@kungfu-tech/buildchain 2.13.0-alpha.0 → 2.13.0-alpha.2

package/dist/site/public-surface-audit.json

@@ -626,6 +626,9 @@
           "auto-no-gate",
           "buildchain-ref",
           "buildchain-repository",
+          "consumer-predicate-digest",
+          "consumer-predicate-id",
+          "consumer-qualification-required",
           "control-plane-audit-json",
           "dry-run",
           "evidence-controller-artifact",
@@ -649,15 +652,17 @@
           "target-ref",
           "used-nonces-json"
         ],
-        "inputCount": 29,
+        "inputCount": 32,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
           "capability-artifact",
           "capability-digest",
-          "capability-json"
+          "capability-json",
+          "gate-aggregate-digest",
+          "gate-aggregate-json"
         ],
-        "outputCount": 3
+        "outputCount": 5
       },
       {
         "id": ".release-docker",
@@ -1615,6 +1620,8 @@
           "publication-admission-json",
           "publication-auto-admission",
           "publication-auto-no-gate",
+          "publication-consumer-predicate-id",
+          "publication-consumer-qualification-command",
           "publication-control-plane-audit-json",
           "publication-expected-json",
           "publication-gate-aggregate-json",
@@ -1624,6 +1631,7 @@
           "publication-runner-provenance-json",
           "publication-target",
           "publication-used-nonces-json",
+          "publication-used-qualification-nonces-json",
           "publish-artifact-kind",
           "publish-command",
           "publish-dist-tag",
@@ -1652,7 +1660,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 56,
+        "inputCount": 59,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1835,6 +1843,10 @@
           "github-release-notes",
           "github-release-title",
           "promote-only-release-candidate",
+          "publication-capability-json",
+          "publication-gate-aggregate-json",
+          "publication-qualification-receipt-json",
+          "publication-used-qualification-nonces-json",
           "publish-auth",
           "publish-command",
           "publish-dist-tag",
@@ -1867,6 +1879,7 @@
           "release-passport-platform-manifest-paths",
           "release-passport-product-name",
           "require-governance",
+          "require-publication-qualification",
           "require-publish-source-lock",
           "require-version-state",
           "required-status-check",
@@ -1877,7 +1890,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 54
+        "inputCount": 59
       },
       {
         "id": "report-buildchain-issue",
@@ -3428,8 +3441,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "ff1772371ec74271c21b6723dad0745a080347be8feef36a37e3948ebd19993d",
-    "workflowRegistryDigest": "c496f3c91b98409ecadf252ac087e620bb95c02222690ec4543013d0740190d1",
-    "pageRegistryDigest": "246e694c72df3166277b128d60bf18bf58c15583d0b70f5652dd4f342510fcdc"
+    "workflowRegistryDigest": "f4dc70cba95a30b79eadbffc3a4ba5f8d382aae220a7bc13965365c2bbd5e674",
+    "pageRegistryDigest": "5df8fd620c13f894a00ecc7159b7a53f518692d3d2ab3ad0b78687582efa406a"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-15T16:38:35.118Z",
-  "publishedAt": "2026-07-15T16:38:35.118Z",
+  "generatedAt": "2026-07-16T02:29:49.950Z",
+  "publishedAt": "2026-07-16T02:29:49.950Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "aa454f78402e4e89a05592f8714e2d0f55f10c86",
+  "sourceRevision": "87491685ffc7b6522176f8e7519f6c595e9bf5a7",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.13.0-alpha.0",
+    "version": "2.13.0-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-15T16:38:35.118Z",
-  "publishedAt": "2026-07-15T16:38:35.118Z",
+  "generatedAt": "2026-07-16T02:29:49.950Z",
+  "publishedAt": "2026-07-16T02:29:49.950Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "aa454f78402e4e89a05592f8714e2d0f55f10c86",
+  "sourceRevision": "87491685ffc7b6522176f8e7519f6c595e9bf5a7",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.13.0-alpha.0",
+    "version": "2.13.0-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -61,7 +61,7 @@
       "path": "docs/install.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:2600738a92b5853bc26d4e01211f0c07b8b36a21d4d72ca809bc6032dff5dc5f"
+      "digest": "sha256:1879849c01f82b8820f2d9aeb09faed0931954cb7fe6939176a5eb69110cee59"
     },
     {
       "id": "release-passport",
@@ -85,7 +85,7 @@
       "path": "docs/publication-authority.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:05bc22c7e5885e591bc121fc43f588e5d49ccf0a8de6a642811c1d0d03dcee1e"
+      "digest": "sha256:920d4f14902ded1999f46d39f6d02db8cb5be6f22e376f6f2d456b3a1cc0c674"
     },
     {
       "id": "release-candidate",
@@ -93,7 +93,7 @@
       "path": "docs/release-candidate.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:554613c963f57cc391acbd072bf73e1a2543d9bd1371087d4411577cccbf817c"
+      "digest": "sha256:1fc581cf1b4e4a202464c8d6671b3bff12d0b349760246a951e88ef524f99e6b"
     },
     {
       "id": "release-propagation",
@@ -229,7 +229,7 @@
       "path": "docs/publish-transaction.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:8d5d7075cf8b4280a4c5097726f5c51ae40db83e2652eafefe4fa5e487794f57"
+      "digest": "sha256:9e77030dbd69e27c2402d855980f7560a465270cac1f3225c0470523ab4a8ddf"
     },
     {
       "id": "release-governance",
@@ -237,7 +237,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:03108f05a608cb0849e7a668fe23671b62863907ce02a70bc6522eb8074f3e63"
+      "digest": "sha256:cb6aafc3410c0e72da3d9c3ba330421005af27c3c67665a2f3356603f02da84a"
     },
     {
       "id": "release-flow",

package/dist/site/workflow-registry.json

@@ -222,6 +222,9 @@
         "auto-no-gate",
         "buildchain-ref",
         "buildchain-repository",
+        "consumer-predicate-digest",
+        "consumer-predicate-id",
+        "consumer-qualification-required",
         "control-plane-audit-json",
         "dry-run",
         "evidence-controller-artifact",
@@ -245,15 +248,17 @@
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 29,
+      "inputCount": 32,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
         "capability-artifact",
         "capability-digest",
-        "capability-json"
+        "capability-json",
+        "gate-aggregate-digest",
+        "gate-aggregate-json"
       ],
-      "outputCount": 3,
+      "outputCount": 5,
       "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
       "status": "active"
@@ -1313,6 +1318,8 @@
         "publication-admission-json",
         "publication-auto-admission",
         "publication-auto-no-gate",
+        "publication-consumer-predicate-id",
+        "publication-consumer-qualification-command",
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
@@ -1322,6 +1329,7 @@
         "publication-runner-provenance-json",
         "publication-target",
         "publication-used-nonces-json",
+        "publication-used-qualification-nonces-json",
         "publish-artifact-kind",
         "publish-command",
         "publish-dist-tag",
@@ -1350,7 +1358,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 56,
+      "inputCount": 59,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1561,6 +1569,10 @@
         "github-release-notes",
         "github-release-title",
         "promote-only-release-candidate",
+        "publication-capability-json",
+        "publication-gate-aggregate-json",
+        "publication-qualification-receipt-json",
+        "publication-used-qualification-nonces-json",
         "publish-auth",
         "publish-command",
         "publish-dist-tag",
@@ -1593,6 +1605,7 @@
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
         "require-governance",
+        "require-publication-qualification",
         "require-publish-source-lock",
         "require-version-state",
         "required-status-check",
@@ -1603,7 +1616,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 54,
+      "inputCount": 59,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/install.md

@@ -51,7 +51,9 @@ npx buildchain version
 npx buildchain doctor --json
 ```
 
-Alpha releases publish to the `alpha` npm dist-tag. Stable releases publish to
+The highest alpha minor publishes to the `alpha` npm dist-tag; older maintenance
+minor alphas use `vX.Y-alpha` so they cannot roll the global alpha channel back.
+Stable releases publish to
 `latest`. Both are created by the protected Buildchain promotion transaction.
 
 Stable consumers should pin the exact Buildchain version they have validated,

package/docs/publication-authority.md

@@ -136,6 +136,32 @@ publication capability.
 Evidence publication is a separate authority class and never grants product
 publication.
 
+## Consumer qualification handoff
+
+Consumers may explicitly opt in to a final, consumer-owned qualification
+predicate. Buildchain then transports the complete Gate aggregate alongside the
+sealed capability instead of reducing it to a summary. The capability binds the
+authority registry, consumer Gate registry and policy, exact source and runtime,
+controller, runner, control-plane, artifact, provider target, channel, version,
+freshness window, nonce, and exact predicate command digest.
+
+The predicate runs in a separate job with read-only source access, no inherited
+secrets, no OIDC permission, and no provider write permission. It receives only
+paths to `capability.json` and `gate-aggregate.json` plus the exact predicate id
+and digest. The consumer writes a
+`kungfu-buildchain-consumer-publication-decision`; Buildchain seals that result
+as a deterministic
+`kungfu-buildchain-publication-qualification-receipt`. Buildchain does not parse
+product-specific Gate meanings.
+
+The provider action revalidates the capability, full aggregate, receipt,
+predicate identity, freshness, nonce, source, version, channel, target, and all
+sealed digests immediately before the publish transaction. Missing, denied,
+stale, replayed, substituted, or drifted receipts fail before provider mutation.
+Direct calls to the provider action cannot bypass the receipt when
+`require-publication-qualification` is enabled. Consumers that do not opt in
+retain the existing publication contract.
+
 ## API and CLI
 
 Use `@kungfu-tech/buildchain/publication-authority` or run:

package/docs/publish-transaction.md

@@ -210,7 +210,7 @@ Buildchain distinguishes two npm release modes:
 
 | Mode | Use | Auth | npm operation |
 | --- | --- | --- | --- |
-| `publish-final-version` | normal alpha or stable publication | `trusted-publishing` | `npm publish --tag <alpha|latest>` |
+| `publish-final-version` | normal alpha or stable publication | `trusted-publishing` | `npm publish --tag <alpha|vX.Y-alpha|latest>` |
 | `promote-existing-version` | same-version alpha-to-latest recovery | `npm-token` | `npm dist-tag add <pkg>@<version> latest` |
 
 The normal libnode path is `publish-final-version`: publish an alpha package set

package/docs/release-candidate.md

@@ -140,3 +140,22 @@ consumer with a Shifu Gate registry supplies `publication-gate-aggregate-json`
 instead. Buildchain still requires caller-owned RC evidence, an exact authority
 runtime and source SHA, a repository-local publisher workflow, matching npm
 target/package identity, and a qualifying control-plane audit.
+
+A consumer that owns additional product qualification semantics can opt in to
+the sealed handoff without teaching Buildchain those semantics:
+
+```yaml
+      publication-consumer-predicate-id: kungfu.release-admission/v1
+      publication-consumer-qualification-command: node scripts/qualify-release.mjs
+```
+
+The command reads `BUILDCHAIN_PUBLICATION_CAPABILITY_PATH` and
+`BUILDCHAIN_PUBLICATION_GATE_AGGREGATE_PATH`, evaluates the complete aggregate,
+and writes a decision JSON document to
+`BUILDCHAIN_PUBLICATION_QUALIFICATION_RESULT_PATH`. It also receives
+`BUILDCHAIN_PUBLICATION_PREDICATE_ID` and
+`BUILDCHAIN_PUBLICATION_PREDICATE_DIGEST`. The separate qualification job has
+no write or OIDC permission and does not inherit publication secrets. A
+successful deterministic receipt is rechecked by the provider action
+immediately before mutation. Omitting both inputs preserves the existing
+consumer contract; supplying only one fails closed.

package/docs/release-governance.md

@@ -169,6 +169,11 @@ Buildchain then:
 7. Moves `vX.Y-alpha` to the same generated alpha commit.
 8. Moves `vX-alpha` only when `X.Y` is the highest minor in major `X` with a published alpha; older minor alpha work records a skip and cannot move the major channel backwards.
 
+The npm channel follows the same ownership rule. The highest alpha minor publishes
+with dist-tag `alpha`; maintenance alphas on an older minor publish with the
+line-specific dist-tag `vX.Y-alpha` so they cannot roll the global `alpha`
+channel backward. Exact prerelease versions remain installable directly.
+
 This keeps the test channel self-describing. If a consumer checks out
 `v2.0-alpha` or `v2-alpha`, the manifests and exact alpha tag agree. The major
 alpha ref removes routine consumer edits when Buildchain opens a newer minor,
@@ -590,7 +595,11 @@ Buildchain's own promotion workflow reads `BUILDCHAIN_PROMOTION_BYPASS_APPS`,
 `BUILDCHAIN_PROMOTION_BYPASS_TEAMS` repository variables so the declared bypass
 identity can match the actual `BUILDCHAIN_PROMOTION_TOKEN` actor, but consumers
 do not need to duplicate that actor manually when the token identity is
-discoverable.
+discoverable. Buildchain's release-line bootstrap applies the same declared
+allowances when it creates new `dev`, `alpha`, and `release` branch protection,
+and fails closed before changing protection when no promotion authority is
+declared. This keeps a new minor line publishable without weakening its normal
+human review gate.
 
 ## What This Guarantees
 

package/docs/stable-candidate-patrol.md

@@ -59,6 +59,15 @@ after the producer has observed the successful authoritative workflow run. The
 stable gate still verifies the workflow identity, exact runtime SHA, target URL,
 and allowed attestor before accepting that status.
 
+When a candidate changes the outer reusable-workflow YAML itself, the stable
+shell cannot exercise that change through a runtime override. A maintainer may
+manually qualify it with `canary-ref` set to an exact 40-character commit in the
+consumer repository whose canary workflow pins the candidate's exact Buildchain
+SHA. The qualification producer still dispatches and observes the authoritative
+consumer workflow before writing the normal candidate-bound status. Floating
+consumer branches are rejected, and the automatic path continues to use the
+consumer default branch.
+
 ## Repository policy
 
 Declare the default once in `.buildchain/buildchain.toml`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.13.0-alpha.0",
+  "version": "2.13.0-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/index.js

@@ -138,19 +138,25 @@ export {
   PUBLICATION_AUTHORITY_CLASSES,
   PUBLICATION_AUTHORITY_REGISTRY_CONTRACT,
   PUBLICATION_CAPABILITY_CONTRACT,
+  CONSUMER_PUBLICATION_DECISION_CONTRACT,
   PUBLICATION_CONTROL_PLANE_AUDIT_CONTRACT,
   PUBLICATION_GATE_DECISION_CONTRACT,
+  PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT,
   RUNNER_PROVENANCE_CLASSES,
   RUNNER_PROVENANCE_CONTRACT,
   createPublicationAuthorityRegistry,
   createPublicationAdmission,
   createPublicationArtifactManifestSet,
+  createConsumerPublicationDecision,
   createPublicationControlPlaneAudit,
   createPublicationGateDecision,
+  createPublicationQualificationReceipt,
   createRunnerProvenance,
   detectPublicationAuthoritySignals,
   publicationAuthorityDigest,
+  publicationGateAggregateBindings,
   verifyPublicationAdmission,
+  verifyPublicationQualificationReceipt,
 } from "./publication-authority.js";
 
 export {