@kungfu-tech/buildchain 4.1.3-alpha.9 → 4.1.4-alpha.0

package/dist/site/workflow-registry.json

@@ -3,6 +3,152 @@
   "contract": "kungfu-buildchain-workflow-registry",
   "workflowSource": ".github/workflows reverse input enumeration",
   "workflows": [
+    {
+      "id": ".build-adopter-qualification",
+      "path": ".github/workflows/.build-adopter-qualification.yml",
+      "reusable": true,
+      "inputs": [
+        "consumer",
+        "consumer-ref",
+        "consumer-repository",
+        "contract-lock",
+        "input-path",
+        "invocation-source-path",
+        "runtime-ref",
+        "runtime-selection"
+      ],
+      "inputCount": 8,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": "v4-adopter-delivery",
+        "role": "component",
+        "category": "build",
+        "purpose": "adopter-qualification",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build-adopter-qualification.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": ".build-candidate",
+      "path": ".github/workflows/.build-candidate.yml",
+      "reusable": true,
+      "inputs": [
+        "config-path",
+        "contract-lock",
+        "resume-run-id",
+        "runtime-ref",
+        "runtime-selection"
+      ],
+      "inputCount": 5,
+      "secrets": [
+        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
+        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
+        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN"
+      ],
+      "secretCount": 6,
+      "outputs": [
+        "controller-receipt-artifact",
+        "release-candidate-artifact",
+        "result"
+      ],
+      "outputCount": 3,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": "build",
+        "role": "component",
+        "category": "build",
+        "purpose": "candidate",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build-candidate.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "channel-build-router",
+      "capabilityGroup": "reusable-build",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": ".build-check",
+      "path": ".github/workflows/.build-check.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "mode",
+        "node-version",
+        "require-version-state",
+        "runtime-ref",
+        "runtime-selection",
+        "source-proof-closure-paths-json",
+        "source-proof-dependency-paths-json",
+        "source-proof-policy-paths-json",
+        "source-proof-required-contexts-json",
+        "source-proof-reuse",
+        "upload-artifacts",
+        "working-directory"
+      ],
+      "inputCount": 13,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "source-proof-decision-root",
+        "source-proof-producer-run-id",
+        "source-proof-reuse-reason",
+        "source-proof-reused",
+        "source-proof-root"
+      ],
+      "outputCount": 12,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": "check",
+        "role": "component",
+        "category": "build",
+        "purpose": "check",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build-check.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
     {
       "id": ".build-demo-adapter",
       "path": ".github/workflows/.build-demo-adapter.yml",
@@ -41,6 +187,7 @@
         "source-sha"
       ],
       "outputCount": 13,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": ".auditable-demo",
         "role": "component",
@@ -52,9 +199,65 @@
       },
       "surface": "auditable-demo",
       "capabilityGroup": "api-cli-reference",
-      "status": "preview",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": ".build-demo",
+      "path": ".github/workflows/.build-demo.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-retention-days",
+        "binary-artifact-digest",
+        "binary-artifact-name",
+        "contract-lock",
+        "materialize",
+        "materialize-base-ref",
+        "media-profile",
+        "render-failure-advisory",
+        "render-media",
+        "renderer-image",
+        "runtime-ref",
+        "runtime-selection",
+        "scenario-path",
+        "source-ref"
+      ],
+      "inputCount": 14,
+      "secrets": [
+        "DEMO_UPDATE_TOKEN"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "capture-artifact-digest",
+        "capture-artifact-name",
+        "evidence-artifact-digest",
+        "evidence-artifact-name",
+        "publication-pr-url",
+        "render-result",
+        "source-sha"
+      ],
+      "outputCount": 7,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": ".declarative-auditable-demo",
+        "role": "component",
+        "category": "build",
+        "purpose": "demo",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build-demo.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "declarative-auditable-demo",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "preview",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -118,6 +321,7 @@
         "source-sha"
       ],
       "outputCount": 14,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": ".gate-profile",
         "role": "component",
@@ -129,9 +333,9 @@
       },
       "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -139,44 +343,69 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": ".build",
-      "path": ".github/workflows/.build.yml",
+      "id": ".build-publication",
+      "path": ".github/workflows/.build-publication.yml",
       "reusable": true,
       "inputs": [
-        "config-path",
+        "artifact-name",
+        "artifact-paths",
+        "artifact-retention-days",
+        "build-command",
+        "buildchain-alpha-contract-lock-path",
+        "buildchain-stable-contract-lock-path",
         "contract-lock",
-        "resume-run-id",
+        "node-version",
+        "package-name",
+        "prepare-paper-package",
+        "publish-dist-tag",
         "runtime-ref",
-        "runtime-selection"
-      ],
-      "inputCount": 5,
-      "secrets": [
-        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
-        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
-        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
-        "BUILDCHAIN_PROMOTION_TOKEN"
+        "runtime-selection",
+        "setup-node",
+        "target-ref",
+        "toolchain-command",
+        "toolchain-digest",
+        "toolchain-image",
+        "toolchain-type",
+        "verify-command",
+        "working-directory"
       ],
-      "secretCount": 6,
+      "inputCount": 21,
+      "secrets": [],
+      "secretCount": 0,
       "outputs": [
-        "result"
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "package-name",
+        "package-version",
+        "publication-artifact-name",
+        "publication-manifest-json",
+        "publication-manifest-path",
+        "publication-passport-path",
+        "publication-registry-path",
+        "publish-dist-tag",
+        "runtime-sha"
       ],
-      "outputCount": 1,
+      "outputCount": 16,
+      "apiRole": "implementation",
       "taxonomy": {
-        "id": ".build",
+        "id": "publication-artifact",
         "role": "component",
         "category": "build",
-        "purpose": "engine",
+        "purpose": "publication",
         "status": "active",
-        "canonicalPath": ".github/workflows/.build.yml",
+        "canonicalPath": ".github/workflows/.build-publication.yml",
         "compatibilityAlias": false
       },
-      "surface": "reusable-build",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "surface": "reusable-workflow",
+      "capabilityGroup": "reusable-build",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -184,603 +413,40 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": ".ops-git-sync",
-      "path": ".github/workflows/.ops-git-sync.yml",
-      "reusable": true,
-      "inputs": [
-        "contract-lock",
-        "force",
-        "remote-host",
-        "remote-path",
-        "remote-repo",
-        "runtime-ref",
-        "runtime-selection"
-      ],
-      "inputCount": 7,
-      "secrets": [
-        "REMOTE_CREDENTIAL",
-        "REMOTE_USER"
-      ],
-      "secretCount": 2,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": ".sync-remote-git",
-        "role": "component",
-        "category": "ops",
-        "purpose": "git-sync",
-        "status": "active",
-        "canonicalPath": ".github/workflows/.ops-git-sync.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "reusable-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": ".ops-pipeline-delivery",
-      "path": ".github/workflows/.ops-pipeline-delivery.yml",
-      "reusable": true,
-      "inputs": [
-        "request",
-        "runtime-selection"
-      ],
-      "inputCount": 2,
-      "secrets": [
-        "BUILDCHAIN_AUTOMATION_TOKEN"
-      ],
-      "secretCount": 1,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": ".pipeline-delivery",
-        "role": "component",
-        "category": "ops",
-        "purpose": "pipeline-delivery",
-        "status": "active",
-        "canonicalPath": ".github/workflows/.ops-pipeline-delivery.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "reusable-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": ".ops-pipeline-execute",
-      "path": ".github/workflows/.ops-pipeline-execute.yml",
-      "reusable": true,
-      "inputs": [
-        "attempt",
-        "context",
-        "matrix",
-        "operation",
-        "request",
-        "runtime-selection"
-      ],
-      "inputCount": 6,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": ".pipeline-execute",
-        "role": "component",
-        "category": "ops",
-        "purpose": "pipeline-execute",
-        "status": "active",
-        "canonicalPath": ".github/workflows/.ops-pipeline-execute.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "reusable-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": ".release-authority",
-      "path": ".github/workflows/.release-authority.yml",
-      "reusable": true,
-      "inputs": [
-        "admission-json",
-        "authority-workflow-path",
-        "auto-admission",
-        "auto-admission-kind",
-        "auto-no-gate",
-        "consumer-gate-command",
-        "consumer-gate-controller-sha",
-        "consumer-gate-evidence-source-sha",
-        "consumer-gate-evidence-source-tree",
-        "consumer-predicate-digest",
-        "consumer-predicate-id",
-        "consumer-qualification-required",
-        "contract-lock",
-        "control-plane-audit-json",
-        "dry-run",
-        "evidence-controller-artifact",
-        "evidence-manifest-pattern",
-        "evidence-passport-artifact",
-        "evidence-payload-pattern",
-        "evidence-publication-artifact",
-        "evidence-repository",
-        "evidence-run-id",
-        "evidence-summary-artifact",
-        "expected-json",
-        "gate-aggregate-json",
-        "github-governance-receipt-json",
-        "package-name",
-        "product",
-        "publication-target",
-        "publication-version",
-        "publisher-workflow-path",
-        "required-status-check",
-        "runner-provenance-json",
-        "runtime-ref",
-        "runtime-selection",
-        "source-sha",
-        "target-ref",
-        "used-nonces-json"
-      ],
-      "inputCount": 38,
-      "secrets": [
-        "BUILDCHAIN_GOVERNANCE_READ_TOKEN",
-        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
-      ],
-      "secretCount": 2,
-      "outputs": [
-        "capability-artifact",
-        "capability-digest",
-        "capability-json",
-        "gate-aggregate-digest",
-        "gate-aggregate-json"
-      ],
-      "outputCount": 5,
-      "taxonomy": {
-        "id": ".publication-authority",
-        "role": "component",
-        "category": "release",
-        "purpose": "authority",
-        "status": "active",
-        "canonicalPath": ".github/workflows/.release-authority.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "reusable-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": ".release-binary-assets",
-      "path": ".github/workflows/.release-binary-assets.yml",
-      "reusable": true,
-      "inputs": [
-        "auto-admission",
-        "contract-lock",
-        "evidence-run-id",
-        "github-governance-receipt-json",
-        "publication-admission-json",
-        "publication-control-plane-audit-json",
-        "publication-expected-json",
-        "publication-gate-aggregate-json",
-        "publication-runner-provenance-json",
-        "publication-used-nonces-json",
-        "publication-version",
-        "release-tag",
-        "runtime-ref",
-        "runtime-selection",
-        "source-sha",
-        "target-ref"
-      ],
-      "inputCount": 16,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": ".binary-release-assets",
-        "role": "component",
-        "category": "release",
-        "purpose": "binary-assets",
-        "status": "active",
-        "canonicalPath": ".github/workflows/.release-binary-assets.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "reusable-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": ".release-pipeline-products",
-      "path": ".github/workflows/.release-pipeline-products.yml",
-      "reusable": true,
-      "inputs": [
-        "attempt",
-        "runtime-selection"
-      ],
-      "inputCount": 2,
-      "secrets": [
-        "BUILDCHAIN_APP_PRIVATE_KEY",
-        "BUILDCHAIN_AUTOMATION_TOKEN",
-        "BUILDCHAIN_NPM_TOKEN"
-      ],
-      "secretCount": 3,
-      "outputs": [
-        "stable-wait"
-      ],
-      "outputCount": 1,
-      "taxonomy": {
-        "id": ".pipeline-products",
-        "role": "component",
-        "category": "release",
-        "purpose": "pipeline-products",
-        "status": "active",
-        "canonicalPath": ".github/workflows/.release-pipeline-products.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "reusable-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": ".release-pipeline-version",
-      "path": ".github/workflows/.release-pipeline-version.yml",
-      "reusable": true,
-      "inputs": [
-        "context",
-        "matrix",
-        "operation",
-        "purpose",
-        "runtime-selection"
-      ],
-      "inputCount": 5,
-      "secrets": [
-        "BUILDCHAIN_APP_PRIVATE_KEY",
-        "BUILDCHAIN_AUTOMATION_TOKEN"
-      ],
-      "secretCount": 2,
-      "outputs": [
-        "context",
-        "matrix",
-        "operation",
-        "stable-wait"
-      ],
-      "outputCount": 4,
-      "taxonomy": {
-        "id": ".pipeline-version",
-        "role": "component",
-        "category": "release",
-        "purpose": "pipeline-version",
-        "status": "active",
-        "canonicalPath": ".github/workflows/.release-pipeline-version.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "reusable-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": ".release-promote",
-      "path": ".github/workflows/.release-promote.yml",
-      "reusable": true,
-      "inputs": [
-        "contract-lock",
-        "request-json",
-        "runtime-ref",
-        "runtime-selection"
-      ],
-      "inputCount": 4,
-      "secrets": [
-        "BUILDCHAIN_ISSUE_APP_ID",
-        "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
-        "BUILDCHAIN_ISSUE_TOKEN",
-        "BUILDCHAIN_PROMOTION_TOKEN",
-        "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
-        "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
-        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
-        "buildchain-issue-app-id",
-        "buildchain-issue-app-private-key",
-        "buildchain-issue-token"
-      ],
-      "secretCount": 10,
-      "outputs": [
-        "built-source-sha",
-        "controller-plan-artifact",
-        "controller-plan-digest",
-        "controller-plan-json",
-        "controller-receipt-artifact",
-        "controller-receipt-digest",
-        "controller-receipt-json",
-        "controller-receipt-status",
-        "discussion-id",
-        "discussion-url",
-        "github-artifact-attestation-evidence-root",
-        "github-artifact-attestation-id",
-        "github-artifact-attestation-publication-receipt-digest",
-        "github-artifact-attestation-url",
-        "promoted-sha",
-        "publication-capability-digest",
-        "publication-commit-evidence-digest",
-        "publication-commit-evidence-path",
-        "publication-commit-payload-root",
-        "publication-commit-url",
-        "release-candidate-action",
-        "release-candidate-artifact",
-        "release-candidate-recovery-receipt-artifact",
-        "release-candidate-recovery-root",
-        "release-invocation-root",
-        "release-propagation-work-artifact",
-        "release-receipt-root",
-        "release-tail-declaration-root",
-        "release-tail-receipt-roots-json",
-        "release-tail-state-root",
-        "release-tail-transaction-root",
-        "release-tail-transaction-state",
-        "release-transaction-root"
-      ],
-      "outputCount": 33,
-      "taxonomy": {
-        "id": ".release-candidate-promote",
-        "role": "component",
-        "category": "release",
-        "purpose": "promote",
-        "status": "active",
-        "canonicalPath": ".github/workflows/.release-promote.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "reusable-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "build",
-      "path": ".github/workflows/build.yml",
-      "reusable": true,
-      "inputs": [
-        "config-path",
-        "contract-lock",
-        "resume-run-id",
-        "runtime-ref",
-        "runtime-selection"
-      ],
-      "inputCount": 5,
-      "secrets": [
-        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
-        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
-        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
-        "BUILDCHAIN_PROMOTION_TOKEN"
-      ],
-      "secretCount": 6,
-      "outputs": [
-        "controller-receipt-artifact",
-        "release-candidate-artifact",
-        "result"
-      ],
-      "outputCount": 3,
-      "taxonomy": {
-        "id": "build",
-        "role": "public",
-        "category": "build",
-        "purpose": "candidate",
-        "status": "active",
-        "canonicalPath": ".github/workflows/build.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "channel-build-router",
-      "capabilityGroup": "reusable-build",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "buildchain-recover",
-      "path": ".github/workflows/buildchain-recover.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "buildchain-recover",
-        "role": "self",
-        "category": "ops",
-        "purpose": "recovery",
-        "status": "active",
-        "canonicalPath": ".github/workflows/buildchain-recover.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "buildchain",
-      "path": ".github/workflows/buildchain.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "buildchain",
-        "role": "self",
-        "category": "ops",
-        "purpose": "pipeline",
-        "status": "active",
-        "canonicalPath": ".github/workflows/buildchain.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "public-build-adopter-qualification",
-      "path": ".github/workflows/public-build-adopter-qualification.yml",
+      "id": ".build-stage-capsule-canary",
+      "path": ".github/workflows/.build-stage-capsule-canary.yml",
       "reusable": true,
       "inputs": [
+        "build-artifact-path",
         "consumer",
-        "consumer-ref",
-        "consumer-repository",
-        "contract-lock",
-        "input-path",
-        "invocation-source-path",
-        "runtime-ref",
-        "runtime-selection"
-      ],
-      "inputCount": 8,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "taxonomy": {
-        "id": "v4-adopter-delivery",
-        "role": "public",
-        "category": "build",
-        "purpose": "adopter-qualification",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-build-adopter-qualification.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "public-build-check",
-      "path": ".github/workflows/public-build-check.yml",
-      "reusable": true,
-      "inputs": [
         "contract-lock",
-        "mode",
-        "node-version",
-        "require-version-state",
-        "runtime-ref",
-        "runtime-selection",
-        "source-proof-closure-paths-json",
-        "source-proof-dependency-paths-json",
-        "source-proof-policy-paths-json",
-        "source-proof-required-contexts-json",
-        "source-proof-reuse",
-        "upload-artifacts",
-        "working-directory"
+        "go-version",
+        "install-artifact-path",
+        "node-version",
+        "runtime-ref",
+        "runtime-selection",
+        "verify-artifact-path"
       ],
-      "inputCount": 13,
+      "inputCount": 9,
       "secrets": [],
       "secretCount": 0,
-      "outputs": [
-        "controller-plan-artifact",
-        "controller-plan-digest",
-        "controller-plan-json",
-        "controller-receipt-artifact",
-        "controller-receipt-digest",
-        "controller-receipt-json",
-        "controller-receipt-status",
-        "source-proof-decision-root",
-        "source-proof-producer-run-id",
-        "source-proof-reuse-reason",
-        "source-proof-reused",
-        "source-proof-root"
-      ],
-      "outputCount": 12,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "implementation",
       "taxonomy": {
-        "id": "check",
-        "role": "public",
+        "id": "v4-stage-capsule-canary",
+        "role": "component",
         "category": "build",
-        "purpose": "check",
+        "purpose": "stage-capsule-canary",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-build-check.yml",
+        "canonicalPath": ".github/workflows/.build-stage-capsule-canary.yml",
         "compatibilityAlias": false
       },
-      "surface": "repository-workflow",
+      "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -788,163 +454,45 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-build-demo",
-      "path": ".github/workflows/public-build-demo.yml",
+      "id": ".build",
+      "path": ".github/workflows/.build.yml",
       "reusable": true,
       "inputs": [
-        "artifact-retention-days",
-        "binary-artifact-digest",
-        "binary-artifact-name",
+        "config-path",
         "contract-lock",
-        "materialize",
-        "materialize-base-ref",
-        "media-profile",
-        "render-failure-advisory",
-        "render-media",
-        "renderer-image",
+        "resume-run-id",
         "runtime-ref",
-        "runtime-selection",
-        "scenario-path",
-        "source-ref"
+        "runtime-selection"
       ],
-      "inputCount": 14,
+      "inputCount": 5,
       "secrets": [
-        "DEMO_UPDATE_TOKEN"
-      ],
-      "secretCount": 1,
-      "outputs": [
-        "capture-artifact-digest",
-        "capture-artifact-name",
-        "evidence-artifact-digest",
-        "evidence-artifact-name",
-        "publication-pr-url",
-        "render-result",
-        "source-sha"
-      ],
-      "outputCount": 7,
-      "taxonomy": {
-        "id": ".declarative-auditable-demo",
-        "role": "public",
-        "category": "build",
-        "purpose": "demo",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-build-demo.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "declarative-auditable-demo",
-      "capabilityGroup": "api-cli-reference",
-      "status": "preview",
-      "owner": "buildchain-workflows",
-      "maturity": "preview",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "public-build-publication",
-      "path": ".github/workflows/public-build-publication.yml",
-      "reusable": true,
-      "inputs": [
-        "artifact-name",
-        "artifact-paths",
-        "artifact-retention-days",
-        "build-command",
-        "buildchain-alpha-contract-lock-path",
-        "buildchain-stable-contract-lock-path",
-        "contract-lock",
-        "node-version",
-        "package-name",
-        "prepare-paper-package",
-        "publish-dist-tag",
-        "runtime-ref",
-        "runtime-selection",
-        "setup-node",
-        "target-ref",
-        "toolchain-command",
-        "toolchain-digest",
-        "toolchain-image",
-        "toolchain-type",
-        "verify-command",
-        "working-directory"
+        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
+        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
+        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN"
       ],
-      "inputCount": 21,
-      "secrets": [],
-      "secretCount": 0,
+      "secretCount": 6,
       "outputs": [
-        "controller-plan-artifact",
-        "controller-plan-digest",
-        "controller-plan-json",
-        "controller-receipt-artifact",
-        "controller-receipt-digest",
-        "controller-receipt-json",
-        "controller-receipt-status",
-        "package-name",
-        "package-version",
-        "publication-artifact-name",
-        "publication-manifest-json",
-        "publication-manifest-path",
-        "publication-passport-path",
-        "publication-registry-path",
-        "publish-dist-tag",
-        "runtime-sha"
-      ],
-      "outputCount": 16,
-      "taxonomy": {
-        "id": "publication-artifact",
-        "role": "public",
-        "category": "build",
-        "purpose": "publication",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-build-publication.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "reusable-build",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "public-build-stage-capsule-canary",
-      "path": ".github/workflows/public-build-stage-capsule-canary.yml",
-      "reusable": true,
-      "inputs": [
-        "build-artifact-path",
-        "consumer",
-        "contract-lock",
-        "go-version",
-        "install-artifact-path",
-        "node-version",
-        "runtime-ref",
-        "runtime-selection",
-        "verify-artifact-path"
+        "result"
       ],
-      "inputCount": 9,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
+      "outputCount": 1,
+      "apiRole": "implementation",
       "taxonomy": {
-        "id": "v4-stage-capsule-canary",
-        "role": "public",
+        "id": ".build",
+        "role": "component",
         "category": "build",
-        "purpose": "stage-capsule-canary",
+        "purpose": "engine",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-build-stage-capsule-canary.yml",
+        "canonicalPath": ".github/workflows/.build.yml",
         "compatibilityAlias": false
       },
-      "surface": "repository-workflow",
+      "surface": "reusable-build",
       "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -952,8 +500,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-alpha-candidate-patrol",
-      "path": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
+      "id": ".ops-alpha-candidate-patrol",
+      "path": ".github/workflows/.ops-alpha-candidate-patrol.yml",
       "reusable": true,
       "inputs": [
         "alpha-workflow-path",
@@ -997,20 +545,21 @@
         "train-root"
       ],
       "outputCount": 17,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "dev-alpha-candidate-patrol",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "alpha-candidate-patrol",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
+        "canonicalPath": ".github/workflows/.ops-alpha-candidate-patrol.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-patrol",
       "capabilityGroup": "governance-versioning",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1018,8 +567,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-bootstrap",
-      "path": ".github/workflows/public-ops-bootstrap.yml",
+      "id": ".ops-bootstrap",
+      "path": ".github/workflows/.ops-bootstrap.yml",
       "reusable": true,
       "inputs": [
         "contract-lock",
@@ -1040,20 +589,21 @@
         "terminal-receipt-root"
       ],
       "outputCount": 7,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "bootstrap",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "bootstrap",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-bootstrap.yml",
+        "canonicalPath": ".github/workflows/.ops-bootstrap.yml",
         "compatibilityAlias": false
       },
-      "surface": "repository-workflow",
+      "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1061,8 +611,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-dev-auto-merge",
-      "path": ".github/workflows/public-ops-dev-auto-merge.yml",
+      "id": ".ops-dev-auto-merge",
+      "path": ".github/workflows/.ops-dev-auto-merge.yml",
       "reusable": true,
       "inputs": [
         "active-lease-context",
@@ -1137,20 +687,21 @@
         "warrant-state-root"
       ],
       "outputCount": 19,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "dev-pr-auto-merge",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "dev-auto-merge",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-dev-auto-merge.yml",
+        "canonicalPath": ".github/workflows/.ops-dev-auto-merge.yml",
         "compatibilityAlias": false
       },
       "surface": "dev-governance",
       "capabilityGroup": "governance-versioning",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1158,8 +709,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-dev-qualification-patrol",
-      "path": ".github/workflows/public-ops-dev-qualification-patrol.yml",
+      "id": ".ops-dev-qualification-patrol",
+      "path": ".github/workflows/.ops-dev-qualification-patrol.yml",
       "reusable": true,
       "inputs": [
         "contract-lock",
@@ -1189,20 +740,63 @@
         "state"
       ],
       "outputCount": 7,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "dev-qualification-patrol",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "dev-qualification-patrol",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
+        "canonicalPath": ".github/workflows/.ops-dev-qualification-patrol.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-patrol",
       "capabilityGroup": "governance-versioning",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": ".ops-git-sync",
+      "path": ".github/workflows/.ops-git-sync.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "force",
+        "remote-host",
+        "remote-path",
+        "remote-repo",
+        "runtime-ref",
+        "runtime-selection"
+      ],
+      "inputCount": 7,
+      "secrets": [
+        "REMOTE_CREDENTIAL",
+        "REMOTE_USER"
+      ],
+      "secretCount": 2,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": ".sync-remote-git",
+        "role": "component",
+        "category": "ops",
+        "purpose": "git-sync",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-git-sync.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1210,8 +804,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-housekeeping",
-      "path": ".github/workflows/public-ops-housekeeping.yml",
+      "id": ".ops-housekeeping",
+      "path": ".github/workflows/.ops-housekeeping.yml",
       "reusable": true,
       "inputs": [
         "apply-enabled",
@@ -1249,29 +843,30 @@
         "report-receipt-root"
       ],
       "outputCount": 9,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "engineering-housekeeper",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "housekeeping",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-housekeeping.yml",
+        "canonicalPath": ".github/workflows/.ops-housekeeping.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-patrol",
       "capabilityGroup": "governance-versioning",
-      "status": "preview",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "preview",
-      "introducedVersion": "4.1.3-alpha.9",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.4-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
       "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only."
     },
     {
-      "id": "public-ops-observed-evidence",
-      "path": ".github/workflows/public-ops-observed-evidence.yml",
+      "id": ".ops-observed-evidence",
+      "path": ".github/workflows/.ops-observed-evidence.yml",
       "reusable": true,
       "inputs": [
         "artifact-path",
@@ -1296,20 +891,21 @@
         "receipt-path"
       ],
       "outputCount": 1,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "patrol-observed-evidence",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "observed-evidence",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-observed-evidence.yml",
+        "canonicalPath": ".github/workflows/.ops-observed-evidence.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-patrol",
       "capabilityGroup": "governance-versioning",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1317,8 +913,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-patrol-daily",
-      "path": ".github/workflows/public-ops-patrol-daily.yml",
+      "id": ".ops-patrol-daily",
+      "path": ".github/workflows/.ops-patrol-daily.yml",
       "reusable": true,
       "inputs": [
         "allowed-head-prefixes",
@@ -1349,20 +945,21 @@
         "skipped-count"
       ],
       "outputCount": 5,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "patrol-daily",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "patrol-daily",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-patrol-daily.yml",
+        "canonicalPath": ".github/workflows/.ops-patrol-daily.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-patrol",
       "capabilityGroup": "governance-versioning",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1370,8 +967,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-patrol-monthly",
-      "path": ".github/workflows/public-ops-patrol-monthly.yml",
+      "id": ".ops-patrol-monthly",
+      "path": ".github/workflows/.ops-patrol-monthly.yml",
       "reusable": true,
       "inputs": [
         "contract-lock",
@@ -1393,20 +990,21 @@
         "skipped-count"
       ],
       "outputCount": 5,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "patrol-monthly",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "patrol-monthly",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-patrol-monthly.yml",
+        "canonicalPath": ".github/workflows/.ops-patrol-monthly.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-patrol",
       "capabilityGroup": "governance-versioning",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1414,8 +1012,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-patrol-weekly",
-      "path": ".github/workflows/public-ops-patrol-weekly.yml",
+      "id": ".ops-patrol-weekly",
+      "path": ".github/workflows/.ops-patrol-weekly.yml",
       "reusable": true,
       "inputs": [
         "contract-lock",
@@ -1437,20 +1035,21 @@
         "skipped-count"
       ],
       "outputCount": 5,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "patrol-weekly",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "patrol-weekly",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-patrol-weekly.yml",
+        "canonicalPath": ".github/workflows/.ops-patrol-weekly.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-patrol",
       "capabilityGroup": "governance-versioning",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1458,8 +1057,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-patrol",
-      "path": ".github/workflows/public-ops-patrol.yml",
+      "id": ".ops-patrol",
+      "path": ".github/workflows/.ops-patrol.yml",
       "reusable": true,
       "inputs": [
         "allowed-head-prefixes",
@@ -1493,20 +1092,21 @@
         "skipped-count"
       ],
       "outputCount": 5,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "buildchain-patrol",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "patrol",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-patrol.yml",
+        "canonicalPath": ".github/workflows/.ops-patrol.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-patrol",
       "capabilityGroup": "governance-versioning",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1514,31 +1114,35 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-pipeline",
-      "path": ".github/workflows/public-ops-pipeline.yml",
+      "id": ".ops-pipeline-delivery",
+      "path": ".github/workflows/.ops-pipeline-delivery.yml",
       "reusable": true,
       "inputs": [
-        "config-path"
+        "request",
+        "runtime-selection"
       ],
-      "inputCount": 1,
-      "secrets": [],
-      "secretCount": 0,
+      "inputCount": 2,
+      "secrets": [
+        "BUILDCHAIN_AUTOMATION_TOKEN"
+      ],
+      "secretCount": 1,
       "outputs": [],
       "outputCount": 0,
+      "apiRole": "implementation",
       "taxonomy": {
-        "id": "pipeline",
-        "role": "public",
+        "id": ".pipeline-delivery",
+        "role": "component",
         "category": "ops",
-        "purpose": "pipeline",
+        "purpose": "pipeline-delivery",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-pipeline.yml",
+        "canonicalPath": ".github/workflows/.ops-pipeline-delivery.yml",
         "compatibilityAlias": false
       },
-      "surface": "repository-workflow",
+      "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1546,32 +1150,37 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-recover",
-      "path": ".github/workflows/public-ops-recover.yml",
+      "id": ".ops-pipeline-execute",
+      "path": ".github/workflows/.ops-pipeline-execute.yml",
       "reusable": true,
       "inputs": [
         "attempt",
-        "runtime-ref"
+        "context",
+        "matrix",
+        "operation",
+        "request",
+        "runtime-selection"
       ],
-      "inputCount": 2,
+      "inputCount": 6,
       "secrets": [],
       "secretCount": 0,
       "outputs": [],
       "outputCount": 0,
+      "apiRole": "implementation",
       "taxonomy": {
-        "id": "recover",
-        "role": "public",
+        "id": ".pipeline-execute",
+        "role": "component",
         "category": "ops",
-        "purpose": "recover",
+        "purpose": "pipeline-execute",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-recover.yml",
+        "canonicalPath": ".github/workflows/.ops-pipeline-execute.yml",
         "compatibilityAlias": false
       },
-      "surface": "repository-workflow",
+      "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1579,8 +1188,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-release-governance",
-      "path": ".github/workflows/public-ops-release-governance.yml",
+      "id": ".ops-release-governance",
+      "path": ".github/workflows/.ops-release-governance.yml",
       "reusable": true,
       "inputs": [
         "apply",
@@ -1598,20 +1207,21 @@
       "secretCount": 2,
       "outputs": [],
       "outputCount": 0,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "release-governance-reconcile",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "release-governance",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-release-governance.yml",
+        "canonicalPath": ".github/workflows/.ops-release-governance.yml",
         "compatibilityAlias": false
       },
       "surface": "release-governance",
       "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1619,8 +1229,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-stable-candidate-patrol",
-      "path": ".github/workflows/public-ops-stable-candidate-patrol.yml",
+      "id": ".ops-stable-candidate-patrol",
+      "path": ".github/workflows/.ops-stable-candidate-patrol.yml",
       "reusable": true,
       "inputs": [
         "auto-approve",
@@ -1656,20 +1266,21 @@
         "stable-version"
       ],
       "outputCount": 6,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "stable-candidate-patrol",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "stable-candidate-patrol",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
+        "canonicalPath": ".github/workflows/.ops-stable-candidate-patrol.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-patrol",
       "capabilityGroup": "governance-versioning",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1677,8 +1288,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-tail-reseal",
-      "path": ".github/workflows/public-ops-tail-reseal.yml",
+      "id": ".ops-tail-reseal",
+      "path": ".github/workflows/.ops-tail-reseal.yml",
       "reusable": true,
       "inputs": [
         "artifact-retention-days",
@@ -1700,20 +1311,21 @@
         "tail-reseal-receipt-root"
       ],
       "outputCount": 2,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "v4-tail-reseal",
-        "role": "public",
+        "role": "component",
         "category": "ops",
         "purpose": "tail-reseal",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-tail-reseal.yml",
+        "canonicalPath": ".github/workflows/.ops-tail-reseal.yml",
         "compatibilityAlias": false
       },
-      "surface": "repository-workflow",
+      "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1721,8 +1333,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-warrant-cancel",
-      "path": ".github/workflows/public-ops-warrant-cancel.yml",
+      "id": ".ops-warrant-cancel",
+      "path": ".github/workflows/.ops-warrant-cancel.yml",
       "reusable": true,
       "inputs": [
         "contract-lock",
@@ -1749,21 +1361,207 @@
         "cancellation-receipt-root",
         "final-state-root"
       ],
-      "outputCount": 3,
+      "outputCount": 3,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": "dev-delivery-warrant-cancel",
+        "role": "component",
+        "category": "ops",
+        "purpose": "warrant-cancel",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-warrant-cancel.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "reusable-workflow",
+      "capabilityGroup": "governance-versioning",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": ".ops-warrant-close",
+      "path": ".github/workflows/.ops-warrant-close.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "current-base-sha",
+        "expected-head-sha",
+        "expected-pr-number",
+        "merge-group-head-sha",
+        "merge-group-tree-sha",
+        "outcome",
+        "reason",
+        "replay-tree-sha",
+        "required-context-roots-json",
+        "runtime-ref",
+        "runtime-selection",
+        "target-branch",
+        "terminal-evidence-root"
+      ],
+      "inputCount": 14,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "close-receipt-root",
+        "final-state-root",
+        "integration-proof-root",
+        "successor-wake-json"
+      ],
+      "outputCount": 4,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": "dev-delivery-warrant-close",
+        "role": "component",
+        "category": "ops",
+        "purpose": "warrant-close",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-warrant-close.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "reusable-workflow",
+      "capabilityGroup": "governance-versioning",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": ".release-artifact-attestation",
+      "path": ".github/workflows/.release-artifact-attestation.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "environment",
+        "evidence-artifact-name",
+        "evidence-run-id",
+        "platform-manifest-artifact-name",
+        "platform-manifest-relative-path",
+        "policy-json",
+        "release-passport-artifact-name",
+        "release-passport-relative-path",
+        "retention-days",
+        "runtime-ref",
+        "runtime-selection",
+        "source-sha",
+        "subject-artifact-name",
+        "subject-relative-path"
+      ],
+      "inputCount": 15,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "attestation-id",
+        "attestation-url",
+        "bundle-digest",
+        "evidence-artifact-name",
+        "evidence-root"
+      ],
+      "outputCount": 5,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": "github-artifact-attestation",
+        "role": "component",
+        "category": "release",
+        "purpose": "artifact-attestation",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-artifact-attestation.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "release-passport",
+      "capabilityGroup": "release-passport-trust",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": ".release-authority",
+      "path": ".github/workflows/.release-authority.yml",
+      "reusable": true,
+      "inputs": [
+        "admission-json",
+        "authority-workflow-path",
+        "auto-admission",
+        "auto-admission-kind",
+        "auto-no-gate",
+        "consumer-gate-command",
+        "consumer-gate-controller-sha",
+        "consumer-gate-evidence-source-sha",
+        "consumer-gate-evidence-source-tree",
+        "consumer-predicate-digest",
+        "consumer-predicate-id",
+        "consumer-qualification-required",
+        "contract-lock",
+        "control-plane-audit-json",
+        "dry-run",
+        "evidence-controller-artifact",
+        "evidence-manifest-pattern",
+        "evidence-passport-artifact",
+        "evidence-payload-pattern",
+        "evidence-publication-artifact",
+        "evidence-repository",
+        "evidence-run-id",
+        "evidence-summary-artifact",
+        "expected-json",
+        "gate-aggregate-json",
+        "github-governance-receipt-json",
+        "package-name",
+        "product",
+        "publication-target",
+        "publication-version",
+        "publisher-workflow-path",
+        "required-status-check",
+        "runner-provenance-json",
+        "runtime-ref",
+        "runtime-selection",
+        "source-sha",
+        "target-ref",
+        "used-nonces-json"
+      ],
+      "inputCount": 38,
+      "secrets": [
+        "BUILDCHAIN_GOVERNANCE_READ_TOKEN",
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
+      ],
+      "secretCount": 2,
+      "outputs": [
+        "capability-artifact",
+        "capability-digest",
+        "capability-json",
+        "gate-aggregate-digest",
+        "gate-aggregate-json"
+      ],
+      "outputCount": 5,
+      "apiRole": "implementation",
       "taxonomy": {
-        "id": "dev-delivery-warrant-cancel",
-        "role": "public",
-        "category": "ops",
-        "purpose": "warrant-cancel",
+        "id": ".publication-authority",
+        "role": "component",
+        "category": "release",
+        "purpose": "authority",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-warrant-cancel.yml",
+        "canonicalPath": ".github/workflows/.release-authority.yml",
         "compatibilityAlias": false
       },
-      "surface": "repository-workflow",
-      "capabilityGroup": "governance-versioning",
-      "status": "active",
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1771,51 +1569,47 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-ops-warrant-close",
-      "path": ".github/workflows/public-ops-warrant-close.yml",
+      "id": ".release-binary-assets",
+      "path": ".github/workflows/.release-binary-assets.yml",
       "reusable": true,
       "inputs": [
+        "auto-admission",
         "contract-lock",
-        "current-base-sha",
-        "expected-head-sha",
-        "expected-pr-number",
-        "merge-group-head-sha",
-        "merge-group-tree-sha",
-        "outcome",
-        "reason",
-        "replay-tree-sha",
-        "required-context-roots-json",
+        "evidence-run-id",
+        "github-governance-receipt-json",
+        "publication-admission-json",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-gate-aggregate-json",
+        "publication-runner-provenance-json",
+        "publication-used-nonces-json",
+        "publication-version",
+        "release-tag",
         "runtime-ref",
         "runtime-selection",
-        "target-branch",
-        "terminal-evidence-root"
-      ],
-      "inputCount": 14,
-      "secrets": [
-        "github-token"
-      ],
-      "secretCount": 1,
-      "outputs": [
-        "close-receipt-root",
-        "final-state-root",
-        "integration-proof-root",
-        "successor-wake-json"
+        "source-sha",
+        "target-ref"
       ],
-      "outputCount": 4,
+      "inputCount": 16,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "implementation",
       "taxonomy": {
-        "id": "dev-delivery-warrant-close",
-        "role": "public",
-        "category": "ops",
-        "purpose": "warrant-close",
+        "id": ".binary-release-assets",
+        "role": "component",
+        "category": "release",
+        "purpose": "binary-assets",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-warrant-close.yml",
+        "canonicalPath": ".github/workflows/.release-binary-assets.yml",
         "compatibilityAlias": false
       },
-      "surface": "repository-workflow",
-      "capabilityGroup": "governance-versioning",
-      "status": "active",
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1823,51 +1617,92 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-release-artifact-attestation",
-      "path": ".github/workflows/public-release-artifact-attestation.yml",
+      "id": ".release-candidate-promote",
+      "path": ".github/workflows/.release-candidate-promote.yml",
       "reusable": true,
       "inputs": [
         "contract-lock",
-        "environment",
-        "evidence-artifact-name",
-        "evidence-run-id",
-        "platform-manifest-artifact-name",
-        "platform-manifest-relative-path",
-        "policy-json",
-        "release-passport-artifact-name",
-        "release-passport-relative-path",
-        "retention-days",
+        "request-json",
         "runtime-ref",
-        "runtime-selection",
-        "source-sha",
-        "subject-artifact-name",
-        "subject-relative-path"
+        "runtime-selection"
       ],
-      "inputCount": 15,
-      "secrets": [],
-      "secretCount": 0,
+      "inputCount": 4,
+      "secrets": [
+        "BUILDCHAIN_ISSUE_APP_ID",
+        "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
+        "BUILDCHAIN_ISSUE_TOKEN",
+        "BUILDCHAIN_PROMOTION_TOKEN",
+        "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+        "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
+        "buildchain-issue-app-id",
+        "buildchain-issue-app-private-key",
+        "buildchain-issue-token"
+      ],
+      "secretCount": 10,
       "outputs": [
-        "attestation-id",
-        "attestation-url",
-        "bundle-digest",
-        "evidence-artifact-name",
-        "evidence-root"
+        "buildchain-channel",
+        "built-source-sha",
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "discussion-id",
+        "discussion-url",
+        "github-artifact-attestation-evidence-root",
+        "github-artifact-attestation-id",
+        "github-artifact-attestation-publication-receipt-digest",
+        "github-artifact-attestation-url",
+        "promoted-sha",
+        "promotion-contract-lock-digest",
+        "promotion-contract-lock-path",
+        "promotion-override-used",
+        "promotion-publication-channel",
+        "promotion-router-ref",
+        "promotion-router-sha",
+        "promotion-runtime-ref",
+        "promotion-runtime-sha",
+        "promotion-shell-ref",
+        "promotion-shell-sha",
+        "promotion-target-ref",
+        "publication-capability-digest",
+        "publication-commit-evidence-digest",
+        "publication-commit-evidence-path",
+        "publication-commit-payload-root",
+        "publication-commit-url",
+        "release-candidate-action",
+        "release-candidate-artifact",
+        "release-candidate-recovery-receipt-artifact",
+        "release-candidate-recovery-root",
+        "release-invocation-root",
+        "release-propagation-work-artifact",
+        "release-receipt-root",
+        "release-tail-declaration-root",
+        "release-tail-receipt-roots-json",
+        "release-tail-state-root",
+        "release-tail-transaction-root",
+        "release-tail-transaction-state",
+        "release-transaction-root"
       ],
-      "outputCount": 5,
+      "outputCount": 45,
+      "apiRole": "implementation",
       "taxonomy": {
-        "id": "github-artifact-attestation",
-        "role": "public",
+        "id": "release-candidate-promote",
+        "role": "component",
         "category": "release",
-        "purpose": "artifact-attestation",
+        "purpose": "candidate-promote",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-release-artifact-attestation.yml",
+        "canonicalPath": ".github/workflows/.release-candidate-promote.yml",
         "compatibilityAlias": false
       },
-      "surface": "release-passport",
-      "capabilityGroup": "release-passport-trust",
-      "status": "active",
+      "surface": "release-governance",
+      "capabilityGroup": "reusable-build",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1875,8 +1710,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-release-oci-compose-preview",
-      "path": ".github/workflows/public-release-oci-compose-preview.yml",
+      "id": ".release-oci-compose-preview",
+      "path": ".github/workflows/.release-oci-compose-preview.yml",
       "reusable": true,
       "inputs": [
         "contract-lock",
@@ -1890,20 +1725,21 @@
       "secretCount": 1,
       "outputs": [],
       "outputCount": 0,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "oci-compose-preview",
-        "role": "public",
+        "role": "component",
         "category": "release",
         "purpose": "oci-compose-preview",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-release-oci-compose-preview.yml",
+        "canonicalPath": ".github/workflows/.release-oci-compose-preview.yml",
         "compatibilityAlias": false
       },
-      "surface": "repository-workflow",
+      "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1911,8 +1747,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-release-paper",
-      "path": ".github/workflows/public-release-paper.yml",
+      "id": ".release-paper",
+      "path": ".github/workflows/.release-paper.yml",
       "reusable": true,
       "inputs": [
         "artifact-name",
@@ -1938,45 +1774,131 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 22,
+      "inputCount": 22,
+      "secrets": [
+        "BUILDCHAIN_GENERATED_WRITE_APP_CLIENT_ID",
+        "BUILDCHAIN_GENERATED_WRITE_APP_PRIVATE_KEY",
+        "BUILDCHAIN_GENERATED_WRITE_TOKEN",
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
+      ],
+      "secretCount": 4,
+      "outputs": [
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "github-release-url",
+        "package-name",
+        "package-version",
+        "propagation-work-artifact",
+        "public-release-tag",
+        "release-passport-path",
+        "upstream-release-json"
+      ],
+      "outputCount": 14,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": "paper-release",
+        "role": "component",
+        "category": "release",
+        "purpose": "paper",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-paper.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "reusable-build",
+      "capabilityGroup": "reusable-build",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": ".release-pipeline-products",
+      "path": ".github/workflows/.release-pipeline-products.yml",
+      "reusable": true,
+      "inputs": [
+        "attempt",
+        "runtime-selection"
+      ],
+      "inputCount": 2,
+      "secrets": [
+        "BUILDCHAIN_APP_PRIVATE_KEY",
+        "BUILDCHAIN_AUTOMATION_TOKEN",
+        "BUILDCHAIN_NPM_TOKEN"
+      ],
+      "secretCount": 3,
+      "outputs": [
+        "stable-wait"
+      ],
+      "outputCount": 1,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": ".pipeline-products",
+        "role": "component",
+        "category": "release",
+        "purpose": "pipeline-products",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-pipeline-products.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": ".release-pipeline-version",
+      "path": ".github/workflows/.release-pipeline-version.yml",
+      "reusable": true,
+      "inputs": [
+        "context",
+        "matrix",
+        "operation",
+        "purpose",
+        "runtime-selection"
+      ],
+      "inputCount": 5,
       "secrets": [
-        "BUILDCHAIN_GENERATED_WRITE_APP_CLIENT_ID",
-        "BUILDCHAIN_GENERATED_WRITE_APP_PRIVATE_KEY",
-        "BUILDCHAIN_GENERATED_WRITE_TOKEN",
-        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
+        "BUILDCHAIN_APP_PRIVATE_KEY",
+        "BUILDCHAIN_AUTOMATION_TOKEN"
       ],
-      "secretCount": 4,
+      "secretCount": 2,
       "outputs": [
-        "controller-plan-artifact",
-        "controller-plan-digest",
-        "controller-plan-json",
-        "controller-receipt-artifact",
-        "controller-receipt-digest",
-        "controller-receipt-json",
-        "controller-receipt-status",
-        "github-release-url",
-        "package-name",
-        "package-version",
-        "propagation-work-artifact",
-        "public-release-tag",
-        "release-passport-path",
-        "upstream-release-json"
+        "context",
+        "matrix",
+        "operation",
+        "stable-wait"
       ],
-      "outputCount": 14,
+      "outputCount": 4,
+      "apiRole": "implementation",
       "taxonomy": {
-        "id": "paper-release",
-        "role": "public",
+        "id": ".pipeline-version",
+        "role": "component",
         "category": "release",
-        "purpose": "paper",
+        "purpose": "pipeline-version",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-release-paper.yml",
+        "canonicalPath": ".github/workflows/.release-pipeline-version.yml",
         "compatibilityAlias": false
       },
-      "surface": "reusable-build",
-      "capabilityGroup": "reusable-build",
-      "status": "active",
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -1984,8 +1906,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-release-promote",
-      "path": ".github/workflows/public-release-promote.yml",
+      "id": ".release-promote",
+      "path": ".github/workflows/.release-promote.yml",
       "reusable": true,
       "inputs": [
         "contract-lock",
@@ -2008,7 +1930,6 @@
       ],
       "secretCount": 10,
       "outputs": [
-        "buildchain-channel",
         "built-source-sha",
         "controller-plan-artifact",
         "controller-plan-digest",
@@ -2024,17 +1945,6 @@
         "github-artifact-attestation-publication-receipt-digest",
         "github-artifact-attestation-url",
         "promoted-sha",
-        "promotion-contract-lock-digest",
-        "promotion-contract-lock-path",
-        "promotion-override-used",
-        "promotion-publication-channel",
-        "promotion-router-ref",
-        "promotion-router-sha",
-        "promotion-runtime-ref",
-        "promotion-runtime-sha",
-        "promotion-shell-ref",
-        "promotion-shell-sha",
-        "promotion-target-ref",
         "publication-capability-digest",
         "publication-commit-evidence-digest",
         "publication-commit-evidence-path",
@@ -2054,21 +1964,22 @@
         "release-tail-transaction-state",
         "release-transaction-root"
       ],
-      "outputCount": 45,
+      "outputCount": 33,
+      "apiRole": "implementation",
       "taxonomy": {
-        "id": "release-candidate-promote",
-        "role": "public",
+        "id": ".release-candidate-promote",
+        "role": "component",
         "category": "release",
         "purpose": "promote",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-release-promote.yml",
+        "canonicalPath": ".github/workflows/.release-promote.yml",
         "compatibilityAlias": false
       },
-      "surface": "release-governance",
-      "capabilityGroup": "reusable-build",
-      "status": "active",
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -2076,8 +1987,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-release-propagation",
-      "path": ".github/workflows/public-release-propagation.yml",
+      "id": ".release-propagation",
+      "path": ".github/workflows/.release-propagation.yml",
       "reusable": true,
       "inputs": [
         "agent-work-context-json",
@@ -2122,20 +2033,21 @@
         "propagation-work-root"
       ],
       "outputCount": 13,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "release-propagation",
-        "role": "public",
+        "role": "component",
         "category": "release",
         "purpose": "propagation",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-release-propagation.yml",
+        "canonicalPath": ".github/workflows/.release-propagation.yml",
         "compatibilityAlias": false
       },
       "surface": "release-propagation",
       "capabilityGroup": "site-and-propagation",
-      "status": "preview",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "preview",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -2143,8 +2055,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-release-signing-authority",
-      "path": ".github/workflows/public-release-signing-authority.yml",
+      "id": ".release-signing-authority",
+      "path": ".github/workflows/.release-signing-authority.yml",
       "reusable": false,
       "inputs": [],
       "inputCount": 0,
@@ -2152,20 +2064,21 @@
       "secretCount": 0,
       "outputs": [],
       "outputCount": 0,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "artifact-signing-authority",
-        "role": "public",
+        "role": "component",
         "category": "release",
         "purpose": "signing-authority",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-release-signing-authority.yml",
+        "canonicalPath": ".github/workflows/.release-signing-authority.yml",
         "compatibilityAlias": false
       },
-      "surface": "repository-workflow",
+      "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -2173,8 +2086,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-release-tail",
-      "path": ".github/workflows/public-release-tail.yml",
+      "id": ".release-tail",
+      "path": ".github/workflows/.release-tail.yml",
       "reusable": true,
       "inputs": [
         "candidate-root",
@@ -2202,20 +2115,21 @@
         "transaction-state"
       ],
       "outputCount": 4,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": "release-tail",
-        "role": "public",
+        "role": "component",
         "category": "release",
         "purpose": "tail",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-release-tail.yml",
+        "canonicalPath": ".github/workflows/.release-tail.yml",
         "compatibilityAlias": false
       },
       "surface": "release-tail-provider-plane",
       "capabilityGroup": "release-passport-trust",
-      "status": "active",
+      "status": "repository-internal",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
@@ -2223,8 +2137,8 @@
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
     {
-      "id": "public-release-web",
-      "path": ".github/workflows/public-release-web.yml",
+      "id": ".release-web",
+      "path": ".github/workflows/.release-web.yml",
       "reusable": true,
       "inputs": [
         "artifact-path",
@@ -2297,13 +2211,143 @@
         "web-surface-urls-json"
       ],
       "outputCount": 23,
+      "apiRole": "implementation",
       "taxonomy": {
         "id": ".web-surface",
-        "role": "public",
+        "role": "component",
         "category": "release",
         "purpose": "web",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-release-web.yml",
+        "canonicalPath": ".github/workflows/.release-web.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": "buildchain-recover",
+      "path": ".github/workflows/buildchain-recover.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": "buildchain-recover",
+        "role": "self",
+        "category": "ops",
+        "purpose": "recovery",
+        "status": "active",
+        "canonicalPath": ".github/workflows/buildchain-recover.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": "buildchain",
+      "path": ".github/workflows/buildchain.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": "buildchain",
+        "role": "self",
+        "category": "ops",
+        "purpose": "pipeline",
+        "status": "active",
+        "canonicalPath": ".github/workflows/buildchain.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": "public-ops-pipeline",
+      "path": ".github/workflows/public-ops-pipeline.yml",
+      "reusable": true,
+      "inputs": [
+        "config-path"
+      ],
+      "inputCount": 1,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "public",
+      "taxonomy": {
+        "id": "pipeline",
+        "role": "public",
+        "category": "ops",
+        "purpose": "pipeline",
+        "status": "active",
+        "canonicalPath": ".github/workflows/public-ops-pipeline.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": "public-ops-recover",
+      "path": ".github/workflows/public-ops-recover.yml",
+      "reusable": true,
+      "inputs": [
+        "attempt",
+        "runtime-ref"
+      ],
+      "inputCount": 2,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "public",
+      "taxonomy": {
+        "id": "recover",
+        "role": "public",
+        "category": "ops",
+        "purpose": "recover",
+        "status": "active",
+        "canonicalPath": ".github/workflows/public-ops-recover.yml",
         "compatibilityAlias": false
       },
       "surface": "repository-workflow",
@@ -2533,7 +2577,7 @@
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
     {
-      "apiRole": "public",
+      "apiRole": "implementation",
       "id": "build/artifact/prepare-attestation",
       "path": "actions/build/artifact/prepare-attestation/action.yml",
       "inputs": [
@@ -2597,7 +2641,7 @@
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
     {
-      "apiRole": "public",
+      "apiRole": "implementation",
       "id": "build/artifact/seal-attestation",
       "path": "actions/build/artifact/seal-attestation/action.yml",
       "inputs": [
@@ -2838,7 +2882,7 @@
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
     {
-      "apiRole": "public",
+      "apiRole": "implementation",
       "id": "build/credential/macos-island",
       "path": "actions/build/credential/macos-island/action.yml",
       "inputs": [
@@ -3375,7 +3419,7 @@
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
     {
-      "apiRole": "public",
+      "apiRole": "implementation",
       "id": "build/lifecycle/run",
       "path": "actions/build/lifecycle/run/action.yml",
       "inputs": [
@@ -3435,7 +3479,7 @@
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
     {
-      "apiRole": "public",
+      "apiRole": "implementation",
       "id": "build/lifecycle/validate",
       "path": "actions/build/lifecycle/validate/action.yml",
       "inputs": [
@@ -4829,7 +4873,7 @@
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
     {
-      "apiRole": "public",
+      "apiRole": "implementation",
       "id": "governance/incident/report",
       "path": "actions/governance/incident/report/action.yml",
       "inputs": [
@@ -6572,7 +6616,7 @@
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
     {
-      "apiRole": "public",
+      "apiRole": "implementation",
       "id": "release/promotion/candidate",
       "path": "actions/release/promotion/candidate/action.yml",
       "inputs": [
@@ -6701,7 +6745,7 @@
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
     {
-      "apiRole": "public",
+      "apiRole": "implementation",
       "id": "release/promotion/ref",
       "path": "actions/release/promotion/ref/action.yml",
       "inputs": [
@@ -7263,7 +7307,7 @@
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
     {
-      "apiRole": "public",
+      "apiRole": "implementation",
       "id": "release/tail/settle",
       "path": "actions/release/tail/settle/action.yml",
       "inputs": [