@kungfu-tech/buildchain 3.0.6-alpha.4 → 3.0.6-alpha.6

package/dist/site/public-surface-audit.json

@@ -7604,7 +7604,7 @@
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "2e7804e1fa8ef08bbe59fcf58908e47daef4dc145675fc9a989862671e40f993",
     "workflowRegistryDigest": "1ab8b8d32f2ceb8dffad69d1f877f6ad6b37355dbe62c6ef5c0e6b9f4f197acb",
-    "pageRegistryDigest": "ce8922a853a4784781b708b0572cb3035ec08058847900b1eff2580130ba6d28"
+    "pageRegistryDigest": "300d36c3126d981d2b749827b550f7428e0da8981bf87d8b189b6832bbda7816"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-06T04:18:30.646Z",
-  "publishedAt": "2026-08-06T04:18:30.646Z",
+  "generatedAt": "2026-08-06T06:16:10.942Z",
+  "publishedAt": "2026-08-06T06:16:10.942Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "0adfa4b1f1784f8d43ac056991822a32cf5e8e7f",
+  "sourceRevision": "507c67140e094085af9c0431557fa32ed65a43df",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.4",
+    "version": "3.0.6-alpha.6",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-06T04:18:30.646Z",
-  "publishedAt": "2026-08-06T04:18:30.646Z",
+  "generatedAt": "2026-08-06T06:16:10.942Z",
+  "publishedAt": "2026-08-06T06:16:10.942Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "0adfa4b1f1784f8d43ac056991822a32cf5e8e7f",
+  "sourceRevision": "507c67140e094085af9c0431557fa32ed65a43df",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.4",
+    "version": "3.0.6-alpha.6",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -125,7 +125,7 @@
       "path": "docs/release-candidate.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:71161bb57229fe6b66ca131189d3ff3f1dd1a8ca7f6894aa1f596827cb8167f3"
+      "digest": "sha256:9cb06463e0cbb06180ae4e9ed3258a9e7466237916ffc766c548ef5faa730651"
     },
     {
       "id": "release-propagation",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:18da0179c3dbfee4fa393d46111122ef16b9da1130092b6d88d820e4277e87c2"
+      "digest": "sha256:f8ae86b9182811d9f980b3ae1f1a42d2c84cd6c133003c996946848f938099a8"
     },
     {
       "id": "build-facts",

package/docs/node-api-reference.md

@@ -447,7 +447,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `readReleaseTransaction` | function: function readReleaseTransaction(filePath) | filePath | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { readReleaseTransaction } from "@kungfu-tech/buildchain";` | `packages/core/publish-transaction.js:367` |
 | `recordReleaseActivationPhase` | function: function recordReleaseActivationPhase(transaction, phaseId, { receiptRoots = [], failure = "" } = {}) | transaction, phaseId, { receiptRoots = [], failure = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordReleaseActivationPhase } from "@kungfu-tech/buildchain";` | `packages/core/release-activation-transaction.js:217` |
 | `recordReleasePropagationStage` | function: function recordReleasePropagationStage({ work, expectedWorkRoot, receipt } = {}) | { work, expectedWorkRoot, receipt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordReleasePropagationStage } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work-transitions.js:45` |
-| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:396` |
+| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:441` |
 | `redactBuildchainLogAttributes` | function: function redactBuildchainLogAttributes(attributes = {}) | attributes = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { redactBuildchainLogAttributes } from "@kungfu-tech/buildchain";` | `packages/core/logging.js:33` |
 | `redactDiagnosticsValue` | function: function redactDiagnosticsValue(key, value, pattern = DEFAULT_SECRET_KEY_PATTERN) | key, value, pattern = DEFAULT_SECRET_KEY_PATTERN | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { redactDiagnosticsValue } from "@kungfu-tech/buildchain";` | `packages/core/diagnostics.js:953` |
 | `redactIssueText` | function: function redactIssueText(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { redactIssueText } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:51` |
@@ -571,7 +571,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `verifyPublicationQualificationReceipt` | function: function verifyPublicationQualificationReceipt({ receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {}) | { receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationQualificationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:1096` |
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain";` | `packages/core/publication-reproducibility.js:869` |
 | `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:124` |
-| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:273` |
+| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:318` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain";` | `packages/core/release-passport.js:2743` |
 | `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:486` |
 | `WEB_SURFACE_PRODUCTION_DECISION_CONTRACT` | constant: const WEB_SURFACE_PRODUCTION_DECISION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PRODUCTION_DECISION_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/web-surface-publication-candidate.js:7` |
@@ -1062,7 +1062,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `readReleaseTransaction` | function: function readReleaseTransaction(filePath) | filePath | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { readReleaseTransaction } from "@kungfu-tech/buildchain/core";` | `packages/core/publish-transaction.js:367` |
 | `recordReleaseActivationPhase` | function: function recordReleaseActivationPhase(transaction, phaseId, { receiptRoots = [], failure = "" } = {}) | transaction, phaseId, { receiptRoots = [], failure = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordReleaseActivationPhase } from "@kungfu-tech/buildchain/core";` | `packages/core/release-activation-transaction.js:217` |
 | `recordReleasePropagationStage` | function: function recordReleasePropagationStage({ work, expectedWorkRoot, receipt } = {}) | { work, expectedWorkRoot, receipt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordReleasePropagationStage } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work-transitions.js:45` |
-| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:396` |
+| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:441` |
 | `redactBuildchainLogAttributes` | function: function redactBuildchainLogAttributes(attributes = {}) | attributes = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { redactBuildchainLogAttributes } from "@kungfu-tech/buildchain/core";` | `packages/core/logging.js:33` |
 | `redactDiagnosticsValue` | function: function redactDiagnosticsValue(key, value, pattern = DEFAULT_SECRET_KEY_PATTERN) | key, value, pattern = DEFAULT_SECRET_KEY_PATTERN | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { redactDiagnosticsValue } from "@kungfu-tech/buildchain/core";` | `packages/core/diagnostics.js:953` |
 | `redactIssueText` | function: function redactIssueText(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { redactIssueText } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:51` |
@@ -1186,7 +1186,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `verifyPublicationQualificationReceipt` | function: function verifyPublicationQualificationReceipt({ receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {}) | { receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationQualificationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:1096` |
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-reproducibility.js:869` |
 | `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:124` |
-| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:273` |
+| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:318` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain/core";` | `packages/core/release-passport.js:2743` |
 | `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:486` |
 | `WEB_SURFACE_PRODUCTION_DECISION_CONTRACT` | constant: const WEB_SURFACE_PRODUCTION_DECISION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PRODUCTION_DECISION_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/web-surface-publication-candidate.js:7` |
@@ -1906,14 +1906,15 @@ Target: `./packages/core/release-candidate.js`. Public symbols: 5.
 
 ## `@kungfu-tech/buildchain/release-candidate-recovery`
 
-Target: `./packages/core/release-candidate-recovery.js`. Public symbols: 4.
+Target: `./packages/core/release-candidate-recovery.js`. Public symbols: 5.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:396` |
+| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:441` |
 | `RELEASE_CANDIDATE_RECOVERY_CONTRACT` | constant: const RELEASE_CANDIDATE_RECOVERY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_CANDIDATE_RECOVERY_CONTRACT } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:11` |
 | `ReleaseCandidateRecoveryError` | class: class ReleaseCandidateRecoveryError | none | ReleaseCandidateRecoveryError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseCandidateRecoveryError } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:18` |
-| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:273` |
+| `validateReleaseCandidateRecoveryReceipt` | function: function validateReleaseCandidateRecoveryReceipt({ receipt, passport, repository = "", targetChannel = "", targetRef = "", targetSha = "", targetTree = "", version = "", } = {}) | { receipt, passport, repository = "", targetChannel = "", targetRef = "", targetSha = "", targetTree = "", version = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateReleaseCandidateRecoveryReceipt } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:96` |
+| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:318` |
 
 ## `@kungfu-tech/buildchain/stable-candidate-ledger`
 

package/docs/release-candidate.md

@@ -195,6 +195,15 @@ the skipped stages, current tooling SHA, transaction identity/state, and an
 exact receipt root. The receipt is uploaded as an Actions artifact and staged
 with immutable GitHub Release Passport assets.
 
+The original candidate Passport is never rewritten when a reusable fixture or
+consumer build records a product version different from the sealed publication
+package. In that case the promote action validates the Passport without
+discarding its original target, then requires the immutable recovery receipt to
+bind the original candidate root and source/tree to the exact version read from
+the sealed payload. Without that receipt, the existing direct Passport version
+check remains mandatory; receipt, candidate-root, target, or version drift fails
+before publication side effects.
+
 Missing or expired artifacts, archive or payload digest drift, tree/root,
 repository/workflow/channel/target mismatch, untrusted run/PR provenance,
 incomplete controller evidence, and transaction conflict fail closed with an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.6-alpha.4",
+  "version": "3.0.6-alpha.6",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/release-candidate-recovery.js

@@ -93,6 +93,51 @@ function normalizedRef(value) {
   return String(value || "").replace(/^refs\/heads\//, "").trim();
 }
 
+export function validateReleaseCandidateRecoveryReceipt({
+  receipt,
+  passport,
+  repository = "",
+  targetChannel = "",
+  targetRef = "",
+  targetSha = "",
+  targetTree = "",
+  version = "",
+} = {}) {
+  const receiptObject = Boolean(receipt && typeof receipt === "object" && !Array.isArray(receipt));
+  const passportObject = Boolean(passport && typeof passport === "object" && !Array.isArray(passport));
+  const rootedReceipt = Object.assign({}, receipt);
+  delete rootedReceipt.root;
+  const candidateHash = String(passport?.candidateHash || "");
+  const candidateRoot = `sha256:${candidateHash}`;
+  const checks = [
+    [receiptObject, "receipt must be an object"],
+    [passportObject, "passport must be an object"],
+    [receipt?.contract === RELEASE_CANDIDATE_RECOVERY_CONTRACT, `contract must be ${RELEASE_CANDIDATE_RECOVERY_CONTRACT}`],
+    [Number(receipt?.schemaVersion) === 1, "schemaVersion must be 1"],
+    [receipt?.action === "reused", "action must be reused"],
+    [receipt?.payloadBytes === "unchanged", "payloadBytes must be unchanged"],
+    [JSON.stringify(receipt?.skippedBuildStages) === JSON.stringify(["install", "build", "verify", "platform-matrix"]), "skippedBuildStages must record the complete skipped product build matrix"],
+    [receipt?.root === `sha256:${sha256Json(rootedReceipt)}`, "receipt root mismatch"],
+    [!repository || receipt?.repository === repository, `repository mismatch: expected ${repository}, got ${receipt?.repository || "<empty>"}`],
+    [!targetChannel || receipt?.target?.channel === targetChannel, `target channel mismatch: expected ${targetChannel}, got ${receipt?.target?.channel || "<empty>"}`],
+    [!targetRef || normalizedRef(receipt?.target?.ref) === normalizedRef(targetRef), `target ref mismatch: expected ${normalizedRef(targetRef)}, got ${normalizedRef(receipt?.target?.ref) || "<empty>"}`],
+    [!targetSha || receipt?.target?.sha === targetSha, `target SHA mismatch: expected ${targetSha}, got ${receipt?.target?.sha || "<empty>"}`],
+    [!targetTree || receipt?.target?.tree === targetTree, `target tree mismatch: expected ${targetTree}, got ${receipt?.target?.tree || "<empty>"}`],
+    [!version || receipt?.target?.version === version, `publication version mismatch: expected ${version}, got ${receipt?.target?.version || "<empty>"}`],
+    [passportObject && /^[0-9a-f]{64}$/.test(candidateHash), "passport candidateHash must be a sha256 digest"],
+    [passportObject && receipt?.recovered?.candidateRoot === candidateRoot, `candidate root mismatch: expected ${candidateRoot}, got ${receipt?.recovered?.candidateRoot || "<empty>"}`],
+    [passportObject && receipt?.originalCandidate?.sourceSha === passport?.source?.headSha, "original candidate source SHA mismatch"],
+    [passportObject && receipt?.originalCandidate?.tree === passport?.source?.treeHash, "original candidate tree mismatch"],
+  ];
+  const errors = checks.filter(([ok]) => !ok).map(([, message]) => message);
+  return {
+    ok: errors.length === 0,
+    errors,
+    publicationVersion: String(receipt?.target?.version || ""),
+    candidateRoot: String(receipt?.recovered?.candidateRoot || ""),
+  };
+}
+
 function sameArtifactFile(left, right) {
   return Boolean(left && right && left.size === right.size && left.sha256 === right.sha256);
 }

package/scripts/check-inventory.mjs

@@ -1051,6 +1051,8 @@ for (const requiredSnippet of [
   "publish-sealed-bundle-root: ${{ steps.rc.outputs.publish-sealed-bundle-root }}",
   "BUILDCHAIN_EXPECTED_TRANSACTION_ID: ${{ inputs.resume-transaction-id }}",
   "if: ${{ inputs.resume-candidate-run-id == '' }}",
+  "Bridge Buildchain self-runtime dependencies",
+  "ln -s .buildchain/runtime/node_modules node_modules",
 ]) {
   if (!releaseCandidatePromoteWorkflow.includes(requiredSnippet)) {
     throw new Error(`release candidate promote workflow missing KFD gate pass-through: ${requiredSnippet}`);

package/scripts/publication-candidate-sealer.mjs

@@ -0,0 +1,104 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+import {
+  PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT,
+  publicationArtifactCandidateDigest,
+} from "../packages/core/publication-artifact-candidate.js";
+import { createPublicationSealedBundle } from "../packages/core/publication-sealed-bundle.js";
+
+function requiredString(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} must be a non-empty string`);
+  return normalized;
+}
+
+function normalizeSha256(value, label) {
+  const digest = requiredString(value, label).replace(/^sha256:/, "").toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(digest)) throw new Error(`${label} must be a sha256 digest`);
+  return digest;
+}
+
+function assertGitSha(value, label) {
+  const sha = requiredString(value, label);
+  if (!/^[0-9a-f]{40}$/i.test(sha)) throw new Error(`${label} must be a 40-character Git SHA`);
+  return sha.toLowerCase();
+}
+
+function collectCandidateFiles(root) {
+  const resolvedRoot = path.resolve(requiredString(root, "bundleRoot"));
+  const files = [];
+  const stack = fs.existsSync(resolvedRoot) ? [resolvedRoot] : [];
+  while (stack.length) {
+    const current = stack.pop();
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const absolutePath = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        stack.push(absolutePath);
+      } else if (entry.isFile()) {
+        files.push({
+          path: path.relative(resolvedRoot, absolutePath).split(path.sep).join("/"),
+          absolutePath,
+          size: fs.statSync(absolutePath).size,
+          sha256: crypto.createHash("sha256").update(fs.readFileSync(absolutePath)).digest("hex"),
+        });
+      }
+    }
+  }
+  return { resolvedRoot, files: files.sort((left, right) => left.path.localeCompare(right.path)) };
+}
+
+export function createResolvedPublicationSealedBundle({
+  bundleRoot,
+  repository,
+  sourceSha,
+  sourceTreeSha,
+  runtimeSha,
+  releaseCandidateRoot,
+  npmArtifacts = [],
+  releaseAssetPaths = [],
+} = {}) {
+  if (npmArtifacts.length === 0) return undefined;
+  const { resolvedRoot, files } = collectCandidateFiles(bundleRoot);
+  const byAbsolutePath = new Map(files.map((file) => [path.resolve(file.absolutePath), file]));
+  const resolvedNpmArtifacts = npmArtifacts.map((artifact, index) => {
+    const file = byAbsolutePath.get(path.resolve(requiredString(artifact.path, `npmArtifacts[${index}].path`)));
+    if (!file) throw new Error(`npmArtifacts[${index}].path is outside the sealed payload root`);
+    return { file, metadata: artifact };
+  });
+  const main = resolvedNpmArtifacts.find((entry) => entry.metadata.role === "main")
+    || (resolvedNpmArtifacts.length === 1 ? resolvedNpmArtifacts[0] : undefined);
+  if (!main) throw new Error("candidate npm payload set has no unique main package tarball");
+  const selectedReleaseAssets = (releaseAssetPaths.length > 0
+    ? releaseAssetPaths
+    : resolvedNpmArtifacts.map((entry) => entry.file.absolutePath))
+    .map((assetPath, index) => {
+      const file = byAbsolutePath.get(path.resolve(assetPath));
+      if (!file) throw new Error(`releaseAssetPaths[${index}] is outside the sealed payload root`);
+      return file;
+    });
+  const candidatePayload = {
+    schemaVersion: 1,
+    contract: PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT,
+    repository: requiredString(repository, "repository"),
+    sourceSha: assertGitSha(sourceSha, "sourceSha"),
+    sourceTreeSha: assertGitSha(sourceTreeSha, "sourceTreeSha"),
+    runtimeSha: assertGitSha(runtimeSha, "runtimeSha"),
+    releaseCandidateRoot: `sha256:${normalizeSha256(releaseCandidateRoot, "releaseCandidateRoot")}`,
+    files: files.map(({ path: filePath, size, sha256 }) => ({ path: filePath, size, sha256 })),
+  };
+  const candidate = {
+    ...candidatePayload,
+    candidateDigest: publicationArtifactCandidateDigest(candidatePayload),
+  };
+  const manifest = createPublicationSealedBundle({
+    candidate,
+    packageName: main.metadata.name,
+    packageVersion: main.metadata.ref,
+    npmTarballPath: main.file.path,
+    npmIntegrity: main.metadata.integrity,
+    releaseAssetPaths: selectedReleaseAssets.map((file) => file.path),
+  });
+  return { root: resolvedRoot, manifest, npmArtifacts: resolvedNpmArtifacts, files };
+}

package/scripts/release-candidate-resolver.mjs

@@ -5,6 +5,7 @@ import os from "node:os";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
+import { createResolvedPublicationSealedBundle } from "./publication-candidate-sealer.mjs";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 const DEFAULT_WORKFLOW_FILE = "build-surface-fixture.yml";
@@ -421,6 +422,7 @@ export async function resolveReleaseCandidateArtifacts({
   requiredArtifactCount = 0,
   publishArtifactKind = "npm",
   publishPackageMain = "",
+  runtimeSha = "",
   outputDir = ".buildchain/release-candidate",
   fetchImpl = globalThis.fetch,
   download = true,
@@ -668,6 +670,27 @@ export async function resolveReleaseCandidateArtifacts({
   });
   const requiredArtifactsPath = path.join(resolvedOutput, "publish-required-artifacts.json");
   fs.writeFileSync(requiredArtifactsPath, `${JSON.stringify(generatedRequiredArtifacts, null, 2)}\n`);
+  const sealedBundle = publishArtifactKind === "npm"
+    ? createResolvedPublicationSealedBundle({
+        bundleRoot: payloadDir,
+        repository: repoInfo.fullName,
+        sourceSha: passport.source?.headSha,
+        sourceTreeSha: passport.source?.treeHash,
+        runtimeSha: runtimeSha || sha,
+        releaseCandidateRoot: passport.candidateHash,
+        npmArtifacts: npmTarballPaths.map((tarballPath) => ({
+          path: tarballPath,
+          ...readNpmPackageArtifact({ tarballPath, mainPackage: publishPackageMain }),
+        })),
+        releaseAssetPaths,
+      })
+    : undefined;
+  const sealedBundleManifestPath = sealedBundle
+    ? path.join(resolvedOutput, "sealed-bundle.json")
+    : "";
+  if (sealedBundleManifestPath) {
+    fs.writeFileSync(sealedBundleManifestPath, `${JSON.stringify(sealedBundle.manifest, null, 2)}\n`);
+  }
   return {
     ...result,
     paths: {
@@ -679,6 +702,8 @@ export async function resolveReleaseCandidateArtifacts({
       npmTarballs: npmTarballPaths.map(outputPath),
       releaseAssets: releaseAssetPaths.map(outputPath),
       publishRequiredArtifacts: outputPath(requiredArtifactsPath),
+      sealedBundleRoot: sealedBundle ? outputPath(sealedBundle.root) : "",
+      sealedBundleManifest: sealedBundleManifestPath ? outputPath(sealedBundleManifestPath) : "",
     },
     version: passport.target?.version || "",
     candidateHash: passport.candidateHash || "",
@@ -705,6 +730,7 @@ export async function resolveReleaseCandidateArtifactsCli() {
     requiredArtifactCount: env("BUILDCHAIN_REQUIRED_ARTIFACT_COUNT", "0"),
     publishArtifactKind: env("BUILDCHAIN_PUBLISH_ARTIFACT_KIND", "npm"),
     publishPackageMain: env("BUILDCHAIN_PUBLISH_PACKAGE_MAIN"),
+    runtimeSha: env("BUILDCHAIN_CURRENT_RUNTIME_SHA", env("BUILDCHAIN_RUNTIME_SHA", env("BUILDCHAIN_TARGET_SHA"))),
     outputDir: env("BUILDCHAIN_RC_OUTPUT_DIR", ".buildchain/release-candidate"),
     download: releaseCandidateDownloadEnabled(env("BUILDCHAIN_RC_DOWNLOAD", "true")),
     waitSeconds: env("BUILDCHAIN_RC_WAIT_SECONDS", "600"),
@@ -735,6 +761,8 @@ export async function resolveReleaseCandidateArtifactsCli() {
     ).join("\n"),
     "publish-required-artifacts-json": JSON.stringify(result.publishRequiredArtifacts || []),
     "publish-required-artifacts-path": result.paths?.publishRequiredArtifacts || "",
+    "publish-sealed-bundle-root": result.paths?.sealedBundleRoot || "",
+    "publish-sealed-bundle-manifest": result.paths?.sealedBundleManifest || "",
     "release-candidate-run-id": result.run?.id || "",
     "release-candidate-run-url": result.run?.url || "",
     "release-candidate-pr": result.pullRequest?.number ? String(result.pullRequest.number) : "",