@kungfu-tech/buildchain 2.11.1 → 2.11.2-alpha.2

package/dist/site/publication-registry.json

@@ -0,0 +1,109 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-publication-release-registry",
+  "generatedAt": "2026-07-09T16:06:47.861Z",
+  "publishedAt": "2026-07-09T16:06:47.861Z",
+  "reproducible": true,
+  "timestampPolicy": "ci-injected",
+  "deterministicInputs": [
+    "README.md",
+    "docs/*.md",
+    "actions/*/README.md",
+    "fixtures/*/README.md",
+    "packages/core/README.md",
+    "package.json#exports",
+    "tests/buildchain-inventory.json",
+    "sourceRevision",
+    "sourceDateEpoch",
+    "package content",
+    "declared Buildchain surface manifest contract"
+  ],
+  "sourceDateEpoch": "0",
+  "sourceRevision": "b93fcd8237e6060596fc6bcb82198e9097356f5b",
+  "timestampPolicyDetails": {
+    "contract": "kungfu-buildchain-surface-timestamp-policy",
+    "timestampFields": [
+      "generatedAt",
+      "publishedAt"
+    ],
+    "timestampFieldsParticipateInArtifactDigest": true,
+    "artifactDigestScope": "npm package dist/site JSON files",
+    "note": "Human-readable timestamps are separate from reproducibility inputs; do not infer reproducibility from epoch timestamps."
+  },
+  "package": {
+    "name": "@kungfu-tech/buildchain",
+    "version": "2.11.2-alpha.2",
+    "versionSource": "package.json#version"
+  },
+  "sourceKind": "package-site-bundle",
+  "sourceBoundary": {
+    "truthOwner": "@kungfu-tech/buildchain",
+    "siteRole": "rendering, routing, archive preservation checks, and agent discovery",
+    "rule": "Downstream papers sites render this registry; Buildchain owns publication route, latest, immutable artifact, passport, and source bundle facts."
+  },
+  "archivePolicy": {
+    "contract": "kungfu-buildchain-publication-archive-policy",
+    "mutableRouteKinds": [
+      "canonical-reader",
+      "latest",
+      "registry-index"
+    ],
+    "immutableRouteKinds": [
+      "version-artifact",
+      "version-passport",
+      "version-source"
+    ],
+    "deploymentBoundary": "append-only immutable version prefixes",
+    "rule": "A site build may update latest and canonical reader pages, but it must not delete or overwrite files under a declared immutable version prefix."
+  },
+  "publications": [
+    {
+      "id": "publication-archive-fixture",
+      "title": "Publication Archive Fixture",
+      "summary": "A paper-shaped Buildchain package fact proving that site rendering preserves immutable versioned PDF, source, and passport routes while latest pages can move.",
+      "canonicalReader": {
+        "kind": "canonical-reader",
+        "url": "https://kungfu.tech/whitepaper/",
+        "owner": "site-kungfu-tech"
+      },
+      "latest": {
+        "kind": "latest",
+        "version": "0.1.0",
+        "path": "/publication-archive-fixture/latest/"
+      },
+      "immutablePrefixTemplate": "/publication-archive-fixture/v{version}/",
+      "versions": [
+        {
+          "version": "0.1.0",
+          "releasedAt": "2026-07-09T00:00:00.000Z",
+          "immutable": true,
+          "immutablePath": "/publication-archive-fixture/v0.1.0/",
+          "source": {
+            "repository": "https://github.com/kungfu-systems/publication-archive-fixture",
+            "tag": "v0.1.0",
+            "commit": "0000000000000000000000000000000000000000",
+            "bundle": {
+              "path": "source.tar.gz",
+              "sha256": "sha256:e2ca891dbf441f867ed135b21b3556ee5cdcd3ec80038f267a3ecff496c5a38b",
+              "fixtureBodyBase64": "c2l0ZS1saWJrdW5nZnUtZGV2IHB1YmxpY2F0aW9uIGFyY2hpdmUgZml4dHVyZSBzb3VyY2UgYnVuZGxlCnZlcnNpb246IDAuMS4wCg=="
+            }
+          },
+          "passport": {
+            "path": "publication-artifact-passport.json",
+            "sha256": "sha256:ca214e2e17c8d3c01565e507e57d5b440943c762199aa8d9de21995940538cea",
+            "fixtureBodyBase64": "ewogICJjb250cmFjdCI6ICJrdW5nZnUtYnVpbGRjaGFpbi1wdWJsaWNhdGlvbi1hcnRpZmFjdC1wYXNzcG9ydCIsCiAgInB1YmxpY2F0aW9uIjogInB1YmxpY2F0aW9uLWFyY2hpdmUtZml4dHVyZSIsCiAgInZlcnNpb24iOiAiMC4xLjAiLAogICJzdGF0dXMiOiAiZml4dHVyZSIKfQo="
+          },
+          "artifacts": [
+            {
+              "role": "pdf",
+              "path": "main.pdf",
+              "mediaType": "application/pdf",
+              "sha256": "sha256:c1c2020cbdcf0cc339323d2276480a48d9b8d7da9be1d19ab58a0b3c0b7a4fbb",
+              "fixtureBodyBase64": "JVBERi0xLjQKJSBzaXRlLWxpYmt1bmdmdS1kZXYgcHVibGljYXRpb24gYXJjaGl2ZSBmaXh0dXJlCjEgMCBvYmogPDwgL1R5cGUgL0NhdGFsb2cgL1BhZ2VzIDIgMCBSID4+IGVuZG9iagoyIDAgb2JqIDw8IC9UeXBlIC9QYWdlcyAvS2lkcyBbMyAwIFJdIC9Db3VudCAxID4+IGVuZG9iagozIDAgb2JqIDw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMiAwIFIgL01lZGlhQm94IFswIDAgMzAwIDE0NF0gL0NvbnRlbnRzIDQgMCBSID4+IGVuZG9iago0IDAgb2JqIDw8IC9MZW5ndGggNzIgPj4gc3RyZWFtCkJUIC9GMSAxMiBUZiAzNiAxMDAgVGQgKFB1YmxpY2F0aW9uIGFyY2hpdmUgZml4dHVyZSB2MC4xLjApIFRqIEVUCmVuZHN0cmVhbSBlbmRvYmoKeHJlZgowIDUKMDAwMDAwMDAwMCA2NTUzNSBmIAp0cmFpbGVyIDw8IC9Sb290IDEgMCBSIC9TaXplIDUgPj4Kc3RhcnR4cmVmCjM2MAolJUVPRgo="
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/dist/site/release-provenance.json

@@ -24,6 +24,7 @@
       "./public-surface-audit": "./packages/core/public-surface-audit.js",
       "./logging": "./packages/core/logging.js",
       "./publication-artifact": "./packages/core/publication-artifact.js",
+      "./publication-package": "./packages/core/publication-package.js",
       "./kfd-gate": "./packages/core/kfd-gate.js",
       "./release-candidate": "./packages/core/release-candidate.js",
       "./release-passport": "./packages/core/release-passport.js",
@@ -32,6 +33,7 @@
       "./buildchain-kfd-claims": "./packages/core/buildchain-kfd-claims.js",
       "./site/buildchain-site.json": "./dist/site/buildchain-site.json",
       "./site/site-manifest.json": "./dist/site/site-manifest.json",
+      "./site/publication-registry.json": "./dist/site/publication-registry.json",
       "./site/page-registry.json": "./dist/site/page-registry.json",
       "./site/capability-registry.json": "./dist/site/capability-registry.json",
       "./site/cli-registry.json": "./dist/site/cli-registry.json",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-09T11:53:37.992Z",
-  "publishedAt": "2026-07-09T11:53:37.992Z",
+  "generatedAt": "2026-07-09T16:06:47.861Z",
+  "publishedAt": "2026-07-09T16:06:47.861Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "eca0282a03517a31383b533e27a7ee09c46a8392",
+  "sourceRevision": "b93fcd8237e6060596fc6bcb82198e9097356f5b",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.1",
+    "version": "2.11.2-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:795464d3d84af5698b19a26821dbd16040c258b708e070daaaba6d55e6ad81f7"
+      "digest": "sha256:886d073bd37ac655e1ad9659baf161c72ef796b6032c5c3332218ac8198c2aeb"
     },
     {
       "id": "install",
@@ -141,7 +141,7 @@
       "path": "docs/site-bundle-contract.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:6b5bc2ee0f785b16d762f140f14a9163c07caf0d424200c2ececc74f7bb2271c"
+      "digest": "sha256:d67a874b356fbfbee9a5d5ece7021fb52b2848347dc6a14f5562c98570096916"
     },
     {
       "id": "migration-inventory",
@@ -173,7 +173,7 @@
       "path": "docs/cli.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:4b31f7ff5330cde8ab32b237f533c7af76463cce570d67dd14669c3a14c83c84"
+      "digest": "sha256:81624885888c9e357db128f644f93dcab2286910df426b532730b0141d7cb00d"
     },
     {
       "id": "build-facts",
@@ -267,6 +267,7 @@
     "release-model.json",
     "artifact-schemas.json",
     "badge-endpoint-registry.json",
+    "publication-registry.json",
     "product-mechanism.json",
     "release-provenance.json",
     "kfd-upstream-aggregate.json",

package/dist/site/workflow-registry.json

@@ -479,6 +479,48 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": "paper-release",
+      "path": ".github/workflows/paper-release.yml",
+      "inputs": [
+        "artifact-name",
+        "artifact-retention-days",
+        "branch-protection-bypass-apps",
+        "branch-protection-bypass-teams",
+        "branch-protection-bypass-users",
+        "build-command",
+        "buildchain-contract-compatibility-policy",
+        "buildchain-contract-drift-issue-mode",
+        "buildchain-contract-lock-path",
+        "buildchain-ref",
+        "buildchain-repository",
+        "dry-run",
+        "github-release",
+        "github-release-notes",
+        "github-release-title",
+        "node-version",
+        "package-name",
+        "publish-dist-tag",
+        "publish-package-set-order",
+        "release-passport-impact-json",
+        "release-passport-output-dir",
+        "release-passport-product-name",
+        "required-status-check",
+        "setup-node",
+        "target-ref",
+        "target-sha",
+        "toolchain-command",
+        "toolchain-digest",
+        "toolchain-image",
+        "toolchain-type",
+        "verify-command",
+        "working-directory"
+      ],
+      "inputCount": 32,
+      "surface": "reusable-build",
+      "capabilityGroup": "reusable-build",
+      "status": "active"
+    },
     {
       "id": "patrol-daily",
       "path": ".github/workflows/patrol-daily.yml",

package/docs/MAP.md

@@ -31,7 +31,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Reusable Build and Lifecycle | `workflow-registry.json`, `release-model.json` | [`reusable-build-surface.md`](reusable-build-surface.md), [`lifecycle-protocol.md`](lifecycle-protocol.md) |
 | KFD Trust and Surface Closure | `kfd-claims.json`, `public-surface-audit.json`, `cli-registry.json`, `node-api-registry.json` | [`kfd-support.md`](kfd-support.md), [`release-passport.md`](release-passport.md) |
 | Site Bundle, Web Surfaces, and Propagation | `buildchain-site.json`, `site-manifest.json`, `page-registry.json`, `release-model.json` | [`site-bundle-contract.md`](site-bundle-contract.md), [`web-surface-deployments.md`](web-surface-deployments.md), [`release-propagation.md`](release-propagation.md) |
-| Publication Artifacts | `workflow-registry.json`, `node-api-registry.json`, `manual-registry.json`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md), [`reusable-build-surface.md`](reusable-build-surface.md) |
+| Publication Artifacts | `publication-registry.json`, `workflow-registry.json`, `node-api-registry.json`, `manual-registry.json`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md), [`reusable-build-surface.md`](reusable-build-surface.md) |
 | Distribution Indexes and Badges | `badge-endpoint-registry.json`, `node-api-registry.json`, `manual-registry.json` | [`readme-badges.md`](readme-badges.md), [`homebrew.md`](homebrew.md) |
 | Build Facts, Observability, and Diagnostics | `cli-registry.json`, `node-api-registry.json`, lifecycle artifacts | [`build-facts.md`](build-facts.md), [`toolkit-observability.md`](toolkit-observability.md), [`consumer-issue-reporting.md`](consumer-issue-reporting.md) |
 | Governance, Versioning, and Runtime Drift | `buildchain-contract.json`, `workflow-registry.json`, `release-model.json` | [`release-governance.md`](release-governance.md), [`release-flow.md`](release-flow.md), [`versioning.md`](versioning.md), [`runtime-train-validation.md`](runtime-train-validation.md) |
@@ -48,7 +48,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Git/source/version/module/product build facts | `dist/site/node-api-registry.json`, `dist/site/cli-registry.json`, `kungfu-buildchain-module-build-facts`, `kungfu-buildchain-product-build-facts` | [`build-facts.md`](build-facts.md) |
 | GitHub Release passport/evidence publication | `dist/site/release-model.json`, `dist/site/artifact-schemas.json` | [`release-governance.md`](release-governance.md), [`release-candidate.md`](release-candidate.md) |
 | release propagation for package/publication/site chains | `dist/site/release-model.json` | [`release-propagation.md`](release-propagation.md) |
-| publication artifact manifests, immutable archive registries, source bundles, and paper repository workflows | `dist/site/workflow-registry.json`, `dist/site/node-api-registry.json`, `kungfu-buildchain-publication-artifact-manifest`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md) |
+| publication artifact manifests, immutable archive registries, source bundles, and paper repository workflows | `dist/site/publication-registry.json`, `dist/site/workflow-registry.json`, `dist/site/node-api-registry.json`, `kungfu-buildchain-publication-artifact-manifest`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md) |
 | Generated badge bundles, README badge blocks, and badge facts | `dist/site/node-api-registry.json`, `dist/site/manual-registry.json`, `kungfu-buildchain-badge-bundle-facts`, `kungfu-buildchain-readme-badge-facts` | [`readme-badges.md`](readme-badges.md) |
 | Homebrew tap distribution indexes | `dist/site/node-api-registry.json`, `dist/site/buildchain-contract.json` | [`homebrew.md`](homebrew.md) |
 | Buildchain CLI manual | `dist/site/cli-registry.json`, `dist/site/manual-registry.json` | [`cli.md`](cli.md) |
@@ -87,7 +87,7 @@ replace them.
 | How do I detect, register, audit, witness, or query KFD-3 product surfaces? | [`kfd-support.md`](kfd-support.md) + [`cli.md`](cli.md) | verify/use | stable |
 | How do I keep `@v2` floating refs while detecting Buildchain contract drift? | [`reusable-build-surface.md`](reusable-build-surface.md#floating-ref-contract-lock) | verify/use | stable |
 | How do I propagate finalized upstream releases to downstream package/site PRs? | [`release-propagation.md`](release-propagation.md) | use | preview |
-| How do paper or report repositories publish PDFs, metadata, source bundles, and site-consumable manifests? | [`publication-artifacts.md`](publication-artifacts.md) | use | stable |
+| How do paper or report repositories publish PDFs, metadata, source bundles, site-consumable manifests, npm packages, and GitHub Releases? | [`publication-artifacts.md`](publication-artifacts.md) | use | stable |
 | How do I generate KFD / Release Passport badge bundles without hand-maintaining Markdown? | [`readme-badges.md`](readme-badges.md) + [`cli.md`](cli.md) | use | stable |
 | How do I generate and verify a Homebrew tap from release passport evidence? | [`homebrew.md`](homebrew.md) + [`cli.md`](cli.md) | use/verify | stable |
 | How do I prove a PR-stage reusable build is the artifact source promoted later? | [`release-candidate.md`](release-candidate.md) + [`reusable-build-surface.md`](reusable-build-surface.md) | verify | stable |

package/docs/cli.md

@@ -398,6 +398,19 @@ buildchain publication-artifact manifest \
   --json
 ```
 
+Generate the Buildchain-owned npm paper package contents from declared
+publication facts:
+
+```bash
+buildchain publication-artifact npm-package --json
+```
+
+This command reads `project.type = "publication-artifact"`,
+`publication.version`, and `[publish] kind = "npm-paper-package"` plus
+`publish.package`; it writes `.buildchain/publication/npm-package` by default.
+The `paper-release.yml@v2` reusable workflow uses the same command before
+running the standard npm publish transaction.
+
 The command writes `.buildchain/publication/publication-artifact.json`,
 `.buildchain/publication/publication-artifact-passport.json`, a source bundle,
 and, when `[publication.archive]` is configured,

package/docs/publication-artifacts.md

@@ -50,6 +50,11 @@ image = "ghcr.io/kungfu-systems/build-images/latex-pdf-builder"
 digest = "sha256:c20f3809e96836c1c78e97c76939d12f1de3fed0ea9b7c40c43332ec2ea480f8"
 command = "latexmk -pdf -outdir=_build paper/main.tex"
 
+[publish]
+kind = "npm-paper-package"
+package = "@kungfu-tech/paper-observer-declared-timelines"
+auth = "trusted-publishing"
+
 [lifecycle.build]
 command = "make pdf"
 
@@ -91,9 +96,16 @@ for compatibility, but the passport records it as lower trust because
 Buildchain can record the command boundary without proving the compiler or
 LaTeX distribution digest.
 
+`publish.kind = "npm-paper-package"` declares that Buildchain, not the consumer
+repository, owns the standard paper npm package shape and release transaction
+mechanics. `publish.package` is the public npm package that contains the PDF,
+publication manifest, publication passport, optional archive registry, source
+bundle, and declared metadata files.
+
 ## Reusable Workflow
 
-Consumer repositories can call the Buildchain wrapper directly:
+Consumer repositories that only need to build and upload paper evidence can
+call the build-only wrapper directly:
 
 ```yaml
 jobs:
@@ -106,7 +118,7 @@ jobs:
       buildchain-contract-lock-path: .buildchain/contract-lock.json
 ```
 
-The workflow:
+The build-only workflow:
 
 - resolves the Buildchain runtime and checks the floating contract lock before
   any paper build runs;
@@ -126,10 +138,76 @@ The workflow:
 - uploads one GitHub artifact containing the PDF, manifest, passport, optional
   registry, and source bundle.
 
-The wrapper is build-only. It does not publish npm packages, deploy web pages,
-or create GitHub Releases. Release publication can be layered later by a
-repository-specific governance workflow that attaches the generated manifest
-and passport as release assets.
+It does not publish npm packages, deploy web pages, or create GitHub Releases.
+
+## Paper Release Preset
+
+Paper repositories that publish a versioned npm package should use the
+Buildchain-managed release preset instead of copying npm transaction scripts or
+promotion YAML:
+
+```yaml
+name: Paper Release
+
+on:
+  push:
+    branches:
+      - alpha/v1/v1.0
+      - release/v1/v1.0
+  workflow_dispatch:
+    inputs:
+      buildchain-ref:
+        description: "Temporary Buildchain runtime ref"
+        required: false
+        default: ""
+
+jobs:
+  paper-release:
+    uses: kungfu-systems/buildchain/.github/workflows/paper-release.yml@v2
+    permissions:
+      contents: write
+      id-token: write
+      issues: write
+    with:
+      buildchain-ref: ${{ inputs.buildchain-ref || '' }}
+      toolchain-type: config
+      verify-command: make check
+      buildchain-contract-lock-path: .buildchain/contract-lock.json
+```
+
+The preset:
+
+- resolves the same floating Buildchain runtime and contract lock as the build
+  workflow;
+- builds the PDF through the declared pinned LaTeX Docker toolchain or custom
+  command;
+- verifies the paper repository;
+- writes the publication manifest, publication passport, optional archive
+  registry, and source bundle;
+- synthesizes an npm package from `[publication]` and `[publish]` declarations
+  under `.buildchain/publication/npm-package`;
+- computes npm-style `sha512` integrity from `npm pack --dry-run` and passes
+  it as `publish-required-artifacts-json`;
+- creates a `publish-gate/<alpha|release>/.../<version>` source lock for the
+  channel commit and requires `promote-buildchain-ref` to verify that lock
+  before any publish side effect;
+- publishes the package through npm Trusted Publishing;
+- writes Buildchain release/passport evidence; and
+- creates or updates the exact-version GitHub Release by default.
+
+Consumers can opt out of the GitHub Release with `github-release: false`, but
+the default is on so downstream release propagation can observe
+`release.published` without hand-written `gh release` steps.
+
+For npm Trusted Publishing, register the consumer workflow file that calls this
+preset, for example `.github/workflows/paper-release.yml`, against the declared
+package in npm. The trusted publisher is the consumer repository and workflow
+file; the implementation still runs inside Buildchain's reusable workflow.
+
+Standard paper repositories should not carry local copies of
+`scripts/npm-publish-transaction.mjs`, package-generation scripts, or
+promotion/ref-lock YAML. If the default package shape is insufficient, extend
+Buildchain rather than forking the mechanics into each paper repository.
 
 ## CLI And Node API
 
@@ -139,6 +217,12 @@ Generate the publication manifest locally or in CI:
 buildchain publication-artifact manifest --source-sha "$(git rev-parse HEAD)" --json
 ```
 
+Generate the npm package contents after the manifest exists:
+
+```sh
+buildchain publication-artifact npm-package --json
+```
+
 Node API:
 
 ```js
@@ -146,6 +230,11 @@ import {
   collectPublicationArtifact,
   writePublicationArtifact,
 } from "@kungfu-tech/buildchain/publication-artifact";
+
+import {
+  collectPublicationPackageFacts,
+  preparePublicationNpmPackage,
+} from "@kungfu-tech/buildchain/publication-package";
 ```
 
 `writePublicationArtifact()` is the single implementation used by the CLI and
@@ -176,6 +265,24 @@ without rebuilding old PDFs from the latest npm package or paper source.
 A downstream papers site should treat the publication manifest as the single
 fact source for the artifact. The site owns rendering and navigation; it should
 not reinterpret the paper repository as a web deployment source.
+For registry-level routing, sites should first consume the package-owned
+Buildchain fact source:
+
+```text
+node_modules/@kungfu-tech/buildchain/dist/site/publication-registry.json
+```
+
+or the equivalent package export:
+
+```js
+import registry from "@kungfu-tech/buildchain/site/publication-registry.json" with { type: "json" };
+```
+
+That registry uses the `kungfu-buildchain-publication-release-registry`
+contract. It separates mutable canonical/latest reader routes from immutable
+version prefixes, publication artifacts, source bundles, and passport evidence
+so site repositories can render `/papers/**` without maintaining a parallel
+fixture truth source.
 
 For `paper-observer-declared-timelines`, the expected adoption path is:
 

package/docs/site-bundle-contract.md

@@ -13,6 +13,7 @@ release mechanics, command registry, workflow registry, or artifact schema.
 dist/site/
   buildchain-site.json
   site-manifest.json
+  publication-registry.json
   capability-registry.json
   cli-registry.json
   manual-registry.json
@@ -65,6 +66,10 @@ inputs, action inputs, site pages, and documentation command references, then
 compares those sets with `cli-registry.json`, `workflow-registry.json`, and
 `page-registry.json`. Buildchain's self-check fails closed when an enumerable
 public surface is missing from the generated registries.
+`publication-registry.json` is the package-owned publication archive registry
+for downstream papers surfaces. Site repositories can render latest reader
+routes, immutable version artifact routes, source bundles, and publication
+passport links from this file instead of keeping their own fixture registry.
 
 ## Timestamp and Reproducibility Policy
 
@@ -138,6 +143,7 @@ The P0 bundle includes:
 - complete markdown page registry for public Buildchain docs, action manuals,
   Node API overview, and fixtures;
 - site manifest;
+- publication archive registry for downstream papers surfaces;
 - CLI command registry;
 - manual registry for packaged agent-facing documentation;
 - Node API registry for public package exports;
@@ -160,6 +166,11 @@ schema metadata without breaking existing consumers.
 release chain model. The site bundle exposes that document and the
 `release-propagation` CLI entry so downstream sites can render the current
 Buildchain-owned propagation contract instead of hand-writing it.
+`publication-registry.json` is the static site-consumption entrypoint for
+publication archive pages. It uses the
+`kungfu-buildchain-publication-release-registry` contract and declares the
+mutable latest/canonical routes separately from append-only immutable version
+prefixes.
 
 ## Rendering Boundary
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.11.1",
+  "version": "2.11.2-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -27,6 +27,7 @@
     "./public-surface-audit": "./packages/core/public-surface-audit.js",
     "./logging": "./packages/core/logging.js",
     "./publication-artifact": "./packages/core/publication-artifact.js",
+    "./publication-package": "./packages/core/publication-package.js",
     "./kfd-gate": "./packages/core/kfd-gate.js",
     "./release-candidate": "./packages/core/release-candidate.js",
     "./release-passport": "./packages/core/release-passport.js",
@@ -35,6 +36,7 @@
     "./buildchain-kfd-claims": "./packages/core/buildchain-kfd-claims.js",
     "./site/buildchain-site.json": "./dist/site/buildchain-site.json",
     "./site/site-manifest.json": "./dist/site/site-manifest.json",
+    "./site/publication-registry.json": "./dist/site/publication-registry.json",
     "./site/page-registry.json": "./dist/site/page-registry.json",
     "./site/capability-registry.json": "./dist/site/capability-registry.json",
     "./site/cli-registry.json": "./dist/site/cli-registry.json",

package/packages/core/buildchain-config.js

@@ -16,6 +16,7 @@ const SUPPORTED_VERSION_NEXT = new Set(["auto", "manual"]);
 const SUPPORTED_PROJECT_TYPES = new Set(["package", "web-surface", "infra-contract", "distribution-index", "publication-artifact"]);
 const SUPPORTED_PUBLISH_MODES = new Set(["publish-final-version", "promote-existing-version"]);
 const SUPPORTED_PUBLISH_AUTH = new Set(["trusted-publishing", "npm-token"]);
+const SUPPORTED_PUBLISH_KINDS = new Set(["npm-package", "npm-paper-package"]);
 const SUPPORTED_PACKAGE_SET_ORDER = new Set(["as-provided", "platforms-first-main-last"]);
 const SUPPORTED_NATIVE_COMPILER_CACHE = new Set(["auto", "ccache", "sccache", "none"]);
 const WEB_SURFACE_CHANNELS = ["preview", "staging", "production"];
@@ -338,13 +339,19 @@ function normalizePublishSection(publish) {
   if (mode === "promote-existing-version" && auth !== "npm-token") {
     throw new Error('publish.mode = "promote-existing-version" requires publish.auth = "npm-token"');
   }
+  const kind = publish.kind === undefined
+    ? ""
+    : assertString(publish.kind, "publish.kind");
+  if (kind && !SUPPORTED_PUBLISH_KINDS.has(kind)) {
+    throw new Error("publish.kind must be one of npm-package or npm-paper-package");
+  }
   const packageSetOrder = publish.package_set_order === undefined
     ? "as-provided"
     : assertString(publish.package_set_order, "publish.package_set_order");
   if (!SUPPORTED_PACKAGE_SET_ORDER.has(packageSetOrder)) {
     throw new Error("publish.package_set_order must be one of as-provided or platforms-first-main-last");
   }
-  return {
+  const normalized = {
     mode,
     auth,
     distTag: publish.dist_tag === undefined
@@ -355,6 +362,13 @@ function normalizePublishSection(publish) {
       ? ""
       : assertString(publish.main_package, "publish.main_package"),
   };
+  if (publish.kind !== undefined) {
+    normalized.kind = kind;
+  }
+  if (publish.package !== undefined) {
+    normalized.package = assertString(publish.package, "publish.package");
+  }
+  return normalized;
 }
 
 function normalizeProjectSection(project) {

package/packages/core/buildchain-kfd-claims.js

@@ -42,6 +42,7 @@ export const BUILDCHAIN_AGENT_MANUALS = Object.freeze([
 const SITE_CONTRACT_FILES = Object.freeze([
   "dist/site/buildchain-site.json",
   "dist/site/site-manifest.json",
+  "dist/site/publication-registry.json",
   "dist/site/page-registry.json",
   "dist/site/capability-registry.json",
   "dist/site/cli-registry.json",
@@ -268,6 +269,7 @@ export function createBuildchainPublicClaimDefinitions() {
         "dist/site/node-api-registry.json",
         "dist/site/page-registry.json",
         "dist/site/capability-registry.json",
+        "dist/site/publication-registry.json",
         "dist/site/buildchain-site.json",
         "dist/site/site-manifest.json",
       ],

package/packages/core/index.js

@@ -111,6 +111,12 @@ export {
   validateReleaseCandidatePassport,
 } from "./release-candidate.js";
 
+export {
+  PUBLICATION_NPM_PACKAGE_CONTRACT,
+  collectPublicationPackageFacts,
+  preparePublicationNpmPackage,
+} from "./publication-package.js";
+
 export {
   ARTIFACT_PASSPORT_LOCATOR_CONTRACT,
   ARTIFACT_PASSPORT_POINTER_CONTRACT,

package/packages/core/kfd-gate.js

@@ -1,9 +1,10 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { createRequire } from "node:module";
 
-const require = createRequire(import.meta.url);
+import kfdPackageJson from "@kungfu-tech/kfd/package.json" with { type: "json" };
+import kfdStandards from "@kungfu-tech/kfd/standards.json" with { type: "json" };
+import kfdTrustTaxonomySchema from "@kungfu-tech/kfd/schemas/kfd-2/trust-taxonomy.schema.json" with { type: "json" };
 
 export const KFD1_RELEASE_GATE_CONTRACT = "kungfu-buildchain-kfd-1-release-gate";
 export const KFD1_WITNESS_SET_CONTRACT = "kungfu-buildchain-kfd-1-witness-set";
@@ -54,8 +55,21 @@ export function sha256File(filePath) {
   return crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
 }
 
+const bundledKfdJsonExports = new Map([
+  ["@kungfu-tech/kfd/package.json", kfdPackageJson],
+  ["@kungfu-tech/kfd/standards.json", kfdStandards],
+  ["@kungfu-tech/kfd/schemas/kfd-2/trust-taxonomy.schema.json", kfdTrustTaxonomySchema],
+]);
+
+function cloneJson(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
 function readJsonPackageExport(exportPath) {
-  return JSON.parse(fs.readFileSync(require.resolve(exportPath), "utf8"));
+  if (!bundledKfdJsonExports.has(exportPath)) {
+    throw new Error(`KFD metadata package export is not bundled into Buildchain release gates: ${exportPath}`);
+  }
+  return cloneJson(bundledKfdJsonExports.get(exportPath));
 }
 
 function tryReadJsonPackageExport(exportPath) {