@kungfu-tech/buildchain 4.1.6-alpha.0 → 4.1.7-alpha.0

package/dist/site/workflow-registry.json

@@ -48,13 +48,14 @@
       "path": ".github/workflows/.build-candidate.yml",
       "reusable": true,
       "inputs": [
+        "compatibility-inputs",
         "config-path",
         "contract-lock",
         "resume-run-id",
         "runtime-ref",
         "runtime-selection"
       ],
-      "inputCount": 5,
+      "inputCount": 6,
       "secrets": [
         "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
         "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
@@ -342,6 +343,54 @@
       "sunsetCondition": "explicit-contract-change-review",
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
+    {
+      "id": ".build-historical",
+      "path": ".github/workflows/.build-historical.yml",
+      "reusable": true,
+      "inputs": [
+        "compatibility-inputs",
+        "config-path",
+        "contract-lock",
+        "resume-run-id",
+        "runtime-ref",
+        "runtime-selection"
+      ],
+      "inputCount": 6,
+      "secrets": [
+        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
+        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
+        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN"
+      ],
+      "secretCount": 6,
+      "outputs": [
+        "result",
+        "runtime-selection"
+      ],
+      "outputCount": 2,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": ".build",
+        "role": "component",
+        "category": "build",
+        "purpose": "engine",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "reusable-build",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
     {
       "id": ".build-publication",
       "path": ".github/workflows/.build-publication.yml",
@@ -458,13 +507,14 @@
       "path": ".github/workflows/.build.yml",
       "reusable": true,
       "inputs": [
+        "compatibility-inputs",
         "config-path",
         "contract-lock",
         "resume-run-id",
         "runtime-ref",
         "runtime-selection"
       ],
-      "inputCount": 5,
+      "inputCount": 6,
       "secrets": [
         "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
         "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
@@ -858,7 +908,7 @@
       "status": "repository-internal",
       "owner": "buildchain-workflows",
       "maturity": "repository-internal",
-      "introducedVersion": "4.1.6-alpha.0",
+      "introducedVersion": "4.1.7-alpha.0",
       "compatibilityPromise": "current-contract-only",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
@@ -1709,6 +1759,87 @@
       "sunsetCondition": "explicit-contract-change-review",
       "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
     },
+    {
+      "id": ".release-historical",
+      "path": ".github/workflows/.release-historical.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "request-json",
+        "runtime-ref",
+        "runtime-selection"
+      ],
+      "inputCount": 4,
+      "secrets": [
+        "BUILDCHAIN_ISSUE_APP_ID",
+        "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
+        "BUILDCHAIN_ISSUE_TOKEN",
+        "BUILDCHAIN_PROMOTION_TOKEN",
+        "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+        "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
+        "buildchain-issue-app-id",
+        "buildchain-issue-app-private-key",
+        "buildchain-issue-token"
+      ],
+      "secretCount": 10,
+      "outputs": [
+        "built-source-sha",
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "discussion-id",
+        "discussion-url",
+        "github-artifact-attestation-evidence-root",
+        "github-artifact-attestation-id",
+        "github-artifact-attestation-publication-receipt-digest",
+        "github-artifact-attestation-url",
+        "promoted-sha",
+        "publication-capability-digest",
+        "publication-commit-evidence-digest",
+        "publication-commit-evidence-path",
+        "publication-commit-payload-root",
+        "publication-commit-url",
+        "release-candidate-action",
+        "release-candidate-artifact",
+        "release-candidate-recovery-receipt-artifact",
+        "release-candidate-recovery-root",
+        "release-invocation-root",
+        "release-propagation-work-artifact",
+        "release-receipt-root",
+        "release-tail-declaration-root",
+        "release-tail-receipt-roots-json",
+        "release-tail-state-root",
+        "release-tail-transaction-root",
+        "release-tail-transaction-state",
+        "release-transaction-root"
+      ],
+      "outputCount": 33,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": ".release-candidate-promote",
+        "role": "component",
+        "category": "release",
+        "purpose": "promote",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-promote.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
     {
       "id": ".release-oci-compose-preview",
       "path": ".github/workflows/.release-oci-compose-preview.yml",
@@ -2179,17 +2310,2259 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 37,
+      "inputCount": 37,
+      "secrets": [
+        "production-release-app-private-key",
+        "production-release-pr-token"
+      ],
+      "secretCount": 2,
+      "outputs": [
+        "buildchain-runtime-class",
+        "buildchain-runtime-override",
+        "buildchain-runtime-ref",
+        "buildchain-runtime-sha",
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "preview-apply-result-json",
+        "preview-cleanup-result-json",
+        "production-apply-result-json",
+        "production-release-pr-url",
+        "release-pr-status",
+        "staging-apply-result-json",
+        "web-surface-alias",
+        "web-surface-channel",
+        "web-surface-cleanup-plan-json",
+        "web-surface-manifest-json",
+        "web-surface-url",
+        "web-surface-urls-json"
+      ],
+      "outputCount": 23,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": ".web-surface",
+        "role": "component",
+        "category": "release",
+        "purpose": "web",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-web.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": "build",
+      "path": ".github/workflows/build.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-compression-level",
+        "artifact-finalization-command",
+        "artifact-finalization-on-platform",
+        "artifact-name",
+        "artifact-name-template",
+        "artifact-paths",
+        "artifact-relay-s3-bucket",
+        "artifact-relay-s3-download-role-arn",
+        "artifact-relay-s3-oidc-audience",
+        "artifact-relay-s3-prefix",
+        "artifact-relay-s3-region",
+        "artifact-relay-s3-role-arn",
+        "artifact-relay-s3-upload-role-arn",
+        "artifact-retention-days",
+        "artifact-signing-request-upload-no-proxy",
+        "artifact-transfer-mode",
+        "aws-codebuild-project",
+        "aws-ec2-macos-runner-label",
+        "aws-ec2-windows-runner-label",
+        "build-command",
+        "buildchain-alpha-contract-lock-path",
+        "buildchain-channel",
+        "buildchain-contract-compatibility-policy",
+        "buildchain-contract-drift-issue-mode",
+        "buildchain-contract-lock-path",
+        "buildchain-expected-channel",
+        "buildchain-expected-major",
+        "buildchain-ref",
+        "buildchain-repository",
+        "buildchain-stable-contract-lock-path",
+        "cache-dependency-lock-root",
+        "cache-policy-root",
+        "cache-toolchain-root",
+        "cargo-registry-index",
+        "checkout-cache-fallback",
+        "checkout-cache-fetch-attempts",
+        "checkout-cache-github-timeout-seconds",
+        "checkout-cache-mirror-url-template",
+        "checkout-cache-mode",
+        "checkout-cache-reference-repository-template",
+        "checkout-cache-timeout-seconds",
+        "checkout-history-mode",
+        "compiler-cache-platforms-json",
+        "compiler-cache-provider",
+        "compiler-cache-required",
+        "config-path",
+        "contract-lock",
+        "control-runner-json",
+        "credential-island-caller-owned",
+        "credential-island-environment",
+        "credential-island-macos-app-path",
+        "credential-island-macos-platform-id",
+        "expected-artifacts-json",
+        "fail-fast",
+        "gate-profile-aggregate-json",
+        "github-artifact-attestation-platform-id",
+        "github-artifact-attestation-signer-sha",
+        "github-artifact-attestation-subject-path",
+        "install-command",
+        "kfd-agent-hub",
+        "lifecycle-timeout-minutes",
+        "linux-container-image",
+        "linux-container-preset",
+        "node-version",
+        "platforms-json",
+        "pre-upload-transport-smoke-artifact-root",
+        "pre-upload-transport-smoke-scenario-path",
+        "process-sample-interval-ms",
+        "process-summary-path",
+        "publish-anchor-request-json",
+        "publish-channel",
+        "publish-refs-json",
+        "publish-registry",
+        "publish-source-ref",
+        "release-candidate",
+        "release-candidate-family-evidence-json",
+        "requested-parallelism",
+        "require-build",
+        "require-install",
+        "require-trusted-event",
+        "require-verify",
+        "resume-run-id",
+        "runner-preset",
+        "runtime-ref",
+        "runtime-selection",
+        "rust-toolchain",
+        "rustup-dist-server",
+        "rustup-update-root",
+        "sample-process-tree",
+        "self-hosted-offline-fallback",
+        "setup-node",
+        "setup-rust",
+        "shifu-cache-profile-digest",
+        "shifu-cache-profile-ref",
+        "untrusted-policy",
+        "verify-command",
+        "verify-substage-evidence-path",
+        "working-directory"
+      ],
+      "inputCount": 98,
+      "secrets": [
+        "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
+        "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
+        "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
+        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
+        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
+        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN"
+      ],
+      "secretCount": 9,
+      "outputs": [
+        "artifact-coordinates-json",
+        "build-diagnostics-summary-artifact",
+        "build-diagnostics-summary-json",
+        "build-summary-artifact",
+        "build-summary-json",
+        "buildchain-channel",
+        "buildchain-channel-reason",
+        "buildchain-channel-selection-source",
+        "buildchain-contract-digest",
+        "buildchain-contract-lock-drift",
+        "buildchain-contract-lock-status",
+        "buildchain-runtime-class",
+        "buildchain-runtime-override",
+        "buildchain-runtime-ref",
+        "buildchain-runtime-sha",
+        "buildchain-runtime-trust-decision",
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "credential-island-macos-artifact",
+        "credential-island-macos-manifest-artifact",
+        "linux-container-enabled",
+        "linux-container-image",
+        "platform-count",
+        "platforms-json",
+        "publish-allowed",
+        "publish-channel",
+        "publish-reason",
+        "publish-source-channel",
+        "publish-source-consumer-version",
+        "publish-source-line",
+        "publish-source-locked",
+        "publish-source-ref",
+        "publish-source-sha",
+        "publish-source-tree-sha",
+        "release-candidate-artifact",
+        "release-candidate-passport-artifact",
+        "release-candidate-passport-json",
+        "release-manifest-json",
+        "result",
+        "runner-preset",
+        "runner-routing-json",
+        "trusted-event"
+      ],
+      "outputCount": 47,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "build",
+        "role": "component",
+        "category": "build",
+        "purpose": "candidate",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build-candidate.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "channel-build-router",
+      "capabilityGroup": "reusable-build",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "buildchain-recover",
+      "path": ".github/workflows/buildchain-recover.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": "buildchain-recover",
+        "role": "self",
+        "category": "ops",
+        "purpose": "recovery",
+        "status": "active",
+        "canonicalPath": ".github/workflows/buildchain-recover.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": "buildchain",
+      "path": ".github/workflows/buildchain.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "implementation",
+      "taxonomy": {
+        "id": "buildchain",
+        "role": "self",
+        "category": "ops",
+        "purpose": "pipeline",
+        "status": "active",
+        "canonicalPath": ".github/workflows/buildchain.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": "check",
+      "path": ".github/workflows/check.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "buildchain-repository",
+        "contract-lock",
+        "mode",
+        "node-version",
+        "require-version-state",
+        "runtime-ref",
+        "runtime-selection",
+        "source-proof-closure-paths-json",
+        "source-proof-dependency-paths-json",
+        "source-proof-policy-paths-json",
+        "source-proof-required-contexts-json",
+        "source-proof-reuse",
+        "upload-artifacts",
+        "working-directory"
+      ],
+      "inputCount": 15,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "source-proof-decision-root",
+        "source-proof-producer-run-id",
+        "source-proof-reuse-reason",
+        "source-proof-reused",
+        "source-proof-root"
+      ],
+      "outputCount": 12,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "check",
+        "role": "component",
+        "category": "build",
+        "purpose": "check",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build-check.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "dev-pr-auto-merge",
+      "path": ".github/workflows/dev-pr-auto-merge.yml",
+      "reusable": true,
+      "inputs": [
+        "active-lease-context",
+        "affected-paths-json",
+        "allowed-head-prefixes",
+        "assignment-root",
+        "block-labels",
+        "buildchain-ref",
+        "buildchain-repository",
+        "closure-root",
+        "contract-lock",
+        "defer-landing",
+        "delivery-class",
+        "delivery-priority",
+        "delivery-warrant-mode",
+        "dependency-root",
+        "diagnostic-context",
+        "dry-run",
+        "environment-root",
+        "expected-head-sha",
+        "expected-pr-number",
+        "handoff-workflow-id",
+        "initiative-root",
+        "landing-mode",
+        "legacy-active-owner-binding-json",
+        "max-merges",
+        "merge-method",
+        "native-command",
+        "native-command-root",
+        "native-heartbeat-seconds",
+        "native-platform",
+        "native-proof-json",
+        "pipeline-attempt",
+        "plan-root",
+        "project-cut-proof-json",
+        "queue-admission-context",
+        "ready-label",
+        "release-blocker-priority-json",
+        "require-approval",
+        "required-status-checks",
+        "runtime-ref",
+        "runtime-selection",
+        "same-repository-only",
+        "shard-evidence-roots-json",
+        "source-identity-root",
+        "source-patch-root",
+        "source-root",
+        "source-workflow-id",
+        "source-workflow-run-id",
+        "target-branch",
+        "toolchain-root",
+        "universal-request-json",
+        "warrant-lease-seconds"
+      ],
+      "inputCount": 51,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "action-count",
+        "admission-receipt-root",
+        "admission-state",
+        "enqueued-count",
+        "evaluated-count",
+        "final-base-sha",
+        "merged-count",
+        "native-execution-transfer-root",
+        "native-proof-root",
+        "native-reuse-decision-root",
+        "project-cut-proof-root",
+        "provider-finalizer-boundary-root",
+        "provider-heartbeat-receipt-root",
+        "qualified-warrant-receipt-root",
+        "skipped-count",
+        "source-proof-root",
+        "warrant-receipt-root",
+        "warrant-state-commit",
+        "warrant-state-root"
+      ],
+      "outputCount": 19,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "dev-pr-auto-merge",
+        "role": "component",
+        "category": "ops",
+        "purpose": "dev-auto-merge",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-dev-auto-merge.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "dev-governance",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-build-adopter-qualification",
+      "path": ".github/workflows/public-build-adopter-qualification.yml",
+      "reusable": true,
+      "inputs": [
+        "consumer",
+        "consumer-ref",
+        "consumer-repository",
+        "contract-lock",
+        "input-path",
+        "invocation-source-path",
+        "runtime-ref",
+        "runtime-selection"
+      ],
+      "inputCount": 8,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "v4-adopter-delivery",
+        "role": "component",
+        "category": "build",
+        "purpose": "adopter-qualification",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build-adopter-qualification.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-build-check",
+      "path": ".github/workflows/public-build-check.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "mode",
+        "node-version",
+        "require-version-state",
+        "runtime-ref",
+        "runtime-selection",
+        "source-proof-closure-paths-json",
+        "source-proof-dependency-paths-json",
+        "source-proof-policy-paths-json",
+        "source-proof-required-contexts-json",
+        "source-proof-reuse",
+        "upload-artifacts",
+        "working-directory"
+      ],
+      "inputCount": 13,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "source-proof-decision-root",
+        "source-proof-producer-run-id",
+        "source-proof-reuse-reason",
+        "source-proof-reused",
+        "source-proof-root"
+      ],
+      "outputCount": 12,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "check",
+        "role": "component",
+        "category": "build",
+        "purpose": "check",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build-check.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-build-demo",
+      "path": ".github/workflows/public-build-demo.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-retention-days",
+        "binary-artifact-digest",
+        "binary-artifact-name",
+        "contract-lock",
+        "materialize",
+        "materialize-base-ref",
+        "media-profile",
+        "render-failure-advisory",
+        "render-media",
+        "renderer-image",
+        "runtime-ref",
+        "runtime-selection",
+        "scenario-path",
+        "source-ref"
+      ],
+      "inputCount": 14,
+      "secrets": [
+        "DEMO_UPDATE_TOKEN"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "capture-artifact-digest",
+        "capture-artifact-name",
+        "evidence-artifact-digest",
+        "evidence-artifact-name",
+        "publication-pr-url",
+        "render-result",
+        "source-sha"
+      ],
+      "outputCount": 7,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": ".declarative-auditable-demo",
+        "role": "component",
+        "category": "build",
+        "purpose": "demo",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build-demo.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "declarative-auditable-demo",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-build-publication",
+      "path": ".github/workflows/public-build-publication.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-name",
+        "artifact-paths",
+        "artifact-retention-days",
+        "build-command",
+        "buildchain-alpha-contract-lock-path",
+        "buildchain-stable-contract-lock-path",
+        "contract-lock",
+        "node-version",
+        "package-name",
+        "prepare-paper-package",
+        "publish-dist-tag",
+        "runtime-ref",
+        "runtime-selection",
+        "setup-node",
+        "target-ref",
+        "toolchain-command",
+        "toolchain-digest",
+        "toolchain-image",
+        "toolchain-type",
+        "verify-command",
+        "working-directory"
+      ],
+      "inputCount": 21,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "package-name",
+        "package-version",
+        "publication-artifact-name",
+        "publication-manifest-json",
+        "publication-manifest-path",
+        "publication-passport-path",
+        "publication-registry-path",
+        "publish-dist-tag",
+        "runtime-sha"
+      ],
+      "outputCount": 16,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "publication-artifact",
+        "role": "component",
+        "category": "build",
+        "purpose": "publication",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build-publication.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "reusable-build",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-build-stage-capsule-canary",
+      "path": ".github/workflows/public-build-stage-capsule-canary.yml",
+      "reusable": true,
+      "inputs": [
+        "build-artifact-path",
+        "consumer",
+        "contract-lock",
+        "go-version",
+        "install-artifact-path",
+        "node-version",
+        "runtime-ref",
+        "runtime-selection",
+        "verify-artifact-path"
+      ],
+      "inputCount": 9,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "v4-stage-capsule-canary",
+        "role": "component",
+        "category": "build",
+        "purpose": "stage-capsule-canary",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.build-stage-capsule-canary.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-alpha-candidate-patrol",
+      "path": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
+      "reusable": true,
+      "inputs": [
+        "alpha-workflow-path",
+        "auto-merge",
+        "contract-lock",
+        "dev-workflow-path",
+        "dry-run",
+        "max-age-seconds",
+        "merge-method",
+        "pull-request-body-prefix",
+        "pull-request-body-prefix-renderer",
+        "reactivation-authorized",
+        "runtime-ref",
+        "runtime-selection",
+        "settlement-authorized",
+        "source-branch",
+        "target-branch"
+      ],
+      "inputCount": 15,
+      "secrets": [
+        "promotion-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "active-candidate-pr",
+        "candidate-generation",
+        "candidate-tree-sha",
+        "controller-state",
+        "cut-root",
+        "drift-root",
+        "eligible",
+        "hold-root",
+        "next-candidate-sha",
+        "prior-state-root",
+        "promotion-pr",
+        "result-path",
+        "runtime-sha",
+        "selected-sha",
+        "settlement-action",
+        "source-lock-ref",
+        "train-root"
+      ],
+      "outputCount": 17,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "dev-alpha-candidate-patrol",
+        "role": "component",
+        "category": "ops",
+        "purpose": "alpha-candidate-patrol",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-alpha-candidate-patrol.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-bootstrap",
+      "path": ".github/workflows/public-ops-bootstrap.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "request-json",
+        "runtime-ref",
+        "runtime-selection"
+      ],
+      "inputCount": 4,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "admission-root",
+        "request-root",
+        "result-json",
+        "result-root",
+        "runtime-sha",
+        "terminal-receipt-json",
+        "terminal-receipt-root"
+      ],
+      "outputCount": 7,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "bootstrap",
+        "role": "component",
+        "category": "ops",
+        "purpose": "bootstrap",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-bootstrap.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-dev-auto-merge",
+      "path": ".github/workflows/public-ops-dev-auto-merge.yml",
+      "reusable": true,
+      "inputs": [
+        "active-lease-context",
+        "affected-paths-json",
+        "allowed-head-prefixes",
+        "block-labels",
+        "closure-root",
+        "contract-lock",
+        "defer-landing",
+        "delivery-class",
+        "delivery-priority",
+        "delivery-warrant-mode",
+        "dependency-root",
+        "diagnostic-context",
+        "dry-run",
+        "environment-root",
+        "expected-head-sha",
+        "expected-pr-number",
+        "handoff-workflow-id",
+        "landing-mode",
+        "max-merges",
+        "merge-method",
+        "native-command",
+        "native-command-root",
+        "native-heartbeat-seconds",
+        "native-platform",
+        "native-proof-json",
+        "pipeline-attempt",
+        "plan-root",
+        "project-cut-proof-json",
+        "queue-admission-context",
+        "ready-label",
+        "release-blocker-priority-json",
+        "require-approval",
+        "required-status-checks",
+        "runtime-ref",
+        "runtime-selection",
+        "same-repository-only",
+        "shard-evidence-roots-json",
+        "source-identity-root",
+        "source-patch-root",
+        "source-root",
+        "source-workflow-run-id",
+        "target-branch",
+        "toolchain-root",
+        "warrant-lease-seconds"
+      ],
+      "inputCount": 44,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "action-count",
+        "admission-receipt-root",
+        "admission-state",
+        "enqueued-count",
+        "evaluated-count",
+        "final-base-sha",
+        "merged-count",
+        "native-execution-transfer-root",
+        "native-proof-root",
+        "native-reuse-decision-root",
+        "project-cut-proof-root",
+        "provider-finalizer-boundary-root",
+        "provider-heartbeat-receipt-root",
+        "qualified-warrant-receipt-root",
+        "skipped-count",
+        "source-proof-root",
+        "warrant-receipt-root",
+        "warrant-state-commit",
+        "warrant-state-root"
+      ],
+      "outputCount": 19,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "dev-pr-auto-merge",
+        "role": "component",
+        "category": "ops",
+        "purpose": "dev-auto-merge",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-dev-auto-merge.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "dev-governance",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-dev-qualification-patrol",
+      "path": ".github/workflows/public-ops-dev-qualification-patrol.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "dev-workflow-path",
+        "dispatch-inputs-json",
+        "dry-run",
+        "max-attempts",
+        "mutation-authorized",
+        "preflight-workflow-path",
+        "priority-workflows-json",
+        "runtime-ref",
+        "runtime-selection",
+        "source-branch"
+      ],
+      "inputCount": 11,
+      "secrets": [
+        "qualification-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "action",
+        "active-run-id",
+        "decision-root",
+        "pending-sha",
+        "reason",
+        "source-sha",
+        "state"
+      ],
+      "outputCount": 7,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "dev-qualification-patrol",
+        "role": "component",
+        "category": "ops",
+        "purpose": "dev-qualification-patrol",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-dev-qualification-patrol.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-housekeeping",
+      "path": ".github/workflows/public-ops-housekeeping.yml",
+      "reusable": true,
+      "inputs": [
+        "apply-enabled",
+        "artifact-prefix",
+        "artifact-retention-days",
+        "contract-lock",
+        "max-actions",
+        "mode",
+        "protected-patterns",
+        "repository",
+        "retained-patterns",
+        "runtime-ref",
+        "runtime-selection",
+        "stale-days",
+        "stale-pull-request-label",
+        "target-branch",
+        "temporary-branch-patterns"
+      ],
+      "inputCount": 15,
+      "secrets": [
+        "housekeeper_app_id",
+        "housekeeper_app_private_key",
+        "housekeeper_token"
+      ],
+      "secretCount": 3,
+      "outputs": [
+        "action-count",
+        "branch-receipt-root",
+        "outcome",
+        "plan-artifact",
+        "plan-root",
+        "pull-request-receipt-root",
+        "receipt-artifact",
+        "report-artifact",
+        "report-receipt-root"
+      ],
+      "outputCount": 9,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "engineering-housekeeper",
+        "role": "component",
+        "category": "ops",
+        "purpose": "housekeeping",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-housekeeping.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.7-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-observed-evidence",
+      "path": ".github/workflows/public-ops-observed-evidence.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-path",
+        "build-command",
+        "cloudfront-distribution",
+        "contract-lock",
+        "evidence-source-path",
+        "evidence-source-ref",
+        "evidence-source-repository",
+        "manifest-path",
+        "production-aws-role-arn",
+        "production-bucket",
+        "production-environment",
+        "runtime-ref",
+        "runtime-selection",
+        "verify-command"
+      ],
+      "inputCount": 14,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "receipt-path"
+      ],
+      "outputCount": 1,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "patrol-observed-evidence",
+        "role": "component",
+        "category": "ops",
+        "purpose": "observed-evidence",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-observed-evidence.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-patrol-daily",
+      "path": ".github/workflows/public-ops-patrol-daily.yml",
+      "reusable": true,
+      "inputs": [
+        "allowed-head-prefixes",
+        "block-labels",
+        "contract-lock",
+        "dry-run",
+        "landing-mode",
+        "max-actions",
+        "merge-method",
+        "ready-label",
+        "require-approval",
+        "required-status-checks",
+        "runtime-ref",
+        "runtime-selection",
+        "same-repository-only",
+        "target-branch"
+      ],
+      "inputCount": 14,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "action-count",
+        "evaluated-count",
+        "planned-count",
+        "result-path",
+        "skipped-count"
+      ],
+      "outputCount": 5,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "patrol-daily",
+        "role": "component",
+        "category": "ops",
+        "purpose": "patrol-daily",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-patrol-daily.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-patrol-monthly",
+      "path": ".github/workflows/public-ops-patrol-monthly.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "dry-run",
+        "runtime-ref",
+        "runtime-selection",
+        "target-branch"
+      ],
+      "inputCount": 5,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "action-count",
+        "evaluated-count",
+        "planned-count",
+        "result-path",
+        "skipped-count"
+      ],
+      "outputCount": 5,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "patrol-monthly",
+        "role": "component",
+        "category": "ops",
+        "purpose": "patrol-monthly",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-patrol-monthly.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-patrol-weekly",
+      "path": ".github/workflows/public-ops-patrol-weekly.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "dry-run",
+        "runtime-ref",
+        "runtime-selection",
+        "target-branch"
+      ],
+      "inputCount": 5,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "action-count",
+        "evaluated-count",
+        "planned-count",
+        "result-path",
+        "skipped-count"
+      ],
+      "outputCount": 5,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "patrol-weekly",
+        "role": "component",
+        "category": "ops",
+        "purpose": "patrol-weekly",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-patrol-weekly.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-patrol",
+      "path": ".github/workflows/public-ops-patrol.yml",
+      "reusable": true,
+      "inputs": [
+        "allowed-head-prefixes",
+        "block-labels",
+        "cadence",
+        "capabilities",
+        "contract-lock",
+        "dry-run",
+        "landing-mode",
+        "max-actions",
+        "merge-method",
+        "mode",
+        "ready-label",
+        "require-approval",
+        "required-status-checks",
+        "runtime-ref",
+        "runtime-selection",
+        "same-repository-only",
+        "target-branch"
+      ],
+      "inputCount": 17,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "action-count",
+        "evaluated-count",
+        "planned-count",
+        "result-path",
+        "skipped-count"
+      ],
+      "outputCount": 5,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "buildchain-patrol",
+        "role": "component",
+        "category": "ops",
+        "purpose": "patrol",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-patrol.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-pipeline",
+      "path": ".github/workflows/public-ops-pipeline.yml",
+      "reusable": true,
+      "inputs": [
+        "config-path"
+      ],
+      "inputCount": 1,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "public",
+      "taxonomy": {
+        "id": "pipeline",
+        "role": "public",
+        "category": "ops",
+        "purpose": "pipeline",
+        "status": "active",
+        "canonicalPath": ".github/workflows/public-ops-pipeline.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": "public-ops-recover",
+      "path": ".github/workflows/public-ops-recover.yml",
+      "reusable": true,
+      "inputs": [
+        "attempt",
+        "runtime-ref"
+      ],
+      "inputCount": 2,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "public",
+      "taxonomy": {
+        "id": "recover",
+        "role": "public",
+        "category": "ops",
+        "purpose": "recover",
+        "status": "active",
+        "canonicalPath": ".github/workflows/public-ops-recover.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+    },
+    {
+      "id": "public-ops-release-governance",
+      "path": ".github/workflows/public-ops-release-governance.yml",
+      "reusable": true,
+      "inputs": [
+        "apply",
+        "branch",
+        "candidate-sha",
+        "contract-lock",
+        "runtime-ref",
+        "runtime-selection"
+      ],
+      "inputCount": 6,
+      "secrets": [
+        "BUILDCHAIN_PROMOTION_TOKEN",
+        "governance-token"
+      ],
+      "secretCount": 2,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "release-governance-reconcile",
+        "role": "component",
+        "category": "ops",
+        "purpose": "release-governance",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-release-governance.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "release-governance",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-stable-candidate-patrol",
+      "path": ".github/workflows/public-ops-stable-candidate-patrol.yml",
+      "reusable": true,
+      "inputs": [
+        "auto-approve",
+        "auto-merge",
+        "auto-promote",
+        "contract-lock",
+        "dry-run",
+        "hold",
+        "hold-reason",
+        "ledger-ref",
+        "merge-method",
+        "minimum-soak-seconds",
+        "release-now",
+        "required-checks",
+        "revoke-reason",
+        "revoked-versions",
+        "runtime-ref",
+        "runtime-selection",
+        "target-branch"
+      ],
+      "inputCount": 17,
+      "secrets": [
+        "approval-token",
+        "promotion-token"
+      ],
+      "secretCount": 2,
+      "outputs": [
+        "promotion-pr",
+        "result-path",
+        "selected",
+        "selected-sha",
+        "selected-version",
+        "stable-version"
+      ],
+      "outputCount": 6,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "stable-candidate-patrol",
+        "role": "component",
+        "category": "ops",
+        "purpose": "stable-candidate-patrol",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-stable-candidate-patrol.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-tail-reseal",
+      "path": ".github/workflows/public-ops-tail-reseal.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-retention-days",
+        "consumer-policy-receipt-json",
+        "contract-lock",
+        "macos-finalization-command",
+        "request-json",
+        "runtime-ref",
+        "runtime-selection"
+      ],
+      "inputCount": 7,
+      "secrets": [
+        "BUILDCHAIN_EVIDENCE_READ_TOKEN",
+        "BUILDCHAIN_SIGNING_TOKEN"
+      ],
+      "secretCount": 2,
+      "outputs": [
+        "release-candidate-passport-json",
+        "tail-reseal-receipt-root"
+      ],
+      "outputCount": 2,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "v4-tail-reseal",
+        "role": "component",
+        "category": "ops",
+        "purpose": "tail-reseal",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-tail-reseal.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-warrant-cancel",
+      "path": ".github/workflows/public-ops-warrant-cancel.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "event-action",
+        "expected-candidate-id",
+        "expected-old-state-root",
+        "expected-pr-number",
+        "expected-source-head-sha",
+        "observed-source-head-sha",
+        "outcome",
+        "reason",
+        "runtime-ref",
+        "runtime-selection",
+        "target-branch",
+        "terminal-evidence-root"
+      ],
+      "inputCount": 13,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "cancellation-action",
+        "cancellation-receipt-root",
+        "final-state-root"
+      ],
+      "outputCount": 3,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "dev-delivery-warrant-cancel",
+        "role": "component",
+        "category": "ops",
+        "purpose": "warrant-cancel",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-warrant-cancel.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-ops-warrant-close",
+      "path": ".github/workflows/public-ops-warrant-close.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "current-base-sha",
+        "expected-head-sha",
+        "expected-pr-number",
+        "merge-group-head-sha",
+        "merge-group-tree-sha",
+        "outcome",
+        "reason",
+        "replay-tree-sha",
+        "required-context-roots-json",
+        "runtime-ref",
+        "runtime-selection",
+        "target-branch",
+        "terminal-evidence-root"
+      ],
+      "inputCount": 14,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "close-receipt-root",
+        "final-state-root",
+        "integration-proof-root",
+        "successor-wake-json"
+      ],
+      "outputCount": 4,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "dev-delivery-warrant-close",
+        "role": "component",
+        "category": "ops",
+        "purpose": "warrant-close",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.ops-warrant-close.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "governance-versioning",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-release-artifact-attestation",
+      "path": ".github/workflows/public-release-artifact-attestation.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "environment",
+        "evidence-artifact-name",
+        "evidence-run-id",
+        "platform-manifest-artifact-name",
+        "platform-manifest-relative-path",
+        "policy-json",
+        "release-passport-artifact-name",
+        "release-passport-relative-path",
+        "retention-days",
+        "runtime-ref",
+        "runtime-selection",
+        "source-sha",
+        "subject-artifact-name",
+        "subject-relative-path"
+      ],
+      "inputCount": 15,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "attestation-id",
+        "attestation-url",
+        "bundle-digest",
+        "evidence-artifact-name",
+        "evidence-root"
+      ],
+      "outputCount": 5,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "github-artifact-attestation",
+        "role": "component",
+        "category": "release",
+        "purpose": "artifact-attestation",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-artifact-attestation.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "release-passport",
+      "capabilityGroup": "release-passport-trust",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-release-oci-compose-preview",
+      "path": ".github/workflows/public-release-oci-compose-preview.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "runtime-ref",
+        "runtime-selection"
+      ],
+      "inputCount": 3,
+      "secrets": [
+        "BUILDCHAIN_PROMOTION_TOKEN"
+      ],
+      "secretCount": 1,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "oci-compose-preview",
+        "role": "component",
+        "category": "release",
+        "purpose": "oci-compose-preview",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-oci-compose-preview.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-release-paper",
+      "path": ".github/workflows/public-release-paper.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-name",
+        "artifact-paths",
+        "artifact-retention-days",
+        "branch-protection-bypass-apps",
+        "contract-lock",
+        "dry-run",
+        "github-governance-receipt-json",
+        "github-release",
+        "package-name",
+        "publish-dist-tag",
+        "publisher-workflow-path",
+        "release-passport-impact-json",
+        "release-passport-output-dir",
+        "release-passport-product-name",
+        "required-status-check",
+        "runtime-ref",
+        "runtime-selection",
+        "target-ref",
+        "target-sha",
+        "toolchain-type",
+        "verify-command",
+        "working-directory"
+      ],
+      "inputCount": 22,
+      "secrets": [
+        "BUILDCHAIN_GENERATED_WRITE_APP_CLIENT_ID",
+        "BUILDCHAIN_GENERATED_WRITE_APP_PRIVATE_KEY",
+        "BUILDCHAIN_GENERATED_WRITE_TOKEN",
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
+      ],
+      "secretCount": 4,
+      "outputs": [
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "github-release-url",
+        "package-name",
+        "package-version",
+        "propagation-work-artifact",
+        "public-release-tag",
+        "release-passport-path",
+        "upstream-release-json"
+      ],
+      "outputCount": 14,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "paper-release",
+        "role": "component",
+        "category": "release",
+        "purpose": "paper",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-paper.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "reusable-build",
+      "capabilityGroup": "reusable-build",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-release-promote",
+      "path": ".github/workflows/public-release-promote.yml",
+      "reusable": true,
+      "inputs": [
+        "contract-lock",
+        "request-json",
+        "runtime-ref",
+        "runtime-selection"
+      ],
+      "inputCount": 4,
+      "secrets": [
+        "BUILDCHAIN_ISSUE_APP_ID",
+        "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
+        "BUILDCHAIN_ISSUE_TOKEN",
+        "BUILDCHAIN_PROMOTION_TOKEN",
+        "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+        "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
+        "buildchain-issue-app-id",
+        "buildchain-issue-app-private-key",
+        "buildchain-issue-token"
+      ],
+      "secretCount": 10,
+      "outputs": [
+        "buildchain-channel",
+        "built-source-sha",
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "discussion-id",
+        "discussion-url",
+        "github-artifact-attestation-evidence-root",
+        "github-artifact-attestation-id",
+        "github-artifact-attestation-publication-receipt-digest",
+        "github-artifact-attestation-url",
+        "promoted-sha",
+        "promotion-contract-lock-digest",
+        "promotion-contract-lock-path",
+        "promotion-override-used",
+        "promotion-publication-channel",
+        "promotion-router-ref",
+        "promotion-router-sha",
+        "promotion-runtime-ref",
+        "promotion-runtime-sha",
+        "promotion-shell-ref",
+        "promotion-shell-sha",
+        "promotion-target-ref",
+        "publication-capability-digest",
+        "publication-commit-evidence-digest",
+        "publication-commit-evidence-path",
+        "publication-commit-payload-root",
+        "publication-commit-url",
+        "release-candidate-action",
+        "release-candidate-artifact",
+        "release-candidate-recovery-receipt-artifact",
+        "release-candidate-recovery-root",
+        "release-invocation-root",
+        "release-propagation-work-artifact",
+        "release-receipt-root",
+        "release-tail-declaration-root",
+        "release-tail-receipt-roots-json",
+        "release-tail-state-root",
+        "release-tail-transaction-root",
+        "release-tail-transaction-state",
+        "release-transaction-root"
+      ],
+      "outputCount": 45,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "release-candidate-promote",
+        "role": "component",
+        "category": "release",
+        "purpose": "candidate-promote",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-candidate-promote.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "release-governance",
+      "capabilityGroup": "reusable-build",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-release-propagation",
+      "path": ".github/workflows/public-release-propagation.yml",
+      "reusable": true,
+      "inputs": [
+        "agent-work-context-json",
+        "agent-work-mode",
+        "contract-lock",
+        "downstream-base-ref",
+        "downstream-branch",
+        "downstream-prepare-command",
+        "downstream-repository",
+        "downstream-target",
+        "downstream-update-command",
+        "downstream-verify-command",
+        "dry-run",
+        "graph-json",
+        "lock-path",
+        "pr-body",
+        "pr-title",
+        "refresh-managed-readme-badges",
+        "runtime-ref",
+        "runtime-selection",
+        "source-node",
+        "upstream-release-json"
+      ],
+      "inputCount": 20,
+      "secrets": [
+        "propagation-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "propagation-receipt-digest",
+        "propagation-receipt-json",
+        "propagation-work-artifact",
+        "propagation-work-json",
+        "propagation-work-next-action",
+        "propagation-work-root"
+      ],
+      "outputCount": 13,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "release-propagation",
+        "role": "component",
+        "category": "release",
+        "purpose": "propagation",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-propagation.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "release-propagation",
+      "capabilityGroup": "site-and-propagation",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-release-signing-authority",
+      "path": ".github/workflows/public-release-signing-authority.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "artifact-signing-authority",
+        "role": "component",
+        "category": "release",
+        "purpose": "signing-authority",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-signing-authority.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-release-tail",
+      "path": ".github/workflows/public-release-tail.yml",
+      "reusable": true,
+      "inputs": [
+        "candidate-root",
+        "contract-lock",
+        "declaration-path",
+        "execute",
+        "provider-bindings-path",
+        "rehearsal-authority-path",
+        "rehearsal-capsule-path",
+        "rehearsal-evidence-path",
+        "rehearsal-mode",
+        "runtime-ref",
+        "runtime-selection",
+        "state-path"
+      ],
+      "inputCount": 12,
+      "secrets": [
+        "http-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "rehearsal-evidence-root",
+        "state-root",
+        "transaction-root",
+        "transaction-state"
+      ],
+      "outputCount": 4,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": "release-tail",
+        "role": "component",
+        "category": "release",
+        "purpose": "tail",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-tail.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "release-tail-provider-plane",
+      "capabilityGroup": "release-passport-trust",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "public-release-web",
+      "path": ".github/workflows/public-release-web.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-path",
+        "aws-region",
+        "build-command",
+        "contract-lock",
+        "fail-on-release-pr-error",
+        "github-governance-receipt-json",
+        "node-version",
+        "preview-apply",
+        "preview-aws-role-arn",
+        "preview-cleanup-apply",
+        "preview-comment",
+        "preview-environment",
+        "production-apply",
+        "production-approved",
+        "production-aws-role-arn",
+        "production-environment",
+        "production-release-app-client-id",
+        "production-release-branch-channel",
+        "production-release-head-prefix",
+        "production-release-label",
+        "production-release-on-main",
+        "production-release-pr-mode",
+        "production-source-sha",
+        "publication-admission-json",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-gate-aggregate-json",
+        "publication-runner-provenance-json",
+        "publication-used-nonces-json",
+        "release-feedback-actor-privacy",
+        "runtime-ref",
+        "runtime-selection",
+        "staging-apply",
+        "staging-aws-role-arn",
+        "staging-environment",
+        "verify-command",
+        "working-directory"
+      ],
+      "inputCount": 37,
+      "secrets": [
+        "production-release-app-private-key",
+        "production-release-pr-token"
+      ],
+      "secretCount": 2,
+      "outputs": [
+        "buildchain-runtime-class",
+        "buildchain-runtime-override",
+        "buildchain-runtime-ref",
+        "buildchain-runtime-sha",
+        "controller-plan-artifact",
+        "controller-plan-digest",
+        "controller-plan-json",
+        "controller-receipt-artifact",
+        "controller-receipt-digest",
+        "controller-receipt-json",
+        "controller-receipt-status",
+        "preview-apply-result-json",
+        "preview-cleanup-result-json",
+        "production-apply-result-json",
+        "production-release-pr-url",
+        "release-pr-status",
+        "staging-apply-result-json",
+        "web-surface-alias",
+        "web-surface-channel",
+        "web-surface-cleanup-plan-json",
+        "web-surface-manifest-json",
+        "web-surface-url",
+        "web-surface-urls-json"
+      ],
+      "outputCount": 23,
+      "apiRole": "compatibility",
+      "taxonomy": {
+        "id": ".web-surface",
+        "role": "component",
+        "category": "release",
+        "purpose": "web",
+        "status": "active",
+        "canonicalPath": ".github/workflows/.release-web.yml",
+        "compatibilityAlias": true
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "compatibility",
+      "owner": "buildchain-workflows",
+      "maturity": "repository-internal",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "retained-consumer-contract",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
+    },
+    {
+      "id": "release-candidate-promote",
+      "path": ".github/workflows/release-candidate-promote.yml",
+      "reusable": true,
+      "inputs": [
+        "allow-repository",
+        "artifact-name",
+        "artifact-patterns",
+        "branch-protection-bypass-apps",
+        "branch-protection-bypass-teams",
+        "branch-protection-bypass-users",
+        "buildchain-alpha-contract-lock-path",
+        "buildchain-channel",
+        "buildchain-contract-compatibility-policy",
+        "buildchain-contract-drift-issue-mode",
+        "buildchain-contract-lock-path",
+        "buildchain-ref",
+        "buildchain-repository",
+        "buildchain-stable-contract-lock-path",
+        "channel",
+        "contract-lock",
+        "declarative-release-tail",
+        "dry-run",
+        "github-artifact-attestation-environment",
+        "github-artifact-attestation-policy-json",
+        "github-artifact-attestation-retention-days",
+        "github-governance-receipt-json",
+        "github-release",
+        "github-release-notes",
+        "github-release-payload-patterns",
+        "github-release-title",
+        "package-manager",
+        "publication-admission-json",
+        "publication-auto-admission",
+        "publication-auto-no-gate",
+        "publication-commit-command",
+        "publication-commit-evidence-path",
+        "publication-consumer-predicate-id",
+        "publication-consumer-qualification-command",
+        "publication-consumer-qualification-controller-sha",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-gate-aggregate-json",
+        "publication-gate-command",
+        "publication-gate-controller-sha",
+        "publication-package-name",
+        "publication-product",
+        "publication-publisher-workflow-path",
+        "publication-runner-provenance-json",
+        "publication-target",
+        "publication-used-nonces-json",
+        "publication-used-qualification-nonces-json",
+        "publish-artifact-kind",
+        "publish-command",
+        "publish-dist-tag",
+        "publish-mode",
+        "publish-package-main",
+        "publish-package-set-order",
+        "publish-rematerialize-on-resume",
+        "publish-required-artifacts-json",
+        "publish-target",
+        "publish-transaction-override",
+        "release-activation-command",
+        "release-activation-receipt-set-path",
+        "release-candidate-family-assignment-id",
+        "release-candidate-family-evidence-required",
+        "release-candidate-family-evidence-root",
+        "release-candidate-family-initiative-id",
+        "release-candidate-wait-seconds",
+        "release-candidate-workflow-file",
+        "release-candidate-workflow-name",
+        "release-passport",
+        "release-passport-attachment-command",
+        "release-passport-buildchain-self-kfd",
+        "release-passport-evidence-command",
+        "release-passport-evidence-jsons",
+        "release-passport-evidence-path",
+        "release-passport-impact-json",
+        "release-passport-invariant-passport-command",
+        "release-passport-invariant-passport-jsons",
+        "release-passport-kfd-1-witness-jsons",
+        "release-passport-kfd-2-claim-jsons",
+        "release-passport-kfd-3-artifact-verify-command",
+        "release-passport-kfd-3-artifact-witness-jsons",
+        "release-passport-kfd-3-prebuild-witness-jsons",
+        "release-passport-kfd-adopter-manifest-json",
+        "release-passport-kfd-product-gate-jsons",
+        "release-passport-kfd-support-matrix-json",
+        "release-passport-output-dir",
+        "release-passport-platform-manifest-paths",
+        "release-passport-product-name",
+        "release-propagation-config-path",
+        "request-json",
+        "required-artifact-count",
+        "required-status-check",
+        "resume-buildchain-runtime-sha",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-expected-source-tree",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-transaction-id",
+        "runner-preset",
+        "runtime-ref",
+        "runtime-selection",
+        "standalone-binary-distribution",
+        "target-ref",
+        "target-sha",
+        "trusted-publishing"
+      ],
+      "inputCount": 106,
       "secrets": [
-        "production-release-app-private-key",
-        "production-release-pr-token"
+        "BUILDCHAIN_ISSUE_APP_ID",
+        "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
+        "BUILDCHAIN_ISSUE_TOKEN",
+        "BUILDCHAIN_PROMOTION_TOKEN",
+        "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+        "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
+        "buildchain-issue-app-id",
+        "buildchain-issue-app-private-key",
+        "buildchain-issue-token"
       ],
-      "secretCount": 2,
+      "secretCount": 10,
       "outputs": [
-        "buildchain-runtime-class",
-        "buildchain-runtime-override",
-        "buildchain-runtime-ref",
-        "buildchain-runtime-sha",
+        "buildchain-channel",
+        "built-source-sha",
         "controller-plan-artifact",
         "controller-plan-digest",
         "controller-plan-json",
@@ -2197,169 +4570,105 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
-        "preview-apply-result-json",
-        "preview-cleanup-result-json",
-        "production-apply-result-json",
-        "production-release-pr-url",
-        "release-pr-status",
-        "staging-apply-result-json",
-        "web-surface-alias",
-        "web-surface-channel",
-        "web-surface-cleanup-plan-json",
-        "web-surface-manifest-json",
-        "web-surface-url",
-        "web-surface-urls-json"
+        "discussion-id",
+        "discussion-url",
+        "github-artifact-attestation-evidence-root",
+        "github-artifact-attestation-id",
+        "github-artifact-attestation-publication-receipt-digest",
+        "github-artifact-attestation-url",
+        "promoted-sha",
+        "promotion-contract-lock-digest",
+        "promotion-contract-lock-path",
+        "promotion-override-used",
+        "promotion-publication-channel",
+        "promotion-router-ref",
+        "promotion-router-sha",
+        "promotion-runtime-ref",
+        "promotion-runtime-sha",
+        "promotion-shell-ref",
+        "promotion-shell-sha",
+        "promotion-target-ref",
+        "publication-capability-digest",
+        "publication-commit-evidence-digest",
+        "publication-commit-evidence-path",
+        "publication-commit-payload-root",
+        "publication-commit-url",
+        "release-candidate-action",
+        "release-candidate-artifact",
+        "release-candidate-recovery-receipt-artifact",
+        "release-candidate-recovery-root",
+        "release-invocation-root",
+        "release-propagation-work-artifact",
+        "release-receipt-root",
+        "release-tail-declaration-root",
+        "release-tail-receipt-roots-json",
+        "release-tail-state-root",
+        "release-tail-transaction-root",
+        "release-tail-transaction-state",
+        "release-transaction-root"
       ],
-      "outputCount": 23,
-      "apiRole": "implementation",
+      "outputCount": 45,
+      "apiRole": "compatibility",
       "taxonomy": {
-        "id": ".web-surface",
+        "id": "release-candidate-promote",
         "role": "component",
         "category": "release",
-        "purpose": "web",
+        "purpose": "candidate-promote",
         "status": "active",
-        "canonicalPath": ".github/workflows/.release-web.yml",
-        "compatibilityAlias": false
+        "canonicalPath": ".github/workflows/.release-candidate-promote.yml",
+        "compatibilityAlias": true
       },
-      "surface": "reusable-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "repository-internal",
+      "surface": "release-governance",
+      "capabilityGroup": "reusable-build",
+      "status": "compatibility",
       "owner": "buildchain-workflows",
       "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "buildchain-recover",
-      "path": ".github/workflows/buildchain-recover.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "apiRole": "implementation",
-      "taxonomy": {
-        "id": "buildchain-recover",
-        "role": "self",
-        "category": "ops",
-        "purpose": "recovery",
-        "status": "active",
-        "canonicalPath": ".github/workflows/buildchain-recover.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "buildchain",
-      "path": ".github/workflows/buildchain.yml",
-      "reusable": false,
-      "inputs": [],
-      "inputCount": 0,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "apiRole": "implementation",
-      "taxonomy": {
-        "id": "buildchain",
-        "role": "self",
-        "category": "ops",
-        "purpose": "pipeline",
-        "status": "active",
-        "canonicalPath": ".github/workflows/buildchain.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
-      "deprecationReplacement": "",
-      "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
-    },
-    {
-      "id": "public-ops-pipeline",
-      "path": ".github/workflows/public-ops-pipeline.yml",
-      "reusable": true,
-      "inputs": [
-        "config-path"
-      ],
-      "inputCount": 1,
-      "secrets": [],
-      "secretCount": 0,
-      "outputs": [],
-      "outputCount": 0,
-      "apiRole": "public",
-      "taxonomy": {
-        "id": "pipeline",
-        "role": "public",
-        "category": "ops",
-        "purpose": "pipeline",
-        "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-pipeline.yml",
-        "compatibilityAlias": false
-      },
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active",
-      "owner": "buildchain-workflows",
-      "maturity": "active",
-      "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
+      "compatibilityPromise": "retained-consumer-contract",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
     },
     {
-      "id": "public-ops-recover",
-      "path": ".github/workflows/public-ops-recover.yml",
+      "id": "v4-stage-capsule-canary",
+      "path": ".github/workflows/v4-stage-capsule-canary.yml",
       "reusable": true,
       "inputs": [
-        "attempt",
-        "runtime-ref"
+        "build-artifact-path",
+        "consumer",
+        "contract-lock",
+        "go-version",
+        "install-artifact-path",
+        "node-version",
+        "runtime-ref",
+        "runtime-selection",
+        "verify-artifact-path"
       ],
-      "inputCount": 2,
+      "inputCount": 9,
       "secrets": [],
       "secretCount": 0,
       "outputs": [],
       "outputCount": 0,
-      "apiRole": "public",
+      "apiRole": "compatibility",
       "taxonomy": {
-        "id": "recover",
-        "role": "public",
-        "category": "ops",
-        "purpose": "recover",
+        "id": "v4-stage-capsule-canary",
+        "role": "component",
+        "category": "build",
+        "purpose": "stage-capsule-canary",
         "status": "active",
-        "canonicalPath": ".github/workflows/public-ops-recover.yml",
-        "compatibilityAlias": false
+        "canonicalPath": ".github/workflows/.build-stage-capsule-canary.yml",
+        "compatibilityAlias": true
       },
       "surface": "repository-workflow",
       "capabilityGroup": "api-cli-reference",
-      "status": "active",
+      "status": "compatibility",
       "owner": "buildchain-workflows",
-      "maturity": "active",
+      "maturity": "repository-internal",
       "introducedVersion": "4.1.0-alpha.0",
-      "compatibilityPromise": "current-contract-only",
+      "compatibilityPromise": "retained-consumer-contract",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-contract-change-review",
-      "nonDuplicationRationale": "Canonical workflow owns one declared API or orchestration responsibility."
+      "nonDuplicationRationale": "Generated from the registered canonical implementation; retained published inputs, outputs, defaults, permissions and job contexts are verified before release."
     }
   ],
   "actionSource": "actions/*/*/*/action.yml reverse input enumeration",
@@ -3319,6 +5628,25 @@
       "sunsetCondition": "explicit-contract-change-review",
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
+    {
+      "apiRole": "implementation",
+      "id": "build/gate/qualify-contract",
+      "path": "actions/build/gate/qualify-contract/action.yml",
+      "inputs": [
+        "conclusion",
+        "result"
+      ],
+      "inputCount": 2,
+      "capabilityGroup": "reusable-build",
+      "status": "active",
+      "owner": "buildchain-actions",
+      "maturity": "stable",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
+    },
     {
       "apiRole": "implementation",
       "id": "build/gate/qualify-profile",
@@ -3381,12 +5709,13 @@
       "id": "build/lifecycle/plan",
       "path": "actions/build/lifecycle/plan/action.yml",
       "inputs": [
+        "compatibility-inputs",
         "config-path",
         "control-token",
         "workflow-ref",
         "workflow-sha"
       ],
-      "inputCount": 4,
+      "inputCount": 5,
       "capabilityGroup": "reusable-build",
       "status": "active",
       "owner": "buildchain-actions",
@@ -3503,13 +5832,14 @@
       "id": "build/plan/resolve",
       "path": "actions/build/plan/resolve/action.yml",
       "inputs": [
+        "compatibility-inputs",
         "config-path",
         "control-token",
         "token",
         "workflow-ref",
         "workflow-sha"
       ],
-      "inputCount": 5,
+      "inputCount": 6,
       "capabilityGroup": "reusable-build",
       "status": "active",
       "owner": "buildchain-actions",
@@ -6624,6 +8954,7 @@
         "candidate-build-summary-path",
         "candidate-passport-path",
         "failure-after-capability",
+        "historical-inputs-json",
         "mutation-token",
         "product-publication-intent-path",
         "publication-qualification-path",
@@ -6636,6 +8967,7 @@
         "publish-package-set-order",
         "publish-rematerialize-on-resume",
         "publish-transaction-override",
+        "publisher-workflow-path",
         "publisher-workflow-sha",
         "recovery-receipt-path",
         "repository",
@@ -6655,7 +8987,7 @@
         "target-sha",
         "token"
       ],
-      "inputCount": 34,
+      "inputCount": 36,
       "capabilityGroup": "release-passport-trust",
       "status": "active",
       "owner": "buildchain-actions",
@@ -6684,6 +9016,25 @@
       "sunsetCondition": "explicit-contract-change-review",
       "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
     },
+    {
+      "apiRole": "implementation",
+      "id": "release/promotion/historical-evidence",
+      "path": "actions/release/promotion/historical-evidence/action.yml",
+      "inputs": [
+        "request-json",
+        "source-sha"
+      ],
+      "inputCount": 2,
+      "capabilityGroup": "release-passport-trust",
+      "status": "active",
+      "owner": "buildchain-actions",
+      "maturity": "stable",
+      "introducedVersion": "4.1.0-alpha.0",
+      "compatibilityPromise": "current-contract-only",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-contract-change-review",
+      "nonDuplicationRationale": "One capability node owns the composite or JavaScript adapter boundary."
+    },
     {
       "apiRole": "implementation",
       "id": "release/promotion/inspect-invocation",
@@ -7462,6 +9813,7 @@
       "id": "runtime/selection/resolve",
       "path": "actions/runtime/selection/resolve/action.yml",
       "inputs": [
+        "compatibility-inputs",
         "contract-lock",
         "pipeline-attempt",
         "recovery-attempt",
@@ -7474,7 +9826,7 @@
         "workflow-ref",
         "workflow-sha"
       ],
-      "inputCount": 11,
+      "inputCount": 12,
       "capabilityGroup": "api-cli-reference",
       "status": "active",
       "owner": "buildchain-actions",