@kungfu-tech/buildchain 2.14.18-alpha.8 → 2.14.18

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.8",
+    "version": "2.14.18",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -212,7 +212,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:dd9c3179fd7ccd0736396f4924c297bf7ce3452ea6bb9c423d32f15455761c9e"
+      "auditDigest": "sha256:ba3117f22b343d5f18cd48d327bffaa8ed442cb6150b6c2f95d091808cd009a7"
     },
     {
       "contractVersion": 1,
@@ -663,7 +663,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:6cc4353f5c2ae7b5e260b38b1810e4216e7ac31528ffe8da850d22e73246b6f6"
+      "auditDigest": "sha256:4572769775450f49fa37a72e6dda211eea0af0a4dd73ad1d188dbb34782a35a9"
     },
     {
       "contractVersion": 1,
@@ -2928,7 +2928,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:dd9c3179fd7ccd0736396f4924c297bf7ce3452ea6bb9c423d32f15455761c9e"
+      "auditDigest": "sha256:ba3117f22b343d5f18cd48d327bffaa8ed442cb6150b6c2f95d091808cd009a7"
     },
     {
       "contractVersion": 1,
@@ -3126,5 +3126,5 @@
     }
   ],
   "compatibilityDigest": "sha256:df13c3b8066068925ce847b31002201d533034d10d342542422db3a665c10475",
-  "contractDigest": "sha256:b6192f49aca3f3e70767290dea22578aa295fccd274c0482dae9968145844e02"
+  "contractDigest": "sha256:9a73a8824bfbdb1bdbeb8acd5b6366eb980f3e505c7a5dd1bc439d1d803469a9"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-24T14:23:08.194Z",
-  "publishedAt": "2026-07-24T14:23:08.194Z",
+  "generatedAt": "2026-07-24T16:50:01.298Z",
+  "publishedAt": "2026-07-24T16:50:01.298Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "c432ae15fe0c8efc912628dfaaf6b0b3eec196fb",
+  "sourceRevision": "aa1bea6f12a7a815793fb223cfaea9db691c1908",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.8",
+    "version": "2.14.18",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.8",
+    "version": "2.14.18",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -125,7 +125,7 @@
       "specifier": "@kungfu-tech/buildchain/controller-evidence",
       "export": "./controller-evidence",
       "target": "./packages/core/controller-evidence.js",
-      "digest": "sha256:5a4d6d9f2180f60de2eaab5eeb5a0deb79cde688d6047719c3748eaefdd31940",
+      "digest": "sha256:6169f625ab2bd8a21ddcbb1c72529df481a4eeadd2b37a4c5e8e0dee9668a435",
       "summary": "Project-independent controller descriptors, source/runtime-bound plans, receipts, aggregates, and validation APIs.",
       "capabilityGroup": "reusable-build",
       "audience": [
@@ -320,7 +320,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-control-plane-audit",
       "export": "./publication-control-plane-audit",
       "target": "./packages/core/publication-control-plane-audit.js",
-      "digest": "sha256:319cd46deac8d720698ffbb40f63cec33901b7ac33cd8c0dbc720f448686a789",
+      "digest": "sha256:3817d243ef01490be7375d7ed8bb0d00326f528b1fe0681bfd0d003c9932cc96",
       "summary": "Read-only publication control-plane snapshot evaluation APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-24T14:23:08.194Z",
-  "publishedAt": "2026-07-24T14:23:08.194Z",
+  "generatedAt": "2026-07-24T16:50:01.298Z",
+  "publishedAt": "2026-07-24T16:50:01.298Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "c432ae15fe0c8efc912628dfaaf6b0b3eec196fb",
+  "sourceRevision": "aa1bea6f12a7a815793fb223cfaea9db691c1908",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.8",
+    "version": "2.14.18",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-24T14:23:08.194Z",
-  "publishedAt": "2026-07-24T14:23:08.194Z",
+  "generatedAt": "2026-07-24T16:50:01.298Z",
+  "publishedAt": "2026-07-24T16:50:01.298Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "c432ae15fe0c8efc912628dfaaf6b0b3eec196fb",
+  "sourceRevision": "aa1bea6f12a7a815793fb223cfaea9db691c1908",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.8",
+    "version": "2.14.18",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.18-alpha.8",
+  "version": "2.14.18",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/controller-evidence.js

@@ -7,7 +7,7 @@ export const BUILDCHAIN_CONTROLLER_AGGREGATE_CONTRACT = "buildchain.controller-e
 
 const SHA256_PATTERN = /^sha256:[0-9a-f]{64}$/;
 const GIT_SHA_PATTERN = /^[0-9a-f]{40}$/;
-const STAGE_STATUSES = new Set(["passed", "failed", "skipped", "cancelled", "missing"]);
+const STAGE_STATUSES = new Set(["passed", "failed", "skipped", "cancelled", "missing", "partial"]);
 
 const CONTROLLER_SPECS = [
   {

package/packages/core/publication-control-plane-audit.js

@@ -160,6 +160,7 @@ export function evaluatePublicationControlPlaneSnapshot({
           environmentPolicy.declared === true &&
           environmentPolicy.exists === true &&
           environmentPolicy.protected === true &&
+          environmentPolicy.branchAuthorized === true &&
           (environmentPolicy.reviewRequired !== true || environmentPolicy.preventSelfReview === true),
       environmentPolicy,
     ),

package/scripts/audit-publication-control-plane.mjs

@@ -239,6 +239,16 @@ function main() {
   const deploymentBranches = environment !== "none" && environmentState.deployment_branch_policy?.custom_branch_policies === true
     ? githubJson(`repos/${repository}/environments/${encodeURIComponent(environment)}/deployment-branch-policies?per_page=100`, "Environment deployment branch policy")
     : { branch_policies: [] };
+  const exactEnvironmentBranchPolicy = (deploymentBranches.branch_policies || []).find((entry) =>
+    entry?.type === "branch" && entry?.name === branch
+  );
+  const environmentBranchAuthorized = environment !== "none" && (
+    (
+      environmentState.deployment_branch_policy?.protected_branches === true &&
+      branchState.protected === true
+    ) ||
+    Boolean(exactEnvironmentBranchPolicy)
+  );
   const oidc = githubJson(`repos/${repository}/actions/oidc/customization/sub`, "OIDC subject policy");
   if (!["npm-trusted-publisher", "github-token", "oidc-role"].includes(publisherMode)) {
     throw new Error(`unsupported --publisher-mode: ${publisherMode}`);
@@ -454,6 +464,13 @@ function main() {
         protected: (environmentState.protection_rules || []).length > 0 ||
           environmentState.deployment_branch_policy?.protected_branches === true ||
           (deploymentBranches.branch_policies || []).length > 0,
+        branchAuthorized: environmentBranchAuthorized,
+        branchPolicyMode: environmentState.deployment_branch_policy?.protected_branches === true
+          ? "protected-branches"
+          : exactEnvironmentBranchPolicy
+            ? "exact-custom-branch"
+            : "unqualified",
+        authorizedBranch: exactEnvironmentBranchPolicy?.name || "",
         reviewRequired: reviewRules.length > 0,
         preventSelfReview: reviewRules.some((rule) => rule.prevent_self_review === true),
       },