@kungfu-tech/buildchain 2.12.6 → 2.12.7-alpha.10

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-14T04:26:37.000Z",
-  "publishedAt": "2026-07-14T04:26:37.000Z",
+  "generatedAt": "2026-07-15T02:23:03.502Z",
+  "publishedAt": "2026-07-15T02:23:03.502Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "cbc30aab42b6ef7a32f8ab87b9e5674ce676f5c3",
+  "sourceRevision": "5f17ef81ba524233331ffcd0c15b1fb800b3fa82",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.6",
+    "version": "2.12.7-alpha.10",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -26,6 +26,9 @@
       "./logging": "./packages/core/logging.js",
       "./publication-artifact": "./packages/core/publication-artifact.js",
       "./publication-package": "./packages/core/publication-package.js",
+      "./publication-authority": "./packages/core/publication-authority.js",
+      "./publication-control-plane-audit": "./packages/core/publication-control-plane-audit.js",
+      "./buildchain-publication-authority": "./packages/core/buildchain-publication-authority.js",
       "./kfd-gate": "./packages/core/kfd-gate.js",
       "./release-candidate": "./packages/core/release-candidate.js",
       "./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",
@@ -44,6 +47,7 @@
       "./site/kfd-claims.json": "./dist/site/kfd-claims.json",
       "./site/workflow-registry.json": "./dist/site/workflow-registry.json",
       "./site/controller-registry.json": "./dist/site/controller-registry.json",
+      "./site/publication-authority-registry.json": "./dist/site/publication-authority-registry.json",
       "./site/public-surface-audit.json": "./dist/site/public-surface-audit.json",
       "./site/kfd-upstream-aggregate.json": "./dist/site/kfd-upstream-aggregate.json",
       "./site/release-model.json": "./dist/site/release-model.json",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-14T04:26:37.000Z",
-  "publishedAt": "2026-07-14T04:26:37.000Z",
+  "generatedAt": "2026-07-15T02:23:03.502Z",
+  "publishedAt": "2026-07-15T02:23:03.502Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "cbc30aab42b6ef7a32f8ab87b9e5674ce676f5c3",
+  "sourceRevision": "5f17ef81ba524233331ffcd0c15b1fb800b3fa82",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.6",
+    "version": "2.12.7-alpha.10",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:223c7e2d20680d4a10c84f6a7c7875602538607217e9dfe291a356bbd21ac4f1"
+      "digest": "sha256:91dc800bafc31bc149680c86272827936c94e0f025d547bbabc10d58fe5f128e"
     },
     {
       "id": "install",
@@ -79,6 +79,14 @@
       "exists": true,
       "digest": "sha256:442e1b72e3977af56a8ae5e081ffd89c2f3ebcd9cfd50f07af730344bdf9fb0e"
     },
+    {
+      "id": "publication-authority",
+      "title": "Sealed publication authority",
+      "path": "docs/publication-authority.md",
+      "plane": "verify",
+      "exists": true,
+      "digest": "sha256:06ba05f9d8a2685a0896334b6013a97c45b7d71163cf6898e5a6274baf7f0296"
+    },
     {
       "id": "release-candidate",
       "title": "Release Candidate Passport",
@@ -229,7 +237,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:beba38634bfdde032bb2ff85dc98dd8d755f942dabe227bf9b7aba8127ab7ce9"
+      "digest": "sha256:cce9f80add3c746fe28d8ebf5afb809348694741cb75d19154ed3057a9374c0d"
     },
     {
       "id": "release-flow",
@@ -272,6 +280,7 @@
     "node-api-registry.json",
     "workflow-registry.json",
     "controller-registry.json",
+    "publication-authority-registry.json",
     "public-surface-audit.json",
     "release-model.json",
     "artifact-schemas.json",

package/dist/site/workflow-registry.json

@@ -3,6 +3,30 @@
   "contract": "kungfu-buildchain-workflow-registry",
   "workflowSource": ".github/workflows reverse input enumeration",
   "workflows": [
+    {
+      "id": ".binary-release-assets",
+      "path": ".github/workflows/.binary-release-assets.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "buildchain-repository",
+        "evidence-run-id",
+        "publication-admission-json",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-runner-provenance-json",
+        "publication-used-nonces-json",
+        "release-tag"
+      ],
+      "inputCount": 9,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": ".build",
       "path": ".github/workflows/.build.yml",
@@ -185,6 +209,53 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": ".publication-authority",
+      "path": ".github/workflows/.publication-authority.yml",
+      "reusable": true,
+      "inputs": [
+        "admission-json",
+        "authority-workflow-path",
+        "auto-admission",
+        "auto-admission-kind",
+        "buildchain-ref",
+        "buildchain-repository",
+        "control-plane-audit-json",
+        "dry-run",
+        "evidence-controller-artifact",
+        "evidence-manifest-pattern",
+        "evidence-passport-artifact",
+        "evidence-payload-pattern",
+        "evidence-publication-artifact",
+        "evidence-repository",
+        "evidence-run-id",
+        "evidence-summary-artifact",
+        "expected-json",
+        "gate-aggregate-json",
+        "package-name",
+        "product",
+        "publication-target",
+        "publication-version",
+        "publisher-workflow-path",
+        "required-status-check",
+        "runner-provenance-json",
+        "source-sha",
+        "target-ref",
+        "used-nonces-json"
+      ],
+      "inputCount": 28,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "capability-artifact",
+        "capability-digest",
+        "capability-json"
+      ],
+      "outputCount": 3,
+      "surface": "reusable-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": ".release-docker",
       "path": ".github/workflows/.release-docker.yml",
@@ -474,6 +545,11 @@
         "production-release-on-main",
         "production-release-pr-mode",
         "production-release-pr-token",
+        "publication-admission-json",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-runner-provenance-json",
+        "publication-used-nonces-json",
         "release-feedback-actor-privacy",
         "staging-apply",
         "staging-aws-role-arn",
@@ -481,7 +557,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 33,
+      "inputCount": 38,
       "secrets": [
         "production-release-app-private-key"
       ],
@@ -575,6 +651,20 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": "binary-release-assets",
+      "path": ".github/workflows/binary-release-assets.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": "build-surface-fixture",
       "path": ".github/workflows/build-surface-fixture.yml",
@@ -940,6 +1030,52 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": "paper-release-sealed",
+      "path": ".github/workflows/paper-release-sealed.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-name",
+        "artifact-paths",
+        "artifact-retention-days",
+        "branch-protection-bypass-apps",
+        "branch-protection-bypass-teams",
+        "branch-protection-bypass-users",
+        "buildchain-contract-lock-path",
+        "buildchain-ref",
+        "buildchain-repository",
+        "dry-run",
+        "github-release",
+        "github-release-notes",
+        "github-release-title",
+        "package-name",
+        "publish-dist-tag",
+        "publisher-workflow-path",
+        "release-passport-impact-json",
+        "release-passport-output-dir",
+        "release-passport-product-name",
+        "required-status-check",
+        "target-ref",
+        "target-sha",
+        "toolchain-type",
+        "verify-command",
+        "working-directory"
+      ],
+      "inputCount": 25,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "github-release-url",
+        "package-name",
+        "package-version",
+        "public-release-tag",
+        "release-passport-path"
+      ],
+      "outputCount": 5,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": "paper-release",
       "path": ".github/workflows/paper-release.yml",
@@ -962,6 +1098,11 @@
         "github-release-title",
         "node-version",
         "package-name",
+        "publication-admission-json",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-runner-provenance-json",
+        "publication-used-nonces-json",
         "publish-dist-tag",
         "publish-package-set-order",
         "release-passport-impact-json",
@@ -978,11 +1119,9 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 32,
-      "secrets": [
-        "BUILDCHAIN_PROMOTION_TOKEN"
-      ],
-      "secretCount": 1,
+      "inputCount": 37,
+      "secrets": [],
+      "secretCount": 0,
       "outputs": [
         "controller-plan-artifact",
         "controller-plan-digest",
@@ -1106,7 +1245,11 @@
         "buildchain-ref",
         "buildchain-repository",
         "node-version",
+        "package-name",
+        "prepare-paper-package",
+        "publish-dist-tag",
         "setup-node",
+        "target-ref",
         "toolchain-command",
         "toolchain-digest",
         "toolchain-image",
@@ -1114,7 +1257,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 17,
+      "inputCount": 21,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1125,13 +1268,17 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
+        "package-name",
+        "package-version",
         "publication-artifact-name",
         "publication-manifest-json",
         "publication-manifest-path",
         "publication-passport-path",
-        "publication-registry-path"
+        "publication-registry-path",
+        "publish-dist-tag",
+        "runtime-sha"
       ],
-      "outputCount": 12,
+      "outputCount": 16,
       "surface": "repository-workflow",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -1158,6 +1305,17 @@
         "github-release-notes",
         "github-release-title",
         "package-manager",
+        "publication-admission-json",
+        "publication-auto-admission",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-gate-aggregate-json",
+        "publication-package-name",
+        "publication-product",
+        "publication-publisher-workflow-path",
+        "publication-runner-provenance-json",
+        "publication-target",
+        "publication-used-nonces-json",
         "publish-artifact-kind",
         "publish-command",
         "publish-dist-tag",
@@ -1186,7 +1344,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 44,
+      "inputCount": 55,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1207,9 +1365,10 @@
         "controller-receipt-json",
         "controller-receipt-status",
         "promoted-sha",
+        "publication-capability-digest",
         "release-candidate-artifact"
       ],
-      "outputCount": 10,
+      "outputCount": 11,
       "surface": "release-governance",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -1388,9 +1547,11 @@
         "branch-protection-bypass-teams",
         "branch-protection-bypass-users",
         "dry-run",
+        "expected-publication-version",
         "generated-ref-update-token",
         "generated-status-check-token",
         "github-release",
+        "github-release-artifact-paths",
         "github-release-notes",
         "github-release-title",
         "promote-only-release-candidate",
@@ -1436,7 +1597,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 52,
+      "inputCount": 54,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/MAP.md

@@ -27,7 +27,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Capability group | Primary facts | Primary manuals |
 | --- | --- | --- |
 | Getting Started | `capability-registry.json`, `product-mechanism.json` | [`install.md`](install.md), [`product-mechanism.md`](product-mechanism.md), [`cli.md`](cli.md) |
-| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`release-candidate.md`](release-candidate.md), [`publish-transaction.md`](publish-transaction.md), [`binary-distribution.md`](binary-distribution.md) |
+| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`publish-transaction.md`](publish-transaction.md), [`binary-distribution.md`](binary-distribution.md) |
 | Reusable Build and Lifecycle | `workflow-registry.json`, `controller-registry.json`, `release-model.json` | [`reusable-build-surface.md`](reusable-build-surface.md), [`controller-evidence.md`](controller-evidence.md), [`shifu-gate-profiles.md`](shifu-gate-profiles.md), [`lifecycle-protocol.md`](lifecycle-protocol.md) |
 | KFD Trust and Surface Closure | `kfd-claims.json`, `public-surface-audit.json`, `cli-registry.json`, `node-api-registry.json` | [`kfd-support.md`](kfd-support.md), [`release-passport.md`](release-passport.md) |
 | Site Bundle, Web Surfaces, and Propagation | `buildchain-site.json`, `site-manifest.json`, `page-registry.json`, `release-model.json` | [`site-bundle-contract.md`](site-bundle-contract.md), [`web-surface-deployments.md`](web-surface-deployments.md), [`release-propagation.md`](release-propagation.md) |
@@ -81,6 +81,7 @@ replace them.
 | How does publish evidence, recovery, and finalization work? | [`publish-transaction.md`](publish-transaction.md) | verify | stable |
 | How do I collect and verify module/product build facts from Git source, version files, and outputs? | [`build-facts.md`](build-facts.md) + [`cli.md`](cli.md) | use/verify | stable |
 | How do I publish or verify release passport artifacts? | [`release-passport.md`](release-passport.md) | use | stable |
+| How is product publication authority sealed to an exact workflow, runner, control plane, nonce, and artifact? | [`publication-authority.md`](publication-authority.md) | verify | preview |
 | How do I gate release artifacts with KFD-1 contract-world witnesses? | [`release-passport.md`](release-passport.md#kfd-1-contract-world-release-gate) | verify/use | stable |
 | How do I declare, render, and audit product KFD-2 release trust claims? | [`kfd-support.md`](kfd-support.md#kfd-2) + [`release-passport.md`](release-passport.md#kfd-2-release-trust-passport-audit) + [`cli.md`](cli.md) | verify/use | stable |
 | How do I gate KFD-3 collaboration-interface releases? | [`release-passport.md`](release-passport.md#kfd-3-collaboration-interface-release-gate) + [`cli.md`](cli.md) | verify/use | stable |

package/docs/publication-artifacts.md

@@ -182,38 +182,37 @@ on:
 
 jobs:
   paper-release:
-    uses: kungfu-systems/buildchain/.github/workflows/paper-release.yml@v2
+    uses: kungfu-systems/buildchain/.github/workflows/paper-release-sealed.yml@v2
     permissions:
+      actions: read
       checks: write
       contents: write
       id-token: write
       issues: write
-    secrets:
-      BUILDCHAIN_PROMOTION_TOKEN: ${{ secrets.RELEASE_AUTHORITY_TOKEN }}
     with:
       buildchain-ref: ${{ inputs.buildchain-ref || '' }}
+      publisher-workflow-path: .github/workflows/paper-release.yml
       toolchain-type: config
       verify-command: make check
+      artifact-paths: _build/paper-name.pdf
       buildchain-contract-lock-path: .buildchain/contract-lock.json
 ```
 
-`RELEASE_AUTHORITY_TOKEN` is a caller-chosen release authority secret name.
-Map whichever repository or organization secret owns protected release
-bookkeeping into the reusable workflow's `BUILDCHAIN_PROMOTION_TOKEN` contract;
-the reusable workflow does not require that provider-side secret to use a
-specific name. Before it builds the paper, the workflow uses that authority to
-read the target channel's branch protection and fails with a configuration
-diagnostic if the protection is not readable. `github.token` remains a fallback
-for repositories where its permissions are sufficient.
+The sealed preset does not accept a long-lived promotion token. It builds and
+packages the paper in a read-only job, then a credential-free authority job
+downloads that exact candidate, audits the external control plane, and seals a
+capability over the source tree, Buildchain runtime, controller receipt, PDF,
+and npm package bytes. Only the final job receives write and OIDC permissions;
+it downloads the admitted candidate, recomputes the capability binding, and
+publishes without executing consumer build commands. npm binds the OIDC identity
+to the consumer workflow named by `publisher-workflow-path`.
 
 The preset:
 
-- resolves the same floating Buildchain runtime and contract lock as the build
-  workflow;
-- verifies that the declared promotion authority can read the protected target
-  channel before starting the publication build;
+- resolves the floating Buildchain runtime once and binds the exact SHA into the
+  publication candidate and authority capability;
 - builds the PDF through the declared pinned LaTeX Docker toolchain or custom
-  command;
+  command in a read-only job;
 - verifies the paper repository;
 - writes the publication manifest, publication passport, optional archive
   registry, and source bundle;
@@ -224,14 +223,22 @@ The preset:
 - creates a `publish-gate/<alpha|release>/.../<version>` source lock for the
   channel commit and requires `promote-buildchain-ref` to verify that lock
   before any publish side effect;
-- publishes the package through npm Trusted Publishing;
+- verifies the complete candidate again after authority and publishes the
+  package through npm Trusted Publishing without rebuilding it;
 - writes Buildchain release/passport evidence; and
-- creates or updates the exact-version GitHub Release by default.
+- creates or updates the exact-version GitHub Release by default, uploading
+  every file declared by `publication.primary_artifact` and
+  `publication.artifact_paths` alongside the release evidence.
 
 Consumers can opt out of the GitHub Release with `github-release: false`, but
 the default is on so downstream release propagation can observe
 `release.published` without hand-written `gh release` steps.
 
+Declared publication artifacts are resolved from the generated publication
+manifest rather than repeated in consumer workflow YAML. Publication fails
+before upload if a declared artifact is missing or if its basename would
+collide with another GitHub Release asset.
+
 For npm Trusted Publishing, register the consumer workflow file that calls this
 preset, for example `.github/workflows/paper-release.yml`, against the declared
 package in npm. The trusted publisher is the consumer repository and workflow