@kungfu-tech/buildchain 4.1.2 → 4.1.3-alpha.1

package/dist/site/public-surface-audit.json

@@ -5,8 +5,8 @@
   "summary": {
     "cliCommandCount": 117,
     "workflowCount": 67,
-    "actionCount": 265,
-    "sitePageCount": 93,
+    "actionCount": 268,
+    "sitePageCount": 94,
     "docCommandRefCount": 1036,
     "failureCount": 0
   },
@@ -864,6 +864,8 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
+          "discussion-id",
+          "discussion-url",
           "github-artifact-attestation-evidence-root",
           "github-artifact-attestation-id",
           "github-artifact-attestation-publication-receipt-digest",
@@ -888,7 +890,7 @@
           "release-tail-transaction-state",
           "release-transaction-root"
         ],
-        "outputCount": 31
+        "outputCount": 33
       },
       {
         "id": "build",
@@ -1740,6 +1742,8 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
+          "discussion-id",
+          "discussion-url",
           "github-artifact-attestation-evidence-root",
           "github-artifact-attestation-id",
           "github-artifact-attestation-publication-receipt-digest",
@@ -1775,7 +1779,7 @@
           "release-tail-transaction-state",
           "release-transaction-root"
         ],
-        "outputCount": 43
+        "outputCount": 45
       },
       {
         "id": "public-release-propagation",
@@ -4435,6 +4439,7 @@
           "repository",
           "required-artifacts-path",
           "required-status-check",
+          "resume-discussion-id",
           "resume-transaction-id",
           "runtime-commit",
           "runtime-tree",
@@ -4442,12 +4447,13 @@
           "sealed-bundle-root",
           "source-sha",
           "stage-capsules-path",
+          "standalone-binary-distribution",
           "state-path",
           "target-ref",
           "target-sha",
           "token"
         ],
-        "inputCount": 32
+        "inputCount": 34
       },
       {
         "id": "release/promotion/classify",
@@ -4837,6 +4843,42 @@
         ],
         "inputCount": 11
       },
+      {
+        "id": "release/transaction/inspect",
+        "path": "actions/release/transaction/inspect/action.yml",
+        "inputs": [
+          "session-json",
+          "token"
+        ],
+        "inputCount": 2
+      },
+      {
+        "id": "release/transaction/open",
+        "path": "actions/release/transaction/open/action.yml",
+        "inputs": [
+          "discussion-id",
+          "dry-run",
+          "expected-nodes-json",
+          "intent-key",
+          "predecessor",
+          "source-json",
+          "token"
+        ],
+        "inputCount": 7
+      },
+      {
+        "id": "release/transaction/record",
+        "path": "actions/release/transaction/record/action.yml",
+        "inputs": [
+          "node",
+          "payload-json",
+          "sequence",
+          "session-json",
+          "status",
+          "token"
+        ],
+        "inputCount": 6
+      },
       {
         "id": "runtime/dependencies/install",
         "path": "actions/runtime/dependencies/install/action.yml",
@@ -5518,6 +5560,10 @@
         "id": "manual:release-candidate",
         "category": "manual"
       },
+      {
+        "id": "manual:release-discussions",
+        "category": "manual"
+      },
       {
         "id": "manual:release-flow",
         "category": "manual"
@@ -10831,8 +10877,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "e43fdb0289df88871f3f0febbe04dcb9311a252a2b1df9b3a83a2d10c9d4a70f",
-    "workflowRegistryDigest": "36c67c70f168b8a727bd53c594e93e635c8df370078dc1e8ba537023e99a0fa1",
-    "pageRegistryDigest": "db7e6d4ea151259ee3cfc863d9f928d77db783548788771097a94f148d5f9a0a"
+    "workflowRegistryDigest": "3e137e0f54830a7be7976ac3a5d071fa05586d8011daab2eb149f40b4e535cf5",
+    "pageRegistryDigest": "56222fb3665c9bcd626a301d809db80ac8f8cb42b2a15b98d32241708f26b398"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-11T23:17:50.000Z",
-  "publishedAt": "2026-09-11T23:17:50.000Z",
+  "generatedAt": "2026-09-12T06:35:54.000Z",
+  "publishedAt": "2026-09-12T06:35:54.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "b76388c9a5a82d956edac123d08a72945424a84e",
+  "sourceRevision": "b06002db5210f70c8da3ad79357ac7d5ab3d6497",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.1.2",
+    "version": "4.1.3-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -119,7 +119,8 @@
       "./publication-rehearsal": "./packages/core/publication/publication-rehearsal.js",
       "./publication-qualification": "./packages/core/publication/publication-qualification.js",
       "./adopter-delivery": "./packages/core/adoption/adopter-delivery.js",
-      "./cross-platform-adopter-qualification": "./packages/core/adoption/cross-platform-adopter-qualification.js"
+      "./cross-platform-adopter-qualification": "./packages/core/adoption/cross-platform-adopter-qualification.js",
+      "./release-discussion-reader": "./packages/core/release/discussion/reader.js"
     }
   },
   "repository": "https://github.com/kungfu-systems/buildchain",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-11T23:17:50.000Z",
-  "publishedAt": "2026-09-11T23:17:50.000Z",
+  "generatedAt": "2026-09-12T06:35:54.000Z",
+  "publishedAt": "2026-09-12T06:35:54.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "b76388c9a5a82d956edac123d08a72945424a84e",
+  "sourceRevision": "b06002db5210f70c8da3ad79357ac7d5ab3d6497",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.1.2",
+    "version": "4.1.3-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ba1b9db61750646d507f086f0f267965a94b6c1276ab6d9f958ca4645b2a5073"
+      "digest": "sha256:0fc24661217d58302858cca49a5f11d49c894fc720f6735e11da2dba50300c91"
     },
     {
       "id": "build-facts",

package/dist/site/workflow-registry.json

@@ -382,6 +382,8 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
+        "discussion-id",
+        "discussion-url",
         "github-artifact-attestation-evidence-root",
         "github-artifact-attestation-id",
         "github-artifact-attestation-publication-receipt-digest",
@@ -406,7 +408,7 @@
         "release-tail-transaction-state",
         "release-transaction-root"
       ],
-      "outputCount": 31,
+      "outputCount": 33,
       "taxonomy": {
         "id": ".release-candidate-promote",
         "role": "component",
@@ -1044,7 +1046,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.1.2",
+      "introducedVersion": "4.1.3-alpha.1",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
@@ -1733,6 +1735,8 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
+        "discussion-id",
+        "discussion-url",
         "github-artifact-attestation-evidence-root",
         "github-artifact-attestation-id",
         "github-artifact-attestation-publication-receipt-digest",
@@ -1768,7 +1772,7 @@
         "release-tail-transaction-state",
         "release-transaction-root"
       ],
-      "outputCount": 43,
+      "outputCount": 45,
       "taxonomy": {
         "id": "release-candidate-promote",
         "role": "public",
@@ -2475,7 +2479,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.1.2",
+      "introducedVersion": "4.1.3-alpha.1",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
@@ -2505,7 +2509,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.1.2",
+      "introducedVersion": "4.1.3-alpha.1",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
@@ -2535,7 +2539,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.1.2",
+      "introducedVersion": "4.1.3-alpha.1",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
@@ -7044,6 +7048,7 @@
         "repository",
         "required-artifacts-path",
         "required-status-check",
+        "resume-discussion-id",
         "resume-transaction-id",
         "runtime-commit",
         "runtime-tree",
@@ -7051,12 +7056,13 @@
         "sealed-bundle-root",
         "source-sha",
         "stage-capsules-path",
+        "standalone-binary-distribution",
         "state-path",
         "target-ref",
         "target-sha",
         "token"
       ],
-      "inputCount": 32,
+      "inputCount": 34,
       "capabilityGroup": "release-passport-trust",
       "status": "active",
       "owner": "buildchain-actions",
@@ -7735,6 +7741,72 @@
       "sunsetCondition": "explicit-contract-change-review",
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
+    {
+      "apiRole": "implementation",
+      "id": "release/transaction/inspect",
+      "path": "actions/release/transaction/inspect/action.yml",
+      "inputs": [
+        "session-json",
+        "token"
+      ],
+      "inputCount": 2,
+      "capabilityGroup": "release-passport-trust",
+      "status": "active",
+      "owner": "buildchain-actions",
+      "maturity": "stable",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
+    },
+    {
+      "apiRole": "implementation",
+      "id": "release/transaction/open",
+      "path": "actions/release/transaction/open/action.yml",
+      "inputs": [
+        "discussion-id",
+        "dry-run",
+        "expected-nodes-json",
+        "intent-key",
+        "predecessor",
+        "source-json",
+        "token"
+      ],
+      "inputCount": 7,
+      "capabilityGroup": "release-passport-trust",
+      "status": "active",
+      "owner": "buildchain-actions",
+      "maturity": "stable",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
+    },
+    {
+      "apiRole": "implementation",
+      "id": "release/transaction/record",
+      "path": "actions/release/transaction/record/action.yml",
+      "inputs": [
+        "node",
+        "payload-json",
+        "sequence",
+        "session-json",
+        "status",
+        "token"
+      ],
+      "inputCount": 6,
+      "capabilityGroup": "release-passport-trust",
+      "status": "active",
+      "owner": "buildchain-actions",
+      "maturity": "stable",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
+    },
     {
       "apiRole": "implementation",
       "id": "runtime/dependencies/install",

package/docs/node-api-reference.md

@@ -2707,3 +2707,12 @@ Target: `./packages/core/adoption/cross-platform-adopter-qualification.js`. Publ
 | `CROSS_PLATFORM_NEUTRAL_DRIVER` | constant: const CROSS_PLATFORM_NEUTRAL_DRIVER | none | value | Import does not declare a throw contract. | none-on-import | `import { CROSS_PLATFORM_NEUTRAL_DRIVER } from "@kungfu-tech/buildchain/cross-platform-adopter-qualification";` | `packages/core/adoption/cross-platform-adopter-qualification.js:12` |
 | `qualifyCrossPlatformAdopters` | function: function qualifyCrossPlatformAdopters({ reports, consumers }) | { reports, consumers } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { qualifyCrossPlatformAdopters } from "@kungfu-tech/buildchain/cross-platform-adopter-qualification";` | `packages/core/adoption/cross-platform-adopter-qualification.js:143` |
 | `validateCrossPlatformAdopterReport` | function: function validateCrossPlatformAdopterReport(report) | report | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateCrossPlatformAdopterReport } from "@kungfu-tech/buildchain/cross-platform-adopter-qualification";` | `packages/core/adoption/cross-platform-adopter-qualification.js:97` |
+
+## `@kungfu-tech/buildchain/release-discussion-reader`
+
+Target: `./packages/core/release/discussion/reader.js`. Public symbols: 2.
+
+| Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| `discussionStatus` | function: function discussionStatus(state) | state | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { discussionStatus } from "@kungfu-tech/buildchain/release-discussion-reader";` | `packages/core/release/discussion/reader.js:155` |
+| `readReleaseDiscussion` | function: function readReleaseDiscussion({ body, records }) | { body, records } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { readReleaseDiscussion } from "@kungfu-tech/buildchain/release-discussion-reader";` | `packages/core/release/discussion/reader.js:11` |

package/docs/release-discussions.md

@@ -0,0 +1,193 @@
+---
+status: draft
+period: ongoing
+theme: release-discussion-transactions
+doc_type: implementation-contract
+source_level: user-consensus
+confidence: medium
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-12
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-12
+  visible_context: Release workflow implementation and agreed consumer Discussion transaction model.
+  invisible_context_boundary: Hosted token qualification and alpha publication are not claimed by this document.
+---
+
+# Release Discussion transactions
+
+One release intent owns one Discussion in the consumer repository. Its immutable
+body declares the intent and the complete expected semantic node list. The
+Announcements category is resolved by the initialization service; subsequent
+operations receive the exact Discussion ID. Categories have repository-specific
+IDs. Enable Discussions and retain the Announcements category before executing a
+release. A preview performs no Discussion reads or writes.
+
+The caller grants `discussions: write` to the reusable workflow job alongside its
+existing release permissions. The called workflow uses the consumer's automatic
+`GITHUB_TOKEN`. Checking out Buildchain does not change that repository or token.
+A reusable workflow cannot elevate the permissions granted by its caller.
+
+```yaml
+jobs:
+  release:
+    permissions:
+      contents: write
+      discussions: write
+      actions: write
+      id-token: write
+    uses: kungfu-systems/buildchain/.github/workflows/public-release-promote.yml@v4
+    with:
+      request-json: ${{ inputs.request-json }}
+      runtime-ref: ${{ inputs.runtime-ref || '' }}
+```
+
+This fragment illustrates the additional Discussion permission; retain other
+permissions required by the consumer's publication provider. The platform
+contracts are documented in GitHub's [reusable workflow reference](https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations)
+and [Discussions API guide](https://docs.github.com/en/graphql/guides/using-the-graphql-api-for-discussions).
+
+## Records and concurrency
+
+The body is not a mutable global status document. New intents declare `organization: attempt-threads/v1`. Each attempt owns exactly
+one top-level root comment; node events, checkpoints and diagnostics are appended
+as replies using that root comment ID. Workflows append bounded JSON envelopes
+with readable context and evidence links. Each record contains an intent ID, workflow attempt,
+predecessor, semantic node, sequence, status, payload schema, and the selected
+runtime's exact repository and revision. These are provenance; downstream nodes
+do not compare the runtime revision with the workflow entry revision.
+
+Node owners serialize their own sequences. Different node owners append
+independent replies under the same attempt root. Recovery explicitly selects the predecessor in the same
+Discussion. A late result from an older attempt remains history; it cannot
+complete or overwrite the recovering attempt. Success requires every declared
+node, including nodes whose records have not appeared. Reusing completed work
+requires explicit qualification by the recovering runtime.
+
+The release controller must serialize initialization for one intent. GitHub does
+not supply a unique constraint, compare-and-swap or exactly-once mutation API.
+Initialization scans complete repository category pages, reuses the matching
+intent, and refuses duplicate owners. A mutation whose response was lost is read
+back before another write. If its outcome remains unknown, execution stops with
+an explicit diagnosis. `clientMutationId` is not used as an idempotency guarantee.
+The attempt owner creates the root before dispatching independent node writers.
+Root creation is serialized and response-loss recovery reads it back. Different
+roots for one attempt, nested roots and events attached to the wrong attempt are
+rejected. Root and reply connections are both completely paginated; individual
+page and total byte bounds fail closed. Community conversation is ignored.
+
+Exact IDs carry the transaction through execution; search indexing is not an
+execution dependency. Pagination limits fail closed instead of silently hiding
+records. Only records from the original workflow writer are authoritative;
+ordinary community replies are excluded and edited transaction records are
+reported as integrity failures.
+
+## Human-readable information hub
+
+The Discussion body declares the release intent and expected nodes. Each root
+links its workflow execution, selected runtime and predecessor attempt. Replies
+name the semantic node, distinguish checkpoint sequence from execution status,
+and expose bounded details. An independent binary workflow links its own run but
+replies to the release attempt it observed before starting; a late completion
+cannot migrate into a successor attempt.
+
+Checkpoint replies include downloadable JSON attachments with file names, media
+types, byte counts and SHA-256 digests. On node failures, the same thread receives
+JSON diagnostics and a text `.log` containing the recorded event timeline and
+bounded failure classification. Raw exceptions, environment variables and HTTP
+credentials are not copied into diagnostics. Complete execution logs remain
+linked through their Actions runs. Qualification also exercises JSON/log downloads.
+
+Automation uploads these files through the documented GitHub Release asset API
+and embeds the provider's download links in the owning comment. This does not
+use GitHub's browser-only drag-and-drop upload implementation. The existing draft
+material archive is private to users with the required repository access; a
+public Discussion does not make draft attachments publicly downloadable. Download
+links require that permission and files remain outside the source Git database.
+
+Root comments and event replies are immutable execution facts. The latest state
+is computed from records, not from an overwritten status summary. Historical flat
+intents remain readable as historical data; all new writes use an attempt root
+and replies, and new intents enforce that organization. No historical Discussion
+body or comment is rewritten to change its layout.
+
+## Recovery bytes and historical readers
+
+Large sealed inputs and provider checkpoints are retained as immutable,
+content-addressed assets in a draft material archive associated with the intent.
+The archive is storage, not publication state. A Discussion checkpoint commits
+the exact material manifest after upload and byte readback. Failed uploads can
+leave unreferenced material but cannot commit an incomplete checkpoint. No
+transaction-log history is added to the consumer's source Git object database.
+Actual version-code commits and publication refs retain their existing roles.
+
+Each runtime distributes the standalone `dist/readers/release-discussion.cjs`.
+The same pure reader is available as the versioned Node API
+`@kungfu-tech/buildchain/release-discussion-reader`. Records carry the standalone
+reader byte digest. The recovery archive retains the exact reader bytes and the public
+release includes the first retained reader asset. Recovery preserves those public
+bytes while retaining each later writer's decoder in the archive. The standalone reader accepts captured JSON
+on standard input and emits a projection and a small
+`buildchain.release-handoff/v1` document. It performs no provider effects.
+
+```sh
+node --permission --allow-fs-read=/absolute/path/release-discussion.cjs \
+  /absolute/path/release-discussion.cjs < captured-discussion.json
+```
+
+A payload with a different schema belongs to its recorded historical reader.
+The current runtime does not silently reinterpret it. Historical decoding and
+new execution are separate: the recovering runtime consumes a supported handoff,
+qualifies original source and material, and reads providers before issuing any
+remaining effects. Switching runtime X to Y creates new attempt records in the
+same Discussion. It neither rewrites X's records nor changes the release intent.
+
+## Ownership
+
+`actions/release/transaction/{open,record,inspect}` are reusable Node adapters.
+`packages/core/release/discussion` owns envelopes, pure state projections, sessions, thread organization,
+presentation, declared evidence and recovery contracts. `threads.js` checks
+provider placement; `presentation.js` renders contextual Markdown; `evidence.js`
+builds bounded attachment descriptors and diagnostic reports. `packages/core/providers/github/discussions` owns GitHub
+transport and immutable material IO. The existing public promotion workflow
+owns job boundaries; the Rust publication state machine still owns publication
+decisions and provider-effect ordering.
+
+The public Bootstrap API also exposes the `release-discussion` capability for
+consumer transport qualification and read-only diagnosis. Buildchain's existing
+Bootstrap dogfood caller accepts this request through its manual
+`request-json` input, preserving the same public entry and central
+runtime preparation as other consumers.
+
+## First publication with a selected runtime
+
+For Buildchain self-publication, dispatch `self-release-promote.yml` with the exact
+protected alpha `sha`, its `target-ref`, `dry-run: "false"`, and the desired
+`runtime-ref`. Leave recovery selectors empty for a first publication. The public
+publisher still verifies the protected source and obtains fresh hosted admission.
+`recover-durable-transaction` is reserved for an existing partial publication;
+it is not required merely because the selected runtime differs from the entry.
+
+## Resume by Discussion
+
+Pass `resume-discussion-id` in the public promotion request and select the repaired
+train through `runtime-ref`. Keep the protected target ref and source coordinates.
+The qualifier restores content-addressed candidate material, verifies original
+qualification, then re-observes providers before any remaining publication effect.
+Do not combine this selector with candidate-run or transaction-id recovery.
+
+When standalone binary distribution is requested, the intent also requires the
+`binary-distribution` node. Its separate workflow resolves the immutable locator
+from the public release, captures the active attempt, and appends provider readback
+to that attempt. A result arriving after recovery stays on the older attempt.
+The terminal publication receipt remains independently verifiable even while
+next-development or binary distribution is incomplete.
+
+The manual Bootstrap caller inherits the declared repository workflow permissions;
+the typed capability request must declare its own subset. `verifyMaterials: true`
+on a qualification request additionally tests draft Release asset retention using
+`contents: write`. The initial injected failure is intentional and leaves durable
+records for a subsequent runtime recovery probe.