@kungfu-tech/buildchain 3.0.6-alpha.0 → 3.0.6-alpha.1

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-03T02:31:12.352Z",
-  "publishedAt": "2026-08-03T02:31:12.352Z",
+  "generatedAt": "2026-08-03T09:35:55.854Z",
+  "publishedAt": "2026-08-03T09:35:55.854Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "83280a3d21c4c75774be91ee802286b48c17fc54",
+  "sourceRevision": "88a8b532ce69ee3def5926a42c9cd75e4809ae88",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.0",
+    "version": "3.0.6-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:216e69758e78866e5a22fae1c4d017aaccf1b759937fcd953934407263344c03"
+      "digest": "sha256:0ea7f59030e5a087e3ff7e9eb591fec8d92c64399799e554aa1fa7ecb6a263ae"
     },
     {
       "id": "getting-started",
@@ -293,7 +293,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:a38eca4d8ada75aed5cb60f2ef23ffe4ba36b1c804ea1ee7f74b3271765b7a1c"
+      "digest": "sha256:fc7f0add1afce775c327d50a1e269a7040865e65ca2441dbeb8d0373c5f8d5aa"
     },
     {
       "id": "release-flow",

package/dist/site/workflow-registry.json

@@ -1681,13 +1681,14 @@
         "landing-mode",
         "max-merges",
         "merge-method",
+        "queue-admission-context",
         "ready-label",
         "require-approval",
         "required-status-checks",
         "same-repository-only",
         "target-branch"
       ],
-      "inputCount": 13,
+      "inputCount": 14,
       "secrets": [
         "github-token"
       ],

package/docs/MAP.md

@@ -152,6 +152,7 @@ replace them.
 | How do I automatically qualify alpha candidates and publish the newest non-revoked qualified candidate at a fixed window? | [`stable-candidate-patrol.md`](stable-candidate-patrol.md) | use | preview |
 | How do I deploy a site/app preview, staging, or production surface? | [`web-surface-deployments.md`](web-surface-deployments.md) | use | stable |
 | How do I publish observed infrastructure contracts for downstream consumers? | [`infra-contract.md`](infra-contract.md) | use | preview |
+| How do I operate a repeatable, disabled-by-default, budget-fail-closed AWS Windows JIT campaign? | [`aws-us-elastic-runner-burst-plane.md`](aws-us-elastic-runner-burst-plane.md#phase-2-operator-workflow) | use/verify | preview |
 | How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md), [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md), [`../actions/github-artifact-attestation/README.md`](../actions/github-artifact-attestation/README.md), [`../actions/macos-credential-island/README.md`](../actions/macos-credential-island/README.md); `dist/site/workflow-registry.json#actions` is authoritative for the six-entry inventory. | use | stable |
 | How can a consumer workflow report a Buildchain-owned failure back to Buildchain? | [`consumer-issue-reporting.md`](consumer-issue-reporting.md) + [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md) | use | stable |
 | What do the fixture repositories demonstrate? | [`../fixtures/libnode-shaped/README.md`](../fixtures/libnode-shaped/README.md), [`../fixtures/publish-transaction-shaped/README.md`](../fixtures/publish-transaction-shaped/README.md), [`../fixtures/web-surface-shaped/README.md`](../fixtures/web-surface-shaped/README.md), [`../fixtures/publication-artifact-shaped/README.md`](../fixtures/publication-artifact-shaped/README.md) | verify | stable |

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-08-02
+last_reviewed: 2026-08-03
 ai_provenance:
   model_family: GPT-5
   product: Codex
-  generated_at: 2026-08-01
+  generated_at: 2026-08-03
   invisible_information: No hidden model checkpoint, parameters, or private training data were available.
 ---
 
@@ -189,7 +189,7 @@ and atomically refuses a sixth accepted instance. Five accepted instances
 therefore reserve at most USD 21.75. The campaign also persists the
 operator-observed spend from earlier Windows work, and refuses to arm unless
 that baseline, all five reservations, and one USD 4.35 fail-closed race
-allowance remain below the USD 80 phase cap.
+allowance remain below the USD 110 phase cap.
 
 The campaign starts unarmed and expires within 24 hours. Its `CONTROL` record
 can be created only once: a killed or expired campaign cannot be re-armed by
@@ -199,16 +199,34 @@ paid launch. Reservations are never refunded: a controller crash, ambiguous
 launch, or successful launch all remain charged to the campaign, favoring a
 false stop over an accidental budget overrun.
 
+The 2026-08-03 timeout-only campaign decision narrows the campaign to two
+accepted instances with one active instance at a time. The second reservation
+is an operator-gated repair retry: it may be used only after the first attempt
+is classified as non-counting and runner, EC2, EBS, SSM, and workflow residue
+have returned to zero. The two-slot ledger is a maximum spend boundary, not an
+authorization to consume both reservations.
+
 Each stack owns a stack-scoped reaper log group, so an independent retained
 one-shot campaign stack can be created without colliding with another
 campaign's audit log resource.
 
 The tag-filtered AWS Budget is defense in depth, not the authoritative launch
-gate. It is disabled by default because a linked account cannot activate a
-cost-allocation tag. Set `EnableTagFilteredBudget=true` only after the AWS
-Organizations management account has activated `kungfu:provider` and a Cost
-Explorer readback proves that `windows-ec2-jit` spend is visible. The DynamoDB
-reservation cap remains mandatory in either mode.
+gate. It is owned by the singleton
+`kungfu-buildchain-windows-jit-budget-guard` stack rather than any retained
+campaign stack. This prevents Budget-name collisions and prevents a stale
+campaign reaper from becoming the provider-wide cost authority. The Budget
+filters exactly `user:kungfu:provider$windows-ec2-jit`; its 80% and 95% actual
+notifications persist the provider kill sentinel, terminate every tagged
+Windows JIT instance, and delete scoped JIT parameters. Every launch controller
+refuses to proceed when the sentinel exists or when the Budget identity or tag
+filter does not match.
+
+Budget installation fails closed until the AWS Organizations management
+account activates `kungfu:provider` and Cost Explorer returns
+`windows-ec2-jit` for that key. A linked account cannot activate the tag. Do not
+create an unfiltered fallback Budget or treat a tag-filtered zero as evidence.
+The DynamoDB campaign reservation remains the atomic launch authority because
+Cost Explorer and AWS Budgets can lag provider activity.
 
 Qualification requires one runner-profile smoke and three trusted exact-source
 full Windows jobs all bound to the same campaign, independent cancellation and
@@ -216,82 +234,94 @@ timeout cleanup exercises, and zero repository runner, EC2 instance,
 disposable volume, min capacity, and desired capacity within 15 minutes of the
 final job.
 
-### Phase 2 campaign controller
-
-`scripts/aws-windows-jit-campaign.mjs` is the one-shot operator boundary.
-Without a mutation mode it emits the arm plan. `arm-campaign` requires the
-campaign id, exact source SHA, state table, observed prior phase spend, and a
-bounded one-to-five accepted-instance ceiling to be repeated as confirmations,
-then creates `CONTROL` and `CAMPAIGN#<id>` with
-`attribute_not_exists`
-conditions. DynamoDB therefore refuses a second campaign in the same retained
-state table. The operator can always use `kill-campaign`; there is deliberately
-no clear or re-arm operation.
-
-Every `scripts/aws-windows-jit-controller.mjs --execute` call must provide the
-same `--campaign-id`, `--confirm-campaign-id`, `--state-table`, and
-`--confirm-state-table`. After the GitHub, AMI, active-instance, SSM, and EC2
-DryRun checks pass, the controller
-atomically reserves one run. Duplicate run-attempt-qualification identities,
-source mismatch, expiry, `KILLED`, the sixth accepted instance, or a
-reservation that would exceed the baseline-adjusted USD 80 phase ceiling all
-fail closed before `RunInstances`.
-
-Example dry-run and arm boundary (do not execute without a new campaign budget
-decision):
+### Phase 2 operator workflow
+
+`pnpm operator:windows-jit` is the reusable lifecycle entrypoint. Its default
+mode is `plan`, which performs no AWS or GitHub call. A plan binds the account,
+region, unique campaign and stack names, source SHA/ref, Cost Explorer window,
+workflow id, network, OIDC provider, expiry, slot ceiling, singleton Budget
+identity, and exact confirmation digest.
+
+The modes are deliberately separated:
+
+- `plan` emits the deterministic mutation boundary and digest.
+- `audit` reads AWS and GitHub only. It verifies the account, disabled workflow,
+  singleton guard stack, exact Budget filter, SNS thresholds/subscribers,
+  provider kill sentinel, campaign stack, and zero EC2/EBS/SSM/JIT/runner
+  residue.
+- `install-budget --execute` deploys or updates only the singleton Budget guard.
+  It refuses to mutate unless the provider tag value is visible, the Windows
+  workflow is disabled, and the account, campaign, source, Budget, and plan
+  digest confirmations match.
+- `prepare --execute` requires the installed Budget guard, absent kill
+  sentinel, fresh Cost Explorer readback filtered by both
+  `kungfu:provider=windows-ec2-jit` and `BoxUsage:c7i.4xlarge`, zero residue, a
+  never-used campaign stack name, and the disabled workflow. The receipt binds
+  the query timestamp and exact filter identity. Preparation deploys the
+  campaign stack and atomically arms the ledger with that provider-spend
+  baseline. It never enables or dispatches the workflow and never creates EC2
+  capacity.
+- `close --execute` disables the workflow first, persists `KILLED`, publishes
+  the campaign kill switch, and reports terminal success only after EC2, EBS,
+  SSM, JIT parameter, and GitHub runner residue is zero. It is safe to rerun
+  while the reaper settles.
+
+All mutating modes require `--execute`, `--confirm-plan-digest`,
+`--confirm-account-id`, `--confirm-campaign-id`, and
+`--confirm-source-sha`. Budget installation and preparation additionally
+require `--confirm-budget-name`. A future paid workload still requires a
+separate exact workflow/run authorization and uses
+`scripts/aws-windows-jit-controller.mjs`; preparation is not paid-launch
+authority.
+
+Start by recording one reproducible plan:
 
 ```bash
-windows_campaign=win-REPLACE_WITH_CAMPAIGN_ID
-windows_source=REPLACE_WITH_EXACT_40_CHARACTER_SHA
-windows_state_table=REPLACE_WITH_CAMPAIGN_STATE_TABLE
-windows_expires_at=REPLACE_WITH_ISO_TIMESTAMP_WITHIN_24_HOURS
-windows_phase_spend_baseline_usd=REPLACE_WITH_OBSERVED_PRIOR_WINDOWS_SPEND
-windows_max_accepted_instances=REPLACE_WITH_INTEGER_FROM_1_THROUGH_5
-
-node scripts/aws-windows-jit-campaign.mjs plan-arm \
-  --campaign-id "$windows_campaign" \
-  --source-sha "$windows_source" \
-  --state-table "$windows_state_table" \
-  --expires-at "$windows_expires_at" \
-  --phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
-  --max-accepted-instances "$windows_max_accepted_instances"
-
-node scripts/aws-windows-jit-campaign.mjs arm-campaign \
-  --campaign-id "$windows_campaign" \
-  --confirm-campaign-id "$windows_campaign" \
-  --source-sha "$windows_source" \
-  --confirm-source-sha "$windows_source" \
-  --state-table "$windows_state_table" \
-  --confirm-state-table "$windows_state_table" \
-  --expires-at "$windows_expires_at" \
-  --phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
-  --confirm-phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
-  --max-accepted-instances "$windows_max_accepted_instances" \
-  --confirm-max-accepted-instances "$windows_max_accepted_instances"
+pnpm operator:windows-jit plan \
+  --aws-profile us \
+  --account-id 727884401362 \
+  --campaign-id win-REPLACE \
+  --source-sha REPLACE_WITH_EXACT_40_CHARACTER_SHA \
+  --source-ref refs/heads/dev/v4/v4.0 \
+  --observed-at REPLACE_WITH_ISO_TIMESTAMP \
+  --expires-at REPLACE_WITH_ISO_TIMESTAMP_WITHIN_24_HOURS \
+  --cost-start REPLACE_WITH_PHASE_START_DATE \
+  --cost-end REPLACE_WITH_EXCLUSIVE_END_DATE \
+  --max-accepted-instances 1 \
+  --workflow-id 322620360 \
+  --vpc-id REPLACE_WITH_VPC_ID \
+  --subnet-id REPLACE_WITH_SUBNET_ID \
+  --oidc-provider-arn REPLACE_WITH_GITHUB_OIDC_PROVIDER_ARN
 ```
 
-Arming creates a permanent one-shot control record and admits only the
-explicitly confirmed number of paid instances, never more than five. Its
-rollback is fail-closed, not deletion: `kill-campaign` first
-persists `KILLED`, then publishes to the dedicated SNS topic so the reaper
-terminates active card-owned instances and removes their JIT parameters. The
-command is idempotent, but the operator must read back DynamoDB, EC2, SSM, and
-GitHub runners before treating cleanup as complete:
+Reuse those exact arguments for `audit`, `install-budget`, `prepare`, or
+`close`; never regenerate `--observed-at` between the plan and its confirmed
+mutation. Capture stdout as the operator receipt. Do not put credentials,
+tokens, JIT configuration, or signed URLs in arguments or receipts.
 
-```bash
-windows_kill_topic=REPLACE_WITH_DEDICATED_KILL_SWITCH_TOPIC_ARN
-
-node scripts/aws-windows-jit-campaign.mjs kill-campaign \
-  --campaign-id "$windows_campaign" \
-  --confirm-campaign-id "$windows_campaign" \
-  --source-sha "$windows_source" \
-  --confirm-source-sha "$windows_source" \
-  --state-table "$windows_state_table" \
-  --confirm-state-table "$windows_state_table" \
-  --kill-switch-topic "$windows_kill_topic" \
-  --confirm-kill-switch-topic "$windows_kill_topic" \
-  --reason operator-kill
-```
+### Lower-level campaign and launch controllers
+
+`scripts/aws-windows-jit-campaign-core.mjs` owns the pure one-shot ledger
+contract used by the operator and launch controller. Arming creates `CONTROL`
+and `CAMPAIGN#<id>` with `attribute_not_exists` conditions, so DynamoDB refuses
+a second campaign in the same retained state table. There is deliberately no
+clear or re-arm operation.
+
+Every `scripts/aws-windows-jit-controller.mjs --execute` call must provide the
+same `--account-id`, `--campaign-id`, `--confirm-campaign-id`, `--state-table`,
+and `--confirm-state-table`. Before GitHub JIT material is created, the
+controller verifies the exact provider Budget/tag filter and proves the global
+Budget kill sentinel absent. After the GitHub, AMI, active-instance, SSM, and
+EC2 DryRun checks pass, the controller
+atomically reserves one run. Duplicate run-attempt-qualification identities,
+source mismatch, expiry, `KILLED`, the sixth accepted instance, or a
+reservation that would exceed the USD 110 ceiling after combining the persisted
+fresh Cost Explorer baseline with all in-flight campaign reservations all fail
+closed in one DynamoDB transaction before `RunInstances`. AWS Budget alarms are
+defense in depth for delayed billing telemetry; the atomic ledger is the
+authoritative launch-time guard. The operator is the only supported mutation
+surface for campaign preparation and closeout; direct imports of the core are
+not operator authority.
 
 ## Phase 3 contract
 

package/docs/release-governance.md

@@ -648,10 +648,11 @@ jobs:
       contents: write
       pull-requests: write
       checks: read
-      statuses: read
+      statuses: write
     with:
       target-branch: dev/v3/v3.0
       required-status-checks: check / check
+      queue-admission-context: Queue admission lease
       ready-label: ready
       block-labels: blocked,do-not-merge
       max-merges: 1
@@ -659,6 +660,12 @@ jobs:
       dry-run: ${{ inputs.dry-run || false }}
 ```
 
+When the protected branch requires a merge-group-only queue lease, the wrapper
+posts that configured context as a temporary success status on the exact PR
+head only after the ready, review, and required-check gates pass. It then
+enqueues with `expectedHeadOid`; a rejected enqueue rewrites the temporary
+status to failure, while the merge group must still produce its own final check.
+
 ## Buildchain Patrol
 
 `dev-pr-auto-merge.yml` remains the focused merge primitive. For repositories

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.6-alpha.0",
+  "version": "3.0.6-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -108,6 +108,7 @@
   },
   "packageManager": "pnpm@11.7.0",
   "scripts": {
+    "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
     "check": "pnpm run check:static && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json bin/internal/command-registry.mjs scripts/authorize-promotion-runtime-override.cjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/maintainability-metrics.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs",
     "check:workflows": "bash scripts/check-workflows.sh",
@@ -128,7 +129,7 @@
     "typescript": "^5.9.0"
   },
   "dependencies": {
-    "@kungfu-tech/kfd": "1.0.0-alpha.47",
+    "@kungfu-tech/kfd": "1.0.0-alpha.53",
     "smol-toml": "1.7.0"
   }
 }

package/scripts/aws-windows-jit-campaign-core.mjs

@@ -35,18 +35,15 @@ function tableName(value) {
 }
 
 function number(value) {
-  return { N: String(value) };
+  return { N: String(Math.round(value * 100_000_000) / 100_000_000) };
 }
 
 function money(value, label) {
   const normalized = String(value ?? "").trim();
-  if (!normalized) {
-    throw new Error(`${label} is required`);
-  }
+  if (!normalized) throw new Error(`${label} is required`);
   const parsed = Number(normalized);
-  if (!Number.isFinite(parsed) || parsed < 0) {
+  if (!Number.isFinite(parsed) || parsed < 0)
     throw new Error(`${label} must be a non-negative finite number`);
-  }
   return Math.round(parsed * 100_000_000) / 100_000_000;
 }
 
@@ -90,9 +87,11 @@ export function createWindowsJitCampaignArmPlan(values = {}) {
   );
   const maxAcceptedInstances = acceptedInstances(values.maxAcceptedInstances);
   const campaignReservationCeilingUsd = reservationUsd * maxAcceptedInstances;
-  const campaignSafetyCeilingUsd =
+  const campaignSafetyCeilingUsd = money(
     campaignReservationCeilingUsd +
-    reservationUsd * WINDOWS_EC2_JIT.maxConcurrentInstances;
+      reservationUsd * WINDOWS_EC2_JIT.maxConcurrentInstances,
+    "campaignSafetyCeilingUsd",
+  );
   const remainingPhaseBudgetUsd =
     WINDOWS_EC2_JIT.budgetLimitUsd - phaseSpendBaselineUsd;
   if (campaignSafetyCeilingUsd >= remainingPhaseBudgetUsd) {

package/scripts/aws-windows-jit-controller.mjs

@@ -164,6 +164,7 @@ function assertLivePreflight(plan, profile) {
     throw new Error("Windows AMI identity or availability mismatch");
   }
   return {
+    budgetGuard: jsonResult(commandResult("/bin/bash", ["scripts/aws-windows-jit-operator.sh", "launch-gate", "--region", plan.aws.region, ...(profile ? ["--aws-profile", profile] : [])]), "provider Budget launch gate"),
     runStatus: run.status,
     jobStatus: job.status,
     activeInstances: activeInstances.length,

package/scripts/aws-windows-jit-core.mjs

@@ -12,7 +12,7 @@ export const WINDOWS_EC2_JIT = Object.freeze({
   maximumInstanceLifetimeMinutes: 180,
   maxConcurrentInstances: 1,
   maxAcceptedInstances: 5,
-  budgetLimitUsd: 80,
+  budgetLimitUsd: 110,
   minimumSmokeJobs: 1,
   minimumFullJobs: 3,
   maximumCleanupLatencySeconds: 900,

package/scripts/dev-pr-auto-merge.mjs

@@ -8,13 +8,7 @@ const DEFAULT_REQUIRED_CHECKS = ["check"];
 const SUCCESS_STATES = new Set(["success"]);
 const SUCCESS_CONCLUSIONS = new Set(["success", "neutral", "skipped"]);
 const VALID_LANDING_MODES = new Set(["auto", "direct", "queue"]);
-const STATIC_SKIP_REASONS = new Set([
-  "draft",
-  "fork-or-cross-repository-head",
-  "head-prefix-not-allowed",
-  "missing-ready-label",
-  "blocked-label",
-]);
+const STATIC_SKIP_REASONS = new Set(["draft", "fork-or-cross-repository-head", "head-prefix-not-allowed", "missing-ready-label", "blocked-label"]);
 const ADMISSION_CONTRACT = "kungfu-buildchain-dev-merge-queue-admission";
 
 function splitList(value, fallback = []) {
@@ -62,6 +56,7 @@ function normalizeOptions(options = {}) {
     blockLabels: splitList(options.blockLabels, DEFAULT_BLOCK_LABELS).map((label) => label.toLowerCase()),
     allowedHeadPrefixes: splitList(options.allowedHeadPrefixes, DEFAULT_ALLOWED_HEAD_PREFIXES),
     requiredChecks: splitList(options.requiredChecks, DEFAULT_REQUIRED_CHECKS),
+    queueAdmissionContext: String(options.queueAdmissionContext || "").trim(),
     requireApproval: boolOption(options.requireApproval, true),
     sameRepositoryOnly: boolOption(options.sameRepositoryOnly, true),
     maxMerges: intOption(options.maxMerges, 1),
@@ -155,8 +150,12 @@ function summarizeChecks({ statuses = [], checkRuns = [] } = {}, requiredChecks
 function mergeableAccepted(pr, landingMode = "direct") {
   if (pr.mergeable === false) return false;
   const state = String(pr.mergeable_state || pr.mergeStateStatus || "").toLowerCase();
-  if (!state) return pr.mergeable === true;
-  return ["clean", "has_hooks", "unstable", "unknown", ...(landingMode === "queue" && pr.mergeable === true ? ["blocked"] : [])].includes(state);
+  return state ? ["clean", "has_hooks", "unstable", "unknown", ...(landingMode === "queue" && pr.mergeable === true ? ["blocked"] : [])].includes(state) : pr.mergeable === true;
+}
+async function setQueueAdmissionStatus(client, repository, sha, context, state) {
+  if (!context) return null;
+  await client.request("POST", `/repos/${repository.owner}/${repository.repo}/statuses/${sha}`, { body: { state, context, description: state === "success" ? "Buildchain admitted this exact PR head to the merge queue" : "Buildchain rejected merge queue admission for this exact PR head" } });
+  return { context, state, sha };
 }
 
 function skip(reason, details = {}) {
@@ -521,9 +520,7 @@ export async function runDevPrAutoMerge(optionsInput = {}, clientInput) {
     client.getMergeQueueState(options.targetBranch),
   ]);
   const landingMode = initialQueueState.enabled ? "queue" : options.landingMode === "queue" ? "queue" : "direct";
-  const orderedPullRequests = landingMode === "queue"
-    ? [...pullRequests].sort((left, right) => Number(left.number) - Number(right.number))
-    : pullRequests;
+  const orderedPullRequests = landingMode === "queue" ? [...pullRequests].sort((left, right) => Number(left.number) - Number(right.number)) : pullRequests;
   const result = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-dev-pr-auto-merge",
@@ -662,6 +659,7 @@ export async function runDevPrAutoMerge(optionsInput = {}, clientInput) {
           result.skipped.push(entry);
         } else {
           try {
+            entry.queueAdmissionStatus = await setQueueAdmissionStatus(client, options.repository, expectedHeadSha, options.queueAdmissionContext, "success");
             const queueEntry = await client.enqueuePullRequest({
               pullRequestId: decision.pullRequestId,
               expectedHeadOid: expectedHeadSha,
@@ -673,6 +671,7 @@ export async function runDevPrAutoMerge(optionsInput = {}, clientInput) {
             result.actions.push(entry);
             result.enqueued.push(entry);
           } catch (error) {
+            entry.queueAdmissionStatus = await setQueueAdmissionStatus(client, options.repository, expectedHeadSha, options.queueAdmissionContext, "failure");
             entry.action = "skip";
             entry.reason = "enqueue-rejected";
             entry.enqueueError = {
@@ -744,6 +743,7 @@ async function main() {
     blockLabels: process.env.BUILDCHAIN_DEV_PR_BLOCK_LABELS,
     allowedHeadPrefixes: process.env.BUILDCHAIN_DEV_PR_ALLOWED_HEAD_PREFIXES,
     requiredChecks: process.env.BUILDCHAIN_DEV_PR_REQUIRED_CHECKS,
+    queueAdmissionContext: process.env.BUILDCHAIN_DEV_PR_QUEUE_ADMISSION_CONTEXT,
     requireApproval: process.env.BUILDCHAIN_DEV_PR_REQUIRE_APPROVAL,
     sameRepositoryOnly: process.env.BUILDCHAIN_DEV_PR_SAME_REPOSITORY_ONLY,
     maxMerges: process.env.BUILDCHAIN_DEV_PR_MAX_MERGES,

package/scripts/dispatch-artifact-signing-authority.mjs

@@ -86,10 +86,8 @@ export function validateArtifactSigningAuthorityRun(
   ) {
     throw new Error("Buildchain signing authority repository mismatch");
   }
-  if (
-    run.path &&
-    !String(run.path).startsWith(`.github/workflows/${AUTHORITY_WORKFLOW}@`)
-  ) {
+  const runPath = String(run.path || "").split("@", 1)[0];
+  if (run.path && runPath !== `.github/workflows/${AUTHORITY_WORKFLOW}`) {
     throw new Error("Buildchain signing authority workflow path mismatch");
   }
   return run;