@kungfu-tech/buildchain 2.11.9 → 2.11.10-alpha.2

package/AGENTS.md

@@ -53,6 +53,10 @@ pnpm run check
 `pnpm run check` validates inventory data, lints root workflows, runs unit tests,
 and rebuilds every action bundle.
 
+Before broad maintenance or consolidation work, read the current engineering
+handoff in
+[`2026-07-10-buildchain-consolidation.md`](.github/retrospectives/2026-07-10-buildchain-consolidation.md).
+
 ## Proposing changes
 
 - Open pull requests against the relevant `dev/*` channel branch.

package/CONTRIBUTING.md

@@ -30,8 +30,11 @@ repository itself is a Node/pnpm workspace.
 
 - `.github/workflows` - repository checks, reusable workflows, and Buildchain
   self-promotion.
+- `.github/retrospectives` - time-bounded engineering reviews and maintenance
+  handoff records. Start with the latest record before broad consolidation work.
 - `actions` - the active GitHub Actions surface:
-  `validate-config`, `run-lifecycle`, and `promote-buildchain-ref`.
+  `validate-config`, `run-lifecycle`, `promote-buildchain-ref`, and
+  `report-buildchain-issue`.
 - `bin` - the published `buildchain` command-line entrypoint.
 - `docs` - release governance, lifecycle, reusable workflow, web-surface, and
   CLI documentation.
@@ -43,6 +46,9 @@ repository itself is a Node/pnpm workspace.
 Standalone historical `action-*` repositories are not mirrored here as active
 actions. See [`docs/migration-inventory.md`](docs/migration-inventory.md).
 
+The current consolidation handoff is
+[`2026-07-10-buildchain-consolidation.md`](.github/retrospectives/2026-07-10-buildchain-consolidation.md).
+
 ## Build and verification
 
 ```sh

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.11.9",
+    "version": "2.11.10-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -235,7 +235,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:188279a8b94e9e9de331936881329720deee6788c2e052ae9208e811945d4122"
+      "auditDigest": "sha256:f458470154bed291a4adcd703f0fe810897d95d4e939793da676cc526a5a80bb"
     },
     {
       "contractVersion": 1,
@@ -284,7 +284,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:188279a8b94e9e9de331936881329720deee6788c2e052ae9208e811945d4122"
+      "auditDigest": "sha256:f458470154bed291a4adcd703f0fe810897d95d4e939793da676cc526a5a80bb"
     },
     {
       "contractVersion": 1,
@@ -456,9 +456,9 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:db2738592b80be42f0ff3d2be1161fd09467cf45e9dc4bba7d039aea0808880b"
+      "auditDigest": "sha256:1cda1562ba9b386200aa9ae5b5c349ee921e4dbff9419c868b8af33754a7e424"
     }
   ],
   "compatibilityDigest": "sha256:967df7e854fdf582294ddfb6403eff25c00db9518a24051e7d47cbd75527c785",
-  "contractDigest": "sha256:4c33a8ac39ab220d95f02a65a0eb53f649aeaff013ab0ee7befc175e42ba21c8"
+  "contractDigest": "sha256:a9adfc334cddc5d381899106923795432212c28e0a12d46133bf2cfa00d01b27"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-10T01:02:49.840Z",
-  "publishedAt": "2026-07-10T01:02:49.840Z",
+  "generatedAt": "2026-07-10T03:16:35.087Z",
+  "publishedAt": "2026-07-10T03:16:35.087Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "02ca0700220ae7ce59b9824bf8a231fb90026e39",
+  "sourceRevision": "8925c651e39677f5366e5bca1b2755d51ef76bca",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.9",
+    "version": "2.11.10-alpha.2",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.9",
+    "version": "2.11.10-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -255,7 +255,7 @@
       "specifier": "@kungfu-tech/buildchain/release-passport",
       "export": "./release-passport",
       "target": "./packages/core/release-passport.js",
-      "digest": "sha256:188279a8b94e9e9de331936881329720deee6788c2e052ae9208e811945d4122",
+      "digest": "sha256:f458470154bed291a4adcd703f0fe810897d95d4e939793da676cc526a5a80bb",
       "summary": "Release passport collection, verification, explanation, and evidence APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-10T01:02:49.840Z",
-  "publishedAt": "2026-07-10T01:02:49.840Z",
+  "generatedAt": "2026-07-10T03:16:35.087Z",
+  "publishedAt": "2026-07-10T03:16:35.087Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "02ca0700220ae7ce59b9824bf8a231fb90026e39",
+  "sourceRevision": "8925c651e39677f5366e5bca1b2755d51ef76bca",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.9",
+    "version": "2.11.10-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-10T01:02:49.840Z",
-  "publishedAt": "2026-07-10T01:02:49.840Z",
+  "generatedAt": "2026-07-10T03:16:35.087Z",
+  "publishedAt": "2026-07-10T03:16:35.087Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "02ca0700220ae7ce59b9824bf8a231fb90026e39",
+  "sourceRevision": "8925c651e39677f5366e5bca1b2755d51ef76bca",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.9",
+    "version": "2.11.10-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.11.9",
+  "version": "2.11.10-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/release-passport.js

@@ -1768,6 +1768,19 @@ export function createReleaseCheckReport({
   }
   const surfaceImpacts = Array.isArray(impact?.surfaceImpacts) ? impact.surfaceImpacts : [];
   const passportSurfaceImpacts = Array.isArray(passport?.surfaceImpacts) ? passport.surfaceImpacts : [];
+  const impactRelease = impact?.release && typeof impact.release === "object" && !Array.isArray(impact.release)
+    ? impact.release
+    : {};
+  const impactVersion = optionalString(impactRelease.version);
+  const impactLine = optionalString(impactRelease.line);
+  const passportVersion = optionalString(passport?.release?.publishedVersion || passport?.release?.package?.version);
+  const passportTargetRef = optionalString(passport?.release?.targetRef || passport?.release?.target_ref);
+  const passportTargetLineMatch = passportTargetRef.match(/^(?:alpha|release)\/v(\d+)\/v\1\.(\d+)$/);
+  const passportLine = optionalString(
+    passport?.release?.line ||
+    (passportTargetLineMatch ? `v${passportTargetLineMatch[1]}.${passportTargetLineMatch[2]}` : ""),
+  );
+  const impactClassification = normalizeImpactLevel(impact?.classification);
   const declaredFinalImpact = normalizeImpactLevel(impact?.versionImpact?.final || impact?.classification);
   const computedFinalImpact = highestImpactLevel(surfaceImpacts.map((entry) => entry.impact));
   const requiredSurfaceImpacts = surfaceImpactRequirement({ passport, impact });
@@ -1786,6 +1799,38 @@ export function createReleaseCheckReport({
       issues.push(issue("error", "kfd-3.metadata", error.message));
     }
   }
+  if (impactVersion) {
+    if (!impactLine) {
+      issues.push(issue("error", "impact.release.line", "version-bound impact requires release.line"));
+    } else if (passportLine && impactLine !== passportLine) {
+      issues.push(issue("error", "impact.release.line", "impact release line must match the release passport line", {
+        impactLine,
+        passportLine,
+      }));
+    }
+    if (passportVersion && impactVersion !== passportVersion) {
+      issues.push(issue("error", "impact.release.version", "impact release version must match the published release version", {
+        impactVersion,
+        passportVersion,
+      }));
+    }
+    if (!["patch", "minor", "major"].includes(impactClassification)) {
+      issues.push(issue("error", "impact.classification", "version-bound impact classification must be patch, minor, or major"));
+    } else if (impactClassification !== declaredFinalImpact) {
+      issues.push(issue("error", "impact.classification", "version-bound impact classification must match versionImpact.final", {
+        classification: impactClassification,
+        versionImpact: declaredFinalImpact,
+      }));
+    }
+    if (!optionalString(impact?.summary).trim()) {
+      issues.push(issue("error", "impact.summary", "version-bound impact summary is required"));
+    }
+    if (surfaceImpacts.length === 0) {
+      issues.push(issue("error", "impact.surfaceImpacts.required", "version-bound impact requires surfaceImpacts[]", {
+        type: "version-bound-release-impact",
+      }));
+    }
+  }
   if (requiredSurfaceImpacts.required && surfaceImpacts.length === 0) {
     issues.push(issue("error", "impact.surfaceImpacts.required", "surfaceImpacts[] is required for this release passport type", requiredSurfaceImpacts));
   }

package/scripts/check-inventory.mjs

@@ -58,6 +58,7 @@ const requiredPaths = [
   "tests/buildchain-inventory.json",
   ".buildchain/buildchain.toml",
   ".buildchain/contract-lock.json",
+  ".buildchain/release-impact.json",
   ".github/actionlint.yaml",
   ".github/workflows/self-hosted-runner-smoke.yml",
   ".github/workflows/buildchain-ref-promotion.yml",
@@ -651,6 +652,22 @@ const binaryDistributionWorkflow = fs.readFileSync(path.join(root, ".github/work
 const selfHostedRunnerSmokeWorkflow = fs.readFileSync(path.join(root, ".github/workflows/self-hosted-runner-smoke.yml"), "utf8");
 const npmDryRunScript = fs.readFileSync(path.join(root, "scripts/npm-publish-dry-run.mjs"), "utf8");
 const npmPublishTransactionScript = fs.readFileSync(path.join(root, "scripts/npm-publish-transaction.mjs"), "utf8");
+const rootPackageJson = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+const selfReleaseImpact = JSON.parse(fs.readFileSync(path.join(root, ".buildchain/release-impact.json"), "utf8"));
+const selfReleaseLineMatch = String(rootPackageJson.version || "").match(/^(\d+)\.(\d+)\./);
+const expectedSelfReleaseLine = selfReleaseLineMatch ? `v${selfReleaseLineMatch[1]}.${selfReleaseLineMatch[2]}` : "";
+if (selfReleaseImpact.release?.version !== rootPackageJson.version) {
+  throw new Error("Buildchain self release impact version must match package.json version");
+}
+if (!expectedSelfReleaseLine || selfReleaseImpact.release?.line !== expectedSelfReleaseLine) {
+  throw new Error("Buildchain self release impact line must match package.json major/minor line");
+}
+if (!["patch", "minor", "major"].includes(selfReleaseImpact.classification)) {
+  throw new Error("Buildchain self release impact classification must be patch, minor, or major");
+}
+if (!String(selfReleaseImpact.summary || "").trim() || !Array.isArray(selfReleaseImpact.surfaceImpacts) || selfReleaseImpact.surfaceImpacts.length === 0) {
+  throw new Error("Buildchain self release impact requires a summary and surfaceImpacts[]");
+}
 for (const requiredSnippet of [
   "runs-on: ubuntu-24.04",
   "workflow_dispatch:",
@@ -680,12 +697,7 @@ for (const requiredSnippet of [
   "github-release: true",
   "release-passport-buildchain-self-kfd: true",
   "publish-required-artifacts-json: \"[]\"",
-  "release-passport-impact-json: >-",
-  "Buildchain v2.10 patch release accepts strict publish-gate channel-lineage PRs",
-  "directory_index_rewrite = external",
-  "publish-gate-channel-lineage",
-  "web-surface-external-directory-index-rewrite",
-  "\"surfaceImpacts\":[",
+  "release-passport-impact-json: .buildchain/release-impact.json",
 ]) {
   if (!buildchainRefPromotionWorkflow.includes(requiredSnippet)) {
     throw new Error(`buildchain ref promotion workflow missing npm transaction snippet: ${requiredSnippet}`);