@kungfu-tech/buildchain 4.1.3-alpha.4 → 4.1.3-alpha.6

package/architecture/minimal-consumer-migration.json

@@ -1,6 +1,6 @@
 {
   "schema": "buildchain.consumer-migration/v1",
-  "stage": "contract-defined; execution-entry-not-yet-published",
+  "stage": "self-cutover-in-progress; final-release-qualification-pending",
   "workflows": [
     {
       "path": ".github/workflows/build.yml",
@@ -92,6 +92,68 @@
         }
       ]
     },
+    {
+      "path": ".github/workflows/buildchain-recover.yml",
+      "role": "self",
+      "events": ["workflow_dispatch"],
+      "secrets": [],
+      "outputs": [],
+      "destination": "self-dogfood.two-callers-or-internal-component",
+      "interfaces": [
+        {
+          "trigger": "workflow_dispatch",
+          "name": "attempt",
+          "definition": {
+            "description": "Exact Buildchain attempt to recover",
+            "required": true,
+            "type": "string"
+          },
+          "destination": "attempt.material-index"
+        },
+        {
+          "trigger": "workflow_dispatch",
+          "name": "runtime-ref",
+          "definition": {
+            "description": "Optional repaired runtime",
+            "required": false,
+            "type": "string"
+          },
+          "destination": "recovery-entry.runtime-ref"
+        }
+      ],
+      "calls": [
+        {
+          "id": "buildchain",
+          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-recover.yml@v4-alpha",
+          "inputs": ["attempt", "runtime-ref"],
+          "destination": "internal.workflow-composition"
+        }
+      ]
+    },
+    {
+      "path": ".github/workflows/buildchain.yml",
+      "role": "self",
+      "events": [
+        "merge_group",
+        "pull_request",
+        "pull_request_review",
+        "pull_request_target",
+        "push",
+        "repository_dispatch"
+      ],
+      "secrets": [],
+      "outputs": [],
+      "destination": "self-dogfood.two-callers-or-internal-component",
+      "interfaces": [],
+      "calls": [
+        {
+          "id": "buildchain",
+          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-pipeline.yml@v4-alpha",
+          "inputs": ["config-path"],
+          "destination": "internal.workflow-composition"
+        }
+      ]
+    },
     {
       "path": ".github/workflows/public-build-adopter-qualification.yml",
       "role": "public",
@@ -5043,1991 +5105,30 @@
           "destination": "internal.workflow-composition"
         }
       ]
-    },
-    {
-      "path": ".github/workflows/self-build-adopter-dogfood.yml",
-      "role": "self",
-      "events": ["workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [],
-      "calls": [
-        {
-          "id": "dogfood",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-build-adopter-qualification.yml@v4",
-          "inputs": ["consumer", "input-path"],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-build-alpha-dogfood.yml",
-      "role": "self",
-      "events": ["schedule", "workflow_dispatch", "workflow_run"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [],
-      "calls": [
-        {
-          "id": "alpha-consumer",
-          "uses": "kungfu-systems/buildchain/.github/workflows/build.yml@v4-alpha",
-          "inputs": [],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-build-binary-distribution.yml",
-      "role": "self",
-      "events": ["push", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "tag",
-          "definition": {
-            "description": "Exact v4 release tag; dispatch this workflow at the same tag.",
-            "required": true
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": []
-    },
-    {
-      "path": ".github/workflows/self-build-channel-verify.yml",
-      "role": "self",
-      "events": ["pull_request"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [],
-      "calls": []
-    },
+    }
+  ],
+  "consumerSources": [
     {
-      "path": ".github/workflows/self-build-demo-dogfood.yml",
-      "role": "self",
-      "events": ["push", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "mode",
-          "definition": {
-            "description": "Run the required Gate only, or Gate plus native media rendering",
-            "required": true,
-            "default": "full",
-            "type": "choice",
-            "options": ["gate-only", "full"]
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "materialize",
-          "definition": {
-            "description": "Open or update the protected README media pull request",
-            "required": true,
-            "default": false,
-            "type": "boolean"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "base-ref",
-          "definition": {
-            "description": "Target branch for the protected README media pull request",
-            "required": true,
-            "default": "dev/v4/v4.1",
-            "type": "string"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": [
-        {
-          "id": "dogfood",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-build-demo.yml@v4",
-          "inputs": [
-            "artifact-retention-days",
-            "binary-artifact-digest",
-            "binary-artifact-name",
-            "materialize",
-            "materialize-base-ref",
-            "media-profile",
-            "render-media",
-            "renderer-image",
-            "runtime-selection",
-            "scenario-path",
-            "source-ref"
-          ],
-          "destination": "internal.workflow-composition"
-        }
-      ]
+      "path": ".buildchain/alpha-contract-lock.json",
+      "kind": "consumer-source",
+      "destination": "retain-product-source; move-orchestration-into-runtime",
+      "commandReferences": []
     },
     {
-      "path": ".github/workflows/self-build-demo-media-qualification.yml",
-      "role": "self",
-      "events": ["pull_request", "push", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": []
-    },
-    {
-      "path": ".github/workflows/self-build-fixture.yml",
-      "role": "self",
-      "events": ["pull_request", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-run-id",
-          "definition": {
-            "description": "Original failed fixture build; preserve its source and valid checkpoints.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": [
-        {
-          "id": "libnode-shaped",
-          "uses": "kungfu-systems/buildchain/.github/workflows/build.yml@v4",
-          "inputs": ["config-path", "runtime-selection"],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-build-public-consumer-dogfood.yml",
-      "role": "self",
-      "events": ["pull_request", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient runtime selected by the public entry.",
-            "type": "string",
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        }
-      ],
-      "calls": [
-        {
-          "id": "dogfood",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml@v4",
-          "inputs": [
-            "build-artifact-path",
-            "consumer",
-            "go-version",
-            "install-artifact-path",
-            "node-version",
-            "runtime-ref",
-            "verify-artifact-path"
-          ],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-build-stable-candidate-qualification.yml",
-      "role": "self",
-      "events": ["workflow_dispatch", "workflow_run"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "run-id",
-          "definition": {
-            "description": "Successful public zero-input build run to qualify",
-            "required": true,
-            "type": "string"
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": []
-    },
-    {
-      "path": ".github/workflows/self-build-stable-dogfood.yml",
-      "role": "self",
-      "events": ["schedule", "workflow_dispatch", "workflow_run"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [],
-      "calls": [
-        {
-          "id": "stable-consumer",
-          "uses": "kungfu-systems/buildchain/.github/workflows/build.yml@v4",
-          "inputs": [],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-build-verify.yml",
-      "role": "self",
-      "events": ["merge_group", "pull_request", "push", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": []
-    },
-    {
-      "path": ".github/workflows/self-ops-bootstrap-dogfood.yml",
-      "role": "self",
-      "events": ["pull_request", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "request-json",
-          "definition": {
-            "description": "Optional typed request passed through the public Bootstrap API.",
-            "required": false,
-            "default": "",
-            "type": "string"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "candidate-sha",
-          "definition": {
-            "description": "Exact candidate SHA",
-            "required": true,
-            "type": "string"
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "pull-request",
-          "definition": {
-            "description": "Same-repository candidate-to-dev review PR",
-            "required": true,
-            "type": "number"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "consumer-sha",
-          "definition": {
-            "description": "Exact unchanged Buildchain consumer SHA",
-            "required": true,
-            "type": "string"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "recovery-runtime-ref",
-          "definition": {
-            "description": "Transient repaired runtime used through the same public entry.",
-            "required": false,
-            "type": "string",
-            "default": ""
-          },
-          "destination": "attempt.material-index"
-        }
-      ],
-      "calls": [
-        {
-          "id": "primary-conformance",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4",
-          "inputs": ["request-json", "runtime-ref"],
-          "destination": "internal.workflow-composition"
-        },
-        {
-          "id": "recovery-conformance",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4",
-          "inputs": ["request-json", "runtime-ref"],
-          "destination": "internal.workflow-composition"
-        },
-        {
-          "id": "primary-alpha",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4",
-          "inputs": ["request-json", "runtime-ref"],
-          "destination": "internal.workflow-composition"
-        },
-        {
-          "id": "recovery-alpha",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4",
-          "inputs": ["request-json", "runtime-ref"],
-          "destination": "internal.workflow-composition"
-        },
-        {
-          "id": "primary-stable",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4",
-          "inputs": ["request-json", "runtime-ref"],
-          "destination": "internal.workflow-composition"
-        },
-        {
-          "id": "recovery-stable",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4",
-          "inputs": ["request-json", "runtime-ref"],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-ops-dev-delivery.yml",
-      "role": "self",
-      "events": ["repository_dispatch", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "target-branch",
-          "definition": {
-            "description": "Exact protected development branch",
-            "type": "string",
-            "required": false,
-            "default": "dev/v4/v4.1"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "expected-pr-number",
-          "definition": {
-            "description": "Exact Buildchain PR number",
-            "type": "number",
-            "required": true
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "expected-head-sha",
-          "definition": {
-            "description": "Exact 40-character PR head",
-            "type": "string",
-            "required": true
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "native-roots-json",
-          "definition": {
-            "description": "Machine-supplied canonical Work sourceRoot",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "source-workflow-run-id",
-          "definition": {
-            "description": "Exact successful source workflow run",
-            "type": "number",
-            "required": false,
-            "default": 0
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "source-identity-root",
-          "definition": {
-            "description": "Immutable semantic source identity root",
-            "type": "string",
-            "required": true
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "source-patch-root",
-          "definition": {
-            "description": "Immutable source patch or tree-intent root",
-            "type": "string",
-            "required": true
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "plan-root",
-          "definition": {
-            "description": "Exact qualification plan root",
-            "type": "string",
-            "required": true
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "closure-root",
-          "definition": {
-            "description": "Exact affected-closure root",
-            "type": "string",
-            "required": true
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "dependency-root",
-          "definition": {
-            "description": "Exact dependency-graph root",
-            "type": "string",
-            "required": true
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "toolchain-root",
-          "definition": {
-            "description": "Exact qualification toolchain root",
-            "type": "string",
-            "required": true
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "environment-root",
-          "definition": {
-            "description": "Exact pre-spawn native environment root",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "affected-paths-json",
-          "definition": {
-            "description": "Optional covered paths; an empty array reconstructs the exact source run paths",
-            "type": "string",
-            "required": false,
-            "default": "[]"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "shard-evidence-roots-json",
-          "definition": {
-            "description": "Exact rooted native shard evidence JSON",
-            "type": "string",
-            "required": false,
-            "default": "[]"
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "release-blocker-priority-json",
-          "definition": {
-            "description": "Optional exact rooted release-blocker priority claim",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "native-proof-json",
-          "definition": {
-            "description": "Optional reusable semantic native proof",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "native-command",
-          "definition": {
-            "description": "Slow native qualification command",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "native-command-root",
-          "definition": {
-            "description": "Optional exact native command contract root",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "native-heartbeat-seconds",
-          "definition": {
-            "description": "Native qualification heartbeat cadence",
-            "type": "number",
-            "required": false,
-            "default": 30
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "delivery-class",
-          "definition": {
-            "description": "Bounded delivery class",
-            "type": "string",
-            "required": false,
-            "default": "native-proof-required"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "delivery-priority",
-          "definition": {
-            "description": "Reviewed delivery priority",
-            "type": "string",
-            "required": false,
-            "default": "ordinary"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        }
-      ],
-      "calls": [
-        {
-          "id": "deliver",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-dev-auto-merge.yml@v4",
-          "inputs": [
-            "active-lease-context",
-            "affected-paths-json",
-            "allowed-head-prefixes",
-            "block-labels",
-            "closure-root",
-            "delivery-class",
-            "delivery-priority",
-            "delivery-warrant-mode",
-            "dependency-root",
-            "dry-run",
-            "environment-root",
-            "expected-head-sha",
-            "expected-pr-number",
-            "handoff-workflow-id",
-            "landing-mode",
-            "native-command",
-            "native-command-root",
-            "native-heartbeat-seconds",
-            "native-proof-json",
-            "plan-root",
-            "queue-admission-context",
-            "ready-label",
-            "release-blocker-priority-json",
-            "required-status-checks",
-            "runtime-ref",
-            "shard-evidence-roots-json",
-            "source-identity-root",
-            "source-patch-root",
-            "source-root",
-            "source-workflow-run-id",
-            "target-branch",
-            "toolchain-root"
-          ],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-ops-governance-audit.yml",
-      "role": "self",
-      "events": [
-        "merge_group",
-        "pull_request",
-        "schedule",
-        "workflow_dispatch"
-      ],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": []
-    },
-    {
-      "path": ".github/workflows/self-ops-housekeeping-daily.yml",
-      "role": "self",
-      "events": ["schedule", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "mode",
-          "definition": {
-            "description": "Report by default; apply also requires apply-enabled.",
-            "type": "choice",
-            "options": ["report", "apply"],
-            "default": "report"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "apply-enabled",
-          "definition": {
-            "description": "Explicit positive mutation gate.",
-            "type": "boolean",
-            "default": false
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": [
-        {
-          "id": "report",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-housekeeping.yml@v4",
-          "inputs": ["max-actions", "mode", "runtime-selection", "stale-days"],
-          "destination": "internal.workflow-composition"
-        },
-        {
-          "id": "apply",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-housekeeping.yml@v4",
-          "inputs": [
-            "apply-enabled",
-            "max-actions",
-            "mode",
-            "runtime-selection",
-            "stale-days",
-            "stale-pull-request-label"
-          ],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-ops-housekeeping-monthly.yml",
-      "role": "self",
-      "events": ["schedule", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "mode",
-          "definition": {
-            "description": "Report by default; apply also requires apply-enabled.",
-            "type": "choice",
-            "options": ["report", "apply"],
-            "default": "report"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "apply-enabled",
-          "definition": {
-            "description": "Explicit positive mutation gate.",
-            "type": "boolean",
-            "default": false
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": [
-        {
-          "id": "report",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-housekeeping.yml@v4",
-          "inputs": ["max-actions", "mode", "runtime-selection", "stale-days"],
-          "destination": "internal.workflow-composition"
-        },
-        {
-          "id": "apply",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-housekeeping.yml@v4",
-          "inputs": [
-            "apply-enabled",
-            "max-actions",
-            "mode",
-            "runtime-selection",
-            "stale-days",
-            "stale-pull-request-label"
-          ],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-ops-housekeeping-weekly.yml",
-      "role": "self",
-      "events": ["schedule", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "mode",
-          "definition": {
-            "description": "Report by default; apply also requires apply-enabled.",
-            "type": "choice",
-            "options": ["report", "apply"],
-            "default": "report"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "apply-enabled",
-          "definition": {
-            "description": "Explicit positive mutation gate.",
-            "type": "boolean",
-            "default": false
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": [
-        {
-          "id": "report",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-housekeeping.yml@v4",
-          "inputs": ["max-actions", "mode", "runtime-selection", "stale-days"],
-          "destination": "internal.workflow-composition"
-        },
-        {
-          "id": "apply",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-housekeeping.yml@v4",
-          "inputs": [
-            "apply-enabled",
-            "max-actions",
-            "mode",
-            "runtime-selection",
-            "stale-days",
-            "stale-pull-request-label"
-          ],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-ops-merge-queue.yml",
-      "role": "self",
-      "events": ["push", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "branch",
-          "definition": {
-            "description": "Protected Buildchain dev branch",
-            "required": true,
-            "type": "string"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "apply",
-          "definition": {
-            "description": "Apply the reconciled policy after emitting the plan",
-            "required": false,
-            "default": false,
-            "type": "boolean"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": []
-    },
-    {
-      "path": ".github/workflows/self-ops-patrol-daily.yml",
-      "role": "self",
-      "events": ["schedule", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "dry-run",
-          "definition": {
-            "description": "Plan only; do not mutate repository state",
-            "required": false,
-            "type": "boolean",
-            "default": false
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        }
-      ],
-      "calls": [
-        {
-          "id": "patrol",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-patrol-daily.yml@v4",
-          "inputs": [
-            "dry-run",
-            "landing-mode",
-            "max-actions",
-            "required-status-checks",
-            "runtime-ref"
-          ],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-ops-patrol-monthly.yml",
-      "role": "self",
-      "events": ["schedule", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "dry-run",
-          "definition": {
-            "description": "Plan only; do not mutate repository state",
-            "required": false,
-            "type": "boolean",
-            "default": true
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        }
-      ],
-      "calls": [
-        {
-          "id": "patrol",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-patrol-monthly.yml@v4",
-          "inputs": ["dry-run", "runtime-ref"],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-ops-patrol-weekly.yml",
-      "role": "self",
-      "events": ["schedule", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "dry-run",
-          "definition": {
-            "description": "Plan only; do not mutate repository state",
-            "required": false,
-            "type": "boolean",
-            "default": true
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        }
-      ],
-      "calls": [
-        {
-          "id": "patrol",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-patrol-weekly.yml@v4",
-          "inputs": ["dry-run", "runtime-ref"],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-ops-promotion-recovery.yml",
-      "role": "self",
-      "events": ["workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "sha",
-          "definition": {
-            "description": "Exact protected v4 channel commit that owns the recovery",
-            "required": true
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "target-ref",
-          "definition": {
-            "description": "Exact protected v4 alpha or stable channel branch",
-            "required": true,
-            "default": "alpha/v4/v4.1"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "dry-run",
-          "definition": {
-            "description": "Only print planned publication changes",
-            "required": true,
-            "default": true,
-            "type": "boolean"
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-candidate-repository",
-          "definition": {
-            "description": "Repository that owns the sealed candidate run; empty rematerializes a fresh candidate"
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-candidate-run-id",
-          "definition": {
-            "description": "Exact successful Build Surface Fixture run ID; empty rematerializes a fresh candidate"
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-expected-source-tree",
-          "definition": {
-            "description": "Exact Git tree recorded for the sealed candidate"
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-expected-candidate-root",
-          "definition": { "description": "Optional exact candidate root" },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-discussion-id",
-          "definition": {
-            "description": "Existing release Discussion ID whose retained materials will be recovered.",
-            "type": "string",
-            "default": ""
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-transaction-id",
-          "definition": {
-            "description": "Exact durable publication transaction identity; required only when resuming a sealed candidate"
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "release-passport-v4-runtime-resume-evidence-json",
-          "definition": {
-            "description": "Optional precomputed runtime A+B Stage Capsule resume evidence JSON"
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        }
-      ],
-      "calls": [
-        {
-          "id": "resume",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-release-promote.yml@v4",
-          "inputs": ["request-json", "runtime-ref"],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-ops-runner-smoke.yml",
-      "role": "self",
-      "events": ["workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": []
-    },
-    {
-      "path": ".github/workflows/self-ops-stable-candidate-patrol.yml",
-      "role": "self",
-      "events": ["schedule", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "release-now",
-          "definition": {
-            "description": "Exact alpha selected by explicit human authority",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "dry-run",
-          "definition": {
-            "description": "Evaluate without durable ledger or promotion writes",
-            "required": false,
-            "type": "boolean",
-            "default": false
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        }
-      ],
-      "calls": [
-        {
-          "id": "patrol",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-ops-stable-candidate-patrol.yml@v4",
-          "inputs": ["auto-approve", "dry-run", "release-now", "runtime-ref"],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-release-binary-assets.yml",
-      "role": "self",
-      "events": ["workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "evidence-run-id",
-          "definition": {
-            "description": "Successful Binary Distribution run id.",
-            "required": true
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "release-tag",
-          "definition": {
-            "description": "Existing v* release tag.",
-            "required": true
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "publication-used-nonces-json",
-          "definition": {
-            "description": "JSON array of already consumed admission nonces.",
-            "required": true,
-            "default": "[]"
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": [
-        {
-          "id": "publish",
-          "uses": "./.github/workflows/.release-binary-assets.yml",
-          "inputs": [
-            "auto-admission",
-            "evidence-run-id",
-            "publication-used-nonces-json",
-            "publication-version",
-            "release-tag",
-            "runtime-selection",
-            "source-sha",
-            "target-ref"
-          ],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-release-line-open.yml",
-      "role": "self",
-      "events": ["workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "major",
-          "definition": {
-            "description": "Semver major number, for example 2",
-            "required": true,
-            "type": "string"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "minor",
-          "definition": {
-            "description": "Semver minor number, for example 10",
-            "required": true,
-            "type": "string"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "source-ref",
-          "definition": {
-            "description": "Existing ref used as the baseline for alpha/release branches",
-            "required": true,
-            "type": "string"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "initial-version",
-          "definition": {
-            "description": "Initial dev version. Defaults to <major>.<minor>.0-alpha.0",
-            "required": false,
-            "default": "",
-            "type": "string"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "apply",
-          "definition": {
-            "description": "Create refs, protection, default branch, and alpha PR",
-            "required": false,
-            "default": false,
-            "type": "boolean"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "required-status-check",
-          "definition": {
-            "description": "Exact required branch-protection check context",
-            "required": false,
-            "default": "check",
-            "type": "string"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "create-alpha-pr",
-          "definition": {
-            "description": "Open dev -> alpha channel PR",
-            "required": false,
-            "default": true,
-            "type": "boolean"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "set-default-branch",
-          "definition": {
-            "description": "Switch repository default branch to the new dev line",
-            "required": false,
-            "default": true,
-            "type": "boolean"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": []
-    },
-    {
-      "path": ".github/workflows/self-release-next-development.yml",
-      "role": "self",
-      "events": ["workflow_run"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [],
-      "calls": []
-    },
-    {
-      "path": ".github/workflows/self-release-npm-dry-run.yml",
-      "role": "self",
-      "events": ["workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "ref",
-          "definition": {
-            "description": "Ref to dry-run. Defaults to the selected workflow ref.",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "run-check",
-          "definition": {
-            "description": "Run the full Buildchain check before npm publish dry-run.",
-            "required": true,
-            "default": true,
-            "type": "boolean"
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": []
-    },
-    {
-      "path": ".github/workflows/self-release-promote.yml",
-      "role": "self",
-      "events": ["workflow_dispatch", "workflow_run"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "sha",
-          "definition": {
-            "description": "Verified alpha/release commit to promote. Defaults to the current workflow ref SHA.",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "target-ref",
-          "definition": {
-            "description": "Buildchain channel branch to promote",
-            "required": true,
-            "default": "alpha/v4/v4.1"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "dry-run",
-          "definition": {
-            "description": "Only print planned tag updates",
-            "required": true,
-            "default": "true"
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "recover-durable-transaction",
-          "definition": {
-            "description": "Recover an existing durable transaction from its exact original source SHA using fresh GitHub-hosted admission",
-            "required": true,
-            "default": false,
-            "type": "boolean"
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "publication-admission-json",
-          "definition": {
-            "description": "Fresh sealed admission JSON required for manual apply",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "publication-runner-provenance-json",
-          "definition": {
-            "description": "Runner provenance receipt JSON bound by the admission",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "publication-control-plane-audit-json",
-          "definition": {
-            "description": "Fresh external control-plane audit receipt JSON",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "publication-gate-aggregate-json",
-          "definition": {
-            "description": "Qualifying Shifu Gate aggregate or explicit consumer-owned no-Gate decision",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "publication-expected-json",
-          "definition": {
-            "description": "Independent exact publication bindings JSON",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "publication-used-nonces-json",
-          "definition": {
-            "description": "JSON array of consumed admission nonces",
-            "required": false,
-            "default": "[]"
-          },
-          "destination": "attempt.internal-authority"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "release-passport-v4-runtime-resume-evidence-json",
-          "definition": {
-            "description": "Verified runtime A+B Stage Capsule resume evidence JSON",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-candidate-repository",
-          "definition": {
-            "description": "Repository that owns the sealed candidate run",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-candidate-run-id",
-          "definition": {
-            "description": "Exact successful Build Surface Fixture run ID to recover",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-expected-source-tree",
-          "definition": {
-            "description": "Exact Git tree recorded for the candidate",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-expected-candidate-root",
-          "definition": {
-            "description": "Optional exact sha256 Release Candidate root",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-discussion-id",
-          "definition": {
-            "description": "Existing release Discussion ID whose retained materials will be recovered.",
-            "type": "string",
-            "default": ""
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "resume-transaction-id",
-          "definition": {
-            "description": "Optional existing durable transaction identity",
-            "required": false,
-            "default": ""
-          },
-          "destination": "attempt.material-index"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "runtime-ref",
-          "definition": {
-            "description": "Transient execution runtime; empty selects the consumer lock.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "recovery-entry.runtime-ref"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "contract-lock",
-          "definition": {
-            "description": "Optional consumer runtime lock path.",
-            "type": "string",
-            "required": false,
-            "default": ""
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": [
-        {
-          "id": "promote",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-release-promote.yml@v4",
-          "inputs": ["request-json", "runtime-selection"],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-release-rehearsal-dogfood.yml",
-      "role": "self",
-      "events": ["pull_request", "workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [],
-      "calls": [
-        {
-          "id": "rehearsal",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-release-tail.yml@v4",
-          "inputs": [
-            "candidate-root",
-            "execute",
-            "rehearsal-capsule-path",
-            "rehearsal-evidence-path",
-            "rehearsal-mode",
-            "state-path"
-          ],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    },
-    {
-      "path": ".github/workflows/self-release-tail-dogfood.yml",
-      "role": "self",
-      "events": ["workflow_dispatch"],
-      "secrets": [],
-      "outputs": [],
-      "destination": "self-dogfood.two-callers-or-internal-component",
-      "interfaces": [
-        {
-          "trigger": "workflow_dispatch",
-          "name": "target-sha",
-          "definition": {
-            "description": "Exact protected alpha/v4/v4.1 candidate SHA",
-            "required": true,
-            "type": "string"
-          },
-          "destination": "internal.plan-derived-input"
-        },
-        {
-          "trigger": "workflow_dispatch",
-          "name": "failure-after-capability",
-          "definition": {
-            "description": "Checkpointed capability after which the first provider invocation is interrupted",
-            "default": "artifact.publish",
-            "required": false,
-            "type": "string"
-          },
-          "destination": "internal.plan-derived-input"
-        }
-      ],
-      "calls": [
-        {
-          "id": "publish",
-          "uses": "kungfu-systems/buildchain/.github/workflows/public-release-promote.yml@v4",
-          "inputs": ["request-json"],
-          "destination": "internal.workflow-composition"
-        }
-      ]
-    }
-  ],
-  "consumerSources": [
-    {
-      "path": ".buildchain/alpha-contract-lock.json",
-      "kind": "consumer-source",
-      "destination": "retain-product-source; move-orchestration-into-runtime",
-      "commandReferences": []
-    },
-    {
-      "path": ".buildchain/auditable-demo.json",
-      "kind": "consumer-source",
-      "destination": "retain-product-source; move-orchestration-into-runtime",
-      "commandReferences": []
+      "path": ".buildchain/auditable-demo.json",
+      "kind": "consumer-source",
+      "destination": "retain-product-source; move-orchestration-into-runtime",
+      "commandReferences": []
     },
     {
       "path": ".buildchain/buildchain.toml",
       "kind": "config",
       "destination": "closed-toml-plan",
       "commandReferences": [
-        "packages/core/publication/commands/npm-publish-transaction.mjs",
-        "scripts/generate-site-bundle.mjs"
+        "scripts/build-standalone-binary.mjs",
+        "scripts/prepare-product-toolchain.mjs",
+        "scripts/verify-product-platform.mjs",
+        "scripts/verify-standalone-product.mjs"
       ]
     },
     {
@@ -7042,6 +5143,8 @@
       "destination": "closed-toml-plan",
       "commandReferences": [
         "scripts/build-standalone-binary.mjs",
+        "scripts/prepare-product-toolchain.mjs",
+        "scripts/verify-product-platform.mjs",
         "scripts/verify-standalone-product.mjs"
       ]
     },