@kungfu-tech/buildchain 2.14.18-alpha.1 → 2.14.18-alpha.10

package/dist/site/public-surface-audit.json

@@ -3,11 +3,11 @@
   "contract": "kungfu-buildchain-public-surface-reverse-audit",
   "status": "passed",
   "summary": {
-    "cliCommandCount": 86,
-    "workflowCount": 51,
+    "cliCommandCount": 87,
+    "workflowCount": 52,
     "actionCount": 5,
-    "sitePageCount": 53,
-    "docCommandRefCount": 265,
+    "sitePageCount": 54,
+    "docCommandRefCount": 276,
     "failureCount": 0
   },
   "enumerated": {
@@ -102,6 +102,11 @@
         "source": "bin/buildchain.mjs",
         "usage": "buildchain facts"
       },
+      {
+        "id": "github-governance",
+        "source": "bin/buildchain.mjs",
+        "usage": "buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ..."
+      },
       {
         "id": "help",
         "source": "bin/buildchain.mjs",
@@ -453,6 +458,7 @@
           "buildchain-ref",
           "buildchain-repository",
           "evidence-run-id",
+          "github-governance-receipt-json",
           "publication-admission-json",
           "publication-control-plane-audit-json",
           "publication-expected-json",
@@ -464,7 +470,7 @@
           "source-sha",
           "target-ref"
         ],
-        "inputCount": 14,
+        "inputCount": 15,
         "secrets": [],
         "secretCount": 0,
         "outputs": [],
@@ -501,6 +507,7 @@
           "checkout-cache-mode",
           "checkout-cache-reference-repository-template",
           "checkout-cache-timeout-seconds",
+          "credential-island-caller-owned",
           "credential-island-environment",
           "credential-island-macos-app-path",
           "credential-island-macos-platform-id",
@@ -540,7 +547,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 64,
+        "inputCount": 65,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -683,6 +690,7 @@
           "evidence-summary-artifact",
           "expected-json",
           "gate-aggregate-json",
+          "github-governance-receipt-json",
           "package-name",
           "product",
           "publication-target",
@@ -694,9 +702,11 @@
           "target-ref",
           "used-nonces-json"
         ],
-        "inputCount": 32,
-        "secrets": [],
-        "secretCount": 0,
+        "inputCount": 33,
+        "secrets": [
+          "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
+        ],
+        "secretCount": 1,
         "outputs": [
           "capability-artifact",
           "capability-digest",
@@ -724,8 +734,10 @@
           "buildchain-repository",
           "channel",
           "dry-run",
+          "github-governance-receipt-json",
           "github-release",
           "github-release-notes",
+          "github-release-payload-patterns",
           "github-release-title",
           "package-manager",
           "promotion-contract-lock-digest",
@@ -742,6 +754,8 @@
           "publication-admission-json",
           "publication-auto-admission",
           "publication-auto-no-gate",
+          "publication-commit-command",
+          "publication-commit-evidence-path",
           "publication-consumer-predicate-id",
           "publication-consumer-qualification-command",
           "publication-control-plane-audit-json",
@@ -786,17 +800,20 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 74,
+        "inputCount": 78,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
           "BUILDCHAIN_ISSUE_TOKEN",
           "BUILDCHAIN_PROMOTION_TOKEN",
+          "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+          "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+          "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
           "buildchain-issue-app-id",
           "buildchain-issue-app-private-key",
           "buildchain-issue-token"
         ],
-        "secretCount": 7,
+        "secretCount": 10,
         "outputs": [
           "built-source-sha",
           "controller-plan-artifact",
@@ -808,9 +825,13 @@
           "controller-receipt-status",
           "promoted-sha",
           "publication-capability-digest",
+          "publication-commit-evidence-digest",
+          "publication-commit-evidence-path",
+          "publication-commit-payload-root",
+          "publication-commit-url",
           "release-candidate-artifact"
         ],
-        "outputCount": 11
+        "outputCount": 15
       },
       {
         "id": ".release-docker",
@@ -1059,6 +1080,7 @@
           "buildchain-ref",
           "buildchain-repository",
           "fail-on-release-pr-error",
+          "github-governance-receipt-json",
           "node-version",
           "preview-apply",
           "preview-aws-role-arn",
@@ -1090,7 +1112,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 39,
+        "inputCount": 40,
         "secrets": [
           "production-release-app-private-key"
         ],
@@ -1228,6 +1250,7 @@
           "checkout-cache-mode",
           "checkout-cache-reference-repository-template",
           "checkout-cache-timeout-seconds",
+          "credential-island-caller-owned",
           "credential-island-environment",
           "credential-island-macos-app-path",
           "credential-island-macos-platform-id",
@@ -1267,7 +1290,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 67,
+        "inputCount": 68,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1523,6 +1546,17 @@
         ],
         "outputCount": 6
       },
+      {
+        "id": "github-governance-audit",
+        "path": ".github/workflows/github-governance-audit.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
       {
         "id": "npm-publish",
         "path": ".github/workflows/npm-publish.yml",
@@ -1549,6 +1583,7 @@
           "buildchain-ref",
           "buildchain-repository",
           "dry-run",
+          "github-governance-receipt-json",
           "github-release",
           "github-release-notes",
           "github-release-title",
@@ -1565,7 +1600,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 25,
+        "inputCount": 26,
         "secrets": [
           "BUILDCHAIN_PROMOTION_TOKEN"
         ],
@@ -1596,6 +1631,7 @@
           "buildchain-ref",
           "buildchain-repository",
           "dry-run",
+          "github-governance-receipt-json",
           "github-release",
           "github-release-notes",
           "github-release-title",
@@ -1622,7 +1658,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 37,
+        "inputCount": 38,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
@@ -1819,13 +1855,17 @@
           "buildchain-stable-contract-lock-path",
           "channel",
           "dry-run",
+          "github-governance-receipt-json",
           "github-release",
           "github-release-notes",
+          "github-release-payload-patterns",
           "github-release-title",
           "package-manager",
           "publication-admission-json",
           "publication-auto-admission",
           "publication-auto-no-gate",
+          "publication-commit-command",
+          "publication-commit-evidence-path",
           "publication-consumer-predicate-id",
           "publication-consumer-qualification-command",
           "publication-control-plane-audit-json",
@@ -1870,17 +1910,20 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 66,
+        "inputCount": 70,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
           "BUILDCHAIN_ISSUE_TOKEN",
           "BUILDCHAIN_PROMOTION_TOKEN",
+          "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+          "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+          "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
           "buildchain-issue-app-id",
           "buildchain-issue-app-private-key",
           "buildchain-issue-token"
         ],
-        "secretCount": 7,
+        "secretCount": 10,
         "outputs": [
           "buildchain-channel",
           "built-source-sha",
@@ -1904,9 +1947,13 @@
           "promotion-shell-sha",
           "promotion-target-ref",
           "publication-capability-digest",
+          "publication-commit-evidence-digest",
+          "publication-commit-evidence-path",
+          "publication-commit-payload-root",
+          "publication-commit-url",
           "release-candidate-artifact"
         ],
-        "outputCount": 23
+        "outputCount": 27
       },
       {
         "id": "release-governance-reconcile",
@@ -2107,6 +2154,7 @@
           "branch-protection-bypass-users",
           "dry-run",
           "expected-publication-version",
+          "generated-pull-request-token",
           "generated-ref-update-token",
           "generated-status-check-token",
           "github-release",
@@ -2165,7 +2213,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 63
+        "inputCount": 64
       },
       {
         "id": "report-buildchain-issue",
@@ -2353,6 +2401,10 @@
         "id": "manual:controller-evidence",
         "category": "manual"
       },
+      {
+        "id": "manual:github-governance-authority",
+        "category": "manual"
+      },
       {
         "id": "manual:homebrew",
         "category": "manual"
@@ -2471,6 +2523,16 @@
       }
     ],
     "docCommandRefs": [
+      {
+        "id": "audit",
+        "path": "docs/github-governance-authority.md",
+        "command": "buildchain audit github-governance"
+      },
+      {
+        "id": "audit",
+        "path": "docs/github-governance-authority.md",
+        "command": "buildchain audit github-governance"
+      },
       {
         "id": "audit",
         "path": "docs/publication-authority.md",
@@ -2786,6 +2848,51 @@
         "path": "docs/cli.md",
         "command": "buildchain facts"
       },
+      {
+        "id": "github-governance",
+        "path": "docs/github-governance-authority.md",
+        "command": "buildchain github-governance plan"
+      },
+      {
+        "id": "github-governance",
+        "path": "docs/github-governance-authority.md",
+        "command": "buildchain github-governance apply"
+      },
+      {
+        "id": "github-governance",
+        "path": "docs/github-governance-authority.md",
+        "command": "buildchain github-governance rollback"
+      },
+      {
+        "id": "github-governance",
+        "path": "docs/github-governance-authority.md",
+        "command": "buildchain github-governance protection-policy-plan"
+      },
+      {
+        "id": "github-governance",
+        "path": "docs/github-governance-authority.md",
+        "command": "buildchain github-governance protection-policy-apply"
+      },
+      {
+        "id": "github-governance",
+        "path": "docs/github-governance-authority.md",
+        "command": "buildchain github-governance protection-policy-rollback"
+      },
+      {
+        "id": "github-governance",
+        "path": "docs/github-governance-authority.md",
+        "command": "buildchain github-governance ruleset-policy-plan"
+      },
+      {
+        "id": "github-governance",
+        "path": "docs/github-governance-authority.md",
+        "command": "buildchain github-governance ruleset-policy-apply"
+      },
+      {
+        "id": "github-governance",
+        "path": "docs/github-governance-authority.md",
+        "command": "buildchain github-governance ruleset-policy-rollback"
+      },
       {
         "id": "help",
         "path": "docs/cli.md",
@@ -3802,9 +3909,9 @@
     "cliRegistryPath": "dist/site/cli-registry.json",
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
-    "cliRegistryDigest": "cc76cd0f061103d8ab78ee97dd0b7f0d28d64489f79b7ed06c94d8fef28bc200",
-    "workflowRegistryDigest": "3a444436846b336459e4ee7e968f820e442a170b642d7b73ea19eaa28ed7da6c",
-    "pageRegistryDigest": "47fb460187d5775db272b95f59ce44d89fce89d10301d52a815b00eebebbadca"
+    "cliRegistryDigest": "5ba7fd93a13993b05767b6f02d0626a7347f25c3d7cd4589ed4f70028c1f1bd1",
+    "workflowRegistryDigest": "c2abf629b205a96f536e8758c3d9cdb3eade6945294fe278774877ef41d90b60",
+    "pageRegistryDigest": "16a40ed6f3848fcb6a743f9d0369b04e956dfb7b8548b1a7a79266f76b928c80"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -323,6 +323,19 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/github-governance-audit.yml",
+      "authorityClass": "governance-write",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/github-governance-audit.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/npm-publish.yml",
       "authorityClass": "dry-run-only",
@@ -726,6 +739,13 @@
       ],
       "classified": true
     },
+    {
+      "path": ".github/workflows/github-governance-audit.yml",
+      "signals": [
+        "write-permission"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/npm-publish.yml",
       "signals": [
@@ -850,5 +870,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "afd9a121b15d4965c55fcbe2c6c4d59b94e96536179c145f246d8fd0517aad7b"
+  "registryDigest": "5487944a7dcac3931faeec5cde33a00254b9fdd8023ef0d21e1569c43d65e1bf"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-24T00:28:32.040Z",
-  "publishedAt": "2026-07-24T00:28:32.040Z",
+  "generatedAt": "2026-07-24T15:05:40.482Z",
+  "publishedAt": "2026-07-24T15:05:40.482Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ac97c62bfce8d1c686718519ccf2fd8f974142e1",
+  "sourceRevision": "dd874a40c2a6c55f2b7939760104249f60017807",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.1",
+    "version": "2.14.18-alpha.10",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -34,6 +34,7 @@
       "./publication-authority": "./packages/core/publication-authority.js",
       "./publication-control-plane-audit": "./packages/core/publication-control-plane-audit.js",
       "./buildchain-publication-authority": "./packages/core/buildchain-publication-authority.js",
+      "./github-governance-authority": "./packages/core/github-governance-authority.js",
       "./kfd-gate": "./packages/core/kfd-gate.js",
       "./release-candidate": "./packages/core/release-candidate.js",
       "./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-24T00:28:32.040Z",
-  "publishedAt": "2026-07-24T00:28:32.040Z",
+  "generatedAt": "2026-07-24T15:05:40.482Z",
+  "publishedAt": "2026-07-24T15:05:40.482Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ac97c62bfce8d1c686718519ccf2fd8f974142e1",
+  "sourceRevision": "dd874a40c2a6c55f2b7939760104249f60017807",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.1",
+    "version": "2.14.18-alpha.10",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:7f007a9d295d597dfc5b1447629ab0d6bf2b3fa3d625b02d27abf7493d73bb40"
+      "digest": "sha256:c9eb92eb02601e1e36cb38d7df93097c582dec2b8dc34f769f58c30fc5190bbe"
     },
     {
       "id": "install",
@@ -87,6 +87,14 @@
       "exists": true,
       "digest": "sha256:118dc751fa3c37b4b20f4b909534458148c0f42c2c9d69f13e2fa5373dbfe244"
     },
+    {
+      "id": "github-governance-authority",
+      "title": "GitHub governance authority",
+      "path": "docs/github-governance-authority.md",
+      "plane": "verify",
+      "exists": true,
+      "digest": "sha256:8484b18d5b0fe6d61d102d6b9cb9e18beac9f47ecb516d430fb5427518e2931f"
+    },
     {
       "id": "release-candidate",
       "title": "Release Candidate Passport",
@@ -221,7 +229,7 @@
       "path": "docs/lifecycle-protocol.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:71552baae51146fa790d40af02d5d5b3a1a4aa0d9764af09907bb05d3360b0cc"
+      "digest": "sha256:9c669d3d2d1926dc5b421207089cca85bac0a6dcdb5544c28a7e1659ba9ed5ee"
     },
     {
       "id": "reusable-build-surface",
@@ -229,7 +237,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:069ba73cf32b9f55a62fd5f4bfaec00608498019b53e8ae1387d7dc9de26bc29"
+      "digest": "sha256:ff6f36e1db2be12df37ef076935b5583493742528d98403297678a0682b67dc2"
     },
     {
       "id": "publish-transaction",
@@ -237,7 +245,7 @@
       "path": "docs/publish-transaction.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:57673d6e1e57a9be0019b30ad0f8784cd05c9a0f389a775ac5f49f67d8f52a79"
+      "digest": "sha256:cde5256d5f6443a6d32b47783900a0677e973855266af5a360db8d4d112bb677"
     },
     {
       "id": "release-governance",
@@ -245,7 +253,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:4476d9464d29b4ff3951a362607a11c78b7a3b723247af93ded1b15ff8f0b83e"
+      "digest": "sha256:5aa7fef2c831d14b4d1df4cddb45c6ce97929d8530eb14e3b3dfa3dee5e0d651"
     },
     {
       "id": "release-flow",
@@ -277,7 +285,7 @@
       "path": "docs/web-surface-deployments.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ecdece4b7d916b7d8b323db68c5d81c533d67348c71907b46eb97d3c2fe432ba"
+      "digest": "sha256:809d765d89277320d710ecfdc2287029530b74fe38f36dd04d057076dded9a0d"
     }
   ],
   "facts": [