@kungfu-tech/buildchain 4.1.3-alpha.5 → 4.1.3-alpha.6

package/AGENTS.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-11
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-11
+  generated_at: 2026-09-14
   visible_context: Buildchain 4.1 source, architecture registries and local validation.
   invisible_context_boundary: No unpublished release or external consumer qualification is claimed.
 ---
@@ -38,52 +38,27 @@ restating them.
 
 ## Using this repo as a Buildchain consumer
 
-Ordinary builds read project configuration from `buildchain.toml`. Single-project
-consumers call the public workflow with no inputs:
-
-```yaml
-uses: kungfu-systems/buildchain/.github/workflows/build.yml@v4
-```
-
-The public workflow is the API entry. It selects the execution runtime from a
-trusted non-persistent runtime input (`runtime-ref`), the selected consumer
-contract lock, or the entry commit default. `@v4-alpha` selects the alpha entry
-and its default lock path. Entry and runtime commits may differ. See
-[`Runtime entry`](docs/runtime-entry.md) for selection and recovery.
-
-Project settings belong in TOML; `config-path` locates a nested project. All
-execution jobs prepare the selected runtime through
-`actions/runtime/environment/prepare`. Subsequent business actions use that
-runtime without Buildchain SHA comparisons or secondary runtime admission.
-
-For new repositories, prefer the CLI:
-
-```sh
-npx @kungfu-tech/buildchain init --type package
-npx @kungfu-tech/buildchain validate --require-version-state
-npx @kungfu-tech/buildchain release --dry-run --target-ref alpha/v4/v4.1
-```
-
-For governed Paper repositories, scaffold or migrate the repository once, then
-follow the generated `AGENTS.md` entry contract. Work begins and ends through
-the pinned pnpm scripts:
-
-```sh
-pnpm paper:agent:verify
-pnpm paper:work:start -- <topic> --execute --json
-pnpm paper:work:submit -- --execute --json
-```
-
-The reusable required check independently enforces the same contract and PR
-lineage, so local command use is never treated as remote acceptance evidence.
-
-See [`docs/cli.md`](docs/cli.md), [`docs/lifecycle-protocol.md`](docs/lifecycle-protocol.md),
-and [`docs/reusable-build-surface.md`](docs/reusable-build-surface.md) for the
-consumer contract.
-
-All public entries share the same runtime contract. A runtime bug is recovered
-through a new execution with a repaired train and original source evidence.
-An entry bug requires an upgraded published entry and a complete new run.
+The consumer-facing self boundary is `.buildchain/buildchain.toml`, two generated
+callers (`.github/workflows/buildchain.yml` and `buildchain-recover.yml`),
+tool-maintained contract locks, and necessary provider permissions. The normal
+caller invokes the published `public-ops-pipeline.yml`; recovery accepts only an
+exact attempt and an optional repaired runtime through `public-ops-recover.yml`.
+No repository-specific runtime selection or recovery exception is allowed.
+
+During the protected migration, both callers use `@v4-alpha` and the prepared
+`.buildchain/minimal-consumer.toml` path, kept byte-identical to the canonical
+TOML. The pipeline reads policy at the same path on its protected target branch,
+so each target must contain the schema-2 policy before its first pipeline PR.
+The TOML declares `feature/*`, `fix/*`, `chore/*`, `docs/*`, `ci/*`, and
+`refactor/*` development routes before the first new-pipeline Alpha qualification.
+After the canonical path is protected and the stable entry is qualified,
+regenerate the same pair using the default path and `@v4`.
+Do not claim the transition complete while that final cleanup is outstanding.
+
+Products declare their own install, build, and verification commands in TOML.
+Publication, source qualification, reviews, merge queues, provider readback and
+recovery belong to the published runtime. Internal workflow libraries may be
+retained, but self callers must use the same public reusable-workflow contract as every other consumer.
 
 ## Building this repo
 
@@ -119,33 +94,24 @@ Stage Capsule resume planning is governed by
 TypeScript projection pure and byte-identical; explicit provider/release-tail
 effects always require readback and never become Capsule reuse.
 
-Stage Capsule qualification and Wave 2 reconciliation are governed by
-`architecture/stage-capsule-qualification.json`. Buildchain v4 dogfood is a
-repository invariant, not an implementation convenience: this repository must
-consume `kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml`
-through the same public reusable-workflow contract as every other consumer.
-The caller must remain a thin workflow with no steps or local orchestration,
-and `.buildchain/buildchain.toml` must declare the same real `install`, `build`,
-and `verify` lifecycle. The public workflow records the entry and selected runtime and binds
-consumer source SHA, platform, commands, manifests, summaries, dependencies,
-and output roots on Linux, macOS, and Windows.
-
-Dogfood callers use the same public entry and runtime preparation as external
-consumers. No repository-specific runtime selection or recovery exception is
-allowed. Stage Capsule internals are invoked by public workflows and tests;
-provider effects remain subject to their own source, artifact and readback rules.
-
-External Buildchain v4 workflow calls persisted in tracked source use only `@v4` or
-`@v4-alpha` and retain matching stable and alpha contract locks. A
-source-persisted exact commit SHA or train is not a durable entry selector.
-Exact resolved SHAs belong in lock data and provenance. Normal self workflows
-call `@v4`; dedicated post-publication alpha entry qualification calls `@v4-alpha`.
-
-Train validation passes `train/v4/v4.1/<capability>` only through the trusted
-non-persistent runtime input. The central entry resolves it once, and every
-business job executes the selected runtime. Protected merge and requested alpha
-publication follow successful validation. Changes to dogfood policy or its
-gates require independent `@kungfu-origin` review.
+Stage Capsule qualification and Wave 2 reconciliation remain governed by
+`architecture/stage-capsule-qualification.json`. Its prior standalone public
+Canary caller is explicitly historical; its shadow-only authority and retained
+evidence do not grant publication or production reuse. Current product verification
+runs the committed WASM checks, clean-process checkpoint restoration, and resume
+planning on Linux, macOS and Windows, with the same pinned Linux container
+backbone checks. These are product tests, not consumer-side delivery controllers.
+
+Normal self workflows and recovery share central runtime selection. The
+central entry resolves it once, and every business job uses that selected runtime.
+Persist only `@v4` or `@v4-alpha` in caller source, with matching stable and alpha contract locks
+maintained by the tooling. A source-persisted exact commit SHA or train is not a durable entry selector;
+exact SHAs belong in locks and provenance. A repaired train is a trusted,
+non-persistent recovery input and must retain the original attempt evidence.
+The optional repair selector is a trusted non-persistent runtime input.
+
+Changes to this consumer wiring, its required product checks, or publication
+gates require `@kungfu-origin` approval through the protected PR workflow.
 
 `pnpm run check` validates inventory data, generated public references and site
 bundle drift, lints root workflows, runs unit tests, and rebuilds every action

package/CONTRIBUTING.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-12
+last_reviewed: 2026-09-14
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-12
+  generated_at: 2026-09-14
   visible_context: Repository contribution rules and implementation naming and release transition changes.
   invisible_context_boundary: No private credentials or unpublished external release state.
 ---
@@ -39,7 +39,7 @@ sensitive material in issues or pull requests.
 
 - Node.js 24
 - Corepack with pnpm 11
-- Go 1.25 for workflow validation paths that exercise Go setup
+- Go 1.25 or newer in major 1 for product verification
 
 Buildchain's reusable workflow consumers may build with npm, yarn, pnpm, CMake,
 Conan, Python, Docker, or other tools through lifecycle commands. This
@@ -91,17 +91,16 @@ category vocabulary is enforced by `architecture/workflow-taxonomy.json`:
 | --- | --- | --- |
 | Public | `public-<category>-<purpose>.yml` | Consumer entry |
 | Component | `.<category>-<purpose>.yml` | Advanced reusable component |
-| Self | `self-<category>-<purpose>.yml` | Buildchain repository automation |
+| Self | `buildchain.yml`, `buildchain-recover.yml` | Generated normal and recovery callers |
 
 Categories are only `build`, `release`, and `ops`. Register the identity, role,
 category, purpose, owner, lifecycle status, invocation, and rationale before
 adding its derived filename. The [Workflow Catalog](docs/workflow-catalog.md)
-lists every canonical API and component path; self workflows have one
-event entry. Retired paths have no generated aliases. A matching prefix alone does not admit an unregistered workflow.
+lists every canonical API and component path; self automation has only the generated normal and recovery entries. Retired paths have no generated aliases. A matching prefix alone does not admit an unregistered workflow.
 
 Run `pnpm run generate:workflows`, `pnpm run check:workflows`, then the full
-`pnpm run check`. The required Verify lifecycle runs this gate on PRs, merge
-queue candidates, and pushes. Policy, enforcement, and ownership changes require
+`pnpm run check`. The product verification commands run this gate through the shared pipeline on PRs, merge
+queue candidates, and protected source qualification. Policy, enforcement, and ownership changes require
 independent `@kungfu-origin` review. A development merge does not publish a floating channel. Consumers adopt the
 new API only after that channel publishes it and their contract locks are refreshed.
 
@@ -145,24 +144,18 @@ release/vX/vX.Y -> publish-gate/major
   them for direct ad-hoc commits. Work from `feature/*`, `fix/*`, `chore/*`,
   `docs/*`, `ci/*`, or `refactor/*` branches and open a PR into the target dev
   line.
-- Repositories may call
-  `.github/workflows/public-ops-dev-auto-merge.yml` from their own scheduled or manual
-  wrapper to merge ready, conflict-free dev PRs. The wrapper is policy-gated:
-  required checks, ready/block labels, same-repository heads, approvals,
-  branch prefixes, max merges, and dry-run are all declared inputs.
-- Ordinary build callers use `build.yml@v4` or `build.yml@v4-alpha` with
-  project settings in `buildchain.toml`. Every public workflow uses the central
-  runtime entry: transient `runtime-ref`, contract lock, then entry default.
-  Validate the implementation before protected Dev, publish Alpha, and qualify
-  the published consumer entry. See `docs/runtime-entry.md`.
-- Merging into `alpha/*`, `release/*`, or `publish-gate/major` expresses a
-  release intent. Buildchain promotion then creates version-state commits,
-  exact tags, floating tags, npm publish evidence, and next-alpha state.
-- Manual alpha publication requires an explicit protected source SHA and passes
-  the same source qualification and fresh hosted admission as automatic publication.
-  Use `runtime-ref` to select the execution runtime. Set recovery inputs only when
-  resuming an existing transaction; a first publication leaves them empty. Stable
-  publication continues through the protected automatic channel path.
+- The generated `buildchain.yml` caller invokes `public-ops-pipeline.yml` using
+  a published floating entry. Product build, verification, artifacts, channels
+  and review policy are declared in the schema-2 TOML.
+- The published runtime owns source qualification, protected review and merge,
+  version materialization, publication, provider readback and next-development.
+- Recover an interrupted operation through `buildchain-recover.yml` using its
+  exact attempt and, when required, one transient repaired runtime. Recovery
+  does not accept replacement source, artifact or provider-effect parameters.
+- During this repository's protected cutover, both generated callers use
+  `@v4-alpha` and the protected `.buildchain/minimal-consumer.toml` policy path;
+  see `AGENTS.md` for target-policy admission, stable qualification and final
+  default-path cleanup requirements.
 
 See [`docs/release-governance.md`](docs/release-governance.md),
 [`docs/release-flow.md`](docs/release-flow.md), and

package/architecture/agent-change-map.md

@@ -108,7 +108,6 @@ Safe change route: Reduce one declared responsibility in its owning module, run
 - tests: `tests/release-propagation.test.mjs`
 - tests: `tests/web-surface.test.mjs`
 - workflows: `.github/workflows/public-release-web.yml`
-- workflows: `.github/workflows/self-ops-bootstrap-dogfood.yml`
 
 ### Current top twenty maintenance hotspots
 
@@ -121,7 +120,6 @@ Safe change route: Reduce one declared responsibility in its owning module, run
 - `tests/dev-delivery-minimal-request.test.mjs`
 - `tests/build-configuration.test.mjs`
 - `.github/workflows/build.yml`
-- `.github/workflows/self-build-fixture.yml`
 - `scripts/generate-channel-promotion-workflow.mjs`
 - `tests/github-governance-authority.test.mjs`
 - `tests/maintainability.test.mjs`
@@ -132,18 +130,19 @@ Safe change route: Reduce one declared responsibility in its owning module, run
 - `.github/workflows/public-build-stage-capsule-canary.yml`
 - `.github/workflows/public-release-oci-compose-preview.yml`
 - `.github/workflows/public-release-promote.yml`
-- `.github/workflows/self-build-verify.yml`
-- `.github/workflows/self-release-promote.yml`
 - `.github/workflows/.release-binary-assets.yml`
 - `.github/workflows/public-ops-dev-auto-merge.yml`
 - `tests/release-topology.test.mjs`
 - `scripts/check-release-topology.mjs`
+- `packages/core/governance/buildchain-publication-authority.js`
 - `scripts/check-universal-workflow-bootstrap.mjs`
 - `packages/core/providers/github/discussions/materials.js`
-- `.github/workflows/self-build-alpha-dogfood.yml`
-- `.github/workflows/self-build-binary-distribution.yml`
-- `.github/workflows/self-ops-bootstrap-dogfood.yml`
-- `packages/core/governance/buildchain-publication-authority.js`
+- `tests/controller-evidence.test.mjs`
+- `tests/floating-consumer-policy-contract.test.mjs`
+- `tests/macos-credential-island.test.mjs`
+- `tests/minimal-consumer-contract.test.mjs`
+- `tests/native-artifact-signing-authority.test.mjs`
+- `tests/workflow-taxonomy.test.mjs`
 
 ## action-process-runtime
 
@@ -2539,7 +2538,6 @@ Owner: Buildchain adopter delivery maintainers
 - `contracts/fixtures/v4-adopter-delivery-v1/gate-unknown-selector.json`
 - `contracts/fixtures/v4-adopter-delivery-v1/offline-vectors.json`
 - `.github/workflows/public-build-adopter-qualification.yml`
-- `.github/workflows/self-build-adopter-dogfood.yml`
 - `docs/v4-adopter-delivery.md`
 
 ### Tests
@@ -2762,7 +2760,6 @@ Owner: Buildchain protected delivery maintainers
 - `contracts/dev-delivery-authority-v2.schema.json`
 - `dist/site/schemas/dev-delivery-authority-v2.schema.json`
 - `.github/workflows/public-ops-dev-auto-merge.yml`
-- `.github/workflows/self-ops-dev-delivery.yml`
 - `templates/native-dev-delivery.yml`
 - `docs/dev-delivery-warrant.md`
 - `docs/dev-delivery-qualification-landing-adr.md`
@@ -2803,7 +2800,6 @@ Owner: Buildchain publication rehearsal maintainers
 
 - `architecture/publication-rehearsal-parity.json`
 - `contracts/v4-publication-rehearsal-capsule-v1.schema.json`
-- `.github/workflows/self-release-rehearsal-dogfood.yml`
 - `docs/v4-publication-rehearsal.md`
 
 ### Tests
@@ -2834,7 +2830,6 @@ Owner: Buildchain workflow maintainers
 - `architecture/universal-workflow-fault-campaign.json`
 - `architecture/universal-workflow-capability-policy.json`
 - `.github/workflows/public-ops-bootstrap.yml`
-- `.github/workflows/self-ops-bootstrap-dogfood.yml`
 
 ### Tests
 

package/architecture/capability-state-machine-manifest.json

@@ -120,10 +120,7 @@
       "id": "release-candidate-recovery",
       "owner": "Buildchain promotion recovery plane",
       "sourceInventoryId": "release-candidate-recovery",
-      "surfaces": [
-        "export:./release-candidate-recovery",
-        "workflow:self-ops-promotion-recovery"
-      ],
+      "surfaces": ["export:./release-candidate-recovery"],
       "migrationPhase": "legacy-retired"
     },
     {