@kungfu-tech/buildchain 3.0.6-alpha.6 → 3.0.6

package/dist/site/public-surface-audit.json

@@ -907,6 +907,9 @@
           "buildchain-ref",
           "buildchain-repository",
           "consumer-gate-command",
+          "consumer-gate-controller-sha",
+          "consumer-gate-evidence-source-sha",
+          "consumer-gate-evidence-source-tree",
           "consumer-predicate-digest",
           "consumer-predicate-id",
           "consumer-qualification-required",
@@ -934,7 +937,7 @@
           "target-ref",
           "used-nonces-json"
         ],
-        "inputCount": 34,
+        "inputCount": 37,
         "secrets": [
           "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
         ],
@@ -997,6 +1000,7 @@
           "publication-expected-json",
           "publication-gate-aggregate-json",
           "publication-gate-command",
+          "publication-gate-controller-sha",
           "publication-package-name",
           "publication-product",
           "publication-publisher-workflow-path",
@@ -1060,7 +1064,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 106,
+        "inputCount": 107,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2419,6 +2423,7 @@
           "publication-expected-json",
           "publication-gate-aggregate-json",
           "publication-gate-command",
+          "publication-gate-controller-sha",
           "publication-package-name",
           "publication-product",
           "publication-publisher-workflow-path",
@@ -2482,7 +2487,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 98,
+        "inputCount": 99,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -7603,8 +7608,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "2e7804e1fa8ef08bbe59fcf58908e47daef4dc145675fc9a989862671e40f993",
-    "workflowRegistryDigest": "1ab8b8d32f2ceb8dffad69d1f877f6ad6b37355dbe62c6ef5c0e6b9f4f197acb",
-    "pageRegistryDigest": "300d36c3126d981d2b749827b550f7428e0da8981bf87d8b189b6832bbda7816"
+    "workflowRegistryDigest": "20c6b31e754f9f0ffb15362bd1b646376e9cf2698951d5f502a5bafcdfd523e7",
+    "pageRegistryDigest": "50489f303fc5343c6c13ed307f0f7d008fa8deee7f32dd8ff701d47775b210df"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-06T06:16:10.942Z",
-  "publishedAt": "2026-08-06T06:16:10.942Z",
+  "generatedAt": "2026-08-07T01:27:51.160Z",
+  "publishedAt": "2026-08-07T01:27:51.160Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "507c67140e094085af9c0431557fa32ed65a43df",
+  "sourceRevision": "4d3415855debb03bac01c4f5d11417f0d1ea42d8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.6",
+    "version": "3.0.6",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-06T06:16:10.942Z",
-  "publishedAt": "2026-08-06T06:16:10.942Z",
+  "generatedAt": "2026-08-07T01:27:51.160Z",
+  "publishedAt": "2026-08-07T01:27:51.160Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "507c67140e094085af9c0431557fa32ed65a43df",
+  "sourceRevision": "4d3415855debb03bac01c4f5d11417f0d1ea42d8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.6",
+    "version": "3.0.6",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -125,7 +125,7 @@
       "path": "docs/release-candidate.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:9cb06463e0cbb06180ae4e9ed3258a9e7466237916ffc766c548ef5faa730651"
+      "digest": "sha256:d76bbd75aab3c4dd94756c1c64562a125e74369c7c8b97342dbcacc5d7561602"
     },
     {
       "id": "release-propagation",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:f8ae86b9182811d9f980b3ae1f1a42d2c84cd6c133003c996946848f938099a8"
+      "digest": "sha256:f5592359584e98ab4283d56b0262fdcf9c5da61f48033cecad1b0404aa95bd2e"
     },
     {
       "id": "build-facts",
@@ -293,7 +293,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:481640f398d966dca4f1f2e29a8100f0f479315ee19e65b0e259720f2b61213f"
+      "digest": "sha256:34fb81d1dd9f913cbed6ee76ac9f0bdb095669e55c1bee67389601fd494470cf"
     },
     {
       "id": "release-flow",

package/dist/site/workflow-registry.json

@@ -396,6 +396,9 @@
         "buildchain-ref",
         "buildchain-repository",
         "consumer-gate-command",
+        "consumer-gate-controller-sha",
+        "consumer-gate-evidence-source-sha",
+        "consumer-gate-evidence-source-tree",
         "consumer-predicate-digest",
         "consumer-predicate-id",
         "consumer-qualification-required",
@@ -423,7 +426,7 @@
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 34,
+      "inputCount": 37,
       "secrets": [
         "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
       ],
@@ -496,6 +499,7 @@
         "publication-expected-json",
         "publication-gate-aggregate-json",
         "publication-gate-command",
+        "publication-gate-controller-sha",
         "publication-package-name",
         "publication-product",
         "publication-publisher-workflow-path",
@@ -559,7 +563,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 106,
+      "inputCount": 107,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2388,6 +2392,7 @@
         "publication-expected-json",
         "publication-gate-aggregate-json",
         "publication-gate-command",
+        "publication-gate-controller-sha",
         "publication-package-name",
         "publication-product",
         "publication-publisher-workflow-path",
@@ -2451,7 +2456,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 98,
+      "inputCount": 99,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",

package/docs/node-api-reference.md

@@ -217,7 +217,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `createPublicationControlPlaneAudit` | function: function createPublicationControlPlaneAudit({ repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {}) | { repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationControlPlaneAudit } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:208` |
 | `createPublicationGateDecision` | function: function createPublicationGateDecision({ sourceSha, profile, required = false, rationale, policy = {}, } = {}) | { sourceSha, profile, required = false, rationale, policy = {}, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationGateDecision } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:280` |
 | `createPublicationQualificationReceipt` | function: function createPublicationQualificationReceipt({ capability, gateAggregate, consumerDecision, now = new Date(), } = {}) | { capability, gateAggregate, consumerDecision, now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationQualificationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:1035` |
-| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:75` |
+| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:84` |
 | `createPublicationSourceBundle` | function: function createPublicationSourceBundle({ cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {}) | { cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { createPublicationSourceBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-artifact.js:249` |
 | `createReadmeBadgeEndpointRegistry` | function: function createReadmeBadgeEndpointRegistry({ kfdSpecs = undefined, kfdStandards = undefined } = {}) | { kfdSpecs = undefined, kfdStandards = undefined } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createReadmeBadgeEndpointRegistry } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:133` |
 | `createReleaseActivationReceiptSet` | function: function createReleaseActivationReceiptSet({ transaction, receipts = [], } = {}) | { transaction, receipts = [], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createReleaseActivationReceiptSet } from "@kungfu-tech/buildchain";` | `packages/core/release-activation-transaction.js:311` |
@@ -447,7 +447,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `readReleaseTransaction` | function: function readReleaseTransaction(filePath) | filePath | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { readReleaseTransaction } from "@kungfu-tech/buildchain";` | `packages/core/publish-transaction.js:367` |
 | `recordReleaseActivationPhase` | function: function recordReleaseActivationPhase(transaction, phaseId, { receiptRoots = [], failure = "" } = {}) | transaction, phaseId, { receiptRoots = [], failure = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordReleaseActivationPhase } from "@kungfu-tech/buildchain";` | `packages/core/release-activation-transaction.js:217` |
 | `recordReleasePropagationStage` | function: function recordReleasePropagationStage({ work, expectedWorkRoot, receipt } = {}) | { work, expectedWorkRoot, receipt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordReleasePropagationStage } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work-transitions.js:45` |
-| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:441` |
+| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:529` |
 | `redactBuildchainLogAttributes` | function: function redactBuildchainLogAttributes(attributes = {}) | attributes = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { redactBuildchainLogAttributes } from "@kungfu-tech/buildchain";` | `packages/core/logging.js:33` |
 | `redactDiagnosticsValue` | function: function redactDiagnosticsValue(key, value, pattern = DEFAULT_SECRET_KEY_PATTERN) | key, value, pattern = DEFAULT_SECRET_KEY_PATTERN | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { redactDiagnosticsValue } from "@kungfu-tech/buildchain";` | `packages/core/diagnostics.js:953` |
 | `redactIssueText` | function: function redactIssueText(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { redactIssueText } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:51` |
@@ -457,7 +457,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `RELEASE_ACTIVATION_PHASES` | constant: const RELEASE_ACTIVATION_PHASES | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_ACTIVATION_PHASES } from "@kungfu-tech/buildchain";` | `packages/core/release-activation-transaction.js:8` |
 | `RELEASE_ACTIVATION_RECEIPT_SET_CONTRACT` | constant: const RELEASE_ACTIVATION_RECEIPT_SET_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_ACTIVATION_RECEIPT_SET_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-activation-transaction.js:5` |
 | `RELEASE_CANDIDATE_PASSPORT_CONTRACT` | constant: const RELEASE_CANDIDATE_PASSPORT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_CANDIDATE_PASSPORT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate.js:4` |
-| `RELEASE_CANDIDATE_RECOVERY_CONTRACT` | constant: const RELEASE_CANDIDATE_RECOVERY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_CANDIDATE_RECOVERY_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:11` |
+| `RELEASE_CANDIDATE_RECOVERY_CONTRACT` | constant: const RELEASE_CANDIDATE_RECOVERY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_CANDIDATE_RECOVERY_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:15` |
 | `RELEASE_CHECK_REPORT_CONTRACT` | constant: const RELEASE_CHECK_REPORT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_CHECK_REPORT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-passport.js:33` |
 | `RELEASE_EVIDENCE_ATTACHMENT_CONTRACT` | constant: const RELEASE_EVIDENCE_ATTACHMENT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_EVIDENCE_ATTACHMENT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-passport.js:34` |
 | `RELEASE_PASSPORT_CHECK_MANIFEST_CONTRACT` | constant: const RELEASE_PASSPORT_CHECK_MANIFEST_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PASSPORT_CHECK_MANIFEST_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-passport-contract.js:9` |
@@ -476,7 +476,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `RELEASE_PROPAGATION_WORK_CONTRACT` | constant: const RELEASE_PROPAGATION_WORK_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_WORK_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work-constants.js:1` |
 | `RELEASE_PROPAGATION_WORK_STAGES` | constant: const RELEASE_PROPAGATION_WORK_STAGES | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_WORK_STAGES } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work-constants.js:4` |
 | `releaseActivationRoot` | function: function releaseActivationRoot(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { releaseActivationRoot } from "@kungfu-tech/buildchain";` | `packages/core/release-activation-transaction.js:38` |
-| `ReleaseCandidateRecoveryError` | class: class ReleaseCandidateRecoveryError | none | ReleaseCandidateRecoveryError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseCandidateRecoveryError } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:18` |
+| `ReleaseCandidateRecoveryError` | class: class ReleaseCandidateRecoveryError | none | ReleaseCandidateRecoveryError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseCandidateRecoveryError } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:56` |
 | `renderBadgeBundleBlock` | function: function renderBadgeBundleBlock(facts) | facts | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBadgeBundleBlock } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:840` |
 | `renderBuildchainContractDriftIssueBody` | function: function renderBuildchainContractDriftIssueBody({ repository = "", workflow = "", runUrl = "", lockPath = "", evaluation, } = {}) | { repository = "", workflow = "", runUrl = "", lockPath = "", evaluation, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBuildchainContractDriftIssueBody } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-contract.js:985` |
 | `renderHomebrewFormula` | function: function renderHomebrewFormula(facts) | facts | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { renderHomebrewFormula } from "@kungfu-tech/buildchain";` | `packages/core/homebrew.js:290` |
@@ -570,8 +570,8 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `verifyPublicationAdmission` | function: function verifyPublicationAdmission({ admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {}) | { admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationAdmission } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:791` |
 | `verifyPublicationQualificationReceipt` | function: function verifyPublicationQualificationReceipt({ receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {}) | { receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationQualificationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:1096` |
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain";` | `packages/core/publication-reproducibility.js:869` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:124` |
-| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:318` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:133` |
+| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:398` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain";` | `packages/core/release-passport.js:2743` |
 | `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:486` |
 | `WEB_SURFACE_PRODUCTION_DECISION_CONTRACT` | constant: const WEB_SURFACE_PRODUCTION_DECISION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PRODUCTION_DECISION_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/web-surface-publication-candidate.js:7` |
@@ -832,7 +832,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `createPublicationControlPlaneAudit` | function: function createPublicationControlPlaneAudit({ repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {}) | { repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationControlPlaneAudit } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:208` |
 | `createPublicationGateDecision` | function: function createPublicationGateDecision({ sourceSha, profile, required = false, rationale, policy = {}, } = {}) | { sourceSha, profile, required = false, rationale, policy = {}, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationGateDecision } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:280` |
 | `createPublicationQualificationReceipt` | function: function createPublicationQualificationReceipt({ capability, gateAggregate, consumerDecision, now = new Date(), } = {}) | { capability, gateAggregate, consumerDecision, now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationQualificationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:1035` |
-| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:75` |
+| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:84` |
 | `createPublicationSourceBundle` | function: function createPublicationSourceBundle({ cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {}) | { cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { createPublicationSourceBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-artifact.js:249` |
 | `createReadmeBadgeEndpointRegistry` | function: function createReadmeBadgeEndpointRegistry({ kfdSpecs = undefined, kfdStandards = undefined } = {}) | { kfdSpecs = undefined, kfdStandards = undefined } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createReadmeBadgeEndpointRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:133` |
 | `createReleaseActivationReceiptSet` | function: function createReleaseActivationReceiptSet({ transaction, receipts = [], } = {}) | { transaction, receipts = [], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createReleaseActivationReceiptSet } from "@kungfu-tech/buildchain/core";` | `packages/core/release-activation-transaction.js:311` |
@@ -1062,7 +1062,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `readReleaseTransaction` | function: function readReleaseTransaction(filePath) | filePath | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { readReleaseTransaction } from "@kungfu-tech/buildchain/core";` | `packages/core/publish-transaction.js:367` |
 | `recordReleaseActivationPhase` | function: function recordReleaseActivationPhase(transaction, phaseId, { receiptRoots = [], failure = "" } = {}) | transaction, phaseId, { receiptRoots = [], failure = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordReleaseActivationPhase } from "@kungfu-tech/buildchain/core";` | `packages/core/release-activation-transaction.js:217` |
 | `recordReleasePropagationStage` | function: function recordReleasePropagationStage({ work, expectedWorkRoot, receipt } = {}) | { work, expectedWorkRoot, receipt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordReleasePropagationStage } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work-transitions.js:45` |
-| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:441` |
+| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:529` |
 | `redactBuildchainLogAttributes` | function: function redactBuildchainLogAttributes(attributes = {}) | attributes = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { redactBuildchainLogAttributes } from "@kungfu-tech/buildchain/core";` | `packages/core/logging.js:33` |
 | `redactDiagnosticsValue` | function: function redactDiagnosticsValue(key, value, pattern = DEFAULT_SECRET_KEY_PATTERN) | key, value, pattern = DEFAULT_SECRET_KEY_PATTERN | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { redactDiagnosticsValue } from "@kungfu-tech/buildchain/core";` | `packages/core/diagnostics.js:953` |
 | `redactIssueText` | function: function redactIssueText(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { redactIssueText } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:51` |
@@ -1072,7 +1072,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `RELEASE_ACTIVATION_PHASES` | constant: const RELEASE_ACTIVATION_PHASES | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_ACTIVATION_PHASES } from "@kungfu-tech/buildchain/core";` | `packages/core/release-activation-transaction.js:8` |
 | `RELEASE_ACTIVATION_RECEIPT_SET_CONTRACT` | constant: const RELEASE_ACTIVATION_RECEIPT_SET_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_ACTIVATION_RECEIPT_SET_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-activation-transaction.js:5` |
 | `RELEASE_CANDIDATE_PASSPORT_CONTRACT` | constant: const RELEASE_CANDIDATE_PASSPORT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_CANDIDATE_PASSPORT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate.js:4` |
-| `RELEASE_CANDIDATE_RECOVERY_CONTRACT` | constant: const RELEASE_CANDIDATE_RECOVERY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_CANDIDATE_RECOVERY_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:11` |
+| `RELEASE_CANDIDATE_RECOVERY_CONTRACT` | constant: const RELEASE_CANDIDATE_RECOVERY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_CANDIDATE_RECOVERY_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:15` |
 | `RELEASE_CHECK_REPORT_CONTRACT` | constant: const RELEASE_CHECK_REPORT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_CHECK_REPORT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-passport.js:33` |
 | `RELEASE_EVIDENCE_ATTACHMENT_CONTRACT` | constant: const RELEASE_EVIDENCE_ATTACHMENT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_EVIDENCE_ATTACHMENT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-passport.js:34` |
 | `RELEASE_PASSPORT_CHECK_MANIFEST_CONTRACT` | constant: const RELEASE_PASSPORT_CHECK_MANIFEST_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PASSPORT_CHECK_MANIFEST_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-passport-contract.js:9` |
@@ -1091,7 +1091,7 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `RELEASE_PROPAGATION_WORK_CONTRACT` | constant: const RELEASE_PROPAGATION_WORK_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_WORK_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work-constants.js:1` |
 | `RELEASE_PROPAGATION_WORK_STAGES` | constant: const RELEASE_PROPAGATION_WORK_STAGES | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_WORK_STAGES } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work-constants.js:4` |
 | `releaseActivationRoot` | function: function releaseActivationRoot(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { releaseActivationRoot } from "@kungfu-tech/buildchain/core";` | `packages/core/release-activation-transaction.js:38` |
-| `ReleaseCandidateRecoveryError` | class: class ReleaseCandidateRecoveryError | none | ReleaseCandidateRecoveryError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseCandidateRecoveryError } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:18` |
+| `ReleaseCandidateRecoveryError` | class: class ReleaseCandidateRecoveryError | none | ReleaseCandidateRecoveryError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseCandidateRecoveryError } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:56` |
 | `renderBadgeBundleBlock` | function: function renderBadgeBundleBlock(facts) | facts | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBadgeBundleBlock } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:840` |
 | `renderBuildchainContractDriftIssueBody` | function: function renderBuildchainContractDriftIssueBody({ repository = "", workflow = "", runUrl = "", lockPath = "", evaluation, } = {}) | { repository = "", workflow = "", runUrl = "", lockPath = "", evaluation, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBuildchainContractDriftIssueBody } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-contract.js:985` |
 | `renderHomebrewFormula` | function: function renderHomebrewFormula(facts) | facts | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { renderHomebrewFormula } from "@kungfu-tech/buildchain/core";` | `packages/core/homebrew.js:290` |
@@ -1185,8 +1185,8 @@ Target: `./packages/core/index.js`. Public symbols: 562.
 | `verifyPublicationAdmission` | function: function verifyPublicationAdmission({ admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {}) | { admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationAdmission } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:791` |
 | `verifyPublicationQualificationReceipt` | function: function verifyPublicationQualificationReceipt({ receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {}) | { receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationQualificationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:1096` |
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-reproducibility.js:869` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:124` |
-| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:318` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:133` |
+| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:398` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain/core";` | `packages/core/release-passport.js:2743` |
 | `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:486` |
 | `WEB_SURFACE_PRODUCTION_DECISION_CONTRACT` | constant: const WEB_SURFACE_PRODUCTION_DECISION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PRODUCTION_DECISION_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/web-surface-publication-candidate.js:7` |
@@ -1727,9 +1727,9 @@ Target: `./packages/core/publication-sealed-bundle.js`. Public symbols: 3.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:75` |
+| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:84` |
 | `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:10` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:124` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:133` |
 
 ## `@kungfu-tech/buildchain/paper`
 
@@ -1906,15 +1906,17 @@ Target: `./packages/core/release-candidate.js`. Public symbols: 5.
 
 ## `@kungfu-tech/buildchain/release-candidate-recovery`
 
-Target: `./packages/core/release-candidate-recovery.js`. Public symbols: 5.
+Target: `./packages/core/release-candidate-recovery.js`. Public symbols: 7.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:441` |
-| `RELEASE_CANDIDATE_RECOVERY_CONTRACT` | constant: const RELEASE_CANDIDATE_RECOVERY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_CANDIDATE_RECOVERY_CONTRACT } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:11` |
-| `ReleaseCandidateRecoveryError` | class: class ReleaseCandidateRecoveryError | none | ReleaseCandidateRecoveryError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseCandidateRecoveryError } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:18` |
-| `validateReleaseCandidateRecoveryReceipt` | function: function validateReleaseCandidateRecoveryReceipt({ receipt, passport, repository = "", targetChannel = "", targetRef = "", targetSha = "", targetTree = "", version = "", } = {}) | { receipt, passport, repository = "", targetChannel = "", targetRef = "", targetSha = "", targetTree = "", version = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateReleaseCandidateRecoveryReceipt } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:96` |
-| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:318` |
+| `rebindPublicationGateAggregateForEquivalentTree` | function: function rebindPublicationGateAggregateForEquivalentTree(gateAggregate, { evidenceSourceSha = "", targetSourceSha = "", targetSourceTreeSha = "", expectedSourceTreeSha = "" } = {}) | gateAggregate, { evidenceSourceSha = "", targetSourceSha = "", targetSourceTreeSha = "", expectedSourceTreeSha = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { rebindPublicationGateAggregateForEquivalentTree } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:18` |
+| `recoveryFailure` | function: function recoveryFailure(error) | error | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { recoveryFailure } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:529` |
+| `RELEASE_CANDIDATE_RECOVERY_CONTRACT` | constant: const RELEASE_CANDIDATE_RECOVERY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_CANDIDATE_RECOVERY_CONTRACT } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:15` |
+| `ReleaseCandidateRecoveryError` | class: class ReleaseCandidateRecoveryError | none | ReleaseCandidateRecoveryError | Construction and method errors follow the linked source implementation. | class-dependent | `import { ReleaseCandidateRecoveryError } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:56` |
+| `validateRecoveryTargetRef` | function: function validateRecoveryTargetRef({ targetSha, observedTargetSha, expectedTransactionId = "", existingTransaction = undefined, ancestry = undefined, } = {}) | { targetSha, observedTargetSha, expectedTransactionId = "", existingTransaction = undefined, ancestry = undefined, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateRecoveryTargetRef } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:134` |
+| `validateReleaseCandidateRecoveryReceipt` | function: function validateReleaseCandidateRecoveryReceipt({ receipt, passport, repository = "", targetChannel = "", targetRef = "", targetSha = "", targetTree = "", version = "", } = {}) | { receipt, passport, repository = "", targetChannel = "", targetRef = "", targetSha = "", targetTree = "", version = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { validateReleaseCandidateRecoveryReceipt } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:176` |
+| `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain/release-candidate-recovery";` | `packages/core/release-candidate-recovery.js:398` |
 
 ## `@kungfu-tech/buildchain/stable-candidate-ledger`
 

package/docs/release-candidate.md

@@ -186,7 +186,13 @@ of those identities still agree.
 The recovery path conditionally skips consumer dependency installation and all
 product `install`, `build`, `verify`, and platform-matrix jobs. It restores the
 downloaded bytes as a content-addressed sealed bundle, so npm publication uses
-the original `.tgz`; it may regenerate only Buildchain-owned receipts,
+the original `.tgz`. The explicit recovery entry binds the bundle identity to
+the original candidate runtime recorded in the Passport; a newer recovery
+tooling SHA is recorded only in the recovery evidence and cannot perturb the
+durable payload root. A transaction-only re-resolution remains a narrower
+finalization path and is not a substitute for the candidate-run entry when the
+original complete artifact inventory must be reconstructed. Recovery may
+regenerate only Buildchain-owned receipts,
 attestations, signatures, Release Passport data, publication, and readback.
 
 Success emits `kungfu-buildchain-release-candidate-recovery/v1` with
@@ -217,6 +223,25 @@ and `complete` transactions use the normal idempotent state machine. Matching
 registry and GitHub bytes are preserved, only missing publication work is
 performed, and conflicting public digests enter `repair_required`.
 
+When the immutable recovery receipt proves that the transaction was already
+`complete` before the recovery run began, Buildchain verifies the existing
+public Release Passport bundle in place and reports the GitHub Release action
+as `reused`. Buildchain-owned evidence regenerated by newer recovery tooling is
+kept in the new recovery artifact; it does not replace same-name evidence that
+was sealed by the original completed publication. Every declared product
+payload is still compared byte-for-byte, a missing payload is uploaded from the
+restored sealed bundle, and a conflicting payload digest fails closed. Ordinary
+duplicate publication without a complete recovery receipt retains the stricter
+same-name/same-digest rule for all assets.
+
+After a transaction finalizes, the target branch can legitimately advance from
+the original promotion SHA. Repeating explicit recovery accepts that movement
+only when the caller supplies the exact durable transaction identity, the
+transaction remains resumable, and GitHub proves the observed target head is a
+descendant of the original transaction source. The recovery receipt records
+both the immutable transaction SHA and the observed ref SHA. Missing identity,
+unrelated advancement, or a repair state fails closed.
+
 By default, the wrapper forwards GitHub Release publication to the underlying
 `promote-buildchain-ref` semver model. Once the release transaction is complete,
 the action creates or updates the public GitHub Release, applies

package/docs/release-governance.md

@@ -963,6 +963,12 @@ preserves an existing asset when its SHA-256 digest matches the regenerated
 bytes, uploads only missing assets, and fails with an immutable-release
 collision when a same-name asset has different bytes. It never deletes and
 replaces an existing asset during retry or duplicate workflow delivery.
+An explicit candidate recovery whose validated receipt records an already
+complete transaction instead verifies the existing public Release Passport
+bundle and preserves its Buildchain-owned evidence generation. Product payload
+bytes remain digest-bound to the restored candidate, and missing product assets
+alone may be filled from that sealed bundle. This exception is unavailable to
+ordinary reruns or receipts from earlier transaction states.
 
 Product payloads are included only through the explicit
 `github-release-payload-patterns` input. Patterns match basenames inside the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.6-alpha.6",
+  "version": "3.0.6",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/publication-sealed-bundle.js

@@ -36,7 +36,16 @@ function normalizeSha256(value, label) {
 }
 
 function sha256File(filePath) {
-  return crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
+  const hash = crypto.createHash("sha256");
+  const descriptor = fs.openSync(filePath, "r");
+  const chunk = Buffer.allocUnsafe(8 * 1024 * 1024);
+  try {
+    let bytesRead = 0;
+    while ((bytesRead = fs.readSync(descriptor, chunk, 0, chunk.length, null)) > 0) hash.update(chunk.subarray(0, bytesRead));
+  } finally {
+    fs.closeSync(descriptor);
+  }
+  return hash.digest("hex");
 }
 
 function normalizeFile(entry, label) {

package/packages/core/release-candidate-recovery.js

@@ -7,13 +7,51 @@ import {
   validateReleaseCandidatePassport,
 } from "./release-candidate.js";
 import { releaseTransactionId } from "./publish-transaction.js";
+import {
+  publicationAuthorityDigest,
+  publicationGateAggregateBindings,
+} from "./publication-authority.js";
 
 export const RELEASE_CANDIDATE_RECOVERY_CONTRACT =
   "kungfu-buildchain-release-candidate-recovery/v1";
 
+export function rebindPublicationGateAggregateForEquivalentTree(
+  gateAggregate,
+  { evidenceSourceSha = "", targetSourceSha = "", targetSourceTreeSha = "", expectedSourceTreeSha = "" } = {},
+) {
+  const bindings = publicationGateAggregateBindings(gateAggregate);
+  const evidenceSource = exactSha(evidenceSourceSha, "evidenceSourceSha");
+  const targetSource = exactSha(targetSourceSha, "targetSourceSha");
+  if (bindings.sourceSha !== evidenceSource) {
+    throw new Error("consumer Gate aggregate evidence source SHA mismatch");
+  }
+  if (evidenceSource === targetSource) return gateAggregate;
+  const targetTree = exactSha(targetSourceTreeSha, "targetSourceTreeSha");
+  const expectedTree = exactSha(expectedSourceTreeSha, "expectedSourceTreeSha");
+  if (targetTree !== expectedTree) throw new Error("consumer Gate aggregate source tree mismatch");
+  if (gateAggregate.candidateReuse !== undefined) {
+    throw new Error("consumer Gate aggregate already declares candidate reuse");
+  }
+  const { digest: _digest, ...payload } = gateAggregate;
+  const rebound = {
+    ...payload,
+    sourceSha: targetSource,
+    candidateReuse: { action: "reused", evidenceSourceSha: evidenceSource, sourceTreeSha: expectedTree },
+  };
+  return { ...rebound, digest: `sha256:${publicationAuthorityDigest(rebound)}` };
+}
+
 const SHA_PATTERN = /^[0-9a-f]{40}$/;
 const SHA256_PATTERN = /^sha256:[0-9a-f]{64}$/;
 const TRUSTED_ASSOCIATIONS = new Set(["COLLABORATOR", "MEMBER", "OWNER"]);
+const RESUMABLE_TRANSACTION_STATES = new Set([
+  "sealed",
+  "publishing",
+  "published",
+  "package-published",
+  "finalizing",
+  "complete",
+]);
 
 export class ReleaseCandidateRecoveryError extends Error {
   constructor(code, message, nextAction) {
@@ -93,6 +131,48 @@ function normalizedRef(value) {
   return String(value || "").replace(/^refs\/heads\//, "").trim();
 }
 
+export function validateRecoveryTargetRef({
+  targetSha,
+  observedTargetSha,
+  expectedTransactionId = "",
+  existingTransaction = undefined,
+  ancestry = undefined,
+} = {}) {
+  const expected = exactSha(targetSha, "targetSha");
+  const observed = exactSha(observedTargetSha, "observedTargetSha");
+  if (observed === expected) return { advanced: false, observedSha: observed };
+  if (!expectedTransactionId) {
+    fail(
+      "target-ref-moved",
+      `target ref advanced from ${expected} to ${observed} without an explicit durable transaction identity`,
+      "Resume with the exact existing transaction identity, or select a new candidate explicitly; never rebuild implicitly.",
+    );
+  }
+  if (!existingTransaction || existingTransaction.id !== expectedTransactionId) {
+    fail(
+      "transaction-identity-conflict",
+      `target ref advanced but durable transaction ${expectedTransactionId} was not found exactly`,
+      "Enter repair_required and inspect the durable transaction before any retry.",
+    );
+  }
+  const state = String(existingTransaction.state || existingTransaction.publication_state || "");
+  if (!RESUMABLE_TRANSACTION_STATES.has(state)) {
+    fail(
+      "transaction-state-conflict",
+      `target ref advanced while durable transaction ${expectedTransactionId} is in non-resumable state ${state || "<empty>"}`,
+      "Preserve the transaction evidence and enter repair_required; do not republish or rebuild automatically.",
+    );
+  }
+  if (ancestry?.mergeIsAncestor !== true || !["ahead", "identical"].includes(String(ancestry?.status || ""))) {
+    fail(
+      "target-ancestry-mismatch",
+      `observed target ${observed} is not an ancestry-bound continuation of transaction source ${expected}`,
+      "Preserve the candidate and transaction evidence; inspect the target ref for unrelated advancement before retrying.",
+    );
+  }
+  return { advanced: true, observedSha: observed };
+}
+
 export function validateReleaseCandidateRecoveryReceipt({
   receipt,
   passport,
@@ -324,6 +404,7 @@ export function verifyReleaseCandidateRecovery({
   channel,
   targetRef,
   targetSha,
+  targetRefSha = targetSha,
   targetTree,
   expectedSourceTree = "",
   expectedCandidateRoot = "",
@@ -416,7 +497,14 @@ export function verifyReleaseCandidateRecovery({
       mergeSha: String(pullRequest.mergeSha || ""),
       tree: passport.source.treeHash,
     },
-    target: { channel: passport.target.channel, ref: normalizedRef(targetRef), sha, tree, version },
+    target: {
+      channel: passport.target.channel,
+      ref: normalizedRef(targetRef),
+      sha,
+      observedRefSha: exactSha(targetRefSha, "targetRefSha"),
+      tree,
+      version,
+    },
     recovered: {
       candidateRoot,
       buildSummaryRoot: `sha256:${passport.diagnostics.buildSummaryHash}`,