@kungfu-tech/buildchain 4.1.3-alpha.4 → 4.1.3-alpha.6

package/dist/site/workflow-registry.json

@@ -233,8 +233,10 @@
         "runtime-selection"
       ],
       "inputCount": 2,
-      "secrets": [],
-      "secretCount": 0,
+      "secrets": [
+        "BUILDCHAIN_AUTOMATION_TOKEN"
+      ],
+      "secretCount": 1,
       "outputs": [],
       "outputCount": 0,
       "taxonomy": {
@@ -629,6 +631,66 @@
       "sunsetCondition": "explicit-contract-change-review",
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
+    {
+      "id": "buildchain-recover",
+      "path": ".github/workflows/buildchain-recover.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "taxonomy": {
+        "id": "buildchain-recover",
+        "role": "self",
+        "category": "ops",
+        "purpose": "recovery",
+        "status": "active",
+        "canonicalPath": ".github/workflows/buildchain-recover.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": "buildchain",
+      "path": ".github/workflows/buildchain.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "taxonomy": {
+        "id": "buildchain",
+        "role": "self",
+        "category": "ops",
+        "purpose": "pipeline",
+        "status": "active",
+        "canonicalPath": ".github/workflows/buildchain.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
     {
       "id": "public-build-adopter-qualification",
       "path": ".github/workflows/public-build-adopter-qualification.yml",
@@ -1201,7 +1263,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.1.3-alpha.4",
+      "introducedVersion": "4.1.3-alpha.6",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
@@ -1978,1054 +2040,32 @@
         "publication-commit-evidence-path",
         "publication-commit-payload-root",
         "publication-commit-url",
-        "release-candidate-action",
-        "release-candidate-artifact",
-        "release-candidate-recovery-receipt-artifact",
-        "release-candidate-recovery-root",
-        "release-invocation-root",
-        "release-propagation-work-artifact",
-        "release-receipt-root",
-        "release-tail-declaration-root",
-        "release-tail-receipt-roots-json",
-        "release-tail-state-root",
-        "release-tail-transaction-root",
-        "release-tail-transaction-state",
-        "release-transaction-root"
-      ],
-      "outputCount": 45,
-      "taxonomy": {
-        "id": "release-candidate-promote",
-        "role": "public",
-        "category": "release",
-        "purpose": "promote",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-release-promote.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "release-governance",
-      "capabilityGroup": "reusable-build",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "public-release-propagation",
-      "path": ".github/workflows/public-release-propagation.yml",
-      "reusable": true,
-      "inputs": [
-        "agent-work-context-json",
-        "agent-work-mode",
-        "contract-lock",
-        "downstream-base-ref",
-        "downstream-branch",
-        "downstream-prepare-command",
-        "downstream-repository",
-        "downstream-target",
-        "downstream-update-command",
-        "downstream-verify-command",
-        "dry-run",
-        "graph-json",
-        "lock-path",
-        "pr-body",
-        "pr-title",
-        "refresh-managed-readme-badges",
-        "runtime-ref",
-        "runtime-selection",
-        "source-node",
-        "upstream-release-json"
-      ],
-      "inputCount": 20,
-      "secrets": [
-        "propagation-token"
-      ],
-      "secretCount": 1,
-      "outputs": [
-        "controller-plan-artifact",
-        "controller-plan-digest",
-        "controller-plan-json",
-        "controller-receipt-artifact",
-        "controller-receipt-digest",
-        "controller-receipt-json",
-        "controller-receipt-status",
-        "propagation-receipt-digest",
-        "propagation-receipt-json",
-        "propagation-work-artifact",
-        "propagation-work-json",
-        "propagation-work-next-action",
-        "propagation-work-root"
-      ],
-      "outputCount": 13,
-      "taxonomy": {
-        "id": "release-propagation",
-        "role": "public",
-        "category": "release",
-        "purpose": "propagation",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-release-propagation.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "release-propagation",
-      "capabilityGroup": "site-and-propagation",
-      "status": "preview",
-      "owner": "buildchain-workflows",
-      "maturity": "preview",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "public-release-signing-authority",
-      "path": ".github/workflows/public-release-signing-authority.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "artifact-signing-authority",
-        "role": "public",
-        "category": "release",
-        "purpose": "signing-authority",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-release-signing-authority.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "public-release-tail",
-      "path": ".github/workflows/public-release-tail.yml",
-      "reusable": true,
-      "inputs": [
-        "candidate-root",
-        "contract-lock",
-        "declaration-path",
-        "execute",
-        "provider-bindings-path",
-        "rehearsal-authority-path",
-        "rehearsal-capsule-path",
-        "rehearsal-evidence-path",
-        "rehearsal-mode",
-        "runtime-ref",
-        "runtime-selection",
-        "state-path"
-      ],
-      "inputCount": 12,
-      "secrets": [
-        "http-token"
-      ],
-      "secretCount": 1,
-      "outputs": [
-        "rehearsal-evidence-root",
-        "state-root",
-        "transaction-root",
-        "transaction-state"
-      ],
-      "outputCount": 4,
-      "taxonomy": {
-        "id": "release-tail",
-        "role": "public",
-        "category": "release",
-        "purpose": "tail",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-release-tail.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "release-tail-provider-plane",
-      "capabilityGroup": "release-passport-trust",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "public-release-web",
-      "path": ".github/workflows/public-release-web.yml",
-      "reusable": true,
-      "inputs": [
-        "artifact-path",
-        "aws-region",
-        "build-command",
-        "contract-lock",
-        "fail-on-release-pr-error",
-        "github-governance-receipt-json",
-        "node-version",
-        "preview-apply",
-        "preview-aws-role-arn",
-        "preview-cleanup-apply",
-        "preview-comment",
-        "preview-environment",
-        "production-apply",
-        "production-approved",
-        "production-aws-role-arn",
-        "production-environment",
-        "production-release-app-client-id",
-        "production-release-branch-channel",
-        "production-release-head-prefix",
-        "production-release-label",
-        "production-release-on-main",
-        "production-release-pr-mode",
-        "production-source-sha",
-        "publication-admission-json",
-        "publication-control-plane-audit-json",
-        "publication-expected-json",
-        "publication-gate-aggregate-json",
-        "publication-runner-provenance-json",
-        "publication-used-nonces-json",
-        "release-feedback-actor-privacy",
-        "runtime-ref",
-        "runtime-selection",
-        "staging-apply",
-        "staging-aws-role-arn",
-        "staging-environment",
-        "verify-command",
-        "working-directory"
-      ],
-      "inputCount": 37,
-      "secrets": [
-        "production-release-app-private-key",
-        "production-release-pr-token"
-      ],
-      "secretCount": 2,
-      "outputs": [
-        "buildchain-runtime-class",
-        "buildchain-runtime-override",
-        "buildchain-runtime-ref",
-        "buildchain-runtime-sha",
-        "controller-plan-artifact",
-        "controller-plan-digest",
-        "controller-plan-json",
-        "controller-receipt-artifact",
-        "controller-receipt-digest",
-        "controller-receipt-json",
-        "controller-receipt-status",
-        "preview-apply-result-json",
-        "preview-cleanup-result-json",
-        "production-apply-result-json",
-        "production-release-pr-url",
-        "release-pr-status",
-        "staging-apply-result-json",
-        "web-surface-alias",
-        "web-surface-channel",
-        "web-surface-cleanup-plan-json",
-        "web-surface-manifest-json",
-        "web-surface-url",
-        "web-surface-urls-json"
-      ],
-      "outputCount": 23,
-      "taxonomy": {
-        "id": ".web-surface",
-        "role": "public",
-        "category": "release",
-        "purpose": "web",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-release-web.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-build-adopter-dogfood",
-      "path": ".github/workflows/self-build-adopter-dogfood.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "v4-adopter-delivery-dogfood",
-        "role": "self",
-        "category": "build",
-        "purpose": "adopter-dogfood",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-build-adopter-dogfood.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-build-alpha-dogfood",
-      "path": ".github/workflows/self-build-alpha-dogfood.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "buildchain-alpha-self-dogfood",
-        "role": "self",
-        "category": "build",
-        "purpose": "alpha-dogfood",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-build-alpha-dogfood.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-build-binary-distribution",
-      "path": ".github/workflows/self-build-binary-distribution.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "binary-distribution",
-        "role": "self",
-        "category": "build",
-        "purpose": "binary-distribution",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-build-binary-distribution.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "release-passport",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-build-channel-verify",
-      "path": ".github/workflows/self-build-channel-verify.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "channel-verify",
-        "role": "self",
-        "category": "build",
-        "purpose": "channel-verify",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-build-channel-verify.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-build-demo-dogfood",
-      "path": ".github/workflows/self-build-demo-dogfood.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "auditable-demo",
-        "role": "self",
-        "category": "build",
-        "purpose": "demo-dogfood",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-build-demo-dogfood.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-build-demo-media-qualification",
-      "path": ".github/workflows/self-build-demo-media-qualification.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "auditable-demo-media-profile-qualification",
-        "role": "self",
-        "category": "build",
-        "purpose": "demo-media-qualification",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-build-demo-media-qualification.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-build-fixture",
-      "path": ".github/workflows/self-build-fixture.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "build-surface-fixture",
-        "role": "self",
-        "category": "build",
-        "purpose": "fixture",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-build-fixture.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "repository-internal",
-      "owner": "buildchain-workflows",
-      "maturity": "repository-internal",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-build-public-consumer-dogfood",
-      "path": ".github/workflows/self-build-public-consumer-dogfood.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "v4-public-consumer-dogfood",
-        "role": "self",
-        "category": "build",
-        "purpose": "public-consumer-dogfood",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-build-public-consumer-dogfood.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-build-stable-candidate-qualification",
-      "path": ".github/workflows/self-build-stable-candidate-qualification.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "buildchain-stable-candidate-qualification",
-        "role": "self",
-        "category": "build",
-        "purpose": "stable-candidate-qualification",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-build-stable-candidate-qualification.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-patrol",
-      "capabilityGroup": "api-cli-reference",
-      "status": "repository-internal",
-      "owner": "buildchain-workflows",
-      "maturity": "repository-internal",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-build-stable-dogfood",
-      "path": ".github/workflows/self-build-stable-dogfood.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "buildchain-stable-self-dogfood",
-        "role": "self",
-        "category": "build",
-        "purpose": "stable-dogfood",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-build-stable-dogfood.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-build-verify",
-      "path": ".github/workflows/self-build-verify.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "verify",
-        "role": "self",
-        "category": "build",
-        "purpose": "verify",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-build-verify.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-ops-bootstrap-dogfood",
-      "path": ".github/workflows/self-ops-bootstrap-dogfood.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "universal-bootstrap-dogfood",
-        "role": "self",
-        "category": "ops",
-        "purpose": "bootstrap-dogfood",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-bootstrap-dogfood.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-ops-dev-delivery",
-      "path": ".github/workflows/self-ops-dev-delivery.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "buildchain-dev-delivery",
-        "role": "self",
-        "category": "ops",
-        "purpose": "dev-delivery",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-dev-delivery.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "dev-governance",
-      "capabilityGroup": "governance-versioning",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-ops-governance-audit",
-      "path": ".github/workflows/self-ops-governance-audit.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "github-governance-audit",
-        "role": "self",
-        "category": "ops",
-        "purpose": "governance-audit",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-governance-audit.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "dev-governance",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-ops-housekeeping-daily",
-      "path": ".github/workflows/self-ops-housekeeping-daily.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "engineering-housekeeper-daily",
-        "role": "self",
-        "category": "ops",
-        "purpose": "housekeeping-daily",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-housekeeping-daily.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-patrol",
-      "capabilityGroup": "governance-versioning",
-      "status": "preview",
-      "owner": "buildchain-workflows",
-      "maturity": "preview",
-      "introducedVersion": "4.1.3-alpha.4",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only."
-    },
-    {
-      "id": "self-ops-housekeeping-monthly",
-      "path": ".github/workflows/self-ops-housekeeping-monthly.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "engineering-housekeeper-monthly",
-        "role": "self",
-        "category": "ops",
-        "purpose": "housekeeping-monthly",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-housekeeping-monthly.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-patrol",
-      "capabilityGroup": "governance-versioning",
-      "status": "preview",
-      "owner": "buildchain-workflows",
-      "maturity": "preview",
-      "introducedVersion": "4.1.3-alpha.4",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only."
-    },
-    {
-      "id": "self-ops-housekeeping-weekly",
-      "path": ".github/workflows/self-ops-housekeeping-weekly.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "engineering-housekeeper-weekly",
-        "role": "self",
-        "category": "ops",
-        "purpose": "housekeeping-weekly",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-housekeeping-weekly.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-patrol",
-      "capabilityGroup": "governance-versioning",
-      "status": "preview",
-      "owner": "buildchain-workflows",
-      "maturity": "preview",
-      "introducedVersion": "4.1.3-alpha.4",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only."
-    },
-    {
-      "id": "self-ops-merge-queue",
-      "path": ".github/workflows/self-ops-merge-queue.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "dev-merge-queue-governance",
-        "role": "self",
-        "category": "ops",
-        "purpose": "merge-queue",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-merge-queue.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-ops-patrol-daily",
-      "path": ".github/workflows/self-ops-patrol-daily.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "buildchain-patrol-daily",
-        "role": "self",
-        "category": "ops",
-        "purpose": "patrol-daily",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-patrol-daily.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-patrol",
-      "capabilityGroup": "governance-versioning",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-ops-patrol-monthly",
-      "path": ".github/workflows/self-ops-patrol-monthly.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "buildchain-patrol-monthly",
-        "role": "self",
-        "category": "ops",
-        "purpose": "patrol-monthly",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-patrol-monthly.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-patrol",
-      "capabilityGroup": "governance-versioning",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-ops-patrol-weekly",
-      "path": ".github/workflows/self-ops-patrol-weekly.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "buildchain-patrol-weekly",
-        "role": "self",
-        "category": "ops",
-        "purpose": "patrol-weekly",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-patrol-weekly.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-patrol",
-      "capabilityGroup": "governance-versioning",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-ops-promotion-recovery",
-      "path": ".github/workflows/self-ops-promotion-recovery.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "buildchain-ref-promotion-recovery",
-        "role": "self",
-        "category": "ops",
-        "purpose": "promotion-recovery",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-promotion-recovery.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-ops-runner-smoke",
-      "path": ".github/workflows/self-ops-runner-smoke.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "self-hosted-runner-smoke",
-        "role": "self",
-        "category": "ops",
-        "purpose": "runner-smoke",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-runner-smoke.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "compatibility-fixture",
-      "owner": "buildchain-workflows",
-      "maturity": "compatibility-fixture",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-ops-stable-candidate-patrol",
-      "path": ".github/workflows/self-ops-stable-candidate-patrol.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "buildchain-stable-candidate-patrol",
-        "role": "self",
-        "category": "ops",
-        "purpose": "stable-candidate-patrol",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-ops-stable-candidate-patrol.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-patrol",
-      "capabilityGroup": "governance-versioning",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-release-binary-assets",
-      "path": ".github/workflows/self-release-binary-assets.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "binary-release-assets",
-        "role": "self",
-        "category": "release",
-        "purpose": "binary-assets",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-release-binary-assets.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-release-line-open",
-      "path": ".github/workflows/self-release-line-open.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
+        "release-candidate-action",
+        "release-candidate-artifact",
+        "release-candidate-recovery-receipt-artifact",
+        "release-candidate-recovery-root",
+        "release-invocation-root",
+        "release-propagation-work-artifact",
+        "release-receipt-root",
+        "release-tail-declaration-root",
+        "release-tail-receipt-roots-json",
+        "release-tail-state-root",
+        "release-tail-transaction-root",
+        "release-tail-transaction-state",
+        "release-transaction-root"
+      ],
+      "outputCount": 45,
       "taxonomy": {
-        "id": "release-line-bootstrap",
-        "role": "self",
+        "id": "release-candidate-promote",
+        "role": "public",
         "category": "release",
-        "purpose": "line-open",
+        "purpose": "promote",
         "status": "active",
-        "canonicalPath": ".github/workflows/self-release-line-open.yml",
+        "canonicalPath": ".github/workflows/public-release-promote.yml",
         "compatibilityAlias": false
       },
       "surface": "release-governance",
-      "capabilityGroup": "release-passport-trust",
+      "capabilityGroup": "reusable-build",
       "status": "active",
       "owner": "buildchain-workflows",
       "maturity": "active",
@@ -3036,29 +2076,66 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "self-release-next-development",
-      "path": ".github/workflows/self-release-next-development.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
+      "id": "public-release-propagation",
+      "path": ".github/workflows/public-release-propagation.yml",
+      "reusable": true,
+      "inputs": [
+        "agent-work-context-json",
+        "agent-work-mode",
+        "contract-lock",
+        "downstream-base-ref",
+        "downstream-branch",
+        "downstream-prepare-command",
+        "downstream-repository",
+        "downstream-target",
+        "downstream-update-command",
+        "downstream-verify-command",
+        "dry-run",
+        "graph-json",
+        "lock-path",
+        "pr-body",
+        "pr-title",
+        "refresh-managed-readme-badges",
+        "runtime-ref",
+        "runtime-selection",
+        "source-node",
+        "upstream-release-json"
+      ],
+      "inputCount": 20,
+      "secrets": [
+        "propagation-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "propagation-receipt-digest",
+        "propagation-receipt-json",
+        "propagation-work-artifact",
+        "propagation-work-json",
+        "propagation-work-next-action",
+        "propagation-work-root"
+      ],
+      "outputCount": 13,
       "taxonomy": {
-        "id": "next-development-review",
-        "role": "self",
+        "id": "release-propagation",
+        "role": "public",
         "category": "release",
-        "purpose": "next-development",
+        "purpose": "propagation",
         "status": "active",
-        "canonicalPath": ".github/workflows/self-release-next-development.yml",
+        "canonicalPath": ".github/workflows/public-release-propagation.yml",
         "compatibilityAlias": false
       },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "surface": "release-propagation",
+      "capabilityGroup": "site-and-propagation",
+      "status": "preview",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "preview",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -3066,8 +2143,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "self-release-npm-dry-run",
-      "path": ".github/workflows/self-release-npm-dry-run.yml",
+      "id": "public-release-signing-authority",
+      "path": ".github/workflows/public-release-signing-authority.yml",
       "reusable": false,
       "inputs": [],
       "inputCount": 0,
@@ -3076,12 +2153,12 @@
       "outputs": [],
       "outputCount": 0,
       "taxonomy": {
-        "id": "npm-publish",
-        "role": "self",
+        "id": "artifact-signing-authority",
+        "role": "public",
         "category": "release",
-        "purpose": "npm-dry-run",
+        "purpose": "signing-authority",
         "status": "active",
-        "canonicalPath": ".github/workflows/self-release-npm-dry-run.yml",
+        "canonicalPath": ".github/workflows/public-release-signing-authority.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-workflow",
@@ -3096,25 +2173,45 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "self-release-promote",
-      "path": ".github/workflows/self-release-promote.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
+      "id": "public-release-tail",
+      "path": ".github/workflows/public-release-tail.yml",
+      "reusable": true,
+      "inputs": [
+        "candidate-root",
+        "contract-lock",
+        "declaration-path",
+        "execute",
+        "provider-bindings-path",
+        "rehearsal-authority-path",
+        "rehearsal-capsule-path",
+        "rehearsal-evidence-path",
+        "rehearsal-mode",
+        "runtime-ref",
+        "runtime-selection",
+        "state-path"
+      ],
+      "inputCount": 12,
+      "secrets": [
+        "http-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "rehearsal-evidence-root",
+        "state-root",
+        "transaction-root",
+        "transaction-state"
+      ],
+      "outputCount": 4,
       "taxonomy": {
-        "id": "buildchain-ref-promotion",
-        "role": "self",
+        "id": "release-tail",
+        "role": "public",
         "category": "release",
-        "purpose": "promote",
+        "purpose": "tail",
         "status": "active",
-        "canonicalPath": ".github/workflows/self-release-promote.yml",
+        "canonicalPath": ".github/workflows/public-release-tail.yml",
         "compatibilityAlias": false
       },
-      "surface": "release-governance",
+      "surface": "release-tail-provider-plane",
       "capabilityGroup": "release-passport-trust",
       "status": "active",
       "owner": "buildchain-workflows",
@@ -3126,52 +2223,87 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "self-release-rehearsal-dogfood",
-      "path": ".github/workflows/self-release-rehearsal-dogfood.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "v4-publication-rehearsal-dogfood",
-        "role": "self",
-        "category": "release",
-        "purpose": "rehearsal-dogfood",
-        "status": "active",
-        "canonicalPath": ".github/workflows/self-release-rehearsal-dogfood.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "self-release-tail-dogfood",
-      "path": ".github/workflows/self-release-tail-dogfood.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
+      "id": "public-release-web",
+      "path": ".github/workflows/public-release-web.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-path",
+        "aws-region",
+        "build-command",
+        "contract-lock",
+        "fail-on-release-pr-error",
+        "github-governance-receipt-json",
+        "node-version",
+        "preview-apply",
+        "preview-aws-role-arn",
+        "preview-cleanup-apply",
+        "preview-comment",
+        "preview-environment",
+        "production-apply",
+        "production-approved",
+        "production-aws-role-arn",
+        "production-environment",
+        "production-release-app-client-id",
+        "production-release-branch-channel",
+        "production-release-head-prefix",
+        "production-release-label",
+        "production-release-on-main",
+        "production-release-pr-mode",
+        "production-source-sha",
+        "publication-admission-json",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-gate-aggregate-json",
+        "publication-runner-provenance-json",
+        "publication-used-nonces-json",
+        "release-feedback-actor-privacy",
+        "runtime-ref",
+        "runtime-selection",
+        "staging-apply",
+        "staging-aws-role-arn",
+        "staging-environment",
+        "verify-command",
+        "working-directory"
+      ],
+      "inputCount": 37,
+      "secrets": [
+        "production-release-app-private-key",
+        "production-release-pr-token"
+      ],
+      "secretCount": 2,
+      "outputs": [
+        "buildchain-runtime-class",
+        "buildchain-runtime-override",
+        "buildchain-runtime-ref",
+        "buildchain-runtime-sha",
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "preview-apply-result-json",
+        "preview-cleanup-result-json",
+        "production-apply-result-json",
+        "production-release-pr-url",
+        "release-pr-status",
+        "staging-apply-result-json",
+        "web-surface-alias",
+        "web-surface-channel",
+        "web-surface-cleanup-plan-json",
+        "web-surface-manifest-json",
+        "web-surface-url",
+        "web-surface-urls-json"
+      ],
+      "outputCount": 23,
       "taxonomy": {
-        "id": "v4-declarative-release-tail-dogfood",
-        "role": "self",
+        "id": ".web-surface",
+        "role": "public",
         "category": "release",
-        "purpose": "tail-dogfood",
+        "purpose": "web",
         "status": "active",
-        "canonicalPath": ".github/workflows/self-release-tail-dogfood.yml",
+        "canonicalPath": ".github/workflows/public-release-web.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-workflow",
@@ -5248,9 +4380,10 @@
         "project-cut-proof-root",
         "request-json",
         "runtime-sha",
+        "status-token",
         "token"
       ],
-      "inputCount": 5,
+      "inputCount": 6,
       "capabilityGroup": "release-passport-trust",
       "status": "active",
       "owner": "buildchain-actions",
@@ -9092,9 +8225,10 @@
       "path": "actions/workflow/pipeline/control/action.yml",
       "inputs": [
         "config-path",
+        "queue-token",
         "token"
       ],
-      "inputCount": 2,
+      "inputCount": 3,
       "capabilityGroup": "api-cli-reference",
       "status": "active",
       "owner": "buildchain-actions",
@@ -9131,9 +8265,10 @@
       "inputs": [
         "attempt",
         "definition-sha",
+        "queue-token",
         "token"
       ],
-      "inputCount": 3,
+      "inputCount": 4,
       "capabilityGroup": "api-cli-reference",
       "status": "active",
       "owner": "buildchain-actions",