@kungfu-tech/buildchain 3.0.3-alpha.2 → 3.0.3

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.3-alpha.2",
+    "version": "3.0.3",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -731,7 +731,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:4e45333ae4e971cc948e24d55ee046b859118aac9f338340a45353f0e7392957"
+      "auditDigest": "sha256:580c8766d5007b1655b341b8e6d0f417cbdd1324f59cac094bead261fa50c961"
     },
     {
       "contractVersion": 1,
@@ -3522,5 +3522,5 @@
     }
   ],
   "compatibilityDigest": "sha256:61af7d0871220bc0909008bdc571905ad500cccf853e7841bc5d462a34b2d436",
-  "contractDigest": "sha256:1de59de15caa16f233ec3b813944dc771ec530ae8d59bc797e6923bcc4b26c60"
+  "contractDigest": "sha256:9dda48dbfc95d7d8195bb131940014d8461ad984830e23a3755bf0053eaf4063"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-31T15:25:20.771Z",
-  "publishedAt": "2026-07-31T15:25:20.771Z",
+  "generatedAt": "2026-07-31T20:22:06.715Z",
+  "publishedAt": "2026-07-31T20:22:06.715Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "00a07a9a2eb0e4839727cf455fa209066166abbf",
+  "sourceRevision": "be111671f1c89e2da2fb7114cec362271e067463",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.3-alpha.2",
+    "version": "3.0.3",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.3-alpha.2",
+    "version": "3.0.3",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -616,7 +616,7 @@
       "specifier": "@kungfu-tech/buildchain/paper",
       "export": "./paper",
       "target": "./packages/core/paper.js",
-      "digest": "sha256:8c8484ae8eaec9065f32cd5cb8a90b85d7bfae00c066dfcf416971243591b61d",
+      "digest": "sha256:9e92cd56383d09ea020f7e9b80bc87ae61ab1e66f4cd771dcb5e918708b7bbc4",
       "summary": "Unified Paper work, fleet, scaffold, preflight, npm bootstrap, build, Alpha, status, and resume planning APIs.",
       "capabilityGroup": "reusable-build",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-31T15:25:20.771Z",
-  "publishedAt": "2026-07-31T15:25:20.771Z",
+  "generatedAt": "2026-07-31T20:22:06.715Z",
+  "publishedAt": "2026-07-31T20:22:06.715Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "00a07a9a2eb0e4839727cf455fa209066166abbf",
+  "sourceRevision": "be111671f1c89e2da2fb7114cec362271e067463",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.3-alpha.2",
+    "version": "3.0.3",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-31T15:25:20.771Z",
-  "publishedAt": "2026-07-31T15:25:20.771Z",
+  "generatedAt": "2026-07-31T20:22:06.715Z",
+  "publishedAt": "2026-07-31T20:22:06.715Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "00a07a9a2eb0e4839727cf455fa209066166abbf",
+  "sourceRevision": "be111671f1c89e2da2fb7114cec362271e067463",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.3-alpha.2",
+    "version": "3.0.3",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.3-alpha.2",
+  "version": "3.0.3",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/paper-fleet.js

@@ -46,6 +46,24 @@ function plannedManagedSurfaces(options) {
   }
 }
 
+function legacyBuildchainWorkflowRefs(cwd) {
+  const workflowRoot = path.resolve(cwd, ".github", "workflows");
+  if (!fs.existsSync(workflowRoot)) return [];
+  return fs
+    .readdirSync(workflowRoot, { withFileTypes: true })
+    .filter(
+      (entry) =>
+        entry.isFile() && /\.ya?ml$/i.test(entry.name),
+    )
+    .filter((entry) =>
+      /uses:\s*kungfu-systems\/buildchain\/[^\s]+@v2(?:[-.][^\s]+)?/i.test(
+        fs.readFileSync(path.join(workflowRoot, entry.name), "utf8"),
+      ),
+    )
+    .map((entry) => `.github/workflows/${entry.name}`)
+    .sort();
+}
+
 function paperFleetEntry({
   cwd,
   buildchainRoot,
@@ -78,6 +96,7 @@ function paperFleetEntry({
   const lockText = fs.existsSync(lockPath)
     ? fs.readFileSync(lockPath, "utf8")
     : "";
+  const legacyWorkflows = legacyBuildchainWorkflowRefs(cwd);
   const checks = [
     workCheck(
       "repository.canonical-origin",
@@ -112,6 +131,12 @@ function paperFleetEntry({
       "Every Buildchain-owned paper control surface matches v3.",
       "buildchain paper migrate --write --json",
     ),
+    workCheck(
+      "workflows.buildchain-v2-absent",
+      legacyWorkflows.length === 0,
+      "No workflow calls a Buildchain v2 reusable surface.",
+      "buildchain paper migrate --write --json",
+    ),
   ];
   return {
     name: path.basename(cwd),
@@ -124,6 +149,7 @@ function paperFleetEntry({
     buildchainDependency: dependency,
     expectedError: expected.error,
     managed,
+    legacyWorkflows,
     checks,
     ok: checks.every((entry) => entry.status === "pass"),
   };

package/packages/core/paper-repository.js

@@ -9,6 +9,7 @@ export const PAPER_PATHS = Object.freeze({
   versionPin: ".buildchain-version",
   contractLock: ".buildchain/contract-lock.json",
   buildWorkflow: ".github/workflows/build.yml",
+  verifyWorkflow: ".github/workflows/verify.yml",
   releaseWorkflow: ".github/workflows/paper-release.yml",
   reproducibilityReceipt:
     ".buildchain/publication/reproducibility-receipt.json",

package/packages/core/paper.js

@@ -172,11 +172,30 @@ function runtimeGitSha(buildchainRoot, buildchainVersion = "") {
   return GIT_SHA_PATTERN.test(gitHead) ? gitHead : "";
 }
 
-function runtimeAcceptedAt(buildchainRoot, sha) {
+function runtimeAcceptedAt(buildchainRoot, sha, buildchainVersion = "") {
   if (!sha) return "1970-01-01T00:00:00.000Z";
   const value = gitValue(buildchainRoot, ["show", "-s", "--format=%cI", sha]);
-  if (!value) return "1970-01-01T00:00:00.000Z";
-  const parsed = new Date(value);
+  let acceptedAt = value;
+  if (!acceptedAt && buildchainVersion) {
+    const identity = buildchainPackageIdentity(
+      buildchainRoot,
+      buildchainVersion,
+    );
+    const observed = commandResult(
+      "npm",
+      [
+        "view",
+        `${identity.name}@${identity.version}`,
+        "time",
+        "--json",
+        `--registry=${NPM_REGISTRY}`,
+      ],
+      { cwd: buildchainRoot },
+    );
+    const published = observed.ok ? safeParseJson(observed.stdout) : null;
+    acceptedAt = String(published?.[identity.version] || "");
+  }
+  const parsed = new Date(acceptedAt);
   return Number.isNaN(parsed.valueOf())
     ? "1970-01-01T00:00:00.000Z"
     : parsed.toISOString();
@@ -613,9 +632,9 @@ function scaffoldFiles({
   ).value;
   const acceptedAt =
     existingLock?.buildchain?.acceptedAt ||
-    runtimeAcceptedAt(buildchainRoot, buildchainSha);
+    runtimeAcceptedAt(buildchainRoot, buildchainSha, buildchainVersion);
   const contractLock = createBuildchainContractLock({
-    buildchainRef: buildchainSha,
+    buildchainRef,
     resolvedSha: buildchainSha,
     contractWorld,
     acceptedAt,
@@ -918,13 +937,17 @@ function migrationFiles({
     path.resolve(cwd, PAPER_PATHS.contractLock),
   ).value;
   const contractLock = createBuildchainContractLock({
-    buildchainRef: runtimeSha,
+    buildchainRef: "v3",
     resolvedSha: runtimeSha,
     contractWorld: runtimeContractWorld(buildchainRoot),
     acceptedAt:
       existingLock?.buildchain?.resolvedSha === runtimeSha
         ? existingLock.buildchain.acceptedAt
-        : runtimeAcceptedAt(buildchainRoot, runtimeSha),
+        : runtimeAcceptedAt(
+            buildchainRoot,
+            runtimeSha,
+            runtimeIdentity.version,
+          ),
   });
   const contractLockText = jsonText(contractLock);
   const buildWorkflow = scaffoldBuildWorkflow(runtimeSha, {
@@ -951,7 +974,7 @@ function migrationFiles({
     currentPackage.value,
     runtimeIdentity.version,
   );
-  return new Map([
+  const files = new Map([
     [PAPER_PATHS.contractLock, contractLockText],
     [PAPER_PATHS.versionPin, `${runtimeIdentity.version}\n`],
     [PAPER_PATHS.buildWorkflow, buildWorkflow],
@@ -959,6 +982,18 @@ function migrationFiles({
     [PAPER_PATHS.provisioningAuthority, jsonText(provisioningAuthority)],
     ["package.json", jsonText(packageJson)],
   ]);
+  const verifyWorkflowPath = path.resolve(cwd, PAPER_PATHS.verifyWorkflow);
+  if (fs.existsSync(verifyWorkflowPath)) {
+    const currentVerifyWorkflow = fs.readFileSync(verifyWorkflowPath, "utf8");
+    const migratedVerifyWorkflow = currentVerifyWorkflow.replace(
+      /(uses:\s*kungfu-systems\/buildchain\/\.github\/workflows\/check\.yml@)[^\s]+/g,
+      `$1${runtimeSha}`,
+    );
+    if (migratedVerifyWorkflow !== currentVerifyWorkflow) {
+      files.set(PAPER_PATHS.verifyWorkflow, migratedVerifyWorkflow);
+    }
+  }
+  return files;
 }
 
 export function planPaperMigration({