@kungfu-tech/buildchain 4.1.3-alpha.5 → 4.1.3-alpha.7

package/packages/core/workflow/workflow-taxonomy.mjs

@@ -20,7 +20,8 @@ const PROTECTED = [
   "scripts/generate-workflow-taxonomy.mjs",
   "scripts/check-workflows.sh",
   "tests/workflow-taxonomy.test.mjs",
-  ".github/workflows/self-build-verify.yml",
+  ".github/workflows/buildchain.yml",
+  ".github/workflows/buildchain-recover.yml",
   "package.json",
   ".buildchain/buildchain.toml",
 ];
@@ -63,12 +64,13 @@ function validateEntries(policy, errors) {
     if (
       entry.path &&
       !(
-        (entry.id === ".build" || entry.id === "build") &&
-        entry.path === `.github/workflows/${entry.id}.yml`
+        [".build", "build", "buildchain", "buildchain-recover"].includes(
+          entry.id,
+        ) && entry.path === `.github/workflows/${entry.id}.yml`
       )
     )
       errors.push(
-        `${entry.id}: explicit path is reserved for the build facade and backbone`,
+        `${entry.id}: explicit path is reserved for build APIs and the generated consumer pair`,
       );
     const file = workflowPath(entry);
     if (!WORKFLOW.test(file) || paths.has(file))
@@ -191,35 +193,53 @@ function validateGateIntegration(root, errors) {
     )
   )
     errors.push("required check chain does not enforce check:workflows");
-  const { parse: parseToml } = createRequire(import.meta.url)("smol-toml");
-  const config = parseToml(read(".buildchain/buildchain.toml"));
+  const require = createRequire(import.meta.url);
+  const { parse: parseYaml } = require("yaml");
+  const { compileConsumerPlan } = require("../consumer/contract/plan.js");
+  const { consumerWorkflows } = require("../consumer/contract/entries.js");
+  const config = compileConsumerPlan(read(".buildchain/buildchain.toml"));
+  for (const platform of ["linux-x64", "macos-arm64", "windows-x64"])
+    if (
+      !config.products.some(
+        (product) =>
+          product.platforms.includes(platform) &&
+          product.verify.includes("corepack pnpm@11.7.0 run check") &&
+          product.verify.includes("node scripts/verify-product-platform.mjs"),
+      )
+    )
+      errors.push(
+        `${platform}: declared product verification must execute the full required check and checkpoint recovery`,
+      );
+  const caller = parseYaml(read(".github/workflows/buildchain.yml"));
+  const channel = caller.jobs?.buildchain?.uses?.split("@").at(-1);
+  const configPath = caller.jobs?.buildchain?.with?.["config-path"];
+  for (const [file, expected] of Object.entries(
+    consumerWorkflows(channel, configPath),
+  ))
+    if (read(file) !== expected)
+      errors.push(`${file}: required generated pipeline caller drift`);
+  const execution = parseYaml(
+    read(".github/workflows/.ops-pipeline-execute.yml"),
+  );
+  const build = execution.jobs?.build;
+  const record = execution.jobs?.["record-build"];
   if (
-    !config.lifecycle?.verify?.commands?.includes(
-      "corepack pnpm@11.7.0 run check",
+    build?.permissions?.contents !== "read" ||
+    Object.values(build?.permissions || {}).includes("write") ||
+    !build?.steps?.some(
+      (step) =>
+        step.uses === "./.buildchain/runtime/actions/workflow/pipeline/build",
+    ) ||
+    ![record?.needs].flat().includes("build") ||
+    !record?.steps?.some(
+      (step) =>
+        step.uses ===
+        "./.buildchain/runtime/actions/workflow/pipeline/record-build",
     )
   )
     errors.push(
-      "declared verify lifecycle must execute the full required check",
+      "required product execution and independent source qualification boundary is missing",
     );
-  const verify = read(".github/workflows/self-build-verify.yml");
-  const document = parseWorkflowDocument(verify);
-  for (const trigger of ["pull_request", "merge_group", "push"]) {
-    if (!document.triggers.some((item) => item.split(":")[0] === trigger))
-      errors.push(`required Verify workflow lacks ${trigger}`);
-  }
-  const checkJob = verify.match(/^  check:\n([\s\S]*?)(?=^  [\w-]+:|(?![\s\S]))/mu)?.[1] || "";
-  const verifyNode = "./.buildchain/runtime/actions/build/verification/repository";
-  const verifyAction = read("actions/build/verification/repository/action.yml");
-  const sourceAction = read("actions/build/verification/qualify-source/action.yml");
-  const sourceVerification = read("packages/core/build/verification/source.js");
-  const sourceLifecycle = read("packages/core/build/source/lifecycle.js");
-  if (!parseYamlUses(checkJob).some(call => call.value === verifyNode) ||
-      !parseYamlUses(verifyAction).some(call => call.value === "./.buildchain/runtime/actions/build/verification/qualify-source") ||
-      !/using: node24/u.test(sourceAction) ||
-      !/qualify = qualifySourceLifecycle/u.test(sourceVerification) ||
-      !/mode: "verify"/u.test(sourceVerification) ||
-      !/lifecycle\(\{[\s\S]*stageName,[\s\S]*required: true/u.test(sourceLifecycle))
-    errors.push("required Verify lifecycle integration is missing");
   const owners = read(".github/CODEOWNERS")
     .split(/\r?\n/u)
     .map((line) => line.trim());
@@ -306,7 +326,7 @@ export function renderWorkflowCatalog(policy) {
     "",
     "Public workflows own the consumer API. Component workflows own reusable multi-job topology. Self workflows own Buildchain repository automation. Actions own execution steps; JS adapters and Rust/WASM own implementation.",
     "",
-    "Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and `self-<category>-<purpose>.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.",
+    "Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and the generated self callers `buildchain.yml` and `buildchain-recover.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.",
     "",
     "Register ownership before adding a workflow. `pnpm run check:workflows` validates source, calls, required CI integration and independent review ownership. `pnpm run generate:workflows` regenerates this catalog.",
     "",
@@ -330,22 +350,22 @@ export function renderWorkflowCatalog(policy) {
 }
 
 function validateEntryOwnership(entry, errors) {
-    for (const field of ["summary", "owner", "rationale"])
-      if (typeof entry[field] !== "string" || !entry[field].trim())
-        errors.push(`${entry.id}: missing ${field}`);
-    if (!["active", "preview"].includes(entry.status))
-      errors.push(`${entry.id}: unsupported lifecycle status`);
-    for (const field of ["compatibility", "migration", "retiredAlias"])
-      if (field in entry)
-        errors.push(
-          `${entry.id}: ${field} is not an executable architecture contract`,
-        );
-    if (
-      !["reusable", "dispatch-service", "repository"].includes(entry.invocation)
-    )
-      errors.push(`${entry.id}: invalid invocation`);
-    if ((entry.role === "self") !== (entry.invocation === "repository"))
-      errors.push(`${entry.id}: role and invocation disagree`);
-    if (entry.role === "component" && entry.invocation !== "reusable")
-      errors.push(`${entry.id}: component must be reusable`);
+  for (const field of ["summary", "owner", "rationale"])
+    if (typeof entry[field] !== "string" || !entry[field].trim())
+      errors.push(`${entry.id}: missing ${field}`);
+  if (!["active", "preview"].includes(entry.status))
+    errors.push(`${entry.id}: unsupported lifecycle status`);
+  for (const field of ["compatibility", "migration", "retiredAlias"])
+    if (field in entry)
+      errors.push(
+        `${entry.id}: ${field} is not an executable architecture contract`,
+      );
+  if (
+    !["reusable", "dispatch-service", "repository"].includes(entry.invocation)
+  )
+    errors.push(`${entry.id}: invalid invocation`);
+  if ((entry.role === "self") !== (entry.invocation === "repository"))
+    errors.push(`${entry.id}: role and invocation disagree`);
+  if (entry.role === "component" && entry.invocation !== "reusable")
+    errors.push(`${entry.id}: component must be reusable`);
 }

package/scripts/check-inventory.mjs

@@ -1,3 +1,4 @@
+import { checkSelfConsumerContract } from "./check-self-consumer-contract.mjs";
 import { assertBinaryInventory } from "./inventory/binary.mjs";
 import YAML from "yaml";
 import { actionInventory } from "../packages/core/contracts/action-inventory.js";
@@ -145,41 +146,29 @@ const requiredPaths = [
   ".buildchain/alpha-contract-lock.json",
   ".buildchain/release-impact.json",
   ".github/actionlint.yaml",
-  ".github/workflows/self-ops-runner-smoke.yml",
-  ".github/workflows/self-release-promote.yml",
-  ".github/workflows/self-release-line-open.yml",
   ".github/workflows/public-ops-release-governance.yml",
   ".github/workflows/public-ops-dev-auto-merge.yml",
-  ".github/workflows/self-ops-dev-delivery.yml",
   ".github/workflows/public-ops-patrol.yml",
   ".github/workflows/public-ops-patrol-daily.yml",
   ".github/workflows/public-ops-patrol-weekly.yml",
   ".github/workflows/public-ops-patrol-monthly.yml",
   ".github/workflows/public-ops-observed-evidence.yml",
-  ".github/workflows/self-ops-patrol-daily.yml",
-  ".github/workflows/self-ops-patrol-weekly.yml",
-  ".github/workflows/self-ops-patrol-monthly.yml",
-  ".github/workflows/self-build-alpha-dogfood.yml",
-  ".github/workflows/self-build-stable-dogfood.yml",
   ".github/workflows/public-release-promote.yml",
   ".github/workflows/.release-promote.yml",
   ".github/workflows/public-release-propagation.yml",
-  ".github/workflows/self-release-npm-dry-run.yml",
   ".github/workflows/public-release-paper.yml",
-  ".github/workflows/self-build-binary-distribution.yml",
   ".github/workflows/.release-binary-assets.yml",
-  ".github/workflows/self-release-binary-assets.yml",
-  ".github/workflows/self-build-verify.yml",
   ".github/workflows/.build.yml",
   ".github/workflows/.build-gate-profile.yml",
   ".github/workflows/.build-demo-adapter.yml",
   ".github/workflows/public-build-demo.yml",
-  ".github/workflows/self-build-demo-dogfood.yml",
   ".github/workflows/build.yml",
-  ".github/workflows/self-build-fixture.yml",
   "fixtures/libnode-shaped/buildchain.toml",
   "fixtures/libnode-shaped/.github/workflows/build.yml",
-  "fixtures/libnode-shaped/package.json"
+  "fixtures/libnode-shaped/package.json",
+  ".github/workflows/buildchain.yml",
+  ".github/workflows/buildchain-recover.yml",
+  "scripts/check-self-consumer-contract.mjs",
 ];
 
 for (const rel of requiredPaths) {
@@ -277,14 +266,7 @@ for (const channel of ["alpha-contract-lock.json", "contract-lock.json"]) {
   if (lock.buildchain.ref !== ref)
     throw new Error(`${channel}: invalid accepted runtime selector`);
 }
-for (const [channel, ref] of [["alpha", `v${selfDogfoodMajor}-alpha`], ["stable", `v${selfDogfoodMajor}`]]) {
-  const workflow = fs.readFileSync(path.join(root, `.github/workflows/self-build-${channel}-dogfood.yml`), "utf8");
-  if (!workflow.includes(`/.github/workflows/build.yml@${ref}`) || /steps:|buildchain-channel:|runner-preset:|working-directory:/u.test(workflow)) throw new Error(`${channel} self-dogfood must remain a thin public TOML build caller`);
-  if (!workflow.includes(`group: buildchain-${channel}-self-dogfood-`) || !workflow.includes("cancel-in-progress: false")) throw new Error(`${channel} self-dogfood must serialize its own runs`);
-  const expectedInputs = [];
-  const call = parseWorkflowCallJobs(workflow).find((job) => job.id === `${channel}-consumer`);
-  if (JSON.stringify(Object.keys(call.with || {})) !== JSON.stringify(expectedInputs)) throw new Error(`${channel} self-dogfood input contract drift`);
-}
+checkSelfConsumerContract(root);
 const reusableBuildWorkflow = fs.readFileSync(
   path.join(root, ".github/workflows/.build.yml"),
   "utf8",
@@ -310,10 +292,6 @@ const channelPromotionWorkflow = fs.readFileSync(
   path.join(root, ".github/workflows/public-release-promote.yml"),
   "utf8",
 );
-const boundedAlphaRecoveryWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/self-ops-promotion-recovery.yml"),
-  "utf8",
-);
 assertPromotionInventory(root);
 for (const workflow of [channelBuildWorkflow, reusableBuildWorkflow]) {
   const block = workflow.split("    inputs:\n")[1].split("    secrets:\n")[0];
@@ -957,11 +935,6 @@ for (const requiredSnippet of [
 if (commonJsSourcePattern.test(standaloneBinaryScript)) {
   throw new Error("scripts/build-standalone-binary.mjs must use ESM syntax");
 }
-const npmPublishWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-release-npm-dry-run.yml"), "utf8");
-const buildchainRefPromotionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-release-promote.yml"), "utf8");
-const binaryDistributionWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-build-binary-distribution.yml"), "utf8");
-const binaryReleaseAssetsWorkflow = fs.readFileSync(path.join(root, ".github/workflows/.release-binary-assets.yml"), "utf8");
-const selfHostedRunnerSmokeWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-ops-runner-smoke.yml"), "utf8");
 const npmDryRunScript = fs.readFileSync(path.join(root, "packages/core/publication/npm/preview.js"), "utf8").replace(/\s+/gu, " ");
 const npmPublishTransactionScript = ["transaction", "environment"].map(name => fs.readFileSync(path.join(root, `packages/core/publication/npm/${name}.js`), "utf8")).join("\n");
 const rootPackageJson = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
@@ -977,29 +950,6 @@ if (!["patch", "minor", "major"].includes(selfReleaseImpact.classification)) {
 if (!Array.isArray(selfReleaseImpact.surfaceImpacts) || selfReleaseImpact.surfaceImpacts.length === 0) {
   throw new Error("Buildchain self release impact requires a summary and surfaceImpacts[]");
 }
-for (const requiredSnippet of [
-  "runs-on: ubuntu-24.04",
-  "workflow_dispatch:",
-  "Dry-run npm publish",
-]) {
-  if (!npmPublishWorkflow.includes(requiredSnippet)) {
-    throw new Error(`npm publish workflow missing required snippet: ${requiredSnippet}`);
-  }
-}
-for (const forbiddenSnippet of [
-  "tags:",
-  "Publish exact release tag",
-  "npm publish --access public --tag",
-]) {
-  if (npmPublishWorkflow.includes(forbiddenSnippet)) {
-    throw new Error(`npm publish dry-run workflow must not contain real publish snippet: ${forbiddenSnippet}`);
-  }
-}
-const selfPromotion = inspectWorkflowJob(".github/workflows/self-release-promote.yml", "classify-workflow-run", root);
-if (![...selfPromotion.modules.values()].some(source => source.includes("selectFinalizedProductPublicationVersion")))
-  throw new Error("self promotion must classify finalization from rooted product state");
-if (buildchainRefPromotionWorkflow.includes("workflow_run.display_title"))
-  throw new Error("self promotion must not classify finalization from a display title");
 const workflowDir = path.join(root, ".github/workflows");
 for (const workflowFile of fs.readdirSync(workflowDir).filter((entry) => entry.endsWith(".yml"))) {
   const workflowPath = path.join(workflowDir, workflowFile);
@@ -1054,14 +1004,6 @@ for (const requiredSnippet of [
     throw new Error(`promote-buildchain-ref index missing semver GitHub Release implementation: ${requiredSnippet}`);
   }
 }
-for (const forbiddenSnippet of [
-  "run: node packages/core/release/commands/release-candidate-resolver.mjs",
-  "uses: ./actions/release/promotion/ref",
-]) {
-  if (buildchainRefPromotionWorkflow.includes(forbiddenSnippet)) {
-    throw new Error(`buildchain ref promotion workflow must use the declarative wrapper, found manual snippet: ${forbiddenSnippet}`);
-  }
-}
 for (const requiredSnippet of [
   "distTag || (pkg.version.includes(\"-\") ? \"alpha\" : \"latest\")",
   "\"publish\", \"--dry-run\", \"--access\", \"public\"",
@@ -1089,13 +1031,8 @@ for (const requiredSnippet of [
 if (commonJsSourcePattern.test(npmPublishTransactionScript)) {
   throw new Error("packages/core/publication/commands/npm-publish-transaction.mjs must use ESM syntax");
 }
-if (/runs-on:\s*self-hosted/.test(npmPublishWorkflow)) {
-  throw new Error("npm publish workflow must use GitHub-hosted runners for trusted publishing");
-}
 assertBinaryInventory(root);
-if (!inspectWorkflowJob(".github/workflows/self-ops-runner-smoke.yml", "smoke", root).modules.get("packages/core/build/verification/runner.js")?.includes('runnerKind: "self-hosted"')) {
-  throw new Error("self-hosted smoke must identify its actual runner kind");
-}
+
 
 const inventory = JSON.parse(
   fs.readFileSync(path.join(root, "tests/buildchain-inventory.json"), "utf8")

package/scripts/check-pipeline-publication-topology.mjs

@@ -13,6 +13,8 @@ export function assertPipelinePublicationTopology(
     ".github/workflows/public-ops-recover.yml",
     ".github/workflows/.ops-pipeline-execute.yml",
     ".github/workflows/.release-pipeline-version.yml",
+    ".github/workflows/buildchain.yml",
+    ".github/workflows/buildchain-recover.yml",
   ]);
   const pipelineTopology = discoverReleaseTopology(
     pipeline.workflowPaths,

package/scripts/check-public-dogfood-contract.mjs

@@ -4,6 +4,7 @@ import fs from "node:fs";
 import YAML from "yaml";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { checkSelfConsumerContract } from "./check-self-consumer-contract.mjs";
 
 const DEFAULT_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -15,35 +16,6 @@ export const PUBLIC_DOGFOOD_ENTRY_REF = "v4";
 const PRIVATE_CONSUMER = ["buildchain", "self", "dogfood"].join("-");
 const PRIVATE_SHADOW = ["kungfu", "shadow"].join("-");
 
-export function expectedPublicDogfoodWorkflow(validationRef) {
-  return `name: V4 Public Consumer Dogfood
-
-on:
-  pull_request:
-  workflow_dispatch:
-    inputs:
-      runtime-ref:
-        description: Transient runtime selected by the public entry.
-        type: string
-        default: ""
-
-permissions:
-  contents: read
-
-jobs:
-  dogfood:
-    uses: kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml@${validationRef}
-    with:
-      runtime-ref: \${{ inputs.runtime-ref }}
-      consumer: buildchain
-      node-version: "24"
-      go-version: "1.25.x"
-      install-artifact-path: node_modules/.modules.yaml
-      build-artifact-path: actions/build/lifecycle/run/dist/index.js
-      verify-artifact-path: dist/site
-`;
-}
-
 function fail(message) {
   throw new Error(`v4-public-dogfood-contract: ${message}`);
 }
@@ -238,17 +210,22 @@ function assertWorkflowInventory(root) {
 }
 
 function assertProtectedVerify(root) {
-  const verify = read(root, ".github/workflows/self-build-verify.yml");
-  const parsed = YAML.parse(verify);
-  const nodePath = "actions/build/verification/repository/action.yml";
+  checkSelfConsumerContract(root);
+  const verify = read(root, "scripts/verify-product-platform.mjs");
   if (
-    ![parsed.jobs.check.needs].flat().includes("stage-capsule-checkpoints") ||
-    parsed.jobs.check.steps.at(-1).uses !==
-      `./.buildchain/runtime/${nodePath.replace(/\/action.yml$/, "")}`
+    !verify.includes("verifyStageCapsuleCheckpoints({") ||
+    !verify.includes('"--network=none"') ||
+    !verify.includes(
+      "sha256:11f0ba64267ce88174a4f73a9bf833ff4e9c59cd16ec3d08a6432a06c2be6fb1",
+    ) ||
+    !verify.includes("tests/build-orchestration.test.mjs") ||
+    !verify.includes("tests/build-artifact-pipeline.test.mjs") ||
+    !verify.includes("tests/dev-delivery-minimal-request.test.mjs")
   )
     fail(
-      "Verify must bind the protected check node after Stage Capsule checkpoints",
+      "Product verification must retain checkpoint recovery and the isolated container backbone lane",
     );
+  const nodePath = "actions/build/verification/repository/action.yml";
   const implementation = read(root, nodePath);
   const steps = YAML.parse(implementation).runs.steps;
   const qualify = steps.find((step) => step.id === "source-verification");
@@ -283,12 +260,13 @@ function assertArchitecture(root) {
   const validationRef = dogfood?.validationRef;
   if (validationRef !== PUBLIC_DOGFOOD_ENTRY_REF)
     fail("architecture validationRef must use the public v4 entry");
-  const caller = read(root, CALLER_PATH);
   if (
-    JSON.stringify(YAML.parse(caller)) !==
-    JSON.stringify(YAML.parse(expectedPublicDogfoodWorkflow(validationRef)))
+    dogfood?.active !== false ||
+    dogfood.supersededBy !== ".github/workflows/buildchain.yml"
   )
-    fail(`${CALLER_PATH} must remain the exact thin public consumer caller`);
+    fail(
+      "Historical Canary caller must be explicitly superseded by the minimal pipeline",
+    );
   if (JSON.stringify(architecture.campaign?.consumers) !== '["buildchain"]')
     fail(
       "architecture must qualify only the public Buildchain consumer identity",
@@ -335,17 +313,25 @@ function assertArchitecture(root) {
 }
 
 function assertConsumerLifecycle(root) {
-  const lifecycle = read(root, ".buildchain/buildchain.toml");
-  for (const declaration of [
-    '[lifecycle.install]\ncommand = "corepack enable pnpm && corepack pnpm@11.7.0 install --frozen-lockfile"',
-    '[lifecycle.build]\ncommand = "corepack pnpm@11.7.0 run build && corepack pnpm@11.7.0 run generate:site"',
-    "[lifecycle.verify]\ncommands = [",
-    '"corepack pnpm@11.7.0 run check",',
-  ])
-    if (!lifecycle.includes(declaration))
+  const { plan } = checkSelfConsumerContract(root);
+  for (const platform of ["linux-x64", "macos-arm64", "windows-x64"]) {
+    const product = plan.products.find(
+      (product) =>
+        product.platforms.includes(platform) &&
+        product.verify.includes("corepack pnpm@11.7.0 run check"),
+    );
+    if (
+      !product?.install.includes("corepack enable pnpm") ||
+      !product.install.includes(
+        "corepack pnpm@11.7.0 install --frozen-lockfile",
+      ) ||
+      !product.build.includes("corepack pnpm@11.7.0 run build") ||
+      !product.build.includes("corepack pnpm@11.7.0 run generate:site")
+    )
       fail(
-        `tracked consumer lifecycle is missing ${declaration.split("\n")[0]}`,
+        `${platform}: tracked consumer lifecycle is missing its pinned install or full generated build`,
       );
+  }
   const attributes = read(root, ".gitattributes");
   if (!attributes.split("\n").includes("* text=auto eol=lf"))
     fail("consumer checkout is missing the cross-platform LF contract");
@@ -394,8 +380,9 @@ export function checkPublicDogfoodContract(root = DEFAULT_ROOT) {
   return {
     schema: "buildchain-v4-public-dogfood-contract-check/v1",
     ok: true,
-    caller: CALLER_PATH,
-    reusable: REUSABLE_PATH,
+    caller: ".github/workflows/buildchain.yml",
+    reusable: ".github/workflows/public-ops-pipeline.yml",
+    historicalCanary: REUSABLE_PATH,
     validationRef,
     productionAuthority: "v4-native",
   };

package/scripts/check-release-topology.mjs

@@ -186,7 +186,10 @@ export function discoverReleaseAuthorityClosure() {
       ]),
     ].sort(),
     runtimeSelectors,
-    runtimeEngines: ["packages/core/release/promote-candidate/action.js"],
+    runtimeEngines: [
+      "packages/core/release/promote-candidate/action.js",
+      "packages/core/publication/pipeline/apply.js",
+    ],
     terminalProjections,
     privilegedExecutableClosure: {
       entrypoints: PRIVILEGED_ENTRYPOINTS,
@@ -382,7 +385,7 @@ export function findUnknownReleaseTopology(
     .filter((relative) => {
       const source = readWorkflow(relative);
       const usesReleaseAuthority = parseYamlUses(source).some(({ value }) =>
-        /(?:release-candidate-promote|promote-buildchain-ref|release-tail|actions\/release\/promotion\/(?:candidate|ref)|\.github\/workflows\/(?:public-release-promote|\.release-promote))/u.test(
+        /(?:release-candidate-promote|promote-buildchain-ref|release-tail|actions\/release\/promotion\/(?:candidate|ref)|\.github\/workflows\/(?:public-release-promote|\.release-promote|public-ops-pipeline|public-ops-recover|\.release-pipeline-products))/u.test(
           value,
         ),
       );
@@ -461,14 +464,12 @@ function assertAuthorityClosure(ledger) {
   );
   assert.deepEqual(closure.runtimeEngines, [
     "packages/core/release/promote-candidate/action.js",
+    "packages/core/publication/pipeline/apply.js",
   ]);
-  assert.equal(
-    closure.freshEntry,
-    ".github/workflows/public-release-promote.yml",
-  );
+  assert.equal(closure.freshEntry, ".github/workflows/public-ops-pipeline.yml");
   assert.equal(
     closure.recoveryEntry,
-    ".github/workflows/self-ops-promotion-recovery.yml",
+    ".github/workflows/public-ops-recover.yml",
   );
   const engineSurface = [
     ".github/workflows/.release-promote.yml",

package/scripts/check-self-consumer-contract.mjs

@@ -0,0 +1,133 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse as yaml } from "yaml";
+import { compileConsumerPlan } from "../packages/core/consumer/contract/plan.js";
+import { consumerWorkflows } from "../packages/core/consumer/contract/entries.js";
+import { workflowPath } from "../packages/core/workflow/workflow-taxonomy.mjs";
+
+export const SELF_ENTRY_CHANNEL = "v4-alpha";
+export const SELF_CONFIG_PATH = ".buildchain/minimal-consumer.toml";
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const PLATFORMS = ["linux-x64", "macos-arm64", "windows-x64"];
+
+// Repository policy checks the consumer-facing wiring. Product implementation
+// libraries are separately registered and may not own repository event triggers.
+// This policy supplies no repository identity exception to runtime admission.
+export function checkSelfConsumerContract(root = ROOT) {
+  const read = (file) => fs.readFileSync(path.join(root, file), "utf8");
+  const fail = (message) => {
+    throw new Error(`self-consumer-contract: ${message}`);
+  };
+  const plan = compileConsumerPlan(read(SELF_CONFIG_PATH));
+  if (read(SELF_CONFIG_PATH) !== read(".buildchain/buildchain.toml"))
+    fail("transition config must match the canonical product plan");
+  const callers = consumerWorkflows(SELF_ENTRY_CHANNEL, SELF_CONFIG_PATH);
+  for (const [file, bytes] of Object.entries(callers))
+    if (read(file) !== bytes) fail(`${file}: generated caller drift`);
+  const taxonomy = JSON.parse(read("architecture/workflow-taxonomy.json"));
+  const registered = new Set(taxonomy.entries.map(workflowPath));
+  const observed = fs
+    .readdirSync(path.join(root, ".github/workflows"))
+    .filter((file) => /\.ya?ml$/u.test(file))
+    .map((file) => `.github/workflows/${file}`);
+  if (
+    observed.length !== registered.size ||
+    observed.some((file) => !registered.has(file))
+  )
+    fail("workflow inventory is not closed");
+  const self = taxonomy.entries
+    .filter((entry) => entry.role === "self")
+    .map(workflowPath)
+    .sort();
+  if (JSON.stringify(self) !== JSON.stringify(Object.keys(callers).sort()))
+    fail("self automation must contain exactly the generated caller pair");
+  for (const entry of taxonomy.entries.filter(
+    (entry) => entry.role !== "self",
+  )) {
+    const file = workflowPath(entry);
+    const document = yaml(read(file));
+    if (
+      Object.keys(document.on || {}).some(
+        (event) => !["workflow_call", "workflow_dispatch"].includes(event),
+      )
+    )
+      fail(`${file}: product library owns a repository event`);
+  }
+  for (const prefix of ["feature", "fix", "chore", "docs", "ci", "refactor"])
+    if (
+      !plan.channels.some(
+        (route) =>
+          route.from === `${prefix}/*` &&
+          route.to === "dev/v4/v4.1" &&
+          route.operation === "develop",
+      )
+    )
+      fail(`missing protected development route for ${prefix}`);
+  for (const platform of PLATFORMS) {
+    const verified = plan.products.some(
+      (product) =>
+        product.platforms.includes(platform) &&
+        product.verify.includes("corepack pnpm@11.7.0 run check") &&
+        product.verify.includes("node scripts/verify-product-platform.mjs"),
+    );
+    if (!verified)
+      fail(
+        `${platform}: full check and platform recovery verification are required`,
+      );
+  }
+  if (
+    !plan.products.some(
+      (product) =>
+        product.type === "npm" &&
+        product.targets.some((target) => target.provider === "npm"),
+    )
+  )
+    fail("npm publication is missing");
+  for (const platform of PLATFORMS)
+    if (
+      !plan.products.some(
+        (product) =>
+          product.type === "binary" &&
+          product.platforms.includes(platform) &&
+          product.targets.some(
+            (target) => target.provider === "github-release",
+          ),
+      )
+    )
+      fail(`${platform}: binary release asset is missing`);
+  const commands = plan.products.flatMap((product) => [
+    ...(product.install || []),
+    ...product.build,
+    ...product.verify,
+  ]);
+  if (
+    commands.some((command) =>
+      /\b(?:npm publish|gh release|buildchain (?:dev warrant|release|promote|recover|publish))\b|request-json|fencingToken/u.test(
+        command,
+      ),
+    )
+  )
+    fail("product lifecycle contains consumer-owned publication orchestration");
+  if (!read(".gitattributes").split("\n").includes("* text=auto eol=lf"))
+    fail("cross-platform LF checkout contract is missing");
+  return {
+    ok: true,
+    channel: SELF_ENTRY_CHANNEL,
+    callers: Object.keys(callers),
+    plan,
+  };
+}
+
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+  const { plan, ...result } = checkSelfConsumerContract();
+  console.log(
+    JSON.stringify({
+      ...result,
+      products: plan.products.map((product) => product.id),
+    }),
+  );
+}

package/scripts/check-universal-workflow-bootstrap.mjs

@@ -43,10 +43,8 @@ assert.doesNotMatch(read(contract.bootstrap.publicWorkflow), /admission-policy-j
 const template = parse(contract.bootstrap.consumerTemplate);
 assert.equal(template.jobs.bootstrap.uses, "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4");
 assert.equal(template.jobs.bootstrap.with["runtime-ref"], "${{ inputs.runtime-ref }}");
-const dogfood = parse(contract.bootstrap.selfDogfoodWorkflow);
-for (const channel of ["conformance", "alpha", "stable"]) for (const mode of ["primary", "recovery"]) {
-  const job = dogfood.jobs[`${mode}-${channel}`];
-  assert.equal(job.uses, "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4");
-  assert.equal(job.with["runtime-ref"], mode === "primary" ? "${{ inputs.runtime-ref }}" : "${{ inputs.recovery-runtime-ref }}");
-}
+assert.equal(contract.bootstrap.selfDogfoodActive, false);
+assert.equal(fs.existsSync(path.join(root, contract.bootstrap.selfDogfoodWorkflow)), false,
+  "The retired bootstrap self controller must not coexist with the minimal pipeline");
+assert.equal(contract.bootstrap.selfDogfoodSupersededBy, ".github/workflows/buildchain.yml");
 console.log(JSON.stringify({ ok: true, reusableWorkflowCount: reusable.length, runtimeAcquisitionOwners: 1 }));

package/scripts/generate-minimal-consumer-contract.mjs

@@ -143,7 +143,7 @@ output(
   await format(
     JSON.stringify({
       schema: "buildchain.consumer-migration/v1",
-      stage: "contract-defined; execution-entry-not-yet-published",
+      stage: "self-cutover-in-progress; final-release-qualification-pending",
       workflows: workflowInventory(),
       consumerSources: consumerSourceInventory(),
     }),