@kungfu-tech/buildchain 2.14.18 → 3.0.0

package/dist/site/buildchain-contract.json

@@ -4,10 +4,10 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.18",
+    "version": "3.0.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
-  "majorLine": "v2",
+  "majorLine": "v3",
   "compatibilityPolicy": "major-compatible",
   "surfaces": [
     {
@@ -17,7 +17,7 @@
       "id": "reusable-build",
       "kind": "workflow",
       "path": ".github/workflows/.build.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/.build.yml@v2",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/.build.yml@v3",
       "requiredInputs": [],
       "requiredOutputs": [
         "buildchain-runtime-sha",
@@ -59,7 +59,7 @@
       "id": "channel-build-router",
       "kind": "workflow",
       "path": ".github/workflows/build.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/build.yml@v2",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/build.yml@v3",
       "requiredInputs": [],
       "requiredOutputs": [
         "buildchain-channel",
@@ -98,7 +98,7 @@
       "id": "release-candidate-promote",
       "kind": "workflow",
       "path": ".github/workflows/release-candidate-promote.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v2",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v3",
       "requiredInputs": [
         "channel"
       ],
@@ -109,8 +109,8 @@
       ],
       "breakingDefaults": {
         "channelDefault": "auto",
-        "alphaShellDefault": "v2-alpha",
-        "stableShellDefault": "v2",
+        "alphaShellDefault": "v3-alpha",
+        "stableShellDefault": "v3",
         "promoteOnlyReleaseCandidate": true,
         "requiredStatusCheck": "check / check"
       },
@@ -169,8 +169,8 @@
         "publish-gate source locks are created by the wrapper and enforced by promote-buildchain-ref before publish side effects",
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
-      "breakingDigest": "sha256:1f476fb9a4854b362c4b24cef89a3c7675d7d63baf3bc828d7b8ae7d2787cead",
-      "auditDigest": "sha256:5a5cbec0b5382c34101623ed11f264797b618920d8c98c78e0d14af9f07a1f6b"
+      "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
+      "auditDigest": "sha256:fb1e6e05c16df3e357a9b47d2c8335b99e23b2ccf8d92432b0cbc655fa9196a1"
     },
     {
       "contractVersion": 1,
@@ -179,7 +179,7 @@
       "id": "advanced-release-candidate-promote",
       "kind": "workflow",
       "path": ".github/workflows/.release-candidate-promote.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v2",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v3",
       "requiredInputs": [
         "channel"
       ],
@@ -212,7 +212,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:ba3117f22b343d5f18cd48d327bffaa8ed442cb6150b6c2f95d091808cd009a7"
+      "auditDigest": "sha256:821aa9a8b69fc2fb0fdea3fe569133b9f084be6bb0e4543e1583372c10d2316f"
     },
     {
       "contractVersion": 1,
@@ -221,7 +221,7 @@
       "id": "web-surface",
       "kind": "workflow",
       "path": ".github/workflows/.web-surface.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v2",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3",
       "requiredInputs": [],
       "requiredOutputs": [
         "buildchain-runtime-sha",
@@ -265,7 +265,7 @@
       "id": "promote-buildchain-ref-action",
       "kind": "action",
       "path": "actions/promote-buildchain-ref/action.yml",
-      "publicRef": "kungfu-systems/buildchain/actions/promote-buildchain-ref@v2",
+      "publicRef": "kungfu-systems/buildchain/actions/promote-buildchain-ref@v3",
       "requiredInputs": [
         "token",
         "sha",
@@ -327,7 +327,7 @@
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
       ],
       "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
-      "auditDigest": "sha256:c23298988d29d6dbf99c65fd7d5567d704f012cc7a061c46a848c26814cab4b9"
+      "auditDigest": "sha256:90dc42a2b7077441afba4493132c1baf2645be46e3e73abe9f8436598d9b9bc9"
     },
     {
       "contractVersion": 1,
@@ -336,7 +336,7 @@
       "id": "macos-credential-island-action",
       "kind": "action",
       "path": "actions/macos-credential-island/action.yml",
-      "publicRef": "kungfu-systems/buildchain/actions/macos-credential-island@v2",
+      "publicRef": "kungfu-systems/buildchain/actions/macos-credential-island@v3",
       "requiredInputs": [
         "input-root",
         "output-root",
@@ -392,7 +392,7 @@
       "id": "report-buildchain-issue-action",
       "kind": "action",
       "path": "actions/report-buildchain-issue/action.yml",
-      "publicRef": "kungfu-systems/buildchain/actions/report-buildchain-issue@v2",
+      "publicRef": "kungfu-systems/buildchain/actions/report-buildchain-issue@v3",
       "requiredInputs": [
         "token"
       ],
@@ -663,7 +663,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:4572769775450f49fa37a72e6dda211eea0af0a4dd73ad1d188dbb34782a35a9"
+      "auditDigest": "sha256:9e45dffc31b061f2c074cbc50e2d2b61da67250504f20cff475c4648fea4ae65"
     },
     {
       "contractVersion": 1,
@@ -714,7 +714,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -873,7 +873,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:a06607b6ebd3fb00b77519098c81d6fb5e9943ec268aebb1e5fdbefef6e598ad",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1297,7 +1297,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:4fc6c33bf5b429f8087ac752d5cf2a19f4a1cc30db01aae927a28cee1cf924f0",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1671,7 +1671,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:29569f4b754595792a16742d1c4c63838b54601674a2cb6c96261a72c962dece",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1843,7 +1843,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:65cc01e6d2b622277d67237e4811e82d24d2289d55c2f7d2dfb72325c610b2ea",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2083,7 +2083,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2265,7 +2265,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2539,6 +2539,7 @@
         "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
         "publish-target",
+        "publish-transaction-override",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
@@ -2564,8 +2565,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:98e2676d01470992d7b4ca9c2a1e12b0e6c816c0586a8e8e1736f4b58a1360a9",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "digest": "sha256:0fcfcb36cad335e6ffe50b087d17f8bce9d6bd711e285740b28ce05bf9be7c6e",
+        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -2831,6 +2832,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "publish-transaction-override": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "release-candidate-workflow-file": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2928,7 +2933,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:ba3117f22b343d5f18cd48d327bffaa8ed442cb6150b6c2f95d091808cd009a7"
+      "auditDigest": "sha256:821aa9a8b69fc2fb0fdea3fe569133b9f084be6bb0e4543e1583372c10d2316f"
     },
     {
       "contractVersion": 1,
@@ -2989,7 +2994,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -3112,7 +3117,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
+        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3125,6 +3130,6 @@
       "auditDigest": "sha256:e07a5db56a71bd0ac79c81f12619938055361bf0a0ed8e5891f88ca1c51f1c93"
     }
   ],
-  "compatibilityDigest": "sha256:df13c3b8066068925ce847b31002201d533034d10d342542422db3a665c10475",
-  "contractDigest": "sha256:9a73a8824bfbdb1bdbeb8acd5b6366eb980f3e505c7a5dd1bc439d1d803469a9"
+  "compatibilityDigest": "sha256:199fd83a7da33b0f654692ca973b33155e376ed50f0ce1f5864e1b6b18e0500a",
+  "contractDigest": "sha256:914720131f07664cd187a1033f357c4952ef1008f5553cb6b285a75f786a7fbc"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-24T16:50:01.298Z",
-  "publishedAt": "2026-07-24T16:50:01.298Z",
+  "generatedAt": "2026-07-25T02:29:54.202Z",
+  "publishedAt": "2026-07-25T02:29:54.202Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "aa1bea6f12a7a815793fb223cfaea9db691c1908",
+  "sourceRevision": "173df79be292987e76383a1955c8a9d31b0cb499",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18",
+    "version": "3.0.0",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/controller-registry.json

@@ -1718,6 +1718,10 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "publish-transaction-override": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "release-candidate-workflow-file": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1848,7 +1852,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:98e2676d01470992d7b4ca9c2a1e12b0e6c816c0586a8e8e1736f4b58a1360a9"
+      "digest": "sha256:0fcfcb36cad335e6ffe50b087d17f8bce9d6bd711e285740b28ce05bf9be7c6e"
     },
     {
       "schemaVersion": 1,
@@ -2024,5 +2028,5 @@
       "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555"
     }
   ],
-  "digest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b"
+  "digest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144"
 }

package/dist/site/kfd-claims.json

@@ -14,14 +14,14 @@
   },
   "runtimeContract": {
     "contract": "kungfu-buildchain-runtime-contract-world",
-    "compatibilityDigest": "sha256:df13c3b8066068925ce847b31002201d533034d10d342542422db3a665c10475",
-    "majorLine": "v2"
+    "compatibilityDigest": "sha256:199fd83a7da33b0f654692ca973b33155e376ed50f0ce1f5864e1b6b18e0500a",
+    "majorLine": "v3"
   },
   "publicSurfaceReverseAudit": {
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "e2ed3df53a48587531486466e02c82f044920fb629a77b0880e9b9aaa762adac",
+    "sha256": "e04e65883d48ed353c4a07f340b827444122ec28815d9b0d876b6fe45833e3bf",
     "summary": {
       "cliCommandCount": 87,
       "workflowCount": 52,
@@ -228,7 +228,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "e2ed3df53a48587531486466e02c82f044920fb629a77b0880e9b9aaa762adac",
+      "sha256": "e04e65883d48ed353c4a07f340b827444122ec28815d9b0d876b6fe45833e3bf",
       "summary": {
         "cliCommandCount": 87,
         "workflowCount": 52,
@@ -2933,7 +2933,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 78,
+          "inputCount": 79,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -2991,6 +2991,7 @@
             "publish-rematerialize-on-resume",
             "publish-required-artifacts-json",
             "publish-target",
+            "publish-transaction-override",
             "release-candidate-workflow-file",
             "release-candidate-workflow-name",
             "release-passport",
@@ -3919,7 +3920,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 70,
+          "inputCount": 71,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -3969,6 +3970,7 @@
             "publish-rematerialize-on-resume",
             "publish-required-artifacts-json",
             "publish-target",
+            "publish-transaction-override",
             "release-candidate-workflow-file",
             "release-candidate-workflow-name",
             "release-passport",

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18",
+    "version": "3.0.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -307,7 +307,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-authority",
       "export": "./publication-authority",
       "target": "./packages/core/publication-authority.js",
-      "digest": "sha256:90bbbe0105f4c4458fdaa8eb37bf2595a00627724d6d3ac54b9e6634ee749fc4",
+      "digest": "sha256:10a33dae7768c9fced757c7d75c673adbd016b149064dce39d9f42df5c84073e",
       "summary": "Sealed publication authority registry, runner provenance, control-plane audit, admission, and independent verification APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/public-surface-audit.json

@@ -777,6 +777,7 @@
           "publish-rematerialize-on-resume",
           "publish-required-artifacts-json",
           "publish-target",
+          "publish-transaction-override",
           "release-candidate-workflow-file",
           "release-candidate-workflow-name",
           "release-passport",
@@ -800,7 +801,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 78,
+        "inputCount": 79,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1887,6 +1888,7 @@
           "publish-rematerialize-on-resume",
           "publish-required-artifacts-json",
           "publish-target",
+          "publish-transaction-override",
           "release-candidate-workflow-file",
           "release-candidate-workflow-name",
           "release-passport",
@@ -1910,7 +1912,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 70,
+        "inputCount": 71,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -3910,7 +3912,7 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "5ba7fd93a13993b05767b6f02d0626a7347f25c3d7cd4589ed4f70028c1f1bd1",
-    "workflowRegistryDigest": "c2abf629b205a96f536e8758c3d9cdb3eade6945294fe278774877ef41d90b60",
+    "workflowRegistryDigest": "aab70864785c4b8f2089dd833732dbbb26b1b29cf20063a2fcdeeee3f36d2780",
     "pageRegistryDigest": "16a40ed6f3848fcb6a743f9d0369b04e956dfb7b8548b1a7a79266f76b928c80"
   },
   "comparison": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-24T16:50:01.298Z",
-  "publishedAt": "2026-07-24T16:50:01.298Z",
+  "generatedAt": "2026-07-25T02:29:54.202Z",
+  "publishedAt": "2026-07-25T02:29:54.202Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "aa1bea6f12a7a815793fb223cfaea9db691c1908",
+  "sourceRevision": "173df79be292987e76383a1955c8a9d31b0cb499",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18",
+    "version": "3.0.0",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-24T16:50:01.298Z",
-  "publishedAt": "2026-07-24T16:50:01.298Z",
+  "generatedAt": "2026-07-25T02:29:54.202Z",
+  "publishedAt": "2026-07-25T02:29:54.202Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "aa1bea6f12a7a815793fb223cfaea9db691c1908",
+  "sourceRevision": "173df79be292987e76383a1955c8a9d31b0cb499",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18",
+    "version": "3.0.0",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -346,6 +346,7 @@
         "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
         "publish-target",
+        "publish-transaction-override",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
@@ -369,7 +370,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 78,
+      "inputCount": 79,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1567,6 +1568,7 @@
         "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
         "publish-target",
+        "publish-transaction-override",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
@@ -1590,7 +1592,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 70,
+      "inputCount": 71,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.18",
+  "version": "3.0.0",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/publication-authority.js

@@ -54,6 +54,10 @@ const REQUIRED_CONTROL_PLANE_FACTS = Object.freeze([
   "runner-policy",
 ]);
 
+function releaseCandidateEvidenceChannel(publicationChannel) {
+  return publicationChannel === "major" ? "release" : publicationChannel;
+}
+
 function stableJson(value) {
   if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
   if (value && typeof value === "object") {
@@ -633,7 +637,7 @@ function validatePublicationEvidence(publicationEvidence, admission) {
     passport,
     buildSummary,
     repository: admission.repository,
-    targetChannel: admission.channel,
+    targetChannel: releaseCandidateEvidenceChannel(admission.channel),
   });
   if (!passportValidation.ok) {
     throw new Error(`release-candidate passport did not qualify: ${passportValidation.errors.join("; ")}`);

package/packages/core/self-dogfood-version.js

@@ -0,0 +1,85 @@
+function parsePackageVersion(version) {
+  const match = String(version || "").match(
+    /^(\d+)\.(\d+)\.(\d+)(?:-alpha\.(\d+))?$/,
+  );
+  if (!match) {
+    throw new Error(
+      "root package version must expose a numeric semver version for self-dogfood",
+    );
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    alpha: match[4] === undefined ? undefined : Number(match[4]),
+  };
+}
+
+function parseAlphaRef(ref) {
+  const match = String(ref || "").match(/^v(\d+)-alpha$/);
+  if (!match) {
+    throw new Error(
+      "Buildchain self-dogfood alpha lock must target a major alpha ref",
+    );
+  }
+  return Number(match[1]);
+}
+
+export function resolveSelfDogfoodMajor({
+  packageVersion,
+  alphaRef,
+  majorBootstrap = false,
+} = {}) {
+  const version = parsePackageVersion(packageVersion);
+  const acceptedMajor = parseAlphaRef(alphaRef);
+  if (acceptedMajor === version.major) {
+    return {
+      packageMajor: version.major,
+      workflowMajor: acceptedMajor,
+      bootstrap: false,
+    };
+  }
+
+  const stableBootstrap =
+    version.minor === 0 && version.patch === 0 && version.alpha === undefined;
+  const nextAlphaBootstrap =
+    version.minor === 0 && version.patch === 1 && version.alpha !== undefined;
+  if (
+    majorBootstrap === true &&
+    acceptedMajor + 1 === version.major &&
+    (stableBootstrap || nextAlphaBootstrap)
+  ) {
+    return {
+      packageMajor: version.major,
+      workflowMajor: acceptedMajor,
+      bootstrap: true,
+    };
+  }
+
+  throw new Error(
+    "Buildchain self-dogfood alpha lock must target the current major alpha ref",
+  );
+}
+
+export function contractForSelfDogfoodEvaluation({
+  currentContract,
+  majorResolution,
+} = {}) {
+  if (!currentContract || typeof currentContract !== "object") {
+    throw new Error("Buildchain self-dogfood requires a current contract");
+  }
+  if (!majorResolution?.bootstrap) {
+    return currentContract;
+  }
+  return {
+    ...currentContract,
+    majorLine: `v${majorResolution.workflowMajor}`,
+  };
+}
+
+export function canAdmitSelfDogfoodLockEvaluation({
+  evaluation,
+  majorResolution,
+} = {}) {
+  return evaluation?.compatible === true || majorResolution?.bootstrap === true;
+}

package/scripts/check-inventory.mjs

@@ -5,6 +5,11 @@ import {
   collectPublicSurfaceReverseAudit,
 } from "../packages/core/public-surface-audit.js";
 import { evaluateBuildchainContractLock } from "../packages/core/buildchain-contract.js";
+import {
+  canAdmitSelfDogfoodLockEvaluation,
+  contractForSelfDogfoodEvaluation,
+  resolveSelfDogfoodMajor,
+} from "../packages/core/self-dogfood-version.js";
 import { generateChannelBuildWorkflow } from "./generate-channel-build-workflow.mjs";
 import {
   generateChannelPromotionWorkflow,
@@ -138,13 +143,12 @@ const selfDogfoodAlphaLock = JSON.parse(
 const currentBuildchainContract = JSON.parse(
   fs.readFileSync(path.join(root, "dist/site/buildchain-contract.json"), "utf8"),
 );
-const selfDogfoodMajor = String(rootPackage.version || "").match(/^(\d+)\./)?.[1];
-if (!selfDogfoodMajor) {
-  throw new Error("root package version must expose a numeric major for self-dogfood");
-}
-if (selfDogfoodAlphaLock.buildchain?.ref !== `v${selfDogfoodMajor}-alpha`) {
-  throw new Error("Buildchain self-dogfood alpha lock must target the current major alpha ref");
-}
+const selfDogfoodMajorResolution = resolveSelfDogfoodMajor({
+  packageVersion: rootPackage.version,
+  alphaRef: selfDogfoodAlphaLock.buildchain?.ref,
+  majorBootstrap: process.env.BUILDCHAIN_MAJOR_VERSION_BOOTSTRAP === "true",
+});
+const selfDogfoodMajor = String(selfDogfoodMajorResolution.workflowMajor);
 if (!/^[0-9a-f]{40}$/.test(selfDogfoodAlphaLock.buildchain?.resolvedSha || "")) {
   throw new Error("Buildchain self-dogfood alpha lock must record an exact accepted SHA");
 }
@@ -153,12 +157,20 @@ if (selfDogfoodAlphaLock.buildchain?.compatibilityPolicy !== "major-compatible")
 }
 const selfDogfoodAlphaEvaluation = evaluateBuildchainContractLock({
   lock: selfDogfoodAlphaLock,
-  current: currentBuildchainContract,
+  current: contractForSelfDogfoodEvaluation({
+    currentContract: currentBuildchainContract,
+    majorResolution: selfDogfoodMajorResolution,
+  }),
   runtimeRef: `v${selfDogfoodMajor}-alpha`,
   runtimeSha: "current-development-contract",
   runtimeClass: "alpha",
 });
-if (!selfDogfoodAlphaEvaluation.compatible) {
+if (
+  !canAdmitSelfDogfoodLockEvaluation({
+    evaluation: selfDogfoodAlphaEvaluation,
+    majorResolution: selfDogfoodMajorResolution,
+  })
+) {
   throw new Error("Buildchain self-dogfood alpha lock requires review after a breaking contract change");
 }
 for (const requiredSnippet of [

package/scripts/release-candidate-resolver.mjs

@@ -402,7 +402,9 @@ export async function resolveReleaseCandidateArtifacts({
   const repoInfo = splitRepository(repository);
   const sha = assertSha(targetSha, "targetSha");
   const normalizedTarget = normalizeBranch(targetRef);
-  if (!/^(alpha|release)\/v\d+\/v\d+\.\d+$/.test(normalizedTarget)) {
+  const releaseCandidateTarget = /^(alpha|release)\/v\d+\/v\d+\.\d+$/.test(normalizedTarget);
+  const majorGateTarget = normalizedTarget === "publish-gate/major" || normalizedTarget === "major-gate";
+  if (!releaseCandidateTarget && !majorGateTarget) {
     return {
       enabled: false,
       reason: `target ref ${normalizedTarget || "(empty)"} does not require release-candidate promotion`,
@@ -414,14 +416,49 @@ export async function resolveReleaseCandidateArtifacts({
     fetchImpl,
     path: `/repos/${repoInfo.owner}/${repoInfo.repo}/commits/${sha}/pulls`,
   });
-  const pullRequest = selectMergedChannelPullRequest({
+  const channelPullRequest = selectMergedChannelPullRequest({
     pullRequests: Array.isArray(pulls) ? pulls : [],
     targetRef: normalizedTarget,
     repository: repoInfo.fullName,
   });
-  if (!pullRequest) {
+  if (!channelPullRequest) {
     throw new Error(`no same-repository merged channel PR found for ${sha} into ${normalizedTarget}`);
   }
+  let pullRequest = channelPullRequest;
+  if (majorGateTarget) {
+    const releaseRef = normalizeBranch(channelPullRequest.head?.ref || "");
+    if (!/^release\/v\d+\/v\d+\.\d+$/.test(releaseRef)) {
+      throw new Error(
+        `major gate ${normalizedTarget} must be merged from a release/vN/vN.M head, got ${releaseRef || "<empty>"}`,
+      );
+    }
+    const releaseSha = assertSha(channelPullRequest.head?.sha, "major gate release head SHA");
+    const releasePulls = await githubJson({
+      apiUrl,
+      token,
+      fetchImpl,
+      path: `/repos/${repoInfo.owner}/${repoInfo.repo}/commits/${releaseSha}/pulls`,
+    });
+    pullRequest = selectMergedChannelPullRequest({
+      pullRequests: Array.isArray(releasePulls) ? releasePulls : [],
+      targetRef: releaseRef,
+      repository: repoInfo.fullName,
+    });
+    if (!pullRequest) {
+      throw new Error(
+        `no same-repository merged release-candidate PR found for major gate release head ${releaseSha} into ${releaseRef}`,
+      );
+    }
+    const releaseMergeSha = assertSha(
+      pullRequest.merge_commit_sha || pullRequest.mergeCommit?.oid,
+      "release-candidate PR merge SHA",
+    );
+    if (releaseMergeSha !== releaseSha) {
+      throw new Error(
+        `major gate release head ${releaseSha} does not equal release-candidate PR #${pullRequest.number} merge ${releaseMergeSha}`,
+      );
+    }
+  }
   const timeoutMs = Number(waitSeconds) * 1000;
   const intervalMs = Number(pollIntervalMs);
   if (!Number.isFinite(timeoutMs) || timeoutMs < 0) {
@@ -501,6 +538,16 @@ export async function resolveReleaseCandidateArtifacts({
       headRef: pullRequest.head?.ref || "",
       baseRef: pullRequest.base?.ref || "",
     },
+    ...(majorGateTarget
+      ? {
+          promotionPullRequest: {
+            number: channelPullRequest.number,
+            url: channelPullRequest.html_url || channelPullRequest.url || "",
+            headRef: channelPullRequest.head?.ref || "",
+            baseRef: channelPullRequest.base?.ref || "",
+          },
+        }
+      : {}),
     run: {
       id: String(run.id || ""),
       url: run.html_url || run.url || "",