@kungfu-tech/buildchain 3.0.4 → 3.0.5-alpha.0

package/dist/site/public-surface-audit.json

@@ -1001,6 +1001,7 @@
           "release-passport-output-dir",
           "release-passport-platform-manifest-paths",
           "release-passport-product-name",
+          "release-propagation-config-path",
           "required-artifact-count",
           "required-status-check",
           "runner-preset",
@@ -1009,7 +1010,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 94,
+        "inputCount": 95,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1042,9 +1043,10 @@
           "publication-commit-evidence-path",
           "publication-commit-payload-root",
           "publication-commit-url",
-          "release-candidate-artifact"
+          "release-candidate-artifact",
+          "release-propagation-work-artifact"
         ],
-        "outputCount": 19
+        "outputCount": 20
       },
       {
         "id": ".release-docker",
@@ -2249,6 +2251,7 @@
           "release-passport-output-dir",
           "release-passport-platform-manifest-paths",
           "release-passport-product-name",
+          "release-propagation-config-path",
           "required-artifact-count",
           "required-status-check",
           "runner-preset",
@@ -2257,7 +2260,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 86,
+        "inputCount": 87,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2302,9 +2305,10 @@
           "publication-commit-evidence-path",
           "publication-commit-payload-root",
           "publication-commit-url",
-          "release-candidate-artifact"
+          "release-candidate-artifact",
+          "release-propagation-work-artifact"
         ],
-        "outputCount": 31
+        "outputCount": 32
       },
       {
         "id": "release-governance-reconcile",
@@ -7024,8 +7028,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "0db010925d1c60209c3dac8bc2797537f307ab21bc68084263e79004c5c16ff7",
-    "workflowRegistryDigest": "745714c3f1dcb82ad075038b6fbe3989fd2d12780dc36d04f55c12fb0836bd99",
-    "pageRegistryDigest": "99f79e716c21d622880f50dae6dc81e5aad48cb9568ace1b711009c5f0f22e0f"
+    "workflowRegistryDigest": "b5b860965abf645e1618d7840db544d638fd8ea3d0ee04ed00ccd4c8f8ccaabb",
+    "pageRegistryDigest": "fda54ffd3528f81630f0fabf91ab777a471f9d6bbd89f5f995d1dc383e077264"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-01T20:14:21.853Z",
-  "publishedAt": "2026-08-01T20:14:21.853Z",
+  "generatedAt": "2026-08-02T01:14:59.679Z",
+  "publishedAt": "2026-08-02T01:14:59.679Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "60df93f1e632388806bd1249daa392ec7c18cdbd",
+  "sourceRevision": "99ce7a8de4cd35f81d743b63d723bee2d4c26f80",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.4",
+    "version": "3.0.5-alpha.0",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-01T20:14:21.853Z",
-  "publishedAt": "2026-08-01T20:14:21.853Z",
+  "generatedAt": "2026-08-02T01:14:59.679Z",
+  "publishedAt": "2026-08-02T01:14:59.679Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "60df93f1e632388806bd1249daa392ec7c18cdbd",
+  "sourceRevision": "99ce7a8de4cd35f81d743b63d723bee2d4c26f80",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.4",
+    "version": "3.0.5-alpha.0",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -69,7 +69,7 @@
       "path": "docs/auditable-demo.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:4b3e529060ba54a439a86159a4dc0fc7fb43c8456a90e4b32579c86b20bc6bab"
+      "digest": "sha256:4d32c82b652decfbb26b441c203fe34e70daa86022bb4baed9da02a5d6cf5831"
     },
     {
       "id": "install",
@@ -133,7 +133,7 @@
       "path": "docs/release-propagation.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:d9c9b4ba9dff6ed336b1ff31e5a02fcdf68dd013278caa86510e5fd0b50c4267"
+      "digest": "sha256:3b7a2a0437f8a3a4e5cff7e05a2a8c427be597d85e93d49d5e35ba2a2b089afc"
     },
     {
       "id": "readme-badges",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ce9b018e6b1cfd98d8faa0ccadd6570585f2812b4828d610810f984f9810df5d"
+      "digest": "sha256:38f051f579fb93dc7d8b4f2c70acd622c020e867394344b5e932568cd8d2ad83"
     },
     {
       "id": "build-facts",

package/dist/site/workflow-registry.json

@@ -490,6 +490,7 @@
         "release-passport-output-dir",
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
+        "release-propagation-config-path",
         "required-artifact-count",
         "required-status-check",
         "runner-preset",
@@ -498,7 +499,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 94,
+      "inputCount": 95,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -531,9 +532,10 @@
         "publication-commit-evidence-path",
         "publication-commit-payload-root",
         "publication-commit-url",
-        "release-candidate-artifact"
+        "release-candidate-artifact",
+        "release-propagation-work-artifact"
       ],
-      "outputCount": 19,
+      "outputCount": 20,
       "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
       "status": "active",
@@ -2148,6 +2150,7 @@
         "release-passport-output-dir",
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
+        "release-propagation-config-path",
         "required-artifact-count",
         "required-status-check",
         "runner-preset",
@@ -2156,7 +2159,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 86,
+      "inputCount": 87,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2201,9 +2204,10 @@
         "publication-commit-evidence-path",
         "publication-commit-payload-root",
         "publication-commit-url",
-        "release-candidate-artifact"
+        "release-candidate-artifact",
+        "release-propagation-work-artifact"
       ],
-      "outputCount": 31,
+      "outputCount": 32,
       "surface": "release-governance",
       "capabilityGroup": "reusable-build",
       "status": "active",

package/docs/auditable-demo.md

@@ -47,6 +47,13 @@ fixed 80-200 by 24-80 terminal cells, 10,000 events, and 4 MiB of canonical
 base64 bytes. It must contain a passed completion sentinel and an explicitly
 empty authority-grant list. Existing three-file adapters remain valid.
 
+The completion sentinel names a consumer-owned versioned schema, the exact
+`qualified` status, a content root, and an event count. Buildchain validates
+that envelope generically; it does not reinterpret a command-specific result
+as Agent Work Lab evidence or grant authority from the schema name. The
+consumer projection and its retained source artifact remain responsible for
+the exact claim boundary.
+
 Terminal bytes are volatile observations, not Work, Warrant, capability, or
 publication authority. First-party or System identity, KFD compliance, Product
 System metadata, package metadata, scan output, registry history, and

package/docs/node-api-reference.md

@@ -24,7 +24,7 @@ Signatures and source locations are mechanical. JavaScript return types remain c
 
 ## `@kungfu-tech/buildchain`
 
-Target: `./packages/core/index.js`. Public symbols: 538.
+Target: `./packages/core/index.js`. Public symbols: 541.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -199,6 +199,7 @@ Target: `./packages/core/index.js`. Public symbols: 538.
 | `createKfdBadgeSpecsFromStandards` | function: function createKfdBadgeSpecsFromStandards(standardsMetadata) | standardsMetadata | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdBadgeSpecsFromStandards } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:126` |
 | `createKfdSupportProjection` | function: function createKfdSupportProjection({ matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdSupportProjection } from "@kungfu-tech/buildchain";` | `packages/core/kfd-product-gates.js:716` |
 | `createKungfuBuildInfoProjection` | function: function createKungfuBuildInfoProjection({ moduleFact, cwd = process.cwd(), now = nowIso() } = {}) | { moduleFact, cwd = process.cwd(), now = nowIso() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKungfuBuildInfoProjection } from "@kungfu-tech/buildchain";` | `packages/core/build-facts.js:520` |
+| `createPackageReleasePropagationCapture` | function: function createPackageReleasePropagationCapture({ config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {}) | { config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPackageReleasePropagationCapture } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-capture.js:101` |
 | `createPaperAlphaPlan` | function: function createPaperAlphaPlan({ cwd = process.cwd(), sourceRef = "", targetRef = "", } = {}) | { cwd = process.cwd(), sourceRef = "", targetRef = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperAlphaPlan } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:2655` |
 | `createPaperBuildPlan` | function: function createPaperBuildPlan({ cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {}) | { cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperBuildPlan } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:2592` |
 | `createPaperResumePlan` | function: function createPaperResumePlan({ cwd = process.cwd(), buildchainRef = "", } = {}) | { cwd = process.cwd(), buildchainRef = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write | `import { createPaperResumePlan } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:2713` |
@@ -362,8 +363,10 @@ Target: `./packages/core/index.js`. Public symbols: 538.
 | `normalizeKfd3DistributionDeclaration` | function: function normalizeKfd3DistributionDeclaration(distribution, { surfaceId = "surface" } = {}) | distribution, { surfaceId = "surface" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeKfd3DistributionDeclaration } from "@kungfu-tech/buildchain";` | `packages/core/kfd3-surface-register.js:73` |
 | `normalizeKfdStandardId` | function: function normalizeKfdStandardId(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeKfdStandardId } from "@kungfu-tech/buildchain";` | `packages/core/kfd.js:455` |
 | `normalizeLifecycleStage` | function: function normalizeLifecycleStage(stage, label = "lifecycle stage", lifecycle = {}) | stage, label = "lifecycle stage", lifecycle = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeLifecycleStage } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-config.js:1333` |
+| `normalizePackageReleasePropagationConfig` | function: function normalizePackageReleasePropagationConfig(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizePackageReleasePropagationConfig } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-capture.js:63` |
 | `normalizeReleasePropagationGraph` | function: function normalizeReleasePropagationGraph(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeReleasePropagationGraph } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation.js:163` |
 | `normalizeStableCandidateLedger` | function: function normalizeStableCandidateLedger(input, expected = {}) | input, expected = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeStableCandidateLedger } from "@kungfu-tech/buildchain";` | `packages/core/stable-candidate-ledger.js:76` |
+| `PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT` | constant: const PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-capture.js:17` |
 | `PAPER_ALPHA_PLAN_CONTRACT` | constant: const PAPER_ALPHA_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_ALPHA_PLAN_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:90` |
 | `PAPER_BUILD_PLAN_CONTRACT` | constant: const PAPER_BUILD_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_BUILD_PLAN_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:89` |
 | `PAPER_FLEET_AUDIT_CONTRACT` | constant: const PAPER_FLEET_AUDIT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_FLEET_AUDIT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/paper-fleet.js:19` |
@@ -615,7 +618,7 @@ Target: `./packages/core/build-facts.js`. Public symbols: 15.
 
 ## `@kungfu-tech/buildchain/core`
 
-Target: `./packages/core/index.js`. Public symbols: 538.
+Target: `./packages/core/index.js`. Public symbols: 541.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -790,6 +793,7 @@ Target: `./packages/core/index.js`. Public symbols: 538.
 | `createKfdBadgeSpecsFromStandards` | function: function createKfdBadgeSpecsFromStandards(standardsMetadata) | standardsMetadata | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdBadgeSpecsFromStandards } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:126` |
 | `createKfdSupportProjection` | function: function createKfdSupportProjection({ matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdSupportProjection } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd-product-gates.js:716` |
 | `createKungfuBuildInfoProjection` | function: function createKungfuBuildInfoProjection({ moduleFact, cwd = process.cwd(), now = nowIso() } = {}) | { moduleFact, cwd = process.cwd(), now = nowIso() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKungfuBuildInfoProjection } from "@kungfu-tech/buildchain/core";` | `packages/core/build-facts.js:520` |
+| `createPackageReleasePropagationCapture` | function: function createPackageReleasePropagationCapture({ config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {}) | { config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPackageReleasePropagationCapture } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-capture.js:101` |
 | `createPaperAlphaPlan` | function: function createPaperAlphaPlan({ cwd = process.cwd(), sourceRef = "", targetRef = "", } = {}) | { cwd = process.cwd(), sourceRef = "", targetRef = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperAlphaPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:2655` |
 | `createPaperBuildPlan` | function: function createPaperBuildPlan({ cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {}) | { cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperBuildPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:2592` |
 | `createPaperResumePlan` | function: function createPaperResumePlan({ cwd = process.cwd(), buildchainRef = "", } = {}) | { cwd = process.cwd(), buildchainRef = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write | `import { createPaperResumePlan } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:2713` |
@@ -953,8 +957,10 @@ Target: `./packages/core/index.js`. Public symbols: 538.
 | `normalizeKfd3DistributionDeclaration` | function: function normalizeKfd3DistributionDeclaration(distribution, { surfaceId = "surface" } = {}) | distribution, { surfaceId = "surface" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeKfd3DistributionDeclaration } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd3-surface-register.js:73` |
 | `normalizeKfdStandardId` | function: function normalizeKfdStandardId(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeKfdStandardId } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd.js:455` |
 | `normalizeLifecycleStage` | function: function normalizeLifecycleStage(stage, label = "lifecycle stage", lifecycle = {}) | stage, label = "lifecycle stage", lifecycle = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeLifecycleStage } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-config.js:1333` |
+| `normalizePackageReleasePropagationConfig` | function: function normalizePackageReleasePropagationConfig(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizePackageReleasePropagationConfig } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-capture.js:63` |
 | `normalizeReleasePropagationGraph` | function: function normalizeReleasePropagationGraph(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeReleasePropagationGraph } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation.js:163` |
 | `normalizeStableCandidateLedger` | function: function normalizeStableCandidateLedger(input, expected = {}) | input, expected = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeStableCandidateLedger } from "@kungfu-tech/buildchain/core";` | `packages/core/stable-candidate-ledger.js:76` |
+| `PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT` | constant: const PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-capture.js:17` |
 | `PAPER_ALPHA_PLAN_CONTRACT` | constant: const PAPER_ALPHA_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_ALPHA_PLAN_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:90` |
 | `PAPER_BUILD_PLAN_CONTRACT` | constant: const PAPER_BUILD_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_BUILD_PLAN_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:89` |
 | `PAPER_FLEET_AUDIT_CONTRACT` | constant: const PAPER_FLEET_AUDIT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_FLEET_AUDIT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/paper-fleet.js:19` |
@@ -1879,17 +1885,20 @@ Target: `./packages/core/release-passport-contract.js`. Public symbols: 5.
 
 ## `@kungfu-tech/buildchain/release-propagation`
 
-Target: `./packages/core/release-propagation.js`. Public symbols: 22.
+Target: `./packages/core/release-propagation.js`. Public symbols: 25.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | `claimReleasePropagationWork` | function: function claimReleasePropagationWork({ work, expectedWorkRoot, authority, familyState, } = {}) | { work, expectedWorkRoot, authority, familyState, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { claimReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-transitions.js:17` |
 | `completeReleasePropagationWork` | function: function completeReleasePropagationWork({ work, expectedWorkRoot, receipt, completionDecision, } = {}) | { work, expectedWorkRoot, receipt, completionDecision, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { completeReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-transitions.js:110` |
+| `createPackageReleasePropagationCapture` | function: function createPackageReleasePropagationCapture({ config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {}) | { config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPackageReleasePropagationCapture } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-capture.js:101` |
 | `createReleasePropagationLock` | function: function createReleasePropagationLock({ graph, edge, sourceNode, targetNode, upstreamRelease, downstreamChannel, } = {}) | { graph, edge, sourceNode, targetNode, upstreamRelease, downstreamChannel, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createReleasePropagationLock } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:199` |
 | `createReleasePropagationReceipt` | function: function createReleasePropagationReceipt({ plan, target = "", lockResult, prOutcome, stagingState = "pending", productionState = "not-requested", observedAt = "", } = {}) | { plan, target = "", lockResult, prOutcome, stagingState = "pending", productionState = "not-requested", observedAt = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createReleasePropagationReceipt } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:370` |
 | `createReleasePropagationStageReceipt` | function: function createReleasePropagationStageReceipt({ work, stage, outcome = "success", observedAt, actor, summary, evidence, failure = null, } = {}) | { work, stage, outcome = "success", observedAt, actor, summary, evidence, failure = null, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createReleasePropagationStageReceipt } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:214` |
 | `createReleasePropagationWork` | function: function createReleasePropagationWork({ plan, target = "", workContext, expectedDownstreamBaseSha, } = {}) | { plan, target = "", workContext, expectedDownstreamBaseSha, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:111` |
+| `normalizePackageReleasePropagationConfig` | function: function normalizePackageReleasePropagationConfig(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizePackageReleasePropagationConfig } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-capture.js:63` |
 | `normalizeReleasePropagationGraph` | function: function normalizeReleasePropagationGraph(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeReleasePropagationGraph } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:163` |
+| `PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT` | constant: const PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-capture.js:17` |
 | `planReleasePropagation` | function: function planReleasePropagation({ graph: graphInput, upstreamRelease: releaseInput, sourceNode = "" } = {}) | { graph: graphInput, upstreamRelease: releaseInput, sourceNode = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { planReleasePropagation } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:248` |
 | `readReleasePropagationJson` | function: function readReleasePropagationJson(value, { cwd = process.cwd(), label = "json" } = {}) | value, { cwd = process.cwd(), label = "json" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { readReleasePropagationJson } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:304` |
 | `recordReleasePropagationStage` | function: function recordReleasePropagationStage({ work, expectedWorkRoot, receipt } = {}) | { work, expectedWorkRoot, receipt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordReleasePropagationStage } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-transitions.js:45` |

package/docs/release-propagation.md

@@ -316,6 +316,40 @@ target; publication itself does not open a Site PR.
 }
 ```
 
+A managed npm package uses the parallel generic contract and passes its path to
+the release-candidate promotion workflow:
+
+```json
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-package-release-propagation",
+  "sourceNode": "kfd",
+  "graph": {
+    "schemaVersion": 1,
+    "contract": "kungfu-buildchain-release-propagation-graph",
+    "nodes": [],
+    "edges": []
+  },
+  "targets": ["site-libkungfu-dev"]
+}
+```
+
+```yaml
+with:
+  release-propagation-config-path: .buildchain/release-propagation.json
+```
+
+The config is read with `git show` from the exact finalized release SHA. Its
+root fields, graph fields, nodes, edges, targets, and execution profiles reject
+unknown fields. After npm publication and the public GitHub Release are
+complete, Buildchain independently reads npm `version`, `dist.integrity`, and
+`gitHead`, resolves annotated Git tags to their commit, downloads the public
+`buildchain.release.json` asset, and compares its bytes with the finalized
+Passport. Only an exact source SHA, tag target, npm `gitHead`, package version,
+integrity, and Passport digest can produce the capture artifact. The promotion
+output `release-propagation-work-artifact` names the restart-safe artifact set.
+No downstream checkout, branch, or pull request is created by this step.
+
 Each graph target owns an exact GitHub web-surface execution profile: workflow,
 base and managed branch, lock path, consumer commands, production status URL,
 and production artifact readback URLs. The sealed workflow rejects extra config

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.4",
+  "version": "3.0.5-alpha.0",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/release-propagation-capture.js

@@ -0,0 +1,150 @@
+import {
+  assertCommitSha,
+} from "./release-propagation-work-control.js";
+import {
+  assertExactFields,
+  assertPlainObject,
+  assertString,
+} from "./release-propagation-common.js";
+import {
+  createReleasePropagationWork,
+  normalizeReleasePropagationGraph,
+  planReleasePropagation,
+  verifyReleasePropagationWork,
+} from "./release-propagation.js";
+import { normalizeUpstreamRelease } from "./release-propagation-release.js";
+
+export const PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT =
+  "kungfu-buildchain-package-release-propagation";
+
+function assertAllowedFields(value, allowed, required, label) {
+  const object = assertPlainObject(value, label);
+  const unknown = Object.keys(object).filter((field) => !allowed.has(field));
+  if (unknown.length > 0) {
+    throw new Error(`${label} has unknown fields: ${unknown.sort().join(", ")}`);
+  }
+  for (const field of required) {
+    if (!(field in object)) throw new Error(`${label}.${field} is required`);
+  }
+  return object;
+}
+
+function assertStrictGraph(graph) {
+  const value = assertAllowedFields(
+    graph,
+    new Set(["schemaVersion", "contract", "channelPolicy", "nodes", "edges"]),
+    ["schemaVersion", "contract", "nodes", "edges"],
+    "package release propagation config graph",
+  );
+  if (!Array.isArray(value.nodes) || !Array.isArray(value.edges)) {
+    throw new Error("package release propagation config graph nodes and edges must be arrays");
+  }
+  value.nodes.forEach((node, index) => assertAllowedFields(
+    node,
+    new Set([
+      "id", "repository", "package", "lockPath", "baseRef", "workflow",
+      "executionProfile",
+    ]),
+    ["id", "repository"],
+    `package release propagation config graph nodes[${index}]`,
+  ));
+  value.edges.forEach((edge, index) => assertAllowedFields(
+    edge,
+    new Set([
+      "id", "from", "to", "channels", "channelPolicy", "channelMap",
+      "lockPath", "prBaseRef",
+    ]),
+    ["from", "to"],
+    `package release propagation config graph edges[${index}]`,
+  ));
+  return normalizeReleasePropagationGraph(value);
+}
+
+export function normalizePackageReleasePropagationConfig(input) {
+  const config = assertExactFields(input, [
+    "schemaVersion", "contract", "sourceNode", "graph", "targets",
+  ], "package release propagation config");
+  if (config.schemaVersion !== 1 || config.contract !== PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT) {
+    throw new Error(`package release propagation config must use ${PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT} v1`);
+  }
+  const sourceNode = assertString(config.sourceNode, "package release propagation config sourceNode");
+  if (!/^[A-Za-z0-9._-]+$/.test(sourceNode)) {
+    throw new Error("package release propagation config sourceNode must be a canonical node id");
+  }
+  if (!Array.isArray(config.targets) || config.targets.length === 0) {
+    throw new Error("package release propagation config targets must be a non-empty array");
+  }
+  const targets = config.targets.map((target, index) => {
+    const value = assertString(target, `package release propagation config targets[${index}]`);
+    if (!/^[A-Za-z0-9._-]+$/.test(value)) {
+      throw new Error("package release propagation config targets must be canonical node ids");
+    }
+    return value;
+  });
+  const canonicalTargets = [...new Set(targets)].sort();
+  if (JSON.stringify(targets) !== JSON.stringify(canonicalTargets)) {
+    throw new Error("package release propagation config targets must be sorted and unique");
+  }
+  const graph = assertStrictGraph(config.graph);
+  const source = graph.nodes.find((node) => node.id === sourceNode);
+  if (!source) throw new Error("package release propagation config sourceNode is absent from graph");
+  if (!source.package) throw new Error("package release propagation source node must declare a package");
+  return {
+    schemaVersion: 1,
+    contract: PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT,
+    sourceNode,
+    graph,
+    targets: canonicalTargets,
+  };
+}
+
+export function createPackageReleasePropagationCapture({
+  config: configInput,
+  upstreamRelease: upstreamReleaseInput,
+  expectedBaseShas = {},
+} = {}) {
+  const config = normalizePackageReleasePropagationConfig(configInput);
+  const upstreamRelease = normalizeUpstreamRelease(upstreamReleaseInput);
+  const source = config.graph.nodes.find((node) => node.id === config.sourceNode);
+  if (source.repository !== upstreamRelease.repository) {
+    throw new Error("package release propagation source repository disagrees with release envelope");
+  }
+  if (source.package !== upstreamRelease.package?.name) {
+    throw new Error("package release propagation source package disagrees with release envelope");
+  }
+  const plan = planReleasePropagation({
+    graph: config.graph,
+    upstreamRelease,
+    sourceNode: config.sourceNode,
+  });
+  const plannedTargets = plan.targets.map((target) => target.target).sort();
+  if (JSON.stringify(plannedTargets) !== JSON.stringify(config.targets)) {
+    throw new Error("package release propagation targets must exactly match the release-channel plan");
+  }
+  const works = plan.targets.map((target) => {
+    const expectedBaseSha = expectedBaseShas[target.target]
+      || expectedBaseShas[target.repository]
+      || "";
+    assertCommitSha(
+      expectedBaseSha,
+      `expected downstream base SHA for ${target.target}`,
+    );
+    const work = createReleasePropagationWork({
+      plan,
+      target: target.target,
+      expectedDownstreamBaseSha: expectedBaseSha,
+    });
+    const status = verifyReleasePropagationWork(work);
+    if (status.lifecycle !== "paused" || status.nextAction?.action !== "claim") {
+      throw new Error("captured package propagation work must remain paused at claim");
+    }
+    return {
+      target: target.target,
+      repository: target.repository,
+      propagationKey: target.propagationKey,
+      work,
+      status,
+    };
+  });
+  return { config, upstreamRelease, plan, works };
+}

package/packages/core/release-propagation-stage-evidence.js

@@ -58,7 +58,7 @@ function exactClaims(entry, fields, label) {
 function releaseClaims(work) {
   return {
     releaseRoot: work.upstream.releaseRoot,
-    releaseLockRoot: work.downstream.releaseLockRoot,
+    releaseLockRoot: `sha256:${work.downstream.lockSha256}`,
     sourceSha: work.upstream.release.sourceSha,
     tagTargetSha: work.upstream.release.tagTargetSha,
   };

package/packages/core/release-propagation.js

@@ -471,3 +471,8 @@ export {
   recordReleasePropagationStage,
   repairReleasePropagationWork,
 } from "./release-propagation-work-transitions.js";
+export {
+  PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT,
+  createPackageReleasePropagationCapture,
+  normalizePackageReleasePropagationConfig,
+} from "./release-propagation-capture.js";

package/scripts/auditable-demo-renditions.mjs

@@ -16,7 +16,6 @@ const RENDITION_SET_NON_AUTHORITIES = [
   "runtime-authority",
   ...TERMINAL_CAPTURE_NON_AUTHORITIES,
 ];
-
 export function validateTerminalCapture(value, scene, helpers) {
   const { decodeBase64, digestPattern, exactKeys, integer, invariant, maxBytes, maxEvents, text } = helpers;
   exactKeys(
@@ -53,10 +52,10 @@ export function validateTerminalCapture(value, scene, helpers) {
   }
   exactKeys(value.completion, ["schema", "status", "reportRoot", "eventCount"], [], "terminalCapture.completion");
   invariant(
-    value.completion.schema === "kungfu.agent-work-lab.tui-autoplay/v1"
+    /^[a-z0-9][a-z0-9._/-]*\/v[1-9][0-9]*$/u.test(value.completion.schema)
       && value.completion.status === "qualified"
       && digestPattern.test(value.completion.reportRoot),
-    "terminal capture completion sentinel is not a qualified Agent Work Lab autoplay",
+    "terminal capture completion sentinel is not a qualified versioned result",
   );
   integer(value.completion.eventCount, 1, 100_000, "terminalCapture.completion.eventCount");
   invariant(value.exitCode === 0, "terminal capture exitCode must be zero");