@kungfu-tech/buildchain 2.12.5-alpha.1 → 2.12.5-alpha.3

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.12.5-alpha.1",
+    "version": "2.12.5-alpha.3",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -89,7 +89,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:00f575bb160b851361927a998b4dab66f7eade003f80d1fa5bc72bb68328835c"
+      "auditDigest": "sha256:13d6d3cfaadf68c32c38b4014956f6deab8c8c07e6d9a63ff5acf0d3d9cb04aa"
     },
     {
       "contractVersion": 1,
@@ -328,7 +328,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:f452026600687ecc266651457a8c1151303210d312f0d16ad16e4c3f414ed170"
+      "auditDigest": "sha256:32fd54ceb8e1a0219918e7744797e3a1bf3f614bb8498028209275b98304ac5b"
     },
     {
       "contractVersion": 1,
@@ -377,7 +377,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:f452026600687ecc266651457a8c1151303210d312f0d16ad16e4c3f414ed170"
+      "auditDigest": "sha256:32fd54ceb8e1a0219918e7744797e3a1bf3f614bb8498028209275b98304ac5b"
     },
     {
       "contractVersion": 1,
@@ -549,7 +549,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:b2d4e6e8a3839374cf0f39b2ad2ac60fcb10985611597c44f5273c0c16a5c27d"
+      "auditDigest": "sha256:3bcfa43a81ab6b7cab1a82deee789d412978df48496f8cc73b6edef71a38569a"
     },
     {
       "contractVersion": 1,
@@ -1374,7 +1374,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:00f575bb160b851361927a998b4dab66f7eade003f80d1fa5bc72bb68328835c"
+      "auditDigest": "sha256:13d6d3cfaadf68c32c38b4014956f6deab8c8c07e6d9a63ff5acf0d3d9cb04aa"
     },
     {
       "contractVersion": 1,
@@ -2549,5 +2549,5 @@
     }
   ],
   "compatibilityDigest": "sha256:2520207c5d6d6a737dd32251a42be9c5299644d9aebf690a8402ead1724ed495",
-  "contractDigest": "sha256:cc06a00825e7aa4d16ae647af346cf8457f177255b73beff65d086f022b66d11"
+  "contractDigest": "sha256:2c9a5c8a22c208b3d58a99079831f0177d1f7c2fdecf9036257212fc91c6a7fa"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-14T01:49:12.636Z",
-  "publishedAt": "2026-07-14T01:49:12.636Z",
+  "generatedAt": "2026-07-14T02:25:54.973Z",
+  "publishedAt": "2026-07-14T02:25:54.973Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e80475ac79f2673396c1fb006f381d83d20d688d",
+  "sourceRevision": "fe6b044ccd9e27ee6d0c6c72fc8e25920303171b",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.5-alpha.1",
+    "version": "2.12.5-alpha.3",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.5-alpha.1",
+    "version": "2.12.5-alpha.3",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -86,7 +86,7 @@
       "specifier": "@kungfu-tech/buildchain/controller-evidence",
       "export": "./controller-evidence",
       "target": "./packages/core/controller-evidence.js",
-      "digest": "sha256:e5db8c1534f634c525c00dd81e380157a8d7415e95471474574edd4cf92f0fb7",
+      "digest": "sha256:6aba1af5216feaec16581a1ea36fdf318cf4af4e03b22fe5399a8bf597b8c003",
       "summary": "Project-independent controller descriptors, source/runtime-bound plans, receipts, aggregates, and validation APIs.",
       "capabilityGroup": "reusable-build",
       "audience": [
@@ -281,7 +281,7 @@
       "specifier": "@kungfu-tech/buildchain/release-passport",
       "export": "./release-passport",
       "target": "./packages/core/release-passport.js",
-      "digest": "sha256:f452026600687ecc266651457a8c1151303210d312f0d16ad16e4c3f414ed170",
+      "digest": "sha256:32fd54ceb8e1a0219918e7744797e3a1bf3f614bb8498028209275b98304ac5b",
       "summary": "Release passport collection, verification, explanation, and evidence APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-14T01:49:12.636Z",
-  "publishedAt": "2026-07-14T01:49:12.636Z",
+  "generatedAt": "2026-07-14T02:25:54.973Z",
+  "publishedAt": "2026-07-14T02:25:54.973Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e80475ac79f2673396c1fb006f381d83d20d688d",
+  "sourceRevision": "fe6b044ccd9e27ee6d0c6c72fc8e25920303171b",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.5-alpha.1",
+    "version": "2.12.5-alpha.3",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-14T01:49:12.636Z",
-  "publishedAt": "2026-07-14T01:49:12.636Z",
+  "generatedAt": "2026-07-14T02:25:54.973Z",
+  "publishedAt": "2026-07-14T02:25:54.973Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e80475ac79f2673396c1fb006f381d83d20d688d",
+  "sourceRevision": "fe6b044ccd9e27ee6d0c6c72fc8e25920303171b",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.5-alpha.1",
+    "version": "2.12.5-alpha.3",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.5-alpha.1",
+  "version": "2.12.5-alpha.3",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/controller-evidence.js

@@ -452,6 +452,7 @@ export function createControllerReceiptReference(receipt) {
 
 export function validateControllerReceiptReference(reference, {
   expectedSourceSha = "",
+  acceptedSourceShas = [],
   expectedRuntimeSha = "",
   requirePassed = false,
 } = {}) {
@@ -468,7 +469,10 @@ export function validateControllerReceiptReference(reference, {
     issues.push("controller receipt reference status is invalid");
   }
   if (requirePassed && reference.status !== "passed") issues.push("controller receipt reference status must be passed");
-  if (expectedSourceSha && reference.sourceSha !== expectedSourceSha) issues.push("controller receipt reference source SHA mismatch");
+  const allowedSourceShas = new Set([expectedSourceSha, ...(acceptedSourceShas || [])].filter(Boolean));
+  if (allowedSourceShas.size > 0 && !allowedSourceShas.has(reference.sourceSha)) {
+    issues.push("controller receipt reference source SHA mismatch");
+  }
   if (expectedRuntimeSha && reference.runtimeSha !== expectedRuntimeSha) issues.push("controller receipt reference runtime SHA mismatch");
   return { ok: issues.length === 0, issues };
 }
@@ -477,6 +481,7 @@ export function normalizeControllerReceiptReferences({
   receipts = [],
   references = [],
   expectedSourceSha = "",
+  acceptedSourceShas = [],
   expectedRuntimeSha = "",
   requirePassed = false,
 } = {}) {
@@ -486,7 +491,12 @@ export function normalizeControllerReceiptReferences({
   ];
   const seen = new Set();
   for (const reference of normalized) {
-    const validation = validateControllerReceiptReference(reference, { expectedSourceSha, expectedRuntimeSha, requirePassed });
+    const validation = validateControllerReceiptReference(reference, {
+      expectedSourceSha,
+      acceptedSourceShas,
+      expectedRuntimeSha,
+      requirePassed,
+    });
     if (!validation.ok) throw new Error(`controller receipt reference is invalid: ${validation.issues.join("; ")}`);
     if (seen.has(reference.controllerId)) throw new Error(`duplicate controller receipt reference: ${reference.controllerId}`);
     seen.add(reference.controllerId);

package/packages/core/release-passport.js

@@ -1019,10 +1019,16 @@ export function createReleasePassport({
     kfd1Section: normalizedKfd1?.passportSection,
     kfd3Section: normalizedKfd3?.passportSection,
   });
+  const builtSourceSha = optionalString(release.builtSourceSha || release.built_source_sha);
+  const promotionChannelSha = optionalString(release.promotionChannelSha || release.promotion_channel_sha);
+  const treeEquivalent = release.treeEquivalent === true;
   const normalizedControllerReceipts = normalizeControllerReceiptReferences({
     receipts: controllerReceipts,
     references: controllerReceiptReferences,
     expectedSourceSha: sourceSha,
+    acceptedSourceShas: treeEquivalent && promotionChannelSha === sourceSha && builtSourceSha
+      ? [builtSourceSha]
+      : [],
     requirePassed: true,
   });
   const publishArtifacts = normalizedPublishEvidence?.artifacts || [];

package/scripts/generate-channel-build-workflow.mjs

@@ -92,20 +92,20 @@ function routerControllerPlanJob() {
       controller-plan-digest: \${{ steps.plan.outputs.controller-plan-digest }}
       runtime-sha: \${{ steps.identities.outputs.runtime-sha }}
     steps:
-      - name: Checkout selected Buildchain runtime
+      - name: Checkout Buildchain controller workflow shell
         uses: actions/checkout@v7.0.0
         with:
-          repository: \${{ inputs.buildchain-repository }}
-          ref: \${{ needs.resolve-channel.outputs.buildchain-ref }}
-          path: .buildchain/runtime
+          repository: \${{ needs.resolve-channel.outputs.router-repository }}
+          ref: \${{ needs.resolve-channel.outputs.router-ref }}
+          path: .buildchain/controller-runtime
           persist-credentials: false
 
-      - name: Resolve selected runtime identity
+      - name: Resolve controller workflow shell identity
         id: identities
         shell: bash
         run: |
-          runtime_sha="$(git -C .buildchain/runtime rev-parse HEAD)"
-          contract_digest="$(node -e 'const fs=require("fs"); const value=JSON.parse(fs.readFileSync(".buildchain/runtime/dist/site/buildchain-contract.json","utf8")); process.stdout.write(value.contractDigest)')"
+          runtime_sha="$(git -C .buildchain/controller-runtime rev-parse HEAD)"
+          contract_digest="$(node -e 'const fs=require("fs"); const value=JSON.parse(fs.readFileSync(".buildchain/controller-runtime/dist/site/buildchain-contract.json","utf8")); process.stdout.write(value.contractDigest)')"
           {
             echo "runtime-sha=\${runtime_sha}"
             echo "contract-digest=\${contract_digest}"
@@ -113,12 +113,12 @@ function routerControllerPlanJob() {
 
       - name: Create channel router controller plan
         id: plan
-        run: node .buildchain/runtime/scripts/controller-evidence.mjs --mode plan
+        run: node .buildchain/controller-runtime/scripts/controller-evidence.mjs --mode plan
         env:
           BUILDCHAIN_CONTROLLER_ID: build-channel-router
           BUILDCHAIN_CONTROLLER_SOURCE_REPOSITORY: \${{ github.repository }}
           BUILDCHAIN_CONTROLLER_SOURCE_SHA: \${{ github.sha }}
-          BUILDCHAIN_CONTROLLER_RUNTIME_REF: \${{ needs.resolve-channel.outputs.buildchain-ref }}
+          BUILDCHAIN_CONTROLLER_RUNTIME_REF: \${{ needs.resolve-channel.outputs.router-ref }}
           BUILDCHAIN_CONTROLLER_RUNTIME_SHA: \${{ steps.identities.outputs.runtime-sha }}
           BUILDCHAIN_CONTROLLER_CONTRACT_DIGEST: \${{ steps.identities.outputs.contract-digest }}
           BUILDCHAIN_CONTROLLER_INPUTS_JSON: \${{ toJSON(inputs) }}
@@ -153,12 +153,12 @@ function routerControllerReceiptJob() {
       controller-receipt-digest: \${{ steps.receipt.outputs.controller-receipt-digest }}
       controller-receipt-status: \${{ steps.receipt.outputs.controller-receipt-status }}
     steps:
-      - name: Checkout selected Buildchain runtime
+      - name: Checkout Buildchain controller workflow shell
         uses: actions/checkout@v7.0.0
         with:
-          repository: \${{ inputs.buildchain-repository }}
+          repository: \${{ needs.resolve-channel.outputs.router-repository }}
           ref: \${{ needs.controller-plan.outputs.runtime-sha }}
-          path: .buildchain/runtime
+          path: .buildchain/controller-runtime
           persist-credentials: false
 
       - name: Download channel router controller plan
@@ -169,7 +169,7 @@ function routerControllerReceiptJob() {
 
       - name: Create channel router controller receipt
         id: receipt
-        run: node .buildchain/runtime/scripts/controller-evidence.mjs --mode receipt
+        run: node .buildchain/controller-runtime/scripts/controller-evidence.mjs --mode receipt
         env:
           BUILDCHAIN_CONTROLLER_PLAN_PATH: .buildchain/controller/plan.json
           BUILDCHAIN_CONTROLLER_STAGES_JSON: >-
@@ -214,6 +214,15 @@ function generateChannelBuildWorkflowBase(source) {
 
 export function generateChannelBuildWorkflow(source) {
   const generated = generateChannelBuildWorkflowBase(source)
+    .replace(
+      "      contract-lock-path: ${{ steps.lock.outputs.path }}\n",
+      [
+        "      contract-lock-path: ${{ steps.lock.outputs.path }}",
+        "      router-repository: ${{ steps.router.outputs.repository }}",
+        "      router-ref: ${{ steps.router.outputs.ref }}",
+        "",
+      ].join("\n"),
+    )
     .replace("\n  build:\n", `\n${routerControllerPlanJob()}\n\n  build:\n`)
     .replace(
       "    needs: resolve-channel\n    uses: ./.github/workflows/.build.yml",