@kungfu-tech/buildchain 2.14.18-alpha.10 → 2.14.18-alpha.2

package/actions/promote-buildchain-ref/README.md

@@ -89,11 +89,10 @@ tries to apply that commit directly. If GitHub still rejects release
 finalization bookkeeping, Buildchain creates or reuses a same-repository
 `buildchain/version-state/*` PR based on the current target channel head and
 returns `finalization-needed=true`; a later idempotent promotion run can resume
-from the durable transaction state. Strict alpha uses the same protected
-version-state PR recovery for its target and dev bookkeeping, and does not move
-tags until those provider-enforced transactions land. Reusable wrapper callers
-should allow `checks: write` so the generated checks are owned by GitHub Actions
-and match the managed branch protection rule.
+from the durable transaction state. Strict alpha promotion still fails with a
+configuration diagnostic instead of opening a post-publish human PR. Reusable
+wrapper callers should allow `checks: write` so the generated checks are owned by
+GitHub Actions and matches the managed branch protection rule.
 
 Stable promotion also protects concurrent development work. The reusable
 wrapper checks out the exact current `dev/vN/vN.M` head as a reconciliation
@@ -115,14 +114,6 @@ allowance only lets the named automation identity apply generated version-state
 or channel bookkeeping without a second human review after the reviewed channel
 PR has already merged.
 
-GitHub may return either `403` or a deliberately opaque `404` when a
-non-administrator token reads the full branch-protection endpoint. In that
-case, promotion reads the provider's branch summary and accepts only an
-already-protected branch that enforces the exact required check for everyone.
-It does not interpret the opaque response as missing protection or try to
-rewrite policy with a developer token. The independent publication-authority
-audit remains responsible for the complete read-only governance proof.
-
 ## Publish Transactions
 
 Promotion can also own external publish side effects. Enable this only from a
@@ -413,16 +404,16 @@ governance semantics:
   with either the `verification-command` input or `buildchain.toml`
   `lifecycle.verify` before any tags or channel refs move.
 
-The reusable promotion workflow keeps governance reads, generated status checks,
-and generated ref updates on the run-scoped `github.token`. When branch
-protection rejects generated bookkeeping, it supplies `BUILDCHAIN_PROMOTION_TOKEN`
-only through `generated-pull-request-token` so the same-repository recovery PR can
-be listed or created without broadening the governance client. Protected branch
-review and check rules guard human channel merges, while the reusable build trust
-gate checks the source-lock channel HEAD and merged same-repository PR lineage
-before heavy build runners start. This action still independently rechecks PR
-lineage, alpha/release tree equivalence, and generated version-state verification
-before moving channel refs and tags.
+The promotion workflow should use `BUILDCHAIN_PROMOTION_TOKEN` for non-dry-run
+promotion. The token is the buildchain equivalent of the old ABV runner release
+authority: protected branch review and check rules guard human channel merges,
+while the reusable build trust gate now checks the source-lock channel HEAD and
+merged same-repository PR lineage before heavy build runners start. This action
+still independently rechecks PR lineage, alpha/release tree equivalence, and
+generated version-state verification before moving channel refs and tags.
+Generated version-state direct ref updates can use a separate
+`generated-ref-update-token`; the reusable wrapper binds it to the run-scoped
+`github.token`.
 The reusable `release-candidate-promote.yml` wrapper defaults
 `branch-protection-bypass-apps` to `github-actions`, so flow-internal promotion
 can complete generated `dev`/`alpha`/`release` bookkeeping while ordinary human

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.10",
+    "version": "2.14.18-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -170,7 +170,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:1f476fb9a4854b362c4b24cef89a3c7675d7d63baf3bc828d7b8ae7d2787cead",
-      "auditDigest": "sha256:5a5cbec0b5382c34101623ed11f264797b618920d8c98c78e0d14af9f07a1f6b"
+      "auditDigest": "sha256:a328740bbd24990af1a95e93055de54ff6261ec6c9943b53d209440c7cb4a4cc"
     },
     {
       "contractVersion": 1,
@@ -212,7 +212,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:ba3117f22b343d5f18cd48d327bffaa8ed442cb6150b6c2f95d091808cd009a7"
+      "auditDigest": "sha256:fc3bab430f17f990948c98b93cf1d07643982548881c230e37adac8ad9bdb662"
     },
     {
       "contractVersion": 1,
@@ -256,7 +256,7 @@
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
       ],
       "breakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
-      "auditDigest": "sha256:063dfe24e1ccdd95b4ffbf89a154aa71197c8bd1cb98b4705d8663917c026366"
+      "auditDigest": "sha256:3032fbbba0920b0ec2b7e1e4ba96a5a7e51c10249ff4e5bc9f0ad81b933eae45"
     },
     {
       "contractVersion": 1,
@@ -327,7 +327,7 @@
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
       ],
       "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
-      "auditDigest": "sha256:c23298988d29d6dbf99c65fd7d5567d704f012cc7a061c46a848c26814cab4b9"
+      "auditDigest": "sha256:40247c580fb55f387c0d0c9f26adb7e7f111dafe600444ec815134c080b09cff"
     },
     {
       "contractVersion": 1,
@@ -641,7 +641,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:29b45afe77400b5b38872574cdf7ccfcf8abc93b7f78ad32d994a6636a4f9f68"
+      "auditDigest": "sha256:06b0ce651bca9d9f9cd53bf734f391bb55851945c8049fb854d881676d0d025a"
     },
     {
       "contractVersion": 1,
@@ -663,7 +663,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:4572769775450f49fa37a72e6dda211eea0af0a4dd73ad1d188dbb34782a35a9"
+      "auditDigest": "sha256:6f459e9bad07f4ec63ce1de30edaacef33587bc939c77140d5c31b75679a5091"
     },
     {
       "contractVersion": 1,
@@ -2018,7 +2018,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27",
-      "auditDigest": "sha256:063dfe24e1ccdd95b4ffbf89a154aa71197c8bd1cb98b4705d8663917c026366"
+      "auditDigest": "sha256:3032fbbba0920b0ec2b7e1e4ba96a5a7e51c10249ff4e5bc9f0ad81b933eae45"
     },
     {
       "contractVersion": 1,
@@ -2428,7 +2428,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:0eb318df455ef9cb737a7c2515a2411b685d34ed0bde7b5f5b173a7a42513114",
-      "auditDigest": "sha256:fd939f9dcce745f3e1b8063b68715460cb8e1af6d2b813a96b37a741740122b9"
+      "auditDigest": "sha256:56a9f981034988be3d796119a5704c592bd080d61211a03eb364e93210323d9d"
     },
     {
       "contractVersion": 1,
@@ -2928,7 +2928,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:ba3117f22b343d5f18cd48d327bffaa8ed442cb6150b6c2f95d091808cd009a7"
+      "auditDigest": "sha256:fc3bab430f17f990948c98b93cf1d07643982548881c230e37adac8ad9bdb662"
     },
     {
       "contractVersion": 1,
@@ -3126,5 +3126,5 @@
     }
   ],
   "compatibilityDigest": "sha256:df13c3b8066068925ce847b31002201d533034d10d342542422db3a665c10475",
-  "contractDigest": "sha256:f762f013ae69bdf5f313c1801408be47af9e7d0270c28de7ecd040aa3483f99d"
+  "contractDigest": "sha256:b68d06cff4de41052d18b13e7c7af9890331a4e8fa626bb452f48c912a9a1ba1"
 }