@kungfu-tech/buildchain 2.12.7-alpha.1 → 2.12.7-alpha.10

package/dist/site/public-surface-audit.json

@@ -4,7 +4,7 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 79,
-    "workflowCount": 46,
+    "workflowCount": 47,
     "actionCount": 4,
     "sitePageCount": 49,
     "docCommandRefCount": 246,
@@ -609,14 +609,18 @@
         "reusable": true,
         "inputs": [
           "admission-json",
+          "authority-workflow-path",
           "auto-admission",
+          "auto-admission-kind",
           "buildchain-ref",
           "buildchain-repository",
           "control-plane-audit-json",
           "dry-run",
+          "evidence-controller-artifact",
           "evidence-manifest-pattern",
           "evidence-passport-artifact",
           "evidence-payload-pattern",
+          "evidence-publication-artifact",
           "evidence-repository",
           "evidence-run-id",
           "evidence-summary-artifact",
@@ -625,13 +629,15 @@
           "package-name",
           "product",
           "publication-target",
+          "publication-version",
           "publisher-workflow-path",
+          "required-status-check",
           "runner-provenance-json",
           "source-sha",
           "target-ref",
           "used-nonces-json"
         ],
-        "inputCount": 22,
+        "inputCount": 28,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
@@ -1334,6 +1340,49 @@
         "outputs": [],
         "outputCount": 0
       },
+      {
+        "id": "paper-release-sealed",
+        "path": ".github/workflows/paper-release-sealed.yml",
+        "reusable": true,
+        "inputs": [
+          "artifact-name",
+          "artifact-paths",
+          "artifact-retention-days",
+          "branch-protection-bypass-apps",
+          "branch-protection-bypass-teams",
+          "branch-protection-bypass-users",
+          "buildchain-contract-lock-path",
+          "buildchain-ref",
+          "buildchain-repository",
+          "dry-run",
+          "github-release",
+          "github-release-notes",
+          "github-release-title",
+          "package-name",
+          "publish-dist-tag",
+          "publisher-workflow-path",
+          "release-passport-impact-json",
+          "release-passport-output-dir",
+          "release-passport-product-name",
+          "required-status-check",
+          "target-ref",
+          "target-sha",
+          "toolchain-type",
+          "verify-command",
+          "working-directory"
+        ],
+        "inputCount": 25,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "github-release-url",
+          "package-name",
+          "package-version",
+          "public-release-tag",
+          "release-passport-path"
+        ],
+        "outputCount": 5
+      },
       {
         "id": "paper-release",
         "path": ".github/workflows/paper-release.yml",
@@ -1491,7 +1540,11 @@
           "buildchain-ref",
           "buildchain-repository",
           "node-version",
+          "package-name",
+          "prepare-paper-package",
+          "publish-dist-tag",
           "setup-node",
+          "target-ref",
           "toolchain-command",
           "toolchain-digest",
           "toolchain-image",
@@ -1499,7 +1552,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 17,
+        "inputCount": 21,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
@@ -1510,13 +1563,17 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
+          "package-name",
+          "package-version",
           "publication-artifact-name",
           "publication-manifest-json",
           "publication-manifest-path",
           "publication-passport-path",
-          "publication-registry-path"
+          "publication-registry-path",
+          "publish-dist-tag",
+          "runtime-sha"
         ],
-        "outputCount": 12
+        "outputCount": 16
       },
       {
         "id": "release-candidate-promote",
@@ -1584,11 +1641,12 @@
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
           "BUILDCHAIN_ISSUE_TOKEN",
+          "BUILDCHAIN_PROMOTION_TOKEN",
           "buildchain-issue-app-id",
           "buildchain-issue-app-private-key",
           "buildchain-issue-token"
         ],
-        "secretCount": 6,
+        "secretCount": 7,
         "outputs": [
           "built-source-sha",
           "controller-plan-artifact",
@@ -1753,9 +1811,11 @@
           "branch-protection-bypass-teams",
           "branch-protection-bypass-users",
           "dry-run",
+          "expected-publication-version",
           "generated-ref-update-token",
           "generated-status-check-token",
           "github-release",
+          "github-release-artifact-paths",
           "github-release-notes",
           "github-release-title",
           "promote-only-release-candidate",
@@ -1801,7 +1861,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 52
+        "inputCount": 54
       },
       {
         "id": "report-buildchain-issue",
@@ -3327,8 +3387,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "a6daf4822365bf576425777230246046ebca67b3f8dcfea61fc7a61773776185",
-    "workflowRegistryDigest": "c71378eba66d2e03b5c90ed3e5b20a3e68f279b503062ffbf9fdfabe341adcae",
-    "pageRegistryDigest": "289cfbb5251f8dcba1ab683da86a434af31de2a791e7cd453e16d1c86b5069be"
+    "workflowRegistryDigest": "a61b85b07185e02e340c27d50f77a6710968db87dd42d1b1f4dd81260779a0ed",
+    "pageRegistryDigest": "3a4779e3d85d0a175e33c7d2a8bee30ede3931cc721a7d8c422ab321f0dec723"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -306,6 +306,22 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/paper-release-sealed.yml",
+      "authorityClass": "product-publication",
+      "publicationCapable": true,
+      "capabilityIds": [
+        "github-release",
+        "npm-publish"
+      ],
+      "credentialMode": "trusted-publishing",
+      "publisherWorkflowMode": "caller-bound",
+      "publisherWorkflowPath": ".github/workflows/paper-release-sealed.yml",
+      "environment": "none",
+      "environmentMode": "fixed",
+      "runnerPolicy": "qualified-measured",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/paper-release.yml",
       "authorityClass": "product-publication",
@@ -655,6 +671,14 @@
       ],
       "classified": true
     },
+    {
+      "path": ".github/workflows/paper-release-sealed.yml",
+      "signals": [
+        "write-permission",
+        "oidc"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/paper-release.yml",
       "signals": [
@@ -750,5 +774,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "a606a7da7188a8eee970d63b15f859b99024c246fb698d74e04fd548d2552c55"
+  "registryDigest": "760215fb39e6c85890c925e924c538a766d78abd6319794c8799fb47c23dec3d"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-14T16:13:01.149Z",
-  "publishedAt": "2026-07-14T16:13:01.149Z",
+  "generatedAt": "2026-07-15T02:23:03.502Z",
+  "publishedAt": "2026-07-15T02:23:03.502Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "3412ff280be0e1160a0e33b11b461adde02b57e4",
+  "sourceRevision": "5f17ef81ba524233331ffcd0c15b1fb800b3fa82",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.1",
+    "version": "2.12.7-alpha.10",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-14T16:13:01.149Z",
-  "publishedAt": "2026-07-14T16:13:01.149Z",
+  "generatedAt": "2026-07-15T02:23:03.502Z",
+  "publishedAt": "2026-07-15T02:23:03.502Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "3412ff280be0e1160a0e33b11b461adde02b57e4",
+  "sourceRevision": "5f17ef81ba524233331ffcd0c15b1fb800b3fa82",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.1",
+    "version": "2.12.7-alpha.10",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -85,7 +85,7 @@
       "path": "docs/publication-authority.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:fc08e6657a1b586b6b8b5618ca4f49dfaa85955687f5bba8e2e69e7513fe6c71"
+      "digest": "sha256:06ba05f9d8a2685a0896334b6013a97c45b7d71163cf6898e5a6274baf7f0296"
     },
     {
       "id": "release-candidate",
@@ -237,7 +237,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:beba38634bfdde032bb2ff85dc98dd8d755f942dabe227bf9b7aba8127ab7ce9"
+      "digest": "sha256:cce9f80add3c746fe28d8ebf5afb809348694741cb75d19154ed3057a9374c0d"
     },
     {
       "id": "release-flow",

package/dist/site/workflow-registry.json

@@ -215,14 +215,18 @@
       "reusable": true,
       "inputs": [
         "admission-json",
+        "authority-workflow-path",
         "auto-admission",
+        "auto-admission-kind",
         "buildchain-ref",
         "buildchain-repository",
         "control-plane-audit-json",
         "dry-run",
+        "evidence-controller-artifact",
         "evidence-manifest-pattern",
         "evidence-passport-artifact",
         "evidence-payload-pattern",
+        "evidence-publication-artifact",
         "evidence-repository",
         "evidence-run-id",
         "evidence-summary-artifact",
@@ -231,13 +235,15 @@
         "package-name",
         "product",
         "publication-target",
+        "publication-version",
         "publisher-workflow-path",
+        "required-status-check",
         "runner-provenance-json",
         "source-sha",
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 22,
+      "inputCount": 28,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1024,6 +1030,52 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": "paper-release-sealed",
+      "path": ".github/workflows/paper-release-sealed.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-name",
+        "artifact-paths",
+        "artifact-retention-days",
+        "branch-protection-bypass-apps",
+        "branch-protection-bypass-teams",
+        "branch-protection-bypass-users",
+        "buildchain-contract-lock-path",
+        "buildchain-ref",
+        "buildchain-repository",
+        "dry-run",
+        "github-release",
+        "github-release-notes",
+        "github-release-title",
+        "package-name",
+        "publish-dist-tag",
+        "publisher-workflow-path",
+        "release-passport-impact-json",
+        "release-passport-output-dir",
+        "release-passport-product-name",
+        "required-status-check",
+        "target-ref",
+        "target-sha",
+        "toolchain-type",
+        "verify-command",
+        "working-directory"
+      ],
+      "inputCount": 25,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "github-release-url",
+        "package-name",
+        "package-version",
+        "public-release-tag",
+        "release-passport-path"
+      ],
+      "outputCount": 5,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": "paper-release",
       "path": ".github/workflows/paper-release.yml",
@@ -1193,7 +1245,11 @@
         "buildchain-ref",
         "buildchain-repository",
         "node-version",
+        "package-name",
+        "prepare-paper-package",
+        "publish-dist-tag",
         "setup-node",
+        "target-ref",
         "toolchain-command",
         "toolchain-digest",
         "toolchain-image",
@@ -1201,7 +1257,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 17,
+      "inputCount": 21,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1212,13 +1268,17 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
+        "package-name",
+        "package-version",
         "publication-artifact-name",
         "publication-manifest-json",
         "publication-manifest-path",
         "publication-passport-path",
-        "publication-registry-path"
+        "publication-registry-path",
+        "publish-dist-tag",
+        "runtime-sha"
       ],
-      "outputCount": 12,
+      "outputCount": 16,
       "surface": "repository-workflow",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -1289,11 +1349,12 @@
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
         "BUILDCHAIN_ISSUE_TOKEN",
+        "BUILDCHAIN_PROMOTION_TOKEN",
         "buildchain-issue-app-id",
         "buildchain-issue-app-private-key",
         "buildchain-issue-token"
       ],
-      "secretCount": 6,
+      "secretCount": 7,
       "outputs": [
         "built-source-sha",
         "controller-plan-artifact",
@@ -1486,9 +1547,11 @@
         "branch-protection-bypass-teams",
         "branch-protection-bypass-users",
         "dry-run",
+        "expected-publication-version",
         "generated-ref-update-token",
         "generated-status-check-token",
         "github-release",
+        "github-release-artifact-paths",
         "github-release-notes",
         "github-release-title",
         "promote-only-release-candidate",
@@ -1534,7 +1597,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 52,
+      "inputCount": 54,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/publication-artifacts.md

@@ -182,40 +182,37 @@ on:
 
 jobs:
   paper-release:
-    uses: kungfu-systems/buildchain/.github/workflows/paper-release.yml@v2
+    uses: kungfu-systems/buildchain/.github/workflows/paper-release-sealed.yml@v2
     permissions:
+      actions: read
       checks: write
       contents: write
       id-token: write
       issues: write
     with:
       buildchain-ref: ${{ inputs.buildchain-ref || '' }}
-      publication-admission-json: ${{ needs.authority.outputs.admission-json }}
-      publication-runner-provenance-json: ${{ needs.authority.outputs.runner-provenance-json }}
-      publication-control-plane-audit-json: ${{ needs.authority.outputs.control-plane-audit-json }}
-      publication-expected-json: ${{ needs.authority.outputs.expected-json }}
+      publisher-workflow-path: .github/workflows/paper-release.yml
       toolchain-type: config
       verify-command: make check
+      artifact-paths: _build/paper-name.pdf
       buildchain-contract-lock-path: .buildchain/contract-lock.json
 ```
 
-The publication job does not accept a long-lived promotion token. The caller
-must first produce a fresh sealed admission, runner provenance, external
-control-plane audit, and exact expected bindings. The credential-free verifier
-job checks those receipts; only then can the publication job use its short-lived
-`github.token` and caller-bound OIDC trusted publisher identity. npm binds that
-identity to the consumer workflow filename; an npm Environment restriction is
-optional and must be represented explicitly when configured. The workflow fails
-before the publication build when the target branch protection cannot be read.
+The sealed preset does not accept a long-lived promotion token. It builds and
+packages the paper in a read-only job, then a credential-free authority job
+downloads that exact candidate, audits the external control plane, and seals a
+capability over the source tree, Buildchain runtime, controller receipt, PDF,
+and npm package bytes. Only the final job receives write and OIDC permissions;
+it downloads the admitted candidate, recomputes the capability binding, and
+publishes without executing consumer build commands. npm binds the OIDC identity
+to the consumer workflow named by `publisher-workflow-path`.
 
 The preset:
 
-- resolves the same floating Buildchain runtime and contract lock as the build
-  workflow;
-- verifies that the declared promotion authority can read the protected target
-  channel before starting the publication build;
+- resolves the floating Buildchain runtime once and binds the exact SHA into the
+  publication candidate and authority capability;
 - builds the PDF through the declared pinned LaTeX Docker toolchain or custom
-  command;
+  command in a read-only job;
 - verifies the paper repository;
 - writes the publication manifest, publication passport, optional archive
   registry, and source bundle;
@@ -226,14 +223,22 @@ The preset:
 - creates a `publish-gate/<alpha|release>/.../<version>` source lock for the
   channel commit and requires `promote-buildchain-ref` to verify that lock
   before any publish side effect;
-- publishes the package through npm Trusted Publishing;
+- verifies the complete candidate again after authority and publishes the
+  package through npm Trusted Publishing without rebuilding it;
 - writes Buildchain release/passport evidence; and
-- creates or updates the exact-version GitHub Release by default.
+- creates or updates the exact-version GitHub Release by default, uploading
+  every file declared by `publication.primary_artifact` and
+  `publication.artifact_paths` alongside the release evidence.
 
 Consumers can opt out of the GitHub Release with `github-release: false`, but
 the default is on so downstream release propagation can observe
 `release.published` without hand-written `gh release` steps.
 
+Declared publication artifacts are resolved from the generated publication
+manifest rather than repeated in consumer workflow YAML. Publication fails
+before upload if a declared artifact is missing or if its basename would
+collide with another GitHub Release asset.
+
 For npm Trusted Publishing, register the consumer workflow file that calls this
 preset, for example `.github/workflows/paper-release.yml`, against the declared
 package in npm. The trusted publisher is the consumer repository and workflow

package/docs/publication-authority.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-07-14
+last_reviewed: 2026-07-15
 ai_provenance:
   model_family: GPT-5
   product: Codex
-  generated_at: 2026-07-14
+  generated_at: 2026-07-15
   limits: Live provider configuration must be re-audited; no credential values are represented.
 ---
 
@@ -121,6 +121,15 @@ repositories, unknown refs, non-exact source SHAs, and any caller other than
 `.github/workflows/buildchain-ref-promotion.yml`. Manual apply and external
 consumer workflows still require their own explicit admission inputs.
 
+Before authority verification, the reusable promotion controller runs the same
+release transaction selector in read-only mode. That plan supplies one exact
+publication version and tag to the admission verifier, the publish-gate source
+lock, and the real promotion action. The verifier rejects a capability for a
+different version, and the promotion action rechecks the planned version before
+any publish transaction side effect. Release-candidate fixture versions are
+artifact evidence only; they never name Buildchain's own source-lock or
+publication capability.
+
 Evidence publication is a separate authority class and never grants product
 publication.
 

package/docs/release-governance.md

@@ -627,7 +627,9 @@ passes `require-publish-source-lock`, `publish-source-ref`,
 `promote-buildchain-ref`. Direct action callers must pass the same four inputs
 from the reusable build outputs. Workflows that only collect passports or run
 dry-run package checks do not move publish refs and are not publish-gate
-publication models.
+publication models. A dry-run of `release-candidate-promote.yml` computes and
+reports the exact `publish-gate/*` source lock that a real promotion would use,
+but does not read, create, or move that ref.
 
 Semver GitHub Release publication is owned by `promote-buildchain-ref`, not by
 consumer shell glue. Consumers normally use the `release-candidate-promote.yml`

package/docs/shifu-gate-profiles.md

@@ -78,6 +78,12 @@ Every matrix job checks out the exact source SHA planned by Buildchain, invokes
 then invokes `shifu gate receipt validate`. Buildchain uploads the original
 receipt and validation result even when the run fails.
 
+Before invoking the project-owned command, the workflow adds the runner
+account's `~/.local/bin` directory to `PATH` on Windows, Linux, and macOS. This
+keeps user-scoped tools such as `uv` available to strict Shifu cache profiles
+without assuming an administrator-managed system installation. The consumer or
+runner owner remains responsible for provisioning the declared tools.
+
 The fixed `Gate profile / aggregate` job fails closed for missing receipts,
 invalid or stale Shifu validation, dirty or mismatched source SHA, registry or
 plan drift, missing required results, required failures/skips, or gate action

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.7-alpha.1",
+  "version": "2.12.7-alpha.10",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-publication-authority.js

@@ -27,6 +27,7 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
   [".github/workflows/npm-publish.yml", "dry-run-only"],
+  [".github/workflows/paper-release-sealed.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/paper-release.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/patrol-daily.yml", "governance-write"],
   [".github/workflows/patrol-monthly.yml", "governance-write"],

package/packages/core/controller-evidence.js

@@ -303,7 +303,7 @@ function normalizeEvidence(entries = []) {
 function receiptStatus(plan, stages) {
   if (stages.some((stage) => stage.status === "failed")) return "failed";
   if (stages.length > 0 && stages.every((stage) => stage.status === "skipped")) return "skipped";
-  if (stages.some((stage) => stage.status === "cancelled" || stage.status === "missing")) return "partial";
+  if (stages.some((stage) => stage.status === "cancelled" || (stage.required && stage.status === "missing"))) return "partial";
   const required = new Set(plan.expected.stages.filter((stage) => stage.required).map((stage) => stage.id));
   if (stages.filter((stage) => required.has(stage.id)).every((stage) => stage.status === "passed")) return "passed";
   return "partial";

package/packages/core/index.js

@@ -153,6 +153,13 @@ export {
   verifyPublicationAdmission,
 } from "./publication-authority.js";
 
+export {
+  PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT,
+  createPublicationArtifactCandidate,
+  publicationArtifactCandidateDigest,
+  resolvePublicationCandidateFile,
+} from "./publication-artifact-candidate.js";
+
 export {
   buildchainPublicationAuthorityDescriptors,
   createBuildchainPublicationAuthorityRegistry,