@kungfu-tech/buildchain 4.0.2 → 4.0.3-alpha.0

package/scripts/{check-v4-public-dogfood-contract.mjs → check-public-dogfood-contract.mjs}

@@ -11,11 +11,11 @@ const DEFAULT_ROOT = path.resolve(
 );
 const CALLER_PATH = ".github/workflows/self-build-public-consumer-dogfood.yml";
 const REUSABLE_PATH = ".github/workflows/public-build-stage-capsule-canary.yml";
-export const V4_PUBLIC_DOGFOOD_ALPHA_REF = "v4-alpha";
+export const PUBLIC_DOGFOOD_ALPHA_REF = "v4-alpha";
 const PRIVATE_CONSUMER = ["buildchain", "self", "dogfood"].join("-");
 const PRIVATE_SHADOW = ["kungfu", "shadow"].join("-");
 
-export function expectedV4PublicDogfoodWorkflow(validationRef) {
+export function expectedPublicDogfoodWorkflow(validationRef) {
   return `name: V4 Public Consumer Dogfood
 
 on:
@@ -109,7 +109,7 @@ function assertWorkflowInventory(root) {
     }
     if (
       relative !== REUSABLE_PATH &&
-      text.includes("scripts/v4-stage-capsule-qualification.mjs")
+      text.includes("scripts/stage-capsule-qualification.mjs")
     )
       fail(`${relative} invokes the private qualification script directly`);
     if (
@@ -136,7 +136,7 @@ function assertProtectedVerify(root) {
   for (const forbidden of [
     "stage-capsule-qualification:",
     "stage-capsule-qualification-reconciliation:",
-    "scripts/v4-stage-capsule-qualification.mjs",
+    "scripts/stage-capsule-qualification.mjs",
   ])
     if (verify.includes(forbidden))
       fail(`Verify retains private dogfood path ${forbidden}`);
@@ -145,14 +145,14 @@ function assertProtectedVerify(root) {
 function assertArchitecture(root) {
   const architecture = exactJson(
     root,
-    "architecture/v4-stage-capsule-qualification.json",
+    "architecture/stage-capsule-qualification.json",
   );
   const dogfood = architecture.publicConsumerDogfood;
   const validationRef = dogfood?.validationRef;
-  if (validationRef !== V4_PUBLIC_DOGFOOD_ALPHA_REF)
+  if (validationRef !== PUBLIC_DOGFOOD_ALPHA_REF)
     fail("architecture validationRef must use the floating v4-alpha channel");
   const caller = read(root, CALLER_PATH);
-  if (caller !== expectedV4PublicDogfoodWorkflow(validationRef))
+  if (caller !== expectedPublicDogfoodWorkflow(validationRef))
     fail(`${CALLER_PATH} must remain the exact thin public consumer caller`);
   if (JSON.stringify(architecture.campaign?.consumers) !== '["buildchain"]')
     fail(
@@ -218,10 +218,10 @@ function assertConsumerLifecycle(root) {
 
 function assertPolicySources(root) {
   for (const relative of [
-    "packages/core/v4-stage-capsule-qualification.js",
-    "packages/core/v4-stage-capsule-qualification-campaign.js",
-    "scripts/v4-stage-capsule-qualification.mjs",
-    "architecture/v4-stage-capsule-qualification.json",
+    "packages/core/stage-capsule-qualification.js",
+    "packages/core/stage-capsule-qualification-campaign.js",
+    "scripts/stage-capsule-qualification.mjs",
+    "architecture/stage-capsule-qualification.json",
     "docs/v4-stage-capsule.md",
   ])
     assertNoPrivateMarkers(relative, read(root, relative));
@@ -231,7 +231,7 @@ function assertPolicySources(root) {
     "same public reusable-workflow contract as every other consumer",
     "No agent may add or restore a relative/self reusable-workflow call",
     "never solve recursion with an internal exception",
-    "scripts/check-v4-public-dogfood-contract.mjs",
+    "scripts/check-public-dogfood-contract.mjs",
     "source-persisted exact commit SHA",
     "v4-alpha",
   ])
@@ -241,13 +241,13 @@ function assertPolicySources(root) {
   const packageJson = exactJson(root, "package.json");
   if (
     !String(packageJson.scripts?.check || "").includes(
-      "node scripts/check-v4-public-dogfood-contract.mjs",
+      "node scripts/check-public-dogfood-contract.mjs",
     )
   )
     fail("pnpm run check does not include the public dogfood gate");
 }
 
-export function checkV4PublicDogfoodContract(root = DEFAULT_ROOT) {
+export function checkPublicDogfoodContract(root = DEFAULT_ROOT) {
   assertReusableWorkflow(root);
   assertWorkflowInventory(root);
   assertProtectedVerify(root);
@@ -270,7 +270,7 @@ if (
   path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
 ) {
   try {
-    process.stdout.write(`${JSON.stringify(checkV4PublicDogfoodContract())}\n`);
+    process.stdout.write(`${JSON.stringify(checkPublicDogfoodContract())}\n`);
   } catch (error) {
     process.stderr.write(`${error.message}\n`);
     process.exitCode = 1;

package/scripts/{check-v4-release-topology.mjs → check-release-topology.mjs}

@@ -14,7 +14,7 @@ import {
 } from "../packages/core/workflow-yaml-contract.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const ledgerPath = path.join(root, "architecture/v4-release-topology.json");
+const ledgerPath = path.join(root, "architecture/release-topology.json");
 
 function read(relative) {
   return fs.readFileSync(path.join(root, relative), "utf8");
@@ -22,10 +22,11 @@ function read(relative) {
 
 const LOCAL_MODULE_EXTENSIONS = ["", ".js", ".mjs", ".cjs"];
 const PRIVILEGED_ENTRYPOINTS = [
-  "actions/v4-release-candidate-promote/index.js",
+  "actions/release-candidate-promote/index.js",
   "scripts/binary-publication-evidence.mjs",
   "scripts/next-development-review.mjs",
-  "scripts/v4-publication-settlement.mjs",
+  "scripts/oci-compose-preview.mjs",
+  "scripts/publication-settlement.mjs",
 ];
 
 export function localModuleSpecifiers(source) {
@@ -137,12 +138,12 @@ function productionFiles(relative, extensions) {
 function matchingProductionFiles(roots, extensions, pattern) {
   return roots
     .flatMap((relative) => productionFiles(relative, extensions))
-    .filter((relative) => relative !== "scripts/check-v4-release-topology.mjs")
+    .filter((relative) => relative !== "scripts/check-release-topology.mjs")
     .filter((relative) => pattern.test(read(relative)))
     .sort();
 }
 
-export function discoverV4ReleaseAuthorityClosure() {
+export function discoverReleaseAuthorityClosure() {
   const providerPlane = matchingProductionFiles(
     ["actions", "packages/core"],
     [".js", ".mjs", ".cjs"],
@@ -151,19 +152,19 @@ export function discoverV4ReleaseAuthorityClosure() {
   const runtimeSelectors = matchingProductionFiles(
     [".github/workflows", "scripts", "packages/core"],
     [".yml", ".yaml", ".js", ".mjs", ".cjs"],
-    /(?:promotion-runtime-sha|resume-buildchain-runtime-sha|BUILDCHAIN_(?:CURRENT_RUNTIME_SHA|RUNTIME_REF|RESUME_CANDIDATE_RUN_ID)|authorizeV4RuntimeSelection|scanV4RuntimeSelectorPersistence|v4-release-candidate-adapter)/u,
+    /(?:promotion-runtime-sha|resume-buildchain-runtime-sha|BUILDCHAIN_(?:CURRENT_RUNTIME_SHA|RUNTIME_REF|RESUME_CANDIDATE_RUN_ID)|authorizeRuntimeSelection|scanRuntimeSelectorPersistence|release-candidate-adapter)/u,
   );
   const terminalProjections = matchingProductionFiles(
     [".github/workflows", "actions", "packages/core", "scripts"],
     [".yml", ".yaml", ".js", ".mjs", ".cjs"],
-    /(?:createV4ReleaseReceipt|release-receipt\.json|V4_RELEASE_RECEIPT_CONTRACT)/u,
+    /(?:createReleaseReceipt|release-receipt\.json|RELEASE_RECEIPT_CONTRACT)/u,
   );
   const privilegedModules = discoverStaticModuleClosure(PRIVILEGED_ENTRYPOINTS);
-  const rustWasmArtifact = "packages/core/buildchain-v4-domain.wasm";
+  const rustWasmArtifact = "packages/core/buildchain-domain.wasm";
   const rustWasmDistributions = [
-    "actions/promote-buildchain-ref/dist/buildchain-v4-domain.wasm",
-    "actions/release-tail/dist/buildchain-v4-domain.wasm",
-    "actions/v4-release-candidate-promote/dist/buildchain-v4-domain.wasm",
+    "actions/promote-buildchain-ref/dist/buildchain-domain.wasm",
+    "actions/release-tail/dist/buildchain-domain.wasm",
+    "actions/release-candidate-promote/dist/buildchain-domain.wasm",
   ];
   const legacyEngineModules = productionFiles(
     "actions/promote-buildchain-ref",
@@ -183,7 +184,7 @@ export function discoverV4ReleaseAuthorityClosure() {
       ]),
     ].sort(),
     runtimeSelectors,
-    runtimeEngines: ["actions/v4-release-candidate-promote/index.js"],
+    runtimeEngines: ["actions/release-candidate-promote/index.js"],
     terminalProjections,
     privilegedExecutableClosure: {
       entrypoints: PRIVILEGED_ENTRYPOINTS,
@@ -191,8 +192,8 @@ export function discoverV4ReleaseAuthorityClosure() {
       root: rootedPathSet(privilegedModules),
     },
     rustWasmAuthority: {
-      loader: "packages/core/v4-domain-wasm.js",
-      metadata: "packages/core/v4-domain-wasm-artifact.js",
+      loader: "packages/core/domain-wasm.js",
+      metadata: "packages/core/domain-wasm-artifact.js",
       artifact: rustWasmArtifact,
       artifactRoot: fileSha256(rustWasmArtifact),
       distributedArtifacts: rustWasmDistributions,
@@ -233,13 +234,21 @@ function workflowSnapshot(relative) {
     .map((job) => {
       const block = jobBlock(source, job.id);
       const uses = job.uses || null;
+      // A built-in publisher still requires mutation authority when the caller supplies its envelope.
+      const inheritedPublisher =
+        !/^    permissions:/mu.test(block) &&
+        /uses:.*actions\/release-candidate-promote/u.test(block);
       return {
         id: job.id,
         kind: uses ? "reusable-call" : "runner",
         uses,
         permissions: {
-          contents: permission(block, "contents"),
-          idToken: permission(block, "id-token"),
+          contents:
+            permission(block, "contents") ||
+            (inheritedPublisher ? "inherited" : null),
+          idToken:
+            permission(block, "id-token") ||
+            (inheritedPublisher ? "inherited" : null),
         },
         carriers: {
           artifactDownload: /uses:\s+actions\/download-artifact@/u.test(block),
@@ -247,9 +256,11 @@ function workflowSnapshot(relative) {
           jobOutput: /GITHUB_OUTPUT/u.test(block),
         },
         mutationSignals: [
-          /contents:\s*write/u.test(block) && "contents-write",
-          /id-token:\s*write/u.test(block) && "oidc-write",
-          /(?:promote-buildchain-ref|v4-release-candidate-promote)/u.test(
+          (/contents:\s*write/u.test(block) || inheritedPublisher) &&
+            "contents-write",
+          (/id-token:\s*write/u.test(block) || inheritedPublisher) &&
+            "oidc-write",
+          /(?:promote-buildchain-ref|actions\/release-candidate-promote)/u.test(
             block,
           ) && "promotion-runtime",
           /(?:git push|npm publish|gh release (?:create|upload))/u.test(
@@ -270,7 +281,7 @@ function workflowSnapshot(relative) {
   };
 }
 
-export function discoverV4ReleaseTopology(
+export function discoverReleaseTopology(
   workflowPaths,
   semanticWorkflowPaths = workflowPaths,
 ) {
@@ -355,7 +366,7 @@ export function discoverV4ReleaseTopology(
   };
 }
 
-export function findUnknownV4ReleaseTopology(
+export function findUnknownReleaseTopology(
   workflowPaths,
   allWorkflowPaths = fs
     .readdirSync(path.join(root, ".github/workflows"))
@@ -374,7 +385,7 @@ export function findUnknownV4ReleaseTopology(
     .filter((relative) => {
       const source = readWorkflow(relative);
       const usesReleaseAuthority = parseYamlUses(source).some(({ value }) =>
-        /(?:release-candidate-promote|promote-buildchain-ref|v4-release-candidate-promote|release-tail)/u.test(
+        /(?:release-candidate-promote|promote-buildchain-ref|release-tail)/u.test(
           value,
         ),
       );
@@ -395,7 +406,7 @@ export function findUnknownV4ReleaseTopology(
 }
 
 function assertClosedWorld(workflowPaths) {
-  const unknown = findUnknownV4ReleaseTopology(workflowPaths);
+  const unknown = findUnknownReleaseTopology(workflowPaths);
   assert.deepEqual(
     unknown,
     [],
@@ -426,7 +437,7 @@ function assertAuthorityClosure(ledger) {
         `authority closure path is not a file: ${relative}`,
       );
   }
-  const discovered = discoverV4ReleaseAuthorityClosure();
+  const discovered = discoverReleaseAuthorityClosure();
   for (const className of Object.keys(discovered))
     assert.deepEqual(
       closure[className],
@@ -452,7 +463,7 @@ function assertAuthorityClosure(ledger) {
     `legacy release engines remain reachable from APPLY: ${reachableLegacyEngines.join(", ")}`,
   );
   assert.deepEqual(closure.runtimeEngines, [
-    "actions/v4-release-candidate-promote/index.js",
+    "actions/release-candidate-promote/index.js",
   ]);
   assert.equal(
     closure.freshEntry,
@@ -479,7 +490,7 @@ function assertAuthorityClosure(ledger) {
   );
   assert.match(
     canonicalWorkflow,
-    /scripts\/v4-release-candidate-adapter\.mjs/u,
+    /scripts\/release-candidate-adapter\.mjs/u,
   );
   assert.match(
     canonicalWorkflow,
@@ -487,12 +498,23 @@ function assertAuthorityClosure(ledger) {
   );
 }
 
-export function checkV4ReleaseTopology() {
+export function checkReleaseTopology() {
   const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
   assert.equal(ledger.contract, "kungfu-buildchain-v4-release-topology/v1");
   assertClosedWorld(ledger.closedWorld.workflowPaths);
   assertAuthorityClosure(ledger);
-  const actual = discoverV4ReleaseTopology(
+  const preview = ledger.postPublicationScope;
+  assert.deepEqual(preview.workflowPaths, [
+    ".github/workflows/public-release-oci-compose-preview.yml",
+  ]);
+  const previewTopology = discoverReleaseTopology(
+    preview.workflowPaths,
+    preview.workflowPaths,
+  );
+  assert.equal(previewTopology.semanticMetrics.contentsWriteJobCount, 1);
+  assert.equal(previewTopology.semanticMetrics.oidcWriteJobCount, 0);
+  assert.deepEqual(preview.observedTopology, previewTopology);
+  const actual = discoverReleaseTopology(
     ledger.closedWorld.workflowPaths,
     ledger.semanticScope.workflowPaths,
   );
@@ -526,13 +548,13 @@ if (
 ) {
   if (process.argv.includes("--print-closure")) {
     process.stdout.write(
-      `${JSON.stringify(discoverV4ReleaseAuthorityClosure(), null, 2)}\n`,
+      `${JSON.stringify(discoverReleaseAuthorityClosure(), null, 2)}\n`,
     );
   } else if (process.argv.includes("--print")) {
     const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
     process.stdout.write(
       `${JSON.stringify(
-        discoverV4ReleaseTopology(
+        discoverReleaseTopology(
           ledger.closedWorld.workflowPaths,
           ledger.semanticScope.workflowPaths,
         ),
@@ -541,7 +563,7 @@ if (
       )}\n`,
     );
   } else {
-    checkV4ReleaseTopology();
+    checkReleaseTopology();
     process.stdout.write("v4 release topology: ok\n");
   }
 }

package/scripts/{check-v4-runtime-semantic-closure.mjs → check-runtime-semantic-closure.mjs}

@@ -4,10 +4,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-export const V4_RUNTIME_SEMANTIC_CLOSURE_CONTRACT =
+export const RUNTIME_SEMANTIC_CLOSURE_CONTRACT =
   "kungfu-buildchain-v4-runtime-semantic-closure";
-export const V4_RUNTIME_SEMANTIC_CLOSURE_PATH =
-  "architecture/v4-runtime-semantic-closure.json";
+export const RUNTIME_SEMANTIC_CLOSURE_PATH =
+  "architecture/runtime-semantic-closure.json";
 export const REQUIRED_RUNTIME_EVIDENCE = Object.freeze([
   "positive",
   "negative",
@@ -159,17 +159,20 @@ function validateAuthority(capability, stateMachine, issues) {
 
 export function validateRuntimeSemanticClosure({
   root = process.cwd(),
-  manifest = loadJson(root, V4_RUNTIME_SEMANTIC_CLOSURE_PATH),
-  v3Inventory = loadJson(root, "architecture/v3-core-mechanism-inventory.json"),
-  v4Manifest = loadJson(
+  manifest = loadJson(root, RUNTIME_SEMANTIC_CLOSURE_PATH),
+  v3Inventory: baselineInventory = loadJson(
     root,
-    "architecture/v4-capability-state-machine-manifest.json",
+    "architecture/baseline-core-mechanism-inventory.json",
+  ),
+  v4Manifest: domainManifest = loadJson(
+    root,
+    "architecture/capability-state-machine-manifest.json",
   ),
 } = {}) {
   const issues = [];
   if (
     manifest?.schemaVersion !== 1 ||
-    manifest?.contract !== V4_RUNTIME_SEMANTIC_CLOSURE_CONTRACT
+    manifest?.contract !== RUNTIME_SEMANTIC_CLOSURE_CONTRACT
   )
     issues.push(
       "runtime semantic closure contract or schemaVersion is invalid",
@@ -178,13 +181,13 @@ export function validateRuntimeSemanticClosure({
     issues.push("runtime semantic closure evidence dimensions drifted");
 
   const mechanisms = new Map(
-    (v3Inventory.mechanisms || []).map((entry) => [entry.id, entry]),
+    (baselineInventory.mechanisms || []).map((entry) => [entry.id, entry]),
   );
-  const v4Capabilities = new Map(
-    (v4Manifest.capabilities || []).map((entry) => [entry.id, entry]),
+  const domainCapabilities = new Map(
+    (domainManifest.capabilities || []).map((entry) => [entry.id, entry]),
   );
   const stateMachines = new Map(
-    (v4Manifest.stateMachines || []).map((entry) => [entry.id, entry]),
+    (domainManifest.stateMachines || []).map((entry) => [entry.id, entry]),
   );
   const capabilities = Array.isArray(manifest?.capabilities)
     ? manifest.capabilities
@@ -201,7 +204,7 @@ export function validateRuntimeSemanticClosure({
   if (
     !sameMembers(
       capabilities.map((entry) => entry.id),
-      v4Capabilities.keys(),
+      domainCapabilities.keys(),
     )
   )
     issues.push(
@@ -219,15 +222,15 @@ export function validateRuntimeSemanticClosure({
     }
     ids.add(capability.id);
     const mechanism = mechanisms.get(capability.id);
-    const v4Capability = v4Capabilities.get(capability.id);
-    if (!mechanism || !v4Capability) continue;
+    const domainCapability = domainCapabilities.get(capability.id);
+    if (!mechanism || !domainCapability) continue;
     if (capability.sourceMechanismId !== capability.id)
       issues.push(`${capability.id}: source mechanism identity drifted`);
     validateImplementation(root, mechanism, capability, issues);
     validateResidualClosure(mechanism, capability, issues);
     validateEvidence(root, mechanism, capability, issues);
     validateAuthority(capability, stateMachines.get(capability.id), issues);
-    for (const surface of v4Capability.surfaces || []) {
+    for (const surface of domainCapability.surfaces || []) {
       if (!surfaces.has(surface))
         issues.push(
           `${capability.id}: executable v4 surface is absent: ${surface}`,

package/scripts/{check-v4-universal-workflow-bootstrap.mjs → check-universal-workflow-bootstrap.mjs}

@@ -8,16 +8,16 @@ import { fileURLToPath } from "node:url";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const contract = JSON.parse(
-  fs.readFileSync(
-    path.join(root, "architecture/v4-universal-workflow-bootstrap.json"),
-    "utf8",
-  ),
+  fs.readFileSync(path.join(root, "architecture/universal-workflow-bootstrap.json"), "utf8"),
 );
 const admissionPolicy = JSON.parse(
-  fs.readFileSync(
-    path.join(root, "architecture/v4-universal-workflow-train-admission.json"),
-    "utf8",
-  ),
+  fs.readFileSync(path.join(root, "architecture/universal-workflow-train-admission.json"), "utf8"),
+);
+const admissionObservedAt = Date.now();
+assert.ok(
+  admissionObservedAt >= Date.parse(admissionPolicy.validFrom) &&
+    admissionObservedAt < Date.parse(admissionPolicy.expiresAt),
+  `release admission policy is outside its validity window (${admissionPolicy.validFrom} to ${admissionPolicy.expiresAt}); renew it through protected review before publishing`,
 );
 const fileRoot = (relative) =>
   `sha256:${crypto
@@ -131,12 +131,12 @@ assert.ok(!admissionPolicy.allowedCapabilities.includes("workflow-contract"));
 assert.deepEqual(
   admissionPolicy.contractRoots,
   [
-    fileRoot("architecture/v4-universal-workflow-bootstrap.json"),
+    fileRoot("architecture/universal-workflow-bootstrap.json"),
     fileRoot(contract.bootstrap.faultCampaign),
-    fileRoot("packages/core/v4-universal-workflow-bootstrap.js"),
-    fileRoot("scripts/v4-universal-workflow-backflow.mjs"),
-    fileRoot("scripts/v4-universal-workflow-engine.mjs"),
-    fileRoot("scripts/v4-universal-workflow-self-dogfood.mjs"),
+    fileRoot("packages/core/universal-workflow-bootstrap.js"),
+    fileRoot("scripts/universal-workflow-backflow.mjs"),
+    fileRoot("scripts/universal-workflow-engine.mjs"),
+    fileRoot("scripts/universal-workflow-self-dogfood.mjs"),
     fileRoot(contract.bootstrap.publicWorkflow),
   ].sort(),
 );
@@ -171,7 +171,7 @@ assert.match(
 assert.match(bootstrapSource, /settle:[\s\S]*needs: \[admit, execute\]/u);
 assert.match(
   bootstrapSource,
-  /ascii_downcase\) == "kungfu-origin"[\s\S]*\.name == "check"[\s\S]*map\(select\(\.status == "completed" and \(\.conclusion \/\/ ""\) != ""\)\)[\s\S]*candidate\/architecture\/v4-universal-workflow-train-admission\.json/u,
+  /ascii_downcase\) == "kungfu-origin"[\s\S]*\.name == "check"[\s\S]*map\(select\(\.status == "completed" and \(\.conclusion \/\/ ""\) != ""\)\)[\s\S]*candidate\/architecture\/universal-workflow-train-admission\.json/u,
 );
 assert.match(
   bootstrapSource,

package/scripts/{v4-consumer-policy.mjs → consumer-policy.mjs}

@@ -3,11 +3,11 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import {
-  certifyV4FloatingConsumerPolicyReceipt,
-  resolveV4FloatingConsumerPolicyAuthority,
-  scanV4FloatingConsumerPolicy,
-  v4ConsumerPolicyScannerRoot,
-} from "../packages/core/v4-floating-consumer-policy.js";
+  certifyFloatingConsumerPolicyReceipt,
+  resolveFloatingConsumerPolicyAuthority,
+  scanFloatingConsumerPolicy,
+  consumerPolicyScannerRoot,
+} from "../packages/core/floating-consumer-policy.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 const RUNTIME_ROOT = path.resolve(import.meta.dirname, "..");
 function parseArgs(argv) {
@@ -36,7 +36,7 @@ function writeJson(file, value) {
   fs.mkdirSync(path.dirname(file), { recursive: true });
   fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
 }
-export { v4ConsumerPolicyScannerRoot };
+export { consumerPolicyScannerRoot };
 export function scanCommand(options = {}) {
   const root = path.resolve(
     options.root || env("BUILDCHAIN_CONSUMER_ROOT", process.cwd()),
@@ -49,13 +49,13 @@ export function scanCommand(options = {}) {
     options.output ||
       env(
         "BUILDCHAIN_V4_POLICY_RECEIPT_PATH",
-        ".buildchain/evidence/v4-consumer-policy-receipt.json",
+        ".buildchain/evidence/consumer-policy-receipt.json",
       ),
   );
   const policy = readJson(
-    path.join(RUNTIME_ROOT, "architecture/v4-floating-consumer-policy.json"),
+    path.join(RUNTIME_ROOT, "architecture/floating-consumer-policy.json"),
   );
-  const result = scanV4FloatingConsumerPolicy({
+  const result = scanFloatingConsumerPolicy({
     root,
     invocationRoot,
     repository: options.repository || env("GITHUB_REPOSITORY"),
@@ -86,7 +86,7 @@ export function scanCommand(options = {}) {
         ".buildchain/alpha-contract-lock.json",
       ),
     policy,
-    scannerRoot: v4ConsumerPolicyScannerRoot(),
+    scannerRoot: consumerPolicyScannerRoot(),
   });
   writeJson(output, result);
   writeGitHubOutputs({
@@ -137,13 +137,13 @@ export function certifyCommand(options = {}) {
     receipt?.invocation?.workflow;
   const resolvedRuntimeSha =
     options.resolvedRuntimeSha || env("BUILDCHAIN_EXPECTED_RUNTIME_SHA");
-  const authority = resolveV4FloatingConsumerPolicyAuthority({
+  const authority = resolveFloatingConsumerPolicyAuthority({
     runtimeRoot: RUNTIME_ROOT,
     callerRoot,
     stableLockPath,
     alphaLockPath,
   });
-  const authorityScan = scanV4FloatingConsumerPolicy({
+  const authorityScan = scanFloatingConsumerPolicy({
     root: callerRoot,
     repository,
     sourceSha,
@@ -163,7 +163,7 @@ export function certifyCommand(options = {}) {
     scannerRoot: authority.scannerRoot,
     contractLocks: authority.contractLocks,
   };
-  const result = certifyV4FloatingConsumerPolicyReceipt({
+  const result = certifyFloatingConsumerPolicyReceipt({
     receipt,
     receiptRoot,
     expectedReceiptRoot: authorityScan.receiptRoot,
@@ -183,7 +183,7 @@ export function certifyCommand(options = {}) {
     options.output ||
       env(
         "BUILDCHAIN_V4_POLICY_CERTIFICATION_PATH",
-        ".buildchain/evidence/v4-consumer-policy-certification.json",
+        ".buildchain/evidence/consumer-policy-certification.json",
       ),
   );
   const documentWithAuthority = {
@@ -211,7 +211,7 @@ function main(argv = process.argv.slice(2)) {
         ? certifyCommand(options)
         : (() => {
             throw new Error(
-              "usage: v4-consumer-policy.mjs <scan|certify> [--option value]",
+              "usage: consumer-policy.mjs <scan|certify> [--option value]",
             );
           })();
   process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);

package/scripts/{copy-v4-domain-wasm.mjs → copy-domain-wasm.mjs}

@@ -5,10 +5,10 @@ import { fileURLToPath } from "node:url";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const destination = path.resolve(process.argv[2] || "");
 if (!process.argv[2] || path.basename(destination) !== "dist") {
-  throw new Error("usage: copy-v4-domain-wasm.mjs ACTION_DIST_DIRECTORY");
+  throw new Error("usage: copy-domain-wasm.mjs ACTION_DIST_DIRECTORY");
 }
 fs.mkdirSync(destination, { recursive: true });
 fs.copyFileSync(
-  path.join(root, "packages", "core", "buildchain-v4-domain.wasm"),
-  path.join(destination, "buildchain-v4-domain.wasm"),
+  path.join(root, "packages", "core", "buildchain-domain.wasm"),
+  path.join(destination, "buildchain-domain.wasm"),
 );

package/scripts/{v4-cross-platform-adopter-qualification.mjs → cross-platform-adopter-qualification.mjs}

@@ -5,10 +5,10 @@ import fs from "node:fs";
 import path from "node:path";
 
 import {
-  createV4CrossPlatformAdopterReport,
-  qualifyV4CrossPlatformAdopters,
-  summarizeV3V4CapabilityInventory,
-} from "../packages/core/v4-cross-platform-adopter-qualification.js";
+  createCrossPlatformAdopterReport,
+  qualifyCrossPlatformAdopters,
+  summarizeBaselineCapabilityInventory,
+} from "../packages/core/cross-platform-adopter-qualification.js";
 
 function flag(name, fallback = "") {
   const index = process.argv.indexOf(`--${name}`);
@@ -74,9 +74,9 @@ function runPlatform() {
     });
 
   const inventory = readJson(
-    path.join(runtimeRoot, "architecture/v3-v4-live-capability-inventory.json"),
+    path.join(runtimeRoot, "architecture/capability-parity-live-capability-inventory.json"),
   );
-  const inventoryEvidence = summarizeV3V4CapabilityInventory(inventory);
+  const inventoryEvidence = summarizeBaselineCapabilityInventory(inventory);
   fs.mkdirSync(workRoot, { recursive: true });
   const initialPath = path.join(workRoot, "initial-readback.json");
   const retryPath = path.join(workRoot, "retry-readback.json");
@@ -135,7 +135,7 @@ function runPlatform() {
   );
   expectPass(neutralDriver, "independent protocol-neutral driver");
 
-  const report = createV4CrossPlatformAdopterReport({
+  const report = createCrossPlatformAdopterReport({
     platform: required("platform"),
     consumer: required("consumer"),
     sourceBinding: {
@@ -210,7 +210,7 @@ function collectReports(root) {
 
 function aggregate() {
   const reportsRoot = path.resolve(required("reports-root"));
-  const qualification = qualifyV4CrossPlatformAdopters({
+  const qualification = qualifyCrossPlatformAdopters({
     reports: collectReports(reportsRoot),
     consumers: repeated("consumer"),
   });
@@ -224,5 +224,5 @@ if (mode === "run") runPlatform();
 else if (mode === "aggregate") aggregate();
 else
   throw new Error(
-    "usage: v4-cross-platform-adopter-qualification.mjs <run|aggregate> ...",
+    "usage: cross-platform-adopter-qualification.mjs <run|aggregate> ...",
   );

package/scripts/{v4-declarative-promotion-admission.mjs → declarative-promotion-admission.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { pathToFileURL } from "node:url";
 
-import { assertV4DeclarativePromotionInputs } from "../packages/core/v4-publication-qualification.js";
+import { assertDeclarativePromotionInputs } from "../packages/core/publication-qualification.js";
 
-export function admitV4DeclarativePromotion({
+export function admitDeclarativePromotion({
   inputs,
   runtimeRef,
   declarative,
@@ -21,7 +21,7 @@ export function admitV4DeclarativePromotion({
     error.code = "v4-declarative-release-tail-required";
     throw error;
   }
-  assertV4DeclarativePromotionInputs(inputs);
+  assertDeclarativePromotionInputs(inputs);
   return Object.freeze({ mode: "v4-declarative", admitted: true });
 }
 
@@ -30,7 +30,7 @@ if (
   import.meta.url === pathToFileURL(process.argv[1]).href
 ) {
   try {
-    const result = admitV4DeclarativePromotion({
+    const result = admitDeclarativePromotion({
       inputs: JSON.parse(process.env.BUILDCHAIN_PROMOTION_INPUTS_JSON || "{}"),
       runtimeRef: process.env.BUILDCHAIN_RUNTIME_REF,
       declarative: process.env.BUILDCHAIN_DECLARATIVE_RELEASE_TAIL === "true",