@kungfu-tech/buildchain 4.1.3 → 4.1.4

package/packages/core/workflow/pipeline/build.js

@@ -3,12 +3,15 @@ import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { bindConsumerSource } from "../../consumer/contract/identity.js";
+import { inspectConsumerContract } from "../../consumer/contract/inspection.js";
+import { validateConsumerWiring } from "../../consumer/contract/local-validation.js";
 import { recordDigest } from "../../release/discussion/envelope.js";
 import { consumerCommandSession } from "../../runtime/consumer-shell.js";
 import { createNativeChildEnvironment } from "../../dev-delivery/native/execution.js";
 
 function inspectTrackedBytes(cwd, tree) {
   const root = fs.realpathSync(cwd);
+  const files = Object.create(null);
   const entries = execFileSync(
     "git",
     ["-C", root, "ls-tree", "-r", "-z", tree],
@@ -48,7 +51,13 @@ function inspectTrackedBytes(cwd, tree) {
       throw new Error(
         `Build tracked source bytes differ from the admitted tree: ${file}`,
       );
+    Object.defineProperty(files, file, {
+      enumerable: true,
+      get: () =>
+        link ? fs.readlinkSync(absolute) : fs.readFileSync(absolute, "utf8"),
+    });
   }
+  return files;
 }
 
 export function inspectPipelineSource(cwd, expected) {
@@ -82,7 +91,18 @@ export function inspectPipelineSource(cwd, expected) {
       "Build source has tracked modifications at its verification boundary",
     );
   // Index flags and local Git filters cannot qualify different product bytes.
-  inspectTrackedBytes(cwd, expected.tree);
+  const files = inspectTrackedBytes(cwd, expected.tree);
+  const { channel } = validateConsumerWiring(cwd, expected.configPath);
+  const inspection = inspectConsumerContract(files, {
+    channel,
+    configPath: expected.configPath,
+  });
+  if (inspection.controlIssues.length)
+    throw new Error(
+      `Consumer control wiring is invalid: ${inspection.controlIssues.join("; ")}`,
+    );
+  // Unresolved product language/tool edges are not a static safety proof.
+  // Execution remains confined to the runtime's read-only product jobs below.
   return plan;
 }
 

package/packages/core/workflow/pipeline/delivery-observation.js

@@ -65,9 +65,13 @@ export async function observePipelineWorker(session, current, queue, host) {
         run,
       };
   }
+  // Retained executions keep the workflow identity that actually produced them.
+  // The old path is read-only evidence, never a new dispatch or consumer alias.
   const entries = (run.referenced_workflows || []).filter((entry) =>
-    entry.path?.startsWith(
-      "kungfu-systems/buildchain/.github/workflows/public-ops-dev-auto-merge.yml@",
+    [".ops-dev-auto-merge.yml", "public-ops-dev-auto-merge.yml"].some((file) =>
+      entry.path?.startsWith(
+        `kungfu-systems/buildchain/.github/workflows/${file}@`,
+      ),
     ),
   );
   if (entries.length !== 1) return null;

package/packages/core/workflow/workflow-taxonomy.mjs

@@ -64,13 +64,12 @@ function validateEntries(policy, errors) {
     if (
       entry.path &&
       !(
-        [".build", "build", "buildchain", "buildchain-recover"].includes(
-          entry.id,
-        ) && entry.path === `.github/workflows/${entry.id}.yml`
+        [".build", "buildchain", "buildchain-recover"].includes(entry.id) &&
+        entry.path === `.github/workflows/${entry.id}.yml`
       )
     )
       errors.push(
-        `${entry.id}: explicit path is reserved for build APIs and the generated consumer pair`,
+        `${entry.id}: explicit path is reserved for the internal build engine and generated consumer pair`,
       );
     const file = workflowPath(entry);
     if (!WORKFLOW.test(file) || paths.has(file))
@@ -82,6 +81,33 @@ function validateEntries(policy, errors) {
       );
     validateEntryOwnership(entry, errors);
   }
+  const publicEntries = policy.entries.filter(
+    (entry) => entry.role === "public",
+  );
+  if (
+    policy.entries
+      .filter((entry) => entry.role === "self")
+      .map((entry) => entry.id)
+      .sort()
+      .join(",") !== "buildchain,buildchain-recover"
+  )
+    errors.push(
+      "repository event roots must be exactly the generated consumer pair",
+    );
+  if (
+    publicEntries.length !== 2 ||
+    ["pipeline", "recover"].some(
+      (purpose) =>
+        !publicEntries.some(
+          (entry) =>
+            entry.id === purpose &&
+            entry.category === "ops" &&
+            entry.purpose === purpose &&
+            entry.invocation === "reusable",
+        ),
+    )
+  )
+    errors.push("consumer public entries must be exactly pipeline and recover");
   return policy.entries;
 }
 
@@ -100,11 +126,9 @@ export function discoverWorkflowFiles(root) {
   return visit(directory).sort();
 }
 
-function validateWorkflow(root, entry, declared, errors) {
+function validateWorkflow(entry, text, declared, errors) {
+  if (typeof text !== "string") return;
   const file = workflowPath(entry),
-    absolute = path.join(root, file);
-  if (!fs.existsSync(absolute) || !fs.lstatSync(absolute).isFile()) return;
-  const text = fs.readFileSync(absolute, "utf8"),
     document = parseWorkflowDocument(text);
   if (
     (entry.invocation === "reusable") !==
@@ -258,23 +282,41 @@ function validateGateIntegration(root, errors) {
 
 export function checkWorkflowTaxonomy(
   root,
-  { integration = true, documentation = true } = {},
+  { integration = true, documentation = true, files } = {},
 ) {
   const errors = [],
-    policy = readWorkflowTaxonomy(root),
+    policy = files
+      ? JSON.parse(files[TAXONOMY_PATH] || "null")
+      : readWorkflowTaxonomy(root),
     entries = validateEntries(policy, errors);
   if (errors.length) return { ok: false, errors };
+  files ??= Object.fromEntries(
+    discoverWorkflowFiles(root).map((file) => {
+      const absolute = path.join(root, file);
+      return [
+        file,
+        fs.lstatSync(absolute).isFile()
+          ? fs.readFileSync(absolute, "utf8")
+          : null,
+      ];
+    }),
+  );
   const declared = new Set(entries.map(workflowPath)),
-    observed = new Set(discoverWorkflowFiles(root));
+    observed = new Set(
+      Object.keys(files).filter((file) =>
+        /^\.github\/workflows\/.*\.ya?ml$/iu.test(file),
+      ),
+    );
   for (const file of observed) {
     if (!declared.has(file)) errors.push(`unregistered workflow: ${file}`);
-    if (!fs.lstatSync(path.join(root, file)).isFile())
+    if (typeof files[file] !== "string")
       errors.push(`workflow must be a regular file: ${file}`);
   }
   for (const file of declared)
     if (!observed.has(file))
       errors.push(`registered workflow missing: ${file}`);
-  for (const entry of entries) validateWorkflow(root, entry, declared, errors);
+  for (const entry of entries)
+    validateWorkflow(entry, files[workflowPath(entry)], declared, errors);
   if (integration) validateGateIntegration(root, errors);
   if (documentation) {
     const file = path.join(root, TAXONOMY_DOC);
@@ -324,9 +366,9 @@ export function renderWorkflowCatalog(policy) {
     "",
     "Generated from `architecture/workflow-taxonomy.json`. Every workflow has one canonical implementation; alternate paths and historical forwarding aliases are rejected.",
     "",
-    "Public workflows own the consumer API. Component workflows own reusable multi-job topology. Self workflows own Buildchain repository automation. Actions own execution steps; JS adapters and Rust/WASM own implementation.",
+    "The two public workflows own normal pipeline execution and exact-attempt recovery. Component workflows are internal runtime implementation, including once-only setup and the dispatch signing service; consumers do not wire these components. Self workflows are the generated consumer pair. Actions own execution steps; JS adapters and Rust/WASM own implementation.",
     "",
-    "Names use `public-<category>-<purpose>.yml`, `.<category>-<purpose>.yml`, and the generated self callers `buildchain.yml` and `buildchain-recover.yml`, with categories `build`, `release`, and `ops`. The primary build API and backbone use `build.yml` and `.build.yml`.",
+    "Names use `public-ops-pipeline.yml`, `public-ops-recover.yml`, internal `.<category>-<purpose>.yml`, and the generated self callers `buildchain.yml` and `buildchain-recover.yml`. Categories are `build`, `release`, and `ops`; the internal build engine retains `.build.yml`.",
     "",
     "Register ownership before adding a workflow. `pnpm run check:workflows` validates source, calls, required CI integration and independent review ownership. `pnpm run generate:workflows` regenerates this catalog.",
     "",
@@ -366,6 +408,8 @@ function validateEntryOwnership(entry, errors) {
     errors.push(`${entry.id}: invalid invocation`);
   if ((entry.role === "self") !== (entry.invocation === "repository"))
     errors.push(`${entry.id}: role and invocation disagree`);
-  if (entry.role === "component" && entry.invocation !== "reusable")
-    errors.push(`${entry.id}: component must be reusable`);
+  if (entry.invocation === "dispatch-service" && entry.role !== "component")
+    errors.push(
+      `${entry.id}: dispatch services must remain internal components`,
+    );
 }

package/scripts/check-code-layout.mjs

@@ -204,6 +204,8 @@ export function inspectPublicActionNodes(actions, publicNodes) {
   const issues = [];
   if (!Array.isArray(publicNodes))
     return ["public Action registry must be an array"];
+  if (publicNodes.length)
+    issues.push("Actions are internal runtime nodes; consumers use pipeline and recovery workflows");
   const known = new Set(
     actions.map((action) => action.directory.replace(/^actions\//u, "")),
   );

package/scripts/check-core-mechanism-inventory.mjs

@@ -34,15 +34,24 @@ function registrySurfaceIds(root) {
     (entry) => `cli:${entry.id}`,
   );
   const workflows = loadJson(root, "dist/site/workflow-registry.json");
-  const workflowIds = workflows.workflows.flatMap((entry) => [
-    `workflow:${entry.id}`,
-    ...(entry.taxonomy ? [`workflow:${entry.taxonomy.id}`] : []),
+  const workflowIds = workflows.workflows.flatMap((entry) =>
+    [entry.id, ...(entry.taxonomy ? [entry.taxonomy.id] : [])].map((id) => [
+      `workflow:${id}`,
+      entry.apiRole === "public" ? "public" : "internal",
+    ]),
+  );
+  const actionIds = workflows.actions.map((entry) => [
+    `action:${entry.id}`,
+    entry.apiRole === "public" ? "public" : "internal",
   ]);
-  const actionIds = workflows.actions.map((entry) => `action:${entry.id}`);
   const exports = Object.keys(loadJson(root, "package.json").exports).map(
     (entry) => `export:${entry}`,
   );
-  return new Set([...cli, ...workflowIds, ...actionIds, ...exports]);
+  return new Map(
+    [...cli, ...exports]
+      .map((id) => [id, "public"])
+      .concat(workflowIds, actionIds),
+  );
 }
 
 function listFiles(root, relativeRoot) {
@@ -99,12 +108,12 @@ function validateOwnership(mechanism, ownedSources, issues) {
 }
 
 function validateSurfaces(mechanism, surfaces, issues) {
-  for (const surface of mechanism.publicSurfaces || []) {
-    if (!surfaces.has(surface))
-      issues.push(
-        `${mechanism.id}: public surface is absent from generated/package registries: ${surface}`,
-      );
-  }
+  for (const role of ["public", "internal"])
+    for (const surface of mechanism[`${role}Surfaces`] || [])
+      if (surfaces.get(surface) !== role)
+        issues.push(
+          `${mechanism.id}: ${role} surface is absent or has a different role in generated/package registries: ${surface}`,
+        );
 }
 
 function validateGitRefStore(root, mechanism, issues) {
@@ -140,12 +149,15 @@ function validateReverseScanReferences(root, reverseScan, issues) {
 function validateSurfaceKinds(inventory, issues) {
   const surfaceKinds = new Set(
     (inventory.mechanisms || []).flatMap((mechanism) =>
-      (mechanism.publicSurfaces || []).map((surface) => surface.split(":")[0]),
+      [
+        ...(mechanism.publicSurfaces || []),
+        ...(mechanism.internalSurfaces || []),
+      ].map((surface) => surface.split(":")[0]),
     ),
   );
   for (const kind of ["action", "cli", "export", "workflow"]) {
     if (!surfaceKinds.has(kind))
-      issues.push(`reverse scan has no ${kind} public surface coverage`);
+      issues.push(`reverse scan has no ${kind} surface coverage`);
   }
   return surfaceKinds;
 }
@@ -329,6 +341,10 @@ function checkCoreMechanismInventory({
       (sum, entry) => sum + entry.publicSurfaces.length,
       0,
     ),
+    internalSurfaces: inventory.mechanisms.reduce(
+      (sum, entry) => sum + (entry.internalSurfaces || []).length,
+      0,
+    ),
     dependencyCycles: inventory.maintainability.dependencyCycles,
     ...reverseScan,
   };

package/scripts/check-floating-consumer-policy-contract.mjs

@@ -116,10 +116,10 @@ export function checkFloatingConsumerPolicyContract() {
   assertOrdered("actions/publication/candidate/plan/action.yml", [
     "Admit source checkout", "Enforce v4 floating consumer policy", "Resolve controller identities",
   ]);
-  const publication = YAML.parse(read(".github/workflows/public-build-publication.yml"));
+  const publication = YAML.parse(read(".github/workflows/.build-publication.yml"));
   if (!Object.values(publication.jobs).some((job) => job.steps?.some((step) => step.uses?.endsWith("/actions/publication/candidate/plan"))))
     fail("publication does not invoke its consumer policy node");
-  const stageCanary = read(".github/workflows/public-build-stage-capsule-canary.yml");
+  const stageCanary = read(".github/workflows/.build-stage-capsule-canary.yml");
   if (
     !stageCanary.includes("consumer-admission:") ||
     !jobDependsOn(stageCanary, "qualify", "consumer-admission")
@@ -128,7 +128,7 @@ export function checkFloatingConsumerPolicyContract() {
       "Stage Capsule qualification is not transitively gated by consumer admission",
     );
   }
-  const promotion = read(".github/workflows/public-release-promote.yml");
+  const promotion = read(".github/workflows/.release-candidate-promote.yml");
   if (
     !promotion.includes("consumer-admission:") ||
     !jobDependsOn(promotion, "invoke", "consumer-admission")

package/scripts/check-inventory.mjs

@@ -146,23 +146,23 @@ const requiredPaths = [
   ".buildchain/alpha-contract-lock.json",
   ".buildchain/release-impact.json",
   ".github/actionlint.yaml",
-  ".github/workflows/public-ops-release-governance.yml",
-  ".github/workflows/public-ops-dev-auto-merge.yml",
-  ".github/workflows/public-ops-patrol.yml",
-  ".github/workflows/public-ops-patrol-daily.yml",
-  ".github/workflows/public-ops-patrol-weekly.yml",
-  ".github/workflows/public-ops-patrol-monthly.yml",
-  ".github/workflows/public-ops-observed-evidence.yml",
-  ".github/workflows/public-release-promote.yml",
+  ".github/workflows/.ops-release-governance.yml",
+  ".github/workflows/.ops-dev-auto-merge.yml",
+  ".github/workflows/.ops-patrol.yml",
+  ".github/workflows/.ops-patrol-daily.yml",
+  ".github/workflows/.ops-patrol-weekly.yml",
+  ".github/workflows/.ops-patrol-monthly.yml",
+  ".github/workflows/.ops-observed-evidence.yml",
+  ".github/workflows/.release-candidate-promote.yml",
   ".github/workflows/.release-promote.yml",
-  ".github/workflows/public-release-propagation.yml",
-  ".github/workflows/public-release-paper.yml",
+  ".github/workflows/.release-propagation.yml",
+  ".github/workflows/.release-paper.yml",
   ".github/workflows/.release-binary-assets.yml",
   ".github/workflows/.build.yml",
   ".github/workflows/.build-gate-profile.yml",
   ".github/workflows/.build-demo-adapter.yml",
-  ".github/workflows/public-build-demo.yml",
-  ".github/workflows/build.yml",
+  ".github/workflows/.build-demo.yml",
+  ".github/workflows/.build-candidate.yml",
   "fixtures/libnode-shaped/buildchain.toml",
   "fixtures/libnode-shaped/.github/workflows/build.yml",
   "fixtures/libnode-shaped/package.json",
@@ -281,7 +281,7 @@ for (const requiredSnippet of [
   }
 }
 const channelBuildWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/build.yml"),
+  path.join(root, ".github/workflows/.build-candidate.yml"),
   "utf8",
 );
 const advancedPromotionWorkflow = fs.readFileSync(
@@ -289,7 +289,7 @@ const advancedPromotionWorkflow = fs.readFileSync(
   "utf8",
 );
 const channelPromotionWorkflow = fs.readFileSync(
-  path.join(root, ".github/workflows/public-release-promote.yml"),
+  path.join(root, ".github/workflows/.release-candidate-promote.yml"),
   "utf8",
 );
 assertPromotionInventory(root);
@@ -306,7 +306,7 @@ const actionlintConfig = fs.readFileSync(
   "utf8",
 );
 for (const requiredSnippet of [
-  ".github/workflows/build.yml:",
+  ".github/workflows/.build-candidate.yml:",
   ".github/workflows/.build.yml:",
   ".github/workflows/.build-gate-profile.yml:",
   'property "workflow_ref" is not defined in object type',
@@ -859,25 +859,25 @@ for (const requiredSnippet of [
 }
 const reusableBuildSurfaceDoc = fs.readFileSync(path.join(root, "docs/reusable-build-surface.md"), "utf8");
 for (const requiredSnippet of [
-  "config-path",
-  "buildchain.toml",
-  ".buildchain/contract-lock.json",
-  ".buildchain/alpha-contract-lock.json",
-  "architecture/build-environments.json",
-  "build.contract",
-  "cache roots",
-  "exact consumer source",
-  "run-build-stage",
-  "transfer-build-artifact",
+  ".buildchain/buildchain.toml",
+  "schema = 2",
+  "[[products]]",
+  "public-ops-pipeline.yml@v4",
+  "public-ops-recover.yml@v4",
+  "Without a lock",
+  "exact Git commit, tree and TOML blob",
+  "without provider credentials",
+  "original attempt",
+  "Consumers do not call",
 ]) {
   if (!reusableBuildSurfaceDoc.includes(requiredSnippet)) {
-    throw new Error(`reusable build surface doc missing contract lock snippet: ${requiredSnippet}`);
+    throw new Error(`consumer build surface doc missing schema-2 contract snippet: ${requiredSnippet}`);
   }
 }
 for (const [docName, docSource] of Object.entries({ "docs/cli.md": cliDoc, "docs/install.md": installDoc })) {
   for (const requiredSnippet of [
     "minimumReleaseAgeExclude",
-    "@kungfu-tech/buildchain@4.0.0",
+    "@kungfu-tech/buildchain@4.1.3",
     "package/version-specific",
   ]) {
     if (!docSource.includes(requiredSnippet)) {

package/scripts/check-maintainability.mjs

@@ -1,7 +1,14 @@
 #!/usr/bin/env node
 
 import fs from "node:fs";
-import { projectRenamedMetrics } from "./source-metric-lineage.mjs";
+import {
+  projectRenamedMetrics,
+  projectWorkflowMetrics,
+} from "./source-metric-lineage.mjs";
+import {
+  workflowPath,
+  TAXONOMY_PATH,
+} from "../packages/core/workflow/workflow-taxonomy.mjs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
@@ -417,10 +424,25 @@ function checkMaintainability({ root = process.cwd() } = {}) {
     if (file.endsWith(".rs")) baselineFiles[file] = metrics;
   }
   const baselineTests = testMetricsAtRevision(root, extendedCoverageRevision);
-  const baselineWorkflows = workflowMetricsAtRevision(
-    root,
-    extendedCoverageRevision,
-  );
+  const taxonomyCoordinates = (policy) =>
+    policy.entries.map((entry) => ({
+      id: entry.id,
+      path: workflowPath(entry),
+    }));
+  const workflowLineage = projectWorkflowMetrics({
+    before: taxonomyCoordinates(
+      JSON.parse(
+        gitOutput(root, [
+          "show",
+          `${extendedCoverageRevision}:${TAXONOMY_PATH}`,
+        ]),
+      ),
+    ),
+    after: taxonomyCoordinates(readJson(root, TAXONOMY_PATH)),
+    metrics: workflowMetricsAtRevision(root, extendedCoverageRevision),
+    currentPaths: new Set(Object.keys(current.workflows)),
+  });
+  const baselineWorkflows = workflowLineage.metrics;
   const issues = evaluateExceptionGovernance({ policy });
   issues.push(...evaluateExceptionBudget({ policy }));
   const hotspots = collectHotspots(root, current, 20, debt.hotspots || []);
@@ -469,6 +491,7 @@ function checkMaintainability({ root = process.cwd() } = {}) {
     trackedFiles: current.repository.trackedFiles,
     sourceFiles: current.repository.handMaintainedSourceFiles,
     measurementRenames: lineage.renames,
+    workflowMeasurementRenames: workflowLineage.renames,
     publicSurface: current.publicSurface,
     hotspots: current.hotspots,
     governedDebtSurfaces: Object.values(debt.surfaces).reduce(

package/scripts/check-public-dogfood-contract.mjs

@@ -11,7 +11,7 @@ const DEFAULT_ROOT = path.resolve(
   "..",
 );
 const CALLER_PATH = ".github/workflows/self-build-public-consumer-dogfood.yml";
-const REUSABLE_PATH = ".github/workflows/public-build-stage-capsule-canary.yml";
+const REUSABLE_PATH = ".github/workflows/.build-stage-capsule-canary.yml";
 export const PUBLIC_DOGFOOD_ENTRY_REF = "v4";
 const PRIVATE_CONSUMER = ["buildchain", "self", "dogfood"].join("-");
 const PRIVATE_SHADOW = ["kungfu", "shadow"].join("-");
@@ -201,7 +201,7 @@ function assertWorkflowInventory(root) {
       fail(`${relative} invokes the private qualification script directly`);
     if (
       relative !== CALLER_PATH &&
-      text.includes(".github/workflows/public-build-stage-capsule-canary.yml@")
+      text.includes(".github/workflows/.build-stage-capsule-canary.yml@")
     )
       fail(`${relative} creates a second v4 dogfood caller`);
     if (relative !== REUSABLE_PATH && relative !== CALLER_PATH)
@@ -275,7 +275,7 @@ function assertArchitecture(root) {
     !dogfood ||
     dogfood.callerWorkflow !== CALLER_PATH ||
     dogfood.reusableWorkflow !==
-      "kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml" ||
+      "kungfu-systems/buildchain/.github/workflows/.build-stage-capsule-canary.yml" ||
     dogfood.runtimeBinding !== "entry-selected-runtime" ||
     dogfood.consumerSourceBinding !== "github.sha" ||
     JSON.stringify(dogfood.executableStages) !==

package/scripts/check-release-topology.mjs

@@ -532,7 +532,7 @@ export function checkReleaseTopology() {
   assertPipelinePublicationTopology(ledger, discoverReleaseTopology, root);
   const preview = ledger.postPublicationScope;
   assert.deepEqual(preview.workflowPaths, [
-    ".github/workflows/public-release-oci-compose-preview.yml",
+    ".github/workflows/.release-oci-compose-preview.yml",
   ]);
   const previewTopology = discoverReleaseTopology(
     preview.workflowPaths,

package/scripts/check-self-consumer-contract.mjs

@@ -2,12 +2,11 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { parse as yaml } from "yaml";
-import { compileConsumerPlan } from "../packages/core/consumer/contract/plan.js";
+import * as consumerPlan from "../packages/core/consumer/contract/plan.js";
 import { consumerWorkflows } from "../packages/core/consumer/contract/entries.js";
 import { workflowPath } from "../packages/core/workflow/workflow-taxonomy.mjs";
 
-export const SELF_ENTRY_CHANNEL = "v4-alpha";
-export const SELF_CONFIG_PATH = ".buildchain/minimal-consumer.toml";
+export const SELF_ENTRY_CHANNEL = "v4";
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const PLATFORMS = ["linux-x64", "macos-arm64", "windows-x64"];
 
@@ -19,10 +18,11 @@ export function checkSelfConsumerContract(root = ROOT) {
   const fail = (message) => {
     throw new Error(`self-consumer-contract: ${message}`);
   };
-  const plan = compileConsumerPlan(read(SELF_CONFIG_PATH));
-  if (read(SELF_CONFIG_PATH) !== read(".buildchain/buildchain.toml"))
-    fail("transition config must match the canonical product plan");
-  const callers = consumerWorkflows(SELF_ENTRY_CHANNEL, SELF_CONFIG_PATH);
+  const plan = consumerPlan.compileConsumerPlan(read(consumerPlan.CONFIG_PATH));
+  const retired = path.join(root, ".buildchain/minimal-consumer.toml");
+  if (fs.lstatSync(retired, { throwIfNoEntry: false }))
+    fail("retired transition config must not remain in the self consumer tree");
+  const callers = consumerWorkflows();
   for (const [file, bytes] of Object.entries(callers))
     if (read(file) !== bytes) fail(`${file}: generated caller drift`);
   const taxonomy = JSON.parse(read("architecture/workflow-taxonomy.json"));

package/scripts/check-universal-workflow-bootstrap.mjs

@@ -41,7 +41,7 @@ assert.equal(executor.with["mutation-token"], "${{ inputs.secrets-buildchain-pro
 assert.equal(executor.with.token, "${{ github.token }}");
 assert.doesNotMatch(read(contract.bootstrap.publicWorkflow), /admission-policy-json:/u);
 const template = parse(contract.bootstrap.consumerTemplate);
-assert.equal(template.jobs.bootstrap.uses, "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4");
+assert.equal(template.jobs.bootstrap.uses, "kungfu-systems/buildchain/.github/workflows/.ops-bootstrap.yml@v4");
 assert.equal(template.jobs.bootstrap.with["runtime-ref"], "${{ inputs.runtime-ref }}");
 assert.equal(contract.bootstrap.selfDogfoodActive, false);
 assert.equal(fs.existsSync(path.join(root, contract.bootstrap.selfDogfoodWorkflow)), false,

package/scripts/generate-channel-promotion-workflow.mjs

@@ -41,4 +41,4 @@ export function generateChannelPromotionWorkflow(source) {
   }, { lineWidth: 0, aliasDuplicateObjects: false });
 }
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url))
-  writeWorkflowSource(root, ".github/workflows/public-release-promote.yml", generateChannelPromotionWorkflow(fs.readFileSync(path.join(root, ".github/workflows/.release-promote.yml"), "utf8")));
+  writeWorkflowSource(root, ".github/workflows/.release-candidate-promote.yml", generateChannelPromotionWorkflow(fs.readFileSync(path.join(root, ".github/workflows/.release-promote.yml"), "utf8")));

package/scripts/generate-minimal-consumer-contract.mjs

@@ -5,6 +5,7 @@ import { parse as yaml } from "yaml";
 import { format } from "prettier";
 import { standardConsumerExample } from "../packages/core/consumer/contract/examples.js";
 import { inspectConsumerContract } from "../packages/core/consumer/contract/inspection.js";
+import { validateConsumerWiring } from "../packages/core/consumer/contract/local-validation.js";
 import { workflowPath } from "../packages/core/workflow/workflow-taxonomy.mjs";
 
 const root = process.cwd(),
@@ -13,6 +14,25 @@ const tracked = execFileSync("git", ["ls-files", "-z"], { encoding: "utf8" })
   .split("\0")
   .filter(Boolean);
 
+if (check) {
+  const files = Object.create(null);
+  for (const file of tracked)
+    Object.defineProperty(files, file, {
+      enumerable: true,
+      get: () => fs.readFileSync(path.join(root, file), "utf8"),
+    });
+  const { channel } = validateConsumerWiring(root);
+  const inspection = inspectConsumerContract(files, { channel });
+  if (inspection.controlIssues.length)
+    throw new Error(inspection.controlIssues.join("\n"));
+  const unresolved = inspection.commandClosures.filter(
+    (closure) => !closure.commandEdgesResolved,
+  ).length;
+  console.log(
+    `Self control wiring verified; ${unresolved} product graphs remain unresolved and require read-only runtime execution.`,
+  );
+}
+
 function output(file, value) {
   const target = path.join(root, file);
   if (check) {
@@ -143,7 +163,7 @@ output(
   await format(
     JSON.stringify({
       schema: "buildchain.consumer-migration/v1",
-      stage: "self-cutover-in-progress; final-release-qualification-pending",
+      stage: "self-default-entry; final-release-qualification-pending",
       workflows: workflowInventory(),
       consumerSources: consumerSourceInventory(),
     }),

package/scripts/generate-site-bundle.mjs

@@ -887,8 +887,9 @@ function buildSiteBundle() {
         ["self-hosted-runner-smoke", "compatibility-fixture"],
       ]);
       const engineeringHousekeeper = semanticId.startsWith("engineering-housekeeper");
+      if (classification?.role === "component") statusById.set(semanticId, "repository-internal");
       return {
-        ...entry,
+        ...entry, apiRole: classification?.role === "public" ? "public" : "implementation",
         ...(classification ? { taxonomy: { id: classification.id, role: classification.role, category: classification.category, purpose: classification.purpose, status: classification.status, canonicalPath: workflowPath(classification), ...(classification.role === "self" && classification.migration ? { contractPath: classification.migration.previousPath } : {}), compatibilityAlias: entry.path !== workflowPath(classification) } } : {}),
         surface: surfaceById.get(semanticId) || (entry.path.includes("/.") ? "reusable-workflow" : "repository-workflow"),
         capabilityGroup: workflowCapabilityGroup({

package/scripts/generate-tail-reseal-fixture.mjs

@@ -19,8 +19,8 @@ export function tailResealFixturePolicyReceipt(fixture, policy) {
   try {
     fs.mkdirSync(path.join(root, ".github/workflows"), { recursive: true });
     fs.writeFileSync(
-      path.join(root, ".github/workflows/build.yml"),
-      "jobs:\n  build:\n    uses: kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml@v4-alpha\n",
+      path.join(root, ".github/workflows/.build-candidate.yml"),
+      "jobs:\n  build:\n    uses: kungfu-systems/buildchain/.github/workflows/.build-stage-capsule-canary.yml@v4-alpha\n",
     );
     fs.mkdirSync(path.join(root, ".buildchain"), { recursive: true });
     for (const [file, ref, resolvedSha] of [
@@ -51,7 +51,7 @@ export function tailResealFixturePolicyReceipt(fixture, policy) {
       root,
       repository: fixture.repository,
       sourceSha: fixture.source.sha,
-      invokedWorkflow: "public-build-stage-capsule-canary.yml",
+      invokedWorkflow: ".build-stage-capsule-canary.yml",
       expectedInvocationChannel: "alpha",
       resolvedRuntimeSha: fixture.runtime.sha,
       policy,

package/scripts/inventory/promotion.mjs

@@ -8,7 +8,7 @@ import { generateChannelPromotionWorkflow } from "../generate-channel-promotion-
 
 export function assertPromotionInventory(root) {
   const read = (file) => fs.readFileSync(path.join(root, file), "utf8");
-  const publicPath = ".github/workflows/public-release-promote.yml";
+  const publicPath = ".github/workflows/.release-candidate-promote.yml";
   const api = YAML.parse(read(publicPath));
   assert.equal(
     read(publicPath),