@kungfu-tech/buildchain 2.14.18-alpha.7 → 2.14.18-alpha.9

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.7",
+    "version": "2.14.18-alpha.9",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -212,7 +212,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:dd9c3179fd7ccd0736396f4924c297bf7ce3452ea6bb9c423d32f15455761c9e"
+      "auditDigest": "sha256:8eea73b0f1dafd490b8bbbfc41fb345055b457097e16a8c05fe6258d43bd6983"
     },
     {
       "contractVersion": 1,
@@ -663,7 +663,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:6f459e9bad07f4ec63ce1de30edaacef33587bc939c77140d5c31b75679a5091"
+      "auditDigest": "sha256:2b5ddfdf209121d62d41bd8565094e4df5e2314a3f26e5e71ed6422c7fd6f69e"
     },
     {
       "contractVersion": 1,
@@ -2928,7 +2928,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:dd9c3179fd7ccd0736396f4924c297bf7ce3452ea6bb9c423d32f15455761c9e"
+      "auditDigest": "sha256:8eea73b0f1dafd490b8bbbfc41fb345055b457097e16a8c05fe6258d43bd6983"
     },
     {
       "contractVersion": 1,
@@ -3126,5 +3126,5 @@
     }
   ],
   "compatibilityDigest": "sha256:df13c3b8066068925ce847b31002201d533034d10d342542422db3a665c10475",
-  "contractDigest": "sha256:9af0d6ab0322ad8ae141f85e463be09938850e9f315b5369d45bddafb1b7c171"
+  "contractDigest": "sha256:1123021240712e38cee4354638e6b25261c5444764aea2ee7b1aaf34cca5bd60"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-24T14:02:02.767Z",
-  "publishedAt": "2026-07-24T14:02:02.767Z",
+  "generatedAt": "2026-07-24T14:45:55.889Z",
+  "publishedAt": "2026-07-24T14:45:55.889Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "bb9b154e8081819601a54e6dc0f4252ebb72e981",
+  "sourceRevision": "0a6e29f7c10cee85b49cfd974349bb883ee6330c",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.7",
+    "version": "2.14.18-alpha.9",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.7",
+    "version": "2.14.18-alpha.9",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -320,7 +320,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-control-plane-audit",
       "export": "./publication-control-plane-audit",
       "target": "./packages/core/publication-control-plane-audit.js",
-      "digest": "sha256:0f16457858b95d504e2a9e53558356a8f509f6ca8b011f550efd60bd8db469a4",
+      "digest": "sha256:3817d243ef01490be7375d7ed8bb0d00326f528b1fe0681bfd0d003c9932cc96",
       "summary": "Read-only publication control-plane snapshot evaluation APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-24T14:02:02.767Z",
-  "publishedAt": "2026-07-24T14:02:02.767Z",
+  "generatedAt": "2026-07-24T14:45:55.889Z",
+  "publishedAt": "2026-07-24T14:45:55.889Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "bb9b154e8081819601a54e6dc0f4252ebb72e981",
+  "sourceRevision": "0a6e29f7c10cee85b49cfd974349bb883ee6330c",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.7",
+    "version": "2.14.18-alpha.9",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-24T14:02:02.767Z",
-  "publishedAt": "2026-07-24T14:02:02.767Z",
+  "generatedAt": "2026-07-24T14:45:55.889Z",
+  "publishedAt": "2026-07-24T14:45:55.889Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "bb9b154e8081819601a54e6dc0f4252ebb72e981",
+  "sourceRevision": "0a6e29f7c10cee85b49cfd974349bb883ee6330c",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.7",
+    "version": "2.14.18-alpha.9",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.18-alpha.7",
+  "version": "2.14.18-alpha.9",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/publication-control-plane-audit.js

@@ -122,6 +122,8 @@ export function evaluatePublicationControlPlaneSnapshot({
     Array.isArray(branchPolicy.releaseReconciliation.changedPaths) &&
     branchPolicy.releaseReconciliation.changedPaths.length > 0
   );
+  const sourceBranchBindingPass = branchPolicy.sourceSha === branchPolicy.headSha ||
+    branchPolicy.sourceContainedInBranch === true;
   const providerTransactionBranchPass = branchPolicy.ref === branch &&
     branchPolicy.policyMode === "provider-enforced-transaction" &&
     branchPolicy.protected === true &&
@@ -132,7 +134,7 @@ export function evaluatePublicationControlPlaneSnapshot({
     branchPolicy.requiredCheckPassed === true &&
     /^[0-9a-f]{40}$/i.test(String(branchPolicy.requiredCheckSha || "")) &&
     branchPolicy.requiredCheckSha === branchPolicy.pullRequestHeadSha &&
-    branchPolicy.sourceSha === branchPolicy.headSha &&
+    sourceBranchBindingPass &&
     sourceAuthorizationPass &&
     branchPolicy.mergedPullRequest === true &&
     branchPolicy.baseRef === branch &&
@@ -158,6 +160,7 @@ export function evaluatePublicationControlPlaneSnapshot({
           environmentPolicy.declared === true &&
           environmentPolicy.exists === true &&
           environmentPolicy.protected === true &&
+          environmentPolicy.branchAuthorized === true &&
           (environmentPolicy.reviewRequired !== true || environmentPolicy.preventSelfReview === true),
       environmentPolicy,
     ),

package/scripts/audit-publication-control-plane.mjs

@@ -239,6 +239,16 @@ function main() {
   const deploymentBranches = environment !== "none" && environmentState.deployment_branch_policy?.custom_branch_policies === true
     ? githubJson(`repos/${repository}/environments/${encodeURIComponent(environment)}/deployment-branch-policies?per_page=100`, "Environment deployment branch policy")
     : { branch_policies: [] };
+  const exactEnvironmentBranchPolicy = (deploymentBranches.branch_policies || []).find((entry) =>
+    entry?.type === "branch" && entry?.name === branch
+  );
+  const environmentBranchAuthorized = environment !== "none" && (
+    (
+      environmentState.deployment_branch_policy?.protected_branches === true &&
+      branchState.protected === true
+    ) ||
+    Boolean(exactEnvironmentBranchPolicy)
+  );
   const oidc = githubJson(`repos/${repository}/actions/oidc/customization/sub`, "OIDC subject policy");
   if (!["npm-trusted-publisher", "github-token", "oidc-role"].includes(publisherMode)) {
     throw new Error(`unsupported --publisher-mode: ${publisherMode}`);
@@ -277,10 +287,24 @@ function main() {
       message: sourceMessage,
       changedPaths: sourceChangedPaths,
     };
+    const branchHeadSha = String(branchState.commit?.sha || "").toLowerCase();
+    const sourceComparison = sourceSha === branchHeadSha
+      ? null
+      : githubJson(
+        `repos/${repository}/compare/${sourceSha}...${branchHeadSha}`,
+        "source protected-branch lineage",
+      );
+    const sourceContainedInBranch = sourceSha === branchHeadSha || (
+      sourceComparison?.status === "ahead" &&
+      String(sourceComparison?.merge_base_commit?.sha || "").toLowerCase() === sourceSha
+    );
     let pullRequests = githubJson(`repos/${repository}/commits/${authorizationSha}/pulls`, "source pull-request lineage");
     let mergedPullRequest = (Array.isArray(pullRequests) ? pullRequests : []).find((entry) =>
       entry?.merged_at &&
-      entry.merge_commit_sha === authorizationSha &&
+      (
+        String(entry.merge_commit_sha || "").toLowerCase() === authorizationSha ||
+        String(entry.head?.sha || "").toLowerCase() === authorizationSha
+      ) &&
       entry.base?.ref === branch &&
       entry.head?.repo?.full_name === repository
     );
@@ -318,10 +342,12 @@ function main() {
       const login = String(review?.user?.login || "");
       if (login) latestReviews.set(login, review);
     }
+    const pullRequestHeadSha = String(mergedPullRequest?.head?.sha || "").toLowerCase();
     const independentApprovals = [...latestReviews.values()].filter((review) =>
-      review.state === "APPROVED" && review.user?.login !== mergedPullRequest?.user?.login
+      review.state === "APPROVED" &&
+      review.user?.login !== mergedPullRequest?.user?.login &&
+      String(review.commit_id || "").toLowerCase() === pullRequestHeadSha
     );
-    const pullRequestHeadSha = String(mergedPullRequest?.head?.sha || "").toLowerCase();
     const checkRuns = /^[0-9a-f]{40}$/.test(pullRequestHeadSha)
       ? githubJson(`repos/${repository}/commits/${pullRequestHeadSha}/check-runs?per_page=100`, "merged pull-request head check runs")
       : { check_runs: [] };
@@ -360,7 +386,8 @@ function main() {
       requiredCheckSha: pullRequestHeadSha,
       sourceSha,
       authorizationSha,
-      headSha: String(branchState.commit?.sha || "").toLowerCase(),
+      headSha: branchHeadSha,
+      sourceContainedInBranch,
       releaseReconciliation,
       mergedPullRequest: Boolean(mergedPullRequest),
       pullRequestNumber: mergedPullRequest?.number || 0,
@@ -437,6 +464,13 @@ function main() {
         protected: (environmentState.protection_rules || []).length > 0 ||
           environmentState.deployment_branch_policy?.protected_branches === true ||
           (deploymentBranches.branch_policies || []).length > 0,
+        branchAuthorized: environmentBranchAuthorized,
+        branchPolicyMode: environmentState.deployment_branch_policy?.protected_branches === true
+          ? "protected-branches"
+          : exactEnvironmentBranchPolicy
+            ? "exact-custom-branch"
+            : "unqualified",
+        authorizedBranch: exactEnvironmentBranchPolicy?.name || "",
         reviewRequired: reviewRules.length > 0,
         preventSelfReview: reviewRules.some((rule) => rule.prevent_self_review === true),
       },