@kungfu-tech/buildchain 4.1.3-alpha.0 → 4.1.3-alpha.2

package/architecture/release-topology.json

@@ -10,14 +10,18 @@
   "closedWorld": {
     "workflowPaths": [
       ".github/workflows/.build.yml",
+      ".github/workflows/.ops-pipeline-execute.yml",
       ".github/workflows/.release-authority.yml",
       ".github/workflows/.release-binary-assets.yml",
+      ".github/workflows/.release-pipeline-products.yml",
       ".github/workflows/.release-promote.yml",
       ".github/workflows/build.yml",
       ".github/workflows/public-build-demo.yml",
       ".github/workflows/public-ops-alpha-candidate-patrol.yml",
       ".github/workflows/public-ops-dev-auto-merge.yml",
       ".github/workflows/public-ops-observed-evidence.yml",
+      ".github/workflows/public-ops-pipeline.yml",
+      ".github/workflows/public-ops-recover.yml",
       ".github/workflows/public-ops-stable-candidate-patrol.yml",
       ".github/workflows/public-release-artifact-attestation.yml",
       ".github/workflows/public-release-oci-compose-preview.yml",
@@ -68,6 +72,7 @@
       "packages/core/index.js",
       "packages/core/publication/oci-compose-qualification.js",
       "packages/core/publication/oci/preview-promotion.js",
+      "packages/core/publication/pipeline/documents.js",
       "packages/core/publication/publication-rehearsal-capsule.js",
       "packages/core/publication/publication-rehearsal-runtime.js",
       "packages/core/publication/publication-rehearsal.js",
@@ -87,14 +92,18 @@
     "runtimeSelectors": [
       "packages/core/runtime/entry/actions.js",
       "packages/core/runtime/entry/activation.js",
+      "packages/core/runtime/entry/attempt.js",
       "packages/core/runtime/entry/github.js",
       "packages/core/runtime/entry/recovery.js",
-      "packages/core/runtime/entry/selection.js"
+      "packages/core/runtime/entry/selection.js",
+      "packages/core/runtime/entry/source.js"
     ],
     "runtimeEngines": ["packages/core/release/promote-candidate/action.js"],
     "terminalProjections": [
       "actions/release/promotion/apply/action.yml",
       "actions/release/promotion/settle/action.yml",
+      "packages/core/publication/pipeline/apply.js",
+      "packages/core/publication/pipeline/recovery-admission.js",
       "packages/core/publication/settlement/transaction.js",
       "packages/core/release/promote-candidate/provider-settlement.js",
       "packages/core/release/release-invocation.js",
@@ -106,7 +115,8 @@
         "packages/core/publication/binary/action.js",
         "packages/core/release/next-development/actions.js",
         "packages/core/publication/oci/preview-actions.js",
-        "packages/core/publication/settlement/actions.js"
+        "packages/core/publication/settlement/actions.js",
+        "packages/core/publication/pipeline/actions.js"
       ],
       "modules": [
         "packages/core/adoption/kfd-adopter-manifest.js",
@@ -117,8 +127,14 @@
         "packages/core/build/build-configuration.js",
         "packages/core/build/github-artifact-attestation.js",
         "packages/core/build/package-manager.js",
+        "packages/core/build/stage-capsule.js",
         "packages/core/consumer/buildchain-channel-identity.js",
         "packages/core/consumer/buildchain-config.js",
+        "packages/core/consumer/contract/entries.js",
+        "packages/core/consumer/contract/identity.js",
+        "packages/core/consumer/contract/plan.js",
+        "packages/core/consumer/contract/products.js",
+        "packages/core/consumer/contract/shape.js",
         "packages/core/consumer/floating-consumer-evidence.js",
         "packages/core/consumer/floating-consumer-policy.js",
         "packages/core/consumer/floating-consumer-release-passport.js",
@@ -130,22 +146,69 @@
         "packages/core/contracts/public-surface-audit.js",
         "packages/core/contracts/public-surface-cli.js",
         "packages/core/contracts/workflow-yaml-contract.js",
+        "packages/core/dev-delivery/admission/github-client.js",
+        "packages/core/dev-delivery/delivery-warrant-fixture-runner.js",
+        "packages/core/dev-delivery/delivery-warrant-read-candidate.js",
+        "packages/core/dev-delivery/delivery-warrant-semantic-diff-gate.js",
+        "packages/core/dev-delivery/delivery-warrant-shadow-adapter.js",
+        "packages/core/dev-delivery/dev-delivery-authority-candidate.js",
+        "packages/core/dev-delivery/dev-delivery-authority-state.js",
+        "packages/core/dev-delivery/dev-delivery-candidate-identity.js",
         "packages/core/dev-delivery/dev-delivery-common.js",
         "packages/core/dev-delivery/dev-delivery-contract-surface.js",
+        "packages/core/dev-delivery/dev-delivery-execution-failure.js",
+        "packages/core/dev-delivery/dev-delivery-execution-transfer.js",
+        "packages/core/dev-delivery/dev-delivery-native-execution.js",
+        "packages/core/dev-delivery/dev-delivery-native-proof.js",
+        "packages/core/dev-delivery/dev-delivery-process-boundary.js",
+        "packages/core/dev-delivery/dev-delivery-proof.js",
+        "packages/core/dev-delivery/dev-delivery-provider-attempt.js",
+        "packages/core/dev-delivery/dev-delivery-warrant-cancellation.js",
+        "packages/core/dev-delivery/dev-delivery-warrant-native-requirements.js",
+        "packages/core/dev-delivery/dev-delivery-warrant-qualification.js",
+        "packages/core/dev-delivery/dev-delivery-warrant-settlement.js",
+        "packages/core/dev-delivery/dev-delivery-warrant-state.js",
+        "packages/core/dev-delivery/dev-delivery-warrant.js",
+        "packages/core/dev-delivery/dev-delivery-writer-protocol-transition.js",
+        "packages/core/dev-delivery/native/execution.js",
+        "packages/core/dev-delivery/warrant/observation.js",
+        "packages/core/dev-delivery/warrant/persistence.js",
+        "packages/core/dev-delivery/warrant/service.js",
+        "packages/core/dev-delivery/warrant/transitions.js",
+        "packages/core/dev-delivery/warrant/values.js",
         "packages/core/governance/buildchain-compatibility-authority.js",
         "packages/core/governance/buildchain-compatibility-fact.js",
         "packages/core/governance/buildchain-compatibility-facts.json",
         "packages/core/governance/buildchain-compatibility-proof.js",
         "packages/core/observability/controller-evidence.js",
+        "packages/core/providers/dev-delivery/store.js",
         "packages/core/providers/github-cli-api.js",
+        "packages/core/providers/github/attempt-index.js",
+        "packages/core/providers/github/attempt-journal.js",
         "packages/core/providers/github/discussions/materials.js",
         "packages/core/providers/github/discussions/transport.js",
         "packages/core/providers/github/graphql-errors.js",
+        "packages/core/providers/github/json-client.js",
+        "packages/core/providers/github/pipeline-integration.js",
+        "packages/core/providers/github/pipeline-policy.js",
+        "packages/core/providers/github/pipeline-product-payload.js",
+        "packages/core/providers/github/pipeline-product-release.js",
+        "packages/core/providers/github/pipeline-publication-artifacts.js",
+        "packages/core/providers/github/pipeline-run-entry.js",
+        "packages/core/providers/github/pipeline-runs.js",
+        "packages/core/providers/github/pipeline-source.js",
+        "packages/core/providers/github/pipeline-version.js",
+        "packages/core/providers/github/pipeline-worker.js",
         "packages/core/providers/github/release-assets.js",
         "packages/core/publication/binary/action.js",
         "packages/core/publication/binary/capability.js",
         "packages/core/publication/binary/evidence.js",
         "packages/core/publication/binary/transaction.js",
+        "packages/core/publication/npm/pack-result.js",
+        "packages/core/publication/npm/package.js",
+        "packages/core/publication/npm/pipeline-channel.js",
+        "packages/core/publication/npm/pipeline-provider.js",
+        "packages/core/publication/npm/registry.js",
         "packages/core/publication/oci-compose-qualification.js",
         "packages/core/publication/oci-publication-bundle.js",
         "packages/core/publication/oci-publication-graph.js",
@@ -155,6 +218,47 @@
         "packages/core/publication/oci/preview-registry.js",
         "packages/core/publication/oci/preview-transaction.js",
         "packages/core/publication/oci/preview-values.js",
+        "packages/core/publication/pipeline/actions.js",
+        "packages/core/publication/pipeline/apply.js",
+        "packages/core/publication/pipeline/build-segments.js",
+        "packages/core/publication/pipeline/capsules.js",
+        "packages/core/publication/pipeline/context.js",
+        "packages/core/publication/pipeline/development-anchor.js",
+        "packages/core/publication/pipeline/development-current.js",
+        "packages/core/publication/pipeline/development-pr.js",
+        "packages/core/publication/pipeline/development-proof.js",
+        "packages/core/publication/pipeline/development-transition.js",
+        "packages/core/publication/pipeline/distribution.js",
+        "packages/core/publication/pipeline/documents.js",
+        "packages/core/publication/pipeline/effects.js",
+        "packages/core/publication/pipeline/files.js",
+        "packages/core/publication/pipeline/imported-materials.js",
+        "packages/core/publication/pipeline/journal.js",
+        "packages/core/publication/pipeline/next-development.js",
+        "packages/core/publication/pipeline/pack.js",
+        "packages/core/publication/pipeline/package-policy.js",
+        "packages/core/publication/pipeline/plan.js",
+        "packages/core/publication/pipeline/prepare.js",
+        "packages/core/publication/pipeline/qualification.js",
+        "packages/core/publication/pipeline/qualify.js",
+        "packages/core/publication/pipeline/recovery-admission.js",
+        "packages/core/publication/pipeline/recovery-build-download.js",
+        "packages/core/publication/pipeline/recovery-build-plan.js",
+        "packages/core/publication/pipeline/recovery-build-readback.js",
+        "packages/core/publication/pipeline/recovery-capsules.js",
+        "packages/core/publication/pipeline/recovery-import.js",
+        "packages/core/publication/pipeline/recovery-inspection.js",
+        "packages/core/publication/pipeline/recovery-materials.js",
+        "packages/core/publication/pipeline/recovery-plan.js",
+        "packages/core/publication/pipeline/recovery-prepare.js",
+        "packages/core/publication/pipeline/recovery-qualification.js",
+        "packages/core/publication/pipeline/recovery-readback.js",
+        "packages/core/publication/pipeline/recovery-signing.js",
+        "packages/core/publication/pipeline/sealed-products.js",
+        "packages/core/publication/pipeline/settle.js",
+        "packages/core/publication/pipeline/signing.js",
+        "packages/core/publication/pipeline/source-plan.js",
+        "packages/core/publication/pipeline/version.js",
         "packages/core/publication/publication-artifact-candidate.js",
         "packages/core/publication/publication-authority.js",
         "packages/core/publication/publication-development.js",
@@ -162,14 +266,20 @@
         "packages/core/publication/publication-sealed-bundle.js",
         "packages/core/publication/settlement/actions.js",
         "packages/core/publication/settlement/transaction.js",
+        "packages/core/release/candidate/payloads.js",
+        "packages/core/release/candidate/selection.js",
+        "packages/core/release/candidate/transport.js",
         "packages/core/release/commands/ensure-github-release.mjs",
         "packages/core/release/discussion/binary.js",
         "packages/core/release/discussion/checkpoints.js",
         "packages/core/release/discussion/envelope.js",
+        "packages/core/release/discussion/evidence.js",
+        "packages/core/release/discussion/presentation.js",
         "packages/core/release/discussion/publication.js",
         "packages/core/release/discussion/reader.js",
         "packages/core/release/discussion/session.js",
         "packages/core/release/discussion/store.js",
+        "packages/core/release/discussion/threads.js",
         "packages/core/release/github-provider-plane.js",
         "packages/core/release/github-release.js",
         "packages/core/release/next-development-transition.js",
@@ -224,6 +334,7 @@
         "packages/core/release/protected-publication-source.js",
         "packages/core/release/publish-transaction.js",
         "packages/core/release/recovery/lineage.js",
+        "packages/core/release/release-blocker-priority.js",
         "packages/core/release/release-candidate-recovery.js",
         "packages/core/release/release-candidate.js",
         "packages/core/release/release-invocation.js",
@@ -232,24 +343,59 @@
         "packages/core/release/release-tail-product-capabilities.js",
         "packages/core/release/release-tail-provider-adapters.js",
         "packages/core/release/release-tail-provider-plane.js",
+        "packages/core/release/release-train.js",
         "packages/core/release/reuse-complete-release.js",
         "packages/core/release/version-state.js",
         "packages/core/release/version-state/verification.js",
         "packages/core/runtime/action-process.mjs",
         "packages/core/runtime/checkout-identity.js",
+        "packages/core/runtime/consumer-shell.js",
         "packages/core/runtime/domain-wasm-artifact.js",
         "packages/core/runtime/domain-wasm.js",
+        "packages/core/runtime/entry/selection.js",
         "packages/core/runtime/installation-root.js",
         "packages/core/runtime/spawn-command.js",
-        "packages/core/web/web-surface-publication-candidate.js"
+        "packages/core/web/web-surface-publication-candidate.js",
+        "packages/core/workflow/attempt/identity.js",
+        "packages/core/workflow/attempt/journal.js",
+        "packages/core/workflow/attempt/materials.js",
+        "packages/core/workflow/attempt/reader.js",
+        "packages/core/workflow/attempt/records.js",
+        "packages/core/workflow/pipeline/build-evidence.js",
+        "packages/core/workflow/pipeline/build-qualification.js",
+        "packages/core/workflow/pipeline/build.js",
+        "packages/core/workflow/pipeline/channel-control.js",
+        "packages/core/workflow/pipeline/delivery-observation.js",
+        "packages/core/workflow/pipeline/events.js",
+        "packages/core/workflow/pipeline/fence.js",
+        "packages/core/workflow/pipeline/group-control.js",
+        "packages/core/workflow/pipeline/host.js",
+        "packages/core/workflow/pipeline/materials.js",
+        "packages/core/workflow/pipeline/notifications.js",
+        "packages/core/workflow/pipeline/parent-notification.js",
+        "packages/core/workflow/pipeline/platforms.js",
+        "packages/core/workflow/pipeline/progress.js",
+        "packages/core/workflow/pipeline/projection.js",
+        "packages/core/workflow/pipeline/reconcile.js",
+        "packages/core/workflow/pipeline/recovery-integration.js",
+        "packages/core/workflow/pipeline/recovery-merge-proof.js",
+        "packages/core/workflow/pipeline/recovery-ownership-settlement.js",
+        "packages/core/workflow/pipeline/recovery-ownership.js",
+        "packages/core/workflow/pipeline/recovery-plan.js",
+        "packages/core/workflow/pipeline/recovery-runtime.js",
+        "packages/core/workflow/pipeline/recovery-session.js",
+        "packages/core/workflow/pipeline/session.js",
+        "packages/core/workflow/pipeline/settlement.js",
+        "packages/core/workflow/pipeline/wake.js",
+        "packages/core/workflow/pipeline/web-status.js"
       ],
-      "root": "sha256:876e54a9240478ecd3bfa2b3cc386529e04bc818ca15844b9047832c9a9c4898"
+      "root": "sha256:c043e16d6f8995cbecbdaa3d24466b47c9624bee0b7227c0e1842f37138b2508"
     },
     "rustWasmAuthority": {
       "loader": "packages/core/runtime/domain-wasm.js",
       "metadata": "packages/core/runtime/domain-wasm-artifact.js",
       "artifact": "packages/core/runtime/buildchain-domain.wasm",
-      "artifactRoot": "sha256:504e23c9241f43611813f0fbd213b7a694946328b00e23d22f6ba678e7b0c841",
+      "artifactRoot": "sha256:d42ab5ae8d42253d40ab49057e460285a848925cece176c4d68e63e90ca86c72",
       "distributedArtifacts": [
         "actions/release/promotion/ref/dist/buildchain-domain.wasm",
         "actions/release/tail/settle/dist/buildchain-domain.wasm",
@@ -383,12 +529,12 @@
       }
     ],
     "metrics": {
-      "workflowCount": 34,
-      "jobCount": 95,
-      "reusableEdgeCount": 20,
-      "mutationRelevantNodeCount": 61,
-      "contentsWriteJobCount": 22,
-      "oidcWriteJobCount": 19
+      "workflowCount": 38,
+      "jobCount": 111,
+      "reusableEdgeCount": 24,
+      "mutationRelevantNodeCount": 73,
+      "contentsWriteJobCount": 34,
+      "oidcWriteJobCount": 25
     },
     "semanticMetrics": {
       "workflowCount": 5,
@@ -438,5 +584,96 @@
         "oidcWriteJobCount": 0
       }
     }
+  },
+  "pipelinePublicationScope": {
+    "workflowPaths": [
+      ".github/workflows/.release-pipeline-products.yml",
+      ".github/workflows/public-ops-pipeline.yml",
+      ".github/workflows/public-ops-recover.yml",
+      ".github/workflows/.ops-pipeline-execute.yml"
+    ],
+    "authority": "retained-protected-source-qualified-sealed-products-and-live-provider-readback",
+    "maximumMetrics": {
+      "workflowCount": 4,
+      "jobCount": 16,
+      "reusableEdgeCount": 4,
+      "mutationRelevantNodeCount": 12,
+      "contentsWriteJobCount": 12,
+      "oidcWriteJobCount": 6
+    },
+    "observedTopology": {
+      "jobRecordFields": [
+        "id",
+        "kind",
+        "uses",
+        "contentsPermission",
+        "oidcPermission",
+        "carriers",
+        "mutationSignals"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/.release-pipeline-products.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "apply|runner|-|write|write|-|contents-write,oidc-write",
+            "build|runner|-|read|-|-|-",
+            "prepare|runner|-|write|-|jobOutput|contents-write",
+            "qualify|runner|-|write|write|-|contents-write,oidc-write",
+            "settle|runner|-|write|write|-|contents-write,oidc-write"
+          ],
+          "reusableEdges": []
+        },
+        {
+          "path": ".github/workflows/public-ops-pipeline.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "control|runner|-|write|-|jobOutput|contents-write",
+            "execute|reusable-call|./.github/workflows/.ops-pipeline-execute.yml|write|write|-|contents-write,oidc-write",
+            "runtime|runner|-|read|-|jobOutput|-"
+          ],
+          "reusableEdges": ["./.github/workflows/.ops-pipeline-execute.yml"]
+        },
+        {
+          "path": ".github/workflows/public-ops-recover.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "control|runner|-|write|-|jobOutput|contents-write",
+            "execute|reusable-call|./.github/workflows/.ops-pipeline-execute.yml|write|write|-|contents-write,oidc-write",
+            "runtime|runner|-|read|-|jobOutput|-"
+          ],
+          "reusableEdges": ["./.github/workflows/.ops-pipeline-execute.yml"]
+        },
+        {
+          "path": ".github/workflows/.ops-pipeline-execute.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "build|runner|-|read|-|-|-",
+            "delivery|reusable-call|./.github/workflows/.ops-pipeline-delivery.yml|write|-|-|contents-write",
+            "publication|reusable-call|./.github/workflows/.release-pipeline-products.yml|write|write|-|contents-write,oidc-write",
+            "record-build|runner|-|write|-|-|contents-write",
+            "record-delivery|runner|-|write|-|-|contents-write"
+          ],
+          "reusableEdges": [
+            "./.github/workflows/.ops-pipeline-delivery.yml",
+            "./.github/workflows/.release-pipeline-products.yml"
+          ]
+        }
+      ],
+      "metrics": {
+        "workflowCount": 4,
+        "jobCount": 16,
+        "reusableEdgeCount": 4,
+        "mutationRelevantNodeCount": 12,
+        "contentsWriteJobCount": 12,
+        "oidcWriteJobCount": 6
+      },
+      "semanticMetrics": {
+        "workflowCount": 4,
+        "mutationRelevantNodeCount": 12,
+        "contentsWriteJobCount": 8,
+        "oidcWriteJobCount": 3
+      }
+    }
   }
 }

package/architecture/universal-workflow-bootstrap.json

@@ -116,8 +116,11 @@
     ".github/workflows/.build-gate-profile.yml",
     ".github/workflows/.build.yml",
     ".github/workflows/.ops-git-sync.yml",
+    ".github/workflows/.ops-pipeline-delivery.yml",
+    ".github/workflows/.ops-pipeline-execute.yml",
     ".github/workflows/.release-authority.yml",
     ".github/workflows/.release-binary-assets.yml",
+    ".github/workflows/.release-pipeline-products.yml",
     ".github/workflows/.release-promote.yml",
     ".github/workflows/build.yml",
     ".github/workflows/public-build-adopter-qualification.yml",
@@ -135,6 +138,8 @@
     ".github/workflows/public-ops-patrol-monthly.yml",
     ".github/workflows/public-ops-patrol-weekly.yml",
     ".github/workflows/public-ops-patrol.yml",
+    ".github/workflows/public-ops-pipeline.yml",
+    ".github/workflows/public-ops-recover.yml",
     ".github/workflows/public-ops-release-governance.yml",
     ".github/workflows/public-ops-stable-candidate-patrol.yml",
     ".github/workflows/public-ops-tail-reseal.yml",
@@ -158,8 +163,11 @@
     ".github/workflows/.build-gate-profile.yml",
     ".github/workflows/.build.yml",
     ".github/workflows/.ops-git-sync.yml",
+    ".github/workflows/.ops-pipeline-delivery.yml",
+    ".github/workflows/.ops-pipeline-execute.yml",
     ".github/workflows/.release-authority.yml",
     ".github/workflows/.release-binary-assets.yml",
+    ".github/workflows/.release-pipeline-products.yml",
     ".github/workflows/.release-promote.yml",
     ".github/workflows/build.yml",
     ".github/workflows/public-build-adopter-qualification.yml",
@@ -176,6 +184,8 @@
     ".github/workflows/public-ops-patrol-monthly.yml",
     ".github/workflows/public-ops-patrol-weekly.yml",
     ".github/workflows/public-ops-patrol.yml",
+    ".github/workflows/public-ops-pipeline.yml",
+    ".github/workflows/public-ops-recover.yml",
     ".github/workflows/public-ops-release-governance.yml",
     ".github/workflows/public-ops-stable-candidate-patrol.yml",
     ".github/workflows/public-ops-tail-reseal.yml",

package/architecture/universal-workflow-capability-policy.json

@@ -27,7 +27,6 @@
   "contractRoots": [
     "sha256:025e2a4a37bb9364c03aa3c9ab6bad773f78a541203a23791e2d7afd70d773ca",
     "sha256:02e8b51faabbc960e9c70b090426272b720f3e1438b69a0f683b21257bed6302",
-    "sha256:030f75da0b1a1b7678155e0ac03c5866d89d53db45084c61cb2deef824042292",
     "sha256:07bb744fedc9512b1e40f5c00a0037194fc869600fc7fd07de7f3b975b9760ff",
     "sha256:13dea813a98cb2cc1a51cafb880127ee2c022f3c5aae5144818aec17e9cb7498",
     "sha256:17c5fc05f8599662cd061a94add5313dc0fcea58404f9a92ee632c98abce24c6",
@@ -35,10 +34,10 @@
     "sha256:24cbb86e8fb198f7a949372291e712dd83ff12ba667c7049775ef497261bc62e",
     "sha256:265ccc9da3d84b8bf50746b6722b18c680dcc65bd322a5170e81bd5d0fa5b2b0",
     "sha256:2c5a19fe5ebe2550336c42f7de0c71b0e736776758b404716a5f77e0236920dc",
-    "sha256:310b9c3db199e6d900ca4756f152396103630da36aafa7218fe50fb8996f1da1",
     "sha256:34829b6e556284ef7c3f342fafcf92588a94761534e5f19ea12131f389ad4f50",
     "sha256:3d6119d1295ea7083d44a1b82fde5cb5dca910e427d1aee119d3ffbf421810f3",
     "sha256:40fdce377a9b02cb53f41e822cfc5d96c2f7e57a86a7574bf8ee39f3e0f0e12e",
+    "sha256:421b65afe174ce4ae57290efc73e43f94140b8ef70a2db5cda43e16921d61b4e",
     "sha256:428467c6ac1d768609ff12e72a190462bab9b5bc7dd2ea491553a364aa4c6ef6",
     "sha256:49065b4b7f0e4fd1760e808e310edfea3bd7333c8407c4b419a097ea3d908adc",
     "sha256:5e4788c95b22cbade1323070c03fc6c613cb6086dee8364a7f3805ce95482397",
@@ -52,15 +51,16 @@
     "sha256:9ef9093a7116ad05a7430c60e9164644f47af2a085a60c6043cf46c16bce3479",
     "sha256:a2a553a0e774224b398e5bccde811f8354638547656453adf7734f416f011a2b",
     "sha256:b727204daaae0e09dd94801f1fcd80902fc9e3f1103870e98df379e33094f52a",
-    "sha256:c78f2afe6dfeb8b514982318935885ee7f3e3fbb37946fb2cf5133d51b9bdaeb",
-    "sha256:cb3c04c820fc9d55e02a5c58215061a8e61b9dd69f5d545cbf8444b3b124ca60",
+    "sha256:c48e28c26b13955b4d3ba08803ef8ba2f8f297019513cafa50c3295f03dd2087",
+    "sha256:c5b239dd961249d9f58750311380534cfa45e17a4989ed1318e65769ff5b81db",
     "sha256:cf0b38a5fbbab2ed8aa7998a3c6d3fa48a058de43b6850612294058d263a24c1",
     "sha256:d6bafefea6f0934dcef27910c6dc6fd6bd5ade3a317bce21a0fd235ef14865a2",
+    "sha256:da8d3bfc6ba04130df6e894fc28ef4786eae322d8db874f87080429aab382b81",
     "sha256:dd9ae24a7a586c616a7b3b2b733eb38bfd3f8b19e5faec9e16851719be6abd61",
     "sha256:deee1c61c9731de6e2120abd4c30d3ce760df2ff3f7afb4dd84973543b353660",
     "sha256:e207436baa946b3d25d0159a510b7da474cac8d33701c2e66c089117c05f473d",
-    "sha256:f780070e235bffdee96fc355d7ed5e2fd4188482c41b24e2558a32086634a87c",
-    "sha256:ffda31a96dfb4f5515e0e1099ec34300e79327f3f23b83b211a9b0747c760720"
+    "sha256:f1ddf715b9524abd78eddabfd20cc73a9e22453d3736a30b30203cdfe1687650",
+    "sha256:f780070e235bffdee96fc355d7ed5e2fd4188482c41b24e2558a32086634a87c"
   ],
   "validFrom": "2026-08-30T00:00:00.000Z",
   "expiresAt": "2026-09-15T00:00:00.000Z"

package/architecture/workflow-taxonomy.json

@@ -742,6 +742,61 @@
       "status": "active",
       "invocation": "repository",
       "rationale": "Verify exact release PR lineage without retired prebuild, dependency discovery, version mutation or approval adapters."
+    },
+    {
+      "id": "pipeline",
+      "role": "public",
+      "category": "ops",
+      "purpose": "pipeline",
+      "summary": "Buildchain pipeline",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Buildchain pipeline: owned normal pipeline and internal credential boundaries."
+    },
+    {
+      "id": ".pipeline-delivery",
+      "role": "component",
+      "category": "ops",
+      "purpose": "pipeline-delivery",
+      "summary": "Internal pipeline delivery",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Internal pipeline delivery: owned normal pipeline and internal credential boundaries."
+    },
+    {
+      "id": ".pipeline-products",
+      "role": "component",
+      "category": "release",
+      "purpose": "pipeline-products",
+      "summary": "Internal pipeline product publication",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Separate product execution, qualification/signing, canonical APPLY and protected follow-ups without consumer orchestration."
+    },
+    {
+      "id": "recover",
+      "role": "public",
+      "category": "ops",
+      "purpose": "recover",
+      "summary": "Buildchain recovery",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Recover one exact attempt with an optional repaired runtime through the same internal product and delivery jobs."
+    },
+    {
+      "id": ".pipeline-execute",
+      "role": "component",
+      "category": "ops",
+      "purpose": "pipeline-execute",
+      "summary": "Internal pipeline execution",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Share credentialless product execution and protected delivery between normal and recovery public entries."
     }
   ]
 }

package/contracts/release-discussion-v1.schema.json

@@ -41,6 +41,9 @@
         },
         "source": {
           "type": "object"
+        },
+        "organization": {
+          "const": "attempt-threads/v1"
         }
       },
       "additionalProperties": false