@kungfu-tech/buildchain 3.0.1-alpha.2 → 3.0.1-alpha.4

package/dist/site/public-surface-audit.json

@@ -7,7 +7,7 @@
     "workflowCount": 53,
     "actionCount": 5,
     "sitePageCount": 56,
-    "docCommandRefCount": 276,
+    "docCommandRefCount": 275,
     "failureCount": 0
   },
   "enumerated": {
@@ -660,6 +660,13 @@
           "artifact-retention-days",
           "buildchain-ref",
           "buildchain-repository",
+          "checkout-cache-fallback",
+          "checkout-cache-fetch-attempts",
+          "checkout-cache-github-timeout-seconds",
+          "checkout-cache-mirror-url-template",
+          "checkout-cache-mode",
+          "checkout-cache-reference-repository-template",
+          "checkout-cache-timeout-seconds",
           "gate-command-json",
           "gate-environment-json",
           "gate-plan-command-json",
@@ -676,7 +683,7 @@
           "untrusted-policy",
           "working-directory"
         ],
-        "inputCount": 19,
+        "inputCount": 26,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
@@ -3937,11 +3944,6 @@
         "path": "docs/release-passport.md",
         "command": "buildchain verify release-passport"
       },
-      {
-        "id": "verify-release-passport",
-        "path": "README.md",
-        "command": "buildchain verify release-passport buildchain"
-      },
       {
         "id": "version",
         "path": "docs/install.md",
@@ -3964,8 +3966,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "5ba7fd93a13993b05767b6f02d0626a7347f25c3d7cd4589ed4f70028c1f1bd1",
-    "workflowRegistryDigest": "4a627dcf07131d07095d5e6bf0a3373e55c62cf325b3f81bb156c43d31367d62",
-    "pageRegistryDigest": "835b03c155e87749a3d43a9e9af284601b863698592e401c6d183625cbf6ef63"
+    "workflowRegistryDigest": "1ae515aa9c38a443aaac1ea21f92ecd53e0e0d771c949bf157e1c29c036ddc6e",
+    "pageRegistryDigest": "752b9d4f725f90f731f4b83a599905fbfb50f6d668b220e085c4b5bddbc2fb5e"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-26T01:19:14.862Z",
-  "publishedAt": "2026-07-26T01:19:14.862Z",
+  "generatedAt": "2026-07-26T12:42:50.669Z",
+  "publishedAt": "2026-07-26T12:42:50.669Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "563a000b882460cdc7f632cb3d2c4f415e7119a2",
+  "sourceRevision": "3a01e45adedac327dd6095cff8cc83106fb7aa67",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.1-alpha.2",
+    "version": "3.0.1-alpha.4",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -74,7 +74,7 @@
   "packageManager": "pnpm@11.7.0",
   "inventoryRelease": "buildchain-v2",
   "stableRefs": {
-    "actions": "kungfu-systems/buildchain/actions/<name>@v2",
-    "workflows": "kungfu-systems/buildchain/.github/workflows/<workflow>.yml@v2"
+    "actions": "kungfu-systems/buildchain/actions/<name>@v3",
+    "workflows": "kungfu-systems/buildchain/.github/workflows/<workflow>.yml@v3"
   }
 }

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-26T01:19:14.862Z",
-  "publishedAt": "2026-07-26T01:19:14.862Z",
+  "generatedAt": "2026-07-26T12:42:50.669Z",
+  "publishedAt": "2026-07-26T12:42:50.669Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "563a000b882460cdc7f632cb3d2c4f415e7119a2",
+  "sourceRevision": "3a01e45adedac327dd6095cff8cc83106fb7aa67",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.1-alpha.2",
+    "version": "3.0.1-alpha.4",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:11ccb0a90cc0583a1a67da36609a8b07207f259815ac9ac0926c2ec8d7a8764a"
+      "digest": "sha256:fc8f7c63b8427e513f9524b8e22e4b0dcd8981fcc724417a29b942fe237fc0a9"
     },
     {
       "id": "auditable-demo",
@@ -69,7 +69,7 @@
       "path": "docs/install.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:1879849c01f82b8820f2d9aeb09faed0931954cb7fe6939176a5eb69110cee59"
+      "digest": "sha256:570bf79189925ae0dfc040a83804a71149cda122c033d5aa763672b2a137072a"
     },
     {
       "id": "release-passport",
@@ -77,7 +77,7 @@
       "path": "docs/release-passport.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:f10d2f0f9cc694976b2a1d2a61195ed155c1bc24c964de1551475882e8197c92"
+      "digest": "sha256:c7f096af40224efb53b2e0e8b7e1ceedc3aafeb341c476a7cce7e5974004a775"
     },
     {
       "id": "controller-evidence",
@@ -109,7 +109,7 @@
       "path": "docs/release-candidate.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:e933241bc138661a73cf1b419690cad629ba328ce05ecbd85841199a337d37c1"
+      "digest": "sha256:887bc3c041c3231d8e6dd403964d04d28a9eb13081bc4154dc2a6ebd56697ecd"
     },
     {
       "id": "release-propagation",
@@ -117,7 +117,7 @@
       "path": "docs/release-propagation.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:fc2b743e3d76c4f90cdd8c6560cf9d619ad25d74c15c074be96db7bcb6cc2a29"
+      "digest": "sha256:b7d2deef7d50fc412aa21c7ef1019c4c2bd8b0392b9b323356b1c0b1fc2596b6"
     },
     {
       "id": "readme-badges",
@@ -133,7 +133,7 @@
       "path": "docs/homebrew.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:2fc4e8411f35ca86d19d61c7843b9a1fa440f7afea25df13d3aa03342f09f90c"
+      "digest": "sha256:e690ea465d4289f2246d93765776b057c6aca1c68dc290abcee94c947e5d5c47"
     },
     {
       "id": "binary-distribution",
@@ -149,7 +149,7 @@
       "path": "docs/consumer-issue-reporting.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:8e2159312e47b42ab0bb644cb195362150acc8872e6ac0e7380ece0c5cf36955"
+      "digest": "sha256:96804310360c02f408fee9d540385d875a40d09bef046c3df369228d311a1cdd"
     },
     {
       "id": "infra-contract",
@@ -165,7 +165,7 @@
       "path": "docs/toolkit-observability.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:b2ffc3b2520ca7879309b7607b2eaa1aceb647503e893887159a6916de14e2d7"
+      "digest": "sha256:d7f4179c3912d7bbc5940bfba69e674fb03d020a740063c0b877a171bd5789e3"
     },
     {
       "id": "site-bundle-contract",
@@ -173,7 +173,7 @@
       "path": "docs/site-bundle-contract.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:583661a7886bdca7e8352a5325a105a9df5d134b3896dbda13ad9b637697481f"
+      "digest": "sha256:40831ce35dca6ac2a3a81d54a83fb0e5ab064137829a4f7844e5d80ba61aa65c"
     },
     {
       "id": "migration-inventory",
@@ -181,7 +181,7 @@
       "path": "docs/migration-inventory.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:18f98635bb16a4e43cac2d46443b3e812c305f708f071929dc6a46a8cd5dccd5"
+      "digest": "sha256:bb73731a3b747d02b9453537109754f194c58dba92c260ac84c632b0d58607af"
     },
     {
       "id": "ownership",
@@ -189,7 +189,7 @@
       "path": "docs/ownership.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:49074fb520c404d3c9f5b49b33562d4bdc4e3ed407cf22543fa8e19e312a6b8e"
+      "digest": "sha256:a9f54f211b55da6464d890b0ebfe046dbf564aabdfee3aadf457723f9aae398a"
     },
     {
       "id": "product-mechanism",
@@ -205,7 +205,7 @@
       "path": "docs/cli.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:758625143a51d0fe66871220c52273ceaf5c7a47fc1a99bda4608e3ad587ae81"
+      "digest": "sha256:f4518193026571d1e84bc245725a9f83e842b2e4b4dfaa072c8207021fa89cd1"
     },
     {
       "id": "build-facts",
@@ -229,7 +229,7 @@
       "path": "docs/kfd-agent-hub.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:7528f8a11c7fe67b350c0dd380b77d724c2d9e0001b4427949ee1c6012735d49"
+      "digest": "sha256:9bfba0a872590bb1b4f260ddbe71b54572ef291f3fc11d32bcd04e79f5e740ff"
     },
     {
       "id": "lifecycle-protocol",
@@ -237,7 +237,7 @@
       "path": "docs/lifecycle-protocol.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:9c669d3d2d1926dc5b421207089cca85bac0a6dcdb5544c28a7e1659ba9ed5ee"
+      "digest": "sha256:55425241363da6105a6b36a46bf8c9d7edd5b0e0f9dbcebe1452327642eb2af9"
     },
     {
       "id": "reusable-build-surface",
@@ -245,7 +245,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ff6f36e1db2be12df37ef076935b5583493742528d98403297678a0682b67dc2"
+      "digest": "sha256:fe73561e8f038e73624bc776f7c527efe59bab105e1208bbaa5af6ebeade6216"
     },
     {
       "id": "publish-transaction",
@@ -261,7 +261,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:5aa7fef2c831d14b4d1df4cddb45c6ce97929d8530eb14e3b3dfa3dee5e0d651"
+      "digest": "sha256:a77c2bb1d2245e1ee2318f650ad64ada6c8cdd3292a62a028e3ccc7517fb4e12"
     },
     {
       "id": "release-flow",
@@ -277,7 +277,7 @@
       "path": "docs/runtime-train-validation.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:1872e511b31c04ba75fc3a005c7a4f857c8b06ecadfedb75bc35b2ce70e7764a"
+      "digest": "sha256:1315fe264d0e22215183122fc05e287be974751a78268642076898b689e435e6"
     },
     {
       "id": "versioning",
@@ -293,7 +293,7 @@
       "path": "docs/web-surface-deployments.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:809d765d89277320d710ecfdc2287029530b74fe38f36dd04d057076dded9a0d"
+      "digest": "sha256:ed4ff02dcb6f66118a29084784f25d8008ca472f59005b2e014133524706a9c5"
     }
   ],
   "facts": [

package/dist/site/workflow-registry.json

@@ -226,6 +226,13 @@
         "artifact-retention-days",
         "buildchain-ref",
         "buildchain-repository",
+        "checkout-cache-fallback",
+        "checkout-cache-fetch-attempts",
+        "checkout-cache-github-timeout-seconds",
+        "checkout-cache-mirror-url-template",
+        "checkout-cache-mode",
+        "checkout-cache-reference-repository-template",
+        "checkout-cache-timeout-seconds",
         "gate-command-json",
         "gate-environment-json",
         "gate-plan-command-json",
@@ -242,7 +249,7 @@
         "untrusted-policy",
         "working-directory"
       ],
-      "inputCount": 19,
+      "inputCount": 26,
       "secrets": [],
       "secretCount": 0,
       "outputs": [

package/docs/MAP.md

@@ -45,7 +45,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | KFD-3 public surface reverse audit | `dist/site/public-surface-audit.json`, `dist/site/cli-registry.json`, `dist/site/workflow-registry.json`, `dist/site/page-registry.json` | [`cli.md`](cli.md), [`site-bundle-contract.md`](site-bundle-contract.md) |
 | KFD-1 / KFD-2 / KFD-3 first-class CLI and Node API | `.buildchain/kfd/kfd-3/surfaces.json`, `dist/site/kfd-claims.json`, `buildchain.release.json`, KFD schemas from `@kungfu-tech/kfd` | [`kfd-support.md`](kfd-support.md), [`cli.md`](cli.md#commands) |
 | Declarative KFD Agent Hub adapter conformance and Passport evidence | `.buildchain/kfd/agent-hub.json`, `.buildchain/artifacts/kfd-agent-hub/evidence.json`, `buildchain.release.json#kfdAgentHub` | [`kfd-agent-hub.md`](kfd-agent-hub.md) |
-| Floating `@v2` drift detection and compatibility issues | `dist/site/buildchain-contract.json` | [`reusable-build-surface.md`](reusable-build-surface.md#floating-ref-contract-lock) |
+| Floating `@v3` drift detection and compatibility issues | `dist/site/buildchain-contract.json` | [`reusable-build-surface.md`](reusable-build-surface.md#floating-ref-contract-lock) |
 | npm publish transactions, evidence, dist-tags, and recovery | `dist/site/release-model.json`, `dist/site/artifact-schemas.json` | [`publish-transaction.md`](publish-transaction.md) |
 | Git/source/version/module/product build facts | `dist/site/node-api-registry.json`, `dist/site/cli-registry.json`, `kungfu-buildchain-module-build-facts`, `kungfu-buildchain-product-build-facts` | [`build-facts.md`](build-facts.md) |
 | GitHub Release passport/evidence publication | `dist/site/release-model.json`, `dist/site/artifact-schemas.json` | [`release-governance.md`](release-governance.md), [`release-candidate.md`](release-candidate.md) |
@@ -93,7 +93,7 @@ replace them.
 | How do I gate KFD-3 collaboration-interface releases? | [`release-passport.md`](release-passport.md#kfd-3-collaboration-interface-release-gate) + [`cli.md`](cli.md) | verify/use | stable |
 | How do I detect, register, audit, witness, or query KFD-3 product surfaces? | [`kfd-support.md`](kfd-support.md) + [`cli.md`](cli.md) | verify/use | stable |
 | How do I adopt the KFD Agent Hub profile with one declaration and one adapter? | [`kfd-agent-hub.md`](kfd-agent-hub.md) | verify/use | preview |
-| How do I keep `@v2` floating refs while detecting Buildchain contract drift? | [`reusable-build-surface.md`](reusable-build-surface.md#floating-ref-contract-lock) | verify/use | stable |
+| How do I keep `@v3` floating refs while detecting Buildchain contract drift? | [`reusable-build-surface.md`](reusable-build-surface.md#floating-ref-contract-lock) | verify/use | stable |
 | How do reusable workflows bind controller intent, source/runtime identity, outcomes, and receipt evidence? | [`controller-evidence.md`](controller-evidence.md) | verify/use | draft |
 | How do I propagate finalized upstream releases to downstream package/site PRs? | [`release-propagation.md`](release-propagation.md) | use | preview |
 | How do paper or report repositories publish PDFs, metadata, source bundles, site-consumable manifests, npm packages, and GitHub Releases? | [`publication-artifacts.md`](publication-artifacts.md) | use | stable |
@@ -110,7 +110,7 @@ replace them.
 | How do self-hosted runners relay large artifacts through S3 before GitHub artifacts? | [`reusable-build-surface.md`](reusable-build-surface.md#artifact-transfer-relay) | use | stable |
 | How do self-hosted runners reuse local Git checkout caches without weakening source locks? | [`reusable-build-surface.md`](reusable-build-surface.md#locked-source-checkout-cache) | use | stable |
 | How do ephemeral GitHub-hosted runners share exact dependency or compiler caches without fixed-runner affinity? | [`cli.md`](cli.md#commands) | use/verify | preview |
-| How do I validate an unreleased Buildchain runtime train while keeping `@v2`? | [`runtime-train-validation.md`](runtime-train-validation.md) | use | stable |
+| How do I validate an unreleased Buildchain runtime train while keeping `@v3`? | [`runtime-train-validation.md`](runtime-train-validation.md) | use | stable |
 | How do I automatically qualify alpha candidates and publish the newest non-revoked qualified candidate at a fixed window? | [`stable-candidate-patrol.md`](stable-candidate-patrol.md) | use | preview |
 | How do I deploy a site/app preview, staging, or production surface? | [`web-surface-deployments.md`](web-surface-deployments.md) | use | stable |
 | How do I publish observed infrastructure contracts for downstream consumers? | [`infra-contract.md`](infra-contract.md) | use | preview |
@@ -125,7 +125,7 @@ replace them.
 
 - **ABV / old workflows / old action repositories** -> [`release-governance.md`](release-governance.md)
   and [`migration-inventory.md`](migration-inventory.md).
-- **v2 / v2-alpha / v2.0 / v2.0-alpha / exact tags / floating tags** ->
+- **v2 / v3-alpha / v2.0 / v2.0-alpha / exact tags / floating tags** ->
   [`release-governance.md`](release-governance.md) and
   [`release-flow.md`](release-flow.md).
 - **Buildchain self-dogfood / released alpha canary / stable compatibility lane** ->
@@ -181,7 +181,7 @@ replace them.
   [`release-passport.md`](release-passport.md#kfd-2-release-trust-passport-audit).
 - **KFD-3 collaboration-interface / agent-facing control surface closure** ->
   [`release-passport.md`](release-passport.md#kfd-3-collaboration-interface-release-gate).
-- **floating `@v2` / contract lock / compatible drift issue** ->
+- **floating `@v3` / contract lock / compatible drift issue** ->
   [`reusable-build-surface.md`](reusable-build-surface.md#floating-ref-contract-lock).
 - **GitHub Release passport / binary assets / artifact evidence / agent release checks** ->
   [`release-passport.md`](release-passport.md),

package/docs/cli.md

@@ -31,7 +31,7 @@ Consumers should pin the exact Buildchain version that was validated in their
 repository. When dogfooding a fresh Buildchain release immediately after it is
 published, pnpm may block the install through a minimum release-age policy. In
 that case, add a temporary package/version-specific `minimumReleaseAgeExclude`
-entry, such as `@kungfu-tech/buildchain@2.2.5`, and remove it once the package
+entry, such as `@kungfu-tech/buildchain@3.0.0`, and remove it once the package
 has aged past the normal policy window. Do not replace that with a broad
 registry or scope-wide exclude.
 
@@ -88,7 +88,7 @@ import publicSurfaceAudit from "@kungfu-tech/buildchain/site/public-surface-audi
 
 Use `dist/site/manual-registry.json` to find the packaged operating manuals and
 their SHA-256 digests. Use `dist/site/buildchain-contract.json` to verify the
-floating-ref contract world for a runtime such as `@v2`.
+floating-ref contract world for a runtime such as `@v3`.
 
 ## Commands
 
@@ -371,6 +371,12 @@ and have those events grouped into the same lifecycle summary.
 is missing, has too few events, contains error events, or does not include
 required phases, components, or event names.
 
+The JSON summary also includes an additive `controlPlane` block. It counts
+workflow-friction incident outcomes and production release-intent outcomes,
+including incident reuse rate, release-intent suppression rate, and suppression
+reasons. Buildchain writes those outcome events locally; it does not send
+telemetry outside the runner.
+
 The event protocol is JSONL and is also available from the SDK:
 
 ```js
@@ -518,7 +524,7 @@ buildchain publication-artifact npm-package --json
 This command reads `project.type = "publication-artifact"`,
 `publication.version`, and `[publish] kind = "npm-paper-package"` plus
 `publish.package`; it writes `.buildchain/publication/npm-package` by default.
-The `paper-release.yml@v2` reusable workflow uses the same command before
+The `paper-release.yml@v3` reusable workflow uses the same command before
 running the standard npm publish transaction.
 
 The command writes `.buildchain/publication/publication-artifact.json`,
@@ -555,7 +561,7 @@ Generate or check Homebrew tap projections from upstream release passports:
 ```bash
 buildchain homebrew update-formula \
   --package buildchain \
-  --release-passport https://github.com/kungfu-systems/buildchain/releases/download/v2.8.15/buildchain.release.json \
+  --release-passport https://github.com/kungfu-systems/buildchain/releases/download/v3.0.0/buildchain.release.json \
   --write
 
 buildchain homebrew check --json
@@ -571,7 +577,7 @@ GitHub Release assets or a local asset directory:
 
 ```bash
 buildchain collect github-release \
-  --tag v2.2.0 \
+  --tag v3.0.0 \
   --repository kungfu-systems/buildchain \
   --assets-dir dist \
   --output-dir .buildchain/release-passport
@@ -589,11 +595,11 @@ asset summary:
 
 ```bash
 buildchain collect github-release \
-  --tag v2.3.2 \
+  --tag v3.0.0 \
   --repository kungfu-systems/buildchain \
   --assets-dir dist \
-  --publish-evidence-json .buildchain/release-evidence/v2.3.2/evidence.json \
-  --transaction-json .buildchain/release-state/v2.3.2/state.json \
+  --publish-evidence-json .buildchain/release-evidence/v3.0.0/evidence.json \
+  --transaction-json .buildchain/release-state/v3.0.0/state.json \
   --package-set-json package-set.json \
   --impact-json impact.json \
   --trusted-publishing-json trusted-publishing.json \
@@ -602,7 +608,7 @@ buildchain collect github-release \
   --platform-manifest-json .buildchain/artifacts/linux-x64/manifest.json \
   --platform-manifest-json .buildchain/artifacts/darwin-arm64/manifest.json \
   --platform-manifest-json .buildchain/artifacts/win32-x64/manifest.json \
-  --dist-tag-evidence-json .buildchain/release-evidence/v2.3.2/dist-tag-evidence.json \
+  --dist-tag-evidence-json .buildchain/release-evidence/v3.0.0/dist-tag-evidence.json \
   --kfd-1-witness-json .buildchain/kfd/kfd-1/contract-world.witness.json \
   --kfd-2-claim-json .buildchain/kfd/kfd-2/release-claims.json \
   --kfd-3-prebuild-witness-json .buildchain/kfd/kfd-3/collaboration-interface.prebuild.json \
@@ -813,10 +819,10 @@ even when the bundle hash has been refreshed.
 maintainer opens or merges a channel PR:
 
 ```bash
-buildchain release --dry-run --target-ref alpha/v2/v2.2
-buildchain release --dry-run --target-ref release/v2/v2.2 --sha <verified-sha>
-buildchain release dry-run --target-ref publish-gate/major --source-ref release/v2/v2.2
-buildchain release explain --target-ref alpha/v2/v2.1 --json
+buildchain release --dry-run --target-ref alpha/v3/v3.0
+buildchain release --dry-run --target-ref release/v3/v3.0 --sha <verified-sha>
+buildchain release dry-run --target-ref publish-gate/major --source-ref release/v3/v3.0
+buildchain release explain --target-ref alpha/v3/v3.0 --json
 ```
 
 This is a Buildchain-level dry-run, not an npm dry-run. It explains the legal
@@ -831,7 +837,7 @@ Pass `--json` for a machine-readable plan.
 for the publish transaction state:
 
 ```bash
-buildchain transaction inspect --version v2.1.0-alpha.0
+buildchain transaction inspect --version v3.0.1-alpha.2
 ```
 
 It reads or locally initializes the durable transaction record and validates

package/docs/consumer-issue-reporting.md

@@ -27,7 +27,7 @@ The recommended pattern is:
     owner: kungfu-systems
     repositories: buildchain
 
-- uses: kungfu-systems/buildchain/actions/report-buildchain-issue@v2
+- uses: kungfu-systems/buildchain/actions/report-buildchain-issue@v3
   if: failure()
   with:
     token: ${{ steps.buildchain-issue-token.outputs.token }}

package/docs/homebrew.md

@@ -21,6 +21,8 @@ name = "homebrew-tap"
 command = "buildchain homebrew check"
 ```
 
+Buildchain v3.0.0 currently publishes evidence assets but no standalone platform archives, so the Buildchain formula continues to index the latest verified legacy binary line, v2.14.16. This does not change the tap repository's v3 management workflow.
+
 The tap manifest is the repository-owned declaration of which upstream releases
 are indexed. Buildchain writes `tap-manifest.json` as a machine-readable
 projection:
@@ -37,10 +39,10 @@ projection:
       "path": "Formula/buildchain.rb",
       "upstream": {
         "repository": "kungfu-systems/buildchain",
-        "tag": "v2.8.15",
-        "releasePassportUrl": "https://github.com/kungfu-systems/buildchain/releases/download/v2.8.15/buildchain.release.json"
+        "tag": "v2.14.16",
+        "releasePassportUrl": "https://github.com/kungfu-systems/buildchain/releases/download/v2.14.16/buildchain.release.json"
       },
-      "version": "2.8.15",
+      "version": "2.14.16",
       "kfd": {
         "kfd-1": "passed",
         "kfd-2": "passed",
@@ -49,7 +51,7 @@ projection:
       "artifacts": [
         {
           "platform": "darwin-arm64",
-          "url": "https://github.com/kungfu-systems/buildchain/releases/download/v2.8.15/buildchain-aarch64-apple-darwin.tar.gz",
+          "url": "https://github.com/kungfu-systems/buildchain/releases/download/v2.14.16/buildchain-aarch64-apple-darwin.tar.gz",
           "sha256": "..."
         }
       ]
@@ -65,7 +67,7 @@ Update a formula and manifest from an upstream passport:
 ```bash
 buildchain homebrew update-formula \
   --package buildchain \
-  --release-passport https://github.com/kungfu-systems/buildchain/releases/download/v2.8.15/buildchain.release.json \
+  --release-passport https://github.com/kungfu-systems/buildchain/releases/download/v2.14.16/buildchain.release.json \
   --write
 ```
 

package/docs/install.md

@@ -6,6 +6,10 @@ adopting a new version.
 
 ## Standalone Binary
 
+Buildchain v3.0.0 does not publish standalone platform archives. This section
+documents the verified legacy binary release contract; v3 consumers should use
+the npm package or repository workflow surface below.
+
 Use the archive that matches the platform:
 
 | Platform | Asset |
@@ -60,7 +64,7 @@ Stable consumers should pin the exact Buildchain version they have validated,
 for example:
 
 ```bash
-pnpm add -D @kungfu-tech/buildchain@2.2.5
+pnpm add -D @kungfu-tech/buildchain@3.0.0
 ```
 
 If a repository dogfoods a just-published Buildchain version and pnpm's release
@@ -72,7 +76,7 @@ all packages:
 {
   "pnpm": {
     "minimumReleaseAgeExclude": [
-      "@kungfu-tech/buildchain@2.2.5"
+      "@kungfu-tech/buildchain@3.0.0"
     ]
   }
 }
@@ -86,7 +90,7 @@ policy. Do not use a broad exclude such as `@kungfu-tech/*` for this case.
 ```bash
 npx @kungfu-tech/buildchain init --type package --package-manager pnpm
 npx @kungfu-tech/buildchain validate --require-version-state
-npx @kungfu-tech/buildchain release --dry-run --target-ref alpha/v2/v2.2
+npx @kungfu-tech/buildchain release --dry-run --target-ref alpha/v3/v3.0
 ```
 
 Use `.buildchain/buildchain.toml` to declare lifecycle commands. The commands may use Node

package/docs/kfd-agent-hub.md

@@ -83,7 +83,7 @@ not KFD certification, a security assessment, or production-fitness evidence.
 ```yaml
 jobs:
   build:
-    uses: kungfu-systems/buildchain/.github/workflows/build.yml@v2
+    uses: kungfu-systems/buildchain/.github/workflows/build.yml@v3
     with:
       kfd-agent-hub: auto
 ```

package/docs/lifecycle-protocol.md

@@ -187,7 +187,7 @@ git diff --check
 `lifecycle.check` is the repository-owned source-acceptance gate. It should
 validate the checked-out source revision without entering the build, artifact,
 or release lifecycle. Consumers can run it on GitHub-hosted Linux through
-`.github/workflows/check.yml@v2` with `mode: source`; the reusable workflow runs
+`.github/workflows/check.yml@v3` with `mode: source`; the reusable workflow runs
 only `lifecycle.install` and `lifecycle.check`. The default `mode: verify`
 continues to run `lifecycle.install` and `lifecycle.verify` for existing callers.
 Both executed stages receive `BUILDCHAIN_CHECK_MODE=source` or
@@ -343,7 +343,7 @@ build and the first migration milestone is to prove the release metadata and
 lifecycle protocol without consuming build runners.
 
 ```yaml
-- uses: kungfu-systems/buildchain/actions/validate-config@v2
+- uses: kungfu-systems/buildchain/actions/validate-config@v3
   with:
     require-version-state: "true"
     require-lifecycle-stages: "install,build,verify"
@@ -353,7 +353,7 @@ Web-surface repositories can use the same action without requiring version
 state:
 
 ```yaml
-- uses: kungfu-systems/buildchain/actions/validate-config@v2
+- uses: kungfu-systems/buildchain/actions/validate-config@v3
   with:
     require-lifecycle-stages: "build,verify"
 ```

package/docs/migration-inventory.md

@@ -33,9 +33,9 @@ surface. New publish integrations should use `.build.yml`, `buildchain.toml`,
 Release templates that previously performed direct publishing or deployment are
 now fail-closed when retained for compatibility discovery. They do not call
 legacy publish actions, `npm publish`, or deploy providers directly. Callers must
-migrate to `release-candidate-promote.yml@v2` or a project-owned
+migrate to `release-candidate-promote.yml@v3` or a project-owned
 `lifecycle.publish` command behind a publish-gate source lock, so floating
-`@v2` consumers cannot bypass source-lock drift protection.
+`@v3` consumers cannot bypass source-lock drift protection.
 
 The public promotion workflow is now a generated dual-channel router. Existing
 callers remain source-compatible, while callers that want alpha workflow-shell
@@ -113,8 +113,8 @@ older standalone action repository.
 
 ## Stable v2 Refs
 
-- Actions: `kungfu-systems/buildchain/actions/<name>@v2`
-- Reusable workflows: `kungfu-systems/buildchain/.github/workflows/<workflow>.yml@v2`
+- Actions: `kungfu-systems/buildchain/actions/<name>@v3`
+- Reusable workflows: `kungfu-systems/buildchain/.github/workflows/<workflow>.yml@v3`
 
 ## Verification Gates
 

package/docs/ownership.md

@@ -22,10 +22,10 @@ Any consumer migration must record:
 
 New stable references should use:
 
-- `kungfu-systems/buildchain/actions/validate-config@v2`
-- `kungfu-systems/buildchain/actions/run-lifecycle@v2`
-- `kungfu-systems/buildchain/actions/promote-buildchain-ref@v2`
-- `kungfu-systems/buildchain/.github/workflows/<workflow>.yml@v2`
+- `kungfu-systems/buildchain/actions/validate-config@v3`
+- `kungfu-systems/buildchain/actions/run-lifecycle@v3`
+- `kungfu-systems/buildchain/actions/promote-buildchain-ref@v3`
+- `kungfu-systems/buildchain/.github/workflows/<workflow>.yml@v3`
 
 ## Publishing Rule
 

package/docs/publication-artifacts.md

@@ -120,7 +120,7 @@ call the build-only wrapper directly:
 ```yaml
 jobs:
   publication:
-    uses: kungfu-systems/buildchain/.github/workflows/publication-artifact.yml@v2
+    uses: kungfu-systems/buildchain/.github/workflows/publication-artifact.yml@v3
     with:
       toolchain-type: config
       verify-command: make check
@@ -182,7 +182,7 @@ on:
 
 jobs:
   paper-release:
-    uses: kungfu-systems/buildchain/.github/workflows/paper-release-sealed.yml@v2
+    uses: kungfu-systems/buildchain/.github/workflows/paper-release-sealed.yml@v3
     permissions:
       actions: read
       checks: write