@kungfu-tech/buildchain 2.14.18-alpha.7 → 2.14.18-alpha.8

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.7",
+    "version": "2.14.18-alpha.8",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -663,7 +663,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:6f459e9bad07f4ec63ce1de30edaacef33587bc939c77140d5c31b75679a5091"
+      "auditDigest": "sha256:6cc4353f5c2ae7b5e260b38b1810e4216e7ac31528ffe8da850d22e73246b6f6"
     },
     {
       "contractVersion": 1,
@@ -3126,5 +3126,5 @@
     }
   ],
   "compatibilityDigest": "sha256:df13c3b8066068925ce847b31002201d533034d10d342542422db3a665c10475",
-  "contractDigest": "sha256:9af0d6ab0322ad8ae141f85e463be09938850e9f315b5369d45bddafb1b7c171"
+  "contractDigest": "sha256:b6192f49aca3f3e70767290dea22578aa295fccd274c0482dae9968145844e02"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-24T14:02:02.767Z",
-  "publishedAt": "2026-07-24T14:02:02.767Z",
+  "generatedAt": "2026-07-24T14:23:08.194Z",
+  "publishedAt": "2026-07-24T14:23:08.194Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "bb9b154e8081819601a54e6dc0f4252ebb72e981",
+  "sourceRevision": "c432ae15fe0c8efc912628dfaaf6b0b3eec196fb",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.7",
+    "version": "2.14.18-alpha.8",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.7",
+    "version": "2.14.18-alpha.8",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -320,7 +320,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-control-plane-audit",
       "export": "./publication-control-plane-audit",
       "target": "./packages/core/publication-control-plane-audit.js",
-      "digest": "sha256:0f16457858b95d504e2a9e53558356a8f509f6ca8b011f550efd60bd8db469a4",
+      "digest": "sha256:319cd46deac8d720698ffbb40f63cec33901b7ac33cd8c0dbc720f448686a789",
       "summary": "Read-only publication control-plane snapshot evaluation APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-24T14:02:02.767Z",
-  "publishedAt": "2026-07-24T14:02:02.767Z",
+  "generatedAt": "2026-07-24T14:23:08.194Z",
+  "publishedAt": "2026-07-24T14:23:08.194Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "bb9b154e8081819601a54e6dc0f4252ebb72e981",
+  "sourceRevision": "c432ae15fe0c8efc912628dfaaf6b0b3eec196fb",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.7",
+    "version": "2.14.18-alpha.8",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-24T14:02:02.767Z",
-  "publishedAt": "2026-07-24T14:02:02.767Z",
+  "generatedAt": "2026-07-24T14:23:08.194Z",
+  "publishedAt": "2026-07-24T14:23:08.194Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "bb9b154e8081819601a54e6dc0f4252ebb72e981",
+  "sourceRevision": "c432ae15fe0c8efc912628dfaaf6b0b3eec196fb",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.7",
+    "version": "2.14.18-alpha.8",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.18-alpha.7",
+  "version": "2.14.18-alpha.8",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/publication-control-plane-audit.js

@@ -122,6 +122,8 @@ export function evaluatePublicationControlPlaneSnapshot({
     Array.isArray(branchPolicy.releaseReconciliation.changedPaths) &&
     branchPolicy.releaseReconciliation.changedPaths.length > 0
   );
+  const sourceBranchBindingPass = branchPolicy.sourceSha === branchPolicy.headSha ||
+    branchPolicy.sourceContainedInBranch === true;
   const providerTransactionBranchPass = branchPolicy.ref === branch &&
     branchPolicy.policyMode === "provider-enforced-transaction" &&
     branchPolicy.protected === true &&
@@ -132,7 +134,7 @@ export function evaluatePublicationControlPlaneSnapshot({
     branchPolicy.requiredCheckPassed === true &&
     /^[0-9a-f]{40}$/i.test(String(branchPolicy.requiredCheckSha || "")) &&
     branchPolicy.requiredCheckSha === branchPolicy.pullRequestHeadSha &&
-    branchPolicy.sourceSha === branchPolicy.headSha &&
+    sourceBranchBindingPass &&
     sourceAuthorizationPass &&
     branchPolicy.mergedPullRequest === true &&
     branchPolicy.baseRef === branch &&

package/scripts/audit-publication-control-plane.mjs

@@ -277,10 +277,24 @@ function main() {
       message: sourceMessage,
       changedPaths: sourceChangedPaths,
     };
+    const branchHeadSha = String(branchState.commit?.sha || "").toLowerCase();
+    const sourceComparison = sourceSha === branchHeadSha
+      ? null
+      : githubJson(
+        `repos/${repository}/compare/${sourceSha}...${branchHeadSha}`,
+        "source protected-branch lineage",
+      );
+    const sourceContainedInBranch = sourceSha === branchHeadSha || (
+      sourceComparison?.status === "ahead" &&
+      String(sourceComparison?.merge_base_commit?.sha || "").toLowerCase() === sourceSha
+    );
     let pullRequests = githubJson(`repos/${repository}/commits/${authorizationSha}/pulls`, "source pull-request lineage");
     let mergedPullRequest = (Array.isArray(pullRequests) ? pullRequests : []).find((entry) =>
       entry?.merged_at &&
-      entry.merge_commit_sha === authorizationSha &&
+      (
+        String(entry.merge_commit_sha || "").toLowerCase() === authorizationSha ||
+        String(entry.head?.sha || "").toLowerCase() === authorizationSha
+      ) &&
       entry.base?.ref === branch &&
       entry.head?.repo?.full_name === repository
     );
@@ -318,10 +332,12 @@ function main() {
       const login = String(review?.user?.login || "");
       if (login) latestReviews.set(login, review);
     }
+    const pullRequestHeadSha = String(mergedPullRequest?.head?.sha || "").toLowerCase();
     const independentApprovals = [...latestReviews.values()].filter((review) =>
-      review.state === "APPROVED" && review.user?.login !== mergedPullRequest?.user?.login
+      review.state === "APPROVED" &&
+      review.user?.login !== mergedPullRequest?.user?.login &&
+      String(review.commit_id || "").toLowerCase() === pullRequestHeadSha
     );
-    const pullRequestHeadSha = String(mergedPullRequest?.head?.sha || "").toLowerCase();
     const checkRuns = /^[0-9a-f]{40}$/.test(pullRequestHeadSha)
       ? githubJson(`repos/${repository}/commits/${pullRequestHeadSha}/check-runs?per_page=100`, "merged pull-request head check runs")
       : { check_runs: [] };
@@ -360,7 +376,8 @@ function main() {
       requiredCheckSha: pullRequestHeadSha,
       sourceSha,
       authorizationSha,
-      headSha: String(branchState.commit?.sha || "").toLowerCase(),
+      headSha: branchHeadSha,
+      sourceContainedInBranch,
       releaseReconciliation,
       mergedPullRequest: Boolean(mergedPullRequest),
       pullRequestNumber: mergedPullRequest?.number || 0,