@kungfu-tech/buildchain 4.1.3-alpha.1 → 4.1.3-alpha.10

package/docs/release-governance.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-09-12
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-12
-  visible_context: Stable canary policy, symmetric zero-input self-build callers, artifact validation and regression tests.
+  generated_at: 2026-09-14
+  visible_context: User-directed zero-delay self release policy, required provider evidence and regression tests.
   invisible_context_boundary: No external consumer changes or completed stable publication is claimed.
 ---
 
@@ -358,7 +358,7 @@ The production channel and the test channel therefore intentionally diverge
 after release: production stays on the release commit, while alpha/dev continue
 at the next prerelease commit.
 
-### Stable Release Throttle And Canary Gate
+### Stable Release Evidence Gate
 
 Buildchain's own stable channel has an additional pre-publication gate. It is
 evaluated after the PR-stage release candidate has been resolved and before the
@@ -379,8 +379,6 @@ candidate is allowed only when all of these facts are true:
 
 - the candidate resolves to an immutable exact alpha tag and its GitHub
   prerelease timestamp;
-- at least 24 hours have passed since the preceding stable patch on the same
-  minor line;
 - the preceding stable-to-alpha comparison contains a product or public
   contract path, not only version, test, evidence, or retrospective changes;
 - the version-bound impact record has a non-empty summary and at least one
@@ -392,8 +390,7 @@ candidate is allowed only when all of these facts are true:
 - the status target is the repository-owned alpha dogfood workflow, its summary
   archive matches the provider digest, and the summary binds the source run,
   attempt, exact candidate runtime and all install/build/verify stages; overrides,
-  another candidate and incomplete artifacts are rejected;
-- at least one hour has elapsed after the last required canary completed.
+  another candidate and incomplete artifacts are rejected.
 
 The machine report is written to
 `.buildchain/release-passport/stable-release-gate.json`. A passing report is
@@ -407,10 +404,11 @@ Generic `commit-status` consumer canaries remain supported for repositories that
 explicitly declare them; their runtime input or workflow-owned run-name binding
 continues to apply.
 
-The cooldown is a minimum interval, not an instruction to release every day.
-Compatible work should still be batched until a stable release has a concrete
-consumer need. Changing the interval, canary set, attestors, product path
-boundary, or soak time is a reviewed policy change.
+Buildchain sets both the minimum stable interval and canary soak duration to
+zero. A candidate can proceed as soon as its required evidence is valid; no
+fixed cooldown, soak window or scheduled release time delays this delivery.
+Changing the canary set, attestors or product path boundary remains a reviewed
+policy change.
 
 Repositories that want a predictable scheduled stable window can use
 [`Stable Candidate Patrol`](stable-candidate-patrol.md). It persists each exact

package/docs/runtime-entry.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-11
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-11
-  visible_context: Explicit user-approved runtime selection, recovery and alpha publication requirements.
+  generated_at: 2026-09-14
+  visible_context: Source-bound recovery, nested delivery credential transport, published entry contract and local failure-path tests.
   invisible_context_boundary: This contract does not claim implementation or hosted qualification is complete.
 ---
 
@@ -40,7 +40,9 @@ Switching runtimes does not automatically qualify all previous results for reuse
 Neither the persisted caller nor its contract lock needs a train rewrite.
 
 An entry failure is repaired by publishing and adopting a corrected entry and
-starting a complete run. Recovering an invalid entry is not a runtime feature.
+starting a new provider run through the corrected floating entry. The caller files
+remain unchanged. A usable recovery entry can still recover the exact existing
+attempt; an entry failure before admission has no attempt to recover.
 Buildchain self-dogfood uses exactly the same consumer contract and has no
 repository-specific execution or recovery route.
 
@@ -54,7 +56,73 @@ single preparation ownership, different entry/runtime execution, train recovery,
 platform and multi-job qualification, and validation of the published consumer
 entry. A source test or a successful package import alone is insufficient.
 
-## Consumer build and recovery
+## Minimal pipeline provider credentials
+
+Configure `BUILDCHAIN_AUTOMATION_TOKEN` once as a repository Actions secret when
+protected delivery requires permissions unavailable to `GITHUB_TOKEN`. Both
+generated callers already inherit secrets. No token value, additional input or
+provider orchestration belongs in the consumer TOML or workflow source.
+
+Scope this credential to the consumer repository. Delivery needs Administration
+read access to inspect classic branch locks, Checks read, and Actions, Contents,
+Pull requests and Commit statuses write access for its existing provider steps.
+It does not need permission to change branch protection or bypass review. Development
+admission can fall back to `GITHUB_TOKEN`; unreadable protection still fails
+closed before candidate reservation instead of assuming an unlocked branch.
+Channel enqueue requires an explicit automation credential or an App installation
+credential because `GITHUB_TOKEN` suppresses the required `merge_group` workflow.
+Both central entries select that credential through the shared token provider;
+queue reads and journal writes retain their existing workflow credential. An App
+uses `BUILDCHAIN_APP_CLIENT_ID` and `BUILDCHAIN_APP_PRIVATE_KEY`, scoped to the
+consumer repository with Pull requests write access. Missing or incomplete queue
+credentials fail closed before enqueue.
+
+The internal delivery edge forwards only this named secret to the credentialed
+source, reservation, heartbeat and landing steps. Product builds, native
+execution and native evidence sealing retain their separate read-only jobs and
+receive no automation credential. Publication settlement uses the same canonical
+secret as its existing fallback credential. Repairing a missing workflow secret
+edge requires a corrected published entry and a new provider run.
+
+## Minimal pipeline recovery
+
+The minimal contract has one normal event caller and one manual recovery caller,
+plus `.buildchain/buildchain.toml`. Both callers are maintained by Buildchain's
+consumer setup; product differences do not require additional recovery workflows.
+The repository implementation alone does not prove the entry has been published
+or qualified in a clean consumer.
+
+The workflow summary identifies the current attempt, its source PR, completed
+steps and remaining work. Follow **Recover this attempt**, choose **Run workflow**,
+and paste the exact attempt. Leave `runtime-ref` empty for an ordinary retry;
+supply a repaired runtime only when needed. The public recovery entry accepts no
+other recovery selectors. It derives configuration, producer runs, artifacts and
+transaction coordinates from the canonical attempt history.
+
+Recovery opens a new attempt with an explicit predecessor. Successful platform
+jobs and their actual retained artifacts are independently requalified; only
+missing platforms or explicitly incompatible stage implementations are rebuilt.
+A signing failure can requalify the original sealed bytes under the repaired
+publisher. Partial publication preserves its original signed transaction and
+completed effects, reads providers again, and authorizes only remaining effects.
+Missing, expired or conflicting evidence stops with a diagnosis; it does not
+silently trigger a complete rebuild or replace published bytes.
+
+A repeated request for the same predecessor and repair selects the same successor.
+If that recovery was interrupted, select the successor shown in the summary for
+the next recovery. An active predecessor must first finish or be cancelled using
+its ordinary GitHub execution link. A changed or superseded source cannot reuse
+an old attempt as authority for the current PR. Completed publication remains
+recorded even when distribution or the next development version still needs work.
+Cancellation stops remaining work and cannot undo published results.
+
+Once admitted, ordinary wake events continue with the recovered attempt's exact
+runtime, even when the consumer lock still names the original runtime. A further
+runtime change requires another explicit recovery. An entry repair is distributed
+through the existing `@v4` or `@v4-alpha` entry; consumers do not maintain backup
+scripts, patch a job definition, or add a different recovery workflow family.
+
+## Advanced build component recovery
 
 ```yaml
 on:

package/docs/runtime-train-validation.md

@@ -8,27 +8,30 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-08
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-08
-  invisible_context: not asserted
+  generated_at: 2026-09-14
+  visible_context: Source-bound caller installation, pipeline wake implementation and GitHub event documentation.
+  invisible_context_boundary: No unobserved provider execution or publication authority is claimed.
 ---
 
 # Runtime Train Validation
 
 A train repairs the execution runtime without changing the consumer's durable
 public entry. All public workflows, including ordinary builds, use the same
-[Runtime entry contract](runtime-entry.md). The transient runtime parameter
-wins over the consumer lock. Buildchain dogfood follows this same path.
+[Runtime entry contract](runtime-entry.md). The recovery entry accepts a transient runtime parameter, which wins over the
+consumer lock. The normal minimal pipeline accepts only an optional config path.
+Buildchain dogfood follows the same two-entry contract.
 
 ## Validate a runtime change
 
 1. Commit the candidate with its action bundles, WASM and runtime contract.
 2. Publish the candidate at `train/v4/v4.1/<capability>`.
-3. Dispatch the consumer's existing public entry with `runtime-ref` set to that
-   train. Record the selected runtime, consumer source and resulting evidence.
+3. Recover the exact retained attempt through `buildchain-recover.yml`, with
+   `runtime-ref` set to that train. Record the attempt, selected runtime, consumer
+   source and resulting evidence.
 4. After checks and independent review, merge into protected Dev and publish
    the requested Alpha. Qualify the published entry before Stable promotion.
 
@@ -38,13 +41,38 @@ provider credentials, capability constraints and readback requirements.
 
 ## Recover a runtime failure
 
-Start a new dispatch through the same public entry with the repaired train.
-For builds, supply `resume-run-id`; for release promotion, preserve the original
-candidate run and transaction in the typed request. The entry prepares runtime
-Y while the task keeps its original source and valid completed evidence.
+Start a new dispatch through `buildchain-recover.yml` with the exact attempt
+and the repaired train. The runtime selects the retained source and completed
+evidence; the consumer does not provide candidate, run or transaction selectors.
 A GitHub failed-job rerun does not change its inputs and cannot select a new
 runtime. Do not persist the train into the caller workflow or contract lock.
 
 If the public entry itself is defective, publish and adopt the corrected entry
 and start a full run. Copied consumer recovery packages and alternate recovery
 workflows are not part of the runtime contract.
+
+## Protected minimal-entry installation
+
+Install both generated callers, `buildchain.yml` and `buildchain-recover.yml`,
+on the protected default branch before retiring the previous delivery controller.
+Read back both files at the exact protected commit and verify their provider
+workflow registrations. A workflow registered from a task branch does not prove
+that its event receiver is installed on the default branch. GitHub requires that
+location for [repository dispatch events](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#repository_dispatch).
+
+Recovery preserves source and completed artifacts, then emits a repository
+wake for the remaining pipeline work. That wake requires the normal caller on
+the default branch; installing only the manual recovery caller leaves this
+continuation receiver absent. Verify the complete pair before the first recovery.
+
+During this bounded migration, pause the normal pipeline before enabling the
+previous protected delivery controller. After the installation merge, wait for
+its runs and Warrant to become terminal, then pause that controller and enable
+the normal pipeline before recovering a current admitted attempt. An installation
+merge advances the protected base, so an older unmerged source attempt must be
+re-admitted on the current base before recovery.
+
+Both callers are byte-identical to the generated consumer entries and call the
+published `@v4-alpha` public workflows. Recovery accepts only `attempt` and
+optional `runtime-ref`; the normal caller retains its protected config path.
+This installation order does not qualify the full self cutover or Stable release.

package/docs/stable-candidate-patrol.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-09-12
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-12
-  visible_context: Repository stable policy, public build qualification producer, artifact reader and regression tests.
+  generated_at: 2026-09-14
+  visible_context: User-directed zero-delay self release policy, required provider evidence and regression tests.
   invisible_context_boundary: No credentials, private logs, or unpublished consumer content were used.
 ---
 
@@ -52,7 +52,8 @@ It writes `buildchain-canary/buildchain-zero-input` on the qualified runtime SHA
 as `github-actions[bot]`. The consumer source SHA may differ from that runtime.
 
 The repository Patrol policy requires the alpha Release and this qualification
-status. It retains the one-hour soak. The publication transaction still requires
+status. Its minimum soak and stable publication interval are both zero.
+The publication transaction still requires
 its sealed release candidate and protected branch checks. Qualification produces
 evidence; it does not publish or merge a candidate.
 
@@ -78,7 +79,7 @@ Declare the default once in `.buildchain/buildchain.toml`:
 strategy = "latest-qualified-alpha"
 timezone = "Asia/Shanghai"
 publish_at = "03:00"
-minimum_soak_seconds = 3600
+minimum_soak_seconds = 0
 required_checks = [
   "alpha-release",
   "workflow:Build",

package/docs/workflow-catalog.md

@@ -23,7 +23,7 @@ Generated from `architecture/workflow-taxonomy.json`. Every workflow has one can
 
 Public workflows own the consumer API. Component workflows own reusable multi-job topology. Self workflows own Buildchain repository automation. Actions own execution steps; JS adapters and Rust/WASM own implementation.
 
-Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and `self-<category>-<purpose>.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.
+Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and the generated self callers `buildchain.yml` and `buildchain-recover.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.
 
 Register ownership before adding a workflow. `pnpm run check:workflows` validates source, calls, required CI integration and independent review ownership. `pnpm run generate:workflows` regenerates this catalog.
 
@@ -47,6 +47,8 @@ Register ownership before adding a workflow. `pnpm run check:workflows` validate
 | [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly |
 | [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly |
 | [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol |
+| [public-ops-pipeline.yml](../.github/workflows/public-ops-pipeline.yml) | ops | reusable | active | Buildchain pipeline |
+| [public-ops-recover.yml](../.github/workflows/public-ops-recover.yml) | ops | reusable | active | Buildchain recovery |
 | [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile |
 | [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol |
 | [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal |
@@ -69,42 +71,17 @@ Register ownership before adding a workflow. `pnpm run check:workflows` validate
 | [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile |
 | [.build.yml](../.github/workflows/.build.yml) | build | reusable | active | Buildchain Build |
 | [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git |
+| [.ops-pipeline-delivery.yml](../.github/workflows/.ops-pipeline-delivery.yml) | ops | reusable | active | Internal pipeline delivery |
+| [.ops-pipeline-execute.yml](../.github/workflows/.ops-pipeline-execute.yml) | ops | reusable | active | Internal pipeline execution |
 | [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority |
 | [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets |
+| [.release-pipeline-products.yml](../.github/workflows/.release-pipeline-products.yml) | release | reusable | active | Internal pipeline product publication |
+| [.release-pipeline-version.yml](../.github/workflows/.release-pipeline-version.yml) | release | reusable | active | Internal pipeline version preparation |
 | [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced |
 
 ## self
 
 | Workflow | Category | Invocation | Status | Purpose |
 | --- | --- | --- | --- | --- |
-| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood |
-| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood |
-| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution |
-| [self-build-channel-verify.yml](../.github/workflows/self-build-channel-verify.yml) | build | repository | active | Release - Verify |
-| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood |
-| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification |
-| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture |
-| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood |
-| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification |
-| [self-build-stable-dogfood.yml](../.github/workflows/self-build-stable-dogfood.yml) | build | repository | active | Buildchain Stable Self-Dogfood |
-| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify |
-| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood |
-| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery |
-| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit |
-| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily |
-| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly |
-| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly |
-| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance |
-| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily |
-| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly |
-| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly |
-| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery |
-| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke |
-| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol |
-| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets |
-| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap |
-| [self-release-next-development.yml](../.github/workflows/self-release-next-development.yml) | release | repository | active | Next Development Review |
-| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package |
-| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion |
-| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood |
-| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood |
+| [buildchain-recover.yml](../.github/workflows/buildchain-recover.yml) | ops | repository | active | Buildchain recovery |
+| [buildchain.yml](../.github/workflows/buildchain.yml) | ops | repository | active | Buildchain pipeline |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.1.3-alpha.1",
+  "version": "4.1.3-alpha.10",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -157,7 +157,7 @@
   "scripts": {
     "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery/dev-delivery-authority-candidate.js packages/core/dev-delivery/dev-delivery-authority-evidence.js packages/core/dev-delivery/dev-delivery-authority-landing.js packages/core/dev-delivery/dev-delivery-authority-observation.js packages/core/dev-delivery/dev-delivery-authority-qualification.js packages/core/dev-delivery/dev-delivery-authority-settlement.js packages/core/dev-delivery/dev-delivery-authority-state.js packages/core/dev-delivery/dev-delivery-execution-failure.js packages/core/dev-delivery/dev-delivery-execution-transfer.js packages/core/dev-delivery/dev-delivery-landing-readback.js packages/core/dev-delivery/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery/dev-delivery-landing-testing-port.js packages/core/dev-delivery/dev-delivery-native-execution.js packages/core/dev-delivery/dev-delivery-native-proof.js packages/core/dev-delivery/dev-delivery-process-boundary.js packages/core/dev-delivery/dev-delivery-warrant-qualification.js packages/core/dev-delivery/dev-delivery-warrant-state.js packages/core/dev-delivery/commands/dev-delivery-authority-command-adapters.mjs packages/core/dev-delivery/commands/dev-delivery-authority-provider.mjs packages/core/dev-delivery/commands/dev-delivery-authority.mjs packages/core/dev-delivery/native/execution.js packages/core/dev-delivery/commands/dev-delivery-process-boundary.mjs packages/core/dev-delivery/native/transactions.js packages/core/dev-delivery/commands/dev-delivery-two-phase.mjs packages/core/dev-delivery/commands/dev-delivery-warrant-options.mjs packages/core/dev-delivery/warrant/persistence.js templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash packages/core/providers/commands/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:discussion-reader && pnpm run check:layout && node scripts/check-runtime-entry.mjs && pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node packages/core/governance/commands/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check": "pnpm run check:consumer-contract && pnpm run check:discussion-reader && pnpm run check:layout && node scripts/check-runtime-entry.mjs && pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node packages/core/governance/commands/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && node scripts/check-source-bindings.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/runtime-resume-lineage-v2.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/runtime-resume-lineage-v2/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json packages/core/contracts/command-registry.mjs packages/core/governance/cli/compatibility-facts.mjs packages/core/contracts/canonical-contracts.js packages/core/contracts/kungfu-temporal-fact.js packages/core/governance/buildchain-compatibility-fact.js packages/core/governance/buildchain-compatibility-authority.js packages/core/governance/buildchain-compatibility-proof.js packages/core/consumer/floating-consumer-evidence.js packages/core/consumer/floating-consumer-policy.js packages/core/consumer/floating-consumer-release-passport.js packages/core/release/recovery/lineage.js packages/core/release/tail-reseal-contract.js packages/core/release/tail-reseal-github.js packages/core/release/tail-reseal-receipt.js packages/core/release/tail-reseal.js packages/core/consumer/runtime-selector-persistence.js packages/core/release/provider-operation-journal.js packages/core/release/provider-readback-idempotency.js packages/core/release/release-activation-shadow.js packages/core/release/stable-publication-fence.js packages/core/release/partial-mutation-recovery-qualification.js packages/core/build/stage-capsule.js packages/core/build/stage-capsule-store.js packages/core/build/stage-capsule-local-store.js packages/core/build/platform-stage-checkpoints.js packages/core/build/stage-capsule-resume-planner.js packages/core/build/stage-capsule-qualification.js packages/core/build/stage-capsule-qualification-campaign.js packages/core/dev-delivery/delivery-warrant-fixture-runner.js packages/core/dev-delivery/delivery-warrant-read-candidate.js packages/core/dev-delivery/delivery-warrant-semantic-diff-gate.js packages/core/dev-delivery/delivery-warrant-shadow-adapter.js scripts/check-core-mechanism-inventory.mjs scripts/check-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs packages/core/dev-delivery/commands/dev-pr-prequeue-guard.mjs scripts/check-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs packages/core/governance/commands/architecture.mjs packages/core/runtime/commands/bridge-bootstrap.mjs scripts/bridge-evidence.mjs packages/core/consumer/commands/consumer-policy.mjs packages/core/runtime/commands/host-adapter.mjs scripts/platform-stage-checkpoint-rehearsal.mjs scripts/stage-capsule-resume-rehearsal.mjs packages/core/build/commands/stage-capsule-qualification.mjs scripts/tail-reseal-macos-rehearsal.mjs packages/core/release/commands/tail-reseal.mjs scripts/warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/runtime-entry-provider.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/architecture.test.mjs tests/bridge.test.mjs tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-resume-lineage.test.mjs tests/runtime-semantic-closure.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs tests/warrant-shadow-plan.test.mjs",
     "check:bridge": "cargo fmt --manifest-path crates/buildchain-host-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml",
     "check:contracts": "pnpm run check:contracts:rust && node --test tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/domain-wasm.test.mjs tests/floating-consumer-policy-contract.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-resume-lineage.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/publication-rehearsal.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs",
@@ -184,7 +184,8 @@
     "check:implementation-naming": "node scripts/check-implementation-naming.mjs",
     "check:layout": "node scripts/check-code-layout.mjs",
     "build:discussion-reader": "node scripts/build-release-discussion-reader.mjs",
-    "check:discussion-reader": "node scripts/build-release-discussion-reader.mjs --check"
+    "check:discussion-reader": "node scripts/build-release-discussion-reader.mjs --check",
+    "check:consumer-contract": "node scripts/generate-minimal-consumer-contract.mjs --check"
   },
   "devDependencies": {
     "@actions/expressions": "0.3.61",

package/packages/core/adoption/buildchain-kfd-claims.js

@@ -58,7 +58,10 @@ const WORKFLOW_AND_ACTION_FILES = Object.freeze([
   ".github/workflows/.build.yml",
   ".github/workflows/.release-promote.yml",
   ".github/workflows/public-release-promote.yml",
-  ".github/workflows/self-release-promote.yml",
+  ".github/workflows/buildchain.yml",
+  ".github/workflows/buildchain-recover.yml",
+  ".github/workflows/public-ops-pipeline.yml",
+  ".github/workflows/public-ops-recover.yml",
   ".github/workflows/public-release-artifact-attestation.yml",
   "actions/build/artifact/prepare-attestation/action.yml",
   "actions/build/artifact/prepare-attestation/index.js",
@@ -75,7 +78,6 @@ const EXTRA_KFD1_FILES = Object.freeze([
   "packages/core/index.js",
   "packages/core/build/homebrew.js",
   "packages/core/build/build-facts.js",
-  "packages/core/adoption/kfd3-surface-register.js",
   "packages/core/release/release-propagation.js",
   "scripts/generate-site-bundle.mjs",
   "packages/core/release/commands/ensure-github-release.mjs",
@@ -446,7 +448,7 @@ export function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}
     {
       name: "Buildchain standalone binary distribution",
       artifactPath: "dist/binary",
-      evidencePath: ".github/workflows/self-build-binary-distribution.yml",
+      evidencePath: ".github/workflows/.release-pipeline-products.yml",
       distribution: normalizeKfd3DistributionDeclaration({
         registrar: "shifu",
         tasks: ["binary:build"],
@@ -529,7 +531,6 @@ export function createBuildchainKfdClaimRegistry({ root = process.cwd(), sourceS
 
 export function createBuildchainKfd1Witness({ root = process.cwd(), sourceSha = "" } = {}) {
   const registry = createBuildchainKfdClaimRegistry({ root, sourceSha });
-  const registrySha256 = sha256Json(registry);
   const paths = uniquePaths([
     ...publicDocumentationFiles(root),
     ...SCHEMA_AND_STANDARD_FILES,
@@ -545,7 +546,7 @@ export function createBuildchainKfd1Witness({ root = process.cwd(), sourceSha =
     contractWorld: {
       id: "buildchain-runtime-contract-world",
       schemaId: "kungfu-buildchain-runtime-contract-world",
-      digest: `sha256:${registrySha256}`,
+      digest: `sha256:${sha256Json(registry)}`,
       owner: "Buildchain maintainers",
       selfHosted: true,
     },
@@ -584,7 +585,6 @@ export function createBuildchainKfd3PrebuildWitness({ root = process.cwd(), sour
   const registry = createBuildchainKfdClaimRegistry({ root, sourceSha });
   const surfaces = createBuildchainKfdSurfaceRegistry({ root });
   const reverseAudit = publicSurfaceAuditEvidence(root);
-  const digest = `sha256:${sha256Json(registry)}`;
   return {
     schemaVersion: 1,
     id: "buildchain-collaboration-interface",
@@ -596,7 +596,7 @@ export function createBuildchainKfd3PrebuildWitness({ root = process.cwd(), sour
       path: "dist/site/kfd-claims.json",
       sha256: fileExists(root, "dist/site/kfd-claims.json") ? sha256File(root, "dist/site/kfd-claims.json") : "",
     },
-    collaborationInterfaceDigest: digest,
+    collaborationInterfaceDigest: `sha256:${sha256Json(registry)}`,
     collaborationInterface: {
       schemaVersion: 1,
       contract: BUILDCHAIN_KFD_COLLABORATION_INTERFACE_CONTRACT,

package/packages/core/build/standalone/build.js

@@ -11,7 +11,12 @@ import {
   readLogPath,
   noopLogger,
 } from "./logging.js";
-import { platformTriple, copyNodeBinary, sourceSha } from "./identity.js";
+import {
+  platformTriple,
+  copyNodeBinary,
+  sourceSha,
+  packageVersion,
+} from "./identity.js";
 import { bundleCli, postjectArgs } from "./bundle.js";
 import { run } from "./process.js";
 function prepareStandaloneExecutable({
@@ -124,6 +129,7 @@ export function buildStandaloneBinary({
   nodePath = process.execPath,
   nodeVersion = process.version,
 } = {}) {
+  version ||= packageVersion(cwd);
   const resolvedOutputDir = path.resolve(cwd, outputDir);
   const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-sea-"));
   try {

package/packages/core/consumer/buildchain-config.js

@@ -5,8 +5,8 @@ import { isDeepStrictEqual } from "node:util";
 import { parse } from "smol-toml";
 import {
   BUILDCHAIN_CONFIG_PATH,
-  resolveBuildchainConfigPath,
 } from "../contracts/buildchain-layout.js";
+import { readProductConfiguration } from "./contract/reader.js";
 import { runShellCommandSync } from "../runtime/spawn-command.js";
 import { normalizeBuildConfiguration } from "../build/build-configuration.js";
 
@@ -181,26 +181,7 @@ function updateTomlStringValuePreservingSource({ source, content, key, value, fi
 }
 
 export function loadBuildchainConfig(cwd = process.cwd()) {
-  const configPath = resolveBuildchainConfigPath(cwd);
-  const filePath = path.join(cwd, configPath);
-  if (!fs.existsSync(filePath)) {
-    return undefined;
-  }
-  const source = fs.readFileSync(filePath, "utf8");
-  let config;
-  try {
-    config = parse(source);
-  } catch (error) {
-    throw new Error(`${configPath} parse failed: ${error.message}`);
-  }
-  if (config.schema !== 1) {
-    throw new Error(`${configPath} schema must be 1`);
-  }
-  return {
-    path: configPath,
-    filePath,
-    config: normalizeBuildchainConfig(config),
-  };
+  return readProductConfiguration(cwd, normalizeBuildchainConfig);
 }
 
 export function normalizeBuildchainConfig(config) {

package/packages/core/consumer/contract/entries.js

@@ -0,0 +1,85 @@
+import { choice, object, relativePath, text } from "./shape.js";
+import { CONFIG_PATH } from "./plan.js";
+
+export const PIPELINE_ENTRY = ".github/workflows/public-ops-pipeline.yml";
+export const RECOVERY_ENTRY = ".github/workflows/public-ops-recover.yml";
+export const PIPELINE_EVENTS = {
+  pull_request: [
+    "opened",
+    "reopened",
+    "synchronize",
+    "ready_for_review",
+    "converted_to_draft",
+    "closed",
+    "labeled",
+    "unlabeled",
+    "edited",
+    "enqueued",
+    "dequeued",
+  ],
+  pull_request_review: ["submitted", "dismissed"],
+  pull_request_target: ["closed"],
+  merge_group: ["checks_requested"],
+  push: [],
+  repository_dispatch: ["buildchain-attempt-wake"],
+};
+
+export function normalInputs(value = {}) {
+  object(value, [], ["config-path"], "inputs");
+  const configPath = relativePath(
+    value["config-path"] ?? CONFIG_PATH,
+    "inputs.config-path",
+  );
+  if (!configPath.endsWith(".toml") || configPath.includes("*"))
+    throw new Error("inputs.config-path: expected one TOML path");
+  return { configPath };
+}
+
+export function recoveryInputs(value) {
+  object(value, ["attempt"], ["runtime-ref"], "inputs");
+  text(value.attempt, "inputs.attempt", /^attempt-[0-9a-f]{64}$/u);
+  const runtimeRef = value["runtime-ref"] ?? "";
+  if (runtimeRef !== "")
+    text(
+      runtimeRef,
+      "inputs.runtime-ref",
+      /^(?:[0-9a-f]{40}|v4(?:-alpha)?|train\/v4\/v4\.[0-9]+\/[a-z0-9][a-z0-9-]*)$/u,
+    );
+  return { attempt: value.attempt, runtimeRef };
+}
+
+export function admitEvent(name, action = "") {
+  choice(name, Object.keys(PIPELINE_EVENTS), "event.name");
+  choice(
+    action,
+    PIPELINE_EVENTS[name].length ? PIPELINE_EVENTS[name] : [""],
+    "event.action",
+  );
+  return { name, action };
+}
+
+function call(entry, channel, extra = "") {
+  return `permissions:\n  contents: read\njobs:\n  buildchain:\n    uses: kungfu-systems/buildchain/${entry}@${channel}\n${extra}    secrets: inherit\n    permissions:\n      actions: write\n      attestations: write\n      checks: write\n      contents: write\n      discussions: write\n      id-token: write\n      pull-requests: write\n      statuses: write\n`;
+}
+
+// Product-independent source of the two caller bytes. Public entry publication
+// is qualified separately; rendering this contract is not an execution receipt.
+export function consumerWorkflows(channel = "v4", configPath = CONFIG_PATH) {
+  choice(channel, ["v4", "v4-alpha"], "entry.channel");
+  normalInputs({ "config-path": configPath });
+  const configInput =
+    configPath === CONFIG_PATH
+      ? ""
+      : `    with:\n      config-path: ${configPath}\n`;
+  const events = Object.entries(PIPELINE_EVENTS)
+    .map(([name, types]) => {
+      return types.length
+        ? `  ${name}:\n    types: [${types.join(", ")}]\n`
+        : `  ${name}:\n`;
+    })
+    .join("");
+  return {
+    ".github/workflows/buildchain.yml": `name: Buildchain pipeline\non:\n${events}${call(PIPELINE_ENTRY, channel, configInput)}`,
+    ".github/workflows/buildchain-recover.yml": `name: Buildchain recovery\non:\n  workflow_dispatch:\n    inputs:\n      attempt:\n        description: Exact Buildchain attempt to recover\n        required: true\n        type: string\n      runtime-ref:\n        description: Optional repaired runtime\n        required: false\n        type: string\n${call(RECOVERY_ENTRY, channel, "    with:\n      attempt: ${{ inputs.attempt }}\n      runtime-ref: ${{ inputs.runtime-ref }}\n")}`,
+  };
+}