@kungfu-tech/buildchain 2.8.8-alpha.4 → 2.8.8-alpha.6

package/dist/site/site-manifest.json

@@ -127,7 +127,7 @@
       "path": "docs/lifecycle-protocol.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ad88ce9f86ccbb7db0225e1baf902f34c7b734b28361d9e616ec3bafb37d906d"
+      "digest": "sha256:43dcaaa53efa8b7e6cdcdaa92a0d39d3ee263b840ed2bfea0a47fe4af922cd59"
     },
     {
       "id": "reusable-build-surface",
@@ -135,7 +135,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:aae753c7fcf4bcb13c08af7b31cc83d898d36e41248b5f710ecee61035de3e8e"
+      "digest": "sha256:165011e2a932461805925c714c2c1c07f1ee60c4b3a614b6dcdda4b81ec22d68"
     },
     {
       "id": "publish-transaction",
@@ -143,7 +143,7 @@
       "path": "docs/publish-transaction.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:ba45f87893b15c3582a52b3cbecba418f35bf409bc672a0d89842f048788e7f7"
+      "digest": "sha256:94844f7bb38dbd85c02f1bc9d55e34dcebd9fc96585789766e8075ac635bc6c0"
     },
     {
       "id": "release-governance",
@@ -151,7 +151,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:85f25aadbadcd8579b3e29204d5ce70dd8831ac3960dfc3d17a547537eb267bd"
+      "digest": "sha256:7fb654a147104125eccbbbcccdeb28c5cad5a6097731e560e72919b9231f985f"
     },
     {
       "id": "release-flow",

package/docs/lifecycle-protocol.md

@@ -250,10 +250,12 @@ checks, and admin enforcement for human channel changes, but adds the
 authenticated promotion token user or app to the managed bypass allowlist for
 generated release bookkeeping. Buildchain also creates the configured required
 check on the exact generated version-state commit before patching the protected
-ref, so the automated bookkeeping remains compatible with strict required
-checks. If the direct generated update is rejected, promotion fails with a
-token/protection diagnostic instead of asking humans to review a post-publish
-version-state PR.
+ref, then applies the protected ref update with the declared generated ref
+update token. The reusable wrapper uses
+`secrets.BUILDCHAIN_PROMOTION_TOKEN || github.token` for that protected
+bookkeeping update. If the direct generated update is rejected, promotion fails
+with a token/protection diagnostic instead of asking humans to review a
+post-publish version-state PR.
 
 For `version.strategy = "anchored"` with `version.next = "manual"`, release
 promotion does not generate a Buildchain-owned version-state commit. In that

package/docs/publish-transaction.md

@@ -293,7 +293,10 @@ Buildchain-managed promotions must finish generated version-state bookkeeping
 with the promotion token directly; they must not require a post-publish human
 PR. Before patching a protected generated bookkeeping ref, Buildchain emits the
 configured required check on the exact generated version-state commit so strict
-branch protection can validate the automation path without a second build.
+branch protection can validate the automation path without a second build, then
+uses the generated ref update token for the protected ref PATCH. The reusable
+wrapper defaults that token to `secrets.BUILDCHAIN_PROMOTION_TOKEN ||
+github.token`.
 
 If finalization fails after an exact Git tag, a channel branch, or dev/alpha
 sync ref has already moved, the next run reads the durable `finalizing` state

package/docs/release-governance.md

@@ -416,8 +416,11 @@ token's authenticated user or app to the managed bypass allowlist. Before
 patching a protected generated bookkeeping ref, the action creates the
 configured required check on the exact generated version-state commit, so strict
 status checks are satisfied by machine-verifiable Buildchain evidence rather
-than a human PR. If direct generated bookkeeping is still rejected, Buildchain
-fails with a token/protection diagnostic instead of creating a post-publish PR.
+than a human PR. The protected ref PATCH itself uses the generated ref update
+token; the reusable wrapper defaults it to
+`secrets.BUILDCHAIN_PROMOTION_TOKEN || github.token`. If direct generated
+bookkeeping is still rejected, Buildchain fails with a token/protection
+diagnostic instead of creating a post-publish PR.
 Buildchain's own promotion workflow reads `BUILDCHAIN_PROMOTION_BYPASS_APPS`,
 `BUILDCHAIN_PROMOTION_BYPASS_USERS`, and
 `BUILDCHAIN_PROMOTION_BYPASS_TEAMS` repository variables so the declared bypass

package/docs/reusable-build-surface.md

@@ -515,9 +515,13 @@ so the workflow automation can apply generated version-state and channel
 bookkeeping on protected `dev`/`alpha`/`release` branches after the reviewed
 channel PR has merged; consumers using a different promotion identity can pass
 `branch-protection-bypass-users`, `branch-protection-bypass-teams`, or a
-different app slug declaratively. It does not call `.build.yml`, does not create
-a matrix, and must fail before publish if the RC evidence, payload set, or
-source-lock ref is missing or ambiguous.
+different app slug declaratively. The wrapper uses
+`secrets.BUILDCHAIN_PROMOTION_TOKEN || github.token` as the generated ref update
+token for protected bookkeeping PATCH calls, so a bypass-capable promotion token
+can sync dev immediately after alpha/release publish without a post-publish PR.
+It does not call `.build.yml`, does not create a matrix, and must fail before
+publish if the RC evidence, payload set, or source-lock ref is missing or
+ambiguous.
 
 ```yaml
 jobs:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.8.8-alpha.4",
+  "version": "2.8.8-alpha.6",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/check-inventory.mjs

@@ -440,6 +440,8 @@ for (const requiredSnippet of [
   "actions: read",
   "uses: ./.github/workflows/release-candidate-promote.yml",
   "github.event.workflow_run.event == 'push'",
+  "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
+  "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
   "target-sha: ${{ github.event.workflow_run.head_sha || inputs.sha || github.sha }}",
   "github-release: true",
   "release-passport-buildchain-self-kfd: true",