@kungfu-tech/buildchain 2.8.9 → 2.8.10-alpha.0

package/README.md

@@ -1,5 +1,17 @@
 # Buildchain
 
+[![Verify](https://github.com/kungfu-systems/buildchain/actions/workflows/verify.yml/badge.svg?branch=dev%2Fv2%2Fv2.8)](https://github.com/kungfu-systems/buildchain/actions/workflows/verify.yml)
+[![Release Gate](https://github.com/kungfu-systems/buildchain/actions/workflows/buildchain-ref-promotion.yml/badge.svg)](https://github.com/kungfu-systems/buildchain/actions/workflows/buildchain-ref-promotion.yml)
+[![npm latest](https://img.shields.io/npm/v/%40kungfu-tech%2Fbuildchain/latest?label=npm%20latest)](https://www.npmjs.com/package/@kungfu-tech/buildchain)
+[![npm alpha](https://img.shields.io/npm/v/%40kungfu-tech%2Fbuildchain/alpha?label=npm%20alpha)](https://www.npmjs.com/package/@kungfu-tech/buildchain?activeTab=versions)
+[![GitHub Release](https://img.shields.io/github/v/release/kungfu-systems/buildchain?label=release)](https://github.com/kungfu-systems/buildchain/releases)
+[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
+[![KFD-1](https://img.shields.io/badge/KFD--1-contract%20world-2ea44f.svg)](docs/release-passport.md#kfd-1-contract-world-release-gate)
+[![KFD-2](https://img.shields.io/badge/KFD--2-trust%20passport-0969da.svg)](docs/release-passport.md#kfd-2-release-trust-passport-audit)
+[![KFD-3](https://img.shields.io/badge/KFD--3-collaboration%20interface-8250df.svg)](docs/release-passport.md#kfd-3-collaboration-interface-release-gate)
+![Status: Stable](https://img.shields.io/badge/status-stable-brightgreen.svg)
+![Platforms: macOS | Linux | Windows](https://img.shields.io/badge/platform-macOS%20%7C%20Linux%20%7C%20Windows-lightgrey.svg)
+
 Buildchain Release Passport is a mature product release record for artifacts
 that users or agents depend on.
 

package/actions/promote-buildchain-ref/README.md

@@ -75,15 +75,18 @@ alpha branch or tag. The repository must create the next upstream anchor line
 explicitly, then run the normal channel promotion flow for that line.
 
 When branch protection requires pull requests, generated version-state commits
-must still complete inside the promotion automation. The action updates
+still run through promotion automation first. The action updates
 Buildchain-managed channel protection before generated bookkeeping, adds the
 authenticated promotion token user or app to the bypass allowlist, creates the
 configured required check on the exact generated version-state commit, then
-applies that commit directly. If GitHub still rejects the direct update,
-promotion fails with a configuration diagnostic instead of opening a
-post-publish human PR. Reusable wrapper callers should allow `checks: write` so
-the generated check is owned by GitHub Actions and matches the managed branch
-protection rule.
+tries to apply that commit directly. If GitHub still rejects release
+finalization bookkeeping, Buildchain creates or reuses a same-repository
+`buildchain/version-state/*` PR based on the current target channel head and
+returns `finalization-needed=true`; a later idempotent promotion run can resume
+from the durable transaction state. Strict alpha promotion still fails with a
+configuration diagnostic instead of opening a post-publish human PR. Reusable
+wrapper callers should allow `checks: write` so the generated check is owned by
+GitHub Actions and matches the managed branch protection rule.
 
 For Buildchain-owned automation, callers may pass
 `branch-protection-bypass-apps`, `branch-protection-bypass-users`, or
@@ -220,8 +223,10 @@ The action outputs `transaction-id`, `transaction-state`,
 `release-passport-state-sha` is the durable ref commit after the generated
 `release-passport/*` files have been uploaded into that recovery ref.
 `finalization-needed=true` means publish evidence is valid, but protected branch
-or ref finalization needs a later idempotent promotion run. It must not require
-a human version-state PR.
+or ref finalization needs a later idempotent promotion run. For release
+finalization, Buildchain may create a same-repository generated version-state
+PR when GitHub rejects the direct protected ref update; that PR is Buildchain
+bookkeeping, not a consumer-authored release change.
 Set `github-release: "true"` when the semver promotion should also publish the
 exact-tag GitHub Release. After the release transaction reaches `complete` and
 `finalization-needed` is false, the action creates or updates the GitHub Release

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.8.9",
+    "version": "2.8.10-alpha.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -362,7 +362,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:56f4d576816d32f34844a248c9b5fdcb1adac99ef8588a1d1591577e8939ad78"
+      "auditDigest": "sha256:fd6753b3d3cd7561cd5f137f78fafa70ad7a6cc014b9f5c021c12e835c8a7a60"
     },
     {
       "contractVersion": 1,
@@ -388,5 +388,5 @@
     }
   ],
   "compatibilityDigest": "sha256:85e27de8d34ceac1652d9374697ea5a1a7a08666d2ba7ae377b9afdd14e2ca1f",
-  "contractDigest": "sha256:d2b7e1c620bbd5a93e3dcea93a708ae6302a80626bb5032245d0f9b9b4f15511"
+  "contractDigest": "sha256:26daabc22aefe3dc60ad1045305c59c6a85534b0acb457c1bc10cc74eca38070"
 }