@kungfu-tech/buildchain 2.12.7-alpha.21 → 2.12.7-alpha.22

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.21",
+    "version": "2.12.7-alpha.22",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -2679,5 +2679,5 @@
     }
   ],
   "compatibilityDigest": "sha256:af162b86ab4506e9b5f1d3c59b41f3fd57fbad79ff4d749a7f12ff16460517f8",
-  "contractDigest": "sha256:048014d9eac273cb507311984dda5030552741df29ed2177f0b9a347d932a423"
+  "contractDigest": "sha256:881914b796ebf2deda418a3840791433aa1502aab1e7f2db03da228f938180e6"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-15T12:26:57.218Z",
-  "publishedAt": "2026-07-15T12:26:57.218Z",
+  "generatedAt": "2026-07-15T13:10:00.779Z",
+  "publishedAt": "2026-07-15T13:10:00.779Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "97973413b7ba208df42a3ead28d2b80067a3ecc8",
+  "sourceRevision": "57c59542464de6d6fa053d83117cf74d018707e9",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.21",
+    "version": "2.12.7-alpha.22",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.21",
+    "version": "2.12.7-alpha.22",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-15T12:26:57.218Z",
-  "publishedAt": "2026-07-15T12:26:57.218Z",
+  "generatedAt": "2026-07-15T13:10:00.779Z",
+  "publishedAt": "2026-07-15T13:10:00.779Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "97973413b7ba208df42a3ead28d2b80067a3ecc8",
+  "sourceRevision": "57c59542464de6d6fa053d83117cf74d018707e9",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.21",
+    "version": "2.12.7-alpha.22",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-15T12:26:57.218Z",
-  "publishedAt": "2026-07-15T12:26:57.218Z",
+  "generatedAt": "2026-07-15T13:10:00.779Z",
+  "publishedAt": "2026-07-15T13:10:00.779Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "97973413b7ba208df42a3ead28d2b80067a3ecc8",
+  "sourceRevision": "57c59542464de6d6fa053d83117cf74d018707e9",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.21",
+    "version": "2.12.7-alpha.22",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.7-alpha.21",
+  "version": "2.12.7-alpha.22",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/locked-source-checkout.mjs

@@ -222,10 +222,32 @@ export function fetchSourceCommit({
   sourceTreeSha = "",
   timeoutMs,
   env = {},
+  allowFullFetchRetry = false,
   runGit = git,
   containsCommit = hasCommit,
 }) {
   const fetchEnv = isolatedGitFetchEnv(env, targetPath);
+  const fetch = (refspec) => {
+    const options = { cwd: targetPath, timeoutMs, env: fetchEnv };
+    try {
+      runGit(["fetch", "--no-tags", "--depth=1", remoteName, refspec], options);
+      return "shallow";
+    } catch (error) {
+      if (
+        !allowFullFetchRetry
+        || !/dumb http transport does not support shallow capabilities/i.test(
+          String(error?.message || error || ""),
+        )
+      ) {
+        throw error;
+      }
+      // Dumb HTTP mirrors are intentionally simple static cache endpoints.
+      // Retry only that explicit capability mismatch without --depth; all
+      // network fallbacks remain shallow and bounded by their own policy.
+      runGit(["fetch", "--no-tags", remoteName, refspec], options);
+      return "full";
+    }
+  };
   try {
     runGit(["remote", "remove", remoteName], { cwd: targetPath, timeoutMs, stdio: "ignore" });
   } catch {
@@ -239,13 +261,9 @@ export function fetchSourceCommit({
 
   if (fetchRef) {
     try {
-      runGit(["fetch", "--no-tags", "--depth=1", remoteName, `+${fetchRef}:refs/buildchain/source-ref`], {
-        cwd: targetPath,
-        timeoutMs,
-        env: fetchEnv,
-      });
+      const fetchMode = fetch(`+${fetchRef}:refs/buildchain/source-ref`);
       if (containsCommit(targetPath, sha, timeoutMs)) {
-        return { selector: "ref", checkoutSha: sha };
+        return { selector: "ref", checkoutSha: sha, fetchMode };
       }
       if (/^refs\/pull\/\d+\/merge$/.test(fetchRef) && sourceTreeSha) {
         const fetchedSha = runGit(["rev-parse", "refs/buildchain/source-ref^{commit}"], {
@@ -257,7 +275,7 @@ export function fetchSourceCommit({
           timeoutMs,
         });
         if (fetchedTree === sourceTreeSha) {
-          return { selector: "ref-tree", checkoutSha: fetchedSha };
+          return { selector: "ref-tree", checkoutSha: fetchedSha, fetchMode };
         }
       }
     } catch (error) {
@@ -269,15 +287,11 @@ export function fetchSourceCommit({
     }
   }
 
-  runGit(["fetch", "--no-tags", "--depth=1", remoteName, `+${sha}:refs/buildchain/source`], {
-    cwd: targetPath,
-    timeoutMs,
-    env: fetchEnv,
-  });
+  const fetchMode = fetch(`+${sha}:refs/buildchain/source`);
   if (!containsCommit(targetPath, sha, timeoutMs)) {
     throw new Error(`fetched ${fetchRef || sha}, but ${sha} is not available`);
   }
-  return { selector: "sha", checkoutSha: sha };
+  return { selector: "sha", checkoutSha: sha, fetchMode };
 }
 
 export function runBoundedFetch({ attempts = 1, fetch, onAttempt = () => {}, onRetry = () => {}, shouldRetry = () => true }) {
@@ -433,7 +447,9 @@ export function lockedSourceCheckout({
           fetchRef,
           sourceTreeSha: treeSha,
           timeoutMs,
+          allowFullFetchRetry: true,
         });
+        evidence.cache.fetchMode = fetchResult.fetchMode;
         checkoutSha = fetchResult.checkoutSha || sha;
         checkoutFetchedCommit(targetPath, checkoutSha, timeoutMs);
       } else {
@@ -478,6 +494,7 @@ export function lockedSourceCheckout({
         shouldRetry: retryableGitFetchError,
       });
       evidence.cache.githubFetchAttempts = fetchResult.attempts;
+      evidence.cache.fetchMode = fetchResult.value.fetchMode;
       checkoutSha = fetchResult.value.checkoutSha || sha;
     } catch (error) {
       evidence.durationMs = Date.now() - startedAt;