@kungfu-tech/buildchain 2.12.5-alpha.1 → 2.12.5-alpha.2

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.12.5-alpha.1",
+    "version": "2.12.5-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -328,7 +328,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:f452026600687ecc266651457a8c1151303210d312f0d16ad16e4c3f414ed170"
+      "auditDigest": "sha256:32fd54ceb8e1a0219918e7744797e3a1bf3f614bb8498028209275b98304ac5b"
     },
     {
       "contractVersion": 1,
@@ -377,7 +377,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:f452026600687ecc266651457a8c1151303210d312f0d16ad16e4c3f414ed170"
+      "auditDigest": "sha256:32fd54ceb8e1a0219918e7744797e3a1bf3f614bb8498028209275b98304ac5b"
     },
     {
       "contractVersion": 1,
@@ -549,7 +549,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:b2d4e6e8a3839374cf0f39b2ad2ac60fcb10985611597c44f5273c0c16a5c27d"
+      "auditDigest": "sha256:3bcfa43a81ab6b7cab1a82deee789d412978df48496f8cc73b6edef71a38569a"
     },
     {
       "contractVersion": 1,
@@ -2549,5 +2549,5 @@
     }
   ],
   "compatibilityDigest": "sha256:2520207c5d6d6a737dd32251a42be9c5299644d9aebf690a8402ead1724ed495",
-  "contractDigest": "sha256:cc06a00825e7aa4d16ae647af346cf8457f177255b73beff65d086f022b66d11"
+  "contractDigest": "sha256:297bf3fb92da8a668f0bcbe9cf4d87fc544dd24b241a1047404eaf64fdfba420"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-14T01:49:12.636Z",
-  "publishedAt": "2026-07-14T01:49:12.636Z",
+  "generatedAt": "2026-07-14T02:08:07.124Z",
+  "publishedAt": "2026-07-14T02:08:07.124Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e80475ac79f2673396c1fb006f381d83d20d688d",
+  "sourceRevision": "0cb2a220385a2ef7bc6eafb76d1e99eaf4b31501",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.5-alpha.1",
+    "version": "2.12.5-alpha.2",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.5-alpha.1",
+    "version": "2.12.5-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -86,7 +86,7 @@
       "specifier": "@kungfu-tech/buildchain/controller-evidence",
       "export": "./controller-evidence",
       "target": "./packages/core/controller-evidence.js",
-      "digest": "sha256:e5db8c1534f634c525c00dd81e380157a8d7415e95471474574edd4cf92f0fb7",
+      "digest": "sha256:6aba1af5216feaec16581a1ea36fdf318cf4af4e03b22fe5399a8bf597b8c003",
       "summary": "Project-independent controller descriptors, source/runtime-bound plans, receipts, aggregates, and validation APIs.",
       "capabilityGroup": "reusable-build",
       "audience": [
@@ -281,7 +281,7 @@
       "specifier": "@kungfu-tech/buildchain/release-passport",
       "export": "./release-passport",
       "target": "./packages/core/release-passport.js",
-      "digest": "sha256:f452026600687ecc266651457a8c1151303210d312f0d16ad16e4c3f414ed170",
+      "digest": "sha256:32fd54ceb8e1a0219918e7744797e3a1bf3f614bb8498028209275b98304ac5b",
       "summary": "Release passport collection, verification, explanation, and evidence APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-14T01:49:12.636Z",
-  "publishedAt": "2026-07-14T01:49:12.636Z",
+  "generatedAt": "2026-07-14T02:08:07.124Z",
+  "publishedAt": "2026-07-14T02:08:07.124Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e80475ac79f2673396c1fb006f381d83d20d688d",
+  "sourceRevision": "0cb2a220385a2ef7bc6eafb76d1e99eaf4b31501",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.5-alpha.1",
+    "version": "2.12.5-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-14T01:49:12.636Z",
-  "publishedAt": "2026-07-14T01:49:12.636Z",
+  "generatedAt": "2026-07-14T02:08:07.124Z",
+  "publishedAt": "2026-07-14T02:08:07.124Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e80475ac79f2673396c1fb006f381d83d20d688d",
+  "sourceRevision": "0cb2a220385a2ef7bc6eafb76d1e99eaf4b31501",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.5-alpha.1",
+    "version": "2.12.5-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.5-alpha.1",
+  "version": "2.12.5-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/controller-evidence.js

@@ -452,6 +452,7 @@ export function createControllerReceiptReference(receipt) {
 
 export function validateControllerReceiptReference(reference, {
   expectedSourceSha = "",
+  acceptedSourceShas = [],
   expectedRuntimeSha = "",
   requirePassed = false,
 } = {}) {
@@ -468,7 +469,10 @@ export function validateControllerReceiptReference(reference, {
     issues.push("controller receipt reference status is invalid");
   }
   if (requirePassed && reference.status !== "passed") issues.push("controller receipt reference status must be passed");
-  if (expectedSourceSha && reference.sourceSha !== expectedSourceSha) issues.push("controller receipt reference source SHA mismatch");
+  const allowedSourceShas = new Set([expectedSourceSha, ...(acceptedSourceShas || [])].filter(Boolean));
+  if (allowedSourceShas.size > 0 && !allowedSourceShas.has(reference.sourceSha)) {
+    issues.push("controller receipt reference source SHA mismatch");
+  }
   if (expectedRuntimeSha && reference.runtimeSha !== expectedRuntimeSha) issues.push("controller receipt reference runtime SHA mismatch");
   return { ok: issues.length === 0, issues };
 }
@@ -477,6 +481,7 @@ export function normalizeControllerReceiptReferences({
   receipts = [],
   references = [],
   expectedSourceSha = "",
+  acceptedSourceShas = [],
   expectedRuntimeSha = "",
   requirePassed = false,
 } = {}) {
@@ -486,7 +491,12 @@ export function normalizeControllerReceiptReferences({
   ];
   const seen = new Set();
   for (const reference of normalized) {
-    const validation = validateControllerReceiptReference(reference, { expectedSourceSha, expectedRuntimeSha, requirePassed });
+    const validation = validateControllerReceiptReference(reference, {
+      expectedSourceSha,
+      acceptedSourceShas,
+      expectedRuntimeSha,
+      requirePassed,
+    });
     if (!validation.ok) throw new Error(`controller receipt reference is invalid: ${validation.issues.join("; ")}`);
     if (seen.has(reference.controllerId)) throw new Error(`duplicate controller receipt reference: ${reference.controllerId}`);
     seen.add(reference.controllerId);

package/packages/core/release-passport.js

@@ -1019,10 +1019,16 @@ export function createReleasePassport({
     kfd1Section: normalizedKfd1?.passportSection,
     kfd3Section: normalizedKfd3?.passportSection,
   });
+  const builtSourceSha = optionalString(release.builtSourceSha || release.built_source_sha);
+  const promotionChannelSha = optionalString(release.promotionChannelSha || release.promotion_channel_sha);
+  const treeEquivalent = release.treeEquivalent === true;
   const normalizedControllerReceipts = normalizeControllerReceiptReferences({
     receipts: controllerReceipts,
     references: controllerReceiptReferences,
     expectedSourceSha: sourceSha,
+    acceptedSourceShas: treeEquivalent && promotionChannelSha === sourceSha && builtSourceSha
+      ? [builtSourceSha]
+      : [],
     requirePassed: true,
   });
   const publishArtifacts = normalizedPublishEvidence?.artifacts || [];