@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/docs/workflow-path-migration.md

@@ -66,8 +66,6 @@ unknown or non-default-branch consumers do not exist.
 | --- | --- | --- |
 | Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-adopter-dogfood.yml` | `v4-alpha` |
 | Buildchain `d434a73d2d4fb010ee80fede2bf3ce872b1d04c8` | `self-build-public-consumer-dogfood.yml` | `v4-alpha` |
-| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-adopter-delivery-qualification.yml` | `v4-alpha` |
-| agent-hub-demo `3f5de882b63464d70c50df0fd7ca418f487b794b` | `v4-stage-capsule-canary.yml` | `v4` |
 | taolu `6dcccdc3bd2c8b1801c7f6decea08ae7877aac2b` | `verify.yml` | `v4-alpha` |
 
 The initial published channel readback was `v4` at
@@ -94,9 +92,7 @@ on all declared platforms and
 The protected dev landing is `7e15123733110ad8ce484241934bbf0ef99fbb45`.
 
 The stable `v4` readback remains
-`da5e2db8384313e899eace87aea0a1a8e28c0aa8`, which does not contain the canonical
-paths. Stable publication and the agent-hub-demo migration remain **pending**
-outside this development change's completion boundary. The alpha.35
+`da5e2db8384313e899eace87aea0a1a8e28c0aa8` in that observation. The alpha.35
 [Build Surface Fixture](https://github.com/kungfu-systems/buildchain/actions/runs/34005360217)
 passed, but this individual result does not establish complete stable
 qualification or authorize moving the stable channel.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.9",
+  "version": "4.1.0-alpha.0",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -12,86 +12,76 @@
   },
   "exports": {
     ".": "./packages/core/index.js",
-    "./badges": "./packages/core/badges.js",
-    "./build-facts": "./packages/core/build-facts.js",
+    "./badges": "./packages/core/web/badges.js",
+    "./build-facts": "./packages/core/build/build-facts.js",
     "./core": "./packages/core/index.js",
-    "./artifact-passport": "./packages/core/artifact-passport.js",
-    "./artifact-verification-envelope": "./packages/core/artifact-verification-envelope.js",
-    "./github-artifact-attestation": "./packages/core/github-artifact-attestation.js",
-    "./artifact-signing": "./packages/core/artifact-signing.js",
-    "./artifact-signing-result": "./packages/core/artifact-signing-result.js",
-    "./detached-artifact-signature": "./packages/core/detached-artifact-signature.js",
-    "./anchored-version-material": "./packages/core/anchored-version-material.js",
-    "./buildchain-contract": "./packages/core/buildchain-contract.js",
-    "./compatibility-fact-authority": "./packages/core/buildchain-compatibility-proof.js",
-    "./candidate-timeline": "./packages/core/candidate-timeline.js",
-    "./ci-lane-change-budget": "./packages/core/ci-lane-change-budget.js",
-    "./channel-candidate": "./packages/core/channel-candidate.js",
-    "./cache-evidence": "./packages/core/cache-evidence.js",
-    "./controller-evidence": "./packages/core/controller-evidence.js",
-    "./diagnostics": "./packages/core/diagnostics.js",
-    "./dev-delivery-authority": "./packages/core/dev-delivery-authority-landing.js",
-    "./dev-delivery-warrant": "./packages/core/dev-delivery-warrant.js",
-    "./homebrew": "./packages/core/homebrew.js",
-    "./issue-reporting": "./packages/core/issue-reporting.js",
-    "./kfd": "./packages/core/kfd.js",
-    "./kfd-product-gates": "./packages/core/kfd-product-gates.js",
-    "./kfd-adopter-manifest": "./packages/core/kfd-adopter-manifest.js",
-    "./kfd-adopter-release-binding": "./packages/core/artifact-verification-envelope.js",
-    "./kfd-agent-hub": "./packages/core/kfd-agent-hub.js",
-    "./buildchain-layout": "./packages/core/buildchain-layout.js",
-    "./release-line-bootstrap": "./packages/core/release-line-bootstrap.js",
-    "./readme-badges": "./packages/core/readme-badges.js",
-    "./public-surface-audit": "./packages/core/public-surface-audit.js",
-    "./v4-floating-consumer-policy": "./packages/compatibility/floating-consumer-policy.js",
-    "./v4-runtime-ref-resume-authority": "./packages/compatibility/runtime-ref-resume-authority.js",
-    "./v4-tail-reseal": "./packages/compatibility/tail-reseal.js",
-    "./v4-tail-reseal-receipt": "./packages/compatibility/tail-reseal-receipt.js",
-    "./v4-publication-rehearsal": "./packages/compatibility/publication-rehearsal.js",
-    "./publication-rehearsal-runtime": "./packages/core/publication-rehearsal-runtime.js",
-    "./publication-rehearsal-projection": "./packages/core/publication-rehearsal-projection.js",
-    "./v4-publication-qualification": "./packages/compatibility/publication-qualification.js",
-    "./adopter-delivery-gate": "./packages/core/adopter-delivery-gate.js",
-    "./kfd-adopter-category-driver": "./packages/core/kfd-adopter-category-driver.js",
-    "./buildchain-delivery-infrastructure": "./packages/core/buildchain-delivery-infrastructure.js",
-    "./buildchain-delivery-bootstrap": "./packages/core/buildchain-delivery-bootstrap.js",
-    "./buildchain-delivery-self-dogfood": "./packages/core/buildchain-delivery-self-dogfood.js",
-    "./published-delivery-authority": "./packages/core/published-delivery-authority.js",
-    "./legacy-kfd-adopter-driver": "./packages/core/legacy-kfd-adopter-driver.js",
-    "./adopter-delivery-passport": "./packages/core/adopter-delivery-passport.js",
-    "./adopter-delivery-vectors": "./packages/core/adopter-delivery-vectors.js",
-    "./v4-adopter-delivery": "./packages/compatibility/adopter-delivery.js",
-    "./v4-cross-platform-adopter-qualification": "./packages/compatibility/cross-platform-adopter-qualification.js",
-    "./logging": "./packages/core/logging.js",
-    "./portable-dev-cache": "./packages/core/portable-dev-cache.js",
-    "./publication-artifact": "./packages/core/publication-artifact.js",
-    "./publication-package": "./packages/core/publication-package.js",
-    "./publication-reproducibility": "./packages/core/publication-reproducibility.js",
-    "./publication-sealed-bundle": "./packages/core/publication-sealed-bundle.js",
-    "./paper": "./packages/core/paper.js",
-    "./publication-authority": "./packages/core/publication-authority.js",
-    "./publication-control-plane-audit": "./packages/core/publication-control-plane-audit.js",
-    "./buildchain-publication-authority": "./packages/core/buildchain-publication-authority.js",
-    "./github-governance-authority": "./packages/core/github-governance-authority.js",
-    "./engineering-housekeeper": "./packages/core/engineering-housekeeper.js",
-    "./engineering-housekeeper-github": "./packages/core/engineering-housekeeper-github.js",
-    "./kfd-gate": "./packages/core/kfd-gate.js",
-    "./release-candidate": "./packages/core/release-candidate.js",
-    "./release-candidate-recovery": "./packages/core/release-candidate-recovery.js",
-    "./release-train": "./packages/core/release-train.js",
-    "./next-development-transition": "./packages/core/next-development-transition.js",
-    "./next-development-controller": "./packages/core/next-development-controller.js",
-    "./next-development-projection": "./packages/core/next-development-projection.js",
-    "./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",
-    "./release-passport": "./packages/core/release-passport.js",
-    "./release-passport-contract": "./packages/core/release-passport-contract.js",
-    "./release-propagation": "./packages/core/release-propagation.js",
-    "./release-activation-transaction": "./packages/core/release-activation-transaction.js",
-    "./release-tail-provider-plane": "./packages/core/release-tail-provider-plane.js",
-    "./release-tail-provider-adapters": "./packages/core/release-tail-provider-adapters.js",
-    "./release-tail-compatibility": "./packages/core/release-tail-compatibility.js",
-    "./surface-manifest": "./packages/core/surface-manifest.js",
-    "./buildchain-kfd-claims": "./packages/core/buildchain-kfd-claims.js",
+    "./artifact-passport": "./packages/core/build/artifact-passport.js",
+    "./artifact-verification-envelope": "./packages/core/build/artifact-verification-envelope.js",
+    "./github-artifact-attestation": "./packages/core/build/github-artifact-attestation.js",
+    "./artifact-signing": "./packages/core/build/artifact-signing.js",
+    "./artifact-signing-result": "./packages/core/build/artifact-signing-result.js",
+    "./detached-artifact-signature": "./packages/core/build/detached-artifact-signature.js",
+    "./anchored-version-material": "./packages/core/build/anchored-version-material.js",
+    "./buildchain-contract": "./packages/core/contracts/buildchain-contract.js",
+    "./compatibility-fact-authority": "./packages/core/governance/buildchain-compatibility-proof.js",
+    "./candidate-timeline": "./packages/core/observability/candidate-timeline.js",
+    "./ci-lane-change-budget": "./packages/core/governance/ci-lane-change-budget.js",
+    "./channel-candidate": "./packages/core/release/channel-candidate.js",
+    "./cache-evidence": "./packages/core/observability/cache-evidence.js",
+    "./controller-evidence": "./packages/core/observability/controller-evidence.js",
+    "./diagnostics": "./packages/core/observability/diagnostics.js",
+    "./dev-delivery-authority": "./packages/core/dev-delivery/dev-delivery-authority-landing.js",
+    "./dev-delivery-warrant": "./packages/core/dev-delivery/dev-delivery-warrant.js",
+    "./homebrew": "./packages/core/build/homebrew.js",
+    "./issue-reporting": "./packages/core/governance/issue-reporting.js",
+    "./kfd": "./packages/core/adoption/kfd.js",
+    "./kfd-product-gates": "./packages/core/adoption/kfd-product-gates.js",
+    "./kfd-adopter-manifest": "./packages/core/adoption/kfd-adopter-manifest.js",
+    "./kfd-adopter-release-binding": "./packages/core/build/artifact-verification-envelope.js",
+    "./kfd-agent-hub": "./packages/core/adoption/kfd-agent-hub.js",
+    "./buildchain-layout": "./packages/core/contracts/buildchain-layout.js",
+    "./release-line-bootstrap": "./packages/core/release/release-line-bootstrap.js",
+    "./readme-badges": "./packages/core/web/readme-badges.js",
+    "./public-surface-audit": "./packages/core/contracts/public-surface-audit.js",
+    "./publication-rehearsal-runtime": "./packages/core/publication/publication-rehearsal-runtime.js",
+    "./publication-rehearsal-projection": "./packages/core/publication/publication-rehearsal-projection.js",
+    "./adopter-delivery-gate": "./packages/core/adoption/adopter-delivery-gate.js",
+    "./kfd-adopter-category-driver": "./packages/core/adoption/kfd-adopter-category-driver.js",
+    "./buildchain-delivery-infrastructure": "./packages/core/dev-delivery/buildchain-delivery-infrastructure.js",
+    "./buildchain-delivery-bootstrap": "./packages/core/dev-delivery/buildchain-delivery-bootstrap.js",
+    "./buildchain-delivery-self-dogfood": "./packages/core/dev-delivery/buildchain-delivery-self-dogfood.js",
+    "./published-delivery-authority": "./packages/core/dev-delivery/published-delivery-authority.js",
+    "./adopter-delivery-passport": "./packages/core/adoption/adopter-delivery-passport.js",
+    "./adopter-delivery-vectors": "./packages/core/adoption/adopter-delivery-vectors.js",
+    "./logging": "./packages/core/observability/logging.js",
+    "./portable-dev-cache": "./packages/core/build/portable-dev-cache.js",
+    "./publication-artifact": "./packages/core/publication/publication-artifact.js",
+    "./publication-package": "./packages/core/publication/publication-package.js",
+    "./publication-reproducibility": "./packages/core/publication/publication-reproducibility.js",
+    "./publication-sealed-bundle": "./packages/core/publication/publication-sealed-bundle.js",
+    "./paper": "./packages/core/paper/paper.js",
+    "./publication-authority": "./packages/core/publication/publication-authority.js",
+    "./publication-control-plane-audit": "./packages/core/publication/publication-control-plane-audit.js",
+    "./buildchain-publication-authority": "./packages/core/governance/buildchain-publication-authority.js",
+    "./github-governance-authority": "./packages/core/governance/github-governance-authority.js",
+    "./engineering-housekeeper": "./packages/core/governance/engineering-housekeeper.js",
+    "./engineering-housekeeper-github": "./packages/core/governance/engineering-housekeeper-github.js",
+    "./kfd-gate": "./packages/core/adoption/kfd-gate.js",
+    "./release-candidate": "./packages/core/release/release-candidate.js",
+    "./release-candidate-recovery": "./packages/core/release/release-candidate-recovery.js",
+    "./release-train": "./packages/core/release/release-train.js",
+    "./next-development-transition": "./packages/core/release/next-development-transition.js",
+    "./next-development-controller": "./packages/core/release/next-development-controller.js",
+    "./next-development-projection": "./packages/core/release/next-development-projection.js",
+    "./stable-candidate-ledger": "./packages/core/release/stable-candidate-ledger.js",
+    "./release-passport": "./packages/core/release/release-passport.js",
+    "./release-passport-contract": "./packages/core/release/release-passport-contract.js",
+    "./release-propagation": "./packages/core/release/release-propagation.js",
+    "./release-activation-transaction": "./packages/core/release/release-activation-transaction.js",
+    "./release-tail-provider-plane": "./packages/core/release/release-tail-provider-plane.js",
+    "./release-tail-provider-adapters": "./packages/core/release/release-tail-provider-adapters.js",
+    "./surface-manifest": "./packages/core/contracts/surface-manifest.js",
+    "./buildchain-kfd-claims": "./packages/core/adoption/buildchain-kfd-claims.js",
     "./site/buildchain-site.json": "./dist/site/buildchain-site.json",
     "./site/site-manifest.json": "./dist/site/site-manifest.json",
     "./site/publication-registry.json": "./dist/site/publication-registry.json",
@@ -124,15 +114,15 @@
     "./site/release-provenance.json": "./dist/site/release-provenance.json",
     "./site/agent-index.json": "./dist/site/agent-index.json",
     "./package.json": "./package.json",
-    "./oci-publication": "./packages/core/oci-publication-bundle.js",
-    "./floating-consumer-policy": "./packages/core/floating-consumer-policy.js",
-    "./runtime-ref-resume-authority": "./packages/core/runtime-ref-resume-authority.js",
-    "./tail-reseal": "./packages/core/tail-reseal.js",
-    "./tail-reseal-receipt": "./packages/core/tail-reseal-receipt.js",
-    "./publication-rehearsal": "./packages/core/publication-rehearsal.js",
-    "./publication-qualification": "./packages/core/publication-qualification.js",
-    "./adopter-delivery": "./packages/core/adopter-delivery.js",
-    "./cross-platform-adopter-qualification": "./packages/core/cross-platform-adopter-qualification.js"
+    "./oci-publication": "./packages/core/publication/oci-publication-bundle.js",
+    "./floating-consumer-policy": "./packages/core/consumer/floating-consumer-policy.js",
+    "./runtime-ref-resume-authority": "./packages/core/consumer/runtime-ref-resume-authority.js",
+    "./tail-reseal": "./packages/core/release/tail-reseal.js",
+    "./tail-reseal-receipt": "./packages/core/release/tail-reseal-receipt.js",
+    "./publication-rehearsal": "./packages/core/publication/publication-rehearsal.js",
+    "./publication-qualification": "./packages/core/publication/publication-qualification.js",
+    "./adopter-delivery": "./packages/core/adoption/adopter-delivery.js",
+    "./cross-platform-adopter-qualification": "./packages/core/adoption/cross-platform-adopter-qualification.js"
   },
   "files": [
     "AGENTS.md",
@@ -144,16 +134,15 @@
     "crates/buildchain-host-bridge/Cargo.toml",
     "crates/buildchain-host-bridge/src/",
     "LICENSE-POLICY.md",
-    "scripts/*.mjs",
     "templates/",
     "packages/core/",
     "dist/site/",
     "README.md",
     "SECURITY.md",
     "docs/*.md",
-    "actions/*/README.md",
     "fixtures/*/README.md",
-    "packages/compatibility/"
+    "scripts/",
+    "actions/*/*/*/README.md"
   ],
   "engines": {
     "node": ">=22.14.0"
@@ -164,14 +153,14 @@
   },
   "packageManager": "pnpm@11.7.0",
   "scripts": {
-    "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery-authority-candidate.js packages/core/dev-delivery-authority-evidence.js packages/core/dev-delivery-authority-landing.js packages/core/dev-delivery-authority-observation.js packages/core/dev-delivery-authority-qualification.js packages/core/dev-delivery-authority-settlement.js packages/core/dev-delivery-authority-state.js packages/core/dev-delivery-execution-failure.js packages/core/dev-delivery-execution-transfer.js packages/core/dev-delivery-landing-readback.js packages/core/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery-landing-testing-port.js packages/core/dev-delivery-native-execution.js packages/core/dev-delivery-native-proof.js packages/core/dev-delivery-process-boundary.js packages/core/dev-delivery-warrant-qualification.js packages/core/dev-delivery-warrant-state.js scripts/dev-delivery-authority-command-adapters.mjs scripts/dev-delivery-authority-provider.mjs scripts/dev-delivery-authority.mjs scripts/dev-delivery-native-run.mjs scripts/dev-delivery-process-boundary.mjs scripts/dev-delivery-two-phase-resume.mjs scripts/dev-delivery-two-phase.mjs scripts/dev-delivery-warrant-options.mjs scripts/dev-delivery-warrant-store.mjs templates/native-dev-delivery.yml",
-    "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node scripts/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
-    "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json bin/internal/command-registry.mjs bin/internal/compatibility-facts-cli.mjs packages/core/canonical-contracts.js packages/core/kungfu-temporal-fact.js packages/core/buildchain-compatibility-fact.js packages/core/buildchain-compatibility-authority.js packages/core/buildchain-compatibility-proof.js packages/core/floating-consumer-evidence.js packages/core/floating-consumer-policy.js packages/core/floating-consumer-release-passport.js packages/core/runtime-ref-resume-authority.js packages/core/tail-reseal-contract.js packages/core/tail-reseal-github.js packages/core/tail-reseal-receipt.js packages/core/tail-reseal.js packages/core/runtime-selector-persistence.js packages/core/provider-operation-journal.js packages/core/provider-readback-idempotency.js packages/core/release-activation-shadow.js packages/core/stable-publication-fence.js packages/core/partial-mutation-recovery-qualification.js packages/core/stage-capsule.js packages/core/stage-capsule-store.js packages/core/stage-capsule-local-store.js packages/core/platform-stage-checkpoints.js packages/core/stage-capsule-resume-planner.js packages/core/stage-capsule-qualification.js packages/core/stage-capsule-qualification-campaign.js packages/core/delivery-warrant-fixture-runner.js packages/core/delivery-warrant-read-candidate.js packages/core/delivery-warrant-semantic-diff-gate.js packages/core/delivery-warrant-shadow-adapter.js scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/dev-pr-prequeue-guard.mjs scripts/check-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/architecture.mjs scripts/bridge-bootstrap.mjs scripts/bridge-evidence.mjs scripts/consumer-policy.mjs scripts/host-adapter.mjs scripts/platform-stage-checkpoint-rehearsal.mjs scripts/stage-capsule-resume-rehearsal.mjs scripts/stage-capsule-qualification.mjs scripts/tail-reseal-macos-rehearsal.mjs scripts/tail-reseal.mjs scripts/warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/architecture.test.mjs tests/bridge.test.mjs tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-ref-resume-authority.test.mjs tests/runtime-semantic-closure.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs tests/warrant-shadow-plan.test.mjs",
+    "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery/dev-delivery-authority-candidate.js packages/core/dev-delivery/dev-delivery-authority-evidence.js packages/core/dev-delivery/dev-delivery-authority-landing.js packages/core/dev-delivery/dev-delivery-authority-observation.js packages/core/dev-delivery/dev-delivery-authority-qualification.js packages/core/dev-delivery/dev-delivery-authority-settlement.js packages/core/dev-delivery/dev-delivery-authority-state.js packages/core/dev-delivery/dev-delivery-execution-failure.js packages/core/dev-delivery/dev-delivery-execution-transfer.js packages/core/dev-delivery/dev-delivery-landing-readback.js packages/core/dev-delivery/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery/dev-delivery-landing-testing-port.js packages/core/dev-delivery/dev-delivery-native-execution.js packages/core/dev-delivery/dev-delivery-native-proof.js packages/core/dev-delivery/dev-delivery-process-boundary.js packages/core/dev-delivery/dev-delivery-warrant-qualification.js packages/core/dev-delivery/dev-delivery-warrant-state.js packages/core/dev-delivery/commands/dev-delivery-authority-command-adapters.mjs packages/core/dev-delivery/commands/dev-delivery-authority-provider.mjs packages/core/dev-delivery/commands/dev-delivery-authority.mjs packages/core/dev-delivery/native/execution.js packages/core/dev-delivery/commands/dev-delivery-process-boundary.mjs packages/core/dev-delivery/native/transactions.js packages/core/dev-delivery/commands/dev-delivery-two-phase.mjs packages/core/dev-delivery/commands/dev-delivery-warrant-options.mjs packages/core/dev-delivery/warrant/persistence.js templates/native-dev-delivery.yml",
+    "operator:windows-jit": "bash packages/core/providers/commands/aws-windows-jit-operator.sh",
+    "check": "pnpm run check:layout && pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node packages/core/governance/commands/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check:static": "node scripts/check-javascript-syntax.mjs && node scripts/check-source-bindings.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json packages/core/contracts/command-registry.mjs packages/core/governance/cli/compatibility-facts.mjs packages/core/contracts/canonical-contracts.js packages/core/contracts/kungfu-temporal-fact.js packages/core/governance/buildchain-compatibility-fact.js packages/core/governance/buildchain-compatibility-authority.js packages/core/governance/buildchain-compatibility-proof.js packages/core/consumer/floating-consumer-evidence.js packages/core/consumer/floating-consumer-policy.js packages/core/consumer/floating-consumer-release-passport.js packages/core/consumer/runtime-ref-resume-authority.js packages/core/release/tail-reseal-contract.js packages/core/release/tail-reseal-github.js packages/core/release/tail-reseal-receipt.js packages/core/release/tail-reseal.js packages/core/consumer/runtime-selector-persistence.js packages/core/release/provider-operation-journal.js packages/core/release/provider-readback-idempotency.js packages/core/release/release-activation-shadow.js packages/core/release/stable-publication-fence.js packages/core/release/partial-mutation-recovery-qualification.js packages/core/build/stage-capsule.js packages/core/build/stage-capsule-store.js packages/core/build/stage-capsule-local-store.js packages/core/build/platform-stage-checkpoints.js packages/core/build/stage-capsule-resume-planner.js packages/core/build/stage-capsule-qualification.js packages/core/build/stage-capsule-qualification-campaign.js packages/core/dev-delivery/delivery-warrant-fixture-runner.js packages/core/dev-delivery/delivery-warrant-read-candidate.js packages/core/dev-delivery/delivery-warrant-semantic-diff-gate.js packages/core/dev-delivery/delivery-warrant-shadow-adapter.js packages/core/release/runtime-override-authorization.js scripts/check-core-mechanism-inventory.mjs scripts/check-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs packages/core/dev-delivery/commands/dev-pr-prequeue-guard.mjs scripts/check-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs packages/core/governance/commands/architecture.mjs packages/core/runtime/commands/bridge-bootstrap.mjs scripts/bridge-evidence.mjs packages/core/consumer/commands/consumer-policy.mjs packages/core/runtime/commands/host-adapter.mjs scripts/platform-stage-checkpoint-rehearsal.mjs scripts/stage-capsule-resume-rehearsal.mjs packages/core/build/commands/stage-capsule-qualification.mjs scripts/tail-reseal-macos-rehearsal.mjs packages/core/release/commands/tail-reseal.mjs scripts/warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/architecture.test.mjs tests/bridge.test.mjs tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-ref-resume-authority.test.mjs tests/runtime-semantic-closure.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs tests/warrant-shadow-plan.test.mjs",
     "check:bridge": "cargo fmt --manifest-path crates/buildchain-host-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml",
     "check:contracts": "pnpm run check:contracts:rust && node --test tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/domain-wasm.test.mjs tests/floating-consumer-policy-contract.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-ref-resume-authority.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/publication-rehearsal.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs",
     "build:wasm": "node scripts/build-domain-wasm.mjs",
-    "check:wasm": "prettier --check packages/core/domain-wasm.js packages/core/domain-wasm-artifact.js scripts/build-domain-wasm.mjs scripts/copy-domain-wasm.mjs tests/domain-wasm.test.mjs && node scripts/build-domain-wasm.mjs --check",
+    "check:wasm": "prettier --check packages/core/runtime/domain-wasm.js packages/core/runtime/domain-wasm-artifact.js scripts/build-domain-wasm.mjs scripts/tsup-action.config.mjs packages/core/contracts/action-inventory.js tests/domain-wasm.test.mjs && node scripts/build-domain-wasm.mjs --check",
     "check:workflows": "node scripts/check-workflow-taxonomy.mjs && bash scripts/check-workflows.sh",
     "generate:reference": "node scripts/generate-public-reference.mjs",
     "check:reference": "node scripts/generate-public-reference.mjs --check",
@@ -185,20 +174,28 @@
     "binary:build": "node scripts/build-standalone-binary.mjs",
     "package": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
     "pack:check": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
-    "bridge:build": "node scripts/bridge-bootstrap.mjs build",
-    "bridge:run": "node scripts/bridge-bootstrap.mjs run",
+    "bridge:build": "node packages/core/runtime/commands/bridge-bootstrap.mjs build",
+    "bridge:run": "node packages/core/runtime/commands/bridge-bootstrap.mjs run",
     "bridge:evidence": "node scripts/bridge-evidence.mjs",
     "check:contracts:rust": "cargo fmt --manifest-path crates/buildchain-domain-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-domain-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-domain-contracts/Cargo.toml",
-    "generate:workflows": "node scripts/generate-workflow-taxonomy.mjs",
-    "check:implementation-naming": "node scripts/check-implementation-naming.mjs"
+    "generate:workflows": "node scripts/generate-workflow-taxonomy.mjs && node scripts/generate-bootstrap-recovery.mjs && node scripts/generate-bootstrap-admission.mjs",
+    "check:implementation-naming": "node scripts/check-implementation-naming.mjs",
+    "check:layout": "node scripts/check-code-layout.mjs"
   },
   "devDependencies": {
+    "@actions/expressions": "0.3.61",
     "ajv": "8.17.1",
     "prettier": "^3.9.0",
     "tsup": "^8.5.0",
-    "typescript": "^5.9.0"
+    "typescript": "^5.9.0",
+    "yaml": "2.8.2"
   },
   "dependencies": {
+    "@actions/artifact": "6.2.1",
+    "@actions/core": "1.11.1",
+    "@actions/github": "6.0.1",
+    "@actions/glob": "0.7.0",
+    "@electron/osx-sign": "1.3.3",
     "@kungfu-tech/kfd": "1.0.0-alpha.62",
     "smol-toml": "1.7.0"
   }

package/packages/core/README.md

@@ -1,170 +1,47 @@
-# Buildchain Core Package
-
-Shared code lives here when workflow and action migration shows repeated logic
-that is worth centralizing.
-
-Current shared surfaces:
-
-- `buildchain.toml` loading and normalization;
-- version-state file discovery and update helpers;
-- lifecycle stage normalization and execution;
-- config validation for release-package and `web-surface` projects.
-- toolkit observability logging through `@kungfu-tech/buildchain/logging`;
-- toolkit diagnostics and native profile collection through
-  `@kungfu-tech/buildchain/diagnostics`;
-- source/version/module/product build facts through
-  `@kungfu-tech/buildchain/build-facts`;
-- release passport creation and verification through
-  `@kungfu-tech/buildchain/release-passport`.
-- anchored/manual derived witness preflight and exact-tree evidence through
-  `@kungfu-tech/buildchain/anchored-version-material`.
-- sealed exact-root and KFD assessment inputs for KFX admission through
-  `@kungfu-tech/buildchain/artifact-verification-envelope`.
-- managed KFD / Release Passport badge bundle facts and README marker blocks
-  through `@kungfu-tech/buildchain/badges`.
-- publication artifact manifests, source bundles, and publication artifact
-  passports through `@kungfu-tech/buildchain/publication-artifact`.
-- two-clean-build byte reproducibility receipts through
-  `@kungfu-tech/buildchain/publication-reproducibility`.
-- build-once publication bundle manifests and exact-byte verification through
-  `@kungfu-tech/buildchain/publication-sealed-bundle`.
-- governed Paper work-branch start/submit, fleet audit/update, scaffold,
-  preflight, status, npm bootstrap, build, Alpha, and resume plans through
-  `@kungfu-tech/buildchain/paper`.
-
-## Toolkit Imports
-
-The npm package exports ESM APIs. JavaScript build scripts should import these
-APIs directly instead of spawning the `buildchain` CLI:
+---
+status: active
+period: ongoing
+theme: buildchain-layered-architecture
+doc_type: implementation-guide
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-10
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-10
+  visible_context: Buildchain 4.1 source, architecture registries and local validation.
+  invisible_context_boundary: No unpublished release or external consumer qualification is claimed.
+---
+
+# Buildchain Core
+
+Core contains JavaScript business logic and provider IO, grouped by the closed
+capabilities in [`architecture/code-layout.json`](../../architecture/code-layout.json).
+See [Code organization](../../docs/code-organization.md) for the complete layout.
+
+Each capability groups its business transactions, action adapters and supporting
+modules by responsibility. Action adapters invoke named transaction APIs; they do
+not dispatch old CLI steps. Command-line handlers live in `cli/`, and executable
+capability tools in `commands/` delegate to the same core modules. The root `index.js` is the public API aggregation;
+implementation modules import their actual owner directly.
+
+Core cannot depend on `actions`, `.github/workflows`, `bin`, or repository
+`scripts`. Rust-owned domain decisions are called through the existing WASM/host
+boundary and have no JavaScript fallback.
+
+Use the generated [Node API Reference](../../docs/node-api-reference.md) for
+current package subpaths, symbols and signatures. For example:
 
 ```js
 import { createBuildchainLogger } from "@kungfu-tech/buildchain/logging";
 
-const logger = createBuildchainLogger({ source: "user", component: "native" });
-await logger.span("native.package", { phase: "package" }, packageArtifacts);
-```
-
-The CLI remains the right surface for GitHub Actions steps, shell scripts, and
-non-JavaScript build tools.
-
-Diagnostics consumers should import the published subpath and compare stable
-contracts through the exported constants instead of hardcoding JSON contract
-names:
-
-```js
-import {
-  BUILDCHAIN_DIAGNOSTICS_CONTRACT,
-  BUILDCHAIN_DIAGNOSTICS_SUMMARY_CONTRACT,
-  collectRunnerDiagnostics,
-  summarizeDiagnosticsArtifacts,
-} from "@kungfu-tech/buildchain/diagnostics";
-```
-
-CommonJS scripts can use dynamic imports for the same package surfaces:
-
-```js
-const { createBuildchainLogger } =
-  await import("@kungfu-tech/buildchain/logging");
-const { collectRunnerDiagnostics } =
-  await import("@kungfu-tech/buildchain/diagnostics");
-```
-
-Build facts consumers can collect source-bound module/product facts before
-publishing and pass those facts into the release passport:
-
-```js
-import {
-  collectModuleBuildFacts,
-  writeBuildFacts,
-} from "@kungfu-tech/buildchain/build-facts";
-
-const fact = collectModuleBuildFacts({ moduleId: "native-core" });
-writeBuildFacts({ fact, output: ".buildchain/facts/native-core.json" });
-```
-
-KFX producers can seal one passing artifact verification with exact roots,
-identity, lifecycle, revocation, and an existing ADR-0052 assessment. Consumers
-verify or project the same envelope instead of reconstructing bindings:
-
-```js
-import {
-  projectArtifactVerificationEnvelopeToKfx,
-  verifyArtifactVerificationEnvelope,
-} from "@kungfu-tech/buildchain/artifact-verification-envelope";
-```
-
-Publication repositories can produce site-consumable paper/report facts without
-becoming web-surface repositories. When `[publication.archive]` is configured,
-the same API also maintains the append-only publication registry used by site
-repositories for latest and historical version pages. The preferred
-`latex-docker` toolchain records the pinned build-images LaTeX builder digest in
-the publication artifact passport:
-
-```js
-import { writePublicationArtifact } from "@kungfu-tech/buildchain/publication-artifact";
-
-writePublicationArtifact({ sourceSha: process.env.GITHUB_SHA });
-```
-
-Before publication admission, prove the exact PDF, source bundle, manifests,
-and npm tarball twice from the same Git commit:
-
-```js
-import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain/publication-reproducibility";
-
-const receipt = verifyPublicationReproducibility({
-  sourceSha: process.env.GITHUB_SHA,
-  promote: true,
-});
-if (!receipt.qualifying) throw new Error("publication is not reproducible");
-```
-
-Bind the promoted bytes into the durable build-once publication envelope:
-
-```js
-import {
-  createPublicationSealedBundle,
-  verifyPublicationSealedBundle,
-} from "@kungfu-tech/buildchain/publication-sealed-bundle";
-```
-
-The sealed manifest names the exact npm tarball and release assets. Promotion
-persists those binary files before registry publication and verifies them again
-when a fresh runner resumes.
-
-Paper automation can use the same typed contracts as the CLI:
-
-```js
-import {
-  collectPaperPreflight,
-  collectPaperStatus,
-  planPaperMigration,
-  planPaperScaffold,
-  writePaperMigration,
-} from "@kungfu-tech/buildchain/paper";
-```
-
-Planning and observation are side-effect free. `writePaperScaffold()` and
-`writePaperMigration()` perform the bounded local writes, while external
-mutations remain explicit CLI operations guarded by `--execute`.
-
-Web-surface validation stays in core because both local scripts and GitHub
-Actions need the same fail-closed interpretation of project, channel, deploy,
-retention, and staging security declarations.
-
-README badge consumers should import the public badge subpath and treat
-Markdown as a projection of the returned facts:
-
-```js
-import {
-  collectBadgeBundleFacts,
-  renderBadgeBundleBlock,
-} from "@kungfu-tech/buildchain/badges";
-
-const facts = await collectBadgeBundleFacts({ cwd: process.cwd() });
-const markdown = renderBadgeBundleBlock(facts);
+const logger = createBuildchainLogger({ source: "user", component: "build" });
+await logger.span("package", { phase: "package" }, packageArtifacts);
 ```
 
-The older `@kungfu-tech/buildchain/readme-badges` subpath remains available for
-callers that need the full README badge surface instead of the default
-KFD-1 / KFD-2 / KFD-3 / Release Passport bundle.
+The CLI is the adapter for shells and non-JavaScript tools. Core modules can be
+used directly by JavaScript callers. Both paths share the same implementations.