@kungfu-tech/buildchain 4.1.3-alpha.1 → 4.1.3-alpha.2

package/docs/node-api-reference.md

@@ -115,7 +115,7 @@ Target: `./packages/core/index.js`. Public symbols: 625.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain";` | `packages/core/contracts/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/governance/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain";` | `packages/core/adoption/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/governance/buildchain-publication-authority.js:65` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/governance/buildchain-publication-authority.js:70` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/governance/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain";` | `packages/core/build/build-facts.js:44` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/governance/issue-reporting.js:199` |
@@ -187,7 +187,7 @@ Target: `./packages/core/index.js`. Public symbols: 625.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain";` | `packages/core/adoption/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain";` | `packages/core/contracts/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain";` | `packages/core/observability/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/governance/buildchain-publication-authority.js:104` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/governance/buildchain-publication-authority.js:109` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain";` | `packages/core/adoption/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain";` | `packages/core/observability/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/observability/cache-evidence.js:169` |
@@ -291,7 +291,7 @@ Target: `./packages/core/index.js`. Public symbols: 625.
 | `evaluateGithubGovernanceSnapshot` | function: function evaluateGithubGovernanceSnapshot({ descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {}) | { descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateGithubGovernanceSnapshot } from "@kungfu-tech/buildchain";` | `packages/core/governance/github-governance-authority.js:695` |
 | `evaluateKfdProductGate` | function: async function evaluateKfdProductGate({ cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateKfdProductGate } from "@kungfu-tech/buildchain";` | `packages/core/adoption/kfd-product-gates.js:419` |
 | `evaluatePublicationControlPlaneSnapshot` | function: function evaluatePublicationControlPlaneSnapshot({ repository, workflowPath, publisherWorkflowPath = workflowPath, environment, branch, packageName, publisherMode = "npm-trusted-publisher", requiredStatusCheck = "check", snapshot, observedAt, expiresAt, } = {}) | { repository, workflowPath, publisherWorkflowPath = workflowPath, environment, branch, packageName, publisherMode = "npm-trusted-publisher", requiredStatusCheck = "check", snapshot, observedAt, expiresAt, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluatePublicationControlPlaneSnapshot } from "@kungfu-tech/buildchain";` | `packages/core/publication/publication-control-plane-audit.js:245` |
-| `executePaperNpmBootstrap` | function: function executePaperNpmBootstrap(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { executePaperNpmBootstrap } from "@kungfu-tech/buildchain";` | `packages/core/paper/operations/bootstrap.js:47` |
+| `executePaperNpmBootstrap` | function: function executePaperNpmBootstrap(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { executePaperNpmBootstrap } from "@kungfu-tech/buildchain";` | `packages/core/paper/operations/bootstrap.js:48` |
 | `executePaperWorkStart` | function: function executePaperWorkStart(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { executePaperWorkStart } from "@kungfu-tech/buildchain";` | `packages/core/paper/paper-work.js:169` |
 | `executePaperWorkSubmitPush` | function: function executePaperWorkSubmitPush(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { executePaperWorkSubmitPush } from "@kungfu-tech/buildchain";` | `packages/core/paper/paper-work.js:357` |
 | `executeReleasePropagationPush` | function: function executeReleasePropagationPush({ work, expectedWorkRoot, cwd = process.cwd(), remote = "origin", } = {}) | { work, expectedWorkRoot, cwd = process.cwd(), remote = "origin", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { executeReleasePropagationPush } from "@kungfu-tech/buildchain";` | `packages/core/release/release-propagation-push.js:231` |
@@ -458,7 +458,7 @@ Target: `./packages/core/index.js`. Public symbols: 625.
 | `PUBLICATION_NPM_PACKAGE_CONTRACT` | constant: const PUBLICATION_NPM_PACKAGE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_NPM_PACKAGE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication/publication-package.js:6` |
 | `PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT` | constant: const PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication/publication-authority.js:22` |
 | `PUBLICATION_QUALIFICATION_SCHEMA` | constant: const PUBLICATION_QUALIFICATION_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_QUALIFICATION_SCHEMA } from "@kungfu-tech/buildchain";` | `packages/core/publication/publication-qualification.js:3` |
-| `PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT` | constant: const PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication/publication-reproducibility.js:11` |
+| `PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT` | constant: const PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication/publication-reproducibility.js:12` |
 | `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication/publication-sealed-bundle.js:11` |
 | `publicationArtifactCandidateDigest` | function: function publicationArtifactCandidateDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { publicationArtifactCandidateDigest } from "@kungfu-tech/buildchain";` | `packages/core/publication/publication-artifact-candidate.js:19` |
 | `publicationAuthorityDigest` | function: function publicationAuthorityDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { publicationAuthorityDigest } from "@kungfu-tech/buildchain";` | `packages/core/publication/publication-authority.js:72` |
@@ -790,7 +790,7 @@ Target: `./packages/core/index.js`. Public symbols: 625.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain/core";` | `packages/core/contracts/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain/core";` | `packages/core/adoption/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/buildchain-publication-authority.js:65` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/buildchain-publication-authority.js:70` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/build/build-facts.js:44` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/issue-reporting.js:199` |
@@ -862,7 +862,7 @@ Target: `./packages/core/index.js`. Public symbols: 625.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/adoption/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain/core";` | `packages/core/contracts/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain/core";` | `packages/core/observability/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/buildchain-publication-authority.js:104` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/buildchain-publication-authority.js:109` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain/core";` | `packages/core/adoption/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain/core";` | `packages/core/observability/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/observability/cache-evidence.js:169` |
@@ -966,7 +966,7 @@ Target: `./packages/core/index.js`. Public symbols: 625.
 | `evaluateGithubGovernanceSnapshot` | function: function evaluateGithubGovernanceSnapshot({ descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {}) | { descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateGithubGovernanceSnapshot } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/github-governance-authority.js:695` |
 | `evaluateKfdProductGate` | function: async function evaluateKfdProductGate({ cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateKfdProductGate } from "@kungfu-tech/buildchain/core";` | `packages/core/adoption/kfd-product-gates.js:419` |
 | `evaluatePublicationControlPlaneSnapshot` | function: function evaluatePublicationControlPlaneSnapshot({ repository, workflowPath, publisherWorkflowPath = workflowPath, environment, branch, packageName, publisherMode = "npm-trusted-publisher", requiredStatusCheck = "check", snapshot, observedAt, expiresAt, } = {}) | { repository, workflowPath, publisherWorkflowPath = workflowPath, environment, branch, packageName, publisherMode = "npm-trusted-publisher", requiredStatusCheck = "check", snapshot, observedAt, expiresAt, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluatePublicationControlPlaneSnapshot } from "@kungfu-tech/buildchain/core";` | `packages/core/publication/publication-control-plane-audit.js:245` |
-| `executePaperNpmBootstrap` | function: function executePaperNpmBootstrap(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { executePaperNpmBootstrap } from "@kungfu-tech/buildchain/core";` | `packages/core/paper/operations/bootstrap.js:47` |
+| `executePaperNpmBootstrap` | function: function executePaperNpmBootstrap(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { executePaperNpmBootstrap } from "@kungfu-tech/buildchain/core";` | `packages/core/paper/operations/bootstrap.js:48` |
 | `executePaperWorkStart` | function: function executePaperWorkStart(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { executePaperWorkStart } from "@kungfu-tech/buildchain/core";` | `packages/core/paper/paper-work.js:169` |
 | `executePaperWorkSubmitPush` | function: function executePaperWorkSubmitPush(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { executePaperWorkSubmitPush } from "@kungfu-tech/buildchain/core";` | `packages/core/paper/paper-work.js:357` |
 | `executeReleasePropagationPush` | function: function executeReleasePropagationPush({ work, expectedWorkRoot, cwd = process.cwd(), remote = "origin", } = {}) | { work, expectedWorkRoot, cwd = process.cwd(), remote = "origin", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { executeReleasePropagationPush } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-propagation-push.js:231` |
@@ -1133,7 +1133,7 @@ Target: `./packages/core/index.js`. Public symbols: 625.
 | `PUBLICATION_NPM_PACKAGE_CONTRACT` | constant: const PUBLICATION_NPM_PACKAGE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_NPM_PACKAGE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication/publication-package.js:6` |
 | `PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT` | constant: const PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication/publication-authority.js:22` |
 | `PUBLICATION_QUALIFICATION_SCHEMA` | constant: const PUBLICATION_QUALIFICATION_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_QUALIFICATION_SCHEMA } from "@kungfu-tech/buildchain/core";` | `packages/core/publication/publication-qualification.js:3` |
-| `PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT` | constant: const PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication/publication-reproducibility.js:11` |
+| `PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT` | constant: const PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication/publication-reproducibility.js:12` |
 | `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication/publication-sealed-bundle.js:11` |
 | `publicationArtifactCandidateDigest` | function: function publicationArtifactCandidateDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { publicationArtifactCandidateDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/publication/publication-artifact-candidate.js:19` |
 | `publicationAuthorityDigest` | function: function publicationAuthorityDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { publicationAuthorityDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/publication/publication-authority.js:72` |
@@ -2133,7 +2133,7 @@ Target: `./packages/core/publication/publication-reproducibility.js`. Public sym
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT` | constant: const PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain/publication-reproducibility";` | `packages/core/publication/publication-reproducibility.js:11` |
+| `PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT` | constant: const PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain/publication-reproducibility";` | `packages/core/publication/publication-reproducibility.js:12` |
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, toolchain: selectedToolchain, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, toolchain: selectedToolchain, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain/publication-reproducibility";` | `packages/core/publication/publication-reproducibility.js:868` |
 
 ## `@kungfu-tech/buildchain/publication-sealed-bundle`
@@ -2204,8 +2204,8 @@ Target: `./packages/core/governance/buildchain-publication-authority.js`. Public
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/governance/buildchain-publication-authority.js:65` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/governance/buildchain-publication-authority.js:104` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/governance/buildchain-publication-authority.js:70` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/governance/buildchain-publication-authority.js:109` |
 
 ## `@kungfu-tech/buildchain/github-governance-authority`
 

package/docs/runtime-entry.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-11
+last_reviewed: 2026-09-13
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-11
-  visible_context: Explicit user-approved runtime selection, recovery and alpha publication requirements.
+  generated_at: 2026-09-13
+  visible_context: Source-bound attempt recovery implementation, published entry contract and local failure-path tests.
   invisible_context_boundary: This contract does not claim implementation or hosted qualification is complete.
 ---
 
@@ -40,7 +40,9 @@ Switching runtimes does not automatically qualify all previous results for reuse
 Neither the persisted caller nor its contract lock needs a train rewrite.
 
 An entry failure is repaired by publishing and adopting a corrected entry and
-starting a complete run. Recovering an invalid entry is not a runtime feature.
+starting a new provider run through the corrected floating entry. The caller files
+remain unchanged. A usable recovery entry can still recover the exact existing
+attempt; an entry failure before admission has no attempt to recover.
 Buildchain self-dogfood uses exactly the same consumer contract and has no
 repository-specific execution or recovery route.
 
@@ -54,7 +56,45 @@ single preparation ownership, different entry/runtime execution, train recovery,
 platform and multi-job qualification, and validation of the published consumer
 entry. A source test or a successful package import alone is insufficient.
 
-## Consumer build and recovery
+## Minimal pipeline recovery
+
+The minimal contract has one normal event caller and one manual recovery caller,
+plus `.buildchain/buildchain.toml`. Both callers are maintained by Buildchain's
+consumer setup; product differences do not require additional recovery workflows.
+The repository implementation alone does not prove the entry has been published
+or qualified in a clean consumer.
+
+The workflow summary identifies the current attempt, its source PR, completed
+steps and remaining work. Follow **Recover this attempt**, choose **Run workflow**,
+and paste the exact attempt. Leave `runtime-ref` empty for an ordinary retry;
+supply a repaired runtime only when needed. The public recovery entry accepts no
+other recovery selectors. It derives configuration, producer runs, artifacts and
+transaction coordinates from the canonical attempt history.
+
+Recovery opens a new attempt with an explicit predecessor. Successful platform
+jobs and their actual retained artifacts are independently requalified; only
+missing platforms or explicitly incompatible stage implementations are rebuilt.
+A signing failure can requalify the original sealed bytes under the repaired
+publisher. Partial publication preserves its original signed transaction and
+completed effects, reads providers again, and authorizes only remaining effects.
+Missing, expired or conflicting evidence stops with a diagnosis; it does not
+silently trigger a complete rebuild or replace published bytes.
+
+A repeated request for the same predecessor and repair selects the same successor.
+If that recovery was interrupted, select the successor shown in the summary for
+the next recovery. An active predecessor must first finish or be cancelled using
+its ordinary GitHub execution link. A changed or superseded source cannot reuse
+an old attempt as authority for the current PR. Completed publication remains
+recorded even when distribution or the next development version still needs work.
+Cancellation stops remaining work and cannot undo published results.
+
+Once admitted, ordinary wake events continue with the recovered attempt's exact
+runtime, even when the consumer lock still names the original runtime. A further
+runtime change requires another explicit recovery. An entry repair is distributed
+through the existing `@v4` or `@v4-alpha` entry; consumers do not maintain backup
+scripts, patch a job definition, or add a different recovery workflow family.
+
+## Advanced build component recovery
 
 ```yaml
 on:

package/docs/workflow-catalog.md

@@ -47,6 +47,8 @@ Register ownership before adding a workflow. `pnpm run check:workflows` validate
 | [public-ops-patrol-monthly.yml](../.github/workflows/public-ops-patrol-monthly.yml) | ops | reusable | active | Buildchain Patrol Monthly |
 | [public-ops-patrol-weekly.yml](../.github/workflows/public-ops-patrol-weekly.yml) | ops | reusable | active | Buildchain Patrol Weekly |
 | [public-ops-patrol.yml](../.github/workflows/public-ops-patrol.yml) | ops | reusable | active | Buildchain Patrol |
+| [public-ops-pipeline.yml](../.github/workflows/public-ops-pipeline.yml) | ops | reusable | active | Buildchain pipeline |
+| [public-ops-recover.yml](../.github/workflows/public-ops-recover.yml) | ops | reusable | active | Buildchain recovery |
 | [public-ops-release-governance.yml](../.github/workflows/public-ops-release-governance.yml) | ops | reusable | active | Release Governance Reconcile |
 | [public-ops-stable-candidate-patrol.yml](../.github/workflows/public-ops-stable-candidate-patrol.yml) | ops | reusable | active | Buildchain Stable Candidate Patrol |
 | [public-ops-tail-reseal.yml](../.github/workflows/public-ops-tail-reseal.yml) | ops | reusable | active | V4 Retained Candidate Tail Reseal |
@@ -69,8 +71,11 @@ Register ownership before adding a workflow. `pnpm run check:workflows` validate
 | [.build-gate-profile.yml](../.github/workflows/.build-gate-profile.yml) | build | reusable | active | Buildchain Shifu Gate Profile |
 | [.build.yml](../.github/workflows/.build.yml) | build | reusable | active | Buildchain Build |
 | [.ops-git-sync.yml](../.github/workflows/.ops-git-sync.yml) | ops | reusable | active | sync remote git |
+| [.ops-pipeline-delivery.yml](../.github/workflows/.ops-pipeline-delivery.yml) | ops | reusable | active | Internal pipeline delivery |
+| [.ops-pipeline-execute.yml](../.github/workflows/.ops-pipeline-execute.yml) | ops | reusable | active | Internal pipeline execution |
 | [.release-authority.yml](../.github/workflows/.release-authority.yml) | release | reusable | active | Buildchain Sealed Publication Authority |
 | [.release-binary-assets.yml](../.github/workflows/.release-binary-assets.yml) | release | reusable | active | Buildchain Binary Release Assets |
+| [.release-pipeline-products.yml](../.github/workflows/.release-pipeline-products.yml) | release | reusable | active | Internal pipeline product publication |
 | [.release-promote.yml](../.github/workflows/.release-promote.yml) | release | reusable | active | Release Candidate Promote Advanced |
 
 ## self

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.1.3-alpha.1",
+  "version": "4.1.3-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -157,7 +157,7 @@
   "scripts": {
     "precheck:static": "prettier --check architecture/decisions/0003-two-phase-delivery-warrant.md architecture/delivery-authority-parity.json contracts/dev-delivery-authority-v2.schema.json dist/site/schemas/dev-delivery-authority-v2.schema.json docs/dev-delivery-qualification-landing-adr.md packages/core/dev-delivery/dev-delivery-authority-candidate.js packages/core/dev-delivery/dev-delivery-authority-evidence.js packages/core/dev-delivery/dev-delivery-authority-landing.js packages/core/dev-delivery/dev-delivery-authority-observation.js packages/core/dev-delivery/dev-delivery-authority-qualification.js packages/core/dev-delivery/dev-delivery-authority-settlement.js packages/core/dev-delivery/dev-delivery-authority-state.js packages/core/dev-delivery/dev-delivery-execution-failure.js packages/core/dev-delivery/dev-delivery-execution-transfer.js packages/core/dev-delivery/dev-delivery-landing-readback.js packages/core/dev-delivery/dev-delivery-landing-terminal-evidence.js packages/core/dev-delivery/dev-delivery-landing-testing-port.js packages/core/dev-delivery/dev-delivery-native-execution.js packages/core/dev-delivery/dev-delivery-native-proof.js packages/core/dev-delivery/dev-delivery-process-boundary.js packages/core/dev-delivery/dev-delivery-warrant-qualification.js packages/core/dev-delivery/dev-delivery-warrant-state.js packages/core/dev-delivery/commands/dev-delivery-authority-command-adapters.mjs packages/core/dev-delivery/commands/dev-delivery-authority-provider.mjs packages/core/dev-delivery/commands/dev-delivery-authority.mjs packages/core/dev-delivery/native/execution.js packages/core/dev-delivery/commands/dev-delivery-process-boundary.mjs packages/core/dev-delivery/native/transactions.js packages/core/dev-delivery/commands/dev-delivery-two-phase.mjs packages/core/dev-delivery/commands/dev-delivery-warrant-options.mjs packages/core/dev-delivery/warrant/persistence.js templates/native-dev-delivery.yml",
     "operator:windows-jit": "bash packages/core/providers/commands/aws-windows-jit-operator.sh",
-    "check": "pnpm run check:discussion-reader && pnpm run check:layout && node scripts/check-runtime-entry.mjs && pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node packages/core/governance/commands/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
+    "check": "pnpm run check:consumer-contract && pnpm run check:discussion-reader && pnpm run check:layout && node scripts/check-runtime-entry.mjs && pnpm run check:implementation-naming && pnpm run check:static && node scripts/check-ci-lane-change-budget.mjs && node scripts/check-public-dogfood-contract.mjs && node scripts/check-floating-consumer-policy-contract.mjs && node scripts/check-release-topology.mjs && node scripts/check-universal-workflow-bootstrap.mjs && pnpm run check:bridge && pnpm run check:contracts:rust && pnpm run check:wasm && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/generate-agent-change-map.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-runtime-semantic-closure.mjs && node scripts/check-capability-parity-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/publication-rehearsal-fixture.mjs --check && node packages/core/governance/commands/architecture.mjs validate && node scripts/warrant-shadow-plan.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && node scripts/check-source-bindings.mjs && prettier --check architecture/*.json contracts/release-tail-provider-bindings-v1.schema.json contracts/v4-canonical-contracts-v1.schema.json contracts/v4-compatibility-facts-v1.schema.json contracts/v4-delivery-warrant-semantic-diff-report-v1.schema.json contracts/v4-delivery-warrant-trace-v1.schema.json contracts/v4-floating-consumer-policy-receipt-v1.schema.json contracts/runtime-resume-lineage-v2.schema.json contracts/v4-tail-reseal-v1.schema.json contracts/v4-host-contract-v1.schema.json contracts/v4-provider-operation-journal-v1.schema.json contracts/v4-release-activation-shadow-v1.schema.json contracts/v4-stable-publication-fence-v1.schema.json contracts/v4-partial-mutation-recovery-v1.schema.json contracts/v4-stage-capsule-v1.schema.json contracts/v4-stage-capsule-store-v1.schema.json contracts/v4-stage-capsule-resume-v1.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json contracts/fixtures/v4-delivery-warrant-trace-v1/*.json contracts/fixtures/v4-floating-consumer-policy-v1/*.json contracts/fixtures/runtime-resume-lineage-v2/*.json contracts/fixtures/v4-tail-reseal-v1/*.json contracts/fixtures/v4-compatibility-facts-v1/*.json contracts/fixtures/v4-provider-operation-journal-v1/*.json contracts/fixtures/v4-provider-readback-idempotency-v1/*.json contracts/fixtures/v4-release-activation-shadow-v1/*.json contracts/fixtures/v4-stable-publication-fence-v1/*.json contracts/fixtures/v4-partial-mutation-recovery-v1/*.json contracts/fixtures/v4-stage-capsule-v1/*.json contracts/fixtures/v4-stage-capsule-store-v1/*.json contracts/fixtures/v4-stage-capsule-resume-v1/*.json packages/core/contracts/command-registry.mjs packages/core/governance/cli/compatibility-facts.mjs packages/core/contracts/canonical-contracts.js packages/core/contracts/kungfu-temporal-fact.js packages/core/governance/buildchain-compatibility-fact.js packages/core/governance/buildchain-compatibility-authority.js packages/core/governance/buildchain-compatibility-proof.js packages/core/consumer/floating-consumer-evidence.js packages/core/consumer/floating-consumer-policy.js packages/core/consumer/floating-consumer-release-passport.js packages/core/release/recovery/lineage.js packages/core/release/tail-reseal-contract.js packages/core/release/tail-reseal-github.js packages/core/release/tail-reseal-receipt.js packages/core/release/tail-reseal.js packages/core/consumer/runtime-selector-persistence.js packages/core/release/provider-operation-journal.js packages/core/release/provider-readback-idempotency.js packages/core/release/release-activation-shadow.js packages/core/release/stable-publication-fence.js packages/core/release/partial-mutation-recovery-qualification.js packages/core/build/stage-capsule.js packages/core/build/stage-capsule-store.js packages/core/build/stage-capsule-local-store.js packages/core/build/platform-stage-checkpoints.js packages/core/build/stage-capsule-resume-planner.js packages/core/build/stage-capsule-qualification.js packages/core/build/stage-capsule-qualification-campaign.js packages/core/dev-delivery/delivery-warrant-fixture-runner.js packages/core/dev-delivery/delivery-warrant-read-candidate.js packages/core/dev-delivery/delivery-warrant-semantic-diff-gate.js packages/core/dev-delivery/delivery-warrant-shadow-adapter.js scripts/check-core-mechanism-inventory.mjs scripts/check-runtime-semantic-closure.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs packages/core/dev-delivery/commands/dev-pr-prequeue-guard.mjs scripts/check-public-dogfood-contract.mjs scripts/maintainability-metrics.mjs scripts/maintainability-domain-metrics.mjs scripts/maintainability-governance.mjs scripts/generate-agent-change-map.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs packages/core/governance/commands/architecture.mjs packages/core/runtime/commands/bridge-bootstrap.mjs scripts/bridge-evidence.mjs packages/core/consumer/commands/consumer-policy.mjs packages/core/runtime/commands/host-adapter.mjs scripts/platform-stage-checkpoint-rehearsal.mjs scripts/stage-capsule-resume-rehearsal.mjs packages/core/build/commands/stage-capsule-qualification.mjs scripts/tail-reseal-macos-rehearsal.mjs packages/core/release/commands/tail-reseal.mjs scripts/warrant-shadow-plan.mjs scripts/verify-golden-path.mjs tests/runtime-entry-provider.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/maintainability-governance.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/architecture.test.mjs tests/bridge.test.mjs tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-resume-lineage.test.mjs tests/runtime-semantic-closure.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs tests/warrant-shadow-plan.test.mjs",
     "check:bridge": "cargo fmt --manifest-path crates/buildchain-host-bridge/Cargo.toml -- --check && cargo clippy --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml -- -D warnings && cargo test --locked --manifest-path crates/buildchain-host-bridge/Cargo.toml",
     "check:contracts": "pnpm run check:contracts:rust && node --test tests/canonical-contracts.test.mjs tests/delivery-warrant-fixture-runner.test.mjs tests/delivery-warrant-read-candidate.test.mjs tests/domain-wasm.test.mjs tests/floating-consumer-policy-contract.test.mjs tests/floating-consumer-policy.test.mjs tests/runtime-resume-lineage.test.mjs tests/tail-reseal.test.mjs tests/tail-reseal-parity.test.mjs tests/compatibility-facts.test.mjs tests/publication-rehearsal.test.mjs tests/platform-stage-checkpoints.test.mjs tests/provider-operation-journal.test.mjs tests/provider-readback-idempotency.test.mjs tests/public-dogfood-contract.test.mjs tests/release-activation-shadow.test.mjs tests/stable-publication-fence.test.mjs tests/partial-mutation-recovery-qualification.test.mjs tests/stage-capsule.test.mjs tests/stage-capsule-store.test.mjs tests/stage-capsule-resume-planner.test.mjs tests/stage-capsule-qualification.test.mjs",
@@ -184,7 +184,8 @@
     "check:implementation-naming": "node scripts/check-implementation-naming.mjs",
     "check:layout": "node scripts/check-code-layout.mjs",
     "build:discussion-reader": "node scripts/build-release-discussion-reader.mjs",
-    "check:discussion-reader": "node scripts/build-release-discussion-reader.mjs --check"
+    "check:discussion-reader": "node scripts/build-release-discussion-reader.mjs --check",
+    "check:consumer-contract": "node scripts/generate-minimal-consumer-contract.mjs --check"
   },
   "devDependencies": {
     "@actions/expressions": "0.3.61",

package/packages/core/consumer/contract/entries.js

@@ -0,0 +1,85 @@
+import { choice, object, relativePath, text } from "./shape.js";
+import { CONFIG_PATH } from "./plan.js";
+
+export const PIPELINE_ENTRY = ".github/workflows/public-ops-pipeline.yml";
+export const RECOVERY_ENTRY = ".github/workflows/public-ops-recover.yml";
+export const PIPELINE_EVENTS = {
+  pull_request: [
+    "opened",
+    "reopened",
+    "synchronize",
+    "ready_for_review",
+    "converted_to_draft",
+    "closed",
+    "labeled",
+    "unlabeled",
+    "edited",
+    "enqueued",
+    "dequeued",
+  ],
+  pull_request_review: ["submitted", "dismissed"],
+  pull_request_target: ["closed"],
+  merge_group: ["checks_requested"],
+  push: [],
+  repository_dispatch: ["buildchain-attempt-wake"],
+};
+
+export function normalInputs(value = {}) {
+  object(value, [], ["config-path"], "inputs");
+  const configPath = relativePath(
+    value["config-path"] ?? CONFIG_PATH,
+    "inputs.config-path",
+  );
+  if (!configPath.endsWith(".toml") || configPath.includes("*"))
+    throw new Error("inputs.config-path: expected one TOML path");
+  return { configPath };
+}
+
+export function recoveryInputs(value) {
+  object(value, ["attempt"], ["runtime-ref"], "inputs");
+  text(value.attempt, "inputs.attempt", /^attempt-[0-9a-f]{64}$/u);
+  const runtimeRef = value["runtime-ref"] ?? "";
+  if (runtimeRef !== "")
+    text(
+      runtimeRef,
+      "inputs.runtime-ref",
+      /^(?:[0-9a-f]{40}|v4(?:-alpha)?|train\/v4\/v4\.[0-9]+\/[a-z0-9][a-z0-9-]*)$/u,
+    );
+  return { attempt: value.attempt, runtimeRef };
+}
+
+export function admitEvent(name, action = "") {
+  choice(name, Object.keys(PIPELINE_EVENTS), "event.name");
+  choice(
+    action,
+    PIPELINE_EVENTS[name].length ? PIPELINE_EVENTS[name] : [""],
+    "event.action",
+  );
+  return { name, action };
+}
+
+function call(entry, channel, extra = "") {
+  return `permissions:\n  contents: read\njobs:\n  buildchain:\n    uses: kungfu-systems/buildchain/${entry}@${channel}\n${extra}    secrets: inherit\n    permissions:\n      actions: write\n      attestations: write\n      checks: write\n      contents: write\n      discussions: write\n      id-token: write\n      pull-requests: write\n      statuses: write\n`;
+}
+
+// Product-independent source of the two caller bytes. Public entry publication
+// is qualified separately; rendering this contract is not an execution receipt.
+export function consumerWorkflows(channel = "v4", configPath = CONFIG_PATH) {
+  choice(channel, ["v4", "v4-alpha"], "entry.channel");
+  normalInputs({ "config-path": configPath });
+  const configInput =
+    configPath === CONFIG_PATH
+      ? ""
+      : `    with:\n      config-path: ${configPath}\n`;
+  const events = Object.entries(PIPELINE_EVENTS)
+    .map(([name, types]) => {
+      return types.length
+        ? `  ${name}:\n    types: [${types.join(", ")}]\n`
+        : `  ${name}:\n`;
+    })
+    .join("");
+  return {
+    ".github/workflows/buildchain.yml": `name: Buildchain pipeline\non:\n${events}${call(PIPELINE_ENTRY, channel, configInput)}`,
+    ".github/workflows/buildchain-recover.yml": `name: Buildchain recovery\non:\n  workflow_dispatch:\n    inputs:\n      attempt:\n        description: Exact Buildchain attempt to recover\n        required: true\n        type: string\n      runtime-ref:\n        description: Optional repaired runtime\n        required: false\n        type: string\n${call(RECOVERY_ENTRY, channel, "    with:\n      attempt: ${{ inputs.attempt }}\n      runtime-ref: ${{ inputs.runtime-ref }}\n")}`,
+  };
+}

package/packages/core/consumer/contract/examples.js

@@ -0,0 +1,96 @@
+import { choice } from "./shape.js";
+import { consumerWorkflows } from "./entries.js";
+import { CONFIG_PATH } from "./plan.js";
+import { PRODUCT_TYPES } from "./products.js";
+
+const ARTIFACTS = {
+  npm: { path: "dist/package", kind: "npm-package", provider: "npm" },
+  binary: {
+    path: "dist/hello.tar.gz",
+    kind: "archive",
+    provider: "github-release",
+  },
+  paper: { path: "dist/paper.pdf", kind: "pdf", provider: "github-release" },
+};
+
+function productSource(type) {
+  const prefix =
+    'import fs from "node:fs";\nfs.mkdirSync("dist", { recursive: true });\n';
+  if (type === "npm")
+    return `${prefix}fs.mkdirSync("dist/package", { recursive: true });\nfs.writeFileSync("dist/package/index.js", 'export const hello = "hello";\\n');\nfs.writeFileSync("dist/package/package.json", JSON.stringify({ name: "@example/minimal", version: JSON.parse(fs.readFileSync("package.json")).version, type: "module", exports: "./index.js" }));\n`;
+  if (type === "binary")
+    return `${prefix}import { execFileSync } from "node:child_process";\nexecFileSync("cc", ["src/hello.c", "-o", "dist/hello"], { stdio: "inherit" });\nexecFileSync("tar", ["-czf", "dist/hello.tar.gz", "-C", "dist", "hello"], { stdio: "inherit" });\n`;
+  return `${prefix}const stream = "BT /F1 24 Tf 50 700 Td (Minimal Paper) Tj ET";
+const objects = ["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [3 0 R] /Count 1 >>", "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Resources << /Font << /F1 4 0 R >> >> /Contents 5 0 R >>", "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>", \`<< /Length \${stream.length} >>\\nstream\\n\${stream}\\nendstream\`];
+let pdf = "%PDF-1.4\\n";
+const offsets = [0];
+for (const [index, object] of objects.entries()) { offsets.push(Buffer.byteLength(pdf)); pdf += \`\${index + 1} 0 obj\\n\${object}\\nendobj\\n\`; }
+const xref = Buffer.byteLength(pdf);
+pdf += \`xref\\n0 \${offsets.length}\\n0000000000 65535 f \\n\`;
+for (const offset of offsets.slice(1)) pdf += \`\${String(offset).padStart(10, "0")} 00000 n \\n\`;
+pdf += \`trailer\\n<< /Size \${offsets.length} /Root 1 0 R >>\\nstartxref\\n\${xref}\\n%%EOF\\n\`;
+fs.writeFileSync("dist/paper.pdf", pdf);
+`;
+}
+
+export function standardConsumerExample(type, channel = "v4") {
+  choice(type, PRODUCT_TYPES, "product.type");
+  const artifact = ARTIFACTS[type];
+  const npmAccess = type === "npm" ? 'access = "public"\n' : "";
+  const files = {
+    ...consumerWorkflows(channel),
+    "package.json": `${JSON.stringify({ name: `minimal-${type}`, private: true, version: "1.0.0-alpha.1", type: "module" }, null, 2)}\n`,
+    "src/build.mjs": productSource(type),
+    "src/verify.mjs": `import assert from "node:assert/strict";\nimport fs from "node:fs";\nassert.ok(fs.statSync(${JSON.stringify(artifact.path)}).${type === "npm" ? "isDirectory()" : "size > 0"});\n`,
+    [CONFIG_PATH]: `schema = 2
+
+[[products]]
+id = "main"
+type = "${type}"
+platforms = ["linux-x64"]
+build = ["node src/build.mjs"]
+verify = ["node src/verify.mjs"]
+
+[[products.artifacts]]
+id = "main"
+path = "${artifact.path}"
+kind = "${artifact.kind}"
+
+[[products.targets]]
+provider = "${artifact.provider}"
+artifacts = ["main"]
+${npmAccess}
+[version]
+strategy = "semver"
+
+[[version.files]]
+path = "package.json"
+format = "json"
+key = "version"
+
+[[channels]]
+from = "feature/*"
+to = "dev/v1/v1.0"
+operation = "develop"
+
+[[channels]]
+from = "dev/v1/v1.0"
+to = "alpha/v1/v1.0"
+operation = "alpha"
+
+[[channels]]
+from = "alpha/v1/v1.0"
+to = "release/v1/v1.0"
+operation = "stable"
+
+[review]
+minimum_approvals = 1
+code_owners = true
+merge_queue = true
+`,
+  };
+  if (type === "binary")
+    files["src/hello.c"] =
+      '#include <stdio.h>\nint main(void) { puts("hello"); return 0; }\n';
+  return files;
+}

package/packages/core/consumer/contract/identity.js

@@ -0,0 +1,65 @@
+import { createHash } from "node:crypto";
+import { object, relativePath, text } from "./shape.js";
+import { compileConsumerPlan, CONSUMER_CONTRACT } from "./plan.js";
+
+export function contentDigest(bytes) {
+  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+
+// Source identities are prepared from trusted GitHub readback, never caller inputs.
+export function bindConsumerSource(source, configBytes) {
+  object(
+    source,
+    ["repository", "commit", "tree", "configPath", "configBlob"],
+    [],
+    "source",
+  );
+  text(
+    source.repository,
+    "source.repository",
+    /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u,
+  );
+  for (const key of ["commit", "tree", "configBlob"])
+    text(source[key], `source.${key}`, /^[0-9a-f]{40}$/u);
+  relativePath(source.configPath, "source.configPath");
+  const bytes = Buffer.from(configBytes);
+  const blob = createHash("sha1")
+    .update(`blob ${bytes.length}\0`)
+    .update(bytes)
+    .digest("hex");
+  if (blob !== source.configBlob)
+    throw new Error("source.configBlob: config bytes do not match Git blob");
+  const plan = compileConsumerPlan(bytes.toString("utf8"));
+  const identity = {
+    schema: "buildchain.consumer-source/v1",
+    repository: source.repository,
+    commit: source.commit,
+    tree: source.tree,
+    configPath: source.configPath,
+    configBlob: blob,
+    configDigest: contentDigest(bytes),
+    contract: CONSUMER_CONTRACT,
+  };
+  return {
+    identity,
+    identityDigest: contentDigest(JSON.stringify(identity)),
+    plan,
+  };
+}
+
+export function consumerContractLock({ entry, runtime, configDigest }) {
+  for (const [name, value] of Object.entries({ entry, runtime })) {
+    object(value, ["repository", "sha"], [], name);
+    if (value.repository !== "kungfu-systems/buildchain")
+      throw new Error(`${name}: untrusted Buildchain repository`);
+    text(value.sha, `${name}.sha`, /^[0-9a-f]{40}$/u);
+  }
+  text(configDigest, "configDigest", /^sha256:[0-9a-f]{64}$/u);
+  return {
+    schema: "buildchain.consumer-contract-lock/v2",
+    contract: CONSUMER_CONTRACT,
+    entry: { ...entry },
+    runtime: { ...runtime },
+    configDigest,
+  };
+}

package/packages/core/consumer/contract/inspection.js

@@ -0,0 +1,45 @@
+import { consumerWorkflows } from "./entries.js";
+import { compileConsumerPlan, CONFIG_PATH } from "./plan.js";
+
+const INTERNAL_WIRING = [
+  /\b(?:request-json|native-roots-json|used-nonces-json|warrant-result|source-proof|integration-proof)\b/iu,
+  /\bbuildchain\s+(?:dev\s+(?:warrant|proof)|release|promote|recover|publish)\b/iu,
+  /\b(?:npm\s+publish|gh\s+release\s+(?:create|upload)|gh\s+run\s+download)\b/iu,
+  /actions\/download-artifact@/u,
+  /\.buildchain\/runtime\/|packages\/core\/(?:publication|release|dev-delivery)\//u,
+  /\b(?:fencingToken|candidateRoot|sourceProofRoot|usedNonces|generationRoot|compareAndSwap)\b/u,
+  /buildchain[-./][\w-]*(?:warrant|proof|fence|nonce|candidate|authority|transaction)/iu,
+];
+
+// The supplied file map must be the complete tracked consumer tree, including
+// package scripts and the source files they invoke. Runtime source is never run.
+export function inspectConsumerContract(
+  files,
+  { channel = "v4", configPath = CONFIG_PATH } = {},
+) {
+  const issues = [];
+  let plan;
+  try {
+    plan = compileConsumerPlan(files[configPath]);
+  } catch (error) {
+    issues.push(`${configPath}: ${error.message}`);
+  }
+  const workflows = consumerWorkflows(channel, configPath);
+  for (const [file, expected] of Object.entries(workflows))
+    if (files[file] !== expected)
+      issues.push(`${file}: must match the generated thin caller`);
+  for (const [file, source] of Object.entries(files)) {
+    if (
+      /^\.github\/workflows\/.*\.ya?ml$/u.test(file) &&
+      !Object.hasOwn(workflows, file)
+    )
+      issues.push(`${file}: extra consumer workflow is forbidden`);
+    if (!/\.(?:toml|json|ya?ml|[cm]?js|ts|py|sh|ps1|rb)$/u.test(file)) continue;
+    for (const pattern of INTERNAL_WIRING)
+      if (pattern.test(String(source)))
+        issues.push(
+          `${file}: consumer owns internal orchestration (${pattern.source})`,
+        );
+  }
+  return { ok: issues.length === 0, issues, plan };
+}