@kungfu-tech/buildchain 4.1.3-alpha.4 → 4.1.3-alpha.5

package/architecture/agent-change-map.md

@@ -138,6 +138,7 @@ Safe change route: Reduce one declared responsibility in its owning module, run
 - `.github/workflows/public-ops-dev-auto-merge.yml`
 - `tests/release-topology.test.mjs`
 - `scripts/check-release-topology.mjs`
+- `scripts/check-universal-workflow-bootstrap.mjs`
 - `packages/core/providers/github/discussions/materials.js`
 - `.github/workflows/self-build-alpha-dogfood.yml`
 - `.github/workflows/self-build-binary-distribution.yml`

package/architecture/maintainability-debt.json

@@ -2249,6 +2249,7 @@
     ".github/workflows/public-ops-dev-auto-merge.yml",
     "tests/release-topology.test.mjs",
     "scripts/check-release-topology.mjs",
+    "scripts/check-universal-workflow-bootstrap.mjs",
     "packages/core/providers/github/discussions/materials.js",
     ".github/workflows/self-build-alpha-dogfood.yml",
     ".github/workflows/self-build-binary-distribution.yml",

package/architecture/maintainability-policy.json

@@ -27,16 +27,16 @@
   "repositoryBudgets": {
     "baselineRevision": "9569f69c2cb609372b8a3d65ce5dec8fb7b34a84",
     "maxHandMaintainedSourceFiles": 1472,
-    "maxHandMaintainedSourceLines": 217902,
+    "maxHandMaintainedSourceLines": 217919,
     "maxWorkflowFiles": 73,
-    "maxWorkflowLines": 10457,
-    "latestTransition": "Permission-safe pipeline policy and premerge channel source qualification.",
-    "latestTransitionRationale": "Charge one module and 123 measured implementation lines for exact version-blob and Rust-owned channel qualification before required checks and queue admission, viewer-enforced policy readback with check App identity, partitioned material retention, and the six documented task branch prefixes. Existing self workflows remain in place until the repaired runtime is published. Per-file, function, complexity, debt and exception ceilings remain unchanged. This aggregate budget change remains proposed until independent protected review.",
+    "maxWorkflowLines": 10465,
+    "latestTransition": "Exact pipeline source observation and isolated delivery credential transport.",
+    "latestTransitionRationale": "Charge exactly 17 measured source lines and 8 workflow lines for stable source identity observation and canonical automation-secret forwarding across the internal delivery boundary. Existing self workflows remain until the corrected entry is published. Preserve all source/workflow file counts, per-file, function, complexity, debt and exception ceilings. This aggregate budget change remains proposed until independent protected review.",
     "rationale": "Bounded modules separate candidate, evidence, native proof and execution, canonical failure verification, closed-set execution transfer, process-boundary verification, Warrant state and qualification, authority state, qualification, Landing acquisition, verified-attempt admission, Landing settlement and fence validation, provider attempt and heartbeat readback, sealed terminal evidence, hosted heartbeat, resume, store, options, command-specific adapters, and CLI orchestration responsibilities. The protected delivery workflow gives candidate and seal jobs no provider write credential, recursively rejects transfer drift, scopes every transfer artifact to the exact provider run attempt, chains every durable heartbeat state and receipt root on a distinct hosted runner domain, and permits qualification or exact failure settlement only after the finalizer verifies live jobs and the latest durable authority state. Public Landing admission and heartbeat always perform non-injectable fresh exact-attempt provider readback, tolerate only a not-yet-materialized seal job while retaining exact native and duplicate-job rejection, and heartbeat-loss coordination never invokes GitHub's run-scoped cancellation API where a successor rerun could race. The hosted process boundary anchors trust in the kernel-resolved versioned Runner.Worker path while accepting an equivalent argv-zero spelling with the same basename; its public boundary marker is allowed only at the one exact non-secret value, so a forged value under the same credential-like name still fails closed. The credentialless transfer seal validates the rooted native reuse decision against the Warrant-bound source, closure, dependency, toolchain, environment and command inputs; qualifiedBase stays in the proof and decision where it is rooted and later independently rechecked, rather than being assumed on the Warrant schema. V2 mutation cannot initialize a second empty authority beside a legacy ref: migration reads and roots the canonical live v1 ref, rechecks it, applies the explicit configured v2 policy, and atomically replaces its bytes through one expected-old non-force update, so old v1 controllers fail closed while the prior commit remains immutable history. Candidate ancestry classifies the GitHub artifact runtime token as credential authority. Every Landing settlement, including an unexpired fence, requires product-owned terminal readback. Terminal cleanup reads the immutable historical attempt, derives workflow and hosted Landing job identity from live run data, reads the exact protected ref head and compares containment against that immutable SHA, and seals merged only when the admitted merge-group head is contained by that protected base; a later different-head merge settles the old attempt as dequeued. Terminal normalization preserves transfer, finalizer boundary, native and seal job, admitted provider attempt, protected-base head, containment result, and terminal readback coordinates. The public reusable workflow truthfully retains its single-flight v1 authority without advertising v2 migration, while bounded v2 remains a separate opt-in CLI, Node API, and schema contract; the tracked self-caller stays on public v4-alpha with matching stable and alpha locks, and transient train selection is dispatch-only. Next-development parity adds one versioned transition authority, one durable controller, one bounded reservation adapter, and pure public-contract recovery evidence while retaining the existing thin floating-channel callers byte-for-byte. The floating-consumer gate reuses the existing contract-world evaluator so SHA drift passes only under the selected lock's compatibility policy, breaking surface drift still fails closed, and external certification reconstructs the receipt from the observed workflow SHA rather than the lock's historical evidence SHA. Tail reseal adds no Stage Capsule effect or general rebuild authority: it verifies the exact retained four-platform bytes, admits one known macOS tail failure through live provider readback, fences signing and finalization to explicit credentials and Warrant identity, and requires standard candidate Passport plus provider and protected readback. Compatibility Facts parity isolates canonical encoding, temporal verification, lifecycle validation, fixture projection, public authority projection, and CLI adaptation into bounded modules; legacy digest and proof arrays are derived only from exact current Fact lineage. Publication Rehearsal adds no production release authority: the content-addressed capsule contract binds source, candidate, manifest, config, canonical data-only provider bindings, provider policy, observations and core version separately from filesystem, runtime and rehearsal-only provider authority; simulate, replay and explicitly authorized provider rehearsal all reuse the release-tail planner, while same-commit local dogfood resolves the new reusable contract and exact current runtime before external callers remain on floating v4-alpha. Cross-runtime candidate recovery preserves original runtime and provider roots and creates resume lineage only after exact public ref, tag, ancestry, npm version and integrity readback. Adopter Delivery restores the reviewed public v3 gate, drivers, Passport binding, N-1 bootstrap and exact archive loader through one public v4 surface while keeping provider and release authority explicit non-claims. Floating Alpha bootstrap uses only the existing exact resolver and protected Alpha private shell to move an otherwise stale floating shell, retains public v4 stable promotion, and removes itself after protected readback. CI lane change-budget enforcement adds a bounded parser, evaluator, guard, and tests without creating another merge authority. Minimal consumer contract adds exactly seven bounded contract modules, one generated-contract gate and six product build/test example sources; the source-file ceiling increases by fourteen for this reviewed feature slice. Existing per-file, function, complexity and debt limits are unchanged. The final readable template sources require exact source-line and total-automation ceilings of 203394 and 224451 respectively; this charges all generated example sources rather than hiding them from measurement.",
     "governance": "legacy-debt-sunset-2026q4",
     "maxActionDefinitions": 283,
     "maxActionDefinitionLines": 12399,
-    "maxAutomationImplementationLines": 239900
+    "maxAutomationImplementationLines": 239925
   },
   "sourceBudgets": {
     "newFileLines": 600,

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.1.3-alpha.4",
+    "version": "4.1.3-alpha.5",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -2410,5 +2410,5 @@
   "compatibilityFactCutRoot": "sha256:58f33e498596505a26b6fc3c7ae5acef847ff699eee6c7e17a7b318a40bdf0d6",
   "compatibilityProofRegistryRoot": "sha256:2f6477405c7891b754b33ad6515d55618bd320e7cdc59330d7cc645e17201e72",
   "compatibilityDigest": "sha256:14368a3f99f38a8c9c1e053f7ec3651766e3535237f4c551cc75417cf7ef97b3",
-  "contractDigest": "sha256:08573fc38a476e8ba195f8ce48bd6b451e62a56aa093a02d929bcc081aa4015f"
+  "contractDigest": "sha256:20d66ca1efc0cf0fc4d9b7636a11452646f9b67030561e33e6701e6c71ff6392"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-09-13T11:18:20.000Z",
-  "publishedAt": "2026-09-13T11:18:20.000Z",
+  "generatedAt": "2026-09-13T17:39:11.000Z",
+  "publishedAt": "2026-09-13T17:39:11.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "5d19bfb4c25e83116f3bbd09a11dda8792bab7f7",
+  "sourceRevision": "5daa16d74fa52d44ae44f31d18860614d5563517",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.1.3-alpha.4",
+    "version": "4.1.3-alpha.5",
     "versionSource": "package.json#version"
   },
   "source": {
@@ -4663,13 +4663,18 @@
       ],
       "maturity": "stable",
       "sourcePath": "docs/runtime-entry.md",
-      "digest": "sha256:553609beaac13d46e960ceb2c771cd325862c83cbe98a18a6093ccd811483d4d",
+      "digest": "sha256:def81825eac925b6e1ecddd36fd5f6724076f229fafb2bbf9e738dba7a8d49ec",
       "headings": [
         {
           "level": 1,
           "title": "Runtime entry contract",
           "anchor": "runtime-entry-contract"
         },
+        {
+          "level": 2,
+          "title": "Minimal pipeline provider credentials",
+          "anchor": "minimal-pipeline-provider-credentials"
+        },
         {
           "level": 2,
           "title": "Minimal pipeline recovery",
@@ -4681,7 +4686,7 @@
           "anchor": "advanced-build-component-recovery"
         }
       ],
-      "markdown": "---\nstatus: draft\nperiod: ongoing\ntheme: unified-runtime-entry\ndoc_type: implementation-contract\nsource_level: user-consensus\nconfidence: high\nsensitivity: public\nevidence_grade: B\nreview_state: unreviewed\nlast_reviewed: 2026-09-13\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-13\n  visible_context: Source-bound attempt recovery implementation, published entry contract and local failure-path tests.\n  invisible_context_boundary: This contract does not claim implementation or hosted qualification is complete.\n---\n\n# Runtime entry contract\n\nConsumers persist a public workflow reference at `@v4` or `@v4-alpha`.\nGitHub resolves that entry to a commit. The entry selects execution runtime X\nfrom an explicit transient parameter, the selected contract lock, or the entry\ncommit default, in that order. The entry commit and runtime commit may differ.\n\n`actions/runtime/environment/prepare` is the sole runtime preparation owner.\nSelection is resolved once per execution. Each executing job prepares that\nselected runtime through the same implementation. Business workflows and\nactions cannot acquire, replace, reselect or install their own Buildchain\nruntime. All business composites, JavaScript modules, WASM and resources come\nfrom X. Runtime identity is retained as provenance; subsequent business nodes\ndo not compare Buildchain SHAs or require equality with the workflow commit.\n\nA runtime failure can start a recovery execution through the same public\nentry with a transient repaired train branch or tag. The new execution selects\nruntime Y and retains the original task, source and evidence. Valid completed\nresults can be reused; provider effects require readback before further writes.\nSwitching runtimes does not automatically qualify all previous results for reuse.\nNeither the persisted caller nor its contract lock needs a train rewrite.\n\nAn entry failure is repaired by publishing and adopting a corrected entry and\nstarting a new provider run through the corrected floating entry. The caller files\nremain unchanged. A usable recovery entry can still recover the exact existing\nattempt; an entry failure before admission has no attempt to recover.\nBuildchain self-dogfood uses exactly the same consumer contract and has no\nrepository-specific execution or recovery route.\n\nSource checkouts are separate business inputs. Building Buildchain itself may\ncheck out its source, but that source cannot implicitly replace the selected\nexecution runtime. Source, artifact and publication-effect checks retain their\nbusiness meaning; they do not reintroduce downstream Buildchain SHA checks.\n\nAcceptance requires a complete workflow/action acquisition inventory, enforced\nsingle preparation ownership, different entry/runtime execution, train recovery,\nplatform and multi-job qualification, and validation of the published consumer\nentry. A source test or a successful package import alone is insufficient.\n\n## Minimal pipeline recovery\n\nThe minimal contract has one normal event caller and one manual recovery caller,\nplus `.buildchain/buildchain.toml`. Both callers are maintained by Buildchain's\nconsumer setup; product differences do not require additional recovery workflows.\nThe repository implementation alone does not prove the entry has been published\nor qualified in a clean consumer.\n\nThe workflow summary identifies the current attempt, its source PR, completed\nsteps and remaining work. Follow **Recover this attempt**, choose **Run workflow**,\nand paste the exact attempt. Leave `runtime-ref` empty for an ordinary retry;\nsupply a repaired runtime only when needed. The public recovery entry accepts no\nother recovery selectors. It derives configuration, producer runs, artifacts and\ntransaction coordinates from the canonical attempt history.\n\nRecovery opens a new attempt with an explicit predecessor. Successful platform\njobs and their actual retained artifacts are independently requalified; only\nmissing platforms or explicitly incompatible stage implementations are rebuilt.\nA signing failure can requalify the original sealed bytes under the repaired\npublisher. Partial publication preserves its original signed transaction and\ncompleted effects, reads providers again, and authorizes only remaining effects.\nMissing, expired or conflicting evidence stops with a diagnosis; it does not\nsilently trigger a complete rebuild or replace published bytes.\n\nA repeated request for the same predecessor and repair selects the same successor.\nIf that recovery was interrupted, select the successor shown in the summary for\nthe next recovery. An active predecessor must first finish or be cancelled using\nits ordinary GitHub execution link. A changed or superseded source cannot reuse\nan old attempt as authority for the current PR. Completed publication remains\nrecorded even when distribution or the next development version still needs work.\nCancellation stops remaining work and cannot undo published results.\n\nOnce admitted, ordinary wake events continue with the recovered attempt's exact\nruntime, even when the consumer lock still names the original runtime. A further\nruntime change requires another explicit recovery. An entry repair is distributed\nthrough the existing `@v4` or `@v4-alpha` entry; consumers do not maintain backup\nscripts, patch a job definition, or add a different recovery workflow family.\n\n## Advanced build component recovery\n\n```yaml\non:\n  push:\n  workflow_dispatch:\n    inputs:\n      runtime-ref:\n        description: Optional repaired train for this execution\n        default: \"\"\n        type: string\n      resume-run-id:\n        description: Original failed build run to recover\n        default: \"\"\n        type: string\njobs:\n  build:\n    uses: kungfu-systems/buildchain/.github/workflows/build.yml@v4\n    with:\n      runtime-ref: ${{ inputs.runtime-ref || '' }}\n      resume-run-id: ${{ inputs.resume-run-id || '' }}\n```\n\nOrdinary executions use `.buildchain/contract-lock.json`; the alpha entry defaults\nto `.buildchain/alpha-contract-lock.json`. `contract-lock` selects another relative\nlock path. A missing default lock falls back to the entry commit; an invalid lock\nor an unreadable source fails preparation. A supplied runtime parameter overrides\nthe lock and requires caller repository write authority. For `workflow_dispatch`,\nGitHub enforces repository Actions write permission before creating the run,\nincluding calls using installation tokens. The entry uses that authorization;\nan installation bot does not need to be a human repository collaborator.\nOther event types retain the entry's write, maintain or admin collaborator check.\nSee GitHub's [workflow dispatch authorization](https://docs.github.com/en/rest/actions/workflows#create-a-workflow-dispatch-event).\nBranches and tags are resolved to an immutable commit during selection.\n\nFor a Buildchain runtime fault, dispatch the same consumer workflow with\n`runtime-ref: train/v4/v4.1/<repair>` and the original `resume-run-id`. The entry\nretains the original source commit and rejects unrelated workflows or fork runs.\nInstall hydrates the new workspace; completed build outputs are restored only\nwhen source, configuration, platform, tools, artifact producer and all retained\nbytes qualify. The remaining verification runs with the repaired runtime.\nExisting provider effects use their transaction evidence and live readbacks.\nA failed-job rerun cannot supply new inputs; recovery therefore starts a new run.\n\n`runtime-selection` is an internal reusable-workflow transport for an already\nselected runtime. Components forward it unchanged instead of resolving another\nreference. Consumers normally supply `runtime-ref` or a lock, not this transport.\n\nNested components preserve the selected runtime and contract metadata without\nre-reading the lock or comparing the runtime SHA. The internal transport carries\na trusted entry output; consumer source binding and override authorization remain\nentry concerns. Recovery selectors request `actions: read` to read the original\nrun in private repositories as well as public repositories.\n\nBusiness adapters also keep the runtime installation directory separate from the\nconsumer workspace. Queue reconciliation, npm preview, runner qualification and\nbinary packaging read consumer source from the workspace while executing selected\nruntime code. Directory equality is not an admission rule; source SHA and artifact\ncontainment checks still apply. The architecture gate parses business JavaScript\nand rejects direct or aliased runtime/source directory equality comparisons.\n\nPublication authority adapters take runtime repository and revision provenance\nfrom the prepared entry selection. Consumer requests provide source, artifact\nand effect authority; they do not supply or readmit a Buildchain SHA. Governance\nand sealed publication evidence retain the selected runtime as provenance while\nvalidating their own source, policy and provider bindings."
+      "markdown": "---\nstatus: draft\nperiod: ongoing\ntheme: unified-runtime-entry\ndoc_type: implementation-contract\nsource_level: user-consensus\nconfidence: high\nsensitivity: public\nevidence_grade: B\nreview_state: unreviewed\nlast_reviewed: 2026-09-14\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-14\n  visible_context: Source-bound recovery, nested delivery credential transport, published entry contract and local failure-path tests.\n  invisible_context_boundary: This contract does not claim implementation or hosted qualification is complete.\n---\n\n# Runtime entry contract\n\nConsumers persist a public workflow reference at `@v4` or `@v4-alpha`.\nGitHub resolves that entry to a commit. The entry selects execution runtime X\nfrom an explicit transient parameter, the selected contract lock, or the entry\ncommit default, in that order. The entry commit and runtime commit may differ.\n\n`actions/runtime/environment/prepare` is the sole runtime preparation owner.\nSelection is resolved once per execution. Each executing job prepares that\nselected runtime through the same implementation. Business workflows and\nactions cannot acquire, replace, reselect or install their own Buildchain\nruntime. All business composites, JavaScript modules, WASM and resources come\nfrom X. Runtime identity is retained as provenance; subsequent business nodes\ndo not compare Buildchain SHAs or require equality with the workflow commit.\n\nA runtime failure can start a recovery execution through the same public\nentry with a transient repaired train branch or tag. The new execution selects\nruntime Y and retains the original task, source and evidence. Valid completed\nresults can be reused; provider effects require readback before further writes.\nSwitching runtimes does not automatically qualify all previous results for reuse.\nNeither the persisted caller nor its contract lock needs a train rewrite.\n\nAn entry failure is repaired by publishing and adopting a corrected entry and\nstarting a new provider run through the corrected floating entry. The caller files\nremain unchanged. A usable recovery entry can still recover the exact existing\nattempt; an entry failure before admission has no attempt to recover.\nBuildchain self-dogfood uses exactly the same consumer contract and has no\nrepository-specific execution or recovery route.\n\nSource checkouts are separate business inputs. Building Buildchain itself may\ncheck out its source, but that source cannot implicitly replace the selected\nexecution runtime. Source, artifact and publication-effect checks retain their\nbusiness meaning; they do not reintroduce downstream Buildchain SHA checks.\n\nAcceptance requires a complete workflow/action acquisition inventory, enforced\nsingle preparation ownership, different entry/runtime execution, train recovery,\nplatform and multi-job qualification, and validation of the published consumer\nentry. A source test or a successful package import alone is insufficient.\n\n## Minimal pipeline provider credentials\n\nConfigure `BUILDCHAIN_AUTOMATION_TOKEN` once as a repository Actions secret when\nprotected delivery requires permissions unavailable to `GITHUB_TOKEN`. Both\ngenerated callers already inherit secrets. No token value, additional input or\nprovider orchestration belongs in the consumer TOML or workflow source.\n\nScope this credential to the consumer repository. Delivery needs Administration\nread access to inspect classic branch locks, Checks read, and Actions, Contents,\nPull requests and Commit statuses write access for its existing provider steps.\nIt does not need permission to change branch protection or bypass review. A\nmissing credential falls back to `GITHUB_TOKEN`; unreadable protection still\nfails closed before candidate reservation instead of assuming an unlocked branch.\n\nThe internal delivery edge forwards only this named secret to the credentialed\nsource, reservation, heartbeat and landing steps. Product builds, native\nexecution and native evidence sealing retain their separate read-only jobs and\nreceive no automation credential. Publication settlement uses the same canonical\nsecret as its existing fallback credential. Repairing a missing workflow secret\nedge requires a corrected published entry and a new provider run.\n\n## Minimal pipeline recovery\n\nThe minimal contract has one normal event caller and one manual recovery caller,\nplus `.buildchain/buildchain.toml`. Both callers are maintained by Buildchain's\nconsumer setup; product differences do not require additional recovery workflows.\nThe repository implementation alone does not prove the entry has been published\nor qualified in a clean consumer.\n\nThe workflow summary identifies the current attempt, its source PR, completed\nsteps and remaining work. Follow **Recover this attempt**, choose **Run workflow**,\nand paste the exact attempt. Leave `runtime-ref` empty for an ordinary retry;\nsupply a repaired runtime only when needed. The public recovery entry accepts no\nother recovery selectors. It derives configuration, producer runs, artifacts and\ntransaction coordinates from the canonical attempt history.\n\nRecovery opens a new attempt with an explicit predecessor. Successful platform\njobs and their actual retained artifacts are independently requalified; only\nmissing platforms or explicitly incompatible stage implementations are rebuilt.\nA signing failure can requalify the original sealed bytes under the repaired\npublisher. Partial publication preserves its original signed transaction and\ncompleted effects, reads providers again, and authorizes only remaining effects.\nMissing, expired or conflicting evidence stops with a diagnosis; it does not\nsilently trigger a complete rebuild or replace published bytes.\n\nA repeated request for the same predecessor and repair selects the same successor.\nIf that recovery was interrupted, select the successor shown in the summary for\nthe next recovery. An active predecessor must first finish or be cancelled using\nits ordinary GitHub execution link. A changed or superseded source cannot reuse\nan old attempt as authority for the current PR. Completed publication remains\nrecorded even when distribution or the next development version still needs work.\nCancellation stops remaining work and cannot undo published results.\n\nOnce admitted, ordinary wake events continue with the recovered attempt's exact\nruntime, even when the consumer lock still names the original runtime. A further\nruntime change requires another explicit recovery. An entry repair is distributed\nthrough the existing `@v4` or `@v4-alpha` entry; consumers do not maintain backup\nscripts, patch a job definition, or add a different recovery workflow family.\n\n## Advanced build component recovery\n\n```yaml\non:\n  push:\n  workflow_dispatch:\n    inputs:\n      runtime-ref:\n        description: Optional repaired train for this execution\n        default: \"\"\n        type: string\n      resume-run-id:\n        description: Original failed build run to recover\n        default: \"\"\n        type: string\njobs:\n  build:\n    uses: kungfu-systems/buildchain/.github/workflows/build.yml@v4\n    with:\n      runtime-ref: ${{ inputs.runtime-ref || '' }}\n      resume-run-id: ${{ inputs.resume-run-id || '' }}\n```\n\nOrdinary executions use `.buildchain/contract-lock.json`; the alpha entry defaults\nto `.buildchain/alpha-contract-lock.json`. `contract-lock` selects another relative\nlock path. A missing default lock falls back to the entry commit; an invalid lock\nor an unreadable source fails preparation. A supplied runtime parameter overrides\nthe lock and requires caller repository write authority. For `workflow_dispatch`,\nGitHub enforces repository Actions write permission before creating the run,\nincluding calls using installation tokens. The entry uses that authorization;\nan installation bot does not need to be a human repository collaborator.\nOther event types retain the entry's write, maintain or admin collaborator check.\nSee GitHub's [workflow dispatch authorization](https://docs.github.com/en/rest/actions/workflows#create-a-workflow-dispatch-event).\nBranches and tags are resolved to an immutable commit during selection.\n\nFor a Buildchain runtime fault, dispatch the same consumer workflow with\n`runtime-ref: train/v4/v4.1/<repair>` and the original `resume-run-id`. The entry\nretains the original source commit and rejects unrelated workflows or fork runs.\nInstall hydrates the new workspace; completed build outputs are restored only\nwhen source, configuration, platform, tools, artifact producer and all retained\nbytes qualify. The remaining verification runs with the repaired runtime.\nExisting provider effects use their transaction evidence and live readbacks.\nA failed-job rerun cannot supply new inputs; recovery therefore starts a new run.\n\n`runtime-selection` is an internal reusable-workflow transport for an already\nselected runtime. Components forward it unchanged instead of resolving another\nreference. Consumers normally supply `runtime-ref` or a lock, not this transport.\n\nNested components preserve the selected runtime and contract metadata without\nre-reading the lock or comparing the runtime SHA. The internal transport carries\na trusted entry output; consumer source binding and override authorization remain\nentry concerns. Recovery selectors request `actions: read` to read the original\nrun in private repositories as well as public repositories.\n\nBusiness adapters also keep the runtime installation directory separate from the\nconsumer workspace. Queue reconciliation, npm preview, runner qualification and\nbinary packaging read consumer source from the workspace while executing selected\nruntime code. Directory equality is not an admission rule; source SHA and artifact\ncontainment checks still apply. The architecture gate parses business JavaScript\nand rejects direct or aliased runtime/source directory equality comparisons.\n\nPublication authority adapters take runtime repository and revision provenance\nfrom the prepared entry selection. Consumer requests provide source, artifact\nand effect authority; they do not supply or readmit a Buildchain SHA. Governance\nand sealed publication evidence retain the selected runtime as provenance while\nvalidating their own source, policy and provider bindings."
     },
     {
       "id": "manual:runtime-train-validation",

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "0961a448474a107d8a0361e2f691f8f866da52a3d8b30db2edb616c6e737ebea",
+    "sha256": "842f68668013209a8101ddee753c1aa614565497429f8ffde499c3c98ea61fd8",
     "summary": {
       "cliCommandCount": 117,
       "workflowCount": 73,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "0961a448474a107d8a0361e2f691f8f866da52a3d8b30db2edb616c6e737ebea",
+      "sha256": "842f68668013209a8101ddee753c1aa614565497429f8ffde499c3c98ea61fd8",
       "summary": {
         "cliCommandCount": 117,
         "workflowCount": 73,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "4.1.3-alpha.4",
+    "version": "4.1.3-alpha.5",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/page-registry.json

@@ -4597,13 +4597,18 @@
       ],
       "maturity": "stable",
       "sourcePath": "docs/runtime-entry.md",
-      "digest": "sha256:553609beaac13d46e960ceb2c771cd325862c83cbe98a18a6093ccd811483d4d",
+      "digest": "sha256:def81825eac925b6e1ecddd36fd5f6724076f229fafb2bbf9e738dba7a8d49ec",
       "headings": [
         {
           "level": 1,
           "title": "Runtime entry contract",
           "anchor": "runtime-entry-contract"
         },
+        {
+          "level": 2,
+          "title": "Minimal pipeline provider credentials",
+          "anchor": "minimal-pipeline-provider-credentials"
+        },
         {
           "level": 2,
           "title": "Minimal pipeline recovery",
@@ -4615,7 +4620,7 @@
           "anchor": "advanced-build-component-recovery"
         }
       ],
-      "markdown": "---\nstatus: draft\nperiod: ongoing\ntheme: unified-runtime-entry\ndoc_type: implementation-contract\nsource_level: user-consensus\nconfidence: high\nsensitivity: public\nevidence_grade: B\nreview_state: unreviewed\nlast_reviewed: 2026-09-13\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-13\n  visible_context: Source-bound attempt recovery implementation, published entry contract and local failure-path tests.\n  invisible_context_boundary: This contract does not claim implementation or hosted qualification is complete.\n---\n\n# Runtime entry contract\n\nConsumers persist a public workflow reference at `@v4` or `@v4-alpha`.\nGitHub resolves that entry to a commit. The entry selects execution runtime X\nfrom an explicit transient parameter, the selected contract lock, or the entry\ncommit default, in that order. The entry commit and runtime commit may differ.\n\n`actions/runtime/environment/prepare` is the sole runtime preparation owner.\nSelection is resolved once per execution. Each executing job prepares that\nselected runtime through the same implementation. Business workflows and\nactions cannot acquire, replace, reselect or install their own Buildchain\nruntime. All business composites, JavaScript modules, WASM and resources come\nfrom X. Runtime identity is retained as provenance; subsequent business nodes\ndo not compare Buildchain SHAs or require equality with the workflow commit.\n\nA runtime failure can start a recovery execution through the same public\nentry with a transient repaired train branch or tag. The new execution selects\nruntime Y and retains the original task, source and evidence. Valid completed\nresults can be reused; provider effects require readback before further writes.\nSwitching runtimes does not automatically qualify all previous results for reuse.\nNeither the persisted caller nor its contract lock needs a train rewrite.\n\nAn entry failure is repaired by publishing and adopting a corrected entry and\nstarting a new provider run through the corrected floating entry. The caller files\nremain unchanged. A usable recovery entry can still recover the exact existing\nattempt; an entry failure before admission has no attempt to recover.\nBuildchain self-dogfood uses exactly the same consumer contract and has no\nrepository-specific execution or recovery route.\n\nSource checkouts are separate business inputs. Building Buildchain itself may\ncheck out its source, but that source cannot implicitly replace the selected\nexecution runtime. Source, artifact and publication-effect checks retain their\nbusiness meaning; they do not reintroduce downstream Buildchain SHA checks.\n\nAcceptance requires a complete workflow/action acquisition inventory, enforced\nsingle preparation ownership, different entry/runtime execution, train recovery,\nplatform and multi-job qualification, and validation of the published consumer\nentry. A source test or a successful package import alone is insufficient.\n\n## Minimal pipeline recovery\n\nThe minimal contract has one normal event caller and one manual recovery caller,\nplus `.buildchain/buildchain.toml`. Both callers are maintained by Buildchain's\nconsumer setup; product differences do not require additional recovery workflows.\nThe repository implementation alone does not prove the entry has been published\nor qualified in a clean consumer.\n\nThe workflow summary identifies the current attempt, its source PR, completed\nsteps and remaining work. Follow **Recover this attempt**, choose **Run workflow**,\nand paste the exact attempt. Leave `runtime-ref` empty for an ordinary retry;\nsupply a repaired runtime only when needed. The public recovery entry accepts no\nother recovery selectors. It derives configuration, producer runs, artifacts and\ntransaction coordinates from the canonical attempt history.\n\nRecovery opens a new attempt with an explicit predecessor. Successful platform\njobs and their actual retained artifacts are independently requalified; only\nmissing platforms or explicitly incompatible stage implementations are rebuilt.\nA signing failure can requalify the original sealed bytes under the repaired\npublisher. Partial publication preserves its original signed transaction and\ncompleted effects, reads providers again, and authorizes only remaining effects.\nMissing, expired or conflicting evidence stops with a diagnosis; it does not\nsilently trigger a complete rebuild or replace published bytes.\n\nA repeated request for the same predecessor and repair selects the same successor.\nIf that recovery was interrupted, select the successor shown in the summary for\nthe next recovery. An active predecessor must first finish or be cancelled using\nits ordinary GitHub execution link. A changed or superseded source cannot reuse\nan old attempt as authority for the current PR. Completed publication remains\nrecorded even when distribution or the next development version still needs work.\nCancellation stops remaining work and cannot undo published results.\n\nOnce admitted, ordinary wake events continue with the recovered attempt's exact\nruntime, even when the consumer lock still names the original runtime. A further\nruntime change requires another explicit recovery. An entry repair is distributed\nthrough the existing `@v4` or `@v4-alpha` entry; consumers do not maintain backup\nscripts, patch a job definition, or add a different recovery workflow family.\n\n## Advanced build component recovery\n\n```yaml\non:\n  push:\n  workflow_dispatch:\n    inputs:\n      runtime-ref:\n        description: Optional repaired train for this execution\n        default: \"\"\n        type: string\n      resume-run-id:\n        description: Original failed build run to recover\n        default: \"\"\n        type: string\njobs:\n  build:\n    uses: kungfu-systems/buildchain/.github/workflows/build.yml@v4\n    with:\n      runtime-ref: ${{ inputs.runtime-ref || '' }}\n      resume-run-id: ${{ inputs.resume-run-id || '' }}\n```\n\nOrdinary executions use `.buildchain/contract-lock.json`; the alpha entry defaults\nto `.buildchain/alpha-contract-lock.json`. `contract-lock` selects another relative\nlock path. A missing default lock falls back to the entry commit; an invalid lock\nor an unreadable source fails preparation. A supplied runtime parameter overrides\nthe lock and requires caller repository write authority. For `workflow_dispatch`,\nGitHub enforces repository Actions write permission before creating the run,\nincluding calls using installation tokens. The entry uses that authorization;\nan installation bot does not need to be a human repository collaborator.\nOther event types retain the entry's write, maintain or admin collaborator check.\nSee GitHub's [workflow dispatch authorization](https://docs.github.com/en/rest/actions/workflows#create-a-workflow-dispatch-event).\nBranches and tags are resolved to an immutable commit during selection.\n\nFor a Buildchain runtime fault, dispatch the same consumer workflow with\n`runtime-ref: train/v4/v4.1/<repair>` and the original `resume-run-id`. The entry\nretains the original source commit and rejects unrelated workflows or fork runs.\nInstall hydrates the new workspace; completed build outputs are restored only\nwhen source, configuration, platform, tools, artifact producer and all retained\nbytes qualify. The remaining verification runs with the repaired runtime.\nExisting provider effects use their transaction evidence and live readbacks.\nA failed-job rerun cannot supply new inputs; recovery therefore starts a new run.\n\n`runtime-selection` is an internal reusable-workflow transport for an already\nselected runtime. Components forward it unchanged instead of resolving another\nreference. Consumers normally supply `runtime-ref` or a lock, not this transport.\n\nNested components preserve the selected runtime and contract metadata without\nre-reading the lock or comparing the runtime SHA. The internal transport carries\na trusted entry output; consumer source binding and override authorization remain\nentry concerns. Recovery selectors request `actions: read` to read the original\nrun in private repositories as well as public repositories.\n\nBusiness adapters also keep the runtime installation directory separate from the\nconsumer workspace. Queue reconciliation, npm preview, runner qualification and\nbinary packaging read consumer source from the workspace while executing selected\nruntime code. Directory equality is not an admission rule; source SHA and artifact\ncontainment checks still apply. The architecture gate parses business JavaScript\nand rejects direct or aliased runtime/source directory equality comparisons.\n\nPublication authority adapters take runtime repository and revision provenance\nfrom the prepared entry selection. Consumer requests provide source, artifact\nand effect authority; they do not supply or readmit a Buildchain SHA. Governance\nand sealed publication evidence retain the selected runtime as provenance while\nvalidating their own source, policy and provider bindings."
+      "markdown": "---\nstatus: draft\nperiod: ongoing\ntheme: unified-runtime-entry\ndoc_type: implementation-contract\nsource_level: user-consensus\nconfidence: high\nsensitivity: public\nevidence_grade: B\nreview_state: unreviewed\nlast_reviewed: 2026-09-14\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-14\n  visible_context: Source-bound recovery, nested delivery credential transport, published entry contract and local failure-path tests.\n  invisible_context_boundary: This contract does not claim implementation or hosted qualification is complete.\n---\n\n# Runtime entry contract\n\nConsumers persist a public workflow reference at `@v4` or `@v4-alpha`.\nGitHub resolves that entry to a commit. The entry selects execution runtime X\nfrom an explicit transient parameter, the selected contract lock, or the entry\ncommit default, in that order. The entry commit and runtime commit may differ.\n\n`actions/runtime/environment/prepare` is the sole runtime preparation owner.\nSelection is resolved once per execution. Each executing job prepares that\nselected runtime through the same implementation. Business workflows and\nactions cannot acquire, replace, reselect or install their own Buildchain\nruntime. All business composites, JavaScript modules, WASM and resources come\nfrom X. Runtime identity is retained as provenance; subsequent business nodes\ndo not compare Buildchain SHAs or require equality with the workflow commit.\n\nA runtime failure can start a recovery execution through the same public\nentry with a transient repaired train branch or tag. The new execution selects\nruntime Y and retains the original task, source and evidence. Valid completed\nresults can be reused; provider effects require readback before further writes.\nSwitching runtimes does not automatically qualify all previous results for reuse.\nNeither the persisted caller nor its contract lock needs a train rewrite.\n\nAn entry failure is repaired by publishing and adopting a corrected entry and\nstarting a new provider run through the corrected floating entry. The caller files\nremain unchanged. A usable recovery entry can still recover the exact existing\nattempt; an entry failure before admission has no attempt to recover.\nBuildchain self-dogfood uses exactly the same consumer contract and has no\nrepository-specific execution or recovery route.\n\nSource checkouts are separate business inputs. Building Buildchain itself may\ncheck out its source, but that source cannot implicitly replace the selected\nexecution runtime. Source, artifact and publication-effect checks retain their\nbusiness meaning; they do not reintroduce downstream Buildchain SHA checks.\n\nAcceptance requires a complete workflow/action acquisition inventory, enforced\nsingle preparation ownership, different entry/runtime execution, train recovery,\nplatform and multi-job qualification, and validation of the published consumer\nentry. A source test or a successful package import alone is insufficient.\n\n## Minimal pipeline provider credentials\n\nConfigure `BUILDCHAIN_AUTOMATION_TOKEN` once as a repository Actions secret when\nprotected delivery requires permissions unavailable to `GITHUB_TOKEN`. Both\ngenerated callers already inherit secrets. No token value, additional input or\nprovider orchestration belongs in the consumer TOML or workflow source.\n\nScope this credential to the consumer repository. Delivery needs Administration\nread access to inspect classic branch locks, Checks read, and Actions, Contents,\nPull requests and Commit statuses write access for its existing provider steps.\nIt does not need permission to change branch protection or bypass review. A\nmissing credential falls back to `GITHUB_TOKEN`; unreadable protection still\nfails closed before candidate reservation instead of assuming an unlocked branch.\n\nThe internal delivery edge forwards only this named secret to the credentialed\nsource, reservation, heartbeat and landing steps. Product builds, native\nexecution and native evidence sealing retain their separate read-only jobs and\nreceive no automation credential. Publication settlement uses the same canonical\nsecret as its existing fallback credential. Repairing a missing workflow secret\nedge requires a corrected published entry and a new provider run.\n\n## Minimal pipeline recovery\n\nThe minimal contract has one normal event caller and one manual recovery caller,\nplus `.buildchain/buildchain.toml`. Both callers are maintained by Buildchain's\nconsumer setup; product differences do not require additional recovery workflows.\nThe repository implementation alone does not prove the entry has been published\nor qualified in a clean consumer.\n\nThe workflow summary identifies the current attempt, its source PR, completed\nsteps and remaining work. Follow **Recover this attempt**, choose **Run workflow**,\nand paste the exact attempt. Leave `runtime-ref` empty for an ordinary retry;\nsupply a repaired runtime only when needed. The public recovery entry accepts no\nother recovery selectors. It derives configuration, producer runs, artifacts and\ntransaction coordinates from the canonical attempt history.\n\nRecovery opens a new attempt with an explicit predecessor. Successful platform\njobs and their actual retained artifacts are independently requalified; only\nmissing platforms or explicitly incompatible stage implementations are rebuilt.\nA signing failure can requalify the original sealed bytes under the repaired\npublisher. Partial publication preserves its original signed transaction and\ncompleted effects, reads providers again, and authorizes only remaining effects.\nMissing, expired or conflicting evidence stops with a diagnosis; it does not\nsilently trigger a complete rebuild or replace published bytes.\n\nA repeated request for the same predecessor and repair selects the same successor.\nIf that recovery was interrupted, select the successor shown in the summary for\nthe next recovery. An active predecessor must first finish or be cancelled using\nits ordinary GitHub execution link. A changed or superseded source cannot reuse\nan old attempt as authority for the current PR. Completed publication remains\nrecorded even when distribution or the next development version still needs work.\nCancellation stops remaining work and cannot undo published results.\n\nOnce admitted, ordinary wake events continue with the recovered attempt's exact\nruntime, even when the consumer lock still names the original runtime. A further\nruntime change requires another explicit recovery. An entry repair is distributed\nthrough the existing `@v4` or `@v4-alpha` entry; consumers do not maintain backup\nscripts, patch a job definition, or add a different recovery workflow family.\n\n## Advanced build component recovery\n\n```yaml\non:\n  push:\n  workflow_dispatch:\n    inputs:\n      runtime-ref:\n        description: Optional repaired train for this execution\n        default: \"\"\n        type: string\n      resume-run-id:\n        description: Original failed build run to recover\n        default: \"\"\n        type: string\njobs:\n  build:\n    uses: kungfu-systems/buildchain/.github/workflows/build.yml@v4\n    with:\n      runtime-ref: ${{ inputs.runtime-ref || '' }}\n      resume-run-id: ${{ inputs.resume-run-id || '' }}\n```\n\nOrdinary executions use `.buildchain/contract-lock.json`; the alpha entry defaults\nto `.buildchain/alpha-contract-lock.json`. `contract-lock` selects another relative\nlock path. A missing default lock falls back to the entry commit; an invalid lock\nor an unreadable source fails preparation. A supplied runtime parameter overrides\nthe lock and requires caller repository write authority. For `workflow_dispatch`,\nGitHub enforces repository Actions write permission before creating the run,\nincluding calls using installation tokens. The entry uses that authorization;\nan installation bot does not need to be a human repository collaborator.\nOther event types retain the entry's write, maintain or admin collaborator check.\nSee GitHub's [workflow dispatch authorization](https://docs.github.com/en/rest/actions/workflows#create-a-workflow-dispatch-event).\nBranches and tags are resolved to an immutable commit during selection.\n\nFor a Buildchain runtime fault, dispatch the same consumer workflow with\n`runtime-ref: train/v4/v4.1/<repair>` and the original `resume-run-id`. The entry\nretains the original source commit and rejects unrelated workflows or fork runs.\nInstall hydrates the new workspace; completed build outputs are restored only\nwhen source, configuration, platform, tools, artifact producer and all retained\nbytes qualify. The remaining verification runs with the repaired runtime.\nExisting provider effects use their transaction evidence and live readbacks.\nA failed-job rerun cannot supply new inputs; recovery therefore starts a new run.\n\n`runtime-selection` is an internal reusable-workflow transport for an already\nselected runtime. Components forward it unchanged instead of resolving another\nreference. Consumers normally supply `runtime-ref` or a lock, not this transport.\n\nNested components preserve the selected runtime and contract metadata without\nre-reading the lock or comparing the runtime SHA. The internal transport carries\na trusted entry output; consumer source binding and override authorization remain\nentry concerns. Recovery selectors request `actions: read` to read the original\nrun in private repositories as well as public repositories.\n\nBusiness adapters also keep the runtime installation directory separate from the\nconsumer workspace. Queue reconciliation, npm preview, runner qualification and\nbinary packaging read consumer source from the workspace while executing selected\nruntime code. Directory equality is not an admission rule; source SHA and artifact\ncontainment checks still apply. The architecture gate parses business JavaScript\nand rejects direct or aliased runtime/source directory equality comparisons.\n\nPublication authority adapters take runtime repository and revision provenance\nfrom the prepared entry selection. Consumer requests provide source, artifact\nand effect authority; they do not supply or readmit a Buildchain SHA. Governance\nand sealed publication evidence retain the selected runtime as provenance while\nvalidating their own source, policy and provider bindings."
     },
     {
       "id": "manual:runtime-train-validation",

package/dist/site/public-surface-audit.json

@@ -753,8 +753,10 @@
           "runtime-selection"
         ],
         "inputCount": 2,
-        "secrets": [],
-        "secretCount": 0,
+        "secrets": [
+          "BUILDCHAIN_AUTOMATION_TOKEN"
+        ],
+        "secretCount": 1,
         "outputs": [],
         "outputCount": 0
       },
@@ -11128,8 +11130,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "e43fdb0289df88871f3f0febbe04dcb9311a252a2b1df9b3a83a2d10c9d4a70f",
-    "workflowRegistryDigest": "4e97a606f26351e0f946b4f455edb7017b54b6d16bb362d7ca91bf690a289666",
-    "pageRegistryDigest": "71e5bb99567bf82b2c896da95f83197b58fad84e35ef54f5e9e4dc0cc3b7e465"
+    "workflowRegistryDigest": "d52b008d8113340194ec1e074870b71b83392a914536e2ef830c10abee0756d6",
+    "pageRegistryDigest": "a2631ef693dd1f1a6df3b42f31c5113b242368b7680343e5ff7cd94222d30d3d"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-13T11:18:20.000Z",
-  "publishedAt": "2026-09-13T11:18:20.000Z",
+  "generatedAt": "2026-09-13T17:39:11.000Z",
+  "publishedAt": "2026-09-13T17:39:11.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "5d19bfb4c25e83116f3bbd09a11dda8792bab7f7",
+  "sourceRevision": "5daa16d74fa52d44ae44f31d18860614d5563517",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.1.3-alpha.4",
+    "version": "4.1.3-alpha.5",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-13T11:18:20.000Z",
-  "publishedAt": "2026-09-13T11:18:20.000Z",
+  "generatedAt": "2026-09-13T17:39:11.000Z",
+  "publishedAt": "2026-09-13T17:39:11.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "5d19bfb4c25e83116f3bbd09a11dda8792bab7f7",
+  "sourceRevision": "5daa16d74fa52d44ae44f31d18860614d5563517",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.1.3-alpha.4",
+    "version": "4.1.3-alpha.5",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -233,8 +233,10 @@
         "runtime-selection"
       ],
       "inputCount": 2,
-      "secrets": [],
-      "secretCount": 0,
+      "secrets": [
+        "BUILDCHAIN_AUTOMATION_TOKEN"
+      ],
+      "secretCount": 1,
       "outputs": [],
       "outputCount": 0,
       "taxonomy": {
@@ -1201,7 +1203,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.1.3-alpha.4",
+      "introducedVersion": "4.1.3-alpha.5",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
@@ -2699,7 +2701,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.1.3-alpha.4",
+      "introducedVersion": "4.1.3-alpha.5",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
@@ -2729,7 +2731,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.1.3-alpha.4",
+      "introducedVersion": "4.1.3-alpha.5",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
@@ -2759,7 +2761,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.1.3-alpha.4",
+      "introducedVersion": "4.1.3-alpha.5",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",

package/docs/runtime-entry.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-13
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-13
-  visible_context: Source-bound attempt recovery implementation, published entry contract and local failure-path tests.
+  generated_at: 2026-09-14
+  visible_context: Source-bound recovery, nested delivery credential transport, published entry contract and local failure-path tests.
   invisible_context_boundary: This contract does not claim implementation or hosted qualification is complete.
 ---
 
@@ -56,6 +56,27 @@ single preparation ownership, different entry/runtime execution, train recovery,
 platform and multi-job qualification, and validation of the published consumer
 entry. A source test or a successful package import alone is insufficient.
 
+## Minimal pipeline provider credentials
+
+Configure `BUILDCHAIN_AUTOMATION_TOKEN` once as a repository Actions secret when
+protected delivery requires permissions unavailable to `GITHUB_TOKEN`. Both
+generated callers already inherit secrets. No token value, additional input or
+provider orchestration belongs in the consumer TOML or workflow source.
+
+Scope this credential to the consumer repository. Delivery needs Administration
+read access to inspect classic branch locks, Checks read, and Actions, Contents,
+Pull requests and Commit statuses write access for its existing provider steps.
+It does not need permission to change branch protection or bypass review. A
+missing credential falls back to `GITHUB_TOKEN`; unreadable protection still
+fails closed before candidate reservation instead of assuming an unlocked branch.
+
+The internal delivery edge forwards only this named secret to the credentialed
+source, reservation, heartbeat and landing steps. Product builds, native
+execution and native evidence sealing retain their separate read-only jobs and
+receive no automation credential. Publication settlement uses the same canonical
+secret as its existing fallback credential. Repairing a missing workflow secret
+edge requires a corrected published entry and a new provider run.
+
 ## Minimal pipeline recovery
 
 The minimal contract has one normal event caller and one manual recovery caller,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.1.3-alpha.4",
+  "version": "4.1.3-alpha.5",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/providers/github/pipeline-source.js

@@ -10,17 +10,34 @@ function exactSha(value) {
   return value;
 }
 
+function sourceRefBinding(reference) {
+  return {
+    ref: reference?.ref ?? null,
+    sha: reference?.sha ?? null,
+    repository: {
+      id: reference?.repo?.id ?? null,
+      nodeId: reference?.repo?.node_id ?? null,
+      fullName: reference?.repo?.full_name ?? null,
+    },
+  };
+}
+
+function mergedCommit(pr) {
+  return pr.merged === true ? pr.merge_commit_sha : null;
+}
+
 function pullRequestBinding(pr) {
+  // Provider timestamps and repository metadata can change during our own
+  // evidence writes. Bind source and delivery state, not those unrelated fields.
   return {
     number: pr.number,
     state: pr.state,
     merged: pr.merged,
-    mergeCommit: pr.merge_commit_sha,
-    head: pr.head,
-    base: pr.base,
+    mergeCommit: mergedCommit(pr),
+    head: sourceRefBinding(pr.head),
+    base: sourceRefBinding(pr.base),
     draft: pr.draft,
-    labels: pr.labels,
-    updatedAt: pr.updated_at,
+    ready: pr.labels.some((label) => label.name === "ready"),
   };
 }
 
@@ -113,7 +130,7 @@ export function githubPipelineSource(request, repository) {
         baseCommit,
         state: pr.state,
         merged: pr.merged === true,
-        mergeCommit: pr.merge_commit_sha,
+        mergeCommit: mergedCommit(pr),
         draft: pr.draft === true,
         ready: pr.labels.some((label) => label.name === "ready"),
       },
@@ -141,7 +158,7 @@ export function githubPipelineSource(request, repository) {
       targetBranch: pr.base.ref,
       state: pr.state,
       merged: pr.merged === true,
-      mergeCommit: pr.merge_commit_sha,
+      mergeCommit: mergedCommit(pr),
       source: sameHead ? generation.source : null,
       baseCommit: null,
       ready: pr.labels.some((label) => label.name === "ready"),