@kungfu-tech/buildchain 4.0.8 → 4.0.9-alpha.0

package/architecture/maintainability-policy.json

@@ -26,7 +26,7 @@
   },
   "repositoryBudgets": {
     "baselineRevision": "9569f69c2cb609372b8a3d65ce5dec8fb7b34a84",
-    "maxHandMaintainedSourceFiles": 510,
+    "maxHandMaintainedSourceFiles": 512,
     "maxHandMaintainedSourceLines": 175456,
     "maxWorkflowFiles": 80,
     "maxWorkflowLines": 26791,
@@ -193,8 +193,8 @@
       "governance": "legacy-debt-sunset-2026q4"
     },
     "packages/core/buildchain-config.js": {
-      "maxLines": 1885,
-      "rationale": "Artifact signing configuration admits only the Buildchain-owned JIT profile with exact safe archive-relative target paths while rejecting credentials, entitlement files, wildcard paths, incompatible artifact kinds, and incomplete declarations. Publication rehearsal remains effect-disabled. Adopter delivery adds only a closed public contract, exact selectors and repository-relative input, readback, bootstrap, archive and result paths; this exact wiring ceiling cannot grow implicitly.",
+      "maxLines": 1887,
+      "rationale": "Artifact signing configuration admits only the Buildchain-owned JIT profile with exact safe archive-relative target paths while rejecting credentials, entitlement files, wildcard paths, incompatible artifact kinds, and incomplete declarations. Publication rehearsal remains effect-disabled. Adopter delivery adds only a closed public contract, exact selectors and repository-relative input, readback, bootstrap, archive and result paths; this exact wiring ceiling cannot grow implicitly. TOML build configuration delegates to a strict normalizer through one import and one call; this exact two-line increase accompanies removal of duplicate workflow and router implementations.",
       "governance": "legacy-debt-sunset-2026q4"
     },
     "scripts/check-internal-architecture.mjs": {
@@ -772,101 +772,7 @@
         "id": ".build",
         "path": ".github/workflows/.build.yml",
         "reusable": true,
-        "inputs": [
-          "artifact-compression-level",
-          "artifact-finalization-command",
-          "artifact-finalization-on-platform",
-          "artifact-name",
-          "artifact-name-template",
-          "artifact-paths",
-          "artifact-relay-s3-bucket",
-          "artifact-relay-s3-download-role-arn",
-          "artifact-relay-s3-oidc-audience",
-          "artifact-relay-s3-prefix",
-          "artifact-relay-s3-region",
-          "artifact-relay-s3-role-arn",
-          "artifact-relay-s3-upload-role-arn",
-          "artifact-retention-days",
-          "artifact-signing-request-upload-no-proxy",
-          "artifact-transfer-mode",
-          "aws-codebuild-project",
-          "aws-ec2-macos-runner-label",
-          "aws-ec2-windows-runner-label",
-          "build-command",
-          "buildchain-contract-compatibility-policy",
-          "buildchain-contract-drift-issue-mode",
-          "buildchain-contract-expected-channel",
-          "buildchain-contract-expected-major",
-          "buildchain-contract-lock-path",
-          "buildchain-expected-channel",
-          "buildchain-expected-major",
-          "buildchain-ref",
-          "buildchain-repository",
-          "buildchain-visible-workflow",
-          "cache-dependency-lock-root",
-          "cache-policy-root",
-          "cache-toolchain-root",
-          "cargo-registry-index",
-          "checkout-cache-fallback",
-          "checkout-cache-fetch-attempts",
-          "checkout-cache-github-timeout-seconds",
-          "checkout-cache-mirror-url-template",
-          "checkout-cache-mode",
-          "checkout-cache-reference-repository-template",
-          "checkout-cache-timeout-seconds",
-          "checkout-history-mode",
-          "compiler-cache-platforms-json",
-          "compiler-cache-provider",
-          "compiler-cache-required",
-          "control-runner-json",
-          "credential-island-caller-owned",
-          "credential-island-environment",
-          "credential-island-macos-app-path",
-          "credential-island-macos-platform-id",
-          "expected-artifacts-json",
-          "fail-fast",
-          "gate-profile-aggregate-json",
-          "github-artifact-attestation-platform-id",
-          "github-artifact-attestation-signer-sha",
-          "github-artifact-attestation-subject-path",
-          "install-command",
-          "kfd-agent-hub",
-          "lifecycle-timeout-minutes",
-          "linux-container-image",
-          "linux-container-preset",
-          "node-version",
-          "platforms-json",
-          "pre-upload-transport-smoke-artifact-root",
-          "pre-upload-transport-smoke-scenario-path",
-          "process-sample-interval-ms",
-          "process-summary-path",
-          "publish-anchor-request-json",
-          "publish-channel",
-          "publish-refs-json",
-          "publish-registry",
-          "publish-source-ref",
-          "release-candidate",
-          "release-candidate-family-evidence-json",
-          "requested-parallelism",
-          "require-build",
-          "require-install",
-          "require-trusted-event",
-          "require-verify",
-          "runner-preset",
-          "rust-toolchain",
-          "rustup-dist-server",
-          "rustup-update-root",
-          "sample-process-tree",
-          "self-hosted-offline-fallback",
-          "setup-node",
-          "setup-rust",
-          "shifu-cache-profile-digest",
-          "shifu-cache-profile-ref",
-          "untrusted-policy",
-          "verify-command",
-          "verify-substage-evidence-path",
-          "working-directory"
-        ],
+        "inputs": ["config-path"],
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -926,7 +832,7 @@
           "v4-consumer-policy-receipt-root"
         ]
       },
-      "rationale": "The reusable build surface carries one internal visible-workflow coordinate into the earliest semantic v4 consumer admission gate and emits the source/runtime/dual-lock-bound receipt; build, install, and release authority remain downstream of that gate.",
+      "rationale": "Project configuration moves to typed TOML; ordinary build calls expose only config-path, derive exact runtime identity, and share owner-scoped composite steps. The protected PR review must approve this deliberate breaking successor.",
       "governance": "legacy-debt-sunset-2026q4"
     },
     "workflow:build": {
@@ -935,104 +841,7 @@
         "id": "build",
         "path": ".github/workflows/build.yml",
         "reusable": true,
-        "inputs": [
-          "artifact-compression-level",
-          "artifact-finalization-command",
-          "artifact-finalization-on-platform",
-          "artifact-name",
-          "artifact-name-template",
-          "artifact-paths",
-          "artifact-relay-s3-bucket",
-          "artifact-relay-s3-download-role-arn",
-          "artifact-relay-s3-oidc-audience",
-          "artifact-relay-s3-prefix",
-          "artifact-relay-s3-region",
-          "artifact-relay-s3-role-arn",
-          "artifact-relay-s3-upload-role-arn",
-          "artifact-retention-days",
-          "artifact-signing-request-upload-no-proxy",
-          "artifact-transfer-mode",
-          "aws-codebuild-project",
-          "aws-ec2-macos-runner-label",
-          "aws-ec2-windows-runner-label",
-          "build-command",
-          "buildchain-alpha-contract-lock-path",
-          "buildchain-channel",
-          "buildchain-contract-compatibility-policy",
-          "buildchain-contract-drift-issue-mode",
-          "buildchain-contract-expected-channel",
-          "buildchain-contract-expected-major",
-          "buildchain-contract-lock-path",
-          "buildchain-expected-channel",
-          "buildchain-expected-major",
-          "buildchain-ref",
-          "buildchain-repository",
-          "buildchain-stable-contract-lock-path",
-          "buildchain-visible-workflow",
-          "cache-dependency-lock-root",
-          "cache-policy-root",
-          "cache-toolchain-root",
-          "cargo-registry-index",
-          "checkout-cache-fallback",
-          "checkout-cache-fetch-attempts",
-          "checkout-cache-github-timeout-seconds",
-          "checkout-cache-mirror-url-template",
-          "checkout-cache-mode",
-          "checkout-cache-reference-repository-template",
-          "checkout-cache-timeout-seconds",
-          "checkout-history-mode",
-          "compiler-cache-platforms-json",
-          "compiler-cache-provider",
-          "compiler-cache-required",
-          "control-runner-json",
-          "credential-island-caller-owned",
-          "credential-island-environment",
-          "credential-island-macos-app-path",
-          "credential-island-macos-platform-id",
-          "expected-artifacts-json",
-          "fail-fast",
-          "gate-profile-aggregate-json",
-          "github-artifact-attestation-platform-id",
-          "github-artifact-attestation-signer-sha",
-          "github-artifact-attestation-subject-path",
-          "install-command",
-          "kfd-agent-hub",
-          "lifecycle-timeout-minutes",
-          "linux-container-image",
-          "linux-container-preset",
-          "node-version",
-          "platforms-json",
-          "pre-upload-transport-smoke-artifact-root",
-          "pre-upload-transport-smoke-scenario-path",
-          "process-sample-interval-ms",
-          "process-summary-path",
-          "publish-anchor-request-json",
-          "publish-channel",
-          "publish-refs-json",
-          "publish-registry",
-          "publish-source-ref",
-          "release-candidate",
-          "release-candidate-family-evidence-json",
-          "requested-parallelism",
-          "require-build",
-          "require-install",
-          "require-trusted-event",
-          "require-verify",
-          "runner-preset",
-          "rust-toolchain",
-          "rustup-dist-server",
-          "rustup-update-root",
-          "sample-process-tree",
-          "self-hosted-offline-fallback",
-          "setup-node",
-          "setup-rust",
-          "shifu-cache-profile-digest",
-          "shifu-cache-profile-ref",
-          "untrusted-policy",
-          "verify-command",
-          "verify-substage-evidence-path",
-          "working-directory"
-        ],
+        "inputs": ["config-path"],
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1095,7 +904,7 @@
           "v4-consumer-policy-receipt-root"
         ]
       },
-      "rationale": "The generated channel router forwards the visible-workflow coordinate and semantic v4 policy receipt while retaining floating v4 or v4-alpha selectors, dual consumer locks, and trusted nonpersistent runtime override routing.",
+      "rationale": "Project configuration moves to typed TOML; ordinary build calls expose only config-path, derive exact runtime identity, and share owner-scoped composite steps. The protected PR review must approve this deliberate breaking successor.",
       "governance": "legacy-debt-sunset-2026q4"
     },
     "workflow:paper-release-sealed": {
@@ -1904,12 +1713,12 @@
   },
   "approvedWorkflowDebtTransitions": {
     ".github/workflows/.build.yml": {
-      "maxLines": 3341,
-      "maxJobs": 14,
-      "maxSteps": 194,
-      "maxStepsPerJob": 44,
-      "maxDecisions": 113,
-      "rationale": "Pure release-candidate channel and summary-name computation runs in the exact checked-out Buildchain runtime script. Jobs, steps, decisions, permissions, credentials, outputs, uploads, publication authority and failure behavior are unchanged; YAML lines fall from 3370 to 3341 and cannot grow implicitly.",
+      "maxLines": 2244,
+      "maxJobs": 15,
+      "maxSteps": 170,
+      "maxStepsPerJob": 32,
+      "maxDecisions": 87,
+      "rationale": "TOML-only ordinary build replaces 94 inputs with one locator and six shared owner-scoped composites. A read-only configuration job derives an exact rooted plan before admission. The public facade delegates once; this exact reduced surface cannot grow implicitly.",
       "governance": "stage2-workflow-yaml-reduction"
     },
     ".github/workflows/.release-candidate-promote.yml": {
@@ -1940,12 +1749,12 @@
       "governance": "legacy-debt-sunset-2026q4"
     },
     ".github/workflows/build.yml": {
-      "maxLines": 1218,
-      "maxJobs": 7,
-      "maxSteps": 16,
-      "maxStepsPerJob": 6,
-      "maxDecisions": 7,
-      "rationale": "The generated channel router forwards the two historical contract-channel aliases into the reusable build workflow without adding a second normalization or build authority. These exact generated ceilings cannot grow implicitly.",
+      "maxLines": 190,
+      "maxJobs": 1,
+      "maxSteps": 0,
+      "maxStepsPerJob": 0,
+      "maxDecisions": 0,
+      "rationale": "TOML-only ordinary build replaces 94 inputs with one locator and six shared owner-scoped composites. A read-only configuration job derives an exact rooted plan before admission. The public facade delegates once; this exact reduced surface cannot grow implicitly.",
       "governance": "legacy-debt-sunset-2026q4"
     },
     ".github/workflows/release-candidate-promote.yml": {

package/architecture/release-topology.json

@@ -152,6 +152,7 @@
         "packages/core/adopter-delivery-json.js",
         "packages/core/adopter-delivery-passport.js",
         "packages/core/artifact-verification-envelope.js",
+        "packages/core/build-configuration.js",
         "packages/core/buildchain-channel-identity.js",
         "packages/core/buildchain-compatibility-authority.js",
         "packages/core/buildchain-compatibility-fact.js",
@@ -212,7 +213,7 @@
         "scripts/release-finalization-review.mjs",
         "scripts/verify-version-state-delta.mjs"
       ],
-      "root": "sha256:7a51840f34c85125fc7b65c6b1881d59e62ea05ad8265f7c8f3a66a3d11539f7"
+      "root": "sha256:5301e4d5f49b4700ef4a7f69de5a8ba2bd42261364a1492e813633228f7f4c0f"
     },
     "rustWasmAuthority": {
       "loader": "packages/core/domain-wasm.js",
@@ -352,11 +353,11 @@
     ],
     "metrics": {
       "workflowCount": 35,
-      "jobCount": 91,
-      "reusableEdgeCount": 23,
-      "mutationRelevantNodeCount": 76,
+      "jobCount": 86,
+      "reusableEdgeCount": 21,
+      "mutationRelevantNodeCount": 72,
       "contentsWriteJobCount": 14,
-      "oidcWriteJobCount": 15
+      "oidcWriteJobCount": 12
     },
     "semanticMetrics": {
       "workflowCount": 5,

package/architecture/universal-workflow-bootstrap.json

@@ -116,7 +116,6 @@
   "bootstrapGovernedWorkflows": [
     ".github/workflows/.auditable-demo.yml",
     ".github/workflows/.binary-release-assets.yml",
-    ".github/workflows/.build.yml",
     ".github/workflows/.bump-minor-version.yml",
     ".github/workflows/.declarative-auditable-demo.yml",
     ".github/workflows/.gate-profile.yml",
@@ -129,7 +128,6 @@
     ".github/workflows/.web-surface.yml",
     ".github/workflows/.wheel-verify.yml",
     ".github/workflows/bootstrap.yml",
-    ".github/workflows/build.yml",
     ".github/workflows/buildchain-patrol.yml",
     ".github/workflows/check.yml",
     ".github/workflows/dev-alpha-candidate-patrol.yml",
@@ -160,7 +158,6 @@
     "compatibilityFacadeGenerator": "scripts/generate-universal-workflow-facades.mjs",
     "facadeSourceRevision": "06a2d9f7d5753c5c9b2bf0e7f0e3220fc18cc183",
     "channelGeneratedFacades": [
-      ".github/workflows/build.yml",
       ".github/workflows/release-candidate-promote.yml"
     ],
     "staticBootstrap": "implemented",
@@ -172,5 +169,9 @@
     "postMigrationWorkflows": [
       ".github/workflows/public-release-oci-compose-preview.yml"
     ]
-  }
+  },
+  "configurationGovernedWorkflows": [
+    ".github/workflows/.build.yml",
+    ".github/workflows/build.yml"
+  ]
 }

package/architecture/universal-workflow-train-admission.json

@@ -24,10 +24,10 @@
   },
   "contractRoots": [
     "sha256:19034e431506e219bec09851b0adb0e5ee6d1798528d2369f3f60b3f1bf2a8bf",
-    "sha256:20d48eff5e9eac02d552a1cbdb76f01e2b5addec798260ab43c0102ebf630f4b",
     "sha256:348955860bd0c5f5486c48be2e6c8553b50afa0be96699eff1b3dba914e7f80d",
     "sha256:5e922ecc5f5b7b17a67ccd73be1eb73ae9db886a9da439dbef942b5e2d80062b",
-    "sha256:b5d0050d17f2302e337dbbc9ad9bc07012d41b575cbca59123af5ae9df157579",
+    "sha256:639d7e151d7cccbdaab34ca7e2e5dfe10c5705e5a4d559f87fd4e688b291590b",
+    "sha256:803309167edeb5f2db25e3b7aa5d83d813d8b0912fdec2f1d307b9812d1564cf",
     "sha256:bab725233283c317972f383bcdd7c72725a1b46d96aa732e117f042b4bd313e9",
     "sha256:bbc0b1317f612b81ba3e462eab5a5ed2e0549ced6918fdc9b58b3dd14dc3db19"
   ],

package/bin/buildchain.mjs

@@ -1344,7 +1344,7 @@ async function handleInitCommand(args) {
       force: readBooleanFlag(args, "force"),
       packageManager: readFlag(args, "package-manager", ""),
       runnerPreset: readFlag(args, "runner-preset", "github-hosted"),
-      artifactName: readFlag(args, "artifact-name", "{repo}-{version}-{platform}"),
+      artifactName: readFlag(args, "artifact-name", ""),
     });
     printJson(result);
     return;

package/contracts/fixtures/v4-tail-reseal-v1/valid.json

@@ -22,7 +22,7 @@
     "ref": "v4-alpha",
     "sha": "dddddddddddddddddddddddddddddddddddddddd",
     "contractRoot": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
-    "consumerPolicyReceiptRoot": "sha256:acee2edcda59dfaf5fc0dd5877b7a20405fc6e0fa419abdd279a68aef32a0e5c"
+    "consumerPolicyReceiptRoot": "sha256:f80e32e2fcba14a942ead6eea5d34f7d208b9c1fa6012977a35f901a1081c9c0"
   },
   "warrant": {
     "candidateId": "candidate-alpha-2",