@kungfu-tech/buildchain 4.0.2 → 4.0.3-alpha.0

package/scripts/dev-delivery-warrant-options.mjs

@@ -278,7 +278,7 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
       rest,
       "read-evidence-output",
       environment.BUILDCHAIN_V4_WARRANT_READ_EVIDENCE ||
-        ".buildchain/dev-delivery/v4-read-evidence.json",
+        ".buildchain/dev-delivery/read-evidence.json",
     ),
     now: flag(rest, "now", environment.BUILDCHAIN_DEV_DELIVERY_NOW),
     outputPath: flag(

package/scripts/dev-delivery-warrant-store.mjs

@@ -54,7 +54,10 @@ function decodeGitHubBlobEnvelope(raw) {
   ).toString("utf8");
 }
 
-function validateStoredState(queue, { allowLegacyV3Readback = false } = {}) {
+function validateStoredState(
+  queue,
+  { allowLegacyBaselineReadback = false } = {},
+) {
   const body = structuredClone(queue || {});
   const embeddedStateRoot = body.stateRoot;
   delete body.stateRoot;
@@ -67,7 +70,7 @@ function validateStoredState(queue, { allowLegacyV3Readback = false } = {}) {
   ) {
     normalizeDevDeliveryAuthorityState(queue);
   } else {
-    normalizeDevDeliveryQueue(queue, { allowLegacyV3Readback });
+    normalizeDevDeliveryQueue(queue, { allowLegacyBaselineReadback });
   }
   return queue;
 }
@@ -157,9 +160,19 @@ export class GitHubDevDeliveryStore {
     return raw;
   }
 
-  async read({ stateRef, protectedBase, now, allowLegacyV3Readback = false }) {
+  async read({
+    stateRef,
+    protectedBase,
+    now,
+    allowLegacyBaselineReadback = false,
+  }) {
     return this.retryParseableRead(async () =>
-      this.readOnce({ stateRef, protectedBase, now, allowLegacyV3Readback }),
+      this.readOnce({
+        stateRef,
+        protectedBase,
+        now,
+        allowLegacyBaselineReadback,
+      }),
     );
   }
 
@@ -167,7 +180,7 @@ export class GitHubDevDeliveryStore {
     stateRef,
     protectedBase,
     now,
-    allowLegacyV3Readback = false,
+    allowLegacyBaselineReadback = false,
   }) {
     let ref;
     try {
@@ -189,18 +202,24 @@ export class GitHubDevDeliveryStore {
     }
     const commitSha = exactSha(ref?.object?.sha, "state ref commit");
     const readback = await this.readCommit(commitSha, {
-      allowLegacyV3Readback,
+      allowLegacyBaselineReadback,
     });
     return { exists: true, ...readback };
   }
 
-  async readCommit(commitShaInput, { allowLegacyV3Readback = false } = {}) {
+  async readCommit(
+    commitShaInput,
+    { allowLegacyBaselineReadback = false } = {},
+  ) {
     return this.retryParseableRead(async () =>
-      this.readCommitOnce(commitShaInput, { allowLegacyV3Readback }),
+      this.readCommitOnce(commitShaInput, { allowLegacyBaselineReadback }),
     );
   }
 
-  async readCommitOnce(commitShaInput, { allowLegacyV3Readback = false } = {}) {
+  async readCommitOnce(
+    commitShaInput,
+    { allowLegacyBaselineReadback = false } = {},
+  ) {
     const commitSha = exactSha(commitShaInput, "state commit");
     const commit = await this.request(
       "GET",
@@ -221,7 +240,7 @@ export class GitHubDevDeliveryStore {
     );
     const bytes = decodeGitHubBlobEnvelope(raw);
     const queue = validateStoredState(JSON.parse(bytes), {
-      allowLegacyV3Readback,
+      allowLegacyBaselineReadback,
     });
     return { commitSha, queue, bytes };
   }

package/scripts/dev-delivery-warrant.mjs

@@ -17,7 +17,7 @@ import {
 } from "../packages/core/dev-delivery-warrant.js";
 import { recoverLegacyTerminalDevDeliveryQueue } from "../packages/core/dev-delivery-warrant-legacy-recovery.js";
 import { reuseExactActiveDevDeliverySourceProof } from "../packages/core/dev-delivery-candidate-identity.js";
-import { runV4DeliveryWarrantReadCandidate } from "../packages/core/v4-delivery-warrant-read-candidate.js";
+import { runDeliveryWarrantReadCandidate } from "../packages/core/delivery-warrant-read-candidate.js";
 
 import { GitHubDevDeliveryStore } from "./dev-delivery-warrant-store.mjs";
 import { persistDevDeliveryTransition } from "./dev-delivery-warrant-transition.mjs";
@@ -363,7 +363,7 @@ async function observeQueue(loaded, options) {
     throw new Error("readMode must be v3 or v4");
   let observation = observeDevDeliveryQueue(loaded.queue, {
     now: options.now,
-    allowLegacyV3Readback: true,
+    allowLegacyBaselineReadback: true,
   });
   let readCandidate;
   if (readMode === "v4") {
@@ -384,7 +384,7 @@ async function observeQueue(loaded, options) {
         );
         return { receiptRoot: evidence.evidenceRoot };
       });
-    readCandidate = await runV4DeliveryWarrantReadCandidate(loaded.queue, {
+    readCandidate = await runDeliveryWarrantReadCandidate(loaded.queue, {
       qualification,
       expectedQualificationRoot: options.readQualificationRoot,
       expectedSources: {
@@ -444,7 +444,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     stateRef: options.stateRef,
     protectedBase: options.branch,
     now: options.now,
-    allowLegacyV3Readback: ["observe", "recover-legacy-terminal"].includes(
+    allowLegacyBaselineReadback: ["observe", "recover-legacy-terminal"].includes(
       options.command,
     ),
   });

package/scripts/dev-pr-delivery-warrant.mjs

@@ -143,7 +143,7 @@ export async function readCurrentDeliveryQueueState(client, repository, targetBr
   const { queue } = await store.read({
     stateRef: defaultDevDeliveryStateRef(targetBranch),
     protectedBase: targetBranch,
-    allowLegacyV3Readback: true,
+    allowLegacyBaselineReadback: true,
   });
   return queue;
 }

package/scripts/generate-channel-build-workflow.mjs

@@ -4,7 +4,7 @@ import fs from "node:fs";
 import { writeWorkflowSource } from "./workflow-taxonomy.mjs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { migrateV4UniversalWorkflowFacade } from "./generate-v4-universal-workflow-facades.mjs";
+import { migrateUniversalWorkflowFacade } from "./generate-universal-workflow-facades.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const sourcePath = path.join(root, ".github/workflows/.build.yml");
@@ -405,7 +405,7 @@ export function generateChannelBuildWorkflow(source) {
       ].join("\n"),
     )
     .replace("\n  alpha:\n", `\n${routerControllerPlanJob()}\n\n  alpha:\n`);
-  return migrateV4UniversalWorkflowFacade(
+  return migrateUniversalWorkflowFacade(
     `${generated.trimEnd()}\n\n${routerControllerReceiptJob()}\n\n${routerAggregateJob()}\n`,
     ".github/workflows/build.yml",
   );

package/scripts/generate-channel-promotion-workflow.mjs

@@ -4,7 +4,7 @@ import fs from "node:fs";
 import { writeWorkflowSource } from "./workflow-taxonomy.mjs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { migrateV4UniversalWorkflowFacade } from "./generate-v4-universal-workflow-facades.mjs";
+import { migrateUniversalWorkflowFacade } from "./generate-universal-workflow-facades.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const sourcePath = path.join(root, ".github/workflows/.release-candidate-promote.yml");
@@ -210,7 +210,7 @@ function consumerAdmissionJob() {
         with:
           repository: \${{ inputs.buildchain-repository }}
           ref: \${{ needs.resolve-promotion.outputs.router-sha }}
-          path: .buildchain/v4-policy-runtime
+          path: .buildchain/policy-runtime
           persist-credentials: false
       - name: Enforce v4 floating consumer policy
         id: policy
@@ -223,16 +223,16 @@ function consumerAdmissionJob() {
           BUILDCHAIN_RUNTIME_SHA: \${{ needs.resolve-promotion.outputs.router-sha }}
           BUILDCHAIN_STABLE_CONTRACT_LOCK_PATH: \${{ inputs.buildchain-stable-contract-lock-path }}
           BUILDCHAIN_ALPHA_CONTRACT_LOCK_PATH: \${{ inputs.buildchain-alpha-contract-lock-path }}
-          BUILDCHAIN_V4_POLICY_RECEIPT_PATH: .buildchain/evidence/v4-consumer-policy-receipt.json
+          BUILDCHAIN_V4_POLICY_RECEIPT_PATH: .buildchain/evidence/consumer-policy-receipt.json
         run: >-
-          node .buildchain/v4-policy-runtime/scripts/v4-consumer-policy.mjs scan
+          node .buildchain/policy-runtime/scripts/consumer-policy.mjs scan
           --source-sha "\${{ inputs.target-sha || github.sha }}"
 
       - name: Upload rooted consumer admission receipt
         uses: actions/upload-artifact@v7.0.1
         with:
           name: v4-consumer-policy-release-candidate-promote-\${{ github.sha }}
-          path: .buildchain/consumer/.buildchain/evidence/v4-consumer-policy-receipt.json
+          path: .buildchain/consumer/.buildchain/evidence/consumer-policy-receipt.json
           if-no-files-found: error
 
       - name: Authorize transient v4 runtime selection
@@ -240,18 +240,18 @@ function consumerAdmissionJob() {
         if: \${{ needs.resolve-promotion.outputs.override-used == 'true' }}
         uses: actions/github-script@v8
         env:
-          BUILDCHAIN_RUNTIME_AUTHORIZATION_PATH: .buildchain/consumer/.buildchain/evidence/v4-runtime-authorization.json
+          BUILDCHAIN_RUNTIME_AUTHORIZATION_PATH: .buildchain/consumer/.buildchain/evidence/runtime-authorization.json
         with:
           script: |
-            const script = require(process.env.GITHUB_WORKSPACE + "/.buildchain/v4-policy-runtime/scripts/authorize-promotion-runtime-override.cjs");
+            const script = require(process.env.GITHUB_WORKSPACE + "/.buildchain/policy-runtime/scripts/authorize-promotion-runtime-override.cjs");
             const result = await script.authorizePromotionRuntimeOverride({
               github,
               context,
               request: {
                 consumerRoot: process.env.GITHUB_WORKSPACE + "/.buildchain/consumer",
-                runtimeModulePath: process.env.GITHUB_WORKSPACE + "/.buildchain/v4-policy-runtime/packages/core/v4-runtime-ref-resume-authority.js",
+                runtimeModulePath: process.env.GITHUB_WORKSPACE + "/.buildchain/policy-runtime/packages/core/runtime-ref-resume-authority.js",
                 runtimeRepository: "\${{ inputs.buildchain-repository }}",
-                consumerPolicyReceiptPath: process.env.GITHUB_WORKSPACE + "/.buildchain/consumer/.buildchain/evidence/v4-consumer-policy-receipt.json",
+                consumerPolicyReceiptPath: process.env.GITHUB_WORKSPACE + "/.buildchain/consumer/.buildchain/evidence/consumer-policy-receipt.json",
                 consumerPolicyReceiptRoot: "\${{ steps.policy.outputs.v4-consumer-policy-receipt-root }}",
                 sourceSha: "\${{ inputs.target-sha || github.sha }}",
                 requestedRef: "\${{ needs.resolve-promotion.outputs.runtime-ref }}",
@@ -272,7 +272,7 @@ function consumerAdmissionJob() {
         uses: actions/upload-artifact@v7.0.1
         with:
           name: v4-runtime-authorization-release-candidate-promote-\${{ github.run_id }}
-          path: .buildchain/consumer/.buildchain/evidence/v4-runtime-authorization.json
+          path: .buildchain/consumer/.buildchain/evidence/runtime-authorization.json
           if-no-files-found: error
 `;
 }
@@ -304,7 +304,7 @@ export function generateChannelPromotionWorkflow(source, { major = 2, shellRouti
     if (!inputNames.includes(required)) throw new Error(`advanced promotion workflow missing input: ${required}`);
   }
   const invokeForwarded = routedInputs(inputNames, alphaRoute, major);
-  return migrateV4UniversalWorkflowFacade(`# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.
+  return migrateUniversalWorkflowFacade(`# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.
 name: Release Candidate Promote
 
 on:
@@ -316,16 +316,7 @@ ${secrets.trimEnd()}
     outputs:
 ${publicOutputs(outputs)}
 
-permissions:
-  actions: write
-  artifact-metadata: write
-  attestations: write
-  checks: write
-  contents: write
-  id-token: write
-  issues: write
-  pull-requests: write
-
+# Provider authority is inherited from the explicit caller envelope.
 jobs:
   resolve-promotion:
     name: Resolve promotion workflow shell and runtime
@@ -360,7 +351,7 @@ jobs:
         run: |
           set -euo pipefail
           repository="\${BUILDCHAIN_ROUTER_REPOSITORY}"
-          ref="\${BUILDCHAIN_ROUTER_REF}"
+          ref="\${BUILDCHAIN_ROUTER_REF:-${alphaRoute.logicalRef}}"
           ref="\${ref#refs/heads/}"
           ref="\${ref#refs/tags/}"
           if [[ ! "\${repository}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ || -z "\${ref}" || "\${ref}" = /* || "\${ref}" = *..* ]]; then
@@ -503,15 +494,7 @@ ${consumerAdmissionJob()}
     name: Invoke the single v4 publisher adapter
     needs: [resolve-promotion, consumer-admission]
     uses: kungfu-systems/buildchain/${alphaRoute.workflowPath}@${alphaRoute.callRef}
-    permissions:
-      actions: write
-      artifact-metadata: write
-      attestations: write
-      checks: write
-      contents: write
-      id-token: write
-      issues: write
-      pull-requests: write
+    # Provider authority is inherited from the explicit caller envelope.
     with:
 ${invokeForwarded}
     secrets: inherit

package/scripts/generate-release-candidate-passport.mjs

@@ -4,11 +4,11 @@ import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import { createReleaseCandidatePassport, validateReleaseCandidatePassport } from "../packages/core/release-candidate.js";
-import { scanV4FloatingConsumerPolicy, v4ConsumerPolicyScannerRoot } from "../packages/core/v4-floating-consumer-policy.js";
-import { v4ContentRoot } from "../packages/core/v4-canonical-contracts.js";
-import { V4_STAGE_CAPSULE_CONTRACT, V4_STAGE_CAPSULE_IDENTITY_CONTRACT, v4StageCapsuleIdentityRoot, v4StageCapsuleRoot, validateV4StageCapsule } from "../packages/core/v4-stage-capsule.js";
-import { v4RuntimeResumeDocumentRoot } from "../packages/core/v4-runtime-ref-resume-authority.js";
-import { createV4PublicationQualificationReceipt } from "../packages/core/v4-publication-qualification.js";
+import { scanFloatingConsumerPolicy, consumerPolicyScannerRoot } from "../packages/core/floating-consumer-policy.js";
+import { domainContentRoot } from "../packages/core/canonical-contracts.js";
+import { STAGE_CAPSULE_CONTRACT, STAGE_CAPSULE_IDENTITY_CONTRACT, stageCapsuleIdentityRoot, stageCapsuleRoot, validateStageCapsule } from "../packages/core/stage-capsule.js";
+import { runtimeResumeDocumentRoot } from "../packages/core/runtime-ref-resume-authority.js";
+import { createDomainPublicationQualificationReceipt } from "../packages/core/publication-qualification.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 const env = (name, fallback = "") => process.env[name] || fallback;
@@ -37,12 +37,12 @@ export function createReleaseCandidateStageCapsules({
     const coordinate = coordinateByPlatform.get(platform.platformId);
     if (!coordinate || coordinate.name !== platform.artifactName) throw new Error(`Stage Capsule coordinate missing for ${platform.platformId}`);
     const manifest = readJsonFile(platform.manifestPath);
-    return { role: platform.artifactName, platform: platform.platformId, artifactRoot: coordinate.digest, manifestRoot: v4ContentRoot("stage-capsule-artifact-manifest", manifest) };
+    return { role: platform.artifactName, platform: platform.platformId, artifactRoot: coordinate.digest, manifestRoot: domainContentRoot("stage-capsule-artifact-manifest", manifest) };
   });
   const qualificationExpiresAt = coordinates.artifacts.map((entry) => entry.expiresAt).sort((left, right) => Date.parse(left) - Date.parse(right))[0];
-  const qualificationReceipt = createV4PublicationQualificationReceipt({
+  const qualificationReceipt = createDomainPublicationQualificationReceipt({
     repository: passport.repository, candidateRoot: `sha256:${passport.candidateHash}`,
-    sourceSha: passport.source.headSha, sourceRoot: v4ContentRoot("candidate-identity", passport.source),
+    sourceSha: passport.source.headSha, sourceRoot: domainContentRoot("candidate-identity", passport.source),
     policyDigest: passport.consumerPolicy.receiptRoot, artifacts: qualificationArtifacts,
     issuedAt: passport.createdAt || new Date(Date.parse(qualificationExpiresAt) - 86_400_000).toISOString(), expiresAt: qualificationExpiresAt,
   });
@@ -57,13 +57,13 @@ export function createReleaseCandidateStageCapsules({
       }
       const manifest = readJsonFile(platform.manifestPath);
       const identity = {
-        schema: V4_STAGE_CAPSULE_IDENTITY_CONTRACT,
-        sourceRoot: v4ContentRoot("candidate-identity", passport.source),
+        schema: STAGE_CAPSULE_IDENTITY_CONTRACT,
+        sourceRoot: domainContentRoot("candidate-identity", passport.source),
         platform: platform.platformId,
-        platformRoot: v4ContentRoot("candidate-identity", manifest.platform),
+        platformRoot: domainContentRoot("candidate-identity", manifest.platform),
         stage: "verify",
         toolchainRoots: [],
-        runtimeRoot: v4ContentRoot("candidate-identity", {
+        runtimeRoot: domainContentRoot("candidate-identity", {
           sha: passport.buildchain.sha,
         }),
         policyRoot: passport.consumerPolicy.receiptRoot,
@@ -73,11 +73,11 @@ export function createReleaseCandidateStageCapsules({
             root: `sha256:${passport.candidateHash}`,
           },
         ],
-        transformationRoot: v4ContentRoot("candidate-identity", {
+        transformationRoot: domainContentRoot("candidate-identity", {
           lifecycle: manifest.lifecycle,
           summary: platform.summary,
         }),
-        outputManifestRoot: v4ContentRoot(
+        outputManifestRoot: domainContentRoot(
           "stage-capsule-artifact-manifest",
           { artifact: coordinate, manifest },
         ),
@@ -85,24 +85,24 @@ export function createReleaseCandidateStageCapsules({
         observationRoots: [
           {
             name: "provider-coordinate",
-            root: v4ContentRoot("provider-readback-sample", coordinate),
+            root: domainContentRoot("provider-readback-sample", coordinate),
           },
         ],
       };
       const capsule = {
-        schema: V4_STAGE_CAPSULE_CONTRACT,
+        schema: STAGE_CAPSULE_CONTRACT,
         writerAuthority: "typescript-v3",
         rustAuthority: "validation-only",
         identity,
-        identityRoot: v4StageCapsuleIdentityRoot(identity),
+        identityRoot: stageCapsuleIdentityRoot(identity),
         retentionPromise: {
           class: "github-artifact",
           retainUntil: coordinate.expiresAt,
         },
         capsuleRoot: `sha256:${"0".repeat(64)}`,
       };
-      capsule.capsuleRoot = v4StageCapsuleRoot(capsule);
-      validateV4StageCapsule(capsule);
+      capsule.capsuleRoot = stageCapsuleRoot(capsule);
+      validateStageCapsule(capsule);
       return {
         platform: platform.platformId,
         artifactName: coordinate.name,
@@ -133,7 +133,7 @@ export function createReleaseCandidateStageCapsules({
     publicationQualificationReceipt: qualificationReceipt,
     capsules: entries,
   };
-  return { ...body, root: v4RuntimeResumeDocumentRoot(body) };
+  return { ...body, root: runtimeResumeDocumentRoot(body) };
 }
 
 function writeReleaseCandidateStageCapsules({
@@ -188,12 +188,12 @@ export function resolveLegacyConsumerPolicyReceipt(options = {}) {
   if (!/^[0-9a-f]{40}$/u.test(options.runtimeRef || "") || options.runtimeRef !== options.runtimeSha || options.sourceTreeHash !== options.runtimeTreeHash()) return undefined;
   const root = path.resolve(options.root || ".buildchain/runtime");
   const alphaLock = readJsonFile(path.join(root, ".buildchain/alpha-contract-lock.json"));
-  const result = scanV4FloatingConsumerPolicy({
+  const result = scanFloatingConsumerPolicy({
     root, repository: options.repository, sourceSha: options.sourceSha,
     invokedWorkflow: options.invokedWorkflow || ".github/workflows/build.yml", invocationSourcePath: options.invocationSourcePath,
     expectedInvocationChannel: "alpha", resolvedWorkflowSha: alphaLock.buildchain?.resolvedSha,
-    resolvedRuntimeSha: options.runtimeSha, scannerRoot: v4ConsumerPolicyScannerRoot(),
-    policy: readJsonFile(path.resolve(import.meta.dirname, "../architecture/v4-floating-consumer-policy.json")),
+    resolvedRuntimeSha: options.runtimeSha, scannerRoot: consumerPolicyScannerRoot(),
+    policy: readJsonFile(path.resolve(import.meta.dirname, "../architecture/floating-consumer-policy.json")),
   });
   if (!result.ok) throw new Error(`legacy floating-shell policy receipt invalid: ${result.failures.map(({ code }) => code).join(", ")}`);
   return { receipt: result.receipt, receiptRoot: result.receiptRoot };

package/scripts/generate-site-bundle.mjs

@@ -51,31 +51,31 @@ const DEV_DELIVERY_AUTHORITY_SCHEMA =
   "schemas/dev-delivery-authority-v2.schema.json";
 const DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE =
   "contracts/dev-delivery-authority-v2.schema.json";
-const V4_COMPATIBILITY_FACTS_SCHEMA =
+const COMPATIBILITY_FACTS_SCHEMA =
   "schemas/v4-compatibility-facts-v1.schema.json";
-const V4_COMPATIBILITY_FACTS_SCHEMA_SOURCE =
+const COMPATIBILITY_FACTS_SCHEMA_SOURCE =
   "contracts/v4-compatibility-facts-v1.schema.json";
-const V4_PUBLICATION_REHEARSAL_SCHEMA =
+const PUBLICATION_REHEARSAL_SCHEMA =
   "schemas/v4-publication-rehearsal-capsule-v1.schema.json";
-const V4_PUBLICATION_REHEARSAL_SCHEMA_SOURCE =
+const PUBLICATION_REHEARSAL_SCHEMA_SOURCE =
   "contracts/v4-publication-rehearsal-capsule-v1.schema.json";
-const V4_ADOPTER_DELIVERY_SCHEMA =
+const ADOPTER_DELIVERY_SCHEMA =
   "schemas/v4-adopter-delivery-v1.schema.json";
-const V4_ADOPTER_DELIVERY_SCHEMA_SOURCE =
+const ADOPTER_DELIVERY_SCHEMA_SOURCE =
   "contracts/v4-adopter-delivery-v1.schema.json";
 const RELEASE_TAIL_CAPABILITIES_SCHEMA =
   "schemas/release-tail-capabilities-v1.schema.json";
 const RELEASE_TAIL_CAPABILITIES_SCHEMA_SOURCE =
   "contracts/release-tail-capabilities-v1.schema.json";
-const V4_PUBLICATION_QUALIFICATION_SCHEMA =
+const PUBLICATION_QUALIFICATION_SCHEMA =
   "schemas/v4-publication-qualification-v1.schema.json";
-const V4_PUBLICATION_QUALIFICATION_SCHEMA_SOURCE =
+const PUBLICATION_QUALIFICATION_SCHEMA_SOURCE =
   "contracts/v4-publication-qualification-v1.schema.json";
 const PUBLICATION_REHEARSAL_SITE_SCHEMAS = [
-  V4_PUBLICATION_REHEARSAL_SCHEMA,
-  V4_ADOPTER_DELIVERY_SCHEMA,
+  PUBLICATION_REHEARSAL_SCHEMA,
+  ADOPTER_DELIVERY_SCHEMA,
   RELEASE_TAIL_CAPABILITIES_SCHEMA,
-  V4_PUBLICATION_QUALIFICATION_SCHEMA,
+  PUBLICATION_QUALIFICATION_SCHEMA,
 ];
 const root = path.resolve(import.meta.dirname, "..");
 const outputDir = path.join(root, "dist", "site");
@@ -106,10 +106,10 @@ function stableJson(value) {
 
 function siteFileBytes(name, value) {
   if (name === DEV_DELIVERY_AUTHORITY_SCHEMA) return readText(DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE);
-  if (name === V4_COMPATIBILITY_FACTS_SCHEMA) return readText(V4_COMPATIBILITY_FACTS_SCHEMA_SOURCE);
-  if (name === V4_PUBLICATION_REHEARSAL_SCHEMA) return readText(V4_PUBLICATION_REHEARSAL_SCHEMA_SOURCE);
-  if (name === V4_PUBLICATION_QUALIFICATION_SCHEMA) return readText(V4_PUBLICATION_QUALIFICATION_SCHEMA_SOURCE);
-  if (name === V4_ADOPTER_DELIVERY_SCHEMA) return readText(V4_ADOPTER_DELIVERY_SCHEMA_SOURCE);
+  if (name === COMPATIBILITY_FACTS_SCHEMA) return readText(COMPATIBILITY_FACTS_SCHEMA_SOURCE);
+  if (name === PUBLICATION_REHEARSAL_SCHEMA) return readText(PUBLICATION_REHEARSAL_SCHEMA_SOURCE);
+  if (name === PUBLICATION_QUALIFICATION_SCHEMA) return readText(PUBLICATION_QUALIFICATION_SCHEMA_SOURCE);
+  if (name === ADOPTER_DELIVERY_SCHEMA) return readText(ADOPTER_DELIVERY_SCHEMA_SOURCE);
   if (name === RELEASE_TAIL_CAPABILITIES_SCHEMA) return readText(RELEASE_TAIL_CAPABILITIES_SCHEMA_SOURCE);
   return stableJson(value);
 }
@@ -1331,8 +1331,8 @@ function buildSiteBundle() {
     [DEV_DELIVERY_AUTHORITY_SCHEMA]: readJson(
       DEV_DELIVERY_AUTHORITY_SCHEMA_SOURCE,
     ),
-    [V4_COMPATIBILITY_FACTS_SCHEMA]: readJson(
-      V4_COMPATIBILITY_FACTS_SCHEMA_SOURCE,
+    [COMPATIBILITY_FACTS_SCHEMA]: readJson(
+      COMPATIBILITY_FACTS_SCHEMA_SOURCE,
     ),
     ...Object.fromEntries(
       PUBLICATION_REHEARSAL_SITE_SCHEMAS.map((name) => [

package/scripts/{generate-v4-universal-workflow-facades.mjs → generate-universal-workflow-facades.mjs}

@@ -1,14 +1,19 @@
 #!/usr/bin/env node
+import { rewriteImplementationReferences } from "./implementation-references.mjs";
 import fs from "node:fs";
 import crypto from "node:crypto";
-import { currentWorkflowPath, writeWorkflowSource, rewriteRepositoryWorkflowPaths } from "./workflow-taxonomy.mjs";
+import {
+  currentWorkflowPath,
+  writeWorkflowSource,
+  rewriteRepositoryWorkflowPaths,
+} from "./workflow-taxonomy.mjs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const contractPath = path.join(
   root,
-  "architecture/v4-universal-workflow-bootstrap.json",
+  "architecture/universal-workflow-bootstrap.json",
 );
 const contract = JSON.parse(fs.readFileSync(contractPath, "utf8"));
 const laneBudgetPath = path.join(
@@ -96,6 +101,7 @@ function frozenFacadeSource(relative) {
 const mutableFacades = new Set([
   ...(contract.migration.channelGeneratedFacades || []),
   ".github/workflows/dev-pr-auto-merge.yml",
+  ...(contract.migration.postMigrationWorkflows || []),
 ]);
 
 function isMutableFacade(relative) {
@@ -187,9 +193,7 @@ function guardCompatibilityJobs(source, relative) {
 function addRuntimeBootstrapDependencies(source, relative) {
   if (
     relative !== ".github/workflows/.build.yml" ||
-    source.includes(
-      ".buildchain/workflow-shell/scripts/github-output.mjs\n",
-    )
+    source.includes(".buildchain/workflow-shell/scripts/github-output.mjs\n")
   )
     return source;
   const anchor =
@@ -201,26 +205,60 @@ function addRuntimeBootstrapDependencies(source, relative) {
 }
 
 function applyPublicationFacadePatches(source, relative) {
-  const document = JSON.parse(fs.readFileSync(path.join(root,
-    "architecture/v4-publication-facade-patches.json"), "utf8"));
-  const patch = document.facades.find(entry => entry.workflow === relative);
+  const document = JSON.parse(
+    fs.readFileSync(
+      path.join(root, "architecture/publication-facade-patches.json"),
+      "utf8",
+    ),
+  );
+  const patch = document.facades.find((entry) => entry.workflow === relative);
   if (!patch) return source;
-  const digest = value => crypto.createHash("sha256").update(value).digest("hex");
+  const digest = (value) =>
+    crypto.createHash("sha256").update(value).digest("hex");
   if (digest(source) === patch.afterSha256) return source;
-  if (digest(source) !== patch.beforeSha256) fail(`${relative}: publication facade source drift`);
+  if (digest(source) !== patch.beforeSha256)
+    fail(`${relative}: publication facade source drift`);
   for (const { before, after } of patch.replacements) {
-    if (source.split(before).length !== 2) fail(`${relative}: ambiguous publication patch`);
+    if (source.split(before).length !== 2)
+      fail(`${relative}: ambiguous publication patch`);
     source = source.replace(before, () => after);
   }
-  if (digest(source) !== patch.afterSha256) fail(`${relative}: publication facade result drift`);
+  if (digest(source) !== patch.afterSha256)
+    fail(`${relative}: publication facade result drift`);
   return source;
 }
 
-export function migrateV4UniversalWorkflowFacade(source, relative) {
-  return rewriteRepositoryWorkflowPaths(root, applyPublicationFacadePatches(guardCompatibilityJobs(
-    addUniversalInput(addRuntimeBootstrapDependencies(source, relative), relative),
-    relative,
-  ), relative));
+function inheritPublicationProviderAuthority(source, relative) {
+  if (relative !== ".github/workflows/.release-candidate-promote.yml")
+    return source;
+  return source
+    .replace(
+      "permissions:\n  contents: read\n",
+      "# Provider authority is inherited from the explicit caller envelope.\n",
+    )
+    .replace(
+      "    permissions:\n      actions: read\n      checks: write\n      contents: write\n      id-token: write\n      pull-requests: write\n",
+      "    # Provider authority is inherited from the explicit caller envelope.\n",
+    );
+}
+
+export function migrateUniversalWorkflowFacade(source, relative) {
+  return rewriteImplementationReferences(rewriteRepositoryWorkflowPaths(
+    root,
+    inheritPublicationProviderAuthority(
+      applyPublicationFacadePatches(
+        guardCompatibilityJobs(
+          addUniversalInput(
+            addRuntimeBootstrapDependencies(source, relative),
+            relative,
+          ),
+          relative,
+        ),
+        relative,
+      ),
+      relative,
+    ),
+  ));
 }
 
 function verify(source, relative) {
@@ -243,7 +281,7 @@ function verify(source, relative) {
       fail(`${relative}#${header[1]} can overlap universal execution`);
   }
   if (!isMutableFacade(relative)) {
-    const expected = migrateV4UniversalWorkflowFacade(
+    const expected = migrateUniversalWorkflowFacade(
       frozenFacadeSource(relative),
       relative,
     );
@@ -421,7 +459,8 @@ function main() {
       );
   } else {
     writeWorkflowSource(
-      root, path.relative(root, recoveryWorkflowPath),
+      root,
+      path.relative(root, recoveryWorkflowPath),
       fs.readFileSync(recoveryTemplatePath, "utf8"),
     );
   }
@@ -434,8 +473,9 @@ function main() {
     if (check) verify(source, relative);
     else
       writeWorkflowSource(
-        root, current,
-        migrateV4UniversalWorkflowFacade(source, relative),
+        root,
+        current,
+        migrateUniversalWorkflowFacade(source, relative),
       );
   }
   if (!check) {

package/scripts/{v4-host-adapter.mjs → host-adapter.mjs}

@@ -3,7 +3,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
-import { architectureList, architectureShow } from "./v4-architecture.mjs";
+import { architectureList, architectureShow } from "./architecture.mjs";
 
 const MAX_REQUEST_BYTES = 8 * 1024 * 1024;
 const SUPPORTED_CAPABILITIES = Object.freeze([

package/scripts/implementation-references.mjs

@@ -0,0 +1,25 @@
+import fs from "node:fs";
+
+const policy = JSON.parse(
+  fs.readFileSync(
+    new URL("../architecture/implementation-naming.json", import.meta.url),
+    "utf8",
+  ),
+);
+
+// Project frozen workflow sources through the explicit implementation relocation.
+// Historical source commits and published wire identities stay unchanged.
+export function rewriteImplementationReferences(source) {
+  for (const [before, after] of Object.entries({
+    ...policy.pathMigrations,
+    ...Object.fromEntries(
+      Object.entries(policy.ephemeralPathMigrations).filter(([before]) =>
+        before.startsWith(".buildchain/"),
+      ),
+    ),
+  }).sort(([a], [b]) => b.length - a.length))
+    source = source.replaceAll(before, after);
+  for (const [before, after] of Object.entries(policy.symbolMigrations))
+    source = source.replace(new RegExp(`\\b${before}\\b`, "gu"), after);
+  return source;
+}