@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/docs/web-surface-deployments.md

@@ -8,7 +8,7 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-09-09
+last_reviewed: 2026-09-11
 ai_provenance:
   model_family: GPT-6
   product: Codex
@@ -185,11 +185,9 @@ floating ref, such as:
 ```yaml
 jobs:
   web:
-    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v4
     with:
-      buildchain-contract-lock-path: .buildchain/contract-lock.json
-      buildchain-contract-compatibility-policy: major-compatible
-      buildchain-contract-drift-issue-mode: compatible-and-breaking
+      contract-lock: .buildchain/contract-lock.json
       build-command: pnpm build
       artifact-path: dist
 ```
@@ -747,7 +745,7 @@ the standard PR review and promotion flow without copying bespoke glue:
 ```yaml
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v4
     with:
       build-command: npm run build
       verify-command: npm run check
@@ -760,40 +758,38 @@ The reusable workflow maps GitHub events to Buildchain web-surface semantics:
 | --- | --- |
 | `pull_request` opened / synchronized / reopened | validate, build, verify, and plan `preview` for `pr-N` |
 | `pull_request` closed | plan apply-mode cleanup for the `pr-N` preview alias and manifest |
-| `pull_request` closed for a matching release PR | verify the release intent and exact workflow-shell runtime, then wait for the protected `main` push; do not plan or apply production from `refs/pull/*/merge` |
+| `pull_request` closed for a matching release PR | verify the release intent, then wait for the protected `main` push; do not plan or apply production from `refs/pull/*/merge` |
 | `push` to `main` | validate, build, verify, plan and apply `staging` from the merged `main` SHA, then optionally open a production release PR |
 | `push` to `main` from a matching release PR merge | validate the associated release PR, plan `production`, and enter the configured GitHub Environment gate from the protected mainline ref |
 | `workflow_dispatch` with `production-approved = true` | plan `production` and enter the configured GitHub Environment gate |
 
-The optional `buildchain-ref` input is empty by default. Empty keeps the
-web-surface run on the stable Buildchain runtime selected by the reusable
-workflow ref, normally `@v3`. A trusted maintainer can expose a
-`workflow_dispatch` input and pass it through for one-off train validation.
-See [`runtime-train-validation.md`](runtime-train-validation.md) for the shared
-train protocol and notification template:
+The optional `runtime-ref` parameter selects a transient execution runtime.
+An empty value uses the selected consumer contract lock or entry default.
+All preparation goes through the shared [Runtime entry](runtime-entry.md).
+A maintainer can expose a manual input for train validation or repair:
 
 ```yaml
 on:
   workflow_dispatch:
     inputs:
-      buildchain-ref:
+      runtime-ref:
         description: "Temporary Buildchain runtime ref for trusted manual validation"
         required: false
         default: ""
 
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v4
     with:
-      buildchain-ref: ${{ inputs.buildchain-ref || '' }}
+      runtime-ref: ${{ inputs.runtime-ref || '' }}
       build-command: pnpm run build
       verify-command: pnpm run check
       artifact-path: dist
 ```
 
-Only trusted `workflow_dispatch` runs by repository actors with write,
+Only repository actors with write,
 maintain, or admin permission may use a non-empty runtime override. Train refs
-such as `train/v3/v3.0/site-source-of-truth` are temporary validation refs, not
+such as `train/v4/v4.1/site-source-of-truth` are temporary validation refs, not
 stable production dependencies or pending merge targets. They may remain for a
 retention window after release as a fast-use and rollback channel, with old
 trains handled by periodic Buildchain cleanup. The web-surface deployment
@@ -811,7 +807,7 @@ permissions:
 
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v4
     with:
       build-command: pnpm run build
       verify-command: pnpm run check
@@ -905,7 +901,7 @@ For release-PR publishing, callers opt in explicitly:
 ```yaml
 jobs:
   web-surface:
-    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-web.yml@v4
     with:
       build-command: npm run build
       verify-command: npm run check

package/docs/workflow-catalog.md

@@ -38,7 +38,6 @@ Register ownership before adding a workflow. `pnpm run check:workflows` validate
 | [public-build-publication.yml](../.github/workflows/public-build-publication.yml) | build | reusable | active | Buildchain Publication Artifact |
 | [public-build-stage-capsule-canary.yml](../.github/workflows/public-build-stage-capsule-canary.yml) | build | reusable | active | V4 Stage Capsule Canary |
 | [public-ops-alpha-candidate-patrol.yml](../.github/workflows/public-ops-alpha-candidate-patrol.yml) | ops | reusable | active | Buildchain Dev to Alpha Candidate Patrol |
-| [public-ops-bootstrap-recovery.yml](../.github/workflows/public-ops-bootstrap-recovery.yml) | ops | reusable | active | Universal Buildchain Bootstrap Recovery |
 | [public-ops-bootstrap.yml](../.github/workflows/public-ops-bootstrap.yml) | ops | reusable | active | Buildchain Universal Bootstrap |
 | [public-ops-dev-auto-merge.yml](../.github/workflows/public-ops-dev-auto-merge.yml) | ops | reusable | active | Dev PR Auto Merge |
 | [public-ops-dev-qualification-patrol.yml](../.github/workflows/public-ops-dev-qualification-patrol.yml) | ops | reusable | active | Buildchain Dev Qualification Patrol |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.1.0-alpha.0",
+  "version": "4.1.0-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -116,7 +116,7 @@
     "./package.json": "./package.json",
     "./oci-publication": "./packages/core/publication/oci-publication-bundle.js",
     "./floating-consumer-policy": "./packages/core/consumer/floating-consumer-policy.js",
-    "./runtime-ref-resume-authority": "./packages/core/consumer/runtime-ref-resume-authority.js",
+    "./runtime-resume-lineage": "./packages/core/release/recovery/lineage.js",
     "./tail-reseal": "./packages/core/release/tail-reseal.js",
     "./tail-reseal-receipt": "./packages/core/release/tail-reseal-receipt.js",
     "./publication-rehearsal": "./packages/core/publication/publication-rehearsal.js",
@@ -155,10 +155,10 @@
   "scripts": {
     "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery/dev-delivery-authority-candidate.js packages/core/dev-delivery/dev-delivery-authority-evidence.js packages/core/dev-delivery/dev-delivery-authority-landing.js packages/core/dev-delivery/dev-delivery-authority-observation.js packages/core/dev-delivery/dev-delivery-authority-qualification.js packages/core/dev-delivery/dev-delivery-authority-settlement.js packages/core/dev-delivery/dev-delivery-authority-state.js packages/core/dev-delivery/dev-delivery-execution-failure.js packages/core/dev-delivery/dev-delivery-execution-transfer.js packages/core/dev-delivery/dev-delivery-landing-readback.js packages/core/dev-delivery/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery/dev-delivery-landing-testing-port.js packages/core/dev-delivery/dev-delivery-native-execution.js packages/core/dev-delivery/dev-delivery-native-proof.js packages/core/dev-delivery/dev-delivery-process-boundary.js packages/core/dev-delivery/dev-delivery-warrant-qualification.js packages/core/dev-delivery/dev-delivery-warrant-state.js packages/core/dev-delivery/commands/dev-delivery-authority-command-adapters.mjs packages/core/dev-delivery/commands/dev-delivery-authority-provider.mjs packages/core/dev-delivery/commands/dev-delivery-authority.mjs packages/core/dev-delivery/native/execution.js packages/core/dev-delivery/commands/dev-delivery-process-boundary.mjs packages/core/dev-delivery/native/transactions.js packages/core/dev-delivery/commands/dev-delivery-two-phase.mjs packages/core/dev-delivery/commands/dev-delivery-warrant-options.mjs packages/core/dev-delivery/warrant/persistence.js templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash packages/core/providers/commands/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:layout && pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node packages/core/governance/commands/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
-    "check:static": "node scripts/check-javascript-syntax.mjs && node scripts/check-source-bindings.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/v4-runtime-ref-resume-authority-v1.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/v4-runtime-ref-resume-authority-v1/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json packages/core/contracts/command-registry.mjs packages/core/governance/cli/compatibility-facts.mjs packages/core/contracts/canonical-contracts.js packages/core/contracts/kungfu-temporal-fact.js packages/core/governance/buildchain-compatibility-fact.js packages/core/governance/buildchain-compatibility-authority.js packages/core/governance/buildchain-compatibility-proof.js packages/core/consumer/floating-consumer-evidence.js packages/core/consumer/floating-consumer-policy.js packages/core/consumer/floating-consumer-release-passport.js packages/core/consumer/runtime-ref-resume-authority.js packages/core/release/tail-reseal-contract.js packages/core/release/tail-reseal-github.js packages/core/release/tail-reseal-receipt.js packages/core/release/tail-reseal.js packages/core/consumer/runtime-selector-persistence.js packages/core/release/provider-operation-journal.js packages/core/release/provider-readback-idempotency.js packages/core/release/release-activation-shadow.js packages/core/release/stable-publication-fence.js packages/core/release/partial-mutation-recovery-qualification.js packages/core/build/stage-capsule.js packages/core/build/stage-capsule-store.js packages/core/build/stage-capsule-local-store.js packages/core/build/platform-stage-checkpoints.js packages/core/build/stage-capsule-resume-planner.js packages/core/build/stage-capsule-qualification.js packages/core/build/stage-capsule-qualification-campaign.js packages/core/dev-delivery/delivery-warrant-fixture-runner.js packages/core/dev-delivery/delivery-warrant-read-candidate.js packages/core/dev-delivery/delivery-warrant-semantic-diff-gate.js packages/core/dev-delivery/delivery-warrant-shadow-adapter.js packages/core/release/runtime-override-authorization.js scripts/check-core-mechanism-inventory.mjs scripts/check-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs packages/core/dev-delivery/commands/dev-pr-prequeue-guard.mjs scripts/check-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs packages/core/governance/commands/architecture.mjs packages/core/runtime/commands/bridge-bootstrap.mjs scripts/bridge-evidence.mjs packages/core/consumer/commands/consumer-policy.mjs packages/core/runtime/commands/host-adapter.mjs scripts/platform-stage-checkpoint-rehearsal.mjs scripts/stage-capsule-resume-rehearsal.mjs packages/core/build/commands/stage-capsule-qualification.mjs scripts/tail-reseal-macos-rehearsal.mjs packages/core/release/commands/tail-reseal.mjs scripts/warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/architecture.test.mjs tests/bridge.test.mjs tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-ref-resume-authority.test.mjs tests/runtime-semantic-closure.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs tests/warrant-shadow-plan.test.mjs",
+    "check": "pnpm run check:layout && node scripts/check-runtime-entry.mjs && pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node packages/core/governance/commands/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check:static": "node scripts/check-javascript-syntax.mjs && node scripts/check-source-bindings.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/runtime-resume-lineage-v2.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/runtime-resume-lineage-v2/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json packages/core/contracts/command-registry.mjs packages/core/governance/cli/compatibility-facts.mjs packages/core/contracts/canonical-contracts.js packages/core/contracts/kungfu-temporal-fact.js packages/core/governance/buildchain-compatibility-fact.js packages/core/governance/buildchain-compatibility-authority.js packages/core/governance/buildchain-compatibility-proof.js packages/core/consumer/floating-consumer-evidence.js packages/core/consumer/floating-consumer-policy.js packages/core/consumer/floating-consumer-release-passport.js packages/core/release/recovery/lineage.js packages/core/release/tail-reseal-contract.js packages/core/release/tail-reseal-github.js packages/core/release/tail-reseal-receipt.js packages/core/release/tail-reseal.js packages/core/consumer/runtime-selector-persistence.js packages/core/release/provider-operation-journal.js packages/core/release/provider-readback-idempotency.js packages/core/release/release-activation-shadow.js packages/core/release/stable-publication-fence.js packages/core/release/partial-mutation-recovery-qualification.js packages/core/build/stage-capsule.js packages/core/build/stage-capsule-store.js packages/core/build/stage-capsule-local-store.js packages/core/build/platform-stage-checkpoints.js packages/core/build/stage-capsule-resume-planner.js packages/core/build/stage-capsule-qualification.js packages/core/build/stage-capsule-qualification-campaign.js packages/core/dev-delivery/delivery-warrant-fixture-runner.js packages/core/dev-delivery/delivery-warrant-read-candidate.js packages/core/dev-delivery/delivery-warrant-semantic-diff-gate.js packages/core/dev-delivery/delivery-warrant-shadow-adapter.js scripts/check-core-mechanism-inventory.mjs scripts/check-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs packages/core/dev-delivery/commands/dev-pr-prequeue-guard.mjs scripts/check-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs packages/core/governance/commands/architecture.mjs packages/core/runtime/commands/bridge-bootstrap.mjs scripts/bridge-evidence.mjs packages/core/consumer/commands/consumer-policy.mjs packages/core/runtime/commands/host-adapter.mjs scripts/platform-stage-checkpoint-rehearsal.mjs scripts/stage-capsule-resume-rehearsal.mjs packages/core/build/commands/stage-capsule-qualification.mjs scripts/tail-reseal-macos-rehearsal.mjs packages/core/release/commands/tail-reseal.mjs scripts/warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/runtime-entry-provider.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/architecture.test.mjs tests/bridge.test.mjs tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-resume-lineage.test.mjs tests/runtime-semantic-closure.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs tests/warrant-shadow-plan.test.mjs",
     "check:bridge": "cargo fmt --manifest-path crates/buildchain-host-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml",
-    "check:contracts": "pnpm run check:contracts:rust && node --test tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/domain-wasm.test.mjs tests/floating-consumer-policy-contract.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-ref-resume-authority.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/publication-rehearsal.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs",
+    "check:contracts": "pnpm run check:contracts:rust && node --test tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/domain-wasm.test.mjs tests/floating-consumer-policy-contract.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-resume-lineage.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/publication-rehearsal.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs",
     "build:wasm": "node scripts/build-domain-wasm.mjs",
     "check:wasm": "prettier --check packages/core/runtime/domain-wasm.js packages/core/runtime/domain-wasm-artifact.js scripts/build-domain-wasm.mjs scripts/tsup-action.config.mjs packages/core/contracts/action-inventory.js tests/domain-wasm.test.mjs && node scripts/build-domain-wasm.mjs --check",
     "check:workflows": "node scripts/check-workflow-taxonomy.mjs && bash scripts/check-workflows.sh",
@@ -178,7 +178,7 @@
     "bridge:run": "node packages/core/runtime/commands/bridge-bootstrap.mjs run",
     "bridge:evidence": "node scripts/bridge-evidence.mjs",
     "check:contracts:rust": "cargo fmt --manifest-path crates/buildchain-domain-contracts/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-domain-contracts/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-domain-contracts/Cargo.toml",
-    "generate:workflows": "node scripts/generate-workflow-taxonomy.mjs && node scripts/generate-bootstrap-recovery.mjs && node scripts/generate-bootstrap-admission.mjs",
+    "generate:workflows": "node scripts/generate-workflow-taxonomy.mjs && node scripts/generate-bootstrap-admission.mjs",
     "check:implementation-naming": "node scripts/check-implementation-naming.mjs",
     "check:layout": "node scripts/check-code-layout.mjs"
   },

package/packages/core/adoption/commands/init-repo.mjs

@@ -339,7 +339,7 @@ name: Build
 on:
   workflow_dispatch:
     inputs:
-      buildchain-ref:
+      runtime-ref:
         description: "Temporary Buildchain runtime ref for trusted manual validation"
         required: false
         default: ""
@@ -358,7 +358,7 @@ jobs:
   publication:
     uses: kungfu-systems/buildchain/.github/workflows/public-build-publication.yml@v4
     with:
-      buildchain-ref: \${{ inputs.buildchain-ref || '' }}
+      runtime-ref: \${{ inputs.runtime-ref || '' }}
       toolchain-type: config
       verify-command: make check
       artifact-name: publication-artifact

package/packages/core/adoption/cross-platform-adopter-qualification.js

@@ -43,11 +43,10 @@ function validateSourceBinding(binding) {
     "source binding",
   );
   if (
-    !SHA.test(binding.runtimeSha || "") ||
     !SHA.test(binding.consumerSha || "") ||
     !ROOT.test(binding.inputRoot || "")
   )
-    fail("report requires exact runtime, consumer and input roots");
+    fail("report requires exact consumer and input roots");
 }
 
 function validateExecutionEvidence(execution) {
@@ -171,25 +170,15 @@ export function qualifyCrossPlatformAdopters({ reports, consumers }) {
     fail(
       `platform matrix mismatch; missing=${missing.join(",") || "none"}; unexpected=${unexpected.join(",") || "none"}`,
     );
-  const reference = normalized[0].sourceBinding;
-  for (const report of normalized.slice(1)) {
-    if (
-      report.sourceBinding.runtimeSha !== reference.runtimeSha
-    )
-      fail("all platform reports must bind the same exact source and matrix");
-  }
   for (const consumer of consumers) {
     const rows = normalized.filter(report => report.consumer === consumer);
-    if (rows.some(report => !same(report.sourceBinding, rows[0].sourceBinding)))
+    if (rows.some(report => report.sourceBinding.consumerSha !== rows[0].sourceBinding.consumerSha || report.sourceBinding.inputRoot !== rows[0].sourceBinding.inputRoot))
       fail("each consumer must bind the same exact source and input on every platform");
   }
   const orderedReports = expectedKeys.map((key) => reportByKey.get(key));
   const body = {
     schemaVersion: 1,
     contract: CROSS_PLATFORM_ADOPTER_QUALIFICATION_CONTRACT,
-    sourceBinding: {
-      runtimeSha: reference.runtimeSha,
-    },
     consumers: [...consumers],
     platforms: [...CROSS_PLATFORM_ADOPTER_PLATFORMS],
     reports: orderedReports.map(({ consumer, platform, reportRoot, sourceBinding }) => ({

package/packages/core/adoption/qualification/actions.js

@@ -17,7 +17,7 @@ function coordinates(core, env) {
   return {
     runtimeRoot: installationRoot(import.meta.url),
     consumerRoot: path.join(env.GITHUB_WORKSPACE, ".buildchain/consumer"),
-    runtimeSha: core.getInput("workflow-sha", { required: true }),
+    runtimeSha: env.BUILDCHAIN_RUNTIME_SHA,
   };
 }
 export function selectAdopterAction(core, env) {
@@ -25,7 +25,7 @@ export function selectAdopterAction(core, env) {
     request: request(core),
     repository: env.GITHUB_REPOSITORY,
     sourceSha: env.GITHUB_SHA,
-    runtimeSha: core.getInput("workflow-sha", { required: true }),
+    runtimeSha: env.BUILDCHAIN_RUNTIME_SHA,
   });
   for (const [key, value] of Object.entries(selected))
     core.setOutput(key, value);
@@ -46,9 +46,7 @@ export function admitAdopterPolicyAction(core, env) {
     inputPath: input["input-path"],
     invocationSourcePath:
       input["invocation-source-path"] ||
-      (env.GITHUB_REPOSITORY === "kungfu-systems/buildchain"
-        ? ".github/workflows/self-build-adopter-dogfood.yml"
-        : ""),
+      env.GITHUB_WORKFLOW_REF?.split("@")[0].slice(env.GITHUB_REPOSITORY.length + 1),
   });
   for (const [key, value] of Object.entries(
     consumerPolicyOutputs(result, output),

package/packages/core/adoption/qualification/admission.js

@@ -21,8 +21,8 @@ export function selectAdopter({ request, repository, sourceSha, runtimeSha }) {
   if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(request.consumer || ""))
     throw new Error("Adopter identity must be stable lowercase");
   const sha = String(request["consumer-ref"] || sourceSha).toLowerCase();
-  if (!/^[0-9a-f]{40}$/.test(sha) || !/^[0-9a-f]{40}$/.test(runtimeSha || ""))
-    throw new Error("Adopter requires exact consumer and runtime commits");
+  if (!/^[0-9a-f]{40}$/.test(sha))
+    throw new Error("Adopter requires an exact consumer commit");
   return { repository: request["consumer-repository"] || repository, sha };
 }
 export function verifyAdopterCheckouts(
@@ -30,7 +30,6 @@ export function verifyAdopterCheckouts(
   execute = command,
 ) {
   for (const [directory, sha] of [
-    [runtimeRoot, runtimeSha],
     [consumerRoot, consumerSha],
   ]) {
     if (

package/packages/core/build/artifact/attestation.js

@@ -98,7 +98,6 @@ export function createBuildAttestationService({
     );
     if (
       prepared.predicate?.plan_root !== plan.root ||
-      prepared.predicate?.runtime?.sha !== plan.identity.sha ||
       prepared.platform?.id !== plan.build.attestation.platform
     )
       throw new Error("Attestation preparation belongs to another build");

package/packages/core/build/artifact/contracts.js

@@ -44,7 +44,6 @@ export function verifyExecutionIdentity(result, plan, platform) {
     root !== rootOf(body) ||
     result.plan_root !== plan.root ||
     result.source_sha !== plan.source.sha ||
-    result.runtime_sha !== plan.identity.sha ||
     result.platform !== platform.id ||
     JSON.stringify(result.run) !== JSON.stringify(plan.run)
   )
@@ -72,7 +71,6 @@ export function verifyManifest(file, root, plan, platform) {
     manifest.platform?.id !== platform.id ||
     manifest.git?.sha !== plan.source.sha ||
     manifest.git?.treeSha !== plan.source.tree_sha ||
-    manifest.git?.runtimeSha !== plan.identity.sha ||
     manifest.git?.repository !== plan.run.repository
   ) {
     throw new Error(`Artifact manifest identity mismatch: ${platform.id}`);
@@ -142,8 +140,7 @@ export function verifyCredential(manifestFile, payloadRoot, plan, platform) {
     evidence[0].status !== "accepted" ||
     evidence[0].source?.repository !== plan.run.repository ||
     evidence[0].source?.sha !== plan.source.sha ||
-    evidence[0].source?.treeSha !== plan.source.tree_sha ||
-    evidence[0].buildchain?.runtimeSha !== plan.identity.sha
+    evidence[0].source?.treeSha !== plan.source.tree_sha
   )
     throw new Error("Credential evidence identity mismatch");
   return manifest;

package/packages/core/build/artifact/store.js

@@ -72,7 +72,7 @@ export function createBuildArtifactStore({
   ) {
     const result = await client.downloadArtifact(ref.id, {
       path: target,
-      expectedHash: ref.digest.replace(/^sha256:/u, ""),
+      expectedHash: `sha256:${ref.digest.replace(/^sha256:/u, "")}`,
       ...findOptions(repository, runId, token),
     });
     if (result.digestMismatch)
@@ -92,10 +92,11 @@ export function createBuildArtifactStore({
       ...findOptions(repository, runId, token),
     });
     const matches = artifacts.filter((item) => item.name === name);
-    if (matches.length !== 1)
-      throw new Error(
-        `Expected one same-run artifact ${name}; found ${matches.length}`,
-      );
+    if (matches.length !== 1) {
+      const error = new Error(`Expected one artifact ${name}; found ${matches.length}`);
+      error.code = matches.length === 0 ? "artifact-not-found" : "artifact-ambiguous";
+      throw error;
+    }
     const found = matches[0];
     if (!found.digest)
       throw new Error(`Artifact provider omitted digest: ${name}`);

package/packages/core/build/artifact-signing.js

@@ -268,7 +268,7 @@ export function createArtifactSigningRequest({
         runtime.repository || "kungfu-systems/buildchain",
         "runtime repository",
       ),
-      sha: exactSourceSha(runtime.sha, "runtime SHA"),
+      sha: runtime.sha,
     },
     artifact: {
       id: nonEmptyString(artifact.id || artifact.path, "artifact id"),
@@ -398,10 +398,7 @@ export function createArtifactSigningReceipt({
     authority: {
       contract: ARTIFACT_SIGNING_AUTHORITY_CONTRACT,
       id: nonEmptyString(authority.id || request.authority.id, "authority id"),
-      runtimeSha: exactSourceSha(
-        authority.runtimeSha || request.runtime.sha,
-        "authority runtime SHA",
-      ),
+      runtimeSha: authority.runtimeSha || request.runtime.sha,
     },
     signature: { ...request.signature },
     ...(status === "passed"
@@ -443,17 +440,14 @@ export function validateArtifactSigningReceipt(receipt, { request } = {}) {
     }
     if (receipt.digest !== documentDigest(receipt))
       issues.push("receipt digest mismatch");
+
     if (request) {
       const requestCheck = validateArtifactSigningRequest(request);
       if (!requestCheck.ok) issues.push(...requestCheck.issues);
       if (receipt.requestDigest !== request.digest)
         issues.push("receipt request digest mismatch");
-      if (stableJson(receipt.signature) !== stableJson(request.signature)) {
+      if (stableJson(receipt.signature) !== stableJson(request.signature))
         issues.push("receipt signature policy mismatch");
-      }
-      if (receipt.authority?.runtimeSha !== request.runtime.sha) {
-        issues.push("receipt authority runtime mismatch");
-      }
     }
     if (receipt.status === "passed") {
       exactDigest(receipt.result?.artifactDigest, "result artifact digest");

package/packages/core/build/binary/actions.js

@@ -1,5 +1,3 @@
-import path from "node:path";
-import { installationRoot } from "../../runtime/installation-root.js";
 import { command } from "../../runtime/action-process.mjs";
 import { releaseAssetClient } from "../../providers/github/release-assets.js";
 import {
@@ -10,14 +8,14 @@ import {
 function sourceWorkspace(env) {
   const workspace = env.GITHUB_WORKSPACE;
   if (
-    path.resolve(installationRoot(import.meta.url)) !==
-      path.resolve(workspace) ||
     command("git", ["rev-parse", "HEAD"], {
       cwd: workspace,
       stdio: "pipe",
     }).trim() !== env.GITHUB_SHA
   )
-    throw new Error("Binary distribution requires exact source-owned code");
+    throw new Error(
+      "Binary distribution requires the exact checked-out source",
+    );
   return workspace;
 }
 export function admitBinaryDistributionAction(core, env) {
@@ -31,7 +29,11 @@ export function admitBinaryDistributionAction(core, env) {
     sourceSha: env.GITHUB_SHA,
   });
 }
-export async function buildBinaryDistributionAction(core, env) {
+export async function buildBinaryDistributionAction(
+  core,
+  env,
+  { build = buildBinaryDistribution } = {},
+) {
   const workspace = sourceWorkspace(env),
     matrix = JSON.parse(core.getInput("matrix-json", { required: true }));
   const nodePath = command("node", ["-p", "process.execPath"], {
@@ -42,7 +44,7 @@ export async function buildBinaryDistributionAction(core, env) {
     cwd: workspace,
     stdio: "pipe",
   }).trim();
-  return buildBinaryDistribution({
+  return build({
     workspace,
     tag: core.getInput("tag", { required: true }),
     platform: matrix.platform,
@@ -52,9 +54,13 @@ export async function buildBinaryDistributionAction(core, env) {
     logPath: env.BUILDCHAIN_LOG_PATH,
   });
 }
-export async function qualifyBinaryDistributionAction(core, env) {
+export async function qualifyBinaryDistributionAction(
+  core,
+  env,
+  { qualify = qualifyBinaryDistribution } = {},
+) {
   const workspace = sourceWorkspace(env);
-  return qualifyBinaryDistribution({
+  return qualify({
     workspace,
     tag: core.getInput("tag", { required: true }),
     repository: env.GITHUB_REPOSITORY,

package/packages/core/build/binary-publication-dispatch.js

@@ -8,10 +8,6 @@ export function dispatchBinaryPublication(
     /^[\w.-]+\/[\w.-]+$/u.test(repository || ""),
     "Binary publication requires an exact repository",
   );
-  requireValue(
-    /^[0-9a-f]{40}$/u.test(sha || ""),
-    "Binary publication requires an exact runtime SHA",
-  );
   requireValue(
     /^\d+$/u.test(runId || ""),
     "Binary publication requires an exact evidence run",
@@ -29,7 +25,7 @@ export function dispatchBinaryPublication(
     "--ref",
     tag,
     "-f",
-    `buildchain-ref=${sha}`,
+    `runtime-ref=${sha}`,
     "-f",
     `evidence-run-id=${runId}`,
     "-f",
@@ -43,7 +39,7 @@ export function binaryPublicationDispatchAction(_core, env) {
   dispatchBinaryPublication({
     repository: env.GITHUB_REPOSITORY,
     tag: env.RELEASE_TAG,
-    sha: env.GITHUB_SHA,
+    sha: env.BUILDCHAIN_RUNTIME_SHA,
     runId: env.GITHUB_RUN_ID,
   });
 }

package/packages/core/build/demo/action-context.js

@@ -1,19 +1,10 @@
 import path from "node:path";
-import { command } from "../../runtime/action-process.mjs";
 import { installationRoot } from "../../runtime/installation-root.js";
 export function demoActionContext(core, env) {
   const runtimeRoot = installationRoot(import.meta.url);
   const workspace = path.resolve(env.GITHUB_WORKSPACE);
-  const sha = core.getInput("runtime-sha", { required: true });
-  if (
-    !/^[a-f0-9]{40}$/u.test(sha) ||
-    command("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], {
-      stdio: "pipe",
-    }).trim() !== sha
-  )
-    throw new Error(
-      "Demo runtime differs from the exact workflow implementation",
-    );
+  const sha = env.BUILDCHAIN_RUNTIME_SHA;
+
   return {
     workspace,
     runtimeRoot,

package/packages/core/build/demo/binary-action.js

@@ -1,24 +1,22 @@
-import fs from "node:fs";
 import path from "node:path";
-import { installationRoot } from "../../runtime/installation-root.js";
 import { sourceSha } from "../standalone/identity.js";
 import { buildStandaloneBinary } from "../standalone/build.js";
 import { runTransportSmoke } from "./transport-smoke.js";
-export function prepareDemoBinaryAction(core, env) {
+export function prepareDemoBinaryAction(
+  core,
+  env,
+  { build = buildStandaloneBinary, smoke = runTransportSmoke } = {},
+) {
   const workspace = path.resolve(env.GITHUB_WORKSPACE);
-  if (
-    fs.realpathSync(installationRoot(import.meta.url)) !==
-      fs.realpathSync(workspace) ||
-    sourceSha(workspace) !== env.GITHUB_SHA
-  )
+  if (sourceSha(workspace) !== env.GITHUB_SHA)
     throw new Error(
       "Demo binary must be built from the exact checked-out source",
     );
-  buildStandaloneBinary({
+  build({
     cwd: workspace,
     outputDir: "dist/auditable-demo-binary",
   });
-  runTransportSmoke({
+  smoke({
     artifactRoot: path.join(workspace, "dist/auditable-demo-binary"),
     scenarioPath: path.join(workspace, ".buildchain/auditable-demo.json"),
   });

package/packages/core/build/gate/controller.js

@@ -15,8 +15,6 @@ export function prepareGateProfileController({
     execFileSync("git", ["-C", directory, "rev-parse", "HEAD"], {
       encoding: "utf8",
     }).trim();
-  if (git(runtimeRoot) !== runtimeSha)
-    throw new Error("Gate runtime differs from admitted commit");
   const sourceRoot = path.join(workspace, "source");
   const sourceSha = git(sourceRoot);
   const cwd = containedBuildPath(

package/packages/core/build/github-attestation/action.js

@@ -1,24 +1,19 @@
 import path from "node:path";
-import { installationRoot } from "../../runtime/installation-root.js";
-import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 import { validateAttestationInput } from "./admission.js";
 import { prepareAttestation, sealAttestation } from "./transaction.js";
 export function admitAttestationAction(core, env) {
  const input = JSON.parse(core.getInput("request-json", { required: true }));
- validateAttestationInput({ runtimeSha: input["buildchain-ref"], definitionSha: core.getInput("definition-sha", { required: true }), evidenceRunId: input["evidence-run-id"], currentRunId: env.GITHUB_RUN_ID,
+ validateAttestationInput({ evidenceRunId: input["evidence-run-id"], currentRunId: env.GITHUB_RUN_ID,
   sourceSha: input["source-sha"], currentSourceSha: env.GITHUB_SHA, subjectRelativePath: input["subject-relative-path"], platformManifestRelativePath: input["platform-manifest-relative-path"], releasePassportRelativePath: input["release-passport-relative-path"] });
 }
 const input = (core, name) => core.getInput(name, { required: true });
-function runtime(core) { verifyCheckoutIdentity({ directory: installationRoot(import.meta.url), sha: input(core, "runtime-sha"), label: "Attester runtime" }); }
 export function prepareAttestationAction(core, env) {
- runtime(core);
  const outputs = prepareAttestation({ subjectPath: input(core, "subject-path"), platformManifestPath: input(core, "platform-manifest-path"), releasePassportPath: input(core, "release-passport-path"),
-  policy: JSON.parse(input(core, "policy-json")), expectedBuildchainRef: input(core, "runtime-sha"), expectedCallerRepository: env.GITHUB_REPOSITORY, expectedSourceSha: env.GITHUB_SHA,
+  policy: JSON.parse(input(core, "policy-json")), expectedCallerRepository: env.GITHUB_REPOSITORY, expectedSourceSha: env.GITHUB_SHA,
   outputDir: path.join(env.GITHUB_WORKSPACE, ".buildchain/github-artifact-attestation") });
  for (const [key, value] of Object.entries(outputs)) core.setOutput(key, value);
 }
 export function sealAttestationAction(core, env) {
- runtime(core);
  const outputs = sealAttestation({ runtimeSha: input(core, "runtime-sha"), sourceSha: env.GITHUB_SHA, outputDir: path.join(env.GITHUB_WORKSPACE, ".buildchain/github-artifact-attestation"), preparation: JSON.parse(input(core, "preparation-json")),
   bundlePath: input(core, "bundle-path"), attestationId: input(core, "attestation-id"), attestationUrl: input(core, "attestation-url"), token: input(core, "token"), environment: env,
   workflow: { repository: env.GITHUB_REPOSITORY, runId: env.GITHUB_RUN_ID, runAttempt: env.GITHUB_RUN_ATTEMPT, job: env.GITHUB_JOB, url: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}` } });

package/packages/core/build/github-attestation/admission.js

@@ -1,13 +1,5 @@
 import { requireValue } from "../../runtime/action-process.mjs";
 export function validateAttestationInput(request) {
-  requireValue(
-    /^[0-9a-f]{40}$/u.test(request.runtimeSha || ""),
-    "buildchain-ref must be an exact 40-hex commit",
-  );
-  requireValue(
-    request.runtimeSha === request.definitionSha,
-    "attester runtime must match the defining signer workflow SHA",
-  );
   requireValue(
     request.evidenceRunId === request.currentRunId,
     "attestation inputs must come from the current caller workflow run",

package/packages/core/build/github-attestation/transaction.js

@@ -41,7 +41,6 @@ export function sealAttestation(
   verify = verifyArtifactAttestationSigner,
 ) {
   if (
-    preparation.policy.signer.workflowDigest !== runtimeSha ||
     preparation.policy.caller.sourceSha !== sourceSha ||
     preparation.policy.caller.repository !== workflow.repository
   )
@@ -52,7 +51,7 @@ export function sealAttestation(
   verify({
     subjectPath: preparation.subjectPath,
     repository: workflow.repository,
-    runtimeSha,
+    signerDigest: preparation.policy.signer.workflowDigest,
     sourceSha,
     predicateType: preparation.predicateType,
     bundlePath,

package/packages/core/build/lifecycle/stage-action.js

@@ -1,3 +1,4 @@
+import { buildStageRecovery } from "../recovery/transaction.js";
 import { readBuildActionContext } from "../plan/action-context.js";
 import { runBuildStage } from "./stage.js";
 export async function runBuildStageAction(core, env) {
@@ -9,6 +10,7 @@ export async function runBuildStageAction(core, env) {
   );
   await runBuildStage({
     ...context,
+    recovery: buildStageRecovery(context, core.getInput("token", { required: true })),
     stage: core.getInput("stage", { required: true }),
     environment: {
       ...environment,