@kungfu-tech/buildchain 4.1.3-alpha.1 → 4.1.3-alpha.10

package/AGENTS.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-11
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-11
+  generated_at: 2026-09-14
   visible_context: Buildchain 4.1 source, architecture registries and local validation.
   invisible_context_boundary: No unpublished release or external consumer qualification is claimed.
 ---
@@ -38,52 +38,27 @@ restating them.
 
 ## Using this repo as a Buildchain consumer
 
-Ordinary builds read project configuration from `buildchain.toml`. Single-project
-consumers call the public workflow with no inputs:
-
-```yaml
-uses: kungfu-systems/buildchain/.github/workflows/build.yml@v4
-```
-
-The public workflow is the API entry. It selects the execution runtime from a
-trusted non-persistent runtime input (`runtime-ref`), the selected consumer
-contract lock, or the entry commit default. `@v4-alpha` selects the alpha entry
-and its default lock path. Entry and runtime commits may differ. See
-[`Runtime entry`](docs/runtime-entry.md) for selection and recovery.
-
-Project settings belong in TOML; `config-path` locates a nested project. All
-execution jobs prepare the selected runtime through
-`actions/runtime/environment/prepare`. Subsequent business actions use that
-runtime without Buildchain SHA comparisons or secondary runtime admission.
-
-For new repositories, prefer the CLI:
-
-```sh
-npx @kungfu-tech/buildchain init --type package
-npx @kungfu-tech/buildchain validate --require-version-state
-npx @kungfu-tech/buildchain release --dry-run --target-ref alpha/v4/v4.1
-```
-
-For governed Paper repositories, scaffold or migrate the repository once, then
-follow the generated `AGENTS.md` entry contract. Work begins and ends through
-the pinned pnpm scripts:
-
-```sh
-pnpm paper:agent:verify
-pnpm paper:work:start -- <topic> --execute --json
-pnpm paper:work:submit -- --execute --json
-```
-
-The reusable required check independently enforces the same contract and PR
-lineage, so local command use is never treated as remote acceptance evidence.
-
-See [`docs/cli.md`](docs/cli.md), [`docs/lifecycle-protocol.md`](docs/lifecycle-protocol.md),
-and [`docs/reusable-build-surface.md`](docs/reusable-build-surface.md) for the
-consumer contract.
-
-All public entries share the same runtime contract. A runtime bug is recovered
-through a new execution with a repaired train and original source evidence.
-An entry bug requires an upgraded published entry and a complete new run.
+The consumer-facing self boundary is `.buildchain/buildchain.toml`, two generated
+callers (`.github/workflows/buildchain.yml` and `buildchain-recover.yml`),
+tool-maintained contract locks, and necessary provider permissions. The normal
+caller invokes the published `public-ops-pipeline.yml`; recovery accepts only an
+exact attempt and an optional repaired runtime through `public-ops-recover.yml`.
+No repository-specific runtime selection or recovery exception is allowed.
+
+During the protected migration, both callers use `@v4-alpha` and the prepared
+`.buildchain/minimal-consumer.toml` path, kept byte-identical to the canonical
+TOML. The pipeline reads policy at the same path on its protected target branch,
+so each target must contain the schema-2 policy before its first pipeline PR.
+The TOML declares `feature/*`, `fix/*`, `chore/*`, `docs/*`, `ci/*`, and
+`refactor/*` development routes before the first new-pipeline Alpha qualification.
+After the canonical path is protected and the stable entry is qualified,
+regenerate the same pair using the default path and `@v4`.
+Do not claim the transition complete while that final cleanup is outstanding.
+
+Products declare their own install, build, and verification commands in TOML.
+Publication, source qualification, reviews, merge queues, provider readback and
+recovery belong to the published runtime. Internal workflow libraries may be
+retained, but self callers must use the same public reusable-workflow contract as every other consumer.
 
 ## Building this repo
 
@@ -119,33 +94,24 @@ Stage Capsule resume planning is governed by
 TypeScript projection pure and byte-identical; explicit provider/release-tail
 effects always require readback and never become Capsule reuse.
 
-Stage Capsule qualification and Wave 2 reconciliation are governed by
-`architecture/stage-capsule-qualification.json`. Buildchain v4 dogfood is a
-repository invariant, not an implementation convenience: this repository must
-consume `kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml`
-through the same public reusable-workflow contract as every other consumer.
-The caller must remain a thin workflow with no steps or local orchestration,
-and `.buildchain/buildchain.toml` must declare the same real `install`, `build`,
-and `verify` lifecycle. The public workflow records the entry and selected runtime and binds
-consumer source SHA, platform, commands, manifests, summaries, dependencies,
-and output roots on Linux, macOS, and Windows.
-
-Dogfood callers use the same public entry and runtime preparation as external
-consumers. No repository-specific runtime selection or recovery exception is
-allowed. Stage Capsule internals are invoked by public workflows and tests;
-provider effects remain subject to their own source, artifact and readback rules.
-
-External Buildchain v4 workflow calls persisted in tracked source use only `@v4` or
-`@v4-alpha` and retain matching stable and alpha contract locks. A
-source-persisted exact commit SHA or train is not a durable entry selector.
-Exact resolved SHAs belong in lock data and provenance. Normal self workflows
-call `@v4`; dedicated post-publication alpha entry qualification calls `@v4-alpha`.
-
-Train validation passes `train/v4/v4.1/<capability>` only through the trusted
-non-persistent runtime input. The central entry resolves it once, and every
-business job executes the selected runtime. Protected merge and requested alpha
-publication follow successful validation. Changes to dogfood policy or its
-gates require independent `@kungfu-origin` review.
+Stage Capsule qualification and Wave 2 reconciliation remain governed by
+`architecture/stage-capsule-qualification.json`. Its prior standalone public
+Canary caller is explicitly historical; its shadow-only authority and retained
+evidence do not grant publication or production reuse. Current product verification
+runs the committed WASM checks, clean-process checkpoint restoration, and resume
+planning on Linux, macOS and Windows, with the same pinned Linux container
+backbone checks. These are product tests, not consumer-side delivery controllers.
+
+Normal self workflows and recovery share central runtime selection. The
+central entry resolves it once, and every business job uses that selected runtime.
+Persist only `@v4` or `@v4-alpha` in caller source, with matching stable and alpha contract locks
+maintained by the tooling. A source-persisted exact commit SHA or train is not a durable entry selector;
+exact SHAs belong in locks and provenance. A repaired train is a trusted,
+non-persistent recovery input and must retain the original attempt evidence.
+The optional repair selector is a trusted non-persistent runtime input.
+
+Changes to this consumer wiring, its required product checks, or publication
+gates require `@kungfu-origin` approval through the protected PR workflow.
 
 `pnpm run check` validates inventory data, generated public references and site
 bundle drift, lints root workflows, runs unit tests, and rebuilds every action

package/CONTRIBUTING.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-12
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-12
+  generated_at: 2026-09-14
   visible_context: Repository contribution rules and implementation naming and release transition changes.
   invisible_context_boundary: No private credentials or unpublished external release state.
 ---
@@ -39,7 +39,7 @@ sensitive material in issues or pull requests.
 
 - Node.js 24
 - Corepack with pnpm 11
-- Go 1.25 for workflow validation paths that exercise Go setup
+- Go 1.25 or newer in major 1 for product verification
 
 Buildchain's reusable workflow consumers may build with npm, yarn, pnpm, CMake,
 Conan, Python, Docker, or other tools through lifecycle commands. This
@@ -91,17 +91,16 @@ category vocabulary is enforced by `architecture/workflow-taxonomy.json`:
 | --- | --- | --- |
 | Public | `public-<category>-<purpose>.yml` | Consumer entry |
 | Component | `.<category>-<purpose>.yml` | Advanced reusable component |
-| Self | `self-<category>-<purpose>.yml` | Buildchain repository automation |
+| Self | `buildchain.yml`, `buildchain-recover.yml` | Generated normal and recovery callers |
 
 Categories are only `build`, `release`, and `ops`. Register the identity, role,
 category, purpose, owner, lifecycle status, invocation, and rationale before
 adding its derived filename. The [Workflow Catalog](docs/workflow-catalog.md)
-lists every canonical API and component path; self workflows have one
-event entry. Retired paths have no generated aliases. A matching prefix alone does not admit an unregistered workflow.
+lists every canonical API and component path; self automation has only the generated normal and recovery entries. Retired paths have no generated aliases. A matching prefix alone does not admit an unregistered workflow.
 
 Run `pnpm run generate:workflows`, `pnpm run check:workflows`, then the full
-`pnpm run check`. The required Verify lifecycle runs this gate on PRs, merge
-queue candidates, and pushes. Policy, enforcement, and ownership changes require
+`pnpm run check`. The product verification commands run this gate through the shared pipeline on PRs, merge
+queue candidates, and protected source qualification. Policy, enforcement, and ownership changes require
 independent `@kungfu-origin` review. A development merge does not publish a floating channel. Consumers adopt the
 new API only after that channel publishes it and their contract locks are refreshed.
 
@@ -145,24 +144,18 @@ release/vX/vX.Y -> publish-gate/major
   them for direct ad-hoc commits. Work from `feature/*`, `fix/*`, `chore/*`,
   `docs/*`, `ci/*`, or `refactor/*` branches and open a PR into the target dev
   line.
-- Repositories may call
-  `.github/workflows/public-ops-dev-auto-merge.yml` from their own scheduled or manual
-  wrapper to merge ready, conflict-free dev PRs. The wrapper is policy-gated:
-  required checks, ready/block labels, same-repository heads, approvals,
-  branch prefixes, max merges, and dry-run are all declared inputs.
-- Ordinary build callers use `build.yml@v4` or `build.yml@v4-alpha` with
-  project settings in `buildchain.toml`. Every public workflow uses the central
-  runtime entry: transient `runtime-ref`, contract lock, then entry default.
-  Validate the implementation before protected Dev, publish Alpha, and qualify
-  the published consumer entry. See `docs/runtime-entry.md`.
-- Merging into `alpha/*`, `release/*`, or `publish-gate/major` expresses a
-  release intent. Buildchain promotion then creates version-state commits,
-  exact tags, floating tags, npm publish evidence, and next-alpha state.
-- Manual alpha publication requires an explicit protected source SHA and passes
-  the same source qualification and fresh hosted admission as automatic publication.
-  Use `runtime-ref` to select the execution runtime. Set recovery inputs only when
-  resuming an existing transaction; a first publication leaves them empty. Stable
-  publication continues through the protected automatic channel path.
+- The generated `buildchain.yml` caller invokes `public-ops-pipeline.yml` using
+  a published floating entry. Product build, verification, artifacts, channels
+  and review policy are declared in the schema-2 TOML.
+- The published runtime owns source qualification, protected review and merge,
+  version materialization, publication, provider readback and next-development.
+- Recover an interrupted operation through `buildchain-recover.yml` using its
+  exact attempt and, when required, one transient repaired runtime. Recovery
+  does not accept replacement source, artifact or provider-effect parameters.
+- During this repository's protected cutover, both generated callers use
+  `@v4-alpha` and the protected `.buildchain/minimal-consumer.toml` policy path;
+  see `AGENTS.md` for target-policy admission, stable qualification and final
+  default-path cleanup requirements.
 
 See [`docs/release-governance.md`](docs/release-governance.md),
 [`docs/release-flow.md`](docs/release-flow.md), and

package/architecture/action-taxonomy.json

@@ -341,6 +341,26 @@
         "settlement": {
           "responsibility": "Retain immutable publication completion and verify its terminal receipt independently.",
           "operations": ["retain", "verify"]
+        },
+        "pipeline": {
+          "responsibility": "Prepare, independently qualify, publish and settle declared products inside one business attempt.",
+          "operations": [
+            "prepare",
+            "build",
+            "qualify",
+            "prepare-qualification",
+            "seal-qualification",
+            "apply",
+            "settle"
+          ]
+        },
+        "version": {
+          "responsibility": "Regenerate declared version data in credentialless product jobs and materialize independently qualified publication or development sources.",
+          "operations": [
+            "build",
+            "materialize-publication",
+            "materialize-development"
+          ]
         }
       }
     },
@@ -516,6 +536,10 @@
         "settlement": {
           "responsibility": "Seal candidate terminal evidence and reconcile successful protected backflow.",
           "operations": ["seal"]
+        },
+        "pipeline": {
+          "responsibility": "Reconcile source-bound business attempts through protected delivery and product verification.",
+          "operations": ["control", "build", "record-build", "wake", "recover"]
         }
       }
     },

package/architecture/agent-change-map.md

@@ -108,7 +108,6 @@ Safe change route: Reduce one declared responsibility in its owning module, run
 - tests: `tests/release-propagation.test.mjs`
 - tests: `tests/web-surface.test.mjs`
 - workflows: `.github/workflows/public-release-web.yml`
-- workflows: `.github/workflows/self-ops-bootstrap-dogfood.yml`
 
 ### Current top twenty maintenance hotspots
 
@@ -121,7 +120,6 @@ Safe change route: Reduce one declared responsibility in its owning module, run
 - `tests/dev-delivery-minimal-request.test.mjs`
 - `tests/build-configuration.test.mjs`
 - `.github/workflows/build.yml`
-- `.github/workflows/self-build-fixture.yml`
 - `scripts/generate-channel-promotion-workflow.mjs`
 - `tests/github-governance-authority.test.mjs`
 - `tests/maintainability.test.mjs`
@@ -132,9 +130,19 @@ Safe change route: Reduce one declared responsibility in its owning module, run
 - `.github/workflows/public-build-stage-capsule-canary.yml`
 - `.github/workflows/public-release-oci-compose-preview.yml`
 - `.github/workflows/public-release-promote.yml`
-- `.github/workflows/self-build-verify.yml`
-- `.github/workflows/self-release-promote.yml`
 - `.github/workflows/.release-binary-assets.yml`
+- `.github/workflows/public-ops-dev-auto-merge.yml`
+- `tests/release-topology.test.mjs`
+- `scripts/check-release-topology.mjs`
+- `packages/core/governance/buildchain-publication-authority.js`
+- `scripts/check-universal-workflow-bootstrap.mjs`
+- `packages/core/providers/github/discussions/materials.js`
+- `tests/controller-evidence.test.mjs`
+- `tests/floating-consumer-policy-contract.test.mjs`
+- `tests/macos-credential-island.test.mjs`
+- `tests/minimal-consumer-contract.test.mjs`
+- `tests/native-artifact-signing-authority.test.mjs`
+- `tests/workflow-taxonomy.test.mjs`
 
 ## action-process-runtime
 
@@ -439,6 +447,38 @@ Owner: Buildchain build signing transactions maintainers
 
 - `node --test tests/signing-authority-transactions.test.mjs tests/native-artifact-signing-authority.test.mjs`
 
+## business-attempt-journal
+
+Owner: Buildchain pipeline maintainers
+
+### Implementation
+
+- `packages/core/workflow/attempt/identity.js`
+- `packages/core/workflow/attempt/materials.js`
+- `packages/core/workflow/attempt/reader-entry.js`
+- `packages/core/workflow/attempt/reader.js`
+- `packages/core/workflow/attempt/records.js`
+- `packages/core/workflow/attempt/store.js`
+
+### Contracts
+
+- `architecture/decisions/0006-business-attempt-journal.md`
+
+### Tests
+
+- `tests/business-attempt-materials.test.mjs`
+- `tests/business-attempt-store.test.mjs`
+- `tests/business-attempt.test.mjs`
+
+### Generated outputs
+
+- `dist/readers/business-attempt.cjs`
+
+### Minimal validation
+
+- `node --test tests/business-attempt*.test.mjs`
+- `node scripts/build-release-discussion-reader.mjs --check`
+
 ## cli-capability-adapters
 
 Owner: Buildchain CLI maintainers
@@ -1006,6 +1046,223 @@ Owner: Buildchain architecture maintainers
 
 - `node --test tests/internal-architecture.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs`
 
+## minimal-consumer-contract
+
+Owner: Buildchain consumer contract maintainers
+
+### Implementation
+
+- `packages/core/consumer/contract/entries.js`
+- `packages/core/consumer/contract/examples.js`
+- `packages/core/consumer/contract/identity.js`
+- `packages/core/consumer/contract/inspection.js`
+- `packages/core/consumer/contract/plan.js`
+- `packages/core/consumer/contract/products.js`
+- `packages/core/consumer/contract/reader.js`
+- `packages/core/consumer/contract/shape.js`
+- `scripts/generate-minimal-consumer-contract.mjs`
+
+### Contracts
+
+- `architecture/decisions/0005-minimal-consumer-contract.md`
+
+### Tests
+
+- `tests/minimal-consumer-contract.test.mjs`
+- `tests/consumer-product-config.test.mjs`
+
+### Generated outputs
+
+- `architecture/minimal-consumer-migration.json`
+- `templates/minimal-consumer`
+
+### Minimal validation
+
+- `node --test tests/minimal-consumer-contract.test.mjs`
+- `node scripts/generate-minimal-consumer-contract.mjs --check`
+
+## minimal-consumer-pipeline
+
+Owner: Buildchain pipeline maintainers
+
+### Implementation
+
+- `packages/core/providers/github/attempt-index.js`
+- `packages/core/providers/github/attempt-journal.js`
+- `packages/core/providers/github/pipeline-checkout.js`
+- `packages/core/providers/github/pipeline-events.js`
+- `packages/core/providers/github/pipeline-integration.js`
+- `packages/core/providers/github/pipeline-policy.js`
+- `packages/core/providers/github/pipeline-run-entry.js`
+- `packages/core/providers/github/pipeline-runs.js`
+- `packages/core/providers/github/pipeline-source.js`
+- `packages/core/providers/github/pipeline-version-artifacts.js`
+- `packages/core/providers/github/pipeline-version-readback.js`
+- `packages/core/providers/github/pipeline-worker.js`
+- `packages/core/publication/pipeline/actions.js`
+- `packages/core/publication/pipeline/apply.js`
+- `packages/core/publication/pipeline/build-segments.js`
+- `packages/core/publication/pipeline/capsules.js`
+- `packages/core/publication/pipeline/context.js`
+- `packages/core/publication/pipeline/development-anchor.js`
+- `packages/core/publication/pipeline/development-current.js`
+- `packages/core/publication/pipeline/development-pr.js`
+- `packages/core/publication/pipeline/development-proof.js`
+- `packages/core/publication/pipeline/development-transition.js`
+- `packages/core/publication/pipeline/distribution.js`
+- `packages/core/publication/pipeline/documents.js`
+- `packages/core/publication/pipeline/effects.js`
+- `packages/core/publication/pipeline/files.js`
+- `packages/core/publication/pipeline/imported-materials.js`
+- `packages/core/publication/pipeline/journal.js`
+- `packages/core/publication/pipeline/next-development.js`
+- `packages/core/publication/pipeline/pack.js`
+- `packages/core/publication/pipeline/package-policy.js`
+- `packages/core/publication/pipeline/plan.js`
+- `packages/core/publication/pipeline/prepare.js`
+- `packages/core/publication/pipeline/qualification.js`
+- `packages/core/publication/pipeline/qualify.js`
+- `packages/core/publication/pipeline/recovery-admission.js`
+- `packages/core/publication/pipeline/recovery-build-download.js`
+- `packages/core/publication/pipeline/recovery-build-plan.js`
+- `packages/core/publication/pipeline/recovery-build-readback.js`
+- `packages/core/publication/pipeline/recovery-capsules.js`
+- `packages/core/publication/pipeline/recovery-import.js`
+- `packages/core/publication/pipeline/recovery-inspection.js`
+- `packages/core/publication/pipeline/recovery-materials.js`
+- `packages/core/publication/pipeline/recovery-plan.js`
+- `packages/core/publication/pipeline/recovery-prepare.js`
+- `packages/core/publication/pipeline/recovery-qualification.js`
+- `packages/core/publication/pipeline/recovery-readback.js`
+- `packages/core/publication/pipeline/recovery-signing.js`
+- `packages/core/publication/pipeline/sealed-products.js`
+- `packages/core/publication/pipeline/settle.js`
+- `packages/core/publication/pipeline/signing.js`
+- `packages/core/publication/pipeline/source-plan.js`
+- `packages/core/publication/pipeline/version-actions.js`
+- `packages/core/publication/pipeline/version-build.js`
+- `packages/core/publication/pipeline/version-context.js`
+- `packages/core/publication/pipeline/version-material.js`
+- `packages/core/publication/pipeline/version-preparation.js`
+- `packages/core/publication/pipeline/version-regeneration.js`
+- `packages/core/publication/pipeline/version-source-guard.js`
+- `packages/core/publication/pipeline/version.js`
+- `packages/core/publication/pipeline/worker.js`
+- `packages/core/workflow/attempt/journal.js`
+- `packages/core/workflow/commands/pipeline-build.mjs`
+- `packages/core/workflow/pipeline/action-output.js`
+- `packages/core/workflow/pipeline/actions.js`
+- `packages/core/workflow/pipeline/build-control.js`
+- `packages/core/workflow/pipeline/build-evidence.js`
+- `packages/core/workflow/pipeline/build-qualification.js`
+- `packages/core/workflow/pipeline/build-result.js`
+- `packages/core/workflow/pipeline/build.js`
+- `packages/core/workflow/pipeline/cancellation.js`
+- `packages/core/workflow/pipeline/channel-control.js`
+- `packages/core/workflow/pipeline/controller.js`
+- `packages/core/workflow/pipeline/delivery-control.js`
+- `packages/core/workflow/pipeline/delivery-observation.js`
+- `packages/core/workflow/pipeline/delivery-request.js`
+- `packages/core/workflow/pipeline/events.js`
+- `packages/core/workflow/pipeline/fence.js`
+- `packages/core/workflow/pipeline/group-control.js`
+- `packages/core/workflow/pipeline/guard-build.js`
+- `packages/core/workflow/pipeline/guard.js`
+- `packages/core/workflow/pipeline/host.js`
+- `packages/core/workflow/pipeline/materials.js`
+- `packages/core/workflow/pipeline/notifications.js`
+- `packages/core/workflow/pipeline/parent-notification.js`
+- `packages/core/workflow/pipeline/platforms.js`
+- `packages/core/workflow/pipeline/progress.js`
+- `packages/core/workflow/pipeline/projection.js`
+- `packages/core/workflow/pipeline/reconcile.js`
+- `packages/core/workflow/pipeline/recovery-action.js`
+- `packages/core/workflow/pipeline/recovery-admission.js`
+- `packages/core/workflow/pipeline/recovery-build-control.js`
+- `packages/core/workflow/pipeline/recovery-build-evidence.js`
+- `packages/core/workflow/pipeline/recovery-build.js`
+- `packages/core/workflow/pipeline/recovery-controller.js`
+- `packages/core/workflow/pipeline/recovery-integration.js`
+- `packages/core/workflow/pipeline/recovery-merge-proof.js`
+- `packages/core/workflow/pipeline/recovery-ownership-settlement.js`
+- `packages/core/workflow/pipeline/recovery-ownership.js`
+- `packages/core/workflow/pipeline/recovery-plan.js`
+- `packages/core/workflow/pipeline/recovery-runtime.js`
+- `packages/core/workflow/pipeline/recovery-session.js`
+- `packages/core/workflow/pipeline/recovery-transition.js`
+- `packages/core/workflow/pipeline/recovery-unrecorded-build.js`
+- `packages/core/workflow/pipeline/runtime-source.js`
+- `packages/core/workflow/pipeline/selection.js`
+- `packages/core/workflow/pipeline/session.js`
+- `packages/core/workflow/pipeline/settlement.js`
+- `packages/core/workflow/pipeline/wake.js`
+- `packages/core/workflow/pipeline/web-status.js`
+
+### Contracts
+
+- `architecture/decisions/0007-hosted-pipeline-controller.md`
+- `architecture/decisions/0009-pipeline-version-preparation.md`
+
+### Tests
+
+- `tests/business-attempt-journal.test.mjs`
+- `tests/github-attempt-journal.test.mjs`
+- `tests/pipeline-build-qualification.test.mjs`
+- `tests/pipeline-build.test.mjs`
+- `tests/pipeline-cancellation.test.mjs`
+- `tests/pipeline-channel.test.mjs`
+- `tests/pipeline-controller.test.mjs`
+- `tests/pipeline-delivery-request.test.mjs`
+- `tests/pipeline-distribution.test.mjs`
+- `tests/pipeline-events.test.mjs`
+- `tests/pipeline-fence.test.mjs`
+- `tests/pipeline-guard.test.mjs`
+- `tests/pipeline-index.test.mjs`
+- `tests/pipeline-integration.test.mjs`
+- `tests/pipeline-next-development.test.mjs`
+- `tests/pipeline-npm-channel.test.mjs`
+- `tests/pipeline-policy.test.mjs`
+- `tests/pipeline-progress.test.mjs`
+- `tests/pipeline-projection.test.mjs`
+- `tests/pipeline-publication-artifacts.test.mjs`
+- `tests/pipeline-publication-effects.test.mjs`
+- `tests/pipeline-publication-journal.test.mjs`
+- `tests/pipeline-publication-pack.test.mjs`
+- `tests/pipeline-publication-plan.test.mjs`
+- `tests/pipeline-publication-providers.test.mjs`
+- `tests/pipeline-publication-recovery-admission.test.mjs`
+- `tests/pipeline-publication-recovery-apply.test.mjs`
+- `tests/pipeline-publication-recovery-build.test.mjs`
+- `tests/pipeline-publication-recovery-signing.test.mjs`
+- `tests/pipeline-publication-version.test.mjs`
+- `tests/pipeline-reconcile.test.mjs`
+- `tests/pipeline-recovery-admission.test.mjs`
+- `tests/pipeline-recovery-build.test.mjs`
+- `tests/pipeline-recovery-controller.test.mjs`
+- `tests/pipeline-recovery-delivery.test.mjs`
+- `tests/pipeline-recovery-interruption.test.mjs`
+- `tests/pipeline-recovery-ownership.test.mjs`
+- `tests/pipeline-recovery-runtime-continuation.test.mjs`
+- `tests/pipeline-recovery-session.test.mjs`
+- `tests/pipeline-runs.test.mjs`
+- `tests/pipeline-runtime.test.mjs`
+- `tests/pipeline-settlement.test.mjs`
+- `tests/pipeline-source.test.mjs`
+- `tests/pipeline-version-artifacts.test.mjs`
+- `tests/pipeline-version-build.test.mjs`
+- `tests/pipeline-version-context.test.mjs`
+- `tests/pipeline-version-regeneration.test.mjs`
+- `tests/pipeline-web-status.test.mjs`
+- `tests/pipeline-worker.test.mjs`
+
+### Generated outputs
+
+- None.
+
+### Minimal validation
+
+- `node --test tests/pipeline-*.test.mjs tests/business-attempt-journal.test.mjs tests/github-attempt-journal.test.mjs`
+
 ## npm-publication-transaction
 
 Owner: Buildchain npm publication transaction maintainers
@@ -1998,9 +2255,11 @@ Owner: Buildchain runtime maintainers
 
 - `packages/core/runtime/entry/actions.js`
 - `packages/core/runtime/entry/activation.js`
+- `packages/core/runtime/entry/attempt.js`
 - `packages/core/runtime/entry/github.js`
 - `packages/core/runtime/entry/recovery.js`
 - `packages/core/runtime/entry/selection.js`
+- `packages/core/runtime/entry/source.js`
 - `scripts/check-runtime-entry.mjs`
 
 ### Contracts
@@ -2010,10 +2269,11 @@ Owner: Buildchain runtime maintainers
 
 ### Tests
 
-- `tests/runtime-entry-selection.test.mjs`
+- `tests/pipeline-recovery-runtime-continuation.test.mjs`
 - `tests/runtime-entry-activation.test.mjs`
-- `tests/runtime-entry-provider.test.mjs`
 - `tests/runtime-entry-architecture.test.mjs`
+- `tests/runtime-entry-provider.test.mjs`
+- `tests/runtime-entry-selection.test.mjs`
 
 ### Generated outputs
 
@@ -2278,7 +2538,6 @@ Owner: Buildchain adopter delivery maintainers
 - `contracts/fixtures/v4-adopter-delivery-v1/gate-unknown-selector.json`
 - `contracts/fixtures/v4-adopter-delivery-v1/offline-vectors.json`
 - `.github/workflows/public-build-adopter-qualification.yml`
-- `.github/workflows/self-build-adopter-dogfood.yml`
 - `docs/v4-adopter-delivery.md`
 
 ### Tests
@@ -2501,7 +2760,6 @@ Owner: Buildchain protected delivery maintainers
 - `contracts/dev-delivery-authority-v2.schema.json`
 - `dist/site/schemas/dev-delivery-authority-v2.schema.json`
 - `.github/workflows/public-ops-dev-auto-merge.yml`
-- `.github/workflows/self-ops-dev-delivery.yml`
 - `templates/native-dev-delivery.yml`
 - `docs/dev-delivery-warrant.md`
 - `docs/dev-delivery-qualification-landing-adr.md`
@@ -2542,7 +2800,6 @@ Owner: Buildchain publication rehearsal maintainers
 
 - `architecture/publication-rehearsal-parity.json`
 - `contracts/v4-publication-rehearsal-capsule-v1.schema.json`
-- `.github/workflows/self-release-rehearsal-dogfood.yml`
 - `docs/v4-publication-rehearsal.md`
 
 ### Tests
@@ -2573,7 +2830,6 @@ Owner: Buildchain workflow maintainers
 - `architecture/universal-workflow-fault-campaign.json`
 - `architecture/universal-workflow-capability-policy.json`
 - `.github/workflows/public-ops-bootstrap.yml`
-- `.github/workflows/self-ops-bootstrap-dogfood.yml`
 
 ### Tests
 

package/architecture/capability-state-machine-manifest.json

@@ -120,10 +120,7 @@
       "id": "release-candidate-recovery",
       "owner": "Buildchain promotion recovery plane",
       "sourceInventoryId": "release-candidate-recovery",
-      "surfaces": [
-        "export:./release-candidate-recovery",
-        "workflow:self-ops-promotion-recovery"
-      ],
+      "surfaces": ["export:./release-candidate-recovery"],
       "migrationPhase": "legacy-retired"
     },
     {