@kungfu-tech/buildchain 2.12.1-alpha.1 → 2.12.1-alpha.10

package/dist/site/public-surface-audit.json

@@ -3,11 +3,11 @@
   "contract": "kungfu-buildchain-public-surface-reverse-audit",
   "status": "passed",
   "summary": {
-    "cliCommandCount": 75,
-    "workflowCount": 41,
+    "cliCommandCount": 76,
+    "workflowCount": 42,
     "actionCount": 4,
     "sitePageCount": 46,
-    "docCommandRefCount": 237,
+    "docCommandRefCount": 241,
     "failureCount": 0
   },
   "enumerated": {
@@ -257,6 +257,11 @@
         "source": "bin/buildchain.mjs",
         "usage": "buildchain kfd upstream roles [--json]"
       },
+      {
+        "id": "layout",
+        "source": "bin/buildchain.mjs",
+        "usage": "buildchain layout [--cwd <dir>] [--json]"
+      },
       {
         "id": "lifecycle",
         "source": "bin/buildchain.mjs",
@@ -411,6 +416,7 @@
           "buildchain-contract-lock-path",
           "buildchain-ref",
           "buildchain-repository",
+          "cargo-registry-index",
           "checkout-cache-fallback",
           "checkout-cache-fetch-attempts",
           "checkout-cache-github-timeout-seconds",
@@ -438,13 +444,19 @@
           "require-trusted-event",
           "require-verify",
           "runner-preset",
+          "rust-toolchain",
+          "rustup-dist-server",
+          "rustup-update-root",
           "sample-process-tree",
           "setup-node",
+          "setup-rust",
+          "shifu-cache-profile-digest",
+          "shifu-cache-profile-ref",
           "untrusted-policy",
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 50
+        "inputCount": 57
       },
       {
         "id": ".bump-minor-version",
@@ -709,6 +721,7 @@
           "buildchain-ref",
           "buildchain-repository",
           "buildchain-stable-contract-lock-path",
+          "cargo-registry-index",
           "checkout-cache-fallback",
           "checkout-cache-fetch-attempts",
           "checkout-cache-github-timeout-seconds",
@@ -736,13 +749,19 @@
           "require-trusted-event",
           "require-verify",
           "runner-preset",
+          "rust-toolchain",
+          "rustup-dist-server",
+          "rustup-update-root",
           "sample-process-tree",
           "setup-node",
+          "setup-rust",
+          "shifu-cache-profile-digest",
+          "shifu-cache-profile-ref",
           "untrusted-policy",
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 53
+        "inputCount": 60
       },
       {
         "id": "buildchain-alpha-self-dogfood",
@@ -819,6 +838,15 @@
         ],
         "inputCount": 3
       },
+      {
+        "id": "buildchain-stable-candidate-qualification",
+        "path": ".github/workflows/buildchain-stable-candidate-qualification.yml",
+        "inputs": [
+          "candidate-sha",
+          "dry-run"
+        ],
+        "inputCount": 2
+      },
       {
         "id": "candidate-lab",
         "path": ".github/workflows/candidate-lab.yml",
@@ -836,12 +864,13 @@
         "inputs": [
           "buildchain-ref",
           "buildchain-repository",
+          "mode",
           "node-version",
           "require-version-state",
           "upload-artifacts",
           "working-directory"
         ],
-        "inputCount": 6
+        "inputCount": 7
       },
       {
         "id": "dev-pr-auto-merge",
@@ -2210,6 +2239,26 @@
         "path": "README.md",
         "command": "buildchain kfd"
       },
+      {
+        "id": "layout",
+        "path": "docs/binary-distribution.md",
+        "command": "buildchain layout --json"
+      },
+      {
+        "id": "layout",
+        "path": "docs/cli.md",
+        "command": "buildchain layout --cwd"
+      },
+      {
+        "id": "layout",
+        "path": "docs/cli.md",
+        "command": "buildchain layout"
+      },
+      {
+        "id": "layout",
+        "path": "docs/kfd-support.md",
+        "command": "buildchain layout --cwd"
+      },
       {
         "id": "lifecycle",
         "path": "docs/cli.md",
@@ -2641,9 +2690,9 @@
     "cliRegistryPath": "dist/site/cli-registry.json",
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
-    "cliRegistryDigest": "3c0729f5351eb82fe26625fa5aabf30903f45f68af2431e02860f85ada468ac9",
-    "workflowRegistryDigest": "60957af5c033c999d29ca0187eff28841311567580a5279a7b6843c2a270cc08",
-    "pageRegistryDigest": "b15ee7c795d14273836cb82d3a3c902e594647faa6336b17ef8d6f5ee337921d"
+    "cliRegistryDigest": "ab57fec294efb9dde1612787bfd0d532b5bb95298b5da14a2b51a5e71b9c7dcc",
+    "workflowRegistryDigest": "e7e3db196607ac6dbf4058552a84692c86c4e5cbcee7080c6cde9d1b71873daf",
+    "pageRegistryDigest": "8e2240c074e8e7b08761eba80c2650e6e9b94c8a6192266bb1b5b07a8aa08d38"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-11T09:20:25.844Z",
-  "publishedAt": "2026-07-11T09:20:25.844Z",
+  "generatedAt": "2026-07-13T04:23:40.596Z",
+  "publishedAt": "2026-07-13T04:23:40.596Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "68e0ad01b2f84c485af2fd8f8802bf67b41af730",
+  "sourceRevision": "6a389143f2635c16f68971b214f70ed1b600a329",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.1-alpha.1",
+    "version": "2.12.1-alpha.10",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-11T09:20:25.844Z",
-  "publishedAt": "2026-07-11T09:20:25.844Z",
+  "generatedAt": "2026-07-13T04:23:40.596Z",
+  "publishedAt": "2026-07-13T04:23:40.596Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "68e0ad01b2f84c485af2fd8f8802bf67b41af730",
+  "sourceRevision": "6a389143f2635c16f68971b214f70ed1b600a329",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.1-alpha.1",
+    "version": "2.12.1-alpha.10",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -109,7 +109,7 @@
       "path": "docs/binary-distribution.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:36899140a9b2e9ce1565ed41f3d64f73a8829fad3d59a04b9498d9479c85c4be"
+      "digest": "sha256:08be4e97e1940a45a2c0aa2506012255888c23c1cbf8f5362b27c2b21089eb58"
     },
     {
       "id": "consumer-issue-reporting",
@@ -173,7 +173,7 @@
       "path": "docs/cli.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:133a7921163fecda050d772827bd498f35f11b1a3514e303dbfe89bb7a220f5d"
+      "digest": "sha256:3b3ac97c353f7549229f1102cca38236e734ec8d08c219d4a6e5ef2a48fc0e16"
     },
     {
       "id": "build-facts",
@@ -189,7 +189,7 @@
       "path": "docs/kfd-support.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:456eef9dbb71df3842613083054942436e763c6aa5ca3ff8a51c5a4e8cc186e7"
+      "digest": "sha256:ab15de33a1a9e292b6da74c00b8b96b7c46330d0553a454d1de4c24c672fc025"
     },
     {
       "id": "lifecycle-protocol",
@@ -197,7 +197,7 @@
       "path": "docs/lifecycle-protocol.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:60c39693878258d275e9d47983b306faed35d6416297c14570429de73284604c"
+      "digest": "sha256:bef6f703a76667c731dccea6a0385b2196b5a23438ce4bc39894561530975f21"
     },
     {
       "id": "reusable-build-surface",
@@ -205,7 +205,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:dfa37928517a391c2ab214a095954dcb50e84f514cea0a8424619903843d9b8d"
+      "digest": "sha256:fbc74dee3a6f2283ea69a2a9a31945ac82ccaf1d270995539f5d80235ab74614"
     },
     {
       "id": "publish-transaction",
@@ -221,7 +221,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:a868fd50875aa64ae26d8e37a5bfbc4be137ce89be3b0726e97a7a8028a667f4"
+      "digest": "sha256:3ae2bbc2df394726f350e58be1a71dd0379b99b19cd6ccf15fbe3b843f3890b6"
     },
     {
       "id": "release-flow",

package/dist/site/workflow-registry.json

@@ -25,6 +25,7 @@
         "buildchain-contract-lock-path",
         "buildchain-ref",
         "buildchain-repository",
+        "cargo-registry-index",
         "checkout-cache-fallback",
         "checkout-cache-fetch-attempts",
         "checkout-cache-github-timeout-seconds",
@@ -52,13 +53,19 @@
         "require-trusted-event",
         "require-verify",
         "runner-preset",
+        "rust-toolchain",
+        "rustup-dist-server",
+        "rustup-update-root",
         "sample-process-tree",
         "setup-node",
+        "setup-rust",
+        "shifu-cache-profile-digest",
+        "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 50,
+      "inputCount": 57,
       "surface": "reusable-build",
       "capabilityGroup": "api-cli-reference",
       "status": "active"
@@ -368,6 +375,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "buildchain-stable-contract-lock-path",
+        "cargo-registry-index",
         "checkout-cache-fallback",
         "checkout-cache-fetch-attempts",
         "checkout-cache-github-timeout-seconds",
@@ -395,13 +403,19 @@
         "require-trusted-event",
         "require-verify",
         "runner-preset",
+        "rust-toolchain",
+        "rustup-dist-server",
+        "rustup-update-root",
         "sample-process-tree",
         "setup-node",
+        "setup-rust",
+        "shifu-cache-profile-digest",
+        "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 53,
+      "inputCount": 60,
       "surface": "channel-build-router",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -502,6 +516,18 @@
       "capabilityGroup": "governance-versioning",
       "status": "active"
     },
+    {
+      "id": "buildchain-stable-candidate-qualification",
+      "path": ".github/workflows/buildchain-stable-candidate-qualification.yml",
+      "inputs": [
+        "candidate-sha",
+        "dry-run"
+      ],
+      "inputCount": 2,
+      "surface": "repository-patrol",
+      "capabilityGroup": "api-cli-reference",
+      "status": "repository-internal"
+    },
     {
       "id": "candidate-lab",
       "path": ".github/workflows/candidate-lab.yml",
@@ -522,12 +548,13 @@
       "inputs": [
         "buildchain-ref",
         "buildchain-repository",
+        "mode",
         "node-version",
         "require-version-state",
         "upload-artifacts",
         "working-directory"
       ],
-      "inputCount": 6,
+      "inputCount": 7,
       "surface": "repository-workflow",
       "capabilityGroup": "api-cli-reference",
       "status": "active"

package/docs/binary-distribution.md

@@ -38,6 +38,25 @@ Each archive is accompanied by:
 - `buildchain-release-bundle.tar.gz`;
 - `buildchain-release-bundle.json`.
 
+## KFD-3 Distribution Declaration
+
+Buildchain self-describes this release lane in `dist/site/kfd-claims.json` as
+the KFD-3 surface `distribution:buildchain-standalone`. Its declaration assigns
+registration to Shifu, names `binary:build` as the reproducible task, and lists
+the artifact kind, platform, and path glob for all three archives. Shifu should
+discover the registry through `buildchain layout --json`, not by copying the
+registry path.
+
+The repository-owned task is:
+
+```bash
+pnpm binary:build
+```
+
+The release workflow still builds each target on its declared runner. The local
+task is the stable task identity used by the KFD declaration and local smoke
+checks; it does not replace the three-platform release matrix.
+
 ## Runner Policy
 
 Production binary builds use GitHub-hosted runners:
@@ -69,7 +88,7 @@ offline review, mirroring, or site ingestion.
 ## Local Smoke
 
 ```bash
-node scripts/build-standalone-binary.mjs --version v0.0.0-local --output-dir dist/binary
+pnpm binary:build -- --version v0.0.0-local
 node bin/buildchain.mjs collect github-release \
   --tag v0.0.0-local \
   --assets-dir dist/binary \

package/docs/cli.md

@@ -77,6 +77,7 @@ import { verifyReleasePassport } from "@kungfu-tech/buildchain/release-passport"
 import { createReleasePropagationPlan } from "@kungfu-tech/buildchain/release-propagation";
 import { planReleaseLineBootstrap } from "@kungfu-tech/buildchain/release-line-bootstrap";
 import { collectPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain/public-surface-audit";
+import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain/buildchain-layout";
 import contractWorld from "@kungfu-tech/buildchain/site/buildchain-contract.json" with { type: "json" };
 import capabilityRegistry from "@kungfu-tech/buildchain/site/capability-registry.json" with { type: "json" };
 import manualRegistry from "@kungfu-tech/buildchain/site/manual-registry.json" with { type: "json" };
@@ -90,6 +91,22 @@ floating-ref contract world for a runtime such as `@v2`.
 
 ## Commands
 
+`buildchain layout` is the stable machine question for repository layout. Tools
+such as Shifu should call it instead of copying `.buildchain/` path constants:
+
+```bash
+buildchain layout --cwd /path/to/repository --json
+```
+
+The result identifies the Buildchain version pin, repository root and config,
+the canonical and currently resolved KFD-3 registry paths, and the KFD field
+used to declare Shifu jurisdiction. A repository is in Shifu's distribution
+jurisdiction only when a KFD-3 surface explicitly declares
+`distribution.registrar="shifu"`; the presence of Buildchain configuration is
+not sufficient. The same contract is available through
+`createBuildchainLayoutDiscovery()` from
+`@kungfu-tech/buildchain/buildchain-layout`.
+
 `buildchain init` writes a starter `.buildchain/buildchain.toml` and a reusable workflow
 caller at `.github/workflows/build.yml`.
 

package/docs/kfd-support.md

@@ -279,6 +279,49 @@ detect standard public surfaces, write a small product-owned registry, audit the
 registry against the current artifact/source tree, generate a release-passport
 compatible witness, and query the resulting capability map.
 
+## Shifu Discovery and Distribution Declarations
+
+Buildchain owns the repository-layout question; product tools must not copy its
+internal paths. Shifu and other consumers use this sequence:
+
+1. read the welded `.buildchain-version` pin to select Buildchain;
+2. run `buildchain layout --cwd <repository> --json`;
+3. read the returned `kfd.registries["kfd-3"].path`;
+4. treat a surface as Shifu-managed only when its declaration contains
+   `distribution.registrar="shifu"`.
+
+The layout response uses the
+`kungfu-buildchain-layout-discovery` contract with an explicit schema version.
+Changing or removing its fields is a public contract change. Consumers must not
+fall back to a hard-coded registry location when the command is unavailable or
+returns an unsupported contract.
+
+A Shifu distribution declaration must contain at least one task and one
+artifact. Every artifact declares `kind`, `platform`, and `pathGlob`; an
+optional `sha256` is a lowercase 64-character hexadecimal digest. This makes
+artifact form and platform machine-readable without asking Shifu to infer them
+from filenames:
+
+```json
+{
+  "distribution": {
+    "registrar": "shifu",
+    "tasks": ["binary:build"],
+    "artifacts": [
+      {
+        "kind": "binary",
+        "platform": "linux",
+        "pathGlob": "dist/binary/example-x86_64-unknown-linux-gnu.tar.gz"
+      }
+    ]
+  }
+}
+```
+
+Buildchain validates this shape whenever a KFD-3 registry is read or written.
+Repositories that do not declare the registrar remain outside Shifu's
+distribution jurisdiction.
+
 ## Detected, Declared, Enforced
 
 KFD-3 surface registration uses three states.
@@ -402,7 +445,7 @@ Buildchain dogfoods this model in two ways:
   `buildchain kfd 2 trust-assessment --json` expose and validate the KFD
   package's foundation KFD-2 trust facts against the latest KFD taxonomy;
 - `dist/site/kfd-claims.json` declares Buildchain's own KFD-3 collaboration
-  interface;
+  interface, including a Shifu-owned standalone binary distribution surface;
 - `buildchain kfd 3 query buildchain --json` resolves the packaged
   Buildchain capability map from that site fact source.
 

package/docs/lifecycle-protocol.md

@@ -158,6 +158,9 @@ commands = [
   "pnpm run package",
 ]
 
+[lifecycle.check]
+command = "pnpm run check:source"
+
 [lifecycle.verify]
 shell = "bash"
 script = """
@@ -167,6 +170,15 @@ git diff --check
 """
 ```
 
+`lifecycle.check` is the repository-owned source-acceptance gate. It should
+validate the checked-out source revision without entering the build, artifact,
+or release lifecycle. Consumers can run it on GitHub-hosted Linux through
+`.github/workflows/check.yml@v2` with `mode: source`; the reusable workflow runs
+only `lifecycle.install` and `lifecycle.check`. The default `mode: verify`
+continues to run `lifecycle.install` and `lifecycle.verify` for existing callers.
+The reusable job name remains `check`, and `upload-artifacts: false` disables
+evidence upload without changing the job conclusion used by branch protection.
+
 Shared environment variables can be declared once:
 
 ```toml

package/docs/release-governance.md

@@ -412,6 +412,13 @@ Consumers that want Buildchain to own the check wrapper can call
 `lifecycle.install` and `lifecycle.verify` stages and fails the `check` job when
 either declaration is missing or the command exits non-zero.
 
+Development pull requests that need source acceptance without product build or
+artifact verification can opt into `mode: source`. That mode runs only
+`lifecycle.install` and `lifecycle.check` on GitHub-hosted `ubuntu-24.04` while
+preserving the stable `check / check` required-check context. Existing callers
+remain on `mode: verify` by default, and callers may set
+`upload-artifacts: false` without weakening the job conclusion.
+
 Typical consumer wrapper:
 
 ```yaml

package/docs/reusable-build-surface.md

@@ -162,6 +162,43 @@ Artifact names, manifest paths, expected artifact checks, publish-source locks,
 and aggregate summaries are the same in both jobs. The split is an execution
 detail, not a different artifact contract.
 
+## Native Rust Toolchains
+
+Native lifecycle jobs can request an isolated Rust installation instead of
+depending on a self-hosted runner user's PATH:
+
+```yaml
+with:
+  setup-rust: true
+  rust-toolchain: "1.96.0"
+  rustup-dist-server: "https://rsproxy.cn"
+  rustup-update-root: "https://rsproxy.cn/rustup"
+  cargo-registry-index: ${{ vars.BUILDCHAIN_CARGO_REGISTRY_INDEX }}
+```
+
+`setup-rust` defaults to `false`, so existing consumers are unchanged. When it
+is enabled, Buildchain installs `rust-toolchain` before the install, build, and
+verify lifecycle stages on every native matrix platform. Windows uses the
+official rustup bootstrap through `cmd.exe` and `curl.exe` into runner-temporary
+Cargo and rustup homes, so it works under a restrictive PowerShell execution
+policy and the service account does not depend on another user's PATH or mutate
+host toolchain state. Pin an exact toolchain for release builds. Linux container jobs continue
+to obtain Rust from their digest-pinned image contract; Buildchain does not
+mutate that container surface.
+
+The rustup server inputs are optional and default to Rust's official servers.
+Consumers behind a slow cross-border link may select a trusted transport mirror;
+rustup still verifies the selected toolchain's distribution metadata and
+component checksums.
+
+`cargo-registry-index` is also optional. When set, Buildchain exposes it to
+Cargo as `CARGO_REGISTRIES_CRATES_IO_INDEX` for every native lifecycle stage,
+so a self-hosted runner can use a repository or organization variable without
+committing private LAN topology to public workflow YAML. The endpoint must be a
+crates.io-compatible index whose `config.json` download contract serves the
+matching checksum-verified crate archives. An empty value preserves Cargo's
+normal crates.io behavior.
+
 The container image provides `fnm` but does not preinstall Node. Buildchain uses
 `fnm` inside the container to install the requested `node-version` before it
 runs Buildchain runtime scripts or lifecycle actions.
@@ -289,6 +326,38 @@ also pass `buildchain-ref: v2-alpha` explicitly; official floating refs are
 ordinary channel selections and are allowed on pull requests and pushes. Train
 refs and exact SHAs remain trusted manual overrides.
 
+## Shifu Cache Profile Passthrough
+
+Buildchain can carry one trusted Shifu cache-profile reference and its exact
+digest into lifecycle execution. Its contract is an opaque reference and digest
+only. This surface is deliberately opaque:
+Buildchain does not fetch the profile, parse JSON, select cache services,
+rewrite bindings, decide fallback, or emit Shifu resolution evidence. Those
+semantics remain owned by the consumer's pinned Shifu implementation.
+
+```yaml
+jobs:
+  build:
+    uses: kungfu-systems/buildchain/.github/workflows/build.yml@v2
+    with:
+      shifu-cache-profile-ref: ${{ vars.SHIFU_CACHE_PROFILE_REF }}
+      shifu-cache-profile-digest: ${{ vars.SHIFU_CACHE_PROFILE_DIGEST }}
+```
+
+The reusable workflow passes the pair as `SHIFU_CACHE_PROFILE_REF` and
+`SHIFU_CACHE_PROFILE_DIGEST` to install, build, and verify lifecycle commands.
+The consumer must invoke its Shifu cache-aware execution surface. An empty pair
+preserves existing behavior; a consumer Shifu should fail closed when exactly
+one value is present or the resolved bytes do not match the expected digest.
+
+Use trusted repository or organization variables rather than PR-controlled
+files for private/LAN references. The variables must remain secret-free; any
+credentials use a separate provider-approved secret surface and must not be
+embedded in the profile reference. This passthrough is separate from
+Buildchain's locked source checkout cache below: Buildchain owns checkout
+transport and source identity, while Shifu owns post-checkout execution cache
+bindings and receipts.
+
 ## Locked Source Checkout Cache
 
 Self-hosted runners that build large repositories can opt into a locked checkout

package/docs/stable-candidate-patrol.md

@@ -43,6 +43,22 @@ alphas for that exact stable version are closed because that immutable stable
 version has been consumed; their later product changes continue through the
 next patch alpha prepared by the normal release transaction.
 
+For Buildchain's own release line, successful Alpha Self-Dogfood starts an
+idempotent qualification producer for the exact alpha SHA. It dispatches the
+existing `Build Surface Fixture` at the immutable exact tag, runs the existing
+`site-libkungfu-dev` no-apply canary with the exact SHA, and writes the declared
+commit-status attestation only after that authoritative canary succeeds. The
+producer creates evidence only: Patrol still owns qualification and selection,
+and the normal source-lock PR, stable gate, transaction, and branch protections
+remain mandatory.
+
+Cross-repository dispatch and repository-local attestation use separate tokens.
+The promotion token can start the no-apply consumer workflow, while the
+repository-scoped Actions token writes the status as `github-actions[bot]` only
+after the producer has observed the successful authoritative workflow run. The
+stable gate still verifies the workflow identity, exact runtime SHA, target URL,
+and allowed attestor before accepting that status.
+
 ## Repository policy
 
 Declare the default once in `.buildchain/buildchain.toml`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.1-alpha.1",
+  "version": "2.12.1-alpha.10",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -84,6 +84,7 @@
     "check:site": "node scripts/generate-site-bundle.mjs --check",
     "test:unit": "node --test tests/*.test.mjs",
     "build": "pnpm -r --filter \"./actions/**\" build",
+    "binary:build": "node scripts/build-standalone-binary.mjs",
     "package": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
     "pack:check": "npm pack --dry-run --json --registry=https://registry.npmjs.org/"
   },