@kungfu-tech/buildchain 2.13.0 → 2.14.0-alpha.0

package/dist/site/public-surface-audit.json

@@ -3,11 +3,11 @@
   "contract": "kungfu-buildchain-public-surface-reverse-audit",
   "status": "passed",
   "summary": {
-    "cliCommandCount": 81,
+    "cliCommandCount": 82,
     "workflowCount": 47,
     "actionCount": 4,
     "sitePageCount": 50,
-    "docCommandRefCount": 250,
+    "docCommandRefCount": 253,
     "failureCount": 0
   },
   "enumerated": {
@@ -57,6 +57,11 @@
         "source": "bin/buildchain.mjs",
         "usage": "buildchain create publication-admission --input-json <file-or-json> [--output <file>] [--json]"
       },
+      {
+        "id": "dev",
+        "source": "bin/buildchain.mjs",
+        "usage": "buildchain dev merge-queue --repository <owner/repo> --branch <dev/vN/vN.M>"
+      },
       {
         "id": "diagnostics",
         "source": "bin/buildchain.mjs",
@@ -932,6 +937,7 @@
           "publication-admission-json",
           "publication-control-plane-audit-json",
           "publication-expected-json",
+          "publication-gate-aggregate-json",
           "publication-runner-provenance-json",
           "publication-used-nonces-json",
           "release-feedback-actor-privacy",
@@ -941,7 +947,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 38,
+        "inputCount": 39,
         "secrets": [
           "production-release-app-private-key"
         ],
@@ -2409,6 +2415,21 @@
         "path": "docs/release-passport.md",
         "command": "buildchain collect github-release"
       },
+      {
+        "id": "dev",
+        "path": "docs/cli.md",
+        "command": "buildchain dev merge-queue"
+      },
+      {
+        "id": "dev",
+        "path": "docs/cli.md",
+        "command": "buildchain dev merge-queue"
+      },
+      {
+        "id": "dev",
+        "path": "docs/release-governance.md",
+        "command": "buildchain dev merge-queue"
+      },
       {
         "id": "diagnostics-summary",
         "path": "docs/cli.md",
@@ -3440,9 +3461,9 @@
     "cliRegistryPath": "dist/site/cli-registry.json",
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
-    "cliRegistryDigest": "ff1772371ec74271c21b6723dad0745a080347be8feef36a37e3948ebd19993d",
-    "workflowRegistryDigest": "f4dc70cba95a30b79eadbffc3a4ba5f8d382aae220a7bc13965365c2bbd5e674",
-    "pageRegistryDigest": "32a749f66f77ed976da58b16564ae2b27dfd16125ad3b47d49e261c09ec82f58"
+    "cliRegistryDigest": "b07ed2241d34696ad0500c3431b2106b1499a0d4372a77385a8c0e0698421d76",
+    "workflowRegistryDigest": "62b7ca87803c461e1e1436a477c3b6b70103eed84dbf14d855d383e810d7d71e",
+    "pageRegistryDigest": "453e38e1964516ad602ec8bb6a8b23e54177effafdc867069ac0e6218c6b46ed"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-16T07:45:10.422Z",
-  "publishedAt": "2026-07-16T07:45:10.422Z",
+  "generatedAt": "2026-07-16T17:11:20.307Z",
+  "publishedAt": "2026-07-16T17:11:20.307Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "eeac02686f845b4f496b2cbaa78713e6d4b2532b",
+  "sourceRevision": "d20ec69c151eacc49d4fe22afbd738f960f2553c",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.13.0",
+    "version": "2.14.0-alpha.0",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-16T07:45:10.422Z",
-  "publishedAt": "2026-07-16T07:45:10.422Z",
+  "generatedAt": "2026-07-16T17:11:20.307Z",
+  "publishedAt": "2026-07-16T17:11:20.307Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "eeac02686f845b4f496b2cbaa78713e6d4b2532b",
+  "sourceRevision": "d20ec69c151eacc49d4fe22afbd738f960f2553c",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.13.0",
+    "version": "2.14.0-alpha.0",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ce439062d4ed9d8213499e607825afdcf8a65f825343a657d0438f3e229a0af0"
+      "digest": "sha256:a9a9594c0bd9584b145a8f41847db83e297c1c4d1b8b2d7c4bf8d10264ab1cef"
     },
     {
       "id": "install",
@@ -85,7 +85,7 @@
       "path": "docs/publication-authority.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:920d4f14902ded1999f46d39f6d02db8cb5be6f22e376f6f2d456b3a1cc0c674"
+      "digest": "sha256:e191d248a52fc6488aef48050949ed0fd31064ab2a64cca2a5b529eeb68f0ff6"
     },
     {
       "id": "release-candidate",
@@ -101,7 +101,7 @@
       "path": "docs/release-propagation.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:55895694a32b76dfaf5ed0eb9e32f1e10bd859fb590d6f4504d36692ebe61ea9"
+      "digest": "sha256:d5877075eb41a3d41e531549da113756d29d6f34c91e3b68b8ce650753d5ca1d"
     },
     {
       "id": "readme-badges",
@@ -189,7 +189,7 @@
       "path": "docs/cli.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ef5be4484da8628b9e027f00fe0fdb5b295665ed23eeceefac48e63581f12c0c"
+      "digest": "sha256:a7a31bbec048acbc9759324c5421c7ea0734f394f8d6705b63d70654867fdfa6"
     },
     {
       "id": "build-facts",
@@ -237,7 +237,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:cb6aafc3410c0e72da3d9c3ba330421005af27c3c67665a2f3356603f02da84a"
+      "digest": "sha256:e97fd55d09facff9a6a5087fca5881d9756f33e791c9c3b9f9a8164ed2030c1d"
     },
     {
       "id": "release-flow",
@@ -245,7 +245,7 @@
       "path": "docs/release-flow.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:c05905de6a905d1ce0dd977986175b8bc1ad908c6c2eee946809693ea2cb91de"
+      "digest": "sha256:a2f68d42f34acc35940e135285df5ba510d91b15b9d9ede8cabbe8bfa6ab0305"
     },
     {
       "id": "runtime-train-validation",
@@ -261,7 +261,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:280d30e15552ab6a362cb121a7a1cafc3b907913cdc7d4d8a9e8e1930d856f7e"
+      "digest": "sha256:c3dce313b846fb36c69e4a725d086226ff2e875c376cc10e8554a0aff2f67c93"
     },
     {
       "id": "web-surface-deployments",
@@ -269,7 +269,7 @@
       "path": "docs/web-surface-deployments.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:f1e92ba87417dc9aac4f8cf080565f7f2c114b5007bb68b90f33692c73fdad88"
+      "digest": "sha256:797d8f0e81974a49125b17256bb8b4a85fc60673e06d6bbecbbf399651163437"
     }
   ],
   "facts": [

package/dist/site/workflow-registry.json

@@ -555,6 +555,7 @@
         "publication-admission-json",
         "publication-control-plane-audit-json",
         "publication-expected-json",
+        "publication-gate-aggregate-json",
         "publication-runner-provenance-json",
         "publication-used-nonces-json",
         "release-feedback-actor-privacy",
@@ -564,7 +565,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 38,
+      "inputCount": 39,
       "secrets": [
         "production-release-app-private-key"
       ],

package/docs/MAP.md

@@ -34,7 +34,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Publication Artifacts | `publication-registry.json`, `workflow-registry.json`, `node-api-registry.json`, `manual-registry.json`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md), [`reusable-build-surface.md`](reusable-build-surface.md) |
 | Distribution Indexes and Badges | `badge-endpoint-registry.json`, `node-api-registry.json`, `manual-registry.json` | [`readme-badges.md`](readme-badges.md), [`homebrew.md`](homebrew.md) |
 | Build Facts, Observability, and Diagnostics | `cli-registry.json`, `node-api-registry.json`, lifecycle artifacts | [`build-facts.md`](build-facts.md), [`toolkit-observability.md`](toolkit-observability.md), [`consumer-issue-reporting.md`](consumer-issue-reporting.md) |
-| Governance, Versioning, and Runtime Drift | `buildchain-contract.json`, `workflow-registry.json`, `release-model.json` | [`release-governance.md`](release-governance.md), [`release-flow.md`](release-flow.md), [`versioning.md`](versioning.md), [`runtime-train-validation.md`](runtime-train-validation.md) |
+| Governance, Versioning, and Runtime Drift | `buildchain-contract.json`, `workflow-registry.json`, `release-model.json` | [`release-governance.md`](release-governance.md), [`release-flow.md`](release-flow.md), [`versioning.md`](versioning.md), [`runtime-train-validation.md`](runtime-train-validation.md), [`cli.md`](cli.md) |
 | CLI and Node API Reference | `cli-registry.json`, `node-api-registry.json`, `workflow-registry.json`, `manual-registry.json` | [`cli.md`](cli.md), [`../packages/core/README.md`](../packages/core/README.md) |
 
 | Capability | Machine-readable entry | Manual entry |
@@ -72,6 +72,7 @@ replace them.
 | How do I initialize a new repository? | [`cli.md`](cli.md) + [`lifecycle-protocol.md`](lifecycle-protocol.md) | use | stable |
 | Why does Buildchain use branch-driven release governance? | [`release-governance.md`](release-governance.md) | why | stable |
 | How do protected dev branches and scheduled ready-PR merging work? | [`release-governance.md`](release-governance.md#protected-dev-branches) | use | stable |
+| How do slow required checks land reliably on a busy dev channel? | [`release-governance.md`](release-governance.md#protected-dev-branches) + [`cli.md`](cli.md#commands) | use | preview |
 | How do I run daily, weekly, or monthly repository patrols? | [`release-governance.md`](release-governance.md#buildchain-patrol) | use | stable |
 | How does Buildchain decide patch, minor, and major release lines? | [`versioning.md`](versioning.md) | why | stable |
 | What exact branch/tag state machine runs on alpha, release, and major gate? | [`release-flow.md`](release-flow.md) | verify | stable |

package/docs/cli.md

@@ -152,6 +152,25 @@ buildchain lifecycle run build \
   --artifact-name "{repo}-{version}-{platform}"
 ```
 
+`buildchain dev merge-queue` plans a GitHub merge-queue policy for a protected
+Buildchain dev channel. Declare every workflow that emits a required check; the
+command fails closed unless each file handles both `pull_request` and
+`merge_group` without reading `github.event.pull_request` directly:
+
+```bash
+buildchain dev merge-queue \
+  --repository kungfu-systems/example \
+  --branch dev/v4/v4.0 \
+  --workflow .github/workflows/source-acceptance.yml \
+  --workflow .github/workflows/affected-native-pr.yml
+```
+
+The default output is a read-only plan. Add `--apply` only after reviewing it.
+Apply creates the exact-branch merge-queue ruleset before changing classic
+required status checks from strict to loose, preserves the required check
+identities, and is safe to repeat. `gh` must be authenticated with repository
+Administration write permission for apply mode.
+
 `buildchain release line open` plans or writes the first version-state commit
 for a new semver minor line. It does not publish anything. The dry-run mode is
 the default and returns the dev/alpha/release refs, protection contract, default

package/docs/publication-authority.md

@@ -136,6 +136,30 @@ publication capability.
 Evidence publication is a separate authority class and never grants product
 publication.
 
+## Managed web-surface production
+
+The reusable web-surface controller owns a complete standard producer path for
+its documented production mechanisms. A reviewed matching release-PR merge or a
+manual dispatch by an actor with current repository write authority creates a
+signed decision bound to the exact source SHA. After build, verify, and
+production planning, the workflow creates a qualifying pre-publication
+controller receipt and assembles a ten-minute admission over the source tree,
+immutable Buildchain runtime, deployment plan, artifact hash, production
+Environment, AWS role/deploy target, runner provenance, decision digest, and
+nonce. The independent verifier emits the scoped `web-production` capability.
+
+The production job rechecks the capability and candidate against the same plan
+before downloading product artifacts. AWS authorization is deliberately
+recorded as `provider-at-transaction`: the capability binds the exact role and
+Environment, while `configure-aws-credentials` performs the live OIDC exchange
+and remains the final provider authorization gate before mutation. Buildchain
+does not claim that an IAM trust relationship passed before that transaction.
+
+Externally assembled admissions remain an optional compatibility path and must
+provide the full admission, runner, control-plane, Gate aggregate, expected
+bindings, and nonce set. They are not required for the managed web-surface
+release-PR or trusted-manual paths.
+
 ## Consumer qualification handoff
 
 Consumers may explicitly opt in to a final, consumer-owned qualification

package/docs/release-flow.md

@@ -106,7 +106,8 @@ When the workflow is run with `apply=true`, Buildchain:
 - creates `dev/v2/v2.10` from that commit;
 - creates `alpha/v2/v2.10` and `release/v2/v2.10` from the selected source ref;
 - applies branch protection with one approving review and the configured
-  required status check;
+  required status check; dev starts strict, while alpha and release also require
+  the pair-specific `verify` aggregate without a source-up-to-date ancestry loop;
 - switches the repository default branch to the new dev line when requested;
 - opens the first `dev/v2/v2.10 -> alpha/v2/v2.10` channel PR when requested.
 

package/docs/release-governance.md

@@ -84,6 +84,13 @@ The implementation is intentionally stricter than a local release script:
 - non-dry-run promotion must be driven by a completed `Verify` workflow;
 - target branch protection details must be readable, and branch protection must
   apply to administrators as well as regular contributors;
+- `alpha/vX/vX.Y` and `release/vX/vX.Y` branch protection must require both the
+  general `check` context and the Release Verify aggregate `verify` context, so
+  an invalid channel pair cannot merge even when repository checks pass;
+- release targets keep those checks non-strict with respect to source-branch
+  ancestry: generated channel bookkeeping intentionally makes the source and
+  target histories diverge, while the pair-specific `verify` context validates
+  the legal channel transition;
 - alpha promotion must come from a merged same-repository PR from
   `dev/vX/vX.Y` to `alpha/vX/vX.Y`;
 - release promotion must come from a merged same-repository PR from
@@ -385,6 +392,37 @@ This keeps the earliest development channel audit-friendly:
 - later `dev -> alpha -> release` promotion inherits a reviewable source
   lineage instead of trying to reconstruct how the dev branch changed.
 
+When required checks take longer than the normal dev-channel commit interval,
+classic strict up-to-date protection can become a non-converging retry loop:
+each base update invalidates a completed check set and rebasing restarts the
+same slow checks. Buildchain supports GitHub merge queues for that channel
+shape. The queue validates the projected merged result and serializes the final
+ref update, so concurrent channel movement no longer invalidates the candidate.
+
+Every required workflow must handle both `pull_request` and `merge_group`
+before the queue is enabled. Queue runs do not provide
+`github.event.pull_request`; required workflows must use the checked-out
+`github.sha` or event-neutral source facts. The governance command is dry-run by
+default and refuses to enable a queue when a declared required workflow lacks
+either trigger or still reads the pull-request-only payload directly:
+
+```bash
+buildchain dev merge-queue \
+  --repository owner/repository \
+  --branch dev/v4/v4.0 \
+  --workflow .github/workflows/source-acceptance.yml \
+  --workflow .github/workflows/affected-native-pr.yml
+```
+
+After reviewing the plan, repeat with `--apply`. Buildchain creates or updates
+an exact-branch `merge_queue` ruleset first, then changes only the classic
+required-status-check policy from strict to loose. Reviews, administrator
+enforcement, conversation resolution, required check identities, force-push
+protection, and deletion protection remain owned by the existing branch
+protection. The ruleset uses the first merge method that the repository itself
+allows, and fails closed when the repository has no enabled merge method.
+Re-running the command is idempotent.
+
 Buildchain provides the reusable
 `.github/workflows/dev-pr-auto-merge.yml` workflow for repositories that want a
 scheduled or manual "merge ready dev PRs" pass. The consumer repository owns
@@ -561,8 +599,11 @@ to the action, that explicit command overrides `lifecycle.verify`.
 
 Protected release-line branches keep their normal human review gate. Managed
 `dev/vN/vN.M`, `alpha/vN/vN.M`, and `release/vN/vN.M` branches are configured
-with one required approving review, strict GitHub Actions checks, administrator
-enforcement, conversation resolution, no force pushes, and no deletions. The
+with one required approving review, required GitHub Actions checks, administrator
+enforcement, conversation resolution, no force pushes, and no deletions. Dev
+keeps its repository-selected strict or merge-queue policy. Alpha and release
+require both `check` and the pair-specific `verify` aggregate without requiring
+the source branch to contain the target's generated bookkeeping history. The
 reusable `release-candidate-promote.yml` wrapper defaults
 `branch-protection-bypass-apps` to `github-actions`, which lets the workflow's
 automation identity apply generated version-state or post-publish channel
@@ -662,6 +703,12 @@ the supported path for downstream
 `release.published` propagation across semver, major, and promote-only release
 candidate publication models.
 
+Published GitHub Release assets are immutable evidence. A repeated promotion
+preserves an existing asset when its SHA-256 digest matches the regenerated
+bytes, uploads only missing assets, and fails with an immutable-release
+collision when a same-name asset has different bytes. It never deletes and
+replaces an existing asset during retry or duplicate workflow delivery.
+
 Buildchain also does not maintain bare exact tags such as `1.0.0`. The supported
 exact release and alpha refs are v-prefixed:
 

package/docs/release-propagation.md

@@ -187,6 +187,15 @@ jobs:
       propagation-token: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
 ```
 
+The downstream branch name may be reused across upstream releases. Before
+replacing an existing managed branch, the workflow reads its exact remote SHA
+and pushes with an explicit `--force-with-lease=<ref>:<sha>`. A surviving branch
+from a merged PR is therefore reconciled without manual deletion, while a
+concurrent writer makes the lease fail closed. The controller receipt includes a
+`propagation-branch-reconciliation` evidence file recording the branch, observed
+remote SHA, pushed SHA, lease mode, and the deterministically created or updated
+open PR.
+
 The workflow checks out the Buildchain runtime selected by
 `buildchain-repository` and `buildchain-ref` into `.buildchain/runtime`, invokes
 that runtime for the propagation plan and lock write, then checks out the

package/docs/versioning.md

@@ -61,6 +61,7 @@ repository changes are patch".
 
 | Date | Action | Line | Faces | Class | Rationale | PR |
 | --- | --- | --- | --- | --- | --- | --- |
+| 2026-07-16 | open-minor | `v2.14` | dev-merge-queue-governance | additive | The public CLI adds a dry-run-first, idempotent merge-queue governance command that verifies required workflow event compatibility before applying an exact dev-channel ruleset and removing the strict up-to-date race. | |
 | 2026-07-15 | open-minor | `v2.13` | artifact-verification-envelope, package-subpaths | additive | The public envelope seals exact artifact, provenance, identity, lifecycle, revocation, and existing KFD assessment roots into one consumer-ready KFX admission input, with a dedicated Node API export and fail-closed verifier. | |
 | 2026-07-11 | open-minor | `v2.12` | channel-build-router, channel-selection-protocol | additive | The public `build.yml` reusable workflow lets consumers declare one build job while Buildchain selects generic major alpha for development/prerelease intent and stable major for production release intent, with explicit overrides, separate locks, and fail-closed ambiguity handling. | |
 | 2026-07-08 | open-minor | `v2.9` | build-facts-contract | additive | Build Facts add a public CLI command family, Node API export, config protocol, module/product fact contracts, release-passport evidence section, and Kungfu legacy buildinfo projection from the same source facts. | |

package/docs/web-surface-deployments.md

@@ -746,11 +746,25 @@ When enabled, Buildchain owns the full release apply state machine:
   action. Consumers do not need to hand-write `gh pr create` or production
   release-intent glue.
 - Production runs when `production-apply` is true and either:
-  - a trusted `workflow_dispatch` passes `production-approved=true`; or
+  - a `workflow_dispatch` passes `production-approved=true` and the triggering
+    actor currently has `write`, `maintain`, or `admin` permission; or
   - `production-release-on-main=true` and the `main` push commit is associated
     with exactly one same-repository, merged release pull request matching
     `production-release-label` and `production-release-head-prefix`.
   The production job is then gated by the configured GitHub Environment.
+- Before production artifact download, Buildchain assembles a managed sealed
+  publication capability from the exact source/runtime SHAs, production plan
+  and artifact hash, a qualifying pre-publication controller receipt, the
+  trusted manual or reviewed-release-PR decision, production Environment and
+  AWS role target, an ephemeral-runner receipt, and a fresh nonce. Production
+  revalidates that capability against the downloaded plan before it downloads
+  product bytes. The later AWS OIDC exchange remains the provider's final
+  transaction-time authorization decision and fails closed before deploy apply.
+- The `publication-*-json` inputs are an advanced external-evidence
+  compatibility path, not a prerequisite for the standard release-PR or trusted
+  manual mechanisms. External evidence must now include
+  `publication-gate-aggregate-json`; supplying only a partial set still fails
+  closed.
 - Production apply writes a production release feedback passport artifact and
   comments the release PR with the production URL, source SHA, artifact
   identity, run URL, rollback pointer, and failure context when apply did not
@@ -844,9 +858,9 @@ another release PR.
 
 Apply-only inputs are validated before the caller build or verification command
 runs. If the current event would run preview, staging, or production apply,
-missing role inputs or a production apply without `production-approved=true`
-on manual dispatch fail immediately instead of spending the build and plan jobs
-first.
+missing role inputs, a production apply without `production-approved=true` on
+manual dispatch, or a manual actor without repository write authority fail
+immediately instead of spending the build and plan jobs first.
 
 Callers must grant `id-token: write` for OIDC role assumption. Preview comments
 need `pull-requests: write`. Automatic release PR creation also needs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.13.0",
+  "version": "2.14.0-alpha.0",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -85,7 +85,7 @@
   },
   "packageManager": "pnpm@11.7.0",
   "scripts": {
-    "check": "node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm -r --filter \"./actions/**\" build",
+    "check": "node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && node scripts/check-action-bundles.mjs",
     "check:workflows": "bash scripts/check-workflows.sh",
     "generate:site": "node scripts/generate-site-bundle.mjs",
     "check:site": "node scripts/generate-site-bundle.mjs --check",

package/packages/core/index.js

@@ -166,6 +166,14 @@ export {
   resolvePublicationCandidateFile,
 } from "./publication-artifact-candidate.js";
 
+export {
+  WEB_SURFACE_PRODUCTION_DECISION_CONTRACT,
+  WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT,
+  createWebSurfaceProductionDecision,
+  createWebSurfacePublicationCandidate,
+  webSurfacePublicationDigest,
+} from "./web-surface-publication-candidate.js";
+
 export {
   buildchainPublicationAuthorityDescriptors,
   createBuildchainPublicationAuthorityRegistry,

package/packages/core/publication-authority.js

@@ -3,6 +3,7 @@ import crypto from "node:crypto";
 import { validateControllerReceipt } from "./controller-evidence.js";
 import { createPublicationArtifactCandidate } from "./publication-artifact-candidate.js";
 import { sha256Json, validateReleaseCandidatePassport } from "./release-candidate.js";
+import { createWebSurfacePublicationCandidate } from "./web-surface-publication-candidate.js";
 
 export const PUBLICATION_AUTHORITY_REGISTRY_CONTRACT =
   "kungfu-buildchain-publication-authority-registry";
@@ -451,9 +452,9 @@ export function publicationGateAggregateBindings(gateAggregate) {
   };
 }
 
-function validateGateAggregate(gateAggregate, { admission, passport }) {
+function validateGateAggregate(gateAggregate, { admission, passport, sourceSha = "" }) {
   const bindings = publicationGateAggregateBindings(gateAggregate);
-  const passportSourceSha = passport.source?.headSha || passport.source?.sha;
+  const passportSourceSha = sourceSha || passport?.source?.headSha || passport?.source?.sha;
   if (![admission.sourceSha, passportSourceSha].includes(bindings.sourceSha)) {
     throw new Error("gate aggregate source SHA mismatch");
   }
@@ -464,6 +465,55 @@ function validatePublicationEvidence(publicationEvidence, admission) {
   if (!publicationEvidence || typeof publicationEvidence !== "object" || Array.isArray(publicationEvidence)) {
     throw new Error("independent publication evidence is required");
   }
+  if (publicationEvidence.webSurfaceCandidate) {
+    const evidence = publicationEvidence.webSurfaceCandidate;
+    const candidate = createWebSurfacePublicationCandidate(evidence);
+    const controllerReceiptDigest = normalizeDigest(
+      evidence.controllerReceipt.digest,
+      "controllerReceipt.digest",
+    );
+    if (
+      controllerReceiptDigest !==
+      normalizeDigest(admission.controllerReceiptDigest, "admission.controllerReceiptDigest")
+    ) {
+      throw new Error("controller receipt evidence binding mismatch");
+    }
+    const contractDigest = normalizeDigest(
+      evidence.controllerReceipt.runtime?.contractDigest,
+      "controllerReceipt.runtime.contractDigest",
+    );
+    if (contractDigest !== normalizeDigest(admission.contractDigest, "admission.contractDigest")) {
+      throw new Error("runtime contract evidence binding mismatch");
+    }
+    const gate = validateGateAggregate(publicationEvidence.gateAggregate, {
+      admission,
+      sourceSha: candidate.sourceSha,
+    });
+    if (gate.gateAggregateDigest !== normalizeDigest(admission.gateAggregateDigest, "admission.gateAggregateDigest")) {
+      throw new Error("Gate aggregate evidence binding mismatch");
+    }
+    if (gate.policyDigest !== normalizeDigest(admission.policyDigest, "admission.policyDigest")) {
+      throw new Error("Gate policy evidence binding mismatch");
+    }
+    if (candidate.candidateDigest !== normalizeDigest(admission.artifactDigest, "admission.artifactDigest")) {
+      throw new Error("web-surface publication candidate evidence binding mismatch");
+    }
+    return {
+      sourceTreeSha: candidate.sourceTreeSha,
+      controllerReceiptDigest,
+      contractDigest,
+      gateAggregateDigest: gate.gateAggregateDigest,
+      policyDigest: gate.policyDigest,
+      gateRegistryDigest: gate.registryDigest,
+      artifactDigest: candidate.candidateDigest,
+      evidenceDigest: publicationAuthorityDigest({
+        sourceTreeSha: candidate.sourceTreeSha,
+        controllerReceiptDigest,
+        gateAggregateDigest: gate.gateAggregateDigest,
+        artifactDigest: candidate.candidateDigest,
+      }),
+    };
+  }
   if (publicationEvidence.publicationArtifactCandidate) {
     const candidate = createPublicationArtifactCandidate(publicationEvidence.publicationArtifactCandidate);
     const passport = publicationEvidence.publicationArtifactCandidate.passport;

package/packages/core/release-line-bootstrap.js

@@ -191,6 +191,11 @@ export function planReleaseLineBootstrap({
     protection: {
       requiredStatusCheck,
       strictStatusChecks: true,
+      strictStatusChecksByChannel: {
+        dev: true,
+        alpha: false,
+        release: false,
+      },
       requiredApprovingReviewCount: approvalCount,
       requiredConversationResolution: true,
       enforceAdmins: true,