@kungfu-tech/buildchain 4.1.3-alpha.4 → 4.1.3-alpha.6

package/docs/runtime-entry.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-13
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-13
-  visible_context: Source-bound attempt recovery implementation, published entry contract and local failure-path tests.
+  generated_at: 2026-09-14
+  visible_context: Source-bound recovery, nested delivery credential transport, published entry contract and local failure-path tests.
   invisible_context_boundary: This contract does not claim implementation or hosted qualification is complete.
 ---
 
@@ -56,6 +56,34 @@ single preparation ownership, different entry/runtime execution, train recovery,
 platform and multi-job qualification, and validation of the published consumer
 entry. A source test or a successful package import alone is insufficient.
 
+## Minimal pipeline provider credentials
+
+Configure `BUILDCHAIN_AUTOMATION_TOKEN` once as a repository Actions secret when
+protected delivery requires permissions unavailable to `GITHUB_TOKEN`. Both
+generated callers already inherit secrets. No token value, additional input or
+provider orchestration belongs in the consumer TOML or workflow source.
+
+Scope this credential to the consumer repository. Delivery needs Administration
+read access to inspect classic branch locks, Checks read, and Actions, Contents,
+Pull requests and Commit statuses write access for its existing provider steps.
+It does not need permission to change branch protection or bypass review. Development
+admission can fall back to `GITHUB_TOKEN`; unreadable protection still fails
+closed before candidate reservation instead of assuming an unlocked branch.
+Channel enqueue requires an explicit automation credential or an App installation
+credential because `GITHUB_TOKEN` suppresses the required `merge_group` workflow.
+Both central entries select that credential through the shared token provider;
+queue reads and journal writes retain their existing workflow credential. An App
+uses `BUILDCHAIN_APP_CLIENT_ID` and `BUILDCHAIN_APP_PRIVATE_KEY`, scoped to the
+consumer repository with Pull requests write access. Missing or incomplete queue
+credentials fail closed before enqueue.
+
+The internal delivery edge forwards only this named secret to the credentialed
+source, reservation, heartbeat and landing steps. Product builds, native
+execution and native evidence sealing retain their separate read-only jobs and
+receive no automation credential. Publication settlement uses the same canonical
+secret as its existing fallback credential. Repairing a missing workflow secret
+edge requires a corrected published entry and a new provider run.
+
 ## Minimal pipeline recovery
 
 The minimal contract has one normal event caller and one manual recovery caller,

package/docs/runtime-train-validation.md

@@ -8,27 +8,30 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-08
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-08
-  invisible_context: not asserted
+  generated_at: 2026-09-14
+  visible_context: Source-bound caller installation, pipeline wake implementation and GitHub event documentation.
+  invisible_context_boundary: No unobserved provider execution or publication authority is claimed.
 ---
 
 # Runtime Train Validation
 
 A train repairs the execution runtime without changing the consumer's durable
 public entry. All public workflows, including ordinary builds, use the same
-[Runtime entry contract](runtime-entry.md). The transient runtime parameter
-wins over the consumer lock. Buildchain dogfood follows this same path.
+[Runtime entry contract](runtime-entry.md). The recovery entry accepts a transient runtime parameter, which wins over the
+consumer lock. The normal minimal pipeline accepts only an optional config path.
+Buildchain dogfood follows the same two-entry contract.
 
 ## Validate a runtime change
 
 1. Commit the candidate with its action bundles, WASM and runtime contract.
 2. Publish the candidate at `train/v4/v4.1/<capability>`.
-3. Dispatch the consumer's existing public entry with `runtime-ref` set to that
-   train. Record the selected runtime, consumer source and resulting evidence.
+3. Recover the exact retained attempt through `buildchain-recover.yml`, with
+   `runtime-ref` set to that train. Record the attempt, selected runtime, consumer
+   source and resulting evidence.
 4. After checks and independent review, merge into protected Dev and publish
    the requested Alpha. Qualify the published entry before Stable promotion.
 
@@ -38,13 +41,38 @@ provider credentials, capability constraints and readback requirements.
 
 ## Recover a runtime failure
 
-Start a new dispatch through the same public entry with the repaired train.
-For builds, supply `resume-run-id`; for release promotion, preserve the original
-candidate run and transaction in the typed request. The entry prepares runtime
-Y while the task keeps its original source and valid completed evidence.
+Start a new dispatch through `buildchain-recover.yml` with the exact attempt
+and the repaired train. The runtime selects the retained source and completed
+evidence; the consumer does not provide candidate, run or transaction selectors.
 A GitHub failed-job rerun does not change its inputs and cannot select a new
 runtime. Do not persist the train into the caller workflow or contract lock.
 
 If the public entry itself is defective, publish and adopt the corrected entry
 and start a full run. Copied consumer recovery packages and alternate recovery
 workflows are not part of the runtime contract.
+
+## Protected minimal-entry installation
+
+Install both generated callers, `buildchain.yml` and `buildchain-recover.yml`,
+on the protected default branch before retiring the previous delivery controller.
+Read back both files at the exact protected commit and verify their provider
+workflow registrations. A workflow registered from a task branch does not prove
+that its event receiver is installed on the default branch. GitHub requires that
+location for [repository dispatch events](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#repository_dispatch).
+
+Recovery preserves source and completed artifacts, then emits a repository
+wake for the remaining pipeline work. That wake requires the normal caller on
+the default branch; installing only the manual recovery caller leaves this
+continuation receiver absent. Verify the complete pair before the first recovery.
+
+During this bounded migration, pause the normal pipeline before enabling the
+previous protected delivery controller. After the installation merge, wait for
+its runs and Warrant to become terminal, then pause that controller and enable
+the normal pipeline before recovering a current admitted attempt. An installation
+merge advances the protected base, so an older unmerged source attempt must be
+re-admitted on the current base before recovery.
+
+Both callers are byte-identical to the generated consumer entries and call the
+published `@v4-alpha` public workflows. Recovery accepts only `attempt` and
+optional `runtime-ref`; the normal caller retains its protected config path.
+This installation order does not qualify the full self cutover or Stable release.

package/docs/stable-candidate-patrol.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-09-12
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-12
-  visible_context: Repository stable policy, public build qualification producer, artifact reader and regression tests.
+  generated_at: 2026-09-14
+  visible_context: User-directed zero-delay self release policy, required provider evidence and regression tests.
   invisible_context_boundary: No credentials, private logs, or unpublished consumer content were used.
 ---
 
@@ -52,7 +52,8 @@ It writes `buildchain-canary/buildchain-zero-input` on the qualified runtime SHA
 as `github-actions[bot]`. The consumer source SHA may differ from that runtime.
 
 The repository Patrol policy requires the alpha Release and this qualification
-status. It retains the one-hour soak. The publication transaction still requires
+status. Its minimum soak and stable publication interval are both zero.
+The publication transaction still requires
 its sealed release candidate and protected branch checks. Qualification produces
 evidence; it does not publish or merge a candidate.
 
@@ -78,7 +79,7 @@ Declare the default once in `.buildchain/buildchain.toml`:
 strategy = "latest-qualified-alpha"
 timezone = "Asia/Shanghai"
 publish_at = "03:00"
-minimum_soak_seconds = 3600
+minimum_soak_seconds = 0
 required_checks = [
   "alpha-release",
   "workflow:Build",

package/docs/workflow-catalog.md

@@ -23,7 +23,7 @@ Generated from `architecture/workflow-taxonomy.json`. Every workflow has one can
 
 Public workflows own the consumer API. Component workflows own reusable multi-job topology. Self workflows own Buildchain repository automation. Actions own execution steps; JS adapters and Rust/WASM own implementation.
 
-Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and `self-<category>-<purpose>.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.
+Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and the generated self callers `buildchain.yml` and `buildchain-recover.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.
 
 Register ownership before adding a workflow. `pnpm run check:workflows` validates source, calls, required CI integration and independent review ownership. `pnpm run generate:workflows` regenerates this catalog.
 
@@ -83,34 +83,5 @@ Register ownership before adding a workflow. `pnpm run check:workflows` validate
 
 | Workflow | Category | Invocation | Status | Purpose |
 | --- | --- | --- | --- | --- |
-| [self-build-adopter-dogfood.yml](../.github/workflows/self-build-adopter-dogfood.yml) | build | repository | active | V4 Adopter Delivery Dogfood |
-| [self-build-alpha-dogfood.yml](../.github/workflows/self-build-alpha-dogfood.yml) | build | repository | active | Buildchain Alpha Self-Dogfood |
-| [self-build-binary-distribution.yml](../.github/workflows/self-build-binary-distribution.yml) | build | repository | active | Binary Distribution |
-| [self-build-channel-verify.yml](../.github/workflows/self-build-channel-verify.yml) | build | repository | active | Release - Verify |
-| [self-build-demo-dogfood.yml](../.github/workflows/self-build-demo-dogfood.yml) | build | repository | active | Buildchain Declarative Demo Dogfood |
-| [self-build-demo-media-qualification.yml](../.github/workflows/self-build-demo-media-qualification.yml) | build | repository | active | Auditable Demo Media Profile Qualification |
-| [self-build-fixture.yml](../.github/workflows/self-build-fixture.yml) | build | repository | active | Build Surface Fixture |
-| [self-build-public-consumer-dogfood.yml](../.github/workflows/self-build-public-consumer-dogfood.yml) | build | repository | active | V4 Public Consumer Dogfood |
-| [self-build-stable-candidate-qualification.yml](../.github/workflows/self-build-stable-candidate-qualification.yml) | build | repository | active | Buildchain Stable Candidate Qualification |
-| [self-build-stable-dogfood.yml](../.github/workflows/self-build-stable-dogfood.yml) | build | repository | active | Buildchain Stable Self-Dogfood |
-| [self-build-verify.yml](../.github/workflows/self-build-verify.yml) | build | repository | active | Verify |
-| [self-ops-bootstrap-dogfood.yml](../.github/workflows/self-ops-bootstrap-dogfood.yml) | ops | repository | active | Universal Bootstrap Train-First Self-Dogfood |
-| [self-ops-dev-delivery.yml](../.github/workflows/self-ops-dev-delivery.yml) | ops | repository | active | Buildchain Dev Delivery |
-| [self-ops-governance-audit.yml](../.github/workflows/self-ops-governance-audit.yml) | ops | repository | active | GitHub Governance Authority Audit |
-| [self-ops-housekeeping-daily.yml](../.github/workflows/self-ops-housekeeping-daily.yml) | ops | repository | active | Engineering Housekeeper Daily |
-| [self-ops-housekeeping-monthly.yml](../.github/workflows/self-ops-housekeeping-monthly.yml) | ops | repository | active | Engineering Housekeeper Monthly |
-| [self-ops-housekeeping-weekly.yml](../.github/workflows/self-ops-housekeeping-weekly.yml) | ops | repository | active | Engineering Housekeeper Weekly |
-| [self-ops-merge-queue.yml](../.github/workflows/self-ops-merge-queue.yml) | ops | repository | active | Dev Merge Queue Governance |
-| [self-ops-patrol-daily.yml](../.github/workflows/self-ops-patrol-daily.yml) | ops | repository | active | Buildchain Dogfood Patrol Daily |
-| [self-ops-patrol-monthly.yml](../.github/workflows/self-ops-patrol-monthly.yml) | ops | repository | active | Buildchain Dogfood Patrol Monthly |
-| [self-ops-patrol-weekly.yml](../.github/workflows/self-ops-patrol-weekly.yml) | ops | repository | active | Buildchain Dogfood Patrol Weekly |
-| [self-ops-promotion-recovery.yml](../.github/workflows/self-ops-promotion-recovery.yml) | ops | repository | active | Buildchain Ref Promotion Recovery |
-| [self-ops-runner-smoke.yml](../.github/workflows/self-ops-runner-smoke.yml) | ops | repository | active | Self-hosted Runner Smoke |
-| [self-ops-stable-candidate-patrol.yml](../.github/workflows/self-ops-stable-candidate-patrol.yml) | ops | repository | active | Buildchain Dogfood Stable Candidate Patrol |
-| [self-release-binary-assets.yml](../.github/workflows/self-release-binary-assets.yml) | release | repository | active | Binary Release Assets |
-| [self-release-line-open.yml](../.github/workflows/self-release-line-open.yml) | release | repository | active | Release Line Bootstrap |
-| [self-release-next-development.yml](../.github/workflows/self-release-next-development.yml) | release | repository | active | Next Development Review |
-| [self-release-npm-dry-run.yml](../.github/workflows/self-release-npm-dry-run.yml) | release | repository | active | Publish npm package |
-| [self-release-promote.yml](../.github/workflows/self-release-promote.yml) | release | repository | active | Buildchain Ref Promotion |
-| [self-release-rehearsal-dogfood.yml](../.github/workflows/self-release-rehearsal-dogfood.yml) | release | repository | active | V4 Publication Rehearsal Dogfood |
-| [self-release-tail-dogfood.yml](../.github/workflows/self-release-tail-dogfood.yml) | release | repository | active | V4 Declarative Release Tail Dogfood |
+| [buildchain-recover.yml](../.github/workflows/buildchain-recover.yml) | ops | repository | active | Buildchain recovery |
+| [buildchain.yml](../.github/workflows/buildchain.yml) | ops | repository | active | Buildchain pipeline |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.1.3-alpha.4",
+  "version": "4.1.3-alpha.6",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/adoption/buildchain-kfd-claims.js

@@ -58,7 +58,10 @@ const WORKFLOW_AND_ACTION_FILES = Object.freeze([
   ".github/workflows/.build.yml",
   ".github/workflows/.release-promote.yml",
   ".github/workflows/public-release-promote.yml",
-  ".github/workflows/self-release-promote.yml",
+  ".github/workflows/buildchain.yml",
+  ".github/workflows/buildchain-recover.yml",
+  ".github/workflows/public-ops-pipeline.yml",
+  ".github/workflows/public-ops-recover.yml",
   ".github/workflows/public-release-artifact-attestation.yml",
   "actions/build/artifact/prepare-attestation/action.yml",
   "actions/build/artifact/prepare-attestation/index.js",
@@ -75,7 +78,6 @@ const EXTRA_KFD1_FILES = Object.freeze([
   "packages/core/index.js",
   "packages/core/build/homebrew.js",
   "packages/core/build/build-facts.js",
-  "packages/core/adoption/kfd3-surface-register.js",
   "packages/core/release/release-propagation.js",
   "scripts/generate-site-bundle.mjs",
   "packages/core/release/commands/ensure-github-release.mjs",
@@ -446,7 +448,7 @@ export function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}
     {
       name: "Buildchain standalone binary distribution",
       artifactPath: "dist/binary",
-      evidencePath: ".github/workflows/self-build-binary-distribution.yml",
+      evidencePath: ".github/workflows/.release-pipeline-products.yml",
       distribution: normalizeKfd3DistributionDeclaration({
         registrar: "shifu",
         tasks: ["binary:build"],
@@ -529,7 +531,6 @@ export function createBuildchainKfdClaimRegistry({ root = process.cwd(), sourceS
 
 export function createBuildchainKfd1Witness({ root = process.cwd(), sourceSha = "" } = {}) {
   const registry = createBuildchainKfdClaimRegistry({ root, sourceSha });
-  const registrySha256 = sha256Json(registry);
   const paths = uniquePaths([
     ...publicDocumentationFiles(root),
     ...SCHEMA_AND_STANDARD_FILES,
@@ -545,7 +546,7 @@ export function createBuildchainKfd1Witness({ root = process.cwd(), sourceSha =
     contractWorld: {
       id: "buildchain-runtime-contract-world",
       schemaId: "kungfu-buildchain-runtime-contract-world",
-      digest: `sha256:${registrySha256}`,
+      digest: `sha256:${sha256Json(registry)}`,
       owner: "Buildchain maintainers",
       selfHosted: true,
     },
@@ -584,7 +585,6 @@ export function createBuildchainKfd3PrebuildWitness({ root = process.cwd(), sour
   const registry = createBuildchainKfdClaimRegistry({ root, sourceSha });
   const surfaces = createBuildchainKfdSurfaceRegistry({ root });
   const reverseAudit = publicSurfaceAuditEvidence(root);
-  const digest = `sha256:${sha256Json(registry)}`;
   return {
     schemaVersion: 1,
     id: "buildchain-collaboration-interface",
@@ -596,7 +596,7 @@ export function createBuildchainKfd3PrebuildWitness({ root = process.cwd(), sour
       path: "dist/site/kfd-claims.json",
       sha256: fileExists(root, "dist/site/kfd-claims.json") ? sha256File(root, "dist/site/kfd-claims.json") : "",
     },
-    collaborationInterfaceDigest: digest,
+    collaborationInterfaceDigest: `sha256:${sha256Json(registry)}`,
     collaborationInterface: {
       schemaVersion: 1,
       contract: BUILDCHAIN_KFD_COLLABORATION_INTERFACE_CONTRACT,

package/packages/core/dev-delivery/dev-delivery-provider-heartbeat.js

@@ -207,29 +207,32 @@ export async function runDevDeliveryProviderHeartbeat(
   const startedAt = timestamp(now(), "provider heartbeat startedAt");
   let previousStateRoot = initial.stateRoot;
   const heartbeats = [];
+  let untilHeartbeat = 0;
   let jobs;
   try {
     while (true) {
-      const result = await heartbeat({
-        expectedOldStateRoot: previousStateRoot,
-        fencingToken: initial.fencingToken,
-        leaseGeneration: initial.generation,
-        leaseSeconds: duration,
-      });
-      const entry = heartbeatEntry(result, previousStateRoot);
-      heartbeats.push(entry);
-      previousStateRoot = entry.nextStateRoot;
+      if (untilHeartbeat === 0) {
+        const result = await heartbeat({
+          expectedOldStateRoot: previousStateRoot,
+          fencingToken: initial.fencingToken,
+          leaseGeneration: initial.generation,
+          leaseSeconds: duration,
+        });
+        const entry = heartbeatEntry(result, previousStateRoot);
+        heartbeats.push(entry);
+        previousStateRoot = entry.nextStateRoot;
+        untilHeartbeat = cadence * 1000;
+      }
       jobs = providerJobs(
         await readJobs(),
         { nativeJobName, sealJobName },
         { allowMissingSeal: true },
       );
-      if (!jobs) {
-        await wait(cadence * 1000);
-        continue;
-      }
-      if (terminal(jobs.native) && terminal(jobs.seal)) break;
-      await wait(cadence * 1000);
+      if (jobs && terminal(jobs.native) && terminal(jobs.seal)) break;
+      // Terminal detection must not wait for the next durable lease renewal.
+      const interval = Math.min(untilHeartbeat, 5000);
+      await wait(interval);
+      untilHeartbeat -= interval;
     }
   } catch (error) {
     await onHeartbeatLoss({

package/packages/core/dev-delivery/native/actions.js

@@ -6,6 +6,7 @@ import {
 } from "./transactions.js";
 import { admitProviderFinalizer } from "./finalizer-admission.js";
 import { guardPipelineAdmission } from "../../workflow/pipeline/guard.js";
+import { replaceNativeActionProcess } from "./process-entry.js";
 function request(core, env) {
   const candidate = JSON.parse(
     core.getInput("request-json", { required: true }),
@@ -23,6 +24,7 @@ function outputs(core, result) {
     core.setOutput(name, value);
 }
 export async function executeDeliveryNativeAction(core, env) {
+  replaceNativeActionProcess();
   const context = deliveryActionContext(core, env);
   const input = request(core, env);
   outputs(

package/packages/core/dev-delivery/native/process-entry.js

@@ -0,0 +1,19 @@
+// Node Actions receive artifact/OIDC authority even without token inputs.
+// Replace the process before candidate work so the original environment is
+// absent from /proc, memory and ancestry. A scrubbed child would retain it.
+export function replaceNativeActionProcess(host = process) {
+  const injected = ["ACTIONS_RUNTIME_TOKEN", "ACTIONS_ID_TOKEN_REQUEST_TOKEN"];
+  if (!injected.some((name) => host.env[name])) return;
+  if (host.platform !== "linux" || typeof host.execve !== "function") {
+    throw new Error("credentialless native action requires Linux execve");
+  }
+  const environment = { ...host.env };
+  for (const name of injected) delete environment[name];
+  // Other credential-like variables remain subject to the ancestry guard.
+  host.execve(
+    host.execPath,
+    [host.execPath, ...host.execArgv, ...host.argv.slice(1)],
+    environment,
+  );
+  throw new Error("credentialless native process replacement returned");
+}

package/packages/core/dev-delivery/queue/landing-action.js

@@ -4,12 +4,29 @@ import { admissionPolicyRequest } from "../admission/request.js";
 import { runAdmissionTransaction } from "../admission/transaction.js";
 import { enforceLanding } from "./completion.js";
 import { guardPipelineAdmission } from "../../workflow/pipeline/guard.js";
+import { githubJsonClient } from "../../providers/github/json-client.js";
+import { publishPipelineBuildStatus } from "../../workflow/pipeline/guard-build.js";
+import { publishIntegratedPipelineStatus } from "../../workflow/pipeline/integration-status.js";
+import { githubPipelineIntegration } from "../../providers/github/pipeline-integration.js";
+import { githubPipelineSource } from "../../providers/github/pipeline-source.js";
+import { githubPipelineRuns } from "../../providers/github/pipeline-runs.js";
+import { GitHubClient } from "../admission/github-client.js";
 export async function admitLandingAction(core, env) {
   const context = deliveryActionContext(core, env);
   const request = JSON.parse(core.getInput("request-json", { required: true }));
-  await guardPipelineAdmission(request, {
+  const admitted = await guardPipelineAdmission(request, {
     repository: env.GITHUB_REPOSITORY,
     token: core.getInput("token", { required: true }),
+    publishBuildStatus: (build) =>
+      publishPipelineBuildStatus(
+        request,
+        build,
+        githubJsonClient({
+          token: core.getInput("status-token", { required: true }),
+          userAgent: "buildchain-qualified-status",
+        }),
+        env.GITHUB_REPOSITORY,
+      ),
   });
   const result = await runAdmissionTransaction(
     {
@@ -45,6 +62,37 @@ export async function admitLandingAction(core, env) {
     await core.summary.addRaw(result.summary).write();
   if (!result.ok)
     throw new Error("Targeted PR was not admitted at its expected head");
+  if (admitted) {
+    const repository = env.GITHUB_REPOSITORY;
+    const token = core.getInput("token", { required: true });
+    const read = githubJsonClient({
+      token,
+      userAgent: "buildchain-integration-status",
+    });
+    const [owner, repo] = repository.split("/");
+    const queue = new GitHubClient({ repository: { owner, repo }, token });
+    await publishIntegratedPipelineStatus(
+      {
+        ...admitted.history.at(-1),
+        intent: admitted.intent,
+      },
+      {
+        repository,
+        request: read,
+        queue: (branch) => queue.getMergeQueueState(branch),
+        integration: githubPipelineIntegration(
+          read,
+          repository,
+          githubPipelineSource(read, repository),
+          githubPipelineRuns(read, repository),
+        ),
+        status: githubJsonClient({
+          token: core.getInput("status-token", { required: true }),
+          userAgent: "buildchain-qualified-integration-status",
+        }),
+      },
+    );
+  }
 }
 export function completeDeliveryAction(core) {
   enforceLanding({

package/packages/core/dev-delivery/warrant/failure-settlement.js

@@ -11,13 +11,15 @@ export function verifyFailureSettlement(result, settlement, stateRoot) {
       result.receipt.evidenceRoot === settlement.evidenceRoot,
     "Failure settlement receipt does not bind its exact evidence and prior state",
   );
-  const candidate = result.observation?.candidates?.find(
-    (item) =>
-      item.pullRequestNumber === settlement.pullRequestNumber &&
-      item.sourceHead === settlement.sourceHead &&
-      item.terminal?.evidenceRoot === settlement.evidenceRoot,
+  const candidate = result.terminalCandidate;
+  requireValue(
+    candidate?.candidateId === result.receipt.candidateId &&
+      candidate?.pullRequestNumber === settlement.pullRequestNumber &&
+      candidate?.sourceHead === settlement.sourceHead &&
+      candidate?.status === "terminal-failure" &&
+      candidate?.terminal?.evidenceRoot === settlement.evidenceRoot,
+    "Failure settlement terminal candidate is missing",
   );
-  requireValue(candidate, "Failure settlement terminal candidate is missing");
   for (const key of [
     "transferRoot",
     "finalizerBoundaryRoot",

package/packages/core/dev-delivery/warrant/service.js

@@ -104,6 +104,13 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     concurrencyRecovery,
     receipt: persisted.changed.receipt,
     receiptRoot: persisted.changed.receiptRoot,
+    terminalCandidate:
+      options.command === "settle"
+        ? persisted.changed.queue.candidates.find(
+            (candidate) =>
+              candidate.candidateId === persisted.changed.receipt.candidateId,
+          ) || null
+        : null,
     warrant:
       persisted.changed.warrant ||
       persisted.changed.queue.activeWarrant ||

package/packages/core/governance/buildchain-publication-authority.js

@@ -4,6 +4,8 @@ import path from "node:path";
 import { createPublicationAuthorityRegistry } from "../publication/publication-authority.js";
 
 const DESCRIPTORS = Object.freeze([
+  [".github/workflows/buildchain.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
+  [".github/workflows/buildchain-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
   [".github/workflows/public-release-oci-compose-preview.yml", "product-publication", true, ["oci-compose-preview"], "caller-secrets", "none", "fixed", "caller-bound"],
   [".github/workflows/.build-demo-adapter.yml", "non-publication-oidc"],
   [".github/workflows/public-build-demo.yml", "governance-write"],
@@ -16,28 +18,14 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/public-release-web.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
   [".github/workflows/.build-wheel-verify-compat.yml", "retired-deny"],
   [".github/workflows/.release-binary-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
-  [".github/workflows/self-build-binary-distribution.yml", "evidence-publication"],
-  [".github/workflows/self-release-binary-assets.yml", "governance-write"],
   [".github/workflows/public-release-signing-authority.yml", "evidence-publication"],
-  [".github/workflows/self-build-demo-dogfood.yml", "governance-write"],
-  [".github/workflows/self-build-fixture.yml", "non-publication-oidc"],
   [".github/workflows/build.yml", "non-publication-oidc"],
   [".github/workflows/public-ops-bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-build-alpha-dogfood.yml", "non-publication-oidc"],
-  [".github/workflows/self-build-stable-dogfood.yml", "non-publication-oidc"],
-  [".github/workflows/self-ops-dev-delivery.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-daily.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-monthly.yml", "governance-write"],
-  [".github/workflows/self-ops-patrol-weekly.yml", "governance-write"],
   [".github/workflows/public-ops-patrol.yml", "governance-write"],
-  [".github/workflows/self-ops-promotion-recovery.yml", "governance-write"],
-  [".github/workflows/self-release-promote.yml", "governance-write"],
-  [".github/workflows/self-ops-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/public-ops-dev-qualification-patrol.yml", "governance-write"],
   [".github/workflows/public-ops-alpha-candidate-patrol.yml", "governance-write"],
   [".github/workflows/public-ops-warrant-close.yml", "governance-write"],
   [".github/workflows/public-ops-warrant-cancel.yml", "governance-write"],
-  [".github/workflows/self-ops-merge-queue.yml", "governance-write"],
   [".github/workflows/public-ops-dev-auto-merge.yml", "governance-write"],
   [".github/workflows/public-ops-pipeline.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
   [".github/workflows/public-ops-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
@@ -45,13 +33,8 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/.release-pipeline-products.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed"],
   [".github/workflows/.release-pipeline-version.yml", "governance-write"],
   [".github/workflows/.ops-pipeline-delivery.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-daily.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-monthly.yml", "governance-write"],
-  [".github/workflows/self-ops-housekeeping-weekly.yml", "governance-write"],
   [".github/workflows/public-ops-housekeeping.yml", "governance-write"],
-  [".github/workflows/self-ops-governance-audit.yml", "governance-write"],
   [".github/workflows/public-release-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/self-release-npm-dry-run.yml", "dry-run-only"],
   [".github/workflows/public-release-paper.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/public-ops-patrol-daily.yml", "governance-write"],
   [".github/workflows/public-ops-patrol-monthly.yml", "governance-write"],
@@ -59,13 +42,9 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/public-ops-patrol-weekly.yml", "governance-write"],
   [".github/workflows/public-build-publication.yml", "evidence-publication"],
   [".github/workflows/public-release-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-release-line-open.yml", "governance-write"],
   [".github/workflows/public-release-propagation.yml", "governance-write"],
   [".github/workflows/public-release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
-  [".github/workflows/self-build-release-verify-compat.yml", "governance-write"],
   [".github/workflows/public-ops-stable-candidate-patrol.yml", "governance-write"],
-  [".github/workflows/self-ops-bootstrap-dogfood.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
-  [".github/workflows/self-release-tail-dogfood.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "none", "fixed", "fixed"],
 ]);
 
 export function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) {

package/packages/core/governance/github-governance-authority.js

@@ -1257,6 +1257,7 @@ export function createGithubRulesetGovernanceRolloutPlan({
       dismiss_stale_reviews_on_push: true,
       require_code_owner_review: true,
       require_last_push_approval: true,
+      require_extra_approval_for_unattributed_changes: true,
       required_approving_review_count: requiredApprovals,
       required_review_thread_resolution: true,
     },

package/packages/core/observability/controller-evidence.js

@@ -124,14 +124,6 @@ const CONTROLLER_SPECS = [
     ],
     evidence: ["propagation-plan", "propagation-lock", "controller-receipt"],
   },
-  {
-    id: "binary-distribution",
-    workflowId: "binary-distribution",
-    version: 1,
-    capabilities: ["standalone-binary-build", "release-evidence-bundle", "artifact-admission"],
-    stages: ["resolve-runtime", "build", "verify", "bundle", "aggregate"],
-    evidence: ["release-evidence-bundle", "release-passport", "controller-receipt"],
-  },
 ];
 
 function stableJson(value) {

package/packages/core/providers/github/pipeline-entry-runs.js

@@ -167,8 +167,15 @@ export async function pipelineEntryCheck(run, host) {
 
 function exactCheck(checks, run, repository) {
   const url = `https://github.com/${repository}/actions/runs/${run.id}/attempts/${run.run_attempt}`;
+  // Actions may replace details_url with the check's own provider URL. Its
+  // exact external execution identity still binds the original native receipt.
   const matches = checks.filter(
-    (check) => check.name === "check" && check.details_url === url,
+    (check) =>
+      check.name === "check" &&
+      (check.details_url === url ||
+        (check.details_url ===
+          `https://github.com/${repository}/runs/${check.id}` &&
+          check.external_id?.endsWith(`:${run.id}:${run.run_attempt}`))),
   );
   if (!matches.length) return null;
   const values = matches.map((check) => {