@kungfu-tech/buildchain 2.14.18-alpha.1 → 2.14.18-alpha.11

package/dist/site/workflow-registry.json

@@ -12,6 +12,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "evidence-run-id",
+        "github-governance-receipt-json",
         "publication-admission-json",
         "publication-control-plane-audit-json",
         "publication-expected-json",
@@ -23,7 +24,7 @@
         "source-sha",
         "target-ref"
       ],
-      "inputCount": 14,
+      "inputCount": 15,
       "secrets": [],
       "secretCount": 0,
       "outputs": [],
@@ -63,6 +64,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "credential-island-caller-owned",
         "credential-island-environment",
         "credential-island-macos-app-path",
         "credential-island-macos-platform-id",
@@ -102,7 +104,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 64,
+      "inputCount": 65,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -254,6 +256,7 @@
         "evidence-summary-artifact",
         "expected-json",
         "gate-aggregate-json",
+        "github-governance-receipt-json",
         "package-name",
         "product",
         "publication-target",
@@ -265,9 +268,11 @@
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 32,
-      "secrets": [],
-      "secretCount": 0,
+      "inputCount": 33,
+      "secrets": [
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
+      ],
+      "secretCount": 1,
       "outputs": [
         "capability-artifact",
         "capability-digest",
@@ -298,8 +303,10 @@
         "buildchain-repository",
         "channel",
         "dry-run",
+        "github-governance-receipt-json",
         "github-release",
         "github-release-notes",
+        "github-release-payload-patterns",
         "github-release-title",
         "package-manager",
         "promotion-contract-lock-digest",
@@ -316,6 +323,8 @@
         "publication-admission-json",
         "publication-auto-admission",
         "publication-auto-no-gate",
+        "publication-commit-command",
+        "publication-commit-evidence-path",
         "publication-consumer-predicate-id",
         "publication-consumer-qualification-command",
         "publication-control-plane-audit-json",
@@ -360,17 +369,20 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 74,
+      "inputCount": 78,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
         "BUILDCHAIN_ISSUE_TOKEN",
         "BUILDCHAIN_PROMOTION_TOKEN",
+        "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+        "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
         "buildchain-issue-app-id",
         "buildchain-issue-app-private-key",
         "buildchain-issue-token"
       ],
-      "secretCount": 7,
+      "secretCount": 10,
       "outputs": [
         "built-source-sha",
         "controller-plan-artifact",
@@ -382,9 +394,13 @@
         "controller-receipt-status",
         "promoted-sha",
         "publication-capability-digest",
+        "publication-commit-evidence-digest",
+        "publication-commit-evidence-path",
+        "publication-commit-payload-root",
+        "publication-commit-url",
         "release-candidate-artifact"
       ],
-      "outputCount": 11,
+      "outputCount": 15,
       "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
       "status": "active"
@@ -660,6 +676,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "fail-on-release-pr-error",
+        "github-governance-receipt-json",
         "node-version",
         "preview-apply",
         "preview-aws-role-arn",
@@ -691,7 +708,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 39,
+      "inputCount": 40,
       "secrets": [
         "production-release-app-private-key"
       ],
@@ -847,6 +864,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "credential-island-caller-owned",
         "credential-island-environment",
         "credential-island-macos-app-path",
         "credential-island-macos-platform-id",
@@ -886,7 +904,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 67,
+      "inputCount": 68,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1181,6 +1199,20 @@
       "capabilityGroup": "governance-versioning",
       "status": "active"
     },
+    {
+      "id": "github-governance-audit",
+      "path": ".github/workflows/github-governance-audit.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "dev-governance",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": "npm-publish",
       "path": ".github/workflows/npm-publish.yml",
@@ -1210,6 +1242,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "dry-run",
+        "github-governance-receipt-json",
         "github-release",
         "github-release-notes",
         "github-release-title",
@@ -1226,7 +1259,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 25,
+      "inputCount": 26,
       "secrets": [
         "BUILDCHAIN_PROMOTION_TOKEN"
       ],
@@ -1260,6 +1293,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "dry-run",
+        "github-governance-receipt-json",
         "github-release",
         "github-release-notes",
         "github-release-title",
@@ -1286,7 +1320,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 37,
+      "inputCount": 38,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -1501,13 +1535,17 @@
         "buildchain-stable-contract-lock-path",
         "channel",
         "dry-run",
+        "github-governance-receipt-json",
         "github-release",
         "github-release-notes",
+        "github-release-payload-patterns",
         "github-release-title",
         "package-manager",
         "publication-admission-json",
         "publication-auto-admission",
         "publication-auto-no-gate",
+        "publication-commit-command",
+        "publication-commit-evidence-path",
         "publication-consumer-predicate-id",
         "publication-consumer-qualification-command",
         "publication-control-plane-audit-json",
@@ -1552,17 +1590,20 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 66,
+      "inputCount": 70,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
         "BUILDCHAIN_ISSUE_TOKEN",
         "BUILDCHAIN_PROMOTION_TOKEN",
+        "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+        "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
         "buildchain-issue-app-id",
         "buildchain-issue-app-private-key",
         "buildchain-issue-token"
       ],
-      "secretCount": 7,
+      "secretCount": 10,
       "outputs": [
         "buildchain-channel",
         "built-source-sha",
@@ -1586,9 +1627,13 @@
         "promotion-shell-sha",
         "promotion-target-ref",
         "publication-capability-digest",
+        "publication-commit-evidence-digest",
+        "publication-commit-evidence-path",
+        "publication-commit-payload-root",
+        "publication-commit-url",
         "release-candidate-artifact"
       ],
-      "outputCount": 23,
+      "outputCount": 27,
       "surface": "release-governance",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -1822,6 +1867,7 @@
         "branch-protection-bypass-users",
         "dry-run",
         "expected-publication-version",
+        "generated-pull-request-token",
         "generated-ref-update-token",
         "generated-status-check-token",
         "github-release",
@@ -1880,7 +1926,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 63,
+      "inputCount": 64,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/MAP.md

@@ -34,7 +34,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Publication Artifacts | `publication-registry.json`, `workflow-registry.json`, `node-api-registry.json`, `manual-registry.json`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md), [`reusable-build-surface.md`](reusable-build-surface.md) |
 | Distribution Indexes and Badges | `badge-endpoint-registry.json`, `node-api-registry.json`, `manual-registry.json` | [`readme-badges.md`](readme-badges.md), [`homebrew.md`](homebrew.md) |
 | Build Facts, Observability, and Diagnostics | `cli-registry.json`, `node-api-registry.json`, lifecycle artifacts | [`build-facts.md`](build-facts.md), [`toolkit-observability.md`](toolkit-observability.md), [`consumer-issue-reporting.md`](consumer-issue-reporting.md) |
-| Governance, Versioning, and Runtime Drift | `buildchain-contract.json`, `workflow-registry.json`, `release-model.json` | [`release-governance.md`](release-governance.md), [`release-flow.md`](release-flow.md), [`versioning.md`](versioning.md), [`runtime-train-validation.md`](runtime-train-validation.md), [`cli.md`](cli.md) |
+| Governance, Versioning, and Runtime Drift | `buildchain-contract.json`, `workflow-registry.json`, `release-model.json` | [`github-governance-authority.md`](github-governance-authority.md), [`release-governance.md`](release-governance.md), [`release-flow.md`](release-flow.md), [`versioning.md`](versioning.md), [`runtime-train-validation.md`](runtime-train-validation.md), [`cli.md`](cli.md) |
 | CLI and Node API Reference | `cli-registry.json`, `node-api-registry.json`, `workflow-registry.json`, `manual-registry.json` | [`cli.md`](cli.md), [`../packages/core/README.md`](../packages/core/README.md) |
 
 | Capability | Machine-readable entry | Manual entry |
@@ -49,6 +49,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | npm publish transactions, evidence, dist-tags, and recovery | `dist/site/release-model.json`, `dist/site/artifact-schemas.json` | [`publish-transaction.md`](publish-transaction.md) |
 | Git/source/version/module/product build facts | `dist/site/node-api-registry.json`, `dist/site/cli-registry.json`, `kungfu-buildchain-module-build-facts`, `kungfu-buildchain-product-build-facts` | [`build-facts.md`](build-facts.md) |
 | GitHub Release passport/evidence publication | `dist/site/release-model.json`, `dist/site/artifact-schemas.json` | [`release-governance.md`](release-governance.md), [`release-candidate.md`](release-candidate.md) |
+| GitHub ownership, effective protection, plan capability, and managed-zone governance receipts | `dist/site/node-api-registry.json`, `dist/site/cli-registry.json`, `kungfu-buildchain-github-governance-receipt` | [`github-governance-authority.md`](github-governance-authority.md) |
 | release propagation for package/publication/site chains | `dist/site/release-model.json` | [`release-propagation.md`](release-propagation.md) |
 | publication artifact manifests, immutable archive registries, source bundles, and paper repository workflows | `dist/site/publication-registry.json`, `dist/site/workflow-registry.json`, `dist/site/node-api-registry.json`, `kungfu-buildchain-publication-artifact-manifest`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md) |
 | Generated badge bundles, README badge blocks, and badge facts | `dist/site/node-api-registry.json`, `dist/site/manual-registry.json`, `kungfu-buildchain-badge-bundle-facts`, `kungfu-buildchain-readme-badge-facts` | [`readme-badges.md`](readme-badges.md) |
@@ -86,6 +87,7 @@ replace them.
 | How do I publish or verify release passport artifacts? | [`release-passport.md`](release-passport.md) | use | stable |
 | How do I seal exact artifact, identity, lifecycle, and KFD assessment roots for KFX admission? | [`artifact-verification-envelope.md`](artifact-verification-envelope.md) | verify/use | preview |
 | How is product publication authority sealed to an exact workflow, runner, control plane, nonce, and artifact? | [`publication-authority.md`](publication-authority.md) | verify | preview |
+| How are GitHub ownership, independent review, effective protection, and plan capability audited fail-closed? | [`github-governance-authority.md`](github-governance-authority.md) | verify | preview |
 | How do I gate release artifacts with KFD-1 contract-world witnesses? | [`release-passport.md`](release-passport.md#kfd-1-contract-world-release-gate) | verify/use | stable |
 | How do I declare, render, and audit product KFD-2 release trust claims? | [`kfd-support.md`](kfd-support.md#kfd-2) + [`release-passport.md`](release-passport.md#kfd-2-release-trust-passport-audit) + [`cli.md`](cli.md) | verify/use | stable |
 | How do I gate KFD-3 collaboration-interface releases? | [`release-passport.md`](release-passport.md#kfd-3-collaboration-interface-release-gate) + [`cli.md`](cli.md) | verify/use | stable |

package/docs/github-governance-authority.md

@@ -0,0 +1,267 @@
+---
+status: draft
+period: ongoing
+theme: github-governance-authority
+doc_type: protocol
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-07-24
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-07-24
+  limits: Live GitHub state and account recovery remain provider-controlled and must be re-audited.
+---
+
+# GitHub Governance Authority
+
+Buildchain treats GitHub governance as an independently verified, fail-closed
+authority boundary. A green CI run, a CODEOWNERS file, an API success response,
+or an administrator's assertion is not sufficient by itself. The verifier
+combines the exact CODEOWNERS bytes from the target base branch, classic branch
+protection, every applicable repository or organization ruleset, account role
+classes, plan capability, required checks, and provider-read completeness into
+one short-lived immutable receipt.
+
+The machine contract is
+`@kungfu-tech/buildchain/github-governance-authority`. Its policy root covers
+the managed-zone repository and target-ref admission rules, the exact
+required-check context/App bindings and strict-update semantics for every
+public authoritative target, the dual-account authority split, protected
+verifier paths, native review requirements, break-glass constraints, and the
+explicit trust boundary.
+
+## Trust boundary and non-claims
+
+The trusted computing base contains GitHub service integrity, retained
+organization-owner recovery custody, the `kungfu-origin` review/governance
+identity, the exact Buildchain verifier, and official publication identities.
+The protocol does not claim resistance to compromise of GitHub itself,
+compromise of all retained owner and recovery anchors, or malicious control of
+all independent trust anchors. A governance receipt grants no GitHub
+permission and is not a bearer credential.
+
+`dongkeren` is the development and pull-request author identity.
+`kungfu-origin` is the independent Code Owner and governance identity. A
+qualifying receipt requires the development identity to be active without an
+administrator or maintainer role and requires the review identity to retain the
+admitted governance role. Account recovery and retained root custody remain
+outside normal contributor and workflow paths.
+
+## Effective policy
+
+The verifier evaluates native provider layers together. Every authoritative
+target must require:
+
+- a pull request, at least one independent Code Owner approval, and a fresh
+  approval after the latest reviewable push;
+- administrator enforcement, resolved review conversations, and a non-empty
+  required-check set whose exact contexts, GitHub App producer identities, and
+  strict-update setting match the versioned target policy;
+- no unapproved bypass actor, force push, or protected-ref deletion. Managed
+  dev/alpha/release ref bookkeeping may admit only the exact GitHub Actions App
+  identity versioned for that target; user and team bypass actors remain
+  non-qualifying;
+- exact last-match ownership of CODEOWNERS and the governance descriptor,
+  collector, rollout planner, and scheduled audit workflow;
+- complete readable GitHub API evidence. Missing, forbidden, ambiguous, or
+  malformed provider state is non-qualifying.
+
+Repository and organization rulesets are additive to classic branch
+protection. Inspecting only one layer is insufficient because an applicable
+bypass or weaker update path in another layer can invalidate the effective
+policy.
+
+## Repository and plan admission
+
+The 2026-07-24 baseline contains 16 managed repositories: 13 public and three
+private. Public repository names are versioned in the descriptor. Private
+repository names are never emitted in public evidence; their identities are
+represented by stable roots derived from the GitHub provider repository ID,
+independent of the governance policy root. This prevents a policy revision from
+changing repository identity or creating a circular admission dependency. A
+newly discovered repository or target ref is non-authoritative until explicitly
+admitted.
+
+The descriptor also versions every active public merge target. The full audit
+evaluates one receipt per authoritative target rather than assuming the default
+branch represents dev, alpha, release, or major publish-gate branches. The live
+default branch is always included even if it drifts outside the registry, in
+which case it is non-qualifying. Retained historical channels and generated
+per-release publish-gate refs are not silently deleted or promoted to current
+authority; they require an explicit registry revision before they can qualify.
+
+For an admitted private repository, the active target set is the current
+default branch plus existing alpha/release siblings on the same version line.
+Its required-check bindings remain non-qualifying until their sanitized binding
+roots are sealed into the private identity entry after supported native
+protection exists.
+
+Public repositories can qualify on supported Free, Team, or Enterprise
+enforcement. Private repositories and organization-wide rules require Team or
+Enterprise capability. On an unsupported plan they remain explicitly
+`non-authoritative-plan-capability-required` and publication-ineligible. The
+verifier does not replace missing native enforcement with CI or documentation,
+and the implementation never makes a private repository public as a
+workaround.
+
+## Read-only audit
+
+Run the organization audit without mutation:
+
+```bash
+buildchain audit github-governance \
+  --organization kungfu-systems \
+  --output github-governance.json \
+  --json
+```
+
+Limit a canary to one repository:
+
+```bash
+buildchain audit github-governance \
+  --repository kungfu-systems/buildchain \
+  --target-ref dev/v2/v2.14 \
+  --require-qualifying \
+  --json
+```
+
+Protected merge and publication consumers verify the receipt against the exact
+repository, target base ref, policy root, freshness window, and exact
+Buildchain verifier source revision. Non-dry-run publication does not trust a
+caller-supplied JSON hash: it mints a bounded token for the dedicated read-only
+governance auditor GitHub App, recollects live provider state with the exact
+Buildchain runtime, requires the resulting single-repository/single-target
+audit to qualify, and consumes that independently generated receipt. Missing
+App configuration or unreadable provider state denies publication before
+provider mutation. The publication authority workflow is itself an explicit
+Code Owner path.
+
+The publication authority job and every reusable-workflow caller grant the
+built-in `GITHUB_TOKEN` only `actions: read`, `checks: read`, `contents: read`,
+and `pull-requests: read`. The dedicated auditor App independently recollects
+the organization-wide governance receipt, while these job-scoped permissions
+allow the exact publication transaction audit to resolve required check runs
+and merged pull-request review lineage. Omitting either read permission makes
+the transaction evidence incomplete and therefore non-qualifying.
+
+The output is sanitized. Public repositories retain their public identity.
+Private repositories expose only an identity root, visibility class, target
+ref, sanitized required-check bindings and fact roots, and a qualifying or
+non-qualifying decision. Tokens, cookies, recovery material, private
+CODEOWNERS bytes, raw permission payloads, and credential-bearing URLs are
+never included.
+
+## Mutation and rollback boundary
+
+Live role, ruleset, branch-protection, Actions, Environment, or repository
+changes are separate from audit. Every mutation starts from a read-only
+inventory and a frozen rollback snapshot. A rollout plan binds both roots and
+lists the exact API operation, impact, expected observation, and inverse
+operation. Apply must stop on the first unexplained drift and must perform a
+post-change read-back before continuing to the next bounded canary.
+
+Plan one exact branch without mutation:
+
+```bash
+buildchain github-governance plan \
+  --repository kungfu-systems/buildchain \
+  --branch dev/v2/v2.14 \
+  --required-check check \
+  --required-check-app-id check=15368 \
+  --required-approvals 1 \
+  --snapshot-output rollback.json \
+  --plan-output rollout.json
+```
+
+An already protected check preserves its observed GitHub App binding. Every new
+required check must declare `--required-check-app-id <context>=<app-id>`;
+context-only replacement is rejected because it would broaden which producer
+can satisfy the gate.
+
+Classic branch-protection bypass allowances and ruleset bypass actors are both
+part of the effective policy. Reconciliation writes explicit empty user, team,
+and App bypass lists and verifies those lists after apply; omitting the provider
+field is not treated as removal because GitHub may preserve the prior value.
+
+The plan prints a `planRoot`. Apply requires that exact root and stops if live
+protection no longer matches the frozen inventory:
+
+```bash
+buildchain github-governance apply \
+  --plan-json rollout.json \
+  --confirm-plan-root sha256:...
+```
+
+Rollback is separately explicit and root-bound:
+
+```bash
+buildchain github-governance rollback \
+  --plan-json rollout.json \
+  --confirm-rollback-root sha256:...
+```
+
+For an admitted exact target, classic branch protection can also be compiled
+directly from the authority descriptor. This mode preserves both App-bound
+checks and intentionally unbound check contexts such as Kungfu alpha's
+`build`, rather than guessing a provider App identity.
+
+```bash
+buildchain github-governance protection-policy-plan \
+  --repository kungfu-systems/kungfu \
+  --branch alpha/v4/v4.0 \
+  --snapshot-output protection-rollback.json \
+  --plan-output protection-rollout.json
+
+buildchain github-governance protection-policy-apply \
+  --plan-json protection-rollout.json \
+  --confirm-plan-root sha256:...
+
+buildchain github-governance protection-policy-rollback \
+  --plan-json protection-rollout.json \
+  --confirm-rollback-root sha256:...
+```
+
+For an admitted exact target, repository ruleset reconciliation compiles the
+target descriptor into the provider body. It replaces bypass actors with the
+exact provider-admitted desired set, requires fresh Code Owner approval and
+resolved review threads, and binds required checks plus strict-update semantics
+to the target policy. Newly synthesized managed rules include GitHub's explicit
+canonical defaults so the frozen expected root matches provider read-back.
+Repository rulesets default to no bypass actors. The
+descriptor's target-bound GitHub Actions allowance is an upper bound on
+effective provider state, not a requirement to add that actor to every
+protection layer; when needed, the built-in App allowance is expressed by
+classic branch protection. The target condition must contain exactly one
+branch; unrelated rules and conditions are preserved in place.
+
+```bash
+buildchain github-governance ruleset-policy-plan \
+  --repository kungfu-systems/buildchain \
+  --branch alpha/v2/v2.14 \
+  --ruleset-id 19518955 \
+  --snapshot-output ruleset-rollback.json \
+  --plan-output ruleset-rollout.json
+
+buildchain github-governance ruleset-policy-apply \
+  --plan-json ruleset-rollout.json \
+  --confirm-plan-root sha256:...
+
+buildchain github-governance ruleset-policy-rollback \
+  --plan-json ruleset-rollout.json \
+  --confirm-rollback-root sha256:...
+```
+
+The narrower `ruleset-plan` mode changes only `bypass_actors`; it remains
+available for a bypass-only canary, but it cannot prove that an effective
+ruleset matches the target descriptor. Both modes require the frozen ruleset
+snapshot root for rollback.
+
+Paid-plan purchase, billing, legal/account-owner decisions, and any operation
+that could remove the last recoverable owner remain external human gates.
+Break-glass is disabled by default and, if ever admitted, must be separately
+authenticated, reason-bound, time-bounded, independently receipted, and
+followed by mandatory restoration and root comparison.

package/docs/lifecycle-protocol.md

@@ -297,19 +297,19 @@ verification.
 On protected alpha and release branches, the generated version-state commit is
 applied by the promotion automation after the reviewed channel PR has merged.
 Buildchain keeps review requirements, conversation resolution, strict status
-checks, and admin enforcement for human channel changes, but adds the
-authenticated promotion token user or app to the managed bypass allowlist for
-generated release bookkeeping. Buildchain also creates the configured required
+checks, and admin enforcement for human channel changes, but admits only the
+exact GitHub Actions App to the target-bound bypass allowlist for generated
+release bookkeeping. Buildchain also creates the configured required
 check on the exact generated version-state commit before patching the protected
 ref, then applies the protected ref update with the declared generated ref
-update token. The reusable wrapper uses
-`secrets.BUILDCHAIN_PROMOTION_TOKEN || github.token` for that protected
-bookkeeping update. If release finalization bookkeeping is still rejected,
+update token. The reusable wrapper uses the run-scoped `github.token` for that
+protected bookkeeping update. If finalization bookkeeping is still rejected,
 Buildchain creates or reuses a same-repository `buildchain/version-state/*` PR
-from the current target channel head and reports `finalization-needed=true` so
-a later idempotent promotion run can resume. Strict alpha bookkeeping remains
-fail-fast with a token/protection diagnostic instead of asking humans to review
-a post-publish version-state PR.
+and reports `finalization-needed=true` so a later idempotent promotion run can
+resume. This fallback also applies to strict alpha target and dev
+reconciliation. The generated PR must pass the repository's normal protected
+checks, review, and merge-queue policy; Buildchain never weakens that policy or
+treats PR creation as completed finalization.
 
 For `version.strategy = "anchored"` with `version.next = "manual"`, release
 promotion does not generate a Buildchain-owned version-state commit. In that