@kungfu-tech/buildchain 2.10.3 → 2.10.4

package/dist/site/public-surface-audit.json

@@ -2063,7 +2063,7 @@
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "281c186e9dbdf45e55e8afcd59cfee66518f42c146d1b79dfd8837048c00bec8",
     "workflowRegistryDigest": "b24b2a68ae83941cbb6a719a62b4eafbd0f5e859e5810ae766ce9a5db69ddfae",
-    "pageRegistryDigest": "c3be81db06f3a183ce53cd0e9199b88be9c8b1d615c395f7fdbfac139796c455"
+    "pageRegistryDigest": "3f1337aa8d9a1ef1d9c607612db76705479d5a1b270360d001dfcbb1a68a69cb"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-08T10:30:54.924Z",
-  "publishedAt": "2026-07-08T10:30:54.924Z",
+  "generatedAt": "2026-07-08T12:25:38.748Z",
+  "publishedAt": "2026-07-08T12:25:38.748Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "c01d56a7410ded5f631a83950227873cef32c37b",
+  "sourceRevision": "2c2936458d8b1d9af67f4421af00a647de6284bb",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.10.3",
+    "version": "2.10.4",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -69,7 +69,7 @@
       "path": "docs/release-passport.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:75d8bade4b0b96b26941b11835c2debcdada8f1723412935fb8ae6884f08f9f3"
+      "digest": "sha256:ca764740841b364ff7cfea79b87221d29c09df09fee6d19e78ed4b0b173bfad3"
     },
     {
       "id": "release-candidate",
@@ -77,7 +77,7 @@
       "path": "docs/release-candidate.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:6b5107cded122925e8560a9b117ff1c96f5cf05d934caf83d7e4b2a4d777175e"
+      "digest": "sha256:391f14569c7d2a43dd9986c6a29462d674a77338dac6a4ac89c79a4c3d6c4947"
     },
     {
       "id": "release-propagation",
@@ -93,7 +93,7 @@
       "path": "docs/readme-badges.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:06eaef737dcc73a6526d856d79275ee87af9670f0e2be39a5596758bfc3527c9"
+      "digest": "sha256:ddaf49a7d6e6c11aea8d21d1ba736159897e16207cd74af0044014425faf8a2c"
     },
     {
       "id": "homebrew",
@@ -205,7 +205,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:e76aefe23b83f1b99b8c13cee1ca99760fd9902a41fbec25e193426329826340"
+      "digest": "sha256:a3f979fcede4450dabe5b8d6182395993c9f28559f7176b071a6ff9db565a355"
     },
     {
       "id": "publish-transaction",
@@ -221,7 +221,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:15fa0295ae2d97a2fd4ca17024d3da62df1057c9118b77a7e6b7550a404cd27b"
+      "digest": "sha256:69218a4749170e1f84b82f211d57187a7ff33f1a510aced587e240d1d901b9e7"
     },
     {
       "id": "release-flow",

package/docs/readme-badges.md

@@ -24,6 +24,7 @@ Use the public package export:
 import {
   collectBadgeBundleFacts,
   collectReadmeBadgeFacts,
+  createKfdBadgeSpecsFromStandards,
   renderBadgeBundleBlock,
   renderReadmeBadgeBlock,
   checkBadgeBundleBlock,
@@ -60,9 +61,11 @@ The Node API is the implementation source. The CLI delegates to it.
 `collectBadgeBundleFacts({ cwd, claims })` is the trust-badge bundle API. It
 uses the same repository facts, but returns contract
 `kungfu-buildchain-badge-bundle-facts` and only renders the Buildchain trust
-claims: `kfd-1`, `kfd-2`, `kfd-3`, and `release-passport`. Those four claims are
-enabled by default. Callers can pass `claims: "kfd-1,release-passport"` or an
-array to narrow the bundle without hand-writing badge Markdown.
+claims: every active `kfd-*` standard discovered from KFD standards metadata,
+plus `release-passport`. KFD-1, KFD-2, KFD-3, KFD-4, and release passport are
+enabled by default with current KFD metadata. Callers can pass
+`claims: "kfd-1,release-passport"` or an array to narrow the bundle without
+hand-writing badge Markdown.
 
 ## CLI
 
@@ -114,11 +117,12 @@ kfd_standards = "node_modules/@kungfu-tech/kfd/standards.json"
 kfd_1 = "declared"
 kfd_2 = "planned"
 kfd_3 = "aligned"
+kfd_4 = "declared"
 platforms = ["macOS", "Linux", "Windows"]
 workflows = ["verify.yml", "build.yml"]
 
 [badges.bundle]
-claims = ["kfd-1", "kfd-2", "kfd-3", "release-passport"]
+claims = ["kfd-1", "kfd-2", "kfd-3", "kfd-4", "release-passport"]
 ```
 
 `release_passport` may be a local path or URL. If omitted, Buildchain tries
@@ -161,12 +165,12 @@ may display a KFD state as `passed`.
 
 ## KFD Badge Rules
 
-KFD passed is evidence-backed. A repository may display `KFD-1 passed`,
-`KFD-2 passed`, or `KFD-3 passed` only when its own release passport verifies
-successfully and the corresponding passport section has `status: "passed"`.
-The KFD badge vocabulary comes from KFD standards metadata, not Buildchain
-private strings: for example KFD-2 uses the `releaseTrustPassport` concept from
-`@kungfu-tech/kfd/standards.json`.
+KFD passed is evidence-backed. A repository may display `KFD-N passed` only when
+its own release passport verifies successfully and the corresponding passport
+section has `status: "passed"`. The KFD badge vocabulary comes from KFD
+standards metadata, not Buildchain private strings: for example KFD-2 uses the
+`releaseTrustPassport` concept and KFD-4 uses the `observerPerspective` concept
+from `@kungfu-tech/kfd/standards.json`.
 
 When no release passport exists yet, or when the passport cannot be verified,
 Buildchain downgrades each KFD badge to the explicit local declaration such as

package/docs/release-candidate.md

@@ -84,12 +84,15 @@ generation scripts.
 
 By default, the wrapper forwards GitHub Release publication to the underlying
 `promote-buildchain-ref` semver model. Once the release transaction is complete,
-the action creates or updates the exact-tag GitHub Release, applies
+the action creates or updates the public GitHub Release, applies
 prerelease/latest metadata from the semver tag, and uploads the publish evidence
 file together with the generated release passport assets. This keeps
 npm/registry publication, Buildchain release passport persistence, and
 `release.published` propagation in one declarative reusable workflow. Consumers
 that do not publish GitHub Releases can opt out with `github-release: false`.
+For anchored/manual package releases, the public GitHub Release tag defaults to
+`v<publishedVersion>` while the internal transaction exact tag remains recorded
+in the release passport.
 
 Products that publish KFD release trust evidence can keep that path declarative
 too. Pass KFD-1 self contract witnesses, KFD-2 public claim files, and KFD-3

package/docs/release-governance.md

@@ -479,10 +479,13 @@ consumer shell glue. Consumers normally use the `release-candidate-promote.yml`
 wrapper, where GitHub Release publication is enabled by default and can be
 disabled with `github-release: false`; the wrapper passes that declaration to
 the action. After the publish transaction reaches `complete`, Buildchain creates
-or updates the exact-tag GitHub Release and uploads the generated
+or updates the public GitHub Release and uploads the generated
 `buildchain.release.json`, release-passport assets, and publish evidence. Semver
 prerelease tags are marked `prerelease=true` and `make_latest=false`; stable
-semver tags are marked latest. This is the supported path for downstream
+semver tags are marked latest. For anchored/manual package releases, the public
+release tag defaults to `v<publishedVersion>` while the internal exact
+transaction tag remains in the release passport and release-state ref. This is
+the supported path for downstream
 `release.published` propagation across semver, major, and promote-only release
 candidate publication models.
 

package/docs/release-passport.md

@@ -34,8 +34,11 @@ digests, trusted publishing evidence, and transaction result.
 
 Additive passport sections:
 
-- `release`: exact tag, line, channel, source SHA, target ref, release SHA,
-  release material SHA, publish tooling SHA, and durable release-state ref.
+- `release`: public release tag, internal transaction tag, line, channel,
+  source SHA, target ref, release SHA, release material SHA, publish tooling
+  SHA, and durable release-state ref. Anchored/manual package releases use the
+  published package version for the public tag while preserving the internal
+  exact transaction tag for Buildchain recovery.
 - `versionImpact`: final patch/minor/major classification, source, and
   rationale.
 - `surfaceImpacts`: per registered surface classification. The final impact is

package/docs/reusable-build-surface.md

@@ -628,13 +628,16 @@ resolution and before publish. A compatible `v2` drift leaves an issue in the
 consumer repository but does not trigger a second heavy build; an incompatible
 drift fails before publish side effects.
 
-The wrapper publishes the promoted exact tag as a GitHub Release by default.
+The wrapper publishes the public release tag as a GitHub Release by default.
 After `promote-buildchain-ref` reports a complete release transaction, the
-wrapper creates or updates the exact-tag release, marks semver prerelease tags
+wrapper creates or updates the public release, marks semver prerelease tags
 such as `v1.2.3-alpha.0`, `v1.2.3-rc.1`, or `v22.22.3-kf.3-alpha.7` as
 `prerelease=true` and `make_latest=false`, marks stable semver tags as latest,
 and uploads the publish evidence file plus every file in the generated release
 passport directory, including `buildchain.release.json` and `check-report.json`.
+For anchored/manual package releases, the public release tag is derived from the
+published package version and the internal exact transaction tag remains
+available in the release passport.
 Consumers do not need to hand-write `gh release` logic to trigger
 `release.published` propagation. Set `github-release: false` only for
 repositories that intentionally do not maintain GitHub Releases.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.10.3",
+  "version": "2.10.4",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -89,7 +89,7 @@
     "vitest": "^4.1.9"
   },
   "dependencies": {
-    "@kungfu-tech/kfd": "1.0.0-alpha.16",
+    "@kungfu-tech/kfd": "1.0.0-alpha.19",
     "smol-toml": "1.7.0"
   }
 }

package/packages/core/artifact-passport.js

@@ -297,14 +297,31 @@ function embeddedPointerCandidates(subject) {
     : [];
 }
 
-function githubReleasePassportLocation(subject, options) {
-  const repository = options.repository || subject.githubRelease?.repository || "";
-  const tag = options.tag || subject.githubRelease?.tag || "";
-  if (!repository || !tag) {
+function releaseTagForArtifactVersion(version = "") {
+  const value = optionalString(version).trim();
+  if (!value) {
     return "";
   }
+  return value.startsWith("v") ? value : `v${value}`;
+}
+
+function githubReleasePassportLocations(subject, options) {
+  const repository = options.repository || subject.githubRelease?.repository || "";
+  if (!repository) {
+    return [];
+  }
+  const tags = [
+    subject.githubRelease?.tag,
+    releaseTagForArtifactVersion(subject.version),
+    options.tag,
+  ].map(optionalString).filter(Boolean);
+  const uniqueTags = [...new Set(tags)];
   const baseUrl = (options.githubReleaseBaseUrl || "https://github.com").replace(/\/$/, "");
-  return `${baseUrl}/${repository}/releases/download/${encodeURIComponent(tag)}/buildchain.release.json`;
+  return uniqueTags.map((tag) => ({
+    tag,
+    repository,
+    location: `${baseUrl}/${repository}/releases/download/${encodeURIComponent(tag)}/buildchain.release.json`,
+  }));
 }
 
 export async function resolveArtifactSubject(subject, {
@@ -455,18 +472,27 @@ export async function discoverArtifactPassport({
       return found("local-config-index", matched.passportLocation, { locator: matched.locator });
     }
   }
-  const githubLocation = githubReleasePassportLocation(subject, { repository, tag, githubReleaseBaseUrl });
-  if (githubLocation) {
+  const githubLocations = githubReleasePassportLocations(subject, { repository, tag, githubReleaseBaseUrl });
+  for (const githubLocation of githubLocations) {
     try {
-      await readJsonFromLocation(githubLocation);
-      attempts.push({ method: "github-release-default", location: githubLocation, status: "found" });
-      return found("github-release-default", githubLocation, { repository: repository || subject.githubRelease?.repository || "", tag: tag || subject.githubRelease?.tag || "" });
+      await readJsonFromLocation(githubLocation.location);
+      attempts.push({
+        method: "github-release-default",
+        location: githubLocation.location,
+        status: "found",
+        details: { repository: githubLocation.repository, tag: githubLocation.tag },
+      });
+      return found("github-release-default", githubLocation.location, {
+        repository: githubLocation.repository,
+        tag: githubLocation.tag,
+      });
     } catch (error) {
       attempts.push({
         method: "github-release-default",
-        location: githubLocation,
+        location: githubLocation.location,
         status: "miss",
         error: error.message,
+        details: { repository: githubLocation.repository, tag: githubLocation.tag },
       });
     }
   }

package/packages/core/badges.js

@@ -9,6 +9,7 @@ export {
   checkReadmeBadgeBlock,
   collectBadgeBundleFacts,
   collectReadmeBadgeFacts,
+  createKfdBadgeSpecsFromStandards,
   createReadmeBadgeEndpointRegistry,
   readReadme,
   renderBadgeBundleBlock,

package/packages/core/buildchain-contract.js

@@ -207,7 +207,7 @@ export function createBuildchainContractWorld({ root = process.cwd(), packageJso
         "protected release refs and durable release-state are finalized by Buildchain",
         "release passport finalization is idempotent after publish side effects",
         "publish transactions can require a resolved publish-gate source lock to prevent floating-ref drift",
-        "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the exact tag",
+        "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the public release tag",
       ],
     }),
     surface(root, {

package/packages/core/buildchain-kfd-claims.js

@@ -353,7 +353,7 @@ export function createBuildchainPublicClaimDefinitions() {
     },
     {
       id: "claim:buildchain-semver-github-release",
-      claim: "Semver promotion can create or update an exact-tag GitHub Release only after the publish transaction completes, and uploads Buildchain release passport/evidence assets.",
+      claim: "Semver promotion can create or update the public GitHub Release only after the publish transaction completes, and uploads Buildchain release passport/evidence assets while preserving the internal transaction exact tag.",
       sourcePaths: [
         "actions/promote-buildchain-ref/index.js",
         "actions/promote-buildchain-ref/action.yml",

package/packages/core/index.js

@@ -238,6 +238,7 @@ export {
   checkReadmeBadgeBlock,
   collectBadgeBundleFacts,
   collectReadmeBadgeFacts,
+  createKfdBadgeSpecsFromStandards,
   createReadmeBadgeEndpointRegistry,
   readReadme,
   renderBadgeBundleBlock,

package/packages/core/readme-badges.js

@@ -18,19 +18,22 @@ export const BADGE_BUNDLE_DEFAULT_CLAIMS = [
   "kfd-1",
   "kfd-2",
   "kfd-3",
+  "kfd-4",
   "release-passport",
 ];
 
-const KFD_KEYS = [
+const KFD_FALLBACK_KEYS = [
   { key: "kfd-1", id: "kfd1", label: "KFD-1", text: "contract world" },
   { key: "kfd-2", id: "kfd2", label: "KFD-2", text: "trust passport" },
   { key: "kfd-3", id: "kfd3", label: "KFD-3", text: "collaboration interface" },
+  { key: "kfd-4", id: "kfd4", label: "KFD-4", text: "timeline observer" },
 ];
 
 const KFD_BADGE_CONCEPTS = {
   "kfd-1": "contractWorld",
   "kfd-2": "releaseTrustPassport",
   "kfd-3": "collaborationInterface",
+  "kfd-4": "observerPerspective",
 };
 
 const requireFromHere = createRequire(import.meta.url);
@@ -47,23 +50,7 @@ const STATE_COLORS = {
   unknown: "6e7781",
 };
 
-const BUILDCHAIN_BADGE_IDS = [
-  "kfd-1",
-  "kfd-2",
-  "kfd-3",
-  "buildchain-release-passport",
-];
-
-const BADGE_BUNDLE_CLAIM_ALIASES = {
-  kfd1: "kfd-1",
-  "kfd_1": "kfd-1",
-  "kfd-1": "kfd-1",
-  kfd2: "kfd-2",
-  "kfd_2": "kfd-2",
-  "kfd-2": "kfd-2",
-  kfd3: "kfd-3",
-  "kfd_3": "kfd-3",
-  "kfd-3": "kfd-3",
+const STATIC_BADGE_BUNDLE_CLAIM_ALIASES = {
   passport: "release-passport",
   "release_passport": "release-passport",
   "release-passport": "release-passport",
@@ -136,10 +123,20 @@ function hostedBadgeUrl({ badgeConfig = {}, id, state }) {
   return `${badgeEndpointBaseUrl(badgeConfig)}/${encodeURIComponent(id)}/${encodeURIComponent(state || "unknown")}.svg`;
 }
 
-export function createReadmeBadgeEndpointRegistry({ kfdSpecs = KFD_KEYS } = {}) {
+export function createKfdBadgeSpecsFromStandards(standardsMetadata) {
+  return kfdBadgeSpecs(summarizeKfdStandards({
+    value: standardsMetadata && typeof standardsMetadata === "object" ? standardsMetadata : undefined,
+    source: "provided",
+  }));
+}
+
+export function createReadmeBadgeEndpointRegistry({ kfdSpecs = undefined, kfdStandards = undefined } = {}) {
+  const effectiveKfdSpecs = Array.isArray(kfdSpecs) && kfdSpecs.length > 0
+    ? kfdSpecs
+    : createKfdBadgeSpecsFromStandards(kfdStandards);
   const states = Object.keys(STATE_COLORS).filter((state) => state !== "unknown");
   const specs = [
-    ...kfdSpecs.map((entry) => ({
+    ...effectiveKfdSpecs.map((entry) => ({
       id: entry.key,
       label: entry.label,
       messageTemplate: `${entry.text} {state}`,
@@ -211,15 +208,55 @@ function splitClaimList(value) {
   return [];
 }
 
-function normalizeBadgeBundleClaims(value, fallback = BADGE_BUNDLE_DEFAULT_CLAIMS) {
+function fallbackKfdEntryForKey(key) {
+  return KFD_FALLBACK_KEYS.find((entry) => entry.key === key) || {};
+}
+
+function normalizeKfdKey(value) {
+  const normalized = String(value || "").trim().toLowerCase().replace(/_/g, "-");
+  const match = normalized.match(/^kfd-?(\d+)$/);
+  return match ? `kfd-${match[1]}` : normalized;
+}
+
+function kfdSortValue(key) {
+  const match = String(key || "").match(/^kfd-(\d+)$/);
+  return match ? Number(match[1]) : Number.MAX_SAFE_INTEGER;
+}
+
+function sortedKfdKeys(keys = []) {
+  return [...new Set(keys.map(normalizeKfdKey).filter((key) => /^kfd-\d+$/.test(key)))]
+    .sort((left, right) => {
+      const numeric = kfdSortValue(left) - kfdSortValue(right);
+      return numeric || left.localeCompare(right);
+    });
+}
+
+function defaultBadgeBundleClaimsForKfd(kfdSpecs = KFD_FALLBACK_KEYS) {
+  const claims = sortedKfdKeys(kfdSpecs.map((entry) => entry.key));
+  return [...claims, "release-passport"];
+}
+
+function badgeBundleClaimAliases(kfdSpecs = KFD_FALLBACK_KEYS) {
+  const aliases = { ...STATIC_BADGE_BUNDLE_CLAIM_ALIASES };
+  for (const key of sortedKfdKeys(kfdSpecs.map((entry) => entry.key))) {
+    const number = key.replace(/^kfd-/, "");
+    aliases[key] = key;
+    aliases[`kfd${number}`] = key;
+    aliases[`kfd_${number}`] = key;
+  }
+  return aliases;
+}
+
+function normalizeBadgeBundleClaims(value, fallback = BADGE_BUNDLE_DEFAULT_CLAIMS, kfdSpecs = KFD_FALLBACK_KEYS) {
   const selected = [];
   const unknown = [];
+  const aliases = badgeBundleClaimAliases(kfdSpecs);
   for (const claim of splitClaimList(value)) {
     const key = String(claim || "").trim().toLowerCase();
     if (!key) {
       continue;
     }
-    const normalized = BADGE_BUNDLE_CLAIM_ALIASES[key];
+    const normalized = aliases[key.replace(/_/g, "-")] || aliases[key];
     if (!normalized) {
       unknown.push(key);
       continue;
@@ -234,13 +271,18 @@ function normalizeBadgeBundleClaims(value, fallback = BADGE_BUNDLE_DEFAULT_CLAIM
   return selected.length > 0 ? selected : [...fallback];
 }
 
-function badgeBundleConfig(badgeConfig = {}) {
+function badgeBundleConfig(badgeConfig = {}, kfdSpecs = KFD_FALLBACK_KEYS) {
   const configured = badgeConfig.bundle && typeof badgeConfig.bundle === "object"
     ? badgeConfig.bundle
     : {};
+  const defaultClaims = defaultBadgeBundleClaimsForKfd(kfdSpecs);
   return {
     enabled: configured.enabled === undefined ? true : Boolean(configured.enabled),
-    claims: normalizeBadgeBundleClaims(configured.claims || badgeConfig.bundle_claims || badgeConfig.bundleClaims),
+    claims: normalizeBadgeBundleClaims(
+      configured.claims || badgeConfig.bundle_claims || badgeConfig.bundleClaims,
+      defaultClaims,
+      kfdSpecs,
+    ),
     mode: String(configured.mode || "readme"),
     hosted: configured.hosted === undefined ? true : Boolean(configured.hosted),
   };
@@ -320,6 +362,13 @@ function summarizeKfdStandards(loaded) {
   const standards = loaded?.value?.standards && typeof loaded.value.standards === "object"
     ? loaded.value.standards
     : {};
+  const discoveredKeys = sortedKfdKeys(Object.keys(standards).filter((key) => {
+    const standard = standards[key];
+    return standard && typeof standard === "object" && standard.status !== "retired";
+  }));
+  const keys = discoveredKeys.length > 0
+    ? discoveredKeys
+    : sortedKfdKeys(KFD_FALLBACK_KEYS.map((entry) => entry.key));
   const summary = {
     contract: loaded?.value?.contract || "",
     schemaVersion: loaded?.value?.schemaVersion || undefined,
@@ -331,20 +380,22 @@ function summarizeKfdStandards(loaded) {
     error: loaded?.error || "",
     standards: {},
   };
-  for (const fallback of KFD_KEYS) {
-    const standard = standards[fallback.key] || {};
-    const conceptKey = KFD_BADGE_CONCEPTS[fallback.key];
-    summary.standards[fallback.key] = {
-      key: standard.key || fallback.key,
-      id: standard.id || fallback.label,
-      label: standard.label || fallback.label,
+  for (const key of keys) {
+    const fallback = fallbackKfdEntryForKey(key);
+    const standard = standards[key] || {};
+    const conceptKey = KFD_BADGE_CONCEPTS[key] || Object.keys(standard.interfaces || {})[0] || Object.keys(standard.concepts || {})[0] || "";
+    const label = standard.label || fallback.label || String(key).toUpperCase();
+    summary.standards[key] = {
+      key: standard.key || key,
+      id: standard.id || fallback.id || label,
+      label,
       title: standard.title || "",
       status: standard.status || "",
       revision: standard.revision || undefined,
       documentUrl: standard.document?.url || "",
       documentPath: standard.document?.path || "",
       documentSha256: standard.document?.sha256 || "",
-      badgeText: standard.concepts?.[conceptKey] || fallback.text,
+      badgeText: standard.concepts?.[conceptKey] || fallback.text || label,
       interfaceContract: conceptKey ? standard.interfaces?.[conceptKey]?.contract || "" : "",
       schemaId: conceptKey ? standard.interfaces?.[conceptKey]?.schemaId || standard.schemaIds?.[conceptKey] || "" : "",
     };
@@ -353,12 +404,15 @@ function summarizeKfdStandards(loaded) {
 }
 
 function kfdBadgeSpecs(kfdStandards) {
-  return KFD_KEYS.map((fallback) => {
-    const standard = kfdStandards?.standards?.[fallback.key] || {};
+  const keys = sortedKfdKeys(Object.keys(kfdStandards?.standards || {}));
+  return keys.map((key) => {
+    const fallback = fallbackKfdEntryForKey(key);
+    const standard = kfdStandards?.standards?.[key] || {};
     return {
       ...fallback,
+      key,
       label: standard.label || fallback.label,
-      text: standard.badgeText || fallback.text,
+      text: standard.badgeText || fallback.text || standard.label || key.toUpperCase(),
       title: standard.title || "",
       standardDocumentUrl: standard.documentUrl || "",
       standardDocumentSha256: standard.documentSha256 || "",
@@ -664,7 +718,8 @@ export async function collectReadmeBadgeFacts({ cwd = process.cwd() } = {}) {
       : releasePassportLocation;
   const releaseState = releasePassportState({ report, error, badgeConfig });
   const kfdStandards = summarizeKfdStandards(await loadKfdStandards({ cwd: resolvedCwd, badgeConfig }));
-  const kfd = kfdBadgeSpecs(kfdStandards).map((entry) => {
+  const kfdSpecs = kfdBadgeSpecs(kfdStandards);
+  const kfd = kfdSpecs.map((entry) => {
     const passed = kfdSectionPassed({ passport, report, key: entry.key });
     const state = passed ? "passed" : declaredKfdState({ badgeConfig, key: entry.key, id: entry.id });
     return {
@@ -719,10 +774,13 @@ export async function collectReadmeBadgeFacts({ cwd = process.cwd() } = {}) {
     badgeRuntime: {
       provider: "buildchain-hosted",
       endpointBaseUrl: badgeEndpointBaseUrl(badgeConfig),
-      hostedBadgeIds: BUILDCHAIN_BADGE_IDS,
+      hostedBadgeIds: [
+        ...defaultBadgeBundleClaimsForKfd(kfdSpecs).filter((claim) => claim !== "release-passport"),
+        "buildchain-release-passport",
+      ],
       logoPolicy: BUILDCHAIN_BADGE_LOGO_PLACEHOLDER,
     },
-    badgeBundle: badgeBundleConfig(badgeConfig),
+    badgeBundle: badgeBundleConfig(badgeConfig, kfdSpecs),
     badges: [],
   };
   facts.badges = buildBadgeEntries(facts, { badgeConfig });
@@ -733,7 +791,7 @@ export async function collectBadgeBundleFacts({ cwd = process.cwd(), claims = un
   const readmeFacts = await collectReadmeBadgeFacts({ cwd });
   const config = {
     ...readmeFacts.badgeBundle,
-    claims: normalizeBadgeBundleClaims(claims, readmeFacts.badgeBundle.claims),
+    claims: normalizeBadgeBundleClaims(claims, readmeFacts.badgeBundle.claims, readmeFacts.kfd),
   };
   const badges = buildBadgeBundleEntries(readmeFacts, config);
   return {
@@ -746,6 +804,7 @@ export async function collectBadgeBundleFacts({ cwd = process.cwd(), claims = un
     sourceFactsSha256: hashText(JSON.stringify(readmeFacts)),
     policy: {
       defaultClaims: [...BADGE_BUNDLE_DEFAULT_CLAIMS],
+      discoveredDefaultClaims: defaultBadgeBundleClaimsForKfd(readmeFacts.kfd),
       claims: config.claims,
       hosted: config.hosted,
       mode: config.mode,

package/packages/core/release-passport.js

@@ -1032,6 +1032,7 @@ export function createReleasePassport({
     },
     release: {
       tag: normalizedTag,
+      publicTag: optionalString(release.publicTag || release.public_tag || normalizedTag),
       internalTag: optionalString(release.internalTag || release.internal_tag || normalizedTag),
       internalVersion,
       publishedVersion,

package/scripts/check-inventory.mjs

@@ -271,6 +271,7 @@ for (const requiredSnippet of [
   "renderReadmeBadgeBlock",
   "checkReadmeBadgeBlock",
   "updateReadmeBadgeBlock",
+  "createKfdBadgeSpecsFromStandards",
   "createReadmeBadgeEndpointRegistry",
 ]) {
   if (!coreIndexSource.includes(requiredSnippet)) {
@@ -761,6 +762,7 @@ for (const requiredSnippet of [
   "github-release:",
   "github-release-title:",
   "github-release-notes:",
+  "public-release-tag:",
   "github-release-url:",
   "github-release-action:",
 ]) {