@kungfu-tech/buildchain 3.0.6 → 3.0.7-alpha.0

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-07T01:27:51.160Z",
-  "publishedAt": "2026-08-07T01:27:51.160Z",
+  "generatedAt": "2026-08-07T20:20:23.000Z",
+  "publishedAt": "2026-08-07T20:20:23.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "4d3415855debb03bac01c4f5d11417f0d1ea42d8",
+  "sourceRevision": "f1f1ef71bc3aa1488876dbb98533fa98cecc4d9a",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.6",
+    "version": "3.0.7-alpha.0",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:d76416d8cd04dcdb560b7d06fef287fa22d6b186a729cb92cd4cf71cebbac1e9"
+      "digest": "sha256:768042c2b38dd261803f49a141898fe80ce3e19b2a948abda2867e47c56c0b5c"
     },
     {
       "id": "getting-started",
@@ -229,7 +229,7 @@
       "path": "docs/cli-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:2365e125d38e43b68a4af277a91be7aca708a8bf785954ed4589dbd9a5d8db97"
+      "digest": "sha256:3b203848db87e68762417e768eb8a09a7e653eb30fb7cc21354e72678706b714"
     },
     {
       "id": "node-api-reference",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:f5592359584e98ab4283d56b0262fdcf9c5da61f48033cecad1b0404aa95bd2e"
+      "digest": "sha256:6dd79b998f63cf996e5c76b4fe0c654d12ca603cd5db1277ef3347f489b96ef0"
     },
     {
       "id": "build-facts",
@@ -287,6 +287,30 @@
       "exists": true,
       "digest": "sha256:72466943bb459f6857f23ac6f92bcf4714dcd2f535c38a9f0e34864b36404e06"
     },
+    {
+      "id": "release-tail-contract",
+      "title": "Declarative release-tail contract",
+      "path": "docs/release-tail-contract.md",
+      "plane": "verify",
+      "exists": true,
+      "digest": "sha256:1cfd927f30d71a359397a7177048b298269a8e665e67237187eb817e5d196b41"
+    },
+    {
+      "id": "release-tail-provider-plane",
+      "title": "Declarative release-tail provider plane",
+      "path": "docs/release-tail-provider-plane.md",
+      "plane": "use",
+      "exists": true,
+      "digest": "sha256:72f4267de80bb9c57859c78e5624a6d963d452d60412543347d98d6753218d61"
+    },
+    {
+      "id": "publication-rehearsal",
+      "title": "Publication rehearsal",
+      "path": "docs/publication-rehearsal.md",
+      "plane": "use",
+      "exists": true,
+      "digest": "sha256:b71c8be4a73078adae6efa838eeded0bfafef90f1e3873aad65d116f2481ae09"
+    },
     {
       "id": "release-governance",
       "title": "Release governance",

package/dist/site/workflow-registry.json

@@ -467,6 +467,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "channel",
+        "declarative-release-tail",
         "dry-run",
         "github-artifact-attestation-environment",
         "github-artifact-attestation-policy-json",
@@ -489,12 +490,14 @@
         "promotion-shell-sha",
         "promotion-target-ref",
         "publication-admission-json",
+        "publication-authority-workflow-path",
         "publication-auto-admission",
         "publication-auto-no-gate",
         "publication-commit-command",
         "publication-commit-evidence-path",
         "publication-consumer-predicate-id",
         "publication-consumer-qualification-command",
+        "publication-consumer-qualification-controller-sha",
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
@@ -563,7 +566,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 107,
+      "inputCount": 110,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -600,9 +603,14 @@
         "release-candidate-artifact",
         "release-candidate-recovery-receipt-artifact",
         "release-candidate-recovery-root",
-        "release-propagation-work-artifact"
-      ],
-      "outputCount": 23,
+        "release-propagation-work-artifact",
+        "release-tail-declaration-root",
+        "release-tail-receipt-roots-json",
+        "release-tail-state-root",
+        "release-tail-transaction-root",
+        "release-tail-transaction-state"
+      ],
+      "outputCount": 28,
       "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
       "status": "active",
@@ -2371,6 +2379,7 @@
         "buildchain-repository",
         "buildchain-stable-contract-lock-path",
         "channel",
+        "declarative-release-tail",
         "dry-run",
         "github-artifact-attestation-environment",
         "github-artifact-attestation-policy-json",
@@ -2388,6 +2397,7 @@
         "publication-commit-evidence-path",
         "publication-consumer-predicate-id",
         "publication-consumer-qualification-command",
+        "publication-consumer-qualification-controller-sha",
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
@@ -2456,7 +2466,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 99,
+      "inputCount": 101,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2505,9 +2515,14 @@
         "release-candidate-artifact",
         "release-candidate-recovery-receipt-artifact",
         "release-candidate-recovery-root",
-        "release-propagation-work-artifact"
-      ],
-      "outputCount": 35,
+        "release-propagation-work-artifact",
+        "release-tail-declaration-root",
+        "release-tail-receipt-roots-json",
+        "release-tail-state-root",
+        "release-tail-transaction-root",
+        "release-tail-transaction-state"
+      ],
+      "outputCount": 40,
       "surface": "release-governance",
       "capabilityGroup": "reusable-build",
       "status": "active",
@@ -2647,6 +2662,42 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "release-tail",
+      "path": ".github/workflows/release-tail.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "capsule-contract",
+        "capsule-path",
+        "capsule-root",
+        "evidence-path",
+        "state-path"
+      ],
+      "inputCount": 6,
+      "secrets": [
+        "http-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "binding-root",
+        "evidence-root",
+        "state-root",
+        "transaction-root",
+        "transaction-state"
+      ],
+      "outputCount": 5,
+      "surface": "release-tail-provider-plane",
+      "capabilityGroup": "release-passport-trust",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "release-verify",
       "path": ".github/workflows/release-verify.yml",
@@ -2856,6 +2907,7 @@
         "branch-protection-bypass-apps",
         "branch-protection-bypass-teams",
         "branch-protection-bypass-users",
+        "declarative-release-tail",
         "dry-run",
         "expected-publication-version",
         "generated-pull-request-token",
@@ -2865,6 +2917,7 @@
         "github-release-artifact-paths",
         "github-release-notes",
         "github-release-title",
+        "plan-before-target-advance",
         "promote-only-release-candidate",
         "publication-capability-json",
         "publication-gate-aggregate-json",
@@ -2917,6 +2970,7 @@
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
         "release-passport-promotion-routing-json",
+        "release-tail-state-path",
         "require-governance",
         "require-publication-qualification",
         "require-publish-source-lock",
@@ -2929,7 +2983,30 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 76,
+      "inputCount": 79,
+      "capabilityGroup": "release-passport-trust",
+      "status": "active",
+      "owner": "buildchain-actions",
+      "maturity": "stable",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary."
+    },
+    {
+      "id": "release-tail",
+      "path": "actions/release-tail/action.yml",
+      "inputs": [
+        "capsule",
+        "capsule-contract",
+        "capsule-root",
+        "evidence-path",
+        "github-token",
+        "http-token",
+        "state-path"
+      ],
+      "inputCount": 7,
       "capabilityGroup": "release-passport-trust",
       "status": "active",
       "owner": "buildchain-actions",

package/docs/MAP.md

@@ -59,7 +59,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Capability group | Primary facts | Primary manuals |
 | --- | --- | --- |
 | Getting Started | `capability-registry.json`, `product-mechanism.json` | [`getting-started.md`](getting-started.md), [`install.md`](install.md), [`product-mechanism.md`](product-mechanism.md), [`cli.md`](cli.md) |
-| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`github-artifact-attestation.md`](github-artifact-attestation.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`publish-transaction.md`](publish-transaction.md), [`binary-distribution.md`](binary-distribution.md) |
+| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`github-artifact-attestation.md`](github-artifact-attestation.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`publish-transaction.md`](publish-transaction.md), [`release-tail-contract.md`](release-tail-contract.md), [`publication-rehearsal.md`](publication-rehearsal.md), [`binary-distribution.md`](binary-distribution.md) |
 | Reusable Build and Lifecycle | `workflow-registry.json`, `controller-registry.json`, `release-model.json` | [`reusable-build-surface.md`](reusable-build-surface.md), [`controller-evidence.md`](controller-evidence.md), [`shifu-gate-profiles.md`](shifu-gate-profiles.md), [`lifecycle-protocol.md`](lifecycle-protocol.md) |
 | KFD Trust and Surface Closure | `kfd-claims.json`, `public-surface-audit.json`, `cli-registry.json`, `node-api-registry.json` | [`kfd-support.md`](kfd-support.md), [`release-passport.md`](release-passport.md) |
 | Site Bundle, Web Surfaces, and Propagation | `buildchain-site.json`, `site-manifest.json`, `page-registry.json`, `release-model.json` | [`site-bundle-contract.md`](site-bundle-contract.md), [`web-surface-deployments.md`](web-surface-deployments.md), [`release-propagation.md`](release-propagation.md) |
@@ -109,6 +109,7 @@ replace them.
 | How do I import Buildchain toolkit APIs from JavaScript build code? | [`node-api-reference.md`](node-api-reference.md) + [`../packages/core/README.md`](../packages/core/README.md) | use | stable |
 | How do I initialize a new repository? | [`getting-started.md`](getting-started.md) + [`lifecycle-protocol.md`](lifecycle-protocol.md) | use | stable |
 | Why does Buildchain use branch-driven release governance? | [`release-governance.md`](release-governance.md) | why | stable |
+| What freezes the v4 dependency direction, writer authority, complexity budgets, exceptions, and N-1 qualification? | [`../architecture/v4-architecture-constitution.md`](../architecture/v4-architecture-constitution.md) | why/verify | preview |
 | How do protected dev branches and scheduled ready-PR merging work? | [`release-governance.md`](release-governance.md#protected-dev-branches) | use | stable |
 | How do slow required checks land reliably on a busy dev channel? | [`release-governance.md`](release-governance.md#protected-dev-branches) + [`cli.md`](cli.md#commands) | use | preview |
 | How does the durable fair Dev Delivery Warrant Queue prevent slow-candidate starvation?                                                       | [`dev-delivery-warrant.md`](dev-delivery-warrant.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | use/verify | preview |
@@ -120,6 +121,8 @@ replace them.
 | What is the active action and workflow source of truth? | [`ownership.md`](ownership.md) | verify | stable |
 | How do I declare version files and custom lifecycle commands? | [`lifecycle-protocol.md`](lifecycle-protocol.md) | use | stable |
 | How does publish evidence, recovery, and finalization work? | [`publish-transaction.md`](publish-transaction.md) | verify | stable |
+| How are consumer-owned release-tail commands inventoried and replaced by declarative capabilities? | [`release-tail-contract.md`](release-tail-contract.md) | verify | draft |
+| How do I reproduce publication semantics locally without GitHub runner state? | [`publication-rehearsal.md`](publication-rehearsal.md), [`../architecture/decisions/0001-release-local-constructibility.md`](../architecture/decisions/0001-release-local-constructibility.md) | use/verify | preview |
 | How do I collect and verify module/product build facts from Git source, version files, and outputs? | [`build-facts.md`](build-facts.md) + [`cli.md`](cli.md) | use/verify | stable |
 | How do I publish or verify release passport artifacts? | [`release-passport.md`](release-passport.md) | use | stable |
 | How do I keylessly attest Linux release artifacts with GitHub and bind them to a Release Passport? | [`github-artifact-attestation.md`](github-artifact-attestation.md) | verify/use | preview |
@@ -154,7 +157,7 @@ replace them.
 | How do I deploy a site/app preview, staging, or production surface? | [`web-surface-deployments.md`](web-surface-deployments.md) | use | stable |
 | How do I publish observed infrastructure contracts for downstream consumers? | [`infra-contract.md`](infra-contract.md) | use | preview |
 | How do I operate a repeatable, disabled-by-default, budget-fail-closed AWS Windows JIT campaign? | [`aws-us-elastic-runner-burst-plane.md`](aws-us-elastic-runner-burst-plane.md#phase-2-operator-workflow) | use/verify | preview |
-| How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md), [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md), [`../actions/github-artifact-attestation/README.md`](../actions/github-artifact-attestation/README.md), [`../actions/macos-credential-island/README.md`](../actions/macos-credential-island/README.md); `dist/site/workflow-registry.json#actions` is authoritative for the six-entry inventory. | use | stable |
+| How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md), [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md), [`../actions/github-artifact-attestation/README.md`](../actions/github-artifact-attestation/README.md), [`../actions/macos-credential-island/README.md`](../actions/macos-credential-island/README.md), [`../actions/release-tail/README.md`](../actions/release-tail/README.md); `dist/site/workflow-registry.json#actions` is authoritative for the seven-entry inventory. | use | stable |
 | How can a consumer workflow report a Buildchain-owned failure back to Buildchain? | [`consumer-issue-reporting.md`](consumer-issue-reporting.md) + [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md) | use | stable |
 | What do the fixture repositories demonstrate? | [`../fixtures/libnode-shaped/README.md`](../fixtures/libnode-shaped/README.md), [`../fixtures/publish-transaction-shaped/README.md`](../fixtures/publish-transaction-shaped/README.md), [`../fixtures/web-surface-shaped/README.md`](../fixtures/web-surface-shaped/README.md), [`../fixtures/publication-artifact-shaped/README.md`](../fixtures/publication-artifact-shaped/README.md) | verify | stable |
 | What license and contribution terms apply? | [`../LICENSE`](../LICENSE) + [`../LICENSE-POLICY.md`](../LICENSE-POLICY.md) | use | stable |

package/docs/cli-reference.md

@@ -22,6 +22,63 @@ ai_provenance:
 
 Every listed help command is intercepted before dispatch, exits zero, and performs no command side effects.
 
+## `architecture`
+
+### `buildchain architecture`
+
+- Help: `buildchain architecture --help`
+- Canonical id: `architecture`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain architecture
+```
+
+### `buildchain architecture list`
+
+- Help: `buildchain architecture list --help`
+- Canonical id: `architecture`
+- Options: `--cwd`, `--json`
+- Syntax:
+
+```text
+buildchain architecture list [--cwd <dir>] [--json]
+```
+
+### `buildchain architecture qualify`
+
+- Help: `buildchain architecture qualify --help`
+- Canonical id: `architecture`
+- Options: `--authority-revision`, `--candidate-revision`, `--cwd`, `--json`
+- Syntax:
+
+```text
+buildchain architecture qualify --authority-revision <git-revision> [--candidate-revision <git-revision>] [--cwd <dir>] [--json]
+```
+
+### `buildchain architecture show`
+
+- Help: `buildchain architecture show --help`
+- Canonical id: `architecture`
+- Options: `--cwd`, `--json`
+- Syntax:
+
+```text
+buildchain architecture show <capability-id> [--cwd <dir>] [--json]
+```
+
+### `buildchain architecture validate`
+
+- Help: `buildchain architecture validate --help`
+- Canonical id: `architecture`
+- Options: `--cwd`, `--json`
+- Syntax:
+
+```text
+buildchain architecture validate [--cwd <dir>] [--json]
+```
+
 ## `audit`
 
 ### `buildchain audit`
@@ -1877,6 +1934,85 @@ buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
 buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
 ```
 
+## `release-tail`
+
+### `buildchain release-tail`
+
+- Help: `buildchain release-tail --help`
+- Canonical id: `release-tail`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release-tail
+```
+
+### `buildchain release-tail compat`
+
+- Help: `buildchain release-tail compat --help`
+- Canonical id: `release-tail`
+- Options: `--hooks-json`, `--output`
+- Syntax:
+
+```text
+buildchain release-tail compat --hooks-json <json-or-path> [--output <path>]
+```
+
+### `buildchain release-tail init`
+
+- Help: `buildchain release-tail init --help`
+- Canonical id: `release-tail`
+- Options: `--declaration`, `--state`
+- Syntax:
+
+```text
+buildchain release-tail init --declaration <json-or-path> [--state <path>]
+```
+
+### `buildchain release-tail plan`
+
+- Help: `buildchain release-tail plan --help`
+- Canonical id: `release-tail`
+- Options: `--declaration`, `--output`
+- Syntax:
+
+```text
+buildchain release-tail plan --declaration <json-or-path> [--output <path>]
+```
+
+### `buildchain release-tail rehearse`
+
+- Help: `buildchain release-tail rehearse --help`
+- Canonical id: `release-tail`
+- Options: `--capsule`, `--capsule-root`, `--environment-json`, `--evidence`, `--mode`, `--state`
+- Syntax:
+
+```text
+buildchain release-tail rehearse --capsule <path> --capsule-root <absolute-path> --mode <simulate|replay> --state <path> --evidence <path> [--environment-json <json-or-path>]
+```
+
+### `buildchain release-tail status`
+
+- Help: `buildchain release-tail status --help`
+- Canonical id: `release-tail`
+- Options: `--output`, `--state`
+- Syntax:
+
+```text
+buildchain release-tail <status|verify> [--state <path>] [--output <path>]
+```
+
+### `buildchain release-tail verify`
+
+- Help: `buildchain release-tail verify --help`
+- Canonical id: `release-tail`
+- Options: `--output`, `--state`
+- Syntax:
+
+```text
+buildchain release-tail <status|verify> [--state <path>] [--output <path>]
+```
+
 ## `sample`
 
 ### `buildchain sample`