@kungfu-tech/buildchain 2.14.3-alpha.11 → 2.14.3-alpha.3

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.11",
+    "version": "2.14.3-alpha.3",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -50,7 +50,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:18d0ab6f916258871d45e92fa28597f590efbac0a0610f9bf7585472a5126307"
+      "auditDigest": "sha256:46fa80913e6174f34b96c323ed913410b9fea0f3632a0ce9c7d4f3e0b23b7072"
     },
     {
       "contractVersion": 1,
@@ -168,7 +168,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:1f476fb9a4854b362c4b24cef89a3c7675d7d63baf3bc828d7b8ae7d2787cead",
-      "auditDigest": "sha256:4a0f29c9c33ef97609ca0e2244f79a36307de2c3bbb42f1515b358d2f4a2caa2"
+      "auditDigest": "sha256:1cdf90721ff2432378b5628347627824affb25fed3372573969cd16603858864"
     },
     {
       "contractVersion": 1,
@@ -320,7 +320,7 @@
         "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the public release tag"
       ],
       "breakingDigest": "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874",
-      "auditDigest": "sha256:5b365ef8afa4c5d88e73d22415929f4123da0ea3b33374f465a1c8f22aaf2785"
+      "auditDigest": "sha256:df58156fe2ae06cc080c2e1a7e70458ab9177365ac7da1a66abe026386ddd548"
     },
     {
       "contractVersion": 1,
@@ -600,7 +600,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:7d74190fd37b62acc862e5a50fa01f2888605b60404f600548a3bb32c0d8b93f"
+      "auditDigest": "sha256:21b2e8fa81fbeab636fbd6e65ee3f39c05ab5a521b5dc24b95ccbfd06c334cb8"
     },
     {
       "contractVersion": 1,
@@ -1057,7 +1057,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
-      "auditDigest": "sha256:18d0ab6f916258871d45e92fa28597f590efbac0a0610f9bf7585472a5126307"
+      "auditDigest": "sha256:46fa80913e6174f34b96c323ed913410b9fea0f3632a0ce9c7d4f3e0b23b7072"
     },
     {
       "contractVersion": 1,
@@ -2830,5 +2830,5 @@
     }
   ],
   "compatibilityDigest": "sha256:edc3653e5cb34efd97065a6941db16140bbf375a565bbcf329d9d795bb07676f",
-  "contractDigest": "sha256:91993e549e3d101d3b4672cfe1b5a02cd48decab58b0509408a0f447a21b3791"
+  "contractDigest": "sha256:abebb2fdfa6e3fe924f4fbf09992ce30005fd5fc6430e84d9d0eb553b809564c"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-19T15:41:56.133Z",
-  "publishedAt": "2026-07-19T15:41:56.133Z",
+  "generatedAt": "2026-07-19T02:01:22.383Z",
+  "publishedAt": "2026-07-19T02:01:22.383Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "3fb562cafd78f2d52c9cf3e252da5c3f46f9cfde",
+  "sourceRevision": "5903af839d5a3de2bce5c6231d6180181540f3d8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.11",
+    "version": "2.14.3-alpha.3",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.11",
+    "version": "2.14.3-alpha.3",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -281,7 +281,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-control-plane-audit",
       "export": "./publication-control-plane-audit",
       "target": "./packages/core/publication-control-plane-audit.js",
-      "digest": "sha256:3c082cdfea7bda55bd6d389dce140f1f359917c68ecf4e64eb6f2defa77cc03c",
+      "digest": "sha256:58baa05440b86259812f370aa9645ba26a4df8e986dd57598412b479589286dc",
       "summary": "Read-only publication control-plane snapshot evaluation APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-19T15:41:56.133Z",
-  "publishedAt": "2026-07-19T15:41:56.133Z",
+  "generatedAt": "2026-07-19T02:01:22.383Z",
+  "publishedAt": "2026-07-19T02:01:22.383Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "3fb562cafd78f2d52c9cf3e252da5c3f46f9cfde",
+  "sourceRevision": "5903af839d5a3de2bce5c6231d6180181540f3d8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.11",
+    "version": "2.14.3-alpha.3",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-19T15:41:56.133Z",
-  "publishedAt": "2026-07-19T15:41:56.133Z",
+  "generatedAt": "2026-07-19T02:01:22.383Z",
+  "publishedAt": "2026-07-19T02:01:22.383Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "3fb562cafd78f2d52c9cf3e252da5c3f46f9cfde",
+  "sourceRevision": "5903af839d5a3de2bce5c6231d6180181540f3d8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.11",
+    "version": "2.14.3-alpha.3",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.3-alpha.11",
+  "version": "2.14.3-alpha.3",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/publication-control-plane-audit.js

@@ -76,8 +76,6 @@ export function evaluatePublicationControlPlaneSnapshot({
     branchPolicy.requiredStatusCheck === requiredStatusCheck &&
     branchPolicy.requiredStatusChecks.includes(requiredStatusCheck) &&
     branchPolicy.requiredCheckPassed === true &&
-    /^[0-9a-f]{40}$/i.test(String(branchPolicy.requiredCheckSha || "")) &&
-    branchPolicy.requiredCheckSha === branchPolicy.pullRequestHeadSha &&
     branchPolicy.sourceSha === branchPolicy.headSha &&
     branchPolicy.mergedPullRequest === true &&
     branchPolicy.baseRef === branch &&

package/scripts/audit-publication-control-plane.mjs

@@ -278,10 +278,7 @@ function main() {
     const independentApprovals = [...latestReviews.values()].filter((review) =>
       review.state === "APPROVED" && review.user?.login !== mergedPullRequest?.user?.login
     );
-    const pullRequestHeadSha = String(mergedPullRequest?.head?.sha || "").toLowerCase();
-    const checkRuns = /^[0-9a-f]{40}$/.test(pullRequestHeadSha)
-      ? githubJson(`repos/${repository}/commits/${pullRequestHeadSha}/check-runs?per_page=100`, "merged pull-request head check runs")
-      : { check_runs: [] };
+    const checkRuns = githubJson(`repos/${repository}/commits/${sourceSha}/check-runs?per_page=100`, "source check runs");
     const requiredStatusCheckPolicy = branchState.protection?.required_status_checks || {};
     const requiredStatusChecks = requiredStatusCheckPolicy.contexts || [];
     const requiredCheckSource = (requiredStatusCheckPolicy.checks || []).find((entry) => entry.context === requiredStatusCheck);
@@ -298,12 +295,10 @@ function main() {
         (!requiredCheckSource?.app_id || entry.app?.id === requiredCheckSource.app_id)
       ),
       requiredCheckAppId: requiredCheckSource?.app_id || 0,
-      requiredCheckSha: pullRequestHeadSha,
       sourceSha,
       headSha: String(branchState.commit?.sha || "").toLowerCase(),
       mergedPullRequest: Boolean(mergedPullRequest),
       pullRequestNumber: mergedPullRequest?.number || 0,
-      pullRequestHeadSha,
       baseRef: mergedPullRequest?.base?.ref || "",
       headRepository: mergedPullRequest?.head?.repo?.full_name || "",
       approvalCount: independentApprovals.length,

package/scripts/generate-channel-promotion-workflow.mjs

@@ -111,9 +111,6 @@ function forwardedInputs(inputNames, { includeInternal = true } = {}) {
         "promotion-target-ref": "target-ref",
         "promotion-override-used": "override-used",
       }[name];
-      if (name === "promotion-override-used") {
-        return `      ${name}: \${{ needs.resolve-promotion.outputs.override-used == 'true' }}`;
-      }
       return routed
         ? `      ${name}: \${{ needs.resolve-promotion.outputs.${routed} }}`
         : `      ${name}: \${{ inputs.${name} }}`;

package/scripts/promotion-channel-router.mjs

@@ -23,10 +23,12 @@ function targetIntent(targetRef, requestedPublicationChannel = "") {
   if (requested && requested !== target.publicationChannel) {
     throw new Error(`promotion channel ${requested} does not match target ref ${ref} (${target.publicationChannel})`);
   }
+  const match = ref.match(target.pattern);
   return {
     targetRef: ref,
     publicationChannel: target.publicationChannel,
     shellChannel: target.shellChannel,
+    targetMajor: match?.[1] ? Number(match[1]) : undefined,
   };
 }
 
@@ -53,6 +55,11 @@ export function resolvePromotionChannel({
       `promotion target ${intent.targetRef} requires ${intent.shellChannel} shell/runtime, got ${selected.channel}`,
     );
   }
+  if (Number.isInteger(intent.targetMajor) && selected.major !== intent.targetMajor) {
+    throw new Error(
+      `promotion target ${intent.targetRef} requires Buildchain v${intent.targetMajor}, got v${selected.major}`,
+    );
+  }
   const shellRef = intent.shellChannel === "alpha" ? `v${selected.major}-alpha` : `v${selected.major}`;
   return {
     targetRef: intent.targetRef,

package/scripts/stable-candidate-patrol.mjs

@@ -223,7 +223,7 @@ export async function runStableCandidatePatrol(optionsInput = {}, clientInput) {
           `Buildchain Stable Candidate Patrol human release-now for ${selection.candidate.version}`,
         );
       }
-      await client.ensureBranch(refs.sourceRef, selection.candidate.sha, refs.targetRef);
+      await client.ensureBranch(refs.sourceRef, selection.candidate.sha);
       const pullRequest = await client.ensurePromotionPullRequest({
         head: refs.sourceRef,
         base: refs.targetRef,
@@ -371,64 +371,15 @@ export function createGitHubStableCandidateClient({ repository: repositoryInput,
         },
       });
     },
-    async ensureBranch(ref, candidateSha, targetRef) {
+    async ensureBranch(ref, candidateSha) {
       const current = await api(`/repos/${owner}/${repo}/git/ref/heads/${encodeRef(ref)}`, { allow404: true });
-      if (!targetRef) {
-        if (!current) {
-          return api(`/repos/${owner}/${repo}/git/refs`, { method: "POST", body: { ref: `refs/heads/${ref}`, sha: candidateSha } });
-        }
-        if (current.object.sha !== candidateSha) {
-          throw new Error(`source-lock branch ${ref} already points to ${current.object.sha}, not ${candidateSha}`);
-        }
-        return current;
-      }
-
-      const candidateCommit = await api(`/repos/${owner}/${repo}/git/commits/${candidateSha}`);
-      let sourceSha = current?.object?.sha || candidateSha;
-      if (sourceSha !== candidateSha) {
-        const sourceCommit = await api(`/repos/${owner}/${repo}/git/commits/${sourceSha}`);
-        if (sourceCommit.tree?.sha !== candidateCommit.tree?.sha) {
-          throw new Error(`source-lock branch ${ref} no longer preserves candidate ${candidateSha} tree`);
-        }
-        const candidateLineage = await api(`/repos/${owner}/${repo}/compare/${candidateSha}...${sourceSha}`);
-        if (!["ahead", "identical"].includes(candidateLineage.status)) {
-          throw new Error(`source-lock branch ${ref} no longer descends from candidate ${candidateSha}`);
-        }
-      }
-
-      const target = await api(`/repos/${owner}/${repo}/git/ref/heads/${encodeRef(targetRef)}`);
-      const targetSha = target.object?.sha || "";
-      const targetLineage = await api(`/repos/${owner}/${repo}/compare/${targetSha}...${sourceSha}`);
-      if (["ahead", "identical"].includes(targetLineage.status)) {
-        if (current) return current;
+      if (!current) {
         return api(`/repos/${owner}/${repo}/git/refs`, { method: "POST", body: { ref: `refs/heads/${ref}`, sha: candidateSha } });
       }
-
-      const identity = { name: "Buildchain Patrol", email: "buildchain-patrol@kungfu.link" };
-      const reconciliation = await api(`/repos/${owner}/${repo}/git/commits`, {
-        method: "POST",
-        body: {
-          message: [
-            "chore(buildchain): reconcile stable source-lock ancestry",
-            "",
-            `Preserve the exact candidate tree from ${candidateSha} while admitting ${targetRef} at ${targetSha}.`,
-            "",
-            "Signed-off-by: Buildchain Patrol <buildchain-patrol@kungfu.link>",
-          ].join("\n"),
-          tree: candidateCommit.tree.sha,
-          parents: [sourceSha, targetSha],
-          author: identity,
-          committer: identity,
-        },
-      });
-      sourceSha = reconciliation.sha;
-      if (!current) {
-        return api(`/repos/${owner}/${repo}/git/refs`, { method: "POST", body: { ref: `refs/heads/${ref}`, sha: sourceSha } });
+      if (current.object.sha !== candidateSha) {
+        throw new Error(`source-lock branch ${ref} already points to ${current.object.sha}, not ${candidateSha}`);
       }
-      return api(`/repos/${owner}/${repo}/git/refs/heads/${encodeRef(ref)}`, {
-        method: "PATCH",
-        body: { sha: sourceSha, force: false },
-      });
+      return current;
     },
     async ensurePromotionPullRequest({ head, base, title, body }) {
       const open = await api(`/repos/${owner}/${repo}/pulls?state=open&head=${encodeURIComponent(`${owner}:${head}`)}&base=${encodeURIComponent(base)}&per_page=20`);