@kungfu-tech/buildchain 2.14.14-alpha.0 → 2.14.14-alpha.2

package/dist/site/public-surface-audit.json

@@ -439,17 +439,22 @@
         "path": ".github/workflows/.binary-release-assets.yml",
         "reusable": true,
         "inputs": [
+          "auto-admission",
           "buildchain-ref",
           "buildchain-repository",
           "evidence-run-id",
           "publication-admission-json",
           "publication-control-plane-audit-json",
           "publication-expected-json",
+          "publication-gate-aggregate-json",
           "publication-runner-provenance-json",
           "publication-used-nonces-json",
-          "release-tag"
+          "publication-version",
+          "release-tag",
+          "source-sha",
+          "target-ref"
         ],
-        "inputCount": 9,
+        "inputCount": 14,
         "secrets": [],
         "secretCount": 0,
         "outputs": [],
@@ -3689,8 +3694,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "90c8650f870c350ca187c612c37f2459dcbfe265aa9b1d5b375ee5c4fb31fab6",
-    "workflowRegistryDigest": "02950eef2769b1bd2d899099ef23c7b9ae716b18d602e25aef169d788bc6ece0",
-    "pageRegistryDigest": "bb87721a858798cacd2bc79e9e16c78ae32aa8a563e2adcfebc6918b293ef36a"
+    "workflowRegistryDigest": "cdc3924bccc6ddf1242603f0a588e69cbb45882e602f4fba60fa23866813eb50",
+    "pageRegistryDigest": "b544ae35ecc853f227e6b9b233ef5b58b3f8b4867c28377a07cb5cb325f56454"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -624,7 +624,8 @@
     {
       "path": ".github/workflows/binary-release-assets.yml",
       "signals": [
-        "write-permission"
+        "write-permission",
+        "github-release"
       ],
       "classified": true
     },
@@ -846,5 +847,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "588256fc42c36c1e03286f1de1f7abe1e393ce2e452ae1bf548668f017316590"
+  "registryDigest": "9981084c8a18fe72639de7441112a14e32f16b8aa49c0ba0ab9b92dee9bb4df3"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-21T20:21:16.004Z",
-  "publishedAt": "2026-07-21T20:21:16.004Z",
+  "generatedAt": "2026-07-22T01:54:29.864Z",
+  "publishedAt": "2026-07-22T01:54:29.864Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "6d2cbfecd9aa3cd90bbd083d1f6403824e24aa3a",
+  "sourceRevision": "907987a0d059e1f92a2664509514487722dcf04f",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.14-alpha.0",
+    "version": "2.14.14-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-model.json

@@ -38,8 +38,10 @@
   },
   "githubRelease": {
     "exactTagRelease": true,
-    "prereleaseTags": "semver prerelease tags set prerelease=true and make_latest=false",
-    "stableTags": "stable semver tags set make_latest=true",
+    "authoritativeIntent": "Buildchain publication channel controls prerelease/latest metadata when available",
+    "alphaChannel": "alpha publication sets prerelease=true and make_latest=false",
+    "stableChannels": "release, stable, and major publication set prerelease=false and make_latest=true",
+    "tagFallback": "ordinary callers without publication intent use semver prerelease syntax",
     "evidenceAssets": [
       "publish evidence JSON",
       "buildchain.release.json",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-21T20:21:16.004Z",
-  "publishedAt": "2026-07-21T20:21:16.004Z",
+  "generatedAt": "2026-07-22T01:54:29.864Z",
+  "publishedAt": "2026-07-22T01:54:29.864Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "6d2cbfecd9aa3cd90bbd083d1f6403824e24aa3a",
+  "sourceRevision": "907987a0d059e1f92a2664509514487722dcf04f",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.14-alpha.0",
+    "version": "2.14.14-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -93,7 +93,7 @@
       "path": "docs/release-candidate.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:5528710ec63dbdf86a34e69a7ea86dbb4194d72522951fc67108f5cfc58fdd99"
+      "digest": "sha256:2127c22b7b567befd05cba7d50ed0ca229b366072506e06fa09a0962ccfc1db7"
     },
     {
       "id": "release-propagation",
@@ -125,7 +125,7 @@
       "path": "docs/binary-distribution.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:08be4e97e1940a45a2c0aa2506012255888c23c1cbf8f5362b27c2b21089eb58"
+      "digest": "sha256:ae0f8e6cafbb4c39732e6a7252d46b523b0a69e8e05d3ce7ee0b51a916b1b027"
     },
     {
       "id": "consumer-issue-reporting",
@@ -157,7 +157,7 @@
       "path": "docs/site-bundle-contract.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:d67a874b356fbfbee9a5d5ece7021fb52b2848347dc6a14f5562c98570096916"
+      "digest": "sha256:583661a7886bdca7e8352a5325a105a9df5d134b3896dbda13ad9b637697481f"
     },
     {
       "id": "migration-inventory",
@@ -237,7 +237,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:adb3c5d2eb414ffde6e75032c8f795de0c4ad929baa2d1e5d0f8cd7a9af39f1f"
+      "digest": "sha256:4476d9464d29b4ff3951a362607a11c78b7a3b723247af93ded1b15ff8f0b83e"
     },
     {
       "id": "release-flow",
@@ -269,7 +269,7 @@
       "path": "docs/web-surface-deployments.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:856a7602cf1c2d3a0a540cdf0d64566914f79dde24417c92089f0466bee25df1"
+      "digest": "sha256:efbfc97a947978e61c79dac9d67f87050b1bef2297617303340af8aa499703c9"
     }
   ],
   "facts": [

package/dist/site/workflow-registry.json

@@ -8,17 +8,22 @@
       "path": ".github/workflows/.binary-release-assets.yml",
       "reusable": true,
       "inputs": [
+        "auto-admission",
         "buildchain-ref",
         "buildchain-repository",
         "evidence-run-id",
         "publication-admission-json",
         "publication-control-plane-audit-json",
         "publication-expected-json",
+        "publication-gate-aggregate-json",
         "publication-runner-provenance-json",
         "publication-used-nonces-json",
-        "release-tag"
+        "publication-version",
+        "release-tag",
+        "source-sha",
+        "target-ref"
       ],
-      "inputCount": 9,
+      "inputCount": 14,
       "secrets": [],
       "secretCount": 0,
       "outputs": [],

package/docs/binary-distribution.md

@@ -16,16 +16,25 @@ The release lane does not upload loose top-level `buildchain` or
 inside their archives, so top-level loose assets would collide when matrix
 artifacts are merged.
 
-Release asset upload is gated before the matrix starts. Manual
-`workflow_dispatch` runs are binary dry-runs only and must keep
-`upload-release=false`; real GitHub Release uploads must come from a true
-`v*` tag-triggered run so an invalid manual upload request cannot spend the
-three-platform build matrix and then fail at `gh release upload`.
-
-GitHub Release metadata is deterministic and tag-derived. Exact alpha tags such
+`Binary Distribution` is evidence-only. It never receives `contents: write`
+and never calls `gh release upload`; `upload-release=true` is rejected before
+the matrix starts. A completed promotion explicitly dispatches the workflow at
+the exact public tag because tags created by `GITHUB_TOKEN` do not recursively
+start ordinary `push` workflows.
+
+After all three runners qualify, the workflow seals a
+`binary-distribution` controller receipt over the exact source/runtime SHA,
+release bundle, and Release Passport. `Binary Release Assets` observes the
+successful evidence run, rechecks that its source SHA still equals the exact
+tag, derives the governed alpha/release branch, and asks the credential-free
+publication authority to assemble a short-lived capability. Only the nested
+publisher owns `contents: write`, and it runs behind the protected
+`buildchain-release-assets` Environment.
+
+GitHub Release metadata remains deterministic and tag-derived. Exact alpha tags such
 as `v2.6.2-alpha.0` are created or updated with `prerelease=true` and
 `make_latest=false`; exact stable tags such as `v2.6.1` are created or updated
-with `prerelease=false` and `make_latest=true`. The workflow uses
+with `prerelease=false` and `make_latest=true`. The sealed publisher uses
 `scripts/ensure-github-release.mjs` before asset upload instead of relying on
 GitHub's default latest-release heuristic.
 
@@ -85,6 +94,11 @@ buildchain-release-bundle/
 file digest. Consumers can download the bundle when they want one artifact for
 offline review, mirroring, or site ingestion.
 
+Publication fails closed unless the bundle contains all three archives,
+`checksums.txt`, and `buildchain.release.json`; its archive digest, controller
+receipt, live control-plane audit, runner provenance, source/runtime SHA, and
+exact target tag must all match the sealed admission.
+
 ## Local Smoke
 
 ```bash

package/docs/release-candidate.md

@@ -110,8 +110,10 @@ router failure.
 By default, the wrapper forwards GitHub Release publication to the underlying
 `promote-buildchain-ref` semver model. Once the release transaction is complete,
 the action creates or updates the public GitHub Release, applies
-prerelease/latest metadata from the semver tag, and uploads the publish evidence
-file together with the generated release passport assets. This keeps
+prerelease/latest metadata from the authoritative publication channel (falling
+back to semver tag syntax only for ordinary callers without that intent), and
+uploads the publish evidence file together with the generated release passport
+assets. This keeps
 npm/registry publication, Buildchain release passport persistence, and
 `release.published` propagation in one declarative reusable workflow. Consumers
 that do not publish GitHub Releases can opt out with `github-release: false`.

package/docs/release-governance.md

@@ -813,9 +813,11 @@ generated channel router, where GitHub Release publication is enabled by default
 disabled with `github-release: false`; the wrapper passes that declaration to
 the action. After the publish transaction reaches `complete`, Buildchain creates
 or updates the public GitHub Release and uploads the generated
-`buildchain.release.json`, release-passport assets, and publish evidence. Semver
-prerelease tags are marked `prerelease=true` and `make_latest=false`; stable
-semver tags are marked latest. For anchored/manual package releases, the public
+`buildchain.release.json`, release-passport assets, and publish evidence. The
+authoritative publication channel controls GitHub metadata: alpha is marked
+`prerelease=true` and `make_latest=false`; release/stable/major is marked latest.
+Semver tag syntax remains the fallback for ordinary callers without explicit
+publication intent. For anchored/manual package releases, the public
 release tag defaults to `v<publishedVersion>` while the internal exact
 transaction tag remains in the release passport and release-state ref. This is
 the supported path for downstream

package/docs/site-bundle-contract.md

@@ -35,6 +35,10 @@ It includes a `homepage` object generated from `README.md`, including
 `homepage.rendererContract` that is implementation metadata rather than
 ordinary homepage copy. Site repositories should consume those fields instead
 of parsing `README.md` themselves.
+When the README intro starts with the managed Buildchain badge block,
+`homepage.lead` contains that complete marker-delimited block and
+`homepage.mechanismSummary` starts with prose after the block. A renderer must
+not repair or recombine split badge fragments.
 It also includes a `pages` collection that mirrors `page-registry.json`, so a
 site repository can build the full Buildchain public documentation surface from
 the npm package without scanning the source checkout.

package/docs/web-surface-deployments.md

@@ -456,7 +456,12 @@ compatibility evidence, but root correctness comes from the viewer-request
 rewrite contract, not from extensionless S3 keys. If Buildchain-managed mode
 finds a distribution with a different viewer-request function, apply fails
 closed and records that conflict in the apply result instead of silently serving
-403s. The reusable workflow uploads `buildchain-web-surface-*-diagnostics`
+403s. If CloudFront rejects `UpdateDistribution` because its optimistic-lock
+ETag became stale, Buildchain re-reads the distribution and retries with the
+new ETag at most twice. A concurrent update that already attached the intended
+function is accepted as converged; a different viewer-request function or any
+non-ETag AWS error still fails immediately. The reusable workflow uploads
+`buildchain-web-surface-*-diagnostics`
 artifacts containing the apply and health JSON so the failing AWS operation or
 HTTP check is visible from the consumer run.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.14-alpha.0",
+  "version": "2.14.14-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-contract.js

@@ -91,6 +91,7 @@ export function createBuildchainContractWorld({
     "release-candidate-promote",
     ".release-candidate-promote",
     "release-propagation",
+    "binary-distribution",
   ]);
   const hasCompleteControllerSource = [...controllerWorkflowIds]
     .every((id) => workflowDescriptors.some((workflow) => workflow.id === id));
@@ -348,7 +349,7 @@ export function createBuildchainContractWorld({
         "protected release refs and durable release-state are finalized by Buildchain",
         "release passport finalization is idempotent after publish side effects",
         "publish transactions can require a resolved publish-gate source lock to prevent floating-ref drift",
-        "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the public release tag",
+        "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata bound to the authoritative publication channel and tag syntax retained as the fallback for ordinary callers",
       ],
     }),
     surface(root, {

package/packages/core/controller-evidence.js

@@ -113,6 +113,14 @@ const CONTROLLER_SPECS = [
     ],
     evidence: ["propagation-plan", "propagation-lock", "controller-receipt"],
   },
+  {
+    id: "binary-distribution",
+    workflowId: "binary-distribution",
+    version: 1,
+    capabilities: ["standalone-binary-build", "release-evidence-bundle", "artifact-admission"],
+    stages: ["resolve-runtime", "build", "verify", "bundle", "aggregate"],
+    evidence: ["release-evidence-bundle", "release-passport", "controller-receipt"],
+  },
 ];
 
 function stableJson(value) {

package/packages/core/issue-reporting.js

@@ -112,17 +112,22 @@ export function buildConsumerIssueReport(options = {}) {
   const consumerRef = options.consumerRef || env.GITHUB_REF || "";
   const consumerSha = options.consumerSha || env.GITHUB_SHA || "";
   const failureCode = options.failureCode || "consumer-report";
+  const contractDrift = /^buildchain-contract-(?:compatible|breaking)-drift$/.test(failureCode);
   const fingerprint =
     options.fingerprint ||
     computeConsumerIssueFingerprint({
       targetRepository: target.fullName,
       consumerRepository,
-      workflow,
-      job,
       failureCode,
       buildchainRef: options.buildchainRef,
-      buildchainVersion: options.buildchainVersion,
-      title: options.title,
+      ...(contractDrift
+        ? {}
+        : {
+            workflow,
+            job,
+            buildchainVersion: options.buildchainVersion,
+            title: options.title,
+          }),
     });
   const title = redactIssueText(
     options.title ||

package/packages/core/publication-authority.js

@@ -465,6 +465,81 @@ function validatePublicationEvidence(publicationEvidence, admission) {
   if (!publicationEvidence || typeof publicationEvidence !== "object" || Array.isArray(publicationEvidence)) {
     throw new Error("independent publication evidence is required");
   }
+  if (publicationEvidence.binaryReleaseEvidence) {
+    const evidence = publicationEvidence.binaryReleaseEvidence;
+    const manifest = evidence.bundleManifest;
+    if (manifest?.contract !== "kungfu-buildchain-release-evidence-bundle") {
+      throw new Error("binary release evidence bundle contract mismatch");
+    }
+    if (manifest.release?.tag !== `v${admission.version}`) {
+      throw new Error("binary release evidence tag mismatch");
+    }
+    if (normalizeGitSha(manifest.release?.sourceSha, "bundleManifest.release.sourceSha") !== admission.sourceSha) {
+      throw new Error("binary release evidence source mismatch");
+    }
+    const archiveDigest = normalizeDigest(evidence.bundleArchiveDigest, "binaryReleaseEvidence.bundleArchiveDigest");
+    const manifestDigest = normalizeDigest(manifest.bundle?.sha256, "bundleManifest.bundle.sha256");
+    if (archiveDigest !== manifestDigest) {
+      throw new Error("binary release evidence archive digest mismatch");
+    }
+    if (manifestDigest !== normalizeDigest(admission.artifactDigest, "admission.artifactDigest")) {
+      throw new Error("binary release evidence admission binding mismatch");
+    }
+    const fileNames = new Set((manifest.files || []).map((entry) => entry.bundlePath));
+    for (const required of [
+      "release-assets/buildchain-aarch64-apple-darwin.tar.gz",
+      "release-assets/buildchain-x86_64-unknown-linux-gnu.tar.gz",
+      "release-assets/buildchain-x86_64-pc-windows-msvc.zip",
+      "release-assets/checksums.txt",
+      "release-passport/buildchain.release.json",
+    ]) {
+      if (!fileNames.has(required)) throw new Error(`binary release evidence is missing ${required}`);
+    }
+    const controllerReceipt = evidence.controllerReceipt;
+    const controllerValidation = validateControllerReceipt(controllerReceipt, {
+      expectedSourceSha: admission.sourceSha,
+      expectedRuntimeSha: admission.runtimeSha,
+    });
+    if (!controllerValidation.ok || !controllerValidation.qualifying) {
+      throw new Error(`binary distribution controller receipt did not qualify: ${controllerValidation.issues.join("; ")}`);
+    }
+    if (controllerReceipt.controller?.id !== "binary-distribution") {
+      throw new Error("binary release evidence controller mismatch");
+    }
+    const controllerReceiptDigest = normalizeDigest(controllerReceipt.digest, "controllerReceipt.digest");
+    if (controllerReceiptDigest !== normalizeDigest(admission.controllerReceiptDigest, "admission.controllerReceiptDigest")) {
+      throw new Error("binary release controller receipt binding mismatch");
+    }
+    const contractDigest = normalizeDigest(controllerReceipt.runtime?.contractDigest, "controllerReceipt.runtime.contractDigest");
+    if (contractDigest !== normalizeDigest(admission.contractDigest, "admission.contractDigest")) {
+      throw new Error("binary release runtime contract binding mismatch");
+    }
+    const gate = validateGateAggregate(publicationEvidence.gateAggregate, {
+      admission,
+      sourceSha: admission.sourceSha,
+    });
+    if (gate.gateAggregateDigest !== normalizeDigest(admission.gateAggregateDigest, "admission.gateAggregateDigest")) {
+      throw new Error("binary release Gate aggregate binding mismatch");
+    }
+    if (gate.policyDigest !== normalizeDigest(admission.policyDigest, "admission.policyDigest")) {
+      throw new Error("binary release Gate policy binding mismatch");
+    }
+    return {
+      sourceTreeSha: normalizeGitSha(evidence.sourceTreeSha, "binaryReleaseEvidence.sourceTreeSha"),
+      controllerReceiptDigest,
+      contractDigest,
+      gateAggregateDigest: gate.gateAggregateDigest,
+      policyDigest: gate.policyDigest,
+      gateRegistryDigest: gate.registryDigest,
+      artifactDigest: manifestDigest,
+      evidenceDigest: publicationAuthorityDigest({
+        sourceTreeSha: evidence.sourceTreeSha,
+        controllerReceiptDigest,
+        gateAggregateDigest: gate.gateAggregateDigest,
+        artifactDigest: manifestDigest,
+      }),
+    };
+  }
   if (publicationEvidence.webSurfaceCandidate) {
     const evidence = publicationEvidence.webSurfaceCandidate;
     const candidate = createWebSurfacePublicationCandidate(evidence);

package/scripts/assemble-binary-release-admission.mjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+
+import { validateControllerReceipt } from "../packages/core/controller-evidence.js";
+import {
+  createPublicationAdmission,
+  createPublicationGateDecision,
+  createRunnerProvenance,
+  publicationGateAggregateBindings,
+} from "../packages/core/publication-authority.js";
+
+function required(name) {
+  const value = String(process.env[name] || "").trim();
+  if (!value) throw new Error(`${name} is required`);
+  return value;
+}
+
+function sha256(value) {
+  return crypto.createHash("sha256").update(String(value)).digest("hex");
+}
+
+function sha256File(filePath) {
+  return crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
+}
+
+function filesNamed(root, name) {
+  const matches = [];
+  const pending = [root];
+  while (pending.length) {
+    const current = pending.pop();
+    if (!fs.existsSync(current)) continue;
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const full = path.join(current, entry.name);
+      if (entry.isDirectory()) pending.push(full);
+      else if (entry.isFile() && entry.name === name) matches.push(full);
+    }
+  }
+  return matches.sort();
+}
+
+function oneFile(root, name) {
+  const matches = filesNamed(root, name);
+  if (matches.length !== 1) {
+    throw new Error(`expected exactly one ${name} under ${root}, found ${matches.length}`);
+  }
+  return matches[0];
+}
+
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+}
+
+function writeBundle(outputDir, values) {
+  fs.mkdirSync(outputDir, { recursive: true });
+  for (const [name, value] of Object.entries(values)) {
+    fs.writeFileSync(path.join(outputDir, `${name}.json`), `${JSON.stringify(value, null, 2)}\n`);
+  }
+  if (!process.env.GITHUB_OUTPUT) return;
+  const output = fs.createWriteStream(process.env.GITHUB_OUTPUT, { flags: "a" });
+  for (const [name, value] of Object.entries(values)) {
+    output.write(`${name.replaceAll("_", "-")}-json=${JSON.stringify(value)}\n`);
+  }
+  output.end();
+}
+
+function validateBundle(manifest, archivePath, { sourceSha, releaseTag }) {
+  if (manifest?.contract !== "kungfu-buildchain-release-evidence-bundle") {
+    throw new Error("binary release evidence bundle contract mismatch");
+  }
+  if (manifest.release?.tag !== releaseTag) throw new Error("binary release evidence tag mismatch");
+  if (String(manifest.release?.sourceSha || "").toLowerCase() !== sourceSha) {
+    throw new Error("binary release evidence source mismatch");
+  }
+  if (sha256File(archivePath) !== String(manifest.bundle?.sha256 || "").replace(/^sha256:/, "")) {
+    throw new Error("binary release evidence archive digest mismatch");
+  }
+  const names = new Set((manifest.files || []).map((entry) => entry.bundlePath));
+  for (const requiredPath of [
+    "release-assets/buildchain-aarch64-apple-darwin.tar.gz",
+    "release-assets/buildchain-x86_64-unknown-linux-gnu.tar.gz",
+    "release-assets/buildchain-x86_64-pc-windows-msvc.zip",
+    "release-assets/checksums.txt",
+    "release-passport/buildchain.release.json",
+  ]) {
+    if (!names.has(requiredPath)) throw new Error(`binary release evidence is missing ${requiredPath}`);
+  }
+}
+
+function main() {
+  const evidenceRoot = process.env.BUILDCHAIN_EVIDENCE_ROOT || ".buildchain/publication-evidence";
+  const runtimeRoot = process.env.BUILDCHAIN_RUNTIME_ROOT || ".buildchain/authority-runtime";
+  const repository = required("BUILDCHAIN_REPOSITORY");
+  const sourceSha = required("BUILDCHAIN_SOURCE_SHA").toLowerCase();
+  const releaseTag = required("BUILDCHAIN_RELEASE_TAG");
+  const version = required("BUILDCHAIN_PUBLICATION_VERSION");
+  if (releaseTag !== `v${version}`) throw new Error("binary publication version and release tag mismatch");
+
+  const passportRoot = path.join(evidenceRoot, "binary-passport");
+  const controllerRoot = path.join(evidenceRoot, "binary-controller");
+  const manifest = readJson(oneFile(passportRoot, "buildchain-release-bundle.json"));
+  const archivePath = oneFile(passportRoot, "buildchain-release-bundle.tar.gz");
+  const controllerReceipt = readJson(oneFile(controllerRoot, "receipt.json"));
+  validateBundle(manifest, archivePath, { sourceSha, releaseTag });
+
+  const runtimeSha = execFileSync("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], { encoding: "utf8" })
+    .trim()
+    .toLowerCase();
+  const controllerValidation = validateControllerReceipt(controllerReceipt, {
+    expectedSourceSha: sourceSha,
+    expectedRuntimeSha: runtimeSha,
+  });
+  if (!controllerValidation.ok || !controllerValidation.qualifying) {
+    throw new Error(`binary distribution controller receipt did not qualify: ${controllerValidation.issues.join("; ")}`);
+  }
+  if (controllerReceipt.controller?.id !== "binary-distribution") {
+    throw new Error("binary distribution controller receipt has the wrong controller id");
+  }
+
+  const controlPlaneAudit = readJson(required("BUILDCHAIN_CONTROL_PLANE_AUDIT_PATH"));
+  const registry = readJson(path.join(runtimeRoot, "dist/site/publication-authority-registry.json"));
+  const suppliedGate = String(process.env.BUILDCHAIN_GATE_AGGREGATE_JSON || "").trim();
+  let gateAggregate;
+  if (suppliedGate) {
+    gateAggregate = JSON.parse(suppliedGate);
+  } else {
+    if (process.env.BUILDCHAIN_ALLOW_NO_GATE !== "true") {
+      throw new Error("binary release admission requires a Gate aggregate or explicit no-Gate decision");
+    }
+    gateAggregate = createPublicationGateDecision({
+      sourceSha,
+      profile: "buildchain-binary-release-no-gate",
+      required: false,
+      rationale: "Buildchain standalone release assets carry provider-owned evidence and declare no consumer Shifu Gate registry.",
+      policy: { scope: "binary-release-assets", repository },
+    });
+  }
+  const gateBindings = publicationGateAggregateBindings(gateAggregate);
+  const runnerProvenance = createRunnerProvenance({
+    runnerClass: "ephemeral",
+    os: required("RUNNER_OS"),
+    architecture: required("RUNNER_ARCH"),
+    imageDigest: sha256(`${process.env.ImageOS || "unknown"}|${process.env.ImageVersion || "unknown"}`),
+    measurementDigest: sha256([
+      process.env.GITHUB_WORKFLOW,
+      process.env.GITHUB_JOB,
+      process.env.GITHUB_RUN_ID,
+      process.env.GITHUB_RUN_ATTEMPT,
+      process.env.RUNNER_ENVIRONMENT,
+    ].join("|")),
+    isolation: "github-hosted-single-job",
+  });
+  const issuedAt = new Date();
+  const admission = createPublicationAdmission({
+    registryDigest: registry.registryDigest,
+    workflowPath: required("BUILDCHAIN_AUTHORITY_WORKFLOW_PATH"),
+    publisherWorkflowPath: required("BUILDCHAIN_PUBLISHER_WORKFLOW_PATH"),
+    repository,
+    sourceSha,
+    runtimeSha,
+    contractDigest: controllerReceipt.runtime?.contractDigest,
+    policyDigest: gateBindings.policyDigest,
+    gateRegistryDigest: gateBindings.registryDigest,
+    controllerReceiptDigest: controllerReceipt.digest,
+    runnerProvenanceDigest: runnerProvenance.receiptDigest,
+    controlPlaneAuditDigest: controlPlaneAudit.receiptDigest,
+    gateAggregateDigest: gateBindings.gateAggregateDigest,
+    environment: "buildchain-release-assets",
+    product: "Buildchain standalone binary",
+    target: `github-release:${repository}@${releaseTag}`,
+    version,
+    channel: "release-assets",
+    artifactDigest: manifest.bundle.sha256,
+    nonce: `${required("GITHUB_RUN_ID")}:${required("GITHUB_RUN_ATTEMPT")}:${sourceSha}:binary-release-assets`,
+    issuedAt: issuedAt.toISOString(),
+    expiresAt: new Date(issuedAt.getTime() + 10 * 60 * 1000).toISOString(),
+    qualification: { required: false, predicateId: "", predicateDigest: "" },
+  });
+  const expectedKeys = [
+    "repository", "publisherWorkflowPath", "sourceSha", "runtimeSha", "contractDigest", "policyDigest",
+    "gateRegistryDigest", "controllerReceiptDigest", "gateAggregateDigest", "environment", "product", "target",
+    "version", "channel", "artifactDigest",
+  ];
+  const expected = Object.fromEntries(expectedKeys.map((name) => [name, admission[name]]));
+  writeBundle(process.env.BUILDCHAIN_OUTPUT_DIR || ".buildchain/publication-authority/auto", {
+    admission,
+    runner_provenance: runnerProvenance,
+    control_plane_audit: controlPlaneAudit,
+    gate_aggregate: gateAggregate,
+    expected,
+  });
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(`assemble binary release admission: ${error.message}`);
+  process.exitCode = 1;
+}