@kungfu-tech/buildchain 2.14.3-alpha.10 → 2.14.3-alpha.2

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.10",
+    "version": "2.14.3-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -50,7 +50,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:18d0ab6f916258871d45e92fa28597f590efbac0a0610f9bf7585472a5126307"
+      "auditDigest": "sha256:46fa80913e6174f34b96c323ed913410b9fea0f3632a0ce9c7d4f3e0b23b7072"
     },
     {
       "contractVersion": 1,
@@ -168,7 +168,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:1f476fb9a4854b362c4b24cef89a3c7675d7d63baf3bc828d7b8ae7d2787cead",
-      "auditDigest": "sha256:4a0f29c9c33ef97609ca0e2244f79a36307de2c3bbb42f1515b358d2f4a2caa2"
+      "auditDigest": "sha256:b083a71f80052c013468d48473ec0f8f919161e38a3607feebe99edcd3b32460"
     },
     {
       "contractVersion": 1,
@@ -320,7 +320,7 @@
         "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the public release tag"
       ],
       "breakingDigest": "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874",
-      "auditDigest": "sha256:5b365ef8afa4c5d88e73d22415929f4123da0ea3b33374f465a1c8f22aaf2785"
+      "auditDigest": "sha256:df58156fe2ae06cc080c2e1a7e70458ab9177365ac7da1a66abe026386ddd548"
     },
     {
       "contractVersion": 1,
@@ -600,7 +600,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:7d74190fd37b62acc862e5a50fa01f2888605b60404f600548a3bb32c0d8b93f"
+      "auditDigest": "sha256:21b2e8fa81fbeab636fbd6e65ee3f39c05ab5a521b5dc24b95ccbfd06c334cb8"
     },
     {
       "contractVersion": 1,
@@ -1057,7 +1057,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
-      "auditDigest": "sha256:18d0ab6f916258871d45e92fa28597f590efbac0a0610f9bf7585472a5126307"
+      "auditDigest": "sha256:46fa80913e6174f34b96c323ed913410b9fea0f3632a0ce9c7d4f3e0b23b7072"
     },
     {
       "contractVersion": 1,
@@ -2830,5 +2830,5 @@
     }
   ],
   "compatibilityDigest": "sha256:edc3653e5cb34efd97065a6941db16140bbf375a565bbcf329d9d795bb07676f",
-  "contractDigest": "sha256:311379747d9beb4f3d8a1126b8c34122e92750690694ba5a04677ace3004bd21"
+  "contractDigest": "sha256:5ee3923ae7dc5e6633b0ef0be62a4f28611946f5333bb28c9c8229e88c149599"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-19T15:17:37.795Z",
-  "publishedAt": "2026-07-19T15:17:37.795Z",
+  "generatedAt": "2026-07-19T01:05:14.449Z",
+  "publishedAt": "2026-07-19T01:05:14.449Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "4c58fc3d46b34b6c7399cec95ab4dc4aff11bbe7",
+  "sourceRevision": "2a19346a43d0a6be49ca4d6e76fda6c7d3b63c9d",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.10",
+    "version": "2.14.3-alpha.2",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.10",
+    "version": "2.14.3-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -281,7 +281,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-control-plane-audit",
       "export": "./publication-control-plane-audit",
       "target": "./packages/core/publication-control-plane-audit.js",
-      "digest": "sha256:3c082cdfea7bda55bd6d389dce140f1f359917c68ecf4e64eb6f2defa77cc03c",
+      "digest": "sha256:58baa05440b86259812f370aa9645ba26a4df8e986dd57598412b479589286dc",
       "summary": "Read-only publication control-plane snapshot evaluation APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-19T15:17:37.795Z",
-  "publishedAt": "2026-07-19T15:17:37.795Z",
+  "generatedAt": "2026-07-19T01:05:14.449Z",
+  "publishedAt": "2026-07-19T01:05:14.449Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "4c58fc3d46b34b6c7399cec95ab4dc4aff11bbe7",
+  "sourceRevision": "2a19346a43d0a6be49ca4d6e76fda6c7d3b63c9d",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.10",
+    "version": "2.14.3-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-19T15:17:37.795Z",
-  "publishedAt": "2026-07-19T15:17:37.795Z",
+  "generatedAt": "2026-07-19T01:05:14.449Z",
+  "publishedAt": "2026-07-19T01:05:14.449Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "4c58fc3d46b34b6c7399cec95ab4dc4aff11bbe7",
+  "sourceRevision": "2a19346a43d0a6be49ca4d6e76fda6c7d3b63c9d",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.10",
+    "version": "2.14.3-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.3-alpha.10",
+  "version": "2.14.3-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/publication-control-plane-audit.js

@@ -76,8 +76,6 @@ export function evaluatePublicationControlPlaneSnapshot({
     branchPolicy.requiredStatusCheck === requiredStatusCheck &&
     branchPolicy.requiredStatusChecks.includes(requiredStatusCheck) &&
     branchPolicy.requiredCheckPassed === true &&
-    /^[0-9a-f]{40}$/i.test(String(branchPolicy.requiredCheckSha || "")) &&
-    branchPolicy.requiredCheckSha === branchPolicy.pullRequestHeadSha &&
     branchPolicy.sourceSha === branchPolicy.headSha &&
     branchPolicy.mergedPullRequest === true &&
     branchPolicy.baseRef === branch &&

package/scripts/audit-publication-control-plane.mjs

@@ -278,10 +278,7 @@ function main() {
     const independentApprovals = [...latestReviews.values()].filter((review) =>
       review.state === "APPROVED" && review.user?.login !== mergedPullRequest?.user?.login
     );
-    const pullRequestHeadSha = String(mergedPullRequest?.head?.sha || "").toLowerCase();
-    const checkRuns = /^[0-9a-f]{40}$/.test(pullRequestHeadSha)
-      ? githubJson(`repos/${repository}/commits/${pullRequestHeadSha}/check-runs?per_page=100`, "merged pull-request head check runs")
-      : { check_runs: [] };
+    const checkRuns = githubJson(`repos/${repository}/commits/${sourceSha}/check-runs?per_page=100`, "source check runs");
     const requiredStatusCheckPolicy = branchState.protection?.required_status_checks || {};
     const requiredStatusChecks = requiredStatusCheckPolicy.contexts || [];
     const requiredCheckSource = (requiredStatusCheckPolicy.checks || []).find((entry) => entry.context === requiredStatusCheck);
@@ -298,12 +295,10 @@ function main() {
         (!requiredCheckSource?.app_id || entry.app?.id === requiredCheckSource.app_id)
       ),
       requiredCheckAppId: requiredCheckSource?.app_id || 0,
-      requiredCheckSha: pullRequestHeadSha,
       sourceSha,
       headSha: String(branchState.commit?.sha || "").toLowerCase(),
       mergedPullRequest: Boolean(mergedPullRequest),
       pullRequestNumber: mergedPullRequest?.number || 0,
-      pullRequestHeadSha,
       baseRef: mergedPullRequest?.base?.ref || "",
       headRepository: mergedPullRequest?.head?.repo?.full_name || "",
       approvalCount: independentApprovals.length,

package/scripts/generate-channel-promotion-workflow.mjs

@@ -90,34 +90,29 @@ function publicOutputs(outputBlock) {
   return [...routed, ...forwarded].join("\n");
 }
 
-function forwardedInputs(inputNames, { includeInternal = true } = {}) {
-  return inputNames
-    .filter((name) => includeInternal || !internalInputs.has(name))
-    .map((name) => {
-      const routed = {
-        "buildchain-ref": "runtime-ref",
-        "buildchain-contract-lock-path": "contract-lock-path",
-        channel: "publication-channel",
-        "target-ref": "target-ref",
-        "promotion-router-ref": "router-ref",
-        "promotion-router-sha": "router-sha",
-        "promotion-shell-ref": "shell-ref",
-        "promotion-shell-sha": "shell-sha",
-        "promotion-runtime-ref": "runtime-ref",
-        "promotion-runtime-sha": "runtime-sha",
-        "promotion-contract-lock-path": "contract-lock-path",
-        "promotion-contract-lock-digest": "contract-lock-digest",
-        "promotion-publication-channel": "publication-channel",
-        "promotion-target-ref": "target-ref",
-        "promotion-override-used": "override-used",
-      }[name];
-      if (name === "promotion-override-used") {
-        return `      ${name}: \${{ needs.resolve-promotion.outputs.override-used == 'true' }}`;
-      }
-      return routed
-        ? `      ${name}: \${{ needs.resolve-promotion.outputs.${routed} }}`
-        : `      ${name}: \${{ inputs.${name} }}`;
-    }).join("\n");
+function forwardedInputs(inputNames) {
+  return inputNames.map((name) => {
+    const routed = {
+      "buildchain-ref": "runtime-ref",
+      "buildchain-contract-lock-path": "contract-lock-path",
+      channel: "publication-channel",
+      "target-ref": "target-ref",
+      "promotion-router-ref": "router-ref",
+      "promotion-router-sha": "router-sha",
+      "promotion-shell-ref": "shell-ref",
+      "promotion-shell-sha": "shell-sha",
+      "promotion-runtime-ref": "runtime-ref",
+      "promotion-runtime-sha": "runtime-sha",
+      "promotion-contract-lock-path": "contract-lock-path",
+      "promotion-contract-lock-digest": "contract-lock-digest",
+      "promotion-publication-channel": "publication-channel",
+      "promotion-target-ref": "target-ref",
+      "promotion-override-used": "override-used",
+    }[name];
+    return routed
+      ? `      ${name}: \${{ needs.resolve-promotion.outputs.${routed} }}`
+      : `      ${name}: \${{ inputs.${name} }}`;
+  }).join("\n");
 }
 
 function validateWorkflowRoute(name, route, expectedLogicalRef) {
@@ -131,9 +126,6 @@ function validateWorkflowRoute(name, route, expectedLogicalRef) {
   if (!/^(?:v[0-9]+(?:-alpha)?|[0-9a-f]{40})$/.test(route.callRef || "")) {
     throw new Error(`promotion shell ${name} callRef must be an official channel ref or exact SHA`);
   }
-  if (typeof route.forwardInternalInputs !== "boolean") {
-    throw new Error(`promotion shell ${name} forwardInternalInputs must be boolean`);
-  }
   return { ...route };
 }
 
@@ -153,13 +145,11 @@ export function generateChannelPromotionWorkflow(source, { major = 2, shellRouti
       logicalRef: `v${major}-alpha`,
       callRef: `v${major}-alpha`,
       workflowPath: ".github/workflows/.release-candidate-promote.yml",
-      forwardInternalInputs: true,
     },
     stable: {
       logicalRef: `v${major}`,
       callRef: `v${major}`,
       workflowPath: ".github/workflows/.release-candidate-promote.yml",
-      forwardInternalInputs: true,
     },
   };
   const alphaRoute = validateWorkflowRoute("alpha", routes.alpha, `v${major}-alpha`);
@@ -171,12 +161,7 @@ export function generateChannelPromotionWorkflow(source, { major = 2, shellRouti
   for (const required of ["buildchain-ref", "buildchain-contract-lock-path", "channel", "target-ref", ...internalInputs]) {
     if (!inputNames.includes(required)) throw new Error(`advanced promotion workflow missing input: ${required}`);
   }
-  const alphaForwarded = forwardedInputs(inputNames, {
-    includeInternal: alphaRoute.forwardInternalInputs,
-  });
-  const stableForwarded = forwardedInputs(inputNames, {
-    includeInternal: stableRoute.forwardInternalInputs,
-  });
+  const forwarded = forwardedInputs(inputNames);
   return `# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.
 name: Release Candidate Promote
 
@@ -371,7 +356,7 @@ jobs:
       id-token: write
       issues: write
     with:
-${alphaForwarded}
+${forwarded}
     secrets: inherit
 
   stable:
@@ -386,7 +371,7 @@ ${alphaForwarded}
       id-token: write
       issues: write
     with:
-${stableForwarded}
+${forwarded}
     secrets: inherit
 `;
 }

package/scripts/promotion-channel-router.mjs

@@ -23,10 +23,12 @@ function targetIntent(targetRef, requestedPublicationChannel = "") {
   if (requested && requested !== target.publicationChannel) {
     throw new Error(`promotion channel ${requested} does not match target ref ${ref} (${target.publicationChannel})`);
   }
+  const match = ref.match(target.pattern);
   return {
     targetRef: ref,
     publicationChannel: target.publicationChannel,
     shellChannel: target.shellChannel,
+    targetMajor: match?.[1] ? Number(match[1]) : undefined,
   };
 }
 
@@ -53,6 +55,11 @@ export function resolvePromotionChannel({
       `promotion target ${intent.targetRef} requires ${intent.shellChannel} shell/runtime, got ${selected.channel}`,
     );
   }
+  if (Number.isInteger(intent.targetMajor) && selected.major !== intent.targetMajor) {
+    throw new Error(
+      `promotion target ${intent.targetRef} requires Buildchain v${intent.targetMajor}, got v${selected.major}`,
+    );
+  }
   const shellRef = intent.shellChannel === "alpha" ? `v${selected.major}-alpha` : `v${selected.major}`;
   return {
     targetRef: intent.targetRef,

package/scripts/stable-candidate-patrol.mjs

@@ -223,7 +223,7 @@ export async function runStableCandidatePatrol(optionsInput = {}, clientInput) {
           `Buildchain Stable Candidate Patrol human release-now for ${selection.candidate.version}`,
         );
       }
-      await client.ensureBranch(refs.sourceRef, selection.candidate.sha, refs.targetRef);
+      await client.ensureBranch(refs.sourceRef, selection.candidate.sha);
       const pullRequest = await client.ensurePromotionPullRequest({
         head: refs.sourceRef,
         base: refs.targetRef,
@@ -371,64 +371,15 @@ export function createGitHubStableCandidateClient({ repository: repositoryInput,
         },
       });
     },
-    async ensureBranch(ref, candidateSha, targetRef) {
+    async ensureBranch(ref, candidateSha) {
       const current = await api(`/repos/${owner}/${repo}/git/ref/heads/${encodeRef(ref)}`, { allow404: true });
-      if (!targetRef) {
-        if (!current) {
-          return api(`/repos/${owner}/${repo}/git/refs`, { method: "POST", body: { ref: `refs/heads/${ref}`, sha: candidateSha } });
-        }
-        if (current.object.sha !== candidateSha) {
-          throw new Error(`source-lock branch ${ref} already points to ${current.object.sha}, not ${candidateSha}`);
-        }
-        return current;
-      }
-
-      const candidateCommit = await api(`/repos/${owner}/${repo}/git/commits/${candidateSha}`);
-      let sourceSha = current?.object?.sha || candidateSha;
-      if (sourceSha !== candidateSha) {
-        const sourceCommit = await api(`/repos/${owner}/${repo}/git/commits/${sourceSha}`);
-        if (sourceCommit.tree?.sha !== candidateCommit.tree?.sha) {
-          throw new Error(`source-lock branch ${ref} no longer preserves candidate ${candidateSha} tree`);
-        }
-        const candidateLineage = await api(`/repos/${owner}/${repo}/compare/${candidateSha}...${sourceSha}`);
-        if (!["ahead", "identical"].includes(candidateLineage.status)) {
-          throw new Error(`source-lock branch ${ref} no longer descends from candidate ${candidateSha}`);
-        }
-      }
-
-      const target = await api(`/repos/${owner}/${repo}/git/ref/heads/${encodeRef(targetRef)}`);
-      const targetSha = target.object?.sha || "";
-      const targetLineage = await api(`/repos/${owner}/${repo}/compare/${targetSha}...${sourceSha}`);
-      if (["ahead", "identical"].includes(targetLineage.status)) {
-        if (current) return current;
+      if (!current) {
         return api(`/repos/${owner}/${repo}/git/refs`, { method: "POST", body: { ref: `refs/heads/${ref}`, sha: candidateSha } });
       }
-
-      const identity = { name: "Buildchain Patrol", email: "buildchain-patrol@kungfu.link" };
-      const reconciliation = await api(`/repos/${owner}/${repo}/git/commits`, {
-        method: "POST",
-        body: {
-          message: [
-            "chore(buildchain): reconcile stable source-lock ancestry",
-            "",
-            `Preserve the exact candidate tree from ${candidateSha} while admitting ${targetRef} at ${targetSha}.`,
-            "",
-            "Signed-off-by: Buildchain Patrol <buildchain-patrol@kungfu.link>",
-          ].join("\n"),
-          tree: candidateCommit.tree.sha,
-          parents: [sourceSha, targetSha],
-          author: identity,
-          committer: identity,
-        },
-      });
-      sourceSha = reconciliation.sha;
-      if (!current) {
-        return api(`/repos/${owner}/${repo}/git/refs`, { method: "POST", body: { ref: `refs/heads/${ref}`, sha: sourceSha } });
+      if (current.object.sha !== candidateSha) {
+        throw new Error(`source-lock branch ${ref} already points to ${current.object.sha}, not ${candidateSha}`);
       }
-      return api(`/repos/${owner}/${repo}/git/refs/heads/${encodeRef(ref)}`, {
-        method: "PATCH",
-        body: { sha: sourceSha, force: false },
-      });
+      return current;
     },
     async ensurePromotionPullRequest({ head, base, title, body }) {
       const open = await api(`/repos/${owner}/${repo}/pulls?state=open&head=${encodeURIComponent(`${owner}:${head}`)}&base=${encodeURIComponent(base)}&per_page=20`);