@kungfu-tech/buildchain 4.1.3 → 4.1.4-alpha.0

package/dist/site/kfd-claims.json

@@ -14,20 +14,20 @@
   },
   "runtimeContract": {
     "contract": "kungfu-buildchain-runtime-contract-world",
-    "compatibilityDigest": "sha256:81e32696723fe82fe29d2b2214cd56cf6c87bbeae5cff1a201de7ee7fd10ee9c",
+    "compatibilityDigest": "sha256:808c03915bf090ded3082642ffc5163e15bdd090b629344df9bfb65544041dd3",
     "majorLine": "v4"
   },
   "publicSurfaceReverseAudit": {
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "c5ae763ca6bac9648d2291c1908da6a0ee78785651aecfced739c9988dfcf92f",
+    "sha256": "55d89b706fec968198fcef2d3a492a68578ff3054acbff25cd07ebcf199cf34a",
     "summary": {
-      "cliCommandCount": 117,
+      "cliCommandCount": 113,
       "workflowCount": 44,
       "actionCount": 283,
       "sitePageCount": 94,
-      "docCommandRefCount": 1036,
+      "docCommandRefCount": 998,
       "failureCount": 0
     },
     "auditBoundary": {
@@ -185,7 +185,7 @@
         "packages/core/contracts/commands/buildchain-contract-lock.mjs",
         ".github/workflows/.build.yml",
         ".github/workflows/.release-promote.yml",
-        ".github/workflows/public-release-promote.yml",
+        ".github/workflows/.release-candidate-promote.yml",
         "docs/reusable-build-surface.md"
       ],
       "artifactPaths": [
@@ -201,7 +201,7 @@
         "actions/release/promotion/ref/action.yml",
         "packages/core/release/commands/ensure-github-release.mjs",
         ".github/workflows/.release-promote.yml",
-        ".github/workflows/public-release-promote.yml",
+        ".github/workflows/.release-candidate-promote.yml",
         "docs/release-governance.md"
       ],
       "artifactPaths": [
@@ -215,7 +215,7 @@
       "sourcePaths": [
         "packages/core/release/release-propagation.js",
         "packages/core/release/commands/release-propagation.mjs",
-        ".github/workflows/public-release-propagation.yml",
+        ".github/workflows/.release-propagation.yml",
         "docs/release-propagation.md"
       ],
       "artifactPaths": [
@@ -230,7 +230,7 @@
         "packages/core/publication/commands/npm-publish-transaction.mjs",
         "actions/release/promotion/ref/index.js",
         ".github/workflows/.release-promote.yml",
-        ".github/workflows/public-release-promote.yml",
+        ".github/workflows/.release-candidate-promote.yml",
         "docs/publish-transaction.md"
       ],
       "artifactPaths": [
@@ -246,13 +246,13 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "c5ae763ca6bac9648d2291c1908da6a0ee78785651aecfced739c9988dfcf92f",
+      "sha256": "55d89b706fec968198fcef2d3a492a68578ff3054acbff25cd07ebcf199cf34a",
       "summary": {
-        "cliCommandCount": 117,
+        "cliCommandCount": 113,
         "workflowCount": 44,
         "actionCount": 283,
         "sitePageCount": 94,
-        "docCommandRefCount": 1036,
+        "docCommandRefCount": 998,
         "failureCount": 0
       },
       "auditBoundary": {
@@ -2658,7 +2658,7 @@
         },
         {
           "id": "cli:init",
-          "name": "buildchain init [--cwd <dir>] [--type package|native|web-surface|infra-contract|publication-artifact|anchored-package] [--force]",
+          "name": "buildchain init [--cwd <dir>] [--type npm|binary|paper|package|native|publication-artifact|anchored-package] [--force]",
           "kind": "cli-command",
           "sourcePath": "bin/buildchain.mjs",
           "evidencePath": "bin/buildchain.mjs",
@@ -3256,42 +3256,6 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
-        {
-          "id": "cli:paper-alpha",
-          "name": "buildchain paper alpha [--cwd <dir>] [--source-ref <ref>] [--target-ref <ref>]",
-          "kind": "cli-command",
-          "sourcePath": "bin/buildchain.mjs",
-          "evidencePath": "bin/buildchain.mjs",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "reverseAuditSource": "bin/buildchain.mjs"
-        },
-        {
-          "id": "cli:paper-bootstrap-npm",
-          "name": "buildchain paper bootstrap npm [--cwd <dir>] [--execute]",
-          "kind": "cli-command",
-          "sourcePath": "bin/buildchain.mjs",
-          "evidencePath": "bin/buildchain.mjs",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "reverseAuditSource": "bin/buildchain.mjs"
-        },
-        {
-          "id": "cli:paper-build",
-          "name": "buildchain paper build [--cwd <dir>] [--execute] [--json]",
-          "kind": "cli-command",
-          "sourcePath": "bin/buildchain.mjs",
-          "evidencePath": "bin/buildchain.mjs",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "reverseAuditSource": "bin/buildchain.mjs"
-        },
         {
           "id": "cli:paper-fleet-audit",
           "name": "buildchain paper fleet audit [--root <dir>] [--offline] [--json]",
@@ -3340,21 +3304,9 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
-        {
-          "id": "cli:paper-resume",
-          "name": "buildchain paper resume [--cwd <dir>] [--runtime-ref <ref>] [--execute] [--json]",
-          "kind": "cli-command",
-          "sourcePath": "bin/buildchain.mjs",
-          "evidencePath": "bin/buildchain.mjs",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "reverseAuditSource": "bin/buildchain.mjs"
-        },
         {
           "id": "cli:paper-scaffold",
-          "name": "buildchain paper scaffold --package <name> --repository <owner/repo> [--write] [--json]",
+          "name": "buildchain paper scaffold --repository <owner/repo> [--package <name>] [--write] [--json]",
           "kind": "cli-command",
           "sourcePath": "bin/buildchain.mjs",
           "evidencePath": "bin/buildchain.mjs",
@@ -3749,85 +3701,34 @@
           "reverseAuditSource": "bin/buildchain.mjs"
         },
         {
-          "id": "workflow:.build-demo-adapter",
-          "name": "workflow:.build-demo-adapter",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.build-demo-adapter.yml",
-          "evidencePath": ".github/workflows/.build-demo-adapter.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 13,
-          "inputs": [
-            "adapter-arguments-json",
-            "adapter-path",
-            "artifact-retention-days",
-            "contract-lock",
-            "media-profile",
-            "render-media",
-            "renderer-image",
-            "require-trusted-event",
-            "runtime-ref",
-            "runtime-selection",
-            "source-artifact-digest",
-            "source-artifact-name",
-            "source-ref"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.build-gate-profile",
-          "name": "workflow:.build-gate-profile",
+          "id": "workflow:.build-adopter-qualification",
+          "name": "workflow:.build-adopter-qualification",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.build-gate-profile.yml",
-          "evidencePath": ".github/workflows/.build-gate-profile.yml",
+          "sourcePath": ".github/workflows/.build-adopter-qualification.yml",
+          "evidencePath": ".github/workflows/.build-adopter-qualification.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 31,
+          "inputCount": 8,
           "inputs": [
-            "artifact-name",
-            "artifact-retention-days",
-            "cargo-registry-index",
-            "checkout-cache-fallback",
-            "checkout-cache-fetch-attempts",
-            "checkout-cache-github-timeout-seconds",
-            "checkout-cache-mirror-url-template",
-            "checkout-cache-mode",
-            "checkout-cache-reference-repository-template",
-            "checkout-cache-timeout-seconds",
+            "consumer",
+            "consumer-ref",
+            "consumer-repository",
             "contract-lock",
-            "gate-command-json",
-            "gate-environment-json",
-            "gate-plan-command-json",
-            "gate-profile",
-            "gate-registry",
-            "include-advisory",
-            "node-version",
-            "platforms-json",
-            "require-trusted-event",
-            "runner-preset",
+            "input-path",
+            "invocation-source-path",
             "runtime-ref",
-            "runtime-selection",
-            "rust-toolchain",
-            "rustup-dist-server",
-            "rustup-update-root",
-            "shifu-cache-profile-digest",
-            "shifu-cache-profile-ref",
-            "source-ref",
-            "untrusted-policy",
-            "working-directory"
+            "runtime-selection"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.build",
-          "name": "workflow:.build",
+          "id": "workflow:.build-candidate",
+          "name": "workflow:.build-candidate",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.build.yml",
-          "evidencePath": ".github/workflows/.build.yml",
+          "sourcePath": ".github/workflows/.build-candidate.yml",
+          "evidencePath": ".github/workflows/.build-candidate.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -3843,339 +3744,142 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.ops-git-sync",
-          "name": "workflow:.ops-git-sync",
+          "id": "workflow:.build-check",
+          "name": "workflow:.build-check",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.ops-git-sync.yml",
-          "evidencePath": ".github/workflows/.ops-git-sync.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 7,
-          "inputs": [
-            "contract-lock",
-            "force",
-            "remote-host",
-            "remote-path",
-            "remote-repo",
-            "runtime-ref",
-            "runtime-selection"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.ops-pipeline-delivery",
-          "name": "workflow:.ops-pipeline-delivery",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.ops-pipeline-delivery.yml",
-          "evidencePath": ".github/workflows/.ops-pipeline-delivery.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 2,
-          "inputs": [
-            "request",
-            "runtime-selection"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.ops-pipeline-execute",
-          "name": "workflow:.ops-pipeline-execute",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.ops-pipeline-execute.yml",
-          "evidencePath": ".github/workflows/.ops-pipeline-execute.yml",
+          "sourcePath": ".github/workflows/.build-check.yml",
+          "evidencePath": ".github/workflows/.build-check.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 6,
-          "inputs": [
-            "attempt",
-            "context",
-            "matrix",
-            "operation",
-            "request",
-            "runtime-selection"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.release-authority",
-          "name": "workflow:.release-authority",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-authority.yml",
-          "evidencePath": ".github/workflows/.release-authority.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 38,
+          "inputCount": 13,
           "inputs": [
-            "admission-json",
-            "authority-workflow-path",
-            "auto-admission",
-            "auto-admission-kind",
-            "auto-no-gate",
-            "consumer-gate-command",
-            "consumer-gate-controller-sha",
-            "consumer-gate-evidence-source-sha",
-            "consumer-gate-evidence-source-tree",
-            "consumer-predicate-digest",
-            "consumer-predicate-id",
-            "consumer-qualification-required",
             "contract-lock",
-            "control-plane-audit-json",
-            "dry-run",
-            "evidence-controller-artifact",
-            "evidence-manifest-pattern",
-            "evidence-passport-artifact",
-            "evidence-payload-pattern",
-            "evidence-publication-artifact",
-            "evidence-repository",
-            "evidence-run-id",
-            "evidence-summary-artifact",
-            "expected-json",
-            "gate-aggregate-json",
-            "github-governance-receipt-json",
-            "package-name",
-            "product",
-            "publication-target",
-            "publication-version",
-            "publisher-workflow-path",
-            "required-status-check",
-            "runner-provenance-json",
+            "mode",
+            "node-version",
+            "require-version-state",
             "runtime-ref",
             "runtime-selection",
-            "source-sha",
-            "target-ref",
-            "used-nonces-json"
+            "source-proof-closure-paths-json",
+            "source-proof-dependency-paths-json",
+            "source-proof-policy-paths-json",
+            "source-proof-required-contexts-json",
+            "source-proof-reuse",
+            "upload-artifacts",
+            "working-directory"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-binary-assets",
-          "name": "workflow:.release-binary-assets",
+          "id": "workflow:.build-demo-adapter",
+          "name": "workflow:.build-demo-adapter",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-binary-assets.yml",
-          "evidencePath": ".github/workflows/.release-binary-assets.yml",
+          "sourcePath": ".github/workflows/.build-demo-adapter.yml",
+          "evidencePath": ".github/workflows/.build-demo-adapter.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 16,
+          "inputCount": 13,
           "inputs": [
-            "auto-admission",
+            "adapter-arguments-json",
+            "adapter-path",
+            "artifact-retention-days",
             "contract-lock",
-            "evidence-run-id",
-            "github-governance-receipt-json",
-            "publication-admission-json",
-            "publication-control-plane-audit-json",
-            "publication-expected-json",
-            "publication-gate-aggregate-json",
-            "publication-runner-provenance-json",
-            "publication-used-nonces-json",
-            "publication-version",
-            "release-tag",
+            "media-profile",
+            "render-media",
+            "renderer-image",
+            "require-trusted-event",
             "runtime-ref",
             "runtime-selection",
-            "source-sha",
-            "target-ref"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.release-pipeline-products",
-          "name": "workflow:.release-pipeline-products",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-pipeline-products.yml",
-          "evidencePath": ".github/workflows/.release-pipeline-products.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 2,
-          "inputs": [
-            "attempt",
-            "runtime-selection"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.release-pipeline-version",
-          "name": "workflow:.release-pipeline-version",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-pipeline-version.yml",
-          "evidencePath": ".github/workflows/.release-pipeline-version.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 5,
-          "inputs": [
-            "context",
-            "matrix",
-            "operation",
-            "purpose",
-            "runtime-selection"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.release-promote",
-          "name": "workflow:.release-promote",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-promote.yml",
-          "evidencePath": ".github/workflows/.release-promote.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 4,
-          "inputs": [
-            "contract-lock",
-            "request-json",
-            "runtime-ref",
-            "runtime-selection"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:build",
-          "name": "workflow:build",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/build.yml",
-          "evidencePath": ".github/workflows/build.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 5,
-          "inputs": [
-            "config-path",
-            "contract-lock",
-            "resume-run-id",
-            "runtime-ref",
-            "runtime-selection"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:buildchain-recover",
-          "name": "workflow:buildchain-recover",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-recover.yml",
-          "evidencePath": ".github/workflows/buildchain-recover.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:buildchain",
-          "name": "workflow:buildchain",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain.yml",
-          "evidencePath": ".github/workflows/buildchain.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:public-build-adopter-qualification",
-          "name": "workflow:public-build-adopter-qualification",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/public-build-adopter-qualification.yml",
-          "evidencePath": ".github/workflows/public-build-adopter-qualification.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 8,
-          "inputs": [
-            "consumer",
-            "consumer-ref",
-            "consumer-repository",
-            "contract-lock",
-            "input-path",
-            "invocation-source-path",
-            "runtime-ref",
-            "runtime-selection"
+            "source-artifact-digest",
+            "source-artifact-name",
+            "source-ref"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-build-check",
-          "name": "workflow:public-build-check",
+          "id": "workflow:.build-demo",
+          "name": "workflow:.build-demo",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-build-check.yml",
-          "evidencePath": ".github/workflows/public-build-check.yml",
+          "sourcePath": ".github/workflows/.build-demo.yml",
+          "evidencePath": ".github/workflows/.build-demo.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 13,
+          "inputCount": 14,
           "inputs": [
+            "artifact-retention-days",
+            "binary-artifact-digest",
+            "binary-artifact-name",
             "contract-lock",
-            "mode",
-            "node-version",
-            "require-version-state",
+            "materialize",
+            "materialize-base-ref",
+            "media-profile",
+            "render-failure-advisory",
+            "render-media",
+            "renderer-image",
             "runtime-ref",
             "runtime-selection",
-            "source-proof-closure-paths-json",
-            "source-proof-dependency-paths-json",
-            "source-proof-policy-paths-json",
-            "source-proof-required-contexts-json",
-            "source-proof-reuse",
-            "upload-artifacts",
-            "working-directory"
+            "scenario-path",
+            "source-ref"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-build-demo",
-          "name": "workflow:public-build-demo",
+          "id": "workflow:.build-gate-profile",
+          "name": "workflow:.build-gate-profile",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-build-demo.yml",
-          "evidencePath": ".github/workflows/public-build-demo.yml",
+          "sourcePath": ".github/workflows/.build-gate-profile.yml",
+          "evidencePath": ".github/workflows/.build-gate-profile.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 14,
+          "inputCount": 31,
           "inputs": [
+            "artifact-name",
             "artifact-retention-days",
-            "binary-artifact-digest",
-            "binary-artifact-name",
+            "cargo-registry-index",
+            "checkout-cache-fallback",
+            "checkout-cache-fetch-attempts",
+            "checkout-cache-github-timeout-seconds",
+            "checkout-cache-mirror-url-template",
+            "checkout-cache-mode",
+            "checkout-cache-reference-repository-template",
+            "checkout-cache-timeout-seconds",
             "contract-lock",
-            "materialize",
-            "materialize-base-ref",
-            "media-profile",
-            "render-failure-advisory",
-            "render-media",
-            "renderer-image",
+            "gate-command-json",
+            "gate-environment-json",
+            "gate-plan-command-json",
+            "gate-profile",
+            "gate-registry",
+            "include-advisory",
+            "node-version",
+            "platforms-json",
+            "require-trusted-event",
+            "runner-preset",
             "runtime-ref",
             "runtime-selection",
-            "scenario-path",
-            "source-ref"
+            "rust-toolchain",
+            "rustup-dist-server",
+            "rustup-update-root",
+            "shifu-cache-profile-digest",
+            "shifu-cache-profile-ref",
+            "source-ref",
+            "untrusted-policy",
+            "working-directory"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-build-publication",
-          "name": "workflow:public-build-publication",
+          "id": "workflow:.build-publication",
+          "name": "workflow:.build-publication",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-build-publication.yml",
-          "evidencePath": ".github/workflows/public-build-publication.yml",
+          "sourcePath": ".github/workflows/.build-publication.yml",
+          "evidencePath": ".github/workflows/.build-publication.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4207,11 +3911,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-build-stage-capsule-canary",
-          "name": "workflow:public-build-stage-capsule-canary",
+          "id": "workflow:.build-stage-capsule-canary",
+          "name": "workflow:.build-stage-capsule-canary",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-build-stage-capsule-canary.yml",
-          "evidencePath": ".github/workflows/public-build-stage-capsule-canary.yml",
+          "sourcePath": ".github/workflows/.build-stage-capsule-canary.yml",
+          "evidencePath": ".github/workflows/.build-stage-capsule-canary.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4225,17 +3929,37 @@
             "install-artifact-path",
             "node-version",
             "runtime-ref",
-            "runtime-selection",
-            "verify-artifact-path"
+            "runtime-selection",
+            "verify-artifact-path"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.build",
+          "name": "workflow:.build",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.build.yml",
+          "evidencePath": ".github/workflows/.build.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "config-path",
+            "contract-lock",
+            "resume-run-id",
+            "runtime-ref",
+            "runtime-selection"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-alpha-candidate-patrol",
-          "name": "workflow:public-ops-alpha-candidate-patrol",
+          "id": "workflow:.ops-alpha-candidate-patrol",
+          "name": "workflow:.ops-alpha-candidate-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
-          "evidencePath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
+          "sourcePath": ".github/workflows/.ops-alpha-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/.ops-alpha-candidate-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4261,11 +3985,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-bootstrap",
-          "name": "workflow:public-ops-bootstrap",
+          "id": "workflow:.ops-bootstrap",
+          "name": "workflow:.ops-bootstrap",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-bootstrap.yml",
-          "evidencePath": ".github/workflows/public-ops-bootstrap.yml",
+          "sourcePath": ".github/workflows/.ops-bootstrap.yml",
+          "evidencePath": ".github/workflows/.ops-bootstrap.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4280,11 +4004,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-dev-auto-merge",
-          "name": "workflow:public-ops-dev-auto-merge",
+          "id": "workflow:.ops-dev-auto-merge",
+          "name": "workflow:.ops-dev-auto-merge",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-dev-auto-merge.yml",
-          "evidencePath": ".github/workflows/public-ops-dev-auto-merge.yml",
+          "sourcePath": ".github/workflows/.ops-dev-auto-merge.yml",
+          "evidencePath": ".github/workflows/.ops-dev-auto-merge.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4339,11 +4063,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-dev-qualification-patrol",
-          "name": "workflow:public-ops-dev-qualification-patrol",
+          "id": "workflow:.ops-dev-qualification-patrol",
+          "name": "workflow:.ops-dev-qualification-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
-          "evidencePath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
+          "sourcePath": ".github/workflows/.ops-dev-qualification-patrol.yml",
+          "evidencePath": ".github/workflows/.ops-dev-qualification-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4365,11 +4089,33 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-housekeeping",
-          "name": "workflow:public-ops-housekeeping",
+          "id": "workflow:.ops-git-sync",
+          "name": "workflow:.ops-git-sync",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.ops-git-sync.yml",
+          "evidencePath": ".github/workflows/.ops-git-sync.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 7,
+          "inputs": [
+            "contract-lock",
+            "force",
+            "remote-host",
+            "remote-path",
+            "remote-repo",
+            "runtime-ref",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.ops-housekeeping",
+          "name": "workflow:.ops-housekeeping",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-housekeeping.yml",
-          "evidencePath": ".github/workflows/public-ops-housekeeping.yml",
+          "sourcePath": ".github/workflows/.ops-housekeeping.yml",
+          "evidencePath": ".github/workflows/.ops-housekeeping.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4395,11 +4141,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-observed-evidence",
-          "name": "workflow:public-ops-observed-evidence",
+          "id": "workflow:.ops-observed-evidence",
+          "name": "workflow:.ops-observed-evidence",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-observed-evidence.yml",
-          "evidencePath": ".github/workflows/public-ops-observed-evidence.yml",
+          "sourcePath": ".github/workflows/.ops-observed-evidence.yml",
+          "evidencePath": ".github/workflows/.ops-observed-evidence.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4424,11 +4170,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-patrol-daily",
-          "name": "workflow:public-ops-patrol-daily",
+          "id": "workflow:.ops-patrol-daily",
+          "name": "workflow:.ops-patrol-daily",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-patrol-daily.yml",
-          "evidencePath": ".github/workflows/public-ops-patrol-daily.yml",
+          "sourcePath": ".github/workflows/.ops-patrol-daily.yml",
+          "evidencePath": ".github/workflows/.ops-patrol-daily.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4453,11 +4199,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-patrol-monthly",
-          "name": "workflow:public-ops-patrol-monthly",
+          "id": "workflow:.ops-patrol-monthly",
+          "name": "workflow:.ops-patrol-monthly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-patrol-monthly.yml",
-          "evidencePath": ".github/workflows/public-ops-patrol-monthly.yml",
+          "sourcePath": ".github/workflows/.ops-patrol-monthly.yml",
+          "evidencePath": ".github/workflows/.ops-patrol-monthly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4473,11 +4219,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-patrol-weekly",
-          "name": "workflow:public-ops-patrol-weekly",
+          "id": "workflow:.ops-patrol-weekly",
+          "name": "workflow:.ops-patrol-weekly",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-patrol-weekly.yml",
-          "evidencePath": ".github/workflows/public-ops-patrol-weekly.yml",
+          "sourcePath": ".github/workflows/.ops-patrol-weekly.yml",
+          "evidencePath": ".github/workflows/.ops-patrol-weekly.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4493,11 +4239,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-patrol",
-          "name": "workflow:public-ops-patrol",
+          "id": "workflow:.ops-patrol",
+          "name": "workflow:.ops-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-patrol.yml",
-          "evidencePath": ".github/workflows/public-ops-patrol.yml",
+          "sourcePath": ".github/workflows/.ops-patrol.yml",
+          "evidencePath": ".github/workflows/.ops-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4525,44 +4271,49 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-pipeline",
-          "name": "workflow:public-ops-pipeline",
+          "id": "workflow:.ops-pipeline-delivery",
+          "name": "workflow:.ops-pipeline-delivery",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-pipeline.yml",
-          "evidencePath": ".github/workflows/public-ops-pipeline.yml",
+          "sourcePath": ".github/workflows/.ops-pipeline-delivery.yml",
+          "evidencePath": ".github/workflows/.ops-pipeline-delivery.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 1,
+          "inputCount": 2,
           "inputs": [
-            "config-path"
+            "request",
+            "runtime-selection"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-recover",
-          "name": "workflow:public-ops-recover",
+          "id": "workflow:.ops-pipeline-execute",
+          "name": "workflow:.ops-pipeline-execute",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-recover.yml",
-          "evidencePath": ".github/workflows/public-ops-recover.yml",
+          "sourcePath": ".github/workflows/.ops-pipeline-execute.yml",
+          "evidencePath": ".github/workflows/.ops-pipeline-execute.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 2,
+          "inputCount": 6,
           "inputs": [
             "attempt",
-            "runtime-ref"
+            "context",
+            "matrix",
+            "operation",
+            "request",
+            "runtime-selection"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-release-governance",
-          "name": "workflow:public-ops-release-governance",
+          "id": "workflow:.ops-release-governance",
+          "name": "workflow:.ops-release-governance",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-release-governance.yml",
-          "evidencePath": ".github/workflows/public-ops-release-governance.yml",
+          "sourcePath": ".github/workflows/.ops-release-governance.yml",
+          "evidencePath": ".github/workflows/.ops-release-governance.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4579,11 +4330,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-stable-candidate-patrol",
-          "name": "workflow:public-ops-stable-candidate-patrol",
+          "id": "workflow:.ops-stable-candidate-patrol",
+          "name": "workflow:.ops-stable-candidate-patrol",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
-          "evidencePath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
+          "sourcePath": ".github/workflows/.ops-stable-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/.ops-stable-candidate-patrol.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4611,11 +4362,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-tail-reseal",
-          "name": "workflow:public-ops-tail-reseal",
+          "id": "workflow:.ops-tail-reseal",
+          "name": "workflow:.ops-tail-reseal",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-tail-reseal.yml",
-          "evidencePath": ".github/workflows/public-ops-tail-reseal.yml",
+          "sourcePath": ".github/workflows/.ops-tail-reseal.yml",
+          "evidencePath": ".github/workflows/.ops-tail-reseal.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4633,11 +4384,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-warrant-cancel",
-          "name": "workflow:public-ops-warrant-cancel",
+          "id": "workflow:.ops-warrant-cancel",
+          "name": "workflow:.ops-warrant-cancel",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-warrant-cancel.yml",
-          "evidencePath": ".github/workflows/public-ops-warrant-cancel.yml",
+          "sourcePath": ".github/workflows/.ops-warrant-cancel.yml",
+          "evidencePath": ".github/workflows/.ops-warrant-cancel.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4661,11 +4412,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-warrant-close",
-          "name": "workflow:public-ops-warrant-close",
+          "id": "workflow:.ops-warrant-close",
+          "name": "workflow:.ops-warrant-close",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-warrant-close.yml",
-          "evidencePath": ".github/workflows/public-ops-warrant-close.yml",
+          "sourcePath": ".github/workflows/.ops-warrant-close.yml",
+          "evidencePath": ".github/workflows/.ops-warrant-close.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4690,11 +4441,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-release-artifact-attestation",
-          "name": "workflow:public-release-artifact-attestation",
+          "id": "workflow:.release-artifact-attestation",
+          "name": "workflow:.release-artifact-attestation",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-release-artifact-attestation.yml",
-          "evidencePath": ".github/workflows/public-release-artifact-attestation.yml",
+          "sourcePath": ".github/workflows/.release-artifact-attestation.yml",
+          "evidencePath": ".github/workflows/.release-artifact-attestation.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4720,11 +4471,114 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-release-oci-compose-preview",
-          "name": "workflow:public-release-oci-compose-preview",
+          "id": "workflow:.release-authority",
+          "name": "workflow:.release-authority",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-authority.yml",
+          "evidencePath": ".github/workflows/.release-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 38,
+          "inputs": [
+            "admission-json",
+            "authority-workflow-path",
+            "auto-admission",
+            "auto-admission-kind",
+            "auto-no-gate",
+            "consumer-gate-command",
+            "consumer-gate-controller-sha",
+            "consumer-gate-evidence-source-sha",
+            "consumer-gate-evidence-source-tree",
+            "consumer-predicate-digest",
+            "consumer-predicate-id",
+            "consumer-qualification-required",
+            "contract-lock",
+            "control-plane-audit-json",
+            "dry-run",
+            "evidence-controller-artifact",
+            "evidence-manifest-pattern",
+            "evidence-passport-artifact",
+            "evidence-payload-pattern",
+            "evidence-publication-artifact",
+            "evidence-repository",
+            "evidence-run-id",
+            "evidence-summary-artifact",
+            "expected-json",
+            "gate-aggregate-json",
+            "github-governance-receipt-json",
+            "package-name",
+            "product",
+            "publication-target",
+            "publication-version",
+            "publisher-workflow-path",
+            "required-status-check",
+            "runner-provenance-json",
+            "runtime-ref",
+            "runtime-selection",
+            "source-sha",
+            "target-ref",
+            "used-nonces-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-binary-assets",
+          "name": "workflow:.release-binary-assets",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-binary-assets.yml",
+          "evidencePath": ".github/workflows/.release-binary-assets.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 16,
+          "inputs": [
+            "auto-admission",
+            "contract-lock",
+            "evidence-run-id",
+            "github-governance-receipt-json",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "publication-version",
+            "release-tag",
+            "runtime-ref",
+            "runtime-selection",
+            "source-sha",
+            "target-ref"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-candidate-promote",
+          "name": "workflow:.release-candidate-promote",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-candidate-promote.yml",
+          "evidencePath": ".github/workflows/.release-candidate-promote.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 4,
+          "inputs": [
+            "contract-lock",
+            "request-json",
+            "runtime-ref",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-oci-compose-preview",
+          "name": "workflow:.release-oci-compose-preview",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-release-oci-compose-preview.yml",
-          "evidencePath": ".github/workflows/public-release-oci-compose-preview.yml",
+          "sourcePath": ".github/workflows/.release-oci-compose-preview.yml",
+          "evidencePath": ".github/workflows/.release-oci-compose-preview.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4738,11 +4592,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-release-paper",
-          "name": "workflow:public-release-paper",
+          "id": "workflow:.release-paper",
+          "name": "workflow:.release-paper",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-release-paper.yml",
-          "evidencePath": ".github/workflows/public-release-paper.yml",
+          "sourcePath": ".github/workflows/.release-paper.yml",
+          "evidencePath": ".github/workflows/.release-paper.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4775,11 +4629,48 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-release-promote",
-          "name": "workflow:public-release-promote",
+          "id": "workflow:.release-pipeline-products",
+          "name": "workflow:.release-pipeline-products",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-pipeline-products.yml",
+          "evidencePath": ".github/workflows/.release-pipeline-products.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 2,
+          "inputs": [
+            "attempt",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-pipeline-version",
+          "name": "workflow:.release-pipeline-version",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-pipeline-version.yml",
+          "evidencePath": ".github/workflows/.release-pipeline-version.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "context",
+            "matrix",
+            "operation",
+            "purpose",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-promote",
+          "name": "workflow:.release-promote",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-release-promote.yml",
-          "evidencePath": ".github/workflows/public-release-promote.yml",
+          "sourcePath": ".github/workflows/.release-promote.yml",
+          "evidencePath": ".github/workflows/.release-promote.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4794,11 +4685,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-release-propagation",
-          "name": "workflow:public-release-propagation",
+          "id": "workflow:.release-propagation",
+          "name": "workflow:.release-propagation",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-release-propagation.yml",
-          "evidencePath": ".github/workflows/public-release-propagation.yml",
+          "sourcePath": ".github/workflows/.release-propagation.yml",
+          "evidencePath": ".github/workflows/.release-propagation.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4829,11 +4720,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-release-signing-authority",
-          "name": "workflow:public-release-signing-authority",
+          "id": "workflow:.release-signing-authority",
+          "name": "workflow:.release-signing-authority",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-release-signing-authority.yml",
-          "evidencePath": ".github/workflows/public-release-signing-authority.yml",
+          "sourcePath": ".github/workflows/.release-signing-authority.yml",
+          "evidencePath": ".github/workflows/.release-signing-authority.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4843,11 +4734,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-release-tail",
-          "name": "workflow:public-release-tail",
+          "id": "workflow:.release-tail",
+          "name": "workflow:.release-tail",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-release-tail.yml",
-          "evidencePath": ".github/workflows/public-release-tail.yml",
+          "sourcePath": ".github/workflows/.release-tail.yml",
+          "evidencePath": ".github/workflows/.release-tail.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4870,11 +4761,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-release-web",
-          "name": "workflow:public-release-web",
+          "id": "workflow:.release-web",
+          "name": "workflow:.release-web",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-release-web.yml",
-          "evidencePath": ".github/workflows/public-release-web.yml",
+          "sourcePath": ".github/workflows/.release-web.yml",
+          "evidencePath": ".github/workflows/.release-web.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4921,6 +4812,67 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:buildchain-recover",
+          "name": "workflow:buildchain-recover",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/buildchain-recover.yml",
+          "evidencePath": ".github/workflows/buildchain-recover.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:buildchain",
+          "name": "workflow:buildchain",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/buildchain.yml",
+          "evidencePath": ".github/workflows/buildchain.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-pipeline",
+          "name": "workflow:public-ops-pipeline",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-pipeline.yml",
+          "evidencePath": ".github/workflows/public-ops-pipeline.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 1,
+          "inputs": [
+            "config-path"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-recover",
+          "name": "workflow:public-ops-recover",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-recover.yml",
+          "evidencePath": ".github/workflows/public-ops-recover.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 2,
+          "inputs": [
+            "attempt",
+            "runtime-ref"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "action:adoption/adopter/admit",
           "name": "action:adoption/adopter/admit",
@@ -11507,11 +11459,11 @@
         "public": true
       },
       {
-        "id": "control:.github/workflows/public-release-promote.yml",
-        "name": "control:.github/workflows/public-release-promote.yml",
+        "id": "control:.github/workflows/.release-candidate-promote.yml",
+        "name": "control:.github/workflows/.release-candidate-promote.yml",
         "kind": "workflow",
-        "sourcePath": ".github/workflows/public-release-promote.yml",
-        "evidencePath": ".github/workflows/public-release-promote.yml",
+        "sourcePath": ".github/workflows/.release-candidate-promote.yml",
+        "evidencePath": ".github/workflows/.release-candidate-promote.yml",
         "availability": "shipped",
         "visibility": "public",
         "participantFacing": true,
@@ -11562,11 +11514,11 @@
         "public": true
       },
       {
-        "id": "control:.github/workflows/public-release-artifact-attestation.yml",
-        "name": "control:.github/workflows/public-release-artifact-attestation.yml",
+        "id": "control:.github/workflows/.release-artifact-attestation.yml",
+        "name": "control:.github/workflows/.release-artifact-attestation.yml",
         "kind": "workflow",
-        "sourcePath": ".github/workflows/public-release-artifact-attestation.yml",
-        "evidencePath": ".github/workflows/public-release-artifact-attestation.yml",
+        "sourcePath": ".github/workflows/.release-artifact-attestation.yml",
+        "evidencePath": ".github/workflows/.release-artifact-attestation.yml",
         "availability": "shipped",
         "visibility": "public",
         "participantFacing": true,
@@ -11595,11 +11547,11 @@
         "public": true
       },
       {
-        "id": "control:.github/workflows/public-release-propagation.yml",
-        "name": "control:.github/workflows/public-release-propagation.yml",
+        "id": "control:.github/workflows/.release-propagation.yml",
+        "name": "control:.github/workflows/.release-propagation.yml",
         "kind": "workflow",
-        "sourcePath": ".github/workflows/public-release-propagation.yml",
-        "evidencePath": ".github/workflows/public-release-propagation.yml",
+        "sourcePath": ".github/workflows/.release-propagation.yml",
+        "evidencePath": ".github/workflows/.release-propagation.yml",
         "availability": "shipped",
         "visibility": "public",
         "participantFacing": true,
@@ -11685,6 +11637,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 728
+    "publicSurfaceCount": 724
   }
 }