@kungfu-tech/buildchain 2.12.1 → 2.12.2

package/README.md

@@ -1,6 +1,7 @@
 # Buildchain
 
 <!-- buildchain:badges:start -->
+
 [![KFD-1: passed](https://buildchain.libkungfu.dev/badges/v1/kfd-1/passed.svg)](https://github.com/kungfu-systems/buildchain/releases/latest/download/buildchain.release.json)
 [![KFD-2: passed](https://buildchain.libkungfu.dev/badges/v1/kfd-2/passed.svg)](https://github.com/kungfu-systems/buildchain/releases/latest/download/buildchain.release.json)
 [![KFD-3: passed](https://buildchain.libkungfu.dev/badges/v1/kfd-3/passed.svg)](https://github.com/kungfu-systems/buildchain/releases/latest/download/buildchain.release.json)
@@ -199,6 +200,9 @@ Buildchain's active GitHub Action surface is deliberately small:
 
 The active reusable workflow surfaces are:
 
+- `.github/workflows/.gate-profile.yml` for project-neutral Shifu Gate profile
+  planning, capability-aware runner dispatch, receipt validation, and one
+  stable aggregate check;
 - `.github/workflows/.build.yml` for deterministic multi-platform build and
   artifact contracts;
 - `.github/workflows/build.yml` for the single-config channel router that uses
@@ -232,11 +236,11 @@ uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@
 
 Buildchain treats a reviewed branch merge as release intent:
 
-| Merge path | Meaning | Exact tag | Floating refs |
-| --- | --- | --- | --- |
-| `dev/vX/vX.Y -> alpha/vX/vX.Y` | publish the next testable alpha for a minor line | `vX.Y.Z-alpha.N` | `vX.Y-alpha`, `alpha/vX/vX.Y`, `dev/vX/vX.Y` |
-| `alpha/vX/vX.Y -> release/vX/vX.Y` | publish production for that minor line | `vX.Y.Z` | `vX.Y`, usually `vX`, `release/vX/vX.Y` |
-| `release/vX/vX.Y -> publish-gate/major` | publish the next major from a reviewed production line | `v(X+1).0.0` | `v(X+1)`, `v(X+1).0`, new dev/alpha/release branches |
+| Merge path                              | Meaning                                                | Exact tag        | Floating refs                                        |
+| --------------------------------------- | ------------------------------------------------------ | ---------------- | ---------------------------------------------------- |
+| `dev/vX/vX.Y -> alpha/vX/vX.Y`          | publish the next testable alpha for a minor line       | `vX.Y.Z-alpha.N` | `vX.Y-alpha`, `alpha/vX/vX.Y`, `dev/vX/vX.Y`         |
+| `alpha/vX/vX.Y -> release/vX/vX.Y`      | publish production for that minor line                 | `vX.Y.Z`         | `vX.Y`, usually `vX`, `release/vX/vX.Y`              |
+| `release/vX/vX.Y -> publish-gate/major` | publish the next major from a reviewed production line | `v(X+1).0.0`     | `v(X+1)`, `v(X+1).0`, new dev/alpha/release branches |
 
 Exact tags are immutable. Floating channel tags and branches are machine-updated
 by Buildchain and must remain writable by the release authority.
@@ -342,6 +346,7 @@ npm pack --dry-run --json --registry=https://registry.npmjs.org/
 - [Site bundle contract](docs/site-bundle-contract.md)
 - [Lifecycle protocol](docs/lifecycle-protocol.md)
 - [Reusable build surface](docs/reusable-build-surface.md)
+- [Shifu Gate profile orchestration](docs/shifu-gate-profiles.md)
 - [Release candidate passport](docs/release-candidate.md)
 - [Consumer issue reporting](docs/consumer-issue-reporting.md)
 - [Publish transaction](docs/publish-transaction.md)

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.12.1",
+    "version": "2.12.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -50,7 +50,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:f74dbced849a6864e38a68d5c2b2444a5cd8027cd9b4a759b189798261d99d4c"
+      "auditDigest": "sha256:fe8c66aca800df5bac04bdf980ecf3dde1ab5b9047d20097b06258eabc38015a"
     },
     {
       "contractVersion": 1,
@@ -89,7 +89,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:008bac87eb7f47f172f394aba3a42e5b429abd2ccc2a5cd2d090f4a92f773314"
+      "auditDigest": "sha256:8ad1e931c901428daa8aa20d15ed66c58976666c646a88171f37be550788878f"
     },
     {
       "contractVersion": 1,
@@ -481,7 +481,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:b9188b756eb9df02fefe10d2850ad868719fbe16f544d4b396ca232e0143eadd"
+      "auditDigest": "sha256:def4f995282224c7072e4534aa8c8fa7d77b3497e5cd6f00098469da70b5ff6d"
     },
     {
       "contractVersion": 1,
@@ -503,9 +503,9 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:af0ca2ff4793556a7d8d2dae1615674a2b76223d44cca577bae2686ba9b1bd8b"
+      "auditDigest": "sha256:6c4078f847d70ba9d2cca1149e976828c5b0244f2e66cc5232cb79936388c5d5"
     }
   ],
   "compatibilityDigest": "sha256:2090784977bc7d54fc647215ef73532b9db26147a0b40ec3f56c31d611d806cc",
-  "contractDigest": "sha256:3f072c9d07cbf855f96b20f300528be0417c0a9cfac59b2e222141fca8b2e70e"
+  "contractDigest": "sha256:db57a57a03db285dc2d3970c3ef2dc00e72bd95a3fd2791df8990c49d847aa3f"
 }