@kungfu-tech/buildchain 2.14.14-alpha.5 → 2.14.14-alpha.8

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.14-alpha.5",
+    "version": "2.14.14-alpha.8",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -89,7 +89,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:f9d9f940ada25dc33b6c04efb9d1adcdad9cb2a93481bd8fab2094df61e27267"
+      "auditDigest": "sha256:7804f03ac13edf2ffda40774c17d95e24416a97ee4b9091fc28b6cc32daea46e"
     },
     {
       "contractVersion": 1,
@@ -170,7 +170,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:1f476fb9a4854b362c4b24cef89a3c7675d7d63baf3bc828d7b8ae7d2787cead",
-      "auditDigest": "sha256:e8e0e2302a1830add8cb26142e0da548058a049ed13defde1918d5f0c0f12d49"
+      "auditDigest": "sha256:0fbb4713eead1951f01ec1cf7896cac9ab25cd73986573b3c3227ad133550f69"
     },
     {
       "contractVersion": 1,
@@ -212,7 +212,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:39c625b66e6be021ce8c27a1e26324de4964bea730a62ec3260fb40cf1645381"
+      "auditDigest": "sha256:a68b535582028c1dd708e447a43f5083106074df092b74528dfa16db4a4f4153"
     },
     {
       "contractVersion": 1,
@@ -1449,7 +1449,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:f9d9f940ada25dc33b6c04efb9d1adcdad9cb2a93481bd8fab2094df61e27267"
+      "auditDigest": "sha256:7804f03ac13edf2ffda40774c17d95e24416a97ee4b9091fc28b6cc32daea46e"
     },
     {
       "contractVersion": 1,
@@ -2715,7 +2715,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:39c625b66e6be021ce8c27a1e26324de4964bea730a62ec3260fb40cf1645381"
+      "auditDigest": "sha256:a68b535582028c1dd708e447a43f5083106074df092b74528dfa16db4a4f4153"
     },
     {
       "contractVersion": 1,
@@ -2913,5 +2913,5 @@
     }
   ],
   "compatibilityDigest": "sha256:cdf588422ec6b460bd6f631400efa6e361a045e052c8967d6c50fadd7aa4dd90",
-  "contractDigest": "sha256:0bf5f5f214ee58933b5b523b9e03a0b374c1724e34b868e4a3bfd9edf390a1cf"
+  "contractDigest": "sha256:ede35959de3e13be48da1d8f745d93c83c946112cd5ec07a29524bc34183b5ee"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-22T05:34:20.599Z",
-  "publishedAt": "2026-07-22T05:34:20.599Z",
+  "generatedAt": "2026-07-22T07:38:04.463Z",
+  "publishedAt": "2026-07-22T07:38:04.463Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "69360fc86fffa4c07b4966a4173af0e770aa4df3",
+  "sourceRevision": "5ec517227d615b2f11db8b5e36183f16082479b8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.14-alpha.5",
+    "version": "2.14.14-alpha.8",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.14-alpha.5",
+    "version": "2.14.14-alpha.8",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-22T05:34:20.599Z",
-  "publishedAt": "2026-07-22T05:34:20.599Z",
+  "generatedAt": "2026-07-22T07:38:04.463Z",
+  "publishedAt": "2026-07-22T07:38:04.463Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "69360fc86fffa4c07b4966a4173af0e770aa4df3",
+  "sourceRevision": "5ec517227d615b2f11db8b5e36183f16082479b8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.14-alpha.5",
+    "version": "2.14.14-alpha.8",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-22T05:34:20.599Z",
-  "publishedAt": "2026-07-22T05:34:20.599Z",
+  "generatedAt": "2026-07-22T07:38:04.463Z",
+  "publishedAt": "2026-07-22T07:38:04.463Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "69360fc86fffa4c07b4966a4173af0e770aa4df3",
+  "sourceRevision": "5ec517227d615b2f11db8b5e36183f16082479b8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.14-alpha.5",
+    "version": "2.14.14-alpha.8",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.14-alpha.5",
+  "version": "2.14.14-alpha.8",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/check-inventory.mjs

@@ -910,6 +910,8 @@ for (const requiredSnippet of [
   "if (dryRun) {",
   "Enforce Buildchain stable release canary gate",
   "BUILDCHAIN_STABLE_RELEASE_POLICY: .buildchain/stable-release-policy.json",
+  "Consumer has no binary-distribution.yml; standalone binary dispatch is not applicable.",
+  "gh workflow view binary-distribution.yml",
 ]) {
   if (!releaseCandidatePromoteWorkflow.includes(requiredSnippet)) {
     throw new Error(`release candidate promote workflow missing KFD gate pass-through: ${requiredSnippet}`);

package/scripts/generate-channel-build-workflow.mjs

@@ -96,7 +96,7 @@ function routerControllerPlanJob() {
         uses: actions/checkout@v7.0.0
         with:
           repository: \${{ needs.resolve-channel.outputs.router-repository }}
-          ref: \${{ needs.resolve-channel.outputs.router-ref }}
+          ref: \${{ needs.resolve-channel.outputs.router-sha }}
           path: .buildchain/controller-runtime
           persist-credentials: false
 
@@ -237,14 +237,63 @@ function generateChannelBuildWorkflowBase(source) {
   return `# Generated by scripts/generate-channel-build-workflow.mjs. Do not edit directly.\nname: Buildchain Channel Build\n\non:\n  workflow_call:\n    inputs:\n${routerInputs(inputs)}\n    secrets:\n${secrets.trimEnd()}\n    outputs:\n${routerOutputs(outputs)}\n\npermissions:\n  contents: read\n  issues: write\n  id-token: write\n\njobs:\n  resolve-channel:\n    name: Resolve Buildchain channel\n    runs-on: ubuntu-24.04\n    outputs:\n      channel: \${{ steps.channel.outputs.channel }}\n      buildchain-ref: \${{ steps.channel.outputs.buildchain-ref }}\n      contract-lock-path: \${{ steps.lock.outputs.path }}\n      selection-source: \${{ steps.channel.outputs.selection-source }}\n      reason: \${{ steps.channel.outputs.reason }}\n    steps:\n      - name: Resolve router source\n        id: router\n        shell: bash\n        env:\n          BUILDCHAIN_ROUTER_WORKFLOW_REF: \${{ job.workflow_ref }}\n        run: |\n          set -euo pipefail\n          workflow_ref=\"\${BUILDCHAIN_ROUTER_WORKFLOW_REF}\"\n          repository=\"\${workflow_ref%%/.github/workflows/*}\"\n          ref=\"\${workflow_ref##*@}\"\n          ref=\"\${ref#refs/heads/}\"\n          ref=\"\${ref#refs/tags/}\"\n          if [[ -z \"\${repository}\" || \"\${repository}\" = \"\${workflow_ref}\" || -z \"\${ref}\" ]]; then\n            echo \"Unable to resolve Buildchain router source from job.workflow_ref=\${workflow_ref}\" >&2\n            exit 1\n          fi\n          {\n            echo \"repository=\${repository}\"\n            echo \"ref=\${ref}\"\n          } >> \"\${GITHUB_OUTPUT}\"\n\n      - name: Checkout Buildchain router\n        uses: actions/checkout@v7.0.0\n        with:\n          repository: \${{ steps.router.outputs.repository }}\n          ref: \${{ steps.router.outputs.ref }}\n          path: .buildchain/router\n          persist-credentials: false\n\n      - name: Resolve channel\n        id: channel\n        shell: bash\n        env:\n          BUILDCHAIN_CHANNEL: \${{ inputs.buildchain-channel }}\n          BUILDCHAIN_REQUESTED_REF: \${{ inputs.buildchain-ref }}\n          BUILDCHAIN_PUBLISH_CHANNEL: \${{ inputs.publish-channel }}\n          BUILDCHAIN_EVENT_NAME: \${{ github.event_name }}\n          BUILDCHAIN_GIT_REF: \${{ github.ref }}\n          BUILDCHAIN_RELEASE_PRERELEASE: \${{ github.event.release.prerelease }}\n          BUILDCHAIN_ROUTER_REF: \${{ steps.router.outputs.ref }}\n        run: |\n          node .buildchain/router/scripts/buildchain-channel-router.mjs \\\n            --cwd .buildchain/router \\\n            --channel \"\${BUILDCHAIN_CHANNEL}\" \\\n            --buildchain-ref \"\${BUILDCHAIN_REQUESTED_REF}\" \\\n            --publish-channel \"\${BUILDCHAIN_PUBLISH_CHANNEL}\" \\\n            --event-name \"\${BUILDCHAIN_EVENT_NAME}\" \\\n            --ref \"\${BUILDCHAIN_GIT_REF}\" \\\n            --release-prerelease \"\${BUILDCHAIN_RELEASE_PRERELEASE}\" \\\n            --router-ref \"\${BUILDCHAIN_ROUTER_REF}\"\n\n      - name: Select consumer contract lock\n        id: lock\n        shell: bash\n        env:\n          EXPLICIT_PATH: \${{ inputs.buildchain-contract-lock-path }}\n          ALPHA_PATH: \${{ inputs.buildchain-alpha-contract-lock-path }}\n          STABLE_PATH: \${{ inputs.buildchain-stable-contract-lock-path }}\n          CHANNEL: \${{ steps.channel.outputs.channel }}\n        run: |\n          set -euo pipefail\n          path=\"\${EXPLICIT_PATH}\"\n          if [[ -z \"\${path}\" ]]; then\n            if [[ \"\${CHANNEL}\" = \"alpha\" ]]; then\n              path=\"\${ALPHA_PATH}\"\n            else\n              path=\"\${STABLE_PATH}\"\n            fi\n          fi\n          echo \"path=\${path}\" >> \"\${GITHUB_OUTPUT}\"\n\n  build:\n    name: Build with resolved channel\n    needs: resolve-channel\n    uses: ./.github/workflows/.build.yml\n    permissions:\n      contents: read\n      issues: write\n      id-token: write\n    with:\n${forwardedInputs(names)}\n    secrets: inherit\n`;
 }
 
+function bindRouterCheckoutToWorkflowSha(workflow) {
+  return workflow
+    .replace(
+      "          BUILDCHAIN_ROUTER_WORKFLOW_REF: ${{ job.workflow_ref }}\n",
+      [
+        "          BUILDCHAIN_ROUTER_WORKFLOW_REF: ${{ job.workflow_ref }}",
+        "          BUILDCHAIN_ROUTER_WORKFLOW_REPOSITORY: ${{ job.workflow_repository }}",
+        "          BUILDCHAIN_ROUTER_WORKFLOW_SHA: ${{ job.workflow_sha }}",
+        "",
+      ].join("\n"),
+    )
+    .replace(
+      [
+        '          repository="${workflow_ref%%/.github/workflows/*}"',
+        '          ref="${workflow_ref##*@}"',
+        '          ref="${ref#refs/heads/}"',
+        '          ref="${ref#refs/tags/}"',
+        '          if [[ -z "${repository}" || "${repository}" = "${workflow_ref}" || -z "${ref}" ]]; then',
+        '            echo "Unable to resolve Buildchain router source from job.workflow_ref=${workflow_ref}" >&2',
+        "            exit 1",
+        "          fi",
+      ].join("\n"),
+      [
+        '          repository="${BUILDCHAIN_ROUTER_WORKFLOW_REPOSITORY}"',
+        '          ref="${workflow_ref##*@}"',
+        '          ref="${ref#refs/heads/}"',
+        '          ref="${ref#refs/tags/}"',
+        '          parsed_repository="${workflow_ref%%/.github/workflows/*}"',
+        '          if [[ -z "${repository}" || "${repository}" != "${parsed_repository}" || -z "${ref}" ]]; then',
+        '            echo "::error::Unable to resolve Buildchain router source from job.workflow_ref=${workflow_ref}"',
+        "            exit 1",
+        "          fi",
+        '          if [[ ! "${BUILDCHAIN_ROUTER_WORKFLOW_SHA}" =~ ^[0-9a-fA-F]{40}$ ]]; then',
+        '            echo "::error::job.workflow_sha is not an exact commit SHA"',
+        "            exit 1",
+        "          fi",
+      ].join("\n"),
+    )
+    .replace(
+      '            echo "ref=${ref}"\n',
+      '            echo "ref=${ref}"\n            echo "sha=${BUILDCHAIN_ROUTER_WORKFLOW_SHA,,}"\n',
+    )
+    .replace(
+      "          ref: ${{ steps.router.outputs.ref }}\n          path: .buildchain/router",
+      "          ref: ${{ steps.router.outputs.sha }}\n          path: .buildchain/router",
+    );
+}
+
 export function generateChannelBuildWorkflow(source) {
-  const generated = generateChannelBuildWorkflowBase(source)
+  const generated = bindRouterCheckoutToWorkflowSha(generateChannelBuildWorkflowBase(source))
     .replace(
       "      contract-lock-path: ${{ steps.lock.outputs.path }}\n",
       [
         "      contract-lock-path: ${{ steps.lock.outputs.path }}",
         "      router-repository: ${{ steps.router.outputs.repository }}",
         "      router-ref: ${{ steps.router.outputs.ref }}",
+        "      router-sha: ${{ steps.router.outputs.sha }}",
         "",
       ].join("\n"),
     )