@kungfu-tech/buildchain 4.0.8 → 4.0.9-alpha.1

package/architecture/maintainability-debt.json

@@ -7,8 +7,8 @@
   },
   "totalExcessLedger": {
     "metric": "calibrated-full-dimensional-excess-v1",
-    "measuredExcess": 64542,
-    "current": 56481
+    "measuredExcess": 62215,
+    "current": 54154
   },
   "defaults": {
     "owner": "Buildchain architecture maintainers",
@@ -315,10 +315,10 @@
       },
       "packages/core/buildchain-config.js": {
         "baseline": {
-          "lines": 1885
+          "lines": 1887
         },
         "current": {
-          "lines": 1885
+          "lines": 1887
         },
         "target": {
           "lines": 600
@@ -334,10 +334,10 @@
           }
         },
         "current": {
-          "lines": 1078,
+          "lines": 1048,
           "functions": {
             "createBuildchainContractWorld@199": {
-              "lines": 681
+              "lines": 651
             }
           }
         },
@@ -1214,7 +1214,7 @@
           "lines": 1515
         },
         "current": {
-          "lines": 1475
+          "lines": 1489
         },
         "target": {
           "lines": 600
@@ -1223,21 +1223,21 @@
       "scripts/check-maintainability.mjs": {
         "baseline": {
           "functions": {
-            "evaluateMaintainability@260": {
+            "evaluateMaintainability@275": {
               "complexity": 29
             }
           }
         },
         "current": {
           "functions": {
-            "evaluateMaintainability@260": {
+            "evaluateMaintainability@275": {
               "complexity": 29
             }
           }
         },
         "target": {
           "functions": {
-            "evaluateMaintainability@260": {
+            "evaluateMaintainability@275": {
               "complexity": 25
             }
           }
@@ -1457,7 +1457,7 @@
       },
       "scripts/generate-site-bundle.mjs": {
         "baseline": {
-          "lines": 1410,
+          "lines": 1411,
           "functions": {
             "buildSiteBundle@720": {
               "lines": 637
@@ -1465,10 +1465,10 @@
           }
         },
         "current": {
-          "lines": 1410,
+          "lines": 1411,
           "functions": {
             "buildSiteBundle@720": {
-              "lines": 636
+              "lines": 637
             }
           }
         },
@@ -2191,7 +2191,7 @@
     "tests": {
       "tests/auditable-demo-platform.test.mjs": {
         "baseline": {
-          "lines": 712
+          "lines": 714
         },
         "current": {
           "lines": 712
@@ -2241,15 +2241,15 @@
         "baseline": {
           "lines": 3181,
           "functions": {
-            "<anonymous@1559>@1559": {
+            "<anonymous@1494>@1494": {
               "lines": 206
             }
           }
         },
         "current": {
-          "lines": 2738,
+          "lines": 2668,
           "functions": {
-            "<anonymous@1559>@1559": {
+            "<anonymous@1494>@1494": {
               "lines": 206
             }
           }
@@ -2257,7 +2257,7 @@
         "target": {
           "lines": 600,
           "functions": {
-            "<anonymous@1559>@1559": {
+            "<anonymous@1494>@1494": {
               "lines": 180
             }
           }
@@ -2267,33 +2267,27 @@
         "baseline": {
           "lines": 4639,
           "functions": {
-            "<anonymous@170>@170": {
-              "lines": 195
-            },
-            "<anonymous@544>@544": {
+            "<anonymous@445>@445": {
               "lines": 183
             },
-            "<anonymous@1678>@1678": {
+            "<anonymous@1579>@1579": {
               "lines": 249
             },
-            "<anonymous@2684>@2684": {
+            "<anonymous@2585>@2585": {
               "lines": 188
             }
           }
         },
         "current": {
-          "lines": 3027,
+          "lines": 2909,
           "functions": {
-            "<anonymous@170>@170": {
-              "lines": 186
-            },
-            "<anonymous@544>@544": {
+            "<anonymous@445>@445": {
               "lines": 183
             },
-            "<anonymous@1678>@1678": {
+            "<anonymous@1579>@1579": {
               "lines": 249
             },
-            "<anonymous@2684>@2684": {
+            "<anonymous@2585>@2585": {
               "lines": 188
             }
           }
@@ -2301,16 +2295,13 @@
         "target": {
           "lines": 600,
           "functions": {
-            "<anonymous@170>@170": {
-              "lines": 180
-            },
-            "<anonymous@544>@544": {
+            "<anonymous@445>@445": {
               "lines": 180
             },
-            "<anonymous@1678>@1678": {
+            "<anonymous@1579>@1579": {
               "lines": 180
             },
-            "<anonymous@2684>@2684": {
+            "<anonymous@2585>@2585": {
               "lines": 180
             }
           }
@@ -2329,7 +2320,7 @@
       },
       "tests/cli.test.mjs": {
         "baseline": {
-          "lines": 2840,
+          "lines": 2842,
           "functions": {
             "<anonymous@2363>@2363": {
               "lines": 253
@@ -2485,7 +2476,7 @@
           "lines": 916
         },
         "current": {
-          "lines": 916
+          "lines": 899
         },
         "target": {
           "lines": 600
@@ -2756,75 +2747,6 @@
           "lines": 600
         }
       },
-      "tests/build-surface-reusable-build.test.mjs": {
-        "baseline": {
-          "functions": {
-            "<anonymous@3>@3": {
-              "lines": 342
-            }
-          }
-        },
-        "current": {
-          "functions": {
-            "<anonymous@3>@3": {
-              "lines": 342
-            }
-          }
-        },
-        "target": {
-          "functions": {
-            "<anonymous@3>@3": {
-              "lines": 180
-            }
-          }
-        }
-      },
-      "tests/build-surface-reusable-build-signing.test.mjs": {
-        "baseline": {
-          "functions": {
-            "<anonymous@3>@3": {
-              "lines": 266
-            }
-          }
-        },
-        "current": {
-          "functions": {
-            "<anonymous@3>@3": {
-              "lines": 266
-            }
-          }
-        },
-        "target": {
-          "functions": {
-            "<anonymous@3>@3": {
-              "lines": 180
-            }
-          }
-        }
-      },
-      "tests/build-surface-reusable-build-artifacts.test.mjs": {
-        "baseline": {
-          "functions": {
-            "<anonymous@3>@3": {
-              "lines": 232
-            }
-          }
-        },
-        "current": {
-          "functions": {
-            "<anonymous@3>@3": {
-              "lines": 230
-            }
-          }
-        },
-        "target": {
-          "functions": {
-            "<anonymous@3>@3": {
-              "lines": 180
-            }
-          }
-        }
-      },
       "tests/promote-buildchain-ref-durable-recovery.test.mjs": {
         "baseline": {
           "functions": {
@@ -2922,17 +2844,17 @@
       ".github/workflows/.build.yml": {
         "baseline": {
           "lines": 3370,
-          "jobs": 14,
+          "jobs": 15,
           "steps": 194,
           "maxStepsPerJob": 44,
           "decisions": 113
         },
         "current": {
-          "lines": 3341,
-          "jobs": 14,
-          "steps": 194,
-          "maxStepsPerJob": 44,
-          "decisions": 113
+          "lines": 2244,
+          "jobs": 15,
+          "steps": 170,
+          "maxStepsPerJob": 32,
+          "decisions": 87
         },
         "target": {
           "lines": 600,
@@ -3021,17 +2943,6 @@
           "decisions": 25
         }
       },
-      ".github/workflows/build.yml": {
-        "baseline": {
-          "lines": 1218
-        },
-        "current": {
-          "lines": 1218
-        },
-        "target": {
-          "lines": 600
-        }
-      },
       ".github/workflows/check.yml": {
         "baseline": {
           "maxStepsPerJob": 22
@@ -3191,7 +3102,7 @@
       "path": "tests/build-surface.test.mjs",
       "metric": "lines",
       "baseline": 4639,
-      "current": 3027
+      "current": 2909
     },
     {
       "domain": "workflows",

package/architecture/maintainability-policy.json

@@ -26,7 +26,7 @@
   },
   "repositoryBudgets": {
     "baselineRevision": "9569f69c2cb609372b8a3d65ce5dec8fb7b34a84",
-    "maxHandMaintainedSourceFiles": 510,
+    "maxHandMaintainedSourceFiles": 512,
     "maxHandMaintainedSourceLines": 175456,
     "maxWorkflowFiles": 80,
     "maxWorkflowLines": 26791,
@@ -193,8 +193,8 @@
       "governance": "legacy-debt-sunset-2026q4"
     },
     "packages/core/buildchain-config.js": {
-      "maxLines": 1885,
-      "rationale": "Artifact signing configuration admits only the Buildchain-owned JIT profile with exact safe archive-relative target paths while rejecting credentials, entitlement files, wildcard paths, incompatible artifact kinds, and incomplete declarations. Publication rehearsal remains effect-disabled. Adopter delivery adds only a closed public contract, exact selectors and repository-relative input, readback, bootstrap, archive and result paths; this exact wiring ceiling cannot grow implicitly.",
+      "maxLines": 1887,
+      "rationale": "Artifact signing configuration admits only the Buildchain-owned JIT profile with exact safe archive-relative target paths while rejecting credentials, entitlement files, wildcard paths, incompatible artifact kinds, and incomplete declarations. Publication rehearsal remains effect-disabled. Adopter delivery adds only a closed public contract, exact selectors and repository-relative input, readback, bootstrap, archive and result paths; this exact wiring ceiling cannot grow implicitly. TOML build configuration delegates to a strict normalizer through one import and one call; this exact two-line increase accompanies removal of duplicate workflow and router implementations.",
       "governance": "legacy-debt-sunset-2026q4"
     },
     "scripts/check-internal-architecture.mjs": {
@@ -772,101 +772,7 @@
         "id": ".build",
         "path": ".github/workflows/.build.yml",
         "reusable": true,
-        "inputs": [
-          "artifact-compression-level",
-          "artifact-finalization-command",
-          "artifact-finalization-on-platform",
-          "artifact-name",
-          "artifact-name-template",
-          "artifact-paths",
-          "artifact-relay-s3-bucket",
-          "artifact-relay-s3-download-role-arn",
-          "artifact-relay-s3-oidc-audience",
-          "artifact-relay-s3-prefix",
-          "artifact-relay-s3-region",
-          "artifact-relay-s3-role-arn",
-          "artifact-relay-s3-upload-role-arn",
-          "artifact-retention-days",
-          "artifact-signing-request-upload-no-proxy",
-          "artifact-transfer-mode",
-          "aws-codebuild-project",
-          "aws-ec2-macos-runner-label",
-          "aws-ec2-windows-runner-label",
-          "build-command",
-          "buildchain-contract-compatibility-policy",
-          "buildchain-contract-drift-issue-mode",
-          "buildchain-contract-expected-channel",
-          "buildchain-contract-expected-major",
-          "buildchain-contract-lock-path",
-          "buildchain-expected-channel",
-          "buildchain-expected-major",
-          "buildchain-ref",
-          "buildchain-repository",
-          "buildchain-visible-workflow",
-          "cache-dependency-lock-root",
-          "cache-policy-root",
-          "cache-toolchain-root",
-          "cargo-registry-index",
-          "checkout-cache-fallback",
-          "checkout-cache-fetch-attempts",
-          "checkout-cache-github-timeout-seconds",
-          "checkout-cache-mirror-url-template",
-          "checkout-cache-mode",
-          "checkout-cache-reference-repository-template",
-          "checkout-cache-timeout-seconds",
-          "checkout-history-mode",
-          "compiler-cache-platforms-json",
-          "compiler-cache-provider",
-          "compiler-cache-required",
-          "control-runner-json",
-          "credential-island-caller-owned",
-          "credential-island-environment",
-          "credential-island-macos-app-path",
-          "credential-island-macos-platform-id",
-          "expected-artifacts-json",
-          "fail-fast",
-          "gate-profile-aggregate-json",
-          "github-artifact-attestation-platform-id",
-          "github-artifact-attestation-signer-sha",
-          "github-artifact-attestation-subject-path",
-          "install-command",
-          "kfd-agent-hub",
-          "lifecycle-timeout-minutes",
-          "linux-container-image",
-          "linux-container-preset",
-          "node-version",
-          "platforms-json",
-          "pre-upload-transport-smoke-artifact-root",
-          "pre-upload-transport-smoke-scenario-path",
-          "process-sample-interval-ms",
-          "process-summary-path",
-          "publish-anchor-request-json",
-          "publish-channel",
-          "publish-refs-json",
-          "publish-registry",
-          "publish-source-ref",
-          "release-candidate",
-          "release-candidate-family-evidence-json",
-          "requested-parallelism",
-          "require-build",
-          "require-install",
-          "require-trusted-event",
-          "require-verify",
-          "runner-preset",
-          "rust-toolchain",
-          "rustup-dist-server",
-          "rustup-update-root",
-          "sample-process-tree",
-          "self-hosted-offline-fallback",
-          "setup-node",
-          "setup-rust",
-          "shifu-cache-profile-digest",
-          "shifu-cache-profile-ref",
-          "untrusted-policy",
-          "verify-command",
-          "verify-substage-evidence-path",
-          "working-directory"
-        ],
+        "inputs": ["config-path"],
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -926,7 +832,7 @@
           "v4-consumer-policy-receipt-root"
         ]
       },
-      "rationale": "The reusable build surface carries one internal visible-workflow coordinate into the earliest semantic v4 consumer admission gate and emits the source/runtime/dual-lock-bound receipt; build, install, and release authority remain downstream of that gate.",
+      "rationale": "Project configuration moves to typed TOML; ordinary build calls expose only config-path, derive exact runtime identity, and share owner-scoped composite steps. The protected PR review must approve this deliberate breaking successor.",
       "governance": "legacy-debt-sunset-2026q4"
     },
     "workflow:build": {
@@ -935,104 +841,7 @@
         "id": "build",
         "path": ".github/workflows/build.yml",
         "reusable": true,
-        "inputs": [
-          "artifact-compression-level",
-          "artifact-finalization-command",
-          "artifact-finalization-on-platform",
-          "artifact-name",
-          "artifact-name-template",
-          "artifact-paths",
-          "artifact-relay-s3-bucket",
-          "artifact-relay-s3-download-role-arn",
-          "artifact-relay-s3-oidc-audience",
-          "artifact-relay-s3-prefix",
-          "artifact-relay-s3-region",
-          "artifact-relay-s3-role-arn",
-          "artifact-relay-s3-upload-role-arn",
-          "artifact-retention-days",
-          "artifact-signing-request-upload-no-proxy",
-          "artifact-transfer-mode",
-          "aws-codebuild-project",
-          "aws-ec2-macos-runner-label",
-          "aws-ec2-windows-runner-label",
-          "build-command",
-          "buildchain-alpha-contract-lock-path",
-          "buildchain-channel",
-          "buildchain-contract-compatibility-policy",
-          "buildchain-contract-drift-issue-mode",
-          "buildchain-contract-expected-channel",
-          "buildchain-contract-expected-major",
-          "buildchain-contract-lock-path",
-          "buildchain-expected-channel",
-          "buildchain-expected-major",
-          "buildchain-ref",
-          "buildchain-repository",
-          "buildchain-stable-contract-lock-path",
-          "buildchain-visible-workflow",
-          "cache-dependency-lock-root",
-          "cache-policy-root",
-          "cache-toolchain-root",
-          "cargo-registry-index",
-          "checkout-cache-fallback",
-          "checkout-cache-fetch-attempts",
-          "checkout-cache-github-timeout-seconds",
-          "checkout-cache-mirror-url-template",
-          "checkout-cache-mode",
-          "checkout-cache-reference-repository-template",
-          "checkout-cache-timeout-seconds",
-          "checkout-history-mode",
-          "compiler-cache-platforms-json",
-          "compiler-cache-provider",
-          "compiler-cache-required",
-          "control-runner-json",
-          "credential-island-caller-owned",
-          "credential-island-environment",
-          "credential-island-macos-app-path",
-          "credential-island-macos-platform-id",
-          "expected-artifacts-json",
-          "fail-fast",
-          "gate-profile-aggregate-json",
-          "github-artifact-attestation-platform-id",
-          "github-artifact-attestation-signer-sha",
-          "github-artifact-attestation-subject-path",
-          "install-command",
-          "kfd-agent-hub",
-          "lifecycle-timeout-minutes",
-          "linux-container-image",
-          "linux-container-preset",
-          "node-version",
-          "platforms-json",
-          "pre-upload-transport-smoke-artifact-root",
-          "pre-upload-transport-smoke-scenario-path",
-          "process-sample-interval-ms",
-          "process-summary-path",
-          "publish-anchor-request-json",
-          "publish-channel",
-          "publish-refs-json",
-          "publish-registry",
-          "publish-source-ref",
-          "release-candidate",
-          "release-candidate-family-evidence-json",
-          "requested-parallelism",
-          "require-build",
-          "require-install",
-          "require-trusted-event",
-          "require-verify",
-          "runner-preset",
-          "rust-toolchain",
-          "rustup-dist-server",
-          "rustup-update-root",
-          "sample-process-tree",
-          "self-hosted-offline-fallback",
-          "setup-node",
-          "setup-rust",
-          "shifu-cache-profile-digest",
-          "shifu-cache-profile-ref",
-          "untrusted-policy",
-          "verify-command",
-          "verify-substage-evidence-path",
-          "working-directory"
-        ],
+        "inputs": ["config-path"],
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1095,7 +904,7 @@
           "v4-consumer-policy-receipt-root"
         ]
       },
-      "rationale": "The generated channel router forwards the visible-workflow coordinate and semantic v4 policy receipt while retaining floating v4 or v4-alpha selectors, dual consumer locks, and trusted nonpersistent runtime override routing.",
+      "rationale": "Project configuration moves to typed TOML; ordinary build calls expose only config-path, derive exact runtime identity, and share owner-scoped composite steps. The protected PR review must approve this deliberate breaking successor.",
       "governance": "legacy-debt-sunset-2026q4"
     },
     "workflow:paper-release-sealed": {
@@ -1904,12 +1713,12 @@
   },
   "approvedWorkflowDebtTransitions": {
     ".github/workflows/.build.yml": {
-      "maxLines": 3341,
-      "maxJobs": 14,
-      "maxSteps": 194,
-      "maxStepsPerJob": 44,
-      "maxDecisions": 113,
-      "rationale": "Pure release-candidate channel and summary-name computation runs in the exact checked-out Buildchain runtime script. Jobs, steps, decisions, permissions, credentials, outputs, uploads, publication authority and failure behavior are unchanged; YAML lines fall from 3370 to 3341 and cannot grow implicitly.",
+      "maxLines": 2244,
+      "maxJobs": 15,
+      "maxSteps": 170,
+      "maxStepsPerJob": 32,
+      "maxDecisions": 87,
+      "rationale": "TOML-only ordinary build replaces 94 inputs with one locator and six shared owner-scoped composites. A read-only configuration job derives an exact rooted plan before admission. The public facade delegates once; this exact reduced surface cannot grow implicitly.",
       "governance": "stage2-workflow-yaml-reduction"
     },
     ".github/workflows/.release-candidate-promote.yml": {
@@ -1940,12 +1749,12 @@
       "governance": "legacy-debt-sunset-2026q4"
     },
     ".github/workflows/build.yml": {
-      "maxLines": 1218,
-      "maxJobs": 7,
-      "maxSteps": 16,
-      "maxStepsPerJob": 6,
-      "maxDecisions": 7,
-      "rationale": "The generated channel router forwards the two historical contract-channel aliases into the reusable build workflow without adding a second normalization or build authority. These exact generated ceilings cannot grow implicitly.",
+      "maxLines": 190,
+      "maxJobs": 1,
+      "maxSteps": 0,
+      "maxStepsPerJob": 0,
+      "maxDecisions": 0,
+      "rationale": "TOML-only ordinary build replaces 94 inputs with one locator and six shared owner-scoped composites. A read-only configuration job derives an exact rooted plan before admission. The public facade delegates once; this exact reduced surface cannot grow implicitly.",
       "governance": "legacy-debt-sunset-2026q4"
     },
     ".github/workflows/release-candidate-promote.yml": {

package/architecture/release-topology.json

@@ -43,7 +43,8 @@
       ".github/workflows/self-release-rehearsal-dogfood.yml",
       ".github/workflows/self-release-tail-dogfood.yml",
       ".github/workflows/self-release-next-development.yml",
-      ".github/workflows/public-release-oci-compose-preview.yml"
+      ".github/workflows/public-release-oci-compose-preview.yml",
+      ".github/workflows/self-build-stable-dogfood.yml"
     ],
     "unknownTopologyPolicy": "fail-closed"
   },
@@ -152,6 +153,7 @@
         "packages/core/adopter-delivery-json.js",
         "packages/core/adopter-delivery-passport.js",
         "packages/core/artifact-verification-envelope.js",
+        "packages/core/build-configuration.js",
         "packages/core/buildchain-channel-identity.js",
         "packages/core/buildchain-compatibility-authority.js",
         "packages/core/buildchain-compatibility-fact.js",
@@ -212,7 +214,7 @@
         "scripts/release-finalization-review.mjs",
         "scripts/verify-version-state-delta.mjs"
       ],
-      "root": "sha256:7a51840f34c85125fc7b65c6b1881d59e62ea05ad8265f7c8f3a66a3d11539f7"
+      "root": "sha256:5301e4d5f49b4700ef4a7f69de5a8ba2bd42261364a1492e813633228f7f4c0f"
     },
     "rustWasmAuthority": {
       "loader": "packages/core/domain-wasm.js",
@@ -351,12 +353,12 @@
       }
     ],
     "metrics": {
-      "workflowCount": 35,
-      "jobCount": 91,
-      "reusableEdgeCount": 23,
-      "mutationRelevantNodeCount": 76,
+      "workflowCount": 36,
+      "jobCount": 85,
+      "reusableEdgeCount": 21,
+      "mutationRelevantNodeCount": 71,
       "contentsWriteJobCount": 14,
-      "oidcWriteJobCount": 15
+      "oidcWriteJobCount": 10
     },
     "semanticMetrics": {
       "workflowCount": 5,