@kungfu-tech/buildchain 2.13.0-alpha.0 → 2.13.0-alpha.1

package/dist/site/public-surface-audit.json

@@ -626,6 +626,9 @@
           "auto-no-gate",
           "buildchain-ref",
           "buildchain-repository",
+          "consumer-predicate-digest",
+          "consumer-predicate-id",
+          "consumer-qualification-required",
           "control-plane-audit-json",
           "dry-run",
           "evidence-controller-artifact",
@@ -649,15 +652,17 @@
           "target-ref",
           "used-nonces-json"
         ],
-        "inputCount": 29,
+        "inputCount": 32,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
           "capability-artifact",
           "capability-digest",
-          "capability-json"
+          "capability-json",
+          "gate-aggregate-digest",
+          "gate-aggregate-json"
         ],
-        "outputCount": 3
+        "outputCount": 5
       },
       {
         "id": ".release-docker",
@@ -1615,6 +1620,8 @@
           "publication-admission-json",
           "publication-auto-admission",
           "publication-auto-no-gate",
+          "publication-consumer-predicate-id",
+          "publication-consumer-qualification-command",
           "publication-control-plane-audit-json",
           "publication-expected-json",
           "publication-gate-aggregate-json",
@@ -1624,6 +1631,7 @@
           "publication-runner-provenance-json",
           "publication-target",
           "publication-used-nonces-json",
+          "publication-used-qualification-nonces-json",
           "publish-artifact-kind",
           "publish-command",
           "publish-dist-tag",
@@ -1652,7 +1660,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 56,
+        "inputCount": 59,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1835,6 +1843,10 @@
           "github-release-notes",
           "github-release-title",
           "promote-only-release-candidate",
+          "publication-capability-json",
+          "publication-gate-aggregate-json",
+          "publication-qualification-receipt-json",
+          "publication-used-qualification-nonces-json",
           "publish-auth",
           "publish-command",
           "publish-dist-tag",
@@ -1867,6 +1879,7 @@
           "release-passport-platform-manifest-paths",
           "release-passport-product-name",
           "require-governance",
+          "require-publication-qualification",
           "require-publish-source-lock",
           "require-version-state",
           "required-status-check",
@@ -1877,7 +1890,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 54
+        "inputCount": 59
       },
       {
         "id": "report-buildchain-issue",
@@ -3428,8 +3441,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "ff1772371ec74271c21b6723dad0745a080347be8feef36a37e3948ebd19993d",
-    "workflowRegistryDigest": "c496f3c91b98409ecadf252ac087e620bb95c02222690ec4543013d0740190d1",
-    "pageRegistryDigest": "246e694c72df3166277b128d60bf18bf58c15583d0b70f5652dd4f342510fcdc"
+    "workflowRegistryDigest": "f4dc70cba95a30b79eadbffc3a4ba5f8d382aae220a7bc13965365c2bbd5e674",
+    "pageRegistryDigest": "f06ce732622727942f855a2e7e9639fb274722fb4bd2ca8e24fc677ffcdf7d5d"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-15T16:38:35.118Z",
-  "publishedAt": "2026-07-15T16:38:35.118Z",
+  "generatedAt": "2026-07-16T00:47:22.222Z",
+  "publishedAt": "2026-07-16T00:47:22.222Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "aa454f78402e4e89a05592f8714e2d0f55f10c86",
+  "sourceRevision": "b4ee7448f7de3f9dce8f390db06c26569d3ddefe",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.13.0-alpha.0",
+    "version": "2.13.0-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-15T16:38:35.118Z",
-  "publishedAt": "2026-07-15T16:38:35.118Z",
+  "generatedAt": "2026-07-16T00:47:22.222Z",
+  "publishedAt": "2026-07-16T00:47:22.222Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "aa454f78402e4e89a05592f8714e2d0f55f10c86",
+  "sourceRevision": "b4ee7448f7de3f9dce8f390db06c26569d3ddefe",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.13.0-alpha.0",
+    "version": "2.13.0-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -85,7 +85,7 @@
       "path": "docs/publication-authority.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:05bc22c7e5885e591bc121fc43f588e5d49ccf0a8de6a642811c1d0d03dcee1e"
+      "digest": "sha256:920d4f14902ded1999f46d39f6d02db8cb5be6f22e376f6f2d456b3a1cc0c674"
     },
     {
       "id": "release-candidate",
@@ -93,7 +93,7 @@
       "path": "docs/release-candidate.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:554613c963f57cc391acbd072bf73e1a2543d9bd1371087d4411577cccbf817c"
+      "digest": "sha256:1fc581cf1b4e4a202464c8d6671b3bff12d0b349760246a951e88ef524f99e6b"
     },
     {
       "id": "release-propagation",
@@ -237,7 +237,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:03108f05a608cb0849e7a668fe23671b62863907ce02a70bc6522eb8074f3e63"
+      "digest": "sha256:82160f0fd9e45f08dbfbaf8037e0895cbeecf251feca8bdaff607dcc030b3e28"
     },
     {
       "id": "release-flow",

package/dist/site/workflow-registry.json

@@ -222,6 +222,9 @@
         "auto-no-gate",
         "buildchain-ref",
         "buildchain-repository",
+        "consumer-predicate-digest",
+        "consumer-predicate-id",
+        "consumer-qualification-required",
         "control-plane-audit-json",
         "dry-run",
         "evidence-controller-artifact",
@@ -245,15 +248,17 @@
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 29,
+      "inputCount": 32,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
         "capability-artifact",
         "capability-digest",
-        "capability-json"
+        "capability-json",
+        "gate-aggregate-digest",
+        "gate-aggregate-json"
       ],
-      "outputCount": 3,
+      "outputCount": 5,
       "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
       "status": "active"
@@ -1313,6 +1318,8 @@
         "publication-admission-json",
         "publication-auto-admission",
         "publication-auto-no-gate",
+        "publication-consumer-predicate-id",
+        "publication-consumer-qualification-command",
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
@@ -1322,6 +1329,7 @@
         "publication-runner-provenance-json",
         "publication-target",
         "publication-used-nonces-json",
+        "publication-used-qualification-nonces-json",
         "publish-artifact-kind",
         "publish-command",
         "publish-dist-tag",
@@ -1350,7 +1358,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 56,
+      "inputCount": 59,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1561,6 +1569,10 @@
         "github-release-notes",
         "github-release-title",
         "promote-only-release-candidate",
+        "publication-capability-json",
+        "publication-gate-aggregate-json",
+        "publication-qualification-receipt-json",
+        "publication-used-qualification-nonces-json",
         "publish-auth",
         "publish-command",
         "publish-dist-tag",
@@ -1593,6 +1605,7 @@
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
         "require-governance",
+        "require-publication-qualification",
         "require-publish-source-lock",
         "require-version-state",
         "required-status-check",
@@ -1603,7 +1616,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 54,
+      "inputCount": 59,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/publication-authority.md

@@ -136,6 +136,32 @@ publication capability.
 Evidence publication is a separate authority class and never grants product
 publication.
 
+## Consumer qualification handoff
+
+Consumers may explicitly opt in to a final, consumer-owned qualification
+predicate. Buildchain then transports the complete Gate aggregate alongside the
+sealed capability instead of reducing it to a summary. The capability binds the
+authority registry, consumer Gate registry and policy, exact source and runtime,
+controller, runner, control-plane, artifact, provider target, channel, version,
+freshness window, nonce, and exact predicate command digest.
+
+The predicate runs in a separate job with read-only source access, no inherited
+secrets, no OIDC permission, and no provider write permission. It receives only
+paths to `capability.json` and `gate-aggregate.json` plus the exact predicate id
+and digest. The consumer writes a
+`kungfu-buildchain-consumer-publication-decision`; Buildchain seals that result
+as a deterministic
+`kungfu-buildchain-publication-qualification-receipt`. Buildchain does not parse
+product-specific Gate meanings.
+
+The provider action revalidates the capability, full aggregate, receipt,
+predicate identity, freshness, nonce, source, version, channel, target, and all
+sealed digests immediately before the publish transaction. Missing, denied,
+stale, replayed, substituted, or drifted receipts fail before provider mutation.
+Direct calls to the provider action cannot bypass the receipt when
+`require-publication-qualification` is enabled. Consumers that do not opt in
+retain the existing publication contract.
+
 ## API and CLI
 
 Use `@kungfu-tech/buildchain/publication-authority` or run:

package/docs/release-candidate.md

@@ -140,3 +140,22 @@ consumer with a Shifu Gate registry supplies `publication-gate-aggregate-json`
 instead. Buildchain still requires caller-owned RC evidence, an exact authority
 runtime and source SHA, a repository-local publisher workflow, matching npm
 target/package identity, and a qualifying control-plane audit.
+
+A consumer that owns additional product qualification semantics can opt in to
+the sealed handoff without teaching Buildchain those semantics:
+
+```yaml
+      publication-consumer-predicate-id: kungfu.release-admission/v1
+      publication-consumer-qualification-command: node scripts/qualify-release.mjs
+```
+
+The command reads `BUILDCHAIN_PUBLICATION_CAPABILITY_PATH` and
+`BUILDCHAIN_PUBLICATION_GATE_AGGREGATE_PATH`, evaluates the complete aggregate,
+and writes a decision JSON document to
+`BUILDCHAIN_PUBLICATION_QUALIFICATION_RESULT_PATH`. It also receives
+`BUILDCHAIN_PUBLICATION_PREDICATE_ID` and
+`BUILDCHAIN_PUBLICATION_PREDICATE_DIGEST`. The separate qualification job has
+no write or OIDC permission and does not inherit publication secrets. A
+successful deterministic receipt is rechecked by the provider action
+immediately before mutation. Omitting both inputs preserves the existing
+consumer contract; supplying only one fails closed.

package/docs/release-governance.md

@@ -590,7 +590,11 @@ Buildchain's own promotion workflow reads `BUILDCHAIN_PROMOTION_BYPASS_APPS`,
 `BUILDCHAIN_PROMOTION_BYPASS_TEAMS` repository variables so the declared bypass
 identity can match the actual `BUILDCHAIN_PROMOTION_TOKEN` actor, but consumers
 do not need to duplicate that actor manually when the token identity is
-discoverable.
+discoverable. Buildchain's release-line bootstrap applies the same declared
+allowances when it creates new `dev`, `alpha`, and `release` branch protection,
+and fails closed before changing protection when no promotion authority is
+declared. This keeps a new minor line publishable without weakening its normal
+human review gate.
 
 ## What This Guarantees
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.13.0-alpha.0",
+  "version": "2.13.0-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/index.js

@@ -138,19 +138,25 @@ export {
   PUBLICATION_AUTHORITY_CLASSES,
   PUBLICATION_AUTHORITY_REGISTRY_CONTRACT,
   PUBLICATION_CAPABILITY_CONTRACT,
+  CONSUMER_PUBLICATION_DECISION_CONTRACT,
   PUBLICATION_CONTROL_PLANE_AUDIT_CONTRACT,
   PUBLICATION_GATE_DECISION_CONTRACT,
+  PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT,
   RUNNER_PROVENANCE_CLASSES,
   RUNNER_PROVENANCE_CONTRACT,
   createPublicationAuthorityRegistry,
   createPublicationAdmission,
   createPublicationArtifactManifestSet,
+  createConsumerPublicationDecision,
   createPublicationControlPlaneAudit,
   createPublicationGateDecision,
+  createPublicationQualificationReceipt,
   createRunnerProvenance,
   detectPublicationAuthoritySignals,
   publicationAuthorityDigest,
+  publicationGateAggregateBindings,
   verifyPublicationAdmission,
+  verifyPublicationQualificationReceipt,
 } from "./publication-authority.js";
 
 export {