@kungfu-tech/buildchain 4.1.3-alpha.1 → 4.1.3-alpha.3

package/architecture/ci-lane-change-budget.json

@@ -2563,6 +2563,380 @@
         "expectedContributionSeconds": 0,
         "rationale": "Current 4.1 capability node. Budget uses the declared job timeout or the conservative six-hour provider ceiling; it is not a measured latency or a new claim of required-check authority."
       }
+    },
+    {
+      "laneId": ".github/workflows/.ops-pipeline-delivery.yml#delivery",
+      "authorityClass": "merge-critical-admission",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 360,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": true,
+        "metric": "minimal pipeline bounded hosted execution",
+        "expectedContributionSeconds": 21600,
+        "rationale": "Owned runtime, metadata or product job boundary. Product matrix uses only declared platforms; native Warrant transfer waits for exact provider terminality. This is a conservative timeout budget, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/public-ops-pipeline.yml#runtime",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 5,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "minimal pipeline bounded hosted execution",
+        "expectedContributionSeconds": 300,
+        "rationale": "Owned runtime, metadata or product job boundary. Product matrix uses only declared platforms; native Warrant transfer waits for exact provider terminality. This is a conservative timeout budget, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/public-ops-pipeline.yml#control",
+      "authorityClass": "merge-critical-admission",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 20,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": true,
+        "metric": "minimal pipeline bounded hosted execution",
+        "expectedContributionSeconds": 1200,
+        "rationale": "Owned runtime, metadata or product job boundary. Product matrix uses only declared platforms; native Warrant transfer waits for exact provider terminality. This is a conservative timeout budget, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.ops-pipeline-execute.yml#build",
+      "authorityClass": "merge-critical-required",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 60,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": true,
+        "metric": "minimal pipeline bounded hosted execution",
+        "expectedContributionSeconds": 3600,
+        "rationale": "Owned runtime, metadata or product job boundary. Product matrix uses only declared platforms; native Warrant transfer waits for exact provider terminality. This is a conservative timeout budget, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.ops-pipeline-execute.yml#record-build",
+      "authorityClass": "merge-critical-required",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 15,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": true,
+        "metric": "minimal pipeline bounded hosted execution",
+        "expectedContributionSeconds": 900,
+        "rationale": "Owned runtime, metadata or product job boundary. Product matrix uses only declared platforms; native Warrant transfer waits for exact provider terminality. This is a conservative timeout budget, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.ops-pipeline-execute.yml#delivery",
+      "authorityClass": "merge-critical-admission",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 360,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": true,
+        "metric": "minimal pipeline bounded hosted execution",
+        "expectedContributionSeconds": 21600,
+        "rationale": "Owned runtime, metadata or product job boundary. Product matrix uses only declared platforms; native Warrant transfer waits for exact provider terminality. This is a conservative timeout budget, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.ops-pipeline-execute.yml#record-delivery",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 5,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "minimal pipeline bounded hosted execution",
+        "expectedContributionSeconds": 300,
+        "rationale": "Owned runtime, metadata or product job boundary. Product matrix uses only declared platforms; native Warrant transfer waits for exact provider terminality. This is a conservative timeout budget, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.release-pipeline-products.yml#prepare",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "ref-scoped",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 15,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "declared product publication and retained follow-ups",
+        "expectedContributionSeconds": 900,
+        "rationale": "Post-merge product publication serializes provider writers per repository. At most five declared hosted platforms each have a sixty-minute build limit; independent signing and publisher jobs have explicit timeouts. These are conservative bounds, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.release-pipeline-products.yml#build",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "ref-scoped",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 300,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "declared product publication and retained follow-ups",
+        "expectedContributionSeconds": 18000,
+        "rationale": "Post-merge product publication serializes provider writers per repository. At most five declared hosted platforms each have a sixty-minute build limit; independent signing and publisher jobs have explicit timeouts. These are conservative bounds, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.release-pipeline-products.yml#qualify",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "ref-scoped",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 20,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "declared product publication and retained follow-ups",
+        "expectedContributionSeconds": 1200,
+        "rationale": "Post-merge product publication serializes provider writers per repository. At most five declared hosted platforms each have a sixty-minute build limit; independent signing and publisher jobs have explicit timeouts. These are conservative bounds, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.release-pipeline-products.yml#apply",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "ref-scoped",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 30,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "declared product publication and retained follow-ups",
+        "expectedContributionSeconds": 1800,
+        "rationale": "Post-merge product publication serializes provider writers per repository. At most five declared hosted platforms each have a sixty-minute build limit; independent signing and publisher jobs have explicit timeouts. These are conservative bounds, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.release-pipeline-products.yml#settle",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "ref-scoped",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 20,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "declared product publication and retained follow-ups",
+        "expectedContributionSeconds": 1200,
+        "rationale": "Post-merge product publication serializes provider writers per repository. At most five declared hosted platforms each have a sixty-minute build limit; independent signing and publisher jobs have explicit timeouts. These are conservative bounds, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.ops-pipeline-execute.yml#publication",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 385,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "declared product publication and retained follow-ups",
+        "expectedContributionSeconds": 23100,
+        "rationale": "Post-merge product publication serializes provider writers per repository. At most five declared hosted platforms each have a sixty-minute build limit; independent signing and publisher jobs have explicit timeouts. These are conservative bounds, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/public-ops-recover.yml#runtime",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 5,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "minimal pipeline bounded hosted execution",
+        "expectedContributionSeconds": 300,
+        "rationale": "Owned runtime, metadata or product job boundary. Product matrix uses only declared platforms; native Warrant transfer waits for exact provider terminality. This is a conservative timeout budget, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/public-ops-recover.yml#control",
+      "authorityClass": "merge-critical-admission",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 20,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": true,
+        "metric": "minimal pipeline bounded hosted execution",
+        "expectedContributionSeconds": 1200,
+        "rationale": "Owned runtime, metadata or product job boundary. Product matrix uses only declared platforms; native Warrant transfer waits for exact provider terminality. This is a conservative timeout budget, not measured latency."
+      }
+    },
+    {
+      "laneId": ".github/workflows/public-ops-pipeline.yml#execute",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 825,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "shared normal or recovery execution timeout bound",
+        "expectedContributionSeconds": 49500,
+        "rationale": "Delegates to the same isolated product, native delivery and publication jobs. Recovery schedules only qualified missing work; this inherited conservative timeout sum is not measured latency or a new parallel lane family."
+      }
+    },
+    {
+      "laneId": ".github/workflows/public-ops-recover.yml#execute",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "none",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 825,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "shared normal or recovery execution timeout bound",
+        "expectedContributionSeconds": 49500,
+        "rationale": "Delegates to the same isolated product, native delivery and publication jobs. Recovery schedules only qualified missing work; this inherited conservative timeout sum is not measured latency or a new parallel lane family."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.release-pipeline-products.yml#materialize",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "ref-scoped",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 5,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "declared version regeneration before publication or next-development materialization",
+        "expectedContributionSeconds": 300,
+        "rationale": "One shared internal component executes each declared product platform for version-derived files, then independently verifies actual job completion and archive digests before Git writes. Up to five product runners each have a sixty-minute ceiling, and materialization has twenty minutes; the component can run once for publication and once for next development. Parent reusable jobs delegate without a separate product runner. Bounds are declared capacity, not measured latency; per-repository publication concurrency retains a single provider writer."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.release-pipeline-products.yml#development",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "ref-scoped",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 5,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "declared version regeneration before publication or next-development materialization",
+        "expectedContributionSeconds": 300,
+        "rationale": "One shared internal component executes each declared product platform for version-derived files, then independently verifies actual job completion and archive digests before Git writes. Up to five product runners each have a sixty-minute ceiling, and materialization has twenty minutes; the component can run once for publication and once for next development. Parent reusable jobs delegate without a separate product runner. Bounds are declared capacity, not measured latency; per-repository publication concurrency retains a single provider writer."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.release-pipeline-version.yml#build",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "ref-scoped",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 300,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "declared version regeneration before publication or next-development materialization",
+        "expectedContributionSeconds": 18000,
+        "rationale": "One shared internal component executes each declared product platform for version-derived files, then independently verifies actual job completion and archive digests before Git writes. Up to five product runners each have a sixty-minute ceiling, and materialization has twenty minutes; the component can run once for publication and once for next development. Parent reusable jobs delegate without a separate product runner. Bounds are declared capacity, not measured latency; per-repository publication concurrency retains a single provider writer."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.release-pipeline-version.yml#materialize",
+      "authorityClass": "governed-delegation",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "ref-scoped",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 20,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "declared version regeneration before publication or next-development materialization",
+        "expectedContributionSeconds": 1200,
+        "rationale": "One shared internal component executes each declared product platform for version-derived files, then independently verifies actual job completion and archive digests before Git writes. Up to five product runners each have a sixty-minute ceiling, and materialization has twenty minutes; the component can run once for publication and once for next development. Parent reusable jobs delegate without a separate product runner. Bounds are declared capacity, not measured latency; per-repository publication concurrency retains a single provider writer."
+      }
+    },
+    {
+      "laneId": ".github/workflows/.ops-pipeline-execute.yml#stable-recheck",
+      "authorityClass": "evidence",
+      "triggerClass": "reusable",
+      "concurrencyPolicy": {
+        "mode": "ref-scoped",
+        "cancelInProgress": false
+      },
+      "expectedRunnerMinutes": 20,
+      "cancellationBehavior": "finish-started",
+      "sloImpact": {
+        "mergeCritical": false,
+        "metric": "bounded stable qualification recheck",
+        "expectedContributionSeconds": 1200,
+        "rationale": "Wait at most fifteen minutes outside the publication lock, then wake the same native Attempt through the normal entry to collect fresh qualification. Twenty minutes includes runtime preparation; this is a conservative timeout budget, not measured latency."
+      }
     }
   ],
   "declarationFamilies": [

package/architecture/decisions/0005-minimal-consumer-contract.md

@@ -0,0 +1,122 @@
+---
+status: draft
+period: ongoing
+theme: minimal-consumer-contract
+doc_type: architecture-decision-record
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-12
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-12
+  visible_context: Immutable seven-child Assignment and current Buildchain source and tests.
+  invisible_context_boundary: The new pipeline and recovery entries are not yet implemented or published.
+---
+
+# ADR 0005: The consumer owns product intent, Buildchain owns execution
+
+## Contract and rollout boundary
+
+Schema 2 is a closed TOML contract compiled by
+`packages/core/consumer/contract/plan.js`. The compiler receives bytes and has no
+filesystem, process or provider interface. It never runs a configured command.
+Unknown fields fail, including arbitrary request envelopes and publication
+commands. Build and verification commands remain product code, executed later
+in an isolated job with no delivery, signing or publication credentials.
+
+Consumers maintain `.buildchain/buildchain.toml` and two generated callers.
+The normal entry receives the platform event and an optional `config-path`.
+Recovery receives one exact `attempt` and an optional transient `runtime-ref`.
+`entries.js` owns both interfaces and product-independent caller bytes.
+No consumer assembles candidate, Warrant, fence, proof, nonce, run, transaction
+or Discussion selectors. An attempt is a Buildchain business identity, not a
+GitHub run ID, run-attempt number or Discussion number.
+
+This first slice defines and tests that contract. Its generated examples are
+qualification fixtures, not a claim that the new public entries already exist.
+The normal controller is delivered in child 3; recovery in child 5; Buildchain
+self migration and published alpha/stable qualification in child 6; old public
+surface retirement in child 7. Schema 1 is not translated by the new compiler.
+Existing consumers remain on the old implementation until the reviewed
+migration replaces their configuration and entry together. There is no final
+compatibility wrapper, hidden script, or product-specific entry.
+
+## Product plan
+
+Each product declares an ID, type (`npm`, `binary`, `paper`), exact supported
+platforms, optional install commands, build and verify commands, output
+artifacts and publication targets. Artifact IDs are unique and targets must
+cover exactly the declared output set. npm publishing is a typed npm target;
+archive and PDF publication use GitHub Release. Provider credentials are
+one-time setup, never TOML values or command arguments.
+
+Version files, strategy, legal channel PR routes and required independent
+review/merge queue are explicit. Existing dependency locks remain ordinary
+product source and are retained by initialization/migration. The internal
+executor must install dependencies under their lock and current supply-chain
+policy. TOML cannot weaken branch protection or substitute a local check for
+independent source, receipt or provider readback.
+
+## Events, identities and authority
+
+The normal event vocabulary covers PR lifecycle, review, merge group and push.
+Buildchain-owned `repository_dispatch` wake events are internal notifications;
+their payload is untrusted until the controller verifies its retained attempt
+and provider evidence. There is no manual JSON dispatch interface. Wake events
+never create authorization and duplicate or old events cannot authorize a new
+source. The controller owns deduplication, writer fencing and terminal wakeup.
+Consumer YAML contains no event routing logic or internal workflow names.
+
+The trusted `pull_request_target: closed` notification also covers closing a
+conflicted PR, for which GitHub does not run `pull_request`. This is a
+cancellation/settlement observation only and must never execute PR code.
+Merge-group removal is reconciled from PR dequeue and live queue readback;
+`merge_group` subscribes only to GitHub's supported `checks_requested` type.
+See the [GitHub event contract](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows).
+
+The platform-provided event is only an observation. Admission resolves the
+repository, PR head/base and tree through trusted provider readback. Config
+bytes bind to the exact Git blob, config path and source commit. The compiler
+returns data; its digest is not merge or publication authority. PR-controlled
+config and artifacts are not consumed in a job holding privileged credentials.
+Caller permission declarations are upper bounds; internal jobs must narrow
+them and keep untrusted builds separate from qualification and provider writes.
+Fork events must never receive repository write credentials or inherited secrets.
+
+The generated contract lock binds the contract version, entry SHA, selected
+runtime SHA and configuration byte digest. It does not bind the consuming Git
+commit: committing a tracked lock must not invalidate that same lock. Exact
+source commit/tree identity is bound separately for each execution attempt.
+Entry and runtime may differ. A normal run
+uses its admitted lock; recovery may select a repaired runtime once through
+the central entry. Downstream nodes do not compare Buildchain SHAs. A changed
+contract requires an explicit reviewed config/lock upgrade; schema mismatch
+fails rather than silently interpreting old data. An entry bug requires an
+upgraded published entry and a full new execution.
+
+## Evidence and enforcement
+
+`generate-minimal-consumer-contract.mjs --check` verifies all three generated
+examples and the complete migration inventory of current public/self inputs,
+caller edges, template/fixture configuration and consumer scripts. Inventory
+destinations distinguish provider setup, plan-derived internal arguments and
+attempt-owned material/authority. They are migration obligations, not deleted
+functionality or already-migrated state.
+
+`inspectConsumerContract` requires the exact two generated workflows and scans
+the supplied complete consumer tree for known internal orchestration. The
+caller comparison closes YAML wiring; the TOML validator closes configuration
+keys. Source scanning detects known bypasses but is not a proof of arbitrary
+program behavior. Credential isolation and provider authorization remain
+mandatory even when this static gate passes. Child 7 must validate the final
+reachable source/generator closure and adversarial cases after migration.
+
+Tests compile all three plans, reject invalid input/state/route/target/review
+changes, verify exact Git blob binding with different entry/runtime commits,
+and build actual package contents, a native archive and a valid PDF in isolated
+directories. These are local contract/product tests; they do not constitute
+hosted execution, release, provider authorization or recovery qualification.

package/architecture/decisions/0006-business-attempt-journal.md

@@ -0,0 +1,89 @@
+---
+status: draft
+period: ongoing
+theme: minimal-consumer-attempt-journal
+doc_type: architecture-decision-record
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-12
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-12
+  visible_context: Captured second-child Assignment, Discussion implementation and local fault tests.
+  invisible_context_boundary: Hosted pipeline integration and published consumer qualification belong to later slices.
+---
+
+# ADR 0006: One PR intent, immutable generations and recoverable attempts
+
+The internal `workflow/attempt` modules extend the existing Release Discussion
+journal. PR number, repository identity and target branch identify the intent.
+Exact source commit, tree, TOML blob/digest/path and observed protected base
+identify a generation. A request key plus generation and predecessor identifies
+a business attempt. Provider run, run-attempt and job identify each writer;
+several provider runs may contribute to one business attempt.
+
+The admitted ordered phase set covers admission, build, review, Warrant, merge,
+publication, distribution and next-development. A channel-specific plan may
+omit inapplicable phases. Every phase requires successful predecessors. Waiting,
+failure, cancellation and supersession retain a reason. Terminal phase results
+cannot be rewritten: recovery opens a successor with no inherited success.
+Published historical results remain readable even when a new source or base
+requires a new generation. Projection completion does not grant delivery,
+publication or material-reuse authority.
+
+Each event includes its content digest, previous event digest, exact attempt
+and generation, sequence, bounded idempotency key, writer and runtime reader
+identity. Replay rejects gaps, forks, conflicting duplicate keys, undeclared
+or out-of-order phases, missing predecessors, identity drift and history bounds.
+Identical repeated records have one meaning. A reader may receive pages out of
+order; sequence and content links reconstruct the original history.
+
+`businessAttemptStore` uses the existing provider-authenticated Discussion
+transport, immutable attempt roots and reply pagination. Only the expected
+writer's unedited records contribute. Initialization verifies the repository
+node identity. Unknown mutation responses are reconciled by reading back the
+same immutable identity before retry. No attempt state is written into the
+consumer source tree and no independent index or second authoritative store
+is introduced.
+
+The store has no default lock. Its internal `exclusive.run` adapter must own
+the repository/intent writer scope across hosted processes and retain that
+exclusion through the final provider mutation. `assertOwner` is rechecked at
+scope admission and immediately before create/append. Expected-head comparison
+and current-attempt checks fence stale results. The adapter must not transfer
+ownership while an in-flight provider mutation can still commit: a local mutex
+or a check followed by an unfenced lease expiry is insufficient. Child 3 owns
+the hosted controller adapter; this library slice does not claim hosted writer
+exclusion from the injected test fixture. The provider remains the persistence
+authority; a fork makes the reader fail closed rather than selecting a winner.
+
+Material references distinguish artifacts, checkpoints, receipts, Passports
+and provider readbacks. Each binds byte count, digest, producing attempt,
+generation and a permanent consumer-repository URL. Signed URLs and credentials
+are rejected. A reused material ID cannot acquire different bytes. The internal
+material verifier checks retrieved bytes; storing a reference alone does not
+prove retrieval, provider authorization or qualification for another attempt.
+Existing receipt, Passport and provider journal rules continue to own those
+facts. Recovery must qualify retained material under the successor's current
+rules before emitting fresh evidence.
+
+The retained `dist/readers/business-attempt.cjs` is self-contained and accepts
+captured authenticated JSON on stdin. Its CLI outputs status, reason, attempt,
+generation, missing phases and the one recovery selector. The bundle is
+reproducibility-checked alongside the historical release reader and tested in
+a fresh process with filesystem access restricted to the bundle. It has no
+provider write or effect-recovery entry. A runtime's recorded reader digest
+must be verified by the existing archive-loading boundary before execution;
+the pure reader does not authenticate caller-supplied records itself.
+
+The fault tests cover identity drift, incomplete and corrupted chains, duplicate
+and out-of-order delivery, concurrent/stale writers, cancellation/failure state,
+response loss after provider commit, restart, untrusted/edited records, material
+integrity and published-history preservation. Hosted control, user-facing
+attempt selection, actual provider recovery and self publication remain the
+explicit responsibilities of children 3 through 7. This slice adds no public
+workflow or consumer input.