@kungfu-tech/buildchain 2.12.7-alpha.21 → 2.12.7-alpha.3

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-15T12:26:57.218Z",
-  "publishedAt": "2026-07-15T12:26:57.218Z",
+  "generatedAt": "2026-07-14T16:58:46.295Z",
+  "publishedAt": "2026-07-14T16:58:46.295Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "97973413b7ba208df42a3ead28d2b80067a3ecc8",
+  "sourceRevision": "a80e367748620f3c1cb16a08d81c854131ed6d89",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.21",
+    "version": "2.12.7-alpha.3",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-15T12:26:57.218Z",
-  "publishedAt": "2026-07-15T12:26:57.218Z",
+  "generatedAt": "2026-07-14T16:58:46.295Z",
+  "publishedAt": "2026-07-14T16:58:46.295Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "97973413b7ba208df42a3ead28d2b80067a3ecc8",
+  "sourceRevision": "a80e367748620f3c1cb16a08d81c854131ed6d89",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.21",
+    "version": "2.12.7-alpha.3",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -85,7 +85,7 @@
       "path": "docs/publication-authority.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:05bc22c7e5885e591bc121fc43f588e5d49ccf0a8de6a642811c1d0d03dcee1e"
+      "digest": "sha256:fc08e6657a1b586b6b8b5618ca4f49dfaa85955687f5bba8e2e69e7513fe6c71"
     },
     {
       "id": "release-candidate",
@@ -93,7 +93,7 @@
       "path": "docs/release-candidate.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:6a20c6e3e483327d5ccbe70271f7fb4752731bd0523eeddb96f27b2b6ebf1cf8"
+      "digest": "sha256:841d6f3281ba6dfe80527e4f149807bdbd05d41f9e94afe1c446fcd6d29e307c"
     },
     {
       "id": "release-propagation",

package/dist/site/workflow-registry.json

@@ -215,19 +215,14 @@
       "reusable": true,
       "inputs": [
         "admission-json",
-        "authority-workflow-path",
         "auto-admission",
-        "auto-admission-kind",
-        "auto-no-gate",
         "buildchain-ref",
         "buildchain-repository",
         "control-plane-audit-json",
         "dry-run",
-        "evidence-controller-artifact",
         "evidence-manifest-pattern",
         "evidence-passport-artifact",
         "evidence-payload-pattern",
-        "evidence-publication-artifact",
         "evidence-repository",
         "evidence-run-id",
         "evidence-summary-artifact",
@@ -236,15 +231,13 @@
         "package-name",
         "product",
         "publication-target",
-        "publication-version",
         "publisher-workflow-path",
-        "required-status-check",
         "runner-provenance-json",
         "source-sha",
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 29,
+      "inputCount": 22,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1031,54 +1024,6 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
-    {
-      "id": "paper-release-sealed",
-      "path": ".github/workflows/paper-release-sealed.yml",
-      "reusable": true,
-      "inputs": [
-        "artifact-name",
-        "artifact-paths",
-        "artifact-retention-days",
-        "branch-protection-bypass-apps",
-        "branch-protection-bypass-teams",
-        "branch-protection-bypass-users",
-        "buildchain-contract-lock-path",
-        "buildchain-ref",
-        "buildchain-repository",
-        "dry-run",
-        "github-release",
-        "github-release-notes",
-        "github-release-title",
-        "package-name",
-        "publish-dist-tag",
-        "publisher-workflow-path",
-        "release-passport-impact-json",
-        "release-passport-output-dir",
-        "release-passport-product-name",
-        "required-status-check",
-        "target-ref",
-        "target-sha",
-        "toolchain-type",
-        "verify-command",
-        "working-directory"
-      ],
-      "inputCount": 25,
-      "secrets": [
-        "BUILDCHAIN_PROMOTION_TOKEN"
-      ],
-      "secretCount": 1,
-      "outputs": [
-        "github-release-url",
-        "package-name",
-        "package-version",
-        "public-release-tag",
-        "release-passport-path"
-      ],
-      "outputCount": 5,
-      "surface": "repository-workflow",
-      "capabilityGroup": "api-cli-reference",
-      "status": "active"
-    },
     {
       "id": "paper-release",
       "path": ".github/workflows/paper-release.yml",
@@ -1248,11 +1193,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "node-version",
-        "package-name",
-        "prepare-paper-package",
-        "publish-dist-tag",
         "setup-node",
-        "target-ref",
         "toolchain-command",
         "toolchain-digest",
         "toolchain-image",
@@ -1260,7 +1201,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 21,
+      "inputCount": 17,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1271,17 +1212,13 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
-        "package-name",
-        "package-version",
         "publication-artifact-name",
         "publication-manifest-json",
         "publication-manifest-path",
         "publication-passport-path",
-        "publication-registry-path",
-        "publish-dist-tag",
-        "runtime-sha"
+        "publication-registry-path"
       ],
-      "outputCount": 16,
+      "outputCount": 12,
       "surface": "repository-workflow",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -1310,7 +1247,6 @@
         "package-manager",
         "publication-admission-json",
         "publication-auto-admission",
-        "publication-auto-no-gate",
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
@@ -1348,7 +1284,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 56,
+      "inputCount": 55,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1551,11 +1487,9 @@
         "branch-protection-bypass-teams",
         "branch-protection-bypass-users",
         "dry-run",
-        "expected-publication-version",
         "generated-ref-update-token",
         "generated-status-check-token",
         "github-release",
-        "github-release-artifact-paths",
         "github-release-notes",
         "github-release-title",
         "promote-only-release-candidate",
@@ -1601,7 +1535,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 54,
+      "inputCount": 52,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/publication-artifacts.md

@@ -182,42 +182,40 @@ on:
 
 jobs:
   paper-release:
-    uses: kungfu-systems/buildchain/.github/workflows/paper-release-sealed.yml@v2
+    uses: kungfu-systems/buildchain/.github/workflows/paper-release.yml@v2
     permissions:
-      actions: read
       checks: write
       contents: write
       id-token: write
       issues: write
     with:
       buildchain-ref: ${{ inputs.buildchain-ref || '' }}
-      publisher-workflow-path: .github/workflows/paper-release.yml
+      publication-admission-json: ${{ needs.authority.outputs.admission-json }}
+      publication-runner-provenance-json: ${{ needs.authority.outputs.runner-provenance-json }}
+      publication-control-plane-audit-json: ${{ needs.authority.outputs.control-plane-audit-json }}
+      publication-expected-json: ${{ needs.authority.outputs.expected-json }}
       toolchain-type: config
       verify-command: make check
-      artifact-paths: _build/paper-name.pdf
       buildchain-contract-lock-path: .buildchain/contract-lock.json
-    secrets:
-      BUILDCHAIN_PROMOTION_TOKEN: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
 ```
 
-The sealed preset does not use a long-lived token for npm publication. It may
-accept an optional `BUILDCHAIN_PROMOTION_TOKEN` only for machine-generated
-version-state updates on protected channel branches; npm publication remains
-bound to GitHub OIDC trusted publishing. The preset builds and packages the
-paper in a read-only job, then a credential-free authority job downloads that
-exact candidate, audits the external control plane, and seals a capability over
-the source tree, Buildchain runtime, controller receipt, PDF, and npm package
-bytes. Only the final job receives write and OIDC permissions; it downloads the
-admitted candidate, recomputes the capability binding, and publishes without
-executing consumer build commands. npm binds the OIDC identity to the consumer
-workflow named by `publisher-workflow-path`.
+The publication job does not accept a long-lived promotion token. The caller
+must first produce a fresh sealed admission, runner provenance, external
+control-plane audit, and exact expected bindings. The credential-free verifier
+job checks those receipts; only then can the publication job use its short-lived
+`github.token` and caller-bound OIDC trusted publisher identity. npm binds that
+identity to the consumer workflow filename; an npm Environment restriction is
+optional and must be represented explicitly when configured. The workflow fails
+before the publication build when the target branch protection cannot be read.
 
 The preset:
 
-- resolves the floating Buildchain runtime once and binds the exact SHA into the
-  publication candidate and authority capability;
+- resolves the same floating Buildchain runtime and contract lock as the build
+  workflow;
+- verifies that the declared promotion authority can read the protected target
+  channel before starting the publication build;
 - builds the PDF through the declared pinned LaTeX Docker toolchain or custom
-  command in a read-only job;
+  command;
 - verifies the paper repository;
 - writes the publication manifest, publication passport, optional archive
   registry, and source bundle;
@@ -228,22 +226,14 @@ The preset:
 - creates a `publish-gate/<alpha|release>/.../<version>` source lock for the
   channel commit and requires `promote-buildchain-ref` to verify that lock
   before any publish side effect;
-- verifies the complete candidate again after authority and publishes the
-  package through npm Trusted Publishing without rebuilding it;
+- publishes the package through npm Trusted Publishing;
 - writes Buildchain release/passport evidence; and
-- creates or updates the exact-version GitHub Release by default, uploading
-  every file declared by `publication.primary_artifact` and
-  `publication.artifact_paths` alongside the release evidence.
+- creates or updates the exact-version GitHub Release by default.
 
 Consumers can opt out of the GitHub Release with `github-release: false`, but
 the default is on so downstream release propagation can observe
 `release.published` without hand-written `gh release` steps.
 
-Declared publication artifacts are resolved from the generated publication
-manifest rather than repeated in consumer workflow YAML. Publication fails
-before upload if a declared artifact is missing or if its basename would
-collide with another GitHub Release asset.
-
 For npm Trusted Publishing, register the consumer workflow file that calls this
 preset, for example `.github/workflows/paper-release.yml`, against the declared
 package in npm. The trusted publisher is the consumer repository and workflow

package/docs/publication-authority.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-07-15
+last_reviewed: 2026-07-14
 ai_provenance:
   model_family: GPT-5
   product: Codex
-  generated_at: 2026-07-15
+  generated_at: 2026-07-14
   limits: Live provider configuration must be re-audited; no credential values are represented.
 ---
 
@@ -109,29 +109,17 @@ artifacts. The denial explicitly records that npm Trusted Publishing and OIDC
 were not evaluated, so downstream diagnostics cannot misclassify an admission
 assembly failure as an npm authentication failure.
 
-An explicitly opted-in managed `workflow_run` promotion lane may assemble those
-inputs from evidence owned by its caller repository. It downloads the exact prior RC passport,
+Buildchain's own `workflow_run` promotion lane may assemble those inputs only
+for `kungfu-systems/buildchain`. It downloads the exact prior RC passport,
 summary, referenced controller receipt, manifests, and product payloads; proves
 the admitted channel commit has the same Git tree as the RC; performs the live
 read-only control-plane audit; records the GitHub-hosted job as ephemeral runner
-provenance; and consumes either a caller-supplied Gate aggregate or an explicit
-caller no-Gate decision. The
+provenance; and creates an explicit Buildchain-owned no-Gate decision. The
 independent verifier then recomputes every receipt and payload digest exactly as
-it does for externally supplied admission. Automatic assembly keeps Buildchain
-as the canonical authority repository, requires evidence to belong to the
-caller, binds a repository-local publisher workflow, and rejects unknown refs,
-non-exact source SHAs, package/target mismatches, or an undeclared Gate policy.
-Manual apply and consumers that do not opt in still require their own explicit
-admission inputs.
-
-Before authority verification, the reusable promotion controller runs the same
-release transaction selector in read-only mode. That plan supplies one exact
-publication version and tag to the admission verifier, the publish-gate source
-lock, and the real promotion action. The verifier rejects a capability for a
-different version, and the promotion action rechecks the planned version before
-any publish transaction side effect. Release-candidate fixture versions are
-artifact evidence only; they never name Buildchain's own source-lock or
-publication capability.
+it does for externally supplied admission. The self-assembly mode rejects other
+repositories, unknown refs, non-exact source SHAs, and any caller other than
+`.github/workflows/buildchain-ref-promotion.yml`. Manual apply and external
+consumer workflows still require their own explicit admission inputs.
 
 Evidence publication is a separate authority class and never grants product
 publication.

package/docs/release-candidate.md

@@ -116,22 +116,3 @@ KFD-1 source/artifact contract surfaces, audits KFD-2 public release claims, and
 compares KFD-3 declared shipped public surfaces with artifact-exposed public
 surfaces. The release passport records the results under `kfd-1`, `kfd-2`, and
 the KFD-provided `kfd-3` section.
-
-Managed consumers may also ask the promotion wrapper to assemble sealed
-publication evidence from the exact release candidate instead of producing
-short-lived admission JSON in repository-specific workflow code:
-
-```yaml
-      publication-auto-admission: true
-      publication-auto-no-gate: true
-      publication-publisher-workflow-path: .github/workflows/buildchain-ref-promotion.yml
-      publication-product: Example Product
-      publication-target: npm:@example/product
-      publication-package-name: "@example/product"
-```
-
-`publication-auto-no-gate` is an explicit consumer decision, not a default. A
-consumer with a Shifu Gate registry supplies `publication-gate-aggregate-json`
-instead. Buildchain still requires caller-owned RC evidence, an exact authority
-runtime and source SHA, a repository-local publisher workflow, matching npm
-target/package identity, and a qualifying control-plane audit.

package/docs/shifu-gate-profiles.md

@@ -78,12 +78,6 @@ Every matrix job checks out the exact source SHA planned by Buildchain, invokes
 then invokes `shifu gate receipt validate`. Buildchain uploads the original
 receipt and validation result even when the run fails.
 
-Before invoking the project-owned command, the workflow adds the runner
-account's `~/.local/bin` directory to `PATH` on Windows, Linux, and macOS. This
-keeps user-scoped tools such as `uv` available to strict Shifu cache profiles
-without assuming an administrator-managed system installation. The consumer or
-runner owner remains responsible for provisioning the declared tools.
-
 The fixed `Gate profile / aggregate` job fails closed for missing receipts,
 invalid or stale Shifu validation, dirty or mismatched source SHA, registry or
 plan drift, missing required results, required failures/skips, or gate action

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.7-alpha.21",
+  "version": "2.12.7-alpha.3",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-publication-authority.js

@@ -27,7 +27,6 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
   [".github/workflows/npm-publish.yml", "dry-run-only"],
-  [".github/workflows/paper-release-sealed.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/paper-release.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/patrol-daily.yml", "governance-write"],
   [".github/workflows/patrol-monthly.yml", "governance-write"],

package/packages/core/controller-evidence.js

@@ -303,7 +303,7 @@ function normalizeEvidence(entries = []) {
 function receiptStatus(plan, stages) {
   if (stages.some((stage) => stage.status === "failed")) return "failed";
   if (stages.length > 0 && stages.every((stage) => stage.status === "skipped")) return "skipped";
-  if (stages.some((stage) => stage.status === "cancelled" || (stage.required && stage.status === "missing"))) return "partial";
+  if (stages.some((stage) => stage.status === "cancelled" || stage.status === "missing")) return "partial";
   const required = new Set(plan.expected.stages.filter((stage) => stage.required).map((stage) => stage.id));
   if (stages.filter((stage) => required.has(stage.id)).every((stage) => stage.status === "passed")) return "passed";
   return "partial";

package/packages/core/index.js

@@ -153,13 +153,6 @@ export {
   verifyPublicationAdmission,
 } from "./publication-authority.js";
 
-export {
-  PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT,
-  createPublicationArtifactCandidate,
-  publicationArtifactCandidateDigest,
-  resolvePublicationCandidateFile,
-} from "./publication-artifact-candidate.js";
-
 export {
   buildchainPublicationAuthorityDescriptors,
   createBuildchainPublicationAuthorityRegistry,

package/packages/core/publication-authority.js

@@ -1,7 +1,6 @@
 import crypto from "node:crypto";
 
 import { validateControllerReceipt } from "./controller-evidence.js";
-import { createPublicationArtifactCandidate } from "./publication-artifact-candidate.js";
 import { sha256Json, validateReleaseCandidatePassport } from "./release-candidate.js";
 
 export const PUBLICATION_AUTHORITY_REGISTRY_CONTRACT =
@@ -382,7 +381,6 @@ export function createPublicationArtifactManifestSet({
 }
 
 function validateGateAggregate(gateAggregate, { admission, passport }) {
-  const passportSourceSha = passport.source?.headSha || passport.source?.sha;
   if (gateAggregate?.contract === "buildchain.shifu-gate-aggregate/v1") {
     const { digest, ...payload } = gateAggregate;
     const actualDigest = sha256Json(payload);
@@ -392,7 +390,7 @@ function validateGateAggregate(gateAggregate, { admission, passport }) {
     if (gateAggregate.status !== "pass" || gateAggregate.qualifying !== true) {
       throw new Error("gate aggregate is not qualifying");
     }
-    if (![admission.sourceSha, passportSourceSha].includes(gateAggregate.sourceSha)) {
+    if (![admission.sourceSha, passport.source?.headSha].includes(gateAggregate.sourceSha)) {
       throw new Error("gate aggregate source SHA mismatch");
     }
     normalizeDigest(gateAggregate.registry?.digest, "gateAggregate.registry.digest");
@@ -410,7 +408,7 @@ function validateGateAggregate(gateAggregate, { admission, passport }) {
   if (gateAggregate.required !== false) {
     throw new Error("a required Gate policy must supply a qualifying Shifu Gate aggregate");
   }
-  if (![admission.sourceSha, passportSourceSha].includes(gateAggregate.sourceSha)) {
+  if (![admission.sourceSha, passport.source?.headSha].includes(gateAggregate.sourceSha)) {
     throw new Error("publication Gate decision source SHA mismatch");
   }
   const normalizedPolicy = {
@@ -430,43 +428,6 @@ function validatePublicationEvidence(publicationEvidence, admission) {
   if (!publicationEvidence || typeof publicationEvidence !== "object" || Array.isArray(publicationEvidence)) {
     throw new Error("independent publication evidence is required");
   }
-  if (publicationEvidence.publicationArtifactCandidate) {
-    const candidate = createPublicationArtifactCandidate(publicationEvidence.publicationArtifactCandidate);
-    const passport = publicationEvidence.publicationArtifactCandidate.passport;
-    const controllerReceipt = publicationEvidence.publicationArtifactCandidate.controllerReceipt;
-    const controllerReceiptDigest = normalizeDigest(controllerReceipt.digest, "controllerReceipt.digest");
-    if (controllerReceiptDigest !== normalizeDigest(admission.controllerReceiptDigest, "admission.controllerReceiptDigest")) {
-      throw new Error("controller receipt evidence binding mismatch");
-    }
-    const contractDigest = normalizeDigest(controllerReceipt.runtime?.contractDigest, "controllerReceipt.runtime.contractDigest");
-    if (contractDigest !== normalizeDigest(admission.contractDigest, "admission.contractDigest")) {
-      throw new Error("runtime contract evidence binding mismatch");
-    }
-    const gate = validateGateAggregate(publicationEvidence.gateAggregate, { admission, passport });
-    if (gate.gateAggregateDigest !== normalizeDigest(admission.gateAggregateDigest, "admission.gateAggregateDigest")) {
-      throw new Error("Gate aggregate evidence binding mismatch");
-    }
-    if (gate.policyDigest !== normalizeDigest(admission.policyDigest, "admission.policyDigest")) {
-      throw new Error("Gate policy evidence binding mismatch");
-    }
-    if (candidate.candidateDigest !== normalizeDigest(admission.artifactDigest, "admission.artifactDigest")) {
-      throw new Error("publication artifact candidate evidence binding mismatch");
-    }
-    return {
-      sourceTreeSha: candidate.sourceTreeSha,
-      controllerReceiptDigest,
-      contractDigest,
-      gateAggregateDigest: gate.gateAggregateDigest,
-      policyDigest: gate.policyDigest,
-      artifactDigest: candidate.candidateDigest,
-      evidenceDigest: publicationAuthorityDigest({
-        sourceTreeSha: candidate.sourceTreeSha,
-        controllerReceiptDigest,
-        gateAggregateDigest: gate.gateAggregateDigest,
-        artifactDigest: candidate.candidateDigest,
-      }),
-    };
-  }
   const passport = publicationEvidence.releaseCandidatePassport;
   const buildSummary = publicationEvidence.buildSummary;
   const passportValidation = validateReleaseCandidatePassport({

package/packages/core/publication-control-plane-audit.js

@@ -16,7 +16,6 @@ export function evaluatePublicationControlPlaneSnapshot({
   branch,
   packageName,
   publisherMode = "npm-trusted-publisher",
-  requiredStatusCheck = "check",
   snapshot,
   observedAt,
   expiresAt,
@@ -73,8 +72,7 @@ export function evaluatePublicationControlPlaneSnapshot({
     branchPolicy.protected === true &&
     branchPolicy.enforcementLevel === "everyone" &&
     Array.isArray(branchPolicy.requiredStatusChecks) &&
-    branchPolicy.requiredStatusCheck === requiredStatusCheck &&
-    branchPolicy.requiredStatusChecks.includes(requiredStatusCheck) &&
+    branchPolicy.requiredStatusChecks.includes("check") &&
     branchPolicy.requiredCheckPassed === true &&
     branchPolicy.sourceSha === branchPolicy.headSha &&
     branchPolicy.mergedPullRequest === true &&

package/scripts/assemble-self-publication-admission.mjs

@@ -115,22 +115,13 @@ async function main() {
     manifests,
     payloads: manifests.map((manifest) => payloadFor(manifest, path.join(evidenceRoot, "payloads"))),
   });
-  const suppliedGateAggregate = String(process.env.BUILDCHAIN_GATE_AGGREGATE_JSON || "").trim();
-  let gateAggregate;
-  if (suppliedGateAggregate) {
-    gateAggregate = JSON.parse(suppliedGateAggregate);
-  } else {
-    if (process.env.BUILDCHAIN_ALLOW_NO_GATE !== "true") {
-      throw new Error("managed release-candidate admission requires a Gate aggregate or explicit no-Gate decision");
-    }
-    gateAggregate = createPublicationGateDecision({
-      sourceSha,
-      profile: process.env.BUILDCHAIN_GATE_PROFILE || "managed-release-candidate-no-gate",
-      required: false,
-      rationale: process.env.BUILDCHAIN_GATE_RATIONALE || "The consumer explicitly declared no Shifu Gate registry for this publication transaction.",
-      policy: { scope: "managed-release-candidate", repository },
-    });
-  }
+  const gateAggregate = createPublicationGateDecision({
+    sourceSha,
+    profile: process.env.BUILDCHAIN_GATE_PROFILE || "buildchain-self-publication",
+    required: false,
+    rationale: process.env.BUILDCHAIN_GATE_RATIONALE || "Buildchain self-publication has no consumer-owned Shifu Gate registry.",
+    policy: { scope: "buildchain-self-publication", repository },
+  });
   const runnerProvenance = createRunnerProvenance({
     runnerClass: "ephemeral",
     os: required("RUNNER_OS"),
@@ -146,7 +137,6 @@ async function main() {
     isolation: "github-hosted-single-job",
   });
   const packageJson = JSON.parse(fs.readFileSync(path.join(runtimeRoot, "package.json"), "utf8"));
-  const publicationVersion = required("BUILDCHAIN_PUBLICATION_VERSION");
   const issuedAt = new Date();
   const admission = createPublicationAdmission({
     registryDigest: registry.registryDigest,
@@ -164,7 +154,7 @@ async function main() {
     environment: process.env.BUILDCHAIN_PUBLICATION_ENVIRONMENT || "none",
     product: process.env.BUILDCHAIN_PUBLICATION_PRODUCT || "Buildchain",
     target: process.env.BUILDCHAIN_PUBLICATION_TARGET || `npm:${packageJson.name}`,
-    version: publicationVersion,
+    version: process.env.BUILDCHAIN_PUBLICATION_VERSION || packageJson.version,
     channel: required("BUILDCHAIN_PUBLICATION_CHANNEL"),
     artifactDigest: artifactSet.manifestSetDigest,
     nonce: `${required("GITHUB_RUN_ID")}:${required("GITHUB_RUN_ATTEMPT")}:${sourceSha}`,
@@ -187,6 +177,6 @@ async function main() {
 }
 
 main().catch((error) => {
-  console.error(`assemble release-candidate admission: ${error.message}`);
+  console.error(`assemble self publication admission: ${error.message}`);
   process.exitCode = 1;
 });

package/scripts/audit-publication-control-plane.mjs

@@ -191,7 +191,6 @@ function main() {
   const workflowPath = flag("workflow", ".github/workflows/release-candidate-promote.yml");
   const workflowRef = flag("workflow-ref");
   const publisherWorkflowPath = flag("publisher-workflow", workflowPath);
-  const requiredStatusCheck = flag("required-status-check", "check");
   const jobId = flag("job", "promote");
   const environment = flag("environment", "none");
   const providerEnvironment = environment === "none" ? "" : environment;
@@ -281,16 +280,15 @@ function main() {
     const checkRuns = githubJson(`repos/${repository}/commits/${sourceSha}/check-runs?per_page=100`, "source check runs");
     const requiredStatusCheckPolicy = branchState.protection?.required_status_checks || {};
     const requiredStatusChecks = requiredStatusCheckPolicy.contexts || [];
-    const requiredCheckSource = (requiredStatusCheckPolicy.checks || []).find((entry) => entry.context === requiredStatusCheck);
+    const requiredCheckSource = (requiredStatusCheckPolicy.checks || []).find((entry) => entry.context === "check");
     branchPolicy = {
       ref: branch,
       policyMode: "provider-enforced-transaction",
       protected: branchState.protected === true,
       enforcementLevel: branchState.protection?.required_status_checks?.enforcement_level || "",
       requiredStatusChecks,
-      requiredStatusCheck,
       requiredCheckPassed: (checkRuns.check_runs || []).some((entry) =>
-        entry.name === requiredStatusCheck &&
+        entry.name === "check" &&
         entry.conclusion === "success" &&
         (!requiredCheckSource?.app_id || entry.app?.id === requiredCheckSource.app_id)
       ),
@@ -352,7 +350,6 @@ function main() {
     branch,
     packageName,
     publisherMode,
-    requiredStatusCheck,
     observedAt: observedAt.toISOString(),
     expiresAt: expiresAt.toISOString(),
     snapshot: {