@kungfu-tech/buildchain 4.1.3-alpha.1 → 4.1.3-alpha.10

package/architecture/universal-workflow-capability-policy.json

@@ -28,15 +28,15 @@
     "sha256:025e2a4a37bb9364c03aa3c9ab6bad773f78a541203a23791e2d7afd70d773ca",
     "sha256:02e8b51faabbc960e9c70b090426272b720f3e1438b69a0f683b21257bed6302",
     "sha256:07bb744fedc9512b1e40f5c00a0037194fc869600fc7fd07de7f3b975b9760ff",
-    "sha256:13dea813a98cb2cc1a51cafb880127ee2c022f3c5aae5144818aec17e9cb7498",
     "sha256:17c5fc05f8599662cd061a94add5313dc0fcea58404f9a92ee632c98abce24c6",
     "sha256:1f3cbeb68fed850330720784bbe2d1d2c91b759cc2459a7fcd0b150af4c47c34",
     "sha256:24cbb86e8fb198f7a949372291e712dd83ff12ba667c7049775ef497261bc62e",
+    "sha256:2649d77a31c75fb93c40a04dea30362c3247cd777dc8ed38a2487d082d25ab05",
     "sha256:265ccc9da3d84b8bf50746b6722b18c680dcc65bd322a5170e81bd5d0fa5b2b0",
     "sha256:2c5a19fe5ebe2550336c42f7de0c71b0e736776758b404716a5f77e0236920dc",
-    "sha256:310b9c3db199e6d900ca4756f152396103630da36aafa7218fe50fb8996f1da1",
     "sha256:34829b6e556284ef7c3f342fafcf92588a94761534e5f19ea12131f389ad4f50",
     "sha256:3d6119d1295ea7083d44a1b82fde5cb5dca910e427d1aee119d3ffbf421810f3",
+    "sha256:3da67ab9893f312415d23c3ec55ab2c16d20fb4efef972f954b3099141e42a08",
     "sha256:40fdce377a9b02cb53f41e822cfc5d96c2f7e57a86a7574bf8ee39f3e0f0e12e",
     "sha256:421b65afe174ce4ae57290efc73e43f94140b8ef70a2db5cda43e16921d61b4e",
     "sha256:428467c6ac1d768609ff12e72a190462bab9b5bc7dd2ea491553a364aa4c6ef6",
@@ -62,6 +62,6 @@
     "sha256:e207436baa946b3d25d0159a510b7da474cac8d33701c2e66c089117c05f473d",
     "sha256:f780070e235bffdee96fc355d7ed5e2fd4188482c41b24e2558a32086634a87c"
   ],
-  "validFrom": "2026-08-30T00:00:00.000Z",
-  "expiresAt": "2026-09-15T00:00:00.000Z"
+  "validFrom": "2026-09-15T00:00:00.000Z",
+  "expiresAt": "2026-10-01T00:00:00.000Z"
 }

package/architecture/universal-workflow-fault-campaign.json

@@ -60,7 +60,9 @@
       "id": "self-dogfood-caller",
       "injectionTarget": ".github/workflows/self-ops-bootstrap-dogfood.yml",
       "recoveryRoute": "upgrade-entry-and-full-rerun",
-      "recoveryTarget": "templates/universal-buildchain-bootstrap.yml"
+      "recoveryTarget": "templates/universal-buildchain-bootstrap.yml",
+      "retired": true,
+      "retirementReason": "Standalone self caller removed; retained campaign does not qualify the minimal pipeline."
     }
   ]
 }

package/architecture/workflow-taxonomy.json

@@ -115,50 +115,6 @@
       "invocation": "dispatch-service",
       "rationale": "Buildchain Artifact Signing Authority: owned release public workflow with one canonical implementation."
     },
-    {
-      "id": "auditable-demo",
-      "role": "self",
-      "category": "build",
-      "purpose": "demo-dogfood",
-      "summary": "Buildchain Declarative Demo Dogfood",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Declarative Demo Dogfood: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "auditable-demo-media-profile-qualification",
-      "role": "self",
-      "category": "build",
-      "purpose": "demo-media-qualification",
-      "summary": "Auditable Demo Media Profile Qualification",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Auditable Demo Media Profile Qualification: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "binary-distribution",
-      "role": "self",
-      "category": "build",
-      "purpose": "binary-distribution",
-      "summary": "Binary Distribution",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Binary Distribution: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "binary-release-assets",
-      "role": "self",
-      "category": "release",
-      "purpose": "binary-assets",
-      "summary": "Binary Release Assets",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Binary Release Assets: owned release self workflow with one canonical implementation."
-    },
     {
       "id": "bootstrap",
       "role": "public",
@@ -182,50 +138,6 @@
       "rationale": "Buildchain Channel Build: owned build public workflow with one canonical implementation.",
       "path": ".github/workflows/build.yml"
     },
-    {
-      "id": "build-surface-fixture",
-      "role": "self",
-      "category": "build",
-      "purpose": "fixture",
-      "summary": "Build Surface Fixture",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Build Surface Fixture: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-alpha-self-dogfood",
-      "role": "self",
-      "category": "build",
-      "purpose": "alpha-dogfood",
-      "summary": "Buildchain Alpha Self-Dogfood",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Alpha Self-Dogfood: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-stable-self-dogfood",
-      "role": "self",
-      "category": "build",
-      "purpose": "stable-dogfood",
-      "summary": "Buildchain Stable Self-Dogfood",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Stable Self-Dogfood: owned build self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-dev-delivery",
-      "role": "self",
-      "category": "ops",
-      "purpose": "dev-delivery",
-      "summary": "Buildchain Dev Delivery",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Dev Delivery: owned ops self workflow with one canonical implementation."
-    },
     {
       "id": "buildchain-patrol",
       "role": "public",
@@ -237,83 +149,6 @@
       "invocation": "reusable",
       "rationale": "Buildchain Patrol: owned ops public workflow with one canonical implementation."
     },
-    {
-      "id": "buildchain-patrol-daily",
-      "role": "self",
-      "category": "ops",
-      "purpose": "patrol-daily",
-      "summary": "Buildchain Dogfood Patrol Daily",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Dogfood Patrol Daily: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-patrol-monthly",
-      "role": "self",
-      "category": "ops",
-      "purpose": "patrol-monthly",
-      "summary": "Buildchain Dogfood Patrol Monthly",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Dogfood Patrol Monthly: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-patrol-weekly",
-      "role": "self",
-      "category": "ops",
-      "purpose": "patrol-weekly",
-      "summary": "Buildchain Dogfood Patrol Weekly",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Dogfood Patrol Weekly: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-ref-promotion",
-      "role": "self",
-      "category": "release",
-      "purpose": "promote",
-      "summary": "Buildchain Ref Promotion",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Ref Promotion: owned release self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-ref-promotion-recovery",
-      "role": "self",
-      "category": "ops",
-      "purpose": "promotion-recovery",
-      "summary": "Buildchain Ref Promotion Recovery",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Ref Promotion Recovery: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-stable-candidate-patrol",
-      "role": "self",
-      "category": "ops",
-      "purpose": "stable-candidate-patrol",
-      "summary": "Buildchain Dogfood Stable Candidate Patrol",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Dogfood Stable Candidate Patrol: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "buildchain-stable-candidate-qualification",
-      "role": "self",
-      "category": "build",
-      "purpose": "stable-candidate-qualification",
-      "summary": "Buildchain Stable Candidate Qualification",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Buildchain Stable Candidate Qualification: owned build self workflow with one canonical implementation."
-    },
     {
       "id": "check",
       "role": "public",
@@ -358,17 +193,6 @@
       "invocation": "reusable",
       "rationale": "Dev Delivery Warrant Close: owned ops public workflow with one canonical implementation."
     },
-    {
-      "id": "dev-merge-queue-governance",
-      "role": "self",
-      "category": "ops",
-      "purpose": "merge-queue",
-      "summary": "Dev Merge Queue Governance",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Dev Merge Queue Governance: owned ops self workflow with one canonical implementation."
-    },
     {
       "id": "dev-pr-auto-merge",
       "role": "public",
@@ -402,39 +226,6 @@
       "invocation": "reusable",
       "rationale": "Engineering Housekeeper: owned ops public workflow with one canonical implementation."
     },
-    {
-      "id": "engineering-housekeeper-daily",
-      "role": "self",
-      "category": "ops",
-      "purpose": "housekeeping-daily",
-      "summary": "Engineering Housekeeper Daily",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Engineering Housekeeper Daily: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "engineering-housekeeper-monthly",
-      "role": "self",
-      "category": "ops",
-      "purpose": "housekeeping-monthly",
-      "summary": "Engineering Housekeeper Monthly",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Engineering Housekeeper Monthly: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "engineering-housekeeper-weekly",
-      "role": "self",
-      "category": "ops",
-      "purpose": "housekeeping-weekly",
-      "summary": "Engineering Housekeeper Weekly",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Engineering Housekeeper Weekly: owned ops self workflow with one canonical implementation."
-    },
     {
       "id": "github-artifact-attestation",
       "role": "public",
@@ -446,39 +237,6 @@
       "invocation": "reusable",
       "rationale": "Buildchain GitHub Artifact Attestation: owned release public workflow with one canonical implementation."
     },
-    {
-      "id": "github-governance-audit",
-      "role": "self",
-      "category": "ops",
-      "purpose": "governance-audit",
-      "summary": "GitHub Governance Authority Audit",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "GitHub Governance Authority Audit: owned ops self workflow with one canonical implementation."
-    },
-    {
-      "id": "next-development-review",
-      "role": "self",
-      "category": "release",
-      "purpose": "next-development",
-      "summary": "Next Development Review",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Next Development Review: owned release self workflow with one canonical implementation."
-    },
-    {
-      "id": "npm-publish",
-      "role": "self",
-      "category": "release",
-      "purpose": "npm-dry-run",
-      "summary": "Publish npm package",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Publish npm package: owned release self workflow with one canonical implementation."
-    },
     {
       "id": "paper-release",
       "role": "public",
@@ -567,17 +325,6 @@
       "invocation": "reusable",
       "rationale": "Release Governance Reconcile: owned ops public workflow with one canonical implementation."
     },
-    {
-      "id": "release-line-bootstrap",
-      "role": "self",
-      "category": "release",
-      "purpose": "line-open",
-      "summary": "Release Line Bootstrap",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Release Line Bootstrap: owned release self workflow with one canonical implementation."
-    },
     {
       "id": "release-propagation",
       "role": "public",
@@ -600,17 +347,6 @@
       "invocation": "reusable",
       "rationale": "Declarative Release Tail: owned release public workflow with one canonical implementation."
     },
-    {
-      "id": "self-hosted-runner-smoke",
-      "role": "self",
-      "category": "ops",
-      "purpose": "runner-smoke",
-      "summary": "Self-hosted Runner Smoke",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Self-hosted Runner Smoke: owned ops self workflow with one canonical implementation."
-    },
     {
       "id": "stable-candidate-patrol",
       "role": "public",
@@ -622,17 +358,6 @@
       "invocation": "reusable",
       "rationale": "Buildchain Stable Candidate Patrol: owned ops public workflow with one canonical implementation."
     },
-    {
-      "id": "universal-bootstrap-dogfood",
-      "role": "self",
-      "category": "ops",
-      "purpose": "bootstrap-dogfood",
-      "summary": "Universal Bootstrap Train-First Self-Dogfood",
-      "owner": "kungfu-origin",
-      "status": "active",
-      "invocation": "repository",
-      "rationale": "Universal Bootstrap Train-First Self-Dogfood: owned ops self workflow with one canonical implementation."
-    },
     {
       "id": "v4-adopter-delivery",
       "role": "public",
@@ -645,103 +370,127 @@
       "rationale": "V4 Adopter Delivery: owned build public workflow with one canonical implementation."
     },
     {
-      "id": "v4-adopter-delivery-dogfood",
-      "role": "self",
+      "id": "v4-stage-capsule-canary",
+      "role": "public",
       "category": "build",
-      "purpose": "adopter-dogfood",
-      "summary": "V4 Adopter Delivery Dogfood",
+      "purpose": "stage-capsule-canary",
+      "summary": "V4 Stage Capsule Canary",
       "owner": "kungfu-origin",
       "status": "active",
-      "invocation": "repository",
-      "rationale": "V4 Adopter Delivery Dogfood: owned build self workflow with one canonical implementation."
+      "invocation": "reusable",
+      "rationale": "V4 Stage Capsule Canary: owned build public workflow with one canonical implementation."
     },
     {
-      "id": "v4-declarative-release-tail-dogfood",
-      "role": "self",
+      "id": "v4-tail-reseal",
+      "role": "public",
+      "category": "ops",
+      "purpose": "tail-reseal",
+      "summary": "V4 Retained Candidate Tail Reseal",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "V4 Retained Candidate Tail Reseal: owned ops public workflow with one canonical implementation."
+    },
+    {
+      "id": "oci-compose-preview",
+      "role": "public",
       "category": "release",
-      "purpose": "tail-dogfood",
-      "summary": "V4 Declarative Release Tail Dogfood",
+      "purpose": "oci-compose-preview",
+      "summary": "Buildchain OCI Compose Preview",
       "owner": "kungfu-origin",
       "status": "active",
-      "invocation": "repository",
-      "rationale": "V4 Declarative Release Tail Dogfood: owned release self workflow with one canonical implementation."
+      "invocation": "reusable",
+      "rationale": "Buildchain OCI Compose Preview: owned release public workflow with one canonical implementation."
     },
     {
-      "id": "v4-public-consumer-dogfood",
-      "role": "self",
-      "category": "build",
-      "purpose": "public-consumer-dogfood",
-      "summary": "V4 Public Consumer Dogfood",
+      "id": "pipeline",
+      "role": "public",
+      "category": "ops",
+      "purpose": "pipeline",
+      "summary": "Buildchain pipeline",
       "owner": "kungfu-origin",
       "status": "active",
-      "invocation": "repository",
-      "rationale": "V4 Public Consumer Dogfood: owned build self workflow with one canonical implementation."
+      "invocation": "reusable",
+      "rationale": "Buildchain pipeline: owned normal pipeline and internal credential boundaries."
     },
     {
-      "id": "v4-publication-rehearsal-dogfood",
-      "role": "self",
-      "category": "release",
-      "purpose": "rehearsal-dogfood",
-      "summary": "V4 Publication Rehearsal Dogfood",
+      "id": ".pipeline-delivery",
+      "role": "component",
+      "category": "ops",
+      "purpose": "pipeline-delivery",
+      "summary": "Internal pipeline delivery",
       "owner": "kungfu-origin",
       "status": "active",
-      "invocation": "repository",
-      "rationale": "V4 Publication Rehearsal Dogfood: owned release self workflow with one canonical implementation."
+      "invocation": "reusable",
+      "rationale": "Internal pipeline delivery: owned normal pipeline and internal credential boundaries."
     },
     {
-      "id": "v4-stage-capsule-canary",
-      "role": "public",
-      "category": "build",
-      "purpose": "stage-capsule-canary",
-      "summary": "V4 Stage Capsule Canary",
+      "id": ".pipeline-products",
+      "role": "component",
+      "category": "release",
+      "purpose": "pipeline-products",
+      "summary": "Internal pipeline product publication",
       "owner": "kungfu-origin",
       "status": "active",
       "invocation": "reusable",
-      "rationale": "V4 Stage Capsule Canary: owned build public workflow with one canonical implementation."
+      "rationale": "Separate product execution, qualification/signing, canonical APPLY and protected follow-ups without consumer orchestration."
     },
     {
-      "id": "v4-tail-reseal",
+      "id": "recover",
       "role": "public",
       "category": "ops",
-      "purpose": "tail-reseal",
-      "summary": "V4 Retained Candidate Tail Reseal",
+      "purpose": "recover",
+      "summary": "Buildchain recovery",
       "owner": "kungfu-origin",
       "status": "active",
       "invocation": "reusable",
-      "rationale": "V4 Retained Candidate Tail Reseal: owned ops public workflow with one canonical implementation."
+      "rationale": "Recover one exact attempt with an optional repaired runtime through the same internal product and delivery jobs."
     },
     {
-      "id": "verify",
-      "role": "self",
-      "category": "build",
-      "purpose": "verify",
-      "summary": "Verify",
+      "id": ".pipeline-execute",
+      "role": "component",
+      "category": "ops",
+      "purpose": "pipeline-execute",
+      "summary": "Internal pipeline execution",
       "owner": "kungfu-origin",
       "status": "active",
-      "invocation": "repository",
-      "rationale": "Verify: owned build self workflow with one canonical implementation."
+      "invocation": "reusable",
+      "rationale": "Share credentialless product execution and protected delivery between normal and recovery public entries."
     },
     {
-      "id": "oci-compose-preview",
-      "role": "public",
+      "id": ".pipeline-version",
+      "role": "component",
       "category": "release",
-      "purpose": "oci-compose-preview",
-      "summary": "Buildchain OCI Compose Preview",
+      "purpose": "pipeline-version",
+      "summary": "Internal pipeline version preparation",
       "owner": "kungfu-origin",
       "status": "active",
       "invocation": "reusable",
-      "rationale": "Buildchain OCI Compose Preview: owned release public workflow with one canonical implementation."
+      "rationale": "Regenerate declared version material in credentialless product jobs and independently qualify it before publication or protected next-development Git writes."
     },
     {
-      "id": "channel-verify",
+      "id": "buildchain",
       "role": "self",
-      "category": "build",
-      "purpose": "channel-verify",
-      "summary": "Release - Verify",
+      "category": "ops",
+      "purpose": "pipeline",
+      "summary": "Buildchain pipeline",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "repository",
+      "rationale": "Generated minimal consumer caller; all orchestration belongs to the published runtime.",
+      "path": ".github/workflows/buildchain.yml"
+    },
+    {
+      "id": "buildchain-recover",
+      "role": "self",
+      "category": "ops",
+      "purpose": "recovery",
+      "summary": "Buildchain recovery",
       "owner": "kungfu-origin",
       "status": "active",
       "invocation": "repository",
-      "rationale": "Verify exact release PR lineage without retired prebuild, dependency discovery, version mutation or approval adapters."
+      "rationale": "Generated minimal consumer caller; all orchestration belongs to the published runtime.",
+      "path": ".github/workflows/buildchain-recover.yml"
     }
   ]
 }