@kungfu-tech/buildchain 2.12.0-alpha.1 → 2.12.0-alpha.4

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-11T03:14:59.432Z",
-  "publishedAt": "2026-07-11T03:14:59.432Z",
+  "generatedAt": "2026-07-11T05:45:16.756Z",
+  "publishedAt": "2026-07-11T05:45:16.756Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "a17107b60f4b7c8e25acedb33432b1f576b8f585",
+  "sourceRevision": "6ac5e0fbb3e3659c4948685993b9856ad8cf34e5",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.0-alpha.1",
+    "version": "2.12.0-alpha.4",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -205,7 +205,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:9d7b29135c2665882ae09754c47fe5ffb75e86ec2a8d539c48ffc5045dac802b"
+      "digest": "sha256:dfa37928517a391c2ab214a095954dcb50e84f514cea0a8424619903843d9b8d"
     },
     {
       "id": "publish-transaction",
@@ -221,7 +221,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:db9077f3748954dee3d28cd1e418dd537fec498df31155c560f7929b622888cb"
+      "digest": "sha256:11f0e3ff3162c7b3f886a38ab0e4b591886e2046937a9d006eda74b72a8cc9ab"
     },
     {
       "id": "release-flow",

package/docs/release-governance.md

@@ -256,6 +256,15 @@ evaluated after the PR-stage release candidate has been resolved and before the
 publish-gate ref, package registry, exact stable tag, or floating stable refs
 are mutated. Train refs and alpha promotion do not execute this gate.
 
+All alpha and release promotions first run a metadata-only release-candidate
+preflight after queued-intent revalidation. The preflight uses the same resolver
+and exact target SHA as the publication job, but does not download payloads or
+install the candidate repository dependencies. Missing channel PRs, stale
+workflow runs, expired passport pairs, and insufficient payload artifact sets
+therefore fail before the full promotion job starts. The publication job still
+downloads and validates the exact evidence again at the trust boundary; the
+preflight moves failure earlier without weakening the final check.
+
 The policy is versioned in `.buildchain/stable-release-policy.json`. A stable
 candidate is allowed only when all of these facts are true:
 

package/docs/reusable-build-surface.md

@@ -329,13 +329,17 @@ repository or organization variables named
 `BUILDCHAIN_CHECKOUT_CACHE_REFERENCE_REPOSITORY_TEMPLATE`, so consumers can keep
 private LAN topology out of repository YAML.
 
-The GitHub-hosted trust gate uploads the exact runtime version's small checkout
-bootstrap script. Native and Linux-container build jobs download that bootstrap,
-then use the same cache policy to obtain the Buildchain runtime at the already
-resolved immutable SHA. This prevents a large direct `actions/checkout` runtime
-clone from becoming a separate timeout path on constrained self-hosted uplinks.
-The bootstrap artifact does not contain the runtime repository and cannot move
-the selected ref.
+The GitHub-hosted trust gate resolves the reusable workflow shell to an exact
+commit and uploads that shell's small checkout bootstrap script. Native and
+Linux-container build jobs download the bootstrap, then use the same cache
+policy to obtain both the selected Buildchain runtime and consumer source at
+their already resolved immutable SHAs. Keeping the bootstrap owned by the
+workflow shell is important when `@vN-alpha` routes a stable release to an older
+`vN` runtime: the stable runtime does not need to already contain the newest
+checkout transport implementation. This also prevents a large direct
+`actions/checkout` runtime clone from becoming a separate timeout path on
+constrained self-hosted uplinks. The bootstrap artifact does not contain the
+runtime repository and cannot move either selected ref.
 
 Do not read cache URLs or reference paths from PR-controlled files such as
 `.buildchain/buildchain.toml`. These values are trusted workflow inputs or repo/org

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.0-alpha.1",
+  "version": "2.12.0-alpha.4",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/release-candidate-resolver.mjs

@@ -13,6 +13,10 @@ function env(name, fallback = "") {
   return process.env[name] || fallback;
 }
 
+export function releaseCandidateDownloadEnabled(value = "true") {
+  return String(value || "true").trim().toLowerCase() !== "false";
+}
+
 function splitRepository(repository) {
   const match = String(repository || "").trim().match(/^([^/\s]+)\/([^/\s]+)$/);
   if (!match) {
@@ -546,6 +550,7 @@ export async function resolveReleaseCandidateArtifactsCli() {
     publishArtifactKind: env("BUILDCHAIN_PUBLISH_ARTIFACT_KIND", "npm"),
     publishPackageMain: env("BUILDCHAIN_PUBLISH_PACKAGE_MAIN"),
     outputDir: env("BUILDCHAIN_RC_OUTPUT_DIR", ".buildchain/release-candidate"),
+    download: releaseCandidateDownloadEnabled(env("BUILDCHAIN_RC_DOWNLOAD", "true")),
   });
   writeGitHubOutputs({
     "promote-only-release-candidate": String(result.enabled === true),