@kungfu-tech/buildchain 2.12.7-alpha.18 → 2.12.7-alpha.2

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-15T10:03:44.581Z",
-  "publishedAt": "2026-07-15T10:03:44.581Z",
+  "generatedAt": "2026-07-14T16:40:36.563Z",
+  "publishedAt": "2026-07-14T16:40:36.563Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "1115b3787d74a3781f04f66b69ec7ed83c540b5e",
+  "sourceRevision": "31f70f81cbdd542d9473651cf13cd6e8eb33cd74",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.18",
+    "version": "2.12.7-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-15T10:03:44.581Z",
-  "publishedAt": "2026-07-15T10:03:44.581Z",
+  "generatedAt": "2026-07-14T16:40:36.563Z",
+  "publishedAt": "2026-07-14T16:40:36.563Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "1115b3787d74a3781f04f66b69ec7ed83c540b5e",
+  "sourceRevision": "31f70f81cbdd542d9473651cf13cd6e8eb33cd74",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.18",
+    "version": "2.12.7-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -85,7 +85,7 @@
       "path": "docs/publication-authority.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:06ba05f9d8a2685a0896334b6013a97c45b7d71163cf6898e5a6274baf7f0296"
+      "digest": "sha256:fc08e6657a1b586b6b8b5618ca4f49dfaa85955687f5bba8e2e69e7513fe6c71"
     },
     {
       "id": "release-candidate",

package/dist/site/workflow-registry.json

@@ -215,18 +215,14 @@
       "reusable": true,
       "inputs": [
         "admission-json",
-        "authority-workflow-path",
         "auto-admission",
-        "auto-admission-kind",
         "buildchain-ref",
         "buildchain-repository",
         "control-plane-audit-json",
         "dry-run",
-        "evidence-controller-artifact",
         "evidence-manifest-pattern",
         "evidence-passport-artifact",
         "evidence-payload-pattern",
-        "evidence-publication-artifact",
         "evidence-repository",
         "evidence-run-id",
         "evidence-summary-artifact",
@@ -235,15 +231,13 @@
         "package-name",
         "product",
         "publication-target",
-        "publication-version",
         "publisher-workflow-path",
-        "required-status-check",
         "runner-provenance-json",
         "source-sha",
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 28,
+      "inputCount": 22,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1030,54 +1024,6 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
-    {
-      "id": "paper-release-sealed",
-      "path": ".github/workflows/paper-release-sealed.yml",
-      "reusable": true,
-      "inputs": [
-        "artifact-name",
-        "artifact-paths",
-        "artifact-retention-days",
-        "branch-protection-bypass-apps",
-        "branch-protection-bypass-teams",
-        "branch-protection-bypass-users",
-        "buildchain-contract-lock-path",
-        "buildchain-ref",
-        "buildchain-repository",
-        "dry-run",
-        "github-release",
-        "github-release-notes",
-        "github-release-title",
-        "package-name",
-        "publish-dist-tag",
-        "publisher-workflow-path",
-        "release-passport-impact-json",
-        "release-passport-output-dir",
-        "release-passport-product-name",
-        "required-status-check",
-        "target-ref",
-        "target-sha",
-        "toolchain-type",
-        "verify-command",
-        "working-directory"
-      ],
-      "inputCount": 25,
-      "secrets": [
-        "BUILDCHAIN_PROMOTION_TOKEN"
-      ],
-      "secretCount": 1,
-      "outputs": [
-        "github-release-url",
-        "package-name",
-        "package-version",
-        "public-release-tag",
-        "release-passport-path"
-      ],
-      "outputCount": 5,
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active"
-    },
     {
       "id": "paper-release",
       "path": ".github/workflows/paper-release.yml",
@@ -1247,11 +1193,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "node-version",
-        "package-name",
-        "prepare-paper-package",
-        "publish-dist-tag",
         "setup-node",
-        "target-ref",
         "toolchain-command",
         "toolchain-digest",
         "toolchain-image",
@@ -1259,7 +1201,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 21,
+      "inputCount": 17,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1270,17 +1212,13 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
-        "package-name",
-        "package-version",
         "publication-artifact-name",
         "publication-manifest-json",
         "publication-manifest-path",
         "publication-passport-path",
-        "publication-registry-path",
-        "publish-dist-tag",
-        "runtime-sha"
+        "publication-registry-path"
       ],
-      "outputCount": 16,
+      "outputCount": 12,
       "surface": "repository-workflow",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -1351,12 +1289,11 @@
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
         "BUILDCHAIN_ISSUE_TOKEN",
-        "BUILDCHAIN_PROMOTION_TOKEN",
         "buildchain-issue-app-id",
         "buildchain-issue-app-private-key",
         "buildchain-issue-token"
       ],
-      "secretCount": 7,
+      "secretCount": 6,
       "outputs": [
         "built-source-sha",
         "controller-plan-artifact",
@@ -1549,11 +1486,9 @@
         "branch-protection-bypass-teams",
         "branch-protection-bypass-users",
         "dry-run",
-        "expected-publication-version",
         "generated-ref-update-token",
         "generated-status-check-token",
         "github-release",
-        "github-release-artifact-paths",
         "github-release-notes",
         "github-release-title",
         "promote-only-release-candidate",
@@ -1599,7 +1534,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 54,
+      "inputCount": 52,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/publication-artifacts.md

@@ -182,42 +182,40 @@ on:
 
 jobs:
   paper-release:
-    uses: kungfu-systems/buildchain/.github/workflows/paper-release-sealed.yml@v2
+    uses: kungfu-systems/buildchain/.github/workflows/paper-release.yml@v2
     permissions:
-      actions: read
       checks: write
       contents: write
       id-token: write
       issues: write
     with:
       buildchain-ref: ${{ inputs.buildchain-ref || '' }}
-      publisher-workflow-path: .github/workflows/paper-release.yml
+      publication-admission-json: ${{ needs.authority.outputs.admission-json }}
+      publication-runner-provenance-json: ${{ needs.authority.outputs.runner-provenance-json }}
+      publication-control-plane-audit-json: ${{ needs.authority.outputs.control-plane-audit-json }}
+      publication-expected-json: ${{ needs.authority.outputs.expected-json }}
       toolchain-type: config
       verify-command: make check
-      artifact-paths: _build/paper-name.pdf
       buildchain-contract-lock-path: .buildchain/contract-lock.json
-    secrets:
-      BUILDCHAIN_PROMOTION_TOKEN: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
 ```
 
-The sealed preset does not use a long-lived token for npm publication. It may
-accept an optional `BUILDCHAIN_PROMOTION_TOKEN` only for machine-generated
-version-state updates on protected channel branches; npm publication remains
-bound to GitHub OIDC trusted publishing. The preset builds and packages the
-paper in a read-only job, then a credential-free authority job downloads that
-exact candidate, audits the external control plane, and seals a capability over
-the source tree, Buildchain runtime, controller receipt, PDF, and npm package
-bytes. Only the final job receives write and OIDC permissions; it downloads the
-admitted candidate, recomputes the capability binding, and publishes without
-executing consumer build commands. npm binds the OIDC identity to the consumer
-workflow named by `publisher-workflow-path`.
+The publication job does not accept a long-lived promotion token. The caller
+must first produce a fresh sealed admission, runner provenance, external
+control-plane audit, and exact expected bindings. The credential-free verifier
+job checks those receipts; only then can the publication job use its short-lived
+`github.token` and caller-bound OIDC trusted publisher identity. npm binds that
+identity to the consumer workflow filename; an npm Environment restriction is
+optional and must be represented explicitly when configured. The workflow fails
+before the publication build when the target branch protection cannot be read.
 
 The preset:
 
-- resolves the floating Buildchain runtime once and binds the exact SHA into the
-  publication candidate and authority capability;
+- resolves the same floating Buildchain runtime and contract lock as the build
+  workflow;
+- verifies that the declared promotion authority can read the protected target
+  channel before starting the publication build;
 - builds the PDF through the declared pinned LaTeX Docker toolchain or custom
-  command in a read-only job;
+  command;
 - verifies the paper repository;
 - writes the publication manifest, publication passport, optional archive
   registry, and source bundle;
@@ -228,22 +226,14 @@ The preset:
 - creates a `publish-gate/<alpha|release>/.../<version>` source lock for the
   channel commit and requires `promote-buildchain-ref` to verify that lock
   before any publish side effect;
-- verifies the complete candidate again after authority and publishes the
-  package through npm Trusted Publishing without rebuilding it;
+- publishes the package through npm Trusted Publishing;
 - writes Buildchain release/passport evidence; and
-- creates or updates the exact-version GitHub Release by default, uploading
-  every file declared by `publication.primary_artifact` and
-  `publication.artifact_paths` alongside the release evidence.
+- creates or updates the exact-version GitHub Release by default.
 
 Consumers can opt out of the GitHub Release with `github-release: false`, but
 the default is on so downstream release propagation can observe
 `release.published` without hand-written `gh release` steps.
 
-Declared publication artifacts are resolved from the generated publication
-manifest rather than repeated in consumer workflow YAML. Publication fails
-before upload if a declared artifact is missing or if its basename would
-collide with another GitHub Release asset.
-
 For npm Trusted Publishing, register the consumer workflow file that calls this
 preset, for example `.github/workflows/paper-release.yml`, against the declared
 package in npm. The trusted publisher is the consumer repository and workflow

package/docs/publication-authority.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-07-15
+last_reviewed: 2026-07-14
 ai_provenance:
   model_family: GPT-5
   product: Codex
-  generated_at: 2026-07-15
+  generated_at: 2026-07-14
   limits: Live provider configuration must be re-audited; no credential values are represented.
 ---
 
@@ -121,15 +121,6 @@ repositories, unknown refs, non-exact source SHAs, and any caller other than
 `.github/workflows/buildchain-ref-promotion.yml`. Manual apply and external
 consumer workflows still require their own explicit admission inputs.
 
-Before authority verification, the reusable promotion controller runs the same
-release transaction selector in read-only mode. That plan supplies one exact
-publication version and tag to the admission verifier, the publish-gate source
-lock, and the real promotion action. The verifier rejects a capability for a
-different version, and the promotion action rechecks the planned version before
-any publish transaction side effect. Release-candidate fixture versions are
-artifact evidence only; they never name Buildchain's own source-lock or
-publication capability.
-
 Evidence publication is a separate authority class and never grants product
 publication.
 

package/docs/shifu-gate-profiles.md

@@ -78,12 +78,6 @@ Every matrix job checks out the exact source SHA planned by Buildchain, invokes
 then invokes `shifu gate receipt validate`. Buildchain uploads the original
 receipt and validation result even when the run fails.
 
-Before invoking the project-owned command, the workflow adds the runner
-account's `~/.local/bin` directory to `PATH` on Windows, Linux, and macOS. This
-keeps user-scoped tools such as `uv` available to strict Shifu cache profiles
-without assuming an administrator-managed system installation. The consumer or
-runner owner remains responsible for provisioning the declared tools.
-
 The fixed `Gate profile / aggregate` job fails closed for missing receipts,
 invalid or stale Shifu validation, dirty or mismatched source SHA, registry or
 plan drift, missing required results, required failures/skips, or gate action

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.7-alpha.18",
+  "version": "2.12.7-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-publication-authority.js

@@ -27,7 +27,6 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
   [".github/workflows/npm-publish.yml", "dry-run-only"],
-  [".github/workflows/paper-release-sealed.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/paper-release.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/patrol-daily.yml", "governance-write"],
   [".github/workflows/patrol-monthly.yml", "governance-write"],

package/packages/core/controller-evidence.js

@@ -303,7 +303,7 @@ function normalizeEvidence(entries = []) {
 function receiptStatus(plan, stages) {
   if (stages.some((stage) => stage.status === "failed")) return "failed";
   if (stages.length > 0 && stages.every((stage) => stage.status === "skipped")) return "skipped";
-  if (stages.some((stage) => stage.status === "cancelled" || (stage.required && stage.status === "missing"))) return "partial";
+  if (stages.some((stage) => stage.status === "cancelled" || stage.status === "missing")) return "partial";
   const required = new Set(plan.expected.stages.filter((stage) => stage.required).map((stage) => stage.id));
   if (stages.filter((stage) => required.has(stage.id)).every((stage) => stage.status === "passed")) return "passed";
   return "partial";

package/packages/core/index.js

@@ -153,13 +153,6 @@ export {
   verifyPublicationAdmission,
 } from "./publication-authority.js";
 
-export {
-  PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT,
-  createPublicationArtifactCandidate,
-  publicationArtifactCandidateDigest,
-  resolvePublicationCandidateFile,
-} from "./publication-artifact-candidate.js";
-
 export {
   buildchainPublicationAuthorityDescriptors,
   createBuildchainPublicationAuthorityRegistry,

package/packages/core/publication-authority.js

@@ -1,7 +1,6 @@
 import crypto from "node:crypto";
 
 import { validateControllerReceipt } from "./controller-evidence.js";
-import { createPublicationArtifactCandidate } from "./publication-artifact-candidate.js";
 import { sha256Json, validateReleaseCandidatePassport } from "./release-candidate.js";
 
 export const PUBLICATION_AUTHORITY_REGISTRY_CONTRACT =
@@ -382,7 +381,6 @@ export function createPublicationArtifactManifestSet({
 }
 
 function validateGateAggregate(gateAggregate, { admission, passport }) {
-  const passportSourceSha = passport.source?.headSha || passport.source?.sha;
   if (gateAggregate?.contract === "buildchain.shifu-gate-aggregate/v1") {
     const { digest, ...payload } = gateAggregate;
     const actualDigest = sha256Json(payload);
@@ -392,7 +390,7 @@ function validateGateAggregate(gateAggregate, { admission, passport }) {
     if (gateAggregate.status !== "pass" || gateAggregate.qualifying !== true) {
       throw new Error("gate aggregate is not qualifying");
     }
-    if (![admission.sourceSha, passportSourceSha].includes(gateAggregate.sourceSha)) {
+    if (![admission.sourceSha, passport.source?.headSha].includes(gateAggregate.sourceSha)) {
       throw new Error("gate aggregate source SHA mismatch");
     }
     normalizeDigest(gateAggregate.registry?.digest, "gateAggregate.registry.digest");
@@ -410,7 +408,7 @@ function validateGateAggregate(gateAggregate, { admission, passport }) {
   if (gateAggregate.required !== false) {
     throw new Error("a required Gate policy must supply a qualifying Shifu Gate aggregate");
   }
-  if (![admission.sourceSha, passportSourceSha].includes(gateAggregate.sourceSha)) {
+  if (![admission.sourceSha, passport.source?.headSha].includes(gateAggregate.sourceSha)) {
     throw new Error("publication Gate decision source SHA mismatch");
   }
   const normalizedPolicy = {
@@ -430,43 +428,6 @@ function validatePublicationEvidence(publicationEvidence, admission) {
   if (!publicationEvidence || typeof publicationEvidence !== "object" || Array.isArray(publicationEvidence)) {
     throw new Error("independent publication evidence is required");
   }
-  if (publicationEvidence.publicationArtifactCandidate) {
-    const candidate = createPublicationArtifactCandidate(publicationEvidence.publicationArtifactCandidate);
-    const passport = publicationEvidence.publicationArtifactCandidate.passport;
-    const controllerReceipt = publicationEvidence.publicationArtifactCandidate.controllerReceipt;
-    const controllerReceiptDigest = normalizeDigest(controllerReceipt.digest, "controllerReceipt.digest");
-    if (controllerReceiptDigest !== normalizeDigest(admission.controllerReceiptDigest, "admission.controllerReceiptDigest")) {
-      throw new Error("controller receipt evidence binding mismatch");
-    }
-    const contractDigest = normalizeDigest(controllerReceipt.runtime?.contractDigest, "controllerReceipt.runtime.contractDigest");
-    if (contractDigest !== normalizeDigest(admission.contractDigest, "admission.contractDigest")) {
-      throw new Error("runtime contract evidence binding mismatch");
-    }
-    const gate = validateGateAggregate(publicationEvidence.gateAggregate, { admission, passport });
-    if (gate.gateAggregateDigest !== normalizeDigest(admission.gateAggregateDigest, "admission.gateAggregateDigest")) {
-      throw new Error("Gate aggregate evidence binding mismatch");
-    }
-    if (gate.policyDigest !== normalizeDigest(admission.policyDigest, "admission.policyDigest")) {
-      throw new Error("Gate policy evidence binding mismatch");
-    }
-    if (candidate.candidateDigest !== normalizeDigest(admission.artifactDigest, "admission.artifactDigest")) {
-      throw new Error("publication artifact candidate evidence binding mismatch");
-    }
-    return {
-      sourceTreeSha: candidate.sourceTreeSha,
-      controllerReceiptDigest,
-      contractDigest,
-      gateAggregateDigest: gate.gateAggregateDigest,
-      policyDigest: gate.policyDigest,
-      artifactDigest: candidate.candidateDigest,
-      evidenceDigest: publicationAuthorityDigest({
-        sourceTreeSha: candidate.sourceTreeSha,
-        controllerReceiptDigest,
-        gateAggregateDigest: gate.gateAggregateDigest,
-        artifactDigest: candidate.candidateDigest,
-      }),
-    };
-  }
   const passport = publicationEvidence.releaseCandidatePassport;
   const buildSummary = publicationEvidence.buildSummary;
   const passportValidation = validateReleaseCandidatePassport({

package/packages/core/publication-control-plane-audit.js

@@ -16,7 +16,6 @@ export function evaluatePublicationControlPlaneSnapshot({
   branch,
   packageName,
   publisherMode = "npm-trusted-publisher",
-  requiredStatusCheck = "check",
   snapshot,
   observedAt,
   expiresAt,
@@ -73,8 +72,7 @@ export function evaluatePublicationControlPlaneSnapshot({
     branchPolicy.protected === true &&
     branchPolicy.enforcementLevel === "everyone" &&
     Array.isArray(branchPolicy.requiredStatusChecks) &&
-    branchPolicy.requiredStatusCheck === requiredStatusCheck &&
-    branchPolicy.requiredStatusChecks.includes(requiredStatusCheck) &&
+    branchPolicy.requiredStatusChecks.includes("check") &&
     branchPolicy.requiredCheckPassed === true &&
     branchPolicy.sourceSha === branchPolicy.headSha &&
     branchPolicy.mergedPullRequest === true &&

package/scripts/assemble-self-publication-admission.mjs

@@ -137,7 +137,6 @@ async function main() {
     isolation: "github-hosted-single-job",
   });
   const packageJson = JSON.parse(fs.readFileSync(path.join(runtimeRoot, "package.json"), "utf8"));
-  const publicationVersion = required("BUILDCHAIN_PUBLICATION_VERSION");
   const issuedAt = new Date();
   const admission = createPublicationAdmission({
     registryDigest: registry.registryDigest,
@@ -155,7 +154,7 @@ async function main() {
     environment: process.env.BUILDCHAIN_PUBLICATION_ENVIRONMENT || "none",
     product: process.env.BUILDCHAIN_PUBLICATION_PRODUCT || "Buildchain",
     target: process.env.BUILDCHAIN_PUBLICATION_TARGET || `npm:${packageJson.name}`,
-    version: publicationVersion,
+    version: process.env.BUILDCHAIN_PUBLICATION_VERSION || packageJson.version,
     channel: required("BUILDCHAIN_PUBLICATION_CHANNEL"),
     artifactDigest: artifactSet.manifestSetDigest,
     nonce: `${required("GITHUB_RUN_ID")}:${required("GITHUB_RUN_ATTEMPT")}:${sourceSha}`,

package/scripts/audit-publication-control-plane.mjs

@@ -191,7 +191,6 @@ function main() {
   const workflowPath = flag("workflow", ".github/workflows/release-candidate-promote.yml");
   const workflowRef = flag("workflow-ref");
   const publisherWorkflowPath = flag("publisher-workflow", workflowPath);
-  const requiredStatusCheck = flag("required-status-check", "check");
   const jobId = flag("job", "promote");
   const environment = flag("environment", "none");
   const providerEnvironment = environment === "none" ? "" : environment;
@@ -281,16 +280,15 @@ function main() {
     const checkRuns = githubJson(`repos/${repository}/commits/${sourceSha}/check-runs?per_page=100`, "source check runs");
     const requiredStatusCheckPolicy = branchState.protection?.required_status_checks || {};
     const requiredStatusChecks = requiredStatusCheckPolicy.contexts || [];
-    const requiredCheckSource = (requiredStatusCheckPolicy.checks || []).find((entry) => entry.context === requiredStatusCheck);
+    const requiredCheckSource = (requiredStatusCheckPolicy.checks || []).find((entry) => entry.context === "check");
     branchPolicy = {
       ref: branch,
       policyMode: "provider-enforced-transaction",
       protected: branchState.protected === true,
       enforcementLevel: branchState.protection?.required_status_checks?.enforcement_level || "",
       requiredStatusChecks,
-      requiredStatusCheck,
       requiredCheckPassed: (checkRuns.check_runs || []).some((entry) =>
-        entry.name === requiredStatusCheck &&
+        entry.name === "check" &&
         entry.conclusion === "success" &&
         (!requiredCheckSource?.app_id || entry.app?.id === requiredCheckSource.app_id)
       ),
@@ -352,7 +350,6 @@ function main() {
     branch,
     packageName,
     publisherMode,
-    requiredStatusCheck,
     observedAt: observedAt.toISOString(),
     expiresAt: expiresAt.toISOString(),
     snapshot: {

package/scripts/check-inventory.mjs

@@ -840,9 +840,6 @@ for (const requiredSnippet of [
   "publish-source-ref: ${{ steps.publish-gate.outputs.ref }}",
   "publish-source-sha: ${{ steps.publish-gate.outputs.sha }}",
   "publish-source-locked: ${{ steps.publish-gate.outputs.locked }}",
-  "expected-publication-version: ${{ needs.publication-plan.outputs.version }}",
-  "publication-version: ${{ needs.publication-plan.outputs.version }}",
-  "name: Plan exact publication version",
   "DRY_RUN: ${{ inputs.dry-run }}",
   "if (dryRun) {",
   "Enforce Buildchain stable release canary gate",

package/scripts/workflow-friction-report.mjs

@@ -202,8 +202,6 @@ export async function classifyWorkflowFriction({
   buildWorkflowName = DEFAULT_BUILD_WORKFLOW_NAME,
   releaseCandidateOutcome = env("BUILDCHAIN_RC_RESOLVE_OUTCOME"),
   releaseCandidateDiagnosis = env("BUILDCHAIN_RC_DIAGNOSIS"),
-  promotionOutcome = env("BUILDCHAIN_PROMOTION_OUTCOME"),
-  promotionDiagnosis = env("BUILDCHAIN_PROMOTION_DIAGNOSIS"),
   runUrl = env("BUILDCHAIN_WORKFLOW_RUN_URL"),
   outputDir = ".buildchain/workflow-friction",
   fetchImpl = globalThis.fetch,
@@ -258,23 +256,14 @@ export async function classifyWorkflowFriction({
   if (releaseCandidateOutcome === "failure") {
     diagnosisParts.push("Promotion reached the post-Verify workflow before required PR-stage RC evidence could be resolved.");
   }
-  if (releaseCandidateOutcome === "failure" && releaseCandidateDiagnosis) {
+  if (releaseCandidateDiagnosis) {
     diagnosisParts.push(releaseCandidateDiagnosis);
   }
-  if (promotionOutcome === "failure") {
-    diagnosisParts.push(
-      promotionDiagnosis
-        ? `Promotion failed: ${promotionDiagnosis}`
-        : "Promotion failed after PR-stage release-candidate evidence resolved successfully.",
-    );
-  }
   diagnosisParts.push(...workflowRunDiagnostics);
   const diagnosis = diagnosisParts.join(" ") || "Buildchain ref promotion failed after Verify succeeded; inspect the classified evidence and keep the fix in Buildchain.";
   const nextAction = frictionClass === "late-fail-fast"
     ? "Move the missing/stale RC evidence check earlier or make the promotion workflow consume the exact PR-stage RC passport before any publish side effect."
-    : ["duplicate-channel-pr", "duplicate-heavy-build"].includes(frictionClass)
-      ? "Deduplicate the PR/build path or tighten Buildchain workflow gates so the next channel promotion reaches publish exactly once."
-      : "Fix the concrete promotion failure above, then rerun through the protected channel workflow; do not treat successful RC resolution as the failure diagnosis.";
+    : "Deduplicate the PR/build path or tighten Buildchain workflow gates so the next channel promotion reaches publish exactly once.";
   fs.mkdirSync(outputDir, { recursive: true });
   const bodyFile = path.join(outputDir, "issue-body.md");
   const body = buildWorkflowFrictionBody({