@kungfu-tech/buildchain 2.14.18-alpha.11 → 2.14.18-alpha.2

package/dist/site/public-surface-audit.json

@@ -2154,7 +2154,6 @@
           "branch-protection-bypass-users",
           "dry-run",
           "expected-publication-version",
-          "generated-pull-request-token",
           "generated-ref-update-token",
           "generated-status-check-token",
           "github-release",
@@ -2213,7 +2212,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 64
+        "inputCount": 63
       },
       {
         "id": "report-buildchain-issue",
@@ -3910,8 +3909,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "5ba7fd93a13993b05767b6f02d0626a7347f25c3d7cd4589ed4f70028c1f1bd1",
-    "workflowRegistryDigest": "c2abf629b205a96f536e8758c3d9cdb3eade6945294fe278774877ef41d90b60",
-    "pageRegistryDigest": "16a40ed6f3848fcb6a743f9d0369b04e956dfb7b8548b1a7a79266f76b928c80"
+    "workflowRegistryDigest": "1c2d1662c528b7762c45f626b815387430b89f8d062085ca47fc7205460c12a5",
+    "pageRegistryDigest": "01f6a9b7e4ac673595d60e55f305681b80b3f7a3cae711950c3417c9326f8d3f"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-24T15:58:21.871Z",
-  "publishedAt": "2026-07-24T15:58:21.871Z",
+  "generatedAt": "2026-07-24T10:46:25.692Z",
+  "publishedAt": "2026-07-24T10:46:25.692Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "89243e5a9cb346e8c52cec5c69733ada91dcd153",
+  "sourceRevision": "951a54ab893c75bb397024f5891a61e7d79db90e",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.11",
+    "version": "2.14.18-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-24T15:58:21.871Z",
-  "publishedAt": "2026-07-24T15:58:21.871Z",
+  "generatedAt": "2026-07-24T10:46:25.692Z",
+  "publishedAt": "2026-07-24T10:46:25.692Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "89243e5a9cb346e8c52cec5c69733ada91dcd153",
+  "sourceRevision": "951a54ab893c75bb397024f5891a61e7d79db90e",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.11",
+    "version": "2.14.18-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -93,7 +93,7 @@
       "path": "docs/github-governance-authority.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:8484b18d5b0fe6d61d102d6b9cb9e18beac9f47ecb516d430fb5427518e2931f"
+      "digest": "sha256:3103d7982c9a30b344c603566520aeb1d5d90c1c54958d9c1c2b7ae897359da8"
     },
     {
       "id": "release-candidate",
@@ -229,7 +229,7 @@
       "path": "docs/lifecycle-protocol.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:9c669d3d2d1926dc5b421207089cca85bac0a6dcdb5544c28a7e1659ba9ed5ee"
+      "digest": "sha256:ffe57d0a938d799033310d2f89e1b4b7502af5677b6b8ae90a1bbde239339982"
     },
     {
       "id": "reusable-build-surface",
@@ -245,7 +245,7 @@
       "path": "docs/publish-transaction.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:cde5256d5f6443a6d32b47783900a0677e973855266af5a360db8d4d112bb677"
+      "digest": "sha256:8f6cc435f57807889827ad2c9bfec1e4ad94290fde6fe02e72a15967e7072edc"
     },
     {
       "id": "release-governance",
@@ -253,7 +253,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:5aa7fef2c831d14b4d1df4cddb45c6ce97929d8530eb14e3b3dfa3dee5e0d651"
+      "digest": "sha256:4e7c4649ee0fa7cea11ccb7031d5dd38046a3aef15dba6a00d24b3a12361b05f"
     },
     {
       "id": "release-flow",

package/dist/site/workflow-registry.json

@@ -1867,7 +1867,6 @@
         "branch-protection-bypass-users",
         "dry-run",
         "expected-publication-version",
-        "generated-pull-request-token",
         "generated-ref-update-token",
         "generated-status-check-token",
         "github-release",
@@ -1926,7 +1925,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 64,
+      "inputCount": 63,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/github-governance-authority.md

@@ -140,14 +140,6 @@ App configuration or unreadable provider state denies publication before
 provider mutation. The publication authority workflow is itself an explicit
 Code Owner path.
 
-The publication authority job and every reusable-workflow caller grant the
-built-in `GITHUB_TOKEN` only `actions: read`, `checks: read`, `contents: read`,
-and `pull-requests: read`. The dedicated auditor App independently recollects
-the organization-wide governance receipt, while these job-scoped permissions
-allow the exact publication transaction audit to resolve required check runs
-and merged pull-request review lineage. Omitting either read permission makes
-the transaction evidence incomplete and therefore non-qualifying.
-
 The output is sanitized. Public repositories retain their public identity.
 Private repositories expose only an identity root, visibility class, target
 ref, sanitized required-check bindings and fact roots, and a qualifying or

package/docs/lifecycle-protocol.md

@@ -303,13 +303,12 @@ release bookkeeping. Buildchain also creates the configured required
 check on the exact generated version-state commit before patching the protected
 ref, then applies the protected ref update with the declared generated ref
 update token. The reusable wrapper uses the run-scoped `github.token` for that
-protected bookkeeping update. If finalization bookkeeping is still rejected,
+protected bookkeeping update. If release finalization bookkeeping is still rejected,
 Buildchain creates or reuses a same-repository `buildchain/version-state/*` PR
-and reports `finalization-needed=true` so a later idempotent promotion run can
-resume. This fallback also applies to strict alpha target and dev
-reconciliation. The generated PR must pass the repository's normal protected
-checks, review, and merge-queue policy; Buildchain never weakens that policy or
-treats PR creation as completed finalization.
+from the current target channel head and reports `finalization-needed=true` so
+a later idempotent promotion run can resume. Strict alpha bookkeeping remains
+fail-fast with a token/protection diagnostic instead of asking humans to review
+a post-publish version-state PR.
 
 For `version.strategy = "anchored"` with `version.next = "manual"`, release
 promotion does not generate a Buildchain-owned version-state commit. In that

package/docs/publish-transaction.md

@@ -363,21 +363,6 @@ When publish transactions are enabled, promotion order is:
 7. move floating tags and channel refs;
 8. mark the transaction `complete`.
 
-When a protected channel requires a generated version-state pull request, the
-first run can stop at `finalizing` after registry publication. If the reviewed
-merge commit later contains that exact transaction release material but the
-exact tag is still absent, a retry performs finalization only: it reloads the
-same durable source, release material, tooling, evidence, version, and target
-bindings; creates the exact and floating tags at the transaction release SHA;
-and completes the passport from the transaction source tree. It does not rerun
-the provider mutation and does not authorize the newer composite channel tree
-as published material. A different source tree still requires a new version and
-a fresh release candidate.
-
-Deferred binary dispatch, controller-evidence bundling, and any consumer
-publication commit are skipped while `finalization-needed=true`. They run only
-after the exact public tag and complete release passport exist.
-
 Consumer products that expose a signed well-known channel can opt into one
 additional, deliberately final step with `publication-commit-command`. Before
 that command runs, Buildchain has already completed the transaction, created
@@ -441,12 +426,11 @@ the exact generated version-state commit so branch protection can
 validate the automation path without a second build, then uses the generated
 ref update token for the protected ref PATCH. If release finalization
 bookkeeping is still rejected, Buildchain creates or reuses a same-repository
-`buildchain/version-state/*` PR and leaves the transaction resumable with
-`finalization-needed=true`. Strict alpha uses the same protected PR fallback
-for both its target channel and subsequent dev reconciliation. A later
-idempotent run continues only after the provider shows that the PR reached the
-protected branch. The reusable wrapper binds that token to the run-scoped
-`github.token` and rejects user, team, or alternate App bypass actors.
+`buildchain/version-state/*` PR based on the current target channel head and
+leaves the transaction resumable with `finalization-needed=true`. Strict alpha
+bookkeeping remains fail-fast. The reusable wrapper binds that token to the
+run-scoped `github.token` and rejects user, team, or alternate App bypass
+actors.
 
 If finalization fails after an exact Git tag, a channel branch, or dev/alpha
 sync ref has already moved, the next run reads the durable `finalizing` state

package/docs/release-governance.md

@@ -719,12 +719,10 @@ status checks are satisfied by machine-verifiable Buildchain evidence rather
 than a human PR. The protected ref PATCH itself uses the generated ref update
 token; the reusable wrapper binds it to the run-scoped `github.token`. If direct generated
 release finalization bookkeeping is still rejected, Buildchain creates or
-reuses a same-repository `buildchain/version-state/*` PR and records
-`finalization-needed=true` in the durable transaction output. Strict alpha
-follows the same provider-enforced PR path for its alpha and dev bookkeeping.
-The PR remains subject to the declared review, required checks, and merge-queue
-policy; publication resumes idempotently after that protected transaction
-lands.
+reuses a same-repository `buildchain/version-state/*` PR based on the current
+target channel head and records `finalization-needed=true` in the durable
+transaction output. Strict alpha bookkeeping still fails with a
+token/protection diagnostic instead of creating a post-publish PR.
 
 For a stable release, the wrapper also checks out the exact current development
 channel into `.buildchain/reconciliation/dev`. When the prepared next-alpha

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.18-alpha.11",
+  "version": "2.14.18-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/controller-evidence.js

@@ -7,7 +7,7 @@ export const BUILDCHAIN_CONTROLLER_AGGREGATE_CONTRACT = "buildchain.controller-e
 
 const SHA256_PATTERN = /^sha256:[0-9a-f]{64}$/;
 const GIT_SHA_PATTERN = /^[0-9a-f]{40}$/;
-const STAGE_STATUSES = new Set(["passed", "failed", "skipped", "cancelled", "missing", "partial"]);
+const STAGE_STATUSES = new Set(["passed", "failed", "skipped", "cancelled", "missing"]);
 
 const CONTROLLER_SPECS = [
   {

package/packages/core/publication-control-plane-audit.js

@@ -122,8 +122,6 @@ export function evaluatePublicationControlPlaneSnapshot({
     Array.isArray(branchPolicy.releaseReconciliation.changedPaths) &&
     branchPolicy.releaseReconciliation.changedPaths.length > 0
   );
-  const sourceBranchBindingPass = branchPolicy.sourceSha === branchPolicy.headSha ||
-    branchPolicy.sourceContainedInBranch === true;
   const providerTransactionBranchPass = branchPolicy.ref === branch &&
     branchPolicy.policyMode === "provider-enforced-transaction" &&
     branchPolicy.protected === true &&
@@ -134,7 +132,7 @@ export function evaluatePublicationControlPlaneSnapshot({
     branchPolicy.requiredCheckPassed === true &&
     /^[0-9a-f]{40}$/i.test(String(branchPolicy.requiredCheckSha || "")) &&
     branchPolicy.requiredCheckSha === branchPolicy.pullRequestHeadSha &&
-    sourceBranchBindingPass &&
+    branchPolicy.sourceSha === branchPolicy.headSha &&
     sourceAuthorizationPass &&
     branchPolicy.mergedPullRequest === true &&
     branchPolicy.baseRef === branch &&
@@ -160,7 +158,6 @@ export function evaluatePublicationControlPlaneSnapshot({
           environmentPolicy.declared === true &&
           environmentPolicy.exists === true &&
           environmentPolicy.protected === true &&
-          environmentPolicy.branchAuthorized === true &&
           (environmentPolicy.reviewRequired !== true || environmentPolicy.preventSelfReview === true),
       environmentPolicy,
     ),

package/scripts/audit-publication-control-plane.mjs

@@ -239,16 +239,6 @@ function main() {
   const deploymentBranches = environment !== "none" && environmentState.deployment_branch_policy?.custom_branch_policies === true
     ? githubJson(`repos/${repository}/environments/${encodeURIComponent(environment)}/deployment-branch-policies?per_page=100`, "Environment deployment branch policy")
     : { branch_policies: [] };
-  const exactEnvironmentBranchPolicy = (deploymentBranches.branch_policies || []).find((entry) =>
-    entry?.type === "branch" && entry?.name === branch
-  );
-  const environmentBranchAuthorized = environment !== "none" && (
-    (
-      environmentState.deployment_branch_policy?.protected_branches === true &&
-      branchState.protected === true
-    ) ||
-    Boolean(exactEnvironmentBranchPolicy)
-  );
   const oidc = githubJson(`repos/${repository}/actions/oidc/customization/sub`, "OIDC subject policy");
   if (!["npm-trusted-publisher", "github-token", "oidc-role"].includes(publisherMode)) {
     throw new Error(`unsupported --publisher-mode: ${publisherMode}`);
@@ -287,24 +277,10 @@ function main() {
       message: sourceMessage,
       changedPaths: sourceChangedPaths,
     };
-    const branchHeadSha = String(branchState.commit?.sha || "").toLowerCase();
-    const sourceComparison = sourceSha === branchHeadSha
-      ? null
-      : githubJson(
-        `repos/${repository}/compare/${sourceSha}...${branchHeadSha}`,
-        "source protected-branch lineage",
-      );
-    const sourceContainedInBranch = sourceSha === branchHeadSha || (
-      sourceComparison?.status === "ahead" &&
-      String(sourceComparison?.merge_base_commit?.sha || "").toLowerCase() === sourceSha
-    );
     let pullRequests = githubJson(`repos/${repository}/commits/${authorizationSha}/pulls`, "source pull-request lineage");
     let mergedPullRequest = (Array.isArray(pullRequests) ? pullRequests : []).find((entry) =>
       entry?.merged_at &&
-      (
-        String(entry.merge_commit_sha || "").toLowerCase() === authorizationSha ||
-        String(entry.head?.sha || "").toLowerCase() === authorizationSha
-      ) &&
+      entry.merge_commit_sha === authorizationSha &&
       entry.base?.ref === branch &&
       entry.head?.repo?.full_name === repository
     );
@@ -342,12 +318,10 @@ function main() {
       const login = String(review?.user?.login || "");
       if (login) latestReviews.set(login, review);
     }
-    const pullRequestHeadSha = String(mergedPullRequest?.head?.sha || "").toLowerCase();
     const independentApprovals = [...latestReviews.values()].filter((review) =>
-      review.state === "APPROVED" &&
-      review.user?.login !== mergedPullRequest?.user?.login &&
-      String(review.commit_id || "").toLowerCase() === pullRequestHeadSha
+      review.state === "APPROVED" && review.user?.login !== mergedPullRequest?.user?.login
     );
+    const pullRequestHeadSha = String(mergedPullRequest?.head?.sha || "").toLowerCase();
     const checkRuns = /^[0-9a-f]{40}$/.test(pullRequestHeadSha)
       ? githubJson(`repos/${repository}/commits/${pullRequestHeadSha}/check-runs?per_page=100`, "merged pull-request head check runs")
       : { check_runs: [] };
@@ -386,8 +360,7 @@ function main() {
       requiredCheckSha: pullRequestHeadSha,
       sourceSha,
       authorizationSha,
-      headSha: branchHeadSha,
-      sourceContainedInBranch,
+      headSha: String(branchState.commit?.sha || "").toLowerCase(),
       releaseReconciliation,
       mergedPullRequest: Boolean(mergedPullRequest),
       pullRequestNumber: mergedPullRequest?.number || 0,
@@ -464,13 +437,6 @@ function main() {
         protected: (environmentState.protection_rules || []).length > 0 ||
           environmentState.deployment_branch_policy?.protected_branches === true ||
           (deploymentBranches.branch_policies || []).length > 0,
-        branchAuthorized: environmentBranchAuthorized,
-        branchPolicyMode: environmentState.deployment_branch_policy?.protected_branches === true
-          ? "protected-branches"
-          : exactEnvironmentBranchPolicy
-            ? "exact-custom-branch"
-            : "unqualified",
-        authorizedBranch: exactEnvironmentBranchPolicy?.name || "",
         reviewRequired: reviewRules.length > 0,
         preventSelfReview: reviewRules.some((rule) => rule.prevent_self_review === true),
       },

package/scripts/generate-channel-promotion-workflow.mjs

@@ -209,7 +209,6 @@ permissions:
   contents: write
   id-token: write
   issues: write
-  pull-requests: write
 
 jobs:
   resolve-promotion:
@@ -410,7 +409,6 @@ jobs:
       contents: write
       id-token: write
       issues: write
-      pull-requests: write
     with:
 ${alphaForwarded}
     secrets: inherit
@@ -426,7 +424,6 @@ ${alphaForwarded}
       contents: write
       id-token: write
       issues: write
-      pull-requests: write
     with:
 ${stableForwarded}
     secrets: inherit