@kungfu-tech/buildchain 4.1.3 → 4.1.4

package/packages/core/publication/pipeline/stable-entry.js

@@ -113,16 +113,21 @@ async function inspectEntryRun(listed, plan, source, host) {
   const { run, jobs } = await host.runs.read(listed.id, listed.run_attempt);
   const consumer = await pipelineEntryRun(run, plan, source, host);
   if (!consumer) return null;
+  const productJobs = jobs.filter((job) =>
+    /(?:^| \/ )Build product \([^)]+\)$/u.test(job.name),
+  );
+  const check = await pipelineEntryCheck(run, host);
+  // Controller-only PR notifications are not new product qualifications. A
+  // failed controller must not displace an earlier actual build. Conversely,
+  // any admitted native receipt or product job (even cancelled/skipped setup)
+  // keeps the execution in scope and must qualify its original full evidence.
   if (
-    !jobs.some(
-      (job) =>
-        job.conclusion !== "skipped" &&
-        /(?:^| \/ )Build product \([^)]+\)$/u.test(job.name),
-    ) &&
-    run.conclusion === "success"
+    !check &&
+    (!productJobs.length ||
+      (run.conclusion === "success" &&
+        productJobs.every((job) => job.conclusion === "skipped")))
   )
     return null;
-  const check = await pipelineEntryCheck(run, host);
   if (!check)
     return {
       status: "missing",

package/packages/core/publication/pipeline/stable-products.js

@@ -17,7 +17,6 @@ function assertPublishedPlan(stablePlan, source, values) {
   const { plan, qualification: qualified, release } = values;
   verifyPipelinePublicationPlan(plan);
   if (
-    plan.evidenceVersion !== 1 ||
     plan.channel !== "alpha" ||
     plan.version !== stablePlan.candidateVersion ||
     plan.tag !== source.candidate.tag ||
@@ -32,17 +31,6 @@ function assertPublishedPlan(stablePlan, source, values) {
     throw new Error(
       "Published product evidence differs from the exact Alpha contract or source",
     );
-  if (
-    plan.publisher.repository !== "kungfu-systems/buildchain" ||
-    plan.publisher.workflow !==
-      ".github/workflows/.release-pipeline-products.yml" ||
-    plan.publisher.job !== "apply" ||
-    !/^[0-9a-f]{40}$/u.test(plan.publisher.workflowSha || "") ||
-    plan.runtime.repository !== "kungfu-systems/buildchain"
-  )
-    throw new Error(
-      "Published product evidence requires the central publisher",
-    );
   const issued = Date.parse(qualified.qualification?.issuedAt);
   if (
     !Number.isFinite(issued) ||
@@ -200,7 +188,11 @@ function completionTime(jobs, qualified, candidate) {
   return new Date(Math.max(...values)).toISOString();
 }
 
-function verifyPublishedDocuments(values, bundle, directory, host, execute) {
+export function verifyPublishedDocuments(
+  values,
+  bundle,
+  { directory, token, execute },
+) {
   const {
     plan,
     qualification: qualified,
@@ -208,6 +200,18 @@ function verifyPublishedDocuments(values, bundle, directory, host, execute) {
     release,
     invocation,
   } = values;
+  if (
+    plan.evidenceVersion !== 1 ||
+    plan.publisher.repository !== "kungfu-systems/buildchain" ||
+    plan.publisher.workflow !==
+      ".github/workflows/.release-pipeline-products.yml" ||
+    plan.publisher.job !== "apply" ||
+    !/^[0-9a-f]{40}$/u.test(plan.publisher.workflowSha || "") ||
+    plan.runtime.repository !== "kungfu-systems/buildchain"
+  )
+    throw new Error(
+      "Published product evidence requires the central publisher",
+    );
   const materialization = release.versionMaterialization;
   const signing = verifyPipelineSigning({
     plan,
@@ -218,7 +222,7 @@ function verifyPublishedDocuments(values, bundle, directory, host, execute) {
       bundle,
     ),
     directory: path.join(directory, "signature"),
-    token: host.token,
+    token,
     // Historical evidence is checked at issue time. It never supplies fresh
     // Stable publisher admission or extends the original receipt's lifetime.
     evaluatedAt: qualified.qualification.issuedAt,
@@ -274,13 +278,11 @@ export async function readPipelineStableProducts(
     path.join(fs.realpathSync(os.tmpdir()), "buildchain-stable-products-"),
   );
   try {
-    const signing = verifyPublishedDocuments(
-      evidence.values,
-      evidence.bundle,
+    const signing = verifyPublishedDocuments(evidence.values, evidence.bundle, {
       directory,
-      host,
+      token: host.token,
       execute,
-    );
+    });
     await reobservePublicationBuild(qualified.build, qualified.source, host);
     const signer = await signingRun(plan, qualified, host);
     const completedAt = completionTime(

package/packages/core/publication/pipeline/version-actions.js

@@ -6,14 +6,18 @@ import { buildPipelineVersionMaterial } from "./version-build.js";
 import { qualifyPipelineVersionContext } from "./version-context.js";
 import { preparePipelinePublication } from "./prepare.js";
 import { settlePipelinePublication } from "./settle.js";
+import {
+  readPipelineContext,
+  writePipelineContext,
+} from "../../providers/github/pipeline-context-artifacts.js";
 
-const contextInput = (core) =>
-  JSON.parse(core.getInput("context", { required: true }));
+const contextInput = (core, env) =>
+  readPipelineContext(core.getInput("context", { required: true }), env);
 const directory = (env) =>
   path.join(env.GITHUB_WORKSPACE, ".buildchain/version-material");
 
 export async function buildPipelineVersionAction(core, env) {
-  const context = contextInput(core);
+  const context = await contextInput(core, env);
   if (
     context.schema !== "buildchain.pipeline-version-context/v1" ||
     context.runId !== Number(env.GITHUB_RUN_ID) ||
@@ -36,7 +40,7 @@ export async function buildPipelineVersionAction(core, env) {
 }
 
 export async function materializePipelinePublicationAction(core, env) {
-  const context = contextInput(core);
+  const context = await contextInput(core, env);
   const operation = core.getInput("operation", { required: true });
   let result = { operation, context };
   if (operation === "regenerate") {
@@ -58,7 +62,12 @@ export async function materializePipelinePublicationAction(core, env) {
   }
   core.setOutput("operation", result.operation);
   core.setOutput("stable-wait", result.wait ? JSON.stringify(result.wait) : "");
-  core.setOutput("context", JSON.stringify(result.context || {}));
+  core.setOutput(
+    "context",
+    operation === "regenerate"
+      ? await writePipelineContext(result.context || {}, env)
+      : core.getInput("context", { required: true }),
+  );
   core.setOutput(
     "matrix",
     JSON.stringify({ include: result.context?.platforms || [] }),
@@ -66,7 +75,7 @@ export async function materializePipelinePublicationAction(core, env) {
 }
 
 export async function materializePipelineDevelopmentAction(core, env) {
-  const context = contextInput(core);
+  const context = await contextInput(core, env);
   if (context.preparation.purpose !== "development")
     throw new Error(
       "Development materialization received a different version purpose",

package/packages/core/publication/publication-rehearsal-projection.js

@@ -9,8 +9,6 @@ export const PUBLICATION_REHEARSAL_AGENT_SECTION_START =
   "<!-- buildchain:publication-rehearsal:start -->";
 export const PUBLICATION_REHEARSAL_AGENT_SECTION_END =
   "<!-- buildchain:publication-rehearsal:end -->";
-export const PUBLICATION_REHEARSAL_WORKFLOW_PATH =
-  ".github/workflows/publication-rehearsal.yml";
 
 export function publicationRehearsalToml() {
   return `[publication_rehearsal]\ncontract = ${JSON.stringify(PUBLICATION_REHEARSAL_CAPSULE_CONTRACT)}\nadr = ${JSON.stringify(RELEASE_LOCAL_CONSTRUCTIBILITY_ADR)}\ninvariant = ${JSON.stringify(RELEASE_LOCAL_CONSTRUCTIBILITY_INVARIANT)}\ncommand = ${JSON.stringify(PUBLICATION_REHEARSAL_COMMAND)}\ncapsule = ".buildchain/publication-rehearsal/capsule.json"\ncandidate_root = ".buildchain/publication-rehearsal/candidate"\nstate = ".buildchain/publication-rehearsal/state.json"\nevidence = ".buildchain/publication-rehearsal/evidence.json"\n`;
@@ -95,10 +93,3 @@ export function mergePublicationRehearsalAgentInstructions(current = "") {
     end + PUBLICATION_REHEARSAL_AGENT_SECTION_END.length,
   )}`;
 }
-
-export function publicationRehearsalWorkflow(buildchainRef) {
-  const ref = String(buildchainRef || "").trim();
-  if (!/^v4(?:-alpha)?$/u.test(ref))
-    throw new Error("publication rehearsal workflow requires a floating public entry");
-  return `name: Publication Rehearsal\n\non:\n  workflow_dispatch:\n    inputs:\n      capsule-path:\n        description: "Source-bound v4 publication rehearsal capsule"\n        required: true\n        default: ".buildchain/publication-rehearsal/capsule.json"\n      candidate-root:\n        description: "Repository-relative candidate root"\n        required: true\n        default: ".buildchain/publication-rehearsal/candidate"\n\npermissions:\n  contents: read\n\njobs:\n  rehearsal:\n    uses: kungfu-systems/buildchain/.github/workflows/public-release-tail.yml@${ref}\n    with:\n      rehearsal-capsule-path: \${{ inputs.capsule-path }}\n      candidate-root: \${{ inputs.candidate-root }}\n      rehearsal-mode: simulate\n      state-path: ".buildchain/publication-rehearsal/state.json"\n      rehearsal-evidence-path: ".buildchain/publication-rehearsal/evidence.json"\n`;
-}

package/packages/core/release/cli/dispatch.mjs

@@ -1,10 +1,7 @@
 import { runReleasePropagationCli } from "../commands/release-propagation.mjs";
 import { runReleaseTailCli } from "../commands/release-tail.mjs";
 import { runTailResealCli } from "../commands/tail-reseal.mjs";
-import {
-  TRUST_RELEASE_COMMANDS,
-  dispatchTrustReleaseCommand,
-} from "./trust-release.mjs";
+import { dispatchTrustReleaseCommand } from "./trust-release.mjs";
 import { packageVersion } from "../../contracts/cli/context.mjs";
 import { runScript } from "../../workflow/cli/process.mjs";
 

package/packages/core/release/cli/inspection-handlers.mjs

@@ -1,44 +1,12 @@
-import fs from "node:fs";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { verifyInfraContractEvidenceBundle } from "../../providers/commands/infra-contract-core.mjs";
-import { verifyBuildchainLogEvents } from "../../observability/logging.js";
-import {
-  explainReleaseLineDryRun,
-  formatReleaseLineDryRun,
-} from "../release-line-dry-run.js";
-import {
-  planReleaseLineBootstrap,
-  writeReleaseLineBootstrapVersionState,
-} from "../release-line-bootstrap.js";
-import { collectGitHubReleasePassport } from "../passport/collection.js";
-import { explainReleasePassport, verifyReleasePassport } from "../release-passport.js";
-import {
-  createPublicationAdmission,
-  createRunnerProvenance,
-  verifyPublicationAdmission,
-} from "../../publication/publication-authority.js";
-import {
-  createGitHubArtifactAttestationPolicy,
-  createGitHubArtifactAttestationVerificationPlan,
-  verifyGitHubArtifactAttestationEvidence,
-} from "../../build/github-artifact-attestation.js";
+import { explainReleasePassport } from "../release-passport.js";
 import {
   explainArtifactPassport,
   verifyArtifactPassport,
 } from "../../build/artifact-passport.js";
 import {
-  projectArtifactVerificationEnvelopeToKfx,
-  verifyArtifactVerificationEnvelope,
-} from "../../build/artifact-verification-envelope.js";
-import {
-  artifactEnvelopeOptions,
   printJson,
   readBooleanFlag,
   readFlag,
-  readJsonInput,
-  readRepeatedFlag,
-  writeJsonFile,
 } from "../../contracts/cli/options.mjs";
 
 async function handleAuditCommand({ args, runScript, packageVersion }) {

package/packages/core/release/cli/release-handlers.mjs

@@ -1,8 +1,4 @@
-import fs from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { verifyInfraContractEvidenceBundle } from "../../providers/commands/infra-contract-core.mjs";
-import { verifyBuildchainLogEvents } from "../../observability/logging.js";
 import {
   explainReleaseLineDryRun,
   formatReleaseLineDryRun,
@@ -12,25 +8,12 @@ import {
   writeReleaseLineBootstrapVersionState,
 } from "../release-line-bootstrap.js";
 import { collectGitHubReleasePassport } from "../passport/collection.js";
-import { explainReleasePassport, verifyReleasePassport } from "../release-passport.js";
 import {
   createPublicationAdmission,
   createRunnerProvenance,
-  verifyPublicationAdmission,
 } from "../../publication/publication-authority.js";
-import {
-  createGitHubArtifactAttestationPolicy,
-  createGitHubArtifactAttestationVerificationPlan,
-  verifyGitHubArtifactAttestationEvidence,
-} from "../../build/github-artifact-attestation.js";
-import {
-  explainArtifactPassport,
-  verifyArtifactPassport,
-} from "../../build/artifact-passport.js";
-import {
-  projectArtifactVerificationEnvelopeToKfx,
-  verifyArtifactVerificationEnvelope,
-} from "../../build/artifact-verification-envelope.js";
+import { createGitHubArtifactAttestationPolicy } from "../../build/github-artifact-attestation.js";
+import { projectArtifactVerificationEnvelopeToKfx } from "../../build/artifact-verification-envelope.js";
 import {
   artifactEnvelopeOptions,
   printJson,

package/packages/core/release/cli/verification-handlers.mjs

@@ -3,34 +3,14 @@ import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { verifyInfraContractEvidenceBundle } from "../../providers/commands/infra-contract-core.mjs";
 import { verifyBuildchainLogEvents } from "../../observability/logging.js";
+import { verifyReleasePassport } from "../release-passport.js";
+import { verifyPublicationAdmission } from "../../publication/publication-authority.js";
 import {
-  explainReleaseLineDryRun,
-  formatReleaseLineDryRun,
-} from "../release-line-dry-run.js";
-import {
-  planReleaseLineBootstrap,
-  writeReleaseLineBootstrapVersionState,
-} from "../release-line-bootstrap.js";
-import { collectGitHubReleasePassport } from "../passport/collection.js";
-import { explainReleasePassport, verifyReleasePassport } from "../release-passport.js";
-import {
-  createPublicationAdmission,
-  createRunnerProvenance,
-  verifyPublicationAdmission,
-} from "../../publication/publication-authority.js";
-import {
-  createGitHubArtifactAttestationPolicy,
   createGitHubArtifactAttestationVerificationPlan,
   verifyGitHubArtifactAttestationEvidence,
 } from "../../build/github-artifact-attestation.js";
-import {
-  explainArtifactPassport,
-  verifyArtifactPassport,
-} from "../../build/artifact-passport.js";
-import {
-  projectArtifactVerificationEnvelopeToKfx,
-  verifyArtifactVerificationEnvelope,
-} from "../../build/artifact-verification-envelope.js";
+import { verifyArtifactPassport } from "../../build/artifact-passport.js";
+import { verifyArtifactVerificationEnvelope } from "../../build/artifact-verification-envelope.js";
 import {
   artifactEnvelopeOptions,
   printJson,
@@ -38,7 +18,6 @@ import {
   readFlag,
   readJsonInput,
   readRepeatedFlag,
-  writeJsonFile,
 } from "../../contracts/cli/options.mjs";
 
 async function verifyGitHubArtifactAttestationCommand({

package/packages/core/release/next-development-projection.js

@@ -266,19 +266,19 @@ invalid.
 
 ## Public self-dogfood and adoption
 
-\`.github/workflows/self-build-public-consumer-dogfood.yml\` remains the exact thin
-consumer of the public \`public-build-stage-capsule-canary.yml@v4-alpha\` contract. Its
-declared \`lifecycle.verify\` runs \`pnpm run check\`, so the same public path
-executes pure recovery tests that inject a transient durable-state write
-failure, restore the adapter operation on a fresh runner, supersede stale work
-when protected Dev moves, preserve \`pr-pending\` during protected-PR delay, and
-prove both legal version models. No caller-local qualification job, action,
-or private self-dogfood route is added.
-
-The existing dual-channel self-consumer separately retains exact hosted
-\`build.yml@v4-alpha\` and \`build.yml@v4\` runtime evidence. Consumers adopt
-the proved contract through the floating v4 coordinates; exact resolved SHAs
-remain audit evidence and never become durable selectors.
+\`.github/workflows/buildchain.yml\` calls the published
+\`public-ops-pipeline.yml@v4\` entry. Products declare their verification commands
+in schema-2 TOML, including the full repository check on each required platform.
+Next-development preparation, independent review, protected merge and settlement
+remain runtime responsibilities.
+
+\`.github/workflows/buildchain-recover.yml\` calls
+\`public-ops-recover.yml@v4\` with one exact attempt and an optional temporary
+repaired runtime. It preserves completed publication evidence while continuing
+unfinished follow-ups. Both callers use the same generated bytes as external
+consumers. Tool-maintained locks and retained receipts bind exact runtime SHAs.
+Earlier Stage Capsule and channel-build proofs retain their historical source
+identities; they do not define additional current consumer entrypoints.
 
 ## Local adapter
 

package/packages/core/release/passport/locations.js

@@ -1,29 +1,32 @@
 import path from "node:path";
 import fs from "node:fs";
-import { readJsonFile } from "./files.js";
 import https from "node:https";
 import http from "node:http";
 import { nonEmptyString } from "./identity.js";
-export async function resolveSiblingJson(basePath, relativePath) {
+export async function resolveSiblingJson(basePath, relativePath, options) {
   if (!basePath || !relativePath) {
     return undefined;
   }
   if (/^https?:\/\//.test(relativePath)) {
-    return readJsonFromLocation(relativePath);
+    return readJsonFromLocation(relativePath, 0, options);
   }
   if (/^https?:\/\//.test(basePath)) {
-    return readJsonFromLocation(new URL(relativePath, basePath).toString());
+    return readJsonFromLocation(
+      new URL(relativePath, basePath).toString(),
+      0,
+      options,
+    );
   }
   const candidate = path.resolve(path.dirname(basePath), relativePath);
   if (!fs.existsSync(candidate)) {
     return undefined;
   }
-  return readJsonFile(candidate);
+  return readJsonFromLocation(candidate, 0, options);
 }
 export async function readJsonFromLocation(
   location,
   redirectCount = 0,
-  { timeoutMs = 15_000 } = {},
+  { timeoutMs = 15_000, raw = false } = {},
 ) {
   const input = nonEmptyString(location, "location");
   if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
@@ -47,6 +50,7 @@ export async function readJsonFromLocation(
           response.resume();
           readJsonFromLocation(nextLocation, redirectCount + 1, {
             timeoutMs,
+            raw,
           }).then(resolve, reject);
           return;
         }
@@ -64,7 +68,7 @@ export async function readJsonFromLocation(
         });
         response.on("end", () => {
           try {
-            resolve(JSON.parse(body));
+            resolve(raw ? body : JSON.parse(body));
           } catch (error) {
             reject(error);
           }
@@ -78,5 +82,6 @@ export async function readJsonFromLocation(
       request.on("error", reject);
     });
   }
-  return readJsonFile(input);
+  const bytes = fs.readFileSync(input, "utf8");
+  return raw ? bytes : JSON.parse(bytes);
 }

package/packages/core/release/release-passport.js

@@ -1,3 +1,7 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { verifyPublishedDocuments } from "../publication/pipeline/stable-products.js";
 import { resolveReleasePassportVerificationInputs } from "./release-passport-contract.js";
 import { nowIso } from "./passport/identity.js";
 import {
@@ -5,6 +9,56 @@ import {
   resolveSiblingJson,
 } from "./passport/locations.js";
 import { createReleaseCheckReport } from "./passport/report.js";
+
+async function verifyPipelinePassport(location, release, checkedAt, execute) {
+  const directory = fs.mkdtempSync(
+    path.join(fs.realpathSync(os.tmpdir()), "buildchain-passport-"),
+  );
+  const report = {
+    schemaVersion: 1,
+    contract: "kungfu-buildchain-release-check-report",
+    checkedAt,
+    verificationScope: "signed-release-metadata",
+    artifactBytesVerified: false,
+    providerStateVerified: false,
+    completeness: { artifactCount: 0 },
+    issues: [],
+  };
+  try {
+    const values = { release };
+    for (const name of ["plan", "qualification", "capsules", "invocation"])
+      values[name] = await resolveSiblingJson(
+        location,
+        `buildchain.${name}.json`,
+      );
+    const bundle = await resolveSiblingJson(
+      location,
+      "buildchain.attestation.json",
+      { raw: true },
+    );
+    verifyPublishedDocuments(values, bundle, {
+      directory,
+      token: process.env.GH_TOKEN || process.env.GITHUB_TOKEN,
+      execute,
+    });
+    report.completeness.artifactCount = values.qualification.artifacts.length;
+    report.source = release.source;
+    report.release = release.release;
+  } catch {
+    report.issues.push({
+      level: "error",
+      code: "pipeline.evidence",
+      message:
+        "Signed release metadata verification failed. Supply all five unchanged companion files and GitHub CLI with attestation verification support.",
+    });
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+  report.ok = report.issues.length === 0;
+  report.trust = report.ok ? "pass" : "fail";
+  return report;
+}
+
 export async function verifyReleasePassport({
   passportLocation,
   artifactEvidenceLocation = "",
@@ -17,7 +71,16 @@ export async function verifyReleasePassport({
   kfdAdopterManifestGateLocation = "",
   kfdSupportEvidenceLocation = "",
   checkedAt = nowIso(),
+  execute,
 } = {}) {
+  const passport = await readJsonFromLocation(passportLocation);
+  if (passport?.schema === "kungfu.buildchain.release-passport/v4")
+    return verifyPipelinePassport(
+      passportLocation,
+      passport,
+      checkedAt,
+      execute,
+    );
   const evidence = await resolveReleasePassportVerificationInputs({
     passportLocation,
     locations: {
@@ -34,10 +97,7 @@ export async function verifyReleasePassport({
     readJson: readJsonFromLocation,
     resolveSibling: resolveSiblingJson,
   });
-  return createReleaseCheckReport({
-    ...evidence,
-    checkedAt,
-  });
+  return createReleaseCheckReport({ ...evidence, checkedAt });
 }
 export async function explainReleasePassport({
   passportLocation,
@@ -46,7 +106,9 @@ export async function explainReleasePassport({
   const report = await verifyReleasePassport({ passportLocation });
   const passport = await readJsonFromLocation(passportLocation);
   const nextAction = report.ok
-    ? "install-or-upgrade-after-policy-review"
+    ? report.verificationScope === "signed-release-metadata"
+      ? "verify-artifact-bytes-and-review-policy"
+      : "install-or-upgrade-after-policy-review"
     : "block-release-and-report-verification-failure";
   return {
     schemaVersion: 1,
@@ -54,6 +116,9 @@ export async function explainReleasePassport({
     audience: forAudience,
     release: passport.release,
     trust: report.trust,
+    verificationScope: report.verificationScope,
+    artifactBytesVerified: report.artifactBytesVerified,
+    providerStateVerified: report.providerStateVerified,
     complete: report.ok,
     artifactCount: report.completeness.artifactCount,
     runnerPolicy: passport.runnerPolicy,

package/packages/core/web/cli/badges.mjs

@@ -13,10 +13,6 @@ import {
   printJson,
   readBooleanFlag,
   readFlag,
-  readJsonInput,
-  readRepeatedFlag,
-  readRepeatedJsonInputs,
-  writeJsonFile,
 } from "../../contracts/cli/options.mjs";
 
 export async function runReadmeBadgesCli(args = []) {

package/packages/core/web/publication-admission.js

@@ -56,7 +56,7 @@ export function assembleWebPublicationAdmission({
       "managed web-surface publication requires an ephemeral GitHub-hosted Actions runner",
     );
   }
-  const workflowPath = ".github/workflows/public-release-web.yml";
+  const workflowPath = ".github/workflows/.release-web.yml";
   const publisherWorkflowPath = workflowPath;
   const controlPlaneAudit = createPublicationControlPlaneAudit({
     repository,

package/packages/core/web/publication-capability.js

@@ -36,7 +36,7 @@ export function verifyWebPublicationCapability(request, now = Date.now()) {
   }
   const roleArn = required(request, "roleArn");
   const exact = {
-    workflowPath: ".github/workflows/public-release-web.yml",
+    workflowPath: ".github/workflows/.release-web.yml",
     repository: required(request, "repository"),
     sourceSha: required(request, "sourceSha").toLowerCase(),
     runtimeSha: required(request, "runtimeSha").toLowerCase(),

package/packages/core/web/readme-badges.js

@@ -457,7 +457,7 @@ function normalizePackageRepository(repository) {
 function discoverWorkflowFacts({ cwd, repository, badgeConfig = {} }) {
   const workflowDir = path.join(cwd, ".github", "workflows");
   const configured = normalizeStringArray(badgeConfig.workflows);
-  const defaults = ["verify.yml", "build.yml", "buildchain-ref-promotion.yml"];
+  const defaults = ["verify.yml", ".build-candidate.yml", "buildchain-ref-promotion.yml"];
   const names = configured.length > 0 ? configured : defaults;
   if (!fs.existsSync(workflowDir)) {
     return [];

package/packages/core/workflow/cli/main.mjs

@@ -1,10 +1,7 @@
 import { initializeCliRuntime } from "../../contracts/cli/context.mjs";
 import { BUILDCHAIN_USAGE } from "../commands/buildchain-cli-help.mjs";
 import { formatCliHelp } from "../../contracts/cli-reference.js";
-import {
-  TRUST_RELEASE_COMMANDS,
-  dispatchTrustReleaseCommand,
-} from "../../release/cli/trust-release.mjs";
+import { TRUST_RELEASE_COMMANDS } from "../../release/cli/trust-release.mjs";
 import { dispatchRegisteredCommand } from "../../contracts/command-registry.mjs";
 import { handleAdopterDeliveryCommand } from "../../adoption/cli/dispatch.mjs";
 import { handleKfdCommand } from "../../adoption/cli/kfd.mjs";

package/packages/core/workflow/cli/process.mjs

@@ -1,4 +1,4 @@
-import { spawn, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { root } from "../../contracts/cli/context.mjs";
 

package/packages/core/workflow/commands/buildchain-cli-help.mjs

@@ -20,7 +20,7 @@ export const BUILDCHAIN_USAGE = `Usage:
                                     [--cold-fallback-status not-run|passed|failed]
                                     [--output <file>] [--json]
   buildchain candidate timeline --input <file-or-json> [--output <file>] [--json]
-  buildchain init [--cwd <dir>] [--type package|native|web-surface|infra-contract|publication-artifact|anchored-package] [--force]
+  buildchain init [--cwd <dir>] [--type npm|binary|paper|package|native|publication-artifact|anchored-package] [--force]
                   [--package-manager pnpm|npm|yarn] [--runner-preset <preset>]
                   [--artifact-name <name>]
   buildchain validate [--cwd <dir>] [--require-version-state]
@@ -253,7 +253,7 @@ export const BUILDCHAIN_USAGE = `Usage:
                                                    [--output <file>] [--promote]
                                                    [--no-toolchain-pull]
                                                    [--allow-unpinned-toolchain] [--json]
-  buildchain paper scaffold --package <name> --repository <owner/repo> [--write] [--json]
+  buildchain paper scaffold --repository <owner/repo> [--package <name>] [--write] [--json]
   buildchain paper migrate [--cwd <dir>] [--write] [--json]
   buildchain paper work start <topic> [--cwd <dir>] [--branch <branch>] [--execute] [--json]
   buildchain paper work submit [--cwd <dir>] [--title <title>] [--body <body>] [--execute] [--json]
@@ -261,13 +261,7 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain paper fleet update [--root <dir>] [--write] [--json]
   buildchain paper agent verify [--cwd <dir>] [--offline] [--json]
   buildchain paper preflight [--cwd <dir>] [--offline] [--json]
-  buildchain paper bootstrap npm [--cwd <dir>] [--execute]
-                                  [--confirm-public-package <name>] [--json]
-  buildchain paper build [--cwd <dir>] [--execute] [--json]
-  buildchain paper alpha [--cwd <dir>] [--source-ref <ref>] [--target-ref <ref>]
-                          [--execute] [--json]
   buildchain paper status [--cwd <dir>] [--json]
-  buildchain paper resume [--cwd <dir>] [--runtime-ref <ref>] [--execute] [--json]
   buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
   buildchain badges readme [--cwd <dir>] [--readme <path>] [--check] [--write] [--json]
   buildchain badges bundle [--cwd <dir>] [--readme <path>] [--claims <csv>] [--check] [--write] [--json]

package/packages/core/workflow/engine/conformance.js

@@ -52,7 +52,7 @@ export function executeBootstrapConformance(
     const source = fs.readFileSync(path.join(runtimeRoot, relative), "utf8");
     if (
       relative !== architecture.bootstrap.publicWorkflow &&
-      !/(?:\.\/)?\.github\/workflows\/public-ops-bootstrap\.yml/u.test(source)
+      !/(?:\.\/)?\.github\/workflows\/\.ops-bootstrap\.yml/u.test(source)
     )
       fail(`candidate Bootstrap facade is not governed: ${relative}`);
   }