@kungfu-tech/buildchain 2.14.2 → 2.14.3-alpha.1

package/dist/site/public-surface-audit.json

@@ -4,10 +4,10 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 83,
-    "workflowCount": 48,
+    "workflowCount": 49,
     "actionCount": 4,
     "sitePageCount": 50,
-    "docCommandRefCount": 257,
+    "docCommandRefCount": 258,
     "failureCount": 0
   },
   "enumerated": {
@@ -674,6 +674,108 @@
         ],
         "outputCount": 5
       },
+      {
+        "id": ".release-candidate-promote",
+        "path": ".github/workflows/.release-candidate-promote.yml",
+        "reusable": true,
+        "inputs": [
+          "allow-repository",
+          "artifact-name",
+          "artifact-patterns",
+          "branch-protection-bypass-apps",
+          "branch-protection-bypass-teams",
+          "branch-protection-bypass-users",
+          "buildchain-contract-compatibility-policy",
+          "buildchain-contract-drift-issue-mode",
+          "buildchain-contract-lock-path",
+          "buildchain-ref",
+          "buildchain-repository",
+          "channel",
+          "dry-run",
+          "github-release",
+          "github-release-notes",
+          "github-release-title",
+          "package-manager",
+          "promotion-contract-lock-digest",
+          "promotion-contract-lock-path",
+          "promotion-override-used",
+          "promotion-publication-channel",
+          "promotion-router-ref",
+          "promotion-router-sha",
+          "promotion-runtime-ref",
+          "promotion-runtime-sha",
+          "promotion-shell-ref",
+          "promotion-shell-sha",
+          "promotion-target-ref",
+          "publication-admission-json",
+          "publication-auto-admission",
+          "publication-auto-no-gate",
+          "publication-consumer-predicate-id",
+          "publication-consumer-qualification-command",
+          "publication-control-plane-audit-json",
+          "publication-expected-json",
+          "publication-gate-aggregate-json",
+          "publication-package-name",
+          "publication-product",
+          "publication-publisher-workflow-path",
+          "publication-runner-provenance-json",
+          "publication-target",
+          "publication-used-nonces-json",
+          "publication-used-qualification-nonces-json",
+          "publish-artifact-kind",
+          "publish-command",
+          "publish-dist-tag",
+          "publish-mode",
+          "publish-package-main",
+          "publish-package-set-order",
+          "publish-required-artifacts-json",
+          "publish-target",
+          "release-candidate-workflow-file",
+          "release-candidate-workflow-name",
+          "release-passport",
+          "release-passport-buildchain-self-kfd",
+          "release-passport-impact-json",
+          "release-passport-kfd-1-witness-jsons",
+          "release-passport-kfd-2-claim-jsons",
+          "release-passport-kfd-3-artifact-verify-command",
+          "release-passport-kfd-3-artifact-witness-jsons",
+          "release-passport-kfd-3-prebuild-witness-jsons",
+          "release-passport-output-dir",
+          "release-passport-platform-manifest-paths",
+          "release-passport-product-name",
+          "required-artifact-count",
+          "required-status-check",
+          "runner-preset",
+          "target-ref",
+          "target-sha",
+          "trusted-publishing"
+        ],
+        "inputCount": 70,
+        "secrets": [
+          "BUILDCHAIN_ISSUE_APP_ID",
+          "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
+          "BUILDCHAIN_ISSUE_TOKEN",
+          "BUILDCHAIN_PROMOTION_TOKEN",
+          "buildchain-issue-app-id",
+          "buildchain-issue-app-private-key",
+          "buildchain-issue-token"
+        ],
+        "secretCount": 7,
+        "outputs": [
+          "built-source-sha",
+          "controller-plan-artifact",
+          "controller-plan-digest",
+          "controller-plan-json",
+          "controller-receipt-artifact",
+          "controller-receipt-digest",
+          "controller-receipt-json",
+          "controller-receipt-status",
+          "promoted-sha",
+          "publication-capability-digest",
+          "release-candidate-artifact"
+        ],
+        "outputCount": 11
+      },
       {
         "id": ".release-docker",
         "path": ".github/workflows/.release-docker.yml",
@@ -1633,11 +1735,14 @@
           "branch-protection-bypass-apps",
           "branch-protection-bypass-teams",
           "branch-protection-bypass-users",
+          "buildchain-alpha-contract-lock-path",
+          "buildchain-channel",
           "buildchain-contract-compatibility-policy",
           "buildchain-contract-drift-issue-mode",
           "buildchain-contract-lock-path",
           "buildchain-ref",
           "buildchain-repository",
+          "buildchain-stable-contract-lock-path",
           "channel",
           "dry-run",
           "github-release",
@@ -1687,7 +1792,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 59,
+        "inputCount": 62,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1699,6 +1804,7 @@
         ],
         "secretCount": 7,
         "outputs": [
+          "buildchain-channel",
           "built-source-sha",
           "controller-plan-artifact",
           "controller-plan-digest",
@@ -1708,10 +1814,21 @@
           "controller-receipt-json",
           "controller-receipt-status",
           "promoted-sha",
+          "promotion-contract-lock-digest",
+          "promotion-contract-lock-path",
+          "promotion-override-used",
+          "promotion-publication-channel",
+          "promotion-router-ref",
+          "promotion-router-sha",
+          "promotion-runtime-ref",
+          "promotion-runtime-sha",
+          "promotion-shell-ref",
+          "promotion-shell-sha",
+          "promotion-target-ref",
           "publication-capability-digest",
           "release-candidate-artifact"
         ],
-        "outputCount": 11
+        "outputCount": 23
       },
       {
         "id": "release-line-bootstrap",
@@ -1744,17 +1861,20 @@
           "buildchain-repository",
           "downstream-base-ref",
           "downstream-branch",
+          "downstream-prepare-command",
           "downstream-repository",
           "downstream-target",
+          "downstream-verify-command",
           "dry-run",
           "graph-json",
           "lock-path",
           "pr-body",
           "pr-title",
+          "refresh-managed-readme-badges",
           "source-node",
           "upstream-release-json"
         ],
-        "inputCount": 13,
+        "inputCount": 16,
         "secrets": [
           "propagation-token"
         ],
@@ -1905,6 +2025,7 @@
           "release-passport-output-dir",
           "release-passport-platform-manifest-paths",
           "release-passport-product-name",
+          "release-passport-promotion-routing-json",
           "require-governance",
           "require-publication-qualification",
           "require-publish-source-lock",
@@ -1917,7 +2038,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 59
+        "inputCount": 60
       },
       {
         "id": "report-buildchain-issue",
@@ -3476,6 +3597,11 @@
         "path": "docs/release-passport.md",
         "command": "buildchain verify release-passport"
       },
+      {
+        "id": "verify-release-passport",
+        "path": "docs/release-passport.md",
+        "command": "buildchain verify release-passport"
+      },
       {
         "id": "verify-release-passport",
         "path": "README.md",
@@ -3503,8 +3629,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "b469949f77ed7777f23fe68c54daf6d2c20d3afc97f3bbd5a178a91202a068d0",
-    "workflowRegistryDigest": "2ad4284a9e275cec6fbc6593a470f9d443e26f7aa880bedf9fa0671448369f2f",
-    "pageRegistryDigest": "53c5c0918268a1ea769a3841ad3b5ad553e81b0fcd602c8289dc049e3559ff89"
+    "workflowRegistryDigest": "4812aea118585c3f527834090569f02cf66c142d2f9a0f8b3d3882e9a614a361",
+    "pageRegistryDigest": "e68b12261716c3ef857d14a327dce77de8ea9f5a7052406c55b86db60e84301c"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -44,6 +44,23 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/.release-candidate-promote.yml",
+      "authorityClass": "product-publication",
+      "publicationCapable": true,
+      "capabilityIds": [
+        "channel-ref",
+        "github-release",
+        "npm-publish"
+      ],
+      "credentialMode": "trusted-publishing",
+      "publisherWorkflowMode": "caller-bound",
+      "publisherWorkflowPath": ".github/workflows/.release-candidate-promote.yml",
+      "environment": "none",
+      "environmentMode": "fixed",
+      "runnerPolicy": "qualified-measured",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/.release-verify.yml",
       "authorityClass": "governance-write",
@@ -507,6 +524,14 @@
       "signals": [],
       "classified": true
     },
+    {
+      "path": ".github/workflows/.release-candidate-promote.yml",
+      "signals": [
+        "write-permission",
+        "oidc"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/.release-docker.yml",
       "signals": [],
@@ -792,5 +817,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "24c7f5210da277b79ce13356c439c14ea49f6c54ba9e083f42ce47fdfdacc55c"
+  "registryDigest": "ac085131119085cfc02e37913ec5eabc9f38b04100c58d797ede3b8e2b7e3046"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-18T01:00:00.995Z",
-  "publishedAt": "2026-07-18T01:00:00.995Z",
+  "generatedAt": "2026-07-19T00:00:09.045Z",
+  "publishedAt": "2026-07-19T00:00:09.045Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ae16e640bf2f21c8f981ffa8b3523c8aae9200b2",
+  "sourceRevision": "cb4ea966786d561d5f6e9c53d55bba5e951bdb24",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.2",
+    "version": "2.14.3-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-model.json

@@ -15,7 +15,9 @@
   "releasePassport": {
     "entrypoint": "buildchain.release.json",
     "bundle": "buildchain-release-bundle.tar.gz",
-    "contract": "kungfu-buildchain-release-passport"
+    "contract": "kungfu-buildchain-release-passport",
+    "schema": "schemas/release-passport-v1.schema.json",
+    "checkManifest": "release-passport-check-manifest.json"
   },
   "releasePropagation": {
     "graphContract": "kungfu-buildchain-release-propagation-graph",

package/dist/site/release-passport-check-manifest.json

@@ -0,0 +1,167 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-release-passport-check-manifest",
+  "passport": {
+    "contract": "kungfu-buildchain-release-passport",
+    "schemaVersion": 1,
+    "schema": {
+      "id": "https://buildchain.libkungfu.dev/schemas/release-passport-v1.schema.json",
+      "path": "schemas/release-passport-v1.schema.json",
+      "npmExport": "@kungfu-tech/buildchain/site/schemas/release-passport-v1.schema.json"
+    },
+    "checker": {
+      "contract": "kungfu-buildchain-release-check-report",
+      "command": "buildchain verify release-passport <buildchain.release.json>",
+      "nodeApi": "@kungfu-tech/buildchain/release-passport#verifyReleasePassport",
+      "result": "check-report.json"
+    }
+  },
+  "ownership": {
+    "envelopeOwner": "Buildchain",
+    "aggregationFields": [
+      "product",
+      "release",
+      "workflow",
+      "runnerPolicy",
+      "versionImpact",
+      "surfaceImpacts",
+      "packageSet",
+      "anchorManifest",
+      "trustedPublishing",
+      "transaction",
+      "surfaceTimestampPolicy",
+      "buildFacts",
+      "buildSummary",
+      "platformArtifactManifests",
+      "distTagPromotion",
+      "controllerReceipts",
+      "artifacts",
+      "evidence",
+      "recovery"
+    ],
+    "kfdSections": [
+      {
+        "section": "kfd-1",
+        "owner": "KFD",
+        "package": "@kungfu-tech/kfd",
+        "metadataSchema": {
+          "id": "https://kfd.libkungfu.dev/schemas/kfd-standards.schema.json",
+          "path": "schemas/kfd-standards.schema.json",
+          "version": "2"
+        },
+        "schemaIds": {
+          "metadata": "https://kfd.libkungfu.dev/schemas/kfd-standards.schema.json",
+          "contractWorld": "https://kfd.libkungfu.dev/schemas/kfd-1/contract-world.schema.json",
+          "witness": "https://kfd.libkungfu.dev/schemas/kfd-1/witness.schema.json",
+          "publicationUrlSemantics": "https://kfd.libkungfu.dev/schemas/kfd-1/publication-url-semantics.schema.json",
+          "candidateRegistry": "https://kfd.libkungfu.dev/schemas/kfd-candidate-registry.schema.json",
+          "verificationBundle": "https://kfd.libkungfu.dev/schemas/kfd-verification-bundle.schema.json",
+          "verificationReport": "https://kfd.libkungfu.dev/schemas/kfd-verification-report.schema.json"
+        },
+        "schemaPaths": {
+          "metadata": "schemas/kfd-standards.schema.json",
+          "contractWorld": "schemas/kfd-1/contract-world.schema.json",
+          "witness": "schemas/kfd-1/witness.schema.json",
+          "publicationUrlSemantics": "schemas/kfd-1/publication-url-semantics.schema.json",
+          "candidateRegistry": "schemas/kfd-candidate-registry.schema.json",
+          "verificationBundle": "schemas/kfd-verification-bundle.schema.json",
+          "verificationReport": "schemas/kfd-verification-report.schema.json"
+        },
+        "compatibility": {
+          "packageLine": "v1.0",
+          "registrySchemaVersion": 1,
+          "metadataSchemaVersion": "2",
+          "rule": "Before the first stable release, fully evidenced Foundation Revision may correct the latest numbered structure while preserving published coordinates and lineage; Foundation Freeze then requires later substantive change to mint a new KFD."
+        },
+        "rule": "Buildchain aggregates and checks kfd-1 evidence but does not redefine its schema semantics."
+      },
+      {
+        "section": "kfd-2",
+        "owner": "KFD",
+        "package": "@kungfu-tech/kfd",
+        "metadataSchema": {
+          "id": "https://kfd.libkungfu.dev/schemas/kfd-standards.schema.json",
+          "path": "schemas/kfd-standards.schema.json",
+          "version": "2"
+        },
+        "schemaIds": {
+          "metadata": "https://kfd.libkungfu.dev/schemas/kfd-standards.schema.json",
+          "trustTaxonomy": "https://kfd.libkungfu.dev/schemas/kfd-2/trust-taxonomy.schema.json",
+          "releaseClaims": "https://kfd.libkungfu.dev/schemas/kfd-2/release-claims.schema.json",
+          "releaseTrustPassport": "https://kfd.libkungfu.dev/schemas/kfd-2/release-trust-passport.schema.json",
+          "trustClaims": "https://kfd.libkungfu.dev/schemas/kfd-2/trust-claims.schema.json",
+          "trustAssessment": "https://kfd.libkungfu.dev/schemas/kfd-2/trust-assessment.schema.json"
+        },
+        "schemaPaths": {
+          "metadata": "schemas/kfd-standards.schema.json",
+          "trustTaxonomy": "schemas/kfd-2/trust-taxonomy.schema.json",
+          "releaseClaims": "schemas/kfd-2/release-claims.schema.json",
+          "releaseTrustPassport": "schemas/kfd-2/release-trust-passport.schema.json",
+          "trustClaims": "schemas/kfd-2/trust-claims.schema.json",
+          "trustAssessment": "schemas/kfd-2/trust-assessment.schema.json"
+        },
+        "compatibility": {
+          "packageLine": "v1.0",
+          "registrySchemaVersion": 1,
+          "metadataSchemaVersion": "2",
+          "rule": "Before the first stable release, maintainer-authorized semantic refinement must declare breaking decision-surface impact; after stable, substantive change mints a new KFD."
+        },
+        "rule": "Buildchain aggregates and checks kfd-2 evidence but does not redefine its schema semantics."
+      },
+      {
+        "section": "kfd-3",
+        "owner": "KFD",
+        "package": "@kungfu-tech/kfd",
+        "metadataSchema": {
+          "id": "https://kfd.libkungfu.dev/schemas/kfd-standards.schema.json",
+          "path": "schemas/kfd-standards.schema.json",
+          "version": "2"
+        },
+        "schemaIds": {
+          "metadata": "https://kfd.libkungfu.dev/schemas/kfd-standards.schema.json",
+          "collaborationInterface": "https://kfd.libkungfu.dev/schemas/kfd-3/collaboration-interface.schema.json",
+          "witness": "https://kfd.libkungfu.dev/schemas/kfd-3/witness.schema.json"
+        },
+        "schemaPaths": {
+          "metadata": "schemas/kfd-standards.schema.json",
+          "collaborationInterface": "schemas/kfd-3/collaboration-interface.schema.json",
+          "witness": "schemas/kfd-3/witness.schema.json"
+        },
+        "compatibility": {
+          "packageLine": "v1.0",
+          "registrySchemaVersion": 1,
+          "metadataSchemaVersion": "2",
+          "rule": "Before the first stable release, maintainer-authorized semantic refinement must declare breaking decision-surface impact; after stable, substantive change mints a new KFD."
+        },
+        "rule": "Buildchain aggregates and checks kfd-3 evidence but does not redefine its schema semantics."
+      }
+    ]
+  },
+  "localClosure": {
+    "entrypoint": "buildchain.release.json",
+    "resolutionBase": "directory containing the passport",
+    "requiredSiblings": [
+      "product.mechanism",
+      "evidence.artifactEvidence",
+      "evidence.impact",
+      "evidence.agentIndex"
+    ],
+    "conditionalSiblings": [
+      {
+        "when": "evidence.publishEvidence is present or packageSet is present",
+        "pointer": "evidence.publishEvidence"
+      },
+      {
+        "when": "evidence.transactionState is present",
+        "pointer": "evidence.transactionState"
+      }
+    ],
+    "rule": "The normative checker resolves every declared sibling relative to the passport and fails closed on missing required evidence, digest drift, or semantic mismatch."
+  },
+  "compatibility": {
+    "envelope": "Compatible optional fields may be added while schemaVersion remains 1; removing or changing required-field semantics requires a new schema id or contract version.",
+    "siblings": "New optional siblings may be added in v1; making a sibling required requires a new schema id or contract version.",
+    "kfdSections": "Each KFD subsection follows the compatibility metadata published by @kungfu-tech/kfd; Buildchain must not silently reinterpret a KFD schema version.",
+    "unknownFields": "Independent readers must preserve or ignore unknown additive fields."
+  }
+}

package/dist/site/release-provenance.json

@@ -35,6 +35,7 @@
       "./release-candidate": "./packages/core/release-candidate.js",
       "./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",
       "./release-passport": "./packages/core/release-passport.js",
+      "./release-passport-contract": "./packages/core/release-passport-contract.js",
       "./release-propagation": "./packages/core/release-propagation.js",
       "./surface-manifest": "./packages/core/surface-manifest.js",
       "./buildchain-kfd-claims": "./packages/core/buildchain-kfd-claims.js",
@@ -54,6 +55,8 @@
       "./site/kfd-upstream-aggregate.json": "./dist/site/kfd-upstream-aggregate.json",
       "./site/release-model.json": "./dist/site/release-model.json",
       "./site/artifact-schemas.json": "./dist/site/artifact-schemas.json",
+      "./site/release-passport-check-manifest.json": "./dist/site/release-passport-check-manifest.json",
+      "./site/schemas/release-passport-v1.schema.json": "./dist/site/schemas/release-passport-v1.schema.json",
       "./site/buildchain-contract.json": "./dist/site/buildchain-contract.json",
       "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
       "./site/release-provenance.json": "./dist/site/release-provenance.json",