@kungfu-tech/buildchain 3.0.6-alpha.0 → 3.0.6-alpha.2

package/docs/node-api-reference.md

@@ -113,13 +113,13 @@ Target: `./packages/core/index.js`. Public symbols: 558.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain";` | `packages/core/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:54` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:57` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain";` | `packages/core/build-facts.js:45` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:199` |
 | `cacheEvidenceDigest` | function: function cacheEvidenceDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { cacheEvidenceDigest } from "@kungfu-tech/buildchain";` | `packages/core/cache-evidence.js:48` |
-| `CHANNEL_CANDIDATE_DECISION_SCHEMA` | constant: const CHANNEL_CANDIDATE_DECISION_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { CHANNEL_CANDIDATE_DECISION_SCHEMA } from "@kungfu-tech/buildchain";` | `packages/core/channel-candidate.js:5` |
-| `channelCandidateSourceLockRef` | function: function channelCandidateSourceLockRef(targetBranch, sourceSha) | targetBranch, sourceSha | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { channelCandidateSourceLockRef } from "@kungfu-tech/buildchain";` | `packages/core/channel-candidate.js:84` |
+| `CHANNEL_CANDIDATE_DECISION_SCHEMA` | constant: const CHANNEL_CANDIDATE_DECISION_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { CHANNEL_CANDIDATE_DECISION_SCHEMA } from "@kungfu-tech/buildchain";` | `packages/core/channel-candidate.js:6` |
+| `channelCandidateSourceLockRef` | function: function channelCandidateSourceLockRef(targetBranch, sourceSha) | targetBranch, sourceSha | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { channelCandidateSourceLockRef } from "@kungfu-tech/buildchain";` | `packages/core/channel-candidate.js:85` |
 | `checkBadgeBundleBlock` | function: function checkBadgeBundleBlock({ readmeText, facts } = {}) | { readmeText, facts } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { checkBadgeBundleBlock } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:867` |
 | `checkHomebrewTap` | function: async function checkHomebrewTap({ cwd = process.cwd(), packageName = "buildchain", releasePassport = "", manifestPath = DEFAULT_MANIFEST_PATH, formulaPath = "", } = {}) | { cwd = process.cwd(), packageName = "buildchain", releasePassport = "", manifestPath = DEFAULT_MANIFEST_PATH, formulaPath = "", } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { checkHomebrewTap } from "@kungfu-tech/buildchain";` | `packages/core/homebrew.js:335` |
 | `checkKfd2ProductClaimOutputs` | function: function checkKfd2ProductClaimOutputs(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { checkKfd2ProductClaimOutputs } from "@kungfu-tech/buildchain";` | `packages/core/kfd2-product-claims.js:415` |
@@ -176,7 +176,7 @@ Target: `./packages/core/index.js`. Public symbols: 558.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain";` | `packages/core/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:79` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:81` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain";` | `packages/core/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/cache-evidence.js:169` |
@@ -237,7 +237,7 @@ Target: `./packages/core/index.js`. Public symbols: 558.
 | `createSurfaceTimestampPolicy` | function: function createSurfaceTimestampPolicy({ generatedAt = "", publishedAt = "", sourceDateEpoch = process.env.SOURCE_DATE_EPOCH \|\| DEFAULT_SOURCE_DATE_EPOCH, sourceRevision = "", deterministicInputs = [], timestampPolicy = "", timestampFields = ["generatedAt", "publishedAt"], timestampFieldsParticipateInArtifactDigest = true, artifactDigestScope = "manifest-and-artifact", reproducible = true, } = {}) | { generatedAt = "", publishedAt = "", sourceDateEpoch = process.env.SOURCE_DATE_EPOCH \|\| DEFAULT_SOURCE_DATE_EPOCH, sourceRevision = "", deterministicInputs = [], timestampPolicy = "", timestampFields = ["generatedAt", "publishedAt"], timestampFieldsParticipateInArtifactDigest = true, artifactDigestScope = "manifest-and-artifact", reproducible = true, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSurfaceTimestampPolicy } from "@kungfu-tech/buildchain";` | `packages/core/surface-manifest.js:34` |
 | `createWebSurfaceProductionDecision` | function: function createWebSurfaceProductionDecision({ approved, kind, repository, sourceSha, actor, actorPermission = "", releasePr = 0, releaseSource = "", reason, } = {}) | { approved, kind, repository, sourceSha, actor, actorPermission = "", releasePr = 0, releaseSource = "", reason, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createWebSurfaceProductionDecision } from "@kungfu-tech/buildchain";` | `packages/core/web-surface-publication-candidate.js:45` |
 | `createWebSurfacePublicationCandidate` | function: function createWebSurfacePublicationCandidate({ repository, sourceSha, sourceTreeSha, runtimeSha, plan, planFileDigest, controllerReceipt, decision, } = {}) | { repository, sourceSha, sourceTreeSha, runtimeSha, plan, planFileDigest, controllerReceipt, decision, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createWebSurfacePublicationCandidate } from "@kungfu-tech/buildchain";` | `packages/core/web-surface-publication-candidate.js:79` |
-| `decideChannelCandidate` | function: function decideChannelCandidate(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { decideChannelCandidate } from "@kungfu-tech/buildchain";` | `packages/core/channel-candidate.js:90` |
+| `decideChannelCandidate` | function: function decideChannelCandidate(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { decideChannelCandidate } from "@kungfu-tech/buildchain";` | `packages/core/channel-candidate.js:91` |
 | `DEFAULT_BUILDCHAIN_ISSUE_REPOSITORY` | constant: const DEFAULT_BUILDCHAIN_ISSUE_REPOSITORY | none | value | Import does not declare a throw contract. | none-on-import | `import { DEFAULT_BUILDCHAIN_ISSUE_REPOSITORY } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:6` |
 | `defaultBuildchainLogPath` | function: function defaultBuildchainLogPath({ cwd = process.cwd() } = {}) | { cwd = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { defaultBuildchainLogPath } from "@kungfu-tech/buildchain";` | `packages/core/logging.js:41` |
 | `defaultPublishEvidencePath` | function: function defaultPublishEvidencePath(version, workspace = process.cwd()) | version, workspace = process.cwd() | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { defaultPublishEvidencePath } from "@kungfu-tech/buildchain";` | `packages/core/publish-transaction.js:193` |
@@ -724,13 +724,13 @@ Target: `./packages/core/index.js`. Public symbols: 558.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:54` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:57` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/build-facts.js:45` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:199` |
 | `cacheEvidenceDigest` | function: function cacheEvidenceDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { cacheEvidenceDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/cache-evidence.js:48` |
-| `CHANNEL_CANDIDATE_DECISION_SCHEMA` | constant: const CHANNEL_CANDIDATE_DECISION_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { CHANNEL_CANDIDATE_DECISION_SCHEMA } from "@kungfu-tech/buildchain/core";` | `packages/core/channel-candidate.js:5` |
-| `channelCandidateSourceLockRef` | function: function channelCandidateSourceLockRef(targetBranch, sourceSha) | targetBranch, sourceSha | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { channelCandidateSourceLockRef } from "@kungfu-tech/buildchain/core";` | `packages/core/channel-candidate.js:84` |
+| `CHANNEL_CANDIDATE_DECISION_SCHEMA` | constant: const CHANNEL_CANDIDATE_DECISION_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { CHANNEL_CANDIDATE_DECISION_SCHEMA } from "@kungfu-tech/buildchain/core";` | `packages/core/channel-candidate.js:6` |
+| `channelCandidateSourceLockRef` | function: function channelCandidateSourceLockRef(targetBranch, sourceSha) | targetBranch, sourceSha | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { channelCandidateSourceLockRef } from "@kungfu-tech/buildchain/core";` | `packages/core/channel-candidate.js:85` |
 | `checkBadgeBundleBlock` | function: function checkBadgeBundleBlock({ readmeText, facts } = {}) | { readmeText, facts } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { checkBadgeBundleBlock } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:867` |
 | `checkHomebrewTap` | function: async function checkHomebrewTap({ cwd = process.cwd(), packageName = "buildchain", releasePassport = "", manifestPath = DEFAULT_MANIFEST_PATH, formulaPath = "", } = {}) | { cwd = process.cwd(), packageName = "buildchain", releasePassport = "", manifestPath = DEFAULT_MANIFEST_PATH, formulaPath = "", } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { checkHomebrewTap } from "@kungfu-tech/buildchain/core";` | `packages/core/homebrew.js:335` |
 | `checkKfd2ProductClaimOutputs` | function: function checkKfd2ProductClaimOutputs(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { checkKfd2ProductClaimOutputs } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd2-product-claims.js:415` |
@@ -787,7 +787,7 @@ Target: `./packages/core/index.js`. Public symbols: 558.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain/core";` | `packages/core/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:79` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:81` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain/core";` | `packages/core/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/cache-evidence.js:169` |
@@ -848,7 +848,7 @@ Target: `./packages/core/index.js`. Public symbols: 558.
 | `createSurfaceTimestampPolicy` | function: function createSurfaceTimestampPolicy({ generatedAt = "", publishedAt = "", sourceDateEpoch = process.env.SOURCE_DATE_EPOCH \|\| DEFAULT_SOURCE_DATE_EPOCH, sourceRevision = "", deterministicInputs = [], timestampPolicy = "", timestampFields = ["generatedAt", "publishedAt"], timestampFieldsParticipateInArtifactDigest = true, artifactDigestScope = "manifest-and-artifact", reproducible = true, } = {}) | { generatedAt = "", publishedAt = "", sourceDateEpoch = process.env.SOURCE_DATE_EPOCH \|\| DEFAULT_SOURCE_DATE_EPOCH, sourceRevision = "", deterministicInputs = [], timestampPolicy = "", timestampFields = ["generatedAt", "publishedAt"], timestampFieldsParticipateInArtifactDigest = true, artifactDigestScope = "manifest-and-artifact", reproducible = true, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSurfaceTimestampPolicy } from "@kungfu-tech/buildchain/core";` | `packages/core/surface-manifest.js:34` |
 | `createWebSurfaceProductionDecision` | function: function createWebSurfaceProductionDecision({ approved, kind, repository, sourceSha, actor, actorPermission = "", releasePr = 0, releaseSource = "", reason, } = {}) | { approved, kind, repository, sourceSha, actor, actorPermission = "", releasePr = 0, releaseSource = "", reason, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createWebSurfaceProductionDecision } from "@kungfu-tech/buildchain/core";` | `packages/core/web-surface-publication-candidate.js:45` |
 | `createWebSurfacePublicationCandidate` | function: function createWebSurfacePublicationCandidate({ repository, sourceSha, sourceTreeSha, runtimeSha, plan, planFileDigest, controllerReceipt, decision, } = {}) | { repository, sourceSha, sourceTreeSha, runtimeSha, plan, planFileDigest, controllerReceipt, decision, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createWebSurfacePublicationCandidate } from "@kungfu-tech/buildchain/core";` | `packages/core/web-surface-publication-candidate.js:79` |
-| `decideChannelCandidate` | function: function decideChannelCandidate(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { decideChannelCandidate } from "@kungfu-tech/buildchain/core";` | `packages/core/channel-candidate.js:90` |
+| `decideChannelCandidate` | function: function decideChannelCandidate(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { decideChannelCandidate } from "@kungfu-tech/buildchain/core";` | `packages/core/channel-candidate.js:91` |
 | `DEFAULT_BUILDCHAIN_ISSUE_REPOSITORY` | constant: const DEFAULT_BUILDCHAIN_ISSUE_REPOSITORY | none | value | Import does not declare a throw contract. | none-on-import | `import { DEFAULT_BUILDCHAIN_ISSUE_REPOSITORY } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:6` |
 | `defaultBuildchainLogPath` | function: function defaultBuildchainLogPath({ cwd = process.cwd() } = {}) | { cwd = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { defaultBuildchainLogPath } from "@kungfu-tech/buildchain/core";` | `packages/core/logging.js:41` |
 | `defaultPublishEvidencePath` | function: function defaultPublishEvidencePath(version, workspace = process.cwd()) | version, workspace = process.cwd() | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { defaultPublishEvidencePath } from "@kungfu-tech/buildchain/core";` | `packages/core/publish-transaction.js:193` |
@@ -1339,9 +1339,9 @@ Target: `./packages/core/channel-candidate.js`. Public symbols: 3.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `CHANNEL_CANDIDATE_DECISION_SCHEMA` | constant: const CHANNEL_CANDIDATE_DECISION_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { CHANNEL_CANDIDATE_DECISION_SCHEMA } from "@kungfu-tech/buildchain/channel-candidate";` | `packages/core/channel-candidate.js:5` |
-| `channelCandidateSourceLockRef` | function: function channelCandidateSourceLockRef(targetBranch, sourceSha) | targetBranch, sourceSha | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { channelCandidateSourceLockRef } from "@kungfu-tech/buildchain/channel-candidate";` | `packages/core/channel-candidate.js:84` |
-| `decideChannelCandidate` | function: function decideChannelCandidate(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { decideChannelCandidate } from "@kungfu-tech/buildchain/channel-candidate";` | `packages/core/channel-candidate.js:90` |
+| `CHANNEL_CANDIDATE_DECISION_SCHEMA` | constant: const CHANNEL_CANDIDATE_DECISION_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { CHANNEL_CANDIDATE_DECISION_SCHEMA } from "@kungfu-tech/buildchain/channel-candidate";` | `packages/core/channel-candidate.js:6` |
+| `channelCandidateSourceLockRef` | function: function channelCandidateSourceLockRef(targetBranch, sourceSha) | targetBranch, sourceSha | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { channelCandidateSourceLockRef } from "@kungfu-tech/buildchain/channel-candidate";` | `packages/core/channel-candidate.js:85` |
+| `decideChannelCandidate` | function: function decideChannelCandidate(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { decideChannelCandidate } from "@kungfu-tech/buildchain/channel-candidate";` | `packages/core/channel-candidate.js:91` |
 
 ## `@kungfu-tech/buildchain/cache-evidence`
 
@@ -1415,6 +1415,45 @@ Target: `./packages/core/diagnostics.js`. Public symbols: 30.
 | `validateAnchoredPackageRelease` | function: function validateAnchoredPackageRelease({ cwd = process.cwd(), requireManifest = true, requirePackageSetOrder = "platforms-first-main-last", requireTrustedPublishing = true, requireLifecycleStages = ["install", "build", "verify", "publish"], requirePublishGateSourceLock = false, publishSource = undefined, env = process.env, } = {}) | { cwd = process.cwd(), requireManifest = true, requirePackageSetOrder = "platforms-first-main-last", requireTrustedPublishing = true, requireLifecycleStages = ["install", "build", "verify", "publish"], requirePublishGateSourceLock = false, publishSource = undefined, env = process.env, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateAnchoredPackageRelease } from "@kungfu-tech/buildchain/diagnostics";` | `packages/core/diagnostics.js:325` |
 | `writeDiagnosticsArtifact` | function: function writeDiagnosticsArtifact(filePath, diagnostics) | filePath, diagnostics | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write | `import { writeDiagnosticsArtifact } from "@kungfu-tech/buildchain/diagnostics";` | `packages/core/diagnostics.js:1459` |
 
+## `@kungfu-tech/buildchain/dev-delivery-warrant`
+
+Target: `./packages/core/dev-delivery-warrant.js`. Public symbols: 32.
+
+| Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| `cancelQueuedDevDeliveryCandidate` | function: function cancelQueuedDevDeliveryCandidate(queueInput, input, options) | queueInput, input, options | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { cancelQueuedDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:559` |
+| `classifyDevDeliveryDelta` | function: function classifyDevDeliveryDelta({ proof, current = {} } = {}) | { proof, current = {} } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { classifyDevDeliveryDelta } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:75` |
+| `closeDevDeliveryWarrant` | function: function closeDevDeliveryWarrant(queueInput, warrant, { outcome, evidenceRoot, reason = "", now = new Date().toISOString() } = {}) | queueInput, warrant, { outcome, evidenceRoot, reason = "", now = new Date().toISOString() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { closeDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:511` |
+| `createDevDeliveryQueue` | function: function createDevDeliveryQueue({ repository: repositoryInput, protectedBase: protectedBaseInput, policy = {}, now = new Date().toISOString() } = {}) | { repository: repositoryInput, protectedBase: protectedBaseInput, policy = {}, now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:95` |
+| `createIntegrationDeliveryProof` | function: function createIntegrationDeliveryProof(input = {}) | input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createIntegrationDeliveryProof } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:207` |
+| `createProjectCutReplayPlan` | function: function createProjectCutReplayPlan(input = {}) | input = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createProjectCutReplayPlan } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:121` |
+| `createProjectCutReplayProof` | function: function createProjectCutReplayProof(input = {}) | input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createProjectCutReplayProof } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:141` |
+| `createSourceQualificationProof` | function: function createSourceQualificationProof(input = {}) | input = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createSourceQualificationProof } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:31` |
+| `DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA` | value: DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
+| `DEV_DELIVERY_CLASSES` | constant: const DEV_DELIVERY_CLASSES | none | value | Import does not declare a throw contract. | none-on-import | `import { DEV_DELIVERY_CLASSES } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:20` |
+| `DEV_DELIVERY_LEASE_RECEIPT_SCHEMA` | constant: const DEV_DELIVERY_LEASE_RECEIPT_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { DEV_DELIVERY_LEASE_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:12` |
+| `DEV_DELIVERY_PRIORITIES` | constant: const DEV_DELIVERY_PRIORITIES | none | value | Import does not declare a throw contract. | none-on-import | `import { DEV_DELIVERY_PRIORITIES } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:14` |
+| `DEV_DELIVERY_QUEUE_CONTRACT` | constant: const DEV_DELIVERY_QUEUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { DEV_DELIVERY_QUEUE_CONTRACT } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:8` |
+| `DEV_DELIVERY_SELECTION_RECEIPT_SCHEMA` | constant: const DEV_DELIVERY_SELECTION_RECEIPT_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { DEV_DELIVERY_SELECTION_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:11` |
+| `DEV_DELIVERY_SETTLEMENT_RECEIPT_SCHEMA` | value: DEV_DELIVERY_SETTLEMENT_RECEIPT_SCHEMA | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { DEV_DELIVERY_SETTLEMENT_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:1` |
+| `DEV_DELIVERY_SUBMISSION_RECEIPT_SCHEMA` | constant: const DEV_DELIVERY_SUBMISSION_RECEIPT_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { DEV_DELIVERY_SUBMISSION_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:10` |
+| `DEV_DELIVERY_WARRANT_SCHEMA` | constant: const DEV_DELIVERY_WARRANT_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { DEV_DELIVERY_WARRANT_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:9` |
+| `devDeliveryContentRoot` | function: function devDeliveryContentRoot(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { devDeliveryContentRoot } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-common.js:27` |
+| `heartbeatDevDeliveryWarrant` | function: function heartbeatDevDeliveryWarrant(queueInput, warrant, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, warrant, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { heartbeatDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:428` |
+| `INTEGRATION_DELIVERY_PROOF_SCHEMA` | constant: const INTEGRATION_DELIVERY_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { INTEGRATION_DELIVERY_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:5` |
+| `normalizeDevDeliveryQueue` | function: function normalizeDevDeliveryQueue(input, expected = {}) | input, expected = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { normalizeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:110` |
+| `observeDevDeliveryQueue` | function: function observeDevDeliveryQueue(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { observeDevDeliveryQueue } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:562` |
+| `PROJECT_CUT_REPLAY_PROOF_SCHEMA` | constant: const PROJECT_CUT_REPLAY_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { PROJECT_CUT_REPLAY_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:4` |
+| `rankDevDeliveryCandidates` | function: function rankDevDeliveryCandidates(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { rankDevDeliveryCandidates } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:269` |
+| `recoverExpiredDevDeliveryWarrant` | function: function recoverExpiredDevDeliveryWarrant(queueInput, { now = new Date().toISOString() } = {}) | queueInput, { now = new Date().toISOString() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoverExpiredDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:461` |
+| `selectDevDeliveryWarrant` | function: function selectDevDeliveryWarrant(queueInput, { now = new Date().toISOString(), leaseSeconds } = {}) | queueInput, { now = new Date().toISOString(), leaseSeconds } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { selectDevDeliveryWarrant } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:293` |
+| `settleDevDeliveryTerminalEvent` | constant: const settleDevDeliveryTerminalEvent | none | value | Import does not declare a throw contract. | none-on-import | `import { settleDevDeliveryTerminalEvent } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:560` |
+| `SOURCE_QUALIFICATION_PROOF_SCHEMA` | constant: const SOURCE_QUALIFICATION_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { SOURCE_QUALIFICATION_PROOF_SCHEMA } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:3` |
+| `submitDevDeliveryCandidate` | function: function submitDevDeliveryCandidate(queueInput, input, { now = new Date().toISOString() } = {}) | queueInput, input, { now = new Date().toISOString() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { submitDevDeliveryCandidate } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-warrant.js:193` |
+| `verifyIntegrationDeliveryProof` | function: function verifyIntegrationDeliveryProof(proofInput, expected = {}) | proofInput, expected = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyIntegrationDeliveryProof } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:228` |
+| `verifyProjectCutReplayProof` | function: function verifyProjectCutReplayProof(proofInput, expected = {}) | proofInput, expected = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyProjectCutReplayProof } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:187` |
+| `verifySourceQualificationProof` | function: function verifySourceQualificationProof(proofInput, expected = {}) | proofInput, expected = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifySourceQualificationProof } from "@kungfu-tech/buildchain/dev-delivery-warrant";` | `packages/core/dev-delivery-proof.js:52` |
+
 ## `@kungfu-tech/buildchain/homebrew`
 
 Target: `./packages/core/homebrew.js`. Public symbols: 7.
@@ -1787,8 +1826,8 @@ Target: `./packages/core/buildchain-publication-authority.js`. Public symbols: 2
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:54` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:79` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:57` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:81` |
 
 ## `@kungfu-tech/buildchain/github-governance-authority`
 

package/docs/publication-authority.md

@@ -167,6 +167,17 @@ release-PR or trusted-manual paths.
 
 ## Consumer qualification handoff
 
+For managed release candidates, a consumer whose Gate can only be decided
+after the exact candidate bytes exist may provide `publication-gate-command`.
+The sealed authority downloads and recomputes the RC evidence first, checks out
+the exact admitted consumer source without credentials, and runs that command
+with read-only evidence paths. The command must write one complete qualifying
+Shifu aggregate to `BUILDCHAIN_PUBLICATION_GATE_RESULT_PATH`. Buildchain then
+checks the aggregate digest and source binding before assembling the admission;
+the later consumer predicate and provider action still revalidate the same
+complete aggregate. A precomputed aggregate, the command, and an explicit
+no-Gate decision are mutually exclusive.
+
 Consumers may explicitly opt in to a final, consumer-owned qualification
 predicate. Buildchain then transports the complete Gate aggregate alongside the
 sealed capability instead of reducing it to a summary. The capability binds the

package/docs/release-candidate.md

@@ -192,12 +192,29 @@ short-lived admission JSON in repository-specific workflow code:
 ```
 
 `publication-auto-no-gate` is an explicit consumer decision, not a default. A
-consumer with a Shifu Gate registry supplies `publication-gate-aggregate-json`
-instead. Buildchain still requires caller-owned RC evidence, an exact authority
+consumer with a Shifu Gate registry either supplies
+`publication-gate-aggregate-json`, or supplies a source-controlled
+`publication-gate-command` that writes the aggregate to
+`BUILDCHAIN_PUBLICATION_GATE_RESULT_PATH`. The command runs from the exact
+consumer source in the credential-free sealed-authority job, after Buildchain
+has downloaded the exact RC passport, summary, controller receipt, manifests,
+and payload bytes. It can read those inputs through
+`BUILDCHAIN_PUBLICATION_EVIDENCE_ROOT`; it receives no publication token, OIDC
+permission, or provider write permission. Buildchain validates the aggregate
+digest and exact source binding before it seals a capability. Exactly one of
+the supplied aggregate, consumer command, or explicit no-Gate decision is
+allowed. Buildchain still requires caller-owned RC evidence, an exact authority
 runtime and source SHA, a repository-local publisher workflow, matching npm
 target/package identity or exact caller-bound GitHub Release target, and a
 qualifying control-plane audit.
 
+Promotion resolves the complete PR-stage workflow, not only the first required
+status job that becomes green. `release-candidate-wait-seconds` bounds that
+wait and defaults to three hours so long native builds can finish controller,
+publication-tail, and retained-evidence jobs without racing a merged promotion.
+An incomplete or failed workflow still fails closed; the longer bound does not
+turn a partial required-check result into candidate evidence.
+
 GitHub-Release-only consumers use the same managed admission without inventing
 an npm package identity:
 

package/docs/release-governance.md

@@ -487,6 +487,15 @@ same slow checks. Buildchain supports GitHub merge queues for that channel
 shape. The queue validates the projected merged result and serializes the final
 ref update, so concurrent channel movement no longer invalidates the candidate.
 
+GitHub Merge Queue does not by itself decide which candidate may spend a long
+native proof before enqueue. Repositories with that workload use the
+[Dev Delivery Warrant Queue](dev-delivery-warrant.md) as the durable,
+FIFO-aging scheduling and fencing authority before native queue admission. A
+selected Warrant owns one complete delivery attempt and later candidates remain
+visibly queued; GitHub still owns the exact `merge_group` proof and final ref
+mutation. Workflow concurrency remains only a process critical section and is
+not fairness or ownership authority.
+
 Every required workflow must handle both `pull_request` and `merge_group`
 before the queue is enabled. Queue runs do not provide
 `github.event.pull_request`; required workflows must use the checked-out
@@ -545,6 +554,33 @@ inputs: target dev branch, required status/check names, ready and block labels,
 allowed work-branch prefixes, review requirements, maximum merges per run,
 merge method, and dry-run mode.
 
+Agent delivery uses the targeted Buildchain command instead of relying on a
+scheduled scan:
+
+```sh
+buildchain dev pr-admit \
+  --repository kungfu-systems/example \
+  --branch dev/v3/v3.0 \
+  --pull-request 123 \
+  --expected-head 0123456789abcdef0123456789abcdef01234567
+```
+
+The default is a mutation-free plan. After reviewing it, add `--execute` to
+establish the configured readiness label for only that PR and exact head, read
+the state back, and attempt native queue admission. Repeating execute is
+idempotent: an exact matching queue entry is adopted, not submitted again. A
+stale head or base, fork, draft, block label, missing approval, failed check,
+active predecessor, or rejected enqueue exits nonzero. Execute mode also
+creates or updates an exact-head PR comment and named commit status containing
+the current state, reason, receipt root, and copyable next action. The JSON
+receipt remains the complete content-addressed evidence.
+
+GitHub auto-merge is observed but is never readiness or admission authority.
+Approval plus green checks plus auto-merge enabled does not qualify a PR that
+lacks explicit Buildchain delivery intent. The targeted workflow interface
+exposes the same contract through `expected-pr-number` and
+`expected-head-sha`; cadence patrol runs leave those inputs empty.
+
 The workflow defaults are conservative. A PR is skipped unless it targets the
 configured dev line, is not a draft, has the ready label, has no block label,
 comes from the same repository, uses an allowed work-branch prefix, has a
@@ -565,6 +601,15 @@ admission runs; GitHub still owns the atomic queue and protected-ref update.
 Repositories may explicitly select `landing-mode: direct` only when the target
 branch has no native queue. Queue presence always disables the direct path.
 
+For slow candidates on a frequently advancing dev line, the optional
+[Dev Delivery Warrant Queue](dev-delivery-warrant.md) adds durable FIFO plus
+aging scheduling before native queue admission. It separates reusable source
+qualification from exact merge-group integration, uses expected-old Git-ref
+updates and fenced leases, and keeps the PR head unchanged when only dev moves.
+The reusable caller supports `off`, read-only `shadow`, and fail-closed
+`required` rollout modes. GitHub Merge Queue remains the final protected-ref
+authority in every mode.
+
 The canonical consumer required check context is `check / check`, matching the
 reusable workflow call plus its `check` job. Buildchain's own `Verify` workflow
 emits the repository-local context `check`, so Buildchain self-promotion,
@@ -648,10 +693,11 @@ jobs:
       contents: write
       pull-requests: write
       checks: read
-      statuses: read
+      statuses: write
     with:
       target-branch: dev/v3/v3.0
       required-status-checks: check / check
+      queue-admission-context: Queue admission lease
       ready-label: ready
       block-labels: blocked,do-not-merge
       max-merges: 1
@@ -659,6 +705,12 @@ jobs:
       dry-run: ${{ inputs.dry-run || false }}
 ```
 
+When the protected branch requires a merge-group-only queue lease, the wrapper
+posts that configured context as a temporary success status on the exact PR
+head only after the ready, review, and required-check gates pass. It then
+enqueues with `expectedHeadOid`; a rejected enqueue rewrites the temporary
+status to failure, while the merge group must still produce its own final check.
+
 ## Buildchain Patrol
 
 `dev-pr-auto-merge.yml` remains the focused merge primitive. For repositories
@@ -680,6 +732,13 @@ The cadence names describe patrol intensity, not release cadence:
 - monthly patrol is for structural drift checks that should not block ordinary
   development velocity.
 
+Every cadence result is typed `runKind: cadence-patrol` with
+`qualification: false`. A run with no open candidates reports
+`no-op-no-candidates`; a run where every candidate is skipped reports
+`no-op-all-skipped`. Either no-op can keep maintenance green, but neither is a
+delivery qualification, a targeted admission receipt, or evidence that an
+expected PR entered the merge queue.
+
 Stable Candidate Patrol is separate from those maintenance cadences because its
 caller-owned cron is a release-intent window. Its candidate ledger and selection
 remain generic; registry-specific side effects still run through the normal

package/docs/reusable-build-surface.md

@@ -774,6 +774,9 @@ Direct GitHub Artifact payloads default to compression level `0`. Buildchain
 artifacts are commonly already-compressed archives; storing them without a
 second compression pass shortens the upload window while preserving the same
 artifact name, run/id/digest binding, retention, and no-overwrite behavior.
+Direct build and signed-finalization payload uploads include hidden files under
+the caller-declared artifact paths, matching the relay path so manifest-bound
+dotfiles are not silently removed in transit.
 Callers may select `1` through `9` for payloads that materially benefit from
 compression. Manifests and diagnostics retain their existing small-artifact
 behavior.
@@ -792,7 +795,14 @@ jobs:
       artifact-relay-s3-prefix: ${{ vars.BUILDCHAIN_ARTIFACT_RELAY_S3_PREFIX }}
 ```
 
-In relay mode, each self-hosted platform job uploads the heavy payload files to
+The mode is a policy for platforms that run outside GitHub. GitHub-hosted
+platforms always upload directly with `actions/upload-artifact`, even when a
+mixed matrix requests `s3-to-github-artifacts`; they never send their payloads
+through S3 or the replay job. Buildchain recognizes its hosted presets and the
+standard hosted runner labels. Custom matrices with non-standard hosted labels
+must declare `"githubHosted": true` on those platform rows.
+
+For remaining relay-mode platforms, each job uploads the heavy payload files to
 S3 and uploads only a small `relay-manifest.json` to GitHub. A GitHub-hosted
 `relay-artifacts` job then assumes the configured download role, downloads the
 payloads from S3, verifies every file by SHA256, and re-uploads the normal

package/docs/shifu-gate-profiles.md

@@ -135,7 +135,18 @@ a shell string.
 
 Projects may also pass non-sensitive scalar environment through
 `gate-environment-json`; Buildchain validates the JSON shape and forwards it
-without interpreting names or values. Cache profile references use the same
+without interpreting names or values. A custom `platforms-json` entry may add
+an `environment` object when a value is platform-specific; those scalars
+override the shared environment only for that matrix job. For example, a
+GitHub-hosted Linux lane can select an installed compiler without leaking the
+same setting into macOS or Windows:
+
+```yaml
+platforms-json: >-
+  [{"id":"linux-x64","name":"Linux x64","platform":"linux","runner":"[\"ubuntu-24.04\"]","capabilities":["node","native-toolchain"],"environment":{"CC":"gcc-14","CXX":"g++-14"}}]
+```
+
+Cache profile references use the same
 opaque `shifu-cache-profile-ref` and `shifu-cache-profile-digest` inputs as the
 reusable build. Do not place tokens, credentials, or other secrets in workflow
 inputs or Gate receipts.

package/docs/versioning.md

@@ -79,6 +79,8 @@ repository changes are patch".
 
 | Date       | Action       | Line    | Faces                                                                                                                                                                        | Class    | Rationale                                                                                                                                                                                                                                                                                                                              | PR    |
 | ---------- | ------------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
+| 2026-08-05 | extend-minor | `v3.0`  | auditable-demo-scenario, auditable-demo-capture, auditable-demo-adapter                                                                                                      | additive | Add an opt-in deterministic readable-playback declaration that preserves captured terminal payloads and order while normalizing only presentation timing; omitted playback continues to use observed PTY timestamps, and existing composition modes remain unchanged.                                                                 |       |
+| 2026-08-04 | extend-minor | `v3.0`  | dev-delivery-warrant-queue, source-qualification-proof, integration-delivery-proof, dev-delivery-cli, reusable-dev-delivery-workflows                                        | additive | Add durable fair and fenced protected-dev scheduling plus split source/integration proof contracts. Existing PR admission remains available through explicit `off` and `shadow` rollout modes; no existing command, export, or release flow is removed.                                                                                |       |
 | 2026-08-01 | extend-minor | `v3.0`  | cli-reference-registry, node-api-symbol-registry, golden-path-manual                                                                                                         | additive | Add generated, drift-checked CLI and Node API reference registries to the public site bundle, plus a package-tested first-user Golden Path; existing command execution and import semantics remain unchanged.                                                                                                                          |       |
 | 2026-07-31 | extend-minor | `v3.0`  | auditable-demo-workflow, auditable-demo-media-profile, auditable-demo-media-receipt                                                                                          | additive | Add an opt-in responsive profile that binds source-resolution and exact 1280x720 MP4/WebM/GIF renditions to one Gate and receipt while rejecting upscales, aspect-ratio drift, and profile changes between Gate-only and full-render paths.                                                                                            |       |
 | 2026-07-31 | extend-minor | `v3.0`  | release-candidate-family-evidence, release-passport-evidence-attachment, promotion-action, release-passport-cli                                                              | additive | Restore all-ref v2 parity for optional Initiative-family candidate binding and typed product-owned release evidence attachments while retaining Kungfu native Family State authority and the newer v3 post-activation released-evidence stage.                                                                                         | #2089 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.6-alpha.0",
+  "version": "3.0.6-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -28,6 +28,7 @@
     "./cache-evidence": "./packages/core/cache-evidence.js",
     "./controller-evidence": "./packages/core/controller-evidence.js",
     "./diagnostics": "./packages/core/diagnostics.js",
+    "./dev-delivery-warrant": "./packages/core/dev-delivery-warrant.js",
     "./homebrew": "./packages/core/homebrew.js",
     "./issue-reporting": "./packages/core/issue-reporting.js",
     "./kfd": "./packages/core/kfd.js",
@@ -108,6 +109,7 @@
   },
   "packageManager": "pnpm@11.7.0",
   "scripts": {
+    "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
     "check": "pnpm run check:static && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
     "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json bin/internal/command-registry.mjs scripts/authorize-promotion-runtime-override.cjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/maintainability-metrics.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs",
     "check:workflows": "bash scripts/check-workflows.sh",
@@ -128,7 +130,7 @@
     "typescript": "^5.9.0"
   },
   "dependencies": {
-    "@kungfu-tech/kfd": "1.0.0-alpha.47",
+    "@kungfu-tech/kfd": "1.0.0-alpha.53",
     "smol-toml": "1.7.0"
   }
 }

package/packages/core/buildchain-publication-authority.js

@@ -24,6 +24,7 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/build-surface-fixture.yml", "non-publication-oidc"],
   [".github/workflows/build.yml", "non-publication-oidc"],
   [".github/workflows/buildchain-alpha-self-dogfood.yml", "non-publication-oidc"],
+  [".github/workflows/buildchain-dev-delivery.yml", "governance-write"],
   [".github/workflows/buildchain-patrol-daily.yml", "governance-write"],
   [".github/workflows/buildchain-patrol-monthly.yml", "governance-write"],
   [".github/workflows/buildchain-patrol-weekly.yml", "governance-write"],
@@ -32,6 +33,8 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
   [".github/workflows/dev-qualification-patrol.yml", "governance-write"],
   [".github/workflows/dev-alpha-candidate-patrol.yml", "governance-write"],
+  [".github/workflows/dev-delivery-warrant-close.yml", "governance-write"],
+  [".github/workflows/dev-delivery-warrant-cancel.yml", "governance-write"],
   [".github/workflows/dev-merge-queue-governance.yml", "governance-write"],
   [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
   [".github/workflows/github-governance-audit.yml", "governance-write"],
@@ -75,7 +78,6 @@ export function buildchainPublicationAuthorityDescriptors() {
     runnerPolicy: publicationCapable ? "qualified-measured" : "unqualified",
   }));
 }
-
 export function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) {
   const workflowsDir = path.join(root, ".github", "workflows");
   const workflows = fs.readdirSync(workflowsDir)

package/packages/core/channel-candidate.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import crypto from "node:crypto";
+import { normalizeChannelCandidateSelection } from "./channel-promotion-baseline.js";
 
 export const CHANNEL_CANDIDATE_DECISION_SCHEMA =
   "kungfu-buildchain-channel-candidate-decision/v1";
@@ -95,27 +96,7 @@ export function decideChannelCandidate(input) {
     throw new Error("sourceBranch and targetBranch must differ");
   const sourceSha = sha(input.sourceSha, "sourceSha");
   const targetSha = sha(input.targetSha, "targetSha");
-  const selection = input.selection
-    ? {
-        mode: required(input.selection.mode, "selection.mode"),
-        observedSourceHeadSha: sha(
-          input.selection.observedSourceHeadSha,
-          "selection.observedSourceHeadSha",
-        ),
-        skippedNewerCommitCount: Number(
-          input.selection.skippedNewerCommitCount || 0,
-        ),
-      }
-    : undefined;
-  if (
-    selection &&
-    (!Number.isSafeInteger(selection.skippedNewerCommitCount) ||
-      selection.skippedNewerCommitCount < 0)
-  ) {
-    throw new Error(
-      "selection.skippedNewerCommitCount must be a non-negative integer",
-    );
-  }
+  const selection = normalizeChannelCandidateSelection(input.selection);
   const now = required(input.now || new Date().toISOString(), "now");
   const maxAgeSeconds = Number(input.maxAgeSeconds ?? 7 * 24 * 60 * 60);
   if (!Number.isSafeInteger(maxAgeSeconds) || maxAgeSeconds <= 0) {