@kungfu-tech/buildchain 4.0.2 → 4.0.3

package/dist/site/public-surface-audit.json

@@ -4,9 +4,9 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 117,
-    "workflowCount": 114,
+    "workflowCount": 115,
     "actionCount": 8,
-    "sitePageCount": 87,
+    "sitePageCount": 88,
     "docCommandRefCount": 1050,
     "failureCount": 0
   },
@@ -3807,6 +3807,21 @@
         ],
         "outputCount": 5
       },
+      {
+        "id": "public-release-oci-compose-preview",
+        "path": ".github/workflows/public-release-oci-compose-preview.yml",
+        "reusable": true,
+        "inputs": [
+          "universal-request-json"
+        ],
+        "inputCount": 1,
+        "secrets": [
+          "BUILDCHAIN_PROMOTION_TOKEN"
+        ],
+        "secretCount": 1,
+        "outputs": [],
+        "outputCount": 0
+      },
       {
         "id": "public-release-paper-sealed",
         "path": ".github/workflows/public-release-paper-sealed.yml",
@@ -5171,6 +5186,44 @@
         ],
         "inputCount": 87
       },
+      {
+        "id": "release-candidate-promote",
+        "path": "actions/release-candidate-promote/action.yml",
+        "inputs": [
+          "artifact-paths",
+          "candidate-build-summary-path",
+          "candidate-passport-path",
+          "failure-after-capability",
+          "mutation-token",
+          "product-publication-intent-path",
+          "publication-qualification-path",
+          "publish-artifact-kind",
+          "publish-auth",
+          "publish-command",
+          "publish-dist-tag",
+          "publish-mode",
+          "publish-package-main",
+          "publish-package-set-order",
+          "publish-rematerialize-on-resume",
+          "publish-transaction-override",
+          "publisher-workflow-sha",
+          "repository",
+          "required-artifacts-path",
+          "required-status-check",
+          "resume-transaction-id",
+          "runtime-commit",
+          "runtime-tree",
+          "sealed-bundle-manifest",
+          "sealed-bundle-root",
+          "source-sha",
+          "stage-capsules-path",
+          "state-path",
+          "target-ref",
+          "target-sha",
+          "token"
+        ],
+        "inputCount": 31
+      },
       {
         "id": "release-tail",
         "path": "actions/release-tail/action.yml",
@@ -5272,44 +5325,6 @@
         ],
         "inputCount": 22
       },
-      {
-        "id": "v4-release-candidate-promote",
-        "path": "actions/v4-release-candidate-promote/action.yml",
-        "inputs": [
-          "artifact-paths",
-          "candidate-build-summary-path",
-          "candidate-passport-path",
-          "failure-after-capability",
-          "mutation-token",
-          "product-publication-intent-path",
-          "publication-qualification-path",
-          "publish-artifact-kind",
-          "publish-auth",
-          "publish-command",
-          "publish-dist-tag",
-          "publish-mode",
-          "publish-package-main",
-          "publish-package-set-order",
-          "publish-rematerialize-on-resume",
-          "publish-transaction-override",
-          "publisher-workflow-sha",
-          "repository",
-          "required-artifacts-path",
-          "required-status-check",
-          "resume-transaction-id",
-          "runtime-commit",
-          "runtime-tree",
-          "sealed-bundle-manifest",
-          "sealed-bundle-root",
-          "source-sha",
-          "stage-capsules-path",
-          "state-path",
-          "target-ref",
-          "target-sha",
-          "token"
-        ],
-        "inputCount": 31
-      },
       {
         "id": "validate-config",
         "path": "actions/validate-config/action.yml",
@@ -5335,19 +5350,19 @@
         "category": "action"
       },
       {
-        "id": "action:release-tail",
+        "id": "action:release-candidate-promote",
         "category": "action"
       },
       {
-        "id": "action:report-buildchain-issue",
+        "id": "action:release-tail",
         "category": "action"
       },
       {
-        "id": "action:run-lifecycle",
+        "id": "action:report-buildchain-issue",
         "category": "action"
       },
       {
-        "id": "action:v4-release-candidate-promote",
+        "id": "action:run-lifecycle",
         "category": "action"
       },
       {
@@ -5518,6 +5533,10 @@
         "id": "manual:observed-evidence-patrol",
         "category": "manual"
       },
+      {
+        "id": "manual:oci-publication",
+        "category": "manual"
+      },
       {
         "id": "manual:ownership",
         "category": "manual"
@@ -10929,8 +10948,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "d0faebaed7233ca9a122e2f914d8a07cd7a44806b3983d57c2e42db4547a9041",
-    "pageRegistryDigest": "de1ba89591aeb5f0e24f1c5e455c21e8477e1094ec616ffddc2c1163f02c53b9"
+    "workflowRegistryDigest": "174593771da3a06b960cd541ad4d650259f73e4e800c239dffff0ce7f77bcb65",
+    "pageRegistryDigest": "764a82aa21026c0fae31c8056366d016cb8548692a68c9f5c8063bfdcd2ed6aa"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -752,6 +752,21 @@
       "runnerPolicy": "qualified-measured",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/public-release-oci-compose-preview.yml",
+      "authorityClass": "product-publication",
+      "publicationCapable": true,
+      "capabilityIds": [
+        "oci-compose-preview"
+      ],
+      "credentialMode": "caller-secrets",
+      "publisherWorkflowMode": "caller-bound",
+      "publisherWorkflowPath": ".github/workflows/public-release-oci-compose-preview.yml",
+      "environment": "none",
+      "environmentMode": "fixed",
+      "runnerPolicy": "qualified-measured",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/public-release-paper-sealed.yml",
       "authorityClass": "product-publication",
@@ -1356,10 +1371,7 @@
     },
     {
       "path": ".github/workflows/.release-candidate-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -1374,10 +1386,7 @@
     },
     {
       "path": ".github/workflows/.release-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -1705,6 +1714,13 @@
       ],
       "classified": true
     },
+    {
+      "path": ".github/workflows/public-release-oci-compose-preview.yml",
+      "signals": [
+        "write-permission"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/public-release-paper-sealed.yml",
       "signals": [
@@ -1723,10 +1739,7 @@
     },
     {
       "path": ".github/workflows/public-release-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -1768,10 +1781,7 @@
     },
     {
       "path": ".github/workflows/release-candidate-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -2021,5 +2031,5 @@
       "classified": true
     }
   ],
-  "registryDigest": "894cce314366698d41a3ab20172a0b7a05f03f2167667eae51793537b832c811"
+  "registryDigest": "e5eb0d7ee3cce4a25674909154f6bd0bf736d5b93df41c1d435c468aad50c32a"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-06T14:59:38.000Z",
-  "publishedAt": "2026-09-06T14:59:38.000Z",
+  "generatedAt": "2026-09-07T14:30:21.000Z",
+  "publishedAt": "2026-09-07T14:30:21.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "fc8d499997b4da35dce74ee916afbd25515db845",
+  "sourceRevision": "84a2ce89275e4f4db04968e377a34dbced372d40",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2",
+    "version": "4.0.3",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -40,14 +40,14 @@
       "./release-line-bootstrap": "./packages/core/release-line-bootstrap.js",
       "./readme-badges": "./packages/core/readme-badges.js",
       "./public-surface-audit": "./packages/core/public-surface-audit.js",
-      "./v4-floating-consumer-policy": "./packages/core/v4-floating-consumer-policy.js",
-      "./v4-runtime-ref-resume-authority": "./packages/core/v4-runtime-ref-resume-authority.js",
-      "./v4-tail-reseal": "./packages/core/v4-tail-reseal.js",
-      "./v4-tail-reseal-receipt": "./packages/core/v4-tail-reseal-receipt.js",
-      "./v4-publication-rehearsal": "./packages/core/v4-publication-rehearsal.js",
+      "./v4-floating-consumer-policy": "./packages/compatibility/floating-consumer-policy.js",
+      "./v4-runtime-ref-resume-authority": "./packages/compatibility/runtime-ref-resume-authority.js",
+      "./v4-tail-reseal": "./packages/compatibility/tail-reseal.js",
+      "./v4-tail-reseal-receipt": "./packages/compatibility/tail-reseal-receipt.js",
+      "./v4-publication-rehearsal": "./packages/compatibility/publication-rehearsal.js",
       "./publication-rehearsal-runtime": "./packages/core/publication-rehearsal-runtime.js",
       "./publication-rehearsal-projection": "./packages/core/publication-rehearsal-projection.js",
-      "./v4-publication-qualification": "./packages/core/v4-publication-qualification.js",
+      "./v4-publication-qualification": "./packages/compatibility/publication-qualification.js",
       "./adopter-delivery-gate": "./packages/core/adopter-delivery-gate.js",
       "./kfd-adopter-category-driver": "./packages/core/kfd-adopter-category-driver.js",
       "./buildchain-delivery-infrastructure": "./packages/core/buildchain-delivery-infrastructure.js",
@@ -57,8 +57,8 @@
       "./legacy-kfd-adopter-driver": "./packages/core/legacy-kfd-adopter-driver.js",
       "./adopter-delivery-passport": "./packages/core/adopter-delivery-passport.js",
       "./adopter-delivery-vectors": "./packages/core/adopter-delivery-vectors.js",
-      "./v4-adopter-delivery": "./packages/core/v4-adopter-delivery.js",
-      "./v4-cross-platform-adopter-qualification": "./packages/core/v4-cross-platform-adopter-qualification.js",
+      "./v4-adopter-delivery": "./packages/compatibility/adopter-delivery.js",
+      "./v4-cross-platform-adopter-qualification": "./packages/compatibility/cross-platform-adopter-qualification.js",
       "./logging": "./packages/core/logging.js",
       "./portable-dev-cache": "./packages/core/portable-dev-cache.js",
       "./publication-artifact": "./packages/core/publication-artifact.js",
@@ -120,7 +120,16 @@
       "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
       "./site/release-provenance.json": "./dist/site/release-provenance.json",
       "./site/agent-index.json": "./dist/site/agent-index.json",
-      "./package.json": "./package.json"
+      "./package.json": "./package.json",
+      "./oci-publication": "./packages/core/oci-publication-bundle.js",
+      "./floating-consumer-policy": "./packages/core/floating-consumer-policy.js",
+      "./runtime-ref-resume-authority": "./packages/core/runtime-ref-resume-authority.js",
+      "./tail-reseal": "./packages/core/tail-reseal.js",
+      "./tail-reseal-receipt": "./packages/core/tail-reseal-receipt.js",
+      "./publication-rehearsal": "./packages/core/publication-rehearsal.js",
+      "./publication-qualification": "./packages/core/publication-qualification.js",
+      "./adopter-delivery": "./packages/core/adopter-delivery.js",
+      "./cross-platform-adopter-qualification": "./packages/core/cross-platform-adopter-qualification.js"
     }
   },
   "repository": "https://github.com/kungfu-systems/buildchain",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-06T14:59:38.000Z",
-  "publishedAt": "2026-09-06T14:59:38.000Z",
+  "generatedAt": "2026-09-07T14:30:21.000Z",
+  "publishedAt": "2026-09-07T14:30:21.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "fc8d499997b4da35dce74ee916afbd25515db845",
+  "sourceRevision": "84a2ce89275e4f4db04968e377a34dbced372d40",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2",
+    "version": "4.0.3",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:aef677bb3e37882f73daf65b7052989fc549e3b40d70bc4036beb2738b608345"
+      "digest": "sha256:93128b060fe11f0c14451966aa2ac467c47248946c577a16daed124344824282"
     },
     {
       "id": "getting-started",
@@ -141,7 +141,7 @@
       "path": "docs/next-development-transition.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:36f514efc9a7c1c6da59e93126e1512529c5c2349ea987516ef13f1e592be454"
+      "digest": "sha256:2a3556d2b7dd1e3a27878c2741aa5ae42d628afa5bb94ab62e468d789ddf0806"
     },
     {
       "id": "release-propagation",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:df073c14c12f15c851eb4507cbeb2919add936ac3079b10f222478138720d092"
+      "digest": "sha256:7ead263fccd68f471a4e3fee4b9ffe39b2ef0cbbea3c961605f8a13f66f09328"
     },
     {
       "id": "build-facts",
@@ -293,7 +293,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:0ea67ecc0eb6e4d49f71e11ccd670d442b811c9132736dd8c600d038dc6ebbe9"
+      "digest": "sha256:71a327274f18445d3e26392d24a707b887650603c574354009243164dbc59cdc"
     },
     {
       "id": "v4-adopter-delivery",
@@ -301,7 +301,7 @@
       "path": "docs/v4-adopter-delivery.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:1afe656ccb66bb63c73956413bb2d3551d3ba39c3f6e50389e7695877dac87a2"
+      "digest": "sha256:6679e6761bcc17d47efebee22f00db207645f134d8d61955f7b89264192ee409"
     },
     {
       "id": "publish-transaction",
@@ -309,7 +309,7 @@
       "path": "docs/publish-transaction.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:635de0da30769e4e6f956748ec9758338a1ae7921bce73268c2d914ae240693d"
+      "digest": "sha256:b1ee27a958bfe2327ec4702f6f288d916b8c7362bcc01c2c59388ffbe61037bf"
     },
     {
       "id": "release-tail-contract",
@@ -349,7 +349,7 @@
       "path": "docs/release-flow.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:1b97defb4f635937ea96f92e1180625cf1a5bc3454191062ec3c76b168d4c451"
+      "digest": "sha256:c981dadaa48e5adf5dcd8712eb1d37b60285bf66b0ba3a6c13a5252fcbdeedba"
     },
     {
       "id": "runtime-train-validation",

package/dist/site/workflow-registry.json

@@ -2746,7 +2746,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2",
+      "introducedVersion": "4.0.3",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -3943,7 +3943,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2",
+      "introducedVersion": "4.0.3",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -4484,6 +4484,40 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "public-release-oci-compose-preview",
+      "path": ".github/workflows/public-release-oci-compose-preview.yml",
+      "reusable": true,
+      "inputs": [
+        "universal-request-json"
+      ],
+      "inputCount": 1,
+      "secrets": [
+        "BUILDCHAIN_PROMOTION_TOKEN"
+      ],
+      "secretCount": 1,
+      "outputs": [],
+      "outputCount": 0,
+      "taxonomy": {
+        "id": "oci-compose-preview",
+        "role": "public",
+        "category": "release",
+        "purpose": "oci-compose-preview",
+        "status": "active",
+        "canonicalPath": ".github/workflows/public-release-oci-compose-preview.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "public-release-paper-sealed",
       "path": ".github/workflows/public-release-paper-sealed.yml",
@@ -5970,7 +6004,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2",
+      "introducedVersion": "4.0.3",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6001,7 +6035,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2",
+      "introducedVersion": "4.0.3",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6032,7 +6066,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2",
+      "introducedVersion": "4.0.3",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6801,6 +6835,53 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary."
     },
+    {
+      "id": "release-candidate-promote",
+      "path": "actions/release-candidate-promote/action.yml",
+      "inputs": [
+        "artifact-paths",
+        "candidate-build-summary-path",
+        "candidate-passport-path",
+        "failure-after-capability",
+        "mutation-token",
+        "product-publication-intent-path",
+        "publication-qualification-path",
+        "publish-artifact-kind",
+        "publish-auth",
+        "publish-command",
+        "publish-dist-tag",
+        "publish-mode",
+        "publish-package-main",
+        "publish-package-set-order",
+        "publish-rematerialize-on-resume",
+        "publish-transaction-override",
+        "publisher-workflow-sha",
+        "repository",
+        "required-artifacts-path",
+        "required-status-check",
+        "resume-transaction-id",
+        "runtime-commit",
+        "runtime-tree",
+        "sealed-bundle-manifest",
+        "sealed-bundle-root",
+        "source-sha",
+        "stage-capsules-path",
+        "state-path",
+        "target-ref",
+        "target-sha",
+        "token"
+      ],
+      "inputCount": 31,
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-actions",
+      "maturity": "stable",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary."
+    },
     {
       "id": "release-tail",
       "path": "actions/release-tail/action.yml",
@@ -6929,53 +7010,6 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary."
     },
-    {
-      "id": "v4-release-candidate-promote",
-      "path": "actions/v4-release-candidate-promote/action.yml",
-      "inputs": [
-        "artifact-paths",
-        "candidate-build-summary-path",
-        "candidate-passport-path",
-        "failure-after-capability",
-        "mutation-token",
-        "product-publication-intent-path",
-        "publication-qualification-path",
-        "publish-artifact-kind",
-        "publish-auth",
-        "publish-command",
-        "publish-dist-tag",
-        "publish-mode",
-        "publish-package-main",
-        "publish-package-set-order",
-        "publish-rematerialize-on-resume",
-        "publish-transaction-override",
-        "publisher-workflow-sha",
-        "repository",
-        "required-artifacts-path",
-        "required-status-check",
-        "resume-transaction-id",
-        "runtime-commit",
-        "runtime-tree",
-        "sealed-bundle-manifest",
-        "sealed-bundle-root",
-        "source-sha",
-        "stage-capsules-path",
-        "state-path",
-        "target-ref",
-        "target-sha",
-        "token"
-      ],
-      "inputCount": 31,
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-actions",
-      "maturity": "stable",
-      "introducedVersion": "pre-3.0.2-alpha.4",
-      "compatibilityPromise": "preserved-through-the-v3-major-line",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
-      "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary."
-    },
     {
       "id": "validate-config",
       "path": "actions/validate-config/action.yml",

package/docs/MAP.md

@@ -38,6 +38,7 @@ running artifact), *use* (consume / extend) - and a **status**:
 | CLI operator or agent | [Generated CLI Reference](cli-reference.md) | [CLI guide](cli.md) for concepts and worked examples |
 | Node toolkit developer | [Generated Node API Reference](node-api-reference.md) | [Core package guide](../packages/core/README.md) for recipes |
 | Workflow contributor | [Workflow Catalog](workflow-catalog.md) | [Contribution rules](../CONTRIBUTING.md#workflow-organization) and the [exact registry](../architecture/workflow-taxonomy.json) |
+| Container image publisher | [OCI image family publication](oci-publication.md) | [Release Flow](release-flow.md) and [Runtime Train Validation](runtime-train-validation.md) |
 | Build/release operator | [Reusable Build Surface](reusable-build-surface.md) | [Release Flow](release-flow.md) and [Release Passport](release-passport.md) |
 | Product/trust reviewer | [Product Mechanism](product-mechanism.md) | [Release Passport](release-passport.md) and [KFD Support](kfd-support.md) |
 
@@ -111,8 +112,8 @@ replace them.
 | How do I import Buildchain toolkit APIs from JavaScript build code? | [`node-api-reference.md`](node-api-reference.md) + [`../packages/core/README.md`](../packages/core/README.md) | use | stable |
 | How do I initialize a new repository? | [`getting-started.md`](getting-started.md) + [`lifecycle-protocol.md`](lifecycle-protocol.md) | use | stable |
 | Why does Buildchain use branch-driven release governance? | [`release-governance.md`](release-governance.md) | why | stable |
-| What freezes the v4 dependency direction, writer authority, complexity budgets, exceptions, and N-1 qualification? | [`../architecture/v4-architecture-constitution.md`](../architecture/v4-architecture-constitution.md) | why/verify | preview |
-| How will Delivery Warrant move from the v3 writer through shadow, v4 read, single-writer cutover, and legacy removal? | [`../architecture/v4-delivery-warrant-shadow-bootstrap-plan.md`](../architecture/v4-delivery-warrant-shadow-bootstrap-plan.md) | why/verify | preview |
+| What freezes the v4 dependency direction, writer authority, complexity budgets, exceptions, and N-1 qualification? | [`../architecture/architecture-constitution.md`](../architecture/architecture-constitution.md) | why/verify | preview |
+| How will Delivery Warrant move from the v3 writer through shadow, v4 read, single-writer cutover, and legacy removal? | [`../architecture/delivery-warrant-shadow-bootstrap-plan.md`](../architecture/delivery-warrant-shadow-bootstrap-plan.md) | why/verify | preview |
 | What exact canonical bytes, roots, clocks, event, receipt, and typed-fault contracts do Rust and JavaScript share in v4? | [`v4-canonical-contracts.md`](v4-canonical-contracts.md) | use/verify | preview |
 | How is one per-platform v4 build stage identified, retained, observed, and reused without provider identity or a second writer? | [`v4-stage-capsule.md`](v4-stage-capsule.md) | use/verify | preview |
 | How does an adopter run protocol-neutral driver conformance, N-1 bootstrap, and published archive readback through v4? | [`v4-adopter-delivery.md`](v4-adopter-delivery.md) | use/verify | preview |
@@ -172,7 +173,7 @@ replace them.
 | How do I deploy a site/app preview, staging, or production surface? | [`web-surface-deployments.md`](web-surface-deployments.md) | use | stable |
 | How do I publish observed infrastructure contracts for downstream consumers? | [`infra-contract.md`](infra-contract.md) | use | preview |
 | How do I operate a repeatable, disabled-by-default, budget-fail-closed AWS Windows JIT campaign? | [`aws-us-elastic-runner-burst-plane.md`](aws-us-elastic-runner-burst-plane.md#phase-2-operator-workflow) | use/verify | preview |
-| How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md), [`../actions/v4-release-candidate-promote/README.md`](../actions/v4-release-candidate-promote/README.md), [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md), [`../actions/github-artifact-attestation/README.md`](../actions/github-artifact-attestation/README.md), [`../actions/macos-credential-island/README.md`](../actions/macos-credential-island/README.md), [`../actions/release-tail/README.md`](../actions/release-tail/README.md); `dist/site/workflow-registry.json#actions` is authoritative for the eight-entry inventory. | use | stable |
+| How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md), [`../actions/release-candidate-promote/README.md`](../actions/release-candidate-promote/README.md), [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md), [`../actions/github-artifact-attestation/README.md`](../actions/github-artifact-attestation/README.md), [`../actions/macos-credential-island/README.md`](../actions/macos-credential-island/README.md), [`../actions/release-tail/README.md`](../actions/release-tail/README.md); `dist/site/workflow-registry.json#actions` is authoritative for the eight-entry inventory. | use | stable |
 | How can a consumer workflow report a Buildchain-owned failure back to Buildchain? | [`consumer-issue-reporting.md`](consumer-issue-reporting.md) + [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md) | use | stable |
 | What do the fixture repositories demonstrate? | [`../fixtures/libnode-shaped/README.md`](../fixtures/libnode-shaped/README.md), [`../fixtures/publish-transaction-shaped/README.md`](../fixtures/publish-transaction-shaped/README.md), [`../fixtures/web-surface-shaped/README.md`](../fixtures/web-surface-shaped/README.md), [`../fixtures/publication-artifact-shaped/README.md`](../fixtures/publication-artifact-shaped/README.md) | verify | stable |
 | What license and contribution terms apply? | [`../LICENSE`](../LICENSE) + [`../LICENSE-POLICY.md`](../LICENSE-POLICY.md) | use | stable |