@kungfu-tech/buildchain 4.0.3 → 4.0.4

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.3",
+    "version": "4.0.4",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -5444,5 +5444,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:a0d4f48bb6236f6932466cfb2802b866035c5be5861a9d41c2975307a640fb18",
-  "contractDigest": "sha256:85ba0b6f77f3f32bab285b66cebcaec8b221d464e0214022b83322694853af1c"
+  "contractDigest": "sha256:c98bbc9fc63f47d55711c7414081174236d94514d916b10f7394ec3d7a9a6fe6"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-09-07T14:30:21.000Z",
-  "publishedAt": "2026-09-07T14:30:21.000Z",
+  "generatedAt": "2026-09-07T17:31:44.000Z",
+  "publishedAt": "2026-09-07T17:31:44.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "84a2ce89275e4f4db04968e377a34dbced372d40",
+  "sourceRevision": "29a053e8547b7b1d12c3244f18f69b7ee1eb8a33",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.3",
+    "version": "4.0.4",
     "versionSource": "package.json#version"
   },
   "source": {
@@ -5128,7 +5128,7 @@
       ],
       "maturity": "stable",
       "sourcePath": "docs/v4-production-release.md",
-      "digest": "sha256:ebefe3b4cc8c34df9494cfe29796d21c0c81eac5941d013ce5cb19ab516d7832",
+      "digest": "sha256:d17548de50809cbd4e9113477593a00f5b6c15c2f82c091da1ce08d0102349ac",
       "headings": [
         {
           "level": 1,
@@ -5156,7 +5156,7 @@
           "anchor": "automatic-next-development-review"
         }
       ],
-      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: buildchain-v4-production-release\ndoc_type: runbook\nsource_level: repository-contracts + protected-provider-readback\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: unreviewed\nlast_reviewed: 2026-09-07\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-07\n  invisible_context: Provider credentials and private provider state were not read.\n---\n\n# Buildchain v4 production release\n\nBuildchain v4 is the production release authority for the `v4.0` line. The\nprotected source path is:\n\n```text\ndev/v4/v4.0 -> alpha/v4/v4.0 -> release/v4/v4.0\n```\n\nPublic consumers use `v4-alpha` for the current prerelease channel and `v4`\nfor stable, with matching stable and alpha contract locks. Exact commits and\nimmutable release tags identify retained evidence and explicitly admitted runtime\ninputs; tracked v4 reusable-workflow selectors remain `@v4` or `@v4-alpha`.\n\nBefore qualifying a new release, run `node scripts/check-universal-workflow-bootstrap.mjs`.\nThe required repository check rejects an expired or not-yet-valid candidate admission\npolicy before publication. Renew the bounded validity window through protected review;\nkeep its capability, permission, reviewer and exact-source requirements unchanged.\nHistorical publication receipts remain immutable when a later admission window expires.\n\nThe release transaction is fail-closed. The v4 provider-operation journal,\nactivation plan, stable publication fence, and partial-mutation recovery plan\nbind the exact source, qualification, policy, provider readback, protected\nancestry, and target roots. Confirmed operations are never replayed; uncertain\noperations require provider readback before retry; stable publication requires\nan N-1 or independently sealed qualification.\n\n## Provider readback\n\nA stable release is complete only when all of these coordinates agree:\n\n- `release/v4/v4.0`, `v4`, `v4.0`, and the exact `v4.0.x` tag;\n- the GitHub Release tag and attached Release Passport evidence;\n- npm `@kungfu-tech/buildchain@4.0.x`, its `gitHead`, and the `latest` tag;\n- the protected source and release transaction roots.\n\nThe alpha channel applies the same rule to `alpha/v4/v4.0`, `v4-alpha`, the\nexact alpha tag, and npm's `alpha` tag.\n\n## Non-destructive rollback\n\nRollback never rewrites an exact tag, release, package version, Passport, or\nprovider journal. Stop forward promotion and select the last verified exact\nv4 runtime through an admitted, non-persistent recovery input; keep tracked v4\nworkflow selectors on their locked floating channel. Use `release/v3/v3.0`\ncoordinate only as an explicit compatibility rollback reference. Restoring v3\nas production authority requires a new reviewed cutover; it is not an implicit\nfallback.\n\nBefore any retry, compare the current provider state with the retained\ntransaction and operation roots. Resume only missing eligible operations.\nConflicting state remains `repair-required` or terminal and must not be\nconverted into success by moving a floating ref.\n\n## Publication settlement and binary recovery\n\nPublication, next-development advancement, and binary distribution have separate\nresults. A completed native ReleaseReceipt remains publication evidence when the\nlater generated Dev PR is still pending or its enqueue call fails. SETTLE verifies\nthe immutable invocation, transaction, both provider states, receipt and Passport\nroots even when APPLY fails after publication. It has no provider write permission.\n\nAPPLY retains that exact chain before waiting for next-development in the existing GitHub Release as\n`buildchain-publication-settlement.json`; it reads the exact tag and original\n`buildchain.release.json` before adding the packet. The APPLY artifact also retains\n`delivery-summary.json`, which reports publication and next-development separately.\nA green workflow label cannot substitute for this receipt verification.\n\nBinary Distribution reads this settlement and the original publication Passport.\nTag creation can precede settlement, so it waits at most 40 observations, 15 seconds\napart, for missing evidence. A mismatched source, tag, Passport or receipt fails\nimmediately. It no longer requires a legacy `buildchain/release-state/*` ref for v4.\n\nThe sealed binary publisher retains the publication Passport and writes its own\nPassport as `buildchain.binary.release.json`. All v4 asset collisions are checked\nbefore uploads: identical bytes are preserved, absent assets are added, and\nconflicting bytes are rejected. Each publication authorization is retained as\n`buildchain.binary.capability-<sha256>.json`, so a fresh recovery capability does\nnot overwrite an earlier grant. Existing assets are never clobbered. Recovery uses\nthe same exact successful Binary Distribution evidence run through\n`self-release-binary-assets.yml`; it does not rebuild already admitted archives or\ncreate another npm version. Read back all three platform archives, checksums,\nboth Passports and the settlement packet before declaring distribution complete.\n\nThe native publication receipt authorizes no stable promotion and makes no claim\nthat a pending next-development PR has merged. Inspect the exact PR head, protected\nbase and merge result independently. A retry of the publication phase must first\nread retained provider facts and resume only missing operations.\n\n## Automatic next-development review\n\n`self-release-next-development.yml` observes a successful exact `Verify` PR run\nfor a same-repository `chore/next-development/*` branch. It executes only the\nprotected default branch runtime. The PR must have one parent equal to the\ncurrent protected Dev head. The protected generator reconstructs every tracked\nbyte, permits only the declared immediate alpha version increment, and verifies\nthe completed alpha settlement against the exact tag and original Passport.\nThe published source tree must equal the protected development base tree.\n\nThe verification step receives no approval credential and never executes PR\ncode. A separate step uses `BUILDCHAIN_APPROVAL_TOKEN`, verifies that its identity\nis the independent `kungfu-origin` CODEOWNER, rereads the exact PR/run/base, and\napproves only that commit. Existing requests for changes stop automation.\nThe exact approval is read back before queue admission with the separate\n`BUILDCHAIN_PROMOTION_TOKEN`. Required checks, CODEOWNER protection and native\nmerge-group verification remain enforced. Missing credentials or evidence,\nforks, source changes and base/head drift fail closed.\n\nThe producer waits for pending independent review and required checks with a\nbounded retry budget. Publication evidence is already durable during this wait,\nso binaries can proceed independently. The reviewer also enqueues the verified\nhead idempotently, allowing a producer interruption to leave a recoverable PR.\nAn interrupted producer run remains failed; a successful later release is needed\nto establish an uninterrupted end-to-end publication."
+      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: buildchain-v4-production-release\ndoc_type: runbook\nsource_level: repository-contracts + protected-provider-readback\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: unreviewed\nlast_reviewed: 2026-09-08\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-08\n  invisible_context: Provider credentials and private provider state were not read.\n---\n\n# Buildchain v4 production release\n\nBuildchain v4 is the production release authority for the `v4.0` line. The\nprotected source path is:\n\n```text\ndev/v4/v4.0 -> alpha/v4/v4.0 -> release/v4/v4.0\n```\n\nPublic consumers use `v4-alpha` for the current prerelease channel and `v4`\nfor stable, with matching stable and alpha contract locks. Exact commits and\nimmutable release tags identify retained evidence and explicitly admitted runtime\ninputs; tracked v4 reusable-workflow selectors remain `@v4` or `@v4-alpha`.\n\nBefore qualifying a new release, run `node scripts/check-universal-workflow-bootstrap.mjs`.\nThe required repository check rejects an expired or not-yet-valid candidate admission\npolicy before publication. Renew the bounded validity window through protected review;\nkeep its capability, permission, reviewer and exact-source requirements unchanged.\nHistorical publication receipts remain immutable when a later admission window expires.\n\nThe release transaction is fail-closed. The v4 provider-operation journal,\nactivation plan, stable publication fence, and partial-mutation recovery plan\nbind the exact source, qualification, policy, provider readback, protected\nancestry, and target roots. Confirmed operations are never replayed; uncertain\noperations require provider readback before retry; stable publication requires\nan N-1 or independently sealed qualification.\n\n## Provider readback\n\nA stable release is complete only when all of these coordinates agree:\n\n- `release/v4/v4.0`, `v4`, `v4.0`, and the exact `v4.0.x` tag;\n- the GitHub Release tag and attached Release Passport evidence;\n- npm `@kungfu-tech/buildchain@4.0.x`, its `gitHead`, and the `latest` tag;\n- the protected source and release transaction roots.\n\nThe alpha channel applies the same rule to `alpha/v4/v4.0`, `v4-alpha`, the\nexact alpha tag, and npm's `alpha` tag.\n\n## Non-destructive rollback\n\nRollback never rewrites an exact tag, release, package version, Passport, or\nprovider journal. Stop forward promotion and select the last verified exact\nv4 runtime through an admitted, non-persistent recovery input; keep tracked v4\nworkflow selectors on their locked floating channel. Use `release/v3/v3.0`\ncoordinate only as an explicit compatibility rollback reference. Restoring v3\nas production authority requires a new reviewed cutover; it is not an implicit\nfallback.\n\nBefore any retry, compare the current provider state with the retained\ntransaction and operation roots. Resume only missing eligible operations.\nConflicting state remains `repair-required` or terminal and must not be\nconverted into success by moving a floating ref.\n\n## Publication settlement and binary recovery\n\nPublication, next-development advancement, and binary distribution have separate\nresults. A completed native ReleaseReceipt remains publication evidence when the\nlater generated Dev PR is still pending or its enqueue call fails. SETTLE verifies\nthe immutable invocation, transaction, both provider states, receipt and Passport\nroots even when APPLY fails after publication. It has no provider write permission.\n\nAPPLY retains that exact chain before waiting for next-development in the existing GitHub Release as\n`buildchain-publication-settlement.json`; it reads the exact tag and original\n`buildchain.release.json` before adding the packet. The APPLY artifact also retains\n`delivery-summary.json`, which reports publication and next-development separately.\nA green workflow label cannot substitute for this receipt verification.\n\nRecovery verifies both its current execution chain and any already published\nsettlement against the exact tag, source and original Passport. It preserves\nthe existing settlement bytes and uses that original receipt for development\nadvancement. A corrected runtime may produce different recovery observations;\nthey do not authorize replacing the completed publication packet. Ambiguous,\ntampered or mismatched retained evidence still blocks recovery.\n\nBinary Distribution reads this settlement and the original publication Passport.\nTag creation can precede settlement, so it waits at most 40 observations, 15 seconds\napart, for missing evidence. A mismatched source, tag, Passport or receipt fails\nimmediately. It no longer requires a legacy `buildchain/release-state/*` ref for v4.\n\nThe sealed binary publisher retains the publication Passport and writes its own\nPassport as `buildchain.binary.release.json`. All v4 asset collisions are checked\nbefore uploads: identical bytes are preserved, absent assets are added, and\nconflicting bytes are rejected. Each publication authorization is retained as\n`buildchain.binary.capability-<sha256>.json`, so a fresh recovery capability does\nnot overwrite an earlier grant. Existing assets are never clobbered. Recovery uses\nthe same exact successful Binary Distribution evidence run through\n`self-release-binary-assets.yml`; it does not rebuild already admitted archives or\ncreate another npm version. Read back all three platform archives, checksums,\nboth Passports and the settlement packet before declaring distribution complete.\n\nThe native publication receipt authorizes no stable promotion and makes no claim\nthat a pending next-development PR has merged. Inspect the exact PR head, protected\nbase and merge result independently. A retry of the publication phase must first\nread retained provider facts and resume only missing operations.\n\n## Automatic next-development review\n\nAfter stable completion, the producer generates the next patch at `alpha.0`\nfrom an isolated Git checkout of the exact current protected Dev commit. The\ncheckout explicitly fetches the exact Dev commit into its own object database;\nshallow local clones alone may omit commits fetched only into `FETCH_HEAD`.\nIt retains its own index so version verification can inspect the actual\ngenerated delta, and uses the admitted runtime dependency bridge. A source\narchive without Git metadata cannot perform that verification. The publication\nreceipt remains complete if development preparation fails; recover the original\ntransaction with corrected, reviewed tooling before publishing the next version.\n\n`self-release-next-development.yml` observes a successful exact `Verify` PR run\nfor a same-repository `chore/next-development/*` branch. It executes only the\nprotected default branch runtime. The PR must have one parent equal to the\ncurrent protected Dev head. The protected generator reconstructs every tracked\nbyte, permits only the declared immediate alpha version increment, and verifies\nthe completed alpha settlement against the exact tag and original Passport.\nThe published source tree must equal the protected development base tree.\n\nThe verification step receives no approval credential and never executes PR\ncode. A separate step uses `BUILDCHAIN_APPROVAL_TOKEN`, verifies that its identity\nis the independent `kungfu-origin` CODEOWNER, rereads the exact PR/run/base, and\napproves only that commit. Existing requests for changes stop automation.\nThe exact approval is read back before queue admission with the separate\n`BUILDCHAIN_PROMOTION_TOKEN`. Required checks, CODEOWNER protection and native\nmerge-group verification remain enforced. Missing credentials or evidence,\nforks, source changes and base/head drift fail closed.\n\nThe producer waits for pending independent review and required checks with a\nbounded retry budget. Publication evidence is already durable during this wait,\nso binaries can proceed independently. The reviewer also enqueues the verified\nhead idempotently, allowing a producer interruption to leave a recoverable PR.\nAn interrupted producer run remains failed; a successful later release is needed\nto establish an uninterrupted end-to-end publication."
     },
     {
       "id": "manual:v4-publication-rehearsal",

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "0051e6c8680376734a3cbf0f7acdba2bcaaff77fe55b6ff1f013344ca4ec5235",
+    "sha256": "2a4ae3826c24eb556bee87b11e642b18a86876ff53bd7de1a25d96a101100ec2",
     "summary": {
       "cliCommandCount": 117,
       "workflowCount": 115,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "0051e6c8680376734a3cbf0f7acdba2bcaaff77fe55b6ff1f013344ca4ec5235",
+      "sha256": "2a4ae3826c24eb556bee87b11e642b18a86876ff53bd7de1a25d96a101100ec2",
       "summary": {
         "cliCommandCount": 117,
         "workflowCount": 115,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.3",
+    "version": "4.0.4",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/page-registry.json

@@ -5062,7 +5062,7 @@
       ],
       "maturity": "stable",
       "sourcePath": "docs/v4-production-release.md",
-      "digest": "sha256:ebefe3b4cc8c34df9494cfe29796d21c0c81eac5941d013ce5cb19ab516d7832",
+      "digest": "sha256:d17548de50809cbd4e9113477593a00f5b6c15c2f82c091da1ce08d0102349ac",
       "headings": [
         {
           "level": 1,
@@ -5090,7 +5090,7 @@
           "anchor": "automatic-next-development-review"
         }
       ],
-      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: buildchain-v4-production-release\ndoc_type: runbook\nsource_level: repository-contracts + protected-provider-readback\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: unreviewed\nlast_reviewed: 2026-09-07\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-07\n  invisible_context: Provider credentials and private provider state were not read.\n---\n\n# Buildchain v4 production release\n\nBuildchain v4 is the production release authority for the `v4.0` line. The\nprotected source path is:\n\n```text\ndev/v4/v4.0 -> alpha/v4/v4.0 -> release/v4/v4.0\n```\n\nPublic consumers use `v4-alpha` for the current prerelease channel and `v4`\nfor stable, with matching stable and alpha contract locks. Exact commits and\nimmutable release tags identify retained evidence and explicitly admitted runtime\ninputs; tracked v4 reusable-workflow selectors remain `@v4` or `@v4-alpha`.\n\nBefore qualifying a new release, run `node scripts/check-universal-workflow-bootstrap.mjs`.\nThe required repository check rejects an expired or not-yet-valid candidate admission\npolicy before publication. Renew the bounded validity window through protected review;\nkeep its capability, permission, reviewer and exact-source requirements unchanged.\nHistorical publication receipts remain immutable when a later admission window expires.\n\nThe release transaction is fail-closed. The v4 provider-operation journal,\nactivation plan, stable publication fence, and partial-mutation recovery plan\nbind the exact source, qualification, policy, provider readback, protected\nancestry, and target roots. Confirmed operations are never replayed; uncertain\noperations require provider readback before retry; stable publication requires\nan N-1 or independently sealed qualification.\n\n## Provider readback\n\nA stable release is complete only when all of these coordinates agree:\n\n- `release/v4/v4.0`, `v4`, `v4.0`, and the exact `v4.0.x` tag;\n- the GitHub Release tag and attached Release Passport evidence;\n- npm `@kungfu-tech/buildchain@4.0.x`, its `gitHead`, and the `latest` tag;\n- the protected source and release transaction roots.\n\nThe alpha channel applies the same rule to `alpha/v4/v4.0`, `v4-alpha`, the\nexact alpha tag, and npm's `alpha` tag.\n\n## Non-destructive rollback\n\nRollback never rewrites an exact tag, release, package version, Passport, or\nprovider journal. Stop forward promotion and select the last verified exact\nv4 runtime through an admitted, non-persistent recovery input; keep tracked v4\nworkflow selectors on their locked floating channel. Use `release/v3/v3.0`\ncoordinate only as an explicit compatibility rollback reference. Restoring v3\nas production authority requires a new reviewed cutover; it is not an implicit\nfallback.\n\nBefore any retry, compare the current provider state with the retained\ntransaction and operation roots. Resume only missing eligible operations.\nConflicting state remains `repair-required` or terminal and must not be\nconverted into success by moving a floating ref.\n\n## Publication settlement and binary recovery\n\nPublication, next-development advancement, and binary distribution have separate\nresults. A completed native ReleaseReceipt remains publication evidence when the\nlater generated Dev PR is still pending or its enqueue call fails. SETTLE verifies\nthe immutable invocation, transaction, both provider states, receipt and Passport\nroots even when APPLY fails after publication. It has no provider write permission.\n\nAPPLY retains that exact chain before waiting for next-development in the existing GitHub Release as\n`buildchain-publication-settlement.json`; it reads the exact tag and original\n`buildchain.release.json` before adding the packet. The APPLY artifact also retains\n`delivery-summary.json`, which reports publication and next-development separately.\nA green workflow label cannot substitute for this receipt verification.\n\nBinary Distribution reads this settlement and the original publication Passport.\nTag creation can precede settlement, so it waits at most 40 observations, 15 seconds\napart, for missing evidence. A mismatched source, tag, Passport or receipt fails\nimmediately. It no longer requires a legacy `buildchain/release-state/*` ref for v4.\n\nThe sealed binary publisher retains the publication Passport and writes its own\nPassport as `buildchain.binary.release.json`. All v4 asset collisions are checked\nbefore uploads: identical bytes are preserved, absent assets are added, and\nconflicting bytes are rejected. Each publication authorization is retained as\n`buildchain.binary.capability-<sha256>.json`, so a fresh recovery capability does\nnot overwrite an earlier grant. Existing assets are never clobbered. Recovery uses\nthe same exact successful Binary Distribution evidence run through\n`self-release-binary-assets.yml`; it does not rebuild already admitted archives or\ncreate another npm version. Read back all three platform archives, checksums,\nboth Passports and the settlement packet before declaring distribution complete.\n\nThe native publication receipt authorizes no stable promotion and makes no claim\nthat a pending next-development PR has merged. Inspect the exact PR head, protected\nbase and merge result independently. A retry of the publication phase must first\nread retained provider facts and resume only missing operations.\n\n## Automatic next-development review\n\n`self-release-next-development.yml` observes a successful exact `Verify` PR run\nfor a same-repository `chore/next-development/*` branch. It executes only the\nprotected default branch runtime. The PR must have one parent equal to the\ncurrent protected Dev head. The protected generator reconstructs every tracked\nbyte, permits only the declared immediate alpha version increment, and verifies\nthe completed alpha settlement against the exact tag and original Passport.\nThe published source tree must equal the protected development base tree.\n\nThe verification step receives no approval credential and never executes PR\ncode. A separate step uses `BUILDCHAIN_APPROVAL_TOKEN`, verifies that its identity\nis the independent `kungfu-origin` CODEOWNER, rereads the exact PR/run/base, and\napproves only that commit. Existing requests for changes stop automation.\nThe exact approval is read back before queue admission with the separate\n`BUILDCHAIN_PROMOTION_TOKEN`. Required checks, CODEOWNER protection and native\nmerge-group verification remain enforced. Missing credentials or evidence,\nforks, source changes and base/head drift fail closed.\n\nThe producer waits for pending independent review and required checks with a\nbounded retry budget. Publication evidence is already durable during this wait,\nso binaries can proceed independently. The reviewer also enqueues the verified\nhead idempotently, allowing a producer interruption to leave a recoverable PR.\nAn interrupted producer run remains failed; a successful later release is needed\nto establish an uninterrupted end-to-end publication."
+      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: buildchain-v4-production-release\ndoc_type: runbook\nsource_level: repository-contracts + protected-provider-readback\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: unreviewed\nlast_reviewed: 2026-09-08\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-08\n  invisible_context: Provider credentials and private provider state were not read.\n---\n\n# Buildchain v4 production release\n\nBuildchain v4 is the production release authority for the `v4.0` line. The\nprotected source path is:\n\n```text\ndev/v4/v4.0 -> alpha/v4/v4.0 -> release/v4/v4.0\n```\n\nPublic consumers use `v4-alpha` for the current prerelease channel and `v4`\nfor stable, with matching stable and alpha contract locks. Exact commits and\nimmutable release tags identify retained evidence and explicitly admitted runtime\ninputs; tracked v4 reusable-workflow selectors remain `@v4` or `@v4-alpha`.\n\nBefore qualifying a new release, run `node scripts/check-universal-workflow-bootstrap.mjs`.\nThe required repository check rejects an expired or not-yet-valid candidate admission\npolicy before publication. Renew the bounded validity window through protected review;\nkeep its capability, permission, reviewer and exact-source requirements unchanged.\nHistorical publication receipts remain immutable when a later admission window expires.\n\nThe release transaction is fail-closed. The v4 provider-operation journal,\nactivation plan, stable publication fence, and partial-mutation recovery plan\nbind the exact source, qualification, policy, provider readback, protected\nancestry, and target roots. Confirmed operations are never replayed; uncertain\noperations require provider readback before retry; stable publication requires\nan N-1 or independently sealed qualification.\n\n## Provider readback\n\nA stable release is complete only when all of these coordinates agree:\n\n- `release/v4/v4.0`, `v4`, `v4.0`, and the exact `v4.0.x` tag;\n- the GitHub Release tag and attached Release Passport evidence;\n- npm `@kungfu-tech/buildchain@4.0.x`, its `gitHead`, and the `latest` tag;\n- the protected source and release transaction roots.\n\nThe alpha channel applies the same rule to `alpha/v4/v4.0`, `v4-alpha`, the\nexact alpha tag, and npm's `alpha` tag.\n\n## Non-destructive rollback\n\nRollback never rewrites an exact tag, release, package version, Passport, or\nprovider journal. Stop forward promotion and select the last verified exact\nv4 runtime through an admitted, non-persistent recovery input; keep tracked v4\nworkflow selectors on their locked floating channel. Use `release/v3/v3.0`\ncoordinate only as an explicit compatibility rollback reference. Restoring v3\nas production authority requires a new reviewed cutover; it is not an implicit\nfallback.\n\nBefore any retry, compare the current provider state with the retained\ntransaction and operation roots. Resume only missing eligible operations.\nConflicting state remains `repair-required` or terminal and must not be\nconverted into success by moving a floating ref.\n\n## Publication settlement and binary recovery\n\nPublication, next-development advancement, and binary distribution have separate\nresults. A completed native ReleaseReceipt remains publication evidence when the\nlater generated Dev PR is still pending or its enqueue call fails. SETTLE verifies\nthe immutable invocation, transaction, both provider states, receipt and Passport\nroots even when APPLY fails after publication. It has no provider write permission.\n\nAPPLY retains that exact chain before waiting for next-development in the existing GitHub Release as\n`buildchain-publication-settlement.json`; it reads the exact tag and original\n`buildchain.release.json` before adding the packet. The APPLY artifact also retains\n`delivery-summary.json`, which reports publication and next-development separately.\nA green workflow label cannot substitute for this receipt verification.\n\nRecovery verifies both its current execution chain and any already published\nsettlement against the exact tag, source and original Passport. It preserves\nthe existing settlement bytes and uses that original receipt for development\nadvancement. A corrected runtime may produce different recovery observations;\nthey do not authorize replacing the completed publication packet. Ambiguous,\ntampered or mismatched retained evidence still blocks recovery.\n\nBinary Distribution reads this settlement and the original publication Passport.\nTag creation can precede settlement, so it waits at most 40 observations, 15 seconds\napart, for missing evidence. A mismatched source, tag, Passport or receipt fails\nimmediately. It no longer requires a legacy `buildchain/release-state/*` ref for v4.\n\nThe sealed binary publisher retains the publication Passport and writes its own\nPassport as `buildchain.binary.release.json`. All v4 asset collisions are checked\nbefore uploads: identical bytes are preserved, absent assets are added, and\nconflicting bytes are rejected. Each publication authorization is retained as\n`buildchain.binary.capability-<sha256>.json`, so a fresh recovery capability does\nnot overwrite an earlier grant. Existing assets are never clobbered. Recovery uses\nthe same exact successful Binary Distribution evidence run through\n`self-release-binary-assets.yml`; it does not rebuild already admitted archives or\ncreate another npm version. Read back all three platform archives, checksums,\nboth Passports and the settlement packet before declaring distribution complete.\n\nThe native publication receipt authorizes no stable promotion and makes no claim\nthat a pending next-development PR has merged. Inspect the exact PR head, protected\nbase and merge result independently. A retry of the publication phase must first\nread retained provider facts and resume only missing operations.\n\n## Automatic next-development review\n\nAfter stable completion, the producer generates the next patch at `alpha.0`\nfrom an isolated Git checkout of the exact current protected Dev commit. The\ncheckout explicitly fetches the exact Dev commit into its own object database;\nshallow local clones alone may omit commits fetched only into `FETCH_HEAD`.\nIt retains its own index so version verification can inspect the actual\ngenerated delta, and uses the admitted runtime dependency bridge. A source\narchive without Git metadata cannot perform that verification. The publication\nreceipt remains complete if development preparation fails; recover the original\ntransaction with corrected, reviewed tooling before publishing the next version.\n\n`self-release-next-development.yml` observes a successful exact `Verify` PR run\nfor a same-repository `chore/next-development/*` branch. It executes only the\nprotected default branch runtime. The PR must have one parent equal to the\ncurrent protected Dev head. The protected generator reconstructs every tracked\nbyte, permits only the declared immediate alpha version increment, and verifies\nthe completed alpha settlement against the exact tag and original Passport.\nThe published source tree must equal the protected development base tree.\n\nThe verification step receives no approval credential and never executes PR\ncode. A separate step uses `BUILDCHAIN_APPROVAL_TOKEN`, verifies that its identity\nis the independent `kungfu-origin` CODEOWNER, rereads the exact PR/run/base, and\napproves only that commit. Existing requests for changes stop automation.\nThe exact approval is read back before queue admission with the separate\n`BUILDCHAIN_PROMOTION_TOKEN`. Required checks, CODEOWNER protection and native\nmerge-group verification remain enforced. Missing credentials or evidence,\nforks, source changes and base/head drift fail closed.\n\nThe producer waits for pending independent review and required checks with a\nbounded retry budget. Publication evidence is already durable during this wait,\nso binaries can proceed independently. The reviewer also enqueues the verified\nhead idempotently, allowing a producer interruption to leave a recoverable PR.\nAn interrupted producer run remains failed; a successful later release is needed\nto establish an uninterrupted end-to-end publication."
     },
     {
       "id": "manual:v4-publication-rehearsal",

package/dist/site/public-surface-audit.json

@@ -10948,8 +10948,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "174593771da3a06b960cd541ad4d650259f73e4e800c239dffff0ce7f77bcb65",
-    "pageRegistryDigest": "764a82aa21026c0fae31c8056366d016cb8548692a68c9f5c8063bfdcd2ed6aa"
+    "workflowRegistryDigest": "46a2b2c9c8be40bd3221a8f1a29522ec65a67cd61777806c3b02e55251b03267",
+    "pageRegistryDigest": "876cf4df5144c253cc3f6b06593d2a0d0b033c231b9552743064609148183469"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-07T14:30:21.000Z",
-  "publishedAt": "2026-09-07T14:30:21.000Z",
+  "generatedAt": "2026-09-07T17:31:44.000Z",
+  "publishedAt": "2026-09-07T17:31:44.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "84a2ce89275e4f4db04968e377a34dbced372d40",
+  "sourceRevision": "29a053e8547b7b1d12c3244f18f69b7ee1eb8a33",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.3",
+    "version": "4.0.4",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-07T14:30:21.000Z",
-  "publishedAt": "2026-09-07T14:30:21.000Z",
+  "generatedAt": "2026-09-07T17:31:44.000Z",
+  "publishedAt": "2026-09-07T17:31:44.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "84a2ce89275e4f4db04968e377a34dbced372d40",
+  "sourceRevision": "29a053e8547b7b1d12c3244f18f69b7ee1eb8a33",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.3",
+    "version": "4.0.4",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -2746,7 +2746,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.3",
+      "introducedVersion": "4.0.4",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -3943,7 +3943,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.3",
+      "introducedVersion": "4.0.4",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6004,7 +6004,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.3",
+      "introducedVersion": "4.0.4",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6035,7 +6035,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.3",
+      "introducedVersion": "4.0.4",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6066,7 +6066,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.3",
+      "introducedVersion": "4.0.4",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/v4-production-release.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-09-07
+last_reviewed: 2026-09-08
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-07
+  generated_at: 2026-09-08
   invisible_context: Provider credentials and private provider state were not read.
 ---
 
@@ -84,6 +84,13 @@ APPLY retains that exact chain before waiting for next-development in the existi
 `delivery-summary.json`, which reports publication and next-development separately.
 A green workflow label cannot substitute for this receipt verification.
 
+Recovery verifies both its current execution chain and any already published
+settlement against the exact tag, source and original Passport. It preserves
+the existing settlement bytes and uses that original receipt for development
+advancement. A corrected runtime may produce different recovery observations;
+they do not authorize replacing the completed publication packet. Ambiguous,
+tampered or mismatched retained evidence still blocks recovery.
+
 Binary Distribution reads this settlement and the original publication Passport.
 Tag creation can precede settlement, so it waits at most 40 observations, 15 seconds
 apart, for missing evidence. A mismatched source, tag, Passport or receipt fails
@@ -107,6 +114,16 @@ read retained provider facts and resume only missing operations.
 
 ## Automatic next-development review
 
+After stable completion, the producer generates the next patch at `alpha.0`
+from an isolated Git checkout of the exact current protected Dev commit. The
+checkout explicitly fetches the exact Dev commit into its own object database;
+shallow local clones alone may omit commits fetched only into `FETCH_HEAD`.
+It retains its own index so version verification can inspect the actual
+generated delta, and uses the admitted runtime dependency bridge. A source
+archive without Git metadata cannot perform that verification. The publication
+receipt remains complete if development preparation fails; recover the original
+transaction with corrected, reviewed tooling before publishing the next version.
+
 `self-release-next-development.yml` observes a successful exact `Verify` PR run
 for a same-repository `chore/next-development/*` branch. It executes only the
 protected default branch runtime. The PR must have one parent equal to the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.3",
+  "version": "4.0.4",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/publication-settlement.mjs

@@ -138,44 +138,50 @@ export async function settlePublication({
     );
   const tag = documents.invocation.target.tag;
   const release = client.release(tag);
-  const sourceSha = client.json(
-    `repos/${repository}/commits/${encodeURIComponent(tag)}`,
-  ).sha;
-  const matches = release.assets.filter(
-    ({ name }) => name === "buildchain.release.json",
-  );
+  const sourceSha = client.json(`repos/${repository}/commits/${encodeURIComponent(tag)}`).sha;
+  const matches = release.assets.filter(({ name }) => name === "buildchain.release.json");
   if (matches.length !== 1)
     throw new Error(
       "exact public publication passport is missing or ambiguous",
     );
   const publicPassport = JSON.parse(client.assetBytes(matches[0]));
-  const status = verifyPublicationSettlement(documents, {
+  const expected = {
     repository,
     tag,
     sourceSha,
     publicPassport,
-  });
+    candidateSha,
+  };
+  let status = verifyPublicationSettlement(documents, expected);
   // Publication completion is immutable; next-development and distribution progress stay separate.
-  const settlement = {
+  let settlement = {
     schemaVersion: 1,
     contract: "buildchain-v4-publication-settlement/v1",
     id: "v4-publication",
     release: { sourceSha, tag, channel: documents.invocation.target.channel },
     documents,
   };
+  const retained = release.assets.filter(({ name }) => name === SETTLEMENT_ASSET);
+  if (retained.length > 1) throw new Error("ambiguous immutable publication settlement");
+  if (retained.length === 1) {
+    const original = JSON.parse(client.assetBytes(retained[0]));
+    if (original.contract !== settlement.contract ||
+        original.release?.sourceSha !== sourceSha || original.release?.tag !== tag ||
+        original.release?.channel !== documents.invocation.target.channel)
+      throw new Error("retained publication settlement identity mismatch");
+    status = verifyPublicationSettlement(original.documents, expected);
+    settlement = original;
+  }
   const file = path.join(base, "release-tail", SETTLEMENT_ASSET);
   client.write(file, settlement);
-  await client.publish(release, [file]);
+  if (retained.length === 0) await client.publish(release, [file]);
   const summary = {
     ...status,
     nextDevelopment: applyOutcome === "success" ? "advanced" : "incomplete",
     binaryDistribution: "pending-provider-readback",
   };
-  client.write(
-    path.join(base, "release-tail", "delivery-summary.json"),
-    summary,
-  );
-  return { summary, receipt: documents.receipt };
+  client.write(path.join(base, "release-tail", "delivery-summary.json"), summary);
+  return { summary, receipt: settlement.documents.receipt };
 }
 
 async function main() {