@kungfu-tech/buildchain 2.14.18-alpha.9 → 2.14.19-alpha.0

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.9",
+    "version": "2.14.19-alpha.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -170,7 +170,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:1f476fb9a4854b362c4b24cef89a3c7675d7d63baf3bc828d7b8ae7d2787cead",
-      "auditDigest": "sha256:5a5cbec0b5382c34101623ed11f264797b618920d8c98c78e0d14af9f07a1f6b"
+      "auditDigest": "sha256:e0fad79855df3dedfaa2e92c20f6154f2ff18890e65f97f1279ce948bb426b04"
     },
     {
       "contractVersion": 1,
@@ -212,7 +212,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:8eea73b0f1dafd490b8bbbfc41fb345055b457097e16a8c05fe6258d43bd6983"
+      "auditDigest": "sha256:c3b618429257e3a332f0f9d0827fb17fc7762ec215c64f849f6f51874aa3a1d3"
     },
     {
       "contractVersion": 1,
@@ -256,7 +256,7 @@
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
       ],
       "breakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
-      "auditDigest": "sha256:063dfe24e1ccdd95b4ffbf89a154aa71197c8bd1cb98b4705d8663917c026366"
+      "auditDigest": "sha256:92432be1f049d261434c986f79e55899f2097ca7b66f1261666fc5b85d685889"
     },
     {
       "contractVersion": 1,
@@ -327,7 +327,7 @@
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
       ],
       "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
-      "auditDigest": "sha256:c23298988d29d6dbf99c65fd7d5567d704f012cc7a061c46a848c26814cab4b9"
+      "auditDigest": "sha256:90dc42a2b7077441afba4493132c1baf2645be46e3e73abe9f8436598d9b9bc9"
     },
     {
       "contractVersion": 1,
@@ -663,7 +663,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:2b5ddfdf209121d62d41bd8565094e4df5e2314a3f26e5e71ed6422c7fd6f69e"
+      "auditDigest": "sha256:9ad3fe0e0b693621e0e3482072ae819fb65e6e53396186d9715552bb598906f3"
     },
     {
       "contractVersion": 1,
@@ -714,7 +714,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -873,7 +873,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:a06607b6ebd3fb00b77519098c81d6fb5e9943ec268aebb1e5fdbefef6e598ad",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1297,7 +1297,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:4fc6c33bf5b429f8087ac752d5cf2a19f4a1cc30db01aae927a28cee1cf924f0",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1671,7 +1671,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:29569f4b754595792a16742d1c4c63838b54601674a2cb6c96261a72c962dece",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1827,6 +1827,7 @@
         "production-release-on-main",
         "production-release-pr-mode",
         "production-release-pr-token",
+        "production-source-sha",
         "publication-admission-json",
         "publication-control-plane-audit-json",
         "publication-expected-json",
@@ -1842,8 +1843,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:65cc01e6d2b622277d67237e4811e82d24d2289d55c2f7d2dfb72325c610b2ea",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -1961,6 +1962,10 @@
             "classification": "redacted",
             "source": "workflow-call-input"
           },
+          "production-source-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "publication-admission-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -2018,7 +2023,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27",
-      "auditDigest": "sha256:063dfe24e1ccdd95b4ffbf89a154aa71197c8bd1cb98b4705d8663917c026366"
+      "auditDigest": "sha256:92432be1f049d261434c986f79e55899f2097ca7b66f1261666fc5b85d685889"
     },
     {
       "contractVersion": 1,
@@ -2083,7 +2088,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2265,7 +2270,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2539,10 +2544,15 @@
         "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
         "publish-target",
+        "publish-transaction-override",
+        "release-activation-command",
+        "release-activation-receipt-set-path",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
         "release-passport-buildchain-self-kfd",
+        "release-passport-evidence-command",
+        "release-passport-evidence-path",
         "release-passport-impact-json",
         "release-passport-invariant-passport-command",
         "release-passport-invariant-passport-jsons",
@@ -2564,8 +2574,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:98e2676d01470992d7b4ca9c2a1e12b0e6c816c0586a8e8e1736f4b58a1360a9",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "digest": "sha256:2bae7310eb27f48a3afc6b7f993872d6b6121cf3f67ad4d6e2da35b254c4d047",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -2831,6 +2841,18 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "publish-transaction-override": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "release-activation-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "release-activation-receipt-set-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "release-candidate-workflow-file": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2847,6 +2869,14 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "release-passport-evidence-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "release-passport-evidence-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "release-passport-impact-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -2928,7 +2958,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:8eea73b0f1dafd490b8bbbfc41fb345055b457097e16a8c05fe6258d43bd6983"
+      "auditDigest": "sha256:c3b618429257e3a332f0f9d0827fb17fc7762ec215c64f849f6f51874aa3a1d3"
     },
     {
       "contractVersion": 1,
@@ -2989,7 +3019,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -3112,7 +3142,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3126,5 +3156,5 @@
     }
   ],
   "compatibilityDigest": "sha256:df13c3b8066068925ce847b31002201d533034d10d342542422db3a665c10475",
-  "contractDigest": "sha256:1123021240712e38cee4354638e6b25261c5444764aea2ee7b1aaf34cca5bd60"
+  "contractDigest": "sha256:c2adec72d5f57a4e264521d178dc052f36b5645dc38b793c24029367d5734b42"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-24T14:45:55.889Z",
-  "publishedAt": "2026-07-24T14:45:55.889Z",
+  "generatedAt": "2026-07-25T09:03:07.729Z",
+  "publishedAt": "2026-07-25T09:03:07.729Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "0a6e29f7c10cee85b49cfd974349bb883ee6330c",
+  "sourceRevision": "22974861f653c475febd15dd67dcc5cc01fb6f83",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.9",
+    "version": "2.14.19-alpha.0",
     "versionSource": "package.json#version"
   },
   "source": {
@@ -1436,6 +1436,27 @@
       ],
       "markdown": "# README Badge Blocks\n\nBuildchain can generate a managed README badge block from repository-owned\nfacts. The README keeps only a projection; the source facts remain in\n`.buildchain/buildchain.toml`, package metadata, workflow files, KFD standards metadata,\nand the repository's own release passport.\n\nThe managed block is delimited by:\n\n```markdown\n<!-- buildchain:badges:start -->\n...\n<!-- buildchain:badges:end -->\n```\n\nBuildchain owns only that block. Everything outside the markers remains normal\nREADME content.\n\n## Node API\n\nUse the public package export:\n\n```js\nimport {\n  collectBadgeBundleFacts,\n  collectReadmeBadgeFacts,\n  createKfdBadgeSpecsFromStandards,\n  renderBadgeBundleBlock,\n  renderReadmeBadgeBlock,\n  checkBadgeBundleBlock,\n  checkReadmeBadgeBlock,\n  updateBadgeBundleBlock,\n  updateReadmeBadgeBlock,\n} from \"@kungfu-tech/buildchain/badges\";\n```\n\n`@kungfu-tech/buildchain/readme-badges` remains available for compatibility,\nbut new integrations should use `@kungfu-tech/buildchain/badges`.\n\n`collectReadmeBadgeFacts({ cwd })` returns a machine-readable object with\ncontract `kungfu-buildchain-readme-badge-facts`. It collects repository\nidentity, package name/version/license, configured platforms, configured\nworkflow status badges, the repository's own Buildchain Release Passport\nlocation and verification result, and KFD badge state. KFD badge labels,\nhuman-facing concept text, standard document links, schema IDs, and interface\ncontracts are read from\n`@kungfu-tech/kfd/standards.json` when the package is installed, or from an\nexplicit `kfd_standards` path/URL. When present, it also summarizes local KFD\nclaim registry and product-mechanism facts from the package-owned site bundle,\nso downstream agents can connect README badges back to Buildchain's\nKFD/source-of-truth surfaces.\n\n`renderReadmeBadgeBlock(facts)` renders deterministic Markdown from that facts\nobject. `checkReadmeBadgeBlock({ readmeText, facts })` compares the current\nREADME marker block against the expected block and reports missing or stale\ndrift. `updateReadmeBadgeBlock({ readmeText, facts })` inserts or replaces the\nmanaged block.\n\nThe Node API is the implementation source. The CLI delegates to it.\n\n`collectBadgeBundleFacts({ cwd, claims })` is the trust-badge bundle API. It\nuses the same repository facts, but returns contract\n`kungfu-buildchain-badge-bundle-facts` and only renders the Buildchain trust\nclaims: every active `kfd-*` standard discovered from KFD standards metadata,\nplus `release-passport`. KFD-1, KFD-2, KFD-3, KFD-4, and release passport are\nenabled by default with current KFD metadata. Callers can pass\n`claims: \"kfd-1,release-passport\"` or an array to narrow the bundle without\nhand-writing badge Markdown.\n\n## CLI\n\nGenerate facts as JSON:\n\n```bash\nbuildchain badges readme --json\n```\n\nFail closed when the README block is missing or stale:\n\n```bash\nbuildchain badges readme --check\n```\n\nInsert or replace the block:\n\n```bash\nbuildchain badges readme --write\n```\n\nGenerate only the Buildchain trust badge bundle:\n\n```bash\nbuildchain badges bundle --json\nbuildchain badges bundle --check\nbuildchain badges bundle --write\n```\n\nNarrow the bundle to specific claims:\n\n```bash\nbuildchain badges bundle --claims kfd-1,release-passport --write\n```\n\nAll commands accept `--cwd <dir>` and `--readme <path>`. Repositories can add\n`buildchain badges bundle --check` or `buildchain badges readme --check` to CI\nso badge drift is detected like any other generated release-facing surface.\n\n## Configuration\n\nThe optional `[badges]` table in `.buildchain/buildchain.toml` declares local facts that\ncannot be inferred safely:\n\n```toml\n[badges]\nrelease_passport = \"https://github.com/example/project/releases/latest/download/buildchain.release.json\"\nkfd_standards = \"node_modules/@kungfu-tech/kfd/standards.json\"\nkfd_1 = \"declared\"\nkfd_2 = \"planned\"\nkfd_3 = \"aligned\"\nkfd_4 = \"declared\"\nplatforms = [\"macOS\", \"Linux\", \"Windows\"]\nworkflows = [\"verify.yml\", \"build.yml\"]\n\n[badges.bundle]\nclaims = [\"kfd-1\", \"kfd-2\", \"kfd-3\", \"kfd-4\", \"release-passport\"]\n```\n\n`release_passport` may be a local path or URL. If omitted, Buildchain tries\n`buildchain.release.json`, then `.buildchain/release-passport/buildchain.release.json`,\nthen the repository's latest GitHub Release asset when the GitHub repository\ncan be discovered.\n\nThe generated `Buildchain Release Passport` badge is a repository capability\nbadge: it says whether the current repository has a Buildchain release passport\nthat can be verified. It does not report the upstream `kungfu-systems/buildchain`\nrepository status. Buildchain's own README dogfoods the same rule because its\nconfigured `release_passport` points at Buildchain's own release passport.\n\nBuildchain-owned badges use stable hosted image URLs by default:\n\n```text\nhttps://buildchain.libkungfu.dev/badges/v1/{badge}/{state}.svg\n```\n\nThe URL is part of the Buildchain badge contract. Consumers do not need to\nregenerate README files when Buildchain replaces the placeholder badge logo\nwith a formal logo; the hosted endpoint owns logo rendering. The package-owned\nsite bundle publishes `badge-endpoint-registry.json` plus Shields-compatible\nJSON payloads under `badges/v1/**` so the site repository can serve or render\nthe exact SVG endpoints without inventing badge facts.\n\nForks or private deployments can override the image host with:\n\n```toml\n[badges]\nbadge_endpoint_base_url = \"https://example.com/buildchain-badges/v1\"\n```\n\n`kfd_standards` is optional. If omitted, Buildchain tries the installed\n`@kungfu-tech/kfd/standards.json` package export. Use the explicit path or URL\nonly when a repository deliberately vendors KFD standards metadata or validates\nagainst a local KFD development checkout. The KFD standards metadata controls\nthe badge vocabulary; the release passport still controls whether a repository\nmay display a KFD state as `passed`.\n\n## KFD Badge Rules\n\nKFD passed is evidence-backed. A repository may display `KFD-N passed` only when\nits own release passport verifies successfully and the corresponding passport\nsection has `status: \"passed\"`. The KFD badge vocabulary comes from KFD\nstandards metadata, not Buildchain private strings: for example KFD-2 uses the\n`releaseTrustPassport` concept and KFD-4 uses the `observerPerspective` concept\nfrom `@kungfu-tech/kfd/standards.json`.\n\nWhen no release passport exists yet, or when the passport cannot be verified,\nBuildchain downgrades each KFD badge to the explicit local declaration such as\n`declared`, `aligned`, or `planned`. A local `passed` declaration is treated as\n`declared`; unknown local states are normalized to a non-passed fallback.\n\nBuildchain's own README may link to Buildchain's own release passport. Other\nrepositories must not claim Buildchain's KFD status as their own; their badge\nlinks must point to their own release passport or evidence page.\n\n## CI Contract\n\nRecommended CI gate:\n\n```bash\nbuildchain badges readme --check\n```\n\nor, when the repository only wants the Buildchain trust bundle:\n\n```bash\nbuildchain badges bundle --check\n```\n\nThe check fails when:\n\n- the marker block is missing;\n- generated Markdown differs from repository facts;\n- a previously hand-written KFD passed claim is not backed by the repository's\n  verified release passport facts.\n\nThe machine-readable facts object should be used by downstream site renderers\nor audit tools when Markdown badges are not enough."
     },
+    {
+      "id": "manual:release-activation-transaction",
+      "title": "Release activation transaction",
+      "route": "/docs/release-activation-transaction",
+      "category": "manual",
+      "capabilityGroup": "getting-started",
+      "audience": [
+        "agent"
+      ],
+      "maturity": "stable",
+      "sourcePath": "docs/release-activation-transaction.md",
+      "digest": "sha256:c3de5838603d3e6dd3ea03c599e67aafa1d1fc184498fb779cb703f8796424cf",
+      "headings": [
+        {
+          "level": 1,
+          "title": "Release activation transaction",
+          "anchor": "release-activation-transaction"
+        }
+      ],
+      "markdown": "# Release activation transaction\n\nBuildchain exposes `release-activation-transaction` as the final cross-repository\ncontract between a qualified product release, its public web surface, and the\nproduct-owned released-evidence projection.\n\nThe canonical order is:\n\n1. `candidate-qualified`\n2. `artifacts-published`\n3. `passport-sealed`\n4. `site-published`\n5. `public-readback`\n6. `evidence-synthesized`\n\n`packages/core/release-activation-transaction.js` is the executable authority.\nEvery transaction binds an exact product source SHA, exact reviewed site source\nSHA, tag, channel, version, environment, artifact-set root, and the three\nrepository owners. A later phase cannot pass while an earlier phase is\nincomplete. Replaying a passed phase is idempotent only when its retained\nreceipt roots are unchanged.\n\nReleased evidence must be synthesized from a canonical receipt set containing\nexactly one artifact-publication, release-passport, site-publication,\npublic-readback, and product-qualification receipt. Every receipt repeats the\nsame binding root. Missing, duplicated, stale, or substituted roots fail\nclosed.\n\nShadow rehearsal uses `mode=shadow`, `environment=shadow`, and always emits\n`releasedUseClaim=false`. It is suitable for protected PR qualification and\nmust never be published as real release evidence. Activation mode requires the\nproduction environment; actual channel mutation remains the caller's protected\npublication responsibility.\n\nThe web-surface workflow accepts `production-source-sha` only for an explicitly\napproved `workflow_dispatch`. It checks out and plans the exact reviewed\nconsumer commit, while the production environment and normal publication\nauthority gates remain intact."
+    },
     {
       "id": "manual:release-candidate",
       "title": "Release Candidate Passport",
@@ -2547,7 +2568,7 @@
   "pageRegistry": {
     "path": "page-registry.json",
     "contract": "kungfu-buildchain-site-page-registry",
-    "pageCount": 54,
+    "pageCount": 55,
     "categories": [
       "action",
       "api",

package/dist/site/capability-registry.json

@@ -15,7 +15,7 @@
       "maturity": "stable",
       "counts": {
         "manualCount": 3,
-        "pageCount": 9,
+        "pageCount": 10,
         "cliCommandCount": 5,
         "nodeApiCount": 0,
         "workflowCount": 0,
@@ -50,7 +50,7 @@
         "manualCount": 4,
         "pageCount": 4,
         "cliCommandCount": 21,
-        "nodeApiCount": 7,
+        "nodeApiCount": 8,
         "workflowCount": 2,
         "actionCount": 1
       },

package/dist/site/controller-registry.json

@@ -1006,6 +1006,10 @@
           "classification": "redacted",
           "source": "workflow-call-input"
         },
+        "production-source-sha": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "publication-admission-json": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -1098,7 +1102,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:65cc01e6d2b622277d67237e4811e82d24d2289d55c2f7d2dfb72325c610b2ea"
+      "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575"
     },
     {
       "schemaVersion": 1,
@@ -1718,6 +1722,18 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "publish-transaction-override": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "release-activation-command": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "release-activation-receipt-set-path": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "release-candidate-workflow-file": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1734,6 +1750,14 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "release-passport-evidence-command": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "release-passport-evidence-path": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "release-passport-impact-json": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -1848,7 +1872,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:98e2676d01470992d7b4ca9c2a1e12b0e6c816c0586a8e8e1736f4b58a1360a9"
+      "digest": "sha256:2bae7310eb27f48a3afc6b7f993872d6b6121cf3f67ad4d6e2da35b254c4d047"
     },
     {
       "schemaVersion": 1,
@@ -2024,5 +2048,5 @@
       "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555"
     }
   ],
-  "digest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b"
+  "digest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600"
 }

package/dist/site/kfd-claims.json

@@ -21,12 +21,12 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "e2ed3df53a48587531486466e02c82f044920fb629a77b0880e9b9aaa762adac",
+    "sha256": "15df59be9425d65035f0e4a7f1225f77d16c7eb5329c9b6d741feac7ebc5dee8",
     "summary": {
       "cliCommandCount": 87,
       "workflowCount": 52,
       "actionCount": 5,
-      "sitePageCount": 54,
+      "sitePageCount": 55,
       "docCommandRefCount": 276,
       "failureCount": 0
     },
@@ -228,12 +228,12 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "e2ed3df53a48587531486466e02c82f044920fb629a77b0880e9b9aaa762adac",
+      "sha256": "15df59be9425d65035f0e4a7f1225f77d16c7eb5329c9b6d741feac7ebc5dee8",
       "summary": {
         "cliCommandCount": 87,
         "workflowCount": 52,
         "actionCount": 5,
-        "sitePageCount": 54,
+        "sitePageCount": 55,
         "docCommandRefCount": 276,
         "failureCount": 0
       },
@@ -1425,6 +1425,18 @@
           "public": true,
           "packageExport": "./release-propagation"
         },
+        {
+          "id": "export:./release-activation-transaction",
+          "name": "@kungfu-tech/buildchain/release-activation-transaction",
+          "kind": "package-export",
+          "sourcePath": "packages/core/release-activation-transaction.js",
+          "evidencePath": "packages/core/release-activation-transaction.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./release-activation-transaction"
+        },
         {
           "id": "export:./surface-manifest",
           "name": "@kungfu-tech/buildchain/surface-manifest",
@@ -2933,7 +2945,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 78,
+          "inputCount": 83,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -2991,10 +3003,15 @@
             "publish-rematerialize-on-resume",
             "publish-required-artifacts-json",
             "publish-target",
+            "publish-transaction-override",
+            "release-activation-command",
+            "release-activation-receipt-set-path",
             "release-candidate-workflow-file",
             "release-candidate-workflow-name",
             "release-passport",
             "release-passport-buildchain-self-kfd",
+            "release-passport-evidence-command",
+            "release-passport-evidence-path",
             "release-passport-impact-json",
             "release-passport-invariant-passport-command",
             "release-passport-invariant-passport-jsons",
@@ -3243,7 +3260,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 40,
+          "inputCount": 41,
           "inputs": [
             "artifact-path",
             "aws-region",
@@ -3273,6 +3290,7 @@
             "production-release-on-main",
             "production-release-pr-mode",
             "production-release-pr-token",
+            "production-source-sha",
             "publication-admission-json",
             "publication-control-plane-audit-json",
             "publication-expected-json",
@@ -3919,7 +3937,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 70,
+          "inputCount": 75,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -3969,10 +3987,15 @@
             "publish-rematerialize-on-resume",
             "publish-required-artifacts-json",
             "publish-target",
+            "publish-transaction-override",
+            "release-activation-command",
+            "release-activation-receipt-set-path",
             "release-candidate-workflow-file",
             "release-candidate-workflow-name",
             "release-passport",
             "release-passport-buildchain-self-kfd",
+            "release-passport-evidence-command",
+            "release-passport-evidence-path",
             "release-passport-impact-json",
             "release-passport-invariant-passport-command",
             "release-passport-invariant-passport-jsons",
@@ -4864,6 +4887,18 @@
           "public": true,
           "reverseAuditSource": "dist/site/page-registry.json"
         },
+        {
+          "id": "site-page:manual:release-activation-transaction",
+          "name": "site-page:manual:release-activation-transaction",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:manual:release-candidate",
           "name": "site-page:manual:release-candidate",
@@ -5170,6 +5205,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 329
+    "publicSurfaceCount": 331
   }
 }

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.9",
+    "version": "2.14.19-alpha.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -8,7 +8,7 @@
       "specifier": "@kungfu-tech/buildchain",
       "export": ".",
       "target": "./packages/core/index.js",
-      "digest": "sha256:b1cccdca930eb1ab2be006b8fabc795966f61fafdb4933758a42a7bf3c3bf6cd",
+      "digest": "sha256:7f1f3ce6c862e556dc73a0b3b7fe96b8c6772b96de3e677a77eed87c8a03047f",
       "summary": "Root toolkit export for Buildchain's public Node API.",
       "capabilityGroup": "api-cli-reference",
       "audience": [
@@ -47,7 +47,7 @@
       "specifier": "@kungfu-tech/buildchain/core",
       "export": "./core",
       "target": "./packages/core/index.js",
-      "digest": "sha256:b1cccdca930eb1ab2be006b8fabc795966f61fafdb4933758a42a7bf3c3bf6cd",
+      "digest": "sha256:7f1f3ce6c862e556dc73a0b3b7fe96b8c6772b96de3e677a77eed87c8a03047f",
       "summary": "Alias for the root public toolkit export.",
       "capabilityGroup": "api-cli-reference",
       "audience": [
@@ -125,7 +125,7 @@
       "specifier": "@kungfu-tech/buildchain/controller-evidence",
       "export": "./controller-evidence",
       "target": "./packages/core/controller-evidence.js",
-      "digest": "sha256:5a4d6d9f2180f60de2eaab5eeb5a0deb79cde688d6047719c3748eaefdd31940",
+      "digest": "sha256:6169f625ab2bd8a21ddcbb1c72529df481a4eeadd2b37a4c5e8e0dee9668a435",
       "summary": "Project-independent controller descriptors, source/runtime-bound plans, receipts, aggregates, and validation APIs.",
       "capabilityGroup": "reusable-build",
       "audience": [
@@ -307,7 +307,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-authority",
       "export": "./publication-authority",
       "target": "./packages/core/publication-authority.js",
-      "digest": "sha256:90bbbe0105f4c4458fdaa8eb37bf2595a00627724d6d3ac54b9e6634ee749fc4",
+      "digest": "sha256:10a33dae7768c9fced757c7d75c673adbd016b149064dce39d9f42df5c84073e",
       "summary": "Sealed publication authority registry, runner provenance, control-plane audit, admission, and independent verification APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [
@@ -433,6 +433,19 @@
       ],
       "maturity": "stable"
     },
+    {
+      "specifier": "@kungfu-tech/buildchain/release-activation-transaction",
+      "export": "./release-activation-transaction",
+      "target": "./packages/core/release-activation-transaction.js",
+      "digest": "sha256:0f33d276a3089dd314c76712adc42d60ef61793f52de32092e03d43be6922756",
+      "summary": "Ordered cross-repository activation, exact receipt-set binding, retry, abort, rollback, and shadow-rehearsal APIs.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "developer",
+        "agent"
+      ],
+      "maturity": "stable"
+    },
     {
       "specifier": "@kungfu-tech/buildchain/surface-manifest",
       "export": "./surface-manifest",