -313,24 +313,24 @@ export function buildV3V4CapabilityInventory({ root = process.cwd() } = {}) {
   const changedPaths = rows.filter((row) => row.category === "history-change");
   const prior = sourceCut(
     root,
-    V3_V4_CAPABILITY_CUTS.priorFamilyV3,
+    BASELINE_CAPABILITY_CUTS.priorFamilyV3,
     "previous-absorption-family-capture",
   );
-  const liveV3 = sourceCut(
+  const baselineCut = sourceCut(
     root,
-    V3_V4_CAPABILITY_CUTS.liveV3,
+    BASELINE_CAPABILITY_CUTS.liveV3,
     "execution-time-protected-read-only-reference",
   );
-  const liveV4 = sourceCut(
+  const currentCut = sourceCut(
     root,
-    V3_V4_CAPABILITY_CUTS.liveV4,
+    BASELINE_CAPABILITY_CUTS.liveV4,
     "execution-time-protected-target",
   );
-  liveV4.branch = "origin/dev/v4/v4.0";
+  currentCut.branch = "origin/dev/v4/v4.0";
   const inventory = {
     schemaVersion: 1,
-    contract: V3_V4_CAPABILITY_INVENTORY_CONTRACT,
-    sourceCuts: { priorFamilyV3: prior, liveV3, liveV4 },
+    contract: BASELINE_CAPABILITY_INVENTORY_CONTRACT,
+    sourceCuts: { priorFamilyV3: prior, liveV3: baselineCut, liveV4: currentCut },
     extraction: {
       mode: "exact-git-object-closed-world",
       extractor: "scripts/check-v3-v4-capability-inventory.mjs",
@@ -352,13 +352,13 @@ export function buildV3V4CapabilityInventory({ root = process.cwd() } = {}) {
       residualPolicy: "exact-identity-allowlist-with-required-owner",
     },
     reverseHistory: {
-      fromCommit: V3_V4_CAPABILITY_CUTS.priorFamilyV3,
-      toCommit: V3_V4_CAPABILITY_CUTS.liveV3,
+      fromCommit: BASELINE_CAPABILITY_CUTS.priorFamilyV3,
+      toCommit: BASELINE_CAPABILITY_CUTS.liveV3,
       commitCount: Number(
         git(root, [
           "rev-list",
           "--count",
-          `${V3_V4_CAPABILITY_CUTS.priorFamilyV3}..${V3_V4_CAPABILITY_CUTS.liveV3}`,
+          `${BASELINE_CAPABILITY_CUTS.priorFamilyV3}..${BASELINE_CAPABILITY_CUTS.liveV3}`,
         ]),
       ),
       changedPathCount: changedPaths.length,
@@ -378,7 +378,7 @@ export function buildV3V4CapabilityInventory({ root = process.cwd() } = {}) {
     },
     capabilities: rows,
   };
-  assertV3V4CapabilityInventory(inventory);
+  assertBaselineCapabilityInventory(inventory);
   return inventory;
 }
 
@@ -448,8 +448,8 @@ function validateCoverage(inventory, rows, issues) {
   }
   if (
     inventory?.reverseHistory?.fromCommit !==
-      V3_V4_CAPABILITY_CUTS.priorFamilyV3 ||
-    inventory?.reverseHistory?.toCommit !== V3_V4_CAPABILITY_CUTS.liveV3 ||
+      BASELINE_CAPABILITY_CUTS.priorFamilyV3 ||
+    inventory?.reverseHistory?.toCommit !== BASELINE_CAPABILITY_CUTS.liveV3 ||
     inventory?.reverseHistory?.unclassifiedPathCount !== 0
   ) {
     issues.push(
@@ -464,11 +464,11 @@ function validateCoverage(inventory, rows, issues) {
   }
 }
 
-export function assertV3V4CapabilityInventory(inventory) {
+export function assertBaselineCapabilityInventory(inventory) {
   const issues = [];
   if (
     inventory?.schemaVersion !== 1 ||
-    inventory?.contract !== V3_V4_CAPABILITY_INVENTORY_CONTRACT
+    inventory?.contract !== BASELINE_CAPABILITY_INVENTORY_CONTRACT
   ) {
     issues.push("inventory contract or schemaVersion is invalid");
   }
@@ -487,7 +487,7 @@ export function assertV3V4CapabilityInventory(inventory) {
 
 function main() {
   const root = process.cwd();
-  const inventory = buildV3V4CapabilityInventory({ root });
+  const inventory = buildBaselineCapabilityInventory({ root });
   const expected = canonicalInventoryJson(inventory);
   if (process.argv.includes("--write")) {
     fs.writeFileSync(path.join(root, INVENTORY_PATH), expected);

package/scripts/check-ci-lane-change-budget.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import crypto from "node:crypto";
+import { projectWorkflowIdentities } from "./workflow-taxonomy.mjs";
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
@@ -14,7 +15,7 @@ const policyPath = path.join(
   "ci-lane-change-budget.json",
 );
 
-const workflows = fs
+const physicalWorkflows = fs
   .readdirSync(workflowRoot, { withFileTypes: true })
   .filter((entry) => entry.isFile() && /\.(?:yaml|yml)$/u.test(entry.name))
   .map((entry) => {
@@ -26,6 +27,8 @@ const workflows = fs
   })
   .sort((left, right) => left.path.localeCompare(right.path));
 
+const workflows = projectWorkflowIdentities(root, physicalWorkflows);
+
 const policy = JSON.parse(fs.readFileSync(policyPath, "utf8"));
 const baselineRevision = String(policy.baseline?.gitRevision || "").trim();
 if (!/^[0-9a-f]{40}$/u.test(baselineRevision)) {

package/scripts/check-core-mechanism-inventory.mjs

@@ -34,9 +34,10 @@ function registrySurfaceIds(root) {
     (entry) => `cli:${entry.id}`,
   );
   const workflows = loadJson(root, "dist/site/workflow-registry.json");
-  const workflowIds = workflows.workflows.map(
-    (entry) => `workflow:${entry.id}`,
-  );
+  const workflowIds = workflows.workflows.flatMap((entry) => [
+    `workflow:${entry.id}`,
+    ...(entry.taxonomy ? [`workflow:${entry.taxonomy.id}`] : []),
+  ]);
   const actionIds = workflows.actions.map((entry) => `action:${entry.id}`);
   const exports = Object.keys(loadJson(root, "package.json").exports).map(
     (entry) => `export:${entry}`,
@@ -274,7 +275,10 @@ function validateReverseScan(root, inventory, ids, ownedSources, issues) {
 
 function checkCoreMechanismInventory({
   root = process.cwd(),
-  inventory = loadJson(root, "architecture/v3-core-mechanism-inventory.json"),
+  inventory = loadJson(
+    root,
+    "architecture/baseline-core-mechanism-inventory.json",
+  ),
 } = {}) {
   const issues = [];
   if (

package/scripts/{check-v4-floating-consumer-policy-contract.mjs → check-floating-consumer-policy-contract.mjs}

@@ -80,17 +80,17 @@ function assertPersistedSelectors() {
       const selector = match[2];
       const protectedBootstrap =
         relative ===
-          ".github/workflows/buildchain-ref-promotion-recovery.yml" &&
+          ".github/workflows/self-ops-promotion-recovery.yml" &&
         match[1] === ".github/workflows/.release-candidate-promote.yml" &&
         selector === "alpha/v4/v4.0";
-      const isV4 =
+      const isCurrentMajor =
         selector === "v4" ||
         selector === "v4-alpha" ||
         /^v4(?:[./-]|$)/u.test(selector) ||
         /^[0-9a-f]{40}$/iu.test(selector) ||
         selector.includes("${{");
       if (
-        (isV4 || protectedBootstrap) &&
+        (isCurrentMajor || protectedBootstrap) &&
         !["v4", "v4-alpha"].includes(selector) &&
         !protectedBootstrap
       ) {
@@ -104,9 +104,9 @@ function assertPersistedSelectors() {
     );
 }
 
-export function checkV4FloatingConsumerPolicyContract() {
+export function checkFloatingConsumerPolicyContract() {
   const policy = JSON.parse(
-    read("architecture/v4-floating-consumer-policy.json"),
+    read("architecture/floating-consumer-policy.json"),
   );
   if (policy.contract !== "kungfu-buildchain-v4-floating-consumer-policy/v1") {
     fail("architecture policy contract is missing");
@@ -148,7 +148,7 @@ export function checkV4FloatingConsumerPolicyContract() {
     "Resolve controller identities",
     "Install Buildchain runtime dependencies",
   ]);
-  const stageCanary = read(".github/workflows/v4-stage-capsule-canary.yml");
+  const stageCanary = read(".github/workflows/public-build-stage-capsule-canary.yml");
   if (
     !stageCanary.includes("consumer-admission:") ||
     !stageCanary.includes("needs: consumer-admission")
@@ -173,12 +173,12 @@ export function checkV4FloatingConsumerPolicyContract() {
     ["packages/core/release-candidate.js", "consumerPolicy"],
     ["packages/core/release-passport.js", "v4ConsumerPolicy"],
     [
-      "actions/v4-release-candidate-promote/index.js",
+      "actions/release-candidate-promote/index.js",
       "candidate.consumerPolicy?.receiptRoot",
     ],
     [
-      "actions/v4-release-candidate-promote/index.js",
-      "createV4ReleaseInvocation",
+      "actions/release-candidate-promote/index.js",
+      "createReleaseInvocation",
     ],
   ]) {
     if (!read(relative).includes(marker)) {
@@ -205,7 +205,7 @@ if (
 ) {
   try {
     process.stdout.write(
-      `${JSON.stringify(checkV4FloatingConsumerPolicyContract(), null, 2)}\n`,
+      `${JSON.stringify(checkFloatingConsumerPolicyContract(), null, 2)}\n`,
     );
   } catch (error) {
     console.error(error.message);

package/scripts/check-implementation-naming.mjs

@@ -0,0 +1,135 @@
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+import ts from "typescript";
+
+const ROOTS = new Set([
+  "actions",
+  "bin",
+  "crates",
+  "packages",
+  "scripts",
+  "tests",
+]);
+const GENERATION_PATH = /(?:^|[-_])v\d+(?:[-_]|$)/iu;
+const PROTOCOL_VERSION_SYMBOLS = new Set([
+  "createSourceQualificationProofV2",
+  "loadedV2",
+]);
+const GENERATION_SYMBOL =
+  /(?:^|_)V\d+(?:_|$)|V\d+(?=[A-Z]|$)|^v\d+(?=[A-Z]|$)/u;
+
+export function inspectImplementationName(file, source) {
+  const issues = [];
+  if (!ROOTS.has(file.split("/")[0])) return issues;
+  for (const component of file.split("/")) {
+    if (GENERATION_PATH.test(component))
+      issues.push(`${file}: implementation path contains a product generation`);
+  }
+  if (file.endsWith(".rs")) {
+    for (const match of source.matchAll(
+      /\b(?:fn|struct|enum|mod|const|let)\s+([A-Za-z_][A-Za-z0-9_]*)/gu,
+    ))
+      if (
+        GENERATION_SYMBOL.test(match[1]) ||
+        /(?:^|_)v\d+(?:_|$)/u.test(match[1])
+      )
+        issues.push(`${file}: ${match[1]} must describe its responsibility`);
+  }
+  if (!/\.(?:[cm]?js|ts)$/u.test(file) || file.includes("/dist/"))
+    return issues;
+  const syntax = ts.createSourceFile(
+    file,
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+  );
+  const visit = (node) => {
+    if (
+      (ts.isFunctionDeclaration(node) ||
+        ts.isClassDeclaration(node) ||
+        ts.isVariableDeclaration(node) ||
+        ts.isParameter(node) ||
+        ts.isMethodDeclaration(node) ||
+        ts.isBindingElement(node)) &&
+      node.name &&
+      ts.isIdentifier(node.name) &&
+      GENERATION_SYMBOL.test(node.name.text) &&
+      !PROTOCOL_VERSION_SYMBOLS.has(node.name.text) &&
+      !/_V\d+_SCHEMA$/u.test(node.name.text)
+    ) {
+      const line =
+        syntax.getLineAndCharacterOfPosition(node.name.getStart()).line + 1;
+      issues.push(
+        `${file}:${line}: ${node.name.text} must describe its responsibility`,
+      );
+    }
+    if (
+      (ts.isStringLiteral(node) ||
+        ts.isNoSubstitutionTemplateLiteral(node) ||
+        ts.isTemplateHead(node) ||
+        ts.isTemplateMiddle(node) ||
+        ts.isTemplateTail(node)) &&
+      /\.buildchain\/[A-Za-z0-9_./-]*\bv\d+-/u.test(node.text)
+    )
+      issues.push(
+        `${file}: runtime directory must describe its responsibility`,
+      );
+    ts.forEachChild(node, visit);
+  };
+  visit(syntax);
+  return issues;
+}
+
+export function checkImplementationNaming(root = process.cwd()) {
+  const files = execFileSync("git", ["ls-files", "-z"], {
+    cwd: root,
+    encoding: "utf8",
+  })
+    .split("\0")
+    .filter(Boolean);
+  const issues = files.flatMap((file) => {
+    const absolute = path.join(root, file);
+    if (!fs.existsSync(absolute))
+      return [`${file}: tracked implementation is missing`];
+    const source =
+      ROOTS.has(file.split("/")[0]) && /\.(?:[cm]?js|ts|rs)$/u.test(file)
+        ? fs.readFileSync(absolute, "utf8")
+        : "";
+    return inspectImplementationName(file, source);
+  });
+  const manifest = JSON.parse(
+    fs.readFileSync(path.join(root, "package.json"), "utf8"),
+  );
+  for (const name of Object.keys(manifest.scripts || {})) {
+    if (/(?:^|:)v\d+(?:[-:]|$)/iu.test(name))
+      issues.push(`package.json: script ${name} contains a product generation`);
+  }
+  const policy = JSON.parse(
+    fs.readFileSync(
+      path.join(root, "architecture/implementation-naming.json"),
+      "utf8",
+    ),
+  );
+  for (const [file, identities] of Object.entries(policy.wireIdentities)) {
+    const source = fs.readFileSync(path.join(root, file), "utf8");
+    for (const previousIdentity of identities) {
+      const identity =
+        policy.implementationIdentityMigrations?.[file]?.[previousIdentity] ||
+        previousIdentity;
+      if (
+        !source.includes(JSON.stringify(identity)) &&
+        !source.includes(`'${identity}'`)
+      )
+        issues.push(
+          `${file}: published wire identity changed during implementation relocation: ${identity}`,
+        );
+    }
+  }
+  if (issues.length) throw new Error(issues.join("\n"));
+  return { checkedFiles: files.length, issues: [] };
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
+  console.log(JSON.stringify(checkImplementationNaming(), null, 2));

package/scripts/check-inventory.mjs

@@ -145,39 +145,39 @@ const requiredPaths = [
   ".buildchain/alpha-contract-lock.json",
   ".buildchain/release-impact.json",
   ".github/actionlint.yaml",
-  ".github/workflows/self-hosted-runner-smoke.yml",
-  ".github/workflows/buildchain-ref-promotion.yml",
-  ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml",
-  ".github/workflows/release-line-bootstrap.yml",
+  ".github/workflows/self-ops-runner-smoke.yml",
+  ".github/workflows/self-release-promote.yml",
+  ".github/workflows/self-ops-recovery-failure-dogfood.yml",
+  ".github/workflows/self-release-line-open.yml",
   ".github/workflows/release-governance-reconcile.yml",
   ".github/workflows/dev-pr-auto-merge.yml",
-  ".github/workflows/buildchain-dev-delivery.yml",
+  ".github/workflows/self-ops-dev-delivery.yml",
   ".github/workflows/buildchain-patrol.yml",
   ".github/workflows/patrol-daily.yml",
   ".github/workflows/patrol-weekly.yml",
   ".github/workflows/patrol-monthly.yml",
   ".github/workflows/patrol-observed-evidence.yml",
-  ".github/workflows/buildchain-patrol-daily.yml",
-  ".github/workflows/buildchain-patrol-weekly.yml",
-  ".github/workflows/buildchain-patrol-monthly.yml",
-  ".github/workflows/buildchain-alpha-self-dogfood.yml",
+  ".github/workflows/self-ops-patrol-daily.yml",
+  ".github/workflows/self-ops-patrol-weekly.yml",
+  ".github/workflows/self-ops-patrol-monthly.yml",
+  ".github/workflows/self-build-alpha-dogfood.yml",
   ".github/workflows/release-candidate-promote.yml",
   ".github/workflows/.release-candidate-promote.yml",
   ".github/workflows/release-propagation.yml",
-  ".github/workflows/npm-publish.yml",
+  ".github/workflows/self-release-npm-dry-run.yml",
   ".github/workflows/paper-release.yml",
-  ".github/workflows/binary-distribution.yml",
+  ".github/workflows/self-build-binary-distribution.yml",
   ".github/workflows/.binary-release-assets.yml",
-  ".github/workflows/binary-release-assets.yml",
-  ".github/workflows/verify.yml",
+  ".github/workflows/self-release-binary-assets.yml",
+  ".github/workflows/self-build-verify.yml",
   ".github/workflows/.build.yml",
   ".github/workflows/.gate-profile.yml",
   ".github/workflows/.auditable-demo.yml",
   ".github/workflows/.declarative-auditable-demo.yml",
-  ".github/workflows/auditable-demo.yml",
+  ".github/workflows/self-build-demo-dogfood.yml",
   ".github/workflows/build.yml",
-  ".github/workflows/build-surface-fixture.yml",
-  ".github/workflows/candidate-lab.yml",
+  ".github/workflows/self-build-fixture.yml",
+  ".github/workflows/self-build-candidate-lab.yml",
   "fixtures/libnode-shaped/buildchain.toml",
   "fixtures/libnode-shaped/.github/workflows/build.yml",
   "fixtures/libnode-shaped/package.json"
@@ -197,7 +197,7 @@ if (rootPackage.private !== false) {
   throw new Error("root package must be publishable with private=false");
 }
 const selfDogfoodWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/buildchain-alpha-self-dogfood.yml"),
+  path.join(root, ".github/workflows/self-build-alpha-dogfood.yml"),
   "utf8",
 );
 const selfDogfoodAlphaLock = JSON.parse(
@@ -207,7 +207,7 @@ const currentBuildchainContract = JSON.parse(
   fs.readFileSync(path.join(root, "dist/site/buildchain-contract.json"), "utf8"),
 );
 const selfDogfoodBootstrapAuthority = JSON.parse(
-  fs.readFileSync(path.join(root, "architecture/v4-bootstrap-authority.json"), "utf8"),
+  fs.readFileSync(path.join(root, "architecture/bootstrap-authority.json"), "utf8"),
 );
 const selfDogfoodMajorResolution = resolveSelfDogfoodMajor({
   packageVersion: rootPackage.version,
@@ -285,7 +285,7 @@ const channelPromotionWorkflow = fs.readFileSync(
   "utf8",
 );
 const boundedAlphaRecoveryWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/buildchain-ref-promotion-recovery.yml"),
+  path.join(root, ".github/workflows/self-ops-promotion-recovery.yml"),
   "utf8",
 );
 const promotionShellRouting = parsePromotionShellRouting(
@@ -546,7 +546,8 @@ if (!coreIndexSource.includes("KFD2_RELEASE_TRUST_PASSPORT_CONTRACT")) {
 if (!coreIndexSource.includes("KFD2_TRUST_PROOF_CONTRACT")) {
   throw new Error("packages/core/index.js must export KFD-2 trust proof contract");
 }
-if (!coreIndexSource.includes("createSurfaceTimestampPolicy")) {
+const publicCore = await import("../packages/core/index.js");
+if (typeof publicCore.createSurfaceTimestampPolicy !== "function") {
   throw new Error("packages/core/index.js must export surface manifest timestamp policy APIs");
 }
 for (const requiredSnippet of [
@@ -1000,11 +1001,11 @@ for (const requiredSnippet of [
 if (commonJsSourcePattern.test(standaloneBinaryScript)) {
   throw new Error("scripts/build-standalone-binary.mjs must use ESM syntax");
 }
-const npmPublishWorkflow = fs.readFileSync(path.join(root, ".github/workflows/npm-publish.yml"), "utf8");
-const buildchainRefPromotionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/buildchain-ref-promotion.yml"), "utf8");
-const binaryDistributionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/binary-distribution.yml"), "utf8");
+const npmPublishWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-release-npm-dry-run.yml"), "utf8");
+const buildchainRefPromotionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-release-promote.yml"), "utf8");
+const binaryDistributionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-build-binary-distribution.yml"), "utf8");
 const binaryReleaseAssetsWorkflow = fs.readFileSync(path.join(root, ".github/workflows/.binary-release-assets.yml"), "utf8");
-const selfHostedRunnerSmokeWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-hosted-runner-smoke.yml"), "utf8");
+const selfHostedRunnerSmokeWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-ops-runner-smoke.yml"), "utf8");
 const npmDryRunScript = fs.readFileSync(path.join(root, "scripts/npm-publish-dry-run.mjs"), "utf8");
 const npmPublishTransactionScript = fs.readFileSync(path.join(root, "scripts/npm-publish-transaction.mjs"), "utf8");
 const rootPackageJson = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
@@ -1043,8 +1044,8 @@ for (const requiredSnippet of [
   "actions: write",
   "uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha",
   "github.event.workflow_run.event == 'push'",
-  "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
-  "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
+  "name: Classify generated product-state finalization",
+  "selectFinalizedProductPublicationVersion",
   "resume-candidate-run-id:",
   "resume-expected-source-tree:",
   "resume-buildchain-runtime-ref:",
@@ -1056,12 +1057,19 @@ for (const requiredSnippet of [
     throw new Error(`buildchain ref promotion workflow missing npm transaction snippet: ${requiredSnippet}`);
   }
 }
+if (buildchainRefPromotionWorkflow.includes("workflow_run.display_title")) {
+  throw new Error(
+    "buildchain ref promotion must classify finalization from rooted product state, not a display title",
+  );
+}
 const releaseCandidatePromoteWorkflow = fs.readFileSync(path.join(root, ".github/workflows/.release-candidate-promote.yml"), "utf8");
 for (const requiredSnippet of [
   "name: QUALIFY canonical v4 release invocation inputs",
   "name: APPLY one rooted provider transaction",
   "name: SETTLE terminal ReleaseReceipt projection",
-  "uses: ./.buildchain/runtime/actions/v4-release-candidate-promote",
+  "uses: ./.buildchain/runtime/actions/release-candidate-promote",
+  "name: Resolve one exact product publication recovery",
+  "selectRecoveredProductPublicationVersion",
   "publisher-workflow-sha:",
   "runtime-commit:",
   "runtime-tree:",
@@ -1101,31 +1109,15 @@ for (const workflowFile of fs.readdirSync(workflowDir).filter((entry) => entry.e
   }
 }
 for (const retiredWorkflow of [
+  ".release-docker.yml",
   ".release-new-version.yml",
   ".release-elastic-beanstalk.yml",
   ".sam-release.yml",
   ".wheel-release.yml",
+  "schedule-purge-artifacts.yml",
 ]) {
-  const retiredSource = fs.readFileSync(path.join(workflowDir, retiredWorkflow), "utf8");
-  for (const requiredSnippet of [
-    "release path is retired",
-    "release-candidate-promote.yml@v3",
-    "publish-gate source-lock enforcement",
-  ]) {
-    if (!retiredSource.includes(requiredSnippet)) {
-      throw new Error(`${retiredWorkflow} must fail closed and point callers at the source-locked release-candidate-promote model: ${requiredSnippet}`);
-    }
-  }
-  for (const forbiddenSnippet of [
-    "npm publish --access=public",
-    "actions/publish-prebuilt@v2",
-    "actions/bump-version@v2",
-    "beanstalk-deploy@",
-    "sam deploy",
-  ]) {
-    if (retiredSource.includes(forbiddenSnippet)) {
-      throw new Error(`${retiredWorkflow} must not keep retired publish side effects: ${forbiddenSnippet}`);
-    }
+  if (fs.existsSync(path.join(workflowDir, retiredWorkflow))) {
+    throw new Error(`${retiredWorkflow} is fully retired and must remain deleted`);
   }
 }
 const promoteBuildchainRefAction = fs.readFileSync(path.join(root, "actions/promote-buildchain-ref/action.yml"), "utf8");