@kungfu-tech/buildchain 2.14.18-alpha.2 → 2.14.18-alpha.4

package/dist/site/public-surface-audit.json

@@ -3910,7 +3910,7 @@
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "5ba7fd93a13993b05767b6f02d0626a7347f25c3d7cd4589ed4f70028c1f1bd1",
     "workflowRegistryDigest": "1c2d1662c528b7762c45f626b815387430b89f8d062085ca47fc7205460c12a5",
-    "pageRegistryDigest": "01f6a9b7e4ac673595d60e55f305681b80b3f7a3cae711950c3417c9326f8d3f"
+    "pageRegistryDigest": "a078d91bbd656cc928e7210eaa83952a4f6eea61e319656434f963cfb86dc01b"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-24T10:46:25.692Z",
-  "publishedAt": "2026-07-24T10:46:25.692Z",
+  "generatedAt": "2026-07-24T11:59:03.099Z",
+  "publishedAt": "2026-07-24T11:59:03.099Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "951a54ab893c75bb397024f5891a61e7d79db90e",
+  "sourceRevision": "db7bcdcfcbec594eb7dfc0a910c03ea3bf531257",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.2",
+    "version": "2.14.18-alpha.4",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-24T10:46:25.692Z",
-  "publishedAt": "2026-07-24T10:46:25.692Z",
+  "generatedAt": "2026-07-24T11:59:03.099Z",
+  "publishedAt": "2026-07-24T11:59:03.099Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "951a54ab893c75bb397024f5891a61e7d79db90e",
+  "sourceRevision": "db7bcdcfcbec594eb7dfc0a910c03ea3bf531257",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.2",
+    "version": "2.14.18-alpha.4",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -229,7 +229,7 @@
       "path": "docs/lifecycle-protocol.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ffe57d0a938d799033310d2f89e1b4b7502af5677b6b8ae90a1bbde239339982"
+      "digest": "sha256:9c669d3d2d1926dc5b421207089cca85bac0a6dcdb5544c28a7e1659ba9ed5ee"
     },
     {
       "id": "reusable-build-surface",
@@ -245,7 +245,7 @@
       "path": "docs/publish-transaction.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:8f6cc435f57807889827ad2c9bfec1e4ad94290fde6fe02e72a15967e7072edc"
+      "digest": "sha256:732e7da899ab0b532bda2f77181d753ee8af2e397db4b0eedaaa10657ade7b2a"
     },
     {
       "id": "release-governance",
@@ -253,7 +253,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:4e7c4649ee0fa7cea11ccb7031d5dd38046a3aef15dba6a00d24b3a12361b05f"
+      "digest": "sha256:5aa7fef2c831d14b4d1df4cddb45c6ce97929d8530eb14e3b3dfa3dee5e0d651"
     },
     {
       "id": "release-flow",

package/docs/lifecycle-protocol.md

@@ -303,12 +303,13 @@ release bookkeeping. Buildchain also creates the configured required
 check on the exact generated version-state commit before patching the protected
 ref, then applies the protected ref update with the declared generated ref
 update token. The reusable wrapper uses the run-scoped `github.token` for that
-protected bookkeeping update. If release finalization bookkeeping is still rejected,
+protected bookkeeping update. If finalization bookkeeping is still rejected,
 Buildchain creates or reuses a same-repository `buildchain/version-state/*` PR
-from the current target channel head and reports `finalization-needed=true` so
-a later idempotent promotion run can resume. Strict alpha bookkeeping remains
-fail-fast with a token/protection diagnostic instead of asking humans to review
-a post-publish version-state PR.
+and reports `finalization-needed=true` so a later idempotent promotion run can
+resume. This fallback also applies to strict alpha target and dev
+reconciliation. The generated PR must pass the repository's normal protected
+checks, review, and merge-queue policy; Buildchain never weakens that policy or
+treats PR creation as completed finalization.
 
 For `version.strategy = "anchored"` with `version.next = "manual"`, release
 promotion does not generate a Buildchain-owned version-state commit. In that

package/docs/publish-transaction.md

@@ -426,11 +426,12 @@ the exact generated version-state commit so branch protection can
 validate the automation path without a second build, then uses the generated
 ref update token for the protected ref PATCH. If release finalization
 bookkeeping is still rejected, Buildchain creates or reuses a same-repository
-`buildchain/version-state/*` PR based on the current target channel head and
-leaves the transaction resumable with `finalization-needed=true`. Strict alpha
-bookkeeping remains fail-fast. The reusable wrapper binds that token to the
-run-scoped `github.token` and rejects user, team, or alternate App bypass
-actors.
+`buildchain/version-state/*` PR and leaves the transaction resumable with
+`finalization-needed=true`. Strict alpha uses the same protected PR fallback
+for both its target channel and subsequent dev reconciliation. A later
+idempotent run continues only after the provider shows that the PR reached the
+protected branch. The reusable wrapper binds that token to the run-scoped
+`github.token` and rejects user, team, or alternate App bypass actors.
 
 If finalization fails after an exact Git tag, a channel branch, or dev/alpha
 sync ref has already moved, the next run reads the durable `finalizing` state

package/docs/release-governance.md

@@ -719,10 +719,12 @@ status checks are satisfied by machine-verifiable Buildchain evidence rather
 than a human PR. The protected ref PATCH itself uses the generated ref update
 token; the reusable wrapper binds it to the run-scoped `github.token`. If direct generated
 release finalization bookkeeping is still rejected, Buildchain creates or
-reuses a same-repository `buildchain/version-state/*` PR based on the current
-target channel head and records `finalization-needed=true` in the durable
-transaction output. Strict alpha bookkeeping still fails with a
-token/protection diagnostic instead of creating a post-publish PR.
+reuses a same-repository `buildchain/version-state/*` PR and records
+`finalization-needed=true` in the durable transaction output. Strict alpha
+follows the same provider-enforced PR path for its alpha and dev bookkeeping.
+The PR remains subject to the declared review, required checks, and merge-queue
+policy; publication resumes idempotently after that protected transaction
+lands.
 
 For a stable release, the wrapper also checks out the exact current development
 channel into `.buildchain/reconciliation/dev`. When the prepared next-alpha

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.18-alpha.2",
+  "version": "2.14.18-alpha.4",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/generate-channel-promotion-workflow.mjs

@@ -209,6 +209,7 @@ permissions:
   contents: write
   id-token: write
   issues: write
+  pull-requests: write
 
 jobs:
   resolve-promotion:
@@ -409,6 +410,7 @@ jobs:
       contents: write
       id-token: write
       issues: write
+      pull-requests: write
     with:
 ${alphaForwarded}
     secrets: inherit
@@ -424,6 +426,7 @@ ${alphaForwarded}
       contents: write
       id-token: write
       issues: write
+      pull-requests: write
     with:
 ${stableForwarded}
     secrets: inherit