@kungfu-tech/buildchain 2.11.14-alpha.5 → 2.11.14-alpha.7

package/dist/site/public-surface-audit.json

@@ -4,7 +4,7 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 75,
-    "workflowCount": 37,
+    "workflowCount": 38,
     "actionCount": 4,
     "sitePageCount": 45,
     "docCommandRefCount": 237,
@@ -684,6 +684,12 @@
         ],
         "inputCount": 1
       },
+      {
+        "id": "buildchain-alpha-self-dogfood",
+        "path": ".github/workflows/buildchain-alpha-self-dogfood.yml",
+        "inputs": [],
+        "inputCount": 0
+      },
       {
         "id": "buildchain-patrol-daily",
         "path": ".github/workflows/buildchain-patrol-daily.yml",
@@ -2540,8 +2546,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "3c0729f5351eb82fe26625fa5aabf30903f45f68af2431e02860f85ada468ac9",
-    "workflowRegistryDigest": "0fc20324b4154e352176378665daecb3cb7a74179796e3777eb2f6fc93a50092",
-    "pageRegistryDigest": "b066eaa7d8f557f11efe983475f95e0ecbab6e746cc4d30e061c60942e9a356f"
+    "workflowRegistryDigest": "5875dd6440e9585dc8ce86fc61af8546a60ae1140ed25789199adead2846d4fe",
+    "pageRegistryDigest": "de7377d68eb8b3069b83a2096de8ea24153090e746649015388224b9997e2340"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-10T15:16:06.629Z",
-  "publishedAt": "2026-07-10T15:16:06.629Z",
+  "generatedAt": "2026-07-11T00:08:19.877Z",
+  "publishedAt": "2026-07-11T00:08:19.877Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e8db2106e985b396aafbb707132c30bf341e7676",
+  "sourceRevision": "7d3f049ffc8b567c3afad9fa9f8e974b50fd3b90",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.14-alpha.5",
+    "version": "2.11.14-alpha.7",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-model.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-release-model",
   "exactTags": "v-prefixed exact tags are immutable release records.",
-  "floatingTags": "vX, vX.Y, and vX.Y-alpha are channel pointers updated by Buildchain transactions.",
+  "floatingTags": "vX, vX-alpha, vX.Y, and vX.Y-alpha are channel pointers updated by Buildchain transactions; vX-alpha follows the highest minor in major X with a published alpha.",
   "channelBranches": [
     "dev/vX/vX.Y",
     "alpha/vX/vX.Y",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-10T15:16:06.629Z",
-  "publishedAt": "2026-07-10T15:16:06.629Z",
+  "generatedAt": "2026-07-11T00:08:19.877Z",
+  "publishedAt": "2026-07-11T00:08:19.877Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e8db2106e985b396aafbb707132c30bf341e7676",
+  "sourceRevision": "7d3f049ffc8b567c3afad9fa9f8e974b50fd3b90",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.14-alpha.5",
+    "version": "2.11.14-alpha.7",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:7dc5b9adc5f23456ddc3a3f7c46f2cdf3ddd38d9546a45267291ba3fe567e0c9"
+      "digest": "sha256:02987c6bf99441eddc630fa4050fd109c15923047a4591e26d54a714c124539a"
     },
     {
       "id": "install",
@@ -205,7 +205,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:b9335434f95e6173f31d50983f8ab492378b065fa203a3b68bee447487883cea"
+      "digest": "sha256:4611e4ae47091687f50b489ccc6caba911f13bb1f73b27a5d44581d8a6450d06"
     },
     {
       "id": "publish-transaction",
@@ -221,7 +221,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:00b5e4c3ffd91d3f050a6e880f76dd36716660a731db029f636b372707ee3910"
+      "digest": "sha256:69c4146640626bc03b93ac178e250745e45939ba9443f3ba27207a35522036c4"
     },
     {
       "id": "release-flow",
@@ -229,7 +229,7 @@
       "path": "docs/release-flow.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:5b855ab3863e197b2ab257536b1f3ff85c79bca1fe962c45089b3f4c5ab81189"
+      "digest": "sha256:c05905de6a905d1ce0dd977986175b8bc1ad908c6c2eee946809693ea2cb91de"
     },
     {
       "id": "runtime-train-validation",
@@ -237,7 +237,7 @@
       "path": "docs/runtime-train-validation.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:bb053594407bd0f78aa43352a249a2ffa19825374147cc712cd56ca6ad50dfa3"
+      "digest": "sha256:1872e511b31c04ba75fc3a005c7a4f857c8b06ecadfedb75bc35b2ce70e7764a"
     },
     {
       "id": "versioning",

package/dist/site/workflow-registry.json

@@ -343,6 +343,15 @@
       "capabilityGroup": "api-cli-reference",
       "status": "repository-internal"
     },
+    {
+      "id": "buildchain-alpha-self-dogfood",
+      "path": ".github/workflows/buildchain-alpha-self-dogfood.yml",
+      "inputs": [],
+      "inputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": "buildchain-patrol-daily",
       "path": ".github/workflows/buildchain-patrol-daily.yml",

package/docs/MAP.md

@@ -111,9 +111,11 @@ replace them.
 
 - **ABV / old workflows / old action repositories** -> [`release-governance.md`](release-governance.md)
   and [`migration-inventory.md`](migration-inventory.md).
-- **v2 / v2.0 / v2.0-alpha / exact tags / floating tags** ->
+- **v2 / v2-alpha / v2.0 / v2.0-alpha / exact tags / floating tags** ->
   [`release-governance.md`](release-governance.md) and
   [`release-flow.md`](release-flow.md).
+- **Buildchain self-dogfood / released alpha canary / stable compatibility lane** ->
+  [`release-governance.md`](release-governance.md#buildchain-alpha-self-dogfood).
 - **v2.1 vs v2.2 / when to open a new minor line** ->
   [`versioning.md`](versioning.md).
 - **dry-run / what would happen if this channel PR merges** -> [`cli.md`](cli.md)

package/docs/release-flow.md

@@ -53,6 +53,7 @@ for the versioned policy and evidence contract.
 | Exact alpha tag | `v2.0.3-alpha.0` | immutable | audit ref for one tested prerelease |
 | Exact release tag | `v2.0.2` | immutable | audit ref for one production release |
 | Floating alpha tag | `v2.0-alpha` | moves | latest test channel for a minor line |
+| Floating major alpha tag | `v2-alpha` | moves | latest test channel on the highest published alpha minor for a major line |
 | Floating minor tag | `v2.0` | moves | latest production patch on a minor line |
 | Floating major tag | `v2` | moves | selected stable major entrypoint |
 
@@ -68,8 +69,8 @@ refs/tags/v*.*.*
 ```
 
 Do not apply immutable-tag rulesets to every `refs/tags/v*` ref. Buildchain
-must be able to update floating channel tags such as `v2`, `v2.0`, and
-`v2.0-alpha` after the exact tag and publish evidence are valid. A ruleset that
+must be able to update floating channel tags such as `v2`, `v2.0`, `v2.0-alpha`,
+and `v2-alpha` after the exact tag and publish evidence are valid. A ruleset that
 matches all `v*` tags also matches floating tags, so release finalization can
 fail with GitHub protected-ref errors even though the exact release tag and
 published artifacts are already durable.
@@ -77,7 +78,7 @@ published artifacts are already durable.
 The intended governance split is:
 
 - exact tags such as `v2.0.14` and `v2.0.15-alpha.0` are immutable audit refs;
-- floating tags such as `v2`, `v2.0`, and `v2.0-alpha` are mutable channel refs
+- floating tags such as `v2`, `v2.0`, `v2.0-alpha`, and `v2-alpha` are mutable channel refs
   owned by the Buildchain promotion token;
 - protected branches still require reviewed channel PRs before Buildchain can
   move any exact or floating release refs.
@@ -134,6 +135,7 @@ sequenceDiagram
   Promote->>Promote: write and verify version state
   Promote->>Tags: create or reuse vX.Y.Z-alpha.N
   Promote->>Tags: move vX.Y-alpha
+  Promote->>Tags: move vX-alpha when X.Y is the highest published alpha minor
   Promote->>Alpha: move alpha/vX/vX.Y
   Promote->>Dev: move dev/vX/vX.Y
 ```
@@ -143,6 +145,7 @@ Result:
 ```text
 vX.Y.Z-alpha.N
 vX.Y-alpha
+vX-alpha when X.Y is the highest published alpha minor
 alpha/vX/vX.Y
 dev/vX/vX.Y
 ```
@@ -177,6 +180,7 @@ sequenceDiagram
   Promote->>Promote: prepare vX.Y.(Z+1)-alpha.0
   Promote->>Tags: create or reuse vX.Y.(Z+1)-alpha.0
   Promote->>Tags: move vX.Y-alpha
+  Promote->>Tags: move vX-alpha when X.Y is the highest published alpha minor
   Promote->>Alpha: move alpha/vX/vX.Y
   Promote->>Dev: move dev/vX/vX.Y
 ```
@@ -195,6 +199,7 @@ point at the production version-state commit, while:
 ```text
 vX.Y.(Z+1)-alpha.0
 vX.Y-alpha
+vX-alpha when X.Y is the highest published alpha minor
 alpha/vX/vX.Y
 dev/vX/vX.Y
 ```
@@ -235,6 +240,7 @@ It should also prepare:
 ```text
 v2.0.3-alpha.0          exact next alpha tag
 v2.0-alpha              floating alpha tag
+v2-alpha                floating major alpha tag when v2.0 is the highest published alpha minor
 alpha/v2/v2.0           alpha channel branch
 dev/v2/v2.0             development channel branch
 ```

package/docs/release-governance.md

@@ -128,13 +128,14 @@ This is why Buildchain maintains both exact and floating refs:
 - `v2` is the selected stable major-line entrypoint;
 - `v2.0.3-alpha.0` is immutable alpha evidence;
 - `v2.0-alpha` is the latest test channel for the `2.0` line.
+- `v2-alpha` is the latest test channel on the highest published alpha minor in major `2`.
 
 A release does not mean "minor is complete." It means "this patch on this minor
 line is now production."
 
 GitHub repository rules must preserve that distinction. Exact tags such as
 `v2.0.2` and `v2.0.3-alpha.0` should be immutable. Floating channel tags such as
-`v2`, `v2.0`, and `v2.0-alpha` must remain movable by the Buildchain promotion
+`v2`, `v2.0`, `v2.0-alpha`, and `v2-alpha` must remain movable by the Buildchain promotion
 token after governance checks and publish evidence pass. A tag ruleset that
 protects every `refs/tags/v*` ref is too broad because it also locks the
 floating channel tags that Buildchain is required to update. Prefer exact-tag
@@ -159,9 +160,47 @@ Buildchain then:
 6. Moves `dev/vX/vX.Y` to the same generated alpha commit when this is a
    fast-forward update.
 7. Moves `vX.Y-alpha` to the same generated alpha commit.
+8. Moves `vX-alpha` only when `X.Y` is the highest minor in major `X` with a published alpha; older minor alpha work records a skip and cannot move the major channel backwards.
 
 This keeps the test channel self-describing. If a consumer checks out
-`v2.0-alpha`, the manifests and exact alpha tag agree.
+`v2.0-alpha` or `v2-alpha`, the manifests and exact alpha tag agree. The major
+alpha ref removes routine consumer edits when Buildchain opens a newer minor,
+while exact tags and SHAs remain the reproducible audit choice.
+
+### Buildchain Alpha Self-Dogfood
+
+Buildchain continuously consumes its own current major alpha through
+`.github/workflows/buildchain-alpha-self-dogfood.yml`. The workflow calls the
+released outer reusable workflow at `@v2-alpha` without a runtime override, so
+both the workflow shell and its default runtime must resolve through the same
+floating alpha channel. A parallel stable lane checks out `v2` and runs the
+same declared install, build, and verify lifecycle directly. The direct stable
+lane is intentional: it preserves stable-runtime compatibility without
+requiring the previous stable outer workflow to understand a self-call identity
+fix that has not reached stable yet. Both lanes use a single GitHub-hosted Linux
+fixture to keep the recurring check bounded.
+
+The reusable build trust gate reads `job.workflow_ref`, which identifies the
+called workflow and its selected ref. It does not infer the runtime from
+`github.workflow_ref`, because GitHub defines that context as the caller
+workflow identity during a reusable call.
+
+The evidence job resolves `v2-alpha` and `v2` through the GitHub refs API,
+compares those immutable SHAs with the reusable workflow outputs, verifies the
+`alpha` and `stable` classifications, and uploads a JSON evidence artifact.
+The canary runs after successful Buildchain ref promotion, on a daily fallback
+schedule, and on manual dispatch. It shares the release-promotion concurrency
+group, so another promotion cannot move the floating refs between runtime
+resolution and evidence comparison.
+
+This is a post-publication consumer canary, not a release bootstrap. Source
+verification still runs the current commit, and
+`buildchain-ref-promotion.yml` still passes the verified exact SHA into the
+promotion workflow. Patrol, dev-merge, repair, and promotion defaults remain on
+stable or exact refs so a broken alpha cannot prevent Buildchain from publishing
+its fix. When Buildchain opens a new major, inventory validation requires this
+workflow's fixed GitHub `uses` refs to move from `vN`/`vN-alpha` to the new
+major; GitHub does not allow expressions in a reusable-workflow `uses` ref.
 
 If `dev/vX/vX.Y` has already advanced before generated alpha version-state
 bookkeeping can sync back, Buildchain records `skipped-non-fast-forward` for the
@@ -201,6 +240,7 @@ Buildchain then:
    `vX.Y.(Z+1)-alpha.0`.
 10. Moves `alpha/vX/vX.Y`, `dev/vX/vX.Y`, and `vX.Y-alpha` to that next alpha
     commit.
+11. Moves `vX-alpha` to that next alpha only when this remains the highest published alpha minor.
 
 The production channel and the test channel therefore intentionally diverge
 after release: production stays on the release commit, while alpha/dev continue
@@ -513,6 +553,7 @@ When the loop succeeds, maintainers and consumers can rely on these facts:
   not a hidden manual button;
 - every test channel has an exact alpha tag such as `v2.0.3-alpha.0`;
 - every alpha minor line has a floating tag such as `v2.0-alpha`;
+- every major with a published alpha has a cross-minor floating tag such as `v2-alpha`, owned by its highest published alpha minor;
 - version manifests match the tag visible from the same commit;
 - production releases are derived from the alpha tree that was tested;
 - manual non-dry-run promotion cannot bypass PR review and verification;

package/docs/reusable-build-surface.md

@@ -214,6 +214,21 @@ The lock is intentionally small. It does not copy the full contract. The full
 contract remains in the Buildchain ref and package; the consumer records only
 what it accepted and the policy used to compare future floating-ref movement.
 
+Alpha-channel consumers select the matching workflow shell:
+
+```yaml
+jobs:
+  build:
+    uses: kungfu-systems/buildchain/.github/workflows/.build.yml@v2-alpha
+    with:
+      buildchain-contract-lock-path: .buildchain/contract-lock.json
+```
+
+The runtime follows the called workflow through `job.workflow_ref`. Callers may
+also pass `buildchain-ref: v2-alpha` explicitly; official floating refs are
+ordinary channel selections and are allowed on pull requests and pushes. Train
+refs and exact SHAs remain trusted manual overrides.
+
 ## Locked Source Checkout Cache
 
 Self-hosted runners that build large repositories can opt into a locked source
@@ -309,7 +324,7 @@ The reusable workflow exposes the resolved contract:
 | `buildchain-runtime-ref`          | Runtime ref selected after applying the empty-default or override policy        |
 | `buildchain-runtime-sha`          | Immutable Buildchain runtime commit used by all runtime checkouts               |
 | `buildchain-runtime-class`        | `stable`, `alpha`, `train`, `exact-sha`, or `development`                       |
-| `buildchain-runtime-override`     | `true` when a non-empty `buildchain-ref` override was accepted                  |
+| `buildchain-runtime-override`     | `true` when a train or exact-SHA `buildchain-ref` override was accepted          |
 | `buildchain-runtime-trust-decision` | Runtime override trust decision                                               |
 | `buildchain-contract-lock-status` | `unchanged`, `compatible-drift`, `breaking-drift`, `missing-lock`, `non-floating-runtime`, or first-release `runtime-contract-unavailable` |
 | `buildchain-contract-lock-drift`  | `true` when the floating runtime SHA or contract digest changed                 |

package/docs/runtime-train-validation.md

@@ -5,6 +5,14 @@ committed workflow YAML. Runtime trains provide a temporary validation pointer
 for Buildchain changes that are ready for downstream testing but not yet
 promoted through the normal `dev -> alpha -> release` chain.
 
+Official floating channels are not runtime overrides. A consumer that
+deliberately follows `@v2-alpha` gets the matching runtime on pull requests and
+pushes because the reusable workflow reads the called workflow identity from
+`job.workflow_ref`. Passing `buildchain-ref: v2-alpha` explicitly is also
+accepted when the caller wants the channel binding visible in its input set.
+The caller's `github.workflow_ref` is not used for this inference because it
+identifies the caller workflow during reusable calls.
+
 ## Train refs
 
 A train ref is a branch in the Buildchain repository:
@@ -111,10 +119,12 @@ summary. The evidence should include:
 
 ## Trust and limitation
 
-Runtime overrides fail closed unless the event is `workflow_dispatch` and the
-actor has write, maintain, or admin permission on the caller repository.
-Pull requests, including fork-originated pull requests, cannot use a non-empty
-`buildchain-ref`.
+Official floating channel refs such as `v2` and `v2-alpha` may be selected on
+pull requests and pushes. Train refs and arbitrary exact-SHA overrides still
+fail closed unless the event is `workflow_dispatch` and the actor has write,
+maintain, or admin permission on the caller repository. Pull requests,
+including fork-originated pull requests, cannot use train or exact-SHA
+overrides.
 
 Runtime train validation covers Buildchain runtime scripts, CLI code, local
 actions, configuration parsing, and lifecycle behavior. It cannot validate

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.11.14-alpha.5",
+  "version": "2.11.14-alpha.7",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/release-line-dry-run.js

@@ -23,7 +23,7 @@ function parseTags(input) {
     : String(input || "").split(",").map((tag) => tag.trim()).filter(Boolean);
   for (const tag of tags) {
     if (
-      !/^v\d+$|^v\d+\.\d+$|^v\d+\.\d+-alpha$|^v\d+\.\d+\.\d+$|^v\d+\.\d+\.\d+-alpha\.\d+$/.test(tag)
+      !/^v\d+$|^v\d+-alpha$|^v\d+\.\d+$|^v\d+\.\d+-alpha$|^v\d+\.\d+\.\d+$|^v\d+\.\d+\.\d+-alpha\.\d+$/.test(tag)
     ) {
       throw new Error(`Unsupported buildchain dry-run tag: ${tag}`);
     }
@@ -42,6 +42,7 @@ function getPromotionRule(targetRef, sourceRef = "") {
       sourceRef: sourceRef || "release/vN/vN.M",
       releasePrefix: nextMajor ? `v${nextMajor}.0` : "v(N+1).0",
       majorTag: nextMajor ? `v${nextMajor}` : "v(N+1)",
+      majorAlphaTag: nextMajor ? `v${nextMajor}-alpha` : "v(N+1)-alpha",
       minorTag: nextMajor ? `v${nextMajor}.0` : "v(N+1).0",
       alphaTag: nextMajor ? `v${nextMajor}.0-alpha` : "v(N+1).0-alpha",
       exactReleasePattern: nextMajor ? `v${nextMajor}.0.0` : "v(N+1).0.0",
@@ -69,6 +70,7 @@ function getPromotionRule(targetRef, sourceRef = "") {
     minor,
     releasePrefix,
     majorTag: `v${major}`,
+    majorAlphaTag: `v${major}-alpha`,
     minorTag: releasePrefix,
     alphaTag: `${releasePrefix}-alpha`,
     sourceRef: channel === "alpha" ? `dev/v${major}/v${major}.${minor}` : `alpha/v${major}/v${major}.${minor}`,
@@ -193,7 +195,10 @@ function explainReleaseLineDryRun({
       kind: "alpha",
       action: "would create or reuse immutable alpha evidence tag",
     });
-    plan.floatingRefs.push({ ref: rule.alphaTag, kind: "tag", action: "would move to alpha version-state commit" });
+    plan.floatingRefs.push(
+      { ref: rule.alphaTag, kind: "tag", action: "would move to alpha version-state commit" },
+      { ref: rule.majorAlphaTag, kind: "tag", action: "would move when this is the highest published alpha minor" },
+    );
     plan.branchUpdates.push(
       { ref: targetRef, action: "would move to alpha version-state commit" },
       { ref: `dev/v${rule.major}/v${rule.major}.${rule.minor}`, action: "would align dev with the published alpha state" },
@@ -211,6 +216,7 @@ function explainReleaseLineDryRun({
       { ref: rule.minorTag, kind: "tag", action: "would move to production release commit" },
       { ref: rule.majorTag, kind: "tag", action: "would move when no newer minor line owns the major tag" },
       { ref: rule.alphaTag, kind: "tag", action: "would move to next alpha version-state commit" },
+      { ref: rule.majorAlphaTag, kind: "tag", action: "would move when this is the highest published alpha minor" },
     );
     plan.branchUpdates.push(
       { ref: targetRef, action: "would move to production release commit" },
@@ -234,6 +240,7 @@ function explainReleaseLineDryRun({
       { ref: rule.minorTag, kind: "tag", action: "would move to next-major release commit" },
       { ref: rule.majorTag, kind: "tag", action: "would move to next-major release commit" },
       { ref: rule.alphaTag, kind: "tag", action: "would move to next-major alpha commit" },
+      { ref: rule.majorAlphaTag, kind: "tag", action: "would move to next-major alpha commit" },
     );
     plan.branchUpdates.push(
       { ref: targetRef, action: "would move to next-major release commit" },

package/scripts/check-inventory.mjs

@@ -71,6 +71,7 @@ const requiredPaths = [
   ".github/workflows/buildchain-patrol-daily.yml",
   ".github/workflows/buildchain-patrol-weekly.yml",
   ".github/workflows/buildchain-patrol-monthly.yml",
+  ".github/workflows/buildchain-alpha-self-dogfood.yml",
   ".github/workflows/release-candidate-promote.yml",
   ".github/workflows/release-propagation.yml",
   ".github/workflows/npm-publish.yml",
@@ -97,6 +98,58 @@ if (rootPackage.name !== "@kungfu-tech/buildchain") {
 if (rootPackage.private !== false) {
   throw new Error("root package must be publishable with private=false");
 }
+const selfDogfoodWorkflow = fs.readFileSync(
+  path.join(root, ".github/workflows/buildchain-alpha-self-dogfood.yml"),
+  "utf8",
+);
+const selfDogfoodMajor = String(rootPackage.version || "").match(/^(\d+)\./)?.[1];
+if (!selfDogfoodMajor) {
+  throw new Error("root package version must expose a numeric major for self-dogfood");
+}
+for (const requiredSnippet of [
+  `/.github/workflows/.build.yml@v${selfDogfoodMajor}-alpha`,
+  `ref: v${selfDogfoodMajor}`,
+  `echo "ref=v${selfDogfoodMajor}"`,
+  `const alphaRef = "v${selfDogfoodMajor}-alpha"`,
+  `const stableRef = "v${selfDogfoodMajor}"`,
+]) {
+  if (!selfDogfoodWorkflow.includes(requiredSnippet)) {
+    throw new Error(`Buildchain self-dogfood workflow missing current-major snippet: ${requiredSnippet}`);
+  }
+}
+const reusableBuildWorkflow = fs.readFileSync(
+  path.join(root, ".github/workflows/.build.yml"),
+  "utf8",
+);
+for (const requiredSnippet of [
+  "BUILDCHAIN_WORKFLOW_REF: ${{ job.workflow_ref }}",
+  "process.env.BUILDCHAIN_WORKFLOW_REF || process.env.GITHUB_WORKFLOW_REF",
+  'replace(/^refs\\/(?:heads|tags)\\//, "")',
+]) {
+  if (!reusableBuildWorkflow.includes(requiredSnippet)) {
+    throw new Error(`reusable build workflow missing called-workflow identity: ${requiredSnippet}`);
+  }
+}
+for (const requiredSnippet of [
+  "group: buildchain-release-promotion-${{ github.repository }}",
+  "cancel-in-progress: false",
+]) {
+  if (!selfDogfoodWorkflow.includes(requiredSnippet)) {
+    throw new Error(`Buildchain self-dogfood workflow missing promotion serialization: ${requiredSnippet}`);
+  }
+}
+const actionlintConfig = fs.readFileSync(
+  path.join(root, ".github/actionlint.yaml"),
+  "utf8",
+);
+for (const requiredSnippet of [
+  ".github/workflows/.build.yml:",
+  'property "workflow_ref" is not defined in object type',
+]) {
+  if (!actionlintConfig.includes(requiredSnippet)) {
+    throw new Error(`actionlint config missing scoped job.workflow_ref compatibility rule: ${requiredSnippet}`);
+  }
+}
 const packageDependencySections = ["dependencies", "optionalDependencies", "peerDependencies"];
 const exoticDependencyPattern =
   /^(?:git(?:\+ssh|\+https|\+http|\+file)?:|github:|gitlab:|bitbucket:|https?:|file:|link:|workspace:)/i;

package/scripts/generate-site-bundle.mjs

@@ -872,7 +872,7 @@ function buildSiteBundle() {
     schemaVersion: 1,
     contract: "kungfu-buildchain-release-model",
     exactTags: "v-prefixed exact tags are immutable release records.",
-    floatingTags: "vX, vX.Y, and vX.Y-alpha are channel pointers updated by Buildchain transactions.",
+    floatingTags: "vX, vX-alpha, vX.Y, and vX.Y-alpha are channel pointers updated by Buildchain transactions; vX-alpha follows the highest minor in major X with a published alpha.",
     channelBranches: ["dev/vX/vX.Y", "alpha/vX/vX.Y", "release/vX/vX.Y", "publish-gate/major"],
     protectedDevelopmentBranches: ["dev/vX/vX.Y"],
     releasePassport: {

package/scripts/runtime-ref-core.mjs

@@ -1,5 +1,6 @@
 const EXACT_SHA_RE = /^[0-9a-f]{40}$/i;
 const TRAIN_REF_RE = /^train\/v\d+\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
+const OFFICIAL_CHANNEL_REF_RE = /^v\d+(?:\.\d+)?(?:-alpha)?$/;
 
 export function parseWorkflowShellRef(workflowRef = "", fallback = "v2", buildchainRepository = "kungfu-systems/buildchain") {
   const value = String(workflowRef || "");
@@ -8,7 +9,7 @@ export function parseWorkflowShellRef(workflowRef = "", fallback = "v2", buildch
     return fallback;
   }
   const ref = value.split("@").pop()?.trim();
-  return ref || fallback;
+  return (ref || fallback).replace(/^refs\/(?:heads|tags)\//, "");
 }
 
 export function classifyBuildchainRuntimeRef(ref = "") {
@@ -28,13 +29,34 @@ export function classifyBuildchainRuntimeRef(ref = "") {
   return "development";
 }
 
+export function isOfficialBuildchainChannelRef(ref = "") {
+  const value = String(ref || "").trim().replace(/^refs\/tags\//, "");
+  return OFFICIAL_CHANNEL_REF_RE.test(value);
+}
+
 export function normalizeRequestedRuntimeRef(requestedRef = "") {
   const requested = String(requestedRef || "").trim();
   if (!requested) {
-    return { ref: "", fullRef: "", class: "", exactSha: false };
+    return { ref: "", fullRef: "", class: "", exactSha: false, officialChannel: false };
+  }
+  if (isOfficialBuildchainChannelRef(requested)) {
+    const channelRef = requested.replace(/^refs\/tags\//, "");
+    return {
+      ref: channelRef,
+      fullRef: channelRef,
+      class: classifyBuildchainRuntimeRef(channelRef),
+      exactSha: false,
+      officialChannel: true,
+    };
   }
   if (EXACT_SHA_RE.test(requested)) {
-    return { ref: requested, fullRef: requested, class: "exact-sha", exactSha: true };
+    return {
+      ref: requested,
+      fullRef: requested,
+      class: "exact-sha",
+      exactSha: true,
+      officialChannel: false,
+    };
   }
   const trainRef = requested.replace(/^refs\/heads\//, "");
   if (!TRAIN_REF_RE.test(trainRef)) {
@@ -47,6 +69,7 @@ export function normalizeRequestedRuntimeRef(requestedRef = "") {
     fullRef: `refs/heads/${trainRef}`,
     class: "train",
     exactSha: false,
+    officialChannel: false,
   };
 }
 
@@ -71,15 +94,16 @@ export function resolveRuntimeSelection({
     };
   }
   const normalized = normalizeRequestedRuntimeRef(requested);
+  const runtimeOverride = !normalized.officialChannel;
   return {
     requestedRef: requested,
     runtimeRef: normalized.ref,
     runtimeFullRef: normalized.fullRef,
     runtimeClass: normalized.class,
-    runtimeOverride: true,
+    runtimeOverride,
     workflowShellRef: workflowShellRef || defaultStableRef,
     rollbackRef: workflowShellRef || defaultStableRef,
-    trustDecision: "override-requested",
+    trustDecision: normalized.officialChannel ? "official-channel" : "override-requested",
   };
 }
 
@@ -91,6 +115,9 @@ export function validateRuntimeOverrideTrust({
   if (!String(requestedRef || "").trim()) {
     return { ok: true, decision: "stable-default" };
   }
+  if (isOfficialBuildchainChannelRef(requestedRef)) {
+    return { ok: true, decision: "official-channel" };
+  }
   if (eventName !== "workflow_dispatch") {
     return {
       ok: false,