@kungfu-tech/buildchain 2.10.3 → 2.10.4

package/README.md

@@ -4,6 +4,7 @@
 [![KFD-1: passed](https://buildchain.libkungfu.dev/badges/v1/kfd-1/passed.svg)](https://github.com/kungfu-systems/buildchain/releases/latest/download/buildchain.release.json)
 [![KFD-2: passed](https://buildchain.libkungfu.dev/badges/v1/kfd-2/passed.svg)](https://github.com/kungfu-systems/buildchain/releases/latest/download/buildchain.release.json)
 [![KFD-3: passed](https://buildchain.libkungfu.dev/badges/v1/kfd-3/passed.svg)](https://github.com/kungfu-systems/buildchain/releases/latest/download/buildchain.release.json)
+[![KFD-4: declared](https://buildchain.libkungfu.dev/badges/v1/kfd-4/declared.svg)](https://github.com/kungfu-systems/buildchain/releases/latest/download/buildchain.release.json)
 [![Buildchain Release Passport: passed](https://buildchain.libkungfu.dev/badges/v1/buildchain-release-passport/passed.svg)](https://github.com/kungfu-systems/buildchain/releases/latest/download/buildchain.release.json)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-0969da.svg)](https://github.com/kungfu-systems/buildchain/blob/HEAD/LICENSE)
 [![Platform: macOS | Linux | Windows](https://img.shields.io/badge/platform-macOS%20%7C%20Linux%20%7C%20Windows-6e7781.svg)](https://github.com/kungfu-systems/buildchain/releases/latest/download/buildchain.release.json)

package/actions/promote-buildchain-ref/README.md

@@ -215,9 +215,9 @@ BUILDCHAIN_PUBLISH_EVIDENCE
 ```
 
 The action outputs `transaction-id`, `transaction-state`,
-`transaction-exact-tag`, `transaction-release-sha`, `transaction-state-ref`,
-`transaction-state-sha`, `transaction-state-path`, `publish-evidence-path`, and
-`release-passport-path`, `release-passport-output-dir`,
+`transaction-exact-tag`, `public-release-tag`, `transaction-release-sha`,
+`transaction-state-ref`, `transaction-state-sha`, `transaction-state-path`,
+`publish-evidence-path`, and `release-passport-path`, `release-passport-output-dir`,
 `release-passport-state-sha`, and `finalization-needed`.
 `transaction-state-ref` is the durable recovery location.
 `release-passport-state-sha` is the durable ref commit after the generated
@@ -228,13 +228,16 @@ finalization, Buildchain may create a same-repository generated version-state
 PR when GitHub rejects the direct protected ref update; that PR is Buildchain
 bookkeeping, not a consumer-authored release change.
 Set `github-release: "true"` when the semver promotion should also publish the
-exact-tag GitHub Release. After the release transaction reaches `complete` and
+public GitHub Release. After the release transaction reaches `complete` and
 `finalization-needed` is false, the action creates or updates the GitHub Release
-for `transaction-exact-tag`, applies deterministic semver metadata
+for `public-release-tag`, applies deterministic semver metadata
 (`prerelease=true` and `make_latest=false` for prerelease tags, latest for stable
 tags), and uploads the publish evidence file plus generated release passport
-assets. If the transaction is not complete yet, the action defers GitHub Release
-publication to the next idempotent promotion run.
+assets. For anchored/manual package releases, `public-release-tag` is derived
+from the published package version, while `transaction-exact-tag` remains the
+internal Buildchain transaction ref for recovery and audit. If the transaction is
+not complete yet, the action defers GitHub Release publication to the next
+idempotent promotion run.
 
 After a publish transaction reaches `complete`, the action generates the unified
 `buildchain-release-passport` in `.buildchain/release-passport` by default and

package/dist/site/badge-endpoint-registry.json

@@ -495,6 +495,166 @@
         }
       ]
     },
+    {
+      "id": "kfd-4",
+      "label": "KFD-4",
+      "messageTemplate": "observer perspective {state}",
+      "linkRole": "repository-release-passport",
+      "states": [
+        {
+          "state": "passed",
+          "path": "badges/v1/kfd-4/passed.json",
+          "svgPath": "badges/v1/kfd-4/passed.svg",
+          "payload": {
+            "schemaVersion": 1,
+            "label": "KFD-4",
+            "message": "observer perspective passed",
+            "color": "2ea44f",
+            "logoPolicy": {
+              "contract": "kungfu-buildchain-badge-logo-policy",
+              "mode": "hosted-placeholder",
+              "placeholder": "buildchain-monogram",
+              "futureLogoUpdateRequiresConsumerAction": false,
+              "owner": "Buildchain site badge endpoint",
+              "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+            }
+          }
+        },
+        {
+          "state": "aligned",
+          "path": "badges/v1/kfd-4/aligned.json",
+          "svgPath": "badges/v1/kfd-4/aligned.svg",
+          "payload": {
+            "schemaVersion": 1,
+            "label": "KFD-4",
+            "message": "observer perspective aligned",
+            "color": "0969da",
+            "logoPolicy": {
+              "contract": "kungfu-buildchain-badge-logo-policy",
+              "mode": "hosted-placeholder",
+              "placeholder": "buildchain-monogram",
+              "futureLogoUpdateRequiresConsumerAction": false,
+              "owner": "Buildchain site badge endpoint",
+              "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+            }
+          }
+        },
+        {
+          "state": "declared",
+          "path": "badges/v1/kfd-4/declared.json",
+          "svgPath": "badges/v1/kfd-4/declared.svg",
+          "payload": {
+            "schemaVersion": 1,
+            "label": "KFD-4",
+            "message": "observer perspective declared",
+            "color": "6e7781",
+            "logoPolicy": {
+              "contract": "kungfu-buildchain-badge-logo-policy",
+              "mode": "hosted-placeholder",
+              "placeholder": "buildchain-monogram",
+              "futureLogoUpdateRequiresConsumerAction": false,
+              "owner": "Buildchain site badge endpoint",
+              "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+            }
+          }
+        },
+        {
+          "state": "planned",
+          "path": "badges/v1/kfd-4/planned.json",
+          "svgPath": "badges/v1/kfd-4/planned.svg",
+          "payload": {
+            "schemaVersion": 1,
+            "label": "KFD-4",
+            "message": "observer perspective planned",
+            "color": "bf8700",
+            "logoPolicy": {
+              "contract": "kungfu-buildchain-badge-logo-policy",
+              "mode": "hosted-placeholder",
+              "placeholder": "buildchain-monogram",
+              "futureLogoUpdateRequiresConsumerAction": false,
+              "owner": "Buildchain site badge endpoint",
+              "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+            }
+          }
+        },
+        {
+          "state": "draft",
+          "path": "badges/v1/kfd-4/draft.json",
+          "svgPath": "badges/v1/kfd-4/draft.svg",
+          "payload": {
+            "schemaVersion": 1,
+            "label": "KFD-4",
+            "message": "observer perspective draft",
+            "color": "8250df",
+            "logoPolicy": {
+              "contract": "kungfu-buildchain-badge-logo-policy",
+              "mode": "hosted-placeholder",
+              "placeholder": "buildchain-monogram",
+              "futureLogoUpdateRequiresConsumerAction": false,
+              "owner": "Buildchain site badge endpoint",
+              "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+            }
+          }
+        },
+        {
+          "state": "downgraded",
+          "path": "badges/v1/kfd-4/downgraded.json",
+          "svgPath": "badges/v1/kfd-4/downgraded.svg",
+          "payload": {
+            "schemaVersion": 1,
+            "label": "KFD-4",
+            "message": "observer perspective downgraded",
+            "color": "bf8700",
+            "logoPolicy": {
+              "contract": "kungfu-buildchain-badge-logo-policy",
+              "mode": "hosted-placeholder",
+              "placeholder": "buildchain-monogram",
+              "futureLogoUpdateRequiresConsumerAction": false,
+              "owner": "Buildchain site badge endpoint",
+              "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+            }
+          }
+        },
+        {
+          "state": "failed",
+          "path": "badges/v1/kfd-4/failed.json",
+          "svgPath": "badges/v1/kfd-4/failed.svg",
+          "payload": {
+            "schemaVersion": 1,
+            "label": "KFD-4",
+            "message": "observer perspective failed",
+            "color": "cf222e",
+            "logoPolicy": {
+              "contract": "kungfu-buildchain-badge-logo-policy",
+              "mode": "hosted-placeholder",
+              "placeholder": "buildchain-monogram",
+              "futureLogoUpdateRequiresConsumerAction": false,
+              "owner": "Buildchain site badge endpoint",
+              "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+            }
+          }
+        },
+        {
+          "state": "missing",
+          "path": "badges/v1/kfd-4/missing.json",
+          "svgPath": "badges/v1/kfd-4/missing.svg",
+          "payload": {
+            "schemaVersion": 1,
+            "label": "KFD-4",
+            "message": "observer perspective missing",
+            "color": "6e7781",
+            "logoPolicy": {
+              "contract": "kungfu-buildchain-badge-logo-policy",
+              "mode": "hosted-placeholder",
+              "placeholder": "buildchain-monogram",
+              "futureLogoUpdateRequiresConsumerAction": false,
+              "owner": "Buildchain site badge endpoint",
+              "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+            }
+          }
+        }
+      ]
+    },
     {
       "id": "buildchain-release-passport",
       "label": "buildchain",

package/dist/site/badges/v1/kfd-4/aligned.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "label": "KFD-4",
+  "message": "observer perspective aligned",
+  "color": "0969da",
+  "logoPolicy": {
+    "contract": "kungfu-buildchain-badge-logo-policy",
+    "mode": "hosted-placeholder",
+    "placeholder": "buildchain-monogram",
+    "futureLogoUpdateRequiresConsumerAction": false,
+    "owner": "Buildchain site badge endpoint",
+    "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+  }
+}

package/dist/site/badges/v1/kfd-4/declared.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "label": "KFD-4",
+  "message": "observer perspective declared",
+  "color": "6e7781",
+  "logoPolicy": {
+    "contract": "kungfu-buildchain-badge-logo-policy",
+    "mode": "hosted-placeholder",
+    "placeholder": "buildchain-monogram",
+    "futureLogoUpdateRequiresConsumerAction": false,
+    "owner": "Buildchain site badge endpoint",
+    "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+  }
+}

package/dist/site/badges/v1/kfd-4/downgraded.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "label": "KFD-4",
+  "message": "observer perspective downgraded",
+  "color": "bf8700",
+  "logoPolicy": {
+    "contract": "kungfu-buildchain-badge-logo-policy",
+    "mode": "hosted-placeholder",
+    "placeholder": "buildchain-monogram",
+    "futureLogoUpdateRequiresConsumerAction": false,
+    "owner": "Buildchain site badge endpoint",
+    "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+  }
+}

package/dist/site/badges/v1/kfd-4/draft.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "label": "KFD-4",
+  "message": "observer perspective draft",
+  "color": "8250df",
+  "logoPolicy": {
+    "contract": "kungfu-buildchain-badge-logo-policy",
+    "mode": "hosted-placeholder",
+    "placeholder": "buildchain-monogram",
+    "futureLogoUpdateRequiresConsumerAction": false,
+    "owner": "Buildchain site badge endpoint",
+    "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+  }
+}

package/dist/site/badges/v1/kfd-4/failed.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "label": "KFD-4",
+  "message": "observer perspective failed",
+  "color": "cf222e",
+  "logoPolicy": {
+    "contract": "kungfu-buildchain-badge-logo-policy",
+    "mode": "hosted-placeholder",
+    "placeholder": "buildchain-monogram",
+    "futureLogoUpdateRequiresConsumerAction": false,
+    "owner": "Buildchain site badge endpoint",
+    "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+  }
+}

package/dist/site/badges/v1/kfd-4/missing.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "label": "KFD-4",
+  "message": "observer perspective missing",
+  "color": "6e7781",
+  "logoPolicy": {
+    "contract": "kungfu-buildchain-badge-logo-policy",
+    "mode": "hosted-placeholder",
+    "placeholder": "buildchain-monogram",
+    "futureLogoUpdateRequiresConsumerAction": false,
+    "owner": "Buildchain site badge endpoint",
+    "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+  }
+}

package/dist/site/badges/v1/kfd-4/passed.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "label": "KFD-4",
+  "message": "observer perspective passed",
+  "color": "2ea44f",
+  "logoPolicy": {
+    "contract": "kungfu-buildchain-badge-logo-policy",
+    "mode": "hosted-placeholder",
+    "placeholder": "buildchain-monogram",
+    "futureLogoUpdateRequiresConsumerAction": false,
+    "owner": "Buildchain site badge endpoint",
+    "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+  }
+}

package/dist/site/badges/v1/kfd-4/planned.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "label": "KFD-4",
+  "message": "observer perspective planned",
+  "color": "bf8700",
+  "logoPolicy": {
+    "contract": "kungfu-buildchain-badge-logo-policy",
+    "mode": "hosted-placeholder",
+    "placeholder": "buildchain-monogram",
+    "futureLogoUpdateRequiresConsumerAction": false,
+    "owner": "Buildchain site badge endpoint",
+    "note": "README image URLs point at stable Buildchain-hosted badge endpoints; the rendered logo is controlled by the endpoint, not by consumer README text."
+  }
+}

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.10.3",
+    "version": "2.10.4",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -92,7 +92,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:403d2fcdb0c5eabe749e89102defad69745f70a1556707bec7831fcc2e9fa8f8",
-      "auditDigest": "sha256:277d9e6a9b55986911f8331cfbad1d747631085cc73c3ab207319c52ed29d429"
+      "auditDigest": "sha256:377c48c5991c0bc8c0d7874596c2ecb83f8fd61837c8cbc37439058d1f97e71f"
     },
     {
       "contractVersion": 1,
@@ -134,7 +134,7 @@
         "breaking contract drift fails closed before rendering, deployment, or release publication"
       ],
       "breakingDigest": "sha256:82ee63cb336e40d832dfff4a1c5e6cbfa221a4fc8b2359990033bc931bffc43a",
-      "auditDigest": "sha256:46cd44208497d20495c3bc392a1a40ddd419216d8b1ce41198c8eda5b2645c08"
+      "auditDigest": "sha256:c7ccd61dcad7420276d5c13549ccbbd7f9afee30eab28ff09fe3d59b2a3f638f"
     },
     {
       "contractVersion": 1,
@@ -173,10 +173,10 @@
         "protected release refs and durable release-state are finalized by Buildchain",
         "release passport finalization is idempotent after publish side effects",
         "publish transactions can require a resolved publish-gate source lock to prevent floating-ref drift",
-        "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the exact tag"
+        "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the public release tag"
       ],
-      "breakingDigest": "sha256:347b65aecd38bc671d8f697eabd15254f905b6f745389d7b26d7595a904a720c",
-      "auditDigest": "sha256:159883394a38435e91dcff90e4c039cfccddf5282c874d3847d7dfe9fd64d9cf"
+      "breakingDigest": "sha256:0c5896590c8c9a44dfecbe060bcef1b43d3a9556737309dbe7e5f2bf83bfee6c",
+      "auditDigest": "sha256:a2d78432dae8488b0b3a2359eb0daa8f605910689529ea4d0f1b46b7613f00db"
     },
     {
       "contractVersion": 1,
@@ -235,7 +235,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:ce36cc21cfd3e0508a2a816292863dc2e11f19146b2624ef066fc9aaa4f4190e"
+      "auditDigest": "sha256:e4218271c4e24ea9b4a5bab04b4d0364c92774075a07d474e05a234eaceae2b1"
     },
     {
       "contractVersion": 1,
@@ -284,7 +284,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:ce36cc21cfd3e0508a2a816292863dc2e11f19146b2624ef066fc9aaa4f4190e"
+      "auditDigest": "sha256:e4218271c4e24ea9b4a5bab04b4d0364c92774075a07d474e05a234eaceae2b1"
     },
     {
       "contractVersion": 1,
@@ -412,7 +412,7 @@
         "CLI and JavaScript callers use the same Node API implementation"
       ],
       "breakingDigest": "sha256:bcd72ad6dfba8013c96f8b2f7b0a307d2e7713972a1219348f0d5ecc493939a0",
-      "auditDigest": "sha256:3d4b61918f31a24de8fb11b15a9544df2c9696f6bd8c7efb1e373f0745cb3ce0"
+      "auditDigest": "sha256:13914ebabbc92ed49dd842c2aa51cc99d72b0732423c0b53a030c6458a0cd9d8"
     },
     {
       "contractVersion": 1,
@@ -434,7 +434,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:a645ee2ca5b2da568709dd34b59bfa260effbc1fc43f70531fb70c6ad59e0201"
+      "auditDigest": "sha256:e48299d248fbea70481f03d7d3ce200e59ac0d8667cfb78b34307821cfe220d2"
     },
     {
       "contractVersion": 1,
@@ -456,9 +456,9 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:59643ae3425690a0ffd332d96f70439185c7bd454857fa11c5807fa551fecbdc"
+      "auditDigest": "sha256:2f9d529de163b590729dd01cda95eff0ebaed8152fab6502a26bfa32984b7d8a"
     }
   ],
-  "compatibilityDigest": "sha256:407d6d5ee6a96a34d2cc30db9ac64cf4b1819ab6d77bd7a57a07a124f22101ca",
-  "contractDigest": "sha256:5b29ec591bda827e2b1d710a8b55986cb3bca3395213596e5391b0e53bb08e6e"
+  "compatibilityDigest": "sha256:967df7e854fdf582294ddfb6403eff25c00db9518a24051e7d47cbd75527c785",
+  "contractDigest": "sha256:657034ebc39315b3450cd4c4356af2529b6a2ad03d0df680ec6010f3396df52d"
 }