@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/docs/v4-compatibility-facts.md

@@ -27,7 +27,7 @@ verified path receipt.
 ## Authority chain
 
 The package source is
-`packages/core/buildchain-compatibility-facts.json`, retained from v3 exact head
+`packages/core/governance/buildchain-compatibility-facts.json`, retained from v3 exact head
 `6b96bdad8d9f8ccf9275f27d9370a226a9c78465`. Each declaration becomes a KFR2
 predicate and relation, then enters an append-only temporal bundle. The
 registry identity binds all Fact, proof, Cut, supersession, revocation, and

package/docs/v4-declarative-release-tail-migration.md

@@ -1,43 +1,38 @@
 ---
 status: active
 period: ongoing
-theme: buildchain-v4-declarative-release-tail
-doc_type: migration-guide
+theme: buildchain-layered-architecture
+doc_type: implementation-guide
 source_level: local-files
 confidence: high
 sensitivity: public
-evidence_grade: A
-review_state: self-reviewed
-last_reviewed: 2026-08-26
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-10
 ai_provenance:
-  model_family: GPT-5
+  model_family: GPT-6
   product: Codex
-  generated_at: 2026-08-26
-  invisible_context: unavailable
+  generated_at: 2026-09-10
+  visible_context: Buildchain 4.1 source, architecture registries and local validation.
+  invisible_context_boundary: No unpublished release or external consumer qualification is claimed.
 ---
 
-# Migrate a release-candidate promotion to the v4 Provider Plane
+# Adopt the current release promotion API
 
-Persist the public workflow call at the floating major ref and keep the matching contract lock in the consumer repository:
+Call `public-release-promote.yml` with the closed `request-json` contract after
+the selected floating channel publishes this API. Keep both channel contract
+locks in the consumer repository. See [Promotion request](release-promotion-request.md)
+for the complete request and examples.
 
-```yaml
-jobs:
-  promote:
-    uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4
-    with:
-      buildchain-contract-lock-path: .buildchain/contract-lock.json
-      declarative-release-tail: true
-```
+The declaration-driven provider plane is the sole publisher. There is no mode
+switch, command-hook adapter or retained v3 execution path. Candidate identity,
+sealed artifact manifests, qualification and provider receipt roots determine
+execution and recovery.
 
-The Build/Verify workflow now uploads these candidate-owned inputs together:
+On interruption, resume the same candidate and transaction state. The workflow
+verifies the source, artifact and policy roots, then continues the incomplete
+operations. Completed publication recovery reads the existing evidence and
+preserves immutable product bytes.
 
-- `release-candidate-passport.json`
-- `release-candidate-stage-capsules.json`
-- `release-candidate-publication-qualification.json`
-- the typed payload and manifest artifacts bound by those documents
-
-Remove all v4 values for `publish-command`, `publication-gate-command`, `publication-consumer-qualification-command`, `publication-commit-command`, `release-activation-command`, `release-passport-evidence-command`, KFD/invariant command inputs, and every other `command`, `cmd`, `script`, `shell`, or `run` field. v4 admission rejects them before publication planning. Do not replace them with a wrapper script or a standalone workflow; declare provider evidence and let the reusable workflow execute the fixed Provider Plane.
-
-On interruption, rerun with the same candidate and transaction state. Buildchain verifies the candidate/source/artifact/policy roots and continues from the first missing standardized receipt. Never delete the state file to make a failed capability replay from the beginning.
-
-v3 workflow calls retain their existing command-compatible behavior. Migrating a v3 consumer is an explicit contract change, not an automatic reinterpretation.
+The 4.1 development merge is not an alpha publication. Consumer adoption waits
+for the corresponding published channel contract and refreshed locks.

package/docs/v4-production-release.md

@@ -30,6 +30,13 @@ for stable, with matching stable and alpha contract locks. Exact commits and
 immutable release tags identify retained evidence and explicitly admitted runtime
 inputs; tracked v4 reusable-workflow selectors remain `@v4` or `@v4-alpha`.
 
+When generated stable version commits make a direct alpha-to-release merge
+conflict, use the supported `publish-gate/release/v4/v4.0/<exact-alpha-version>`
+source-lock PR. Its reconciliation commit preserves the exact published alpha
+tree and admits the current release head as a parent. Verify both parents and
+tree equality before review. This ancestry preparation does not grant publication
+qualification; the protected PR checks and native stable fence still apply.
+
 Before qualifying a new release, run `node scripts/check-universal-workflow-bootstrap.mjs`.
 The required repository check rejects an expired or not-yet-valid candidate admission
 policy before publication. Renew the bounded validity window through protected review;
@@ -59,9 +66,17 @@ A stable release is complete only when all of these coordinates agree:
 
 - `release/v4/v4.0`, `v4`, `v4.0`, and the exact `v4.0.x` tag;
 - the GitHub Release tag and attached Release Passport evidence;
-- npm `@kungfu-tech/buildchain@4.0.x`, its `gitHead`, and the `latest` tag;
+- npm `@kungfu-tech/buildchain@4.0.x`, its sealed package integrity, and the `latest` tag;
 - the protected source and release transaction roots.
 
+The immutable version tag identifies the publication source. Stable finalization
+can place the release branch and floating runtime tags on a later generated
+version commit. Verify their rooted version delta and ancestry rather than
+requiring those distinct commits to be identical. Registry `gitHead`, when
+present, is additional source evidence; publishing a sealed tarball can omit it.
+The original payload manifest, published package digest and Passport retain the
+required source binding.
+
 The alpha channel applies the same rule to `alpha/v4/v4.0`, `v4-alpha`, the
 exact alpha tag, and npm's `alpha` tag.
 

package/docs/v4-publication-rehearsal.md

@@ -105,7 +105,7 @@ effect_default = "disabled"
 ```
 
 The public reusable
-[`release-tail.yml`](../.github/workflows/release-tail.yml) accepts the same
+[`public-release-tail.yml`](../.github/workflows/public-release-tail.yml) accepts the same
 capsule, candidate root, mode, state and evidence paths. Before publication,
 Buildchain dogfoods that public surface through a thin same-commit local reusable
 call with the exact PR-head or dispatch SHA as its runtime. The reusable is

package/docs/v4-runtime-ref-resume-authority.md

@@ -62,8 +62,8 @@ Normative files:
 
 - `architecture/runtime-ref-resume-authority.json`
 - `contracts/v4-runtime-ref-resume-authority-v1.schema.json`
-- `packages/core/runtime-ref-resume-authority.js`
-- `scripts/authorize-promotion-runtime-override.cjs`
+- `packages/core/consumer/runtime-ref-resume-authority.js`
+- `packages/core/release/runtime-override-authorization.js`
 
 This contract changes no v3 behavior, grants no provider mutation authority,
 and stores no credential material.

package/docs/v4-rust-wasm-production-authority.md

@@ -26,9 +26,9 @@ workflow 输入输出等副作用边界。权威契约见
 
 ## 分发与调用
 
-`packages/core/buildchain-domain.wasm` 与 JavaScript 一起提交和发布。三个生产 Action
+`packages/core/runtime/buildchain-domain.wasm` 与 JavaScript 一起提交和发布。三个生产 Action
 在构建时把完全相同的字节复制到各自 `dist/`；运行时不进入调用方仓库寻找 Rust
-源码，也不要求安装 Rust。`packages/core/domain-wasm.js` 从自身相邻路径同步读取
+源码，也不要求安装 Rust。`packages/core/runtime/domain-wasm.js` 从自身相邻路径同步读取
 artifact，先核验生成元数据中的 SHA-256，再实例化 WebAssembly 并通过封闭 JSON/bytes
 ABI 调用领域操作。
 

package/docs/v4-stage-capsule.md

@@ -182,7 +182,7 @@ authorized by this qualification.
 Focused local rehearsal:
 
 ```sh
-node scripts/stage-capsule-qualification.mjs campaign \
+node packages/core/build/commands/stage-capsule-qualification.mjs campaign \
   --work-root /tmp/buildchain-v4-stage-qualification \
   --platform linux-x64 \
   --consumer buildchain \

package/docs/web-surface-deployments.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-07-30
+last_reviewed: 2026-09-09
 ai_provenance:
-  model_family: GPT-5
+  model_family: GPT-6
   product: Codex
-  generated_at: 2026-07-30
+  generated_at: 2026-09-09
   invisible_context_boundary: No credentials, private logs, or unpublished deployment values are included.
 ---
 
@@ -185,7 +185,7 @@ floating ref, such as:
 ```yaml
 jobs:
   web:
-    uses: kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v3
     with:
       buildchain-contract-lock-path: .buildchain/contract-lock.json
       buildchain-contract-compatibility-policy: major-compatible
@@ -205,7 +205,7 @@ caller build command, and applies these rules:
 - breaking drift: fail closed before rendering, deployment planning, deploy
   apply, or release publication.
 
-The caller no longer needs to run `scripts/buildchain-contract-lock.mjs` inside
+The caller no longer needs to run `packages/core/contracts/commands/buildchain-contract-lock.mjs` inside
 its own build command. That check belongs to Buildchain because the actual
 contract world is stored in the Buildchain runtime ref being used.
 
@@ -342,7 +342,7 @@ manifest JSON, but it does not touch AWS, DNS, CloudFront, or deployment
 credentials.
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode deploy-plan \
   --cwd fixtures/web-surface-shaped \
   --source-sha aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
@@ -352,7 +352,7 @@ node scripts/web-surface.mjs \
 For manifest-only output:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode manifest \
   --cwd fixtures/web-surface-shaped \
   --source-sha aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
@@ -389,7 +389,7 @@ Deploy apply syncs the artifact, writes the deployment manifest, and invalidates
 CloudFront when a distribution id is configured:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode deploy-apply \
   --cwd fixtures/web-surface-shaped \
   --channel staging \
@@ -581,7 +581,7 @@ surface hosts. A production plan therefore rejects staging/preview host facts
 before AWS apply:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode deploy-apply \
   --cwd fixtures/web-surface-shaped \
   --plan .buildchain/web-surface-staging-plan.json \
@@ -593,7 +593,7 @@ Cleanup apply deletes preview content, deletes the preview manifest, and
 invalidates CloudFront:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode cleanup-apply \
   --cwd fixtures/web-surface-shaped \
   --event pull-request-closed \
@@ -606,7 +606,7 @@ node scripts/web-surface.mjs \
 Cleanup apply can also execute a saved cleanup plan:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode cleanup-apply \
   --cwd fixtures/web-surface-shaped \
   --plan .buildchain/web-surface-cleanup-plan.json \
@@ -630,7 +630,7 @@ Production promotion is not just `deploy-apply --channel production`. Before a
 live production apply, the reusable workflow runs:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode production-preflight \
   --cwd fixtures/web-surface-shaped \
   --plan .buildchain/web-surface-production-plan.json \
@@ -651,7 +651,7 @@ The production preflight checks that:
 After preview, staging, and production apply, the workflow runs:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode health-check \
   --cwd fixtures/web-surface-shaped \
   --result .buildchain/web-surface-production-apply.json \
@@ -725,7 +725,7 @@ an apply-mode plan, or the explicit `cleanup-apply` executor with preview-only
 credentials:
 
 ```bash
-node scripts/web-surface.mjs \
+node packages/core/web/commands/web-surface.mjs \
   --mode cleanup-plan \
   --cwd fixtures/web-surface-shaped \
   --event pull-request-closed \
@@ -741,13 +741,13 @@ auditable no-op when no aliases are requested.
 
 ## Reusable Workflow Shape
 
-Buildchain ships `.github/workflows/.web-surface.yml` for repositories that want
+Buildchain ships `.github/workflows/public-release-web.yml` for repositories that want
 the standard PR review and promotion flow without copying bespoke glue:
 
 ```yaml
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v3
     with:
       build-command: npm run build
       verify-command: npm run check
@@ -783,7 +783,7 @@ on:
 
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v3
     with:
       buildchain-ref: ${{ inputs.buildchain-ref || '' }}
       build-command: pnpm run build
@@ -811,7 +811,7 @@ permissions:
 
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v3
     with:
       build-command: pnpm run build
       verify-command: pnpm run check
@@ -905,7 +905,7 @@ For release-PR publishing, callers opt in explicitly:
 ```yaml
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v3
     with:
       build-command: npm run build
       verify-command: npm run check
@@ -956,17 +956,11 @@ that behind the fallback `github.token`. The handoff JSON and job summary report
 the manual PR creation command. If the repository intentionally uses another
 narrow token, pass it through `production-release-pr-token`.
 
-`production-release-app-id` remains accepted as a deprecated alias for the input
-name, but the value should be the GitHub App client id. GitHub App numeric App
-IDs and client IDs are distinct, and Buildchain passes the value to
-`actions/create-github-app-token` through its non-deprecated `client-id` input so
-new runs do not emit the deprecated `app-id` warning.
-
 If a repository already generates its own narrow token or PAT, it can still pass
 that through `production-release-pr-token`:
 
 ```yaml
-with:
+secrets:
   production-release-pr-token: ${{ secrets.BUILDCHAIN_RELEASE_PR_TOKEN }}
 ```
 
@@ -1051,7 +1045,7 @@ excludes the immutable root from mutable deletion.
 Local verification:
 
 ```sh
-node scripts/installer-publication.mjs \
+node packages/core/publication/commands/installer-publication.mjs \
   --manifest dist/installer-publication.json \
   --artifact-root dist
 ```
@@ -1062,7 +1056,7 @@ with `max-age` no greater than 300 seconds; immutable routes require at least
 one year and the `immutable` directive:
 
 ```sh
-node scripts/installer-publication.mjs \
+node packages/core/publication/commands/installer-publication.mjs \
   --manifest dist/installer-publication.json \
   --public-readback
 ```

package/docs/workflow-catalog.md

@@ -8,149 +8,104 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-05
+last_reviewed: 2026-09-09
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-05
-  visible_context: Repository workflow source and the approved naming scheme
-  invisible_context_boundary: No credentials or unpublished provider configuration inspected
+  generated_at: 2026-09-09
+  visible_context: Canonical Buildchain workflow ownership and source files
+  invisible_context_boundary: No private credentials or unpublished consumer state inspected
 ---
 
 # Workflow catalog
 
-Generated from `architecture/workflow-taxonomy.json`; edit that source, then run
-`pnpm run generate:workflows`. Every YAML file, including compatibility paths,
-is checked by the existing required workflow check.
+Generated from `architecture/workflow-taxonomy.json`. Every workflow has one canonical implementation; alternate paths and historical forwarding aliases are rejected.
 
-## Naming and ownership
+Public workflows own the consumer API. Component workflows own reusable multi-job topology. Self workflows own Buildchain repository automation. Actions own execution steps; JS adapters and Rust/WASM own implementation.
 
-`public-<build|release|ops>-<purpose>.yml` is a consumer entry;
-`.<build|release|ops>-<purpose>.yml` is an advanced component;
-`self-<build|release|ops>-<purpose>.yml` is Buildchain's own automation.
-Public is a product role, not GitHub access control. Dispatch services are
-marked separately from reusable workflows. Keep workflow names, job IDs,
-permissions, and trigger semantics stable during path migration.
+Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and `self-<category>-<purpose>.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.
 
-## Channel rollout
-
-Canonical names become callable on a channel only after that channel publishes
-them. Existing `@v4`/`@v4-alpha` consumers keep their exact registered legacy
-paths until provider readback proves canonical availability. New examples below
-describe the target surface, not a claim that both channels already publish it.
-Compatibility files are generated byte-identical projections, not independently
-editable implementations. They retain full jobs to preserve called-workflow
-identity, permission envelopes, and required check names without extra nesting.
-
-The controller registry records the actual source path separately from a migrated
-repository controller contractPath. This preserves the established logical
-contract identity while exposing its current execution source. New workflows
-do not acquire historical identities. Public controllers retain their real
-compatibility paths while those paths remain supported.
-
-## Adding or changing a workflow
-
-Register a stable identity, role, category, purpose, owner, lifecycle status,
-invocation and concrete summary before creating its derived path. A new entry
-must explain its scope in review. New aliases cannot be invented: compatibility
-must name an exact migration source with a reason and removal condition.
-The policy, generator, checker, tests, required CI chain and CODEOWNERS require
-independent `kungfu-origin` review. No wildcard compatibility admission is allowed.
-Workflow filenames cannot contain version tokens such as `v4` or `v5`.
-Retired aliases cannot be recreated or called; see [path migration](workflow-path-migration.md).
-
-A role, category or implementation edit must preserve or deliberately update
-all related declarations. Run `pnpm run generate:workflows` and
-`pnpm run check:workflows`; the full `pnpm run check` remains required.
+Register ownership before adding a workflow. `pnpm run check:workflows` validates source, calls, required CI integration and independent review ownership. `pnpm run generate:workflows` regenerates this catalog.
 
 ## public
 
-| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
-| --- | --- | --- | --- | --- | --- |
-| [public-build-adopter-qualification.yml](../.github/workflows/public-build-adopter-qualification.yml) | build | reusable | active | V4 Adopter Delivery | — |
-| [public-build-candidate.yml](../.github/workflows/public-build-candidate.yml) | build | reusable | active | Buildchain Channel Build | `build.yml` |
-| [public-build-check.yml](../.github/workflows/public-build-check.yml) | build | reusable | active | Buildchain Check | `check.yml` |
-| [public-build-demo.yml](../.github/workflows/public-build-demo.yml) | build | reusable | active | Buildchain Declarative Binary Auditable Demo | `.declarative-auditable-demo.yml` |
-| [public-build-publication.yml](../.github/workflows/public-build-publication.yml) | build | reusable | active | Buildchain Publication Artifact | `publication-artifact.yml` |
-| [public-build-stage-capsule-canary.yml](../.github/workflows/public-build-stage-capsule-canary.yml) | build | reusable | active | V4 Stage Capsule Canary | — |
-| [public-ops-alpha-candidate-patrol.yml](../.github/workflows/public-ops-alpha-candidate-patrol.yml) | ops | reusable | active | Buildchain Dev to Alpha Candidate Patrol | `dev-alpha-candidate-patrol.yml` |
-| [public-ops-bootstrap-recovery.yml](../.github/workflows/public-ops-bootstrap-recovery.yml) | ops | reusable | active | Universal Buildchain Bootstrap Recovery | `universal-bootstrap-recovery.yml` |
-| [public-ops-bootstrap.yml](../.github/workflows/public-ops-bootstrap.yml) | ops | reusable | active | Buildchain Universal Bootstrap | `bootstrap.yml` |
-| [public-ops-dev-auto-merge.yml](../.github/workflows/public-ops-dev-auto-merge.yml) | ops | reusable | active | Dev PR Auto Merge | `dev-pr-auto-merge.yml` |
-| [public-ops-dev-qualification-patrol.yml](../.github/workflows/public-ops-dev-qualification-patrol.yml) | ops | reusable | active | Buildchain Dev Qualification Patrol | `dev-qualification-patrol.yml` |
-| [public-ops-housekeeping.yml](../.github/workflows/public-ops-housekeeping.yml) | ops | reusable | active | Engineering Housekeeper | `engineering-housekeeper.yml` |
-| [public-ops-observed-evidence.yml](../.github/workflows/public-ops-observed-evidence.yml) | ops | reusable | active | Patrol Observed Evidence | `patrol-observed-evidence.yml` |
-| [public-ops-patrol-daily.yml](../.github/workflows/public-ops-patrol-daily.yml) | ops | reusable | active | Buildchain Patrol Daily | `patrol-daily.yml` |
-| [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly | `patrol-monthly.yml` |
-| [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly | `patrol-weekly.yml` |
-| [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol | `buildchain-patrol.yml` |
-| [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile | `release-governance-reconcile.yml` |
-| [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol | `stable-candidate-patrol.yml` |
-| [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal | — |
-| [public-ops-warrant-cancel.yml](../.github/workflows/public-ops-warrant-cancel.yml) | ops | reusable | active | Dev Delivery Warrant Queued Candidate Cancel | `dev-delivery-warrant-cancel.yml` |
-| [public-ops-warrant-close.yml](../.github/workflows/public-ops-warrant-close.yml) | ops | reusable | active | Dev Delivery Warrant Close | `dev-delivery-warrant-close.yml` |
-| [public-release-artifact-attestation.yml](../.github/workflows/public-release-artifact-attestation.yml) | release | reusable | active | Buildchain GitHub Artifact Attestation | `github-artifact-attestation.yml` |
-| [public-release-oci-compose-preview.yml](../.github/workflows/public-release-oci-compose-preview.yml) | release | reusable | active | Buildchain OCI Compose Preview | — |
-| [public-release-paper-sealed.yml](../.github/workflows/public-release-paper-sealed.yml) | release | reusable | active | Buildchain Sealed Paper Release | `paper-release-sealed.yml` |
-| [public-release-paper.yml](../.github/workflows/public-release-paper.yml) | release | reusable | active | Buildchain Paper Release | `paper-release.yml` |
-| [public-release-promote.yml](../.github/workflows/public-release-promote.yml) | release | reusable | active | Release Candidate Promote | `release-candidate-promote.yml` |
-| [public-release-propagation.yml](../.github/workflows/public-release-propagation.yml) | release | reusable | active | Release Propagation | `release-propagation.yml` |
-| [public-release-signing-authority.yml](../.github/workflows/public-release-signing-authority.yml) | release | dispatch-service | active | Buildchain Artifact Signing Authority | `artifact-signing-authority.yml` |
-| [public-release-tail.yml](../.github/workflows/public-release-tail.yml) | release | reusable | active | Declarative Release Tail | `release-tail.yml` |
-| [public-release-web.yml](../.github/workflows/public-release-web.yml) | release | reusable | active | Buildchain Web Surface | `.web-surface.yml` |
+| Workflow | Category | Invocation | Status | Purpose |
+| --- | --- | --- | --- | --- |
+| [build.yml](../.github/workflows/build.yml) | build | reusable | active | Buildchain Channel Build |
+| [public-build-adopter-qualification.yml](../.github/workflows/public-build-adopter-qualification.yml) | build | reusable | active | V4 Adopter Delivery |
+| [public-build-check.yml](../.github/workflows/public-build-check.yml) | build | reusable | active | Buildchain Check |
+| [public-build-demo.yml](../.github/workflows/public-build-demo.yml) | build | reusable | active | Buildchain Declarative Binary Auditable Demo |
+| [public-build-publication.yml](../.github/workflows/public-build-publication.yml) | build | reusable | active | Buildchain Publication Artifact |
+| [public-build-stage-capsule-canary.yml](../.github/workflows/public-build-stage-capsule-canary.yml) | build | reusable | active | V4 Stage Capsule Canary |
+| [public-ops-alpha-candidate-patrol.yml](../.github/workflows/public-ops-alpha-candidate-patrol.yml) | ops | reusable | active | Buildchain Dev to Alpha Candidate Patrol |
+| [public-ops-bootstrap-recovery.yml](../.github/workflows/public-ops-bootstrap-recovery.yml) | ops | reusable | active | Universal Buildchain Bootstrap Recovery |
+| [public-ops-bootstrap.yml](../.github/workflows/public-ops-bootstrap.yml) | ops | reusable | active | Buildchain Universal Bootstrap |
+| [public-ops-dev-auto-merge.yml](../.github/workflows/public-ops-dev-auto-merge.yml) | ops | reusable | active | Dev PR Auto Merge |
+| [public-ops-dev-qualification-patrol.yml](../.github/workflows/public-ops-dev-qualification-patrol.yml) | ops | reusable | active | Buildchain Dev Qualification Patrol |
+| [public-ops-housekeeping.yml](../.github/workflows/public-ops-housekeeping.yml) | ops | reusable | active | Engineering Housekeeper |
+| [public-ops-observed-evidence.yml](../.github/workflows/public-ops-observed-evidence.yml) | ops | reusable | active | Patrol Observed Evidence |
+| [public-ops-patrol-daily.yml](../.github/workflows/public-ops-patrol-daily.yml) | ops | reusable | active | Buildchain Patrol Daily |
+| [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly |
+| [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly |
+| [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol |
+| [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile |
+| [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol |
+| [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal |
+| [public-ops-warrant-cancel.yml](../.github/workflows/public-ops-warrant-cancel.yml) | ops | reusable | active | Dev Delivery Warrant Queued Candidate Cancel |
+| [public-ops-warrant-close.yml](../.github/workflows/public-ops-warrant-close.yml) | ops | reusable | active | Dev Delivery Warrant Close |
+| [public-release-artifact-attestation.yml](../.github/workflows/public-release-artifact-attestation.yml) | release | reusable | active | Buildchain GitHub Artifact Attestation |
+| [public-release-oci-compose-preview.yml](../.github/workflows/public-release-oci-compose-preview.yml) | release | reusable | active | Buildchain OCI Compose Preview |
+| [public-release-paper.yml](../.github/workflows/public-release-paper.yml) | release | reusable | active | Buildchain Paper Release |
+| [public-release-promote.yml](../.github/workflows/public-release-promote.yml) | release | reusable | active | Release Candidate Promote |
+| [public-release-propagation.yml](../.github/workflows/public-release-propagation.yml) | release | reusable | active | Release Propagation |
+| [public-release-signing-authority.yml](../.github/workflows/public-release-signing-authority.yml) | release | dispatch-service | active | Buildchain Artifact Signing Authority |
+| [public-release-tail.yml](../.github/workflows/public-release-tail.yml) | release | reusable | active | Declarative Release Tail |
+| [public-release-web.yml](../.github/workflows/public-release-web.yml) | release | reusable | active | Buildchain Web Surface |
 
 ## component
 
-| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
-| --- | --- | --- | --- | --- | --- |
-| [.build-demo-adapter.yml](../.github/workflows/.build-demo-adapter.yml) | build | reusable | active | Buildchain Auditable Demo | `.auditable-demo.yml` |
-| [.build-engine.yml](../.github/workflows/.build-engine.yml) | build | reusable | active | Buildchain Build | `.build.yml` |
-| [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile | `.gate-profile.yml` |
-| [.build-release-verify-compat.yml](../.github/workflows/.build-release-verify-compat.yml) | build | reusable | compatibility | release verify | `.release-verify.yml` |
-| [.build-sam-verify-compat.yml](../.github/workflows/.build-sam-verify-compat.yml) | build | reusable | compatibility | sam verify | `.sam-verify.yml` |
-| [.build-wheel-verify-compat.yml](../.github/workflows/.build-wheel-verify-compat.yml) | build | reusable | compatibility | wheel verify | `.wheel-verify.yml` |
-| [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git | `.sync-remote-git.yml` |
-| [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority | `.publication-authority.yml` |
-| [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets | `.binary-release-assets.yml` |
-| [.release-minor-bump-compat.yml](../.github/workflows/.release-minor-bump-compat.yml) | release | reusable | compatibility | bump minor version | `.bump-minor-version.yml` |
-| [.release-page-sync-retired.yml](../.github/workflows/.release-page-sync-retired.yml) | release | reusable | retired | sync release page | `.sync-release-page.yml` |
-| [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced | `.release-candidate-promote.yml` |
+| Workflow | Category | Invocation | Status | Purpose |
+| --- | --- | --- | --- | --- |
+| [.build-demo-adapter.yml](../.github/workflows/.build-demo-adapter.yml) | build | reusable | active | Buildchain Auditable Demo |
+| [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile |
+| [.build.yml](../.github/workflows/.build.yml) | build | reusable | active | Buildchain Build |
+| [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git |
+| [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority |
+| [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets |
+| [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced |
 
 ## self
 
-| Canonical workflow | Category | Invocation | Status | Purpose | Compatibility path |
-| --- | --- | --- | --- | --- | --- |
-| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood | — |
-| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood | — |
-| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution | — |
-| [self-build-candidate-lab.yml](../.github/workflows/self-build-candidate-lab.yml) | build | repository | active | Candidate Lab | — |
-| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood | — |
-| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification | — |
-| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture | — |
-| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood | — |
-| [self-build-release-verify-compat.yml](../.github/workflows/self-build-release-verify-compat.yml) | build | repository | compatibility | Release - Verify | — |
-| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification | — |
-| [self-build-stable-dogfood.yml](../.github/workflows/self-build-stable-dogfood.yml) | build | repository | active | Buildchain Stable Self-Dogfood | — |
-| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify | — |
-| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood | — |
-| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery | — |
-| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit | — |
-| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily | — |
-| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly | — |
-| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly | — |
-| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance | — |
-| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily | — |
-| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly | — |
-| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly | — |
-| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery | — |
-| [self-ops-recovery-failure-dogfood.yml](../.github/workflows/self-ops-recovery-failure-dogfood.yml) | ops | repository | active | Buildchain Candidate Recovery Dogfood Startup Failure | — |
-| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke | — |
-| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol | — |
-| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets | — |
-| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap | — |
-| [self-release-new-version-compat.yml](../.github/workflows/self-release-new-version-compat.yml) | release | repository | compatibility | Release - New Version | — |
-| [self-release-next-development.yml](../.github/workflows/self-release-next-development.yml) | release | repository | active | Next Development Review | — |
-| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package | — |
-| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion | — |
-| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood | — |
-| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood | — |
+| Workflow | Category | Invocation | Status | Purpose |
+| --- | --- | --- | --- | --- |
+| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood |
+| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood |
+| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution |
+| [self-build-channel-verify.yml](../.github/workflows/self-build-channel-verify.yml) | build | repository | active | Release - Verify |
+| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood |
+| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification |
+| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture |
+| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood |
+| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification |
+| [self-build-stable-dogfood.yml](../.github/workflows/self-build-stable-dogfood.yml) | build | repository | active | Buildchain Stable Self-Dogfood |
+| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify |
+| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood |
+| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery |
+| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit |
+| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily |
+| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly |
+| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly |
+| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance |
+| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily |
+| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly |
+| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly |
+| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery |
+| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke |
+| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol |
+| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets |
+| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap |
+| [self-release-next-development.yml](../.github/workflows/self-release-next-development.yml) | release | repository | active | Next Development Review |
+| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package |
+| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion |
+| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood |
+| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood |