@kungfu-tech/buildchain 4.0.9-alpha.1 → 4.0.9-alpha.2

package/architecture/maintainability-debt.json

@@ -7,8 +7,8 @@
   },
   "totalExcessLedger": {
     "metric": "calibrated-full-dimensional-excess-v1",
-    "measuredExcess": 62215,
-    "current": 54154
+    "measuredExcess": 62190,
+    "current": 54129
   },
   "defaults": {
     "owner": "Buildchain architecture maintainers",
@@ -2270,24 +2270,24 @@
             "<anonymous@445>@445": {
               "lines": 183
             },
-            "<anonymous@1579>@1579": {
+            "<anonymous@1554>@1554": {
               "lines": 249
             },
-            "<anonymous@2585>@2585": {
+            "<anonymous@2560>@2560": {
               "lines": 188
             }
           }
         },
         "current": {
-          "lines": 2909,
+          "lines": 2884,
           "functions": {
             "<anonymous@445>@445": {
               "lines": 183
             },
-            "<anonymous@1579>@1579": {
+            "<anonymous@1554>@1554": {
               "lines": 249
             },
-            "<anonymous@2585>@2585": {
+            "<anonymous@2560>@2560": {
               "lines": 188
             }
           }
@@ -2298,10 +2298,10 @@
             "<anonymous@445>@445": {
               "lines": 180
             },
-            "<anonymous@1579>@1579": {
+            "<anonymous@1554>@1554": {
               "lines": 180
             },
-            "<anonymous@2585>@2585": {
+            "<anonymous@2560>@2560": {
               "lines": 180
             }
           }
@@ -3102,7 +3102,7 @@
       "path": "tests/build-surface.test.mjs",
       "metric": "lines",
       "baseline": 4639,
-      "current": 2909
+      "current": 2884
     },
     {
       "domain": "workflows",

package/architecture/workflow-taxonomy.json

@@ -616,7 +616,7 @@
         "originalSha256": "7280bc3e9c8b9033c74f136d5a6c6998eb0f0b1caf0184510d0f7567b24b1282"
       },
       "compatibility": null,
-      "rationale": "Classify the existing .github/workflows/buildchain-stable-candidate-qualification.yml capability without adding execution behavior."
+      "rationale": "Qualify the exact published alpha runtime observed by a successful public zero-input Buildchain build, binding its source run and three-platform artifacts without cross-repository dispatch or publication authority."
     },
     {
       "id": "candidate-lab",

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.9-alpha.1",
+    "version": "4.0.9-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -4354,5 +4354,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:e398528e54509c05569630ffcc98a04d41e831479ab921df65943b49bf077719",
-  "contractDigest": "sha256:9f8057f4cb25b751b2430064ea47a68496ada30ebe91e055f5af065656d668cf"
+  "contractDigest": "sha256:9020e79400bb4540e27298d4a035a61328a5e54306ce8a0ee3199bab76a02bd3"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-09-08T13:03:18.000Z",
-  "publishedAt": "2026-09-08T13:03:18.000Z",
+  "generatedAt": "2026-09-08T14:54:17.000Z",
+  "publishedAt": "2026-09-08T14:54:17.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e5b7450f81e4019c1d58b44de3689baad9347ace",
+  "sourceRevision": "55827a43f38b1d75cb4903247c1e126fda4032cf",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.9-alpha.1",
+    "version": "4.0.9-alpha.2",
     "versionSource": "package.json#version"
   },
   "source": {
@@ -5023,13 +5023,18 @@
       ],
       "maturity": "stable",
       "sourcePath": "docs/v4-production-release.md",
-      "digest": "sha256:3753fa5ae591dd706f4838d2b0a3e07428de8ea0a089a30b42a3820d3c2aa4d3",
+      "digest": "sha256:078404ecd65922736de17039c43d160f6e3da971921a39c3fab10f437573e3ea",
       "headings": [
         {
           "level": 1,
           "title": "Buildchain v4 production release",
           "anchor": "buildchain-v4-production-release"
         },
+        {
+          "level": 2,
+          "title": "Public build qualification",
+          "anchor": "public-build-qualification"
+        },
         {
           "level": 2,
           "title": "Provider readback",
@@ -5056,7 +5061,7 @@
           "anchor": "automatic-next-development-review"
         }
       ],
-      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: buildchain-v4-production-release\ndoc_type: runbook\nsource_level: repository-contracts + protected-provider-readback\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: unreviewed\nlast_reviewed: 2026-09-08\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-08\n  invisible_context: Provider credentials and private provider state were not read.\n---\n\n# Buildchain v4 production release\n\nBuildchain v4 is the production release authority for the `v4.0` line. The\nprotected source path is:\n\n```text\ndev/v4/v4.0 -> alpha/v4/v4.0 -> release/v4/v4.0\n```\n\nPublic consumers use `v4-alpha` for the current prerelease channel and `v4`\nfor stable, with matching stable and alpha contract locks. Exact commits and\nimmutable release tags identify retained evidence and explicitly admitted runtime\ninputs; tracked v4 reusable-workflow selectors remain `@v4` or `@v4-alpha`.\n\nBefore qualifying a new release, run `node scripts/check-universal-workflow-bootstrap.mjs`.\nThe required repository check rejects an expired or not-yet-valid candidate admission\npolicy before publication. Renew the bounded validity window through protected review;\nkeep its capability, permission, reviewer and exact-source requirements unchanged.\nHistorical publication receipts remain immutable when a later admission window expires.\n\nThe release transaction is fail-closed. The v4 provider-operation journal,\nactivation plan, stable publication fence, and partial-mutation recovery plan\nbind the exact source, qualification, policy, provider readback, protected\nancestry, and target roots. Confirmed operations are never replayed; uncertain\noperations require provider readback before retry; stable publication requires\nan N-1 or independently sealed qualification.\n\n## Provider readback\n\nA stable release is complete only when all of these coordinates agree:\n\n- `release/v4/v4.0`, `v4`, `v4.0`, and the exact `v4.0.x` tag;\n- the GitHub Release tag and attached Release Passport evidence;\n- npm `@kungfu-tech/buildchain@4.0.x`, its `gitHead`, and the `latest` tag;\n- the protected source and release transaction roots.\n\nThe alpha channel applies the same rule to `alpha/v4/v4.0`, `v4-alpha`, the\nexact alpha tag, and npm's `alpha` tag.\n\n## Non-destructive rollback\n\nRollback never rewrites an exact tag, release, package version, Passport, or\nprovider journal. Stop forward promotion and select the last verified exact\nv4 runtime through an admitted, non-persistent recovery input; keep tracked v4\nworkflow selectors on their locked floating channel. Use `release/v3/v3.0`\ncoordinate only as an explicit compatibility rollback reference. Restoring v3\nas production authority requires a new reviewed cutover; it is not an implicit\nfallback.\n\nBefore any retry, compare the current provider state with the retained\ntransaction and operation roots. Resume only missing eligible operations.\nConflicting state remains `repair-required` or terminal and must not be\nconverted into success by moving a floating ref.\n\n## Publication settlement and binary recovery\n\nPublication, next-development advancement, and binary distribution have separate\nresults. A completed native ReleaseReceipt remains publication evidence when the\nlater generated Dev PR is still pending or its enqueue call fails. SETTLE verifies\nthe immutable invocation, transaction, both provider states, receipt and Passport\nroots even when APPLY fails after publication. It has no provider write permission.\n\nAPPLY retains that exact chain before waiting for next-development in the existing GitHub Release as\n`buildchain-publication-settlement.json`; it reads the exact tag and original\n`buildchain.release.json` before adding the packet. The APPLY artifact also retains\n`delivery-summary.json`, which reports publication and next-development separately.\nA green workflow label cannot substitute for this receipt verification.\n\nRecovery verifies both its current execution chain and any already published\nsettlement against the exact tag, source and original Passport. It preserves\nthe existing settlement bytes and uses that original receipt for development\nadvancement. A corrected runtime may produce different recovery observations;\nthey do not authorize replacing the completed publication packet. Ambiguous,\ntampered or mismatched retained evidence still blocks recovery.\n\nBinary Distribution reads this settlement and the original publication Passport.\nTag creation can precede settlement, so it waits at most 160 observations, 15 seconds\napart, for missing evidence. A mismatched source, tag, Passport or receipt fails\nimmediately. It no longer requires a legacy `buildchain/release-state/*` ref for v4.\n\nThe sealed binary publisher retains the publication Passport and writes its own\nPassport as `buildchain.binary.release.json`. All v4 asset collisions are checked\nbefore uploads: identical bytes are preserved, absent assets are added, and\nconflicting bytes are rejected. Each publication authorization is retained as\n`buildchain.binary.capability-<sha256>.json`, so a fresh recovery capability does\nnot overwrite an earlier grant. Existing assets are never clobbered. Recovery uses\nthe same exact successful Binary Distribution evidence run through\n`self-release-binary-assets.yml`; it does not rebuild already admitted archives or\ncreate another npm version. Read back all three platform archives, checksums,\nboth Passports and the settlement packet before declaring distribution complete.\n\nThe native publication receipt authorizes no stable promotion and makes no claim\nthat a pending next-development PR has merged. Inspect the exact PR head, protected\nbase and merge result independently. A retry of the publication phase must first\nread retained provider facts and resume only missing operations.\n\n## Protected stable finalization\n\nA successful protected `Verify` on the release branch starts the same floating\nalpha publisher used for prereleases. The publisher creates the stable version\nPR and waits within the original transaction for protected merge and the exact\nmerged commit's successful `Verify`, before moving floating tags and completing\nthe publication receipt. Generated finalization heads are classified from their\nrooted product state and exact source tag, so their checks do not publish again.\n\nThe independent version reviewer also handles generated stable finalization PRs.\nIt requires the exact protected source parent, the rooted version-state parent,\nthe matching immutable stable tag, and byte-for-byte regeneration of the complete\ndeclared version delta. Verification uses protected source code without approval\ncredentials. A separate step approves only the verified head and enables normal\nprotected auto-merge. Changed source/base, modified PR contents, requested changes,\nfailed final checks, and timeout remain failures. Recover an interrupted run using\nthe original source and retained provider evidence; never rewrite published bytes.\n\n## Automatic next-development review\n\nAfter stable completion, the producer generates the next patch at `alpha.0`\nfrom an isolated Git checkout of the exact current protected Dev commit. The\ncheckout explicitly fetches the exact Dev commit into its own object database;\nshallow local clones alone may omit commits fetched only into `FETCH_HEAD`.\nIt retains its own index so version verification can inspect the actual\ngenerated delta, and uses the admitted runtime dependency bridge. A source\narchive without Git metadata cannot perform that verification. The publication\nreceipt remains complete if development preparation fails; recover the original\ntransaction with corrected, reviewed tooling before publishing the next version.\n\n`self-release-next-development.yml` observes a successful exact `Verify` PR run\nfor a same-repository `chore/next-development/*` branch. It executes only the\nprotected default branch runtime. The PR must have one parent equal to the\ncurrent protected Dev head. The protected generator reconstructs every tracked\nbyte, permits only the declared immediate alpha version increment, and verifies\nthe completed alpha settlement against the exact tag and original Passport.\nThe published source tree must equal the protected development base tree.\n\nThe verification step receives no approval credential and never executes PR\ncode. A separate step uses `BUILDCHAIN_APPROVAL_TOKEN`, verifies that its identity\nis the independent `kungfu-origin` CODEOWNER, rereads the exact PR/run/base, and\napproves only that commit. Existing requests for changes stop automation.\nThe exact approval is read back before queue admission with the separate\n`BUILDCHAIN_PROMOTION_TOKEN`. Required checks, CODEOWNER protection and native\nmerge-group verification remain enforced. Missing credentials or evidence,\nforks, source changes and base/head drift fail closed.\n\nThe producer waits for pending independent review and required checks with a\nbounded retry budget. Publication evidence is already durable during this wait,\nso binaries can proceed independently. The reviewer also enqueues the verified\nhead idempotently, allowing a producer interruption to leave a recoverable PR.\nAn interrupted producer run remains failed; a successful later release is needed\nto establish an uninterrupted end-to-end publication."
+      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: buildchain-v4-production-release\ndoc_type: runbook\nsource_level: repository-contracts + protected-provider-readback\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: unreviewed\nlast_reviewed: 2026-09-08\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-08\n  invisible_context: Provider credentials and private provider state were not read.\n---\n\n# Buildchain v4 production release\n\nBuildchain v4 is the production release authority for the `v4.0` line. The\nprotected source path is:\n\n```text\ndev/v4/v4.0 -> alpha/v4/v4.0 -> release/v4/v4.0\n```\n\nPublic consumers use `v4-alpha` for the current prerelease channel and `v4`\nfor stable, with matching stable and alpha contract locks. Exact commits and\nimmutable release tags identify retained evidence and explicitly admitted runtime\ninputs; tracked v4 reusable-workflow selectors remain `@v4` or `@v4-alpha`.\n\nBefore qualifying a new release, run `node scripts/check-universal-workflow-bootstrap.mjs`.\nThe required repository check rejects an expired or not-yet-valid candidate admission\npolicy before publication. Renew the bounded validity window through protected review;\nkeep its capability, permission, reviewer and exact-source requirements unchanged.\nHistorical publication receipts remain immutable when a later admission window expires.\n\nThe release transaction is fail-closed. The v4 provider-operation journal,\nactivation plan, stable publication fence, and partial-mutation recovery plan\nbind the exact source, qualification, policy, provider readback, protected\nancestry, and target roots. Confirmed operations are never replayed; uncertain\noperations require provider readback before retry; stable publication requires\nan N-1 or independently sealed qualification.\n\n## Public build qualification\n\nAfter a successful Alpha Self-Dogfood run, Stable Candidate Qualification reads\nits exact `buildchain-summary-<source SHA>` artifact. Protected default-branch\ncode verifies the source run, published alpha runtime, all three platform\nartifacts and install/build/verify evidence before writing\n`buildchain-canary/buildchain-zero-input` on that runtime commit. Manual replay\naccepts only the source run ID. This observation remains Buildchain-owned; it\nneither dispatches another repository nor grants stable publication authority.\n\n## Provider readback\n\nA stable release is complete only when all of these coordinates agree:\n\n- `release/v4/v4.0`, `v4`, `v4.0`, and the exact `v4.0.x` tag;\n- the GitHub Release tag and attached Release Passport evidence;\n- npm `@kungfu-tech/buildchain@4.0.x`, its `gitHead`, and the `latest` tag;\n- the protected source and release transaction roots.\n\nThe alpha channel applies the same rule to `alpha/v4/v4.0`, `v4-alpha`, the\nexact alpha tag, and npm's `alpha` tag.\n\n## Non-destructive rollback\n\nRollback never rewrites an exact tag, release, package version, Passport, or\nprovider journal. Stop forward promotion and select the last verified exact\nv4 runtime through an admitted, non-persistent recovery input; keep tracked v4\nworkflow selectors on their locked floating channel. Use `release/v3/v3.0`\ncoordinate only as an explicit compatibility rollback reference. Restoring v3\nas production authority requires a new reviewed cutover; it is not an implicit\nfallback.\n\nBefore any retry, compare the current provider state with the retained\ntransaction and operation roots. Resume only missing eligible operations.\nConflicting state remains `repair-required` or terminal and must not be\nconverted into success by moving a floating ref.\n\n## Publication settlement and binary recovery\n\nPublication, next-development advancement, and binary distribution have separate\nresults. A completed native ReleaseReceipt remains publication evidence when the\nlater generated Dev PR is still pending or its enqueue call fails. SETTLE verifies\nthe immutable invocation, transaction, both provider states, receipt and Passport\nroots even when APPLY fails after publication. It has no provider write permission.\n\nAPPLY retains that exact chain before waiting for next-development in the existing GitHub Release as\n`buildchain-publication-settlement.json`; it reads the exact tag and original\n`buildchain.release.json` before adding the packet. The APPLY artifact also retains\n`delivery-summary.json`, which reports publication and next-development separately.\nA green workflow label cannot substitute for this receipt verification.\n\nRecovery verifies both its current execution chain and any already published\nsettlement against the exact tag, source and original Passport. It preserves\nthe existing settlement bytes and uses that original receipt for development\nadvancement. A corrected runtime may produce different recovery observations;\nthey do not authorize replacing the completed publication packet. Ambiguous,\ntampered or mismatched retained evidence still blocks recovery.\n\nBinary Distribution reads this settlement and the original publication Passport.\nTag creation can precede settlement, so it waits at most 160 observations, 15 seconds\napart, for missing evidence. A mismatched source, tag, Passport or receipt fails\nimmediately. It no longer requires a legacy `buildchain/release-state/*` ref for v4.\n\nThe sealed binary publisher retains the publication Passport and writes its own\nPassport as `buildchain.binary.release.json`. All v4 asset collisions are checked\nbefore uploads: identical bytes are preserved, absent assets are added, and\nconflicting bytes are rejected. Each publication authorization is retained as\n`buildchain.binary.capability-<sha256>.json`, so a fresh recovery capability does\nnot overwrite an earlier grant. Existing assets are never clobbered. Recovery uses\nthe same exact successful Binary Distribution evidence run through\n`self-release-binary-assets.yml`; it does not rebuild already admitted archives or\ncreate another npm version. Read back all three platform archives, checksums,\nboth Passports and the settlement packet before declaring distribution complete.\n\nThe native publication receipt authorizes no stable promotion and makes no claim\nthat a pending next-development PR has merged. Inspect the exact PR head, protected\nbase and merge result independently. A retry of the publication phase must first\nread retained provider facts and resume only missing operations.\n\n## Protected stable finalization\n\nA successful protected `Verify` on the release branch starts the same floating\nalpha publisher used for prereleases. The publisher creates the stable version\nPR and waits within the original transaction for protected merge and the exact\nmerged commit's successful `Verify`, before moving floating tags and completing\nthe publication receipt. Generated finalization heads are classified from their\nrooted product state and exact source tag, so their checks do not publish again.\n\nThe independent version reviewer also handles generated stable finalization PRs.\nIt requires the exact protected source parent, the rooted version-state parent,\nthe matching immutable stable tag, and byte-for-byte regeneration of the complete\ndeclared version delta. Verification uses protected source code without approval\ncredentials. A separate step approves only the verified head and enables normal\nprotected auto-merge. Changed source/base, modified PR contents, requested changes,\nfailed final checks, and timeout remain failures. Recover an interrupted run using\nthe original source and retained provider evidence; never rewrite published bytes.\n\n## Automatic next-development review\n\nAfter stable completion, the producer generates the next patch at `alpha.0`\nfrom an isolated Git checkout of the exact current protected Dev commit. The\ncheckout explicitly fetches the exact Dev commit into its own object database;\nshallow local clones alone may omit commits fetched only into `FETCH_HEAD`.\nIt retains its own index so version verification can inspect the actual\ngenerated delta, and uses the admitted runtime dependency bridge. A source\narchive without Git metadata cannot perform that verification. The publication\nreceipt remains complete if development preparation fails; recover the original\ntransaction with corrected, reviewed tooling before publishing the next version.\n\n`self-release-next-development.yml` observes a successful exact `Verify` PR run\nfor a same-repository `chore/next-development/*` branch. It executes only the\nprotected default branch runtime. The PR must have one parent equal to the\ncurrent protected Dev head. The protected generator reconstructs every tracked\nbyte, permits only the declared immediate alpha version increment, and verifies\nthe completed alpha settlement against the exact tag and original Passport.\nThe published source tree must equal the protected development base tree.\n\nThe verification step receives no approval credential and never executes PR\ncode. A separate step uses `BUILDCHAIN_APPROVAL_TOKEN`, verifies that its identity\nis the independent `kungfu-origin` CODEOWNER, rereads the exact PR/run/base, and\napproves only that commit. Existing requests for changes stop automation.\nThe exact approval is read back before queue admission with the separate\n`BUILDCHAIN_PROMOTION_TOKEN`. Required checks, CODEOWNER protection and native\nmerge-group verification remain enforced. Missing credentials or evidence,\nforks, source changes and base/head drift fail closed.\n\nThe producer waits for pending independent review and required checks with a\nbounded retry budget. Publication evidence is already durable during this wait,\nso binaries can proceed independently. The reviewer also enqueues the verified\nhead idempotently, allowing a producer interruption to leave a recoverable PR.\nAn interrupted producer run remains failed; a successful later release is needed\nto establish an uninterrupted end-to-end publication."
     },
     {
       "id": "manual:v4-publication-rehearsal",

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "a9b94f9fa34a70d046035f53c5b3fb1f9e98941c1dd59715fa0a88ae0590dc52",
+    "sha256": "9df5d224c8690cb61eb7ea9a9a74d71de2b2a7fd9848763beeb16abeb0e8f964",
     "summary": {
       "cliCommandCount": 117,
       "workflowCount": 116,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "a9b94f9fa34a70d046035f53c5b3fb1f9e98941c1dd59715fa0a88ae0590dc52",
+      "sha256": "9df5d224c8690cb61eb7ea9a9a74d71de2b2a7fd9848763beeb16abeb0e8f964",
       "summary": {
         "cliCommandCount": 117,
         "workflowCount": 116,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.9-alpha.1",
+    "version": "4.0.9-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/page-registry.json

@@ -4957,13 +4957,18 @@
       ],
       "maturity": "stable",
       "sourcePath": "docs/v4-production-release.md",
-      "digest": "sha256:3753fa5ae591dd706f4838d2b0a3e07428de8ea0a089a30b42a3820d3c2aa4d3",
+      "digest": "sha256:078404ecd65922736de17039c43d160f6e3da971921a39c3fab10f437573e3ea",
       "headings": [
         {
           "level": 1,
           "title": "Buildchain v4 production release",
           "anchor": "buildchain-v4-production-release"
         },
+        {
+          "level": 2,
+          "title": "Public build qualification",
+          "anchor": "public-build-qualification"
+        },
         {
           "level": 2,
           "title": "Provider readback",
@@ -4990,7 +4995,7 @@
           "anchor": "automatic-next-development-review"
         }
       ],
-      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: buildchain-v4-production-release\ndoc_type: runbook\nsource_level: repository-contracts + protected-provider-readback\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: unreviewed\nlast_reviewed: 2026-09-08\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-08\n  invisible_context: Provider credentials and private provider state were not read.\n---\n\n# Buildchain v4 production release\n\nBuildchain v4 is the production release authority for the `v4.0` line. The\nprotected source path is:\n\n```text\ndev/v4/v4.0 -> alpha/v4/v4.0 -> release/v4/v4.0\n```\n\nPublic consumers use `v4-alpha` for the current prerelease channel and `v4`\nfor stable, with matching stable and alpha contract locks. Exact commits and\nimmutable release tags identify retained evidence and explicitly admitted runtime\ninputs; tracked v4 reusable-workflow selectors remain `@v4` or `@v4-alpha`.\n\nBefore qualifying a new release, run `node scripts/check-universal-workflow-bootstrap.mjs`.\nThe required repository check rejects an expired or not-yet-valid candidate admission\npolicy before publication. Renew the bounded validity window through protected review;\nkeep its capability, permission, reviewer and exact-source requirements unchanged.\nHistorical publication receipts remain immutable when a later admission window expires.\n\nThe release transaction is fail-closed. The v4 provider-operation journal,\nactivation plan, stable publication fence, and partial-mutation recovery plan\nbind the exact source, qualification, policy, provider readback, protected\nancestry, and target roots. Confirmed operations are never replayed; uncertain\noperations require provider readback before retry; stable publication requires\nan N-1 or independently sealed qualification.\n\n## Provider readback\n\nA stable release is complete only when all of these coordinates agree:\n\n- `release/v4/v4.0`, `v4`, `v4.0`, and the exact `v4.0.x` tag;\n- the GitHub Release tag and attached Release Passport evidence;\n- npm `@kungfu-tech/buildchain@4.0.x`, its `gitHead`, and the `latest` tag;\n- the protected source and release transaction roots.\n\nThe alpha channel applies the same rule to `alpha/v4/v4.0`, `v4-alpha`, the\nexact alpha tag, and npm's `alpha` tag.\n\n## Non-destructive rollback\n\nRollback never rewrites an exact tag, release, package version, Passport, or\nprovider journal. Stop forward promotion and select the last verified exact\nv4 runtime through an admitted, non-persistent recovery input; keep tracked v4\nworkflow selectors on their locked floating channel. Use `release/v3/v3.0`\ncoordinate only as an explicit compatibility rollback reference. Restoring v3\nas production authority requires a new reviewed cutover; it is not an implicit\nfallback.\n\nBefore any retry, compare the current provider state with the retained\ntransaction and operation roots. Resume only missing eligible operations.\nConflicting state remains `repair-required` or terminal and must not be\nconverted into success by moving a floating ref.\n\n## Publication settlement and binary recovery\n\nPublication, next-development advancement, and binary distribution have separate\nresults. A completed native ReleaseReceipt remains publication evidence when the\nlater generated Dev PR is still pending or its enqueue call fails. SETTLE verifies\nthe immutable invocation, transaction, both provider states, receipt and Passport\nroots even when APPLY fails after publication. It has no provider write permission.\n\nAPPLY retains that exact chain before waiting for next-development in the existing GitHub Release as\n`buildchain-publication-settlement.json`; it reads the exact tag and original\n`buildchain.release.json` before adding the packet. The APPLY artifact also retains\n`delivery-summary.json`, which reports publication and next-development separately.\nA green workflow label cannot substitute for this receipt verification.\n\nRecovery verifies both its current execution chain and any already published\nsettlement against the exact tag, source and original Passport. It preserves\nthe existing settlement bytes and uses that original receipt for development\nadvancement. A corrected runtime may produce different recovery observations;\nthey do not authorize replacing the completed publication packet. Ambiguous,\ntampered or mismatched retained evidence still blocks recovery.\n\nBinary Distribution reads this settlement and the original publication Passport.\nTag creation can precede settlement, so it waits at most 160 observations, 15 seconds\napart, for missing evidence. A mismatched source, tag, Passport or receipt fails\nimmediately. It no longer requires a legacy `buildchain/release-state/*` ref for v4.\n\nThe sealed binary publisher retains the publication Passport and writes its own\nPassport as `buildchain.binary.release.json`. All v4 asset collisions are checked\nbefore uploads: identical bytes are preserved, absent assets are added, and\nconflicting bytes are rejected. Each publication authorization is retained as\n`buildchain.binary.capability-<sha256>.json`, so a fresh recovery capability does\nnot overwrite an earlier grant. Existing assets are never clobbered. Recovery uses\nthe same exact successful Binary Distribution evidence run through\n`self-release-binary-assets.yml`; it does not rebuild already admitted archives or\ncreate another npm version. Read back all three platform archives, checksums,\nboth Passports and the settlement packet before declaring distribution complete.\n\nThe native publication receipt authorizes no stable promotion and makes no claim\nthat a pending next-development PR has merged. Inspect the exact PR head, protected\nbase and merge result independently. A retry of the publication phase must first\nread retained provider facts and resume only missing operations.\n\n## Protected stable finalization\n\nA successful protected `Verify` on the release branch starts the same floating\nalpha publisher used for prereleases. The publisher creates the stable version\nPR and waits within the original transaction for protected merge and the exact\nmerged commit's successful `Verify`, before moving floating tags and completing\nthe publication receipt. Generated finalization heads are classified from their\nrooted product state and exact source tag, so their checks do not publish again.\n\nThe independent version reviewer also handles generated stable finalization PRs.\nIt requires the exact protected source parent, the rooted version-state parent,\nthe matching immutable stable tag, and byte-for-byte regeneration of the complete\ndeclared version delta. Verification uses protected source code without approval\ncredentials. A separate step approves only the verified head and enables normal\nprotected auto-merge. Changed source/base, modified PR contents, requested changes,\nfailed final checks, and timeout remain failures. Recover an interrupted run using\nthe original source and retained provider evidence; never rewrite published bytes.\n\n## Automatic next-development review\n\nAfter stable completion, the producer generates the next patch at `alpha.0`\nfrom an isolated Git checkout of the exact current protected Dev commit. The\ncheckout explicitly fetches the exact Dev commit into its own object database;\nshallow local clones alone may omit commits fetched only into `FETCH_HEAD`.\nIt retains its own index so version verification can inspect the actual\ngenerated delta, and uses the admitted runtime dependency bridge. A source\narchive without Git metadata cannot perform that verification. The publication\nreceipt remains complete if development preparation fails; recover the original\ntransaction with corrected, reviewed tooling before publishing the next version.\n\n`self-release-next-development.yml` observes a successful exact `Verify` PR run\nfor a same-repository `chore/next-development/*` branch. It executes only the\nprotected default branch runtime. The PR must have one parent equal to the\ncurrent protected Dev head. The protected generator reconstructs every tracked\nbyte, permits only the declared immediate alpha version increment, and verifies\nthe completed alpha settlement against the exact tag and original Passport.\nThe published source tree must equal the protected development base tree.\n\nThe verification step receives no approval credential and never executes PR\ncode. A separate step uses `BUILDCHAIN_APPROVAL_TOKEN`, verifies that its identity\nis the independent `kungfu-origin` CODEOWNER, rereads the exact PR/run/base, and\napproves only that commit. Existing requests for changes stop automation.\nThe exact approval is read back before queue admission with the separate\n`BUILDCHAIN_PROMOTION_TOKEN`. Required checks, CODEOWNER protection and native\nmerge-group verification remain enforced. Missing credentials or evidence,\nforks, source changes and base/head drift fail closed.\n\nThe producer waits for pending independent review and required checks with a\nbounded retry budget. Publication evidence is already durable during this wait,\nso binaries can proceed independently. The reviewer also enqueues the verified\nhead idempotently, allowing a producer interruption to leave a recoverable PR.\nAn interrupted producer run remains failed; a successful later release is needed\nto establish an uninterrupted end-to-end publication."
+      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: buildchain-v4-production-release\ndoc_type: runbook\nsource_level: repository-contracts + protected-provider-readback\nconfidence: high\nsensitivity: public\nevidence_grade: A\nreview_state: unreviewed\nlast_reviewed: 2026-09-08\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-08\n  invisible_context: Provider credentials and private provider state were not read.\n---\n\n# Buildchain v4 production release\n\nBuildchain v4 is the production release authority for the `v4.0` line. The\nprotected source path is:\n\n```text\ndev/v4/v4.0 -> alpha/v4/v4.0 -> release/v4/v4.0\n```\n\nPublic consumers use `v4-alpha` for the current prerelease channel and `v4`\nfor stable, with matching stable and alpha contract locks. Exact commits and\nimmutable release tags identify retained evidence and explicitly admitted runtime\ninputs; tracked v4 reusable-workflow selectors remain `@v4` or `@v4-alpha`.\n\nBefore qualifying a new release, run `node scripts/check-universal-workflow-bootstrap.mjs`.\nThe required repository check rejects an expired or not-yet-valid candidate admission\npolicy before publication. Renew the bounded validity window through protected review;\nkeep its capability, permission, reviewer and exact-source requirements unchanged.\nHistorical publication receipts remain immutable when a later admission window expires.\n\nThe release transaction is fail-closed. The v4 provider-operation journal,\nactivation plan, stable publication fence, and partial-mutation recovery plan\nbind the exact source, qualification, policy, provider readback, protected\nancestry, and target roots. Confirmed operations are never replayed; uncertain\noperations require provider readback before retry; stable publication requires\nan N-1 or independently sealed qualification.\n\n## Public build qualification\n\nAfter a successful Alpha Self-Dogfood run, Stable Candidate Qualification reads\nits exact `buildchain-summary-<source SHA>` artifact. Protected default-branch\ncode verifies the source run, published alpha runtime, all three platform\nartifacts and install/build/verify evidence before writing\n`buildchain-canary/buildchain-zero-input` on that runtime commit. Manual replay\naccepts only the source run ID. This observation remains Buildchain-owned; it\nneither dispatches another repository nor grants stable publication authority.\n\n## Provider readback\n\nA stable release is complete only when all of these coordinates agree:\n\n- `release/v4/v4.0`, `v4`, `v4.0`, and the exact `v4.0.x` tag;\n- the GitHub Release tag and attached Release Passport evidence;\n- npm `@kungfu-tech/buildchain@4.0.x`, its `gitHead`, and the `latest` tag;\n- the protected source and release transaction roots.\n\nThe alpha channel applies the same rule to `alpha/v4/v4.0`, `v4-alpha`, the\nexact alpha tag, and npm's `alpha` tag.\n\n## Non-destructive rollback\n\nRollback never rewrites an exact tag, release, package version, Passport, or\nprovider journal. Stop forward promotion and select the last verified exact\nv4 runtime through an admitted, non-persistent recovery input; keep tracked v4\nworkflow selectors on their locked floating channel. Use `release/v3/v3.0`\ncoordinate only as an explicit compatibility rollback reference. Restoring v3\nas production authority requires a new reviewed cutover; it is not an implicit\nfallback.\n\nBefore any retry, compare the current provider state with the retained\ntransaction and operation roots. Resume only missing eligible operations.\nConflicting state remains `repair-required` or terminal and must not be\nconverted into success by moving a floating ref.\n\n## Publication settlement and binary recovery\n\nPublication, next-development advancement, and binary distribution have separate\nresults. A completed native ReleaseReceipt remains publication evidence when the\nlater generated Dev PR is still pending or its enqueue call fails. SETTLE verifies\nthe immutable invocation, transaction, both provider states, receipt and Passport\nroots even when APPLY fails after publication. It has no provider write permission.\n\nAPPLY retains that exact chain before waiting for next-development in the existing GitHub Release as\n`buildchain-publication-settlement.json`; it reads the exact tag and original\n`buildchain.release.json` before adding the packet. The APPLY artifact also retains\n`delivery-summary.json`, which reports publication and next-development separately.\nA green workflow label cannot substitute for this receipt verification.\n\nRecovery verifies both its current execution chain and any already published\nsettlement against the exact tag, source and original Passport. It preserves\nthe existing settlement bytes and uses that original receipt for development\nadvancement. A corrected runtime may produce different recovery observations;\nthey do not authorize replacing the completed publication packet. Ambiguous,\ntampered or mismatched retained evidence still blocks recovery.\n\nBinary Distribution reads this settlement and the original publication Passport.\nTag creation can precede settlement, so it waits at most 160 observations, 15 seconds\napart, for missing evidence. A mismatched source, tag, Passport or receipt fails\nimmediately. It no longer requires a legacy `buildchain/release-state/*` ref for v4.\n\nThe sealed binary publisher retains the publication Passport and writes its own\nPassport as `buildchain.binary.release.json`. All v4 asset collisions are checked\nbefore uploads: identical bytes are preserved, absent assets are added, and\nconflicting bytes are rejected. Each publication authorization is retained as\n`buildchain.binary.capability-<sha256>.json`, so a fresh recovery capability does\nnot overwrite an earlier grant. Existing assets are never clobbered. Recovery uses\nthe same exact successful Binary Distribution evidence run through\n`self-release-binary-assets.yml`; it does not rebuild already admitted archives or\ncreate another npm version. Read back all three platform archives, checksums,\nboth Passports and the settlement packet before declaring distribution complete.\n\nThe native publication receipt authorizes no stable promotion and makes no claim\nthat a pending next-development PR has merged. Inspect the exact PR head, protected\nbase and merge result independently. A retry of the publication phase must first\nread retained provider facts and resume only missing operations.\n\n## Protected stable finalization\n\nA successful protected `Verify` on the release branch starts the same floating\nalpha publisher used for prereleases. The publisher creates the stable version\nPR and waits within the original transaction for protected merge and the exact\nmerged commit's successful `Verify`, before moving floating tags and completing\nthe publication receipt. Generated finalization heads are classified from their\nrooted product state and exact source tag, so their checks do not publish again.\n\nThe independent version reviewer also handles generated stable finalization PRs.\nIt requires the exact protected source parent, the rooted version-state parent,\nthe matching immutable stable tag, and byte-for-byte regeneration of the complete\ndeclared version delta. Verification uses protected source code without approval\ncredentials. A separate step approves only the verified head and enables normal\nprotected auto-merge. Changed source/base, modified PR contents, requested changes,\nfailed final checks, and timeout remain failures. Recover an interrupted run using\nthe original source and retained provider evidence; never rewrite published bytes.\n\n## Automatic next-development review\n\nAfter stable completion, the producer generates the next patch at `alpha.0`\nfrom an isolated Git checkout of the exact current protected Dev commit. The\ncheckout explicitly fetches the exact Dev commit into its own object database;\nshallow local clones alone may omit commits fetched only into `FETCH_HEAD`.\nIt retains its own index so version verification can inspect the actual\ngenerated delta, and uses the admitted runtime dependency bridge. A source\narchive without Git metadata cannot perform that verification. The publication\nreceipt remains complete if development preparation fails; recover the original\ntransaction with corrected, reviewed tooling before publishing the next version.\n\n`self-release-next-development.yml` observes a successful exact `Verify` PR run\nfor a same-repository `chore/next-development/*` branch. It executes only the\nprotected default branch runtime. The PR must have one parent equal to the\ncurrent protected Dev head. The protected generator reconstructs every tracked\nbyte, permits only the declared immediate alpha version increment, and verifies\nthe completed alpha settlement against the exact tag and original Passport.\nThe published source tree must equal the protected development base tree.\n\nThe verification step receives no approval credential and never executes PR\ncode. A separate step uses `BUILDCHAIN_APPROVAL_TOKEN`, verifies that its identity\nis the independent `kungfu-origin` CODEOWNER, rereads the exact PR/run/base, and\napproves only that commit. Existing requests for changes stop automation.\nThe exact approval is read back before queue admission with the separate\n`BUILDCHAIN_PROMOTION_TOKEN`. Required checks, CODEOWNER protection and native\nmerge-group verification remain enforced. Missing credentials or evidence,\nforks, source changes and base/head drift fail closed.\n\nThe producer waits for pending independent review and required checks with a\nbounded retry budget. Publication evidence is already durable during this wait,\nso binaries can proceed independently. The reviewer also enqueues the verified\nhead idempotently, allowing a producer interruption to leave a recoverable PR.\nAn interrupted producer run remains failed; a successful later release is needed\nto establish an uninterrupted end-to-end publication."
     },
     {
       "id": "manual:v4-publication-rehearsal",

package/dist/site/public-surface-audit.json

@@ -10639,8 +10639,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "547dde42a349a047f2aadcfc3ee9e3e31b6a7f6bfc75b7d37e5dcff7abd15308",
-    "workflowRegistryDigest": "e5784fc8daadf6d2acb79f6e0662b7ae6b516022a57ee3f31a3997c7b60a15e2",
-    "pageRegistryDigest": "57de14408acbd57b5665078b2ff5a644c8ac8b0a43b4acd69d98b73724e03706"
+    "workflowRegistryDigest": "19481dae8234daed9017d048c655b7a1b5b4099fe30113c9ff8275686b0caa8e",
+    "pageRegistryDigest": "09db5cdb5969b1c411bb23297b1943f35e6150b1f878582b43bd11f897884c10"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-08T13:03:18.000Z",
-  "publishedAt": "2026-09-08T13:03:18.000Z",
+  "generatedAt": "2026-09-08T14:54:17.000Z",
+  "publishedAt": "2026-09-08T14:54:17.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e5b7450f81e4019c1d58b44de3689baad9347ace",
+  "sourceRevision": "55827a43f38b1d75cb4903247c1e126fda4032cf",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.9-alpha.1",
+    "version": "4.0.9-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-08T13:03:18.000Z",
-  "publishedAt": "2026-09-08T13:03:18.000Z",
+  "generatedAt": "2026-09-08T14:54:17.000Z",
+  "publishedAt": "2026-09-08T14:54:17.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e5b7450f81e4019c1d58b44de3689baad9347ace",
+  "sourceRevision": "55827a43f38b1d75cb4903247c1e126fda4032cf",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.9-alpha.1",
+    "version": "4.0.9-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -2464,7 +2464,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.9-alpha.1",
+      "introducedVersion": "4.0.9-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -3565,7 +3565,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.9-alpha.1",
+      "introducedVersion": "4.0.9-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5656,7 +5656,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.9-alpha.1",
+      "introducedVersion": "4.0.9-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5687,7 +5687,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.9-alpha.1",
+      "introducedVersion": "4.0.9-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5718,7 +5718,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.9-alpha.1",
+      "introducedVersion": "4.0.9-alpha.2",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/v4-production-release.md

@@ -43,6 +43,16 @@ ancestry, and target roots. Confirmed operations are never replayed; uncertain
 operations require provider readback before retry; stable publication requires
 an N-1 or independently sealed qualification.
 
+## Public build qualification
+
+After a successful Alpha Self-Dogfood run, Stable Candidate Qualification reads
+its exact `buildchain-summary-<source SHA>` artifact. Protected default-branch
+code verifies the source run, published alpha runtime, all three platform
+artifacts and install/build/verify evidence before writing
+`buildchain-canary/buildchain-zero-input` on that runtime commit. Manual replay
+accepts only the source run ID. This observation remains Buildchain-owned; it
+neither dispatches another repository nor grants stable publication authority.
+
 ## Provider readback
 
 A stable release is complete only when all of these coordinates agree:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.9-alpha.1",
+  "version": "4.0.9-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/stable-candidate-qualification.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createHash } from "node:crypto";
 
 const DEFAULTS = {
   buildWorkflowFile: "self-build-fixture.yml",
@@ -41,27 +42,49 @@ function optionalSha(value, label) {
   return normalized;
 }
 
-export function resolveStableCandidateQualificationCandidate({ eventName, inputCandidateSha = "", selfDogfoodEvidence } = {}) {
-  if (text(eventName) === "workflow_dispatch") {
-    return optionalSha(inputCandidateSha, "candidate SHA");
+export function validatePublicBuildRun(run, workflow, repositoryName) {
+  if (run?.repository?.full_name !== repositoryName || run?.head_repository?.full_name !== repositoryName
+    || run?.workflow_id !== workflow?.id || workflow?.path !== ".github/workflows/self-build-alpha-dogfood.yml"
+    || run?.name !== "Buildchain Alpha Self-Dogfood" || !successful(run) || !optionalSha(run?.head_sha, "source SHA")) {
+    throw new Error("qualification requires the exact successful repository-owned public build run");
   }
-  if (text(eventName) !== "workflow_run") {
-    throw new Error(`qualification candidate resolver does not admit event ${eventName || "<empty>"}`);
-  }
-  const evidence = selfDogfoodEvidence;
-  if (
-    evidence?.contract !== "kungfu-buildchain-alpha-self-dogfood"
-    || evidence?.status !== "passed"
-    || evidence?.observed?.alpha?.ref !== "v4-alpha"
-  ) {
-    throw new Error("self-dogfood evidence is not a passing v4-alpha observation");
+  return run;
+}
+
+export function resolveStableCandidateQualificationCandidate({ sourceRun, buildSummary, repositoryName } = {}) {
+  const evidence = buildSummary, runtime = evidence?.runtime;
+  if (!successful(sourceRun) || sourceRun?.repository?.full_name !== repositoryName
+    || evidence?.artifactName !== "buildchain" || evidence?.contract !== "kungfu-buildchain-build-summary" || evidence?.git?.repository !== repositoryName
+    || evidence?.git?.sha !== sourceRun?.head_sha || String(evidence?.git?.runId) !== String(sourceRun?.id)
+    || String(evidence?.git?.runAttempt) !== String(sourceRun?.run_attempt)
+    || runtime?.ref !== "v4-alpha" || runtime?.workflowShellRef !== "v4-alpha" || runtime?.class !== "alpha"
+    || runtime?.override !== false || runtime?.trustDecision !== "workflow-identity") {
+    throw new Error("public build summary does not bind the exact source run and alpha workflow identity");
   }
-  const observedSha = optionalSha(evidence.observed.alpha.sha, "observed v4-alpha SHA");
-  const expectedSha = optionalSha(evidence.observed.alpha.expectedSha, "expected v4-alpha SHA");
-  if (!observedSha || observedSha !== expectedSha) {
-    throw new Error("self-dogfood evidence does not bind observed and expected v4-alpha SHAs");
+  const platforms = evidence.platforms || [];
+  const ids = platforms.map((entry) => entry.platform?.id).sort();
+  if (evidence.platformCount !== 3 || JSON.stringify(ids) !== JSON.stringify(["linux-x64", "macos", "windows-x64"])
+    || platforms.some((entry) => entry.expectedArtifacts?.ok !== true || !/^[a-f0-9]{64}$/u.test(entry.summary?.digest || "")
+      || ["install", "build", "verify"].some((stage) => !(entry.observability?.lifecycle?.stages?.[stage]?.eventCount > 0)))) {
+    throw new Error("public build summary requires verified artifacts for all three platforms");
   }
-  return observedSha;
+  const sha = optionalSha(runtime.sha, "observed alpha SHA");
+  if (!sha) throw new Error("public build summary is missing its runtime SHA");
+  return sha;
+}
+
+export async function qualifyPublicBuild({ repositoryName, sourceRun, buildSummary }, client) {
+  const sha = resolveStableCandidateQualificationCandidate({ repositoryName, sourceRun, buildSummary });
+  const candidate = await client.resolveExactAlpha(repositoryName, sha);
+  if (!candidate || candidate.sha !== sha) throw new Error("observed runtime must be an exact published alpha, never an ancestor");
+  const context = "buildchain-canary/buildchain-zero-input";
+  const status = await client.createCommitStatus({ repository: repositoryName, sha, context,
+    targetUrl: sourceRun.html_url, description: "Zero-input public build passed on all three platforms" });
+  if (status.state !== "success") throw new Error("public build qualification status readback failed");
+  return { contract: "kungfu-buildchain-public-build-qualification/v1", candidate, sourceSha: sourceRun.head_sha,
+    runId: sourceRun.id, runAttempt: sourceRun.run_attempt, context, status: status.state,
+    summaryRoot: `sha256:${createHash("sha256").update(JSON.stringify(buildSummary)).digest("hex")}`,
+    artifacts: buildSummary.platforms.map((entry) => ({ platform: entry.platform.id, digest: entry.summary.digest })) };
 }
 
 function optionalRef(value, label) {
@@ -253,6 +276,12 @@ export function createGitHubQualificationClient({
       .sort((left, right) => String(right.created_at).localeCompare(String(left.created_at)))[0];
   }
   return {
+    async readPublicBuildRun(repositoryName, runId) {
+      if (!/^[1-9][0-9]*$/u.test(String(runId))) throw new Error("source run ID must be a positive integer");
+      const run = await api(`/repos/${repositoryName}/actions/runs/${runId}`);
+      const workflow = await api(`/repos/${repositoryName}/actions/workflows/self-build-alpha-dogfood.yml`);
+      return validatePublicBuildRun(run, workflow, repositoryName);
+    },
     async resolveExactAlpha(repositoryName, candidateSha) {
       const releases = (await api(`/repos/${repositoryName}/releases?per_page=100`)).sort((left, right) => right.tag_name.localeCompare(left.tag_name, "en", { numeric: true }));
       for (const release of releases) {
@@ -297,22 +326,18 @@ export function createGitHubQualificationClient({
 }
 
 async function main() {
-  if (bool(process.env.BUILDCHAIN_QUALIFICATION_RESOLVE_CANDIDATE, false)) {
-    let selfDogfoodEvidence;
-    if (text(process.env.BUILDCHAIN_QUALIFICATION_EVENT_NAME) === "workflow_run") {
-      const fs = await import("node:fs");
-      const evidencePath = text(process.env.BUILDCHAIN_QUALIFICATION_SELF_DOGFOOD_EVIDENCE);
-      selfDogfoodEvidence = JSON.parse(fs.readFileSync(evidencePath, "utf8"));
-    }
-    const sha = resolveStableCandidateQualificationCandidate({
-      eventName: process.env.BUILDCHAIN_QUALIFICATION_EVENT_NAME,
-      inputCandidateSha: process.env.BUILDCHAIN_QUALIFICATION_INPUT_CANDIDATE_SHA,
-      selfDogfoodEvidence,
-    });
-    process.stdout.write(`${sha}\n`);
-    if (process.env.GITHUB_OUTPUT) {
-      const fs = await import("node:fs");
-      fs.appendFileSync(process.env.GITHUB_OUTPUT, `sha=${sha}\n`);
+  if (["resolve-public-build", "qualify-public-build"].includes(process.argv[2])) {
+    const fs = await import("node:fs");
+    const repositoryName = repository(process.env.GITHUB_REPOSITORY);
+    const client = createGitHubQualificationClient({ token: process.env.GITHUB_TOKEN });
+    const sourceRun = await client.readPublicBuildRun(repositoryName, process.env.BUILDCHAIN_QUALIFICATION_RUN_ID);
+    if (process.argv[2] === "resolve-public-build") {
+      fs.appendFileSync(process.env.GITHUB_OUTPUT, `artifact-name=buildchain-summary-${sourceRun.head_sha}\n`);
+    } else {
+      const buildSummary = JSON.parse(fs.readFileSync(".buildchain/qualification/source/build-summary.json", "utf8"));
+      const result = await qualifyPublicBuild({ repositoryName, sourceRun, buildSummary }, client);
+      fs.writeFileSync(".buildchain/qualification/result.json", JSON.stringify(result, null, 2) + "\n");
+      process.stdout.write(JSON.stringify(result) + "\n");
     }
     return;
   }