@kungfu-tech/buildchain 4.1.3-alpha.0 → 4.1.3-alpha.10

package/architecture/universal-workflow-capability-policy.json

@@ -27,18 +27,18 @@
   "contractRoots": [
     "sha256:025e2a4a37bb9364c03aa3c9ab6bad773f78a541203a23791e2d7afd70d773ca",
     "sha256:02e8b51faabbc960e9c70b090426272b720f3e1438b69a0f683b21257bed6302",
-    "sha256:030f75da0b1a1b7678155e0ac03c5866d89d53db45084c61cb2deef824042292",
     "sha256:07bb744fedc9512b1e40f5c00a0037194fc869600fc7fd07de7f3b975b9760ff",
-    "sha256:13dea813a98cb2cc1a51cafb880127ee2c022f3c5aae5144818aec17e9cb7498",
     "sha256:17c5fc05f8599662cd061a94add5313dc0fcea58404f9a92ee632c98abce24c6",
     "sha256:1f3cbeb68fed850330720784bbe2d1d2c91b759cc2459a7fcd0b150af4c47c34",
     "sha256:24cbb86e8fb198f7a949372291e712dd83ff12ba667c7049775ef497261bc62e",
+    "sha256:2649d77a31c75fb93c40a04dea30362c3247cd777dc8ed38a2487d082d25ab05",
     "sha256:265ccc9da3d84b8bf50746b6722b18c680dcc65bd322a5170e81bd5d0fa5b2b0",
     "sha256:2c5a19fe5ebe2550336c42f7de0c71b0e736776758b404716a5f77e0236920dc",
-    "sha256:310b9c3db199e6d900ca4756f152396103630da36aafa7218fe50fb8996f1da1",
     "sha256:34829b6e556284ef7c3f342fafcf92588a94761534e5f19ea12131f389ad4f50",
     "sha256:3d6119d1295ea7083d44a1b82fde5cb5dca910e427d1aee119d3ffbf421810f3",
+    "sha256:3da67ab9893f312415d23c3ec55ab2c16d20fb4efef972f954b3099141e42a08",
     "sha256:40fdce377a9b02cb53f41e822cfc5d96c2f7e57a86a7574bf8ee39f3e0f0e12e",
+    "sha256:421b65afe174ce4ae57290efc73e43f94140b8ef70a2db5cda43e16921d61b4e",
     "sha256:428467c6ac1d768609ff12e72a190462bab9b5bc7dd2ea491553a364aa4c6ef6",
     "sha256:49065b4b7f0e4fd1760e808e310edfea3bd7333c8407c4b419a097ea3d908adc",
     "sha256:5e4788c95b22cbade1323070c03fc6c613cb6086dee8364a7f3805ce95482397",
@@ -52,16 +52,16 @@
     "sha256:9ef9093a7116ad05a7430c60e9164644f47af2a085a60c6043cf46c16bce3479",
     "sha256:a2a553a0e774224b398e5bccde811f8354638547656453adf7734f416f011a2b",
     "sha256:b727204daaae0e09dd94801f1fcd80902fc9e3f1103870e98df379e33094f52a",
-    "sha256:c78f2afe6dfeb8b514982318935885ee7f3e3fbb37946fb2cf5133d51b9bdaeb",
-    "sha256:cb3c04c820fc9d55e02a5c58215061a8e61b9dd69f5d545cbf8444b3b124ca60",
+    "sha256:c48e28c26b13955b4d3ba08803ef8ba2f8f297019513cafa50c3295f03dd2087",
+    "sha256:c5b239dd961249d9f58750311380534cfa45e17a4989ed1318e65769ff5b81db",
     "sha256:cf0b38a5fbbab2ed8aa7998a3c6d3fa48a058de43b6850612294058d263a24c1",
     "sha256:d6bafefea6f0934dcef27910c6dc6fd6bd5ade3a317bce21a0fd235ef14865a2",
+    "sha256:da8d3bfc6ba04130df6e894fc28ef4786eae322d8db874f87080429aab382b81",
     "sha256:dd9ae24a7a586c616a7b3b2b733eb38bfd3f8b19e5faec9e16851719be6abd61",
     "sha256:deee1c61c9731de6e2120abd4c30d3ce760df2ff3f7afb4dd84973543b353660",
     "sha256:e207436baa946b3d25d0159a510b7da474cac8d33701c2e66c089117c05f473d",
-    "sha256:f780070e235bffdee96fc355d7ed5e2fd4188482c41b24e2558a32086634a87c",
-    "sha256:ffda31a96dfb4f5515e0e1099ec34300e79327f3f23b83b211a9b0747c760720"
+    "sha256:f780070e235bffdee96fc355d7ed5e2fd4188482c41b24e2558a32086634a87c"
   ],
-  "validFrom": "2026-08-30T00:00:00.000Z",
-  "expiresAt": "2026-09-15T00:00:00.000Z"
+  "validFrom": "2026-09-15T00:00:00.000Z",
+  "expiresAt": "2026-10-01T00:00:00.000Z"
 }

package/architecture/universal-workflow-fault-campaign.json

@@ -60,7 +60,9 @@
       "id": "self-dogfood-caller",
       "injectionTarget": ".github/workflows/self-ops-bootstrap-dogfood.yml",
       "recoveryRoute": "upgrade-entry-and-full-rerun",
-      "recoveryTarget": "templates/universal-buildchain-bootstrap.yml"
+      "recoveryTarget": "templates/universal-buildchain-bootstrap.yml",
+      "retired": true,
+      "retirementReason": "Standalone self caller removed; retained campaign does not qualify the minimal pipeline."
     }
   ]
 }

package/architecture/workflow-taxonomy.json

@@ -115,50 +115,6 @@
       "invocation": "dispatch-service",
       "rationale": "Buildchain Artifact Signing Authority: owned release public workflow with one canonical implementation."
     },
-    {
-      "id": "auditable-demo",
-      "role": "self",
-      "category": "build",
-      "purpose": "demo-dogfood",
-      "summary": "Buildchain Declarative Demo Dogfood",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Declarative Demo Dogfood: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "auditable-demo-media-profile-qualification",
-      "role": "self",
-      "category": "build",
-      "purpose": "demo-media-qualification",
-      "summary": "Auditable Demo Media Profile Qualification",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Auditable Demo Media Profile Qualification: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "binary-distribution",
-      "role": "self",
-      "category": "build",
-      "purpose": "binary-distribution",
-      "summary": "Binary Distribution",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Binary Distribution: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "binary-release-assets",
-      "role": "self",
-      "category": "release",
-      "purpose": "binary-assets",
-      "summary": "Binary Release Assets",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Binary Release Assets: owned release self workflow with one canonical implementation."
-    },
     {
       "id": "bootstrap",
       "role": "public",
@@ -182,50 +138,6 @@
       "rationale": "Buildchain Channel Build: owned build public workflow with one canonical implementation.",
       "path": ".github/workflows/build.yml"
     },
-    {
-      "id": "build-surface-fixture",
-      "role": "self",
-      "category": "build",
-      "purpose": "fixture",
-      "summary": "Build Surface Fixture",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Build Surface Fixture: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-alpha-self-dogfood",
-      "role": "self",
-      "category": "build",
-      "purpose": "alpha-dogfood",
-      "summary": "Buildchain Alpha Self-Dogfood",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Alpha Self-Dogfood: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-stable-self-dogfood",
-      "role": "self",
-      "category": "build",
-      "purpose": "stable-dogfood",
-      "summary": "Buildchain Stable Self-Dogfood",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Stable Self-Dogfood: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-dev-delivery",
-      "role": "self",
-      "category": "ops",
-      "purpose": "dev-delivery",
-      "summary": "Buildchain Dev Delivery",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Dev Delivery: owned ops self workflow with one canonical implementation."
-    },
     {
       "id": "buildchain-patrol",
       "role": "public",
@@ -237,83 +149,6 @@
       "invocation": "reusable",
       "rationale": "Buildchain Patrol: owned ops public workflow with one canonical implementation."
     },
-    {
-      "id": "buildchain-patrol-daily",
-      "role": "self",
-      "category": "ops",
-      "purpose": "patrol-daily",
-      "summary": "Buildchain Dogfood Patrol Daily",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Dogfood Patrol Daily: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-patrol-monthly",
-      "role": "self",
-      "category": "ops",
-      "purpose": "patrol-monthly",
-      "summary": "Buildchain Dogfood Patrol Monthly",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Dogfood Patrol Monthly: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-patrol-weekly",
-      "role": "self",
-      "category": "ops",
-      "purpose": "patrol-weekly",
-      "summary": "Buildchain Dogfood Patrol Weekly",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Dogfood Patrol Weekly: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-ref-promotion",
-      "role": "self",
-      "category": "release",
-      "purpose": "promote",
-      "summary": "Buildchain Ref Promotion",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Ref Promotion: owned release self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-ref-promotion-recovery",
-      "role": "self",
-      "category": "ops",
-      "purpose": "promotion-recovery",
-      "summary": "Buildchain Ref Promotion Recovery",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Ref Promotion Recovery: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-stable-candidate-patrol",
-      "role": "self",
-      "category": "ops",
-      "purpose": "stable-candidate-patrol",
-      "summary": "Buildchain Dogfood Stable Candidate Patrol",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Dogfood Stable Candidate Patrol: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-stable-candidate-qualification",
-      "role": "self",
-      "category": "build",
-      "purpose": "stable-candidate-qualification",
-      "summary": "Buildchain Stable Candidate Qualification",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Stable Candidate Qualification: owned build self workflow with one canonical implementation."
-    },
     {
       "id": "check",
       "role": "public",
@@ -358,17 +193,6 @@
       "invocation": "reusable",
       "rationale": "Dev Delivery Warrant Close: owned ops public workflow with one canonical implementation."
     },
-    {
-      "id": "dev-merge-queue-governance",
-      "role": "self",
-      "category": "ops",
-      "purpose": "merge-queue",
-      "summary": "Dev Merge Queue Governance",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Dev Merge Queue Governance: owned ops self workflow with one canonical implementation."
-    },
     {
       "id": "dev-pr-auto-merge",
       "role": "public",
@@ -402,39 +226,6 @@
       "invocation": "reusable",
       "rationale": "Engineering Housekeeper: owned ops public workflow with one canonical implementation."
     },
-    {
-      "id": "engineering-housekeeper-daily",
-      "role": "self",
-      "category": "ops",
-      "purpose": "housekeeping-daily",
-      "summary": "Engineering Housekeeper Daily",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Engineering Housekeeper Daily: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "engineering-housekeeper-monthly",
-      "role": "self",
-      "category": "ops",
-      "purpose": "housekeeping-monthly",
-      "summary": "Engineering Housekeeper Monthly",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Engineering Housekeeper Monthly: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "engineering-housekeeper-weekly",
-      "role": "self",
-      "category": "ops",
-      "purpose": "housekeeping-weekly",
-      "summary": "Engineering Housekeeper Weekly",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Engineering Housekeeper Weekly: owned ops self workflow with one canonical implementation."
-    },
     {
       "id": "github-artifact-attestation",
       "role": "public",
@@ -446,39 +237,6 @@
       "invocation": "reusable",
       "rationale": "Buildchain GitHub Artifact Attestation: owned release public workflow with one canonical implementation."
     },
-    {
-      "id": "github-governance-audit",
-      "role": "self",
-      "category": "ops",
-      "purpose": "governance-audit",
-      "summary": "GitHub Governance Authority Audit",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "GitHub Governance Authority Audit: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "next-development-review",
-      "role": "self",
-      "category": "release",
-      "purpose": "next-development",
-      "summary": "Next Development Review",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Next Development Review: owned release self workflow with one canonical implementation."
-    },
-    {
-      "id": "npm-publish",
-      "role": "self",
-      "category": "release",
-      "purpose": "npm-dry-run",
-      "summary": "Publish npm package",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Publish npm package: owned release self workflow with one canonical implementation."
-    },
     {
       "id": "paper-release",
       "role": "public",
@@ -567,17 +325,6 @@
       "invocation": "reusable",
       "rationale": "Release Governance Reconcile: owned ops public workflow with one canonical implementation."
     },
-    {
-      "id": "release-line-bootstrap",
-      "role": "self",
-      "category": "release",
-      "purpose": "line-open",
-      "summary": "Release Line Bootstrap",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Release Line Bootstrap: owned release self workflow with one canonical implementation."
-    },
     {
       "id": "release-propagation",
       "role": "public",
@@ -600,17 +347,6 @@
       "invocation": "reusable",
       "rationale": "Declarative Release Tail: owned release public workflow with one canonical implementation."
     },
-    {
-      "id": "self-hosted-runner-smoke",
-      "role": "self",
-      "category": "ops",
-      "purpose": "runner-smoke",
-      "summary": "Self-hosted Runner Smoke",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Self-hosted Runner Smoke: owned ops self workflow with one canonical implementation."
-    },
     {
       "id": "stable-candidate-patrol",
       "role": "public",
@@ -622,17 +358,6 @@
       "invocation": "reusable",
       "rationale": "Buildchain Stable Candidate Patrol: owned ops public workflow with one canonical implementation."
     },
-    {
-      "id": "universal-bootstrap-dogfood",
-      "role": "self",
-      "category": "ops",
-      "purpose": "bootstrap-dogfood",
-      "summary": "Universal Bootstrap Train-First Self-Dogfood",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Universal Bootstrap Train-First Self-Dogfood: owned ops self workflow with one canonical implementation."
-    },
     {
       "id": "v4-adopter-delivery",
       "role": "public",
@@ -645,103 +370,127 @@
       "rationale": "V4 Adopter Delivery: owned build public workflow with one canonical implementation."
     },
     {
-      "id": "v4-adopter-delivery-dogfood",
-      "role": "self",
+      "id": "v4-stage-capsule-canary",
+      "role": "public",
       "category": "build",
-      "purpose": "adopter-dogfood",
-      "summary": "V4 Adopter Delivery Dogfood",
+      "purpose": "stage-capsule-canary",
+      "summary": "V4 Stage Capsule Canary",
       "owner": "kungfu-origin",
       "status": "active",
-      "invocation": "repository",
-      "rationale": "V4 Adopter Delivery Dogfood: owned build self workflow with one canonical implementation."
+      "invocation": "reusable",
+      "rationale": "V4 Stage Capsule Canary: owned build public workflow with one canonical implementation."
     },
     {
-      "id": "v4-declarative-release-tail-dogfood",
-      "role": "self",
+      "id": "v4-tail-reseal",
+      "role": "public",
+      "category": "ops",
+      "purpose": "tail-reseal",
+      "summary": "V4 Retained Candidate Tail Reseal",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "V4 Retained Candidate Tail Reseal: owned ops public workflow with one canonical implementation."
+    },
+    {
+      "id": "oci-compose-preview",
+      "role": "public",
       "category": "release",
-      "purpose": "tail-dogfood",
-      "summary": "V4 Declarative Release Tail Dogfood",
+      "purpose": "oci-compose-preview",
+      "summary": "Buildchain OCI Compose Preview",
       "owner": "kungfu-origin",
       "status": "active",
-      "invocation": "repository",
-      "rationale": "V4 Declarative Release Tail Dogfood: owned release self workflow with one canonical implementation."
+      "invocation": "reusable",
+      "rationale": "Buildchain OCI Compose Preview: owned release public workflow with one canonical implementation."
     },
     {
-      "id": "v4-public-consumer-dogfood",
-      "role": "self",
-      "category": "build",
-      "purpose": "public-consumer-dogfood",
-      "summary": "V4 Public Consumer Dogfood",
+      "id": "pipeline",
+      "role": "public",
+      "category": "ops",
+      "purpose": "pipeline",
+      "summary": "Buildchain pipeline",
       "owner": "kungfu-origin",
       "status": "active",
-      "invocation": "repository",
-      "rationale": "V4 Public Consumer Dogfood: owned build self workflow with one canonical implementation."
+      "invocation": "reusable",
+      "rationale": "Buildchain pipeline: owned normal pipeline and internal credential boundaries."
     },
     {
-      "id": "v4-publication-rehearsal-dogfood",
-      "role": "self",
-      "category": "release",
-      "purpose": "rehearsal-dogfood",
-      "summary": "V4 Publication Rehearsal Dogfood",
+      "id": ".pipeline-delivery",
+      "role": "component",
+      "category": "ops",
+      "purpose": "pipeline-delivery",
+      "summary": "Internal pipeline delivery",
       "owner": "kungfu-origin",
       "status": "active",
-      "invocation": "repository",
-      "rationale": "V4 Publication Rehearsal Dogfood: owned release self workflow with one canonical implementation."
+      "invocation": "reusable",
+      "rationale": "Internal pipeline delivery: owned normal pipeline and internal credential boundaries."
     },
     {
-      "id": "v4-stage-capsule-canary",
-      "role": "public",
-      "category": "build",
-      "purpose": "stage-capsule-canary",
-      "summary": "V4 Stage Capsule Canary",
+      "id": ".pipeline-products",
+      "role": "component",
+      "category": "release",
+      "purpose": "pipeline-products",
+      "summary": "Internal pipeline product publication",
       "owner": "kungfu-origin",
       "status": "active",
       "invocation": "reusable",
-      "rationale": "V4 Stage Capsule Canary: owned build public workflow with one canonical implementation."
+      "rationale": "Separate product execution, qualification/signing, canonical APPLY and protected follow-ups without consumer orchestration."
     },
     {
-      "id": "v4-tail-reseal",
+      "id": "recover",
       "role": "public",
       "category": "ops",
-      "purpose": "tail-reseal",
-      "summary": "V4 Retained Candidate Tail Reseal",
+      "purpose": "recover",
+      "summary": "Buildchain recovery",
       "owner": "kungfu-origin",
       "status": "active",
       "invocation": "reusable",
-      "rationale": "V4 Retained Candidate Tail Reseal: owned ops public workflow with one canonical implementation."
+      "rationale": "Recover one exact attempt with an optional repaired runtime through the same internal product and delivery jobs."
     },
     {
-      "id": "verify",
-      "role": "self",
-      "category": "build",
-      "purpose": "verify",
-      "summary": "Verify",
+      "id": ".pipeline-execute",
+      "role": "component",
+      "category": "ops",
+      "purpose": "pipeline-execute",
+      "summary": "Internal pipeline execution",
       "owner": "kungfu-origin",
       "status": "active",
-      "invocation": "repository",
-      "rationale": "Verify: owned build self workflow with one canonical implementation."
+      "invocation": "reusable",
+      "rationale": "Share credentialless product execution and protected delivery between normal and recovery public entries."
     },
     {
-      "id": "oci-compose-preview",
-      "role": "public",
+      "id": ".pipeline-version",
+      "role": "component",
       "category": "release",
-      "purpose": "oci-compose-preview",
-      "summary": "Buildchain OCI Compose Preview",
+      "purpose": "pipeline-version",
+      "summary": "Internal pipeline version preparation",
       "owner": "kungfu-origin",
       "status": "active",
       "invocation": "reusable",
-      "rationale": "Buildchain OCI Compose Preview: owned release public workflow with one canonical implementation."
+      "rationale": "Regenerate declared version material in credentialless product jobs and independently qualify it before publication or protected next-development Git writes."
     },
     {
-      "id": "channel-verify",
+      "id": "buildchain",
       "role": "self",
-      "category": "build",
-      "purpose": "channel-verify",
-      "summary": "Release - Verify",
+      "category": "ops",
+      "purpose": "pipeline",
+      "summary": "Buildchain pipeline",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "repository",
+      "rationale": "Generated minimal consumer caller; all orchestration belongs to the published runtime.",
+      "path": ".github/workflows/buildchain.yml"
+    },
+    {
+      "id": "buildchain-recover",
+      "role": "self",
+      "category": "ops",
+      "purpose": "recovery",
+      "summary": "Buildchain recovery",
       "owner": "kungfu-origin",
       "status": "active",
       "invocation": "repository",
-      "rationale": "Verify exact release PR lineage without retired prebuild, dependency discovery, version mutation or approval adapters."
+      "rationale": "Generated minimal consumer caller; all orchestration belongs to the published runtime.",
+      "path": ".github/workflows/buildchain-recover.yml"
     }
   ]
 }

package/contracts/release-discussion-v1.schema.json

@@ -41,6 +41,9 @@
         },
         "source": {
           "type": "object"
+        },
+        "organization": {
+          "const": "attempt-threads/v1"
         }
       },
       "additionalProperties": false