@kungfu-tech/buildchain 4.1.3-alpha.9 → 4.1.4-alpha.0

package/scripts/check-floating-consumer-policy-contract.mjs

@@ -116,10 +116,10 @@ export function checkFloatingConsumerPolicyContract() {
   assertOrdered("actions/publication/candidate/plan/action.yml", [
     "Admit source checkout", "Enforce v4 floating consumer policy", "Resolve controller identities",
   ]);
-  const publication = YAML.parse(read(".github/workflows/public-build-publication.yml"));
+  const publication = YAML.parse(read(".github/workflows/.build-publication.yml"));
   if (!Object.values(publication.jobs).some((job) => job.steps?.some((step) => step.uses?.endsWith("/actions/publication/candidate/plan"))))
     fail("publication does not invoke its consumer policy node");
-  const stageCanary = read(".github/workflows/public-build-stage-capsule-canary.yml");
+  const stageCanary = read(".github/workflows/.build-stage-capsule-canary.yml");
   if (
     !stageCanary.includes("consumer-admission:") ||
     !jobDependsOn(stageCanary, "qualify", "consumer-admission")
@@ -128,7 +128,7 @@ export function checkFloatingConsumerPolicyContract() {
       "Stage Capsule qualification is not transitively gated by consumer admission",
     );
   }
-  const promotion = read(".github/workflows/public-release-promote.yml");
+  const promotion = read(".github/workflows/.release-candidate-promote.yml");
   if (
     !promotion.includes("consumer-admission:") ||
     !jobDependsOn(promotion, "invoke", "consumer-admission")

package/scripts/check-inventory.mjs

@@ -146,23 +146,23 @@ const requiredPaths = [
   ".buildchain/alpha-contract-lock.json",
   ".buildchain/release-impact.json",
   ".github/actionlint.yaml",
-  ".github/workflows/public-ops-release-governance.yml",
-  ".github/workflows/public-ops-dev-auto-merge.yml",
-  ".github/workflows/public-ops-patrol.yml",
-  ".github/workflows/public-ops-patrol-daily.yml",
-  ".github/workflows/public-ops-patrol-weekly.yml",
-  ".github/workflows/public-ops-patrol-monthly.yml",
-  ".github/workflows/public-ops-observed-evidence.yml",
-  ".github/workflows/public-release-promote.yml",
+  ".github/workflows/.ops-release-governance.yml",
+  ".github/workflows/.ops-dev-auto-merge.yml",
+  ".github/workflows/.ops-patrol.yml",
+  ".github/workflows/.ops-patrol-daily.yml",
+  ".github/workflows/.ops-patrol-weekly.yml",
+  ".github/workflows/.ops-patrol-monthly.yml",
+  ".github/workflows/.ops-observed-evidence.yml",
+  ".github/workflows/.release-candidate-promote.yml",
   ".github/workflows/.release-promote.yml",
-  ".github/workflows/public-release-propagation.yml",
-  ".github/workflows/public-release-paper.yml",
+  ".github/workflows/.release-propagation.yml",
+  ".github/workflows/.release-paper.yml",
   ".github/workflows/.release-binary-assets.yml",
   ".github/workflows/.build.yml",
   ".github/workflows/.build-gate-profile.yml",
   ".github/workflows/.build-demo-adapter.yml",
-  ".github/workflows/public-build-demo.yml",
-  ".github/workflows/build.yml",
+  ".github/workflows/.build-demo.yml",
+  ".github/workflows/.build-candidate.yml",
   "fixtures/libnode-shaped/buildchain.toml",
   "fixtures/libnode-shaped/.github/workflows/build.yml",
   "fixtures/libnode-shaped/package.json",
@@ -281,7 +281,7 @@ for (const requiredSnippet of [
   }
 }
 const channelBuildWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/build.yml"),
+  path.join(root, ".github/workflows/.build-candidate.yml"),
   "utf8",
 );
 const advancedPromotionWorkflow = fs.readFileSync(
@@ -289,7 +289,7 @@ const advancedPromotionWorkflow = fs.readFileSync(
   "utf8",
 );
 const channelPromotionWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/public-release-promote.yml"),
+  path.join(root, ".github/workflows/.release-candidate-promote.yml"),
   "utf8",
 );
 assertPromotionInventory(root);
@@ -306,7 +306,7 @@ const actionlintConfig = fs.readFileSync(
   "utf8",
 );
 for (const requiredSnippet of [
-  ".github/workflows/build.yml:",
+  ".github/workflows/.build-candidate.yml:",
   ".github/workflows/.build.yml:",
   ".github/workflows/.build-gate-profile.yml:",
   'property "workflow_ref" is not defined in object type',
@@ -859,25 +859,25 @@ for (const requiredSnippet of [
 }
 const reusableBuildSurfaceDoc = fs.readFileSync(path.join(root, "docs/reusable-build-surface.md"), "utf8");
 for (const requiredSnippet of [
-  "config-path",
-  "buildchain.toml",
-  ".buildchain/contract-lock.json",
-  ".buildchain/alpha-contract-lock.json",
-  "architecture/build-environments.json",
-  "build.contract",
-  "cache roots",
-  "exact consumer source",
-  "run-build-stage",
-  "transfer-build-artifact",
+  ".buildchain/buildchain.toml",
+  "schema = 2",
+  "[[products]]",
+  "public-ops-pipeline.yml@v4",
+  "public-ops-recover.yml@v4",
+  "Without a lock",
+  "exact Git commit, tree and TOML blob",
+  "without provider credentials",
+  "original attempt",
+  "Consumers do not call",
 ]) {
   if (!reusableBuildSurfaceDoc.includes(requiredSnippet)) {
-    throw new Error(`reusable build surface doc missing contract lock snippet: ${requiredSnippet}`);
+    throw new Error(`consumer build surface doc missing schema-2 contract snippet: ${requiredSnippet}`);
   }
 }
 for (const [docName, docSource] of Object.entries({ "docs/cli.md": cliDoc, "docs/install.md": installDoc })) {
   for (const requiredSnippet of [
     "minimumReleaseAgeExclude",
-    "@kungfu-tech/buildchain@4.0.0",
+    "@kungfu-tech/buildchain@4.1.3",
     "package/version-specific",
   ]) {
     if (!docSource.includes(requiredSnippet)) {

package/scripts/check-maintainability.mjs

@@ -1,7 +1,14 @@
 #!/usr/bin/env node
 
 import fs from "node:fs";
-import { projectRenamedMetrics } from "./source-metric-lineage.mjs";
+import {
+  projectRenamedMetrics,
+  projectWorkflowMetrics,
+} from "./source-metric-lineage.mjs";
+import {
+  workflowPath,
+  TAXONOMY_PATH,
+} from "../packages/core/workflow/workflow-taxonomy.mjs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
@@ -417,10 +424,25 @@ function checkMaintainability({ root = process.cwd() } = {}) {
     if (file.endsWith(".rs")) baselineFiles[file] = metrics;
   }
   const baselineTests = testMetricsAtRevision(root, extendedCoverageRevision);
-  const baselineWorkflows = workflowMetricsAtRevision(
-    root,
-    extendedCoverageRevision,
-  );
+  const taxonomyCoordinates = (policy) =>
+    policy.entries.map((entry) => ({
+      id: entry.id,
+      path: workflowPath(entry),
+    }));
+  const workflowLineage = projectWorkflowMetrics({
+    before: taxonomyCoordinates(
+      JSON.parse(
+        gitOutput(root, [
+          "show",
+          `${extendedCoverageRevision}:${TAXONOMY_PATH}`,
+        ]),
+      ),
+    ),
+    after: taxonomyCoordinates(readJson(root, TAXONOMY_PATH)),
+    metrics: workflowMetricsAtRevision(root, extendedCoverageRevision),
+    currentPaths: new Set(Object.keys(current.workflows)),
+  });
+  const baselineWorkflows = workflowLineage.metrics;
   const issues = evaluateExceptionGovernance({ policy });
   issues.push(...evaluateExceptionBudget({ policy }));
   const hotspots = collectHotspots(root, current, 20, debt.hotspots || []);
@@ -469,6 +491,7 @@ function checkMaintainability({ root = process.cwd() } = {}) {
     trackedFiles: current.repository.trackedFiles,
     sourceFiles: current.repository.handMaintainedSourceFiles,
     measurementRenames: lineage.renames,
+    workflowMeasurementRenames: workflowLineage.renames,
     publicSurface: current.publicSurface,
     hotspots: current.hotspots,
     governedDebtSurfaces: Object.values(debt.surfaces).reduce(

package/scripts/check-public-dogfood-contract.mjs

@@ -11,7 +11,7 @@ const DEFAULT_ROOT = path.resolve(
   "..",
 );
 const CALLER_PATH = ".github/workflows/self-build-public-consumer-dogfood.yml";
-const REUSABLE_PATH = ".github/workflows/public-build-stage-capsule-canary.yml";
+const REUSABLE_PATH = ".github/workflows/.build-stage-capsule-canary.yml";
 export const PUBLIC_DOGFOOD_ENTRY_REF = "v4";
 const PRIVATE_CONSUMER = ["buildchain", "self", "dogfood"].join("-");
 const PRIVATE_SHADOW = ["kungfu", "shadow"].join("-");
@@ -201,7 +201,7 @@ function assertWorkflowInventory(root) {
       fail(`${relative} invokes the private qualification script directly`);
     if (
       relative !== CALLER_PATH &&
-      text.includes(".github/workflows/public-build-stage-capsule-canary.yml@")
+      text.includes(".github/workflows/.build-stage-capsule-canary.yml@")
     )
       fail(`${relative} creates a second v4 dogfood caller`);
     if (relative !== REUSABLE_PATH && relative !== CALLER_PATH)
@@ -275,7 +275,7 @@ function assertArchitecture(root) {
     !dogfood ||
     dogfood.callerWorkflow !== CALLER_PATH ||
     dogfood.reusableWorkflow !==
-      "kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml" ||
+      "kungfu-systems/buildchain/.github/workflows/.build-stage-capsule-canary.yml" ||
     dogfood.runtimeBinding !== "entry-selected-runtime" ||
     dogfood.consumerSourceBinding !== "github.sha" ||
     JSON.stringify(dogfood.executableStages) !==

package/scripts/check-release-topology.mjs

@@ -532,7 +532,7 @@ export function checkReleaseTopology() {
   assertPipelinePublicationTopology(ledger, discoverReleaseTopology, root);
   const preview = ledger.postPublicationScope;
   assert.deepEqual(preview.workflowPaths, [
-    ".github/workflows/public-release-oci-compose-preview.yml",
+    ".github/workflows/.release-oci-compose-preview.yml",
   ]);
   const previewTopology = discoverReleaseTopology(
     preview.workflowPaths,

package/scripts/check-self-consumer-contract.mjs

@@ -2,12 +2,11 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { parse as yaml } from "yaml";
-import { compileConsumerPlan } from "../packages/core/consumer/contract/plan.js";
+import * as consumerPlan from "../packages/core/consumer/contract/plan.js";
 import { consumerWorkflows } from "../packages/core/consumer/contract/entries.js";
 import { workflowPath } from "../packages/core/workflow/workflow-taxonomy.mjs";
 
-export const SELF_ENTRY_CHANNEL = "v4-alpha";
-export const SELF_CONFIG_PATH = ".buildchain/minimal-consumer.toml";
+export const SELF_ENTRY_CHANNEL = "v4";
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const PLATFORMS = ["linux-x64", "macos-arm64", "windows-x64"];
 
@@ -19,10 +18,11 @@ export function checkSelfConsumerContract(root = ROOT) {
   const fail = (message) => {
     throw new Error(`self-consumer-contract: ${message}`);
   };
-  const plan = compileConsumerPlan(read(SELF_CONFIG_PATH));
-  if (read(SELF_CONFIG_PATH) !== read(".buildchain/buildchain.toml"))
-    fail("transition config must match the canonical product plan");
-  const callers = consumerWorkflows(SELF_ENTRY_CHANNEL, SELF_CONFIG_PATH);
+  const plan = consumerPlan.compileConsumerPlan(read(consumerPlan.CONFIG_PATH));
+  const retired = path.join(root, ".buildchain/minimal-consumer.toml");
+  if (fs.lstatSync(retired, { throwIfNoEntry: false }))
+    fail("retired transition config must not remain in the self consumer tree");
+  const callers = consumerWorkflows();
   for (const [file, bytes] of Object.entries(callers))
     if (read(file) !== bytes) fail(`${file}: generated caller drift`);
   const taxonomy = JSON.parse(read("architecture/workflow-taxonomy.json"));

package/scripts/check-universal-workflow-bootstrap.mjs

@@ -41,7 +41,7 @@ assert.equal(executor.with["mutation-token"], "${{ inputs.secrets-buildchain-pro
 assert.equal(executor.with.token, "${{ github.token }}");
 assert.doesNotMatch(read(contract.bootstrap.publicWorkflow), /admission-policy-json:/u);
 const template = parse(contract.bootstrap.consumerTemplate);
-assert.equal(template.jobs.bootstrap.uses, "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4");
+assert.equal(template.jobs.bootstrap.uses, "kungfu-systems/buildchain/.github/workflows/.ops-bootstrap.yml@v4");
 assert.equal(template.jobs.bootstrap.with["runtime-ref"], "${{ inputs.runtime-ref }}");
 assert.equal(contract.bootstrap.selfDogfoodActive, false);
 assert.equal(fs.existsSync(path.join(root, contract.bootstrap.selfDogfoodWorkflow)), false,

package/scripts/generate-channel-promotion-workflow.mjs

@@ -41,4 +41,4 @@ export function generateChannelPromotionWorkflow(source) {
   }, { lineWidth: 0, aliasDuplicateObjects: false });
 }
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url))
-  writeWorkflowSource(root, ".github/workflows/public-release-promote.yml", generateChannelPromotionWorkflow(fs.readFileSync(path.join(root, ".github/workflows/.release-promote.yml"), "utf8")));
+  writeWorkflowSource(root, ".github/workflows/.release-candidate-promote.yml", generateChannelPromotionWorkflow(fs.readFileSync(path.join(root, ".github/workflows/.release-promote.yml"), "utf8")));

package/scripts/generate-minimal-consumer-contract.mjs

@@ -5,6 +5,7 @@ import { parse as yaml } from "yaml";
 import { format } from "prettier";
 import { standardConsumerExample } from "../packages/core/consumer/contract/examples.js";
 import { inspectConsumerContract } from "../packages/core/consumer/contract/inspection.js";
+import { validateConsumerWiring } from "../packages/core/consumer/contract/local-validation.js";
 import { workflowPath } from "../packages/core/workflow/workflow-taxonomy.mjs";
 
 const root = process.cwd(),
@@ -13,6 +14,25 @@ const tracked = execFileSync("git", ["ls-files", "-z"], { encoding: "utf8" })
   .split("\0")
   .filter(Boolean);
 
+if (check) {
+  const files = Object.create(null);
+  for (const file of tracked)
+    Object.defineProperty(files, file, {
+      enumerable: true,
+      get: () => fs.readFileSync(path.join(root, file), "utf8"),
+    });
+  const { channel } = validateConsumerWiring(root);
+  const inspection = inspectConsumerContract(files, { channel });
+  if (inspection.controlIssues.length)
+    throw new Error(inspection.controlIssues.join("\n"));
+  const unresolved = inspection.commandClosures.filter(
+    (closure) => !closure.commandEdgesResolved,
+  ).length;
+  console.log(
+    `Self control wiring verified; ${unresolved} product graphs remain unresolved and require read-only runtime execution.`,
+  );
+}
+
 function output(file, value) {
   const target = path.join(root, file);
   if (check) {
@@ -143,7 +163,7 @@ output(
   await format(
     JSON.stringify({
       schema: "buildchain.consumer-migration/v1",
-      stage: "self-cutover-in-progress; final-release-qualification-pending",
+      stage: "self-default-entry; final-release-qualification-pending",
       workflows: workflowInventory(),
       consumerSources: consumerSourceInventory(),
     }),

package/scripts/generate-site-bundle.mjs

@@ -887,8 +887,9 @@ function buildSiteBundle() {
         ["self-hosted-runner-smoke", "compatibility-fixture"],
       ]);
       const engineeringHousekeeper = semanticId.startsWith("engineering-housekeeper");
+      if (classification?.role === "component") statusById.set(semanticId, "repository-internal");
       return {
-        ...entry,
+        ...entry, apiRole: classification?.role === "public" ? "public" : "implementation",
         ...(classification ? { taxonomy: { id: classification.id, role: classification.role, category: classification.category, purpose: classification.purpose, status: classification.status, canonicalPath: workflowPath(classification), ...(classification.role === "self" && classification.migration ? { contractPath: classification.migration.previousPath } : {}), compatibilityAlias: entry.path !== workflowPath(classification) } } : {}),
         surface: surfaceById.get(semanticId) || (entry.path.includes("/.") ? "reusable-workflow" : "repository-workflow"),
         capabilityGroup: workflowCapabilityGroup({

package/scripts/generate-tail-reseal-fixture.mjs

@@ -19,8 +19,8 @@ export function tailResealFixturePolicyReceipt(fixture, policy) {
   try {
     fs.mkdirSync(path.join(root, ".github/workflows"), { recursive: true });
     fs.writeFileSync(
-      path.join(root, ".github/workflows/build.yml"),
-      "jobs:\n  build:\n    uses: kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml@v4-alpha\n",
+      path.join(root, ".github/workflows/.build-candidate.yml"),
+      "jobs:\n  build:\n    uses: kungfu-systems/buildchain/.github/workflows/.build-stage-capsule-canary.yml@v4-alpha\n",
     );
     fs.mkdirSync(path.join(root, ".buildchain"), { recursive: true });
     for (const [file, ref, resolvedSha] of [
@@ -51,7 +51,7 @@ export function tailResealFixturePolicyReceipt(fixture, policy) {
       root,
       repository: fixture.repository,
       sourceSha: fixture.source.sha,
-      invokedWorkflow: "public-build-stage-capsule-canary.yml",
+      invokedWorkflow: ".build-stage-capsule-canary.yml",
       expectedInvocationChannel: "alpha",
       resolvedRuntimeSha: fixture.runtime.sha,
       policy,

package/scripts/inventory/promotion.mjs

@@ -8,7 +8,7 @@ import { generateChannelPromotionWorkflow } from "../generate-channel-promotion-
 
 export function assertPromotionInventory(root) {
   const read = (file) => fs.readFileSync(path.join(root, file), "utf8");
-  const publicPath = ".github/workflows/public-release-promote.yml";
+  const publicPath = ".github/workflows/.release-candidate-promote.yml";
   const api = YAML.parse(read(publicPath));
   assert.equal(
     read(publicPath),

package/scripts/next-development-self-dogfood-harness.mjs

@@ -164,7 +164,7 @@ export function validateSelfDogfoodRoute(route) {
     targetRepository !== "kungfu-systems/buildchain" ||
     route.runtimeRef !== "v4-alpha" ||
     route.publicWorkflow !==
-      `${targetRepository}/.github/workflows/build.yml@v4-alpha` ||
+      `${targetRepository}/.github/workflows/.build-candidate.yml@v4-alpha` ||
     route.protectedDevBranch !== PROTECTED_DEV_BRANCH ||
     JSON.stringify(route.hostedReadbackPaths) !==
       JSON.stringify(HOSTED_READBACK_PATHS)

package/scripts/next-development-self-dogfood.mjs

@@ -66,7 +66,7 @@ export function validateSelfDogfoodCheckpoint(checkpoint) {
   if (
     checkpoint.route.runtimeRef !== "v4-alpha" ||
     checkpoint.route.publicWorkflow !==
-      `${targetRepository}/.github/workflows/build.yml@v4-alpha` ||
+      `${targetRepository}/.github/workflows/.build-candidate.yml@v4-alpha` ||
     targetRepository !== "kungfu-systems/buildchain"
   ) {
     throw new Error("checkpoint requires the public owner/repo v4-alpha route");
@@ -122,7 +122,7 @@ export async function createSelfDogfoodCheckpoint({
   const routeRepository = repository(targetRepository);
   const route = {
     repository: routeRepository,
-    publicWorkflow: `${routeRepository}/.github/workflows/build.yml@v4-alpha`,
+    publicWorkflow: `${routeRepository}/.github/workflows/.build-candidate.yml@v4-alpha`,
     runtimeRef: required(runtimeRef, "runtimeRef"),
     runtimeSha: exactSha(runtimeSha, "runtimeSha"),
     contractRoot: exactRoot(contractRoot, "contractRoot"),
@@ -239,7 +239,7 @@ export function validateSelfDogfoodEvidence(evidence) {
   validateAdapterEvidence(evidence.adapter, semver, anchored);
   if (
     evidence.adoption?.coordinate !==
-      "kungfu-systems/buildchain/.github/workflows/build.yml@v4" ||
+      "kungfu-systems/buildchain/.github/workflows/.build-candidate.yml@v4" ||
     evidence.adoption?.exactShaProductionPin !== false
   ) {
     throw new Error("Kungfu adoption must use the floating v4 coordinate");
@@ -367,7 +367,7 @@ export async function resumeSelfDogfoodCheckpoint(
       },
     },
     adoption: {
-      coordinate: "kungfu-systems/buildchain/.github/workflows/build.yml@v4",
+      coordinate: "kungfu-systems/buildchain/.github/workflows/.build-candidate.yml@v4",
       runtimeRef: "v4",
       exactShaProductionPin: false,
     },

package/scripts/site-capability-metadata.mjs

@@ -134,14 +134,10 @@ export function cliCommandMeta(id) {
     "npm-dry-run": { group: "release-passport-trust", purpose: "Verify npm publish shape before a release transaction." },
     paper: { group: "reusable-build", purpose: "Inspect the unified paper repository and publication command families." },
     "paper-agent": { group: "getting-started", purpose: "Verify the mandatory managed Paper agent entry contract on an existing work branch." },
-    "paper-alpha": { group: "release-passport-trust", purpose: "Plan or open the protected dev-to-alpha paper publication PR without direct publication." },
-    "paper-bootstrap-npm": { group: "release-passport-trust", purpose: "Dry-run or explicitly bootstrap the public npm package and bind GitHub Trusted Publishing." },
-    "paper-build": { group: "reusable-build", purpose: "Plan or execute the existing two-clean-build reproducibility gate for a paper." },
-    "paper-fleet-audit": { group: "governance-versioning", purpose: "Discover Paper repositories and emit one deterministic v3 dependency, control-surface, and governance audit." },
+    "paper-fleet-audit": { group: "governance-versioning", purpose: "Discover Paper repositories and audit current consumer configuration, dependencies, and governance." },
     "paper-fleet-update": { group: "governance-versioning", purpose: "Plan or write a bounded v3 migration across isolated Paper work branches." },
     "paper-migrate": { group: "getting-started", purpose: "Plan or write the bounded Buildchain-owned control-file migration for an existing paper repository." },
-    "paper-preflight": { group: "reusable-build", purpose: "Report exact source, runtime, permission, npm trust, deterministic build, and release-state readiness." },
-    "paper-resume": { group: "release-passport-trust", purpose: "Plan or dispatch recovery of the exact existing sealed paper release transaction." },
+    "paper-preflight": { group: "reusable-build", purpose: "Validate the schema-2 consumer configuration and inspect retained legacy evidence without inferring hosted publication." },
     "paper-scaffold": { group: "getting-started", purpose: "Plan or write an idempotent, no-overwrite, release-ready paper repository scaffold." },
     "paper-status": { group: "reusable-build", purpose: "Report explicit evidence for every paper lifecycle state without unsupported inference." },
     "paper-work-start": { group: "getting-started", purpose: "Create a safe Paper work branch from the exact canonical remote development SHA." },

package/scripts/source-metric-lineage.mjs

@@ -1,17 +1,72 @@
-import { execFileSync } from 'node:child_process';
+import { execFileSync } from "node:child_process";
 
 // Measurement identity follows Git's observed renames. This does not resolve a
 // runtime path or keep a removed entrypoint callable.
-export function projectRenamedMetrics({ root, revision, metrics, currentPaths }) {
-  const records = execFileSync('git', ['diff', '--name-status', '-z', '--find-renames=50%', '--diff-filter=R', revision],
-    { cwd: root, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }).split('\0');
-  const projected = { ...metrics }, renames = [];
+export function projectRenamedMetrics({
+  root,
+  revision,
+  metrics,
+  currentPaths,
+}) {
+  const records = execFileSync(
+    "git",
+    [
+      "diff",
+      "--name-status",
+      "-z",
+      "--find-renames=50%",
+      "--diff-filter=R",
+      revision,
+    ],
+    { cwd: root, encoding: "utf8", maxBuffer: 16 * 1024 * 1024 },
+  ).split("\0");
+  const projected = { ...metrics },
+    renames = [];
   for (let index = 0; index < records.length && records[index]; index += 3) {
     const [status, source, target] = records.slice(index, index + 3);
-    if (!/^R\d+$/.test(status) || !source || !target) throw Error('Invalid Git metric lineage');
-    if (!metrics[source] || metrics[target] || !currentPaths.has(target)) continue;
+    if (!/^R\d+$/.test(status) || !source || !target)
+      throw Error("Invalid Git metric lineage");
+    if (!metrics[source] || metrics[target] || !currentPaths.has(target))
+      continue;
     projected[target] = { ...metrics[source], file: target };
     renames.push({ source, target, similarity: Number(status.slice(1)) });
   }
   return { metrics: projected, renames };
 }
+
+// Workflow taxonomy IDs survive role/path changes and are available at both
+// exact cuts even in a shallow checkout. Preserve their original measured budget.
+export function projectWorkflowMetrics({
+  metrics,
+  before,
+  after,
+  currentPaths,
+}) {
+  for (const entries of [before, after])
+    for (const key of ["id", "path"])
+      if (
+        new Set(entries.map((entry) => entry[key])).size !== entries.length ||
+        entries.some((entry) => typeof entry[key] !== "string" || !entry[key])
+      )
+        throw Error(
+          "Workflow measurement identities must be unique and explicit",
+        );
+  const originals = new Map(before.map((entry) => [entry.id, entry.path]));
+  const projected = { ...metrics },
+    renames = [];
+  for (const { id, path: target } of after) {
+    const source = originals.get(id);
+    if (
+      !source ||
+      source === target ||
+      !metrics[source] ||
+      metrics[target] ||
+      !currentPaths.has(target) ||
+      currentPaths.has(source)
+    )
+      continue;
+    projected[target] = { ...metrics[source], file: target };
+    renames.push({ id, source, target });
+  }
+  return { metrics: projected, renames };
+}

package/scripts/verify-golden-path.mjs

@@ -56,7 +56,12 @@ export function verifyGoldenPath() {
           name: "buildchain-golden-path-consumer",
           version: "0.1.0",
           private: true,
-          scripts: { build: 'node -e ""', check: 'node -e ""' },
+          scripts: {
+            build:
+              "node -e \"require('fs').mkdirSync('dist',{recursive:true});require('fs').writeFileSync('dist/index.js','export const value = 1;')\"",
+            check:
+              "node -e \"require('assert').ok(require('fs').statSync('dist/index.js').size > 0)\"",
+          },
         },
         null,
         2,
@@ -88,34 +93,19 @@ export function verifyGoldenPath() {
       { cwd: consumer, json: true },
     );
     const workflow = fs.readFileSync(
-      path.join(consumer, ".github", "workflows", "build.yml"),
+      path.join(consumer, ".github", "workflows", "buildchain.yml"),
       "utf8",
     );
-    const releaseDryRun = run(
-      buildchain,
-      ["release", "--dry-run", "--target-ref", "alpha/v4/v4.0", "--json"],
-      { cwd: consumer, json: true },
-    );
-    const passportPath = path.join(
-      consumer,
-      ".buildchain",
-      "golden-path",
-      "buildchain.release.json",
-    );
-    fs.mkdirSync(path.dirname(passportPath), { recursive: true });
-    run(
-      process.execPath,
-      [
-        "--input-type=module",
-        "--eval",
-        `import fs from "node:fs"; import { createReleasePassport } from "@kungfu-tech/buildchain"; const value=createReleasePassport({repository:"example/consumer",tag:"v0.1.0-alpha.0",sourceSha:"a".repeat(40),assets:[{name:"consumer.tgz",sha256:"b".repeat(64)}]}); fs.writeFileSync(${JSON.stringify(passportPath)}, JSON.stringify(value,null,2)+"\\n");`,
-      ],
-      { cwd: consumer },
-    );
-    const inspection = run(
-      buildchain,
-      ["inspect", "release", "--passport", passportPath, "--json"],
-      { cwd: consumer, json: true },
+    run("git", ["init", "-q"], { cwd: consumer });
+    const doctor = run(buildchain, ["doctor", "--json"], {
+      cwd: consumer,
+      json: true,
+    });
+    run("npm", ["run", "build"], { cwd: consumer });
+    run("npm", ["run", "check"], { cwd: consumer });
+    const recovery = fs.readFileSync(
+      path.join(consumer, ".github/workflows/buildchain-recover.yml"),
+      "utf8",
     );
 
     assert(
@@ -133,7 +123,7 @@ export function verifyGoldenPath() {
       "Golden Path validation did not retain the required lifecycle stages",
     );
     assert(
-      /uses:\s+kungfu-systems\/buildchain\/\.github\/workflows\/build\.yml@v4/.test(
+      /uses:\s+kungfu-systems\/buildchain\/\.github\/workflows\/public-ops-pipeline\.yml@v4/.test(
         workflow,
       ),
       "Golden Path workflow is not a thin v4 reusable-workflow caller",
@@ -142,13 +132,18 @@ export function verifyGoldenPath() {
       !/\n\s+(?:inputs|with|steps):/.test(workflow),
       "Golden Path ordinary caller must have zero inputs and delegate its steps",
     );
+    assert(doctor.ok, "Golden Path doctor rejected the initialized consumer");
+    assert(
+      validation.config.schema === 2 && validation.products[0].type === "npm",
+      "Golden Path did not validate the schema-2 product",
+    );
     assert(
-      releaseDryRun && typeof releaseDryRun === "object",
-      "Golden Path release dry-run did not return JSON",
+      /public-ops-recover\.yml@v4/.test(recovery),
+      "Golden Path recovery entry is not the shared caller",
     );
     assert(
-      inspection && typeof inspection === "object",
-      "Golden Path Release Passport inspection did not return JSON",
+      Object.keys(validation.consumer || {}).length > 0,
+      "Golden Path validation did not inspect caller wiring",
     );
     return {
       contract: "kungfu-buildchain-golden-path-verification/v1",
@@ -156,9 +151,10 @@ export function verifyGoldenPath() {
       version,
       projectType: initialized.type,
       validationPath: validation.config?.path,
-      reusableWorkflow: ".github/workflows/build.yml",
-      releaseDryRun: true,
-      releasePassportInspection: true,
+      reusableWorkflows: validation.consumer.workflows,
+      productBuildAndVerification: true,
+      doctor: doctor.ok,
+      providerEffects: false,
     };
   } finally {
     fs.rmSync(temporary, { recursive: true, force: true });

package/templates/native-dev-delivery.yml

@@ -93,7 +93,7 @@ permissions:
   statuses: write
 jobs:
   deliver:
-    uses: kungfu-systems/buildchain/.github/workflows/public-ops-dev-auto-merge.yml@v4-alpha
+    uses: kungfu-systems/buildchain/.github/workflows/.ops-dev-auto-merge.yml@v4-alpha
     with:
       runtime-ref: ${{ inputs.runtime-ref || '' }}
       target-branch: ${{ github.event.client_payload.candidate.targetBranch || inputs.target-branch }}

package/templates/universal-buildchain-bootstrap.yml

@@ -30,7 +30,7 @@ permissions:
 
 jobs:
   bootstrap:
-    uses: kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4
+    uses: kungfu-systems/buildchain/.github/workflows/.ops-bootstrap.yml@v4
     with:
       request-json: ${{ inputs.request-json }}
       runtime-ref: ${{ inputs.runtime-ref }}