@kungfu-tech/buildchain 4.0.2 → 4.0.3-alpha.0

package/scripts/{v4-publication-settlement.mjs → publication-settlement.mjs}

@@ -2,10 +2,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import {
-  createV4ReleaseInvocation,
-  createV4ReleaseReceipt,
-  createV4ReleaseTransaction,
-} from "../packages/core/v4-release-invocation.js";
+  createReleaseInvocation,
+  createReleaseReceipt,
+  createDomainReleaseTransaction,
+} from "../packages/core/release-invocation.js";
 import {
   releaseTailRoot,
   validateReleaseTailTransaction,
@@ -26,8 +26,8 @@ export function verifyPublicationSettlement(
     providerState,
     productState,
   } = documents;
-  const projected = createV4ReleaseInvocation(invocation);
-  const roots = createV4ReleaseTransaction({
+  const projected = createReleaseInvocation(invocation);
+  const roots = createDomainReleaseTransaction({
     invocationRoot: projected.roots.invocationRoot,
     publisherRoot: projected.roots.publisherRoot,
     runtimeRoot: projected.roots.runtimeRoot,
@@ -48,7 +48,7 @@ export function verifyPublicationSettlement(
         ...roots.transaction,
         transactionRoot: roots.transactionRoot,
       }) ||
-    createV4ReleaseReceipt(receiptBody).receiptRoot !== receiptRoot ||
+    createReleaseReceipt(receiptBody).receiptRoot !== receiptRoot ||
     receipt.transactionRoot !== roots.transactionRoot ||
     receipt.outcome !== "complete" ||
     passportRoot !== releaseTailRoot(passportBody) ||
@@ -202,7 +202,7 @@ async function main() {
 
 if (
   process.argv[1] &&
-  path.basename(process.argv[1]) === "v4-publication-settlement.mjs" &&
+  path.basename(process.argv[1]) === "publication-settlement.mjs" &&
   import.meta.url === pathToFileURL(process.argv[1]).href
 )
   main().catch((error) => {

package/scripts/{v4-release-candidate-adapter.mjs → release-candidate-adapter.mjs}

@@ -6,7 +6,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
-export function resolveV4ReleaseCandidateAdapter({
+export function resolveReleaseCandidateAdapter({
   resumeCandidateRunId = "",
 } = {}) {
   const mode = String(resumeCandidateRunId || "").trim() ? "recovery" : "fresh";
@@ -19,11 +19,11 @@ export function resolveV4ReleaseCandidateAdapter({
   });
 }
 
-export function runV4ReleaseCandidateAdapter({
+export function runReleaseCandidateAdapter({
   env = process.env,
   exec = execFileSync,
 } = {}) {
-  const route = resolveV4ReleaseCandidateAdapter({
+  const route = resolveReleaseCandidateAdapter({
     resumeCandidateRunId: env.BUILDCHAIN_RESUME_CANDIDATE_RUN_ID,
   });
   exec(process.execPath, [path.join(root, route.script)], {
@@ -37,5 +37,5 @@ if (
   process.argv[1] &&
   import.meta.url === pathToFileURL(process.argv[1]).href
 ) {
-  runV4ReleaseCandidateAdapter();
+  runReleaseCandidateAdapter();
 }

package/scripts/release-candidate-resolver.mjs

@@ -7,10 +7,10 @@ import { execFileSync } from "node:child_process";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { pathToFileURL } from "node:url";
-import { createResolvedPublicationSealedBundle } from "./publication-candidate-sealer.mjs";
+import { resolveCandidatePublicationBundle } from "./publication-candidate-sealer.mjs";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
-import { v4ContentRoot } from "../packages/core/v4-canonical-contracts.js";
-import { v4PublicationQualificationRoot, validateV4PublicationQualificationReceipt } from "../packages/core/v4-publication-qualification.js";
+import { domainContentRoot } from "../packages/core/canonical-contracts.js";
+import { domainPublicationQualificationRoot, validatePublicationQualificationReceipt } from "../packages/core/publication-qualification.js";
 
 const DEFAULT_WORKFLOW_FILE = "self-build-fixture.yml";
 function env(name, fallback = "") {
@@ -436,7 +436,7 @@ function findDownloadedFile(root, filename) {
   return "";
 }
 
-function resolveV4PublicationEvidence(passportDir, passport, outputPath) {
+function resolvePublicationEvidence(passportDir, passport, outputPath) {
   const stageCapsulesPath = findDownloadedFile(passportDir, "release-candidate-stage-capsules.json");
   const publicationQualificationPath = findDownloadedFile(passportDir, "release-candidate-publication-qualification.json");
   if (!passport.consumerPolicy?.receiptRoot) {
@@ -453,12 +453,12 @@ function resolveV4PublicationEvidence(passportDir, passport, outputPath) {
   }
   const stageCapsules = JSON.parse(fs.readFileSync(stageCapsulesPath, "utf8"));
   const qualification = JSON.parse(fs.readFileSync(publicationQualificationPath, "utf8"));
-  validateV4PublicationQualificationReceipt(qualification, {
+  validatePublicationQualificationReceipt(qualification, {
     repository: passport.repository,
     candidateRoot: `sha256:${passport.candidateHash}`,
     sourceSha: passport.source.headSha,
-    sourceRoot: v4ContentRoot("candidate-identity", passport.source),
-    artifactRoot: v4PublicationQualificationRoot(stageCapsules.capsules.map(({ publicationArtifact }) => publicationArtifact)),
+    sourceRoot: domainContentRoot("candidate-identity", passport.source),
+    artifactRoot: domainPublicationQualificationRoot(stageCapsules.capsules.map(({ publicationArtifact }) => publicationArtifact)),
     policyDigest: passport.consumerPolicy.receiptRoot,
   });
   if (stageCapsules.publicationQualificationRoot !== qualification.receiptRoot) throw new Error("Stage Capsules do not bind the publication qualification receipt");
@@ -705,7 +705,7 @@ export async function resolveReleaseCandidateArtifacts({
     throw new Error("downloaded release-candidate artifacts did not contain release-candidate-passport.json and build-summary.json");
   }
   const passport = JSON.parse(fs.readFileSync(passportPath, "utf8"));
-  const v4Publication = resolveV4PublicationEvidence(passportDir, passport, outputPath);
+  const domainPublication = resolvePublicationEvidence(passportDir, passport, outputPath);
   const platformManifestPaths = findDownloadedFiles(payloadDir, "manifest.json");
   const githubArtifactAttestationPolicyPaths = findDownloadedFiles(
     payloadDir,
@@ -725,23 +725,12 @@ export async function resolveReleaseCandidateArtifacts({
     const noun = publishArtifactKind === "npm" ? "npm package tarballs" : "platform manifests";
     throw new Error(`expected at least ${minimumPayloadCount} downloaded ${noun}, found ${downloadedRequiredArtifactCount}`);
   }
-  const sealedBundle = publishArtifactKind === "npm"
-    ? createResolvedPublicationSealedBundle({
-        bundleRoot: payloadDir,
-        repository: repoInfo.fullName,
-        sourceSha: passport.source?.headSha,
-        sourceTreeSha: passport.source?.treeHash,
-        runtimeSha: releaseCandidateRuntimeSha(passport),
-        releaseCandidateRoot: passport.candidateHash,
-        npmArtifacts: npmTarballPaths.map((tarballPath) => ({
-          path: tarballPath,
-          ...readNpmPackageArtifact({ tarballPath, mainPackage: publishPackageMain }),
-        })),
-        releaseAssetPaths,
-      })
-    : undefined;
+  const sealedBundle = resolveCandidatePublicationBundle({ kind: publishArtifactKind, payloadDir, passport,
+    runtimeSha: releaseCandidateRuntimeSha(passport), releaseAssetPaths,
+    npmArtifacts: npmTarballPaths.map((tarballPath) => ({ path: tarballPath,
+      ...readNpmPackageArtifact({ tarballPath, mainPackage: publishPackageMain }) })) });
   const manifests = platformManifestPaths.map((manifestPath) => JSON.parse(fs.readFileSync(manifestPath, "utf8"))), publicationVersion = resolveFreshPublicationVersion({ sealedBundle, candidateVersion: passport.target?.version });
-  const generatedRequiredArtifacts = generatePublishRequiredArtifacts({
+  const generatedRequiredArtifacts = sealedBundle?.requiredArtifacts || generatePublishRequiredArtifacts({
     manifests,
     version: publicationVersion,
     kind: publishArtifactKind,
@@ -759,7 +748,7 @@ export async function resolveReleaseCandidateArtifacts({
     paths: {
       passport: outputPath(passportPath),
       buildSummary: outputPath(buildSummaryPath),
-      ...v4Publication.paths,
+      ...domainPublication.paths,
       payloads: outputPath(payloadDir),
       platformManifests: platformManifestPaths.map(outputPath),
       githubArtifactAttestationPolicies: githubArtifactAttestationPolicyPaths.map(outputPath),
@@ -777,7 +766,7 @@ export async function resolveReleaseCandidateArtifacts({
     githubArtifactAttestationPolicyCount: githubArtifactAttestationPolicyPaths.length,
     npmTarballCount: npmTarballPaths.length,
     publishRequiredArtifacts: generatedRequiredArtifacts,
-    publicationQualificationRoot: v4Publication.publicationQualificationRoot,
+    publicationQualificationRoot: domainPublication.publicationQualificationRoot,
   };
 }
 

package/scripts/release-tail.mjs

@@ -12,9 +12,9 @@ import {
 } from "../packages/core/release-tail-provider-plane.js";
 import { diagnoseLegacyReleaseTailHooks } from "../packages/core/release-tail-compatibility.js";
 import {
-  V4_PUBLICATION_REHEARSAL_EVIDENCE_CONTRACT,
-  executeV4PublicationRehearsal,
-} from "../packages/core/v4-publication-rehearsal.js";
+  DOMAIN_PUBLICATION_REHEARSAL_EVIDENCE_CONTRACT,
+  executeDomainPublicationRehearsal,
+} from "../packages/core/publication-rehearsal.js";
 
 function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
@@ -76,7 +76,7 @@ export async function runReleaseTailCli(args = process.argv.slice(2)) {
         error.code = "ambient-environment-forbidden";
         throw error;
       }
-      const result = await executeV4PublicationRehearsal({
+      const result = await executeDomainPublicationRehearsal({
         capsule: readJson(capsulePath, "--capsule"),
         candidateRoot,
         mode: rehearsalMode,
@@ -89,7 +89,7 @@ export async function runReleaseTailCli(args = process.argv.slice(2)) {
     } catch (error) {
       output(
         {
-          schema: V4_PUBLICATION_REHEARSAL_EVIDENCE_CONTRACT,
+          schema: DOMAIN_PUBLICATION_REHEARSAL_EVIDENCE_CONTRACT,
           status: "rejected",
           code: error.code || "publication-rehearsal-runtime-error",
           message: error.message,

package/scripts/resume-from-candidate-run.mjs

@@ -6,6 +6,8 @@ import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { resolveOciCandidate, resolveRecoveredPublicationVersion, resolveRecoveredCandidateVersion } from "./publication-candidate-kind.mjs";
+export { resolveRecoveredPublicationVersion, resolveRecoveredCandidateVersion } from "./publication-candidate-kind.mjs";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 import { compareSemver } from "./publication-registry-hydrate.mjs";
 import { normalizeAnchorProvenance, normalizeCandidateRun, recoverCandidateProvenance } from "./release-candidate-anchor-provenance.mjs";
@@ -31,15 +33,15 @@ import {
 } from "../packages/core/publication-artifact-candidate.js";
 import { createPublicationSealedBundle } from "../packages/core/publication-sealed-bundle.js";
 import { releaseTransactionStateRef } from "../packages/core/publish-transaction.js";
-import { v4ContentRoot } from "../packages/core/v4-canonical-contracts.js";
-import { validateV4StageCapsule } from "../packages/core/v4-stage-capsule.js";
+import { domainContentRoot } from "../packages/core/canonical-contracts.js";
+import { validateStageCapsule } from "../packages/core/stage-capsule.js";
 import {
-  authorizeV4RuntimeSelection,
-  createV4RuntimeResumeLineage,
-  scanV4RuntimeSelectorPersistence,
-  v4RuntimeResumeDocumentRoot,
-  verifyV4RuntimeAuthorizationReceipt,
-} from "../packages/core/v4-runtime-ref-resume-authority.js";
+  authorizeRuntimeSelection,
+  createRuntimeResumeLineage,
+  scanRuntimeSelectorPersistence,
+  runtimeResumeDocumentRoot,
+  verifyRuntimeAuthorizationReceipt,
+} from "../packages/core/runtime-ref-resume-authority.js";
 
 function env(name, fallback = "") { return process.env[name] || fallback; }
 function requiredEnv(name) {
@@ -117,7 +119,7 @@ export function trackedRuntimePersistenceScan({
   )
     .split(/\r?\n/)
     .filter((entry) => /\.(?:json|toml|ya?ml)$/u.test(entry));
-  return scanV4RuntimeSelectorPersistence({ root: runtimeRoot, paths });
+  return scanRuntimeSelectorPersistence({ root: runtimeRoot, paths });
 }
 
 export function verifyReleaseCandidateStageCapsules({ sidecar, passport, downloads }) {
@@ -136,7 +138,7 @@ export function verifyReleaseCandidateStageCapsules({ sidecar, passport, downloa
   const expectedAttempt =
     `github-run:${passport.workflow.runId}:attempt:${passport.workflow.runAttempt}`;
   if (
-    sidecar.root !== v4RuntimeResumeDocumentRoot(payload) ||
+    sidecar.root !== runtimeResumeDocumentRoot(payload) ||
     sidecar.repository !== passport.repository ||
     sidecar.source?.sha !== passport.source.headSha ||
     sidecar.source?.treeSha !== passport.source.treeHash ||
@@ -158,7 +160,7 @@ export function verifyReleaseCandidateStageCapsules({ sidecar, passport, downloa
     throw new Error("release-candidate Stage Capsule platform set is incomplete");
   }
   return entries.map((entry) => {
-    validateV4StageCapsule(entry.capsule);
+    validateStageCapsule(entry.capsule);
     const download = artifactByName.get(entry.artifactName);
     const artifact = entry.artifact;
     if (
@@ -174,9 +176,9 @@ export function verifyReleaseCandidateStageCapsules({ sidecar, passport, downloa
         new Date(download.artifact.expires_at).toISOString() ||
       entry.capsule.identity.policyRoot !== sidecar.consumerPolicyReceiptRoot ||
       entry.capsule.identity.sourceRoot !==
-        v4ContentRoot("candidate-identity", passport.source) ||
+        domainContentRoot("candidate-identity", passport.source) ||
       entry.capsule.identity.runtimeRoot !==
-        v4ContentRoot("candidate-identity", { sha: passport.buildchain.sha })
+        domainContentRoot("candidate-identity", { sha: passport.buildchain.sha })
     ) {
       throw new Error(
         `Stage Capsule ${entry.platform} does not bind the verified provider artifact`,
@@ -196,7 +198,7 @@ export function verifyReleaseCandidateStageCapsules({ sidecar, passport, downloa
   });
 }
 
-export function validateV4RuntimeResumePublicReadback({
+export function validateRuntimeResumePublicReadback({
   targetRef,
   targetSha,
   targetVersion,
@@ -273,7 +275,7 @@ export async function readPublicResumeState({
   if (targetPackageFile?.type !== "file" || targetPackageFile.encoding !== "base64" || !targetPackageFile.content)
     throw new Error("cross-runtime recovery requires protected target version state");
   const targetVersion = JSON.parse(Buffer.from(String(targetPackageFile.content).replace(/\s/g, ""), "base64").toString("utf8")).version;
-  validateV4RuntimeResumePublicReadback({ targetRef, targetSha, targetVersion, alphaSha,
+  validateRuntimeResumePublicReadback({ targetRef, targetSha, targetVersion, alphaSha,
     exactTagSha, tagLineage, runtimeLineage, floatingTargetLineage, runtimeSha,
     version, transaction, main, npm });
   const body = {
@@ -296,10 +298,10 @@ export async function readPublicResumeState({
       distTagIntegrity: npm.versions[npm["dist-tags"].alpha].dist.integrity,
     },
   };
-  return { ...body, root: v4RuntimeResumeDocumentRoot(body) };
+  return { ...body, root: runtimeResumeDocumentRoot(body) };
 }
 
-export const resolveV4RuntimeResumePublicRuntimeSha = (material) =>
+export const resolveRuntimeResumePublicRuntimeSha = (material) =>
   material?.buildAttempt?.runtimeSha || "";
 
 function prepareRuntimeResumeEvidence({
@@ -313,14 +315,14 @@ function prepareRuntimeResumeEvidence({
   recovery,
   outputDir,
 }) {
-  const authorizationPath = path.resolve(".buildchain/release-candidate/v4-runtime-authorization.json");
+  const authorizationPath = path.resolve(".buildchain/release-candidate/runtime-authorization.json");
   const delegatedRaw = env("BUILDCHAIN_RUNTIME_AUTHORIZATION_JSON").trim();
   const delegatedRoot = env("BUILDCHAIN_RUNTIME_AUTHORIZATION_ROOT").trim();
   const authorizationFileExists = fs.existsSync(authorizationPath);
   if (!authorizationFileExists && (!delegatedRaw || !delegatedRoot)) throw new Error("cross-runtime recovery requires a fresh runtime authorization receipt");
   const delegated = authorizationFileExists ? readOnlyJson([{ absolutePath: authorizationPath }], "runtime authorization") : JSON.parse(delegatedRaw);
   if (!authorizationFileExists && delegated.receiptRoot !== delegatedRoot) throw new Error("fresh recovery runtime authorization handoff root mismatch");
-  const delegatedVerification = verifyV4RuntimeAuthorizationReceipt({
+  const delegatedVerification = verifyRuntimeAuthorizationReceipt({
     receipt: delegated.receipt,
     receiptRoot: delegated.receiptRoot,
     repository: repoInfo.fullName,
@@ -332,7 +334,7 @@ function prepareRuntimeResumeEvidence({
     );
   }
   const policy = passport.consumerPolicy.receipt;
-  const authorization = authorizeV4RuntimeSelection({
+  const authorization = authorizeRuntimeSelection({
     repository: repoInfo.fullName,
     eventName: "workflow_dispatch",
     mode: "resume",
@@ -362,7 +364,7 @@ function prepareRuntimeResumeEvidence({
     rebuildPlatforms: [],
     skippedBuildStages: recovery.receipt.skippedBuildStages,
   };
-  const plan = { ...planBody, root: v4RuntimeResumeDocumentRoot(planBody) };
+  const plan = { ...planBody, root: runtimeResumeDocumentRoot(planBody) };
   const materialBody = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-v4-runtime-resume-material/v1",
@@ -389,7 +391,7 @@ function prepareRuntimeResumeEvidence({
   };
   const material = {
     ...materialBody,
-    root: v4RuntimeResumeDocumentRoot(materialBody),
+    root: runtimeResumeDocumentRoot(materialBody),
   };
   for (const [name, value] of [
     ["v4-runtime-resume-plan.json", plan],
@@ -416,7 +418,7 @@ export async function finalizeRuntimeResumeEvidence({
   delete body.root;
   if (
     material.contract !== "kungfu-buildchain-v4-runtime-resume-material/v1" ||
-    material.root !== v4RuntimeResumeDocumentRoot(body)
+    material.root !== runtimeResumeDocumentRoot(body)
   ) {
     throw new Error("cross-runtime resume material root mismatch");
   }
@@ -436,14 +438,14 @@ export async function finalizeRuntimeResumeEvidence({
   const readback = await readPublicResumeState({
     repoInfo,
     targetRef,
-    runtimeSha: resolveV4RuntimeResumePublicRuntimeSha(material),
+    runtimeSha: resolveRuntimeResumePublicRuntimeSha(material),
     version,
     transaction,
     token,
     apiUrl,
     fetchImpl,
   });
-  const resumed = createV4RuntimeResumeLineage({
+  const resumed = createRuntimeResumeLineage({
     authorization: material.authorization,
     authorizationRoot: material.authorizationRoot,
     buildAttempt: material.buildAttempt,
@@ -695,22 +697,6 @@ export function createRecoveredPublicationCandidate({
   };
   return { ...payload, candidateDigest: publicationArtifactCandidateDigest(payload) };
 }
-export function resolveRecoveredPublicationVersion({ artifactVersion, channel, rematerializeOnResume = false } = {}) {
-  const version = String(artifactVersion || "").trim(), match = version.match(/^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u);
-  if (!match) throw new Error(`recovered npm artifact has invalid publication version: ${version || "<empty>"}`);
-  return channel === "release" && rematerializeOnResume ? match[1] : version;
-}
-export function resolveRecoveredCandidateVersion({ artifactVersion, publicationVersion, channel, rematerializeOnResume = false, targetRef = "", candidateRef = "" } = {}) {
-  const version = String(artifactVersion || "").trim(), target = String(targetRef || "").replace(/^refs\/heads\//u, ""), candidate = String(candidateRef || "").replace(/^refs\/heads\//u, "");
-  if (channel !== "release" || !rematerializeOnResume) return version;
-  const prefix = `publish-gate/${target}/`;
-  if (!target || !candidate.startsWith(prefix)) throw new Error(`stable recovery candidate ref must descend from ${prefix || "publish-gate/<target>/"}`);
-  const candidateVersion = candidate.slice(prefix.length);
-  if (!/^\d+\.\d+\.\d+-alpha\.\d+$/u.test(candidateVersion)) throw new Error(`stable recovery candidate ref must bind an exact alpha version, got ${candidateVersion || "<empty>"}`);
-  if (candidateVersion.replace(/-alpha\.\d+$/u, "") !== publicationVersion) throw new Error(`stable recovery candidate ${candidateVersion} does not match publication ${publicationVersion || "<empty>"}`);
-  if ((version.match(/^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u)?.[1] || "") !== publicationVersion) throw new Error(`recovered npm artifact version ${version || "<empty>"} does not match publication ${publicationVersion}`);
-  return candidateVersion;
-}
 export function createRecoveredPublication({ downloads, bundleRoot, repository, passport, candidateRuntimeSha, publishArtifactKind, publishPackageMain, releasePatterns, platformManifests, channel, targetRef = "", candidateRef = "", rematerializeOnResume = false }) {
   const allFiles = downloads.flatMap((download) => download.files.map((file) => ({ path: path.relative(bundleRoot, file.absolutePath).split(path.sep).join("/"),
     size: file.size, sha256: file.sha256.replace(/^sha256:/, ""), absolutePath: file.absolutePath })))
@@ -718,6 +704,13 @@ export function createRecoveredPublication({ downloads, bundleRoot, repository,
   const kind = String(publishArtifactKind || "npm");
   const releaseMatchers = splitPatterns(releasePatterns).map(patternMatcher);
   const releaseAssets = allFiles.filter((file) => releaseMatchers.some((matcher) => matcher.test(path.basename(file.path))));
+  if (kind === "oci") {
+    createRecoveredPublicationCandidate({ allFiles, repository, passport, candidateRuntimeSha });
+    const sealed = resolveOciCandidate({ payloadRoot: bundleRoot, passport });
+    return { manifest: sealed.manifest, bundleRoot: sealed.root, npmArtifacts: [], allFiles, releaseAssets,
+      version: sealed.manifest.version, candidateVersion: sealed.manifest.version,
+      publishRequiredArtifacts: sealed.requiredArtifacts };
+  }
   if (kind !== "npm") {
     createRecoveredPublicationCandidate({ allFiles, repository, passport, candidateRuntimeSha });
     const version = String(passport.target?.version || "").trim();
@@ -1019,7 +1012,7 @@ export async function resumeFromCandidateRun({
         npmTarballs: tarballs,
         releaseAssets: publication.releaseAssets.map((asset) => outputPath(asset.absolutePath)),
         publishRequiredArtifacts: outputPath(requiredArtifactsPath),
-        sealedBundleRoot: publication.manifest ? outputPath(bundleRoot) : "",
+        sealedBundleRoot: publication.manifest ? outputPath(publication.bundleRoot || bundleRoot) : "",
         sealedBundleManifest: publication.manifest ? outputPath(sealedManifestPath) : "",
         recoveryReceipt: outputPath(recoveryReceiptPath),
         stageCapsules: stageCapsuleFile ? outputPath(stageCapsuleFile.absolutePath) : "",

package/scripts/site-capability-metadata.mjs

@@ -206,6 +206,7 @@ export function nodeApiMeta(exportName) {
     "./publication-artifact": { group: "reusable-build", summary: "Publication artifact manifest, source bundle, and publication passport APIs." },
     "./publication-package": { group: "reusable-build", summary: "Publication npm package synthesis APIs for Buildchain-managed paper release presets." },
     "./publication-reproducibility": { group: "reusable-build", summary: "Two-clean-build publication byte reproducibility receipt APIs." },
+    "./oci-publication": { group: "reusable-build", summary: "Sealed OCI image family verification, provenance, and smoke evidence APIs." },
     "./publication-sealed-bundle": { group: "reusable-build", summary: "Build-once publication bundle manifests and exact-byte resume verification APIs." },
     "./paper": { group: "reusable-build", summary: "Unified Paper work, fleet, scaffold, preflight, npm bootstrap, build, Alpha, status, and resume planning APIs." },
     "./publication-authority": { group: "release-passport-trust", summary: "Sealed publication authority registry, runner provenance, control-plane audit, admission, and independent verification APIs." },
@@ -226,13 +227,19 @@ export function nodeApiMeta(exportName) {
     "./release-passport-contract": { group: "release-passport-trust", summary: "Standalone release passport JSON Schema, ownership/check manifest, and structural validation APIs." },
     "./release-candidate": { group: "reusable-build", summary: "PR-stage release-candidate artifact, passport, and promote-only resolver APIs." },
     "./v4-floating-consumer-policy": { group: "governance-versioning", summary: "Semantic floating-selector admission, dual-lock receipt, and independent v4 consumer certification APIs." },
+    "./floating-consumer-policy": { group: "governance-versioning", summary: "Semantic floating-selector admission, dual-lock receipt, and independent v4 consumer certification APIs." },
     "./v4-runtime-ref-resume-authority": { group: "release-passport-trust", summary: "Transient exact-runtime authorization, persisted-selector rejection, fresh-attempt Stage Capsule reuse, and A+B Passport lineage APIs." },
+    "./runtime-ref-resume-authority": { group: "release-passport-trust", summary: "Transient exact-runtime authorization, persisted-selector rejection, fresh-attempt Stage Capsule reuse, and A+B Passport lineage APIs." },
     "./v4-tail-reseal": { group: "release-passport-trust", summary: "Effect-pure retained Stage Capsule validation and explicit Warrant-, credential-, and release-tail-fenced macOS reseal planning APIs." },
+    "./tail-reseal": { group: "release-passport-trust", summary: "Effect-pure retained Stage Capsule validation and explicit Warrant-, credential-, and release-tail-fenced macOS reseal planning APIs." },
     "./v4-tail-reseal-receipt": { group: "release-passport-trust", summary: "Four-platform byte readback, standard candidate Passport binding, and terminal v4 tail-reseal receipt APIs." },
+    "./tail-reseal-receipt": { group: "release-passport-trust", summary: "Four-platform byte readback, standard candidate Passport binding, and terminal v4 tail-reseal receipt APIs." },
     "./v4-publication-rehearsal": { group: "release-passport-trust", summary: "Content-addressed v4 publication rehearsal capsules, shared production release-tail execution, replay, provider observation, and fail-closed verification APIs." },
+    "./publication-rehearsal": { group: "release-passport-trust", summary: "Content-addressed v4 publication rehearsal capsules, shared production release-tail execution, replay, provider observation, and fail-closed verification APIs." },
     "./publication-rehearsal-runtime": { group: "release-passport-trust", summary: "Compatibility names for the source-bound v4 publication rehearsal runtime and explicit rooted migration diagnostics." },
     "./publication-rehearsal-projection": { group: "release-passport-trust", summary: "Compatibility projection helpers that emit only the current source-bound v4 publication rehearsal configuration and workflow." },
     "./v4-publication-qualification": { group: "release-passport-trust", summary: "Sealed v4 candidate, source, artifact, policy, freshness, and command-free promotion admission APIs." },
+    "./publication-qualification": { group: "release-passport-trust", summary: "Sealed v4 candidate, source, artifact, policy, freshness, and command-free promotion admission APIs." },
     "./adopter-delivery-gate": { group: "reusable-build", summary: "Protocol-neutral adopter delivery gate, driver interface, artifact profiles, and canonical result APIs." },
     "./kfd-adopter-category-driver": { group: "kfd-trust", summary: "Published KFD adopter-category driver and exact package-cut verification APIs." },
     "./buildchain-delivery-infrastructure": { group: "reusable-build", summary: "Public delivery-infrastructure instance creation and KFD verification APIs." },
@@ -243,7 +250,9 @@ export function nodeApiMeta(exportName) {
     "./adopter-delivery-passport": { group: "release-passport-trust", summary: "Non-authoritative adopter delivery Release Passport binding and substitution checks." },
     "./adopter-delivery-vectors": { group: "reusable-build", summary: "Rooted public adopter delivery conformance vector suite APIs." },
     "./v4-adopter-delivery": { group: "reusable-build", summary: "Public v4 adopter delivery runtime, exact readback, N-1 lineage, and published archive verification APIs." },
+    "./adopter-delivery": { group: "reusable-build", summary: "Public v4 adopter delivery runtime, exact readback, N-1 lineage, and published archive verification APIs." },
     "./v4-cross-platform-adopter-qualification": { group: "reusable-build", summary: "Exact-source v3 capability matrix reports, executed failure and recovery evidence, and cross-platform public adopter qualification APIs." },
+    "./cross-platform-adopter-qualification": { group: "reusable-build", summary: "Exact-source v3 capability matrix reports, executed failure and recovery evidence, and cross-platform public adopter qualification APIs." },
     "./release-candidate-recovery": { group: "release-passport-trust", summary: "Fail-closed verification and immutable receipts for reusing a successful sealed candidate run without rebuilding product payloads." },
     "./release-train": { group: "governance-versioning", summary: "Frozen Release Cut identity, rooted Release Train transitions, Dev observations, supersession, replay, and legacy read compatibility APIs." },
     "./next-development-transition": { group: "governance-versioning", summary: "Provider-neutral completed-Alpha preservation and rooted next-development state, version-model, idempotency, and local materialization APIs." },

package/scripts/source-verification-evidence.mjs

@@ -3,7 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
-import { invokeV4DomainWasm } from "../packages/core/v4-domain-wasm.js";
+import { invokeDomainWasm } from "../packages/core/domain-wasm.js";
 
 const workflow = ".github/workflows/self-build-verify.yml";
 const proofPath = ".buildchain/source-verification/evidence.json";
@@ -46,14 +46,14 @@ export function verificationIdentity({
       "scripts/verify-version-state-delta.mjs",
     ]),
     runtimeRoot: named([
-      "packages/core/buildchain-v4-domain.wasm",
-      "packages/core/v4-domain-wasm-artifact.js",
+      "packages/core/buildchain-domain.wasm",
+      "packages/core/domain-wasm-artifact.js",
     ]),
     dependencyRoot: named([
       "pnpm-lock.yaml",
       "pnpm-workspace.yaml",
-      "crates/buildchain-v4-contracts/Cargo.lock",
-      "crates/buildchain-v4-bridge/Cargo.lock",
+      "crates/buildchain-domain-contracts/Cargo.lock",
+      "crates/buildchain-host-bridge/Cargo.lock",
     ]),
     toolchainRoot: hash(
       JSON.stringify([
@@ -99,11 +99,11 @@ export function verificationIdentity({
 }
 
 export function planVerification(input) {
-  return invokeV4DomainWasm("source-verification-plan", input);
+  return invokeDomainWasm("source-verification-plan", input);
 }
 
 export function sealVerification(input) {
-  return invokeV4DomainWasm("source-verification-seal", input);
+  return invokeDomainWasm("source-verification-seal", input);
 }
 
 const api = (endpoint, binary = false) =>