@kungfu-tech/buildchain 3.0.7 → 3.0.8

package/dist/site/public-surface-audit.json

@@ -6,7 +6,7 @@
     "cliCommandCount": 114,
     "workflowCount": 69,
     "actionCount": 7,
-    "sitePageCount": 70,
+    "sitePageCount": 71,
     "docCommandRefCount": 924,
     "failureCount": 0
   },
@@ -2129,13 +2129,14 @@
           "retained-patterns",
           "stale-days",
           "stale-pull-request-label",
-          "target-branch"
+          "target-branch",
+          "temporary-branch-patterns"
         ],
-        "inputCount": 13,
+        "inputCount": 14,
         "secrets": [
-          "github_app_id",
-          "github_app_private_key",
-          "github_token"
+          "housekeeper_app_id",
+          "housekeeper_app_private_key",
+          "housekeeper_token"
         ],
         "secretCount": 3,
         "outputs": [
@@ -3323,6 +3324,10 @@
         "id": "manual:release-tail-provider-plane",
         "category": "manual"
       },
+      {
+        "id": "manual:release-train",
+        "category": "manual"
+      },
       {
         "id": "manual:reusable-build-surface",
         "category": "manual"
@@ -7988,8 +7993,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "e7b90e95dabcffb3fecb8e84cec48d7a99261c5e90732aff0ebc174b01c4e35c",
-    "workflowRegistryDigest": "ddf86974ae3c900948598aca2d28309681cd5c910f3fcd6fc75fd74a06bebdfa",
-    "pageRegistryDigest": "504454df002494e1bc5cdf37679c28a3914f2df43cf4a70524019d2d97b6c320"
+    "workflowRegistryDigest": "964686c03a329b906a9f832d81c60eed8a50d2d2770b9b9f4ede2dbe32f9b98b",
+    "pageRegistryDigest": "83e4701148132712b684efb1f474943752ad8371e60f598f162b553f504e987f"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -1037,9 +1037,7 @@
     },
     {
       "path": ".github/workflows/engineering-housekeeper.yml",
-      "signals": [
-        "write-permission"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -1189,5 +1187,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "074111987b82f532c9c0a7da9c81a7bf36e93c35ab8ec1a51b9321c8f657fdae"
+  "registryDigest": "26e5356238677038bda4efe2b91dbf3939270b31c65ff8a36bbdf0d3e5227913"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-10T08:49:53.000Z",
-  "publishedAt": "2026-08-10T08:49:53.000Z",
+  "generatedAt": "2026-08-11T00:43:51.000Z",
+  "publishedAt": "2026-08-11T00:43:51.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "828d10df56a6b091a4f117340ff8ca19be5a6a90",
+  "sourceRevision": "827fa0252c0546816c33ec89e66ca505ad6d5162",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.7",
+    "version": "3.0.8",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -51,6 +51,7 @@
       "./kfd-gate": "./packages/core/kfd-gate.js",
       "./release-candidate": "./packages/core/release-candidate.js",
       "./release-candidate-recovery": "./packages/core/release-candidate-recovery.js",
+      "./release-train": "./packages/core/release-train.js",
       "./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",
       "./release-passport": "./packages/core/release-passport.js",
       "./release-passport-contract": "./packages/core/release-passport-contract.js",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-10T08:49:53.000Z",
-  "publishedAt": "2026-08-10T08:49:53.000Z",
+  "generatedAt": "2026-08-11T00:43:51.000Z",
+  "publishedAt": "2026-08-11T00:43:51.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "828d10df56a6b091a4f117340ff8ca19be5a6a90",
+  "sourceRevision": "827fa0252c0546816c33ec89e66ca505ad6d5162",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.7",
+    "version": "3.0.8",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:08cfae94c78776694736e81142e2d64480fdc3e67341b415340c03d3539531e7"
+      "digest": "sha256:5292461118df2ec99a15411b6ed50c288abeb05d992677e3500b9bd46255a001"
     },
     {
       "id": "getting-started",
@@ -127,6 +127,14 @@
       "exists": true,
       "digest": "sha256:d76bbd75aab3c4dd94756c1c64562a125e74369c7c8b97342dbcacc5d7561602"
     },
+    {
+      "id": "release-train",
+      "title": "Release Train and Release Cut",
+      "path": "docs/release-train.md",
+      "plane": "verify",
+      "exists": true,
+      "digest": "sha256:550e50726ff479730bee1abe7839776308396bb01613e31a3ed6e898297619fa"
+    },
     {
       "id": "release-propagation",
       "title": "Release propagation",
@@ -189,7 +197,7 @@
       "path": "docs/site-bundle-contract.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:36a4e60e91f500ea1dcdbef97cd0250a2c26562b98d8d3622e8e0f9df2aad23b"
+      "digest": "sha256:371030eda56d7a968d037e8b9a348e0211038506b8c0b14c539ec790ce884945"
     },
     {
       "id": "migration-inventory",
@@ -237,7 +245,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ed843753964193ecb59610a54f0f23d76578228ebe6d31d1d6edce526729910c"
+      "digest": "sha256:34f39632494c0f4d4961fd79fc8ac94466da56c29f04f09e706f402d98ef125c"
     },
     {
       "id": "build-facts",
@@ -277,7 +285,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:4741dc7661d40e14df8203d88a709b9becb08edc4313f5ad308c7e80bf672085"
+      "digest": "sha256:7f69bf3faf8c86b4af268f8e79d511f73de745e146a23809394074f816a372d7"
     },
     {
       "id": "publish-transaction",
@@ -317,7 +325,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:b37d4de1f1cf9155c0e3f42c8c20a0280a263f50173eb0cad2c5f1961954822e"
+      "digest": "sha256:150a6ceb40636838ed157abe11ae1dfe43f6447f01462a0238d343b9cf89fcb4"
     },
     {
       "id": "release-flow",
@@ -341,7 +349,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:793db9414d11aeb314ff2d37a52481826ca5f636d08eaf93772d37962a51484f"
+      "digest": "sha256:6af44926f8138932aeb606bb264b19a40a273ce7bea7bad9b021bb9aa542d61b"
     },
     {
       "id": "web-surface-deployments",

package/dist/site/workflow-registry.json

@@ -1953,7 +1953,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.7",
+      "introducedVersion": "3.0.8",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1974,7 +1974,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.7",
+      "introducedVersion": "3.0.8",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1995,7 +1995,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.7",
+      "introducedVersion": "3.0.8",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2018,13 +2018,14 @@
         "retained-patterns",
         "stale-days",
         "stale-pull-request-label",
-        "target-branch"
+        "target-branch",
+        "temporary-branch-patterns"
       ],
-      "inputCount": 13,
+      "inputCount": 14,
       "secrets": [
-        "github_app_id",
-        "github_app_private_key",
-        "github_token"
+        "housekeeper_app_id",
+        "housekeeper_app_private_key",
+        "housekeeper_token"
       ],
       "secretCount": 3,
       "outputs": [
@@ -2044,7 +2045,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.7",
+      "introducedVersion": "3.0.8",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/MAP.md

@@ -59,7 +59,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Capability group | Primary facts | Primary manuals |
 | --- | --- | --- |
 | Getting Started | `capability-registry.json`, `product-mechanism.json` | [`getting-started.md`](getting-started.md), [`install.md`](install.md), [`product-mechanism.md`](product-mechanism.md), [`cli.md`](cli.md) |
-| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`github-artifact-attestation.md`](github-artifact-attestation.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`publish-transaction.md`](publish-transaction.md), [`release-tail-contract.md`](release-tail-contract.md), [`publication-rehearsal.md`](publication-rehearsal.md), [`binary-distribution.md`](binary-distribution.md) |
+| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`github-artifact-attestation.md`](github-artifact-attestation.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`release-train.md`](release-train.md), [`publish-transaction.md`](publish-transaction.md), [`release-tail-contract.md`](release-tail-contract.md), [`publication-rehearsal.md`](publication-rehearsal.md), [`binary-distribution.md`](binary-distribution.md) |
 | Reusable Build and Lifecycle | `workflow-registry.json`, `controller-registry.json`, `release-model.json` | [`reusable-build-surface.md`](reusable-build-surface.md), [`controller-evidence.md`](controller-evidence.md), [`shifu-gate-profiles.md`](shifu-gate-profiles.md), [`lifecycle-protocol.md`](lifecycle-protocol.md) |
 | KFD Trust and Surface Closure | `kfd-claims.json`, `public-surface-audit.json`, `cli-registry.json`, `node-api-registry.json` | [`kfd-support.md`](kfd-support.md), [`release-passport.md`](release-passport.md) |
 | Site Bundle, Web Surfaces, and Propagation | `buildchain-site.json`, `site-manifest.json`, `page-registry.json`, `release-model.json` | [`site-bundle-contract.md`](site-bundle-contract.md), [`web-surface-deployments.md`](web-surface-deployments.md), [`release-propagation.md`](release-propagation.md) |

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -352,13 +352,21 @@ job must exercise the full native lifecycle.
 
 AWS imposes a 24-hour minimum Dedicated Host allocation. The contract therefore
 keeps the one host for at least 24 hours even if all three jobs finish earlier.
-At the recorded USD 0.6498 hourly rate, the minimum commitment rounds to USD
-15.60. A 30-hour fail-closed ceiling rounds to USD 19.49, below the dedicated
+At the recorded USD 0.65 hourly rate, the minimum commitment is USD 15.60. A
+30-hour fail-closed ceiling is USD 19.50, below the dedicated
 USD 25 budget. A ten-minute reaper terminates an expired campaign instance and
 retries host release after the minimum allocation and Apple scrub constraints
 allow it. Budget notifications at 80% and 95% invoke the same card-scoped kill
 switch.
 
+The launch controller defaults to `us-east-1` and admits only `us-east-2` as a
+capacity fallback. The regions use mutually exclusive control-plane stacks and
+one shared USD 25 Budget covering Virginia `HostUsage:mac2` and the AWS catalog
+identity `USE2-HostUsage:mac2` for Ohio. A requested region, availability zone,
+stack, and Budget must agree before allocation, and the controller checks both
+regions against one global Host and instance ceiling; no other region is
+accepted.
+
 Qualification requires three trusted exact-source one-job JIT runs on the one
 host, including at least one full run, plus proof that:
 
@@ -375,9 +383,13 @@ host, including at least one full run, plus proof that:
 campaign. It has three explicit mutation modes:
 
 - `launch-campaign` binds the exact repository source, AMI, availability zone,
-  tagged Dedicated Host, and reusable instance. It rejects pre-existing Mac
-  capacity and requires successful `AllocateHosts` and `RunInstances` DryRuns
-  before either real call.
+  tagged Dedicated Host, and reusable instance. Before paid allocation it
+  verifies the exact AWS account, disabled GitHub workflow, complete control
+  plane stack, AWS-dimension-filtered USD 25 Budget, 80% and 95% SNS
+  subscribers, and zero pre-existing Mac capacity. Because AWS does not expose
+  a DryRun parameter for `AllocateHosts`, it requires an allowed IAM policy
+  simulation for the exact tagged allocation before the real call, then a
+  successful `RunInstances` DryRun before launching the instance.
 - `run-job` binds one queued exact-source GitHub job to the existing campaign
   host and instance. It writes the repository JIT configuration through a
   mode-0600 temporary file into a distinct SSM SecureString, sends only the
@@ -392,8 +404,9 @@ campaign. It has three explicit mutation modes:
 
 Every execute mode requires the exact source SHA and campaign id to be repeated
 through `--confirm-source-sha` and `--confirm-campaign-id`. `run-job` also
-requires `--confirm-run-id`. Omitting `--execute` emits a deterministic plan
-without changing AWS or GitHub state.
+requires `--confirm-run-id`; `launch-campaign` additionally requires the
+expected workload account through `--account-id`. Omitting `--execute` emits a
+deterministic plan without changing AWS or GitHub state.
 
 ## Provider lifecycle
 

package/docs/engineering-housekeeper.md

@@ -15,9 +15,16 @@ last_reviewed: 2026-08-10
 
 Engineering Housekeeper is a reusable GitHub workflow for evidence-backed
 branch and pull-request hygiene. It inventories the complete GitHub branch and
-open pull-request surfaces, produces a rooted plan, and defaults to report-only
-execution. It never closes pull requests and never deletes a branch from its
-name alone.
+open pull-request surfaces, discovers the repository default branch and all
+protected version/release mainlines, and produces a rooted plan. The reusable
+workflow defaults to report-only execution; a repository may opt its scheduled
+callers into unattended apply. It never closes pull requests and never deletes
+a branch from its name alone.
+
+Branch deletion uses a positive allowlist. Only `feature/**`, `fix/**`,
+`chore/**`, `docs/**`, `ci/**`, and `refactor/**` are temporary development
+families by default. Unknown families are inventoried and retained, even when
+their heads are already ancestors of a mainline.
 
 The reusable entrypoint is:
 
@@ -38,14 +45,28 @@ jobs:
       contents: read
       pull-requests: read
     with:
-      target-branch: dev/v3/v3.0
       mode: report
 ```
 
-The plan records the exact repository, target branch and target OID, every
-observed branch and open pull request, each retain/delete/report/label decision,
-and stable reason codes. The report receipt records dry-run outcomes and binds
-them to the plan root.
+With no `target-branch`, the plan uses the repository default as its primary
+target and discovers every provider-protected or protected-pattern-matching
+mainline repository-wide. Each eligible temporary branch is bound to the exact
+mainline OID that proves it merged. The plan also records every observed branch
+and open pull request, each retain/delete/report/label decision, and stable
+reason codes. The report receipt records dry-run outcomes and binds them to the
+plan root.
+
+To keep complete-repository patrols within normal GitHub API budgets, the
+engine paginates closed pull requests once, indexes merged associations by the
+exact source branch and OID, and then prioritizes the matching base without a
+per-branch association request. Exact ancestry comparisons run with a fixed
+maximum of eight concurrent requests while preserving deterministic branch
+ordering. A temporary branch without an exact same-repository, same-name,
+same-OID merged pull request association is retained and reported without
+ancestry requests. The association is only a candidate selector: the source
+OID must still be an ancestor of the selected mainline OID. This matches the
+protected-mainline delivery contract and keeps ambiguous or direct historical
+refs fail-closed.
 
 ## Apply mode
 
@@ -54,6 +75,8 @@ and `apply-enabled: true`; either value alone fails closed. Apply jobs consume
 the uploaded exact plan, re-read provider state, and revalidate exact branch
 and target OIDs, ancestry, protection, retention, active pull requests, rename
 state, pull-request state, and staleness before each mutation.
+These are reusable-workflow contract inputs, not an interactive approval step.
+An unattended scheduled caller can set both values in committed policy.
 
 ```yaml
 jobs:
@@ -63,7 +86,6 @@ jobs:
       contents: write
       pull-requests: write
     with:
-      target-branch: dev/v3/v3.0
       mode: apply
       apply-enabled: true
       stale-pull-request-label: stale-housekeeping
@@ -84,20 +106,21 @@ continue.
 
 ## Inputs and outputs
 
-| Input                      | Type    | Default                     | Contract                                                                          |
-| -------------------------- | ------- | --------------------------- | --------------------------------------------------------------------------------- |
-| `repository`               | string  | caller repository           | Exact `owner/repo` target.                                                        |
-| `target-branch`            | string  | required                    | Exact ancestry target; the observed OID is recorded in the plan.                  |
-| `mode`                     | string  | `report`                    | `report` or `apply`. Other values fail.                                           |
-| `apply-enabled`            | boolean | `false`                     | Required positive gate for `apply`. Invalid with `report`.                        |
-| `protected-patterns`       | string  | version/release families    | Comma or newline separated branch globs.                                          |
-| `retained-patterns`        | string  | train/authority families    | Comma or newline separated retention globs.                                       |
-| `stale-days`               | number  | `30`                        | Positive stale pull-request age.                                                  |
-| `stale-pull-request-label` | string  | empty                       | Empty keeps pull requests report-only; non-empty permits labeling, never closure. |
-| `max-actions`              | number  | `20`                        | Positive global apply limit.                                                      |
-| `artifact-retention-days`  | number  | `30`                        | Retention for plan, report, and receipts.                                         |
-| `buildchain-repository`    | string  | `kungfu-systems/buildchain` | Runtime source repository.                                                        |
-| `buildchain-ref`           | string  | `v3`                        | Runtime ref; trusted manual qualification may pass a train or exact SHA.          |
+| Input                       | Type    | Default                     | Contract                                                                          |
+| --------------------------- | ------- | --------------------------- | --------------------------------------------------------------------------------- |
+| `repository`                | string  | caller repository           | Exact `owner/repo` target.                                                        |
+| `target-branch`             | string  | empty                       | Optional primary target; empty discovers all protected mainlines repository-wide. |
+| `mode`                      | string  | `report`                    | `report` or `apply`. Other values fail.                                           |
+| `apply-enabled`             | boolean | `false`                     | Required positive gate for `apply`. Invalid with `report`.                        |
+| `protected-patterns`        | string  | version/release families    | Comma or newline separated branch globs.                                          |
+| `retained-patterns`         | string  | train/authority families    | Comma or newline separated retention globs.                                       |
+| `temporary-branch-patterns` | string  | six development families    | Positive allowlist; unmatched branch families are always retained.                |
+| `stale-days`                | number  | `30`                        | Positive stale pull-request age.                                                  |
+| `stale-pull-request-label`  | string  | empty                       | Empty keeps pull requests report-only; non-empty permits labeling, never closure. |
+| `max-actions`               | number  | `20`                        | Positive global apply limit.                                                      |
+| `artifact-retention-days`   | number  | `30`                        | Retention for plan, report, and receipts.                                         |
+| `buildchain-repository`     | string  | `kungfu-systems/buildchain` | Runtime source repository.                                                        |
+| `buildchain-ref`            | string  | `v3`                        | Runtime ref; trusted manual qualification may pass a train or exact SHA.          |
 
 Stable outputs are `plan-root`, `report-receipt-root`, optional
 `branch-receipt-root` and `pull-request-receipt-root`, `action-count`,
@@ -131,8 +154,18 @@ Buildchain dogfoods the reusable contract through three thin callers:
 - `engineering-housekeeper-weekly.yml` uses a 45-day window and a 20-action cap;
 - `engineering-housekeeper-monthly.yml` uses a 60-day window and a 50-action cap.
 
-Schedules are report-only and read-only. Apply is available only through a
-manual dispatch that selects `apply` and positively enables the apply gate.
-The callers contain schedules and policy values only; inventory, planning,
-revalidation, mutation, evidence, and authentication stay in the reusable
-workflow and its runtime.
+All three schedules run unattended apply with repository-wide mainline
+discovery. They delete only exact merged heads from the positive temporary
+branch allowlist and automatically add `engineering-housekeeper:stale` to stale
+open pull requests; they never close a pull request. Manual dispatch remains a
+diagnostic interface, not a prerequisite for scheduled execution. Each caller
+uses the exact scheduling commit as its runtime, so activation never waits for a
+floating runtime ref to catch up. The callers contain schedules and policy
+values only; inventory, planning, revalidation, mutation, evidence, and
+authentication stay in the reusable workflow and its runtime.
+
+If a deleted merged branch must be restored during artifact retention, use the
+recorded `expectedHeadOid` and branch name from the rooted plan to recreate the
+ref with a normal non-force push. A rejected or provider-error receipt means no
+successful deletion should be inferred; re-run report mode against current
+provider state before taking recovery action.