@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/scripts/check-code-layout.mjs

@@ -0,0 +1,386 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import ts from "typescript";
+import { parse as parseYaml } from "yaml";
+import { actionInventory } from "../packages/core/contracts/action-inventory.js";
+import { inspectActionTaxonomy } from "../packages/core/contracts/action-taxonomy.js";
+import {
+  inspectWorkflowJob,
+  localActionDirectory,
+} from "./workflow-action-graph.mjs";
+
+function filesBelow(root, relative) {
+  return fs
+    .readdirSync(path.join(root, relative), {
+      withFileTypes: true,
+      recursive: true,
+    })
+    .filter((entry) => entry.isFile())
+    .map((entry) =>
+      path
+        .relative(root, path.join(entry.parentPath, entry.name))
+        .split(path.sep)
+        .join("/"),
+    )
+    .filter(
+      (file) => !file.includes("/node_modules/") && !file.includes("/dist/"),
+    );
+}
+
+export function inspectModuleDependencies(root, files) {
+  const issues = [];
+  const edges = [];
+  for (const file of files.filter((file) => /\.(?:mjs|cjs|js)$/u.test(file))) {
+    const source = ts.createSourceFile(
+      file,
+      fs.readFileSync(path.join(root, file), "utf8"),
+      ts.ScriptTarget.Latest,
+      true,
+    );
+    function visit(node) {
+      if (
+        ts.isStringLiteral(node) ||
+        ts.isNoSubstitutionTemplateLiteral(node)
+      ) {
+        const parent = node.parent;
+        const declaration =
+          (ts.isImportDeclaration(parent) || ts.isExportDeclaration(parent)) &&
+          parent.moduleSpecifier === node;
+        const call =
+          ts.isCallExpression(parent) &&
+          parent.arguments[0] === node &&
+          (parent.expression.kind === ts.SyntaxKind.ImportKeyword ||
+            ["require", "require.resolve"].includes(
+              parent.expression.getText(source),
+            ));
+        if ((declaration || call) && node.text.startsWith(".")) {
+          const target = path.posix.normalize(
+            path.posix.join(path.posix.dirname(file), node.text),
+          );
+          edges.push({ from: file, to: target });
+          if (!fs.existsSync(path.join(root, target)))
+            issues.push(`${file}: missing module ${target}`);
+          if (
+            file.startsWith("packages/core/") &&
+            !target.startsWith("packages/core/")
+          )
+            issues.push(
+              `${file}: runtime dependency escapes its layer: ${target}`,
+            );
+          if (
+            file.startsWith("bin/") &&
+            !target.startsWith("bin/") &&
+            !target.startsWith("packages/core/")
+          )
+            issues.push(
+              `${file}: CLI dependency escapes its layers: ${target}`,
+            );
+        }
+      }
+      ts.forEachChild(node, visit);
+    }
+    visit(source);
+  }
+  return { edges, issues };
+}
+
+function scriptLines(step) {
+  return Math.max(
+    ...[step.run, step.with?.script].map((value) =>
+      typeof value === "string" ? value.trim().split("\n").length : 0,
+    ),
+  );
+}
+
+export function inspectCompositeSteps(metadata, label) {
+  const issues = [];
+  if (/\boutputs\.[\w-]*(?:fromJSON|toJSON)\(/u.test(JSON.stringify(metadata)))
+    issues.push(
+      `${label}: output property contains an invalid expression call`,
+    );
+  for (const step of metadata.runs?.steps || []) {
+    const location = `${label}/${step.id || step.name || "step"}`;
+    if (typeof step.uses !== "string" || !step.uses.trim())
+      issues.push(
+        `${location}: composite steps must invoke an action with uses`,
+      );
+    for (const key of ["run", "shell", "working-directory"])
+      if (Object.hasOwn(step, key))
+        issues.push(`${location}: composite cannot own ${key}`);
+    if (Object.hasOwn(step.with || {}, "script"))
+      issues.push(
+        `${location}: composite cannot pass executable script to another action`,
+      );
+  }
+  return issues;
+}
+
+export function inspectWorkflowNodes(source, label, budgets) {
+  const issues = [];
+  const workflow = parseYaml(source);
+  for (const event of ["workflow_call", "workflow_dispatch"]) {
+    const declaration = workflow.on?.[event];
+    for (const field of ["inputs", "outputs", "secrets"]) {
+      if (!declaration || !Object.hasOwn(declaration, field)) continue;
+      const value = declaration[field];
+      if (!value || typeof value !== "object" || Array.isArray(value))
+        issues.push(
+          `${label}: ${event}.${field} must be a mapping when declared`,
+        );
+    }
+  }
+  for (const [id, job] of Object.entries(workflow.jobs || {})) {
+    if (!job.steps) continue;
+    if (job.steps.length > budgets.workflowStepsPerJob)
+      issues.push(
+        `${label}#${id}: ${job.steps.length} steps exceed ${budgets.workflowStepsPerJob} semantic nodes`,
+      );
+    for (const step of job.steps) {
+      if (scriptLines(step) > budgets.workflowInlineScriptLines)
+        issues.push(
+          `${label}#${id}/${step.id || step.name}: workflow contains executable implementation`,
+        );
+    }
+  }
+  return issues;
+}
+
+export function inspectCompositeAdmission(root, workflow, label = "workflow") {
+  const issues = [];
+  for (const [name, job] of Object.entries(workflow.jobs || {})) {
+    for (const step of job.steps || []) {
+      if (
+        Object.values(step.with || {}).some((value) =>
+          /^\$\{\{\s*(?:toJSON\(\s*)?job\.status\s*\)?\s*\}\}$/.test(
+            String(value),
+          ),
+        )
+      )
+        issues.push(`${label}#${name}: action inputs freeze live job.status`);
+    }
+    for (let index = 0; index + 2 < (job.steps?.length || 0); index++) {
+      const [source, loader, call] = job.steps.slice(index, index + 3);
+      if (
+        !source.uses?.startsWith("actions/checkout@") ||
+        source.with?.path ||
+        !loader.uses?.startsWith("actions/checkout@") ||
+        call.id !== "node" ||
+        !call.uses?.startsWith("./.buildchain/")
+      )
+        continue;
+      const outcome = `\${{ steps.${source.id}.outcome }}`;
+      const actionPath = `${call.uses.replace(/^\.\/\.buildchain\/(?:workflow-shell|runtime)\//, "")}/action.yml`;
+      if (
+        loader.if !== "${{ always() }}" ||
+        call.if !== "${{ always() }}" ||
+        call.with?.["source-checkout-outcome"] !== outcome
+      ) {
+        issues.push(
+          `${label}#${name}: source checkout failure cannot reach node diagnostics`,
+        );
+        continue;
+      }
+      const metadata = parseYaml(
+        fs.readFileSync(path.join(root, actionPath), "utf8"),
+      );
+      const guard = metadata.runs.steps?.[0];
+      if (
+        guard?.id !== "source-boundary" ||
+        guard.if !== "${{ always() }}" ||
+        localActionDirectory(guard.uses) !== "actions/build/source/admit" ||
+        guard.with?.["source-checkout-outcome"] !==
+          "${{ inputs.source-checkout-outcome }}"
+      )
+        issues.push(
+          `${label}#${name}: failed source checkout can execute node business steps`,
+        );
+    }
+  }
+  return issues;
+}
+
+export function inspectPublicActionNodes(actions, publicNodes) {
+  const issues = [];
+  if (!Array.isArray(publicNodes))
+    return ["public Action registry must be an array"];
+  const known = new Set(
+    actions.map((action) => action.directory.replace(/^actions\//u, "")),
+  );
+  const seen = new Set();
+  for (const node of publicNodes) {
+    if (seen.has(node)) issues.push(`duplicate public Action node: ${node}`);
+    if (!known.has(node)) issues.push(`unknown public Action node: ${node}`);
+    seen.add(node);
+  }
+  return issues;
+}
+
+export function inspectRequestJsonFields(graph, requestFields) {
+  const issues = [];
+  const workflowInputs =
+    graph.workflow.on?.workflow_call?.inputs ||
+    graph.workflow.on?.workflow_dispatch?.inputs ||
+    {};
+  const scopes = new Map([
+    [
+      "",
+      { inputs: new Set(Object.keys(workflowInputs)), request: requestFields },
+    ],
+  ]);
+  for (const step of graph.steps) {
+    const scope = scopes.get(step.ancestry.join(" > "));
+    if (scope?.request) {
+      for (const match of JSON.stringify(step).matchAll(
+        /fromJSON\(inputs\.request-json\)\.([a-zA-Z0-9-]+)/gu,
+      )) {
+        if (!scope.request.has(match[1]))
+          issues.push(
+            `${step.ancestry.at(-1) || "workflow"}: undeclared request field ${match[1]}`,
+          );
+      }
+    }
+    const directory = localActionDirectory(step.uses);
+    if (!directory) continue;
+    const value = step.with?.["request-json"];
+    const request =
+      value === "${{ toJSON(inputs) }}"
+        ? scope?.inputs
+        : value === "${{ inputs.request-json }}"
+          ? scope?.request
+          : undefined;
+    scopes.set([...step.ancestry, directory].join(" > "), {
+      inputs: new Set(Object.keys(graph.actions.get(directory).inputs || {})),
+      request,
+    });
+  }
+  return [...new Set(issues)];
+}
+
+export function checkCodeLayout(root) {
+  const policy = JSON.parse(
+    fs.readFileSync(path.join(root, "architecture/code-layout.json"), "utf8"),
+  );
+  const issues = [];
+  if (policy.schema !== "buildchain.code-layout/v1")
+    throw new Error("unsupported code layout schema");
+  const capabilities = new Set(policy.capabilities);
+  for (const entry of fs.readdirSync(path.join(root, "packages/core"), {
+    withFileTypes: true,
+  })) {
+    if (
+      entry.isDirectory()
+        ? !capabilities.has(entry.name)
+        : !policy.runtimeRootFiles.includes(entry.name)
+    )
+      issues.push(`packages/core/${entry.name}: undeclared runtime owner`);
+  }
+  const actions = actionInventory(root);
+  issues.push(
+    ...inspectActionTaxonomy(
+      actions,
+      JSON.parse(
+        fs.readFileSync(
+          path.join(root, "architecture/action-taxonomy.json"),
+          "utf8",
+        ),
+      ),
+    ),
+  );
+  issues.push(...inspectPublicActionNodes(actions, policy.publicActionNodes));
+  for (const file of filesBelow(root, "bin")) {
+    if (!policy.cliEntrypoints?.includes(file))
+      issues.push(`${file}: undeclared CLI entrypoint`);
+    const lines = fs
+      .readFileSync(path.join(root, file), "utf8")
+      .trim()
+      .split("\n").length;
+    if (lines > policy.budgets.cliEntryLines)
+      issues.push(`${file}: ${lines} lines exceed thin CLI entry budget`);
+  }
+  for (const action of actions) {
+    if (!capabilities.has(action.capability))
+      issues.push(`${action.directory}: undeclared capability`);
+    const metadata = fs.readFileSync(
+      path.join(root, action.directory, "action.yml"),
+      "utf8",
+    );
+    if (action.using === "composite") {
+      issues.push(
+        ...inspectCompositeSteps(parseYaml(metadata), action.directory),
+      );
+      const implementation = metadata
+        .slice(metadata.search(/^runs:/mu))
+        .trim()
+        .split("\n").length;
+      if (implementation > policy.budgets.compositeImplementationLines)
+        issues.push(
+          `${action.directory}: composite implementation has ${implementation} lines`,
+        );
+      for (const step of parseYaml(metadata).runs.steps) {
+        if (scriptLines(step) > policy.budgets.compositeInlineScriptLines)
+          issues.push(
+            `${action.directory}/${step.id || step.name}: inline implementation exceeds ${policy.budgets.compositeInlineScriptLines} lines`,
+          );
+      }
+    }
+    for (const file of filesBelow(root, action.directory).filter((file) =>
+      /\.(mjs|cjs|js)$/u.test(file),
+    )) {
+      const lines = fs
+        .readFileSync(path.join(root, file), "utf8")
+        .trim()
+        .split("\n").length;
+      if (lines > policy.budgets.actionEntryLines)
+        issues.push(`${file}: ${lines} lines exceed thin entry budget`);
+    }
+  }
+  const runtimeFiles = [
+    ...filesBelow(root, "packages/core"),
+    ...filesBelow(root, "bin"),
+    ...filesBelow(root, "actions"),
+  ];
+  const dependencies = inspectModuleDependencies(root, runtimeFiles);
+  issues.push(...dependencies.issues);
+  for (const file of filesBelow(root, ".github/workflows").filter((file) =>
+    /\.ya?ml$/u.test(file),
+  )) {
+    const source = fs.readFileSync(path.join(root, file), "utf8");
+    const workflow = parseYaml(source);
+    issues.push(...inspectCompositeAdmission(root, workflow, file));
+    issues.push(...inspectWorkflowNodes(source, file, policy.budgets));
+    const schemaPath = policy.workflowRequestSchemas?.[file];
+    const requestFields = schemaPath
+      ? new Set(
+          Object.keys(
+            JSON.parse(fs.readFileSync(path.join(root, schemaPath), "utf8"))
+              .properties,
+          ),
+        )
+      : undefined;
+    for (const jobId of Object.keys(workflow.jobs || {})) {
+      issues.push(
+        ...inspectRequestJsonFields(
+          inspectWorkflowJob(file, jobId, root),
+          requestFields,
+        ).map((issue) => `${file}#${jobId}: ${issue}`),
+      );
+    }
+  }
+  return {
+    issues,
+    actionCount: actions.length,
+    moduleEdges: dependencies.edges.length,
+  };
+}
+
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+  const result = checkCodeLayout(path.resolve(import.meta.dirname, ".."));
+  if (result.issues.length) {
+    console.error(result.issues.join("\n"));
+    process.exitCode = 1;
+  } else console.log(JSON.stringify(result));
+}

package/scripts/check-core-mechanism-inventory.mjs

@@ -18,11 +18,11 @@ const REQUIRED = [
   "invalidation",
   "providerReadback",
   "publicSurfaces",
-  "compatibilityCallers",
+  "callers",
   "sourcePaths",
   "testPaths",
-  "migrationDisposition",
-  "unresolved",
+  "implementationDisposition",
+  "closedRequirements",
 ];
 
 function loadJson(root, file) {
@@ -66,7 +66,7 @@ function listFiles(root, relativeRoot) {
 function validateRequiredDimensions(mechanism, issues) {
   for (const field of REQUIRED) {
     const value = mechanism[field];
-    const empty = ["owner", "migrationDisposition"].includes(field)
+    const empty = ["owner", "implementationDisposition"].includes(field)
       ? !String(value || "").trim()
       : !Array.isArray(value) || value.length === 0;
     if (empty) issues.push(`${mechanism.id}: ${field} is empty`);
@@ -109,6 +109,7 @@ function validateSurfaces(mechanism, surfaces, issues) {
 
 function validateGitRefStore(root, mechanism, issues) {
   const source = (mechanism.sourcePaths || [])
+    .filter((file) => fs.existsSync(path.join(root, file)))
     .map((file) => fs.readFileSync(path.join(root, file), "utf8"))
     .join("\n");
   const writesReleaseState = /refs\/heads\/buildchain\/release-state/u.test(
@@ -275,24 +276,22 @@ function validateReverseScan(root, inventory, ids, ownedSources, issues) {
 
 function checkCoreMechanismInventory({
   root = process.cwd(),
-  inventory = loadJson(
-    root,
-    "architecture/baseline-core-mechanism-inventory.json",
-  ),
+  inventory = loadJson(root, "architecture/core-mechanisms.json"),
 } = {}) {
   const issues = [];
   if (
     inventory.schemaVersion !== 1 ||
-    inventory.contract !== "kungfu-buildchain-v3-core-mechanism-inventory"
+    inventory.contract !== "buildchain.core-mechanisms/v1"
   )
     issues.push("inventory contract or schemaVersion is invalid");
   if (
-    !/^[0-9a-f]{40}$/u.test(inventory.baseline?.commit || "") ||
-    !/^[0-9a-f]{40}$/u.test(inventory.baseline?.tree || "")
+    !/^[0-9a-f]{40}$/u.test(inventory.sourceCut?.protectedDevelopmentSeed || "")
   )
-    issues.push("baseline must bind an exact commit and tree");
+    issues.push(
+      "core mechanism inventory must bind its protected development seed",
+    );
   if (inventory.maintainability?.dependencyCycles !== 0)
-    issues.push("baseline must report the exact zero-cycle result");
+    issues.push("core mechanism inventory must require zero dependency cycles");
   const surfaces = registrySurfaceIds(root);
   const ids = new Set();
   const ownedSources = new Map();
@@ -316,10 +315,12 @@ function checkCoreMechanismInventory({
     issues,
   );
   if ((inventory.mechanisms || []).length < 10)
-    issues.push("inventory must retain all ten v3 core mechanism families");
+    issues.push(
+      "inventory must retain all ten current core mechanism families",
+    );
   if (issues.length)
     throw new Error(
-      `v3 core mechanism inventory check failed:\n- ${issues.join("\n- ")}`,
+      `current core mechanism inventory check failed:\n- ${issues.join("\n- ")}`,
     );
   return {
     mechanisms: inventory.mechanisms.length,
@@ -340,7 +341,7 @@ if (
   try {
     const report = checkCoreMechanismInventory();
     console.log(
-      `v3 core mechanism inventory check passed: ${report.mechanisms} mechanisms, ${report.sourceCoordinates} owned source coordinates, ${report.authorityCoordinates} reverse-discovered authority coordinates, ${report.publicSurfaces} public surfaces across ${report.surfaceKinds.length} registry kinds, ${report.gitRefStores} Git-ref stores, ${report.dependencyCycles} dependency cycles`,
+      `current core mechanism inventory check passed: ${report.mechanisms} mechanisms, ${report.sourceCoordinates} owned source coordinates, ${report.authorityCoordinates} reverse-discovered authority coordinates, ${report.publicSurfaces} public surfaces across ${report.surfaceKinds.length} registry kinds, ${report.gitRefStores} Git-ref stores, ${report.dependencyCycles} dependency cycles`,
     );
   } catch (error) {
     console.error(error instanceof Error ? error.message : String(error));

package/scripts/check-dev-delivery-actions.mjs

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import YAML from "yaml";
+const root = process.cwd();
+const contract = JSON.parse(fs.readFileSync(path.join(root, "architecture/dev-delivery-orchestration.json"), "utf8"));
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-delivery-actionlint-"));
+try {
+  const files = [];
+  for (const node of contract.nodes) for (const implementation of node.implementations) {
+    const action = YAML.parse(fs.readFileSync(path.join(root, implementation.action), "utf8"));
+    assert.deepEqual(Object.keys(action.inputs || {}), implementation.inputs, `${implementation.action}: input contract drift`);
+    assert.deepEqual(Object.keys(action.outputs || {}), implementation.outputs, `${implementation.action}: output contract drift`);
+    if (action.runs.using === "node24") continue;
+    assert.equal(action.runs.using, "composite");
+    for (const step of action.runs.steps) {
+      assert.ok(step.uses && !step.run && !step.shell && !step.with?.script, `${implementation.action}: composite contains executable logic`);
+    }
+    const inputs = Object.fromEntries(Object.entries(action.inputs || {}).map(([name, input]) => [name, { ...input, type: "string" }]));
+    const outputs = Object.fromEntries(Object.entries(action.outputs || {}).map(([name, output]) => [name, output.value]));
+    const file = path.join(temp, `${node.id}-${files.length}.yml`);
+    fs.writeFileSync(file, YAML.stringify({ name: `Validate ${node.id} composite`, on: { workflow_call: { inputs } }, jobs: { node: { "runs-on": "ubuntu-24.04", ...(Object.keys(outputs).length ? { outputs } : {}), steps: action.runs.steps } } }));
+    files.push(file);
+  }
+  const probe = spawnSync("actionlint", ["-version"], { stdio: "ignore" });
+  const command = probe.error?.code === "ENOENT" ? "go" : "actionlint";
+  const prefix = command === "go" ? ["run", "github.com/rhysd/actionlint/cmd/actionlint@v1.7.12"] : [];
+  const result = spawnSync(command, [...prefix, "-color=false", ...files], { stdio: "inherit" });
+  if (result.error) throw result.error;
+  if (result.signal || result.status !== 0) process.exitCode = result.status || 1;
+  else console.log(`Validated ${files.length} delivery composite bodies and interfaces.`);
+} finally { fs.rmSync(temp, { recursive: true, force: true }); }

package/scripts/check-floating-consumer-policy-contract.mjs

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 import fs from "node:fs";
+import YAML from "yaml";
+import { inspectWorkflowJob } from "./workflow-action-graph.mjs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { parseYamlUses } from "../packages/core/workflow-yaml-contract.js";
+import { parseYamlUses } from "../packages/core/contracts/workflow-yaml-contract.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const read = (relative) => fs.readFileSync(path.join(root, relative), "utf8");
@@ -24,18 +26,15 @@ export function workflowJobBlock(source, job) {
 export function assertTrustGatedJobs(source, jobs) {
   for (const job of jobs) {
     const block = workflowJobBlock(source, job);
-    if (!block.includes("- trust-gate")) {
-      fail(`.build.yml job ${job} is not directly gated by trust-gate`);
+    if (!block.includes("- plan")) {
+      fail(`.build.yml job ${job} is not directly gated by plan`);
     }
   }
 }
 
 function jobDependsOn(source, job, dependency) {
-  const block = workflowJobBlock(source, job);
-  return new RegExp(
-    `^    needs:\\s*(?:${dependency}|\\[[^\\]]*\\b${dependency}\\b[^\\]]*\\])\\s*$`,
-    "mu",
-  ).test(block);
+  const needs = YAML.parse(source)?.jobs?.[job]?.needs;
+  return (Array.isArray(needs) ? needs : [needs]).includes(dependency);
 }
 
 function assertOrdered(relative, markers) {
@@ -51,17 +50,13 @@ function assertOrdered(relative, markers) {
 }
 
 export function assertPromotionCertificationWiring(source) {
-  for (const marker of [
-    "Translate and admit legacy-compatible inputs",
-    "BUILDCHAIN_PROMOTION_INPUTS_JSON: ${{ toJSON(inputs) }}",
-    "Resolve and qualify the sealed release candidate",
-    "BUILDCHAIN_RUNTIME_AUTHORIZATION_JSON",
-    "QUALIFY canonical v4 release invocation inputs",
-  ]) {
-    if (!source.includes(marker)) {
-      fail(`promotion certification is missing ${marker}`);
-    }
-  }
+  const workflow = YAML.parse(source);
+  const node = workflow?.jobs?.qualify?.steps?.find((step) => step.id === "node");
+  if (node?.uses !== "./.buildchain/workflow-shell/actions/release/promotion/qualify" ||
+      node.with?.["request-json"] !== "${{ inputs.request-json }}" ||
+      node.with?.["job-workflow-sha"] !== "${{ toJSON(job.workflow_sha) }}")
+    fail("promotion certification is missing its exact owned node and typed request binding");
+  if (!jobDependsOn(source, "apply", "qualify")) fail("promotion certification is missing before APPLY");
 }
 
 function assertPersistedSelectors() {
@@ -78,11 +73,6 @@ function assertPersistedSelectors() {
       );
       if (!match) continue;
       const selector = match[2];
-      const protectedBootstrap =
-        relative ===
-          ".github/workflows/self-ops-promotion-recovery.yml" &&
-        match[1] === ".github/workflows/.release-candidate-promote.yml" &&
-        selector === "alpha/v4/v4.0";
       const isCurrentMajor =
         selector === "v4" ||
         selector === "v4-alpha" ||
@@ -90,9 +80,8 @@ function assertPersistedSelectors() {
         /^[0-9a-f]{40}$/iu.test(selector) ||
         selector.includes("${{");
       if (
-        (isCurrentMajor || protectedBootstrap) &&
-        !["v4", "v4-alpha"].includes(selector) &&
-        !protectedBootstrap
+        isCurrentMajor &&
+        !["v4", "v4-alpha"].includes(selector)
       ) {
         offenders.push(`${relative}:${node.line} @${selector}`);
       }
@@ -117,34 +106,19 @@ export function checkFloatingConsumerPolicyContract() {
     fail("contract lock must bind the visible workflow shell");
   }
   assertPersistedSelectors();
-  assertOrdered(".github/workflows/.build.yml", [
-    "Enforce v4 floating consumer policy",
-    "Validate consumer package manager contract",
-  ]);
+  assertOrdered("packages/core/build/plan/admission.js", ["const policy = scanConsumerPolicy(", "validatePackageManagerContract({", "const lock = inspectRuntimeContract({", "assertRuntimeContractAccepted(lock)"]);
   const buildWorkflow = read(".github/workflows/.build.yml");
-  if (
-    buildWorkflow.includes("Normalize v3 expected identity aliases") ||
-    buildWorkflow.includes("buildchain-expected-channel:") ||
-    !buildWorkflow.includes(
-      "BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: ${{ fromJSON(needs.configure.outputs.plan-json).identity.channel }}",
-    ) ||
-    !buildWorkflow.includes("BUILDCHAIN_WORKFLOW_SHA: ${{ job.workflow_sha }}")
-  )
-    fail("channel builds must disambiguate dual-channel caller invocations");
-  assertTrustGatedJobs(read(".github/workflows/.build.yml"), [
-    "resolve-source",
-    "resolve-contract",
-    "controller-plan",
-    "artifact-transfer",
-    "build-native",
-    "build-linux-container",
-    "summarize",
-  ]);
-  assertOrdered(".github/workflows/publication-artifact.yml", [
-    "Enforce v4 floating consumer policy",
-    "Resolve controller identities",
-    "Install Buildchain runtime dependencies",
+  const planner = read("packages/core/build/plan/admission.js");
+  if (!planner.includes("expectedInvocationChannel: plan.identity.channel") ||
+      !buildWorkflow.includes("workflow-sha: ${{ job.workflow_sha }}") ||
+      !buildWorkflow.includes("actions/build/lifecycle/plan")) fail("build planning must bind called workflow and channel admission");
+  assertTrustGatedJobs(buildWorkflow, ["build-native", "build-container", "sign", "attest", "deliver"]);
+  assertOrdered("actions/publication/candidate/plan/action.yml", [
+    "ref: ${{ inputs.runtime-sha }}", "Prepare exact publication runtime", "Enforce v4 floating consumer policy", "Resolve controller identities",
   ]);
+  const publication = YAML.parse(read(".github/workflows/public-build-publication.yml"));
+  if (!Object.values(publication.jobs).some((job) => job.steps?.some((step) => step.uses?.endsWith("/actions/publication/candidate/plan"))))
+    fail("publication does not invoke its consumer policy node");
   const stageCanary = read(".github/workflows/public-build-stage-capsule-canary.yml");
   if (
     !stageCanary.includes("consumer-admission:") ||
@@ -154,7 +128,7 @@ export function checkFloatingConsumerPolicyContract() {
       "Stage Capsule qualification is not transitively gated by consumer admission",
     );
   }
-  const promotion = read(".github/workflows/release-candidate-promote.yml");
+  const promotion = read(".github/workflows/public-release-promote.yml");
   if (
     !promotion.includes("consumer-admission:") ||
     !jobDependsOn(promotion, "invoke", "consumer-admission")
@@ -164,17 +138,17 @@ export function checkFloatingConsumerPolicyContract() {
     );
   }
   assertPromotionCertificationWiring(
-    read(".github/workflows/.release-candidate-promote.yml"),
+    read(".github/workflows/.release-promote.yml"),
   );
   for (const [relative, marker] of [
-    ["packages/core/release-candidate.js", "consumerPolicy"],
-    ["packages/core/release-passport.js", "v4ConsumerPolicy"],
+    ["packages/core/release/release-candidate.js", "consumerPolicy"],
+    ["packages/core/release/passport/assembly-render.js", "v4ConsumerPolicy"],
     [
-      "actions/release-candidate-promote/index.js",
+      "packages/core/release/promote-candidate/release-documents.js",
       "candidate.consumerPolicy?.receiptRoot",
     ],
     [
-      "actions/release-candidate-promote/index.js",
+      "packages/core/release/promote-candidate/release-documents.js",
       "createReleaseInvocation",
     ],
   ]) {