Give delivery facade ownership of builds

docs/consumers/delivery.md

@@ -62,13 +62,20 @@ The command does not run candidate checks or publish tags.
 
 ## Go API
 
-Pass the Gitea credential explicitly. A `BuildResult` may be supplied for a
-binary-producing release; it must identify the same tagged repository commit
-and selected version, its `SourceVerified` field must confirm the completed
-build's clean, unchanged source observations, and its local artifacts must still
-match their digests. Cleaning the checkout after a dirty build does not make
-that build eligible for delivery.
-Leave `Build` nil for a source-only release.
+Pass the Gitea credential explicitly. Set `Build` to a `BuildSpec` to compile
+selected targets as part of delivery. The facade verifies the local tag, clean
+checkout, and committed release note before compiling. Managed output is stored
+outside the checkout and removed when delivery returns. `Output` receives build
+progress. With no build, or with an empty target set, delivery is page-only.
+
+To deliver binaries built separately, set `Prebuilt` to the `BuildResult`.
+ReleaseKit checks that it identifies the selected repository, tagged commit, and
+version, that its source was verified clean and unchanged during compilation,
+and that the current files still match their recorded digests. The files remain
+caller-owned, so callers can retain the original bytes for retries and are
+responsible for cleanup. With neither artifact source, an empty managed target
+set, or an empty prebuilt result, delivery is page-only. Do not set both `Build`
+and `Prebuilt` in one request.
 
 ```go
 result, err := releasekit.Deliver(ctx, releasekit.DeliveryRequest{
@@ -81,6 +88,11 @@ result, err := releasekit.Deliver(ctx, releasekit.DeliveryRequest{
         Repository: "example",
         Token:      token,
     },
+    Build: &releasekit.BuildSpec{
+        MainPackage: "./cmd/example",
+        BinaryName:  "example",
+        Targets:     []releasekit.Target{{OS: "linux", Arch: "amd64"}},
+    },
 })
 if err != nil {
     // Keep the returned state and any completed asset identities for recovery.

docs/internal/overview.md

@@ -38,7 +38,7 @@ these implemented packages:
 | `internal/artifact` | Shared build-target normalization, artifact declarations, filename rules, and checksum-manifest naming. |
 | `internal/build` | Candidate-build coordination, selected Go target compilation, version injection, native smoke check, and artifact digests. |
 | `internal/candidate` | Stable-version, note, repository-state, candidate capture, and post-validation checks. |
-| `internal/delivery` | Tagged-checkout verification, artifact inventory/hash validation, manifest assembly, and coordination of hosted delivery results. |
+| `internal/delivery` | Tagged-source and release-note checks, managed builds in disposable storage outside the checkout, prebuilt artifact validation, manifest assembly, and hosted delivery coordination. |
 | `internal/git` | Git command boundary, push-destination resolution, exact ref inspection, and tag operations, including captured-endpoint verification during recovery. |
 | `internal/gitea` | Gitea API transport, hosted release pages, asset inspection, manifests, and uploads. |
 | `internal/gotool` | Effective Go configuration discovery and shared native-validation and static-build environments; see [Go command environments](gotool.md). |
@@ -69,7 +69,7 @@ not a separate release matrix:
 | Authoritative endpoint and exact annotated tag publication | `releasekit.Publish`, `internal/publish`, `internal/git` | `TestPublishPushesOnlyTheCapturedAnnotatedTag`, `TestResolveUsesPushURLAndQueriesWithoutMutation` |
 | Publication partial and uncertain recovery | `internal/publish`, `internal/git` | `TestPublishRejectedPushKeepsLocalTagAndReportsNotPublished`, `TestPublishLostAcknowledgmentConfirmsExactRemoteObject`, `TestPublishLostAcknowledgmentWithChangedEndpointRemainsUnknown`, `TestPublishUnavailableReconciliationRemainsUnknownAndPreservesPushError` |
 | Cross-builds, version smoke checks, empty target sets, and partial outputs | `releasekit.Build`, `internal/build`, `buildinfo` | `TestBuildCreatesSelectedTargetsAndInjectsVersion`, `TestBuildWithNoTargetsDoesNotInvokeCompiler`, `TestBuildReturnsPartialArtifactsAfterTargetFailure` |
-| Page-only and binary tagged-source delivery | `releasekit.Deliver`, `internal/delivery`, `internal/gitea`, CLI | `TestDeliverPageOnlyCreatesAndReusesRelease`, `TestDeliverBuildsTaggedArtifactsAndReusesAssets`, `TestDeliverRejectsTamperedAssetsAndStaleReceiptBeforeRemoteWrites` |
+| Page-only and managed or prebuilt binary delivery | `releasekit.Deliver`, `internal/delivery`, `internal/gitea`, CLI | `TestDeliverPageOnlySkipsBuildAndHostedAssets`, `TestDeliverManagedBuildUploadsArtifactsAndCleansTemporaryOutput`, `TestDeliverPrebuiltArtifactsRemainCallerOwned`, `TestDeliverManagedBuildFailureCleansTemporaryOutputBeforeHostedWrites`, `TestDeliverManagedBuildCancellationCleansTemporaryOutput`, `TestDeliverBuildsTaggedArtifactsAndReusesAssets`, `TestDeliverRejectsTamperedAssetsAndStaleReceiptBeforeRemoteWrites` |
 | Page, manifest, asset comparison, and additive retry outcomes | `internal/gitea` | `TestEnsureReleaseCreatesMissingPageFromCommittedNote`, `TestInspectAssetsDetectsSameNameAndSizeWithDifferentBytes`, `TestUploadMissingPartialFailureThenRerunOnlyMissingAssets` |
 | CLI profiles and prepared Woodpecker sequences | `cmd/releasekit`, `cmd/releasekit/internal/cli`, `examples/woodpecker/` | `TestLoadSettingsRejectsInvalidProfiles`, `TestWoodpeckerDeliveryCommandSequences`, `TestReleaseKitSourceDeliveryWorkflowFromTaggedCheckout` |
 

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # ReleaseKit audit implementation plan
 
-Status: Stages 1–5 complete; Stage 6 next.
+Status: Stages 1–6 complete; Stage 7 next.
 Baseline: `e4be7fa` (2026-10-06). The [audit](audit.md) records the evidence,
 product goals, and selected direction. This document owns implementation order
 and completion criteria for that work.
@@ -329,6 +329,17 @@ on success and failure. Extend existing mutation/cancellation coverage where
 needed. Preserve prebuilt retry, digest conflict, note conflict, and source
 eligibility coverage. Confirm the two facades' dependency boundaries.
 
+**Completed:** `Deliver` now owns optional managed builds, page-only requests,
+and explicit prebuilt artifact delivery behind the public facade. Managed output
+uses temporary storage outside the checkout and is cleaned after success,
+failure, and cancellation; source and note checks precede compilation, and
+eligibility is rechecked before hosted writes. Prebuilt files remain
+caller-owned. Consumer and internal package guides describe these paths.
+Facade-level consumer and HTTP tests cover managed upload, page-only delivery,
+preflight and build failures, checkout mutation, cleanup, cancellation, and
+prebuilt ownership. The full offline suite, API boundary check, and
+documentation whitespace checks pass.
+
 ## Stage 7 — Route ordinary CLI delivery through the facade
 
 **Covers:** the CLI portion of F5. **Primary owners:**