@kungfu-tech/buildchain 4.1.3-alpha.1 → 4.1.3-alpha.3

package/architecture/product-upstreams.json

@@ -0,0 +1,20 @@
+[
+  {
+    "id": "kfd",
+    "package": "@kungfu-tech/kfd",
+    "repository": "kungfu-systems/kfd",
+    "kfd_1": "exported-witness",
+    "kfd_2": "exported-claim",
+    "kfd_3": "exported-collaboration-interface",
+    "kfd_4": "schema-metadata",
+    "evidence": [
+      "package:kfd.release.json",
+      "package:.buildchain/kfd-1/contract-world.witness.json",
+      "package:.buildchain/kfd-2/public-release-trust.claim.json",
+      "package:.buildchain/kfd-2/kfd-foundation.trust-claims.json",
+      "package:.buildchain/kfd-2/kfd-foundation.trust-assessment.json",
+      "package:.buildchain/kfd-3/collaboration-interface.json",
+      "package:standards.json"
+    ]
+  }
+]

package/architecture/release-topology.json

@@ -10,14 +10,19 @@
   "closedWorld": {
     "workflowPaths": [
       ".github/workflows/.build.yml",
+      ".github/workflows/.ops-pipeline-execute.yml",
       ".github/workflows/.release-authority.yml",
       ".github/workflows/.release-binary-assets.yml",
+      ".github/workflows/.release-pipeline-products.yml",
+      ".github/workflows/.release-pipeline-version.yml",
       ".github/workflows/.release-promote.yml",
       ".github/workflows/build.yml",
       ".github/workflows/public-build-demo.yml",
       ".github/workflows/public-ops-alpha-candidate-patrol.yml",
       ".github/workflows/public-ops-dev-auto-merge.yml",
       ".github/workflows/public-ops-observed-evidence.yml",
+      ".github/workflows/public-ops-pipeline.yml",
+      ".github/workflows/public-ops-recover.yml",
       ".github/workflows/public-ops-stable-candidate-patrol.yml",
       ".github/workflows/public-release-artifact-attestation.yml",
       ".github/workflows/public-release-oci-compose-preview.yml",
@@ -68,6 +73,7 @@
       "packages/core/index.js",
       "packages/core/publication/oci-compose-qualification.js",
       "packages/core/publication/oci/preview-promotion.js",
+      "packages/core/publication/pipeline/documents.js",
       "packages/core/publication/publication-rehearsal-capsule.js",
       "packages/core/publication/publication-rehearsal-runtime.js",
       "packages/core/publication/publication-rehearsal.js",
@@ -87,14 +93,18 @@
     "runtimeSelectors": [
       "packages/core/runtime/entry/actions.js",
       "packages/core/runtime/entry/activation.js",
+      "packages/core/runtime/entry/attempt.js",
       "packages/core/runtime/entry/github.js",
       "packages/core/runtime/entry/recovery.js",
-      "packages/core/runtime/entry/selection.js"
+      "packages/core/runtime/entry/selection.js",
+      "packages/core/runtime/entry/source.js"
     ],
     "runtimeEngines": ["packages/core/release/promote-candidate/action.js"],
     "terminalProjections": [
       "actions/release/promotion/apply/action.yml",
       "actions/release/promotion/settle/action.yml",
+      "packages/core/publication/pipeline/apply.js",
+      "packages/core/publication/pipeline/recovery-admission.js",
       "packages/core/publication/settlement/transaction.js",
       "packages/core/release/promote-candidate/provider-settlement.js",
       "packages/core/release/release-invocation.js",
@@ -106,7 +116,9 @@
         "packages/core/publication/binary/action.js",
         "packages/core/release/next-development/actions.js",
         "packages/core/publication/oci/preview-actions.js",
-        "packages/core/publication/settlement/actions.js"
+        "packages/core/publication/settlement/actions.js",
+        "packages/core/publication/pipeline/actions.js",
+        "packages/core/publication/pipeline/version-actions.js"
       ],
       "modules": [
         "packages/core/adoption/kfd-adopter-manifest.js",
@@ -117,8 +129,15 @@
         "packages/core/build/build-configuration.js",
         "packages/core/build/github-artifact-attestation.js",
         "packages/core/build/package-manager.js",
+        "packages/core/build/stage-capsule.js",
         "packages/core/consumer/buildchain-channel-identity.js",
         "packages/core/consumer/buildchain-config.js",
+        "packages/core/consumer/contract/entries.js",
+        "packages/core/consumer/contract/identity.js",
+        "packages/core/consumer/contract/plan.js",
+        "packages/core/consumer/contract/products.js",
+        "packages/core/consumer/contract/reader.js",
+        "packages/core/consumer/contract/shape.js",
         "packages/core/consumer/floating-consumer-evidence.js",
         "packages/core/consumer/floating-consumer-policy.js",
         "packages/core/consumer/floating-consumer-release-passport.js",
@@ -130,22 +149,74 @@
         "packages/core/contracts/public-surface-audit.js",
         "packages/core/contracts/public-surface-cli.js",
         "packages/core/contracts/workflow-yaml-contract.js",
+        "packages/core/dev-delivery/admission/github-client.js",
+        "packages/core/dev-delivery/delivery-warrant-fixture-runner.js",
+        "packages/core/dev-delivery/delivery-warrant-read-candidate.js",
+        "packages/core/dev-delivery/delivery-warrant-semantic-diff-gate.js",
+        "packages/core/dev-delivery/delivery-warrant-shadow-adapter.js",
+        "packages/core/dev-delivery/dev-delivery-authority-candidate.js",
+        "packages/core/dev-delivery/dev-delivery-authority-state.js",
+        "packages/core/dev-delivery/dev-delivery-candidate-identity.js",
         "packages/core/dev-delivery/dev-delivery-common.js",
         "packages/core/dev-delivery/dev-delivery-contract-surface.js",
+        "packages/core/dev-delivery/dev-delivery-execution-failure.js",
+        "packages/core/dev-delivery/dev-delivery-execution-transfer.js",
+        "packages/core/dev-delivery/dev-delivery-native-execution.js",
+        "packages/core/dev-delivery/dev-delivery-native-proof.js",
+        "packages/core/dev-delivery/dev-delivery-process-boundary.js",
+        "packages/core/dev-delivery/dev-delivery-proof.js",
+        "packages/core/dev-delivery/dev-delivery-provider-attempt.js",
+        "packages/core/dev-delivery/dev-delivery-warrant-cancellation.js",
+        "packages/core/dev-delivery/dev-delivery-warrant-native-requirements.js",
+        "packages/core/dev-delivery/dev-delivery-warrant-qualification.js",
+        "packages/core/dev-delivery/dev-delivery-warrant-settlement.js",
+        "packages/core/dev-delivery/dev-delivery-warrant-state.js",
+        "packages/core/dev-delivery/dev-delivery-warrant.js",
+        "packages/core/dev-delivery/dev-delivery-writer-protocol-transition.js",
+        "packages/core/dev-delivery/native/execution.js",
+        "packages/core/dev-delivery/warrant/observation.js",
+        "packages/core/dev-delivery/warrant/persistence.js",
+        "packages/core/dev-delivery/warrant/service.js",
+        "packages/core/dev-delivery/warrant/transitions.js",
+        "packages/core/dev-delivery/warrant/values.js",
         "packages/core/governance/buildchain-compatibility-authority.js",
         "packages/core/governance/buildchain-compatibility-fact.js",
         "packages/core/governance/buildchain-compatibility-facts.json",
         "packages/core/governance/buildchain-compatibility-proof.js",
         "packages/core/observability/controller-evidence.js",
+        "packages/core/providers/dev-delivery/store.js",
         "packages/core/providers/github-cli-api.js",
+        "packages/core/providers/github/attempt-index.js",
+        "packages/core/providers/github/attempt-journal.js",
         "packages/core/providers/github/discussions/materials.js",
         "packages/core/providers/github/discussions/transport.js",
         "packages/core/providers/github/graphql-errors.js",
+        "packages/core/providers/github/json-client.js",
+        "packages/core/providers/github/pipeline-entry-runs.js",
+        "packages/core/providers/github/pipeline-integration.js",
+        "packages/core/providers/github/pipeline-policy.js",
+        "packages/core/providers/github/pipeline-product-payload.js",
+        "packages/core/providers/github/pipeline-product-release.js",
+        "packages/core/providers/github/pipeline-publication-artifacts.js",
+        "packages/core/providers/github/pipeline-release-evidence.js",
+        "packages/core/providers/github/pipeline-run-entry.js",
+        "packages/core/providers/github/pipeline-runs.js",
+        "packages/core/providers/github/pipeline-source.js",
+        "packages/core/providers/github/pipeline-stable-source.js",
+        "packages/core/providers/github/pipeline-version-artifacts.js",
+        "packages/core/providers/github/pipeline-version-readback.js",
+        "packages/core/providers/github/pipeline-version.js",
+        "packages/core/providers/github/pipeline-worker.js",
         "packages/core/providers/github/release-assets.js",
         "packages/core/publication/binary/action.js",
         "packages/core/publication/binary/capability.js",
         "packages/core/publication/binary/evidence.js",
         "packages/core/publication/binary/transaction.js",
+        "packages/core/publication/npm/pack-result.js",
+        "packages/core/publication/npm/package.js",
+        "packages/core/publication/npm/pipeline-channel.js",
+        "packages/core/publication/npm/pipeline-provider.js",
+        "packages/core/publication/npm/registry.js",
         "packages/core/publication/oci-compose-qualification.js",
         "packages/core/publication/oci-publication-bundle.js",
         "packages/core/publication/oci-publication-graph.js",
@@ -155,6 +226,59 @@
         "packages/core/publication/oci/preview-registry.js",
         "packages/core/publication/oci/preview-transaction.js",
         "packages/core/publication/oci/preview-values.js",
+        "packages/core/publication/pipeline/actions.js",
+        "packages/core/publication/pipeline/apply.js",
+        "packages/core/publication/pipeline/build-segments.js",
+        "packages/core/publication/pipeline/capsules.js",
+        "packages/core/publication/pipeline/context.js",
+        "packages/core/publication/pipeline/development-anchor.js",
+        "packages/core/publication/pipeline/development-current.js",
+        "packages/core/publication/pipeline/development-pr.js",
+        "packages/core/publication/pipeline/development-proof.js",
+        "packages/core/publication/pipeline/development-transition.js",
+        "packages/core/publication/pipeline/distribution.js",
+        "packages/core/publication/pipeline/documents.js",
+        "packages/core/publication/pipeline/effects.js",
+        "packages/core/publication/pipeline/files.js",
+        "packages/core/publication/pipeline/imported-materials.js",
+        "packages/core/publication/pipeline/journal.js",
+        "packages/core/publication/pipeline/next-development.js",
+        "packages/core/publication/pipeline/pack.js",
+        "packages/core/publication/pipeline/package-policy.js",
+        "packages/core/publication/pipeline/plan.js",
+        "packages/core/publication/pipeline/prepare.js",
+        "packages/core/publication/pipeline/qualification.js",
+        "packages/core/publication/pipeline/qualify.js",
+        "packages/core/publication/pipeline/recovery-admission.js",
+        "packages/core/publication/pipeline/recovery-build-download.js",
+        "packages/core/publication/pipeline/recovery-build-plan.js",
+        "packages/core/publication/pipeline/recovery-build-readback.js",
+        "packages/core/publication/pipeline/recovery-capsules.js",
+        "packages/core/publication/pipeline/recovery-import.js",
+        "packages/core/publication/pipeline/recovery-inspection.js",
+        "packages/core/publication/pipeline/recovery-materials.js",
+        "packages/core/publication/pipeline/recovery-plan.js",
+        "packages/core/publication/pipeline/recovery-prepare.js",
+        "packages/core/publication/pipeline/recovery-qualification.js",
+        "packages/core/publication/pipeline/recovery-readback.js",
+        "packages/core/publication/pipeline/recovery-signing.js",
+        "packages/core/publication/pipeline/sealed-products.js",
+        "packages/core/publication/pipeline/settle.js",
+        "packages/core/publication/pipeline/signing.js",
+        "packages/core/publication/pipeline/source-plan.js",
+        "packages/core/publication/pipeline/stable-entry.js",
+        "packages/core/publication/pipeline/stable-products.js",
+        "packages/core/publication/pipeline/stable-wait.js",
+        "packages/core/publication/pipeline/stable.js",
+        "packages/core/publication/pipeline/version-actions.js",
+        "packages/core/publication/pipeline/version-build.js",
+        "packages/core/publication/pipeline/version-context.js",
+        "packages/core/publication/pipeline/version-material.js",
+        "packages/core/publication/pipeline/version-preparation.js",
+        "packages/core/publication/pipeline/version-regeneration.js",
+        "packages/core/publication/pipeline/version-source-guard.js",
+        "packages/core/publication/pipeline/version.js",
+        "packages/core/publication/pipeline/worker.js",
         "packages/core/publication/publication-artifact-candidate.js",
         "packages/core/publication/publication-authority.js",
         "packages/core/publication/publication-development.js",
@@ -162,6 +286,9 @@
         "packages/core/publication/publication-sealed-bundle.js",
         "packages/core/publication/settlement/actions.js",
         "packages/core/publication/settlement/transaction.js",
+        "packages/core/release/candidate/payloads.js",
+        "packages/core/release/candidate/selection.js",
+        "packages/core/release/candidate/transport.js",
         "packages/core/release/commands/ensure-github-release.mjs",
         "packages/core/release/discussion/binary.js",
         "packages/core/release/discussion/checkpoints.js",
@@ -227,6 +354,7 @@
         "packages/core/release/protected-publication-source.js",
         "packages/core/release/publish-transaction.js",
         "packages/core/release/recovery/lineage.js",
+        "packages/core/release/release-blocker-priority.js",
         "packages/core/release/release-candidate-recovery.js",
         "packages/core/release/release-candidate.js",
         "packages/core/release/release-invocation.js",
@@ -235,24 +363,60 @@
         "packages/core/release/release-tail-product-capabilities.js",
         "packages/core/release/release-tail-provider-adapters.js",
         "packages/core/release/release-tail-provider-plane.js",
+        "packages/core/release/release-train.js",
         "packages/core/release/reuse-complete-release.js",
+        "packages/core/release/stable-release-gate.js",
         "packages/core/release/version-state.js",
         "packages/core/release/version-state/verification.js",
         "packages/core/runtime/action-process.mjs",
         "packages/core/runtime/checkout-identity.js",
+        "packages/core/runtime/consumer-shell.js",
         "packages/core/runtime/domain-wasm-artifact.js",
         "packages/core/runtime/domain-wasm.js",
+        "packages/core/runtime/entry/selection.js",
         "packages/core/runtime/installation-root.js",
         "packages/core/runtime/spawn-command.js",
-        "packages/core/web/web-surface-publication-candidate.js"
+        "packages/core/web/web-surface-publication-candidate.js",
+        "packages/core/workflow/attempt/identity.js",
+        "packages/core/workflow/attempt/journal.js",
+        "packages/core/workflow/attempt/materials.js",
+        "packages/core/workflow/attempt/reader.js",
+        "packages/core/workflow/attempt/records.js",
+        "packages/core/workflow/pipeline/build-evidence.js",
+        "packages/core/workflow/pipeline/build-qualification.js",
+        "packages/core/workflow/pipeline/build.js",
+        "packages/core/workflow/pipeline/channel-control.js",
+        "packages/core/workflow/pipeline/delivery-observation.js",
+        "packages/core/workflow/pipeline/events.js",
+        "packages/core/workflow/pipeline/fence.js",
+        "packages/core/workflow/pipeline/group-control.js",
+        "packages/core/workflow/pipeline/host.js",
+        "packages/core/workflow/pipeline/materials.js",
+        "packages/core/workflow/pipeline/notifications.js",
+        "packages/core/workflow/pipeline/parent-notification.js",
+        "packages/core/workflow/pipeline/platforms.js",
+        "packages/core/workflow/pipeline/progress.js",
+        "packages/core/workflow/pipeline/projection.js",
+        "packages/core/workflow/pipeline/reconcile.js",
+        "packages/core/workflow/pipeline/recovery-integration.js",
+        "packages/core/workflow/pipeline/recovery-merge-proof.js",
+        "packages/core/workflow/pipeline/recovery-ownership-settlement.js",
+        "packages/core/workflow/pipeline/recovery-ownership.js",
+        "packages/core/workflow/pipeline/recovery-plan.js",
+        "packages/core/workflow/pipeline/recovery-runtime.js",
+        "packages/core/workflow/pipeline/recovery-session.js",
+        "packages/core/workflow/pipeline/session.js",
+        "packages/core/workflow/pipeline/settlement.js",
+        "packages/core/workflow/pipeline/wake.js",
+        "packages/core/workflow/pipeline/web-status.js"
       ],
-      "root": "sha256:8c53933d9b9a475bd4961ff64db457ae3043e6e941c8d6c3624c06a0d22392b7"
+      "root": "sha256:5d735b6117bdc114550e736cec02b396e51a3cc284d59d704e906ae8aaceb7c1"
     },
     "rustWasmAuthority": {
       "loader": "packages/core/runtime/domain-wasm.js",
       "metadata": "packages/core/runtime/domain-wasm-artifact.js",
       "artifact": "packages/core/runtime/buildchain-domain.wasm",
-      "artifactRoot": "sha256:504e23c9241f43611813f0fbd213b7a694946328b00e23d22f6ba678e7b0c841",
+      "artifactRoot": "sha256:d42ab5ae8d42253d40ab49057e460285a848925cece176c4d68e63e90ca86c72",
       "distributedArtifacts": [
         "actions/release/promotion/ref/dist/buildchain-domain.wasm",
         "actions/release/tail/settle/dist/buildchain-domain.wasm",
@@ -386,12 +550,12 @@
       }
     ],
     "metrics": {
-      "workflowCount": 34,
-      "jobCount": 95,
-      "reusableEdgeCount": 20,
-      "mutationRelevantNodeCount": 61,
-      "contentsWriteJobCount": 22,
-      "oidcWriteJobCount": 19
+      "workflowCount": 39,
+      "jobCount": 116,
+      "reusableEdgeCount": 26,
+      "mutationRelevantNodeCount": 77,
+      "contentsWriteJobCount": 38,
+      "oidcWriteJobCount": 25
     },
     "semanticMetrics": {
       "workflowCount": 5,
@@ -441,5 +605,112 @@
         "oidcWriteJobCount": 0
       }
     }
+  },
+  "pipelinePublicationScope": {
+    "workflowPaths": [
+      ".github/workflows/.release-pipeline-products.yml",
+      ".github/workflows/public-ops-pipeline.yml",
+      ".github/workflows/public-ops-recover.yml",
+      ".github/workflows/.ops-pipeline-execute.yml",
+      ".github/workflows/.release-pipeline-version.yml"
+    ],
+    "authority": "retained-protected-source-qualified-sealed-products-and-live-provider-readback",
+    "maximumMetrics": {
+      "workflowCount": 5,
+      "jobCount": 21,
+      "reusableEdgeCount": 6,
+      "mutationRelevantNodeCount": 16,
+      "contentsWriteJobCount": 16,
+      "oidcWriteJobCount": 6
+    },
+    "observedTopology": {
+      "jobRecordFields": [
+        "id",
+        "kind",
+        "uses",
+        "contentsPermission",
+        "oidcPermission",
+        "carriers",
+        "mutationSignals"
+      ],
+      "workflows": [
+        {
+          "path": ".github/workflows/.release-pipeline-products.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "apply|runner|-|write|write|jobOutput|contents-write,oidc-write",
+            "build|runner|-|read|-|-|-",
+            "development|reusable-call|./.github/workflows/.release-pipeline-version.yml|write|-|-|contents-write",
+            "materialize|reusable-call|./.github/workflows/.release-pipeline-version.yml|write|-|-|contents-write",
+            "prepare|runner|-|write|-|jobOutput|contents-write",
+            "qualify|runner|-|write|write|-|contents-write,oidc-write",
+            "settle|runner|-|write|write|jobOutput|contents-write,oidc-write"
+          ],
+          "reusableEdges": [
+            "./.github/workflows/.release-pipeline-version.yml",
+            "./.github/workflows/.release-pipeline-version.yml"
+          ]
+        },
+        {
+          "path": ".github/workflows/public-ops-pipeline.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "control|runner|-|write|-|jobOutput|contents-write",
+            "execute|reusable-call|./.github/workflows/.ops-pipeline-execute.yml|write|write|-|contents-write,oidc-write",
+            "runtime|runner|-|read|-|jobOutput|-"
+          ],
+          "reusableEdges": ["./.github/workflows/.ops-pipeline-execute.yml"]
+        },
+        {
+          "path": ".github/workflows/public-ops-recover.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "control|runner|-|write|-|jobOutput|contents-write",
+            "execute|reusable-call|./.github/workflows/.ops-pipeline-execute.yml|write|write|-|contents-write,oidc-write",
+            "runtime|runner|-|read|-|jobOutput|-"
+          ],
+          "reusableEdges": ["./.github/workflows/.ops-pipeline-execute.yml"]
+        },
+        {
+          "path": ".github/workflows/.ops-pipeline-execute.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "build|runner|-|read|-|-|-",
+            "delivery|reusable-call|./.github/workflows/.ops-pipeline-delivery.yml|write|-|-|contents-write",
+            "publication|reusable-call|./.github/workflows/.release-pipeline-products.yml|write|write|-|contents-write,oidc-write",
+            "record-build|runner|-|write|-|-|contents-write",
+            "record-delivery|runner|-|write|-|-|contents-write",
+            "stable-recheck|runner|-|write|-|-|contents-write"
+          ],
+          "reusableEdges": [
+            "./.github/workflows/.ops-pipeline-delivery.yml",
+            "./.github/workflows/.release-pipeline-products.yml"
+          ]
+        },
+        {
+          "path": ".github/workflows/.release-pipeline-version.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "build|runner|-|read|-|-|-",
+            "materialize|runner|-|write|-|jobOutput|contents-write"
+          ],
+          "reusableEdges": []
+        }
+      ],
+      "metrics": {
+        "workflowCount": 5,
+        "jobCount": 21,
+        "reusableEdgeCount": 6,
+        "mutationRelevantNodeCount": 16,
+        "contentsWriteJobCount": 16,
+        "oidcWriteJobCount": 6
+      },
+      "semanticMetrics": {
+        "workflowCount": 5,
+        "mutationRelevantNodeCount": 16,
+        "contentsWriteJobCount": 10,
+        "oidcWriteJobCount": 3
+      }
+    }
   }
 }

package/architecture/universal-workflow-bootstrap.json

@@ -116,8 +116,12 @@
     ".github/workflows/.build-gate-profile.yml",
     ".github/workflows/.build.yml",
     ".github/workflows/.ops-git-sync.yml",
+    ".github/workflows/.ops-pipeline-delivery.yml",
+    ".github/workflows/.ops-pipeline-execute.yml",
     ".github/workflows/.release-authority.yml",
     ".github/workflows/.release-binary-assets.yml",
+    ".github/workflows/.release-pipeline-products.yml",
+    ".github/workflows/.release-pipeline-version.yml",
     ".github/workflows/.release-promote.yml",
     ".github/workflows/build.yml",
     ".github/workflows/public-build-adopter-qualification.yml",
@@ -135,6 +139,8 @@
     ".github/workflows/public-ops-patrol-monthly.yml",
     ".github/workflows/public-ops-patrol-weekly.yml",
     ".github/workflows/public-ops-patrol.yml",
+    ".github/workflows/public-ops-pipeline.yml",
+    ".github/workflows/public-ops-recover.yml",
     ".github/workflows/public-ops-release-governance.yml",
     ".github/workflows/public-ops-stable-candidate-patrol.yml",
     ".github/workflows/public-ops-tail-reseal.yml",
@@ -158,8 +164,12 @@
     ".github/workflows/.build-gate-profile.yml",
     ".github/workflows/.build.yml",
     ".github/workflows/.ops-git-sync.yml",
+    ".github/workflows/.ops-pipeline-delivery.yml",
+    ".github/workflows/.ops-pipeline-execute.yml",
     ".github/workflows/.release-authority.yml",
     ".github/workflows/.release-binary-assets.yml",
+    ".github/workflows/.release-pipeline-products.yml",
+    ".github/workflows/.release-pipeline-version.yml",
     ".github/workflows/.release-promote.yml",
     ".github/workflows/build.yml",
     ".github/workflows/public-build-adopter-qualification.yml",
@@ -176,6 +186,8 @@
     ".github/workflows/public-ops-patrol-monthly.yml",
     ".github/workflows/public-ops-patrol-weekly.yml",
     ".github/workflows/public-ops-patrol.yml",
+    ".github/workflows/public-ops-pipeline.yml",
+    ".github/workflows/public-ops-recover.yml",
     ".github/workflows/public-ops-release-governance.yml",
     ".github/workflows/public-ops-stable-candidate-patrol.yml",
     ".github/workflows/public-ops-tail-reseal.yml",

package/architecture/universal-workflow-capability-policy.json

@@ -34,7 +34,6 @@
     "sha256:24cbb86e8fb198f7a949372291e712dd83ff12ba667c7049775ef497261bc62e",
     "sha256:265ccc9da3d84b8bf50746b6722b18c680dcc65bd322a5170e81bd5d0fa5b2b0",
     "sha256:2c5a19fe5ebe2550336c42f7de0c71b0e736776758b404716a5f77e0236920dc",
-    "sha256:310b9c3db199e6d900ca4756f152396103630da36aafa7218fe50fb8996f1da1",
     "sha256:34829b6e556284ef7c3f342fafcf92588a94761534e5f19ea12131f389ad4f50",
     "sha256:3d6119d1295ea7083d44a1b82fde5cb5dca910e427d1aee119d3ffbf421810f3",
     "sha256:40fdce377a9b02cb53f41e822cfc5d96c2f7e57a86a7574bf8ee39f3e0f0e12e",
@@ -60,6 +59,7 @@
     "sha256:dd9ae24a7a586c616a7b3b2b733eb38bfd3f8b19e5faec9e16851719be6abd61",
     "sha256:deee1c61c9731de6e2120abd4c30d3ce760df2ff3f7afb4dd84973543b353660",
     "sha256:e207436baa946b3d25d0159a510b7da474cac8d33701c2e66c089117c05f473d",
+    "sha256:e42c7878242188da76b146480ae7b1d1cc454eb93942d2071e97e458b2c12e2f",
     "sha256:f780070e235bffdee96fc355d7ed5e2fd4188482c41b24e2558a32086634a87c"
   ],
   "validFrom": "2026-08-30T00:00:00.000Z",

package/architecture/workflow-taxonomy.json

@@ -742,6 +742,72 @@
       "status": "active",
       "invocation": "repository",
       "rationale": "Verify exact release PR lineage without retired prebuild, dependency discovery, version mutation or approval adapters."
+    },
+    {
+      "id": "pipeline",
+      "role": "public",
+      "category": "ops",
+      "purpose": "pipeline",
+      "summary": "Buildchain pipeline",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Buildchain pipeline: owned normal pipeline and internal credential boundaries."
+    },
+    {
+      "id": ".pipeline-delivery",
+      "role": "component",
+      "category": "ops",
+      "purpose": "pipeline-delivery",
+      "summary": "Internal pipeline delivery",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Internal pipeline delivery: owned normal pipeline and internal credential boundaries."
+    },
+    {
+      "id": ".pipeline-products",
+      "role": "component",
+      "category": "release",
+      "purpose": "pipeline-products",
+      "summary": "Internal pipeline product publication",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Separate product execution, qualification/signing, canonical APPLY and protected follow-ups without consumer orchestration."
+    },
+    {
+      "id": "recover",
+      "role": "public",
+      "category": "ops",
+      "purpose": "recover",
+      "summary": "Buildchain recovery",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Recover one exact attempt with an optional repaired runtime through the same internal product and delivery jobs."
+    },
+    {
+      "id": ".pipeline-execute",
+      "role": "component",
+      "category": "ops",
+      "purpose": "pipeline-execute",
+      "summary": "Internal pipeline execution",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Share credentialless product execution and protected delivery between normal and recovery public entries."
+    },
+    {
+      "id": ".pipeline-version",
+      "role": "component",
+      "category": "release",
+      "purpose": "pipeline-version",
+      "summary": "Internal pipeline version preparation",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Regenerate declared version material in credentialless product jobs and independently qualify it before publication or protected next-development Git writes."
     }
   ]
 }