@kungfu-tech/buildchain 2.14.16 → 2.14.17-alpha.1

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.16",
+    "version": "2.14.17-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -256,7 +256,7 @@
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
       ],
       "breakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
-      "auditDigest": "sha256:cd620b10103c27137ae17f23583753adfe2f3ef501e511f7380431aa95f08b18"
+      "auditDigest": "sha256:4a7c696ec399c14aa3170fdd24adac0d624bd33db6a2639c489e2b58726c190b"
     },
     {
       "contractVersion": 1,
@@ -323,6 +323,9 @@
         "publish transactions can require a resolved publish-gate source lock to prevent floating-ref drift",
         "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata bound to the authoritative publication channel and tag syntax retained as the fallback for ordinary callers"
       ],
+      "compatibleBreakingDigests": [
+        "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
+      ],
       "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
       "auditDigest": "sha256:ff220542fd1cb21fc4780d0bb31eb9f78d44d70746b6c4364483e104b48ae083"
     },
@@ -604,7 +607,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:c026509d1fde0a1828ea7d8691f4dfc1d14686ae92a140f3d2350252699d70b3"
+      "auditDigest": "sha256:915daa5d9dd8879a356865d2ab9336a8f2fb9806b43f5ba18eadfe448e6d8304"
     },
     {
       "contractVersion": 1,
@@ -1850,7 +1853,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27",
-      "auditDigest": "sha256:cd620b10103c27137ae17f23583753adfe2f3ef501e511f7380431aa95f08b18"
+      "auditDigest": "sha256:4a7c696ec399c14aa3170fdd24adac0d624bd33db6a2639c489e2b58726c190b"
     },
     {
       "contractVersion": 1,
@@ -2913,5 +2916,5 @@
     }
   ],
   "compatibilityDigest": "sha256:cdf588422ec6b460bd6f631400efa6e361a045e052c8967d6c50fadd7aa4dd90",
-  "contractDigest": "sha256:81c0ed79269d4b0c2f94c11cc316069db7b4264814f3170b3877a9f960ac0320"
+  "contractDigest": "sha256:9d5bef7245674767352cc2746d507d556a11d685502120c00176f1a15bade2ba"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-22T14:12:30.154Z",
-  "publishedAt": "2026-07-22T14:12:30.154Z",
+  "generatedAt": "2026-07-22T23:30:42.191Z",
+  "publishedAt": "2026-07-22T23:30:42.191Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "f75ebb90c708bfed893b89f59bbb5ea77e5e45cb",
+  "sourceRevision": "7c7ff64cd7cd3b34ad377999ed8aa22b1e1d8d93",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.16",
+    "version": "2.14.17-alpha.1",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.16",
+    "version": "2.14.17-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -99,7 +99,7 @@
       "specifier": "@kungfu-tech/buildchain/buildchain-contract",
       "export": "./buildchain-contract",
       "target": "./packages/core/buildchain-contract.js",
-      "digest": "sha256:da92e920f6cc00dd5e21405f06580c2fa943eead3b755dc36b6c3a2381e68423",
+      "digest": "sha256:1e5f8a1741a0a98116e754ef0874337db4c1821bb7a153ab398009145509681c",
       "summary": "Runtime contract world and compatibility digest APIs for floating-ref drift checks.",
       "capabilityGroup": "governance-versioning",
       "audience": [
@@ -307,7 +307,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-control-plane-audit",
       "export": "./publication-control-plane-audit",
       "target": "./packages/core/publication-control-plane-audit.js",
-      "digest": "sha256:f9cab9f0aabee62ed5a054062beb56b2ec7c4251002cf7416fd561322a405bd8",
+      "digest": "sha256:8220ad9cdf7fb9d2f361cf7b066aad039412a378350676edfdb4c1f7019cda20",
       "summary": "Read-only publication control-plane snapshot evaluation APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-22T14:12:30.154Z",
-  "publishedAt": "2026-07-22T14:12:30.154Z",
+  "generatedAt": "2026-07-22T23:30:42.191Z",
+  "publishedAt": "2026-07-22T23:30:42.191Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "f75ebb90c708bfed893b89f59bbb5ea77e5e45cb",
+  "sourceRevision": "7c7ff64cd7cd3b34ad377999ed8aa22b1e1d8d93",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.16",
+    "version": "2.14.17-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-22T14:12:30.154Z",
-  "publishedAt": "2026-07-22T14:12:30.154Z",
+  "generatedAt": "2026-07-22T23:30:42.191Z",
+  "publishedAt": "2026-07-22T23:30:42.191Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "f75ebb90c708bfed893b89f59bbb5ea77e5e45cb",
+  "sourceRevision": "7c7ff64cd7cd3b34ad377999ed8aa22b1e1d8d93",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.16",
+    "version": "2.14.17-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.16",
+  "version": "2.14.17-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-contract.js

@@ -351,6 +351,9 @@ export function createBuildchainContractWorld({
         "publish transactions can require a resolved publish-gate source lock to prevent floating-ref drift",
         "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata bound to the authoritative publication channel and tag syntax retained as the fallback for ordinary callers",
       ],
+      compatibleBreakingDigests: [
+        "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874",
+      ],
     }),
     surface(root, {
       id: "report-buildchain-issue-action",
@@ -758,7 +761,11 @@ export function evaluateBuildchainContractLock({
       reasons.push(`surface removed: ${oldSurface.id}`);
       continue;
     }
-    if (nextSurface.breakingDigest !== oldSurface.breakingDigest) {
+    const compatibleBreakingDigests = new Set(nextSurface.compatibleBreakingDigests || []);
+    if (
+      nextSurface.breakingDigest !== oldSurface.breakingDigest
+      && !compatibleBreakingDigests.has(oldSurface.breakingDigest)
+    ) {
       reasons.push(`surface breaking digest changed: ${oldSurface.id}`);
     }
   }

package/packages/core/publication-control-plane-audit.js

@@ -1,5 +1,41 @@
 import { createPublicationControlPlaneAudit, publicationAuthorityDigest } from "./publication-authority.js";
 
+export const BUILDCHAIN_RELEASE_RECONCILIATION_PATHS = Object.freeze([
+  ".buildchain/release-impact.json",
+  "dist/site/buildchain-contract.json",
+  "dist/site/buildchain-site.json",
+  "dist/site/kfd-upstream-aggregate.json",
+  "dist/site/publication-registry.json",
+  "dist/site/site-manifest.json",
+  "package.json",
+]);
+
+export function evaluateBuildchainReleaseReconciliation({
+  repository,
+  publicationVersion,
+  packageVersion,
+  message,
+  parentSha,
+  changedPaths,
+} = {}) {
+  const normalizedPaths = Array.isArray(changedPaths) ? changedPaths.map(String) : [];
+  const allowedPaths = new Set(BUILDCHAIN_RELEASE_RECONCILIATION_PATHS);
+  return {
+    qualifying: repository === "kungfu-systems/buildchain" &&
+      /^\d+\.\d+\.\d+$/.test(String(publicationVersion || "")) &&
+      message === `chore(release): release v${publicationVersion}` &&
+      packageVersion === publicationVersion &&
+      normalizedPaths.length > 0 &&
+      normalizedPaths.every((entry) => allowedPaths.has(entry)) &&
+      /^[0-9a-f]{40}$/.test(String(parentSha || "")),
+    parentSha: String(parentSha || ""),
+    version: String(publicationVersion || ""),
+    packageVersion: String(packageVersion || ""),
+    message: String(message || ""),
+    changedPaths: normalizedPaths,
+  };
+}
+
 function fact(id, pass, observed) {
   return {
     id,
@@ -77,6 +113,15 @@ export function evaluatePublicationControlPlaneSnapshot({
       branchPolicy.requiredStatusCheckMatchCount === 1
     )
   );
+  const authorizationSha = branchPolicy.authorizationSha || branchPolicy.sourceSha;
+  const sourceAuthorizationPass = branchPolicy.sourceSha === authorizationSha || (
+    branchPolicy.releaseReconciliation?.qualifying === true &&
+    branchPolicy.releaseReconciliation.parentSha === authorizationSha &&
+    /^\d+\.\d+\.\d+$/.test(String(branchPolicy.releaseReconciliation.version || "")) &&
+    branchPolicy.releaseReconciliation.packageVersion === branchPolicy.releaseReconciliation.version &&
+    Array.isArray(branchPolicy.releaseReconciliation.changedPaths) &&
+    branchPolicy.releaseReconciliation.changedPaths.length > 0
+  );
   const providerTransactionBranchPass = branchPolicy.ref === branch &&
     branchPolicy.policyMode === "provider-enforced-transaction" &&
     branchPolicy.protected === true &&
@@ -88,6 +133,7 @@ export function evaluatePublicationControlPlaneSnapshot({
     /^[0-9a-f]{40}$/i.test(String(branchPolicy.requiredCheckSha || "")) &&
     branchPolicy.requiredCheckSha === branchPolicy.pullRequestHeadSha &&
     branchPolicy.sourceSha === branchPolicy.headSha &&
+    sourceAuthorizationPass &&
     branchPolicy.mergedPullRequest === true &&
     branchPolicy.baseRef === branch &&
     branchPolicy.headRepository === repository &&

package/scripts/assemble-binary-release-admission.mjs

@@ -4,7 +4,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 
-import { validateControllerReceipt } from "../packages/core/controller-evidence.js";
+import {
+  validateControllerPlan,
+  validateControllerReceipt,
+} from "../packages/core/controller-evidence.js";
 import {
   createPublicationAdmission,
   createPublicationGateDecision,
@@ -102,15 +105,23 @@ function main() {
   const controllerRoot = path.join(evidenceRoot, "binary-controller");
   const manifest = readJson(oneFile(passportRoot, "buildchain-release-bundle.json"));
   const archivePath = oneFile(passportRoot, "buildchain-release-bundle.tar.gz");
+  const controllerPlan = readJson(oneFile(controllerRoot, "plan.json"));
   const controllerReceipt = readJson(oneFile(controllerRoot, "receipt.json"));
   validateBundle(manifest, archivePath, { sourceSha, releaseTag });
 
-  const runtimeSha = execFileSync("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], { encoding: "utf8" })
+  const authorityRuntimeSha = execFileSync("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], { encoding: "utf8" })
     .trim()
     .toLowerCase();
+  if (!/^[0-9a-f]{40}$/.test(authorityRuntimeSha)) {
+    throw new Error("publication authority runtime SHA is invalid");
+  }
+  const controllerPlanValidation = validateControllerPlan(controllerPlan);
+  if (!controllerPlanValidation.ok || !controllerPlanValidation.qualifying) {
+    throw new Error(`binary distribution controller plan did not qualify: ${controllerPlanValidation.issues.join("; ")}`);
+  }
   const controllerValidation = validateControllerReceipt(controllerReceipt, {
+    plan: controllerPlan,
     expectedSourceSha: sourceSha,
-    expectedRuntimeSha: runtimeSha,
   });
   if (!controllerValidation.ok || !controllerValidation.qualifying) {
     throw new Error(`binary distribution controller receipt did not qualify: ${controllerValidation.issues.join("; ")}`);
@@ -118,6 +129,7 @@ function main() {
   if (controllerReceipt.controller?.id !== "binary-distribution") {
     throw new Error("binary distribution controller receipt has the wrong controller id");
   }
+  const runtimeSha = controllerReceipt.runtime.sha;
 
   const controlPlaneAudit = readJson(required("BUILDCHAIN_CONTROL_PLANE_AUDIT_PATH"));
   const registry = readJson(path.join(runtimeRoot, "dist/site/publication-authority-registry.json"));

package/scripts/audit-publication-control-plane.mjs

@@ -3,7 +3,10 @@ import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
-import { evaluatePublicationControlPlaneSnapshot } from "../packages/core/publication-control-plane-audit.js";
+import {
+  evaluateBuildchainReleaseReconciliation,
+  evaluatePublicationControlPlaneSnapshot,
+} from "../packages/core/publication-control-plane-audit.js";
 
 function flag(name, fallback = "") {
   const index = process.argv.indexOf(`--${name}`);
@@ -199,6 +202,8 @@ function main() {
   const sourceSha = flag("source-sha").toLowerCase();
   const packageName = flag("package", "@kungfu-tech/buildchain");
   const publisherMode = flag("publisher-mode", "npm-trusted-publisher");
+  const publicationVersion = flag("publication-version");
+  const allowReleaseReconciliation = process.argv.includes("--allow-release-reconciliation");
   if (!repository || !branch) throw new Error("--repository and --branch are required");
 
   const encodedWorkflow = workflowPath.split("/").map(encodeURIComponent).join("/");
@@ -260,13 +265,51 @@ function main() {
     if (!/^[0-9a-f]{40}$/.test(sourceSha)) {
       throw new Error("--source-sha is required when detailed branch policy is not readable");
     }
-    const pullRequests = githubJson(`repos/${repository}/commits/${sourceSha}/pulls`, "source pull-request lineage");
-    const mergedPullRequest = (Array.isArray(pullRequests) ? pullRequests : []).find((entry) =>
+    const sourceCommit = githubJson(`repos/${repository}/commits/${sourceSha}`, "source commit");
+    const sourceParents = Array.isArray(sourceCommit.parents) ? sourceCommit.parents.map((entry) => String(entry?.sha || "").toLowerCase()) : [];
+    const sourceChangedPaths = Array.isArray(sourceCommit.files) ? sourceCommit.files.map((entry) => String(entry?.filename || "")) : [];
+    const sourceMessage = String(sourceCommit.commit?.message || "").split("\n", 1)[0];
+    let authorizationSha = sourceSha;
+    let releaseReconciliation = {
+      qualifying: false,
+      parentSha: "",
+      version: publicationVersion,
+      message: sourceMessage,
+      changedPaths: sourceChangedPaths,
+    };
+    let pullRequests = githubJson(`repos/${repository}/commits/${authorizationSha}/pulls`, "source pull-request lineage");
+    let mergedPullRequest = (Array.isArray(pullRequests) ? pullRequests : []).find((entry) =>
       entry?.merged_at &&
-      entry.merge_commit_sha === sourceSha &&
+      entry.merge_commit_sha === authorizationSha &&
       entry.base?.ref === branch &&
       entry.head?.repo?.full_name === repository
     );
+    if (!mergedPullRequest && allowReleaseReconciliation) {
+      const packageFile = githubJson(
+        `repos/${repository}/contents/package.json?ref=${encodeURIComponent(sourceSha)}`,
+        "release reconciliation package metadata",
+      );
+      const packageJson = JSON.parse(Buffer.from(String(packageFile.content || ""), "base64").toString("utf8"));
+      const parentSha = sourceParents.length === 1 ? sourceParents[0] : "";
+      releaseReconciliation = evaluateBuildchainReleaseReconciliation({
+        repository,
+        publicationVersion,
+        packageVersion: packageJson.version,
+        message: sourceMessage,
+        parentSha,
+        changedPaths: sourceChangedPaths,
+      });
+      if (releaseReconciliation.qualifying) {
+        authorizationSha = parentSha;
+        pullRequests = githubJson(`repos/${repository}/commits/${authorizationSha}/pulls`, "release parent pull-request lineage");
+        mergedPullRequest = (Array.isArray(pullRequests) ? pullRequests : []).find((entry) =>
+          entry?.merged_at &&
+          entry.merge_commit_sha === authorizationSha &&
+          entry.base?.ref === branch &&
+          entry.head?.repo?.full_name === repository
+        );
+      }
+    }
     const reviews = mergedPullRequest
       ? githubJson(`repos/${repository}/pulls/${mergedPullRequest.number}/reviews?per_page=100`, "source pull-request reviews")
       : [];
@@ -316,7 +359,9 @@ function main() {
       requiredCheckAppId: requiredCheckSource?.app_id || 0,
       requiredCheckSha: pullRequestHeadSha,
       sourceSha,
+      authorizationSha,
       headSha: String(branchState.commit?.sha || "").toLowerCase(),
+      releaseReconciliation,
       mergedPullRequest: Boolean(mergedPullRequest),
       pullRequestNumber: mergedPullRequest?.number || 0,
       pullRequestHeadSha,

package/scripts/web-surface-core.mjs

@@ -354,7 +354,7 @@ function publicationImmutablePolicy({ artifactRoot, binding }) {
       throw new Error(`declared immutable publication prefix does not exist in artifact: ${prefix}`);
     }
   }
-  const preservedRoots = [...new Set(declaredPrefixes.map((prefix) => prefix.split("/")[0]))].sort();
+  const preservedRoots = declaredPrefixes;
   const files = preservedRoots
     .flatMap((root) => listFiles(surfaceRoot, root))
     .map((filePath) => ({

package/scripts/web-surface-production-decision.mjs

@@ -8,6 +8,7 @@ const TRUSTED_PERMISSIONS = new Set(["write", "maintain", "admin"]);
 
 export function resolveWebSurfaceProductionDecision({
   eventName,
+  eventAction = "",
   refName,
   repository,
   sourceSha,
@@ -36,9 +37,11 @@ export function resolveWebSurfaceProductionDecision({
       reason: trusted ? "trusted-manual-dispatch" : "manual-actor-permission-insufficient",
     });
   }
+  const reviewedReleaseEvent =
+    (eventName === "push" && refName === "main") ||
+    (eventName === "pull_request" && eventAction === "closed");
   if (
-    eventName === "push" &&
-    refName === "main" &&
+    reviewedReleaseEvent &&
     productionApply === true &&
     productionReleaseOnMain === true &&
     releaseApproved === true
@@ -103,9 +106,10 @@ async function main() {
   }
   const decision = resolveWebSurfaceProductionDecision({
     eventName,
+    eventAction: process.env.GITHUB_EVENT_ACTION,
     refName: process.env.GITHUB_REF_NAME,
     repository,
-    sourceSha: process.env.GITHUB_SHA,
+    sourceSha: process.env.BUILDCHAIN_PRODUCTION_SOURCE_SHA || process.env.GITHUB_SHA,
     actor,
     productionApply: bool("BUILDCHAIN_PRODUCTION_APPLY"),
     productionApproved: bool("BUILDCHAIN_PRODUCTION_APPROVED"),