@kungfu-tech/buildchain 3.0.0 → 3.0.1-alpha.1

package/dist/site/public-surface-audit.json

@@ -4,9 +4,9 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 87,
-    "workflowCount": 52,
+    "workflowCount": 53,
     "actionCount": 5,
-    "sitePageCount": 54,
+    "sitePageCount": 56,
     "docCommandRefCount": 276,
     "failureCount": 0
   },
@@ -449,6 +449,39 @@
       }
     ],
     "workflowInputs": [
+      {
+        "id": ".auditable-demo",
+        "path": ".github/workflows/.auditable-demo.yml",
+        "reusable": true,
+        "inputs": [
+          "adapter-path",
+          "artifact-retention-days",
+          "buildchain-repository",
+          "render-media",
+          "renderer-image",
+          "require-trusted-event",
+          "source-artifact-digest",
+          "source-artifact-name",
+          "source-ref"
+        ],
+        "inputCount": 9,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "gate-artifact-digest",
+          "gate-artifact-id",
+          "gate-artifact-name",
+          "gate-artifact-url",
+          "gate-root",
+          "media-artifact-digest",
+          "media-artifact-id",
+          "media-artifact-name",
+          "media-artifact-url",
+          "media-root",
+          "source-sha"
+        ],
+        "outputCount": 11
+      },
       {
         "id": ".binary-release-assets",
         "path": ".github/workflows/.binary-release-assets.yml",
@@ -560,6 +593,7 @@
         ],
         "secretCount": 8,
         "outputs": [
+          "artifact-coordinates-json",
           "build-diagnostics-summary-artifact",
           "build-diagnostics-summary-json",
           "build-summary-artifact",
@@ -602,7 +636,7 @@
           "runner-preset",
           "trusted-event"
         ],
-        "outputCount": 41
+        "outputCount": 42
       },
       {
         "id": ".bump-minor-version",
@@ -778,10 +812,14 @@
           "publish-required-artifacts-json",
           "publish-target",
           "publish-transaction-override",
+          "release-activation-command",
+          "release-activation-receipt-set-path",
           "release-candidate-workflow-file",
           "release-candidate-workflow-name",
           "release-passport",
           "release-passport-buildchain-self-kfd",
+          "release-passport-evidence-command",
+          "release-passport-evidence-path",
           "release-passport-impact-json",
           "release-passport-invariant-passport-command",
           "release-passport-invariant-passport-jsons",
@@ -801,7 +839,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 79,
+        "inputCount": 83,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1100,6 +1138,7 @@
           "production-release-on-main",
           "production-release-pr-mode",
           "production-release-pr-token",
+          "production-source-sha",
           "publication-admission-json",
           "publication-control-plane-audit-json",
           "publication-expected-json",
@@ -1113,7 +1152,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 40,
+        "inputCount": 41,
         "secrets": [
           "production-release-app-private-key"
         ],
@@ -1304,6 +1343,7 @@
         ],
         "secretCount": 8,
         "outputs": [
+          "artifact-coordinates-json",
           "build-diagnostics-summary-artifact",
           "build-diagnostics-summary-json",
           "build-summary-artifact",
@@ -1349,7 +1389,7 @@
           "runner-preset",
           "trusted-event"
         ],
-        "outputCount": 44
+        "outputCount": 45
       },
       {
         "id": "buildchain-alpha-self-dogfood",
@@ -1889,10 +1929,14 @@
           "publish-required-artifacts-json",
           "publish-target",
           "publish-transaction-override",
+          "release-activation-command",
+          "release-activation-receipt-set-path",
           "release-candidate-workflow-file",
           "release-candidate-workflow-name",
           "release-passport",
           "release-passport-buildchain-self-kfd",
+          "release-passport-evidence-command",
+          "release-passport-evidence-path",
           "release-passport-impact-json",
           "release-passport-invariant-passport-command",
           "release-passport-invariant-passport-jsons",
@@ -1912,7 +1956,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 71,
+        "inputCount": 75,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2383,6 +2427,10 @@
         "id": "manual:artifact-verification-envelope",
         "category": "manual"
       },
+      {
+        "id": "manual:auditable-demo",
+        "category": "manual"
+      },
       {
         "id": "manual:binary-distribution",
         "category": "manual"
@@ -2467,6 +2515,10 @@
         "id": "manual:readme-badges",
         "category": "manual"
       },
+      {
+        "id": "manual:release-activation-transaction",
+        "category": "manual"
+      },
       {
         "id": "manual:release-candidate",
         "category": "manual"
@@ -3912,8 +3964,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "5ba7fd93a13993b05767b6f02d0626a7347f25c3d7cd4589ed4f70028c1f1bd1",
-    "workflowRegistryDigest": "aab70864785c4b8f2089dd833732dbbb26b1b29cf20063a2fcdeeee3f36d2780",
-    "pageRegistryDigest": "16a40ed6f3848fcb6a743f9d0369b04e956dfb7b8548b1a7a79266f76b928c80"
+    "workflowRegistryDigest": "4a627dcf07131d07095d5e6bf0a3373e55c62cf325b3f81bb156c43d31367d62",
+    "pageRegistryDigest": "835b03c155e87749a3d43a9e9af284601b863698592e401c6d183625cbf6ef63"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -3,6 +3,19 @@
   "contract": "kungfu-buildchain-publication-authority-registry",
   "defaultDecision": "deny",
   "entries": [
+    {
+      "workflowPath": ".github/workflows/.auditable-demo.yml",
+      "authorityClass": "non-publication-oidc",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/.auditable-demo.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/.binary-release-assets.yml",
       "authorityClass": "product-publication",
@@ -519,6 +532,11 @@
     }
   ],
   "workflowFacts": [
+    {
+      "path": ".github/workflows/.auditable-demo.yml",
+      "signals": [],
+      "classified": true
+    },
     {
       "path": ".github/workflows/.binary-release-assets.yml",
       "signals": [
@@ -870,5 +888,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "5487944a7dcac3931faeec5cde33a00254b9fdd8023ef0d21e1569c43d65e1bf"
+  "registryDigest": "cb18522c1957f0cb2e03c525847602a6163d3b276c106a8bce5b8028d8b9a011"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-25T02:29:54.202Z",
-  "publishedAt": "2026-07-25T02:29:54.202Z",
+  "generatedAt": "2026-07-26T00:14:36.577Z",
+  "publishedAt": "2026-07-26T00:14:36.577Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "173df79be292987e76383a1955c8a9d31b0cb499",
+  "sourceRevision": "a0cda81b67a212b3555e10d041c8d39b4c1b8dce",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.0",
+    "version": "3.0.1-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -41,6 +41,7 @@
       "./release-passport": "./packages/core/release-passport.js",
       "./release-passport-contract": "./packages/core/release-passport-contract.js",
       "./release-propagation": "./packages/core/release-propagation.js",
+      "./release-activation-transaction": "./packages/core/release-activation-transaction.js",
       "./surface-manifest": "./packages/core/surface-manifest.js",
       "./buildchain-kfd-claims": "./packages/core/buildchain-kfd-claims.js",
       "./site/buildchain-site.json": "./dist/site/buildchain-site.json",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-25T02:29:54.202Z",
-  "publishedAt": "2026-07-25T02:29:54.202Z",
+  "generatedAt": "2026-07-26T00:14:36.577Z",
+  "publishedAt": "2026-07-26T00:14:36.577Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "173df79be292987e76383a1955c8a9d31b0cb499",
+  "sourceRevision": "a0cda81b67a212b3555e10d041c8d39b4c1b8dce",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.0",
+    "version": "3.0.1-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,15 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:c9eb92eb02601e1e36cb38d7df93097c582dec2b8dc34f769f58c30fc5190bbe"
+      "digest": "sha256:11ccb0a90cc0583a1a67da36609a8b07207f259815ac9ac0926c2ec8d7a8764a"
+    },
+    {
+      "id": "auditable-demo",
+      "title": "Auditable demo artifact pipeline",
+      "path": "docs/auditable-demo.md",
+      "plane": "verify",
+      "exists": true,
+      "digest": "sha256:cff9786d4de098c84ea7e494b523627d6431909f15c82940e2193dbda1ef10e9"
     },
     {
       "id": "install",
@@ -93,7 +101,7 @@
       "path": "docs/github-governance-authority.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:8484b18d5b0fe6d61d102d6b9cb9e18beac9f47ecb516d430fb5427518e2931f"
+      "digest": "sha256:b8c3d9ad53c2509bbd95804ccc31f6aa89989c3aadf3a2b75d9c73aef168b7e8"
     },
     {
       "id": "release-candidate",
@@ -277,7 +285,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:199ed8e83c988836f757c9a16b58ec441e0bd04a4f3465f21cc73ed7f530e610"
+      "digest": "sha256:f3665f2f173bdcb287cf8aa509035164e818b20088849f4a2bce098951c84ea3"
     },
     {
       "id": "web-surface-deployments",

package/dist/site/workflow-registry.json

@@ -3,6 +3,42 @@
   "contract": "kungfu-buildchain-workflow-registry",
   "workflowSource": ".github/workflows reverse input enumeration",
   "workflows": [
+    {
+      "id": ".auditable-demo",
+      "path": ".github/workflows/.auditable-demo.yml",
+      "reusable": true,
+      "inputs": [
+        "adapter-path",
+        "artifact-retention-days",
+        "buildchain-repository",
+        "render-media",
+        "renderer-image",
+        "require-trusted-event",
+        "source-artifact-digest",
+        "source-artifact-name",
+        "source-ref"
+      ],
+      "inputCount": 9,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "gate-artifact-digest",
+        "gate-artifact-id",
+        "gate-artifact-name",
+        "gate-artifact-url",
+        "gate-root",
+        "media-artifact-digest",
+        "media-artifact-id",
+        "media-artifact-name",
+        "media-artifact-url",
+        "media-root",
+        "source-sha"
+      ],
+      "outputCount": 11,
+      "surface": "auditable-demo",
+      "capabilityGroup": "api-cli-reference",
+      "status": "preview"
+    },
     {
       "id": ".binary-release-assets",
       "path": ".github/workflows/.binary-release-assets.yml",
@@ -117,6 +153,7 @@
       ],
       "secretCount": 8,
       "outputs": [
+        "artifact-coordinates-json",
         "build-diagnostics-summary-artifact",
         "build-diagnostics-summary-json",
         "build-summary-artifact",
@@ -159,7 +196,7 @@
         "runner-preset",
         "trusted-event"
       ],
-      "outputCount": 41,
+      "outputCount": 42,
       "surface": "reusable-build",
       "capabilityGroup": "api-cli-reference",
       "status": "active"
@@ -347,10 +384,14 @@
         "publish-required-artifacts-json",
         "publish-target",
         "publish-transaction-override",
+        "release-activation-command",
+        "release-activation-receipt-set-path",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
         "release-passport-buildchain-self-kfd",
+        "release-passport-evidence-command",
+        "release-passport-evidence-path",
         "release-passport-impact-json",
         "release-passport-invariant-passport-command",
         "release-passport-invariant-passport-jsons",
@@ -370,7 +411,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 79,
+      "inputCount": 83,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -696,6 +737,7 @@
         "production-release-on-main",
         "production-release-pr-mode",
         "production-release-pr-token",
+        "production-source-sha",
         "publication-admission-json",
         "publication-control-plane-audit-json",
         "publication-expected-json",
@@ -709,7 +751,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 40,
+      "inputCount": 41,
       "secrets": [
         "production-release-app-private-key"
       ],
@@ -918,6 +960,7 @@
       ],
       "secretCount": 8,
       "outputs": [
+        "artifact-coordinates-json",
         "build-diagnostics-summary-artifact",
         "build-diagnostics-summary-json",
         "build-summary-artifact",
@@ -963,7 +1006,7 @@
         "runner-preset",
         "trusted-event"
       ],
-      "outputCount": 44,
+      "outputCount": 45,
       "surface": "channel-build-router",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -1569,10 +1612,14 @@
         "publish-required-artifacts-json",
         "publish-target",
         "publish-transaction-override",
+        "release-activation-command",
+        "release-activation-receipt-set-path",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
         "release-passport-buildchain-self-kfd",
+        "release-passport-evidence-command",
+        "release-passport-evidence-path",
         "release-passport-impact-json",
         "release-passport-invariant-passport-command",
         "release-passport-invariant-passport-jsons",
@@ -1592,7 +1639,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 71,
+      "inputCount": 75,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",

package/docs/MAP.md

@@ -105,6 +105,7 @@ replace them.
 | What package-owned facts should buildchain.libkungfu.dev render? | [`site-bundle-contract.md`](site-bundle-contract.md) | use | stable |
 | How do I call the reusable build workflow? | [`reusable-build-surface.md`](reusable-build-surface.md) | use | stable |
 | How does Buildchain schedule and aggregate a project-owned Shifu Gate profile? | [`shifu-gate-profiles.md`](shifu-gate-profiles.md) | use/verify | draft |
+| How do exact build artifacts become qualified, transcript-traceable demo media? | [`auditable-demo.md`](auditable-demo.md) | use/verify | draft |
 | How do I use one build job that follows alpha during development and stable for releases? | [`reusable-build-surface.md`](reusable-build-surface.md#automatic-channel-router) | use | preview |
 | How do self-hosted runners relay large artifacts through S3 before GitHub artifacts? | [`reusable-build-surface.md`](reusable-build-surface.md#artifact-transfer-relay) | use | stable |
 | How do self-hosted runners reuse local Git checkout caches without weakening source locks? | [`reusable-build-surface.md`](reusable-build-surface.md#locked-source-checkout-cache) | use | stable |

package/docs/auditable-demo.md

@@ -0,0 +1,155 @@
+---
+status: draft
+period: 2026-07
+theme: auditable-demo-pipeline
+doc_type: technical-contract
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-07-25
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-07-25
+  invisible_context_boundary: No hidden model build, parameter count, or private corpus is asserted.
+---
+
+# Auditable Demo Pipeline
+
+Buildchain's auditable demo workflow turns an exact GitHub build artifact into
+two distinct evidence products:
+
+1. a required qualified Gate bundle; and
+2. an optional rendered media bundle that can exist only after that exact Gate
+   bundle passes.
+
+The public reusable workflow is
+`.github/workflows/.auditable-demo.yml`. It is consumer-neutral: Buildchain
+does not know how a Kungfu, library, service, or application artifact should be
+interpreted. The consumer owns a small checked-in executable adapter.
+
+## Authority Boundary
+
+The retained build output is authoritative. The adapter reads that exact
+artifact and projects three files:
+
+```text
+complete-transcript.txt
+public-projection.json
+scene.json
+```
+
+The adapter must not rebuild or rerun the product. It receives:
+
+```text
+--artifact-root PATH
+--output PATH
+--source-coordinate PATH
+```
+
+`--source-coordinate` identifies the caller repository, run, artifact id,
+artifact name, upload digest, expiry, and exact source SHA. The workflow finds
+exactly one live artifact with the requested name in the current caller run and
+rejects a digest mismatch before invoking the adapter. Callers must pass the
+digest emitted by their own `upload-artifact` step; a name resolved later from
+the Actions API is discovery evidence, not a substitute for that producer
+output.
+
+Buildchain's reusable build workflow exposes `artifact-coordinates-json` after
+all resolved platform uploads complete. That producer-owned output binds every
+platform id to its same-run artifact id, name, upload digest, URL, and expiry,
+so a consumer that delegates its build to Buildchain can pass an exact
+coordinate without rediscovering authority in a downstream job. The build
+aggregate fails closed if any declared platform lacks one live, digest-bearing
+artifact coordinate. The compact coordinate set is sorted by platform id so
+downstream machine consumers do not depend on matrix completion order.
+
+The adapter runs with a disposable Home/XDG/npm prefix, a minimal environment,
+and no GitHub, npm, or cloud credential injection. It must be a regular,
+non-symlink, executable file inside the exact checked-out consumer source.
+
+## Required Gate
+
+The Gate:
+
+- checks out the exact consumer source and exact called-workflow SHA;
+- resolves and downloads one exact same-run GitHub Artifact;
+- invokes the checked-in adapter by argv, never as an evaluated shell string;
+- rejects undeclared adapter outputs, symlinks, invalid UTF-8, invalid scene or
+  projection schemas, out-of-range transcript references, and oversized input;
+- derives a one-second compatibility scene from the consumer projection;
+- anonymously pulls an immutable `image@sha256:digest` renderer;
+- runs it as non-root with `--network none`, a read-only root filesystem, and a
+  bounded tmpfs;
+- verifies the renderer manifest, media probe, exact input roots, exact output
+  member set, and complete checksums;
+- uploads a content-addressed qualified bundle plus an independent GitHub
+  Artifact id, URL, archive digest, and expiry-bearing source coordinate.
+
+The Gate bundle contains the complete consumer transcript/projection/scene,
+source artifact coordinate, adapter identity, bounded renderer evidence, a
+passed gate receipt, and checksums covering every member exactly once.
+
+## Selective Render
+
+`render-media: true` enables the second job. It downloads the just-uploaded Gate
+bundle by its content-addressed name, recomputes the Gate member root, verifies
+the exact source SHA and renderer digest, and only then renders the complete
+qualified scene.
+
+The media bundle contains MP4, WebM, GIF, poster, probe, renderer manifest,
+renderer checksums, passed Gate receipt, media receipt, and distribution
+checksums. `render-media: false` does not weaken or skip the Gate.
+
+## Consumer Example
+
+The build job must expose both the exact artifact name and the digest returned
+by `upload-artifact`:
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    outputs:
+      artifact-name: product-linux-${{ github.sha }}
+      artifact-digest: ${{ steps.upload.outputs.artifact-digest }}
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - run: ./scripts/build-product
+      - id: upload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: product-linux-${{ github.sha }}
+          path: dist
+          if-no-files-found: error
+          retention-days: 14
+          compression-level: 0
+
+  auditable-demo:
+    needs: build
+    permissions:
+      actions: read
+      contents: read
+    uses: kungfu-systems/buildchain/.github/workflows/.auditable-demo.yml@BUILDCHAIN_EXACT_SHA
+    with:
+      source-ref: ${{ github.sha }}
+      source-artifact-name: ${{ needs.build.outputs.artifact-name }}
+      source-artifact-digest: ${{ needs.build.outputs.artifact-digest }}
+      adapter-path: scripts/auditable-demo-adapter
+      renderer-image: ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:RENDERER_DIGEST
+      render-media: false
+```
+
+Replace both placeholders with reviewed immutable SHAs or digests. An eligible
+build should always call the reusable workflow. Selection policy changes only
+`render-media`; it must never condition away the Gate job.
+
+## Failure Evidence
+
+Gate and render jobs use bounded timeouts and non-cancelling concurrency.
+Diagnostics artifacts are attempted with `always()` so adapter stdout/stderr
+and the resolved source coordinate remain available when qualification fails.
+No production deployment, publication authority, token, or provider mutation
+is part of this workflow.

package/docs/github-governance-authority.md

@@ -124,7 +124,7 @@ Limit a canary to one repository:
 ```bash
 buildchain audit github-governance \
   --repository kungfu-systems/buildchain \
-  --target-ref dev/v2/v2.14 \
+  --target-ref dev/v3/v3.0 \
   --require-qualifying \
   --json
 ```
@@ -169,7 +169,7 @@ Plan one exact branch without mutation:
 ```bash
 buildchain github-governance plan \
   --repository kungfu-systems/buildchain \
-  --branch dev/v2/v2.14 \
+  --branch dev/v3/v3.0 \
   --required-check check \
   --required-check-app-id check=15368 \
   --required-approvals 1 \

package/docs/release-activation-transaction.md

@@ -0,0 +1,38 @@
+# Release activation transaction
+
+Buildchain exposes `release-activation-transaction` as the final cross-repository
+contract between a qualified product release, its public web surface, and the
+product-owned released-evidence projection.
+
+The canonical order is:
+
+1. `candidate-qualified`
+2. `artifacts-published`
+3. `passport-sealed`
+4. `site-published`
+5. `public-readback`
+6. `evidence-synthesized`
+
+`packages/core/release-activation-transaction.js` is the executable authority.
+Every transaction binds an exact product source SHA, exact reviewed site source
+SHA, tag, channel, version, environment, artifact-set root, and the three
+repository owners. A later phase cannot pass while an earlier phase is
+incomplete. Replaying a passed phase is idempotent only when its retained
+receipt roots are unchanged.
+
+Released evidence must be synthesized from a canonical receipt set containing
+exactly one artifact-publication, release-passport, site-publication,
+public-readback, and product-qualification receipt. Every receipt repeats the
+same binding root. Missing, duplicated, stale, or substituted roots fail
+closed.
+
+Shadow rehearsal uses `mode=shadow`, `environment=shadow`, and always emits
+`releasedUseClaim=false`. It is suitable for protected PR qualification and
+must never be published as real release evidence. Activation mode requires the
+production environment; actual channel mutation remains the caller's protected
+publication responsibility.
+
+The web-surface workflow accepts `production-source-sha` only for an explicitly
+approved `workflow_dispatch`. It checks out and plans the exact reviewed
+consumer commit, while the production environment and normal publication
+authority gates remain intact.