@kungfu-tech/buildchain 2.14.14 → 2.14.15-alpha.1

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.14",
+    "version": "2.14.15-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -604,7 +604,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:3749e514599db7f4fe7ce8525c878010f556d2e6ea4f557eaad4a1bd94cf9ff7"
+      "auditDigest": "sha256:c026509d1fde0a1828ea7d8691f4dfc1d14686ae92a140f3d2350252699d70b3"
     },
     {
       "contractVersion": 1,
@@ -2913,5 +2913,5 @@
     }
   ],
   "compatibilityDigest": "sha256:cdf588422ec6b460bd6f631400efa6e361a045e052c8967d6c50fadd7aa4dd90",
-  "contractDigest": "sha256:05bca17e5d2a356660e5d1b76d40c023acd8b84d377f447339b77a63d594f8d7"
+  "contractDigest": "sha256:98bf00165b325017f883bd55313ba1e6903654d591fd45adc35a9557fc422b82"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-22T07:51:29.217Z",
-  "publishedAt": "2026-07-22T07:51:29.217Z",
+  "generatedAt": "2026-07-22T09:24:49.017Z",
+  "publishedAt": "2026-07-22T09:24:49.017Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "d7d1be6ace7aa6a342abbe8dc78b358534ff6b73",
+  "sourceRevision": "120948c0c71fa8659baaee95ace133acd6b14824",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.14",
+    "version": "2.14.15-alpha.1",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.14",
+    "version": "2.14.15-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -112,7 +112,7 @@
       "specifier": "@kungfu-tech/buildchain/controller-evidence",
       "export": "./controller-evidence",
       "target": "./packages/core/controller-evidence.js",
-      "digest": "sha256:3767d8dce1a18e610d4d1dcad3ef5e5c457d97f01769c9961cb45eb4d682ce59",
+      "digest": "sha256:c061ed32e02713fd99ffd291ee8ed4a4dba563265ee530deef4b37197cbb65e6",
       "summary": "Project-independent controller descriptors, source/runtime-bound plans, receipts, aggregates, and validation APIs.",
       "capabilityGroup": "reusable-build",
       "audience": [
@@ -177,7 +177,7 @@
       "specifier": "@kungfu-tech/buildchain/kfd-agent-hub",
       "export": "./kfd-agent-hub",
       "target": "./packages/core/kfd-agent-hub.js",
-      "digest": "sha256:b301acb17af17f462af75f086f506bb529d2456647bfdbd78182852a413f5671",
+      "digest": "sha256:0221784b744fb2a0da02b95ed02b642b7456df2b8c2d8fb818aaa7e8a9a2deb1",
       "summary": "Declarative Agent Hub adapter inspection, fixed-suite execution, exact KFD cut locking, and agent explanation APIs.",
       "capabilityGroup": "kfd-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-22T07:51:29.217Z",
-  "publishedAt": "2026-07-22T07:51:29.217Z",
+  "generatedAt": "2026-07-22T09:24:49.017Z",
+  "publishedAt": "2026-07-22T09:24:49.017Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "d7d1be6ace7aa6a342abbe8dc78b358534ff6b73",
+  "sourceRevision": "120948c0c71fa8659baaee95ace133acd6b14824",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.14",
+    "version": "2.14.15-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-22T07:51:29.217Z",
-  "publishedAt": "2026-07-22T07:51:29.217Z",
+  "generatedAt": "2026-07-22T09:24:49.017Z",
+  "publishedAt": "2026-07-22T09:24:49.017Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "d7d1be6ace7aa6a342abbe8dc78b358534ff6b73",
+  "sourceRevision": "120948c0c71fa8659baaee95ace133acd6b14824",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.14",
+    "version": "2.14.15-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.14",
+  "version": "2.14.15-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/controller-evidence.js

@@ -391,7 +391,7 @@ export function createControllerReceipt({ plan, stages = [], evidence = [], reas
     stages: normalizedStages,
     evidence: normalizedEvidence,
     issues,
-    ...(reason ? {
+    ...(status !== "passed" && reason ? {
       reason: {
         code: nonEmptyString(reason.code, "reason.code"),
         summary: nonEmptyString(reason.summary, "reason.summary"),
@@ -414,6 +414,7 @@ export function validateControllerReceipt(receipt, {
   if (receipt.contract !== BUILDCHAIN_CONTROLLER_EVIDENCE_CONTRACT) issues.push(`receipt contract must be ${BUILDCHAIN_CONTROLLER_EVIDENCE_CONTRACT}`);
   if (receipt.kind !== "receipt") issues.push("receipt kind must be receipt");
   if (receipt.digest !== digestDocument(receipt)) issues.push("receipt digest mismatch");
+  if (receipt.status === "passed" && receipt.reason) issues.push("passed controller receipt must not declare a failure reason");
   issues.push(...(receipt.issues || []));
   if (plan) {
     if (receipt.planDigest !== plan.digest) issues.push("receipt plan digest mismatch");

package/packages/core/kfd-agent-hub.js

@@ -1,8 +1,8 @@
 import crypto from "node:crypto";
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
+import { spawnSyncCommand } from "./spawn-command.js";
 
 export const KFD_AGENT_HUB_DECLARATION = ".buildchain/kfd/agent-hub.json";
 export const KFD_AGENT_HUB_OUTPUT_DIR = ".buildchain/artifacts/kfd-agent-hub";
@@ -278,7 +278,7 @@ function inspectKfdCut(kfd) {
 }
 
 function defaultRun(command, args, { cwd }) {
-  const result = spawnSync(command, args, { cwd, encoding: "utf8", env: process.env });
+  const result = spawnSyncCommand(command, args, { cwd, encoding: "utf8", env: process.env });
   return { status: result.status ?? 2, stdout: result.stdout || "", stderr: result.stderr || "", error: result.error };
 }
 

package/packages/core/spawn-command.js

@@ -0,0 +1,26 @@
+import { spawnSync } from "node:child_process";
+
+const WINDOWS_CMD_SHIMS = new Set(["corepack", "npm", "npx", "pnpm", "yarn"]);
+
+export function resolveSpawnCommand(command, platform = process.platform) {
+  if (platform !== "win32" || !WINDOWS_CMD_SHIMS.has(command)) {
+    return command;
+  }
+  return `${command}.cmd`;
+}
+
+export function usesShellForSpawnCommand(command, platform = process.platform) {
+  return platform === "win32" && WINDOWS_CMD_SHIMS.has(command);
+}
+
+export function spawnSyncCommand(
+  command,
+  args,
+  options = {},
+  { platform = process.platform, spawn = spawnSync } = {},
+) {
+  return spawn(resolveSpawnCommand(command, platform), args, {
+    ...options,
+    shell: options.shell ?? usesShellForSpawnCommand(command, platform),
+  });
+}

package/scripts/build-standalone-binary.mjs

@@ -6,6 +6,12 @@ import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { createBuildchainLogger } from "../packages/core/logging.js";
+import {
+  resolveSpawnCommand,
+  usesShellForSpawnCommand,
+} from "../packages/core/spawn-command.js";
+
+export { resolveSpawnCommand, usesShellForSpawnCommand };
 
 function readArg(name, fallback = "") {
   const index = process.argv.indexOf(`--${name}`);
@@ -42,22 +48,6 @@ function timed(logger, eventName, details, callback) {
   }
 }
 
-const WINDOWS_CMD_SHIMS = new Set(["corepack", "npm", "npx", "pnpm", "yarn"]);
-
-export function resolveSpawnCommand(command, platform = process.platform) {
-  if (platform !== "win32") {
-    return command;
-  }
-  if (!WINDOWS_CMD_SHIMS.has(command)) {
-    return command;
-  }
-  return `${command}.cmd`;
-}
-
-export function usesShellForSpawnCommand(command, platform = process.platform) {
-  return platform === "win32" && WINDOWS_CMD_SHIMS.has(command);
-}
-
 function run(command, args, options = {}) {
   const { logger, event = "process.run", phase = "process", attributes = {}, ...spawnOptions } = options;
   const resolvedCommand = resolveSpawnCommand(command);