npm - @kungfu-tech/buildchain - Versions diffs - 4.0.9 → 4.1.0-alpha.0 - Mend

@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1536) hide show

package/architecture/cross-platform-adopter-qualification.json CHANGED Viewed

@@ -1,16 +1,15 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-v4-cross-platform-adopter-qualification",
-  "inventoryAuthority": "architecture/capability-parity-live-capability-inventory.json",
-  "implementation": "packages/core/cross-platform-adopter-qualification.js",
-  "runner": "scripts/cross-platform-adopter-qualification.mjs",
+  "implementation": "packages/core/adoption/cross-platform-adopter-qualification.js",
+  "runner": "packages/core/adoption/commands/cross-platform-adopter-qualification.mjs",
   "publicWorkflow": ".github/workflows/public-build-adopter-qualification.yml",
   "sourceBinding": {
     "runtime": "job.workflow_sha",
     "consumer": "exact checked-out consumer commit",
     "sameRuntimeAcrossMatrix": true,
     "sameConsumerAcrossMatrix": true,
-    "sameInventoryAcrossMatrix": true
+    "sameInputAcrossMatrix": true
   },
   "candidateDispatch": {
     "externalRepositoryRequiresExactCommit": true,
@@ -19,7 +18,7 @@
     "providerEffects": false
   },
   "platforms": ["linux-x64", "macos-arm64", "windows-x64"],
-  "requiredConsumers": ["buildchain", "agent-hub-demo"],
+  "requiredConsumers": ["buildchain"],
   "protocolNeutralDriver": {
     "id": "ledger-specification-driver",
     "fixture": "fixtures/ledger-specification-driver",
@@ -27,20 +26,11 @@
     "platformCoverage": ["linux-x64", "macos-arm64", "windows-x64"],
     "kfdDependencyAllowed": false
   },
-  "capabilityMatrix": {
-    "rawRowsRequired": true,
-    "everyCategoryRequired": true,
-    "sourceOnlyApplicability": "exact-source-route",
-    "residualMaximum": 0,
-    "unknownMaximum": 0,
-    "unownedMaximum": 0
-  },
   "executedScenarios": [
     "public-run",
     "tampered-readback-failure",
     "public-run-retry",
     "terminal-exact-verify",
-    "n-minus-one-bootstrap",
     "protocol-neutral-clean-room"
   ],
   "authority": {

package/architecture/delivery-authority-parity.json CHANGED Viewed

@@ -8,7 +8,7 @@
     "schemaVersion": 1
   },
   "target": {
-    "branch": "dev/v4/v4.0",
+    "branch": "dev/v4/v4.1",
     "singleFlightContract": "kungfu-buildchain-dev-delivery-warrant-queue",
     "boundedAuthorityContract": "kungfu-buildchain-dev-delivery-authority",
     "boundedAuthoritySchemaVersion": 2
@@ -24,8 +24,8 @@
       "claim": "Native delivery receives provisional authority before expensive execution and cannot use that phase as merge admission.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-warrant.js",
-        "scripts/dev-delivery-two-phase.mjs"
+        "packages/core/dev-delivery/dev-delivery-warrant.js",
+        "packages/core/dev-delivery/commands/dev-delivery-two-phase.mjs"
       ],
       "verificationEvidence": [
         "tests/dev-delivery-two-phase.test.mjs",
@@ -38,8 +38,8 @@
       "claim": "The provisional Warrant heartbeats one exact token and generation, and stale or expired owners cannot renew or qualify.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-warrant.js",
-        "scripts/dev-delivery-native-run.mjs"
+        "packages/core/dev-delivery/dev-delivery-warrant.js",
+        "packages/core/dev-delivery/commands/dev-delivery-native-run.mjs"
       ],
       "verificationEvidence": [
         "tests/dev-delivery-two-phase.test.mjs",
@@ -52,15 +52,15 @@
       "claim": "Native proof binds semantic source, exact source head, qualified base, affected closure, dependency and toolchain roots, environment, heartbeat receipt, and shard evidence; PR-controlled native code and its complete readable process ancestry receive no controller or provider write credentials, the recursively enumerated transfer is an exact regular-file-only closed set staged separately from candidate evidence, an independent hosted heartbeat runner chains durable state and receipt roots through native and seal completion, and only a live-readback-proven distinct GitHub-hosted finalizer job and runner may verify the latest state, revalidate bytes, recompute canonical failure evidence, qualify, or settle the exact bound failure.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-native-proof.js",
-        "packages/core/dev-delivery-execution-failure.js",
-        "packages/core/dev-delivery-execution-transfer.js",
-        "packages/core/dev-delivery-process-boundary.js",
-        "packages/core/dev-delivery-provider-heartbeat.js",
-        "scripts/dev-delivery-native-run.mjs",
-        "scripts/dev-delivery-process-boundary.mjs",
-        "scripts/dev-delivery-provider-heartbeat.mjs",
-        ".github/workflows/dev-pr-auto-merge.yml"
+        "packages/core/dev-delivery/dev-delivery-native-proof.js",
+        "packages/core/dev-delivery/dev-delivery-execution-failure.js",
+        "packages/core/dev-delivery/dev-delivery-execution-transfer.js",
+        "packages/core/dev-delivery/dev-delivery-process-boundary.js",
+        "packages/core/dev-delivery/dev-delivery-provider-heartbeat.js",
+        "packages/core/dev-delivery/commands/dev-delivery-native-run.mjs",
+        "packages/core/dev-delivery/commands/dev-delivery-process-boundary.mjs",
+        "packages/core/dev-delivery/commands/dev-delivery-provider-heartbeat.mjs",
+        ".github/workflows/public-ops-dev-auto-merge.yml"
       ],
       "verificationEvidence": [
         "tests/dev-delivery-two-phase.test.mjs",
@@ -77,8 +77,8 @@
       "claim": "Interruption resumes only from a live qualified fence or a proof whose complete attributed base delta remains disjoint; ambiguity or overlap revalidates.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-native-proof.js",
-        "scripts/dev-delivery-two-phase-resume.mjs"
+        "packages/core/dev-delivery/dev-delivery-native-proof.js",
+        "packages/core/dev-delivery/commands/dev-delivery-two-phase-resume.mjs"
       ],
       "verificationEvidence": [
         "tests/dev-delivery-two-phase.test.mjs",
@@ -91,8 +91,8 @@
       "claim": "Native success upgrades the same fence atomically to qualified authority and records exact proof and reuse roots without minting a second token.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-native-proof.js",
-        "packages/core/dev-delivery-warrant.js"
+        "packages/core/dev-delivery/dev-delivery-native-proof.js",
+        "packages/core/dev-delivery/dev-delivery-warrant.js"
       ],
       "verificationEvidence": ["tests/dev-delivery-two-phase.test.mjs"],
       "behavioralProof": "tests/delivery-authority-parity.test.mjs#DA-05"
@@ -102,8 +102,8 @@
       "claim": "Expiry does not imply worker termination; an expired provisional holder remains exclusive until exact fenced terminal settlement, and duplicate settlement is idempotent.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-warrant.js",
-        "packages/core/dev-delivery-warrant-settlement.js"
+        "packages/core/dev-delivery/dev-delivery-warrant.js",
+        "packages/core/dev-delivery/dev-delivery-warrant-settlement.js"
       ],
       "verificationEvidence": [
         "tests/dev-delivery-warrant.test.mjs",
@@ -116,9 +116,9 @@
       "claim": "GitHub merge_group and the protected Project Cut remain final integration authority; a Warrant alone never mutates branch protection or proves landing.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-proof.js",
-        "scripts/dev-pr-delivery-warrant.mjs",
-        ".github/workflows/dev-pr-auto-merge.yml"
+        "packages/core/dev-delivery/dev-delivery-proof.js",
+        "packages/core/dev-delivery/commands/dev-pr-delivery-warrant.mjs",
+        ".github/workflows/public-ops-dev-auto-merge.yml"
       ],
       "verificationEvidence": [
         "tests/dev-delivery-warrant.test.mjs",
@@ -131,8 +131,8 @@
       "claim": "Bounded mode issues no more than the configured Qualification Leases and only across disjoint rooted safety domains; unknown or overlapping domains serialize.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-authority-qualification.js",
-        "packages/core/dev-delivery-authority-state.js"
+        "packages/core/dev-delivery/dev-delivery-authority-qualification.js",
+        "packages/core/dev-delivery/dev-delivery-authority-state.js"
       ],
       "verificationEvidence": ["tests/dev-delivery-authority.test.mjs"],
       "behavioralProof": "tests/delivery-authority-parity.test.mjs#DA-08"
@@ -142,9 +142,9 @@
       "claim": "Qualification authority cannot admit merge_group; a new Landing requires complete verified-native qualification, its public admission API derives provider identity only from live GitHub readback, and exactly one exclusive Landing Warrant binds the candidate, source head, token, generation, state root, protected base, merge-group head, and verified provider attempt.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-authority-landing.js",
-        "packages/core/dev-delivery-landing-admission-core.js",
-        "packages/core/dev-delivery-authority-qualification.js",
+        "packages/core/dev-delivery/dev-delivery-authority-landing.js",
+        "packages/core/dev-delivery/dev-delivery-landing-admission-core.js",
+        "packages/core/dev-delivery/dev-delivery-authority-qualification.js",
         "contracts/dev-delivery-authority-v2.schema.json"
       ],
       "verificationEvidence": ["tests/dev-delivery-authority.test.mjs"],
@@ -155,8 +155,8 @@
       "claim": "Landing is fair under bounded overtaking, including strict FIFO at zero, and never exposes more than one landing writer under contention.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-authority-qualification.js",
-        "packages/core/dev-delivery-authority-landing.js"
+        "packages/core/dev-delivery/dev-delivery-authority-qualification.js",
+        "packages/core/dev-delivery/dev-delivery-authority-landing.js"
       ],
       "verificationEvidence": ["tests/dev-delivery-authority.test.mjs"],
       "behavioralProof": "tests/delivery-authority-parity.test.mjs#DA-10"
@@ -166,10 +166,10 @@
       "claim": "Every Landing admission derives the provider attempt through non-injectable live GitHub readback, and every admitted heartbeat carries that exact persisted attempt and renews only through the public GitHub workflow run-attempt and job readback; qualification expiry releases only qualification capacity, while every Landing Warrant remains exclusive until an independent terminal verifier reads the immutable historical attempt endpoint and returns fresh rooted evidence bound to state, fence, generation, candidate, admitted source head, provider run, provider job, and protected-base containment without depending on a mutable run projection, referenced-workflow inference, or the synchronized current PR head; runtime sealing enforces the published repository, protected-base, numeric identity, completed-state, run-conclusion, job-conclusion, pull-request-state, merged-flag, containment, and outcome schema, and every resulting settlement is deterministic and idempotent.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-authority-qualification.js",
-        "packages/core/dev-delivery-authority-landing.js",
-        "packages/core/dev-delivery-landing-admission-core.js",
-        "packages/core/dev-delivery-landing-readback.js"
+        "packages/core/dev-delivery/dev-delivery-authority-qualification.js",
+        "packages/core/dev-delivery/dev-delivery-authority-landing.js",
+        "packages/core/dev-delivery/dev-delivery-landing-admission-core.js",
+        "packages/core/dev-delivery/dev-delivery-landing-readback.js"
       ],
       "verificationEvidence": ["tests/dev-delivery-authority.test.mjs"],
       "behavioralProof": "tests/delivery-authority-parity.test.mjs#DA-11"
@@ -179,8 +179,8 @@
       "claim": "Expected-old state roots and non-force Git ref advancement serialize admission and prevent partial or competing writes from becoming two durable authorities.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "scripts/dev-delivery-authority.mjs",
-        "scripts/dev-delivery-warrant.mjs"
+        "packages/core/dev-delivery/commands/dev-delivery-authority.mjs",
+        "packages/core/dev-delivery/commands/dev-delivery-warrant.mjs"
       ],
       "verificationEvidence": [
         "tests/dev-delivery-authority.test.mjs",
@@ -190,23 +190,23 @@
     },
     {
       "id": "DA-13",
-      "claim": "One-shot v1 migration preserves the rooted legacy state and exact active fence while representing phase-less and qualified v1 compatibility honestly; compatibility-only evidence cannot acquire v2 native proof authority or mint a new Landing Warrant.",
+      "claim": "Authority state accepts only the current qualification and landing representation; obsolete migration metadata and compatibility qualification records cannot mint or preserve authority.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-authority-state.js",
-        "scripts/dev-delivery-authority.mjs"
+        "packages/core/dev-delivery/dev-delivery-authority-state.js",
+        "packages/core/dev-delivery/commands/dev-delivery-authority.mjs"
       ],
       "verificationEvidence": ["tests/dev-delivery-authority.test.mjs"],
       "behavioralProof": "tests/delivery-authority-parity.test.mjs#DA-13"
     },
     {
       "id": "DA-14",
-      "claim": "Historical v1 queue bytes and native proofs remain readable, phase-less active-owner handoff uses exact legacy-safe bindings without a native command contract, and unbound or compatibility-only legacy proof cannot acquire new exact reuse or Landing authority.",
+      "claim": "Native qualification accepts only the current execution-receipt-bound proof schema; earlier schemas, missing native command contracts and compatibility switches cannot authorize readback or proof reuse.",
       "disposition": "implemented",
       "implementationEvidence": [
-        "packages/core/dev-delivery-warrant.js",
-        "packages/core/dev-delivery-native-proof.js",
-        ".github/workflows/dev-pr-auto-merge.yml"
+        "packages/core/dev-delivery/dev-delivery-warrant.js",
+        "packages/core/dev-delivery/dev-delivery-native-proof.js",
+        ".github/workflows/public-ops-dev-auto-merge.yml"
       ],
       "verificationEvidence": [
         "tests/dev-delivery-authority.test.mjs",
@@ -221,8 +221,8 @@
       "implementationEvidence": [
         "bin/buildchain.mjs",
         "package.json",
-        "packages/core/dev-delivery-landing-readback.js",
-        "packages/core/dev-delivery-contract-surface.js",
+        "packages/core/dev-delivery/dev-delivery-landing-readback.js",
+        "packages/core/dev-delivery/dev-delivery-contract-surface.js",
         "contracts/dev-delivery-authority-v2.schema.json",
         "docs/dev-delivery-warrant.md",
         "docs/dev-delivery-qualification-landing-adr.md",
@@ -246,5 +246,5 @@
       "verificationEvidence": []
     }
   ],
-  "matrixRoot": "sha256:7cda843562e9cc3d9de0434bab8b3570c1ed793b6c91eaf7aa675bbcdcc60715"
+  "matrixRoot": "sha256:99591bd9b7df091a6e539effcfbdd5cf866221710da3dd2fb8488732b89e64ec"
 }

package/architecture/delivery-warrant-shadow-bootstrap-plan.json CHANGED Viewed

@@ -6,12 +6,12 @@
     "revision": "3fd14c7a6237c3a1709ce29fc9fcb4ac150a0e5d",
     "inventory": "architecture/baseline-core-mechanism-inventory.json",
     "manifest": "architecture/capability-state-machine-manifest.json",
-    "legacyCore": "packages/core/dev-delivery-warrant.js",
-    "legacyStore": "scripts/dev-delivery-warrant.mjs",
+    "legacyCore": "packages/core/dev-delivery/dev-delivery-warrant.js",
+    "legacyStore": "packages/core/dev-delivery/commands/dev-delivery-warrant.mjs",
     "legacyWorkflows": [
       ".github/workflows/self-ops-dev-delivery.yml",
-      ".github/workflows/dev-delivery-warrant-close.yml",
-      ".github/workflows/dev-delivery-warrant-cancel.yml"
+      ".github/workflows/public-ops-warrant-close.yml",
+      ".github/workflows/public-ops-warrant-cancel.yml"
     ]
   },
   "legacyAuthority": {

package/architecture/delivery-warrant-shadow-bootstrap-plan.md CHANGED Viewed

@@ -52,9 +52,9 @@ inventory rather than reconstructing it from workflow prose.
 | Concern                                          | Source of record                                                                   | Result                                                                       |
 | ------------------------------------------------ | ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
 | Current states, events, writers, stores, effects | `baseline-core-mechanism-inventory.json` and `capability-state-machine-manifest.json` | Nine states, seven manifest events, TypeScript v3 sole writer                |
-| Queue roots, generation, selection, leases       | `packages/core/dev-delivery-warrant.js`                                            | Rooted successors, bounded FIFO/aging, one active fence                      |
+| Queue roots, generation, selection, leases       | `packages/core/dev-delivery/dev-delivery-warrant.js`                                            | Rooted successors, bounded FIFO/aging, one active fence                      |
 | Terminal behavior                                | settlement and cancellation modules plus Warrant tests                             | Active fenced close, exact queued cancellation, terminal/no-authority no-ops |
-| Durable compare-and-set                          | `scripts/dev-delivery-warrant.mjs`                                                 | Immutable Git commit plus expected commit/root readback                      |
+| Durable compare-and-set                          | `packages/core/dev-delivery/commands/dev-delivery-warrant.mjs`                                                 | Immutable Git commit plus expected commit/root readback                      |
 | Protected effects                                | Buildchain dev delivery, close, and cancel workflows                               | GitHub admission occurs after exact state readback                           |
 | Bootstrap and N-1                                | `bootstrap-authority.json` and `architecture.mjs`                            | v3 bootstrap authority, protected v4 handoff, no self-qualification          |
@@ -215,7 +215,7 @@ Run the focused contract and fixture checks with:
 ```sh
 node scripts/warrant-shadow-plan.mjs validate
 node --test tests/warrant-shadow-plan.test.mjs
-node scripts/architecture.mjs validate
+node packages/core/governance/commands/architecture.mjs validate
 ```
 The repository `check` command runs the plan validator and the unit suite. A

package/architecture/dev-delivery-orchestration.json ADDED Viewed

@@ -0,0 +1,175 @@
+{
+  "schema": "buildchain.dev-delivery-orchestration/v2",
+  "workflow": ".github/workflows/public-ops-dev-auto-merge.yml",
+  "terminalWorkflow": ".github/workflows/public-ops-warrant-close.yml",
+  "maxOrchestrationLines": 660,
+  "nodes": [
+    {
+      "id": "source",
+      "implementations": [
+        {
+          "action": "actions/dev-delivery/candidate/admit/action.yml",
+          "domains": ["admission"],
+          "inputs": ["request-json", "github-token"],
+          "outputs": [
+            "runtime-sha",
+            "runtime-root",
+            "target-branch",
+            "target-branch-artifact",
+            "proof-source-proof-root",
+            "project-cut-proof-root",
+            "proof-outcome",
+            "qualify-outcome"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "reserve",
+      "implementations": [
+        {
+          "action": "actions/dev-delivery/candidate/reserve/action.yml",
+          "domains": ["admission"],
+          "inputs": [
+            "request-json",
+            "github-token",
+            "proof-outcome",
+            "target-branch",
+            "proof-source-proof-root",
+            "qualify-outcome",
+            "predecessors-ok",
+            "runtime-sha"
+          ],
+          "outputs": [
+            "warrant-receipt-root",
+            "warrant-state-root",
+            "warrant-state-commit",
+            "warrant-native-proof-root",
+            "warrant-decision-root",
+            "warrant-qualification-receipt-root",
+            "warrant-handoff-required",
+            "warrant-handoff-dispatched",
+            "warrant-already-qualified",
+            "warrant-outcome"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "native",
+      "implementations": [
+        {
+          "action": "actions/dev-delivery/native/execute/action.yml",
+          "domains": ["native-execution"],
+          "inputs": ["request-json", "needs-json"],
+          "outputs": []
+        },
+        {
+          "action": "actions/dev-delivery/native/seal/action.yml",
+          "domains": ["seal-native-execution"],
+          "inputs": ["request-json", "needs-json"],
+          "outputs": ["transfer-root", "transfer-native-outcome"]
+        },
+        {
+          "action": "actions/dev-delivery/native/heartbeat/action.yml",
+          "domains": ["delivery-heartbeat"],
+          "inputs": ["request-json", "github-token", "needs-json"],
+          "outputs": ["heartbeat-receipt-root"]
+        }
+      ]
+    },
+    {
+      "id": "qualify",
+      "implementations": [
+        {
+          "action": "actions/dev-delivery/candidate/qualify/action.yml",
+          "domains": ["merge-dev-prs"],
+          "inputs": ["request-json", "github-token", "needs-json"],
+          "outputs": [
+            "native-final-native-proof-root",
+            "native-final-decision-root",
+            "native-final-qualification-receipt-root",
+            "boundary-transfer-root",
+            "boundary-root",
+            "boundary-outcome",
+            "boundary-native-outcome",
+            "native-final-outcome"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "settle",
+      "implementations": [
+        {
+          "action": "actions/dev-delivery/warrant/settle-native-failure/action.yml",
+          "domains": ["merge-dev-prs"],
+          "inputs": ["runtime-sha", "branch", "token"],
+          "outputs": ["receipt-root"]
+        },
+        {
+          "action": "actions/dev-delivery/warrant/settle/action.yml",
+          "domains": ["close"],
+          "inputs": ["request-json", "github-token", "runtime-ref"],
+          "outputs": [
+            "evidence-integration-proof-root",
+            "close-receipt-root",
+            "close-final-state-root",
+            "close-successor-wake-json"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "land",
+      "implementations": [
+        {
+          "action": "actions/dev-delivery/queue/land/action.yml",
+          "domains": ["merge-dev-prs"],
+          "inputs": [
+            "request-json",
+            "github-token",
+            "needs-json",
+            "native-final-outcome",
+            "boundary-outcome",
+            "boundary-native-outcome",
+            "failure-final-outcome",
+            "predecessors-ok"
+          ],
+          "outputs": [
+            "merge-evaluated-count",
+            "merge-merged-count",
+            "merge-enqueued-count",
+            "merge-action-count",
+            "merge-skipped-count",
+            "merge-final-base-sha",
+            "merge-admission-state",
+            "merge-receipt-root"
+          ]
+        }
+      ]
+    }
+  ],
+  "jobs": {
+    "admission": {
+      "nodes": ["source", "reserve"]
+    },
+    "native-execution": {
+      "nodes": ["native"]
+    },
+    "seal-native-execution": {
+      "nodes": ["native"]
+    },
+    "delivery-heartbeat": {
+      "nodes": ["native"]
+    },
+    "merge-dev-prs": {
+      "nodes": ["qualify", "settle", "land"]
+    },
+    "close": {
+      "nodes": ["settle"]
+    }
+  },
+  "maxNodeLines": 160,
+  "maxTotalNodeLines": 960
+}

package/architecture/floating-consumer-policy.json CHANGED Viewed

@@ -1,15 +1,15 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-v4-floating-consumer-policy/v1",
-  "policyVersion": "2026-08-14",
+  "policyVersion": "2026-09-09",
   "scope": {
     "repository": "kungfu-systems/buildchain",
     "majorLine": "v4",
     "persistedSelectors": ["v4", "v4-alpha"],
     "publicWorkflowEntrypoints": [
       ".github/workflows/.build.yml",
-      ".github/workflows/publication-artifact.yml",
-      ".github/workflows/release-candidate-promote.yml",
+      ".github/workflows/public-build-publication.yml",
+      ".github/workflows/public-release-promote.yml",
       ".github/workflows/public-build-stage-capsule-canary.yml"
     ]
   },
@@ -32,16 +32,19 @@
     "inputOrEnvironmentIndirection": "deny",
     "nestedCompositeIndirection": "deny",
     "unknownSyntax": "deny",
-    "missingCallerCheckout": "deny"
+    "missingCallerCheckout": "deny",
+    "repositoryLocalInvocation": {
+      "repository": "kungfu-systems/buildchain",
+      "workflow": ".github/workflows/public-release-promote.yml",
+      "exactDefinitionCommitRequired": true,
+      "committedSourceContentRequired": true,
+      "dualContractLocksRequired": true,
+      "executionAuthority": "same-commit-public-definition",
+      "publishedCompatibilityAllowance": false
+    }
   },
   "runtimeEscapeBoundary": {
     "persistedSelectorOverride": false,
-    "protectedAlphaRecoveryBootstrap": {
-      "selector": "alpha/v4/v4.0",
-      "sourcePath": ".github/workflows/self-ops-promotion-recovery.yml",
-      "workflow": ".github/workflows/.release-candidate-promote.yml",
-      "repository": "kungfu-systems/buildchain"
-    },
     "trustedNonPersistentInput": true,
     "requiresSeparateAuthority": true,
     "requiresReadback": true,
@@ -62,7 +65,8 @@
       "policy-version",
       "policy-root",
       "scanner-root",
-      "source-scan-root"
+      "source-scan-root",
+      "source-owned-workflow-definition"
     ]
   },
   "enforcement": {