@kungfu-tech/buildchain 4.1.6 → 4.1.7-alpha.0

package/dist/site/public-surface-audit.json

@@ -4,8 +4,8 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 113,
-    "workflowCount": 44,
-    "actionCount": 283,
+    "workflowCount": 79,
+    "actionCount": 285,
     "sitePageCount": 94,
     "docCommandRefCount": 998,
     "failureCount": 0
@@ -604,13 +604,14 @@
         "path": ".github/workflows/.build-candidate.yml",
         "reusable": true,
         "inputs": [
+          "compatibility-inputs",
           "config-path",
           "contract-lock",
           "resume-run-id",
           "runtime-ref",
           "runtime-selection"
         ],
-        "inputCount": 5,
+        "inputCount": 6,
         "secrets": [
           "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
           "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
@@ -798,6 +799,34 @@
         ],
         "outputCount": 14
       },
+      {
+        "id": ".build-historical",
+        "path": ".github/workflows/.build-historical.yml",
+        "reusable": true,
+        "inputs": [
+          "compatibility-inputs",
+          "config-path",
+          "contract-lock",
+          "resume-run-id",
+          "runtime-ref",
+          "runtime-selection"
+        ],
+        "inputCount": 6,
+        "secrets": [
+          "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
+          "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
+          "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+          "BUILDCHAIN_PROMOTION_TOKEN"
+        ],
+        "secretCount": 6,
+        "outputs": [
+          "result",
+          "runtime-selection"
+        ],
+        "outputCount": 2
+      },
       {
         "id": ".build-publication",
         "path": ".github/workflows/.build-publication.yml",
@@ -874,13 +903,14 @@
         "path": ".github/workflows/.build.yml",
         "reusable": true,
         "inputs": [
+          "compatibility-inputs",
           "config-path",
           "contract-lock",
           "resume-run-id",
           "runtime-ref",
           "runtime-selection"
         ],
-        "inputCount": 5,
+        "inputCount": 6,
         "secrets": [
           "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
           "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
@@ -1665,6 +1695,67 @@
         ],
         "outputCount": 45
       },
+      {
+        "id": ".release-historical",
+        "path": ".github/workflows/.release-historical.yml",
+        "reusable": true,
+        "inputs": [
+          "contract-lock",
+          "request-json",
+          "runtime-ref",
+          "runtime-selection"
+        ],
+        "inputCount": 4,
+        "secrets": [
+          "BUILDCHAIN_ISSUE_APP_ID",
+          "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
+          "BUILDCHAIN_ISSUE_TOKEN",
+          "BUILDCHAIN_PROMOTION_TOKEN",
+          "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+          "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+          "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
+          "buildchain-issue-app-id",
+          "buildchain-issue-app-private-key",
+          "buildchain-issue-token"
+        ],
+        "secretCount": 10,
+        "outputs": [
+          "built-source-sha",
+          "controller-plan-artifact",
+          "controller-plan-digest",
+          "controller-plan-json",
+          "controller-receipt-artifact",
+          "controller-receipt-digest",
+          "controller-receipt-json",
+          "controller-receipt-status",
+          "discussion-id",
+          "discussion-url",
+          "github-artifact-attestation-evidence-root",
+          "github-artifact-attestation-id",
+          "github-artifact-attestation-publication-receipt-digest",
+          "github-artifact-attestation-url",
+          "promoted-sha",
+          "publication-capability-digest",
+          "publication-commit-evidence-digest",
+          "publication-commit-evidence-path",
+          "publication-commit-payload-root",
+          "publication-commit-url",
+          "release-candidate-action",
+          "release-candidate-artifact",
+          "release-candidate-recovery-receipt-artifact",
+          "release-candidate-recovery-root",
+          "release-invocation-root",
+          "release-propagation-work-artifact",
+          "release-receipt-root",
+          "release-tail-declaration-root",
+          "release-tail-receipt-roots-json",
+          "release-tail-state-root",
+          "release-tail-transaction-root",
+          "release-tail-transaction-state",
+          "release-transaction-root"
+        ],
+        "outputCount": 33
+      },
       {
         "id": ".release-oci-compose-preview",
         "path": ".github/workflows/.release-oci-compose-preview.yml",
@@ -1737,53 +1828,1412 @@
         "outputCount": 14
       },
       {
-        "id": ".release-pipeline-products",
-        "path": ".github/workflows/.release-pipeline-products.yml",
-        "reusable": true,
-        "inputs": [
-          "attempt",
-          "runtime-selection"
-        ],
-        "inputCount": 2,
-        "secrets": [
-          "BUILDCHAIN_APP_PRIVATE_KEY",
-          "BUILDCHAIN_AUTOMATION_TOKEN",
-          "BUILDCHAIN_NPM_TOKEN"
-        ],
-        "secretCount": 3,
-        "outputs": [
-          "stable-wait"
-        ],
-        "outputCount": 1
-      },
-      {
-        "id": ".release-pipeline-version",
-        "path": ".github/workflows/.release-pipeline-version.yml",
-        "reusable": true,
-        "inputs": [
-          "context",
-          "matrix",
-          "operation",
-          "purpose",
-          "runtime-selection"
-        ],
-        "inputCount": 5,
-        "secrets": [
-          "BUILDCHAIN_APP_PRIVATE_KEY",
-          "BUILDCHAIN_AUTOMATION_TOKEN"
-        ],
-        "secretCount": 2,
-        "outputs": [
-          "context",
-          "matrix",
-          "operation",
-          "stable-wait"
-        ],
-        "outputCount": 4
-      },
-      {
-        "id": ".release-promote",
-        "path": ".github/workflows/.release-promote.yml",
+        "id": ".release-pipeline-products",
+        "path": ".github/workflows/.release-pipeline-products.yml",
+        "reusable": true,
+        "inputs": [
+          "attempt",
+          "runtime-selection"
+        ],
+        "inputCount": 2,
+        "secrets": [
+          "BUILDCHAIN_APP_PRIVATE_KEY",
+          "BUILDCHAIN_AUTOMATION_TOKEN",
+          "BUILDCHAIN_NPM_TOKEN"
+        ],
+        "secretCount": 3,
+        "outputs": [
+          "stable-wait"
+        ],
+        "outputCount": 1
+      },
+      {
+        "id": ".release-pipeline-version",
+        "path": ".github/workflows/.release-pipeline-version.yml",
+        "reusable": true,
+        "inputs": [
+          "context",
+          "matrix",
+          "operation",
+          "purpose",
+          "runtime-selection"
+        ],
+        "inputCount": 5,
+        "secrets": [
+          "BUILDCHAIN_APP_PRIVATE_KEY",
+          "BUILDCHAIN_AUTOMATION_TOKEN"
+        ],
+        "secretCount": 2,
+        "outputs": [
+          "context",
+          "matrix",
+          "operation",
+          "stable-wait"
+        ],
+        "outputCount": 4
+      },
+      {
+        "id": ".release-promote",
+        "path": ".github/workflows/.release-promote.yml",
+        "reusable": true,
+        "inputs": [
+          "contract-lock",
+          "request-json",
+          "runtime-ref",
+          "runtime-selection"
+        ],
+        "inputCount": 4,
+        "secrets": [
+          "BUILDCHAIN_ISSUE_APP_ID",
+          "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
+          "BUILDCHAIN_ISSUE_TOKEN",
+          "BUILDCHAIN_PROMOTION_TOKEN",
+          "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+          "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+          "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
+          "buildchain-issue-app-id",
+          "buildchain-issue-app-private-key",
+          "buildchain-issue-token"
+        ],
+        "secretCount": 10,
+        "outputs": [
+          "built-source-sha",
+          "controller-plan-artifact",
+          "controller-plan-digest",
+          "controller-plan-json",
+          "controller-receipt-artifact",
+          "controller-receipt-digest",
+          "controller-receipt-json",
+          "controller-receipt-status",
+          "discussion-id",
+          "discussion-url",
+          "github-artifact-attestation-evidence-root",
+          "github-artifact-attestation-id",
+          "github-artifact-attestation-publication-receipt-digest",
+          "github-artifact-attestation-url",
+          "promoted-sha",
+          "publication-capability-digest",
+          "publication-commit-evidence-digest",
+          "publication-commit-evidence-path",
+          "publication-commit-payload-root",
+          "publication-commit-url",
+          "release-candidate-action",
+          "release-candidate-artifact",
+          "release-candidate-recovery-receipt-artifact",
+          "release-candidate-recovery-root",
+          "release-invocation-root",
+          "release-propagation-work-artifact",
+          "release-receipt-root",
+          "release-tail-declaration-root",
+          "release-tail-receipt-roots-json",
+          "release-tail-state-root",
+          "release-tail-transaction-root",
+          "release-tail-transaction-state",
+          "release-transaction-root"
+        ],
+        "outputCount": 33
+      },
+      {
+        "id": ".release-propagation",
+        "path": ".github/workflows/.release-propagation.yml",
+        "reusable": true,
+        "inputs": [
+          "agent-work-context-json",
+          "agent-work-mode",
+          "contract-lock",
+          "downstream-base-ref",
+          "downstream-branch",
+          "downstream-prepare-command",
+          "downstream-repository",
+          "downstream-target",
+          "downstream-update-command",
+          "downstream-verify-command",
+          "dry-run",
+          "graph-json",
+          "lock-path",
+          "pr-body",
+          "pr-title",
+          "refresh-managed-readme-badges",
+          "runtime-ref",
+          "runtime-selection",
+          "source-node",
+          "upstream-release-json"
+        ],
+        "inputCount": 20,
+        "secrets": [
+          "propagation-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "controller-plan-artifact",
+          "controller-plan-digest",
+          "controller-plan-json",
+          "controller-receipt-artifact",
+          "controller-receipt-digest",
+          "controller-receipt-json",
+          "controller-receipt-status",
+          "propagation-receipt-digest",
+          "propagation-receipt-json",
+          "propagation-work-artifact",
+          "propagation-work-json",
+          "propagation-work-next-action",
+          "propagation-work-root"
+        ],
+        "outputCount": 13
+      },
+      {
+        "id": ".release-signing-authority",
+        "path": ".github/workflows/.release-signing-authority.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": ".release-tail",
+        "path": ".github/workflows/.release-tail.yml",
+        "reusable": true,
+        "inputs": [
+          "candidate-root",
+          "contract-lock",
+          "declaration-path",
+          "execute",
+          "provider-bindings-path",
+          "rehearsal-authority-path",
+          "rehearsal-capsule-path",
+          "rehearsal-evidence-path",
+          "rehearsal-mode",
+          "runtime-ref",
+          "runtime-selection",
+          "state-path"
+        ],
+        "inputCount": 12,
+        "secrets": [
+          "http-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "rehearsal-evidence-root",
+          "state-root",
+          "transaction-root",
+          "transaction-state"
+        ],
+        "outputCount": 4
+      },
+      {
+        "id": ".release-web",
+        "path": ".github/workflows/.release-web.yml",
+        "reusable": true,
+        "inputs": [
+          "artifact-path",
+          "aws-region",
+          "build-command",
+          "contract-lock",
+          "fail-on-release-pr-error",
+          "github-governance-receipt-json",
+          "node-version",
+          "preview-apply",
+          "preview-aws-role-arn",
+          "preview-cleanup-apply",
+          "preview-comment",
+          "preview-environment",
+          "production-apply",
+          "production-approved",
+          "production-aws-role-arn",
+          "production-environment",
+          "production-release-app-client-id",
+          "production-release-branch-channel",
+          "production-release-head-prefix",
+          "production-release-label",
+          "production-release-on-main",
+          "production-release-pr-mode",
+          "production-source-sha",
+          "publication-admission-json",
+          "publication-control-plane-audit-json",
+          "publication-expected-json",
+          "publication-gate-aggregate-json",
+          "publication-runner-provenance-json",
+          "publication-used-nonces-json",
+          "release-feedback-actor-privacy",
+          "runtime-ref",
+          "runtime-selection",
+          "staging-apply",
+          "staging-aws-role-arn",
+          "staging-environment",
+          "verify-command",
+          "working-directory"
+        ],
+        "inputCount": 37,
+        "secrets": [
+          "production-release-app-private-key",
+          "production-release-pr-token"
+        ],
+        "secretCount": 2,
+        "outputs": [
+          "buildchain-runtime-class",
+          "buildchain-runtime-override",
+          "buildchain-runtime-ref",
+          "buildchain-runtime-sha",
+          "controller-plan-artifact",
+          "controller-plan-digest",
+          "controller-plan-json",
+          "controller-receipt-artifact",
+          "controller-receipt-digest",
+          "controller-receipt-json",
+          "controller-receipt-status",
+          "preview-apply-result-json",
+          "preview-cleanup-result-json",
+          "production-apply-result-json",
+          "production-release-pr-url",
+          "release-pr-status",
+          "staging-apply-result-json",
+          "web-surface-alias",
+          "web-surface-channel",
+          "web-surface-cleanup-plan-json",
+          "web-surface-manifest-json",
+          "web-surface-url",
+          "web-surface-urls-json"
+        ],
+        "outputCount": 23
+      },
+      {
+        "id": "build",
+        "path": ".github/workflows/build.yml",
+        "reusable": true,
+        "inputs": [
+          "artifact-compression-level",
+          "artifact-finalization-command",
+          "artifact-finalization-on-platform",
+          "artifact-name",
+          "artifact-name-template",
+          "artifact-paths",
+          "artifact-relay-s3-bucket",
+          "artifact-relay-s3-download-role-arn",
+          "artifact-relay-s3-oidc-audience",
+          "artifact-relay-s3-prefix",
+          "artifact-relay-s3-region",
+          "artifact-relay-s3-role-arn",
+          "artifact-relay-s3-upload-role-arn",
+          "artifact-retention-days",
+          "artifact-signing-request-upload-no-proxy",
+          "artifact-transfer-mode",
+          "aws-codebuild-project",
+          "aws-ec2-macos-runner-label",
+          "aws-ec2-windows-runner-label",
+          "build-command",
+          "buildchain-alpha-contract-lock-path",
+          "buildchain-channel",
+          "buildchain-contract-compatibility-policy",
+          "buildchain-contract-drift-issue-mode",
+          "buildchain-contract-lock-path",
+          "buildchain-expected-channel",
+          "buildchain-expected-major",
+          "buildchain-ref",
+          "buildchain-repository",
+          "buildchain-stable-contract-lock-path",
+          "cache-dependency-lock-root",
+          "cache-policy-root",
+          "cache-toolchain-root",
+          "cargo-registry-index",
+          "checkout-cache-fallback",
+          "checkout-cache-fetch-attempts",
+          "checkout-cache-github-timeout-seconds",
+          "checkout-cache-mirror-url-template",
+          "checkout-cache-mode",
+          "checkout-cache-reference-repository-template",
+          "checkout-cache-timeout-seconds",
+          "checkout-history-mode",
+          "compiler-cache-platforms-json",
+          "compiler-cache-provider",
+          "compiler-cache-required",
+          "config-path",
+          "contract-lock",
+          "control-runner-json",
+          "credential-island-caller-owned",
+          "credential-island-environment",
+          "credential-island-macos-app-path",
+          "credential-island-macos-platform-id",
+          "expected-artifacts-json",
+          "fail-fast",
+          "gate-profile-aggregate-json",
+          "github-artifact-attestation-platform-id",
+          "github-artifact-attestation-signer-sha",
+          "github-artifact-attestation-subject-path",
+          "install-command",
+          "kfd-agent-hub",
+          "lifecycle-timeout-minutes",
+          "linux-container-image",
+          "linux-container-preset",
+          "node-version",
+          "platforms-json",
+          "pre-upload-transport-smoke-artifact-root",
+          "pre-upload-transport-smoke-scenario-path",
+          "process-sample-interval-ms",
+          "process-summary-path",
+          "publish-anchor-request-json",
+          "publish-channel",
+          "publish-refs-json",
+          "publish-registry",
+          "publish-source-ref",
+          "release-candidate",
+          "release-candidate-family-evidence-json",
+          "requested-parallelism",
+          "require-build",
+          "require-install",
+          "require-trusted-event",
+          "require-verify",
+          "resume-run-id",
+          "runner-preset",
+          "runtime-ref",
+          "runtime-selection",
+          "rust-toolchain",
+          "rustup-dist-server",
+          "rustup-update-root",
+          "sample-process-tree",
+          "self-hosted-offline-fallback",
+          "setup-node",
+          "setup-rust",
+          "shifu-cache-profile-digest",
+          "shifu-cache-profile-ref",
+          "untrusted-policy",
+          "verify-command",
+          "verify-substage-evidence-path",
+          "working-directory"
+        ],
+        "inputCount": 98,
+        "secrets": [
+          "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
+          "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
+          "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
+          "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
+          "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
+          "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+          "BUILDCHAIN_PROMOTION_TOKEN"
+        ],
+        "secretCount": 9,
+        "outputs": [
+          "artifact-coordinates-json",
+          "build-diagnostics-summary-artifact",
+          "build-diagnostics-summary-json",
+          "build-summary-artifact",
+          "build-summary-json",
+          "buildchain-channel",
+          "buildchain-channel-reason",
+          "buildchain-channel-selection-source",
+          "buildchain-contract-digest",
+          "buildchain-contract-lock-drift",
+          "buildchain-contract-lock-status",
+          "buildchain-runtime-class",
+          "buildchain-runtime-override",
+          "buildchain-runtime-ref",
+          "buildchain-runtime-sha",
+          "buildchain-runtime-trust-decision",
+          "controller-plan-artifact",
+          "controller-plan-digest",
+          "controller-plan-json",
+          "controller-receipt-artifact",
+          "controller-receipt-digest",
+          "controller-receipt-json",
+          "controller-receipt-status",
+          "credential-island-macos-artifact",
+          "credential-island-macos-manifest-artifact",
+          "linux-container-enabled",
+          "linux-container-image",
+          "platform-count",
+          "platforms-json",
+          "publish-allowed",
+          "publish-channel",
+          "publish-reason",
+          "publish-source-channel",
+          "publish-source-consumer-version",
+          "publish-source-line",
+          "publish-source-locked",
+          "publish-source-ref",
+          "publish-source-sha",
+          "publish-source-tree-sha",
+          "release-candidate-artifact",
+          "release-candidate-passport-artifact",
+          "release-candidate-passport-json",
+          "release-manifest-json",
+          "result",
+          "runner-preset",
+          "runner-routing-json",
+          "trusted-event"
+        ],
+        "outputCount": 47
+      },
+      {
+        "id": "buildchain-recover",
+        "path": ".github/workflows/buildchain-recover.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "buildchain",
+        "path": ".github/workflows/buildchain.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "check",
+        "path": ".github/workflows/check.yml",
+        "reusable": true,
+        "inputs": [
+          "buildchain-ref",
+          "buildchain-repository",
+          "contract-lock",
+          "mode",
+          "node-version",
+          "require-version-state",
+          "runtime-ref",
+          "runtime-selection",
+          "source-proof-closure-paths-json",
+          "source-proof-dependency-paths-json",
+          "source-proof-policy-paths-json",
+          "source-proof-required-contexts-json",
+          "source-proof-reuse",
+          "upload-artifacts",
+          "working-directory"
+        ],
+        "inputCount": 15,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "controller-plan-artifact",
+          "controller-plan-digest",
+          "controller-plan-json",
+          "controller-receipt-artifact",
+          "controller-receipt-digest",
+          "controller-receipt-json",
+          "controller-receipt-status",
+          "source-proof-decision-root",
+          "source-proof-producer-run-id",
+          "source-proof-reuse-reason",
+          "source-proof-reused",
+          "source-proof-root"
+        ],
+        "outputCount": 12
+      },
+      {
+        "id": "dev-pr-auto-merge",
+        "path": ".github/workflows/dev-pr-auto-merge.yml",
+        "reusable": true,
+        "inputs": [
+          "active-lease-context",
+          "affected-paths-json",
+          "allowed-head-prefixes",
+          "assignment-root",
+          "block-labels",
+          "buildchain-ref",
+          "buildchain-repository",
+          "closure-root",
+          "contract-lock",
+          "defer-landing",
+          "delivery-class",
+          "delivery-priority",
+          "delivery-warrant-mode",
+          "dependency-root",
+          "diagnostic-context",
+          "dry-run",
+          "environment-root",
+          "expected-head-sha",
+          "expected-pr-number",
+          "handoff-workflow-id",
+          "initiative-root",
+          "landing-mode",
+          "legacy-active-owner-binding-json",
+          "max-merges",
+          "merge-method",
+          "native-command",
+          "native-command-root",
+          "native-heartbeat-seconds",
+          "native-platform",
+          "native-proof-json",
+          "pipeline-attempt",
+          "plan-root",
+          "project-cut-proof-json",
+          "queue-admission-context",
+          "ready-label",
+          "release-blocker-priority-json",
+          "require-approval",
+          "required-status-checks",
+          "runtime-ref",
+          "runtime-selection",
+          "same-repository-only",
+          "shard-evidence-roots-json",
+          "source-identity-root",
+          "source-patch-root",
+          "source-root",
+          "source-workflow-id",
+          "source-workflow-run-id",
+          "target-branch",
+          "toolchain-root",
+          "universal-request-json",
+          "warrant-lease-seconds"
+        ],
+        "inputCount": 51,
+        "secrets": [
+          "github-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "action-count",
+          "admission-receipt-root",
+          "admission-state",
+          "enqueued-count",
+          "evaluated-count",
+          "final-base-sha",
+          "merged-count",
+          "native-execution-transfer-root",
+          "native-proof-root",
+          "native-reuse-decision-root",
+          "project-cut-proof-root",
+          "provider-finalizer-boundary-root",
+          "provider-heartbeat-receipt-root",
+          "qualified-warrant-receipt-root",
+          "skipped-count",
+          "source-proof-root",
+          "warrant-receipt-root",
+          "warrant-state-commit",
+          "warrant-state-root"
+        ],
+        "outputCount": 19
+      },
+      {
+        "id": "public-build-adopter-qualification",
+        "path": ".github/workflows/public-build-adopter-qualification.yml",
+        "reusable": true,
+        "inputs": [
+          "consumer",
+          "consumer-ref",
+          "consumer-repository",
+          "contract-lock",
+          "input-path",
+          "invocation-source-path",
+          "runtime-ref",
+          "runtime-selection"
+        ],
+        "inputCount": 8,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "public-build-check",
+        "path": ".github/workflows/public-build-check.yml",
+        "reusable": true,
+        "inputs": [
+          "contract-lock",
+          "mode",
+          "node-version",
+          "require-version-state",
+          "runtime-ref",
+          "runtime-selection",
+          "source-proof-closure-paths-json",
+          "source-proof-dependency-paths-json",
+          "source-proof-policy-paths-json",
+          "source-proof-required-contexts-json",
+          "source-proof-reuse",
+          "upload-artifacts",
+          "working-directory"
+        ],
+        "inputCount": 13,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "controller-plan-artifact",
+          "controller-plan-digest",
+          "controller-plan-json",
+          "controller-receipt-artifact",
+          "controller-receipt-digest",
+          "controller-receipt-json",
+          "controller-receipt-status",
+          "source-proof-decision-root",
+          "source-proof-producer-run-id",
+          "source-proof-reuse-reason",
+          "source-proof-reused",
+          "source-proof-root"
+        ],
+        "outputCount": 12
+      },
+      {
+        "id": "public-build-demo",
+        "path": ".github/workflows/public-build-demo.yml",
+        "reusable": true,
+        "inputs": [
+          "artifact-retention-days",
+          "binary-artifact-digest",
+          "binary-artifact-name",
+          "contract-lock",
+          "materialize",
+          "materialize-base-ref",
+          "media-profile",
+          "render-failure-advisory",
+          "render-media",
+          "renderer-image",
+          "runtime-ref",
+          "runtime-selection",
+          "scenario-path",
+          "source-ref"
+        ],
+        "inputCount": 14,
+        "secrets": [
+          "DEMO_UPDATE_TOKEN"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "capture-artifact-digest",
+          "capture-artifact-name",
+          "evidence-artifact-digest",
+          "evidence-artifact-name",
+          "publication-pr-url",
+          "render-result",
+          "source-sha"
+        ],
+        "outputCount": 7
+      },
+      {
+        "id": "public-build-publication",
+        "path": ".github/workflows/public-build-publication.yml",
+        "reusable": true,
+        "inputs": [
+          "artifact-name",
+          "artifact-paths",
+          "artifact-retention-days",
+          "build-command",
+          "buildchain-alpha-contract-lock-path",
+          "buildchain-stable-contract-lock-path",
+          "contract-lock",
+          "node-version",
+          "package-name",
+          "prepare-paper-package",
+          "publish-dist-tag",
+          "runtime-ref",
+          "runtime-selection",
+          "setup-node",
+          "target-ref",
+          "toolchain-command",
+          "toolchain-digest",
+          "toolchain-image",
+          "toolchain-type",
+          "verify-command",
+          "working-directory"
+        ],
+        "inputCount": 21,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "controller-plan-artifact",
+          "controller-plan-digest",
+          "controller-plan-json",
+          "controller-receipt-artifact",
+          "controller-receipt-digest",
+          "controller-receipt-json",
+          "controller-receipt-status",
+          "package-name",
+          "package-version",
+          "publication-artifact-name",
+          "publication-manifest-json",
+          "publication-manifest-path",
+          "publication-passport-path",
+          "publication-registry-path",
+          "publish-dist-tag",
+          "runtime-sha"
+        ],
+        "outputCount": 16
+      },
+      {
+        "id": "public-build-stage-capsule-canary",
+        "path": ".github/workflows/public-build-stage-capsule-canary.yml",
+        "reusable": true,
+        "inputs": [
+          "build-artifact-path",
+          "consumer",
+          "contract-lock",
+          "go-version",
+          "install-artifact-path",
+          "node-version",
+          "runtime-ref",
+          "runtime-selection",
+          "verify-artifact-path"
+        ],
+        "inputCount": 9,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "public-ops-alpha-candidate-patrol",
+        "path": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
+        "reusable": true,
+        "inputs": [
+          "alpha-workflow-path",
+          "auto-merge",
+          "contract-lock",
+          "dev-workflow-path",
+          "dry-run",
+          "max-age-seconds",
+          "merge-method",
+          "pull-request-body-prefix",
+          "pull-request-body-prefix-renderer",
+          "reactivation-authorized",
+          "runtime-ref",
+          "runtime-selection",
+          "settlement-authorized",
+          "source-branch",
+          "target-branch"
+        ],
+        "inputCount": 15,
+        "secrets": [
+          "promotion-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "active-candidate-pr",
+          "candidate-generation",
+          "candidate-tree-sha",
+          "controller-state",
+          "cut-root",
+          "drift-root",
+          "eligible",
+          "hold-root",
+          "next-candidate-sha",
+          "prior-state-root",
+          "promotion-pr",
+          "result-path",
+          "runtime-sha",
+          "selected-sha",
+          "settlement-action",
+          "source-lock-ref",
+          "train-root"
+        ],
+        "outputCount": 17
+      },
+      {
+        "id": "public-ops-bootstrap",
+        "path": ".github/workflows/public-ops-bootstrap.yml",
+        "reusable": true,
+        "inputs": [
+          "contract-lock",
+          "request-json",
+          "runtime-ref",
+          "runtime-selection"
+        ],
+        "inputCount": 4,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "admission-root",
+          "request-root",
+          "result-json",
+          "result-root",
+          "runtime-sha",
+          "terminal-receipt-json",
+          "terminal-receipt-root"
+        ],
+        "outputCount": 7
+      },
+      {
+        "id": "public-ops-dev-auto-merge",
+        "path": ".github/workflows/public-ops-dev-auto-merge.yml",
+        "reusable": true,
+        "inputs": [
+          "active-lease-context",
+          "affected-paths-json",
+          "allowed-head-prefixes",
+          "block-labels",
+          "closure-root",
+          "contract-lock",
+          "defer-landing",
+          "delivery-class",
+          "delivery-priority",
+          "delivery-warrant-mode",
+          "dependency-root",
+          "diagnostic-context",
+          "dry-run",
+          "environment-root",
+          "expected-head-sha",
+          "expected-pr-number",
+          "handoff-workflow-id",
+          "landing-mode",
+          "max-merges",
+          "merge-method",
+          "native-command",
+          "native-command-root",
+          "native-heartbeat-seconds",
+          "native-platform",
+          "native-proof-json",
+          "pipeline-attempt",
+          "plan-root",
+          "project-cut-proof-json",
+          "queue-admission-context",
+          "ready-label",
+          "release-blocker-priority-json",
+          "require-approval",
+          "required-status-checks",
+          "runtime-ref",
+          "runtime-selection",
+          "same-repository-only",
+          "shard-evidence-roots-json",
+          "source-identity-root",
+          "source-patch-root",
+          "source-root",
+          "source-workflow-run-id",
+          "target-branch",
+          "toolchain-root",
+          "warrant-lease-seconds"
+        ],
+        "inputCount": 44,
+        "secrets": [
+          "github-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "action-count",
+          "admission-receipt-root",
+          "admission-state",
+          "enqueued-count",
+          "evaluated-count",
+          "final-base-sha",
+          "merged-count",
+          "native-execution-transfer-root",
+          "native-proof-root",
+          "native-reuse-decision-root",
+          "project-cut-proof-root",
+          "provider-finalizer-boundary-root",
+          "provider-heartbeat-receipt-root",
+          "qualified-warrant-receipt-root",
+          "skipped-count",
+          "source-proof-root",
+          "warrant-receipt-root",
+          "warrant-state-commit",
+          "warrant-state-root"
+        ],
+        "outputCount": 19
+      },
+      {
+        "id": "public-ops-dev-qualification-patrol",
+        "path": ".github/workflows/public-ops-dev-qualification-patrol.yml",
+        "reusable": true,
+        "inputs": [
+          "contract-lock",
+          "dev-workflow-path",
+          "dispatch-inputs-json",
+          "dry-run",
+          "max-attempts",
+          "mutation-authorized",
+          "preflight-workflow-path",
+          "priority-workflows-json",
+          "runtime-ref",
+          "runtime-selection",
+          "source-branch"
+        ],
+        "inputCount": 11,
+        "secrets": [
+          "qualification-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "action",
+          "active-run-id",
+          "decision-root",
+          "pending-sha",
+          "reason",
+          "source-sha",
+          "state"
+        ],
+        "outputCount": 7
+      },
+      {
+        "id": "public-ops-housekeeping",
+        "path": ".github/workflows/public-ops-housekeeping.yml",
+        "reusable": true,
+        "inputs": [
+          "apply-enabled",
+          "artifact-prefix",
+          "artifact-retention-days",
+          "contract-lock",
+          "max-actions",
+          "mode",
+          "protected-patterns",
+          "repository",
+          "retained-patterns",
+          "runtime-ref",
+          "runtime-selection",
+          "stale-days",
+          "stale-pull-request-label",
+          "target-branch",
+          "temporary-branch-patterns"
+        ],
+        "inputCount": 15,
+        "secrets": [
+          "housekeeper_app_id",
+          "housekeeper_app_private_key",
+          "housekeeper_token"
+        ],
+        "secretCount": 3,
+        "outputs": [
+          "action-count",
+          "branch-receipt-root",
+          "outcome",
+          "plan-artifact",
+          "plan-root",
+          "pull-request-receipt-root",
+          "receipt-artifact",
+          "report-artifact",
+          "report-receipt-root"
+        ],
+        "outputCount": 9
+      },
+      {
+        "id": "public-ops-observed-evidence",
+        "path": ".github/workflows/public-ops-observed-evidence.yml",
+        "reusable": true,
+        "inputs": [
+          "artifact-path",
+          "build-command",
+          "cloudfront-distribution",
+          "contract-lock",
+          "evidence-source-path",
+          "evidence-source-ref",
+          "evidence-source-repository",
+          "manifest-path",
+          "production-aws-role-arn",
+          "production-bucket",
+          "production-environment",
+          "runtime-ref",
+          "runtime-selection",
+          "verify-command"
+        ],
+        "inputCount": 14,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "receipt-path"
+        ],
+        "outputCount": 1
+      },
+      {
+        "id": "public-ops-patrol-daily",
+        "path": ".github/workflows/public-ops-patrol-daily.yml",
+        "reusable": true,
+        "inputs": [
+          "allowed-head-prefixes",
+          "block-labels",
+          "contract-lock",
+          "dry-run",
+          "landing-mode",
+          "max-actions",
+          "merge-method",
+          "ready-label",
+          "require-approval",
+          "required-status-checks",
+          "runtime-ref",
+          "runtime-selection",
+          "same-repository-only",
+          "target-branch"
+        ],
+        "inputCount": 14,
+        "secrets": [
+          "github-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "action-count",
+          "evaluated-count",
+          "planned-count",
+          "result-path",
+          "skipped-count"
+        ],
+        "outputCount": 5
+      },
+      {
+        "id": "public-ops-patrol-monthly",
+        "path": ".github/workflows/public-ops-patrol-monthly.yml",
+        "reusable": true,
+        "inputs": [
+          "contract-lock",
+          "dry-run",
+          "runtime-ref",
+          "runtime-selection",
+          "target-branch"
+        ],
+        "inputCount": 5,
+        "secrets": [
+          "github-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "action-count",
+          "evaluated-count",
+          "planned-count",
+          "result-path",
+          "skipped-count"
+        ],
+        "outputCount": 5
+      },
+      {
+        "id": "public-ops-patrol-weekly",
+        "path": ".github/workflows/public-ops-patrol-weekly.yml",
+        "reusable": true,
+        "inputs": [
+          "contract-lock",
+          "dry-run",
+          "runtime-ref",
+          "runtime-selection",
+          "target-branch"
+        ],
+        "inputCount": 5,
+        "secrets": [
+          "github-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "action-count",
+          "evaluated-count",
+          "planned-count",
+          "result-path",
+          "skipped-count"
+        ],
+        "outputCount": 5
+      },
+      {
+        "id": "public-ops-patrol",
+        "path": ".github/workflows/public-ops-patrol.yml",
+        "reusable": true,
+        "inputs": [
+          "allowed-head-prefixes",
+          "block-labels",
+          "cadence",
+          "capabilities",
+          "contract-lock",
+          "dry-run",
+          "landing-mode",
+          "max-actions",
+          "merge-method",
+          "mode",
+          "ready-label",
+          "require-approval",
+          "required-status-checks",
+          "runtime-ref",
+          "runtime-selection",
+          "same-repository-only",
+          "target-branch"
+        ],
+        "inputCount": 17,
+        "secrets": [
+          "github-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "action-count",
+          "evaluated-count",
+          "planned-count",
+          "result-path",
+          "skipped-count"
+        ],
+        "outputCount": 5
+      },
+      {
+        "id": "public-ops-pipeline",
+        "path": ".github/workflows/public-ops-pipeline.yml",
+        "reusable": true,
+        "inputs": [
+          "config-path"
+        ],
+        "inputCount": 1,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "public-ops-recover",
+        "path": ".github/workflows/public-ops-recover.yml",
+        "reusable": true,
+        "inputs": [
+          "attempt",
+          "runtime-ref"
+        ],
+        "inputCount": 2,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "public-ops-release-governance",
+        "path": ".github/workflows/public-ops-release-governance.yml",
+        "reusable": true,
+        "inputs": [
+          "apply",
+          "branch",
+          "candidate-sha",
+          "contract-lock",
+          "runtime-ref",
+          "runtime-selection"
+        ],
+        "inputCount": 6,
+        "secrets": [
+          "BUILDCHAIN_PROMOTION_TOKEN",
+          "governance-token"
+        ],
+        "secretCount": 2,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "public-ops-stable-candidate-patrol",
+        "path": ".github/workflows/public-ops-stable-candidate-patrol.yml",
+        "reusable": true,
+        "inputs": [
+          "auto-approve",
+          "auto-merge",
+          "auto-promote",
+          "contract-lock",
+          "dry-run",
+          "hold",
+          "hold-reason",
+          "ledger-ref",
+          "merge-method",
+          "minimum-soak-seconds",
+          "release-now",
+          "required-checks",
+          "revoke-reason",
+          "revoked-versions",
+          "runtime-ref",
+          "runtime-selection",
+          "target-branch"
+        ],
+        "inputCount": 17,
+        "secrets": [
+          "approval-token",
+          "promotion-token"
+        ],
+        "secretCount": 2,
+        "outputs": [
+          "promotion-pr",
+          "result-path",
+          "selected",
+          "selected-sha",
+          "selected-version",
+          "stable-version"
+        ],
+        "outputCount": 6
+      },
+      {
+        "id": "public-ops-tail-reseal",
+        "path": ".github/workflows/public-ops-tail-reseal.yml",
+        "reusable": true,
+        "inputs": [
+          "artifact-retention-days",
+          "consumer-policy-receipt-json",
+          "contract-lock",
+          "macos-finalization-command",
+          "request-json",
+          "runtime-ref",
+          "runtime-selection"
+        ],
+        "inputCount": 7,
+        "secrets": [
+          "BUILDCHAIN_EVIDENCE_READ_TOKEN",
+          "BUILDCHAIN_SIGNING_TOKEN"
+        ],
+        "secretCount": 2,
+        "outputs": [
+          "release-candidate-passport-json",
+          "tail-reseal-receipt-root"
+        ],
+        "outputCount": 2
+      },
+      {
+        "id": "public-ops-warrant-cancel",
+        "path": ".github/workflows/public-ops-warrant-cancel.yml",
+        "reusable": true,
+        "inputs": [
+          "contract-lock",
+          "event-action",
+          "expected-candidate-id",
+          "expected-old-state-root",
+          "expected-pr-number",
+          "expected-source-head-sha",
+          "observed-source-head-sha",
+          "outcome",
+          "reason",
+          "runtime-ref",
+          "runtime-selection",
+          "target-branch",
+          "terminal-evidence-root"
+        ],
+        "inputCount": 13,
+        "secrets": [
+          "github-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "cancellation-action",
+          "cancellation-receipt-root",
+          "final-state-root"
+        ],
+        "outputCount": 3
+      },
+      {
+        "id": "public-ops-warrant-close",
+        "path": ".github/workflows/public-ops-warrant-close.yml",
+        "reusable": true,
+        "inputs": [
+          "contract-lock",
+          "current-base-sha",
+          "expected-head-sha",
+          "expected-pr-number",
+          "merge-group-head-sha",
+          "merge-group-tree-sha",
+          "outcome",
+          "reason",
+          "replay-tree-sha",
+          "required-context-roots-json",
+          "runtime-ref",
+          "runtime-selection",
+          "target-branch",
+          "terminal-evidence-root"
+        ],
+        "inputCount": 14,
+        "secrets": [
+          "github-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "close-receipt-root",
+          "final-state-root",
+          "integration-proof-root",
+          "successor-wake-json"
+        ],
+        "outputCount": 4
+      },
+      {
+        "id": "public-release-artifact-attestation",
+        "path": ".github/workflows/public-release-artifact-attestation.yml",
+        "reusable": true,
+        "inputs": [
+          "contract-lock",
+          "environment",
+          "evidence-artifact-name",
+          "evidence-run-id",
+          "platform-manifest-artifact-name",
+          "platform-manifest-relative-path",
+          "policy-json",
+          "release-passport-artifact-name",
+          "release-passport-relative-path",
+          "retention-days",
+          "runtime-ref",
+          "runtime-selection",
+          "source-sha",
+          "subject-artifact-name",
+          "subject-relative-path"
+        ],
+        "inputCount": 15,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "attestation-id",
+          "attestation-url",
+          "bundle-digest",
+          "evidence-artifact-name",
+          "evidence-root"
+        ],
+        "outputCount": 5
+      },
+      {
+        "id": "public-release-oci-compose-preview",
+        "path": ".github/workflows/public-release-oci-compose-preview.yml",
+        "reusable": true,
+        "inputs": [
+          "contract-lock",
+          "runtime-ref",
+          "runtime-selection"
+        ],
+        "inputCount": 3,
+        "secrets": [
+          "BUILDCHAIN_PROMOTION_TOKEN"
+        ],
+        "secretCount": 1,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "public-release-paper",
+        "path": ".github/workflows/public-release-paper.yml",
+        "reusable": true,
+        "inputs": [
+          "artifact-name",
+          "artifact-paths",
+          "artifact-retention-days",
+          "branch-protection-bypass-apps",
+          "contract-lock",
+          "dry-run",
+          "github-governance-receipt-json",
+          "github-release",
+          "package-name",
+          "publish-dist-tag",
+          "publisher-workflow-path",
+          "release-passport-impact-json",
+          "release-passport-output-dir",
+          "release-passport-product-name",
+          "required-status-check",
+          "runtime-ref",
+          "runtime-selection",
+          "target-ref",
+          "target-sha",
+          "toolchain-type",
+          "verify-command",
+          "working-directory"
+        ],
+        "inputCount": 22,
+        "secrets": [
+          "BUILDCHAIN_GENERATED_WRITE_APP_CLIENT_ID",
+          "BUILDCHAIN_GENERATED_WRITE_APP_PRIVATE_KEY",
+          "BUILDCHAIN_GENERATED_WRITE_TOKEN",
+          "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
+        ],
+        "secretCount": 4,
+        "outputs": [
+          "controller-plan-artifact",
+          "controller-plan-digest",
+          "controller-plan-json",
+          "controller-receipt-artifact",
+          "controller-receipt-digest",
+          "controller-receipt-json",
+          "controller-receipt-status",
+          "github-release-url",
+          "package-name",
+          "package-version",
+          "propagation-work-artifact",
+          "public-release-tag",
+          "release-passport-path",
+          "upstream-release-json"
+        ],
+        "outputCount": 14
+      },
+      {
+        "id": "public-release-promote",
+        "path": ".github/workflows/public-release-promote.yml",
         "reusable": true,
         "inputs": [
           "contract-lock",
@@ -1806,6 +3256,7 @@
         ],
         "secretCount": 10,
         "outputs": [
+          "buildchain-channel",
           "built-source-sha",
           "controller-plan-artifact",
           "controller-plan-digest",
@@ -1821,6 +3272,17 @@
           "github-artifact-attestation-publication-receipt-digest",
           "github-artifact-attestation-url",
           "promoted-sha",
+          "promotion-contract-lock-digest",
+          "promotion-contract-lock-path",
+          "promotion-override-used",
+          "promotion-publication-channel",
+          "promotion-router-ref",
+          "promotion-router-sha",
+          "promotion-runtime-ref",
+          "promotion-runtime-sha",
+          "promotion-shell-ref",
+          "promotion-shell-sha",
+          "promotion-target-ref",
           "publication-capability-digest",
           "publication-commit-evidence-digest",
           "publication-commit-evidence-path",
@@ -1840,11 +3302,11 @@
           "release-tail-transaction-state",
           "release-transaction-root"
         ],
-        "outputCount": 33
+        "outputCount": 45
       },
       {
-        "id": ".release-propagation",
-        "path": ".github/workflows/.release-propagation.yml",
+        "id": "public-release-propagation",
+        "path": ".github/workflows/public-release-propagation.yml",
         "reusable": true,
         "inputs": [
           "agent-work-context-json",
@@ -1891,8 +3353,8 @@
         "outputCount": 13
       },
       {
-        "id": ".release-signing-authority",
-        "path": ".github/workflows/.release-signing-authority.yml",
+        "id": "public-release-signing-authority",
+        "path": ".github/workflows/public-release-signing-authority.yml",
         "reusable": false,
         "inputs": [],
         "inputCount": 0,
@@ -1902,8 +3364,8 @@
         "outputCount": 0
       },
       {
-        "id": ".release-tail",
-        "path": ".github/workflows/.release-tail.yml",
+        "id": "public-release-tail",
+        "path": ".github/workflows/public-release-tail.yml",
         "reusable": true,
         "inputs": [
           "candidate-root",
@@ -1933,8 +3395,8 @@
         "outputCount": 4
       },
       {
-        "id": ".release-web",
-        "path": ".github/workflows/.release-web.yml",
+        "id": "public-release-web",
+        "path": ".github/workflows/public-release-web.yml",
         "reusable": true,
         "inputs": [
           "artifact-path",
@@ -2009,49 +3471,196 @@
         "outputCount": 23
       },
       {
-        "id": "buildchain-recover",
-        "path": ".github/workflows/buildchain-recover.yml",
-        "reusable": false,
-        "inputs": [],
-        "inputCount": 0,
-        "secrets": [],
-        "secretCount": 0,
-        "outputs": [],
-        "outputCount": 0
-      },
-      {
-        "id": "buildchain",
-        "path": ".github/workflows/buildchain.yml",
-        "reusable": false,
-        "inputs": [],
-        "inputCount": 0,
-        "secrets": [],
-        "secretCount": 0,
-        "outputs": [],
-        "outputCount": 0
-      },
-      {
-        "id": "public-ops-pipeline",
-        "path": ".github/workflows/public-ops-pipeline.yml",
+        "id": "release-candidate-promote",
+        "path": ".github/workflows/release-candidate-promote.yml",
         "reusable": true,
         "inputs": [
-          "config-path"
+          "allow-repository",
+          "artifact-name",
+          "artifact-patterns",
+          "branch-protection-bypass-apps",
+          "branch-protection-bypass-teams",
+          "branch-protection-bypass-users",
+          "buildchain-alpha-contract-lock-path",
+          "buildchain-channel",
+          "buildchain-contract-compatibility-policy",
+          "buildchain-contract-drift-issue-mode",
+          "buildchain-contract-lock-path",
+          "buildchain-ref",
+          "buildchain-repository",
+          "buildchain-stable-contract-lock-path",
+          "channel",
+          "contract-lock",
+          "declarative-release-tail",
+          "dry-run",
+          "github-artifact-attestation-environment",
+          "github-artifact-attestation-policy-json",
+          "github-artifact-attestation-retention-days",
+          "github-governance-receipt-json",
+          "github-release",
+          "github-release-notes",
+          "github-release-payload-patterns",
+          "github-release-title",
+          "package-manager",
+          "publication-admission-json",
+          "publication-auto-admission",
+          "publication-auto-no-gate",
+          "publication-commit-command",
+          "publication-commit-evidence-path",
+          "publication-consumer-predicate-id",
+          "publication-consumer-qualification-command",
+          "publication-consumer-qualification-controller-sha",
+          "publication-control-plane-audit-json",
+          "publication-expected-json",
+          "publication-gate-aggregate-json",
+          "publication-gate-command",
+          "publication-gate-controller-sha",
+          "publication-package-name",
+          "publication-product",
+          "publication-publisher-workflow-path",
+          "publication-runner-provenance-json",
+          "publication-target",
+          "publication-used-nonces-json",
+          "publication-used-qualification-nonces-json",
+          "publish-artifact-kind",
+          "publish-command",
+          "publish-dist-tag",
+          "publish-mode",
+          "publish-package-main",
+          "publish-package-set-order",
+          "publish-rematerialize-on-resume",
+          "publish-required-artifacts-json",
+          "publish-target",
+          "publish-transaction-override",
+          "release-activation-command",
+          "release-activation-receipt-set-path",
+          "release-candidate-family-assignment-id",
+          "release-candidate-family-evidence-required",
+          "release-candidate-family-evidence-root",
+          "release-candidate-family-initiative-id",
+          "release-candidate-wait-seconds",
+          "release-candidate-workflow-file",
+          "release-candidate-workflow-name",
+          "release-passport",
+          "release-passport-attachment-command",
+          "release-passport-buildchain-self-kfd",
+          "release-passport-evidence-command",
+          "release-passport-evidence-jsons",
+          "release-passport-evidence-path",
+          "release-passport-impact-json",
+          "release-passport-invariant-passport-command",
+          "release-passport-invariant-passport-jsons",
+          "release-passport-kfd-1-witness-jsons",
+          "release-passport-kfd-2-claim-jsons",
+          "release-passport-kfd-3-artifact-verify-command",
+          "release-passport-kfd-3-artifact-witness-jsons",
+          "release-passport-kfd-3-prebuild-witness-jsons",
+          "release-passport-kfd-adopter-manifest-json",
+          "release-passport-kfd-product-gate-jsons",
+          "release-passport-kfd-support-matrix-json",
+          "release-passport-output-dir",
+          "release-passport-platform-manifest-paths",
+          "release-passport-product-name",
+          "release-propagation-config-path",
+          "request-json",
+          "required-artifact-count",
+          "required-status-check",
+          "resume-buildchain-runtime-sha",
+          "resume-candidate-repository",
+          "resume-candidate-run-id",
+          "resume-expected-candidate-root",
+          "resume-expected-candidate-runtime-sha",
+          "resume-expected-source-tree",
+          "resume-expected-workflow-file",
+          "resume-expected-workflow-name",
+          "resume-transaction-id",
+          "runner-preset",
+          "runtime-ref",
+          "runtime-selection",
+          "standalone-binary-distribution",
+          "target-ref",
+          "target-sha",
+          "trusted-publishing"
         ],
-        "inputCount": 1,
-        "secrets": [],
-        "secretCount": 0,
-        "outputs": [],
-        "outputCount": 0
+        "inputCount": 106,
+        "secrets": [
+          "BUILDCHAIN_ISSUE_APP_ID",
+          "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
+          "BUILDCHAIN_ISSUE_TOKEN",
+          "BUILDCHAIN_PROMOTION_TOKEN",
+          "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+          "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+          "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
+          "buildchain-issue-app-id",
+          "buildchain-issue-app-private-key",
+          "buildchain-issue-token"
+        ],
+        "secretCount": 10,
+        "outputs": [
+          "buildchain-channel",
+          "built-source-sha",
+          "controller-plan-artifact",
+          "controller-plan-digest",
+          "controller-plan-json",
+          "controller-receipt-artifact",
+          "controller-receipt-digest",
+          "controller-receipt-json",
+          "controller-receipt-status",
+          "discussion-id",
+          "discussion-url",
+          "github-artifact-attestation-evidence-root",
+          "github-artifact-attestation-id",
+          "github-artifact-attestation-publication-receipt-digest",
+          "github-artifact-attestation-url",
+          "promoted-sha",
+          "promotion-contract-lock-digest",
+          "promotion-contract-lock-path",
+          "promotion-override-used",
+          "promotion-publication-channel",
+          "promotion-router-ref",
+          "promotion-router-sha",
+          "promotion-runtime-ref",
+          "promotion-runtime-sha",
+          "promotion-shell-ref",
+          "promotion-shell-sha",
+          "promotion-target-ref",
+          "publication-capability-digest",
+          "publication-commit-evidence-digest",
+          "publication-commit-evidence-path",
+          "publication-commit-payload-root",
+          "publication-commit-url",
+          "release-candidate-action",
+          "release-candidate-artifact",
+          "release-candidate-recovery-receipt-artifact",
+          "release-candidate-recovery-root",
+          "release-invocation-root",
+          "release-propagation-work-artifact",
+          "release-receipt-root",
+          "release-tail-declaration-root",
+          "release-tail-receipt-roots-json",
+          "release-tail-state-root",
+          "release-tail-transaction-root",
+          "release-tail-transaction-state",
+          "release-transaction-root"
+        ],
+        "outputCount": 45
       },
       {
-        "id": "public-ops-recover",
-        "path": ".github/workflows/public-ops-recover.yml",
+        "id": "v4-stage-capsule-canary",
+        "path": ".github/workflows/v4-stage-capsule-canary.yml",
         "reusable": true,
         "inputs": [
-          "attempt",
-          "runtime-ref"
+          "build-artifact-path",
+          "consumer",
+          "contract-lock",
+          "go-version",
+          "install-artifact-path",
+          "node-version",
+          "runtime-ref",
+          "runtime-selection",
+          "verify-artifact-path"
         ],
-        "inputCount": 2,
+        "inputCount": 9,
         "secrets": [],
         "secretCount": 0,
         "outputs": [],
@@ -2554,6 +4163,15 @@
         ],
         "inputCount": 2
       },
+      {
+        "id": "build/gate/qualify-contract",
+        "path": "actions/build/gate/qualify-contract/action.yml",
+        "inputs": [
+          "conclusion",
+          "result"
+        ],
+        "inputCount": 2
+      },
       {
         "id": "build/gate/qualify-profile",
         "path": "actions/build/gate/qualify-profile/action.yml",
@@ -2585,12 +4203,13 @@
         "id": "build/lifecycle/plan",
         "path": "actions/build/lifecycle/plan/action.yml",
         "inputs": [
+          "compatibility-inputs",
           "config-path",
           "control-token",
           "workflow-ref",
           "workflow-sha"
         ],
-        "inputCount": 4
+        "inputCount": 5
       },
       {
         "id": "build/lifecycle/prepare",
@@ -2657,13 +4276,14 @@
         "id": "build/plan/resolve",
         "path": "actions/build/plan/resolve/action.yml",
         "inputs": [
+          "compatibility-inputs",
           "config-path",
           "control-token",
           "token",
           "workflow-ref",
           "workflow-sha"
         ],
-        "inputCount": 5
+        "inputCount": 6
       },
       {
         "id": "build/signing/admit-requests",
@@ -4288,6 +5908,7 @@
           "candidate-build-summary-path",
           "candidate-passport-path",
           "failure-after-capability",
+          "historical-inputs-json",
           "mutation-token",
           "product-publication-intent-path",
           "publication-qualification-path",
@@ -4300,6 +5921,7 @@
           "publish-package-set-order",
           "publish-rematerialize-on-resume",
           "publish-transaction-override",
+          "publisher-workflow-path",
           "publisher-workflow-sha",
           "recovery-receipt-path",
           "repository",
@@ -4319,7 +5941,7 @@
           "target-sha",
           "token"
         ],
-        "inputCount": 34
+        "inputCount": 36
       },
       {
         "id": "release/promotion/classify",
@@ -4329,6 +5951,15 @@
         ],
         "inputCount": 1
       },
+      {
+        "id": "release/promotion/historical-evidence",
+        "path": "actions/release/promotion/historical-evidence/action.yml",
+        "inputs": [
+          "request-json",
+          "source-sha"
+        ],
+        "inputCount": 2
+      },
       {
         "id": "release/promotion/inspect-invocation",
         "path": "actions/release/promotion/inspect-invocation/action.yml",
@@ -4776,6 +6407,7 @@
         "id": "runtime/selection/resolve",
         "path": "actions/runtime/selection/resolve/action.yml",
         "inputs": [
+          "compatibility-inputs",
           "contract-lock",
           "pipeline-attempt",
           "recovery-attempt",
@@ -4788,7 +6420,7 @@
           "workflow-ref",
           "workflow-sha"
         ],
-        "inputCount": 11
+        "inputCount": 12
       },
       {
         "id": "runtime/toolchain/user-paths",
@@ -10604,8 +12236,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "b0cf6f05cea3a3730c2afc07fa767d913242387c9aca6674c7b1a7932d2de31d",
-    "workflowRegistryDigest": "0261fa5e6c987714b36a2f079977fb107fe343dd1dbb35be82c0b0ae0707e511",
-    "pageRegistryDigest": "65cc6e7d9c2f0d86987ea0d3d6a64a7636b6c59b8db64d1efbd1803e501e97d2"
+    "workflowRegistryDigest": "4179ba41fc6b74a4b09826babf86257366514c269527214f8f1b1640ea15cee0",
+    "pageRegistryDigest": "37ea76e412634a9e0174350da33d6a94e67dee94b9511318158775d84e0d5f6e"
   },
   "comparison": {
     "missingCliRegistry": [],