@kungfu-tech/buildchain 4.1.6 → 4.1.7

package/docs/MAP.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-09-20
+last_reviewed: 2026-09-24
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-20
+  generated_at: 2026-09-24
   visible_context: Current consumer contract and release and recovery manuals.
   invisible_context_boundary: No unobserved hosted qualification or external consumer migration.
 ---
@@ -31,9 +31,10 @@ running artifact), *use* (consume / extend) - and a **status**:
 - `to write` - planned; the material exists but is not yet a single doc.
 - `retired` - intentionally not part of the active consumer surface.
 
-The current consumer contract is the shared normal/recovery caller pair plus
-schema-2 TOML. Start with [Getting started](getting-started.md),
+New consumers use the shared normal/recovery caller pair plus schema-2 TOML. Start with [Getting started](getting-started.md),
 [Release governance](release-governance.md), and [Attempt recovery](bootstrap-recovery.md).
+Existing consumers can retain the registered historical contracts; see
+[Compatible upgrades](getting-started.md#migrating-old-callers).
 The mechanism documents below also describe internal components and historical
 qualification; their implementation ports are not additional consumer APIs.
 

package/docs/code-organization.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-20
+last_reviewed: 2026-09-24
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-20
+  generated_at: 2026-09-24
   visible_context: Buildchain 4.1 source, architecture registries and local validation.
   invisible_context_boundary: No unpublished release or external consumer qualification is claimed.
 ---
@@ -20,9 +20,11 @@ ai_provenance:
 # Code organization
 
 Buildchain 4.1 uses responsibility layers, then capability directories. The
-normal pipeline and exact-attempt recovery workflows are the consumer API.
-Product choices belong in schema-2 TOML; other workflows and every action are
-internal implementation. Source changes require separate published qualification.
+normal pipeline and exact-attempt recovery workflows are the API for new consumers.
+Their product choices belong in schema-2 TOML. Existing consumers retain the
+historical interfaces registered in `architecture/consumer-upgrade.json`; see
+[Compatible upgrades](getting-started.md#migrating-old-callers). Other workflows
+and actions are internal implementation. Source changes require separate published qualification.
 
 ```text
 .github/workflows/                 Consumer APIs and hosted job topology
@@ -118,9 +120,10 @@ the candidate build receipt is an input to that publication proof.
 
 Dependencies point down the layers. Core modules cannot import actions,
 workflows, CLI entries or repository tooling. A moved business implementation
-has one current owner; imports bind directly to that owner. Retired aliases,
-compatibility wrappers, command-hook fallbacks and old execution switches are
-removed. Immutable release and qualification evidence remains historical data.
+has one current owner; imports bind directly to that owner. Registered historical
+workflow paths are generated from their maintained canonical implementations.
+They preserve published contracts without independently maintained copies.
+Immutable release and qualification evidence remains historical data.
 
 `pnpm run check:layout` checks the closed directory vocabulary, action registry,
 entry sizes, node budgets, import direction and reachable JSON input fields.

package/docs/getting-started.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-20
+last_reviewed: 2026-09-23
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-20
+  generated_at: 2026-09-23
   visible_context: Schema-2 initializer, shared caller generator and local validation code.
   invisible_context_boundary: Initialization does not prove hosted publication or provider authorization.
 ---
@@ -90,6 +90,35 @@ replacement source, artifacts or provider-effect parameters.
 
 ## Migrating old callers
 
+Existing schema-1 consumers can keep their product configuration and the historical
+workflow contracts listed in `architecture/consumer-upgrade.json`. These entry
+files are generated from the maintained implementations, preserving historical
+inputs, defaults, outputs and permissions. The compatibility paths do not insert
+another reusable job, so existing required job contexts remain intact. A runtime
+lock continues to select its exact runtime; upgrading a package does not silently
+override the lock. Existing Trusted Publishing configuration remains in use.
+
+The frozen compatibility boundary is the published v4.1.3 entry set, plus the
+v4.0 build/check/release interfaces and the v4.0.9 delivery interface used by
+older consumers. Regression fixtures record 11 calls from libnode, kfd and
+taolu, including their v2/v3/v4 selectors. Those fixtures prove parameter and
+secret admission; they do not by themselves prove a full hosted consumer release.
+Local execution tests cover build artifacts, candidate identity, native delivery,
+publication metadata, KFD witness comparisons, recovery pins and failure propagation.
+
+The old final-version publication mode uses the current provider transaction.
+Retained release callers preserve their existing permission envelope and npm
+Trusted Publishing caller identity. KFD witness files and the two retained
+read-only evidence commands are checked against the selected source and sealed
+candidate, then included as rooted publication evidence. Arbitrary legacy
+publishing or preparation commands are not qualified adapters and fail explicitly;
+old phase-less delivery owner migration is not a verified upgrade path. A consumer
+using these extensions needs separate qualification before upgrading.
+
+Moving such a consumer to the schema-2 caller pair is an optional interface
+migration, separate from updating Buildchain. Do not run the initializer over
+an existing configuration as a prerequisite for a compatible version update.
+
 Schema-1 product-specific workflow callers are not generated by this initializer.
 The old `web-surface` and `infra-contract` initialization modes are outside the
 current schema-2 npm/binary/Paper pipeline; initialization rejects them before

package/docs/migration-inventory.md

@@ -8,20 +8,22 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-09-20
+last_reviewed: 2026-09-24
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-20
-  invisible_context: not asserted
+  generated_at: 2026-09-24
+  visible_context: Dated migration inventory and the registered consumer upgrade contract.
+  invisible_context_boundary: No unpublished release or external consumer qualification is claimed.
 ---
 
 # Buildchain v2 Migration Inventory
 
 This inventory records the dated Buildchain v2 consolidation boundary and its
-v3 successor. The original dispositions below remain historical. Current
-consumers follow the [minimal schema-2 contract](getting-started.md), using only
-the shared normal/recovery pair; historical wrappers are not compatibility APIs.
+v3 successor. The original dispositions below remain historical. New consumers
+follow the [minimal schema-2 contract](getting-started.md) through the shared
+normal/recovery pair. Existing consumers retain the registered historical paths;
+see [Compatible upgrades](getting-started.md#migrating-old-callers).
 Standalone `workflows` and `action-*` repositories are historical rollback
 anchors, not active Buildchain migration targets.
 

package/docs/node-api-reference.md

@@ -115,7 +115,7 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain";` | `packages/core/contracts/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/governance/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain";` | `packages/core/adoption/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/governance/buildchain-publication-authority.js:50` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/governance/buildchain-publication-authority.js:51` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/governance/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain";` | `packages/core/build/build-facts.js:44` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/governance/issue-reporting.js:199` |
@@ -170,7 +170,7 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `consumerPolicyScannerRoot` | function: function consumerPolicyScannerRoot(runtimeRoot = defaultRuntimeRoot()) | runtimeRoot = defaultRuntimeRoot() | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { consumerPolicyScannerRoot } from "@kungfu-tech/buildchain";` | `packages/core/consumer/floating-consumer-policy.js:72` |
 | `contractSummary` | function: function contractSummary(contractWorld, runtimeRef = "", runtimeSha = "") | contractWorld, runtimeRef = "", runtimeSha = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { contractSummary } from "@kungfu-tech/buildchain";` | `packages/core/contracts/buildchain-contract.js:868` |
 | `controllerEvidenceDigest` | function: function controllerEvidenceDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { controllerEvidenceDigest } from "@kungfu-tech/buildchain";` | `packages/core/observability/controller-evidence.js:137` |
-| `createActivationReceiptProjectorAdapter` | function: function createActivationReceiptProjectorAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createActivationReceiptProjectorAdapter } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:181` |
+| `createActivationReceiptProjectorAdapter` | function: function createActivationReceiptProjectorAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createActivationReceiptProjectorAdapter } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:182` |
 | `createAnchoredVersionMaterialEvidence` | function: function createAnchoredVersionMaterialEvidence({ cwd = process.cwd(), targetChannel = "", targetRef = "", alphaRef = "", releaseRef = "HEAD", runLifecycle = true, environment = process.env, } = {}) | { cwd = process.cwd(), targetChannel = "", targetRef = "", alphaRef = "", releaseRef = "HEAD", runLifecycle = true, environment = process.env, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createAnchoredVersionMaterialEvidence } from "@kungfu-tech/buildchain";` | `packages/core/build/anchored-version-material.js:118` |
 | `createArtifactEvidence` | function: function createArtifactEvidence({ assets = [], repository = "", tag = "", sourceSha = "", workflow = {}, kfdAdopter = undefined, } = {}) | { assets = [], repository = "", tag = "", sourceSha = "", workflow = {}, kfdAdopter = undefined, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createArtifactEvidence } from "@kungfu-tech/buildchain";` | `packages/core/release/passport/assembly-artifacts.js:3` |
 | `createArtifactSigningReceipt` | function: function createArtifactSigningReceipt({ request, status = "passed", authority = {}, result = {}, signatures = [], reason = "", } = {}) | { request, status = "passed", authority = {}, result = {}, signatures = [], reason = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createArtifactSigningReceipt } from "@kungfu-tech/buildchain";` | `packages/core/build/artifact-signing.js:374` |
@@ -187,7 +187,7 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain";` | `packages/core/adoption/buildchain-kfd-claims.js:413` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain";` | `packages/core/contracts/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain";` | `packages/core/observability/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/governance/buildchain-publication-authority.js:89` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/governance/buildchain-publication-authority.js:85` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain";` | `packages/core/adoption/buildchain-kfd-claims.js:228` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain";` | `packages/core/observability/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/observability/cache-evidence.js:169` |
@@ -206,10 +206,10 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `createGitHubArtifactAttestationVerificationPlan` | function: function createGitHubArtifactAttestationVerificationPlan({ artifactPath, bundlePath, evidence, } = {}) | { artifactPath, bundlePath, evidence, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGitHubArtifactAttestationVerificationPlan } from "@kungfu-tech/buildchain";` | `packages/core/build/github-artifact-attestation.js:524` |
 | `createGithubGovernanceRolloutPlan` | function: function createGithubGovernanceRolloutPlan({ repository, targetRef, inventory, rollbackSnapshot, rollbackProtectionExists = true, desiredProtection, } = {}) | { repository, targetRef, inventory, rollbackSnapshot, rollbackProtectionExists = true, desiredProtection, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGithubGovernanceRolloutPlan } from "@kungfu-tech/buildchain";` | `packages/core/governance/github-governance-authority.js:928` |
 | `createGitHubIssueRequest` | function: function createGitHubIssueRequest({ token, apiUrl = process.env.GITHUB_API_URL \|\| "https://api.github.com", fetchImpl = globalThis.fetch, retryDelaysMs = DEFAULT_RETRY_DELAYS_MS, } = {}) | { token, apiUrl = process.env.GITHUB_API_URL \|\| "https://api.github.com", fetchImpl = globalThis.fetch, retryDelaysMs = DEFAULT_RETRY_DELAYS_MS, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGitHubIssueRequest } from "@kungfu-tech/buildchain";` | `packages/core/governance/issue-reporting.js:393` |
-| `createGitHubReleaseAssetsAdapter` | function: function createGitHubReleaseAssetsAdapter({ octokit, resolveArtifact, } = {}) | { octokit, resolveArtifact, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGitHubReleaseAssetsAdapter } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:310` |
+| `createGitHubReleaseAssetsAdapter` | function: function createGitHubReleaseAssetsAdapter({ octokit, resolveArtifact, } = {}) | { octokit, resolveArtifact, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGitHubReleaseAssetsAdapter } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:311` |
 | `createGithubRulesetBypassRolloutPlan` | function: function createGithubRulesetBypassRolloutPlan({ repository, rulesetId, inventory, rollbackSnapshot, } = {}) | { repository, rulesetId, inventory, rollbackSnapshot, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGithubRulesetBypassRolloutPlan } from "@kungfu-tech/buildchain";` | `packages/core/governance/github-governance-authority.js:1106` |
 | `createGithubRulesetGovernanceRolloutPlan` | function: function createGithubRulesetGovernanceRolloutPlan({ repository, targetRef, rulesetId, rulesetName, inventory, rollbackSnapshot, desiredProtection, } = {}) | { repository, targetRef, rulesetId, rulesetName, inventory, rollbackSnapshot, desiredProtection, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGithubRulesetGovernanceRolloutPlan } from "@kungfu-tech/buildchain";` | `packages/core/governance/github-governance-authority.js:1185` |
-| `createHttpJsonReadback` | function: function createHttpJsonReadback({ fetchImpl = globalThis.fetch } = {}) | { fetchImpl = globalThis.fetch } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createHttpJsonReadback } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:191` |
+| `createHttpJsonReadback` | function: function createHttpJsonReadback({ fetchImpl = globalThis.fetch } = {}) | { fetchImpl = globalThis.fetch } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createHttpJsonReadback } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:192` |
 | `createKfd1ReleaseGateEvidence` | function: function createKfd1ReleaseGateEvidence({ cwd = process.cwd(), artifactRoot = "", artifacts = [], witnesses = [], verifiedAt = new Date().toISOString(), metadata = resolveKfd1Metadata(), } = {}) | { cwd = process.cwd(), artifactRoot = "", artifacts = [], witnesses = [], verifiedAt = new Date().toISOString(), metadata = resolveKfd1Metadata(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfd1ReleaseGateEvidence } from "@kungfu-tech/buildchain";` | `packages/core/adoption/kfd-gate.js:977` |
 | `createKfd3CollaborationInterfaceReleaseGateEvidence` | function: function createKfd3CollaborationInterfaceReleaseGateEvidence({ prebuildWitnesses = [], artifactWitnesses = [], prebuildWitnessMetas = [], artifactWitnessMetas = [], artifactCommandMeta = undefined, verifiedAt = new Date().toISOString(), metadata = resolveKfd3Metadata(), } = {}) | { prebuildWitnesses = [], artifactWitnesses = [], prebuildWitnessMetas = [], artifactWitnessMetas = [], artifactCommandMeta = undefined, verifiedAt = new Date().toISOString(), metadata = resolveKfd3Metadata(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfd3CollaborationInterfaceReleaseGateEvidence } from "@kungfu-tech/buildchain";` | `packages/core/adoption/kfd-gate.js:1132` |
 | `createKfd3SurfaceWitness` | function: function createKfd3SurfaceWitness({ cwd = process.cwd(), registryPath = "", kind = "prebuild", sourceSha = "", artifactPath = "", } = {}) | { cwd = process.cwd(), registryPath = "", kind = "prebuild", sourceSha = "", artifactPath = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | network | `import { createKfd3SurfaceWitness } from "@kungfu-tech/buildchain";` | `packages/core/adoption/kfd3-surface-register.js:702` |
@@ -248,8 +248,8 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `createReleaseTransaction` | function: function createReleaseTransaction({ repository, version, exactTag = "", channel, line = "", sourceSha, targetRef, releaseSha, releaseMaterialSha = releaseSha, publishToolingSha = "", lifecycleIdentity = "lifecycle.publish", statePath = "", evidencePath = "", actor = "", runId = "", } = {}) | { repository, version, exactTag = "", channel, line = "", sourceSha, targetRef, releaseSha, releaseMaterialSha = releaseSha, publishToolingSha = "", lifecycleIdentity = "lifecycle.publish", statePath = "", evidencePath = "", actor = "", runId = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createReleaseTransaction } from "@kungfu-tech/buildchain";` | `packages/core/release/publish-transaction.js:197` |
 | `createRunnerProvenance` | function: function createRunnerProvenance({ runnerClass, os, architecture, imageDigest, measurementDigest, baselineDigest = "", toolchainDigest = "", cacheContractDigest = "", taskIsolationDigest = "", cleanBaselineProven = false, isolation = "", } = {}) | { runnerClass, os, architecture, imageDigest, measurementDigest, baselineDigest = "", toolchainDigest = "", cacheContractDigest = "", taskIsolationDigest = "", cleanBaselineProven = false, isolation = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createRunnerProvenance } from "@kungfu-tech/buildchain";` | `packages/core/publication/publication-authority.js:166` |
 | `createRuntimeResumeLineage` | function: function createRuntimeResumeLineage({ repository, buildAttempt, resumeAttempt, source, consumerPolicyReceiptRoot, requiredPlatforms, stageCapsules, resumePlanRoot, finalPublicReadbackRoot, } = {}) | { repository, buildAttempt, resumeAttempt, source, consumerPolicyReceiptRoot, requiredPlatforms, stageCapsules, resumePlanRoot, finalPublicReadbackRoot, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createRuntimeResumeLineage } from "@kungfu-tech/buildchain";` | `packages/core/release/recovery/lineage.js:89` |
-| `createSignedStaticChannelAdapter` | function: function createSignedStaticChannelAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSignedStaticChannelAdapter } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:161` |
-| `createSiteReleaseActivationAdapter` | function: function createSiteReleaseActivationAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSiteReleaseActivationAdapter } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:171` |
+| `createSignedStaticChannelAdapter` | function: function createSignedStaticChannelAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSignedStaticChannelAdapter } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:162` |
+| `createSiteReleaseActivationAdapter` | function: function createSiteReleaseActivationAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSiteReleaseActivationAdapter } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:172` |
 | `createStableCandidateLedger` | function: function createStableCandidateLedger({ repository, targetBranch, now = new Date().toISOString() } = {}) | { repository, targetBranch, now = new Date().toISOString() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createStableCandidateLedger } from "@kungfu-tech/buildchain";` | `packages/core/release/stable-candidate-ledger.js:56` |
 | `createSurfaceTimestampPolicy` | function: function createSurfaceTimestampPolicy({ generatedAt = "", publishedAt = "", sourceDateEpoch = process.env.SOURCE_DATE_EPOCH \|\| DEFAULT_SOURCE_DATE_EPOCH, sourceRevision = "", deterministicInputs = [], timestampPolicy = "", timestampFields = ["generatedAt", "publishedAt"], timestampFieldsParticipateInArtifactDigest = true, artifactDigestScope = "manifest-and-artifact", reproducible = true, } = {}) | { generatedAt = "", publishedAt = "", sourceDateEpoch = process.env.SOURCE_DATE_EPOCH \|\| DEFAULT_SOURCE_DATE_EPOCH, sourceRevision = "", deterministicInputs = [], timestampPolicy = "", timestampFields = ["generatedAt", "publishedAt"], timestampFieldsParticipateInArtifactDigest = true, artifactDigestScope = "manifest-and-artifact", reproducible = true, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSurfaceTimestampPolicy } from "@kungfu-tech/buildchain";` | `packages/core/contracts/surface-manifest.js:34` |
 | `createWebSurfaceProductionDecision` | function: function createWebSurfaceProductionDecision({ approved, kind, repository, sourceSha, actor, actorPermission = "", releasePr = 0, releaseSource = "", reason, } = {}) | { approved, kind, repository, sourceSha, actor, actorPermission = "", releasePr = 0, releaseSource = "", reason, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createWebSurfaceProductionDecision } from "@kungfu-tech/buildchain";` | `packages/core/web/web-surface-publication-candidate.js:45` |
@@ -330,7 +330,7 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `GitHubHousekeeperClient` | class: class GitHubHousekeeperClient | none | GitHubHousekeeperClient | Construction and method errors follow the linked source implementation. | class-dependent | `import { GitHubHousekeeperClient } from "@kungfu-tech/buildchain";` | `packages/core/governance/engineering-housekeeper-github-client.js:54` |
 | `GitHubHousekeeperProviderError` | class: class GitHubHousekeeperProviderError | none | GitHubHousekeeperProviderError | Construction and method errors follow the linked source implementation. | class-dependent | `import { GitHubHousekeeperProviderError } from "@kungfu-tech/buildchain";` | `packages/core/governance/engineering-housekeeper-github-client.js:37` |
 | `GitHubIssueRequestError` | class: class GitHubIssueRequestError | none | GitHubIssueRequestError | Construction and method errors follow the linked source implementation. | class-dependent | `import { GitHubIssueRequestError } from "@kungfu-tech/buildchain";` | `packages/core/governance/issue-reporting.js:23` |
-| `githubReleaseAssetsTargetRoot` | function: function githubReleaseAssetsTargetRoot({ destination, artifacts }) | { destination, artifacts } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { githubReleaseAssetsTargetRoot } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:297` |
+| `githubReleaseAssetsTargetRoot` | function: function githubReleaseAssetsTargetRoot({ destination, artifacts }) | { destination, artifacts } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { githubReleaseAssetsTargetRoot } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:298` |
 | `HOMEBREW_TAP_CHECK_CONTRACT` | constant: const HOMEBREW_TAP_CHECK_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { HOMEBREW_TAP_CHECK_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/build/homebrew.js:8` |
 | `HOMEBREW_TAP_FACTS_CONTRACT` | constant: const HOMEBREW_TAP_FACTS_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { HOMEBREW_TAP_FACTS_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/build/homebrew.js:7` |
 | `HOMEBREW_TAP_MANIFEST_CONTRACT` | constant: const HOMEBREW_TAP_MANIFEST_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { HOMEBREW_TAP_MANIFEST_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/build/homebrew.js:9` |
@@ -517,7 +517,7 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `RELEASE_TAIL_TRANSACTION_SCHEMA` | constant: const RELEASE_TAIL_TRANSACTION_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_TRANSACTION_SCHEMA } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-plane.js:10` |
 | `releaseActivationRoot` | function: function releaseActivationRoot(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { releaseActivationRoot } from "@kungfu-tech/buildchain";` | `packages/core/release/release-activation-transaction.js:38` |
 | `ReleaseCandidateRecoveryError` | class: class ReleaseCandidateRecoveryError | none | ReleaseCandidateRecoveryError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseCandidateRecoveryError } from "@kungfu-tech/buildchain";` | `packages/core/release/release-candidate-recovery.js:57` |
-| `ReleaseTailProviderError` | class: class ReleaseTailProviderError | none | ReleaseTailProviderError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseTailProviderError } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:9` |
+| `ReleaseTailProviderError` | class: class ReleaseTailProviderError | none | ReleaseTailProviderError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseTailProviderError } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-adapters.js:10` |
 | `releaseTailRetryPolicyFromDeclaration` | function: function releaseTailRetryPolicyFromDeclaration(input) | input | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { releaseTailRetryPolicyFromDeclaration } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-plane.js:227` |
 | `releaseTailRoot` | function: function releaseTailRoot(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { releaseTailRoot } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-plane.js:78` |
 | `releaseTailStableJson` | function: function releaseTailStableJson(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { releaseTailStableJson } from "@kungfu-tech/buildchain";` | `packages/core/release/release-tail-provider-plane.js:73` |
@@ -783,7 +783,7 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain/core";` | `packages/core/contracts/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain/core";` | `packages/core/adoption/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/buildchain-publication-authority.js:50` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/buildchain-publication-authority.js:51` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/build/build-facts.js:44` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/issue-reporting.js:199` |
@@ -838,7 +838,7 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `consumerPolicyScannerRoot` | function: function consumerPolicyScannerRoot(runtimeRoot = defaultRuntimeRoot()) | runtimeRoot = defaultRuntimeRoot() | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { consumerPolicyScannerRoot } from "@kungfu-tech/buildchain/core";` | `packages/core/consumer/floating-consumer-policy.js:72` |
 | `contractSummary` | function: function contractSummary(contractWorld, runtimeRef = "", runtimeSha = "") | contractWorld, runtimeRef = "", runtimeSha = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { contractSummary } from "@kungfu-tech/buildchain/core";` | `packages/core/contracts/buildchain-contract.js:868` |
 | `controllerEvidenceDigest` | function: function controllerEvidenceDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { controllerEvidenceDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/observability/controller-evidence.js:137` |
-| `createActivationReceiptProjectorAdapter` | function: function createActivationReceiptProjectorAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createActivationReceiptProjectorAdapter } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:181` |
+| `createActivationReceiptProjectorAdapter` | function: function createActivationReceiptProjectorAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createActivationReceiptProjectorAdapter } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:182` |
 | `createAnchoredVersionMaterialEvidence` | function: function createAnchoredVersionMaterialEvidence({ cwd = process.cwd(), targetChannel = "", targetRef = "", alphaRef = "", releaseRef = "HEAD", runLifecycle = true, environment = process.env, } = {}) | { cwd = process.cwd(), targetChannel = "", targetRef = "", alphaRef = "", releaseRef = "HEAD", runLifecycle = true, environment = process.env, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createAnchoredVersionMaterialEvidence } from "@kungfu-tech/buildchain/core";` | `packages/core/build/anchored-version-material.js:118` |
 | `createArtifactEvidence` | function: function createArtifactEvidence({ assets = [], repository = "", tag = "", sourceSha = "", workflow = {}, kfdAdopter = undefined, } = {}) | { assets = [], repository = "", tag = "", sourceSha = "", workflow = {}, kfdAdopter = undefined, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createArtifactEvidence } from "@kungfu-tech/buildchain/core";` | `packages/core/release/passport/assembly-artifacts.js:3` |
 | `createArtifactSigningReceipt` | function: function createArtifactSigningReceipt({ request, status = "passed", authority = {}, result = {}, signatures = [], reason = "", } = {}) | { request, status = "passed", authority = {}, result = {}, signatures = [], reason = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createArtifactSigningReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/build/artifact-signing.js:374` |
@@ -855,7 +855,7 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/adoption/buildchain-kfd-claims.js:413` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain/core";` | `packages/core/contracts/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain/core";` | `packages/core/observability/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/buildchain-publication-authority.js:89` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/buildchain-publication-authority.js:85` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain/core";` | `packages/core/adoption/buildchain-kfd-claims.js:228` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain/core";` | `packages/core/observability/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/observability/cache-evidence.js:169` |
@@ -874,10 +874,10 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `createGitHubArtifactAttestationVerificationPlan` | function: function createGitHubArtifactAttestationVerificationPlan({ artifactPath, bundlePath, evidence, } = {}) | { artifactPath, bundlePath, evidence, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGitHubArtifactAttestationVerificationPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/build/github-artifact-attestation.js:524` |
 | `createGithubGovernanceRolloutPlan` | function: function createGithubGovernanceRolloutPlan({ repository, targetRef, inventory, rollbackSnapshot, rollbackProtectionExists = true, desiredProtection, } = {}) | { repository, targetRef, inventory, rollbackSnapshot, rollbackProtectionExists = true, desiredProtection, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGithubGovernanceRolloutPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/github-governance-authority.js:928` |
 | `createGitHubIssueRequest` | function: function createGitHubIssueRequest({ token, apiUrl = process.env.GITHUB_API_URL \|\| "https://api.github.com", fetchImpl = globalThis.fetch, retryDelaysMs = DEFAULT_RETRY_DELAYS_MS, } = {}) | { token, apiUrl = process.env.GITHUB_API_URL \|\| "https://api.github.com", fetchImpl = globalThis.fetch, retryDelaysMs = DEFAULT_RETRY_DELAYS_MS, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGitHubIssueRequest } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/issue-reporting.js:393` |
-| `createGitHubReleaseAssetsAdapter` | function: function createGitHubReleaseAssetsAdapter({ octokit, resolveArtifact, } = {}) | { octokit, resolveArtifact, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGitHubReleaseAssetsAdapter } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:310` |
+| `createGitHubReleaseAssetsAdapter` | function: function createGitHubReleaseAssetsAdapter({ octokit, resolveArtifact, } = {}) | { octokit, resolveArtifact, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGitHubReleaseAssetsAdapter } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:311` |
 | `createGithubRulesetBypassRolloutPlan` | function: function createGithubRulesetBypassRolloutPlan({ repository, rulesetId, inventory, rollbackSnapshot, } = {}) | { repository, rulesetId, inventory, rollbackSnapshot, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGithubRulesetBypassRolloutPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/github-governance-authority.js:1106` |
 | `createGithubRulesetGovernanceRolloutPlan` | function: function createGithubRulesetGovernanceRolloutPlan({ repository, targetRef, rulesetId, rulesetName, inventory, rollbackSnapshot, desiredProtection, } = {}) | { repository, targetRef, rulesetId, rulesetName, inventory, rollbackSnapshot, desiredProtection, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGithubRulesetGovernanceRolloutPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/github-governance-authority.js:1185` |
-| `createHttpJsonReadback` | function: function createHttpJsonReadback({ fetchImpl = globalThis.fetch } = {}) | { fetchImpl = globalThis.fetch } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createHttpJsonReadback } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:191` |
+| `createHttpJsonReadback` | function: function createHttpJsonReadback({ fetchImpl = globalThis.fetch } = {}) | { fetchImpl = globalThis.fetch } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createHttpJsonReadback } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:192` |
 | `createKfd1ReleaseGateEvidence` | function: function createKfd1ReleaseGateEvidence({ cwd = process.cwd(), artifactRoot = "", artifacts = [], witnesses = [], verifiedAt = new Date().toISOString(), metadata = resolveKfd1Metadata(), } = {}) | { cwd = process.cwd(), artifactRoot = "", artifacts = [], witnesses = [], verifiedAt = new Date().toISOString(), metadata = resolveKfd1Metadata(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfd1ReleaseGateEvidence } from "@kungfu-tech/buildchain/core";` | `packages/core/adoption/kfd-gate.js:977` |
 | `createKfd3CollaborationInterfaceReleaseGateEvidence` | function: function createKfd3CollaborationInterfaceReleaseGateEvidence({ prebuildWitnesses = [], artifactWitnesses = [], prebuildWitnessMetas = [], artifactWitnessMetas = [], artifactCommandMeta = undefined, verifiedAt = new Date().toISOString(), metadata = resolveKfd3Metadata(), } = {}) | { prebuildWitnesses = [], artifactWitnesses = [], prebuildWitnessMetas = [], artifactWitnessMetas = [], artifactCommandMeta = undefined, verifiedAt = new Date().toISOString(), metadata = resolveKfd3Metadata(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfd3CollaborationInterfaceReleaseGateEvidence } from "@kungfu-tech/buildchain/core";` | `packages/core/adoption/kfd-gate.js:1132` |
 | `createKfd3SurfaceWitness` | function: function createKfd3SurfaceWitness({ cwd = process.cwd(), registryPath = "", kind = "prebuild", sourceSha = "", artifactPath = "", } = {}) | { cwd = process.cwd(), registryPath = "", kind = "prebuild", sourceSha = "", artifactPath = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | network | `import { createKfd3SurfaceWitness } from "@kungfu-tech/buildchain/core";` | `packages/core/adoption/kfd3-surface-register.js:702` |
@@ -916,8 +916,8 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `createReleaseTransaction` | function: function createReleaseTransaction({ repository, version, exactTag = "", channel, line = "", sourceSha, targetRef, releaseSha, releaseMaterialSha = releaseSha, publishToolingSha = "", lifecycleIdentity = "lifecycle.publish", statePath = "", evidencePath = "", actor = "", runId = "", } = {}) | { repository, version, exactTag = "", channel, line = "", sourceSha, targetRef, releaseSha, releaseMaterialSha = releaseSha, publishToolingSha = "", lifecycleIdentity = "lifecycle.publish", statePath = "", evidencePath = "", actor = "", runId = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createReleaseTransaction } from "@kungfu-tech/buildchain/core";` | `packages/core/release/publish-transaction.js:197` |
 | `createRunnerProvenance` | function: function createRunnerProvenance({ runnerClass, os, architecture, imageDigest, measurementDigest, baselineDigest = "", toolchainDigest = "", cacheContractDigest = "", taskIsolationDigest = "", cleanBaselineProven = false, isolation = "", } = {}) | { runnerClass, os, architecture, imageDigest, measurementDigest, baselineDigest = "", toolchainDigest = "", cacheContractDigest = "", taskIsolationDigest = "", cleanBaselineProven = false, isolation = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createRunnerProvenance } from "@kungfu-tech/buildchain/core";` | `packages/core/publication/publication-authority.js:166` |
 | `createRuntimeResumeLineage` | function: function createRuntimeResumeLineage({ repository, buildAttempt, resumeAttempt, source, consumerPolicyReceiptRoot, requiredPlatforms, stageCapsules, resumePlanRoot, finalPublicReadbackRoot, } = {}) | { repository, buildAttempt, resumeAttempt, source, consumerPolicyReceiptRoot, requiredPlatforms, stageCapsules, resumePlanRoot, finalPublicReadbackRoot, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createRuntimeResumeLineage } from "@kungfu-tech/buildchain/core";` | `packages/core/release/recovery/lineage.js:89` |
-| `createSignedStaticChannelAdapter` | function: function createSignedStaticChannelAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSignedStaticChannelAdapter } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:161` |
-| `createSiteReleaseActivationAdapter` | function: function createSiteReleaseActivationAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSiteReleaseActivationAdapter } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:171` |
+| `createSignedStaticChannelAdapter` | function: function createSignedStaticChannelAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSignedStaticChannelAdapter } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:162` |
+| `createSiteReleaseActivationAdapter` | function: function createSiteReleaseActivationAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSiteReleaseActivationAdapter } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:172` |
 | `createStableCandidateLedger` | function: function createStableCandidateLedger({ repository, targetBranch, now = new Date().toISOString() } = {}) | { repository, targetBranch, now = new Date().toISOString() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createStableCandidateLedger } from "@kungfu-tech/buildchain/core";` | `packages/core/release/stable-candidate-ledger.js:56` |
 | `createSurfaceTimestampPolicy` | function: function createSurfaceTimestampPolicy({ generatedAt = "", publishedAt = "", sourceDateEpoch = process.env.SOURCE_DATE_EPOCH \|\| DEFAULT_SOURCE_DATE_EPOCH, sourceRevision = "", deterministicInputs = [], timestampPolicy = "", timestampFields = ["generatedAt", "publishedAt"], timestampFieldsParticipateInArtifactDigest = true, artifactDigestScope = "manifest-and-artifact", reproducible = true, } = {}) | { generatedAt = "", publishedAt = "", sourceDateEpoch = process.env.SOURCE_DATE_EPOCH \|\| DEFAULT_SOURCE_DATE_EPOCH, sourceRevision = "", deterministicInputs = [], timestampPolicy = "", timestampFields = ["generatedAt", "publishedAt"], timestampFieldsParticipateInArtifactDigest = true, artifactDigestScope = "manifest-and-artifact", reproducible = true, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSurfaceTimestampPolicy } from "@kungfu-tech/buildchain/core";` | `packages/core/contracts/surface-manifest.js:34` |
 | `createWebSurfaceProductionDecision` | function: function createWebSurfaceProductionDecision({ approved, kind, repository, sourceSha, actor, actorPermission = "", releasePr = 0, releaseSource = "", reason, } = {}) | { approved, kind, repository, sourceSha, actor, actorPermission = "", releasePr = 0, releaseSource = "", reason, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createWebSurfaceProductionDecision } from "@kungfu-tech/buildchain/core";` | `packages/core/web/web-surface-publication-candidate.js:45` |
@@ -998,7 +998,7 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `GitHubHousekeeperClient` | class: class GitHubHousekeeperClient | none | GitHubHousekeeperClient | Construction and method errors follow the linked source implementation. | class-dependent | `import { GitHubHousekeeperClient } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/engineering-housekeeper-github-client.js:54` |
 | `GitHubHousekeeperProviderError` | class: class GitHubHousekeeperProviderError | none | GitHubHousekeeperProviderError | Construction and method errors follow the linked source implementation. | class-dependent | `import { GitHubHousekeeperProviderError } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/engineering-housekeeper-github-client.js:37` |
 | `GitHubIssueRequestError` | class: class GitHubIssueRequestError | none | GitHubIssueRequestError | Construction and method errors follow the linked source implementation. | class-dependent | `import { GitHubIssueRequestError } from "@kungfu-tech/buildchain/core";` | `packages/core/governance/issue-reporting.js:23` |
-| `githubReleaseAssetsTargetRoot` | function: function githubReleaseAssetsTargetRoot({ destination, artifacts }) | { destination, artifacts } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { githubReleaseAssetsTargetRoot } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:297` |
+| `githubReleaseAssetsTargetRoot` | function: function githubReleaseAssetsTargetRoot({ destination, artifacts }) | { destination, artifacts } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { githubReleaseAssetsTargetRoot } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:298` |
 | `HOMEBREW_TAP_CHECK_CONTRACT` | constant: const HOMEBREW_TAP_CHECK_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { HOMEBREW_TAP_CHECK_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/build/homebrew.js:8` |
 | `HOMEBREW_TAP_FACTS_CONTRACT` | constant: const HOMEBREW_TAP_FACTS_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { HOMEBREW_TAP_FACTS_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/build/homebrew.js:7` |
 | `HOMEBREW_TAP_MANIFEST_CONTRACT` | constant: const HOMEBREW_TAP_MANIFEST_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { HOMEBREW_TAP_MANIFEST_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/build/homebrew.js:9` |
@@ -1185,7 +1185,7 @@ Target: `./packages/core/index.js`. Public symbols: 618.
 | `RELEASE_TAIL_TRANSACTION_SCHEMA` | constant: const RELEASE_TAIL_TRANSACTION_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_TAIL_TRANSACTION_SCHEMA } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-plane.js:10` |
 | `releaseActivationRoot` | function: function releaseActivationRoot(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { releaseActivationRoot } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-activation-transaction.js:38` |
 | `ReleaseCandidateRecoveryError` | class: class ReleaseCandidateRecoveryError | none | ReleaseCandidateRecoveryError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseCandidateRecoveryError } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-candidate-recovery.js:57` |
-| `ReleaseTailProviderError` | class: class ReleaseTailProviderError | none | ReleaseTailProviderError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseTailProviderError } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:9` |
+| `ReleaseTailProviderError` | class: class ReleaseTailProviderError | none | ReleaseTailProviderError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseTailProviderError } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-adapters.js:10` |
 | `releaseTailRetryPolicyFromDeclaration` | function: function releaseTailRetryPolicyFromDeclaration(input) | input | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { releaseTailRetryPolicyFromDeclaration } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-plane.js:227` |
 | `releaseTailRoot` | function: function releaseTailRoot(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { releaseTailRoot } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-plane.js:78` |
 | `releaseTailStableJson` | function: function releaseTailStableJson(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { releaseTailStableJson } from "@kungfu-tech/buildchain/core";` | `packages/core/release/release-tail-provider-plane.js:73` |
@@ -1643,9 +1643,9 @@ Target: `./packages/core/dev-delivery/dev-delivery-warrant.js`. Public symbols:
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `cancelQueuedDevDeliveryCandidate` | function: function cancelQueuedDevDeliveryCandidate(queueInput, input, options) | queueInput, input, options | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { cancelQueuedDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:519` |
+| `cancelQueuedDevDeliveryCandidate` | function: function cancelQueuedDevDeliveryCandidate(queueInput, input, options) | queueInput, input, options | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { cancelQueuedDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:522` |
 | `classifyDevDeliveryDelta` | function: function classifyDevDeliveryDelta({ proof, current = {} } = {}) | { proof, current = {} } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { classifyDevDeliveryDelta } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-proof.js:105` |
-| `closeDevDeliveryWarrant` | function: function closeDevDeliveryWarrant(queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {}) | queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { closeDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:395` |
+| `closeDevDeliveryWarrant` | function: function closeDevDeliveryWarrant(queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {}) | queueInput, warrant, { outcome, evidenceRoot, reason = "", providerFailureAuthority = null, now = new Date().toISOString(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { closeDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:396` |
 | `createDevDeliveryQueue` | value: createDevDeliveryQueue | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { createDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:1` |
 | `createIntegrationDeliveryProof` | function: function createIntegrationDeliveryProof(input = {}) | input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createIntegrationDeliveryProof } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-proof.js:237` |
 | `createNativeCommandContract` | value: createNativeCommandContract | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { createNativeCommandContract } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-native-proof.js:1` |
@@ -1674,7 +1674,7 @@ Target: `./packages/core/dev-delivery/dev-delivery-warrant.js`. Public symbols:
 | `DEV_DELIVERY_WRITER_PROTOCOL_FENCE_RECEIPT_SCHEMA` | value: DEV_DELIVERY_WRITER_PROTOCOL_FENCE_RECEIPT_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_WRITER_PROTOCOL_FENCE_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:1` |
 | `devDeliveryContentRoot` | function: function devDeliveryContentRoot(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { devDeliveryContentRoot } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-common.js:27` |
 | `fenceDevDeliveryWriterProtocol` | value: fenceDevDeliveryWriterProtocol | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { fenceDevDeliveryWriterProtocol } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:1` |
-| `heartbeatDevDeliveryWarrant` | function: function heartbeatDevDeliveryWarrant(queueInput, warrant, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, warrant, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { heartbeatDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:266` |
+| `heartbeatDevDeliveryWarrant` | function: function heartbeatDevDeliveryWarrant(queueInput, warrant, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, warrant, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { heartbeatDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:267` |
 | `INTEGRATION_DELIVERY_PROOF_SCHEMA` | constant: const INTEGRATION_DELIVERY_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { INTEGRATION_DELIVERY_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-proof.js:6` |
 | `NATIVE_COMMAND_CONTRACT_SCHEMA` | value: NATIVE_COMMAND_CONTRACT_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { NATIVE_COMMAND_CONTRACT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-native-proof.js:1` |
 | `NATIVE_EXECUTION_BINDING_SCHEMA` | value: NATIVE_EXECUTION_BINDING_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { NATIVE_EXECUTION_BINDING_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-native-proof.js:1` |
@@ -1684,16 +1684,16 @@ Target: `./packages/core/dev-delivery/dev-delivery-warrant.js`. Public symbols:
 | `NATIVE_QUALIFICATION_PROOF_SCHEMA` | constant: const NATIVE_QUALIFICATION_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { NATIVE_QUALIFICATION_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-native-proof.js:31` |
 | `normalizeDevDeliveryQueue` | value: normalizeDevDeliveryQueue | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { normalizeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:1` |
 | `normalizeNativeCommandContract` | value: normalizeNativeCommandContract | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { normalizeNativeCommandContract } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-native-proof.js:1` |
-| `observeDevDeliveryQueue` | function: function observeDevDeliveryQueue(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { observeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:533` |
+| `observeDevDeliveryQueue` | function: function observeDevDeliveryQueue(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { observeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:536` |
 | `PROJECT_CUT_REPLAY_PROOF_SCHEMA` | constant: const PROJECT_CUT_REPLAY_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { PROJECT_CUT_REPLAY_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-proof.js:5` |
-| `qualifyDevDeliveryWarrant` | constant: const qualifyDevDeliveryWarrant | none | value | Import does not declare a throw contract. | none-on-import | `import { qualifyDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:391` |
+| `qualifyDevDeliveryWarrant` | constant: const qualifyDevDeliveryWarrant | none | value | Import does not declare a throw contract. | none-on-import | `import { qualifyDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:392` |
 | `rankDevDeliveryCandidates` | value: rankDevDeliveryCandidates | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { rankDevDeliveryCandidates } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:1` |
-| `reconcileDevDeliveryTerminalEvidence` | constant: const reconcileDevDeliveryTerminalEvidence | none | value | Import does not declare a throw contract. | none-on-import | `import { reconcileDevDeliveryTerminalEvidence } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:528` |
-| `recoverExpiredDevDeliveryWarrant` | function: function recoverExpiredDevDeliveryWarrant(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoverExpiredDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:312` |
+| `reconcileDevDeliveryTerminalEvidence` | constant: const reconcileDevDeliveryTerminalEvidence | none | value | Import does not declare a throw contract. | none-on-import | `import { reconcileDevDeliveryTerminalEvidence } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:531` |
+| `recoverExpiredDevDeliveryWarrant` | function: function recoverExpiredDevDeliveryWarrant(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoverExpiredDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:313` |
 | `RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA` | constant: const RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/release/release-blocker-priority.js:15` |
 | `REUSABLE_SOURCE_QUALIFICATION_PROOF_SCHEMA` | constant: const REUSABLE_SOURCE_QUALIFICATION_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { REUSABLE_SOURCE_QUALIFICATION_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-proof.js:4` |
-| `selectDevDeliveryWarrant` | function: function selectDevDeliveryWarrant(queueInput, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { selectDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:106` |
-| `settleDevDeliveryTerminalEvent` | constant: const settleDevDeliveryTerminalEvent | none | value | Import does not declare a throw contract. | none-on-import | `import { settleDevDeliveryTerminalEvent } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:522` |
+| `selectDevDeliveryWarrant` | function: function selectDevDeliveryWarrant(queueInput, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { selectDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:107` |
+| `settleDevDeliveryTerminalEvent` | constant: const settleDevDeliveryTerminalEvent | none | value | Import does not declare a throw contract. | none-on-import | `import { settleDevDeliveryTerminalEvent } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:525` |
 | `SOURCE_QUALIFICATION_PROOF_SCHEMA` | constant: const SOURCE_QUALIFICATION_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { SOURCE_QUALIFICATION_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-proof.js:3` |
 | `submitDevDeliveryCandidate` | value: submitDevDeliveryCandidate | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { submitDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-warrant.js:1` |
 | `verifyIntegrationDeliveryProof` | function: function verifyIntegrationDeliveryProof(proofInput, expected = {}) | proofInput, expected = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyIntegrationDeliveryProof } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery/dev-delivery-proof.js:258` |
@@ -2188,8 +2188,8 @@ Target: `./packages/core/governance/buildchain-publication-authority.js`. Public
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/governance/buildchain-publication-authority.js:50` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/governance/buildchain-publication-authority.js:89` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/governance/buildchain-publication-authority.js:51` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/governance/buildchain-publication-authority.js:85` |
 
 ## `@kungfu-tech/buildchain/github-governance-authority`
 
@@ -2532,13 +2532,13 @@ Target: `./packages/core/release/release-tail-provider-adapters.js`. Public symb
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `createActivationReceiptProjectorAdapter` | function: function createActivationReceiptProjectorAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createActivationReceiptProjectorAdapter } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:181` |
-| `createGitHubReleaseAssetsAdapter` | function: function createGitHubReleaseAssetsAdapter({ octokit, resolveArtifact, } = {}) | { octokit, resolveArtifact, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGitHubReleaseAssetsAdapter } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:310` |
-| `createHttpJsonReadback` | function: function createHttpJsonReadback({ fetchImpl = globalThis.fetch } = {}) | { fetchImpl = globalThis.fetch } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createHttpJsonReadback } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:191` |
-| `createSignedStaticChannelAdapter` | function: function createSignedStaticChannelAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSignedStaticChannelAdapter } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:161` |
-| `createSiteReleaseActivationAdapter` | function: function createSiteReleaseActivationAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSiteReleaseActivationAdapter } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:171` |
-| `githubReleaseAssetsTargetRoot` | function: function githubReleaseAssetsTargetRoot({ destination, artifacts }) | { destination, artifacts } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { githubReleaseAssetsTargetRoot } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:297` |
-| `ReleaseTailProviderError` | class: class ReleaseTailProviderError | none | ReleaseTailProviderError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseTailProviderError } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:9` |
+| `createActivationReceiptProjectorAdapter` | function: function createActivationReceiptProjectorAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createActivationReceiptProjectorAdapter } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:182` |
+| `createGitHubReleaseAssetsAdapter` | function: function createGitHubReleaseAssetsAdapter({ octokit, resolveArtifact, } = {}) | { octokit, resolveArtifact, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createGitHubReleaseAssetsAdapter } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:311` |
+| `createHttpJsonReadback` | function: function createHttpJsonReadback({ fetchImpl = globalThis.fetch } = {}) | { fetchImpl = globalThis.fetch } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createHttpJsonReadback } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:192` |
+| `createSignedStaticChannelAdapter` | function: function createSignedStaticChannelAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSignedStaticChannelAdapter } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:162` |
+| `createSiteReleaseActivationAdapter` | function: function createSiteReleaseActivationAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSiteReleaseActivationAdapter } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:172` |
+| `githubReleaseAssetsTargetRoot` | function: function githubReleaseAssetsTargetRoot({ destination, artifacts }) | { destination, artifacts } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { githubReleaseAssetsTargetRoot } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:298` |
+| `ReleaseTailProviderError` | class: class ReleaseTailProviderError | none | ReleaseTailProviderError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseTailProviderError } from "@kungfu-tech/buildchain/release-tail-provider-adapters";` | `packages/core/release/release-tail-provider-adapters.js:10` |
 
 ## `@kungfu-tech/buildchain/surface-manifest`
 

package/docs/workflow-path-migration.md

@@ -8,22 +8,23 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-20
+last_reviewed: 2026-09-24
 ai_provenance:
   model_family: GPT-6
   product: Codex
-  generated_at: 2026-09-20
-  visible_context: Exact GitHub channel refs and workflow files on 23 organization default branches
+  generated_at: 2026-09-24
+  visible_context: Retained dated migration observations and the registered consumer upgrade contract.
   invisible_context_boundary: Other branches, private or unlisted consumers and future floating ref updates were not established by this audit
 ---
 
 # Version-prefixed workflow path migration
 
 This page retains the dated 2026-09-05/06 migration observations. Its paths and
-channel readbacks are historical, not current consumer instructions. The current
-contract uses `public-ops-pipeline.yml` and `public-ops-recover.yml`; see
-[Getting started](getting-started.md). Former product-specific public workflows
-are now internal components, with no consumer compatibility aliases.
+channel readbacks are historical, not current consumer instructions. New consumers
+use `public-ops-pipeline.yml` and `public-ops-recover.yml`. Existing consumers
+retain the registered historical paths described in
+[Compatible upgrades](getting-started.md#migrating-old-callers). The retirement
+descriptions below remain dated observations of that earlier migration.
 
 This source change retires three filenames. Their reusable capabilities, inputs,
 outputs, jobs and permission envelopes remain at the canonical paths below.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.1.6",
+  "version": "4.1.7",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/build/artifact/contracts.js

@@ -2,15 +2,23 @@ import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 import { rootOf, readJson } from "../plan/values.js";
+import { resolveArtifactContract } from "./naming.js";
 
 export function artifactNames(plan, platform) {
   const base = plan.artifacts.name;
   const sha = plan.source.sha;
   const lane = `${platform.id}-${sha}`;
   const attempt = `${plan.run.id}-${plan.run.attempt}`;
+  const payload = plan.artifacts.name_template ? resolveArtifactContract({
+    artifactName: base, artifactNameTemplate: plan.artifacts.name_template,
+    platformId: platform.id, platformName: platform.name,
+    sha, ref: plan.source.ref, runId: plan.run.id, runAttempt: plan.run.attempt,
+  }).artifactName : `${base}-${lane}`;
+  const historical = plan.identity.visible_workflow === ".github/workflows/build.yml";
   return {
-    payload: `${base}-${lane}`,
-    final: `${base}-final-${lane}`,
+    payload,
+    transfer: historical ? `${base}-unfinalized-${lane}-${attempt}` : payload,
+    final: historical ? payload : `${base}-final-${lane}`,
     manifest: `${base}-manifest-${lane}`,
     diagnostics: `${base}-diagnostics-${lane}`,
     execution: `${base}-execution-${lane}`,

package/packages/core/build/artifact/transport.js

@@ -41,7 +41,7 @@ async function downloadBuild(
     return validateReference(
       matches[0].ref,
       plan,
-      role === "credential" ? names.credentialInput : names[role],
+      role === "credential" ? names.credentialInput : role === "payload" ? names.transfer : names[role],
     );
   };
   if (!payload) return { execution, get };