@kungfu-tech/buildchain 2.14.16 → 2.14.17-alpha.0

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.16",
+    "version": "2.14.17-alpha.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -604,7 +604,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:c026509d1fde0a1828ea7d8691f4dfc1d14686ae92a140f3d2350252699d70b3"
+      "auditDigest": "sha256:8005d01fa6c771f466c77629f0589b361fc43a3a4f04b7d88bc1645d33895a51"
     },
     {
       "contractVersion": 1,
@@ -2913,5 +2913,5 @@
     }
   ],
   "compatibilityDigest": "sha256:cdf588422ec6b460bd6f631400efa6e361a045e052c8967d6c50fadd7aa4dd90",
-  "contractDigest": "sha256:81c0ed79269d4b0c2f94c11cc316069db7b4264814f3170b3877a9f960ac0320"
+  "contractDigest": "sha256:fe7adf9ed1c1a0b14b29fef1eb72205ae29c9558806c9b35bfcc258f07d422a8"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-22T14:12:30.154Z",
-  "publishedAt": "2026-07-22T14:12:30.154Z",
+  "generatedAt": "2026-07-22T15:29:55.552Z",
+  "publishedAt": "2026-07-22T15:29:55.552Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "f75ebb90c708bfed893b89f59bbb5ea77e5e45cb",
+  "sourceRevision": "a013078fdf88b5b850e48e93faf58de582130440",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.16",
+    "version": "2.14.17-alpha.0",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.16",
+    "version": "2.14.17-alpha.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -307,7 +307,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-control-plane-audit",
       "export": "./publication-control-plane-audit",
       "target": "./packages/core/publication-control-plane-audit.js",
-      "digest": "sha256:f9cab9f0aabee62ed5a054062beb56b2ec7c4251002cf7416fd561322a405bd8",
+      "digest": "sha256:8220ad9cdf7fb9d2f361cf7b066aad039412a378350676edfdb4c1f7019cda20",
       "summary": "Read-only publication control-plane snapshot evaluation APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-22T14:12:30.154Z",
-  "publishedAt": "2026-07-22T14:12:30.154Z",
+  "generatedAt": "2026-07-22T15:29:55.552Z",
+  "publishedAt": "2026-07-22T15:29:55.552Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "f75ebb90c708bfed893b89f59bbb5ea77e5e45cb",
+  "sourceRevision": "a013078fdf88b5b850e48e93faf58de582130440",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.16",
+    "version": "2.14.17-alpha.0",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-22T14:12:30.154Z",
-  "publishedAt": "2026-07-22T14:12:30.154Z",
+  "generatedAt": "2026-07-22T15:29:55.552Z",
+  "publishedAt": "2026-07-22T15:29:55.552Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "f75ebb90c708bfed893b89f59bbb5ea77e5e45cb",
+  "sourceRevision": "a013078fdf88b5b850e48e93faf58de582130440",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.16",
+    "version": "2.14.17-alpha.0",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.16",
+  "version": "2.14.17-alpha.0",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/publication-control-plane-audit.js

@@ -1,5 +1,41 @@
 import { createPublicationControlPlaneAudit, publicationAuthorityDigest } from "./publication-authority.js";
 
+export const BUILDCHAIN_RELEASE_RECONCILIATION_PATHS = Object.freeze([
+  ".buildchain/release-impact.json",
+  "dist/site/buildchain-contract.json",
+  "dist/site/buildchain-site.json",
+  "dist/site/kfd-upstream-aggregate.json",
+  "dist/site/publication-registry.json",
+  "dist/site/site-manifest.json",
+  "package.json",
+]);
+
+export function evaluateBuildchainReleaseReconciliation({
+  repository,
+  publicationVersion,
+  packageVersion,
+  message,
+  parentSha,
+  changedPaths,
+} = {}) {
+  const normalizedPaths = Array.isArray(changedPaths) ? changedPaths.map(String) : [];
+  const allowedPaths = new Set(BUILDCHAIN_RELEASE_RECONCILIATION_PATHS);
+  return {
+    qualifying: repository === "kungfu-systems/buildchain" &&
+      /^\d+\.\d+\.\d+$/.test(String(publicationVersion || "")) &&
+      message === `chore(release): release v${publicationVersion}` &&
+      packageVersion === publicationVersion &&
+      normalizedPaths.length > 0 &&
+      normalizedPaths.every((entry) => allowedPaths.has(entry)) &&
+      /^[0-9a-f]{40}$/.test(String(parentSha || "")),
+    parentSha: String(parentSha || ""),
+    version: String(publicationVersion || ""),
+    packageVersion: String(packageVersion || ""),
+    message: String(message || ""),
+    changedPaths: normalizedPaths,
+  };
+}
+
 function fact(id, pass, observed) {
   return {
     id,
@@ -77,6 +113,15 @@ export function evaluatePublicationControlPlaneSnapshot({
       branchPolicy.requiredStatusCheckMatchCount === 1
     )
   );
+  const authorizationSha = branchPolicy.authorizationSha || branchPolicy.sourceSha;
+  const sourceAuthorizationPass = branchPolicy.sourceSha === authorizationSha || (
+    branchPolicy.releaseReconciliation?.qualifying === true &&
+    branchPolicy.releaseReconciliation.parentSha === authorizationSha &&
+    /^\d+\.\d+\.\d+$/.test(String(branchPolicy.releaseReconciliation.version || "")) &&
+    branchPolicy.releaseReconciliation.packageVersion === branchPolicy.releaseReconciliation.version &&
+    Array.isArray(branchPolicy.releaseReconciliation.changedPaths) &&
+    branchPolicy.releaseReconciliation.changedPaths.length > 0
+  );
   const providerTransactionBranchPass = branchPolicy.ref === branch &&
     branchPolicy.policyMode === "provider-enforced-transaction" &&
     branchPolicy.protected === true &&
@@ -88,6 +133,7 @@ export function evaluatePublicationControlPlaneSnapshot({
     /^[0-9a-f]{40}$/i.test(String(branchPolicy.requiredCheckSha || "")) &&
     branchPolicy.requiredCheckSha === branchPolicy.pullRequestHeadSha &&
     branchPolicy.sourceSha === branchPolicy.headSha &&
+    sourceAuthorizationPass &&
     branchPolicy.mergedPullRequest === true &&
     branchPolicy.baseRef === branch &&
     branchPolicy.headRepository === repository &&

package/scripts/assemble-binary-release-admission.mjs

@@ -4,7 +4,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 
-import { validateControllerReceipt } from "../packages/core/controller-evidence.js";
+import {
+  validateControllerPlan,
+  validateControllerReceipt,
+} from "../packages/core/controller-evidence.js";
 import {
   createPublicationAdmission,
   createPublicationGateDecision,
@@ -102,15 +105,23 @@ function main() {
   const controllerRoot = path.join(evidenceRoot, "binary-controller");
   const manifest = readJson(oneFile(passportRoot, "buildchain-release-bundle.json"));
   const archivePath = oneFile(passportRoot, "buildchain-release-bundle.tar.gz");
+  const controllerPlan = readJson(oneFile(controllerRoot, "plan.json"));
   const controllerReceipt = readJson(oneFile(controllerRoot, "receipt.json"));
   validateBundle(manifest, archivePath, { sourceSha, releaseTag });
 
-  const runtimeSha = execFileSync("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], { encoding: "utf8" })
+  const authorityRuntimeSha = execFileSync("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], { encoding: "utf8" })
     .trim()
     .toLowerCase();
+  if (!/^[0-9a-f]{40}$/.test(authorityRuntimeSha)) {
+    throw new Error("publication authority runtime SHA is invalid");
+  }
+  const controllerPlanValidation = validateControllerPlan(controllerPlan);
+  if (!controllerPlanValidation.ok || !controllerPlanValidation.qualifying) {
+    throw new Error(`binary distribution controller plan did not qualify: ${controllerPlanValidation.issues.join("; ")}`);
+  }
   const controllerValidation = validateControllerReceipt(controllerReceipt, {
+    plan: controllerPlan,
     expectedSourceSha: sourceSha,
-    expectedRuntimeSha: runtimeSha,
   });
   if (!controllerValidation.ok || !controllerValidation.qualifying) {
     throw new Error(`binary distribution controller receipt did not qualify: ${controllerValidation.issues.join("; ")}`);
@@ -118,6 +129,7 @@ function main() {
   if (controllerReceipt.controller?.id !== "binary-distribution") {
     throw new Error("binary distribution controller receipt has the wrong controller id");
   }
+  const runtimeSha = controllerReceipt.runtime.sha;
 
   const controlPlaneAudit = readJson(required("BUILDCHAIN_CONTROL_PLANE_AUDIT_PATH"));
   const registry = readJson(path.join(runtimeRoot, "dist/site/publication-authority-registry.json"));

package/scripts/audit-publication-control-plane.mjs

@@ -3,7 +3,10 @@ import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
-import { evaluatePublicationControlPlaneSnapshot } from "../packages/core/publication-control-plane-audit.js";
+import {
+  evaluateBuildchainReleaseReconciliation,
+  evaluatePublicationControlPlaneSnapshot,
+} from "../packages/core/publication-control-plane-audit.js";
 
 function flag(name, fallback = "") {
   const index = process.argv.indexOf(`--${name}`);
@@ -199,6 +202,8 @@ function main() {
   const sourceSha = flag("source-sha").toLowerCase();
   const packageName = flag("package", "@kungfu-tech/buildchain");
   const publisherMode = flag("publisher-mode", "npm-trusted-publisher");
+  const publicationVersion = flag("publication-version");
+  const allowReleaseReconciliation = process.argv.includes("--allow-release-reconciliation");
   if (!repository || !branch) throw new Error("--repository and --branch are required");
 
   const encodedWorkflow = workflowPath.split("/").map(encodeURIComponent).join("/");
@@ -260,13 +265,51 @@ function main() {
     if (!/^[0-9a-f]{40}$/.test(sourceSha)) {
       throw new Error("--source-sha is required when detailed branch policy is not readable");
     }
-    const pullRequests = githubJson(`repos/${repository}/commits/${sourceSha}/pulls`, "source pull-request lineage");
-    const mergedPullRequest = (Array.isArray(pullRequests) ? pullRequests : []).find((entry) =>
+    const sourceCommit = githubJson(`repos/${repository}/commits/${sourceSha}`, "source commit");
+    const sourceParents = Array.isArray(sourceCommit.parents) ? sourceCommit.parents.map((entry) => String(entry?.sha || "").toLowerCase()) : [];
+    const sourceChangedPaths = Array.isArray(sourceCommit.files) ? sourceCommit.files.map((entry) => String(entry?.filename || "")) : [];
+    const sourceMessage = String(sourceCommit.commit?.message || "").split("\n", 1)[0];
+    let authorizationSha = sourceSha;
+    let releaseReconciliation = {
+      qualifying: false,
+      parentSha: "",
+      version: publicationVersion,
+      message: sourceMessage,
+      changedPaths: sourceChangedPaths,
+    };
+    let pullRequests = githubJson(`repos/${repository}/commits/${authorizationSha}/pulls`, "source pull-request lineage");
+    let mergedPullRequest = (Array.isArray(pullRequests) ? pullRequests : []).find((entry) =>
       entry?.merged_at &&
-      entry.merge_commit_sha === sourceSha &&
+      entry.merge_commit_sha === authorizationSha &&
       entry.base?.ref === branch &&
       entry.head?.repo?.full_name === repository
     );
+    if (!mergedPullRequest && allowReleaseReconciliation) {
+      const packageFile = githubJson(
+        `repos/${repository}/contents/package.json?ref=${encodeURIComponent(sourceSha)}`,
+        "release reconciliation package metadata",
+      );
+      const packageJson = JSON.parse(Buffer.from(String(packageFile.content || ""), "base64").toString("utf8"));
+      const parentSha = sourceParents.length === 1 ? sourceParents[0] : "";
+      releaseReconciliation = evaluateBuildchainReleaseReconciliation({
+        repository,
+        publicationVersion,
+        packageVersion: packageJson.version,
+        message: sourceMessage,
+        parentSha,
+        changedPaths: sourceChangedPaths,
+      });
+      if (releaseReconciliation.qualifying) {
+        authorizationSha = parentSha;
+        pullRequests = githubJson(`repos/${repository}/commits/${authorizationSha}/pulls`, "release parent pull-request lineage");
+        mergedPullRequest = (Array.isArray(pullRequests) ? pullRequests : []).find((entry) =>
+          entry?.merged_at &&
+          entry.merge_commit_sha === authorizationSha &&
+          entry.base?.ref === branch &&
+          entry.head?.repo?.full_name === repository
+        );
+      }
+    }
     const reviews = mergedPullRequest
       ? githubJson(`repos/${repository}/pulls/${mergedPullRequest.number}/reviews?per_page=100`, "source pull-request reviews")
       : [];
@@ -316,7 +359,9 @@ function main() {
       requiredCheckAppId: requiredCheckSource?.app_id || 0,
       requiredCheckSha: pullRequestHeadSha,
       sourceSha,
+      authorizationSha,
       headSha: String(branchState.commit?.sha || "").toLowerCase(),
+      releaseReconciliation,
       mergedPullRequest: Boolean(mergedPullRequest),
       pullRequestNumber: mergedPullRequest?.number || 0,
       pullRequestHeadSha,

package/scripts/web-surface-core.mjs

@@ -354,7 +354,7 @@ function publicationImmutablePolicy({ artifactRoot, binding }) {
       throw new Error(`declared immutable publication prefix does not exist in artifact: ${prefix}`);
     }
   }
-  const preservedRoots = [...new Set(declaredPrefixes.map((prefix) => prefix.split("/")[0]))].sort();
+  const preservedRoots = declaredPrefixes;
   const files = preservedRoots
     .flatMap((root) => listFiles(surfaceRoot, root))
     .map((filePath) => ({