@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/scripts/generate-channel-promotion-workflow.mjs

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 
 import fs from "node:fs";
+import { writeWorkflowSource } from "./workflow-taxonomy.mjs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { migrateUniversalWorkflowFacade } from "./generate-universal-workflow-facades.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const sourcePath = path.join(root, ".github/workflows/.release-candidate-promote.yml");
@@ -208,29 +210,29 @@ function consumerAdmissionJob() {
         with:
           repository: \${{ inputs.buildchain-repository }}
           ref: \${{ needs.resolve-promotion.outputs.router-sha }}
-          path: .buildchain/v4-policy-runtime
+          path: .buildchain/policy-runtime
           persist-credentials: false
       - name: Enforce v4 floating consumer policy
         id: policy
         env:
           BUILDCHAIN_CONSUMER_ROOT: .buildchain/consumer
-          BUILDCHAIN_INVOCATION_SOURCE_PATH: \${{ inputs.publication-publisher-workflow-path == '.github/workflows/buildchain-ref-promotion-recovery.yml' && '.github/workflows/release-candidate-promote.yml' || inputs.publication-publisher-workflow-path }}
+          BUILDCHAIN_INVOCATION_SOURCE_PATH: \${{ inputs.publication-publisher-workflow-path == '.github/workflows/self-ops-promotion-recovery.yml' && '.github/workflows/release-candidate-promote.yml' || inputs.publication-publisher-workflow-path }}
           BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: \${{ needs.resolve-promotion.outputs.channel }}
-          BUILDCHAIN_INVOKED_WORKFLOW: \${{ inputs.publication-publisher-workflow-path == '.github/workflows/buildchain-ref-promotion-recovery.yml' && '.github/workflows/.release-candidate-promote.yml' || '.github/workflows/release-candidate-promote.yml' }}
+          BUILDCHAIN_INVOKED_WORKFLOW: \${{ inputs.publication-publisher-workflow-path == '.github/workflows/self-ops-promotion-recovery.yml' && '.github/workflows/.release-candidate-promote.yml' || '.github/workflows/release-candidate-promote.yml' }}
           BUILDCHAIN_WORKFLOW_SHA: \${{ needs.resolve-promotion.outputs.router-sha }}
           BUILDCHAIN_RUNTIME_SHA: \${{ needs.resolve-promotion.outputs.router-sha }}
           BUILDCHAIN_STABLE_CONTRACT_LOCK_PATH: \${{ inputs.buildchain-stable-contract-lock-path }}
           BUILDCHAIN_ALPHA_CONTRACT_LOCK_PATH: \${{ inputs.buildchain-alpha-contract-lock-path }}
-          BUILDCHAIN_V4_POLICY_RECEIPT_PATH: .buildchain/evidence/v4-consumer-policy-receipt.json
+          BUILDCHAIN_V4_POLICY_RECEIPT_PATH: .buildchain/evidence/consumer-policy-receipt.json
         run: >-
-          node .buildchain/v4-policy-runtime/scripts/v4-consumer-policy.mjs scan
+          node .buildchain/policy-runtime/scripts/consumer-policy.mjs scan
           --source-sha "\${{ inputs.target-sha || github.sha }}"
 
       - name: Upload rooted consumer admission receipt
         uses: actions/upload-artifact@v7.0.1
         with:
           name: v4-consumer-policy-release-candidate-promote-\${{ github.sha }}
-          path: .buildchain/consumer/.buildchain/evidence/v4-consumer-policy-receipt.json
+          path: .buildchain/consumer/.buildchain/evidence/consumer-policy-receipt.json
           if-no-files-found: error
 
       - name: Authorize transient v4 runtime selection
@@ -238,18 +240,18 @@ function consumerAdmissionJob() {
         if: \${{ needs.resolve-promotion.outputs.override-used == 'true' }}
         uses: actions/github-script@v8
         env:
-          BUILDCHAIN_RUNTIME_AUTHORIZATION_PATH: .buildchain/consumer/.buildchain/evidence/v4-runtime-authorization.json
+          BUILDCHAIN_RUNTIME_AUTHORIZATION_PATH: .buildchain/consumer/.buildchain/evidence/runtime-authorization.json
         with:
           script: |
-            const script = require(process.env.GITHUB_WORKSPACE + "/.buildchain/v4-policy-runtime/scripts/authorize-promotion-runtime-override.cjs");
+            const script = require(process.env.GITHUB_WORKSPACE + "/.buildchain/policy-runtime/scripts/authorize-promotion-runtime-override.cjs");
             const result = await script.authorizePromotionRuntimeOverride({
               github,
               context,
               request: {
                 consumerRoot: process.env.GITHUB_WORKSPACE + "/.buildchain/consumer",
-                runtimeModulePath: process.env.GITHUB_WORKSPACE + "/.buildchain/v4-policy-runtime/packages/core/v4-runtime-ref-resume-authority.js",
+                runtimeModulePath: process.env.GITHUB_WORKSPACE + "/.buildchain/policy-runtime/packages/core/runtime-ref-resume-authority.js",
                 runtimeRepository: "\${{ inputs.buildchain-repository }}",
-                consumerPolicyReceiptPath: process.env.GITHUB_WORKSPACE + "/.buildchain/consumer/.buildchain/evidence/v4-consumer-policy-receipt.json",
+                consumerPolicyReceiptPath: process.env.GITHUB_WORKSPACE + "/.buildchain/consumer/.buildchain/evidence/consumer-policy-receipt.json",
                 consumerPolicyReceiptRoot: "\${{ steps.policy.outputs.v4-consumer-policy-receipt-root }}",
                 sourceSha: "\${{ inputs.target-sha || github.sha }}",
                 requestedRef: "\${{ needs.resolve-promotion.outputs.runtime-ref }}",
@@ -270,7 +272,7 @@ function consumerAdmissionJob() {
         uses: actions/upload-artifact@v7.0.1
         with:
           name: v4-runtime-authorization-release-candidate-promote-\${{ github.run_id }}
-          path: .buildchain/consumer/.buildchain/evidence/v4-runtime-authorization.json
+          path: .buildchain/consumer/.buildchain/evidence/runtime-authorization.json
           if-no-files-found: error
 `;
 }
@@ -302,7 +304,7 @@ export function generateChannelPromotionWorkflow(source, { major = 2, shellRouti
     if (!inputNames.includes(required)) throw new Error(`advanced promotion workflow missing input: ${required}`);
   }
   const invokeForwarded = routedInputs(inputNames, alphaRoute, major);
-  return `# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.
+  return migrateUniversalWorkflowFacade(`# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.
 name: Release Candidate Promote
 
 on:
@@ -314,16 +316,7 @@ ${secrets.trimEnd()}
     outputs:
 ${publicOutputs(outputs)}
 
-permissions:
-  actions: write
-  artifact-metadata: write
-  attestations: write
-  checks: write
-  contents: write
-  id-token: write
-  issues: write
-  pull-requests: write
-
+# Provider authority is inherited from the explicit caller envelope.
 jobs:
   resolve-promotion:
     name: Resolve promotion workflow shell and runtime
@@ -358,7 +351,7 @@ jobs:
         run: |
           set -euo pipefail
           repository="\${BUILDCHAIN_ROUTER_REPOSITORY}"
-          ref="\${BUILDCHAIN_ROUTER_REF}"
+          ref="\${BUILDCHAIN_ROUTER_REF:-${alphaRoute.logicalRef}}"
           ref="\${ref#refs/heads/}"
           ref="\${ref#refs/tags/}"
           if [[ ! "\${repository}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ || -z "\${ref}" || "\${ref}" = /* || "\${ref}" = *..* ]]; then
@@ -501,19 +494,11 @@ ${consumerAdmissionJob()}
     name: Invoke the single v4 publisher adapter
     needs: [resolve-promotion, consumer-admission]
     uses: kungfu-systems/buildchain/${alphaRoute.workflowPath}@${alphaRoute.callRef}
-    permissions:
-      actions: write
-      artifact-metadata: write
-      attestations: write
-      checks: write
-      contents: write
-      id-token: write
-      issues: write
-      pull-requests: write
+    # Provider authority is inherited from the explicit caller envelope.
     with:
 ${invokeForwarded}
     secrets: inherit
-`;
+`, ".github/workflows/release-candidate-promote.yml");
 }
 
 function main() {
@@ -531,7 +516,7 @@ function main() {
     }
     return;
   }
-  fs.writeFileSync(targetPath, generated);
+  writeWorkflowSource(root, path.relative(root, targetPath), generated);
 }
 
 const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);

package/scripts/generate-release-candidate-passport.mjs

@@ -4,11 +4,11 @@ import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import { createReleaseCandidatePassport, validateReleaseCandidatePassport } from "../packages/core/release-candidate.js";
-import { scanV4FloatingConsumerPolicy, v4ConsumerPolicyScannerRoot } from "../packages/core/v4-floating-consumer-policy.js";
-import { v4ContentRoot } from "../packages/core/v4-canonical-contracts.js";
-import { V4_STAGE_CAPSULE_CONTRACT, V4_STAGE_CAPSULE_IDENTITY_CONTRACT, v4StageCapsuleIdentityRoot, v4StageCapsuleRoot, validateV4StageCapsule } from "../packages/core/v4-stage-capsule.js";
-import { v4RuntimeResumeDocumentRoot } from "../packages/core/v4-runtime-ref-resume-authority.js";
-import { createV4PublicationQualificationReceipt } from "../packages/core/v4-publication-qualification.js";
+import { scanFloatingConsumerPolicy, consumerPolicyScannerRoot } from "../packages/core/floating-consumer-policy.js";
+import { domainContentRoot } from "../packages/core/canonical-contracts.js";
+import { STAGE_CAPSULE_CONTRACT, STAGE_CAPSULE_IDENTITY_CONTRACT, stageCapsuleIdentityRoot, stageCapsuleRoot, validateStageCapsule } from "../packages/core/stage-capsule.js";
+import { runtimeResumeDocumentRoot } from "../packages/core/runtime-ref-resume-authority.js";
+import { createDomainPublicationQualificationReceipt } from "../packages/core/publication-qualification.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 const env = (name, fallback = "") => process.env[name] || fallback;
@@ -37,12 +37,12 @@ export function createReleaseCandidateStageCapsules({
     const coordinate = coordinateByPlatform.get(platform.platformId);
     if (!coordinate || coordinate.name !== platform.artifactName) throw new Error(`Stage Capsule coordinate missing for ${platform.platformId}`);
     const manifest = readJsonFile(platform.manifestPath);
-    return { role: platform.artifactName, platform: platform.platformId, artifactRoot: coordinate.digest, manifestRoot: v4ContentRoot("stage-capsule-artifact-manifest", manifest) };
+    return { role: platform.artifactName, platform: platform.platformId, artifactRoot: coordinate.digest, manifestRoot: domainContentRoot("stage-capsule-artifact-manifest", manifest) };
   });
   const qualificationExpiresAt = coordinates.artifacts.map((entry) => entry.expiresAt).sort((left, right) => Date.parse(left) - Date.parse(right))[0];
-  const qualificationReceipt = createV4PublicationQualificationReceipt({
+  const qualificationReceipt = createDomainPublicationQualificationReceipt({
     repository: passport.repository, candidateRoot: `sha256:${passport.candidateHash}`,
-    sourceSha: passport.source.headSha, sourceRoot: v4ContentRoot("candidate-identity", passport.source),
+    sourceSha: passport.source.headSha, sourceRoot: domainContentRoot("candidate-identity", passport.source),
     policyDigest: passport.consumerPolicy.receiptRoot, artifacts: qualificationArtifacts,
     issuedAt: passport.createdAt || new Date(Date.parse(qualificationExpiresAt) - 86_400_000).toISOString(), expiresAt: qualificationExpiresAt,
   });
@@ -57,13 +57,13 @@ export function createReleaseCandidateStageCapsules({
       }
       const manifest = readJsonFile(platform.manifestPath);
       const identity = {
-        schema: V4_STAGE_CAPSULE_IDENTITY_CONTRACT,
-        sourceRoot: v4ContentRoot("candidate-identity", passport.source),
+        schema: STAGE_CAPSULE_IDENTITY_CONTRACT,
+        sourceRoot: domainContentRoot("candidate-identity", passport.source),
         platform: platform.platformId,
-        platformRoot: v4ContentRoot("candidate-identity", manifest.platform),
+        platformRoot: domainContentRoot("candidate-identity", manifest.platform),
         stage: "verify",
         toolchainRoots: [],
-        runtimeRoot: v4ContentRoot("candidate-identity", {
+        runtimeRoot: domainContentRoot("candidate-identity", {
           sha: passport.buildchain.sha,
         }),
         policyRoot: passport.consumerPolicy.receiptRoot,
@@ -73,11 +73,11 @@ export function createReleaseCandidateStageCapsules({
             root: `sha256:${passport.candidateHash}`,
           },
         ],
-        transformationRoot: v4ContentRoot("candidate-identity", {
+        transformationRoot: domainContentRoot("candidate-identity", {
           lifecycle: manifest.lifecycle,
           summary: platform.summary,
         }),
-        outputManifestRoot: v4ContentRoot(
+        outputManifestRoot: domainContentRoot(
           "stage-capsule-artifact-manifest",
           { artifact: coordinate, manifest },
         ),
@@ -85,24 +85,24 @@ export function createReleaseCandidateStageCapsules({
         observationRoots: [
           {
             name: "provider-coordinate",
-            root: v4ContentRoot("provider-readback-sample", coordinate),
+            root: domainContentRoot("provider-readback-sample", coordinate),
           },
         ],
       };
       const capsule = {
-        schema: V4_STAGE_CAPSULE_CONTRACT,
+        schema: STAGE_CAPSULE_CONTRACT,
         writerAuthority: "typescript-v3",
         rustAuthority: "validation-only",
         identity,
-        identityRoot: v4StageCapsuleIdentityRoot(identity),
+        identityRoot: stageCapsuleIdentityRoot(identity),
         retentionPromise: {
           class: "github-artifact",
           retainUntil: coordinate.expiresAt,
         },
         capsuleRoot: `sha256:${"0".repeat(64)}`,
       };
-      capsule.capsuleRoot = v4StageCapsuleRoot(capsule);
-      validateV4StageCapsule(capsule);
+      capsule.capsuleRoot = stageCapsuleRoot(capsule);
+      validateStageCapsule(capsule);
       return {
         platform: platform.platformId,
         artifactName: coordinate.name,
@@ -133,7 +133,7 @@ export function createReleaseCandidateStageCapsules({
     publicationQualificationReceipt: qualificationReceipt,
     capsules: entries,
   };
-  return { ...body, root: v4RuntimeResumeDocumentRoot(body) };
+  return { ...body, root: runtimeResumeDocumentRoot(body) };
 }
 
 function writeReleaseCandidateStageCapsules({
@@ -188,12 +188,12 @@ export function resolveLegacyConsumerPolicyReceipt(options = {}) {
   if (!/^[0-9a-f]{40}$/u.test(options.runtimeRef || "") || options.runtimeRef !== options.runtimeSha || options.sourceTreeHash !== options.runtimeTreeHash()) return undefined;
   const root = path.resolve(options.root || ".buildchain/runtime");
   const alphaLock = readJsonFile(path.join(root, ".buildchain/alpha-contract-lock.json"));
-  const result = scanV4FloatingConsumerPolicy({
+  const result = scanFloatingConsumerPolicy({
     root, repository: options.repository, sourceSha: options.sourceSha,
     invokedWorkflow: options.invokedWorkflow || ".github/workflows/build.yml", invocationSourcePath: options.invocationSourcePath,
     expectedInvocationChannel: "alpha", resolvedWorkflowSha: alphaLock.buildchain?.resolvedSha,
-    resolvedRuntimeSha: options.runtimeSha, scannerRoot: v4ConsumerPolicyScannerRoot(),
-    policy: readJsonFile(path.resolve(import.meta.dirname, "../architecture/v4-floating-consumer-policy.json")),
+    resolvedRuntimeSha: options.runtimeSha, scannerRoot: consumerPolicyScannerRoot(),
+    policy: readJsonFile(path.resolve(import.meta.dirname, "../architecture/floating-consumer-policy.json")),
   });
   if (!result.ok) throw new Error(`legacy floating-shell policy receipt invalid: ${result.failures.map(({ code }) => code).join(", ")}`);
   return { receipt: result.receipt, receiptRoot: result.receiptRoot };

package/scripts/generate-site-bundle.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { readWorkflowTaxonomy, workflowPath } from "./workflow-taxonomy.mjs";
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
@@ -50,31 +51,31 @@ const DEV_DELIVERY_AUTHORITY_SCHEMA =
   "schemas/dev-delivery-authority-v2.schema.json";
 const DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE =
   "contracts/dev-delivery-authority-v2.schema.json";
-const V4_COMPATIBILITY_FACTS_SCHEMA =
+const COMPATIBILITY_FACTS_SCHEMA =
   "schemas/v4-compatibility-facts-v1.schema.json";
-const V4_COMPATIBILITY_FACTS_SCHEMA_SOURCE =
+const COMPATIBILITY_FACTS_SCHEMA_SOURCE =
   "contracts/v4-compatibility-facts-v1.schema.json";
-const V4_PUBLICATION_REHEARSAL_SCHEMA =
+const PUBLICATION_REHEARSAL_SCHEMA =
   "schemas/v4-publication-rehearsal-capsule-v1.schema.json";
-const V4_PUBLICATION_REHEARSAL_SCHEMA_SOURCE =
+const PUBLICATION_REHEARSAL_SCHEMA_SOURCE =
   "contracts/v4-publication-rehearsal-capsule-v1.schema.json";
-const V4_ADOPTER_DELIVERY_SCHEMA =
+const ADOPTER_DELIVERY_SCHEMA =
   "schemas/v4-adopter-delivery-v1.schema.json";
-const V4_ADOPTER_DELIVERY_SCHEMA_SOURCE =
+const ADOPTER_DELIVERY_SCHEMA_SOURCE =
   "contracts/v4-adopter-delivery-v1.schema.json";
 const RELEASE_TAIL_CAPABILITIES_SCHEMA =
   "schemas/release-tail-capabilities-v1.schema.json";
 const RELEASE_TAIL_CAPABILITIES_SCHEMA_SOURCE =
   "contracts/release-tail-capabilities-v1.schema.json";
-const V4_PUBLICATION_QUALIFICATION_SCHEMA =
+const PUBLICATION_QUALIFICATION_SCHEMA =
   "schemas/v4-publication-qualification-v1.schema.json";
-const V4_PUBLICATION_QUALIFICATION_SCHEMA_SOURCE =
+const PUBLICATION_QUALIFICATION_SCHEMA_SOURCE =
   "contracts/v4-publication-qualification-v1.schema.json";
 const PUBLICATION_REHEARSAL_SITE_SCHEMAS = [
-  V4_PUBLICATION_REHEARSAL_SCHEMA,
-  V4_ADOPTER_DELIVERY_SCHEMA,
+  PUBLICATION_REHEARSAL_SCHEMA,
+  ADOPTER_DELIVERY_SCHEMA,
   RELEASE_TAIL_CAPABILITIES_SCHEMA,
-  V4_PUBLICATION_QUALIFICATION_SCHEMA,
+  PUBLICATION_QUALIFICATION_SCHEMA,
 ];
 const root = path.resolve(import.meta.dirname, "..");
 const outputDir = path.join(root, "dist", "site");
@@ -105,10 +106,10 @@ function stableJson(value) {
 
 function siteFileBytes(name, value) {
   if (name === DEV_DELIVERY_AUTHORITY_SCHEMA) return readText(DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE);
-  if (name === V4_COMPATIBILITY_FACTS_SCHEMA) return readText(V4_COMPATIBILITY_FACTS_SCHEMA_SOURCE);
-  if (name === V4_PUBLICATION_REHEARSAL_SCHEMA) return readText(V4_PUBLICATION_REHEARSAL_SCHEMA_SOURCE);
-  if (name === V4_PUBLICATION_QUALIFICATION_SCHEMA) return readText(V4_PUBLICATION_QUALIFICATION_SCHEMA_SOURCE);
-  if (name === V4_ADOPTER_DELIVERY_SCHEMA) return readText(V4_ADOPTER_DELIVERY_SCHEMA_SOURCE);
+  if (name === COMPATIBILITY_FACTS_SCHEMA) return readText(COMPATIBILITY_FACTS_SCHEMA_SOURCE);
+  if (name === PUBLICATION_REHEARSAL_SCHEMA) return readText(PUBLICATION_REHEARSAL_SCHEMA_SOURCE);
+  if (name === PUBLICATION_QUALIFICATION_SCHEMA) return readText(PUBLICATION_QUALIFICATION_SCHEMA_SOURCE);
+  if (name === ADOPTER_DELIVERY_SCHEMA) return readText(ADOPTER_DELIVERY_SCHEMA_SOURCE);
   if (name === RELEASE_TAIL_CAPABILITIES_SCHEMA) return readText(RELEASE_TAIL_CAPABILITIES_SCHEMA_SOURCE);
   return stableJson(value);
 }
@@ -755,9 +756,7 @@ function buildSiteBundle() {
     timestampFieldsParticipateInArtifactDigest: true,
     artifactDigestScope: "npm package dist/site JSON files",
   });
-
   const cliRegistry = createCliRegistry(packageJson);
-
   const manualRegistry = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-agent-manual-registry",
@@ -805,7 +804,6 @@ function buildSiteBundle() {
     ],
     guidance: "Agent consumers should use this registry to find packaged Buildchain manuals before inferring behavior from workflow snippets or release notes.",
   };
-
   const pageRegistry = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-site-page-registry",
@@ -821,14 +819,15 @@ function buildSiteBundle() {
     capabilityGroups: CAPABILITY_GROUPS.map((group) => group.id),
     pages,
   };
-
   const nodeApiRegistry = createSiteNodeApiRegistry({ root, packageJson, nodeApiMeta, sha256File, publicSurfaceLifecycle });
-
+  const taxonomy = readWorkflowTaxonomy(root);
   const workflowRegistry = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-workflow-registry",
     workflowSource: ".github/workflows reverse input enumeration",
     workflows: enumerateWorkflowInputs({ root }).map((entry) => {
+      const classification = taxonomy?.entries.find((item) => workflowPath(item) === entry.path || item.compatibility?.path === entry.path);
+      const semanticId = classification?.id || entry.id;
       const surfaceById = new Map([
         ["build", "channel-build-router"],
         [".build", "reusable-build"],
@@ -878,18 +877,19 @@ function buildSiteBundle() {
         ["engineering-housekeeper-monthly", "preview"],
         ["self-hosted-runner-smoke", "compatibility-fixture"],
       ]);
-      const engineeringHousekeeper = entry.id.startsWith("engineering-housekeeper");
+      const engineeringHousekeeper = semanticId.startsWith("engineering-housekeeper");
       return {
         ...entry,
-        surface: surfaceById.get(entry.id) || (entry.path.includes("/.") ? "reusable-workflow" : "repository-workflow"),
+        ...(classification ? { taxonomy: { id: classification.id, role: classification.role, category: classification.category, purpose: classification.purpose, status: classification.status, canonicalPath: workflowPath(classification), ...(classification.role === "self" && classification.migration ? { contractPath: classification.migration.previousPath } : {}), compatibilityAlias: entry.path !== workflowPath(classification) } } : {}),
+        surface: surfaceById.get(semanticId) || (entry.path.includes("/.") ? "reusable-workflow" : "repository-workflow"),
         capabilityGroup: workflowCapabilityGroup({
-          ...entry,
-          status: statusById.get(entry.id) || "active",
+          ...entry, id: semanticId,
+          status: statusById.get(semanticId) || "active",
         }),
-        status: statusById.get(entry.id) || "active",
+        status: statusById.get(semanticId) || "active",
         ...publicSurfaceLifecycle({
           owner: "buildchain-workflows",
-          maturity: statusById.get(entry.id) || "active",
+          maturity: statusById.get(semanticId) || "active",
           introducedVersion: engineeringHousekeeper ? packageJson.version : undefined,
           nonDuplicationRationale: engineeringHousekeeper
             ? "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only."
@@ -1331,8 +1331,8 @@ function buildSiteBundle() {
     [DEV_DELIVERY_AUTHORITY_SCHEMA]: readJson(
       DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE,
     ),
-    [V4_COMPATIBILITY_FACTS_SCHEMA]: readJson(
-      V4_COMPATIBILITY_FACTS_SCHEMA_SOURCE,
+    [COMPATIBILITY_FACTS_SCHEMA]: readJson(
+      COMPATIBILITY_FACTS_SCHEMA_SOURCE,
     ),
     ...Object.fromEntries(
       PUBLICATION_REHEARSAL_SITE_SCHEMAS.map((name) => [