{ "schemaVersion": 1, "contract": "kungfu-buildchain-maintainability-policy", "baseline": "architecture/maintainability-baseline.json", "enforcementRevision": "5308189b09bcb5a1314195412f2807a40d678838", "repositoryBudgets": { "baselineRevision": "c70e6ac28431888b24fefc218246cc69f8dde85a", "maxHandMaintainedSourceFiles": 344, "maxHandMaintainedSourceLines": 132432, "maxWorkflowFiles": 71, "maxWorkflowLines": 23636, "latestTransition": "The v4 architecture and Warrant-plan validators now fail closed unless production release authority, writers, and migration phases have completed the v3-to-v4 cutover.", "rationale": "Sixteen validation lines close the production-authority, fallback, rollback, writer-runtime, legacy-retirement, and historical-comparison separation invariants required for the v4 release. This exact measured ceiling cannot grow implicitly." }, "sourceBudgets": { "newFileLines": 600, "newFunctionLines": 180, "newFunctionComplexity": 25, "existingDebtPolicy": "no-widening" }, "approvedNewFileTransitions": { "scripts/v4-architecture.mjs": { "maxLines": 610, "rationale": "The v4 architecture validator adds only the bounded production-authority, fallback, rollback, writer-runtime, and legacy-retirement checks required for the final release cutover. This exact reviewed ceiling cannot grow implicitly." }, "scripts/v4-warrant-shadow-plan.mjs": { "maxLines": 601, "rationale": "The historical v3 comparison plan now separately verifies that the live manifest is v4-authoritative and legacy-retired, preventing comparison evidence from being mistaken for production authority. This exact reviewed ceiling cannot grow implicitly." }, "packages/core/buildchain-channel-identity.js": { "maxLines": 119, "rationale": "The single major-independent classifier and triad evaluator keep shell, runtime, and contract-lock lane identity in one bounded fail-closed authority shared by stable and alpha consumers. This exact reviewed ceiling cannot grow implicitly." }, "packages/core/dev-delivery-warrant.js": { "maxLines": 605, "rationale": "The v4 parity port preserves the reviewed v3 release-blocker claim handoff, root-preserving candidate refresh, deterministic queued ranking and receipt propagation while retaining all prior fencing, lease and terminal semantics; this exact reviewed ceiling cannot grow implicitly." }, "packages/core/release-blocker-priority.js": { "maxLines": 193, "rationale": "The v4 parity adapter preserves the reviewed v3 exact dual-landing priority claim, repair-contract parsing and unrelated-work rejection outside the durable Warrant state machine; this exact reviewed ceiling cannot grow implicitly." }, "packages/core/kfd-adopter-manifest.js": { "maxLines": 390, "rationale": "The package-only adapter keeps published KFD verification, Buildchain-specific evidence constraints, decision and gate roots, and the one-way legacy projection in one bounded public authority seam. This exact reviewed ceiling cannot grow implicitly." }, "packages/core/release-train.js": { "maxLines": 740, "rationale": "The v4 Release Train parity contract preserves the reviewed v3 rooted successor-repair lifecycle, compare-and-swap, frozen origin provenance, exact cut and Dev patch identity, independent candidate-build eligibility, publication gating and deterministic validation; this exact reviewed ceiling cannot grow implicitly." }, "packages/core/engineering-housekeeper-github.js": { "maxLines": 707, "rationale": "The bounded GitHub engine keeps complete pagination, repository-wide protected-mainline discovery, one batched closed-PR inventory, exact association-only target selection, and fixed eight-way ancestry concurrency. Unassociated heads are retained without fallback comparisons; exact source and target revalidation, stale-PR labeling, provider receipts, and replay behavior remain in one public provider surface. This exact reviewed ceiling cannot grow implicitly." }, "packages/core/release-tail-provider-plane.js": { "maxLines": 1228, "maxFunctionLines": 255, "maxFunctionComplexity": 33, "rationale": "The one versioned transaction authority keeps strict declaration normalization, deterministic effect planning, atomic checkpoints, rooted observations and receipts, and bounded recovery in one independently tested audit surface; this exact preview ceiling cannot grow implicitly." } }, "approvedExistingDebtTransitions": { "packages/core/index.js": { "maxLines": 698, "rationale": "The public facade forwards the reviewed declarative release-tail transaction, adapter and compatibility APIs without adding a second implementation or execution path; this exact post-integration ceiling cannot grow implicitly." }, "actions/promote-buildchain-ref/lib.js": { "maxLines": 6952, "rationale": "Named responsibility factories preserve both the audited legacy promotion implementation and the sealed-publication and family-evidence behavior already present at the enforcement revision, while the terminal orchestration budget drops from 3066 lines to at most 600. This exact post-integration ceiling cannot grow implicitly." }, "bin/buildchain.mjs": { "maxLines": 1946, "rationale": "The runtime entrypoint now binds every compatibility command and alias, including the upstream paper command, through the tested command registry; this exact post-integration wiring ceiling cannot grow implicitly." }, "packages/core/release-passport.js": { "maxLines": 2859, "rationale": "Responsibility-owned validators preserve issue ordering, byte-stable reports, and upstream release-evidence attachment verification while the terminal report constructor drops from 470 lines to at most 180. This exact post-integration ceiling cannot grow implicitly." }, "packages/core/buildchain-contract.js": { "maxLines": 1095, "maxFunctionLines": 681, "maxFunctionComplexity": 30, "rationale": "The existing v4 contract evaluator invokes the shared shell-runtime-lock binding before every compatibility or early-success path while preserving the prior contract-world, Release Train, and drift behavior. Its public advanced-workflow projection now declares the two optional expected lane inputs consumed by that unchanged evaluator. This exact public-contract wiring ceiling cannot grow implicitly." }, "packages/core/github-governance-authority.js": { "maxLines": 1368, "rationale": "The publication authority now declares the alpha/v4/v4.0 and release/v4/v4.0 protected channels required for the v4 public train. This exact two-line channel transition cannot grow implicitly." }, "scripts/check-internal-architecture.mjs": { "maxFunctionComplexity": 37, "rationale": "Ownership coverage and zero-cycle enforcement were added to the pre-existing architecture traversal; this exact guard complexity ceiling cannot grow implicitly." }, "scripts/check-maintainability.mjs": { "maxFunctionComplexity": 29, "rationale": "The new-file budget evaluator recognizes only explicit path-scoped transitions with exact ceilings and mandatory rationales; the default budget and every existing no-widening check remain unchanged." }, "scripts/check-inventory.mjs": { "maxLines": 1486, "rationale": "Inventory retains the recovery, sealed-bundle, no-product-install, and durable-finalization checks, requires the self-dogfood lock to match the current major, and binds every channel-router lane to the exact caller shell without unresolved static channel refs. This exact post-integration ceiling cannot grow implicitly." }, "scripts/generate-channel-promotion-workflow.mjs": { "maxFunctionLines": 290, "rationale": "The generated promotion router keeps the exact candidate recovery interface and the latest bounded shell-routing implementation in one deterministic generator. It now derives the advanced contract gate's expected lane and major from the selected route without exposing them as caller-controlled public inputs. This exact combined train ceiling cannot grow implicitly." }, "scripts/release-candidate-resolver.mjs": { "maxLines": 810, "maxFunctionLines": 306, "maxFunctionComplexity": 63, "rationale": "The shared candidate resolver selects the original Passport runtime, seals exact payloads under the existing publication bundle contract, streams GitHub archives to disk, and verifies size and sha256 with bounded-memory reads; the exact ceiling cannot grow implicitly." }, "scripts/auditable-demo.mjs": { "maxLines": 1330, "rationale": "The existing Gate validator admits an explicit bounded long-form duration class while preserving the standard 60-second default and exact capture-to-scene binding; this exact post-integration ceiling cannot grow implicitly." }, "scripts/dev-alpha-candidate-patrol.mjs": { "maxLines": 1184, "rationale": "The existing single-flight exact-source Alpha controller now idempotently registers repository-selected GitHub auto-merge intent only after settlement revalidation, with explicit merge-method validation and no direct merge or approval path; this exact ceiling cannot grow implicitly." }, "scripts/build-contract-core.mjs": { "maxLines": 1229, "rationale": "Runner matrix resolution now binds one explicit GitHub-hosted identity and exact hosted versus relay projections so artifact transport cannot cross regions unnecessarily; this exact post-integration ceiling cannot grow implicitly." }, "scripts/generate-site-bundle.mjs": { "maxLines": 1502, "rationale": "Lifecycle metadata and CLI registry parity are generated centrally across the latest upstream public surface while the largest generator function remains at or below its prior size and complexity ceilings." }, "scripts/run-lifecycle-core.mjs": { "maxLines": 886, "maxFunctionLines": 472, "maxFunctionComplexity": 74, "rationale": "The runtime action now enforces the audited compiler-cache activity gate immediately after a successful build, so consumers receive fail-closed verification before their reusable workflow shell advances; exact existing function complexity does not increase." }, "scripts/dev-pr-auto-merge.mjs": { "maxLines": 1224, "maxFunctionComplexity": 53, "rationale": "The existing Dev PR controller now supports one targeted exact-head Agent admission path with typed receipts and PR-visible diagnostics while preserving independent approval, required-check, same-repository, readiness, and merge-queue gates; this exact post-integration ceiling cannot grow implicitly." } }, "approvedPublicSurfaceTransitions": { "action:promote-buildchain-ref": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "promote-buildchain-ref", "path": "actions/promote-buildchain-ref/action.yml", "inputs": [ "allow-repository", "branch-protection-bypass-apps", "branch-protection-bypass-teams", "branch-protection-bypass-users", "declarative-release-tail", "dry-run", "expected-publication-version", "generated-pull-request-token", "generated-ref-update-token", "generated-status-check-token", "github-release", "github-release-artifact-paths", "github-release-notes", "github-release-title", "promote-only-release-candidate", "publication-capability-json", "publication-gate-aggregate-json", "publication-qualification-receipt-json", "publication-used-qualification-nonces-json", "publish-auth", "publish-command", "publish-dist-tag", "publish-evidence-path", "publish-mode", "publish-package-main", "publish-package-set-order", "publish-rematerialize-on-resume", "publish-required-artifacts-json", "publish-required-artifacts-path", "publish-sealed-bundle-manifest", "publish-sealed-bundle-root", "publish-source-locked", "publish-source-ref", "publish-source-sha", "publish-tooling-sha", "publish-transaction", "publish-transaction-override", "reconciliation-workspace", "release-candidate-build-summary-path", "release-candidate-family-assignment-id", "release-candidate-family-evidence-required", "release-candidate-family-evidence-root", "release-candidate-family-initiative-id", "release-candidate-passport-path", "release-candidate-version", "release-material-sha", "release-passport", "release-passport-attachment-command", "release-passport-build-summary-path", "release-passport-buildchain-self-kfd", "release-passport-evidence-command", "release-passport-evidence-jsons", "release-passport-github-artifact-attestation-policy-jsons", "release-passport-impact-json", "release-passport-invariant-passport-command", "release-passport-invariant-passport-jsons", "release-passport-kfd-1-witness-jsons", "release-passport-kfd-2-claim-jsons", "release-passport-kfd-3-artifact-verify-command", "release-passport-kfd-3-artifact-witness-jsons", "release-passport-kfd-3-prebuild-witness-jsons", "release-passport-kfd-adopter-manifest-json", "release-passport-kfd-product-gate-jsons", "release-passport-kfd-support-matrix-json", "release-passport-output-dir", "release-passport-platform-manifest-paths", "release-passport-product-name", "release-passport-promotion-routing-json", "release-tail-state-path", "require-governance", "require-publication-qualification", "require-publish-source-lock", "require-version-state", "required-status-check", "sha", "tags", "target-ref", "token", "transaction-state-path", "verification-command" ], "secrets": [], "outputs": [] }, "rationale": "The promote action opts into the reviewed declarative release-tail provider path and exposes only rooted transaction checkpoint inputs; the legacy GitHub Release path remains the default and provider failure cannot select success." }, "cli:architecture": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "architecture", "usage": "buildchain architecture validate [--cwd ] [--json]" }, "rationale": "Add a read-only generated list/show/validate surface plus exact Git N-1 qualification; the manifest remains the single authority and the commands do not migrate or write production state." }, "cli:kfd-support": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "kfd-support", "usage": "buildchain kfd support project --manifest-json --manifest-gate-json " }, "rationale": "Replace the product-owned support-matrix declaration authority with a read-only compatibility projection derived from one exact standard adopter manifest and its passing gate; verification now requires the same authority closure and cannot widen adopter claims." }, "cli:dev": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "dev", "usage": "buildchain dev pr-admit --repository --branch " }, "rationale": "The existing Dev command family adds one targeted exact-head admission entry that emits a typed receipt and PR-visible diagnostic status while preserving the merge-queue command and keeping approval and merge authority external." }, "action:run-lifecycle": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "run-lifecycle", "path": "actions/run-lifecycle/action.yml", "inputs": [ "artifact-name", "artifact-paths", "command", "cwd", "diagnostics-artifact-name", "diagnostics-path", "expected-artifacts-json", "manifest-artifact-name", "manifest-path", "platform-id", "platform-name", "process-sample-interval-ms", "process-samples-path", "process-summary-path", "process-summary-required", "requested-parallelism", "required", "sample-process-tree", "stage", "substage-evidence-path", "summary-path", "timeout-minutes" ], "secrets": [], "outputs": [] }, "rationale": "The action accepts one optional consumer-produced substage evidence file, independently verifies its exact source and platform roots, and embeds it in diagnostics without changing behavior for existing callers." }, "workflow:dev-alpha-candidate-patrol": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "dev-alpha-candidate-patrol", "path": ".github/workflows/dev-alpha-candidate-patrol.yml", "reusable": true, "inputs": [ "alpha-workflow-path", "auto-merge", "buildchain-ref", "buildchain-repository", "create-pull-request", "dev-workflow-path", "dry-run", "max-age-seconds", "merge-method", "pull-request-body-prefix", "pull-request-body-prefix-renderer", "reactivation-authorized", "settlement-authorized", "source-branch", "target-branch" ], "secrets": ["promotion-token"], "outputs": [ "active-candidate-pr", "candidate-generation", "candidate-tree-sha", "controller-state", "cut-root", "drift-root", "eligible", "hold-root", "next-candidate-sha", "prior-state-root", "promotion-pr", "result-path", "runtime-sha", "selected-sha", "settlement-action", "source-lock-ref", "train-root" ] }, "rationale": "Expose the frozen Release Cut, generation, candidate tree, exact runtime, Dev-drift observation and fail-closed hold roots for v4 Build inputs while preserving the existing no-publication and protected-settlement boundary." }, "workflow:dev-pr-auto-merge": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "dev-pr-auto-merge", "path": ".github/workflows/dev-pr-auto-merge.yml", "reusable": true, "inputs": [ "affected-paths-json", "allowed-head-prefixes", "assignment-root", "block-labels", "buildchain-ref", "buildchain-repository", "closure-root", "delivery-class", "delivery-priority", "delivery-warrant-mode", "dependency-root", "diagnostic-context", "dry-run", "expected-head-sha", "expected-pr-number", "initiative-root", "landing-mode", "max-merges", "merge-method", "plan-root", "project-cut-proof-json", "queue-admission-context", "ready-label", "require-approval", "required-status-checks", "same-repository-only", "shard-evidence-roots-json", "source-identity-root", "source-patch-root", "target-branch", "toolchain-root", "warrant-lease-seconds" ], "secrets": ["github-token"], "outputs": [ "action-count", "admission-receipt-root", "admission-state", "enqueued-count", "evaluated-count", "final-base-sha", "merged-count", "project-cut-proof-root", "skipped-count", "source-proof-root", "warrant-receipt-root", "warrant-state-commit", "warrant-state-root" ] }, "rationale": "Extend targeted exact-head admission with an optional rooted Project Cut replay proof for the exact current base and immutable Warrant state-commit readback while independent approval, required checks, native queue admission, and exact integration proof remain authoritative." }, "workflow:stable-candidate-patrol": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "stable-candidate-patrol", "path": ".github/workflows/stable-candidate-patrol.yml", "reusable": true, "inputs": [ "auto-approve", "auto-merge", "auto-promote", "buildchain-ref", "buildchain-repository", "dry-run", "hold", "hold-reason", "ledger-ref", "merge-method", "minimum-soak-seconds", "release-now", "required-checks", "revoke-reason", "revoked-versions", "target-branch" ], "secrets": ["approval-token", "promotion-token"], "outputs": [ "promotion-pr", "result-path", "selected", "selected-sha", "selected-version", "stable-version" ] }, "rationale": "Let protected stable callers select the repository-supported GitHub auto-merge method while preserving the existing opt-in and exact-source gates." }, "cli:release-propagation": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "release-propagation", "usage": "buildchain release-propagation ..." }, "rationale": "The existing release-propagation command adds one policy-reporting Site upstream entry and exact non-force Work branch executor while preserving plan, lock, pickup, and Work Control compatibility." }, "workflow:.build": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": ".build", "path": ".github/workflows/.build.yml", "reusable": true, "inputs": [ "artifact-compression-level", "artifact-finalization-command", "artifact-finalization-on-platform", "artifact-name", "artifact-name-template", "artifact-paths", "artifact-relay-s3-bucket", "artifact-relay-s3-download-role-arn", "artifact-relay-s3-oidc-audience", "artifact-relay-s3-prefix", "artifact-relay-s3-region", "artifact-relay-s3-role-arn", "artifact-relay-s3-upload-role-arn", "artifact-retention-days", "artifact-signing-request-upload-no-proxy", "artifact-transfer-mode", "aws-codebuild-project", "aws-ec2-macos-runner-label", "aws-ec2-windows-runner-label", "build-command", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-expected-channel", "buildchain-expected-major", "buildchain-ref", "buildchain-repository", "cache-dependency-lock-root", "cache-policy-root", "cache-toolchain-root", "cargo-registry-index", "checkout-cache-fallback", "checkout-cache-fetch-attempts", "checkout-cache-github-timeout-seconds", "checkout-cache-mirror-url-template", "checkout-cache-mode", "checkout-cache-reference-repository-template", "checkout-cache-timeout-seconds", "checkout-history-mode", "compiler-cache-platforms-json", "compiler-cache-provider", "compiler-cache-required", "control-runner-json", "credential-island-caller-owned", "credential-island-environment", "credential-island-macos-app-path", "credential-island-macos-platform-id", "expected-artifacts-json", "fail-fast", "gate-profile-aggregate-json", "github-artifact-attestation-platform-id", "github-artifact-attestation-signer-sha", "github-artifact-attestation-subject-path", "install-command", "kfd-agent-hub", "lifecycle-timeout-minutes", "linux-container-image", "linux-container-preset", "node-version", "platforms-json", "pre-upload-transport-smoke-artifact-root", "pre-upload-transport-smoke-scenario-path", "process-sample-interval-ms", "process-summary-path", "publish-anchor-request-json", "publish-channel", "publish-refs-json", "publish-registry", "publish-source-ref", "release-candidate", "release-candidate-family-evidence-json", "requested-parallelism", "require-build", "require-install", "require-trusted-event", "require-verify", "runner-preset", "rust-toolchain", "rustup-dist-server", "rustup-update-root", "sample-process-tree", "self-hosted-offline-fallback", "setup-node", "setup-rust", "shifu-cache-profile-digest", "shifu-cache-profile-ref", "untrusted-policy", "verify-command", "verify-substage-evidence-path", "working-directory" ], "secrets": [ "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN", "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64", "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD", "BUILDCHAIN_MACOS_NOTARY_API_ISSUER", "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID", "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64", "BUILDCHAIN_PROMOTION_TOKEN" ], "outputs": [ "artifact-coordinates-json", "build-diagnostics-summary-artifact", "build-diagnostics-summary-json", "build-summary-artifact", "build-summary-json", "buildchain-contract-digest", "buildchain-contract-lock-drift", "buildchain-contract-lock-status", "buildchain-runtime-class", "buildchain-runtime-override", "buildchain-runtime-ref", "buildchain-runtime-sha", "buildchain-runtime-trust-decision", "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "credential-island-macos-artifact", "credential-island-macos-manifest-artifact", "linux-container-enabled", "linux-container-image", "platform-count", "platforms-json", "publish-allowed", "publish-channel", "publish-reason", "publish-source-channel", "publish-source-consumer-version", "publish-source-line", "publish-source-locked", "publish-source-ref", "publish-source-sha", "publish-source-tree-sha", "release-candidate-artifact", "release-candidate-passport-artifact", "release-candidate-passport-json", "release-manifest-json", "runner-preset", "runner-routing-json", "trusted-event" ] }, "rationale": "The reusable build surface adds an opt-in final-byte verification command and trusted platform-native finalization mode. Existing consumers preserve control-runner behavior when both inputs are absent; platform-native mode rejects self-hosted runners and reseals artifacts only after consumer policy succeeds." }, "workflow:build": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "build", "path": ".github/workflows/build.yml", "reusable": true, "inputs": [ "artifact-compression-level", "artifact-finalization-command", "artifact-finalization-on-platform", "artifact-name", "artifact-name-template", "artifact-paths", "artifact-relay-s3-bucket", "artifact-relay-s3-download-role-arn", "artifact-relay-s3-oidc-audience", "artifact-relay-s3-prefix", "artifact-relay-s3-region", "artifact-relay-s3-role-arn", "artifact-relay-s3-upload-role-arn", "artifact-retention-days", "artifact-signing-request-upload-no-proxy", "artifact-transfer-mode", "aws-codebuild-project", "aws-ec2-macos-runner-label", "aws-ec2-windows-runner-label", "build-command", "buildchain-alpha-contract-lock-path", "buildchain-channel", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-expected-channel", "buildchain-expected-major", "buildchain-ref", "buildchain-repository", "buildchain-stable-contract-lock-path", "cache-dependency-lock-root", "cache-policy-root", "cache-toolchain-root", "cargo-registry-index", "checkout-cache-fallback", "checkout-cache-fetch-attempts", "checkout-cache-github-timeout-seconds", "checkout-cache-mirror-url-template", "checkout-cache-mode", "checkout-cache-reference-repository-template", "checkout-cache-timeout-seconds", "checkout-history-mode", "compiler-cache-platforms-json", "compiler-cache-provider", "compiler-cache-required", "control-runner-json", "credential-island-caller-owned", "credential-island-environment", "credential-island-macos-app-path", "credential-island-macos-platform-id", "expected-artifacts-json", "fail-fast", "gate-profile-aggregate-json", "github-artifact-attestation-platform-id", "github-artifact-attestation-signer-sha", "github-artifact-attestation-subject-path", "install-command", "kfd-agent-hub", "lifecycle-timeout-minutes", "linux-container-image", "linux-container-preset", "node-version", "platforms-json", "pre-upload-transport-smoke-artifact-root", "pre-upload-transport-smoke-scenario-path", "process-sample-interval-ms", "process-summary-path", "publish-anchor-request-json", "publish-channel", "publish-refs-json", "publish-registry", "publish-source-ref", "release-candidate", "release-candidate-family-evidence-json", "requested-parallelism", "require-build", "require-install", "require-trusted-event", "require-verify", "runner-preset", "rust-toolchain", "rustup-dist-server", "rustup-update-root", "sample-process-tree", "self-hosted-offline-fallback", "setup-node", "setup-rust", "shifu-cache-profile-digest", "shifu-cache-profile-ref", "untrusted-policy", "verify-command", "verify-substage-evidence-path", "working-directory" ], "secrets": [ "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN", "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64", "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD", "BUILDCHAIN_MACOS_NOTARY_API_ISSUER", "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID", "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64", "BUILDCHAIN_PROMOTION_TOKEN" ], "outputs": [ "artifact-coordinates-json", "build-diagnostics-summary-artifact", "build-diagnostics-summary-json", "build-summary-artifact", "build-summary-json", "buildchain-channel", "buildchain-channel-reason", "buildchain-channel-selection-source", "buildchain-contract-digest", "buildchain-contract-lock-drift", "buildchain-contract-lock-status", "buildchain-runtime-class", "buildchain-runtime-override", "buildchain-runtime-ref", "buildchain-runtime-sha", "buildchain-runtime-trust-decision", "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "credential-island-macos-artifact", "credential-island-macos-manifest-artifact", "linux-container-enabled", "linux-container-image", "platform-count", "platforms-json", "publish-allowed", "publish-channel", "publish-reason", "publish-source-channel", "publish-source-consumer-version", "publish-source-line", "publish-source-locked", "publish-source-ref", "publish-source-sha", "publish-source-tree-sha", "release-candidate-artifact", "release-candidate-passport-artifact", "release-candidate-passport-json", "release-manifest-json", "runner-preset", "runner-routing-json", "trusted-event" ] }, "rationale": "The generated channel router forwards the opt-in final-byte verification command and trusted platform-native finalization mode unchanged to the reusable build surface. Existing callers retain the control-runner default; the advanced workflow owns the hosted-runner guard and final artifact reseal." }, "workflow:paper-release-sealed": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "paper-release-sealed", "path": ".github/workflows/paper-release-sealed.yml", "reusable": true, "inputs": [ "artifact-name", "artifact-paths", "artifact-retention-days", "branch-protection-bypass-apps", "branch-protection-bypass-teams", "branch-protection-bypass-users", "buildchain-contract-lock-path", "buildchain-ref", "buildchain-repository", "dry-run", "github-governance-receipt-json", "github-release", "github-release-notes", "github-release-title", "package-name", "publish-dist-tag", "publisher-workflow-path", "release-passport-impact-json", "release-passport-output-dir", "release-passport-product-name", "required-status-check", "target-ref", "target-sha", "toolchain-type", "verify-command", "working-directory" ], "secrets": [ "BUILDCHAIN_GENERATED_WRITE_APP_CLIENT_ID", "BUILDCHAIN_GENERATED_WRITE_APP_PRIVATE_KEY", "BUILDCHAIN_GENERATED_WRITE_TOKEN", "BUILDCHAIN_PROMOTION_TOKEN", "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY" ], "outputs": [ "github-release-url", "package-name", "package-version", "propagation-work-artifact", "public-release-tag", "release-passport-path", "upstream-release-json" ] }, "rationale": "The sealed Paper release adds one exact upstream release envelope output after npm integrity, gitHead, tag target, Passport, and publication artifacts agree; all prior inputs, secrets, outputs, and behavior remain intact." }, "workflow:release-propagation": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "release-propagation", "path": ".github/workflows/release-propagation.yml", "reusable": true, "inputs": [ "agent-work-context-json", "agent-work-mode", "buildchain-ref", "buildchain-repository", "downstream-base-ref", "downstream-branch", "downstream-prepare-command", "downstream-repository", "downstream-target", "downstream-update-command", "downstream-verify-command", "dry-run", "graph-json", "lock-path", "pr-body", "pr-title", "refresh-managed-readme-badges", "source-node", "upstream-release-json" ], "secrets": ["propagation-token"], "outputs": [ "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "propagation-receipt-digest", "propagation-receipt-json", "propagation-work-artifact", "propagation-work-json", "propagation-work-next-action", "propagation-work-root" ] }, "rationale": "The agent-native extension adds one optional typed Work Control context input and exact work-state outputs while preserving every existing input, secret, output, path, and reusable-workflow behavior. The complete successor contract is pinned here so later drift remains fail-closed." }, "workflow:.publication-authority": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": ".publication-authority", "path": ".github/workflows/.publication-authority.yml", "reusable": true, "inputs": [ "admission-json", "authority-workflow-path", "auto-admission", "auto-admission-kind", "auto-no-gate", "buildchain-ref", "buildchain-repository", "consumer-gate-command", "consumer-gate-controller-sha", "consumer-gate-evidence-source-sha", "consumer-gate-evidence-source-tree", "consumer-predicate-digest", "consumer-predicate-id", "consumer-qualification-required", "control-plane-audit-json", "dry-run", "evidence-controller-artifact", "evidence-manifest-pattern", "evidence-passport-artifact", "evidence-payload-pattern", "evidence-publication-artifact", "evidence-repository", "evidence-run-id", "evidence-summary-artifact", "expected-json", "gate-aggregate-json", "github-governance-receipt-json", "package-name", "product", "publication-target", "publication-version", "publisher-workflow-path", "required-status-check", "runner-provenance-json", "source-sha", "target-ref", "used-nonces-json" ], "secrets": [ "BUILDCHAIN_GOVERNANCE_READ_TOKEN", "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY" ], "outputs": [ "capability-artifact", "capability-digest", "capability-json", "gate-aggregate-digest", "gate-aggregate-json" ] }, "rationale": "The sealed read-only authority preserves the dedicated auditor App while adding an isolated governance-read token mapped from the existing caller credential only at the authority boundary. It independently checks out the immutable publication subject and controller, verifies both SHAs and the subject tree, and binds controller repository, SHA, and command digest into the qualifying aggregate without granting new provider write permission." }, "workflow:.release-candidate-promote": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": ".release-candidate-promote", "path": ".github/workflows/.release-candidate-promote.yml", "reusable": true, "inputs": [ "allow-repository", "artifact-name", "artifact-patterns", "branch-protection-bypass-apps", "branch-protection-bypass-teams", "branch-protection-bypass-users", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-expected-channel", "buildchain-expected-major", "buildchain-ref", "buildchain-repository", "channel", "declarative-release-tail", "dry-run", "github-artifact-attestation-environment", "github-artifact-attestation-policy-json", "github-artifact-attestation-retention-days", "github-governance-receipt-json", "github-release", "github-release-notes", "github-release-payload-patterns", "github-release-title", "package-manager", "promotion-contract-lock-digest", "promotion-contract-lock-path", "promotion-override-used", "promotion-publication-channel", "promotion-router-ref", "promotion-router-sha", "promotion-runtime-ref", "promotion-runtime-sha", "promotion-shell-ref", "promotion-shell-sha", "promotion-target-ref", "publication-admission-json", "publication-authority-workflow-path", "publication-auto-admission", "publication-auto-no-gate", "publication-commit-command", "publication-commit-evidence-path", "publication-consumer-predicate-id", "publication-consumer-qualification-command", "publication-consumer-qualification-controller-sha", "publication-control-plane-audit-json", "publication-expected-json", "publication-gate-aggregate-json", "publication-gate-command", "publication-gate-controller-sha", "publication-package-name", "publication-product", "publication-publisher-workflow-path", "publication-runner-provenance-json", "publication-target", "publication-used-nonces-json", "publication-used-qualification-nonces-json", "publish-artifact-kind", "publish-command", "publish-dist-tag", "publish-mode", "publish-package-main", "publish-package-set-order", "publish-rematerialize-on-resume", "publish-required-artifacts-json", "publish-target", "publish-transaction-override", "release-activation-command", "release-activation-receipt-set-path", "release-candidate-family-assignment-id", "release-candidate-family-evidence-required", "release-candidate-family-evidence-root", "release-candidate-family-initiative-id", "release-candidate-wait-seconds", "release-candidate-workflow-file", "release-candidate-workflow-name", "release-passport", "release-passport-attachment-command", "release-passport-buildchain-self-kfd", "release-passport-evidence-command", "release-passport-evidence-jsons", "release-passport-evidence-path", "release-passport-impact-json", "release-passport-invariant-passport-command", "release-passport-invariant-passport-jsons", "release-passport-kfd-1-witness-jsons", "release-passport-kfd-2-claim-jsons", "release-passport-kfd-3-artifact-verify-command", "release-passport-kfd-3-artifact-witness-jsons", "release-passport-kfd-3-prebuild-witness-jsons", "release-passport-kfd-adopter-manifest-json", "release-passport-kfd-product-gate-jsons", "release-passport-kfd-support-matrix-json", "release-passport-output-dir", "release-passport-platform-manifest-paths", "release-passport-product-name", "release-propagation-config-path", "required-artifact-count", "required-status-check", "resume-buildchain-runtime-sha", "resume-candidate-repository", "resume-candidate-run-id", "resume-expected-candidate-root", "resume-expected-candidate-runtime-sha", "resume-expected-source-tree", "resume-expected-workflow-file", "resume-expected-workflow-name", "resume-transaction-id", "runner-preset", "standalone-binary-distribution", "target-ref", "target-sha", "trusted-publishing" ], "secrets": [ "BUILDCHAIN_ISSUE_APP_ID", "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY", "BUILDCHAIN_ISSUE_TOKEN", "BUILDCHAIN_PROMOTION_TOKEN", "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY", "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN", "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY", "buildchain-issue-app-id", "buildchain-issue-app-private-key", "buildchain-issue-token" ], "outputs": [ "built-source-sha", "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "github-artifact-attestation-evidence-root", "github-artifact-attestation-id", "github-artifact-attestation-publication-receipt-digest", "github-artifact-attestation-url", "promoted-sha", "publication-capability-digest", "publication-commit-evidence-digest", "publication-commit-evidence-path", "publication-commit-payload-root", "publication-commit-url", "release-candidate-action", "release-candidate-artifact", "release-candidate-recovery-receipt-artifact", "release-candidate-recovery-root", "release-propagation-work-artifact", "release-tail-declaration-root", "release-tail-receipt-roots-json", "release-tail-state-root", "release-tail-transaction-root", "release-tail-transaction-state" ] }, "rationale": "The advanced promotion workflow preserves explicit expected channel and major bindings for opaque exact-runtime contract-lock checks while adding one opt-in declarative release-tail input and five rooted transaction outputs. Existing callers preserve legacy GitHub Release behavior by default; candidate, target tree, controller, command, authority workflow and provider transaction identities remain independently bound, and incomplete or mismatched evidence still fails closed without a hidden rebuild." }, "workflow:release-candidate-promote": { "fromRevision": "5308189b09bcb5a1314195412f2807a40d678838", "contract": { "id": "release-candidate-promote", "path": ".github/workflows/release-candidate-promote.yml", "reusable": true, "inputs": [ "allow-repository", "artifact-name", "artifact-patterns", "branch-protection-bypass-apps", "branch-protection-bypass-teams", "branch-protection-bypass-users", "buildchain-alpha-contract-lock-path", "buildchain-channel", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-ref", "buildchain-repository", "buildchain-stable-contract-lock-path", "channel", "declarative-release-tail", "dry-run", "github-artifact-attestation-environment", "github-artifact-attestation-policy-json", "github-artifact-attestation-retention-days", "github-governance-receipt-json", "github-release", "github-release-notes", "github-release-payload-patterns", "github-release-title", "package-manager", "publication-admission-json", "publication-auto-admission", "publication-auto-no-gate", "publication-commit-command", "publication-commit-evidence-path", "publication-consumer-predicate-id", "publication-consumer-qualification-command", "publication-consumer-qualification-controller-sha", "publication-control-plane-audit-json", "publication-expected-json", "publication-gate-aggregate-json", "publication-gate-command", "publication-gate-controller-sha", "publication-package-name", "publication-product", "publication-publisher-workflow-path", "publication-runner-provenance-json", "publication-target", "publication-used-nonces-json", "publication-used-qualification-nonces-json", "publish-artifact-kind", "publish-command", "publish-dist-tag", "publish-mode", "publish-package-main", "publish-package-set-order", "publish-rematerialize-on-resume", "publish-required-artifacts-json", "publish-target", "publish-transaction-override", "release-activation-command", "release-activation-receipt-set-path", "release-candidate-family-assignment-id", "release-candidate-family-evidence-required", "release-candidate-family-evidence-root", "release-candidate-family-initiative-id", "release-candidate-wait-seconds", "release-candidate-workflow-file", "release-candidate-workflow-name", "release-passport", "release-passport-attachment-command", "release-passport-buildchain-self-kfd", "release-passport-evidence-command", "release-passport-evidence-jsons", "release-passport-evidence-path", "release-passport-impact-json", "release-passport-invariant-passport-command", "release-passport-invariant-passport-jsons", "release-passport-kfd-1-witness-jsons", "release-passport-kfd-2-claim-jsons", "release-passport-kfd-3-artifact-verify-command", "release-passport-kfd-3-artifact-witness-jsons", "release-passport-kfd-3-prebuild-witness-jsons", "release-passport-kfd-adopter-manifest-json", "release-passport-kfd-product-gate-jsons", "release-passport-kfd-support-matrix-json", "release-passport-output-dir", "release-passport-platform-manifest-paths", "release-passport-product-name", "release-propagation-config-path", "required-artifact-count", "required-status-check", "resume-buildchain-runtime-sha", "resume-candidate-repository", "resume-candidate-run-id", "resume-expected-candidate-root", "resume-expected-candidate-runtime-sha", "resume-expected-source-tree", "resume-expected-workflow-file", "resume-expected-workflow-name", "resume-transaction-id", "runner-preset", "standalone-binary-distribution", "target-ref", "target-sha", "trusted-publishing" ], "secrets": [ "BUILDCHAIN_ISSUE_APP_ID", "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY", "BUILDCHAIN_ISSUE_TOKEN", "BUILDCHAIN_PROMOTION_TOKEN", "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY", "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN", "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY", "buildchain-issue-app-id", "buildchain-issue-app-private-key", "buildchain-issue-token" ], "outputs": [ "buildchain-channel", "built-source-sha", "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "github-artifact-attestation-evidence-root", "github-artifact-attestation-id", "github-artifact-attestation-publication-receipt-digest", "github-artifact-attestation-url", "promoted-sha", "promotion-contract-lock-digest", "promotion-contract-lock-path", "promotion-override-used", "promotion-publication-channel", "promotion-router-ref", "promotion-router-sha", "promotion-runtime-ref", "promotion-runtime-sha", "promotion-shell-ref", "promotion-shell-sha", "promotion-target-ref", "publication-capability-digest", "publication-commit-evidence-digest", "publication-commit-evidence-path", "publication-commit-payload-root", "publication-commit-url", "release-candidate-action", "release-candidate-artifact", "release-candidate-recovery-receipt-artifact", "release-candidate-recovery-root", "release-propagation-work-artifact", "release-tail-declaration-root", "release-tail-receipt-roots-json", "release-tail-state-root", "release-tail-transaction-root", "release-tail-transaction-state" ] }, "rationale": "The generated v4 promotion router forwards the opt-in declarative release-tail contract and its rooted outputs through both existing channel jobs while preserving v4-alpha and v4 shell selection, exact contract-lock routing, candidate identity and default legacy publication behavior." } }, "approvedExtractedDebt": { "scripts/v4-warrant-shadow-plan.mjs#validatePlan": { "maxLines": 182, "maxComplexity": 26, "rationale": "The validator adds one conjunctive terminal assertion that separates retained v3 comparison evidence from the live v4 writer and retired migration phase. This exact reviewed ceiling cannot grow implicitly." }, "packages/core/release-tail-provider-plane.js#normalizeCapability": { "maxLines": 255, "maxComplexity": 25, "rationale": "The frozen capability normalizer keeps the four closed-world provider declarations, identity constraints and capability-specific target validation in one audited authority; this reviewed v3 implementation is forward-ported byte-for-byte and cannot grow implicitly." }, "packages/core/release-tail-provider-plane.js#validateReleaseTailEffectPlan": { "maxLines": 180, "maxComplexity": 30, "rationale": "The rooted effect-plan validator preserves the reviewed v3 ordering, declaration binding and post-compilation tamper checks in one fail-closed function; this exact complexity ceiling cannot grow implicitly." }, "packages/core/release-tail-provider-plane.js#validateReleaseTailTransaction": { "maxLines": 180, "maxComplexity": 33, "rationale": "The transaction validator preserves the reviewed v3 state, observation, receipt, failure and checkpoint invariants in one audit surface; this exact complexity ceiling cannot grow implicitly." }, "packages/core/release-tail-provider-plane.js#executeReleaseTailTransaction": { "maxLines": 190, "maxComplexity": 27, "rationale": "The single transaction executor preserves bounded retry, pre-effect and post-effect readback, atomic checkpoints and provider non-authority from the reviewed v3 implementation; these exact ceilings cannot grow implicitly." }, "actions/promote-buildchain-ref/lib.js#createRefMutationOperations": { "maxLines": 627, "maxComplexity": 1, "rationale": "Transplanted legacy ref and provider mutation operations; independently tested and prevented from growing beyond this exact extraction point." }, "actions/promote-buildchain-ref/lib.js#createReconciliationOperations": { "maxLines": 672, "maxComplexity": 1, "rationale": "Transplanted legacy reconciliation operations; isolated from orchestration and prevented from growing beyond this exact extraction point." }, "actions/promote-buildchain-ref/internal/version-state-operations.js#createVersionStateOperations": { "maxLines": 440, "maxComplexity": 1, "rationale": "Transplanted legacy version-state operations now live in an independently owned module; explicit dependency injection adds seams while this exact inherited ceiling cannot grow." }, "actions/promote-buildchain-ref/internal/version-state-operations.js#createVersionStateCommit": { "maxLines": 313, "maxComplexity": 29, "rationale": "The existing version-state commit transaction remains nested under its extracted operation factory and is independently regression-tested; this exact inherited ceiling cannot grow." }, "actions/promote-buildchain-ref/internal/durable-transaction-operations.js#createDurableTransactionOperations": { "maxLines": 376, "maxComplexity": 1, "rationale": "Transplanted legacy durable transaction and Passport operations now live in an independently owned module; one semantic durable-material seam lets already-proven contained finalization restore immutable publication facts without accepting a transient rebuilt candidate or inconsistent per-field overrides, and this exact inherited ceiling cannot grow." }, "packages/core/paper-npm-bootstrap.js#executePaperNpmBootstrap": { "maxLines": 490, "maxComplexity": 58, "rationale": "The existing externally guarded npm bootstrap transaction moved intact into an independently owned Paper module with an explicit runtime seam; this exact inherited debt ceiling cannot grow." }, "packages/core/release-passport.js#validateReleaseEvidenceAttachments": { "maxLines": 74, "maxComplexity": 26, "rationale": "Upstream release-evidence attachment validation was moved intact into a named validator during integration; its exact complexity ceiling cannot grow." }, "scripts/dev-pr-auto-merge.mjs#runDevPrAdmission": { "maxLines": 180, "maxComplexity": 36, "rationale": "The targeted admission transaction keeps exact PR and head revalidation, explicit readiness mutation, independent approval and check observation, queue status, and typed receipt emission in one auditable function; this exact complexity ceiling cannot grow." } }, "selectedFunctionBudgets": { "promoteBuildchainRefs": { "file": "actions/promote-buildchain-ref/lib.js", "lines": 600, "complexity": 50 }, "createReleaseCheckReport": { "file": "packages/core/release-passport.js", "lines": 180, "complexity": 25 }, "createReleasePassport": { "file": "packages/core/release-passport.js", "lines": 273, "complexity": 44 }, "promoteMajorChannel": { "file": "actions/promote-buildchain-ref/internal/promote-major-channel.js", "lines": 7, "complexity": 3 }, "promoteAlphaChannel": { "file": "actions/promote-buildchain-ref/internal/promote-alpha-channel.js", "lines": 15, "complexity": 3 }, "promoteReleaseChannel": { "file": "actions/promote-buildchain-ref/internal/promote-release-channel.js", "lines": 8, "complexity": 2 }, "runPublishTransaction": { "file": "actions/promote-buildchain-ref/lib.js", "lines": 259, "complexity": 33 }, "collectPaperStatus": { "file": "packages/core/paper.js", "lines": 190, "complexity": 47 }, "collectPaperPreflight": { "file": "packages/core/paper.js", "lines": 178, "complexity": 18 } }, "publicSurfacePolicy": { "newOnly": true, "requiredLifecycleFields": [ "owner", "maturity", "introducedVersion", "compatibilityPromise", "deprecationReplacement", "sunsetCondition", "capabilityGroup", "nonDuplicationRationale" ] }, "architecturePolicy": { "requireCapabilityOwner": true, "requireImplementationTestContractMapping": true, "dependencyCycles": 0, "forbiddenDirectionChanges": 0 } }