@kungfu-tech/buildchain 4.1.6 → 4.1.7

package/dist/site/kfd-claims.json

@@ -14,18 +14,18 @@
   },
   "runtimeContract": {
     "contract": "kungfu-buildchain-runtime-contract-world",
-    "compatibilityDigest": "sha256:808c03915bf090ded3082642ffc5163e15bdd090b629344df9bfb65544041dd3",
+    "compatibilityDigest": "sha256:813bf1ddee2bf87619b4af9e4abcc74bd524de95aef0b77cb94a14e54d9a15f0",
     "majorLine": "v4"
   },
   "publicSurfaceReverseAudit": {
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "0b098a055c97704cafb0641e7a98de5ea60a617d3184c5a0fdde48d7aab601e2",
+    "sha256": "4d635607e347273e75875dcd26ffc1333086e51459425e2f3973c626eccf973d",
     "summary": {
       "cliCommandCount": 113,
-      "workflowCount": 44,
-      "actionCount": 283,
+      "workflowCount": 79,
+      "actionCount": 285,
       "sitePageCount": 94,
       "docCommandRefCount": 998,
       "failureCount": 0
@@ -246,11 +246,11 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "0b098a055c97704cafb0641e7a98de5ea60a617d3184c5a0fdde48d7aab601e2",
+      "sha256": "4d635607e347273e75875dcd26ffc1333086e51459425e2f3973c626eccf973d",
       "summary": {
         "cliCommandCount": 113,
-        "workflowCount": 44,
-        "actionCount": 283,
+        "workflowCount": 79,
+        "actionCount": 285,
         "sitePageCount": 94,
         "docCommandRefCount": 998,
         "failureCount": 0
@@ -3733,8 +3733,9 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 5,
+          "inputCount": 6,
           "inputs": [
+            "compatibility-inputs",
             "config-path",
             "contract-lock",
             "resume-run-id",
@@ -3874,6 +3875,27 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:.build-historical",
+          "name": "workflow:.build-historical",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.build-historical.yml",
+          "evidencePath": ".github/workflows/.build-historical.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 6,
+          "inputs": [
+            "compatibility-inputs",
+            "config-path",
+            "contract-lock",
+            "resume-run-id",
+            "runtime-ref",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:.build-publication",
           "name": "workflow:.build-publication",
@@ -3944,8 +3966,9 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 5,
+          "inputCount": 6,
           "inputs": [
+            "compatibility-inputs",
             "config-path",
             "contract-lock",
             "resume-run-id",
@@ -4527,58 +4550,1182 @@
           "id": "workflow:.release-binary-assets",
           "name": "workflow:.release-binary-assets",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-binary-assets.yml",
-          "evidencePath": ".github/workflows/.release-binary-assets.yml",
+          "sourcePath": ".github/workflows/.release-binary-assets.yml",
+          "evidencePath": ".github/workflows/.release-binary-assets.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 16,
+          "inputs": [
+            "auto-admission",
+            "contract-lock",
+            "evidence-run-id",
+            "github-governance-receipt-json",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "publication-version",
+            "release-tag",
+            "runtime-ref",
+            "runtime-selection",
+            "source-sha",
+            "target-ref"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-candidate-promote",
+          "name": "workflow:.release-candidate-promote",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-candidate-promote.yml",
+          "evidencePath": ".github/workflows/.release-candidate-promote.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 4,
+          "inputs": [
+            "contract-lock",
+            "request-json",
+            "runtime-ref",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-historical",
+          "name": "workflow:.release-historical",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-historical.yml",
+          "evidencePath": ".github/workflows/.release-historical.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 4,
+          "inputs": [
+            "contract-lock",
+            "request-json",
+            "runtime-ref",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-oci-compose-preview",
+          "name": "workflow:.release-oci-compose-preview",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-oci-compose-preview.yml",
+          "evidencePath": ".github/workflows/.release-oci-compose-preview.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 3,
+          "inputs": [
+            "contract-lock",
+            "runtime-ref",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-paper",
+          "name": "workflow:.release-paper",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-paper.yml",
+          "evidencePath": ".github/workflows/.release-paper.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 22,
+          "inputs": [
+            "artifact-name",
+            "artifact-paths",
+            "artifact-retention-days",
+            "branch-protection-bypass-apps",
+            "contract-lock",
+            "dry-run",
+            "github-governance-receipt-json",
+            "github-release",
+            "package-name",
+            "publish-dist-tag",
+            "publisher-workflow-path",
+            "release-passport-impact-json",
+            "release-passport-output-dir",
+            "release-passport-product-name",
+            "required-status-check",
+            "runtime-ref",
+            "runtime-selection",
+            "target-ref",
+            "target-sha",
+            "toolchain-type",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-pipeline-products",
+          "name": "workflow:.release-pipeline-products",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-pipeline-products.yml",
+          "evidencePath": ".github/workflows/.release-pipeline-products.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 2,
+          "inputs": [
+            "attempt",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-pipeline-version",
+          "name": "workflow:.release-pipeline-version",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-pipeline-version.yml",
+          "evidencePath": ".github/workflows/.release-pipeline-version.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "context",
+            "matrix",
+            "operation",
+            "purpose",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-promote",
+          "name": "workflow:.release-promote",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-promote.yml",
+          "evidencePath": ".github/workflows/.release-promote.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 4,
+          "inputs": [
+            "contract-lock",
+            "request-json",
+            "runtime-ref",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-propagation",
+          "name": "workflow:.release-propagation",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-propagation.yml",
+          "evidencePath": ".github/workflows/.release-propagation.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 20,
+          "inputs": [
+            "agent-work-context-json",
+            "agent-work-mode",
+            "contract-lock",
+            "downstream-base-ref",
+            "downstream-branch",
+            "downstream-prepare-command",
+            "downstream-repository",
+            "downstream-target",
+            "downstream-update-command",
+            "downstream-verify-command",
+            "dry-run",
+            "graph-json",
+            "lock-path",
+            "pr-body",
+            "pr-title",
+            "refresh-managed-readme-badges",
+            "runtime-ref",
+            "runtime-selection",
+            "source-node",
+            "upstream-release-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-signing-authority",
+          "name": "workflow:.release-signing-authority",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-signing-authority.yml",
+          "evidencePath": ".github/workflows/.release-signing-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-tail",
+          "name": "workflow:.release-tail",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-tail.yml",
+          "evidencePath": ".github/workflows/.release-tail.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 12,
+          "inputs": [
+            "candidate-root",
+            "contract-lock",
+            "declaration-path",
+            "execute",
+            "provider-bindings-path",
+            "rehearsal-authority-path",
+            "rehearsal-capsule-path",
+            "rehearsal-evidence-path",
+            "rehearsal-mode",
+            "runtime-ref",
+            "runtime-selection",
+            "state-path"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:.release-web",
+          "name": "workflow:.release-web",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.release-web.yml",
+          "evidencePath": ".github/workflows/.release-web.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 37,
+          "inputs": [
+            "artifact-path",
+            "aws-region",
+            "build-command",
+            "contract-lock",
+            "fail-on-release-pr-error",
+            "github-governance-receipt-json",
+            "node-version",
+            "preview-apply",
+            "preview-aws-role-arn",
+            "preview-cleanup-apply",
+            "preview-comment",
+            "preview-environment",
+            "production-apply",
+            "production-approved",
+            "production-aws-role-arn",
+            "production-environment",
+            "production-release-app-client-id",
+            "production-release-branch-channel",
+            "production-release-head-prefix",
+            "production-release-label",
+            "production-release-on-main",
+            "production-release-pr-mode",
+            "production-source-sha",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "release-feedback-actor-privacy",
+            "runtime-ref",
+            "runtime-selection",
+            "staging-apply",
+            "staging-aws-role-arn",
+            "staging-environment",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:build",
+          "name": "workflow:build",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/build.yml",
+          "evidencePath": ".github/workflows/build.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 98,
+          "inputs": [
+            "artifact-compression-level",
+            "artifact-finalization-command",
+            "artifact-finalization-on-platform",
+            "artifact-name",
+            "artifact-name-template",
+            "artifact-paths",
+            "artifact-relay-s3-bucket",
+            "artifact-relay-s3-download-role-arn",
+            "artifact-relay-s3-oidc-audience",
+            "artifact-relay-s3-prefix",
+            "artifact-relay-s3-region",
+            "artifact-relay-s3-role-arn",
+            "artifact-relay-s3-upload-role-arn",
+            "artifact-retention-days",
+            "artifact-signing-request-upload-no-proxy",
+            "artifact-transfer-mode",
+            "aws-codebuild-project",
+            "aws-ec2-macos-runner-label",
+            "aws-ec2-windows-runner-label",
+            "build-command",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-channel",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
+            "buildchain-expected-channel",
+            "buildchain-expected-major",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "cache-dependency-lock-root",
+            "cache-policy-root",
+            "cache-toolchain-root",
+            "cargo-registry-index",
+            "checkout-cache-fallback",
+            "checkout-cache-fetch-attempts",
+            "checkout-cache-github-timeout-seconds",
+            "checkout-cache-mirror-url-template",
+            "checkout-cache-mode",
+            "checkout-cache-reference-repository-template",
+            "checkout-cache-timeout-seconds",
+            "checkout-history-mode",
+            "compiler-cache-platforms-json",
+            "compiler-cache-provider",
+            "compiler-cache-required",
+            "config-path",
+            "contract-lock",
+            "control-runner-json",
+            "credential-island-caller-owned",
+            "credential-island-environment",
+            "credential-island-macos-app-path",
+            "credential-island-macos-platform-id",
+            "expected-artifacts-json",
+            "fail-fast",
+            "gate-profile-aggregate-json",
+            "github-artifact-attestation-platform-id",
+            "github-artifact-attestation-signer-sha",
+            "github-artifact-attestation-subject-path",
+            "install-command",
+            "kfd-agent-hub",
+            "lifecycle-timeout-minutes",
+            "linux-container-image",
+            "linux-container-preset",
+            "node-version",
+            "platforms-json",
+            "pre-upload-transport-smoke-artifact-root",
+            "pre-upload-transport-smoke-scenario-path",
+            "process-sample-interval-ms",
+            "process-summary-path",
+            "publish-anchor-request-json",
+            "publish-channel",
+            "publish-refs-json",
+            "publish-registry",
+            "publish-source-ref",
+            "release-candidate",
+            "release-candidate-family-evidence-json",
+            "requested-parallelism",
+            "require-build",
+            "require-install",
+            "require-trusted-event",
+            "require-verify",
+            "resume-run-id",
+            "runner-preset",
+            "runtime-ref",
+            "runtime-selection",
+            "rust-toolchain",
+            "rustup-dist-server",
+            "rustup-update-root",
+            "sample-process-tree",
+            "self-hosted-offline-fallback",
+            "setup-node",
+            "setup-rust",
+            "shifu-cache-profile-digest",
+            "shifu-cache-profile-ref",
+            "untrusted-policy",
+            "verify-command",
+            "verify-substage-evidence-path",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:buildchain-recover",
+          "name": "workflow:buildchain-recover",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/buildchain-recover.yml",
+          "evidencePath": ".github/workflows/buildchain-recover.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:buildchain",
+          "name": "workflow:buildchain",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/buildchain.yml",
+          "evidencePath": ".github/workflows/buildchain.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:check",
+          "name": "workflow:check",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/check.yml",
+          "evidencePath": ".github/workflows/check.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 15,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "contract-lock",
+            "mode",
+            "node-version",
+            "require-version-state",
+            "runtime-ref",
+            "runtime-selection",
+            "source-proof-closure-paths-json",
+            "source-proof-dependency-paths-json",
+            "source-proof-policy-paths-json",
+            "source-proof-required-contexts-json",
+            "source-proof-reuse",
+            "upload-artifacts",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:dev-pr-auto-merge",
+          "name": "workflow:dev-pr-auto-merge",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/dev-pr-auto-merge.yml",
+          "evidencePath": ".github/workflows/dev-pr-auto-merge.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 51,
+          "inputs": [
+            "active-lease-context",
+            "affected-paths-json",
+            "allowed-head-prefixes",
+            "assignment-root",
+            "block-labels",
+            "buildchain-ref",
+            "buildchain-repository",
+            "closure-root",
+            "contract-lock",
+            "defer-landing",
+            "delivery-class",
+            "delivery-priority",
+            "delivery-warrant-mode",
+            "dependency-root",
+            "diagnostic-context",
+            "dry-run",
+            "environment-root",
+            "expected-head-sha",
+            "expected-pr-number",
+            "handoff-workflow-id",
+            "initiative-root",
+            "landing-mode",
+            "legacy-active-owner-binding-json",
+            "max-merges",
+            "merge-method",
+            "native-command",
+            "native-command-root",
+            "native-heartbeat-seconds",
+            "native-platform",
+            "native-proof-json",
+            "pipeline-attempt",
+            "plan-root",
+            "project-cut-proof-json",
+            "queue-admission-context",
+            "ready-label",
+            "release-blocker-priority-json",
+            "require-approval",
+            "required-status-checks",
+            "runtime-ref",
+            "runtime-selection",
+            "same-repository-only",
+            "shard-evidence-roots-json",
+            "source-identity-root",
+            "source-patch-root",
+            "source-root",
+            "source-workflow-id",
+            "source-workflow-run-id",
+            "target-branch",
+            "toolchain-root",
+            "universal-request-json",
+            "warrant-lease-seconds"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-build-adopter-qualification",
+          "name": "workflow:public-build-adopter-qualification",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-build-adopter-qualification.yml",
+          "evidencePath": ".github/workflows/public-build-adopter-qualification.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 8,
+          "inputs": [
+            "consumer",
+            "consumer-ref",
+            "consumer-repository",
+            "contract-lock",
+            "input-path",
+            "invocation-source-path",
+            "runtime-ref",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-build-check",
+          "name": "workflow:public-build-check",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-build-check.yml",
+          "evidencePath": ".github/workflows/public-build-check.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "contract-lock",
+            "mode",
+            "node-version",
+            "require-version-state",
+            "runtime-ref",
+            "runtime-selection",
+            "source-proof-closure-paths-json",
+            "source-proof-dependency-paths-json",
+            "source-proof-policy-paths-json",
+            "source-proof-required-contexts-json",
+            "source-proof-reuse",
+            "upload-artifacts",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-build-demo",
+          "name": "workflow:public-build-demo",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-build-demo.yml",
+          "evidencePath": ".github/workflows/public-build-demo.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "artifact-retention-days",
+            "binary-artifact-digest",
+            "binary-artifact-name",
+            "contract-lock",
+            "materialize",
+            "materialize-base-ref",
+            "media-profile",
+            "render-failure-advisory",
+            "render-media",
+            "renderer-image",
+            "runtime-ref",
+            "runtime-selection",
+            "scenario-path",
+            "source-ref"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-build-publication",
+          "name": "workflow:public-build-publication",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-build-publication.yml",
+          "evidencePath": ".github/workflows/public-build-publication.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 21,
+          "inputs": [
+            "artifact-name",
+            "artifact-paths",
+            "artifact-retention-days",
+            "build-command",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-stable-contract-lock-path",
+            "contract-lock",
+            "node-version",
+            "package-name",
+            "prepare-paper-package",
+            "publish-dist-tag",
+            "runtime-ref",
+            "runtime-selection",
+            "setup-node",
+            "target-ref",
+            "toolchain-command",
+            "toolchain-digest",
+            "toolchain-image",
+            "toolchain-type",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-build-stage-capsule-canary",
+          "name": "workflow:public-build-stage-capsule-canary",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-build-stage-capsule-canary.yml",
+          "evidencePath": ".github/workflows/public-build-stage-capsule-canary.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 9,
+          "inputs": [
+            "build-artifact-path",
+            "consumer",
+            "contract-lock",
+            "go-version",
+            "install-artifact-path",
+            "node-version",
+            "runtime-ref",
+            "runtime-selection",
+            "verify-artifact-path"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-alpha-candidate-patrol",
+          "name": "workflow:public-ops-alpha-candidate-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 15,
+          "inputs": [
+            "alpha-workflow-path",
+            "auto-merge",
+            "contract-lock",
+            "dev-workflow-path",
+            "dry-run",
+            "max-age-seconds",
+            "merge-method",
+            "pull-request-body-prefix",
+            "pull-request-body-prefix-renderer",
+            "reactivation-authorized",
+            "runtime-ref",
+            "runtime-selection",
+            "settlement-authorized",
+            "source-branch",
+            "target-branch"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-bootstrap",
+          "name": "workflow:public-ops-bootstrap",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-bootstrap.yml",
+          "evidencePath": ".github/workflows/public-ops-bootstrap.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 4,
+          "inputs": [
+            "contract-lock",
+            "request-json",
+            "runtime-ref",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-dev-auto-merge",
+          "name": "workflow:public-ops-dev-auto-merge",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-dev-auto-merge.yml",
+          "evidencePath": ".github/workflows/public-ops-dev-auto-merge.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 44,
+          "inputs": [
+            "active-lease-context",
+            "affected-paths-json",
+            "allowed-head-prefixes",
+            "block-labels",
+            "closure-root",
+            "contract-lock",
+            "defer-landing",
+            "delivery-class",
+            "delivery-priority",
+            "delivery-warrant-mode",
+            "dependency-root",
+            "diagnostic-context",
+            "dry-run",
+            "environment-root",
+            "expected-head-sha",
+            "expected-pr-number",
+            "handoff-workflow-id",
+            "landing-mode",
+            "max-merges",
+            "merge-method",
+            "native-command",
+            "native-command-root",
+            "native-heartbeat-seconds",
+            "native-platform",
+            "native-proof-json",
+            "pipeline-attempt",
+            "plan-root",
+            "project-cut-proof-json",
+            "queue-admission-context",
+            "ready-label",
+            "release-blocker-priority-json",
+            "require-approval",
+            "required-status-checks",
+            "runtime-ref",
+            "runtime-selection",
+            "same-repository-only",
+            "shard-evidence-roots-json",
+            "source-identity-root",
+            "source-patch-root",
+            "source-root",
+            "source-workflow-run-id",
+            "target-branch",
+            "toolchain-root",
+            "warrant-lease-seconds"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-dev-qualification-patrol",
+          "name": "workflow:public-ops-dev-qualification-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 11,
+          "inputs": [
+            "contract-lock",
+            "dev-workflow-path",
+            "dispatch-inputs-json",
+            "dry-run",
+            "max-attempts",
+            "mutation-authorized",
+            "preflight-workflow-path",
+            "priority-workflows-json",
+            "runtime-ref",
+            "runtime-selection",
+            "source-branch"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-housekeeping",
+          "name": "workflow:public-ops-housekeeping",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-housekeeping.yml",
+          "evidencePath": ".github/workflows/public-ops-housekeeping.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 15,
+          "inputs": [
+            "apply-enabled",
+            "artifact-prefix",
+            "artifact-retention-days",
+            "contract-lock",
+            "max-actions",
+            "mode",
+            "protected-patterns",
+            "repository",
+            "retained-patterns",
+            "runtime-ref",
+            "runtime-selection",
+            "stale-days",
+            "stale-pull-request-label",
+            "target-branch",
+            "temporary-branch-patterns"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-observed-evidence",
+          "name": "workflow:public-ops-observed-evidence",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-observed-evidence.yml",
+          "evidencePath": ".github/workflows/public-ops-observed-evidence.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "artifact-path",
+            "build-command",
+            "cloudfront-distribution",
+            "contract-lock",
+            "evidence-source-path",
+            "evidence-source-ref",
+            "evidence-source-repository",
+            "manifest-path",
+            "production-aws-role-arn",
+            "production-bucket",
+            "production-environment",
+            "runtime-ref",
+            "runtime-selection",
+            "verify-command"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-patrol-daily",
+          "name": "workflow:public-ops-patrol-daily",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-patrol-daily.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol-daily.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 14,
+          "inputs": [
+            "allowed-head-prefixes",
+            "block-labels",
+            "contract-lock",
+            "dry-run",
+            "landing-mode",
+            "max-actions",
+            "merge-method",
+            "ready-label",
+            "require-approval",
+            "required-status-checks",
+            "runtime-ref",
+            "runtime-selection",
+            "same-repository-only",
+            "target-branch"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-patrol-monthly",
+          "name": "workflow:public-ops-patrol-monthly",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-patrol-monthly.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol-monthly.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "contract-lock",
+            "dry-run",
+            "runtime-ref",
+            "runtime-selection",
+            "target-branch"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-patrol-weekly",
+          "name": "workflow:public-ops-patrol-weekly",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-patrol-weekly.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol-weekly.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 5,
+          "inputs": [
+            "contract-lock",
+            "dry-run",
+            "runtime-ref",
+            "runtime-selection",
+            "target-branch"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-patrol",
+          "name": "workflow:public-ops-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 17,
+          "inputs": [
+            "allowed-head-prefixes",
+            "block-labels",
+            "cadence",
+            "capabilities",
+            "contract-lock",
+            "dry-run",
+            "landing-mode",
+            "max-actions",
+            "merge-method",
+            "mode",
+            "ready-label",
+            "require-approval",
+            "required-status-checks",
+            "runtime-ref",
+            "runtime-selection",
+            "same-repository-only",
+            "target-branch"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-pipeline",
+          "name": "workflow:public-ops-pipeline",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-pipeline.yml",
+          "evidencePath": ".github/workflows/public-ops-pipeline.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 1,
+          "inputs": [
+            "config-path"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-recover",
+          "name": "workflow:public-ops-recover",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-recover.yml",
+          "evidencePath": ".github/workflows/public-ops-recover.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 2,
+          "inputs": [
+            "attempt",
+            "runtime-ref"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-release-governance",
+          "name": "workflow:public-ops-release-governance",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-release-governance.yml",
+          "evidencePath": ".github/workflows/public-ops-release-governance.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 6,
+          "inputs": [
+            "apply",
+            "branch",
+            "candidate-sha",
+            "contract-lock",
+            "runtime-ref",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-stable-candidate-patrol",
+          "name": "workflow:public-ops-stable-candidate-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 17,
+          "inputs": [
+            "auto-approve",
+            "auto-merge",
+            "auto-promote",
+            "contract-lock",
+            "dry-run",
+            "hold",
+            "hold-reason",
+            "ledger-ref",
+            "merge-method",
+            "minimum-soak-seconds",
+            "release-now",
+            "required-checks",
+            "revoke-reason",
+            "revoked-versions",
+            "runtime-ref",
+            "runtime-selection",
+            "target-branch"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-tail-reseal",
+          "name": "workflow:public-ops-tail-reseal",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-tail-reseal.yml",
+          "evidencePath": ".github/workflows/public-ops-tail-reseal.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 7,
+          "inputs": [
+            "artifact-retention-days",
+            "consumer-policy-receipt-json",
+            "contract-lock",
+            "macos-finalization-command",
+            "request-json",
+            "runtime-ref",
+            "runtime-selection"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-warrant-cancel",
+          "name": "workflow:public-ops-warrant-cancel",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-warrant-cancel.yml",
+          "evidencePath": ".github/workflows/public-ops-warrant-cancel.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "contract-lock",
+            "event-action",
+            "expected-candidate-id",
+            "expected-old-state-root",
+            "expected-pr-number",
+            "expected-source-head-sha",
+            "observed-source-head-sha",
+            "outcome",
+            "reason",
+            "runtime-ref",
+            "runtime-selection",
+            "target-branch",
+            "terminal-evidence-root"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:public-ops-warrant-close",
+          "name": "workflow:public-ops-warrant-close",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/public-ops-warrant-close.yml",
+          "evidencePath": ".github/workflows/public-ops-warrant-close.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 16,
+          "inputCount": 14,
           "inputs": [
-            "auto-admission",
             "contract-lock",
-            "evidence-run-id",
-            "github-governance-receipt-json",
-            "publication-admission-json",
-            "publication-control-plane-audit-json",
-            "publication-expected-json",
-            "publication-gate-aggregate-json",
-            "publication-runner-provenance-json",
-            "publication-used-nonces-json",
-            "publication-version",
-            "release-tag",
+            "current-base-sha",
+            "expected-head-sha",
+            "expected-pr-number",
+            "merge-group-head-sha",
+            "merge-group-tree-sha",
+            "outcome",
+            "reason",
+            "replay-tree-sha",
+            "required-context-roots-json",
             "runtime-ref",
             "runtime-selection",
-            "source-sha",
-            "target-ref"
+            "target-branch",
+            "terminal-evidence-root"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-candidate-promote",
-          "name": "workflow:.release-candidate-promote",
+          "id": "workflow:public-release-artifact-attestation",
+          "name": "workflow:public-release-artifact-attestation",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-candidate-promote.yml",
-          "evidencePath": ".github/workflows/.release-candidate-promote.yml",
+          "sourcePath": ".github/workflows/public-release-artifact-attestation.yml",
+          "evidencePath": ".github/workflows/public-release-artifact-attestation.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 4,
+          "inputCount": 15,
           "inputs": [
             "contract-lock",
-            "request-json",
+            "environment",
+            "evidence-artifact-name",
+            "evidence-run-id",
+            "platform-manifest-artifact-name",
+            "platform-manifest-relative-path",
+            "policy-json",
+            "release-passport-artifact-name",
+            "release-passport-relative-path",
+            "retention-days",
             "runtime-ref",
-            "runtime-selection"
+            "runtime-selection",
+            "source-sha",
+            "subject-artifact-name",
+            "subject-relative-path"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-oci-compose-preview",
-          "name": "workflow:.release-oci-compose-preview",
+          "id": "workflow:public-release-oci-compose-preview",
+          "name": "workflow:public-release-oci-compose-preview",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-oci-compose-preview.yml",
-          "evidencePath": ".github/workflows/.release-oci-compose-preview.yml",
+          "sourcePath": ".github/workflows/public-release-oci-compose-preview.yml",
+          "evidencePath": ".github/workflows/public-release-oci-compose-preview.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4592,11 +5739,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-paper",
-          "name": "workflow:.release-paper",
+          "id": "workflow:public-release-paper",
+          "name": "workflow:public-release-paper",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-paper.yml",
-          "evidencePath": ".github/workflows/.release-paper.yml",
+          "sourcePath": ".github/workflows/public-release-paper.yml",
+          "evidencePath": ".github/workflows/public-release-paper.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4629,48 +5776,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-pipeline-products",
-          "name": "workflow:.release-pipeline-products",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-pipeline-products.yml",
-          "evidencePath": ".github/workflows/.release-pipeline-products.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 2,
-          "inputs": [
-            "attempt",
-            "runtime-selection"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.release-pipeline-version",
-          "name": "workflow:.release-pipeline-version",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-pipeline-version.yml",
-          "evidencePath": ".github/workflows/.release-pipeline-version.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 5,
-          "inputs": [
-            "context",
-            "matrix",
-            "operation",
-            "purpose",
-            "runtime-selection"
-          ],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:.release-promote",
-          "name": "workflow:.release-promote",
+          "id": "workflow:public-release-promote",
+          "name": "workflow:public-release-promote",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-promote.yml",
-          "evidencePath": ".github/workflows/.release-promote.yml",
+          "sourcePath": ".github/workflows/public-release-promote.yml",
+          "evidencePath": ".github/workflows/public-release-promote.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4685,11 +5795,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-propagation",
-          "name": "workflow:.release-propagation",
+          "id": "workflow:public-release-propagation",
+          "name": "workflow:public-release-propagation",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-propagation.yml",
-          "evidencePath": ".github/workflows/.release-propagation.yml",
+          "sourcePath": ".github/workflows/public-release-propagation.yml",
+          "evidencePath": ".github/workflows/public-release-propagation.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4720,11 +5830,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-signing-authority",
-          "name": "workflow:.release-signing-authority",
+          "id": "workflow:public-release-signing-authority",
+          "name": "workflow:public-release-signing-authority",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-signing-authority.yml",
-          "evidencePath": ".github/workflows/.release-signing-authority.yml",
+          "sourcePath": ".github/workflows/public-release-signing-authority.yml",
+          "evidencePath": ".github/workflows/public-release-signing-authority.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4734,11 +5844,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-tail",
-          "name": "workflow:.release-tail",
+          "id": "workflow:public-release-tail",
+          "name": "workflow:public-release-tail",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-tail.yml",
-          "evidencePath": ".github/workflows/.release-tail.yml",
+          "sourcePath": ".github/workflows/public-release-tail.yml",
+          "evidencePath": ".github/workflows/public-release-tail.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4761,11 +5871,11 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:.release-web",
-          "name": "workflow:.release-web",
+          "id": "workflow:public-release-web",
+          "name": "workflow:public-release-web",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/.release-web.yml",
-          "evidencePath": ".github/workflows/.release-web.yml",
+          "sourcePath": ".github/workflows/public-release-web.yml",
+          "evidencePath": ".github/workflows/public-release-web.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
@@ -4813,63 +5923,147 @@
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:buildchain-recover",
-          "name": "workflow:buildchain-recover",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain-recover.yml",
-          "evidencePath": ".github/workflows/buildchain-recover.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:buildchain",
-          "name": "workflow:buildchain",
-          "kind": "workflow",
-          "sourcePath": ".github/workflows/buildchain.yml",
-          "evidencePath": ".github/workflows/buildchain.yml",
-          "availability": "shipped",
-          "visibility": "public",
-          "participantFacing": true,
-          "public": true,
-          "inputCount": 0,
-          "inputs": [],
-          "reverseAuditSource": ".github/workflows"
-        },
-        {
-          "id": "workflow:public-ops-pipeline",
-          "name": "workflow:public-ops-pipeline",
+          "id": "workflow:release-candidate-promote",
+          "name": "workflow:release-candidate-promote",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-pipeline.yml",
-          "evidencePath": ".github/workflows/public-ops-pipeline.yml",
+          "sourcePath": ".github/workflows/release-candidate-promote.yml",
+          "evidencePath": ".github/workflows/release-candidate-promote.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 1,
+          "inputCount": 106,
           "inputs": [
-            "config-path"
+            "allow-repository",
+            "artifact-name",
+            "artifact-patterns",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "buildchain-alpha-contract-lock-path",
+            "buildchain-channel",
+            "buildchain-contract-compatibility-policy",
+            "buildchain-contract-drift-issue-mode",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "buildchain-stable-contract-lock-path",
+            "channel",
+            "contract-lock",
+            "declarative-release-tail",
+            "dry-run",
+            "github-artifact-attestation-environment",
+            "github-artifact-attestation-policy-json",
+            "github-artifact-attestation-retention-days",
+            "github-governance-receipt-json",
+            "github-release",
+            "github-release-notes",
+            "github-release-payload-patterns",
+            "github-release-title",
+            "package-manager",
+            "publication-admission-json",
+            "publication-auto-admission",
+            "publication-auto-no-gate",
+            "publication-commit-command",
+            "publication-commit-evidence-path",
+            "publication-consumer-predicate-id",
+            "publication-consumer-qualification-command",
+            "publication-consumer-qualification-controller-sha",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-gate-command",
+            "publication-gate-controller-sha",
+            "publication-package-name",
+            "publication-product",
+            "publication-publisher-workflow-path",
+            "publication-runner-provenance-json",
+            "publication-target",
+            "publication-used-nonces-json",
+            "publication-used-qualification-nonces-json",
+            "publish-artifact-kind",
+            "publish-command",
+            "publish-dist-tag",
+            "publish-mode",
+            "publish-package-main",
+            "publish-package-set-order",
+            "publish-rematerialize-on-resume",
+            "publish-required-artifacts-json",
+            "publish-target",
+            "publish-transaction-override",
+            "release-activation-command",
+            "release-activation-receipt-set-path",
+            "release-candidate-family-assignment-id",
+            "release-candidate-family-evidence-required",
+            "release-candidate-family-evidence-root",
+            "release-candidate-family-initiative-id",
+            "release-candidate-wait-seconds",
+            "release-candidate-workflow-file",
+            "release-candidate-workflow-name",
+            "release-passport",
+            "release-passport-attachment-command",
+            "release-passport-buildchain-self-kfd",
+            "release-passport-evidence-command",
+            "release-passport-evidence-jsons",
+            "release-passport-evidence-path",
+            "release-passport-impact-json",
+            "release-passport-invariant-passport-command",
+            "release-passport-invariant-passport-jsons",
+            "release-passport-kfd-1-witness-jsons",
+            "release-passport-kfd-2-claim-jsons",
+            "release-passport-kfd-3-artifact-verify-command",
+            "release-passport-kfd-3-artifact-witness-jsons",
+            "release-passport-kfd-3-prebuild-witness-jsons",
+            "release-passport-kfd-adopter-manifest-json",
+            "release-passport-kfd-product-gate-jsons",
+            "release-passport-kfd-support-matrix-json",
+            "release-passport-output-dir",
+            "release-passport-platform-manifest-paths",
+            "release-passport-product-name",
+            "release-propagation-config-path",
+            "request-json",
+            "required-artifact-count",
+            "required-status-check",
+            "resume-buildchain-runtime-sha",
+            "resume-candidate-repository",
+            "resume-candidate-run-id",
+            "resume-expected-candidate-root",
+            "resume-expected-candidate-runtime-sha",
+            "resume-expected-source-tree",
+            "resume-expected-workflow-file",
+            "resume-expected-workflow-name",
+            "resume-transaction-id",
+            "runner-preset",
+            "runtime-ref",
+            "runtime-selection",
+            "standalone-binary-distribution",
+            "target-ref",
+            "target-sha",
+            "trusted-publishing"
           ],
           "reverseAuditSource": ".github/workflows"
         },
         {
-          "id": "workflow:public-ops-recover",
-          "name": "workflow:public-ops-recover",
+          "id": "workflow:v4-stage-capsule-canary",
+          "name": "workflow:v4-stage-capsule-canary",
           "kind": "workflow",
-          "sourcePath": ".github/workflows/public-ops-recover.yml",
-          "evidencePath": ".github/workflows/public-ops-recover.yml",
+          "sourcePath": ".github/workflows/v4-stage-capsule-canary.yml",
+          "evidencePath": ".github/workflows/v4-stage-capsule-canary.yml",
           "availability": "shipped",
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 2,
+          "inputCount": 9,
           "inputs": [
-            "attempt",
-            "runtime-ref"
+            "build-artifact-path",
+            "consumer",
+            "contract-lock",
+            "go-version",
+            "install-artifact-path",
+            "node-version",
+            "runtime-ref",
+            "runtime-selection",
+            "verify-artifact-path"
           ],
           "reverseAuditSource": ".github/workflows"
         },
@@ -5736,6 +6930,23 @@
           ],
           "reverseAuditSource": "actions/*/action.yml"
         },
+        {
+          "id": "action:build/gate/qualify-contract",
+          "name": "action:build/gate/qualify-contract",
+          "kind": "action",
+          "sourcePath": "actions/build/gate/qualify-contract/action.yml",
+          "evidencePath": "actions/build/gate/qualify-contract/action.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 2,
+          "inputs": [
+            "conclusion",
+            "result"
+          ],
+          "reverseAuditSource": "actions/*/action.yml"
+        },
         {
           "id": "action:build/gate/qualify-profile",
           "name": "action:build/gate/qualify-profile",
@@ -5797,8 +7008,9 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 4,
+          "inputCount": 5,
           "inputs": [
+            "compatibility-inputs",
             "config-path",
             "control-token",
             "workflow-ref",
@@ -5909,8 +7121,9 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 5,
+          "inputCount": 6,
           "inputs": [
+            "compatibility-inputs",
             "config-path",
             "control-token",
             "token",
@@ -8728,12 +9941,13 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 34,
+          "inputCount": 36,
           "inputs": [
             "artifact-paths",
             "candidate-build-summary-path",
             "candidate-passport-path",
             "failure-after-capability",
+            "historical-inputs-json",
             "mutation-token",
             "product-publication-intent-path",
             "publication-qualification-path",
@@ -8746,6 +9960,7 @@
             "publish-package-set-order",
             "publish-rematerialize-on-resume",
             "publish-transaction-override",
+            "publisher-workflow-path",
             "publisher-workflow-sha",
             "recovery-receipt-path",
             "repository",
@@ -8783,6 +9998,23 @@
           ],
           "reverseAuditSource": "actions/*/action.yml"
         },
+        {
+          "id": "action:release/promotion/historical-evidence",
+          "name": "action:release/promotion/historical-evidence",
+          "kind": "action",
+          "sourcePath": "actions/release/promotion/historical-evidence/action.yml",
+          "evidencePath": "actions/release/promotion/historical-evidence/action.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 2,
+          "inputs": [
+            "request-json",
+            "source-sha"
+          ],
+          "reverseAuditSource": "actions/*/action.yml"
+        },
         {
           "id": "action:release/promotion/inspect-invocation",
           "name": "action:release/promotion/inspect-invocation",
@@ -9500,8 +10732,9 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 11,
+          "inputCount": 12,
           "inputs": [
+            "compatibility-inputs",
             "contract-lock",
             "pipeline-attempt",
             "recovery-attempt",
@@ -11637,6 +12870,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 724
+    "publicSurfaceCount": 761
   }
 }