@kungfu-tech/buildchain 3.0.5-alpha.8 → 3.0.6-alpha.0

package/dist/site/public-surface-audit.json

@@ -4,10 +4,10 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 112,
-    "workflowCount": 59,
+    "workflowCount": 60,
     "actionCount": 6,
-    "sitePageCount": 63,
-    "docCommandRefCount": 822,
+    "sitePageCount": 64,
+    "docCommandRefCount": 830,
     "failureCount": 0
   },
   "enumerated": {
@@ -490,7 +490,7 @@
       {
         "id": "release-propagation",
         "source": "bin/buildchain.mjs",
-        "usage": "buildchain release-propagation <plan|write-lock|work|pickup> ..."
+        "usage": "buildchain release-propagation <plan|write-lock|work|entry|pickup> ..."
       },
       {
         "id": "release-transaction",
@@ -699,6 +699,8 @@
           "linux-container-preset",
           "node-version",
           "platforms-json",
+          "pre-upload-transport-smoke-artifact-root",
+          "pre-upload-transport-smoke-scenario-path",
           "process-sample-interval-ms",
           "process-summary-path",
           "publish-anchor-request-json",
@@ -727,7 +729,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 83,
+        "inputCount": 85,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1562,6 +1564,8 @@
           "linux-container-preset",
           "node-version",
           "platforms-json",
+          "pre-upload-transport-smoke-artifact-root",
+          "pre-upload-transport-smoke-scenario-path",
           "process-sample-interval-ms",
           "process-summary-path",
           "publish-anchor-request-json",
@@ -1590,7 +1594,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 86,
+        "inputCount": 88,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1810,12 +1814,14 @@
         "reusable": true,
         "inputs": [
           "alpha-workflow-path",
+          "auto-merge",
           "buildchain-ref",
           "buildchain-repository",
           "create-pull-request",
           "dev-workflow-path",
           "dry-run",
           "max-age-seconds",
+          "merge-method",
           "pull-request-body-prefix",
           "pull-request-body-prefix-renderer",
           "reactivation-authorized",
@@ -1823,7 +1829,7 @@
           "source-branch",
           "target-branch"
         ],
-        "inputCount": 13,
+        "inputCount": 15,
         "secrets": [
           "promotion-token"
         ],
@@ -1887,6 +1893,38 @@
         ],
         "outputCount": 6
       },
+      {
+        "id": "dev-qualification-patrol",
+        "path": ".github/workflows/dev-qualification-patrol.yml",
+        "reusable": true,
+        "inputs": [
+          "buildchain-ref",
+          "buildchain-repository",
+          "dev-workflow-path",
+          "dispatch-inputs-json",
+          "dry-run",
+          "max-attempts",
+          "mutation-authorized",
+          "preflight-workflow-path",
+          "priority-workflows-json",
+          "source-branch"
+        ],
+        "inputCount": 10,
+        "secrets": [
+          "qualification-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "action",
+          "active-run-id",
+          "decision-root",
+          "pending-sha",
+          "reason",
+          "source-sha",
+          "state"
+        ],
+        "outputCount": 7
+      },
       {
         "id": "github-artifact-attestation",
         "path": ".github/workflows/github-artifact-attestation.yml",
@@ -2490,6 +2528,7 @@
           "hold",
           "hold-reason",
           "ledger-ref",
+          "merge-method",
           "minimum-soak-seconds",
           "release-now",
           "required-checks",
@@ -2497,7 +2536,7 @@
           "revoked-versions",
           "target-branch"
         ],
-        "inputCount": 15,
+        "inputCount": 16,
         "secrets": [
           "approval-token",
           "promotion-token"
@@ -2863,6 +2902,10 @@
         "id": "manual:dev-alpha-candidate-patrol",
         "category": "manual"
       },
+      {
+        "id": "manual:dev-qualification-patrol",
+        "category": "manual"
+      },
       {
         "id": "manual:getting-started",
         "category": "manual"
@@ -6376,11 +6419,26 @@
         "path": "docs/cli-reference.md",
         "command": "buildchain release-propagation"
       },
+      {
+        "id": "release-propagation",
+        "path": "docs/cli-reference.md",
+        "command": "buildchain release-propagation"
+      },
       {
         "id": "release-propagation",
         "path": "docs/cli-reference.md",
         "command": "buildchain release-propagation --help"
       },
+      {
+        "id": "release-propagation",
+        "path": "docs/cli-reference.md",
+        "command": "buildchain release-propagation entry"
+      },
+      {
+        "id": "release-propagation",
+        "path": "docs/cli-reference.md",
+        "command": "buildchain release-propagation entry --help"
+      },
       {
         "id": "release-propagation",
         "path": "docs/cli-reference.md",
@@ -6436,6 +6494,21 @@
         "path": "docs/release-propagation.md",
         "command": "buildchain release-propagation receipt"
       },
+      {
+        "id": "release-propagation",
+        "path": "docs/release-propagation.md",
+        "command": "buildchain release-propagation entry plan"
+      },
+      {
+        "id": "release-propagation",
+        "path": "docs/release-propagation.md",
+        "command": "buildchain release-propagation entry plan"
+      },
+      {
+        "id": "release-propagation",
+        "path": "docs/release-propagation.md",
+        "command": "buildchain release-propagation entry fault-matrix"
+      },
       {
         "id": "release-propagation",
         "path": "docs/release-propagation.md",
@@ -6476,6 +6549,16 @@
         "path": "docs/release-propagation.md",
         "command": "buildchain release-propagation work complete"
       },
+      {
+        "id": "release-propagation",
+        "path": "docs/release-propagation.md",
+        "command": "buildchain release-propagation work push-plan"
+      },
+      {
+        "id": "release-propagation",
+        "path": "docs/release-propagation.md",
+        "command": "buildchain release-propagation work push-branch"
+      },
       {
         "id": "release-transaction",
         "path": "docs/cli-reference.md",
@@ -7117,9 +7200,9 @@
     "cliRegistryPath": "dist/site/cli-registry.json",
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
-    "cliRegistryDigest": "c070e7bff9d1cb65a08daacd936f3567871af7844e88fa6ffcb05ea59579c15f",
-    "workflowRegistryDigest": "dff218a0f6f03602912c4f2e238cc79a1304ee2d0f6d1e3f3bae8514302f4706",
-    "pageRegistryDigest": "fcc0611c778caa08e36f91d3d5bd36f61aa90a165fb98388ade07d3ac236716f"
+    "cliRegistryDigest": "2012c52df8cd1c32f5cf2afbee6fa77e69818616d41ff984dad394af0523f266",
+    "workflowRegistryDigest": "e96718b6503e5628a0f0535e4a705d2819a7ee5512b55e35373f10c750b5facf",
+    "pageRegistryDigest": "ad80961597b664645998d29c38d11debbc168447c69cad3749e9468550f5b695"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -388,6 +388,19 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/dev-qualification-patrol.yml",
+      "authorityClass": "governance-write",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/dev-qualification-patrol.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/github-artifact-attestation.yml",
       "authorityClass": "evidence-publication",
@@ -859,6 +872,13 @@
       ],
       "classified": true
     },
+    {
+      "path": ".github/workflows/dev-qualification-patrol.yml",
+      "signals": [
+        "write-permission"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/github-artifact-attestation.yml",
       "signals": [
@@ -999,5 +1019,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "c4574eaddd6cecd08c24e9125a2767f3126e8fbae894ed71d24cd5cc16e2443b"
+  "registryDigest": "bb343f7253b9497e1c9aee3cea170dd5f33fd5e807ea1de805a0fdda5a904bcc"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-02T14:27:56.260Z",
-  "publishedAt": "2026-08-02T14:27:56.260Z",
+  "generatedAt": "2026-08-03T02:31:12.352Z",
+  "publishedAt": "2026-08-03T02:31:12.352Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "4e62e4e0e7e2dec5316b12ab0ca7bef3e7804fbc",
+  "sourceRevision": "83280a3d21c4c75774be91ee802286b48c17fc54",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.8",
+    "version": "3.0.6-alpha.0",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-02T14:27:56.260Z",
-  "publishedAt": "2026-08-02T14:27:56.260Z",
+  "generatedAt": "2026-08-03T02:31:12.352Z",
+  "publishedAt": "2026-08-03T02:31:12.352Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "4e62e4e0e7e2dec5316b12ab0ca7bef3e7804fbc",
+  "sourceRevision": "83280a3d21c4c75774be91ee802286b48c17fc54",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.8",
+    "version": "3.0.6-alpha.0",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:0731b18f6a7aa6a164197080fac3b57ff161640a28433c4cd26adcf145403fb5"
+      "digest": "sha256:216e69758e78866e5a22fae1c4d017aaccf1b759937fcd953934407263344c03"
     },
     {
       "id": "getting-started",
@@ -69,7 +69,7 @@
       "path": "docs/auditable-demo.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:a99175216b3774748b253814c1933683cace8107a34083dd711f639f3e680c61"
+      "digest": "sha256:7e1426d8200bd4e7a7e6684c872f47075cd37d0bddbb262ea3263eaad846b540"
     },
     {
       "id": "install",
@@ -133,7 +133,7 @@
       "path": "docs/release-propagation.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:3b7a2a0437f8a3a4e5cff7e05a2a8c427be597d85e93d49d5e35ba2a2b089afc"
+      "digest": "sha256:6e8417ff70db290ee6197f064ed9b7a7da3770738509fac06161dad05b3fca7f"
     },
     {
       "id": "readme-badges",
@@ -229,7 +229,7 @@
       "path": "docs/cli-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:94207fa353e87b087ecf53b6cebe6dfffdc1311b2b6bc90b511d83d5757e7827"
+      "digest": "sha256:73d34a3b46ecfb772b806f0d79754772446fcc13d7f349b508a0c0212e97fcec"
     },
     {
       "id": "node-api-reference",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:deab508284ed365a830894205a4d293c524281d6da7126094cf8e9eea8efe223"
+      "digest": "sha256:ae49a589091d1ab91d29f2d6ac52cf2551a9d0b1f78350965b408f40fd219e29"
     },
     {
       "id": "build-facts",
@@ -277,7 +277,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:baadd0c0ef61d877b409d2bdf0e696e218971eb541c5f51a1a8e88e75af4904d"
+      "digest": "sha256:fe06637d604101269b013163be558c1ecc842276e27f2b5abfb6eea39e98feb0"
     },
     {
       "id": "publish-transaction",

package/dist/site/workflow-registry.json

@@ -148,6 +148,8 @@
         "linux-container-preset",
         "node-version",
         "platforms-json",
+        "pre-upload-transport-smoke-artifact-root",
+        "pre-upload-transport-smoke-scenario-path",
         "process-sample-interval-ms",
         "process-summary-path",
         "publish-anchor-request-json",
@@ -176,7 +178,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 83,
+      "inputCount": 85,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1241,6 +1243,8 @@
         "linux-container-preset",
         "node-version",
         "platforms-json",
+        "pre-upload-transport-smoke-artifact-root",
+        "pre-upload-transport-smoke-scenario-path",
         "process-sample-interval-ms",
         "process-summary-path",
         "publish-anchor-request-json",
@@ -1269,7 +1273,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 86,
+      "inputCount": 88,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1599,12 +1603,14 @@
       "reusable": true,
       "inputs": [
         "alpha-workflow-path",
+        "auto-merge",
         "buildchain-ref",
         "buildchain-repository",
         "create-pull-request",
         "dev-workflow-path",
         "dry-run",
         "max-age-seconds",
+        "merge-method",
         "pull-request-body-prefix",
         "pull-request-body-prefix-renderer",
         "reactivation-authorized",
@@ -1612,7 +1618,7 @@
         "source-branch",
         "target-branch"
       ],
-      "inputCount": 13,
+      "inputCount": 15,
       "secrets": [
         "promotion-token"
       ],
@@ -1706,6 +1712,48 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "dev-qualification-patrol",
+      "path": ".github/workflows/dev-qualification-patrol.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "buildchain-repository",
+        "dev-workflow-path",
+        "dispatch-inputs-json",
+        "dry-run",
+        "max-attempts",
+        "mutation-authorized",
+        "preflight-workflow-path",
+        "priority-workflows-json",
+        "source-branch"
+      ],
+      "inputCount": 10,
+      "secrets": [
+        "qualification-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "action",
+        "active-run-id",
+        "decision-root",
+        "pending-sha",
+        "reason",
+        "source-sha",
+        "state"
+      ],
+      "outputCount": 7,
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "github-artifact-attestation",
       "path": ".github/workflows/github-artifact-attestation.yml",
@@ -2489,6 +2537,7 @@
         "hold",
         "hold-reason",
         "ledger-ref",
+        "merge-method",
         "minimum-soak-seconds",
         "release-now",
         "required-checks",
@@ -2496,7 +2545,7 @@
         "revoked-versions",
         "target-branch"
       ],
-      "inputCount": 15,
+      "inputCount": 16,
       "secrets": [
         "approval-token",
         "promotion-token"

package/docs/MAP.md

@@ -84,7 +84,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Git/source/version/module/product build facts | `dist/site/node-api-registry.json`, `dist/site/cli-registry.json`, `kungfu-buildchain-module-build-facts`, `kungfu-buildchain-product-build-facts` | [`build-facts.md`](build-facts.md) |
 | GitHub Release passport/evidence publication | `dist/site/release-model.json`, `dist/site/artifact-schemas.json` | [`release-governance.md`](release-governance.md), [`release-candidate.md`](release-candidate.md) |
 | GitHub ownership, effective protection, plan capability, and managed-zone governance receipts | `dist/site/node-api-registry.json`, `dist/site/cli-registry.json`, `kungfu-buildchain-github-governance-receipt` | [`github-governance-authority.md`](github-governance-authority.md) |
-| release propagation for package/publication/site chains | `dist/site/release-model.json` | [`release-propagation.md`](release-propagation.md) |
+| release propagation and the unified Paper/KFD/Buildchain/Core Site agent entry | `dist/site/release-model.json`, `dist/site/cli-registry.json`, `dist/site/node-api-registry.json` | [`release-propagation.md`](release-propagation.md) |
 | publication artifact manifests, immutable archive registries, source bundles, and paper repository workflows | `dist/site/publication-registry.json`, `dist/site/workflow-registry.json`, `dist/site/node-api-registry.json`, `kungfu-buildchain-publication-artifact-manifest`, `kungfu-buildchain-publication-artifact-registry` | [`publication-artifacts.md`](publication-artifacts.md) |
 | Generated badge bundles, README badge blocks, and badge facts | `dist/site/node-api-registry.json`, `dist/site/manual-registry.json`, `kungfu-buildchain-badge-bundle-facts`, `kungfu-buildchain-readme-badge-facts` | [`readme-badges.md`](readme-badges.md) |
 | Homebrew tap distribution indexes | `dist/site/node-api-registry.json`, `dist/site/buildchain-contract.json` | [`homebrew.md`](homebrew.md) |
@@ -111,6 +111,7 @@ replace them.
 | Why does Buildchain use branch-driven release governance? | [`release-governance.md`](release-governance.md) | why | stable |
 | How do protected dev branches and scheduled ready-PR merging work? | [`release-governance.md`](release-governance.md#protected-dev-branches) | use | stable |
 | How do slow required checks land reliably on a busy dev channel? | [`release-governance.md`](release-governance.md#protected-dev-branches) + [`cli.md`](cli.md#commands) | use | preview |
+| How do I coalesce rapid Dev changes, preserve release runner priority, and retry only transient failed jobs? | [`dev-qualification-patrol.md`](dev-qualification-patrol.md) | use/verify | preview |
 | How do I run daily, weekly, or monthly repository patrols? | [`release-governance.md`](release-governance.md#buildchain-patrol) | use | stable |
 | How does Buildchain decide patch, minor, and major release lines? | [`versioning.md`](versioning.md) | why | stable |
 | What exact branch/tag state machine runs on alpha, release, and major gate? | [`release-flow.md`](release-flow.md) | verify | stable |
@@ -176,6 +177,8 @@ replace them.
 - **protected dev branches / scheduled ready-PR merge / daily-weekly-monthly patrol** ->
   [`release-governance.md`](release-governance.md#protected-dev-branches) and
   [`release-governance.md`](release-governance.md#buildchain-patrol).
+- **Dev qualification coalescing / release-priority runners / failed-job retry** ->
+  [`dev-qualification-patrol.md`](dev-qualification-patrol.md).
 - **pnpm / npm / yarn / package-manager adapters** ->
   [`lifecycle-protocol.md`](lifecycle-protocol.md).
 - **pip / Conan / CMake / custom commands** -> [`lifecycle-protocol.md`](lifecycle-protocol.md)

package/docs/auditable-demo.md

@@ -52,9 +52,25 @@ the default. Both classes retain 4 MiB per step, a clean Home/XDG environment,
 no inherited credentials, and a network-disabled read-only container with
 bounded tmpfs.
 
-The uploaded metadata must bind the executable SHA-256 and declare an empty
-runtime dependency set. Capture rejects an artifact name or upload digest that
-does not resolve to exactly one live artifact from the current workflow run.
+The uploaded metadata must bind the executable SHA-256, declare an empty
+runtime dependency set, and provide a bounded `executableFiles` array of exact
+artifact-relative paths and SHA-256 digests. GitHub Artifact transport does not
+retain Unix executable modes, so Buildchain restores mode `0755` only for this
+digest-verified executable closure and verifies the same closure again inside
+the network-disabled capture boundary. It never recursively changes artifact
+modes. This metadata controls assembly only and grants no execution,
+publication, or identity authority. Capture rejects an artifact name or upload
+digest that does not resolve to exactly one live artifact from the current workflow run.
+
+Consumers may also declare one bounded, non-interactive `transportSmoke` argv
+in the same scenario and opt the reusable build into
+`pre-upload-transport-smoke-scenario-path`. Before any GitHub Artifact or S3
+relay upload, Buildchain copies the exact distribution directory, removes Unix
+execute bits to simulate transport, restores only the digest-bound executable
+closure, and runs that real binary with a clean Home/XDG environment. A missing
+launcher, runtime, or embedded interpreter therefore fails before the expensive
+upload begins. This is a transport diagnostic with no authority grants; the
+later network-disabled capture and Gate remain the qualification authority.
 It retains ANSI terminal bytes with the real PTY read timestamps, verifies
 declared stdout and JSON file facts, enforces the total deadline while a step is
 running, and removes the disposable workspace before emitting evidence.

package/docs/cli-reference.md

@@ -1668,6 +1668,17 @@ buildchain release-governance reconcile --repository <owner/repo> --branch <dev|
 buildchain release-propagation
 ```
 
+### `buildchain release-propagation entry`
+
+- Help: `buildchain release-propagation entry --help`
+- Canonical id: `release-propagation`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
+```
+
 ### `buildchain release-propagation pickup`
 
 - Help: `buildchain release-propagation pickup --help`
@@ -1676,7 +1687,7 @@ buildchain release-propagation
 - Syntax:
 
 ```text
-buildchain release-propagation <plan|write-lock|work|pickup> ...
+buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
 ```
 
 ### `buildchain release-propagation plan`
@@ -1687,7 +1698,7 @@ buildchain release-propagation <plan|write-lock|work|pickup> ...
 - Syntax:
 
 ```text
-buildchain release-propagation <plan|write-lock|work|pickup> ...
+buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
 ```
 
 ### `buildchain release-propagation work`
@@ -1698,7 +1709,7 @@ buildchain release-propagation <plan|write-lock|work|pickup> ...
 - Syntax:
 
 ```text
-buildchain release-propagation <plan|write-lock|work|pickup> ...
+buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
 ```
 
 ### `buildchain release-propagation write-lock`
@@ -1709,7 +1720,7 @@ buildchain release-propagation <plan|write-lock|work|pickup> ...
 - Syntax:
 
 ```text
-buildchain release-propagation <plan|write-lock|work|pickup> ...
+buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
 ```
 
 ## `sample`

package/docs/dev-alpha-candidate-patrol.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-07-29
+last_reviewed: 2026-08-03
 ai_provenance:
   model_family: GPT-5
   product: Codex
   generated_at: 2026-07-29
-  visible_context: Existing Buildchain source locks, Kungfu exact-source Alpha preflight, Dev Patrol, repository release governance, and the consumer-owned settlement renderer threat model.
+  visible_context: Existing Buildchain source locks, Kungfu exact-source Alpha preflight, Dev Patrol, protected auto-merge policy, repository release governance, and the consumer-owned settlement renderer threat model.
   invisible_context_boundary: No credentials, private logs, or private configuration were used.
 ---
 
@@ -114,12 +114,21 @@ service. Once the active PR settles or is abandoned, the next execution
 recomputes current exact-SHA qualification and creates only the newest still
 fresh candidate. It never trusts a `workflow_run` trigger SHA as evidence.
 
+The caller may additionally set `auto-merge: true` and choose `merge-method`
+from `merge`, `squash`, or `rebase`. Buildchain only arms GitHub auto-merge for
+the single managed, open, exact-source candidate after the write-permission
+settlement has revalidated the observation. GitHub still owns every required
+review, required check, branch-protection, and merge-queue gate; Buildchain does
+not approve or directly merge the PR. Invalid merge methods and GraphQL
+refusals fail the patrol run.
+
 Consumers should invoke this workflow after relevant qualification workflow
 completion and from an offset periodic fallback. GitHub may delay scheduled
 runs, so the event path supplies low latency while the fallback supplies
 recovery. Workflow concurrency plus the server-side open-PR reconciliation
 makes duplicate or delayed events idempotent.
 
-The workflow never moves the Alpha ref directly, merges or auto-merges the pull
-request, publishes npm, creates a Git tag or GitHub Release, or changes branch
-protection. Those remain repository-owned protected settlement actions.
+The workflow never moves the Alpha ref directly, directly merges the pull
+request, approves it, publishes npm, creates a Git tag or GitHub Release, or
+changes branch protection. Optional auto-merge only registers repository-owned
+intent with GitHub; protected settlement remains authoritative.