@kungfu-tech/buildchain 4.1.3-alpha.0 → 4.1.3-alpha.10

package/docs/release-discussions.md

@@ -52,14 +52,16 @@ and [Discussions API guide](https://docs.github.com/en/graphql/guides/using-the-
 
 ## Records and concurrency
 
-The body is not a mutable global status document. Workflows append bounded JSON
-envelopes in comments. Each record contains an intent ID, workflow attempt,
+The body is not a mutable global status document. New intents declare `organization: attempt-threads/v1`. Each attempt owns exactly
+one top-level root comment; node events, checkpoints and diagnostics are appended
+as replies using that root comment ID. Workflows append bounded JSON envelopes
+with readable context and evidence links. Each record contains an intent ID, workflow attempt,
 predecessor, semantic node, sequence, status, payload schema, and the selected
 runtime's exact repository and revision. These are provenance; downstream nodes
 do not compare the runtime revision with the workflow entry revision.
 
 Node owners serialize their own sequences. Different node owners append
-independent comments. Recovery explicitly selects the predecessor in the same
+independent replies under the same attempt root. Recovery explicitly selects the predecessor in the same
 Discussion. A late result from an older attempt remains history; it cannot
 complete or overwrite the recovering attempt. Success requires every declared
 node, including nodes whose records have not appeared. Reusing completed work
@@ -71,12 +73,47 @@ Initialization scans complete repository category pages, reuses the matching
 intent, and refuses duplicate owners. A mutation whose response was lost is read
 back before another write. If its outcome remains unknown, execution stops with
 an explicit diagnosis. `clientMutationId` is not used as an idempotency guarantee.
+The attempt owner creates the root before dispatching independent node writers.
+Root creation is serialized and response-loss recovery reads it back. Different
+roots for one attempt, nested roots and events attached to the wrong attempt are
+rejected. Root and reply connections are both completely paginated; individual
+page and total byte bounds fail closed. Community conversation is ignored.
+
 Exact IDs carry the transaction through execution; search indexing is not an
 execution dependency. Pagination limits fail closed instead of silently hiding
 records. Only records from the original workflow writer are authoritative;
 ordinary community replies are excluded and edited transaction records are
 reported as integrity failures.
 
+## Human-readable information hub
+
+The Discussion body declares the release intent and expected nodes. Each root
+links its workflow execution, selected runtime and predecessor attempt. Replies
+name the semantic node, distinguish checkpoint sequence from execution status,
+and expose bounded details. An independent binary workflow links its own run but
+replies to the release attempt it observed before starting; a late completion
+cannot migrate into a successor attempt.
+
+Checkpoint replies include downloadable JSON attachments with file names, media
+types, byte counts and SHA-256 digests. On node failures, the same thread receives
+JSON diagnostics and a text `.log` containing the recorded event timeline and
+bounded failure classification. Raw exceptions, environment variables and HTTP
+credentials are not copied into diagnostics. Complete execution logs remain
+linked through their Actions runs. Qualification also exercises JSON/log downloads.
+
+Automation uploads these files through the documented GitHub Release asset API
+and embeds the provider's download links in the owning comment. This does not
+use GitHub's browser-only drag-and-drop upload implementation. The existing draft
+material archive is private to users with the required repository access; a
+public Discussion does not make draft attachments publicly downloadable. Download
+links require that permission and files remain outside the source Git database.
+
+Root comments and event replies are immutable execution facts. The latest state
+is computed from records, not from an overwritten status summary. Historical flat
+intents remain readable as historical data; all new writes use an attempt root
+and replies, and new intents enforce that organization. No historical Discussion
+body or comment is rewritten to change its layout.
+
 ## Recovery bytes and historical readers
 
 Large sealed inputs and provider checkpoints are retained as immutable,
@@ -111,8 +148,10 @@ same Discussion. It neither rewrites X's records nor changes the release intent.
 ## Ownership
 
 `actions/release/transaction/{open,record,inspect}` are reusable Node adapters.
-`packages/core/release/discussion` owns envelopes, projections, sessions and
-recovery contracts. `packages/core/providers/github/discussions` owns GitHub
+`packages/core/release/discussion` owns envelopes, pure state projections, sessions, thread organization,
+presentation, declared evidence and recovery contracts. `threads.js` checks
+provider placement; `presentation.js` renders contextual Markdown; `evidence.js`
+builds bounded attachment descriptors and diagnostic reports. `packages/core/providers/github/discussions` owns GitHub
 transport and immutable material IO. The existing public promotion workflow
 owns job boundaries; the Rust publication state machine still owns publication
 decisions and provider-effect ordering.

package/docs/release-governance.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-09-12
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-12
-  visible_context: Stable canary policy, symmetric zero-input self-build callers, artifact validation and regression tests.
+  generated_at: 2026-09-14
+  visible_context: User-directed zero-delay self release policy, required provider evidence and regression tests.
   invisible_context_boundary: No external consumer changes or completed stable publication is claimed.
 ---
 
@@ -358,7 +358,7 @@ The production channel and the test channel therefore intentionally diverge
 after release: production stays on the release commit, while alpha/dev continue
 at the next prerelease commit.
 
-### Stable Release Throttle And Canary Gate
+### Stable Release Evidence Gate
 
 Buildchain's own stable channel has an additional pre-publication gate. It is
 evaluated after the PR-stage release candidate has been resolved and before the
@@ -379,8 +379,6 @@ candidate is allowed only when all of these facts are true:
 
 - the candidate resolves to an immutable exact alpha tag and its GitHub
   prerelease timestamp;
-- at least 24 hours have passed since the preceding stable patch on the same
-  minor line;
 - the preceding stable-to-alpha comparison contains a product or public
   contract path, not only version, test, evidence, or retrospective changes;
 - the version-bound impact record has a non-empty summary and at least one
@@ -392,8 +390,7 @@ candidate is allowed only when all of these facts are true:
 - the status target is the repository-owned alpha dogfood workflow, its summary
   archive matches the provider digest, and the summary binds the source run,
   attempt, exact candidate runtime and all install/build/verify stages; overrides,
-  another candidate and incomplete artifacts are rejected;
-- at least one hour has elapsed after the last required canary completed.
+  another candidate and incomplete artifacts are rejected.
 
 The machine report is written to
 `.buildchain/release-passport/stable-release-gate.json`. A passing report is
@@ -407,10 +404,11 @@ Generic `commit-status` consumer canaries remain supported for repositories that
 explicitly declare them; their runtime input or workflow-owned run-name binding
 continues to apply.
 
-The cooldown is a minimum interval, not an instruction to release every day.
-Compatible work should still be batched until a stable release has a concrete
-consumer need. Changing the interval, canary set, attestors, product path
-boundary, or soak time is a reviewed policy change.
+Buildchain sets both the minimum stable interval and canary soak duration to
+zero. A candidate can proceed as soon as its required evidence is valid; no
+fixed cooldown, soak window or scheduled release time delays this delivery.
+Changing the canary set, attestors or product path boundary remains a reviewed
+policy change.
 
 Repositories that want a predictable scheduled stable window can use
 [`Stable Candidate Patrol`](stable-candidate-patrol.md). It persists each exact

package/docs/runtime-entry.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-11
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-11
-  visible_context: Explicit user-approved runtime selection, recovery and alpha publication requirements.
+  generated_at: 2026-09-14
+  visible_context: Source-bound recovery, nested delivery credential transport, published entry contract and local failure-path tests.
   invisible_context_boundary: This contract does not claim implementation or hosted qualification is complete.
 ---
 
@@ -40,7 +40,9 @@ Switching runtimes does not automatically qualify all previous results for reuse
 Neither the persisted caller nor its contract lock needs a train rewrite.
 
 An entry failure is repaired by publishing and adopting a corrected entry and
-starting a complete run. Recovering an invalid entry is not a runtime feature.
+starting a new provider run through the corrected floating entry. The caller files
+remain unchanged. A usable recovery entry can still recover the exact existing
+attempt; an entry failure before admission has no attempt to recover.
 Buildchain self-dogfood uses exactly the same consumer contract and has no
 repository-specific execution or recovery route.
 
@@ -54,7 +56,73 @@ single preparation ownership, different entry/runtime execution, train recovery,
 platform and multi-job qualification, and validation of the published consumer
 entry. A source test or a successful package import alone is insufficient.
 
-## Consumer build and recovery
+## Minimal pipeline provider credentials
+
+Configure `BUILDCHAIN_AUTOMATION_TOKEN` once as a repository Actions secret when
+protected delivery requires permissions unavailable to `GITHUB_TOKEN`. Both
+generated callers already inherit secrets. No token value, additional input or
+provider orchestration belongs in the consumer TOML or workflow source.
+
+Scope this credential to the consumer repository. Delivery needs Administration
+read access to inspect classic branch locks, Checks read, and Actions, Contents,
+Pull requests and Commit statuses write access for its existing provider steps.
+It does not need permission to change branch protection or bypass review. Development
+admission can fall back to `GITHUB_TOKEN`; unreadable protection still fails
+closed before candidate reservation instead of assuming an unlocked branch.
+Channel enqueue requires an explicit automation credential or an App installation
+credential because `GITHUB_TOKEN` suppresses the required `merge_group` workflow.
+Both central entries select that credential through the shared token provider;
+queue reads and journal writes retain their existing workflow credential. An App
+uses `BUILDCHAIN_APP_CLIENT_ID` and `BUILDCHAIN_APP_PRIVATE_KEY`, scoped to the
+consumer repository with Pull requests write access. Missing or incomplete queue
+credentials fail closed before enqueue.
+
+The internal delivery edge forwards only this named secret to the credentialed
+source, reservation, heartbeat and landing steps. Product builds, native
+execution and native evidence sealing retain their separate read-only jobs and
+receive no automation credential. Publication settlement uses the same canonical
+secret as its existing fallback credential. Repairing a missing workflow secret
+edge requires a corrected published entry and a new provider run.
+
+## Minimal pipeline recovery
+
+The minimal contract has one normal event caller and one manual recovery caller,
+plus `.buildchain/buildchain.toml`. Both callers are maintained by Buildchain's
+consumer setup; product differences do not require additional recovery workflows.
+The repository implementation alone does not prove the entry has been published
+or qualified in a clean consumer.
+
+The workflow summary identifies the current attempt, its source PR, completed
+steps and remaining work. Follow **Recover this attempt**, choose **Run workflow**,
+and paste the exact attempt. Leave `runtime-ref` empty for an ordinary retry;
+supply a repaired runtime only when needed. The public recovery entry accepts no
+other recovery selectors. It derives configuration, producer runs, artifacts and
+transaction coordinates from the canonical attempt history.
+
+Recovery opens a new attempt with an explicit predecessor. Successful platform
+jobs and their actual retained artifacts are independently requalified; only
+missing platforms or explicitly incompatible stage implementations are rebuilt.
+A signing failure can requalify the original sealed bytes under the repaired
+publisher. Partial publication preserves its original signed transaction and
+completed effects, reads providers again, and authorizes only remaining effects.
+Missing, expired or conflicting evidence stops with a diagnosis; it does not
+silently trigger a complete rebuild or replace published bytes.
+
+A repeated request for the same predecessor and repair selects the same successor.
+If that recovery was interrupted, select the successor shown in the summary for
+the next recovery. An active predecessor must first finish or be cancelled using
+its ordinary GitHub execution link. A changed or superseded source cannot reuse
+an old attempt as authority for the current PR. Completed publication remains
+recorded even when distribution or the next development version still needs work.
+Cancellation stops remaining work and cannot undo published results.
+
+Once admitted, ordinary wake events continue with the recovered attempt's exact
+runtime, even when the consumer lock still names the original runtime. A further
+runtime change requires another explicit recovery. An entry repair is distributed
+through the existing `@v4` or `@v4-alpha` entry; consumers do not maintain backup
+scripts, patch a job definition, or add a different recovery workflow family.
+
+## Advanced build component recovery
 
 ```yaml
 on:

package/docs/runtime-train-validation.md

@@ -8,27 +8,30 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-08
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-08
-  invisible_context: not asserted
+  generated_at: 2026-09-14
+  visible_context: Source-bound caller installation, pipeline wake implementation and GitHub event documentation.
+  invisible_context_boundary: No unobserved provider execution or publication authority is claimed.
 ---
 
 # Runtime Train Validation
 
 A train repairs the execution runtime without changing the consumer's durable
 public entry. All public workflows, including ordinary builds, use the same
-[Runtime entry contract](runtime-entry.md). The transient runtime parameter
-wins over the consumer lock. Buildchain dogfood follows this same path.
+[Runtime entry contract](runtime-entry.md). The recovery entry accepts a transient runtime parameter, which wins over the
+consumer lock. The normal minimal pipeline accepts only an optional config path.
+Buildchain dogfood follows the same two-entry contract.
 
 ## Validate a runtime change
 
 1. Commit the candidate with its action bundles, WASM and runtime contract.
 2. Publish the candidate at `train/v4/v4.1/<capability>`.
-3. Dispatch the consumer's existing public entry with `runtime-ref` set to that
-   train. Record the selected runtime, consumer source and resulting evidence.
+3. Recover the exact retained attempt through `buildchain-recover.yml`, with
+   `runtime-ref` set to that train. Record the attempt, selected runtime, consumer
+   source and resulting evidence.
 4. After checks and independent review, merge into protected Dev and publish
    the requested Alpha. Qualify the published entry before Stable promotion.
 
@@ -38,13 +41,38 @@ provider credentials, capability constraints and readback requirements.
 
 ## Recover a runtime failure
 
-Start a new dispatch through the same public entry with the repaired train.
-For builds, supply `resume-run-id`; for release promotion, preserve the original
-candidate run and transaction in the typed request. The entry prepares runtime
-Y while the task keeps its original source and valid completed evidence.
+Start a new dispatch through `buildchain-recover.yml` with the exact attempt
+and the repaired train. The runtime selects the retained source and completed
+evidence; the consumer does not provide candidate, run or transaction selectors.
 A GitHub failed-job rerun does not change its inputs and cannot select a new
 runtime. Do not persist the train into the caller workflow or contract lock.
 
 If the public entry itself is defective, publish and adopt the corrected entry
 and start a full run. Copied consumer recovery packages and alternate recovery
 workflows are not part of the runtime contract.
+
+## Protected minimal-entry installation
+
+Install both generated callers, `buildchain.yml` and `buildchain-recover.yml`,
+on the protected default branch before retiring the previous delivery controller.
+Read back both files at the exact protected commit and verify their provider
+workflow registrations. A workflow registered from a task branch does not prove
+that its event receiver is installed on the default branch. GitHub requires that
+location for [repository dispatch events](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#repository_dispatch).
+
+Recovery preserves source and completed artifacts, then emits a repository
+wake for the remaining pipeline work. That wake requires the normal caller on
+the default branch; installing only the manual recovery caller leaves this
+continuation receiver absent. Verify the complete pair before the first recovery.
+
+During this bounded migration, pause the normal pipeline before enabling the
+previous protected delivery controller. After the installation merge, wait for
+its runs and Warrant to become terminal, then pause that controller and enable
+the normal pipeline before recovering a current admitted attempt. An installation
+merge advances the protected base, so an older unmerged source attempt must be
+re-admitted on the current base before recovery.
+
+Both callers are byte-identical to the generated consumer entries and call the
+published `@v4-alpha` public workflows. Recovery accepts only `attempt` and
+optional `runtime-ref`; the normal caller retains its protected config path.
+This installation order does not qualify the full self cutover or Stable release.

package/docs/stable-candidate-patrol.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-09-12
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-12
-  visible_context: Repository stable policy, public build qualification producer, artifact reader and regression tests.
+  generated_at: 2026-09-14
+  visible_context: User-directed zero-delay self release policy, required provider evidence and regression tests.
   invisible_context_boundary: No credentials, private logs, or unpublished consumer content were used.
 ---
 
@@ -52,7 +52,8 @@ It writes `buildchain-canary/buildchain-zero-input` on the qualified runtime SHA
 as `github-actions[bot]`. The consumer source SHA may differ from that runtime.
 
 The repository Patrol policy requires the alpha Release and this qualification
-status. It retains the one-hour soak. The publication transaction still requires
+status. Its minimum soak and stable publication interval are both zero.
+The publication transaction still requires
 its sealed release candidate and protected branch checks. Qualification produces
 evidence; it does not publish or merge a candidate.
 
@@ -78,7 +79,7 @@ Declare the default once in `.buildchain/buildchain.toml`:
 strategy = "latest-qualified-alpha"
 timezone = "Asia/Shanghai"
 publish_at = "03:00"
-minimum_soak_seconds = 3600
+minimum_soak_seconds = 0
 required_checks = [
   "alpha-release",
   "workflow:Build",

package/docs/workflow-catalog.md

@@ -23,7 +23,7 @@ Generated from `architecture/workflow-taxonomy.json`. Every workflow has one can
 
 Public workflows own the consumer API. Component workflows own reusable multi-job topology. Self workflows own Buildchain repository automation. Actions own execution steps; JS adapters and Rust/WASM own implementation.
 
-Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and `self-<category>-<purpose>.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.
+Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and the generated self callers `buildchain.yml` and `buildchain-recover.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.
 
 Register ownership before adding a workflow. `pnpm run check:workflows` validates source, calls, required CI integration and independent review ownership. `pnpm run generate:workflows` regenerates this catalog.
 
@@ -47,6 +47,8 @@ Register ownership before adding a workflow. `pnpm run check:workflows` validate
 | [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly |
 | [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly |
 | [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol |
+| [public-ops-pipeline.yml](../.github/workflows/public-ops-pipeline.yml) | ops | reusable | active | Buildchain pipeline |
+| [public-ops-recover.yml](../.github/workflows/public-ops-recover.yml) | ops | reusable | active | Buildchain recovery |
 | [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile |
 | [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol |
 | [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal |
@@ -69,42 +71,17 @@ Register ownership before adding a workflow. `pnpm run check:workflows` validate
 | [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile |
 | [.build.yml](../.github/workflows/.build.yml) | build | reusable | active | Buildchain Build |
 | [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git |
+| [.ops-pipeline-delivery.yml](../.github/workflows/.ops-pipeline-delivery.yml) | ops | reusable | active | Internal pipeline delivery |
+| [.ops-pipeline-execute.yml](../.github/workflows/.ops-pipeline-execute.yml) | ops | reusable | active | Internal pipeline execution |
 | [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority |
 | [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets |
+| [.release-pipeline-products.yml](../.github/workflows/.release-pipeline-products.yml) | release | reusable | active | Internal pipeline product publication |
+| [.release-pipeline-version.yml](../.github/workflows/.release-pipeline-version.yml) | release | reusable | active | Internal pipeline version preparation |
 | [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced |
 
 ## self
 
 | Workflow | Category | Invocation | Status | Purpose |
 | --- | --- | --- | --- | --- |
-| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood |
-| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood |
-| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution |
-| [self-build-channel-verify.yml](../.github/workflows/self-build-channel-verify.yml) | build | repository | active | Release - Verify |
-| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood |
-| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification |
-| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture |
-| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood |
-| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification |
-| [self-build-stable-dogfood.yml](../.github/workflows/self-build-stable-dogfood.yml) | build | repository | active | Buildchain Stable Self-Dogfood |
-| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify |
-| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood |
-| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery |
-| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit |
-| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily |
-| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly |
-| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly |
-| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance |
-| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily |
-| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly |
-| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly |
-| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery |
-| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke |
-| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol |
-| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets |
-| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap |
-| [self-release-next-development.yml](../.github/workflows/self-release-next-development.yml) | release | repository | active | Next Development Review |
-| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package |
-| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion |
-| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood |
-| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood |
+| [buildchain-recover.yml](../.github/workflows/buildchain-recover.yml) | ops | repository | active | Buildchain recovery |
+| [buildchain.yml](../.github/workflows/buildchain.yml) | ops | repository | active | Buildchain pipeline |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.1.3-alpha.0",
+  "version": "4.1.3-alpha.10",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -157,7 +157,7 @@
   "scripts": {
     "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery/dev-delivery-authority-candidate.js packages/core/dev-delivery/dev-delivery-authority-evidence.js packages/core/dev-delivery/dev-delivery-authority-landing.js packages/core/dev-delivery/dev-delivery-authority-observation.js packages/core/dev-delivery/dev-delivery-authority-qualification.js packages/core/dev-delivery/dev-delivery-authority-settlement.js packages/core/dev-delivery/dev-delivery-authority-state.js packages/core/dev-delivery/dev-delivery-execution-failure.js packages/core/dev-delivery/dev-delivery-execution-transfer.js packages/core/dev-delivery/dev-delivery-landing-readback.js packages/core/dev-delivery/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery/dev-delivery-landing-testing-port.js packages/core/dev-delivery/dev-delivery-native-execution.js packages/core/dev-delivery/dev-delivery-native-proof.js packages/core/dev-delivery/dev-delivery-process-boundary.js packages/core/dev-delivery/dev-delivery-warrant-qualification.js packages/core/dev-delivery/dev-delivery-warrant-state.js packages/core/dev-delivery/commands/dev-delivery-authority-command-adapters.mjs packages/core/dev-delivery/commands/dev-delivery-authority-provider.mjs packages/core/dev-delivery/commands/dev-delivery-authority.mjs packages/core/dev-delivery/native/execution.js packages/core/dev-delivery/commands/dev-delivery-process-boundary.mjs packages/core/dev-delivery/native/transactions.js packages/core/dev-delivery/commands/dev-delivery-two-phase.mjs packages/core/dev-delivery/commands/dev-delivery-warrant-options.mjs packages/core/dev-delivery/warrant/persistence.js templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash packages/core/providers/commands/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:discussion-reader && pnpm run check:layout && node scripts/check-runtime-entry.mjs && pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node packages/core/governance/commands/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check": "pnpm run check:consumer-contract && pnpm run check:discussion-reader && pnpm run check:layout && node scripts/check-runtime-entry.mjs && pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node packages/core/governance/commands/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && node scripts/check-source-bindings.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/runtime-resume-lineage-v2.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/runtime-resume-lineage-v2/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json packages/core/contracts/command-registry.mjs packages/core/governance/cli/compatibility-facts.mjs packages/core/contracts/canonical-contracts.js packages/core/contracts/kungfu-temporal-fact.js packages/core/governance/buildchain-compatibility-fact.js packages/core/governance/buildchain-compatibility-authority.js packages/core/governance/buildchain-compatibility-proof.js packages/core/consumer/floating-consumer-evidence.js packages/core/consumer/floating-consumer-policy.js packages/core/consumer/floating-consumer-release-passport.js packages/core/release/recovery/lineage.js packages/core/release/tail-reseal-contract.js packages/core/release/tail-reseal-github.js packages/core/release/tail-reseal-receipt.js packages/core/release/tail-reseal.js packages/core/consumer/runtime-selector-persistence.js packages/core/release/provider-operation-journal.js packages/core/release/provider-readback-idempotency.js packages/core/release/release-activation-shadow.js packages/core/release/stable-publication-fence.js packages/core/release/partial-mutation-recovery-qualification.js packages/core/build/stage-capsule.js packages/core/build/stage-capsule-store.js packages/core/build/stage-capsule-local-store.js packages/core/build/platform-stage-checkpoints.js packages/core/build/stage-capsule-resume-planner.js packages/core/build/stage-capsule-qualification.js packages/core/build/stage-capsule-qualification-campaign.js packages/core/dev-delivery/delivery-warrant-fixture-runner.js packages/core/dev-delivery/delivery-warrant-read-candidate.js packages/core/dev-delivery/delivery-warrant-semantic-diff-gate.js packages/core/dev-delivery/delivery-warrant-shadow-adapter.js scripts/check-core-mechanism-inventory.mjs scripts/check-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs packages/core/dev-delivery/commands/dev-pr-prequeue-guard.mjs scripts/check-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs packages/core/governance/commands/architecture.mjs packages/core/runtime/commands/bridge-bootstrap.mjs scripts/bridge-evidence.mjs packages/core/consumer/commands/consumer-policy.mjs packages/core/runtime/commands/host-adapter.mjs scripts/platform-stage-checkpoint-rehearsal.mjs scripts/stage-capsule-resume-rehearsal.mjs packages/core/build/commands/stage-capsule-qualification.mjs scripts/tail-reseal-macos-rehearsal.mjs packages/core/release/commands/tail-reseal.mjs scripts/warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/runtime-entry-provider.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/architecture.test.mjs tests/bridge.test.mjs tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-resume-lineage.test.mjs tests/runtime-semantic-closure.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs tests/warrant-shadow-plan.test.mjs",
     "check:bridge": "cargo fmt --manifest-path crates/buildchain-host-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml",
     "check:contracts": "pnpm run check:contracts:rust && node --test tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/domain-wasm.test.mjs tests/floating-consumer-policy-contract.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-resume-lineage.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/publication-rehearsal.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs",
@@ -184,7 +184,8 @@
     "check:implementation-naming": "node scripts/check-implementation-naming.mjs",
     "check:layout": "node scripts/check-code-layout.mjs",
     "build:discussion-reader": "node scripts/build-release-discussion-reader.mjs",
-    "check:discussion-reader": "node scripts/build-release-discussion-reader.mjs --check"
+    "check:discussion-reader": "node scripts/build-release-discussion-reader.mjs --check",
+    "check:consumer-contract": "node scripts/generate-minimal-consumer-contract.mjs --check"
   },
   "devDependencies": {
     "@actions/expressions": "0.3.61",

package/packages/core/adoption/buildchain-kfd-claims.js

@@ -58,7 +58,10 @@ const WORKFLOW_AND_ACTION_FILES = Object.freeze([
   ".github/workflows/.build.yml",
   ".github/workflows/.release-promote.yml",
   ".github/workflows/public-release-promote.yml",
-  ".github/workflows/self-release-promote.yml",
+  ".github/workflows/buildchain.yml",
+  ".github/workflows/buildchain-recover.yml",
+  ".github/workflows/public-ops-pipeline.yml",
+  ".github/workflows/public-ops-recover.yml",
   ".github/workflows/public-release-artifact-attestation.yml",
   "actions/build/artifact/prepare-attestation/action.yml",
   "actions/build/artifact/prepare-attestation/index.js",
@@ -75,7 +78,6 @@ const EXTRA_KFD1_FILES = Object.freeze([
   "packages/core/index.js",
   "packages/core/build/homebrew.js",
   "packages/core/build/build-facts.js",
-  "packages/core/adoption/kfd3-surface-register.js",
   "packages/core/release/release-propagation.js",
   "scripts/generate-site-bundle.mjs",
   "packages/core/release/commands/ensure-github-release.mjs",
@@ -446,7 +448,7 @@ export function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}
     {
       name: "Buildchain standalone binary distribution",
       artifactPath: "dist/binary",
-      evidencePath: ".github/workflows/self-build-binary-distribution.yml",
+      evidencePath: ".github/workflows/.release-pipeline-products.yml",
       distribution: normalizeKfd3DistributionDeclaration({
         registrar: "shifu",
         tasks: ["binary:build"],
@@ -529,7 +531,6 @@ export function createBuildchainKfdClaimRegistry({ root = process.cwd(), sourceS
 
 export function createBuildchainKfd1Witness({ root = process.cwd(), sourceSha = "" } = {}) {
   const registry = createBuildchainKfdClaimRegistry({ root, sourceSha });
-  const registrySha256 = sha256Json(registry);
   const paths = uniquePaths([
     ...publicDocumentationFiles(root),
     ...SCHEMA_AND_STANDARD_FILES,
@@ -545,7 +546,7 @@ export function createBuildchainKfd1Witness({ root = process.cwd(), sourceSha =
     contractWorld: {
       id: "buildchain-runtime-contract-world",
       schemaId: "kungfu-buildchain-runtime-contract-world",
-      digest: `sha256:${registrySha256}`,
+      digest: `sha256:${sha256Json(registry)}`,
       owner: "Buildchain maintainers",
       selfHosted: true,
     },
@@ -584,7 +585,6 @@ export function createBuildchainKfd3PrebuildWitness({ root = process.cwd(), sour
   const registry = createBuildchainKfdClaimRegistry({ root, sourceSha });
   const surfaces = createBuildchainKfdSurfaceRegistry({ root });
   const reverseAudit = publicSurfaceAuditEvidence(root);
-  const digest = `sha256:${sha256Json(registry)}`;
   return {
     schemaVersion: 1,
     id: "buildchain-collaboration-interface",
@@ -596,7 +596,7 @@ export function createBuildchainKfd3PrebuildWitness({ root = process.cwd(), sour
       path: "dist/site/kfd-claims.json",
       sha256: fileExists(root, "dist/site/kfd-claims.json") ? sha256File(root, "dist/site/kfd-claims.json") : "",
     },
-    collaborationInterfaceDigest: digest,
+    collaborationInterfaceDigest: `sha256:${sha256Json(registry)}`,
     collaborationInterface: {
       schemaVersion: 1,
       contract: BUILDCHAIN_KFD_COLLABORATION_INTERFACE_CONTRACT,

package/packages/core/build/standalone/build.js

@@ -11,7 +11,12 @@ import {
   readLogPath,
   noopLogger,
 } from "./logging.js";
-import { platformTriple, copyNodeBinary, sourceSha } from "./identity.js";
+import {
+  platformTriple,
+  copyNodeBinary,
+  sourceSha,
+  packageVersion,
+} from "./identity.js";
 import { bundleCli, postjectArgs } from "./bundle.js";
 import { run } from "./process.js";
 function prepareStandaloneExecutable({
@@ -124,6 +129,7 @@ export function buildStandaloneBinary({
   nodePath = process.execPath,
   nodeVersion = process.version,
 } = {}) {
+  version ||= packageVersion(cwd);
   const resolvedOutputDir = path.resolve(cwd, outputDir);
   const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-sea-"));
   try {

package/packages/core/consumer/buildchain-config.js

@@ -5,8 +5,8 @@ import { isDeepStrictEqual } from "node:util";
 import { parse } from "smol-toml";
 import {
   BUILDCHAIN_CONFIG_PATH,
-  resolveBuildchainConfigPath,
 } from "../contracts/buildchain-layout.js";
+import { readProductConfiguration } from "./contract/reader.js";
 import { runShellCommandSync } from "../runtime/spawn-command.js";
 import { normalizeBuildConfiguration } from "../build/build-configuration.js";
 
@@ -181,26 +181,7 @@ function updateTomlStringValuePreservingSource({ source, content, key, value, fi
 }
 
 export function loadBuildchainConfig(cwd = process.cwd()) {
-  const configPath = resolveBuildchainConfigPath(cwd);
-  const filePath = path.join(cwd, configPath);
-  if (!fs.existsSync(filePath)) {
-    return undefined;
-  }
-  const source = fs.readFileSync(filePath, "utf8");
-  let config;
-  try {
-    config = parse(source);
-  } catch (error) {
-    throw new Error(`${configPath} parse failed: ${error.message}`);
-  }
-  if (config.schema !== 1) {
-    throw new Error(`${configPath} schema must be 1`);
-  }
-  return {
-    path: configPath,
-    filePath,
-    config: normalizeBuildchainConfig(config),
-  };
+  return readProductConfiguration(cwd, normalizeBuildchainConfig);
 }
 
 export function normalizeBuildchainConfig(config) {