@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/architecture/{v4-release-topology.json → release-topology.json}

@@ -14,116 +14,139 @@
       ".github/workflows/.declarative-auditable-demo.yml",
       ".github/workflows/.publication-authority.yml",
       ".github/workflows/.release-candidate-promote.yml",
-      ".github/workflows/.release-elastic-beanstalk.yml",
-      ".github/workflows/.release-new-version.yml",
-      ".github/workflows/.sam-release.yml",
       ".github/workflows/.web-surface.yml",
-      ".github/workflows/.wheel-release.yml",
-      ".github/workflows/auditable-demo.yml",
-      ".github/workflows/binary-release-assets.yml",
-      ".github/workflows/build-surface-fixture.yml",
+      ".github/workflows/self-build-demo-dogfood.yml",
+      ".github/workflows/self-release-binary-assets.yml",
+      ".github/workflows/self-build-fixture.yml",
       ".github/workflows/build.yml",
-      ".github/workflows/buildchain-alpha-self-dogfood.yml",
-      ".github/workflows/buildchain-dev-delivery.yml",
-      ".github/workflows/buildchain-ref-promotion-recovery.yml",
-      ".github/workflows/buildchain-ref-promotion.yml",
-      ".github/workflows/buildchain-patrol-daily.yml",
-      ".github/workflows/buildchain-patrol-monthly.yml",
-      ".github/workflows/buildchain-patrol-weekly.yml",
-      ".github/workflows/buildchain-stable-candidate-patrol.yml",
+      ".github/workflows/self-build-alpha-dogfood.yml",
+      ".github/workflows/self-ops-dev-delivery.yml",
+      ".github/workflows/self-ops-promotion-recovery.yml",
+      ".github/workflows/self-release-promote.yml",
+      ".github/workflows/self-ops-patrol-daily.yml",
+      ".github/workflows/self-ops-patrol-monthly.yml",
+      ".github/workflows/self-ops-patrol-weekly.yml",
+      ".github/workflows/self-ops-stable-candidate-patrol.yml",
       ".github/workflows/dev-alpha-candidate-patrol.yml",
       ".github/workflows/dev-pr-auto-merge.yml",
       ".github/workflows/github-artifact-attestation.yml",
-      ".github/workflows/npm-publish.yml",
+      ".github/workflows/self-release-npm-dry-run.yml",
       ".github/workflows/paper-release-sealed.yml",
       ".github/workflows/paper-release.yml",
       ".github/workflows/patrol-observed-evidence.yml",
       ".github/workflows/release-candidate-promote.yml",
-      ".github/workflows/release-line-bootstrap.yml",
-      ".github/workflows/release-new-version.yml",
+      ".github/workflows/self-release-line-open.yml",
+      ".github/workflows/self-release-new-version-compat.yml",
       ".github/workflows/release-propagation.yml",
       ".github/workflows/release-tail.yml",
       ".github/workflows/stable-candidate-patrol.yml",
-      ".github/workflows/v4-publication-rehearsal-dogfood.yml",
-      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+      ".github/workflows/self-release-rehearsal-dogfood.yml",
+      ".github/workflows/self-release-tail-dogfood.yml",
+      ".github/workflows/self-release-next-development.yml",
+      ".github/workflows/public-release-oci-compose-preview.yml"
     ],
     "unknownTopologyPolicy": "fail-closed"
   },
   "semanticScope": {
     "workflowPaths": [
       ".github/workflows/.release-candidate-promote.yml",
-      ".github/workflows/buildchain-ref-promotion-recovery.yml",
-      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/self-ops-promotion-recovery.yml",
+      ".github/workflows/self-release-promote.yml",
       ".github/workflows/release-candidate-promote.yml",
-      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+      ".github/workflows/self-release-tail-dogfood.yml"
     ],
     "excludedMechanisms": [
       "Paper product release",
       "npm dry-run",
       "v3 rollback workflows",
-      "retired compatibility workflows"
+      "retired compatibility workflows",
+      "Post-publication protected development review: no package, tag or Release mutation; independently inventoried in closedWorld and privilegedExecutableClosure.",
+      "Post-publication OCI Compose preview activation is measured separately in postPublicationScope; it consumes completed publication and qualification, copies one manifest to the sealed alias, and cannot materialize versions or release refs."
     ]
   },
   "authorityClosure": {
     "providerAdapters": [
       "actions/promote-buildchain-ref/github-release.js",
-      "actions/promote-buildchain-ref/v4-provider-plane.js",
+      "actions/promote-buildchain-ref/provider-plane.js",
+      "actions/release-candidate-promote/index.js",
+      "actions/release-candidate-promote/oci-provider.js",
+      "actions/release-candidate-promote/product-provider-adapters.js",
+      "actions/release-candidate-promote/product-provider-github-adapters.js",
+      "actions/release-candidate-promote/product-provider.js",
       "actions/release-tail/index.js",
-      "actions/v4-release-candidate-promote/index.js",
-      "actions/v4-release-candidate-promote/product-provider-adapters.js",
-      "actions/v4-release-candidate-promote/product-provider-github-adapters.js",
-      "actions/v4-release-candidate-promote/product-provider.js",
       "packages/core/buildchain-agent-manuals.js",
       "packages/core/index.js",
+      "packages/core/oci-compose-qualification.js",
+      "packages/core/publication-rehearsal-capsule.js",
       "packages/core/publication-rehearsal-runtime.js",
+      "packages/core/publication-rehearsal.js",
       "packages/core/release-tail-provider-adapters.js",
-      "packages/core/release-tail-provider-plane.js",
-      "packages/core/v4-product-publication.js",
-      "packages/core/v4-publication-rehearsal-capsule.js",
-      "packages/core/v4-publication-rehearsal.js"
+      "packages/core/release-tail-provider-plane.js"
     ],
     "runtimeSelectors": [
+      ".github/workflows/.build-engine.yml",
       ".github/workflows/.build.yml",
       ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/.release-promote.yml",
       ".github/workflows/.web-surface.yml",
-      ".github/workflows/buildchain-ref-promotion-recovery.yml",
-      ".github/workflows/buildchain-ref-promotion.yml",
       ".github/workflows/paper-release.yml",
+      ".github/workflows/public-build-publication.yml",
+      ".github/workflows/public-ops-tail-reseal.yml",
+      ".github/workflows/public-release-paper.yml",
+      ".github/workflows/public-release-promote.yml",
+      ".github/workflows/public-release-web.yml",
       ".github/workflows/publication-artifact.yml",
       ".github/workflows/release-candidate-promote.yml",
-      ".github/workflows/v4-tail-reseal.yml",
+      ".github/workflows/self-ops-promotion-recovery.yml",
+      ".github/workflows/self-release-promote.yml",
       "packages/core/buildchain-contract.js",
-      "packages/core/v4-runtime-ref-resume-authority.js",
-      "packages/core/v4-runtime-selector-persistence.js",
+      "packages/core/public-export-compatibility.js",
+      "packages/core/runtime-ref-resume-authority.js",
+      "packages/core/runtime-selector-persistence.js",
       "scripts/aggregate-build-summary.mjs",
       "scripts/artifact-signing-controller-core.mjs",
       "scripts/authorize-promotion-runtime-override.cjs",
       "scripts/buildchain-contract-lock.mjs",
       "scripts/check-inventory.mjs",
+      "scripts/declarative-promotion-admission.mjs",
       "scripts/generate-channel-promotion-workflow.mjs",
       "scripts/generate-release-candidate-passport.mjs",
+      "scripts/release-candidate-adapter.mjs",
       "scripts/release-candidate-resolver.mjs",
-      "scripts/resume-from-candidate-run.mjs",
-      "scripts/v4-declarative-promotion-admission.mjs",
-      "scripts/v4-release-candidate-adapter.mjs"
+      "scripts/resume-from-candidate-run.mjs"
     ],
-    "runtimeEngines": ["actions/v4-release-candidate-promote/index.js"],
+    "runtimeEngines": ["actions/release-candidate-promote/index.js"],
     "terminalProjections": [
       ".github/workflows/.release-candidate-promote.yml",
-      "actions/v4-release-candidate-promote/index.js",
-      "packages/core/v4-release-invocation.js"
+      ".github/workflows/.release-promote.yml",
+      "actions/release-candidate-promote/index.js",
+      "packages/core/release-invocation.js",
+      "scripts/publication-settlement.mjs",
+      "scripts/universal-workflow-engine.mjs"
     ],
     "privilegedExecutableClosure": {
-      "entrypoints": ["actions/v4-release-candidate-promote/index.js"],
+      "entrypoints": [
+        "actions/release-candidate-promote/index.js",
+        "scripts/binary-publication-evidence.mjs",
+        "scripts/next-development-review.mjs",
+        "scripts/oci-compose-preview.mjs",
+        "scripts/publication-settlement.mjs"
+      ],
       "modules": [
         "actions/promote-buildchain-ref/github-release.js",
         "actions/promote-buildchain-ref/internal/version-state.js",
+        "actions/promote-buildchain-ref/provider-plane.js",
         "actions/promote-buildchain-ref/reuse-complete-release.js",
-        "actions/promote-buildchain-ref/v4-provider-plane.js",
-        "actions/v4-release-candidate-promote/index.js",
-        "actions/v4-release-candidate-promote/product-provider-adapters.js",
-        "actions/v4-release-candidate-promote/product-provider-github-adapters.js",
-        "actions/v4-release-candidate-promote/product-provider.js",
+        "actions/release-candidate-promote/development-source.js",
+        "actions/release-candidate-promote/index.js",
+        "actions/release-candidate-promote/next-development-provider.js",
+        "actions/release-candidate-promote/next-development-queue.js",
+        "actions/release-candidate-promote/oci-provider.js",
+        "actions/release-candidate-promote/oci-registry-client.js",
+        "actions/release-candidate-promote/product-provider-adapters.js",
+        "actions/release-candidate-promote/product-provider-github-adapters.js",
+        "actions/release-candidate-promote/product-provider.js",
+        "actions/release-candidate-promote/publication-completion.js",
         "packages/core/adopter-delivery-gate.js",
         "packages/core/adopter-delivery-json.js",
         "packages/core/adopter-delivery-passport.js",
@@ -136,45 +159,71 @@
         "packages/core/buildchain-config.js",
         "packages/core/buildchain-contract.js",
         "packages/core/buildchain-layout.js",
+        "packages/core/canonical-contracts.js",
         "packages/core/controller-evidence.js",
         "packages/core/dev-delivery-common.js",
         "packages/core/dev-delivery-contract-surface.js",
+        "packages/core/domain-wasm-artifact.js",
+        "packages/core/domain-wasm.js",
+        "packages/core/floating-consumer-evidence.js",
+        "packages/core/floating-consumer-policy.js",
+        "packages/core/floating-consumer-release-passport.js",
         "packages/core/github-artifact-attestation.js",
         "packages/core/kfd-adopter-manifest.js",
         "packages/core/kfd-gate.js",
         "packages/core/kfd-product-gates.js",
         "packages/core/kungfu-temporal-fact.js",
+        "packages/core/next-development-transition.js",
+        "packages/core/oci-compose-qualification.js",
+        "packages/core/oci-publication-bundle.js",
+        "packages/core/oci-publication-graph.js",
         "packages/core/package-manager.js",
+        "packages/core/product-publication.js",
+        "packages/core/protected-publication-source.js",
         "packages/core/public-surface-audit.js",
         "packages/core/public-surface-cli.js",
         "packages/core/publication-artifact-candidate.js",
         "packages/core/publication-authority.js",
+        "packages/core/publication-development.js",
+        "packages/core/publication-qualification.js",
         "packages/core/publication-sealed-bundle.js",
         "packages/core/publish-transaction.js",
         "packages/core/release-candidate-recovery.js",
         "packages/core/release-candidate.js",
+        "packages/core/release-invocation.js",
         "packages/core/release-passport-contract.js",
         "packages/core/release-passport.js",
         "packages/core/release-tail-product-capabilities.js",
         "packages/core/release-tail-provider-adapters.js",
         "packages/core/release-tail-provider-plane.js",
+        "packages/core/runtime-ref-resume-authority.js",
+        "packages/core/runtime-selector-persistence.js",
         "packages/core/spawn-command.js",
         "packages/core/surface-manifest.js",
-        "packages/core/v4-canonical-contracts.js",
-        "packages/core/v4-floating-consumer-evidence.js",
-        "packages/core/v4-floating-consumer-policy.js",
-        "packages/core/v4-floating-consumer-release-passport.js",
-        "packages/core/v4-product-publication.js",
-        "packages/core/v4-protected-publication-source.js",
-        "packages/core/v4-publication-qualification.js",
-        "packages/core/v4-release-invocation.js",
-        "packages/core/v4-runtime-ref-resume-authority.js",
-        "packages/core/v4-runtime-selector-persistence.js",
         "packages/core/web-surface-publication-candidate.js",
         "packages/core/workflow-yaml-contract.js",
-        "scripts/ensure-github-release.mjs"
+        "scripts/binary-publication-evidence.mjs",
+        "scripts/ensure-github-release.mjs",
+        "scripts/next-development-review.mjs",
+        "scripts/oci-compose-preview.mjs",
+        "scripts/publication-settlement.mjs",
+        "scripts/release-asset-client.mjs",
+        "scripts/verify-version-state-delta.mjs"
+      ],
+      "root": "sha256:1794b541c105bf048758988b73b4fc0f5e191770a1c091f448a8a4714ee4323c"
+    },
+    "rustWasmAuthority": {
+      "loader": "packages/core/domain-wasm.js",
+      "metadata": "packages/core/domain-wasm-artifact.js",
+      "artifact": "packages/core/buildchain-domain.wasm",
+      "artifactRoot": "sha256:e04814473796c483e82e450b651b60e63609bfca182140b333dd0e6994ae63db",
+      "distributedArtifacts": [
+        "actions/promote-buildchain-ref/dist/buildchain-domain.wasm",
+        "actions/release-tail/dist/buildchain-domain.wasm",
+        "actions/release-candidate-promote/dist/buildchain-domain.wasm"
       ],
-      "root": "sha256:31d13d74b8b3dadbfe4b5061c99f6f6711be6c3b06449114f2708427374f9c85"
+      "byteIdenticalDistributions": true,
+      "fallbackWriterCount": 0
     },
     "legacyEngineModules": [
       "actions/promote-buildchain-ref/internal/durable-transaction-operations.js",
@@ -184,7 +233,7 @@
       "actions/promote-buildchain-ref/lib.js"
     ],
     "freshEntry": ".github/workflows/release-candidate-promote.yml",
-    "recoveryEntry": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+    "recoveryEntry": ".github/workflows/self-ops-promotion-recovery.yml",
     "forbiddenLegacyEnginePatterns": [
       "legacy-promote",
       "v4-declarative-promote",
@@ -246,14 +295,14 @@
         "path": ".github/workflows/.release-candidate-promote.yml",
         "triggers": ["workflow_call"],
         "jobs": [
-          "apply|runner|-|write|write|artifactDownload,artifactUpload|contents-write,oidc-write,promotion-runtime",
+          "apply|runner|-|inherited|inherited|artifactDownload,artifactUpload|contents-write,oidc-write,promotion-runtime",
           "qualify|runner|-|read|-|artifactUpload,jobOutput|-",
           "settle|runner|-|read|-|artifactDownload,artifactUpload,jobOutput|-"
         ],
         "reusableEdges": []
       },
       {
-        "path": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+        "path": ".github/workflows/self-ops-promotion-recovery.yml",
         "triggers": ["workflow_dispatch"],
         "jobs": [
           "resume|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write"
@@ -263,9 +312,10 @@
         ]
       },
       {
-        "path": ".github/workflows/buildchain-ref-promotion.yml",
+        "path": ".github/workflows/self-release-promote.yml",
         "triggers": ["workflow_dispatch", "workflow_run:completed"],
         "jobs": [
+          "classify-workflow-run|runner|-|read|-|-|-",
           "promote|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
           "reject-invalid-candidate-recovery|runner|-|read|-|-|-",
           "reject-invalid-durable-recovery|runner|-|read|-|-|-",
@@ -280,7 +330,7 @@
         "triggers": ["workflow_call"],
         "jobs": [
           "consumer-admission|runner|-|read|-|artifactUpload|-",
-          "invoke|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
+          "invoke|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|-|-|-|-",
           "resolve-promotion|runner|-|read|-|jobOutput|-"
         ],
         "reusableEdges": [
@@ -288,7 +338,7 @@
         ]
       },
       {
-        "path": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
+        "path": ".github/workflows/self-release-tail-dogfood.yml",
         "triggers": ["workflow_dispatch"],
         "jobs": [
           "publish|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|-|-|-|-"
@@ -299,12 +349,12 @@
       }
     ],
     "metrics": {
-      "workflowCount": 37,
-      "jobCount": 92,
+      "workflowCount": 35,
+      "jobCount": 91,
       "reusableEdgeCount": 23,
-      "mutationRelevantNodeCount": 74,
+      "mutationRelevantNodeCount": 76,
       "contentsWriteJobCount": 14,
-      "oidcWriteJobCount": 16
+      "oidcWriteJobCount": 15
     },
     "semanticMetrics": {
       "workflowCount": 5,
@@ -312,5 +362,46 @@
       "contentsWriteJobCount": 1,
       "oidcWriteJobCount": 1
     }
+  },
+  "postPublicationScope": {
+    "workflowPaths": [
+      ".github/workflows/public-release-oci-compose-preview.yml"
+    ],
+    "authority": "exact-publication-plus-source-bound-qualification-and-expected-old-digest",
+    "observedTopology": {
+      "jobRecordFields": [
+        "id",
+        "kind",
+        "uses",
+        "contentsPermission",
+        "oidcPermission",
+        "carriers",
+        "mutationSignals"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/public-release-oci-compose-preview.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "promote|runner|-|write|-|artifactDownload,artifactUpload,jobOutput|contents-write"
+          ],
+          "reusableEdges": []
+        }
+      ],
+      "metrics": {
+        "workflowCount": 1,
+        "jobCount": 1,
+        "reusableEdgeCount": 0,
+        "mutationRelevantNodeCount": 1,
+        "contentsWriteJobCount": 1,
+        "oidcWriteJobCount": 0
+      },
+      "semanticMetrics": {
+        "workflowCount": 1,
+        "mutationRelevantNodeCount": 1,
+        "contentsWriteJobCount": 1,
+        "oidcWriteJobCount": 0
+      }
+    }
   }
 }

package/architecture/{v4-release-train-parity.json → release-train-parity.json}

@@ -55,8 +55,8 @@
     },
     {
       "surface": "architecture-projection",
-      "source": "architecture/v3-core-mechanism-inventory.json",
-      "target": "architecture/v4-release-train-parity.json",
+      "source": "architecture/baseline-core-mechanism-inventory.json",
+      "target": "architecture/release-train-parity.json",
       "semanticImpact": "evidence-only"
     }
   ],

package/architecture/{v4-runtime-ref-resume-authority.json → runtime-ref-resume-authority.json}

@@ -3,7 +3,7 @@
   "contract": "kungfu-buildchain-v4-runtime-ref-resume-authority/v1",
   "schemaAuthority": "contracts/v4-runtime-ref-resume-authority-v1.schema.json",
   "fixtureAuthority": "contracts/fixtures/v4-runtime-ref-resume-authority-v1/scenario.json",
-  "runtimeAuthority": "packages/core/v4-runtime-ref-resume-authority.js",
+  "runtimeAuthority": "packages/core/runtime-ref-resume-authority.js",
   "mode": "v4-only",
   "transientSelection": {
     "trustedEvent": "workflow_dispatch",

package/architecture/{v4-runtime-semantic-closure.json → runtime-semantic-closure.json}

@@ -2,8 +2,8 @@
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-v4-runtime-semantic-closure",
   "sources": {
-    "v3Mechanisms": "architecture/v3-core-mechanism-inventory.json",
-    "v4Capabilities": "architecture/v4-capability-state-machine-manifest.json"
+    "v3Mechanisms": "architecture/baseline-core-mechanism-inventory.json",
+    "domainCapabilities": "architecture/capability-state-machine-manifest.json"
   },
   "requiredEvidence": [
     "positive",

package/architecture/{v4-rust-libnode-bridge-evaluation.json → rust-libnode-bridge-evaluation.json}

@@ -66,9 +66,9 @@
       "portability": "uses std::process plus the repository Node runtime; darwin-arm64 is executed and Linux/Windows remain bounded validation targets",
       "replacementMechanism": "BUILDCHAIN_V4_HOST_COMMAND and BUILDCHAIN_V4_HOST_SCRIPT replace the host without changing the Rust domain contract",
       "evidence": [
-        "tests/v4-bridge.test.mjs",
-        "crates/buildchain-v4-bridge/src/main.rs",
-        "scripts/v4-host-adapter.mjs"
+        "tests/bridge.test.mjs",
+        "crates/buildchain-host-bridge/src/main.rs",
+        "scripts/host-adapter.mjs"
       ]
     }
   ],

package/architecture/{v4-rust-libnode-bridge-spike.md → rust-libnode-bridge-spike.md}

@@ -32,7 +32,7 @@ The host is replaceable through explicit executable and adapter coordinates;
 the Rust code does not import libnode, Node, V8, provider SDK, or private
 runtime types. The exact option matrix, retained fixtures, source revisions,
 and captured measurements are machine-readable in
-[`v4-rust-libnode-bridge-evaluation.json`](v4-rust-libnode-bridge-evaluation.json).
+[`rust-libnode-bridge-evaluation.json`](rust-libnode-bridge-evaluation.json).
 
 ## Contract
 
@@ -64,11 +64,11 @@ risks.
 ## Reproduce
 
 ```bash
-pnpm bridge:v4:build
-pnpm bridge:v4:run -- architecture.list -- --json
-pnpm run bridge:v4:evidence -- --iterations 7
-pnpm run check:v4-bridge
-node --test tests/v4-bridge.test.mjs
+pnpm bridge:build
+pnpm bridge:run -- architecture.list -- --json
+pnpm run bridge:evidence -- --iterations 7
+pnpm run check:bridge
+node --test tests/bridge.test.mjs
 ```
 
 Set `BUILDCHAIN_LIBNODE_ROOT` only when collecting optional local libnode

package/architecture/rust-wasm-production-authority.json

@@ -0,0 +1,58 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-rust-wasm-production-authority/v1",
+  "mode": "production",
+  "sourceAuthority": {
+    "crate": "crates/buildchain-domain-contracts",
+    "toolchain": "crates/buildchain-domain-contracts/rust-toolchain.toml",
+    "build": "scripts/build-domain-wasm.mjs",
+    "reproducibilityCheck": "pnpm run check:wasm"
+  },
+  "runtimeAuthority": {
+    "loader": "packages/core/domain-wasm.js",
+    "metadata": "packages/core/domain-wasm-artifact.js",
+    "artifact": "packages/core/buildchain-domain.wasm",
+    "abiVersion": 1,
+    "fallbackWriterCount": 0,
+    "failurePolicy": "fail-closed"
+  },
+  "rustOwnedSemantics": [
+    "source-verification-evidence-identity-and-reuse",
+    "canonical-json-and-content-roots",
+    "release-invocation-plan-transaction-and-receipt",
+    "product-publication-plan-and-version-intent",
+    "provider-operation-journal-and-readback-fold",
+    "release-activation-plan-and-fold",
+    "stable-publication-fence",
+    "partial-mutation-recovery-plan",
+    "release-tail-plan-transaction-retry-readback-and-receipt"
+  ],
+  "nodeOwnedEffects": [
+    "provider-sdk-calls",
+    "filesystem-io",
+    "credential-and-environment-access",
+    "workflow-input-and-output-transport",
+    "provider-error-classification"
+  ],
+  "distribution": {
+    "npmPackage": "packages/core/buildchain-domain.wasm",
+    "actionArtifacts": [
+      "actions/promote-buildchain-ref/dist/buildchain-domain.wasm",
+      "actions/release-tail/dist/buildchain-domain.wasm",
+      "actions/release-candidate-promote/dist/buildchain-domain.wasm"
+    ],
+    "artifactBinding": "sha256-metadata-before-instantiation",
+    "runtimeCompilation": false
+  },
+  "qualification": {
+    "platforms": ["linux-x64", "macos-arm64", "windows-x64"],
+    "productionRuntime": "node-24",
+    "checks": [
+      "tracked-artifact-reproducibility",
+      "abi-and-digest-binding",
+      "clean-process-loading-without-rust",
+      "missing-or-tampered-artifact-fails-closed",
+      "action-artifact-byte-identity"
+    ]
+  }
+}

package/architecture/{v4-stable-publication-fence.json → stable-publication-fence.json}

@@ -3,14 +3,14 @@
   "contract": "kungfu-buildchain-v4-stable-publication-fence-architecture",
   "schemaAuthority": "contracts/v4-stable-publication-fence-v1.schema.json",
   "fixtureAuthority": "contracts/fixtures/v4-stable-publication-fence-v1/shared.json",
-  "activationPredecessor": "architecture/v4-release-activation-shadow-domain.json",
+  "activationPredecessor": "architecture/release-activation-shadow-domain.json",
   "mode": "production",
   "authority": {
     "productionWriter": "v4-domain",
     "productionWriterCount": 1,
     "fenceAuthority": "rust-v4-core",
     "fenceWriterCount": 1,
-    "typescript": "byte-equivalent-provider-adapter",
+    "typescript": "wasm-calling-provider-adapter",
     "candidateSelfQualification": false,
     "productionWriteChange": true
   },
@@ -28,8 +28,11 @@
   },
   "publicationTargets": ["stable-ref", "npm-tag", "oci-tag", "github-release"],
   "implementations": {
-    "rustDomain": "crates/buildchain-v4-contracts/src/stable_publication_fence.rs",
-    "typescript": "packages/core/v4-stable-publication-fence.js"
+    "rustDomain": "crates/buildchain-domain-contracts/src/stable_publication_fence.rs",
+    "typescript": "packages/core/stable-publication-fence.js",
+    "wasmRuntime": "packages/core/domain-wasm.js",
+    "wasmArtifact": "packages/core/buildchain-domain.wasm",
+    "artifactMetadata": "packages/core/domain-wasm-artifact.js"
   },
   "roots": [
     "stable-publication-candidate",

package/architecture/{v4-stage-capsule-contract.json → stage-capsule-contract.json}

@@ -3,7 +3,7 @@
   "contract": "kungfu-buildchain-v4-stage-capsule-architecture",
   "schemaAuthority": "contracts/v4-stage-capsule-v1.schema.json",
   "fixtureAuthority": "contracts/fixtures/v4-stage-capsule-v1/shared.json",
-  "storeSuccessor": "architecture/v4-stage-capsule-store-contract.json",
+  "storeSuccessor": "architecture/stage-capsule-store-contract.json",
   "authority": {
     "writer": "typescript-v3",
     "writerCount": 1,

package/architecture/{v4-stage-capsule-qualification.json → stage-capsule-qualification.json}

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-v4-stage-capsule-qualification",
-  "capsuleAuthority": "architecture/v4-stage-capsule-contract.json",
-  "storeAuthority": "architecture/v4-stage-capsule-store-contract.json",
-  "checkpointAuthority": "architecture/v4-platform-stage-checkpoints.json",
-  "resumeAuthority": "architecture/v4-stage-capsule-resume-planner.json",
-  "implementation": "packages/core/v4-stage-capsule-qualification.js",
-  "rehearsal": "scripts/v4-stage-capsule-qualification.mjs",
+  "capsuleAuthority": "architecture/stage-capsule-contract.json",
+  "storeAuthority": "architecture/stage-capsule-store-contract.json",
+  "checkpointAuthority": "architecture/platform-stage-checkpoints.json",
+  "resumeAuthority": "architecture/stage-capsule-resume-planner.json",
+  "implementation": "packages/core/stage-capsule-qualification.js",
+  "rehearsal": "scripts/stage-capsule-qualification.mjs",
   "mode": "shadow-only",
   "productionAuthority": "v3",
   "campaign": {
@@ -24,8 +24,8 @@
     ]
   },
   "publicConsumerDogfood": {
-    "callerWorkflow": ".github/workflows/v4-public-consumer-dogfood.yml",
-    "reusableWorkflow": "kungfu-systems/buildchain/.github/workflows/v4-stage-capsule-canary.yml",
+    "callerWorkflow": ".github/workflows/self-build-public-consumer-dogfood.yml",
+    "reusableWorkflow": "kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml",
     "validationRef": "v4-alpha",
     "invocation": "workflow_call",
     "runtimeBinding": "job.workflow_sha",

package/architecture/{v4-stage-capsule-resume-planner.json → stage-capsule-resume-planner.json}

@@ -3,8 +3,8 @@
   "contract": "kungfu-buildchain-v4-stage-capsule-resume-planner",
   "schemaAuthority": "contracts/v4-stage-capsule-resume-v1.schema.json",
   "fixtureAuthority": "contracts/fixtures/v4-stage-capsule-resume-v1/late-platform-failure.json",
-  "capsuleAuthority": "architecture/v4-stage-capsule-contract.json",
-  "checkpointAuthority": "architecture/v4-platform-stage-checkpoints.json",
+  "capsuleAuthority": "architecture/stage-capsule-contract.json",
+  "checkpointAuthority": "architecture/platform-stage-checkpoints.json",
   "mode": "shadow-only",
   "productionAuthority": "v3",
   "planner": {

package/architecture/{v4-stage-capsule-store-contract.json → stage-capsule-store-contract.json}

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-v4-stage-capsule-store-architecture",
-  "identityAuthority": "architecture/v4-stage-capsule-contract.json",
+  "identityAuthority": "architecture/stage-capsule-contract.json",
   "schemaAuthority": "contracts/v4-stage-capsule-store-v1.schema.json",
   "fixtureAuthority": "contracts/fixtures/v4-stage-capsule-store-v1/shared.json",
   "implementations": {
-    "rust": "crates/buildchain-v4-contracts/src/stage_capsule_store.rs",
-    "typescriptContract": "packages/core/v4-stage-capsule-store.js",
-    "localReferenceStore": "packages/core/v4-stage-capsule-local-store.js"
+    "rust": "crates/buildchain-domain-contracts/src/stage_capsule_store.rs",
+    "typescriptContract": "packages/core/stage-capsule-store.js",
+    "localReferenceStore": "packages/core/stage-capsule-local-store.js"
   },
   "authority": {
     "writer": "typescript-v3",