@kungfu-tech/buildchain 2.12.7-alpha.6 → 2.12.7-alpha.8

package/dist/site/public-surface-audit.json

@@ -4,7 +4,7 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 79,
-    "workflowCount": 46,
+    "workflowCount": 47,
     "actionCount": 4,
     "sitePageCount": 49,
     "docCommandRefCount": 246,
@@ -609,14 +609,18 @@
         "reusable": true,
         "inputs": [
           "admission-json",
+          "authority-workflow-path",
           "auto-admission",
+          "auto-admission-kind",
           "buildchain-ref",
           "buildchain-repository",
           "control-plane-audit-json",
           "dry-run",
+          "evidence-controller-artifact",
           "evidence-manifest-pattern",
           "evidence-passport-artifact",
           "evidence-payload-pattern",
+          "evidence-publication-artifact",
           "evidence-repository",
           "evidence-run-id",
           "evidence-summary-artifact",
@@ -627,12 +631,13 @@
           "publication-target",
           "publication-version",
           "publisher-workflow-path",
+          "required-status-check",
           "runner-provenance-json",
           "source-sha",
           "target-ref",
           "used-nonces-json"
         ],
-        "inputCount": 23,
+        "inputCount": 28,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
@@ -1335,6 +1340,49 @@
         "outputs": [],
         "outputCount": 0
       },
+      {
+        "id": "paper-release-sealed",
+        "path": ".github/workflows/paper-release-sealed.yml",
+        "reusable": true,
+        "inputs": [
+          "artifact-name",
+          "artifact-paths",
+          "artifact-retention-days",
+          "branch-protection-bypass-apps",
+          "branch-protection-bypass-teams",
+          "branch-protection-bypass-users",
+          "buildchain-contract-lock-path",
+          "buildchain-ref",
+          "buildchain-repository",
+          "dry-run",
+          "github-release",
+          "github-release-notes",
+          "github-release-title",
+          "package-name",
+          "publish-dist-tag",
+          "publisher-workflow-path",
+          "release-passport-impact-json",
+          "release-passport-output-dir",
+          "release-passport-product-name",
+          "required-status-check",
+          "target-ref",
+          "target-sha",
+          "toolchain-type",
+          "verify-command",
+          "working-directory"
+        ],
+        "inputCount": 25,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "github-release-url",
+          "package-name",
+          "package-version",
+          "public-release-tag",
+          "release-passport-path"
+        ],
+        "outputCount": 5
+      },
       {
         "id": "paper-release",
         "path": ".github/workflows/paper-release.yml",
@@ -1492,7 +1540,11 @@
           "buildchain-ref",
           "buildchain-repository",
           "node-version",
+          "package-name",
+          "prepare-paper-package",
+          "publish-dist-tag",
           "setup-node",
+          "target-ref",
           "toolchain-command",
           "toolchain-digest",
           "toolchain-image",
@@ -1500,7 +1552,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 17,
+        "inputCount": 21,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
@@ -1511,13 +1563,17 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
+          "package-name",
+          "package-version",
           "publication-artifact-name",
           "publication-manifest-json",
           "publication-manifest-path",
           "publication-passport-path",
-          "publication-registry-path"
+          "publication-registry-path",
+          "publish-dist-tag",
+          "runtime-sha"
         ],
-        "outputCount": 12
+        "outputCount": 16
       },
       {
         "id": "release-candidate-promote",
@@ -3331,8 +3387,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "a6daf4822365bf576425777230246046ebca67b3f8dcfea61fc7a61773776185",
-    "workflowRegistryDigest": "2b36c3c532082a835a2054ce565b4b5ca39ef1c09b8188a080d5dc4a5909218b",
-    "pageRegistryDigest": "dc526c6f9aefa92aa566a9664374eb4f177f4b3ae5b9480eb94abbbf3a257a30"
+    "workflowRegistryDigest": "a61b85b07185e02e340c27d50f77a6710968db87dd42d1b1f4dd81260779a0ed",
+    "pageRegistryDigest": "3a4779e3d85d0a175e33c7d2a8bee30ede3931cc721a7d8c422ab321f0dec723"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -306,6 +306,22 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/paper-release-sealed.yml",
+      "authorityClass": "product-publication",
+      "publicationCapable": true,
+      "capabilityIds": [
+        "github-release",
+        "npm-publish"
+      ],
+      "credentialMode": "trusted-publishing",
+      "publisherWorkflowMode": "caller-bound",
+      "publisherWorkflowPath": ".github/workflows/paper-release-sealed.yml",
+      "environment": "none",
+      "environmentMode": "fixed",
+      "runnerPolicy": "qualified-measured",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/paper-release.yml",
       "authorityClass": "product-publication",
@@ -655,6 +671,14 @@
       ],
       "classified": true
     },
+    {
+      "path": ".github/workflows/paper-release-sealed.yml",
+      "signals": [
+        "write-permission",
+        "oidc"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/paper-release.yml",
       "signals": [
@@ -750,5 +774,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "a606a7da7188a8eee970d63b15f859b99024c246fb698d74e04fd548d2552c55"
+  "registryDigest": "760215fb39e6c85890c925e924c538a766d78abd6319794c8799fb47c23dec3d"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-14T23:50:10.932Z",
-  "publishedAt": "2026-07-14T23:50:10.932Z",
+  "generatedAt": "2026-07-15T01:31:56.311Z",
+  "publishedAt": "2026-07-15T01:31:56.311Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "24fef92c4300b69ece36dcfaa9c1453ed6fb588e",
+  "sourceRevision": "a2f11bfd2bae6539f0196ef8fd9571130a809918",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.6",
+    "version": "2.12.7-alpha.8",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-14T23:50:10.932Z",
-  "publishedAt": "2026-07-14T23:50:10.932Z",
+  "generatedAt": "2026-07-15T01:31:56.311Z",
+  "publishedAt": "2026-07-15T01:31:56.311Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "24fef92c4300b69ece36dcfaa9c1453ed6fb588e",
+  "sourceRevision": "a2f11bfd2bae6539f0196ef8fd9571130a809918",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.6",
+    "version": "2.12.7-alpha.8",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -215,14 +215,18 @@
       "reusable": true,
       "inputs": [
         "admission-json",
+        "authority-workflow-path",
         "auto-admission",
+        "auto-admission-kind",
         "buildchain-ref",
         "buildchain-repository",
         "control-plane-audit-json",
         "dry-run",
+        "evidence-controller-artifact",
         "evidence-manifest-pattern",
         "evidence-passport-artifact",
         "evidence-payload-pattern",
+        "evidence-publication-artifact",
         "evidence-repository",
         "evidence-run-id",
         "evidence-summary-artifact",
@@ -233,12 +237,13 @@
         "publication-target",
         "publication-version",
         "publisher-workflow-path",
+        "required-status-check",
         "runner-provenance-json",
         "source-sha",
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 23,
+      "inputCount": 28,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1025,6 +1030,52 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": "paper-release-sealed",
+      "path": ".github/workflows/paper-release-sealed.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-name",
+        "artifact-paths",
+        "artifact-retention-days",
+        "branch-protection-bypass-apps",
+        "branch-protection-bypass-teams",
+        "branch-protection-bypass-users",
+        "buildchain-contract-lock-path",
+        "buildchain-ref",
+        "buildchain-repository",
+        "dry-run",
+        "github-release",
+        "github-release-notes",
+        "github-release-title",
+        "package-name",
+        "publish-dist-tag",
+        "publisher-workflow-path",
+        "release-passport-impact-json",
+        "release-passport-output-dir",
+        "release-passport-product-name",
+        "required-status-check",
+        "target-ref",
+        "target-sha",
+        "toolchain-type",
+        "verify-command",
+        "working-directory"
+      ],
+      "inputCount": 25,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "github-release-url",
+        "package-name",
+        "package-version",
+        "public-release-tag",
+        "release-passport-path"
+      ],
+      "outputCount": 5,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": "paper-release",
       "path": ".github/workflows/paper-release.yml",
@@ -1194,7 +1245,11 @@
         "buildchain-ref",
         "buildchain-repository",
         "node-version",
+        "package-name",
+        "prepare-paper-package",
+        "publish-dist-tag",
         "setup-node",
+        "target-ref",
         "toolchain-command",
         "toolchain-digest",
         "toolchain-image",
@@ -1202,7 +1257,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 17,
+      "inputCount": 21,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1213,13 +1268,17 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
+        "package-name",
+        "package-version",
         "publication-artifact-name",
         "publication-manifest-json",
         "publication-manifest-path",
         "publication-passport-path",
-        "publication-registry-path"
+        "publication-registry-path",
+        "publish-dist-tag",
+        "runtime-sha"
       ],
-      "outputCount": 12,
+      "outputCount": 16,
       "surface": "repository-workflow",
       "capabilityGroup": "reusable-build",
       "status": "active"

package/docs/publication-artifacts.md

@@ -182,40 +182,37 @@ on:
 
 jobs:
   paper-release:
-    uses: kungfu-systems/buildchain/.github/workflows/paper-release.yml@v2
+    uses: kungfu-systems/buildchain/.github/workflows/paper-release-sealed.yml@v2
     permissions:
+      actions: read
       checks: write
       contents: write
       id-token: write
       issues: write
     with:
       buildchain-ref: ${{ inputs.buildchain-ref || '' }}
-      publication-admission-json: ${{ needs.authority.outputs.admission-json }}
-      publication-runner-provenance-json: ${{ needs.authority.outputs.runner-provenance-json }}
-      publication-control-plane-audit-json: ${{ needs.authority.outputs.control-plane-audit-json }}
-      publication-expected-json: ${{ needs.authority.outputs.expected-json }}
+      publisher-workflow-path: .github/workflows/paper-release.yml
       toolchain-type: config
       verify-command: make check
+      artifact-paths: _build/paper-name.pdf
       buildchain-contract-lock-path: .buildchain/contract-lock.json
 ```
 
-The publication job does not accept a long-lived promotion token. The caller
-must first produce a fresh sealed admission, runner provenance, external
-control-plane audit, and exact expected bindings. The credential-free verifier
-job checks those receipts; only then can the publication job use its short-lived
-`github.token` and caller-bound OIDC trusted publisher identity. npm binds that
-identity to the consumer workflow filename; an npm Environment restriction is
-optional and must be represented explicitly when configured. The workflow fails
-before the publication build when the target branch protection cannot be read.
+The sealed preset does not accept a long-lived promotion token. It builds and
+packages the paper in a read-only job, then a credential-free authority job
+downloads that exact candidate, audits the external control plane, and seals a
+capability over the source tree, Buildchain runtime, controller receipt, PDF,
+and npm package bytes. Only the final job receives write and OIDC permissions;
+it downloads the admitted candidate, recomputes the capability binding, and
+publishes without executing consumer build commands. npm binds the OIDC identity
+to the consumer workflow named by `publisher-workflow-path`.
 
 The preset:
 
-- resolves the same floating Buildchain runtime and contract lock as the build
-  workflow;
-- verifies that the declared promotion authority can read the protected target
-  channel before starting the publication build;
+- resolves the floating Buildchain runtime once and binds the exact SHA into the
+  publication candidate and authority capability;
 - builds the PDF through the declared pinned LaTeX Docker toolchain or custom
-  command;
+  command in a read-only job;
 - verifies the paper repository;
 - writes the publication manifest, publication passport, optional archive
   registry, and source bundle;
@@ -226,7 +223,8 @@ The preset:
 - creates a `publish-gate/<alpha|release>/.../<version>` source lock for the
   channel commit and requires `promote-buildchain-ref` to verify that lock
   before any publish side effect;
-- publishes the package through npm Trusted Publishing;
+- verifies the complete candidate again after authority and publishes the
+  package through npm Trusted Publishing without rebuilding it;
 - writes Buildchain release/passport evidence; and
 - creates or updates the exact-version GitHub Release by default, uploading
   every file declared by `publication.primary_artifact` and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.7-alpha.6",
+  "version": "2.12.7-alpha.8",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-publication-authority.js

@@ -27,6 +27,7 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
   [".github/workflows/npm-publish.yml", "dry-run-only"],
+  [".github/workflows/paper-release-sealed.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/paper-release.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/patrol-daily.yml", "governance-write"],
   [".github/workflows/patrol-monthly.yml", "governance-write"],

package/packages/core/index.js

@@ -153,6 +153,12 @@ export {
   verifyPublicationAdmission,
 } from "./publication-authority.js";
 
+export {
+  PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT,
+  createPublicationArtifactCandidate,
+  publicationArtifactCandidateDigest,
+} from "./publication-artifact-candidate.js";
+
 export {
   buildchainPublicationAuthorityDescriptors,
   createBuildchainPublicationAuthorityRegistry,

package/packages/core/publication-artifact-candidate.js

@@ -0,0 +1,116 @@
+import crypto from "node:crypto";
+
+import { validateControllerReceipt } from "./controller-evidence.js";
+
+export const PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT =
+  "kungfu-buildchain-publication-artifact-candidate";
+
+const MANIFEST_CONTRACT = "kungfu-buildchain-publication-artifact-manifest";
+const PASSPORT_CONTRACT = "kungfu-buildchain-publication-artifact-passport";
+
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+export function publicationArtifactCandidateDigest(value) {
+  return crypto.createHash("sha256").update(stableJson(value)).digest("hex");
+}
+
+function requiredString(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} must be a non-empty string`);
+  return normalized;
+}
+
+function normalizeDigest(value, label) {
+  const normalized = requiredString(value, label).replace(/^sha256:/, "").toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(normalized)) throw new Error(`${label} must be a sha256 digest`);
+  return normalized;
+}
+
+function normalizeGitSha(value, label) {
+  const normalized = requiredString(value, label).toLowerCase();
+  if (!/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(normalized)) {
+    throw new Error(`${label} must be a 40- or 64-character Git SHA`);
+  }
+  return normalized;
+}
+
+export function createPublicationArtifactCandidate({
+  repository,
+  sourceSha,
+  sourceTreeSha,
+  runtimeSha,
+  manifest,
+  passport,
+  controllerReceipt,
+  files = [],
+} = {}) {
+  const normalizedRepository = requiredString(repository, "repository");
+  const normalizedSourceSha = normalizeGitSha(sourceSha, "sourceSha");
+  const normalizedSourceTreeSha = normalizeGitSha(sourceTreeSha, "sourceTreeSha");
+  const normalizedRuntimeSha = normalizeGitSha(runtimeSha, "runtimeSha");
+  if (manifest?.contract !== MANIFEST_CONTRACT) throw new Error("publication artifact manifest contract mismatch");
+  if (passport?.contract !== PASSPORT_CONTRACT || passport.status !== "passed") {
+    throw new Error("publication artifact passport is not qualifying");
+  }
+  if (manifest.source?.sha !== normalizedSourceSha || passport.source?.sha !== normalizedSourceSha) {
+    throw new Error("publication artifact source SHA mismatch");
+  }
+  if (manifest.source?.treeSha !== normalizedSourceTreeSha || passport.source?.treeSha !== normalizedSourceTreeSha) {
+    throw new Error("publication artifact source tree mismatch");
+  }
+  const manifestDigest = crypto.createHash("sha256").update(JSON.stringify(manifest, null, 2)).digest("hex");
+  if (normalizeDigest(passport.manifestDigest, "passport.manifestDigest") !== manifestDigest) {
+    throw new Error("publication artifact passport manifest digest mismatch");
+  }
+  const controllerValidation = validateControllerReceipt(controllerReceipt, {
+    expectedSourceSha: normalizedSourceSha,
+    expectedRuntimeSha: normalizedRuntimeSha,
+  });
+  if (!controllerValidation.ok || !controllerValidation.qualifying) {
+    throw new Error(`publication artifact controller receipt did not qualify: ${controllerValidation.issues.join("; ")}`);
+  }
+  const evidenceKinds = new Set((controllerReceipt.evidence || []).map((entry) => entry.kind));
+  for (const kind of ["publication-manifest", "publication-passport"]) {
+    if (!evidenceKinds.has(kind)) throw new Error(`publication artifact controller receipt is missing ${kind} evidence`);
+  }
+  const normalizedFiles = files.map((entry, index) => {
+    const filePath = requiredString(entry.path, `files[${index}].path`).replaceAll("\\", "/");
+    if (filePath.startsWith("/") || filePath.split("/").includes("..")) {
+      throw new Error(`publication artifact candidate contains an unsafe path: ${filePath}`);
+    }
+    const size = Number(entry.size ?? entry.bytes);
+    if (!Number.isSafeInteger(size) || size < 0) throw new Error(`files[${index}].size must be a non-negative safe integer`);
+    return { path: filePath, size, sha256: normalizeDigest(entry.sha256, `files[${index}].sha256`) };
+  }).sort((left, right) => left.path.localeCompare(right.path));
+  if (new Set(normalizedFiles.map((entry) => entry.path)).size !== normalizedFiles.length) {
+    throw new Error("publication artifact candidate file paths must be unique");
+  }
+  const byPath = new Map(normalizedFiles.map((entry) => [entry.path, entry]));
+  for (const [index, artifact] of (manifest.artifacts || []).entries()) {
+    const artifactPath = requiredString(artifact.path, `manifest.artifacts[${index}].path`);
+    const actual = byPath.get(artifactPath);
+    if (!actual) throw new Error(`publication artifact candidate is missing declared artifact: ${artifactPath}`);
+    if (actual.size !== Number(artifact.bytes) || actual.sha256 !== normalizeDigest(artifact.sha256, `manifest.artifacts[${index}].sha256`)) {
+      throw new Error(`publication artifact candidate bytes do not match manifest: ${artifactPath}`);
+    }
+  }
+  const payload = {
+    schemaVersion: 1,
+    contract: PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT,
+    repository: normalizedRepository,
+    sourceSha: normalizedSourceSha,
+    sourceTreeSha: normalizedSourceTreeSha,
+    runtimeSha: normalizedRuntimeSha,
+    manifestDigest,
+    passportDigest: publicationArtifactCandidateDigest(passport),
+    controllerReceiptDigest: normalizeDigest(controllerReceipt.digest, "controllerReceipt.digest"),
+    files: normalizedFiles,
+  };
+  return { ...payload, candidateDigest: publicationArtifactCandidateDigest(payload) };
+}

package/packages/core/publication-authority.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 
 import { validateControllerReceipt } from "./controller-evidence.js";
+import { createPublicationArtifactCandidate } from "./publication-artifact-candidate.js";
 import { sha256Json, validateReleaseCandidatePassport } from "./release-candidate.js";
 
 export const PUBLICATION_AUTHORITY_REGISTRY_CONTRACT =
@@ -381,6 +382,7 @@ export function createPublicationArtifactManifestSet({
 }
 
 function validateGateAggregate(gateAggregate, { admission, passport }) {
+  const passportSourceSha = passport.source?.headSha || passport.source?.sha;
   if (gateAggregate?.contract === "buildchain.shifu-gate-aggregate/v1") {
     const { digest, ...payload } = gateAggregate;
     const actualDigest = sha256Json(payload);
@@ -390,7 +392,7 @@ function validateGateAggregate(gateAggregate, { admission, passport }) {
     if (gateAggregate.status !== "pass" || gateAggregate.qualifying !== true) {
       throw new Error("gate aggregate is not qualifying");
     }
-    if (![admission.sourceSha, passport.source?.headSha].includes(gateAggregate.sourceSha)) {
+    if (![admission.sourceSha, passportSourceSha].includes(gateAggregate.sourceSha)) {
       throw new Error("gate aggregate source SHA mismatch");
     }
     normalizeDigest(gateAggregate.registry?.digest, "gateAggregate.registry.digest");
@@ -408,7 +410,7 @@ function validateGateAggregate(gateAggregate, { admission, passport }) {
   if (gateAggregate.required !== false) {
     throw new Error("a required Gate policy must supply a qualifying Shifu Gate aggregate");
   }
-  if (![admission.sourceSha, passport.source?.headSha].includes(gateAggregate.sourceSha)) {
+  if (![admission.sourceSha, passportSourceSha].includes(gateAggregate.sourceSha)) {
     throw new Error("publication Gate decision source SHA mismatch");
   }
   const normalizedPolicy = {
@@ -428,6 +430,43 @@ function validatePublicationEvidence(publicationEvidence, admission) {
   if (!publicationEvidence || typeof publicationEvidence !== "object" || Array.isArray(publicationEvidence)) {
     throw new Error("independent publication evidence is required");
   }
+  if (publicationEvidence.publicationArtifactCandidate) {
+    const candidate = createPublicationArtifactCandidate(publicationEvidence.publicationArtifactCandidate);
+    const passport = publicationEvidence.publicationArtifactCandidate.passport;
+    const controllerReceipt = publicationEvidence.publicationArtifactCandidate.controllerReceipt;
+    const controllerReceiptDigest = normalizeDigest(controllerReceipt.digest, "controllerReceipt.digest");
+    if (controllerReceiptDigest !== normalizeDigest(admission.controllerReceiptDigest, "admission.controllerReceiptDigest")) {
+      throw new Error("controller receipt evidence binding mismatch");
+    }
+    const contractDigest = normalizeDigest(controllerReceipt.runtime?.contractDigest, "controllerReceipt.runtime.contractDigest");
+    if (contractDigest !== normalizeDigest(admission.contractDigest, "admission.contractDigest")) {
+      throw new Error("runtime contract evidence binding mismatch");
+    }
+    const gate = validateGateAggregate(publicationEvidence.gateAggregate, { admission, passport });
+    if (gate.gateAggregateDigest !== normalizeDigest(admission.gateAggregateDigest, "admission.gateAggregateDigest")) {
+      throw new Error("Gate aggregate evidence binding mismatch");
+    }
+    if (gate.policyDigest !== normalizeDigest(admission.policyDigest, "admission.policyDigest")) {
+      throw new Error("Gate policy evidence binding mismatch");
+    }
+    if (candidate.candidateDigest !== normalizeDigest(admission.artifactDigest, "admission.artifactDigest")) {
+      throw new Error("publication artifact candidate evidence binding mismatch");
+    }
+    return {
+      sourceTreeSha: candidate.sourceTreeSha,
+      controllerReceiptDigest,
+      contractDigest,
+      gateAggregateDigest: gate.gateAggregateDigest,
+      policyDigest: gate.policyDigest,
+      artifactDigest: candidate.candidateDigest,
+      evidenceDigest: publicationAuthorityDigest({
+        sourceTreeSha: candidate.sourceTreeSha,
+        controllerReceiptDigest,
+        gateAggregateDigest: gate.gateAggregateDigest,
+        artifactDigest: candidate.candidateDigest,
+      }),
+    };
+  }
   const passport = publicationEvidence.releaseCandidatePassport;
   const buildSummary = publicationEvidence.buildSummary;
   const passportValidation = validateReleaseCandidatePassport({