@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/scripts/check-javascript-syntax.mjs

@@ -11,7 +11,7 @@ const files = execFileSync(
 )
   .split("\n")
   .filter((file) => [".js", ".mjs", ".cjs"].includes(path.extname(file)))
-  .filter((file) => !/^actions\/[^/]+\/dist\//u.test(file))
+  .filter((file) => !/^actions\/[^/]+\/[^/]+\/[^/]+\/dist\//u.test(file))
   .sort();
 
 const failures = [];

package/scripts/check-maintainability.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 import fs from "node:fs";
+import { projectRenamedMetrics } from "./source-metric-lineage.mjs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
@@ -19,7 +20,6 @@ import {
   evaluateTestBudgets,
   evaluateWorkflowBudgets,
 } from "./maintainability-governance.mjs";
-import { governUniversalFacadeWorkflowMetrics } from "./universal-facade-maintainability.mjs";
 import { evaluatePublicSurface } from "./maintainability-public-surface.mjs";
 
 function collectHotspots(
@@ -49,7 +49,7 @@ function collectHotspots(
     maintained.has(file) && counts.set(file, (counts.get(file) || 0) + 1);
   for (const args of [
     ["log", "-n", "500", "--format=", "--name-only"],
-    ["diff", "--name-only"],
+    ["diff", "HEAD", "--name-only"],
   ])
     for (const file of gitOutput(root, args).split("\n").filter(Boolean))
       record(file);
@@ -127,13 +127,6 @@ function ensureMaintainabilityRevisionsAvailable(
   );
 }
 
-function implementationPathAtPresent(root, historicalPath) {
-  const policyPath = path.join(root, "architecture/implementation-naming.json");
-  if (!fs.existsSync(policyPath)) return historicalPath;
-  const policy = readJson(root, "architecture/implementation-naming.json");
-  return policy.pathMigrations[historicalPath] || historicalPath;
-}
-
 function sourceMetricsAtRevision(root, revision) {
   const files = gitOutput(root, ["ls-tree", "-r", "--name-only", revision])
     .split("\n")
@@ -141,7 +134,7 @@ function sourceMetricsAtRevision(root, revision) {
     .sort();
   return Object.fromEntries(
     files.map((file) => [
-      implementationPathAtPresent(root, file),
+      file,
       analyzeSource(file, gitOutput(root, ["show", `${revision}:${file}`])),
     ]),
   );
@@ -156,7 +149,7 @@ function testMetricsAtRevision(root, revision) {
     .sort();
   return Object.fromEntries(
     files.map((file) => [
-      implementationPathAtPresent(root, file),
+      file,
       analyzeSource(file, gitOutput(root, ["show", `${revision}:${file}`])),
     ]),
   );
@@ -251,6 +244,17 @@ function evaluateRepositoryBudgets({ current, policy }) {
     ],
     ["workflowFiles", "maxWorkflowFiles", "workflow files"],
     ["workflowLines", "maxWorkflowLines", "workflow lines"],
+    ["actionDefinitions", "maxActionDefinitions", "action definitions"],
+    [
+      "actionDefinitionLines",
+      "maxActionDefinitionLines",
+      "action definition lines",
+    ],
+    [
+      "automationImplementationLines",
+      "maxAutomationImplementationLines",
+      "total automation implementation lines",
+    ],
   ];
   for (const [metric, ceiling, label] of checks) {
     if (!Number.isInteger(budgets[ceiling]) || budgets[ceiling] < 0) {
@@ -398,7 +402,13 @@ function checkMaintainability({ root = process.cwd() } = {}) {
     root,
     "architecture/internal-capabilities.json",
   );
-  const baselineFiles = sourceMetricsAtRevision(root, enforcementRevision);
+  const lineage = projectRenamedMetrics({
+    root,
+    revision: enforcementRevision,
+    metrics: sourceMetricsAtRevision(root, enforcementRevision),
+    currentPaths: new Set(Object.keys(current.files)),
+  });
+  const baselineFiles = lineage.metrics;
   const extendedSourceFiles = sourceMetricsAtRevision(
     root,
     extendedCoverageRevision,
@@ -411,18 +421,12 @@ function checkMaintainability({ root = process.cwd() } = {}) {
     root,
     extendedCoverageRevision,
   );
-  const { governed: governedCurrent, migration: facadeMigration } =
-    governUniversalFacadeWorkflowMetrics({
-      root,
-      current,
-      workflowMetricsAtRevision,
-    });
   const issues = evaluateExceptionGovernance({ policy });
   issues.push(...evaluateExceptionBudget({ policy }));
   const hotspots = collectHotspots(root, current, 20, debt.hotspots || []);
   issues.push(
     ...evaluateDebtAuthority({
-      current: governedCurrent,
+      current,
       policy,
       debt,
       capabilityIds: new Set(
@@ -438,7 +442,7 @@ function checkMaintainability({ root = process.cwd() } = {}) {
   );
   issues.push(
     ...evaluateWorkflowBudgets({
-      current: governedCurrent,
+      current,
       baselineFiles: baselineWorkflows,
       policy,
     }),
@@ -449,7 +453,6 @@ function checkMaintainability({ root = process.cwd() } = {}) {
       root,
       revision: enforcementRevision,
       policy,
-      migration: facadeMigration,
     }),
   );
   if (issues.length > 0) {
@@ -465,6 +468,7 @@ function checkMaintainability({ root = process.cwd() } = {}) {
     hydratedExtendedCoverageRevision,
     trackedFiles: current.repository.trackedFiles,
     sourceFiles: current.repository.handMaintainedSourceFiles,
+    measurementRenames: lineage.renames,
     publicSurface: current.publicSurface,
     hotspots: current.hotspots,
     governedDebtSurfaces: Object.values(debt.surfaces).reduce(

package/scripts/check-project-cut-merge-queue-admission.mjs

@@ -4,7 +4,7 @@ import {
   ProjectCutAdmissionError,
   qualifyProjectCut,
   releaseFamilyQueueLease,
-} from "./project-cut-merge-queue-admission.mjs";
+} from "../packages/core/dev-delivery/commands/project-cut-merge-queue-admission.mjs";
 
 function parseArguments(argv) {
   const options = {};

package/scripts/check-public-dogfood-contract.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import fs from "node:fs";
-import { readWorkflowTaxonomy, workflowPath } from "./workflow-taxonomy.mjs";
+import YAML from "yaml";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -33,7 +33,7 @@ jobs:
       node-version: "24"
       go-version: "1.25.x"
       install-artifact-path: node_modules/.modules.yaml
-      build-artifact-path: actions/run-lifecycle/dist/index.js
+      build-artifact-path: actions/build/lifecycle/run/dist/index.js
       verify-artifact-path: dist/site
 `;
 }
@@ -67,49 +67,157 @@ function assertNoPrivateMarkers(relative, text) {
       fail(`${relative} retains private marker ${marker}`);
 }
 
+const CANARY_PHASES = ["consumer-admission", "qualify", "reconcile"];
+const CANARY_NODES = {
+  "consumer-admission": "admit-consumer",
+  qualify: "qualify",
+  reconcile: "reconcile",
+};
+
 function assertReusableWorkflow(root) {
   const reusable = read(root, REUSABLE_PATH);
+  const workflow = YAML.parse(reusable);
+  if (!Object.hasOwn(workflow.on || {}, "workflow_call"))
+    fail("Canary must expose workflow_call");
+  const nodes = CANARY_PHASES.map((phase) => {
+    const nodePath = `actions/build/stage-capsule/${CANARY_NODES[phase]}`;
+    const call = workflow.jobs?.[phase]?.steps?.at(-1);
+    if (
+      call?.uses !== `./.buildchain/workflow-shell/${nodePath}` ||
+      call.with?.["workflow-sha"] !== "${{ job.workflow_sha }}" ||
+      call.with?.["request-json"] !== "${{ toJSON(inputs) }}"
+    )
+      fail(
+        `${REUSABLE_PATH} must bind ${phase} to its exact public node and workflow SHA`,
+      );
+    return read(root, `${nodePath}/action.yml`);
+  });
+  const qualification = YAML.parse(nodes[1]);
+  const steps = qualification.runs.steps;
+  const prepare = steps.findIndex((step) => step.id === "buildchain-runtime");
+  const consumerNode = steps.findIndex((step) =>
+    step.uses?.startsWith("actions/setup-node@"),
+  );
+  if (
+    prepare < 0 ||
+    prepare >= consumerNode ||
+    steps[prepare].uses !==
+      "./.buildchain/workflow-shell/actions/runtime/environment/prepare"
+  )
+    fail(
+      "Canary must bind the Buildchain runtime before selecting the consumer Node version",
+    );
+  if (
+    steps[consumerNode].with?.["node-version"] !==
+    "${{ fromJSON(inputs.request-json).node-version }}"
+  )
+    fail("Canary must preserve the requested consumer Node version");
+  const campaign = steps.find(
+    (step) =>
+      step.uses ===
+      "./.buildchain/runtime/actions/build/stage-capsule/qualify-consumer",
+  );
+  if (
+    campaign?.with?.["workflow-sha"] !== "${{ steps.runtime.outputs.sha }}" ||
+    campaign?.with?.["request-json"] !== "${{ inputs.request-json }}" ||
+    campaign?.with?.platform !== "${{ fromJSON(inputs.matrix-json).platform }}"
+  )
+    fail("Canary campaign lost its exact source/runtime bindings");
+  const action = YAML.parse(
+    read(root, "actions/build/stage-capsule/qualify-consumer/action.yml"),
+  );
+  if (action.runs.using !== "node24" || action.runs.main !== "dist/index.js")
+    fail(
+      "Canary must execute its qualification with the bundled Buildchain Node runtime",
+    );
+  const adapter = read(root, "packages/core/build/stage-capsule/actions.js");
   for (const binding of [
-    "workflow_call:",
-    "BUILDCHAIN_WORKFLOW_SHA: ${{ job.workflow_sha }}",
-    "CONSUMER_SOURCE_SHA: ${{ github.sha }}",
-    "- uses: actions/setup-go@v6.5.0",
-    "if: inputs.go-version != ''",
+    "runtimeRoot",
+    "runtimeSha",
+    "sourceSha: env.GITHUB_SHA",
+    "qualifyStageCapsuleConsumer",
   ])
-    if (!reusable.includes(binding))
-      fail(`${REUSABLE_PATH} is missing exact binding ${binding}`);
-  for (const stage of ["install", "build", "verify"])
-    if (!reusable.includes(`lifecycle run ${stage}`))
-      fail(`${REUSABLE_PATH} does not execute lifecycle.${stage}`);
-  for (const forbidden of [
-    "lifecycle run publish",
-    "self-hosted",
-    "secrets: inherit",
+    if (!adapter.includes(binding))
+      fail(`Canary action lost exact binding: ${binding}`);
+  const transaction = read(root, "packages/core/build/stage-capsule/canary.js");
+  for (const binding of [
+    '["install", "build", "verify"]',
+    "runLifecycle(",
+    "BUILDCHAIN_NODE: process.execPath",
+    "consumerSourceRevision: sourceSha",
+    "runtimeRef: runtimeSha",
   ])
-    if (reusable.toLowerCase().includes(forbidden))
-      fail(`${REUSABLE_PATH} contains forbidden authority ${forbidden}`);
-  if (/\baws\b/iu.test(reusable))
-    fail(`${REUSABLE_PATH} contains forbidden AWS authority`);
+    if (!transaction.includes(binding))
+      fail(`Canary lifecycle lost bound execution: ${binding}`);
+  if (steps.some((step) => step.run || step.shell))
+    fail("Canary composite must only compose actions");
+  const go = steps.find((step) => step.uses?.startsWith("actions/setup-go@"));
+  if (go?.if !== "fromJSON(inputs.request-json).go-version != ''")
+    fail("Canary must retain its optional declared Go toolchain");
+  for (const source of [reusable, ...nodes]) {
+    for (const forbidden of [
+      "lifecycle run publish",
+      "self-hosted",
+      "secrets: inherit",
+    ])
+      if (source.toLowerCase().includes(forbidden))
+        fail(`${REUSABLE_PATH} contains forbidden authority ${forbidden}`);
+    if (/\baws\b/iu.test(source))
+      fail(`${REUSABLE_PATH} contains forbidden AWS authority`);
+  }
+}
+
+function assertActionInventory(root) {
+  const allowed = new Set(
+    CANARY_PHASES.map(
+      (phase) =>
+        `actions/build/stage-capsule/${CANARY_NODES[phase]}/action.yml`,
+    ),
+  );
+  function visit(relative) {
+    for (const entry of fs.readdirSync(path.join(root, relative), {
+      withFileTypes: true,
+    })) {
+      if (entry.name === "node_modules" || entry.name === "dist") continue;
+      const child = `${relative}/${entry.name}`;
+      if (entry.isDirectory()) visit(child);
+      else if (/^action\.ya?ml$/u.test(entry.name) && !allowed.has(child)) {
+        const source = read(root, child);
+        if (
+          source.includes("actions/build/stage-capsule-canary-") ||
+          Object.values(CANARY_NODES).some((node) =>
+            source.includes(`actions/build/stage-capsule/${node}`),
+          ) ||
+          source.includes("actions/build/stage-capsule/qualify-consumer") ||
+          source.includes("actions/build/stage-capsule/aggregate-consumer") ||
+          source.includes(
+            "packages/core/build/commands/stage-capsule-qualification.mjs",
+          )
+        )
+          fail(
+            `${child} invokes private qualification outside the public Canary nodes`,
+          );
+      }
+    }
+  }
+  visit("actions");
 }
 
 function assertWorkflowInventory(root) {
   const workflowRoot = path.join(root, ".github/workflows");
-  const taxonomy = readWorkflowTaxonomy(root);
   for (const entry of fs.readdirSync(workflowRoot, { withFileTypes: true })) {
     if (!entry.isFile() || !/\.ya?ml$/u.test(entry.name)) continue;
     let relative = `.github/workflows/${entry.name}`;
     const text = read(root, relative);
-    const canonical = taxonomy?.entries.find(
-      (item) => workflowPath(item) === relative && item.compatibility,
-    );
-    if (canonical) {
-      if (read(root, canonical.compatibility.path) !== text)
-        fail(`${relative} differs from its public compatibility identity`);
-      relative = canonical.compatibility.path;
-    }
     if (
       relative !== REUSABLE_PATH &&
-      text.includes("scripts/stage-capsule-qualification.mjs")
+      (text.includes(
+        "packages/core/build/commands/stage-capsule-qualification.mjs",
+      ) ||
+        text.includes("actions/build/stage-capsule-canary-") ||
+        Object.values(CANARY_NODES).some((node) =>
+          text.includes(`actions/build/stage-capsule/${node}`),
+        ))
     )
       fail(`${relative} invokes the private qualification script directly`);
     if (
@@ -124,21 +232,35 @@ function assertWorkflowInventory(root) {
 
 function assertProtectedVerify(root) {
   const verify = read(root, ".github/workflows/self-build-verify.yml");
+  const parsed = YAML.parse(verify);
+  const nodePath = "actions/build/verification/repository/action.yml";
+  if (
+    parsed.jobs.check.needs !== "stage-capsule-checkpoints" ||
+    parsed.jobs.check.steps.at(-1).uses !==
+      `./.buildchain/workflow-shell/${nodePath.replace(/\/action.yml$/, "")}`
+  )
+    fail(
+      "Verify must bind the protected check node after Stage Capsule checkpoints",
+    );
+  const implementation = read(root, nodePath);
+  const steps = YAML.parse(implementation).runs.steps;
+  const qualify = steps.find((step) => step.id === "source-verification");
+  if (qualify?.uses !== "./actions/build/verification/qualify-source")
+    fail("Verify is missing its owned source qualification action");
+  const transaction = read(root, "packages/core/build/verification/source.js");
   for (const required of [
-    "needs: stage-capsule-checkpoints",
-    "name: Run declared verify lifecycle (full source tests and generated artifact checks)",
-    "node .buildchain/runtime/bin/buildchain.mjs lifecycle run verify",
-    "run: node scripts/source-verification-evidence.mjs plan",
-    "run: node scripts/source-verification-evidence.mjs seal",
+    "selectSourceVerification",
+    "qualifySourceLifecycle",
+    "sealSourceVerification",
   ])
-    if (!verify.includes(required))
+    if (!transaction.includes(required))
       fail(`Verify is missing protected gate ${required}`);
   for (const forbidden of [
     "stage-capsule-qualification:",
     "stage-capsule-qualification-reconciliation:",
-    "scripts/stage-capsule-qualification.mjs",
+    "packages/core/build/commands/stage-capsule-qualification.mjs",
   ])
-    if (verify.includes(forbidden))
+    if ((verify + implementation).includes(forbidden))
       fail(`Verify retains private dogfood path ${forbidden}`);
 }
 
@@ -183,7 +305,7 @@ function assertArchitecture(root) {
       fail(`architecture retains duplicate ${key}`);
   if (
     architecture.mode !== "shadow-only" ||
-    architecture.productionAuthority !== "v3" ||
+    architecture.productionAuthority !== "v4-native" ||
     [
       "providerEffects",
       "productionWrites",
@@ -218,9 +340,9 @@ function assertConsumerLifecycle(root) {
 
 function assertPolicySources(root) {
   for (const relative of [
-    "packages/core/stage-capsule-qualification.js",
-    "packages/core/stage-capsule-qualification-campaign.js",
-    "scripts/stage-capsule-qualification.mjs",
+    "packages/core/build/stage-capsule-qualification.js",
+    "packages/core/build/stage-capsule-qualification-campaign.js",
+    "packages/core/build/commands/stage-capsule-qualification.mjs",
     "architecture/stage-capsule-qualification.json",
     "docs/v4-stage-capsule.md",
   ])
@@ -250,6 +372,7 @@ function assertPolicySources(root) {
 export function checkPublicDogfoodContract(root = DEFAULT_ROOT) {
   assertReusableWorkflow(root);
   assertWorkflowInventory(root);
+  assertActionInventory(root);
   assertProtectedVerify(root);
   const validationRef = assertArchitecture(root);
   assertConsumerLifecycle(root);
@@ -261,7 +384,7 @@ export function checkPublicDogfoodContract(root = DEFAULT_ROOT) {
     caller: CALLER_PATH,
     reusable: REUSABLE_PATH,
     validationRef,
-    productionAuthority: "v3",
+    productionAuthority: "v4-native",
   };
 }
 

package/scripts/check-release-tail-contract.mjs

@@ -3,8 +3,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+import { inspectWorkflowJob, readWorkflow } from "./workflow-action-graph.mjs";
 
-const INVENTORY_PATH = "architecture/release-tail-contract-inventory.json";
+const INVENTORY_PATH = "architecture/release-tail-contract.json";
 const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/u;
 const SHA_PATTERN = /^[0-9a-f]{40}$/u;
 
@@ -52,10 +53,12 @@ function validateReverseScan(root, inventory, surfaces, issues) {
   const coordinates = [
     ...workflowCoordinates(root, inventory),
     ...actionCoordinates(root, inventory),
-    ...(inventory.reverseScan.configAndCliAliases || []),
+    ...(inventory.reverseScan.configAndCliCoordinates || []),
   ];
   const owned = new Map();
   for (const surface of surfaces) {
+    if (Object.hasOwn(surface, "aliases"))
+      issues.push(`${surface.id}: command aliases are forbidden`);
     for (const coordinate of surface.coordinates || []) {
       if (owned.has(coordinate))
         issues.push(
@@ -279,7 +282,7 @@ function validateContract(root, inventory, issues) {
 }
 
 function validateSurfaceInventory(inventory, issues) {
-  const surfaces = inventory.legacyExecutableSurfaces || [];
+  const surfaces = inventory.executableSurfaces || [];
   const surfaceIds = new Set();
   for (const surface of surfaces) {
     if (!surface.id || surfaceIds.has(surface.id))
@@ -287,13 +290,7 @@ function validateSurfaceInventory(inventory, issues) {
         `release-tail surface id is missing or duplicated: ${surface.id || "<empty>"}`,
       );
     surfaceIds.add(surface.id);
-    for (const field of [
-      "owner",
-      "classification",
-      "default",
-      "replacement",
-      "disposition",
-    ]) {
+    for (const field of ["owner", "classification", "default", "disposition"]) {
       if (!String(surface[field] || "").trim())
         issues.push(`${surface.id}: ${field} is empty`);
     }
@@ -305,22 +302,22 @@ function validateSurfaceInventory(inventory, issues) {
   return { surfaces, surfaceIds };
 }
 
-function validateManagedCallers(inventory, surfaceIds, issues) {
-  for (const caller of inventory.managedConsumerCallers || []) {
-    if (
-      !caller.id ||
-      !caller.repository ||
-      !caller.workflow ||
-      !caller.runtimeRef
-    )
+function validateOwnedCallers(root, inventory, surfaceIds, issues) {
+  for (const caller of inventory.ownedCallers || []) {
+    if (!caller.id || !caller.workflow || !caller.action) {
+      issues.push("owned release-tail caller is incomplete");
+      continue;
+    }
+    const workflow = readWorkflow(caller.workflow, root);
+    const reachable = Object.keys(workflow.jobs).some((jobId) =>
+      inspectWorkflowJob(caller.workflow, jobId, root).actions.has(
+        caller.action,
+      ),
+    );
+    if (!reachable)
       issues.push(
-        `managed consumer caller is incomplete: ${caller.id || "<empty>"}`,
+        `${caller.id}: owned action is not reachable from its workflow`,
       );
-    if (
-      !SHA_PATTERN.test(caller.sourceCommit || "") ||
-      !SHA_PATTERN.test(caller.sourceTree || "")
-    )
-      issues.push(`${caller.id}: managed consumer cut is not exact`);
     for (const surfaceId of caller.executableSurfaceIds || []) {
       if (!surfaceIds.has(surfaceId))
         issues.push(`${caller.id}: unknown executable surface ${surfaceId}`);
@@ -328,64 +325,58 @@ function validateManagedCallers(inventory, surfaceIds, issues) {
   }
 }
 
-function validateInventory(inventory, issues) {
+function validateInventory(root, inventory, issues) {
   if (
     inventory.schemaVersion !== 1 ||
-    inventory.contract !== "kungfu-buildchain-release-tail-contract-inventory"
+    inventory.contract !== "buildchain.release-tail-contract/v1"
   )
     issues.push("release-tail inventory identity is invalid");
   if (
-    !SHA_PATTERN.test(inventory.baseline?.commit || "") ||
-    !SHA_PATTERN.test(inventory.baseline?.tree || "")
+    !SHA_PATTERN.test(inventory.sourceCut?.protectedDevelopmentSeed || "") ||
+    inventory.sourceCut?.implementation !== "working-tree"
   )
-    issues.push("release-tail baseline must bind an exact commit and tree");
+    issues.push("release-tail inventory must identify its current source cut");
   const { surfaces, surfaceIds } = validateSurfaceInventory(inventory, issues);
-  validateManagedCallers(inventory, surfaceIds, issues);
+  validateOwnedCallers(root, inventory, surfaceIds, issues);
   return surfaces;
 }
 
-function validateMigration(inventory, issues) {
-  const migration = inventory.migration || {};
-  const window = migration.compatibilityWindow || {};
+function validateCurrentBoundary(root, inventory, issues) {
+  const boundary = inventory.currentBoundary || {};
   if (
-    window.maximumDurationDays !== 90 ||
-    window.maximumMinorLines !== 2 ||
-    window.permanentEscapeHatch !== false
+    Object.hasOwn(inventory, "migration") ||
+    Object.hasOwn(inventory, "legacyExecutableSurfaces")
   )
     issues.push(
-      "compatibility window is not bounded by time, minor lines, and no-escape policy",
+      "historical migration policy cannot authorize the current release-tail contract",
     );
-  if ((migration.publishedReleasePreservation || []).length < 3)
-    issues.push("published-release preservation rules are incomplete");
-  const codes = new Set(
-    (migration.rejectionRules || []).map((entry) => entry.code),
-  );
-  for (const code of [
-    "release-tail-command-forbidden",
-    "release-tail-alias-collision",
-    "release-tail-operation-id-missing",
-    "release-tail-readback-missing",
-    "release-tail-retry-unbounded",
-  ]) {
-    if (!codes.has(code)) issues.push(`migration rejection rules omit ${code}`);
-  }
-  const excepted = new Set(
-    (migration.exceptionLedger || []).flatMap(
-      (entry) => entry.surfaceIds || [],
-    ),
-  );
-  for (const surface of inventory.legacyExecutableSurfaces || []) {
-    if (
-      surface.classification !== "adjacent-non-tail" &&
-      !excepted.has(surface.id)
-    )
-      issues.push(
-        `${surface.id}: compatibility exception has no owner and sunset test`,
-      );
+  if (
+    boundary.compatibilityFallback !== false ||
+    boundary.commandAliases !== false
+  )
+    issues.push(
+      "current release-tail boundary forbids compatibility fallbacks and command aliases",
+    );
+  for (const kind of ["request", "invocation"]) {
+    const schema = loadJson(root, `contracts/promotion-${kind}-v1.schema.json`);
+    for (const field of boundary.retiredRequestFields || []) {
+      if (Object.hasOwn(schema.properties, field))
+        issues.push(`retired promotion command field: ${field}`);
+    }
   }
-  for (const exception of migration.exceptionLedger || []) {
-    if (!exception.owner || !exception.expires || !exception.removalTest)
-      issues.push(`${exception.id}: exception ledger entry is incomplete`);
+  const graph = inspectWorkflowJob(boundary.canonicalPublisher, "apply", root);
+  if (
+    !graph.actions.has("actions/release/promotion/candidate") ||
+    [...graph.modules.keys()].some((file) => file.includes("/promote-ref/"))
+  )
+    issues.push(
+      "canonical publisher must reach only its current provider transaction",
+    );
+  for (const step of graph.steps) {
+    for (const field of boundary.retiredRequestFields || []) {
+      if (Object.hasOwn(step.with || {}, field))
+        issues.push(`canonical APPLY forwards a retired command: ${field}`);
+    }
   }
 }
 
@@ -395,7 +386,7 @@ function checkReleaseTailContract({
   fixtures,
 } = {}) {
   const issues = [];
-  const surfaces = validateInventory(inventory, issues);
+  const surfaces = validateInventory(root, inventory, issues);
   validateTransaction(inventory, issues);
   if (fixtures) {
     for (const [fixturePath, fixture] of Object.entries(fixtures))
@@ -404,14 +395,14 @@ function checkReleaseTailContract({
     validateContract(root, inventory, issues);
   }
   const reverseScan = validateReverseScan(root, inventory, surfaces, issues);
-  validateMigration(inventory, issues);
+  validateCurrentBoundary(root, inventory, issues);
   if (issues.length)
     throw new Error(
       `release-tail contract check failed:\n- ${issues.join("\n- ")}`,
     );
   return {
     surfaces: surfaces.length,
-    managedCallers: inventory.managedConsumerCallers.length,
+    ownedCallers: inventory.ownedCallers.length,
     capabilities: inventory.declarativeContract.requiredCapabilityIds.length,
     ...reverseScan,
   };
@@ -424,7 +415,7 @@ if (
   try {
     const report = checkReleaseTailContract();
     console.log(
-      `release-tail contract check passed: ${report.surfaces} classified surfaces, ${report.coordinates} reverse-discovered coordinates, ${report.executionSites} execution sites, ${report.capabilities} declarative capabilities, ${report.managedCallers} managed callers`,
+      `release-tail contract check passed: ${report.surfaces} classified surfaces, ${report.coordinates} reverse-discovered coordinates, ${report.executionSites} execution sites, ${report.capabilities} declarative capabilities, ${report.ownedCallers} owned callers`,
     );
   } catch (error) {
     console.error(error instanceof Error ? error.message : String(error));