@kungfu-tech/buildchain 4.0.9-alpha.0 → 4.0.9-alpha.2

package/dist/site/public-surface-audit.json

@@ -4,7 +4,7 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 117,
-    "workflowCount": 115,
+    "workflowCount": 116,
     "actionCount": 14,
     "sitePageCount": 88,
     "docCommandRefCount": 1048,
@@ -4353,6 +4353,17 @@
         "outputs": [],
         "outputCount": 0
       },
+      {
+        "id": "self-build-stable-dogfood",
+        "path": ".github/workflows/self-build-stable-dogfood.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
       {
         "id": "self-build-verify",
         "path": ".github/workflows/self-build-verify.yml",
@@ -10628,8 +10639,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "547dde42a349a047f2aadcfc3ee9e3e31b6a7f6bfc75b7d37e5dcff7abd15308",
-    "workflowRegistryDigest": "82c2a0ad3ca59d91cd71987c968ae5c0f5fe16d2cdb2a37dcfce440cb41777be",
-    "pageRegistryDigest": "a28101c7e678dbdd499b0b263f809884381d7ddecd9d8ba7820c6912bc4f8c4c"
+    "workflowRegistryDigest": "19481dae8234daed9017d048c655b7a1b5b4099fe30113c9ff8275686b0caa8e",
+    "pageRegistryDigest": "09db5cdb5969b1c411bb23297b1943f35e6150b1f878582b43bd11f897884c10"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -1001,6 +1001,19 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/self-build-stable-dogfood.yml",
+      "authorityClass": "non-publication-oidc",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/self-build-stable-dogfood.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/self-ops-bootstrap-dogfood.yml",
       "authorityClass": "product-publication",
@@ -1861,6 +1874,14 @@
       "signals": [],
       "classified": false
     },
+    {
+      "path": ".github/workflows/self-build-stable-dogfood.yml",
+      "signals": [
+        "write-permission",
+        "oidc"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/self-build-verify.yml",
       "signals": [],
@@ -2031,5 +2052,5 @@
       "classified": true
     }
   ],
-  "registryDigest": "e5eb0d7ee3cce4a25674909154f6bd0bf736d5b93df41c1d435c468aad50c32a"
+  "registryDigest": "40ae53e5bf87b44395bd7bf04b19effb2cae1ada5f9864c02dbef4220fc92106"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-08T08:25:09.000Z",
-  "publishedAt": "2026-09-08T08:25:09.000Z",
+  "generatedAt": "2026-09-08T14:54:17.000Z",
+  "publishedAt": "2026-09-08T14:54:17.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "a9e25fd5b7d5dac1b0be1099d8651f7c6b0d7321",
+  "sourceRevision": "55827a43f38b1d75cb4903247c1e126fda4032cf",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.9-alpha.0",
+    "version": "4.0.9-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-08T08:25:09.000Z",
-  "publishedAt": "2026-09-08T08:25:09.000Z",
+  "generatedAt": "2026-09-08T14:54:17.000Z",
+  "publishedAt": "2026-09-08T14:54:17.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "a9e25fd5b7d5dac1b0be1099d8651f7c6b0d7321",
+  "sourceRevision": "55827a43f38b1d75cb4903247c1e126fda4032cf",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.9-alpha.0",
+    "version": "4.0.9-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:29b6f9cfccefae36ce402485b8c4e4c86bfd7cab18a8dcdfab7c1369b2301b4e"
+      "digest": "sha256:0b971a24b4fb850cf941d05f0ee8b3493f0dfe3ddbea5479bf2e344ea8a1553e"
     },
     {
       "id": "build-facts",
@@ -293,7 +293,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:42eda071001e232c0d4f6236c362c862fe7d63cd7b123db9780e0a3b468bc09f"
+      "digest": "sha256:bc609cad079a44afb8c2cf2b4459d44612bfd5ff09ed3064f85a2a3f02a5ec1e"
     },
     {
       "id": "v4-adopter-delivery",
@@ -333,7 +333,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:dab1c9cdc92b96fc79a45d33916973a6006c0be834d2a3adbf70f63f23bf00b5"
+      "digest": "sha256:4dca8751549a33393a0eb6f7237e1e70e9c586929b1e2792f7b32e9beadef75f"
     },
     {
       "id": "v4-compatibility-facts",

package/dist/site/workflow-registry.json

@@ -2464,7 +2464,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.9-alpha.0",
+      "introducedVersion": "4.0.9-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -3565,7 +3565,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.9-alpha.0",
+      "introducedVersion": "4.0.9-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5477,6 +5477,36 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "self-build-stable-dogfood",
+      "path": ".github/workflows/self-build-stable-dogfood.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "taxonomy": {
+        "id": "buildchain-stable-self-dogfood",
+        "role": "self",
+        "category": "build",
+        "purpose": "stable-dogfood",
+        "status": "active",
+        "canonicalPath": ".github/workflows/self-build-stable-dogfood.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "self-build-verify",
       "path": ".github/workflows/self-build-verify.yml",
@@ -5626,7 +5656,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.9-alpha.0",
+      "introducedVersion": "4.0.9-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5657,7 +5687,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.9-alpha.0",
+      "introducedVersion": "4.0.9-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5688,7 +5718,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.9-alpha.0",
+      "introducedVersion": "4.0.9-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/node-api-reference.md

@@ -120,7 +120,7 @@ Target: `./packages/core/index.js`. Public symbols: 662.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain";` | `packages/core/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:66` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:67` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain";` | `packages/core/build-facts.js:45` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:199` |
@@ -193,7 +193,7 @@ Target: `./packages/core/index.js`. Public symbols: 662.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain";` | `packages/core/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:105` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:106` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain";` | `packages/core/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/cache-evidence.js:169` |
@@ -835,7 +835,7 @@ Target: `./packages/core/index.js`. Public symbols: 662.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:66` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:67` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/build-facts.js:45` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:199` |
@@ -908,7 +908,7 @@ Target: `./packages/core/index.js`. Public symbols: 662.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain/core";` | `packages/core/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:105` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:106` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain/core";` | `packages/core/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/cache-evidence.js:169` |
@@ -2544,8 +2544,8 @@ Target: `./packages/core/buildchain-publication-authority.js`. Public symbols: 2
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:66` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:105` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:67` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:106` |
 
 ## `@kungfu-tech/buildchain/github-governance-authority`
 

package/docs/release-governance.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-07-31
+last_reviewed: 2026-09-08
 ai_provenance:
-  model_family: GPT-5
+  model_family: GPT-6
   product: Codex
-  generated_at: 2026-07-27
+  generated_at: 2026-09-08
   invisible_context: not asserted
 ---
 
@@ -243,15 +243,16 @@ This keeps the test channel self-describing. If a consumer checks out
 alpha ref removes routine consumer edits when Buildchain opens a newer minor,
 while exact tags and SHAs remain the reproducible audit choice.
 
-### Buildchain Alpha Self-Dogfood
+### Buildchain public build self-dogfood
 
-Buildchain continuously consumes its own current major alpha through
-`.github/workflows/self-build-alpha-dogfood.yml`. Both lanes call the
-released channel router at `build.yml@v3-alpha`. The auto lane must resolve
-`v3-alpha`; the explicit stable lane must resolve `v3`. Both execute the same
-declared install, build, and verify fixture, proving that a single consumer
-surface routes to distinct released runtimes without duplicating lifecycle
-configuration in the consumer.
+Two independent thin workflows continuously qualify the published channels.
+`self-build-alpha-dogfood.yml` calls `build.yml@v4-alpha` with zero inputs and
+runs the root project's real install, build, and verify lifecycle.
+`self-build-stable-dogfood.yml` calls `build.yml@v4` with only the nested fixture's
+`config-path`, including native and Linux container builds. Project settings
+live in TOML; the called workflow binds its exact runtime SHA and configuration
+root into the build receipts. Separate workflow validation allows each channel
+to advance independently during a breaking producer-first release.
 
 Buildchain's generic artifact-signing contract seals source-, tree-, runtime-,
 platform-, and digest-bound requests from ordinary credential-free build jobs.
@@ -717,13 +718,13 @@ status to failure, while the merge group must still produce its own final check.
 that want a stable day-to-day operations contract, Buildchain also exposes a
 patrol workflow family:
 
-| Workflow | Intended cadence | Default intent |
-| --- | --- | --- |
-| `.github/workflows/patrol-daily.yml` | daily | lightweight inspection plus ready dev PR maintenance |
-| `.github/workflows/patrol-weekly.yml` | weekly | release-state, passport, gate, and stale-state health checks as they are added |
-| `.github/workflows/patrol-monthly.yml` | monthly | governance, permission, branch-protection, and workflow drift checks as they are added |
-| `.github/workflows/patrol-observed-evidence.yml` | caller-selected schedule | validated immutable observation plus atomic last-known-good publication; no per-refresh PR |
-| `.github/workflows/stable-candidate-patrol.yml` | repository-selected release window | qualify immutable alpha candidates and open the exact source-lock stable PR |
+| Workflow                                         | Intended cadence                   | Default intent                                                                             |
+| ------------------------------------------------ | ---------------------------------- | ------------------------------------------------------------------------------------------ |
+| `.github/workflows/patrol-daily.yml`             | daily                              | lightweight inspection plus ready dev PR maintenance                                       |
+| `.github/workflows/patrol-weekly.yml`            | weekly                             | release-state, passport, gate, and stale-state health checks as they are added             |
+| `.github/workflows/patrol-monthly.yml`           | monthly                            | governance, permission, branch-protection, and workflow drift checks as they are added     |
+| `.github/workflows/patrol-observed-evidence.yml` | caller-selected schedule           | validated immutable observation plus atomic last-known-good publication; no per-refresh PR |
+| `.github/workflows/stable-candidate-patrol.yml`  | repository-selected release window | qualify immutable alpha candidates and open the exact source-lock stable PR                |
 
 The cadence names describe patrol intensity, not release cadence:
 

package/docs/reusable-build-surface.md

@@ -80,6 +80,7 @@ fail_fast = false
 [build.tools]
 node = "24"
 rust = "stable"
+go = "1.25.x" # optional; omitted toolchains are not installed
 
 [build.artifacts]
 name = "my-library"

package/docs/v4-production-release.md

@@ -43,6 +43,16 @@ ancestry, and target roots. Confirmed operations are never replayed; uncertain
 operations require provider readback before retry; stable publication requires
 an N-1 or independently sealed qualification.
 
+## Public build qualification
+
+After a successful Alpha Self-Dogfood run, Stable Candidate Qualification reads
+its exact `buildchain-summary-<source SHA>` artifact. Protected default-branch
+code verifies the source run, published alpha runtime, all three platform
+artifacts and install/build/verify evidence before writing
+`buildchain-canary/buildchain-zero-input` on that runtime commit. Manual replay
+accepts only the source run ID. This observation remains Buildchain-owned; it
+neither dispatches another repository nor grants stable publication authority.
+
 ## Provider readback
 
 A stable release is complete only when all of these coordinates agree:

package/docs/workflow-catalog.md

@@ -130,6 +130,7 @@ all related declarations. Run `pnpm run generate:workflows` and
 | [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood | — |
 | [self-build-release-verify-compat.yml](../.github/workflows/self-build-release-verify-compat.yml) | build | repository | compatibility | Release - Verify | — |
 | [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification | — |
+| [self-build-stable-dogfood.yml](../.github/workflows/self-build-stable-dogfood.yml) | build | repository | active | Buildchain Stable Self-Dogfood | — |
 | [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify | — |
 | [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood | — |
 | [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery | — |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.9-alpha.0",
+  "version": "4.0.9-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/build-configuration.js

@@ -4,7 +4,7 @@ import path from "node:path";
 // Project choices only. Provider endpoints, roles, runner labels and cache
 // transport authority belong to the selected, runtime-owned environment.
 const sections = {
-  tools: { node: "24", rust: "" },
+  tools: { node: "24", rust: "", go: "" },
   artifacts: {
     name: "buildchain-artifact", paths: ["dist", "build/stage"],
     required_paths: [], min_files: 0, max_files: Number.MAX_SAFE_INTEGER,

package/packages/core/buildchain-publication-authority.js

@@ -24,6 +24,7 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/build.yml", "non-publication-oidc"],
   [".github/workflows/bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
   [".github/workflows/self-build-alpha-dogfood.yml", "non-publication-oidc"],
+  [".github/workflows/self-build-stable-dogfood.yml", "non-publication-oidc"],
   [".github/workflows/self-ops-dev-delivery.yml", "governance-write"],
   [".github/workflows/self-ops-patrol-daily.yml", "governance-write"],
   [".github/workflows/self-ops-patrol-monthly.yml", "governance-write"],

package/scripts/check-inventory.mjs

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { parseWorkflowCallJobs } from "../packages/core/workflow-yaml-contract.js";
 import { execFileSync } from "node:child_process";
 import {
   assertPublicSurfaceReverseAudit,
@@ -160,6 +161,7 @@ const requiredPaths = [
   ".github/workflows/self-ops-patrol-weekly.yml",
   ".github/workflows/self-ops-patrol-monthly.yml",
   ".github/workflows/self-build-alpha-dogfood.yml",
+  ".github/workflows/self-build-stable-dogfood.yml",
   ".github/workflows/release-candidate-promote.yml",
   ".github/workflows/.release-candidate-promote.yml",
   ".github/workflows/release-propagation.yml",
@@ -195,10 +197,6 @@ if (rootPackage.name !== "@kungfu-tech/buildchain") {
 if (rootPackage.private !== false) {
   throw new Error("root package must be publishable with private=false");
 }
-const selfDogfoodWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/self-build-alpha-dogfood.yml"),
-  "utf8",
-);
 const selfDogfoodAlphaLock = JSON.parse(
   fs.readFileSync(path.join(root, ".buildchain/alpha-contract-lock.json"), "utf8"),
 );
@@ -276,16 +274,13 @@ for (const channel of ["alpha-contract-lock.json", "contract-lock.json"]) {
   if (!evaluation.ok || lock.buildchain.ref !== ref)
     throw new Error(`${channel}: invalid accepted runtime contract`);
 }
-for (const requiredSnippet of [
-  `/.github/workflows/build.yml@v${selfDogfoodMajor}-alpha`,
-  "buildchain-channel: auto",
-  "buildchain-channel: stable",
-  `const alphaRef = "v${selfDogfoodMajor}-alpha"`,
-  `const stableRef = "v${selfDogfoodMajor}"`,
-]) {
-  if (!selfDogfoodWorkflow.includes(requiredSnippet)) {
-    throw new Error(`Buildchain self-dogfood workflow missing current-major snippet: ${requiredSnippet}`);
-  }
+for (const [channel, ref] of [["alpha", `v${selfDogfoodMajor}-alpha`], ["stable", `v${selfDogfoodMajor}`]]) {
+  const workflow = fs.readFileSync(path.join(root, `.github/workflows/self-build-${channel}-dogfood.yml`), "utf8");
+  if (!workflow.includes(`/.github/workflows/build.yml@${ref}`) || /steps:|buildchain-channel:|runner-preset:|working-directory:/u.test(workflow)) throw new Error(`${channel} self-dogfood must remain a thin public TOML build caller`);
+  if (!workflow.includes(`group: buildchain-${channel}-self-dogfood-`) || !workflow.includes("cancel-in-progress: false")) throw new Error(`${channel} self-dogfood must serialize its own runs`);
+  const expectedInputs = channel === "alpha" ? [] : ["config-path"];
+  const call = parseWorkflowCallJobs(workflow).find((job) => job.id === `${channel}-consumer`);
+  if (JSON.stringify(Object.keys(call.with || {})) !== JSON.stringify(expectedInputs)) throw new Error(`${channel} self-dogfood input contract drift`);
 }
 const reusableBuildWorkflow = fs.readFileSync(
   path.join(root, ".github/workflows/.build.yml"),
@@ -382,14 +377,6 @@ for (const workflow of [channelBuildWorkflow, reusableBuildWorkflow]) {
 if ((channelBuildWorkflow.match(/uses: \.\/\.github\/workflows\/\.build\.yml/g) || []).length !== 1) {
   throw new Error("public build facade must invoke its exact backbone once");
 }
-for (const requiredSnippet of [
-  "group: buildchain-release-promotion-${{ github.repository }}",
-  "cancel-in-progress: false",
-]) {
-  if (!selfDogfoodWorkflow.includes(requiredSnippet)) {
-    throw new Error(`Buildchain self-dogfood workflow missing promotion serialization: ${requiredSnippet}`);
-  }
-}
 const actionlintConfig = fs.readFileSync(
   path.join(root, ".github/actionlint.yaml"),
   "utf8",

package/scripts/check-maintainability.mjs

@@ -82,15 +82,30 @@ function revisionAvailable(root, revision) {
   }
 }
 
-function ensureRevisionAvailable(root, revision) {
+function ensureRevisionAvailable(
+  root,
+  revision,
+  {
+    fetchRevision = () =>
+      gitOutput(root, ["fetch", "--no-tags", "--depth=1", "origin", revision]),
+  } = {},
+) {
   if (revisionAvailable(root, revision)) return false;
-  try {
-    gitOutput(root, ["fetch", "--no-tags", "--depth=1", "origin", revision]);
-  } catch (error) {
-    const detail = String(error?.stderr || error?.message || error).trim();
-    throw new Error(
-      `maintainability revision ${revision} is unavailable and could not be fetched from origin${detail ? `: ${detail}` : ""}`,
-    );
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      fetchRevision();
+      break;
+    } catch (error) {
+      const detail = String(error?.stderr || error?.message || error).trim();
+      if (
+        attempt < 2 &&
+        /shallow file has changed since we read it/u.test(detail)
+      )
+        continue;
+      throw new Error(
+        `maintainability revision ${revision} is unavailable and could not be fetched from origin${detail ? `: ${detail}` : ""}`,
+      );
+    }
   }
   if (!revisionAvailable(root, revision)) {
     throw new Error(

package/scripts/resolve-build-configuration.mjs

@@ -45,7 +45,7 @@ export function resolveBuildConfiguration({ root, locator = "", workflowRef, wor
     return selected;
   };
   const evidence = (relative) => relative ? JSON.stringify(JSON.parse(fs.readFileSync(containedBuildPath(root, projectPath(relative)), "utf8"))) : "";
-  const dependencyFiles = ["pnpm-lock.yaml", "package-lock.json", "Cargo.lock"].map(projectPath).filter((file) => fs.existsSync(path.join(root, file)));
+  const dependencyFiles = ["pnpm-lock.yaml", "package-lock.json", "Cargo.lock", "go.sum"].map(projectPath).filter((file) => fs.existsSync(path.join(root, file)));
   const plan = {
     schema: "buildchain.build-plan/v1", project,
     configuration_root: digest(fs.readFileSync(loaded.filePath)),
@@ -59,7 +59,7 @@ export function resolveBuildConfiguration({ root, locator = "", workflowRef, wor
     environment, environment_root: rootOf(environment),
     build,
     lifecycle: Object.fromEntries(["install", "build", "verify"].map((stage) => [stage, { required: stage === "build" || Boolean(loaded.config.lifecycle?.[stage]), configured: Boolean(loaded.config.lifecycle?.[stage]) }])),
-    tools: { node: build.tools.node, setup_node: Boolean(build.tools.node), rust: build.tools.rust || "stable", setup_rust: Boolean(build.tools.rust) },
+    tools: { node: build.tools.node, setup_node: Boolean(build.tools.node), rust: build.tools.rust || "stable", setup_rust: Boolean(build.tools.rust), go: build.tools.go, setup_go: Boolean(build.tools.go) },
     artifacts: {
       name: build.artifacts.name,
       paths: build.artifacts.paths.map(projectPath).join("\n"),