@kungfu-tech/buildchain 2.12.6 → 2.12.7-alpha.1

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-14T04:26:37.000Z",
-  "publishedAt": "2026-07-14T04:26:37.000Z",
+  "generatedAt": "2026-07-14T16:13:01.149Z",
+  "publishedAt": "2026-07-14T16:13:01.149Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "cbc30aab42b6ef7a32f8ab87b9e5674ce676f5c3",
+  "sourceRevision": "3412ff280be0e1160a0e33b11b461adde02b57e4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.6",
+    "version": "2.12.7-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -26,6 +26,9 @@
       "./logging": "./packages/core/logging.js",
       "./publication-artifact": "./packages/core/publication-artifact.js",
       "./publication-package": "./packages/core/publication-package.js",
+      "./publication-authority": "./packages/core/publication-authority.js",
+      "./publication-control-plane-audit": "./packages/core/publication-control-plane-audit.js",
+      "./buildchain-publication-authority": "./packages/core/buildchain-publication-authority.js",
       "./kfd-gate": "./packages/core/kfd-gate.js",
       "./release-candidate": "./packages/core/release-candidate.js",
       "./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",
@@ -44,6 +47,7 @@
       "./site/kfd-claims.json": "./dist/site/kfd-claims.json",
       "./site/workflow-registry.json": "./dist/site/workflow-registry.json",
       "./site/controller-registry.json": "./dist/site/controller-registry.json",
+      "./site/publication-authority-registry.json": "./dist/site/publication-authority-registry.json",
       "./site/public-surface-audit.json": "./dist/site/public-surface-audit.json",
       "./site/kfd-upstream-aggregate.json": "./dist/site/kfd-upstream-aggregate.json",
       "./site/release-model.json": "./dist/site/release-model.json",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-14T04:26:37.000Z",
-  "publishedAt": "2026-07-14T04:26:37.000Z",
+  "generatedAt": "2026-07-14T16:13:01.149Z",
+  "publishedAt": "2026-07-14T16:13:01.149Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "cbc30aab42b6ef7a32f8ab87b9e5674ce676f5c3",
+  "sourceRevision": "3412ff280be0e1160a0e33b11b461adde02b57e4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.6",
+    "version": "2.12.7-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:223c7e2d20680d4a10c84f6a7c7875602538607217e9dfe291a356bbd21ac4f1"
+      "digest": "sha256:91dc800bafc31bc149680c86272827936c94e0f025d547bbabc10d58fe5f128e"
     },
     {
       "id": "install",
@@ -79,6 +79,14 @@
       "exists": true,
       "digest": "sha256:442e1b72e3977af56a8ae5e081ffd89c2f3ebcd9cfd50f07af730344bdf9fb0e"
     },
+    {
+      "id": "publication-authority",
+      "title": "Sealed publication authority",
+      "path": "docs/publication-authority.md",
+      "plane": "verify",
+      "exists": true,
+      "digest": "sha256:fc08e6657a1b586b6b8b5618ca4f49dfaa85955687f5bba8e2e69e7513fe6c71"
+    },
     {
       "id": "release-candidate",
       "title": "Release Candidate Passport",
@@ -272,6 +280,7 @@
     "node-api-registry.json",
     "workflow-registry.json",
     "controller-registry.json",
+    "publication-authority-registry.json",
     "public-surface-audit.json",
     "release-model.json",
     "artifact-schemas.json",

package/dist/site/workflow-registry.json

@@ -3,6 +3,30 @@
   "contract": "kungfu-buildchain-workflow-registry",
   "workflowSource": ".github/workflows reverse input enumeration",
   "workflows": [
+    {
+      "id": ".binary-release-assets",
+      "path": ".github/workflows/.binary-release-assets.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "buildchain-repository",
+        "evidence-run-id",
+        "publication-admission-json",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-runner-provenance-json",
+        "publication-used-nonces-json",
+        "release-tag"
+      ],
+      "inputCount": 9,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": ".build",
       "path": ".github/workflows/.build.yml",
@@ -185,6 +209,47 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": ".publication-authority",
+      "path": ".github/workflows/.publication-authority.yml",
+      "reusable": true,
+      "inputs": [
+        "admission-json",
+        "auto-admission",
+        "buildchain-ref",
+        "buildchain-repository",
+        "control-plane-audit-json",
+        "dry-run",
+        "evidence-manifest-pattern",
+        "evidence-passport-artifact",
+        "evidence-payload-pattern",
+        "evidence-repository",
+        "evidence-run-id",
+        "evidence-summary-artifact",
+        "expected-json",
+        "gate-aggregate-json",
+        "package-name",
+        "product",
+        "publication-target",
+        "publisher-workflow-path",
+        "runner-provenance-json",
+        "source-sha",
+        "target-ref",
+        "used-nonces-json"
+      ],
+      "inputCount": 22,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "capability-artifact",
+        "capability-digest",
+        "capability-json"
+      ],
+      "outputCount": 3,
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": ".release-docker",
       "path": ".github/workflows/.release-docker.yml",
@@ -474,6 +539,11 @@
         "production-release-on-main",
         "production-release-pr-mode",
         "production-release-pr-token",
+        "publication-admission-json",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-runner-provenance-json",
+        "publication-used-nonces-json",
         "release-feedback-actor-privacy",
         "staging-apply",
         "staging-aws-role-arn",
@@ -481,7 +551,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 33,
+      "inputCount": 38,
       "secrets": [
         "production-release-app-private-key"
       ],
@@ -575,6 +645,20 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": "binary-release-assets",
+      "path": ".github/workflows/binary-release-assets.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": "build-surface-fixture",
       "path": ".github/workflows/build-surface-fixture.yml",
@@ -962,6 +1046,11 @@
         "github-release-title",
         "node-version",
         "package-name",
+        "publication-admission-json",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-runner-provenance-json",
+        "publication-used-nonces-json",
         "publish-dist-tag",
         "publish-package-set-order",
         "release-passport-impact-json",
@@ -978,11 +1067,9 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 32,
-      "secrets": [
-        "BUILDCHAIN_PROMOTION_TOKEN"
-      ],
-      "secretCount": 1,
+      "inputCount": 37,
+      "secrets": [],
+      "secretCount": 0,
       "outputs": [
         "controller-plan-artifact",
         "controller-plan-digest",
@@ -1158,6 +1245,17 @@
         "github-release-notes",
         "github-release-title",
         "package-manager",
+        "publication-admission-json",
+        "publication-auto-admission",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-gate-aggregate-json",
+        "publication-package-name",
+        "publication-product",
+        "publication-publisher-workflow-path",
+        "publication-runner-provenance-json",
+        "publication-target",
+        "publication-used-nonces-json",
         "publish-artifact-kind",
         "publish-command",
         "publish-dist-tag",
@@ -1186,17 +1284,16 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 44,
+      "inputCount": 55,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
         "BUILDCHAIN_ISSUE_TOKEN",
-        "BUILDCHAIN_PROMOTION_TOKEN",
         "buildchain-issue-app-id",
         "buildchain-issue-app-private-key",
         "buildchain-issue-token"
       ],
-      "secretCount": 7,
+      "secretCount": 6,
       "outputs": [
         "built-source-sha",
         "controller-plan-artifact",
@@ -1207,9 +1304,10 @@
         "controller-receipt-json",
         "controller-receipt-status",
         "promoted-sha",
+        "publication-capability-digest",
         "release-candidate-artifact"
       ],
-      "outputCount": 10,
+      "outputCount": 11,
       "surface": "release-governance",
       "capabilityGroup": "reusable-build",
       "status": "active"

package/docs/MAP.md

@@ -27,7 +27,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Capability group | Primary facts | Primary manuals |
 | --- | --- | --- |
 | Getting Started | `capability-registry.json`, `product-mechanism.json` | [`install.md`](install.md), [`product-mechanism.md`](product-mechanism.md), [`cli.md`](cli.md) |
-| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`release-candidate.md`](release-candidate.md), [`publish-transaction.md`](publish-transaction.md), [`binary-distribution.md`](binary-distribution.md) |
+| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`publish-transaction.md`](publish-transaction.md), [`binary-distribution.md`](binary-distribution.md) |
 | Reusable Build and Lifecycle | `workflow-registry.json`, `controller-registry.json`, `release-model.json` | [`reusable-build-surface.md`](reusable-build-surface.md), [`controller-evidence.md`](controller-evidence.md), [`shifu-gate-profiles.md`](shifu-gate-profiles.md), [`lifecycle-protocol.md`](lifecycle-protocol.md) |
 | KFD Trust and Surface Closure | `kfd-claims.json`, `public-surface-audit.json`, `cli-registry.json`, `node-api-registry.json` | [`kfd-support.md`](kfd-support.md), [`release-passport.md`](release-passport.md) |
 | Site Bundle, Web Surfaces, and Propagation | `buildchain-site.json`, `site-manifest.json`, `page-registry.json`, `release-model.json` | [`site-bundle-contract.md`](site-bundle-contract.md), [`web-surface-deployments.md`](web-surface-deployments.md), [`release-propagation.md`](release-propagation.md) |
@@ -81,6 +81,7 @@ replace them.
 | How does publish evidence, recovery, and finalization work? | [`publish-transaction.md`](publish-transaction.md) | verify | stable |
 | How do I collect and verify module/product build facts from Git source, version files, and outputs? | [`build-facts.md`](build-facts.md) + [`cli.md`](cli.md) | use/verify | stable |
 | How do I publish or verify release passport artifacts? | [`release-passport.md`](release-passport.md) | use | stable |
+| How is product publication authority sealed to an exact workflow, runner, control plane, nonce, and artifact? | [`publication-authority.md`](publication-authority.md) | verify | preview |
 | How do I gate release artifacts with KFD-1 contract-world witnesses? | [`release-passport.md`](release-passport.md#kfd-1-contract-world-release-gate) | verify/use | stable |
 | How do I declare, render, and audit product KFD-2 release trust claims? | [`kfd-support.md`](kfd-support.md#kfd-2) + [`release-passport.md`](release-passport.md#kfd-2-release-trust-passport-audit) + [`cli.md`](cli.md) | verify/use | stable |
 | How do I gate KFD-3 collaboration-interface releases? | [`release-passport.md`](release-passport.md#kfd-3-collaboration-interface-release-gate) + [`cli.md`](cli.md) | verify/use | stable |

package/docs/publication-artifacts.md

@@ -188,23 +188,25 @@ jobs:
       contents: write
       id-token: write
       issues: write
-    secrets:
-      BUILDCHAIN_PROMOTION_TOKEN: ${{ secrets.RELEASE_AUTHORITY_TOKEN }}
     with:
       buildchain-ref: ${{ inputs.buildchain-ref || '' }}
+      publication-admission-json: ${{ needs.authority.outputs.admission-json }}
+      publication-runner-provenance-json: ${{ needs.authority.outputs.runner-provenance-json }}
+      publication-control-plane-audit-json: ${{ needs.authority.outputs.control-plane-audit-json }}
+      publication-expected-json: ${{ needs.authority.outputs.expected-json }}
       toolchain-type: config
       verify-command: make check
       buildchain-contract-lock-path: .buildchain/contract-lock.json
 ```
 
-`RELEASE_AUTHORITY_TOKEN` is a caller-chosen release authority secret name.
-Map whichever repository or organization secret owns protected release
-bookkeeping into the reusable workflow's `BUILDCHAIN_PROMOTION_TOKEN` contract;
-the reusable workflow does not require that provider-side secret to use a
-specific name. Before it builds the paper, the workflow uses that authority to
-read the target channel's branch protection and fails with a configuration
-diagnostic if the protection is not readable. `github.token` remains a fallback
-for repositories where its permissions are sufficient.
+The publication job does not accept a long-lived promotion token. The caller
+must first produce a fresh sealed admission, runner provenance, external
+control-plane audit, and exact expected bindings. The credential-free verifier
+job checks those receipts; only then can the publication job use its short-lived
+`github.token` and caller-bound OIDC trusted publisher identity. npm binds that
+identity to the consumer workflow filename; an npm Environment restriction is
+optional and must be represented explicitly when configured. The workflow fails
+before the publication build when the target branch protection cannot be read.
 
 The preset:
 

package/docs/publication-authority.md

@@ -0,0 +1,204 @@
+---
+status: draft
+period: ongoing
+theme: sealed-publication-authority
+doc_type: protocol
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-07-14
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-07-14
+  limits: Live provider configuration must be re-audited; no credential values are represented.
+---
+
+# Sealed Publication Authority
+
+Buildchain publication authority is a closed-world, fail-closed protocol. It does
+not mint registry or cloud credentials. It independently verifies whether an
+already protected publication job is allowed to request a short-lived provider
+credential for one exact product, target, version, channel, and artifact digest.
+
+The machine-readable authority inventory is
+`dist/site/publication-authority-registry.json`. Any workflow with a write,
+environment, OIDC, cloud credential, registry publish, release, or Git push
+signal must have an explicit descriptor. A new authority-bearing workflow that
+is absent from the inventory fails site generation. Unknown workflows and every
+descriptor not marked `product-publication` are denied product publication.
+
+## Evidence chain
+
+A qualifying admission binds exact source and runtime SHAs; contract, consumer
+policy, qualifying controller receipt, Shifu/Gate aggregate, artifact, runner,
+and control-plane digests; repository, authority workflow, provider publisher
+workflow, Environment policy,
+product, target, version, and channel; plus a unique nonce and a lifetime of no
+more than 15 minutes. Every expected binding is mandatory at verification time;
+an omitted expected field is not a wildcard.
+
+The independent verifier recomputes every digest and ignores a producer's own
+allow/deny conclusion. It fetches the exact evidence run, validates the actual
+release-candidate passport and referenced qualifying controller receipt,
+recomputes the Shifu Gate aggregate or explicit consumer-owned no-Gate policy,
+recomputes the downloaded artifact manifests, and hashes every declared product
+payload file against those manifests. The `.buildchain/` diagnostics envelope is
+bound by the manifest digest but excluded from the product-byte set because it can
+be finalized after the lifecycle scan. The verifier also compares the PR evidence tree to the
+admitted post-merge source commit tree. It rejects an unknown
+workflow, stale or replayed nonce, runner downgrade, control-plane drift,
+source/runtime mismatch, and artifact substitution. A successful result is a
+scoped capability receipt, not a bearer credential.
+
+## Runner and control-plane evidence
+
+Runner evidence uses exactly four classes: `ephemeral`, `reimaged`,
+`persistent-measured`, and `unqualified`. Ephemeral runners also record their
+job-isolation boundary. Reimaged and persistent runners qualify only when a
+clean baseline is proven and baseline, toolchain, cache-contract, and task-
+isolation digests are all present. Otherwise they still emit diagnostic
+evidence with `qualificationStatus = unqualified`, but cannot receive a product
+capability.
+
+The external audit records digests and pass/fail status for repository Actions
+defaults, classic branch protection or an active matching repository ruleset,
+declared protected Environment policy or an explicit no-Environment binding,
+job-scoped credentials,
+absence of long-lived workflow publication credentials, provider authority,
+and authorized runner class. Provider modes are `npm-trusted-publisher`,
+`github-token`, and `oidc-role`. The OIDC-role mode consumes only a sanitized
+provider audit containing a role digest and qualifying decision; raw IAM policy,
+tokens, or credentials are rejected. Package-owner, cloud-root, GitHub
+administrator, and registry-root credentials remain outside Buildchain's trust
+boundary. Missing or unreadable facts fail closed.
+
+An unauthenticated local npm CLI is not evidence that Trusted Publishing is
+missing. `npm whoami` reports only the local CLI session and does not report the
+OIDC identity that npm creates during `npm publish`. The default read-only audit
+therefore binds the exact provider, repository, caller workflow, optional
+Environment, job-scoped OIDC permission, and absence of long-lived credentials,
+then records `provider-at-transaction`: npm makes the final authorization
+decision when `npm publish` exchanges the job's OIDC token. A missing or drifted
+trusted-publisher configuration consequently denies the transaction safely; it
+is not preflighted through an unrelated long-lived npm login.
+
+An authenticated external auditor can add stronger point-in-time evidence by
+supplying sanitized `npm trust list --json` output with `--npm-trust-json`. This
+changes the publisher fact to `audited-control-plane`; the workflow never runs
+`npm trust list` itself and never receives that auditor's npm credential.
+
+The credential-free collector proves effective Actions and runner scope from
+the publication workflow fetched at `--workflow-ref`: explicit read-only
+workflow defaults, job-scoped write/OIDC permissions, and an exact GitHub-hosted
+runner label. It does not call repository Actions-default or self-hosted-runner
+administration endpoints. Branch/ruleset and OIDC subject facts remain live
+read-only provider queries. When the detailed branch-protection endpoint is not
+readable with the workflow token, `--source-sha` binds the provider's public
+protected-branch summary to the exact merged PR, independent approval, required
+successful check, same-repository lineage, and current branch head. This records
+provider-enforced transaction evidence without treating an unavailable
+administration endpoint as an unprotected branch. It avoids turning a
+repository-admin token into a publication prerequisite.
+
+For non-dry-run workflows, missing admission, runner, control-plane, Gate, or
+expected-binding evidence is rejected before Buildchain downloads candidate
+artifacts. The denial explicitly records that npm Trusted Publishing and OIDC
+were not evaluated, so downstream diagnostics cannot misclassify an admission
+assembly failure as an npm authentication failure.
+
+Buildchain's own `workflow_run` promotion lane may assemble those inputs only
+for `kungfu-systems/buildchain`. It downloads the exact prior RC passport,
+summary, referenced controller receipt, manifests, and product payloads; proves
+the admitted channel commit has the same Git tree as the RC; performs the live
+read-only control-plane audit; records the GitHub-hosted job as ephemeral runner
+provenance; and creates an explicit Buildchain-owned no-Gate decision. The
+independent verifier then recomputes every receipt and payload digest exactly as
+it does for externally supplied admission. The self-assembly mode rejects other
+repositories, unknown refs, non-exact source SHAs, and any caller other than
+`.github/workflows/buildchain-ref-promotion.yml`. Manual apply and external
+consumer workflows still require their own explicit admission inputs.
+
+Evidence publication is a separate authority class and never grants product
+publication.
+
+## API and CLI
+
+Use `@kungfu-tech/buildchain/publication-authority` or run:
+
+```bash
+buildchain verify publication-admission admission.json \
+  --registry-json publication-authority-registry.json \
+  --runner-json runner.json \
+  --control-plane-audit-json control-plane.json \
+  --publication-evidence-json publication-evidence.json \
+  --expected-json expected.json \
+  --used-nonce previous-run-nonce \
+  --json
+```
+
+The read-only live collector defaults to npm trusted publishing. Other product
+providers select an explicit adapter:
+
+```bash
+buildchain audit publication-control-plane \
+  --repository kungfu-systems/buildchain \
+  --branch dev/v2/v2.12 \
+  --source-sha <exact-merged-branch-sha> \
+  --workflow .github/workflows/release-candidate-promote.yml \
+  --workflow-ref <exact-buildchain-sha> \
+  --publisher-workflow .github/workflows/buildchain-ref-promotion.yml \
+  --job promote \
+  --environment none
+
+# Optional stronger external evidence; generate the JSON outside the workflow.
+buildchain audit publication-control-plane \
+  --repository kungfu-systems/buildchain \
+  --branch dev/v2/v2.12 \
+  --workflow .github/workflows/release-candidate-promote.yml \
+  --publisher-workflow .github/workflows/buildchain-ref-promotion.yml \
+  --job promote \
+  --environment none \
+  --npm-trust-json sanitized-npm-trust.json
+
+buildchain audit publication-control-plane \
+  --repository kungfu-systems/buildchain \
+  --branch release/v2/v2.12 \
+  --workflow .github/workflows/.binary-release-assets.yml \
+  --job publish \
+  --environment buildchain-release-assets \
+  --publisher-mode github-token
+
+buildchain audit publication-control-plane \
+  --repository OWNER/CONSUMER \
+  --workflow-repository kungfu-systems/buildchain \
+  --branch main \
+  --workflow .github/workflows/.web-surface.yml \
+  --job production-apply \
+  --environment production \
+  --publisher-mode oidc-role \
+  --provider-audit-json sanitized-oidc-role-audit.json
+```
+
+The authority workflow identifies the reusable implementation that performs the
+publication job. The publisher workflow identifies the caller filename bound by
+the provider's trusted-publisher policy; these identities are deliberately
+separate. `--environment none` is an explicit assertion that the job declares no
+GitHub Environment and the provider policy has no Environment restriction. A
+named Environment must exist, be protected, and be declared by the job. The
+Buildchain receipt alone is never sufficient authorization.
+
+## Publication lanes
+
+`Binary Distribution` is evidence-only. It builds platform archives and a
+release evidence bundle with read-only repository permissions. GitHub Release
+asset writes live in `Binary Release Assets`, which downloads an exact prior
+evidence run, verifies its bundle digest against the sealed capability, and is
+the only binary job with `contents: write` in the protected
+`buildchain-release-assets` Environment.
+
+The npm/promotion, paper, binary-release, and web-production lanes all depend on
+the independent verifier. Preview, staging, build, source-check, controller,
+and failure-evidence lanes do not inherit product publication capability.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.6",
+  "version": "2.12.7-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -29,6 +29,9 @@
     "./logging": "./packages/core/logging.js",
     "./publication-artifact": "./packages/core/publication-artifact.js",
     "./publication-package": "./packages/core/publication-package.js",
+    "./publication-authority": "./packages/core/publication-authority.js",
+    "./publication-control-plane-audit": "./packages/core/publication-control-plane-audit.js",
+    "./buildchain-publication-authority": "./packages/core/buildchain-publication-authority.js",
     "./kfd-gate": "./packages/core/kfd-gate.js",
     "./release-candidate": "./packages/core/release-candidate.js",
     "./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",
@@ -47,6 +50,7 @@
     "./site/kfd-claims.json": "./dist/site/kfd-claims.json",
     "./site/workflow-registry.json": "./dist/site/workflow-registry.json",
     "./site/controller-registry.json": "./dist/site/controller-registry.json",
+    "./site/publication-authority-registry.json": "./dist/site/publication-authority-registry.json",
     "./site/public-surface-audit.json": "./dist/site/public-surface-audit.json",
     "./site/kfd-upstream-aggregate.json": "./dist/site/kfd-upstream-aggregate.json",
     "./site/release-model.json": "./dist/site/release-model.json",

package/packages/core/buildchain-kfd-claims.js

@@ -16,6 +16,7 @@ export const BUILDCHAIN_AGENT_MANUALS = Object.freeze([
   { id: "install", title: "Install and verify Buildchain", path: "docs/install.md", plane: "use" },
   { id: "release-passport", title: "Release Passport protocol", path: "docs/release-passport.md", plane: "verify" },
   { id: "controller-evidence", title: "Controller evidence contract", path: "docs/controller-evidence.md", plane: "verify" },
+  { id: "publication-authority", title: "Sealed publication authority", path: "docs/publication-authority.md", plane: "verify" },
   { id: "release-candidate", title: "Release Candidate Passport", path: "docs/release-candidate.md", plane: "verify" },
   { id: "release-propagation", title: "Release propagation", path: "docs/release-propagation.md", plane: "use" },
   { id: "readme-badges", title: "README badge blocks", path: "docs/readme-badges.md", plane: "use" },
@@ -52,6 +53,7 @@ const SITE_CONTRACT_FILES = Object.freeze([
   "dist/site/node-api-registry.json",
   "dist/site/workflow-registry.json",
   "dist/site/controller-registry.json",
+  "dist/site/publication-authority-registry.json",
   "dist/site/public-surface-audit.json",
   "dist/site/release-model.json",
   "dist/site/artifact-schemas.json",
@@ -68,6 +70,9 @@ const SCHEMA_AND_STANDARD_FILES = Object.freeze([
   "packages/core/release-passport.js",
   "packages/core/buildchain-contract.js",
   "packages/core/controller-evidence.js",
+  "packages/core/publication-authority.js",
+  "packages/core/publication-control-plane-audit.js",
+  "packages/core/buildchain-publication-authority.js",
   "packages/core/buildchain-kfd-claims.js",
   "packages/core/kfd3-surface-register.js",
   "packages/core/public-surface-audit.js",