@kungfu-tech/buildchain 3.0.4 → 3.0.5-alpha.1

package/dist/site/public-surface-audit.json

@@ -1001,6 +1001,7 @@
           "release-passport-output-dir",
           "release-passport-platform-manifest-paths",
           "release-passport-product-name",
+          "release-propagation-config-path",
           "required-artifact-count",
           "required-status-check",
           "runner-preset",
@@ -1009,7 +1010,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 94,
+        "inputCount": 95,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1042,9 +1043,10 @@
           "publication-commit-evidence-path",
           "publication-commit-payload-root",
           "publication-commit-url",
-          "release-candidate-artifact"
+          "release-candidate-artifact",
+          "release-propagation-work-artifact"
         ],
-        "outputCount": 19
+        "outputCount": 20
       },
       {
         "id": ".release-docker",
@@ -2249,6 +2251,7 @@
           "release-passport-output-dir",
           "release-passport-platform-manifest-paths",
           "release-passport-product-name",
+          "release-propagation-config-path",
           "required-artifact-count",
           "required-status-check",
           "runner-preset",
@@ -2257,7 +2260,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 86,
+        "inputCount": 87,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2302,9 +2305,10 @@
           "publication-commit-evidence-path",
           "publication-commit-payload-root",
           "publication-commit-url",
-          "release-candidate-artifact"
+          "release-candidate-artifact",
+          "release-propagation-work-artifact"
         ],
-        "outputCount": 31
+        "outputCount": 32
       },
       {
         "id": "release-governance-reconcile",
@@ -7024,8 +7028,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "0db010925d1c60209c3dac8bc2797537f307ab21bc68084263e79004c5c16ff7",
-    "workflowRegistryDigest": "745714c3f1dcb82ad075038b6fbe3989fd2d12780dc36d04f55c12fb0836bd99",
-    "pageRegistryDigest": "99f79e716c21d622880f50dae6dc81e5aad48cb9568ace1b711009c5f0f22e0f"
+    "workflowRegistryDigest": "b5b860965abf645e1618d7840db544d638fd8ea3d0ee04ed00ccd4c8f8ccaabb",
+    "pageRegistryDigest": "13e408bcfe519ed58f0723980506c522bf124921883c880ac89258db28b06ce5"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-01T20:14:21.853Z",
-  "publishedAt": "2026-08-01T20:14:21.853Z",
+  "generatedAt": "2026-08-02T02:26:15.287Z",
+  "publishedAt": "2026-08-02T02:26:15.287Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "60df93f1e632388806bd1249daa392ec7c18cdbd",
+  "sourceRevision": "8b96fb02e587124bad0f9055f9de6eb7c6b8081c",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.4",
+    "version": "3.0.5-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-01T20:14:21.853Z",
-  "publishedAt": "2026-08-01T20:14:21.853Z",
+  "generatedAt": "2026-08-02T02:26:15.287Z",
+  "publishedAt": "2026-08-02T02:26:15.287Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "60df93f1e632388806bd1249daa392ec7c18cdbd",
+  "sourceRevision": "8b96fb02e587124bad0f9055f9de6eb7c6b8081c",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.4",
+    "version": "3.0.5-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -69,7 +69,7 @@
       "path": "docs/auditable-demo.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:4b3e529060ba54a439a86159a4dc0fc7fb43c8456a90e4b32579c86b20bc6bab"
+      "digest": "sha256:4d32c82b652decfbb26b441c203fe34e70daa86022bb4baed9da02a5d6cf5831"
     },
     {
       "id": "install",
@@ -133,7 +133,7 @@
       "path": "docs/release-propagation.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:d9c9b4ba9dff6ed336b1ff31e5a02fcdf68dd013278caa86510e5fd0b50c4267"
+      "digest": "sha256:3b7a2a0437f8a3a4e5cff7e05a2a8c427be597d85e93d49d5e35ba2a2b089afc"
     },
     {
       "id": "readme-badges",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ce9b018e6b1cfd98d8faa0ccadd6570585f2812b4828d610810f984f9810df5d"
+      "digest": "sha256:38f051f579fb93dc7d8b4f2c70acd622c020e867394344b5e932568cd8d2ad83"
     },
     {
       "id": "build-facts",
@@ -285,7 +285,7 @@
       "path": "docs/publish-transaction.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:9b830727e5b0d2192c937f19106c11ea5064dde77e30d290825f343df47f291b"
+      "digest": "sha256:3a9ef099d5d93d9b558c7b6a0aa4403dfcce1479ce5d6fc36ecb3e34cdd5bb6d"
     },
     {
       "id": "release-governance",
@@ -293,7 +293,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:60ec90d3294818d3c53e403312801a8ab47be7c0f34810002676fbfcdbceaa60"
+      "digest": "sha256:96d78f800cd7d43d3a47a11863d4813711e360418ba33a4284688389c7e4b70c"
     },
     {
       "id": "release-flow",
@@ -301,7 +301,7 @@
       "path": "docs/release-flow.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:bac959565c36cf39c3cd30dfce00dbbb59b73ed21b852a8f24a6cae281cb5f05"
+      "digest": "sha256:dc54b8a264489341984ca6157b07d1956e934366f937b7412a21df7f025d2d8d"
     },
     {
       "id": "runtime-train-validation",

package/dist/site/workflow-registry.json

@@ -490,6 +490,7 @@
         "release-passport-output-dir",
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
+        "release-propagation-config-path",
         "required-artifact-count",
         "required-status-check",
         "runner-preset",
@@ -498,7 +499,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 94,
+      "inputCount": 95,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -531,9 +532,10 @@
         "publication-commit-evidence-path",
         "publication-commit-payload-root",
         "publication-commit-url",
-        "release-candidate-artifact"
+        "release-candidate-artifact",
+        "release-propagation-work-artifact"
       ],
-      "outputCount": 19,
+      "outputCount": 20,
       "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
       "status": "active",
@@ -2148,6 +2150,7 @@
         "release-passport-output-dir",
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
+        "release-propagation-config-path",
         "required-artifact-count",
         "required-status-check",
         "runner-preset",
@@ -2156,7 +2159,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 86,
+      "inputCount": 87,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2201,9 +2204,10 @@
         "publication-commit-evidence-path",
         "publication-commit-payload-root",
         "publication-commit-url",
-        "release-candidate-artifact"
+        "release-candidate-artifact",
+        "release-propagation-work-artifact"
       ],
-      "outputCount": 31,
+      "outputCount": 32,
       "surface": "release-governance",
       "capabilityGroup": "reusable-build",
       "status": "active",

package/docs/auditable-demo.md

@@ -47,6 +47,13 @@ fixed 80-200 by 24-80 terminal cells, 10,000 events, and 4 MiB of canonical
 base64 bytes. It must contain a passed completion sentinel and an explicitly
 empty authority-grant list. Existing three-file adapters remain valid.
 
+The completion sentinel names a consumer-owned versioned schema, the exact
+`qualified` status, a content root, and an event count. Buildchain validates
+that envelope generically; it does not reinterpret a command-specific result
+as Agent Work Lab evidence or grant authority from the schema name. The
+consumer projection and its retained source artifact remain responsible for
+the exact claim boundary.
+
 Terminal bytes are volatile observations, not Work, Warrant, capability, or
 publication authority. First-party or System identity, KFD compliance, Product
 System metadata, package metadata, scan output, registry history, and

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -8,7 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-07-30
+last_reviewed: 2026-08-01
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-01
+  invisible_information: No hidden model checkpoint, parameters, or private training data were available.
 ---
 
 # AWS US elastic runner burst plane
@@ -226,6 +231,32 @@ host, including at least one full run, plus proof that:
 - AWS has no active campaign instance or allocated campaign host;
 - actual incremental spend remained below USD 25.
 
+### Phase 3 lifecycle controller
+
+`scripts/aws-macos-jit-controller.mjs` is the operator boundary for the paid
+campaign. It has three explicit mutation modes:
+
+- `launch-campaign` binds the exact repository source, AMI, availability zone,
+  tagged Dedicated Host, and reusable instance. It rejects pre-existing Mac
+  capacity and requires successful `AllocateHosts` and `RunInstances` DryRuns
+  before either real call.
+- `run-job` binds one queued exact-source GitHub job to the existing campaign
+  host and instance. It writes the repository JIT configuration through a
+  mode-0600 temporary file into a distinct SSM SecureString, sends only the
+  credential-free bootstrap through SSM, and removes the parameter plus runner
+  registration if command delivery fails.
+- `close-campaign` refuses execution before the provider's 24-hour minimum,
+  verifies the encrypted delete-on-termination root volume, removes scoped JIT
+  residue, terminates the exact instance, and requires a `ReleaseHosts` DryRun
+  before release. If Apple host scrubbing is still in progress, it reports
+  `release-pending`; the ten-minute card-scoped reaper remains the bounded
+  retry path.
+
+Every execute mode requires the exact source SHA and campaign id to be repeated
+through `--confirm-source-sha` and `--confirm-campaign-id`. `run-job` also
+requires `--confirm-run-id`. Omitting `--execute` emits a deterministic plan
+without changing AWS or GitHub state.
+
 ## Provider lifecycle
 
 The three infrastructure templates live under

package/docs/node-api-reference.md

@@ -24,7 +24,7 @@ Signatures and source locations are mechanical. JavaScript return types remain c
 
 ## `@kungfu-tech/buildchain`
 
-Target: `./packages/core/index.js`. Public symbols: 538.
+Target: `./packages/core/index.js`. Public symbols: 541.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -199,6 +199,7 @@ Target: `./packages/core/index.js`. Public symbols: 538.
 | `createKfdBadgeSpecsFromStandards` | function: function createKfdBadgeSpecsFromStandards(standardsMetadata) | standardsMetadata | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdBadgeSpecsFromStandards } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:126` |
 | `createKfdSupportProjection` | function: function createKfdSupportProjection({ matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdSupportProjection } from "@kungfu-tech/buildchain";` | `packages/core/kfd-product-gates.js:716` |
 | `createKungfuBuildInfoProjection` | function: function createKungfuBuildInfoProjection({ moduleFact, cwd = process.cwd(), now = nowIso() } = {}) | { moduleFact, cwd = process.cwd(), now = nowIso() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKungfuBuildInfoProjection } from "@kungfu-tech/buildchain";` | `packages/core/build-facts.js:520` |
+| `createPackageReleasePropagationCapture` | function: function createPackageReleasePropagationCapture({ config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {}) | { config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPackageReleasePropagationCapture } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-capture.js:101` |
 | `createPaperAlphaPlan` | function: function createPaperAlphaPlan({ cwd = process.cwd(), sourceRef = "", targetRef = "", } = {}) | { cwd = process.cwd(), sourceRef = "", targetRef = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperAlphaPlan } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:2655` |
 | `createPaperBuildPlan` | function: function createPaperBuildPlan({ cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {}) | { cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperBuildPlan } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:2592` |
 | `createPaperResumePlan` | function: function createPaperResumePlan({ cwd = process.cwd(), buildchainRef = "", } = {}) | { cwd = process.cwd(), buildchainRef = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write | `import { createPaperResumePlan } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:2713` |
@@ -362,8 +363,10 @@ Target: `./packages/core/index.js`. Public symbols: 538.
 | `normalizeKfd3DistributionDeclaration` | function: function normalizeKfd3DistributionDeclaration(distribution, { surfaceId = "surface" } = {}) | distribution, { surfaceId = "surface" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeKfd3DistributionDeclaration } from "@kungfu-tech/buildchain";` | `packages/core/kfd3-surface-register.js:73` |
 | `normalizeKfdStandardId` | function: function normalizeKfdStandardId(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeKfdStandardId } from "@kungfu-tech/buildchain";` | `packages/core/kfd.js:455` |
 | `normalizeLifecycleStage` | function: function normalizeLifecycleStage(stage, label = "lifecycle stage", lifecycle = {}) | stage, label = "lifecycle stage", lifecycle = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeLifecycleStage } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-config.js:1333` |
+| `normalizePackageReleasePropagationConfig` | function: function normalizePackageReleasePropagationConfig(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizePackageReleasePropagationConfig } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-capture.js:63` |
 | `normalizeReleasePropagationGraph` | function: function normalizeReleasePropagationGraph(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeReleasePropagationGraph } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation.js:163` |
 | `normalizeStableCandidateLedger` | function: function normalizeStableCandidateLedger(input, expected = {}) | input, expected = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeStableCandidateLedger } from "@kungfu-tech/buildchain";` | `packages/core/stable-candidate-ledger.js:76` |
+| `PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT` | constant: const PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-capture.js:17` |
 | `PAPER_ALPHA_PLAN_CONTRACT` | constant: const PAPER_ALPHA_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_ALPHA_PLAN_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:90` |
 | `PAPER_BUILD_PLAN_CONTRACT` | constant: const PAPER_BUILD_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_BUILD_PLAN_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:89` |
 | `PAPER_FLEET_AUDIT_CONTRACT` | constant: const PAPER_FLEET_AUDIT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_FLEET_AUDIT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/paper-fleet.js:19` |
@@ -615,7 +618,7 @@ Target: `./packages/core/build-facts.js`. Public symbols: 15.
 
 ## `@kungfu-tech/buildchain/core`
 
-Target: `./packages/core/index.js`. Public symbols: 538.
+Target: `./packages/core/index.js`. Public symbols: 541.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -790,6 +793,7 @@ Target: `./packages/core/index.js`. Public symbols: 538.
 | `createKfdBadgeSpecsFromStandards` | function: function createKfdBadgeSpecsFromStandards(standardsMetadata) | standardsMetadata | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdBadgeSpecsFromStandards } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:126` |
 | `createKfdSupportProjection` | function: function createKfdSupportProjection({ matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdSupportProjection } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd-product-gates.js:716` |
 | `createKungfuBuildInfoProjection` | function: function createKungfuBuildInfoProjection({ moduleFact, cwd = process.cwd(), now = nowIso() } = {}) | { moduleFact, cwd = process.cwd(), now = nowIso() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKungfuBuildInfoProjection } from "@kungfu-tech/buildchain/core";` | `packages/core/build-facts.js:520` |
+| `createPackageReleasePropagationCapture` | function: function createPackageReleasePropagationCapture({ config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {}) | { config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPackageReleasePropagationCapture } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-capture.js:101` |
 | `createPaperAlphaPlan` | function: function createPaperAlphaPlan({ cwd = process.cwd(), sourceRef = "", targetRef = "", } = {}) | { cwd = process.cwd(), sourceRef = "", targetRef = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperAlphaPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:2655` |
 | `createPaperBuildPlan` | function: function createPaperBuildPlan({ cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {}) | { cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperBuildPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:2592` |
 | `createPaperResumePlan` | function: function createPaperResumePlan({ cwd = process.cwd(), buildchainRef = "", } = {}) | { cwd = process.cwd(), buildchainRef = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write | `import { createPaperResumePlan } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:2713` |
@@ -953,8 +957,10 @@ Target: `./packages/core/index.js`. Public symbols: 538.
 | `normalizeKfd3DistributionDeclaration` | function: function normalizeKfd3DistributionDeclaration(distribution, { surfaceId = "surface" } = {}) | distribution, { surfaceId = "surface" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeKfd3DistributionDeclaration } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd3-surface-register.js:73` |
 | `normalizeKfdStandardId` | function: function normalizeKfdStandardId(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeKfdStandardId } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd.js:455` |
 | `normalizeLifecycleStage` | function: function normalizeLifecycleStage(stage, label = "lifecycle stage", lifecycle = {}) | stage, label = "lifecycle stage", lifecycle = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeLifecycleStage } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-config.js:1333` |
+| `normalizePackageReleasePropagationConfig` | function: function normalizePackageReleasePropagationConfig(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizePackageReleasePropagationConfig } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-capture.js:63` |
 | `normalizeReleasePropagationGraph` | function: function normalizeReleasePropagationGraph(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeReleasePropagationGraph } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation.js:163` |
 | `normalizeStableCandidateLedger` | function: function normalizeStableCandidateLedger(input, expected = {}) | input, expected = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeStableCandidateLedger } from "@kungfu-tech/buildchain/core";` | `packages/core/stable-candidate-ledger.js:76` |
+| `PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT` | constant: const PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-capture.js:17` |
 | `PAPER_ALPHA_PLAN_CONTRACT` | constant: const PAPER_ALPHA_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_ALPHA_PLAN_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:90` |
 | `PAPER_BUILD_PLAN_CONTRACT` | constant: const PAPER_BUILD_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_BUILD_PLAN_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:89` |
 | `PAPER_FLEET_AUDIT_CONTRACT` | constant: const PAPER_FLEET_AUDIT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_FLEET_AUDIT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/paper-fleet.js:19` |
@@ -1879,17 +1885,20 @@ Target: `./packages/core/release-passport-contract.js`. Public symbols: 5.
 
 ## `@kungfu-tech/buildchain/release-propagation`
 
-Target: `./packages/core/release-propagation.js`. Public symbols: 22.
+Target: `./packages/core/release-propagation.js`. Public symbols: 25.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | `claimReleasePropagationWork` | function: function claimReleasePropagationWork({ work, expectedWorkRoot, authority, familyState, } = {}) | { work, expectedWorkRoot, authority, familyState, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { claimReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-transitions.js:17` |
 | `completeReleasePropagationWork` | function: function completeReleasePropagationWork({ work, expectedWorkRoot, receipt, completionDecision, } = {}) | { work, expectedWorkRoot, receipt, completionDecision, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { completeReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-transitions.js:110` |
+| `createPackageReleasePropagationCapture` | function: function createPackageReleasePropagationCapture({ config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {}) | { config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPackageReleasePropagationCapture } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-capture.js:101` |
 | `createReleasePropagationLock` | function: function createReleasePropagationLock({ graph, edge, sourceNode, targetNode, upstreamRelease, downstreamChannel, } = {}) | { graph, edge, sourceNode, targetNode, upstreamRelease, downstreamChannel, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createReleasePropagationLock } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:199` |
 | `createReleasePropagationReceipt` | function: function createReleasePropagationReceipt({ plan, target = "", lockResult, prOutcome, stagingState = "pending", productionState = "not-requested", observedAt = "", } = {}) | { plan, target = "", lockResult, prOutcome, stagingState = "pending", productionState = "not-requested", observedAt = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createReleasePropagationReceipt } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:370` |
 | `createReleasePropagationStageReceipt` | function: function createReleasePropagationStageReceipt({ work, stage, outcome = "success", observedAt, actor, summary, evidence, failure = null, } = {}) | { work, stage, outcome = "success", observedAt, actor, summary, evidence, failure = null, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createReleasePropagationStageReceipt } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:214` |
 | `createReleasePropagationWork` | function: function createReleasePropagationWork({ plan, target = "", workContext, expectedDownstreamBaseSha, } = {}) | { plan, target = "", workContext, expectedDownstreamBaseSha, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:111` |
+| `normalizePackageReleasePropagationConfig` | function: function normalizePackageReleasePropagationConfig(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizePackageReleasePropagationConfig } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-capture.js:63` |
 | `normalizeReleasePropagationGraph` | function: function normalizeReleasePropagationGraph(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeReleasePropagationGraph } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:163` |
+| `PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT` | constant: const PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-capture.js:17` |
 | `planReleasePropagation` | function: function planReleasePropagation({ graph: graphInput, upstreamRelease: releaseInput, sourceNode = "" } = {}) | { graph: graphInput, upstreamRelease: releaseInput, sourceNode = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { planReleasePropagation } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:248` |
 | `readReleasePropagationJson` | function: function readReleasePropagationJson(value, { cwd = process.cwd(), label = "json" } = {}) | value, { cwd = process.cwd(), label = "json" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { readReleasePropagationJson } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:304` |
 | `recordReleasePropagationStage` | function: function recordReleasePropagationStage({ work, expectedWorkRoot, receipt } = {}) | { work, expectedWorkRoot, receipt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordReleasePropagationStage } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-transitions.js:45` |

package/docs/publish-transaction.md

@@ -415,9 +415,10 @@ first run can stop at `finalizing` after registry publication. If the reviewed
 merge commit later contains that exact transaction release material but the
 exact tag is still absent, a retry performs finalization only: it reloads the
 same durable source, release material, tooling, evidence, version, and target
-bindings; creates the exact and floating tags at the transaction release SHA;
-and completes the passport from the transaction source tree. It does not rerun
-the provider mutation and does not authorize the newer composite channel tree
+bindings; creates the exact tag at the transaction source SHA; moves floating
+refs to the transaction release SHA; and completes the passport from the
+transaction source tree. It does not rerun the provider mutation and does not
+authorize the newer composite channel tree
 as published material. A different source tree still requires a new version and
 a fresh release candidate.
 
@@ -536,8 +537,9 @@ inside the mutation boundary.
 
 If finalization fails after an exact Git tag is created, the next run reads the
 durable `finalizing` state, verifies the exact tag points at the recorded
-release SHA, and retries the remaining floating refs. An exact tag at a
-different SHA is a material conflict and blocks recovery.
+source SHA (while accepting legacy release/material targets for recovery), and
+retries the remaining floating refs. An exact tag at an unrelated SHA is a
+material conflict and blocks recovery.
 
 ## CLI Recovery
 

package/docs/release-flow.md

@@ -96,6 +96,10 @@ published artifacts are already durable.
 The intended governance split is:
 
 - exact tags such as `v3.0.2` and `v3.0.3-alpha.0` are immutable audit refs;
+- for publish transactions, the exact tag points to the transaction
+  `source_sha`, matching package-registry source metadata such as npm
+  `gitHead`; generated version-state commits remain on protected branches and
+  floating channel refs;
 - floating tags such as `v3`, `v3.0`, `v3.0-alpha`, and `v3-alpha` are mutable channel refs
   owned by the Buildchain promotion token;
 - protected branches still require reviewed channel PRs before Buildchain can

package/docs/release-governance.md

@@ -831,6 +831,13 @@ must be absent or already point at accepted release material. This preserves an
 immutable tag that represents a completed transaction while allowing a tag
 collision discovered after registry publication to recover without republishing.
 
+For package publish transactions, the immutable public version tag points to
+the transaction `source_sha`, so registry source metadata such as npm `gitHead`
+and the Git tag identify the same source commit. Protected branches and mutable
+channel tags continue to point to the generated `release_sha`. Recovery accepts
+older completed transactions whose exact tags already point to recorded release
+or release-material SHAs, but new tags are source-bound.
+
 Every Buildchain publish model that can run registry side effects must bind the
 publish entrypoint to an immutable `publish-gate/*` source lock. The reusable
 `release-candidate-promote.yml@v3` wrapper creates or updates that gate ref and

package/docs/release-propagation.md

@@ -316,6 +316,40 @@ target; publication itself does not open a Site PR.
 }
 ```
 
+A managed npm package uses the parallel generic contract and passes its path to
+the release-candidate promotion workflow:
+
+```json
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-package-release-propagation",
+  "sourceNode": "kfd",
+  "graph": {
+    "schemaVersion": 1,
+    "contract": "kungfu-buildchain-release-propagation-graph",
+    "nodes": [],
+    "edges": []
+  },
+  "targets": ["site-libkungfu-dev"]
+}
+```
+
+```yaml
+with:
+  release-propagation-config-path: .buildchain/release-propagation.json
+```
+
+The config is read with `git show` from the exact finalized release SHA. Its
+root fields, graph fields, nodes, edges, targets, and execution profiles reject
+unknown fields. After npm publication and the public GitHub Release are
+complete, Buildchain independently reads npm `version`, `dist.integrity`, and
+`gitHead`, resolves annotated Git tags to their commit, downloads the public
+`buildchain.release.json` asset, and compares its bytes with the finalized
+Passport. Only an exact source SHA, tag target, npm `gitHead`, package version,
+integrity, and Passport digest can produce the capture artifact. The promotion
+output `release-propagation-work-artifact` names the restart-safe artifact set.
+No downstream checkout, branch, or pull request is created by this step.
+
 Each graph target owns an exact GitHub web-surface execution profile: workflow,
 base and managed branch, lock path, consumer commands, production status URL,
 and production artifact readback URLs. The sealed workflow rejects extra config

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.4",
+  "version": "3.0.5-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",