@kungfu-tech/buildchain 3.0.9-alpha.0 → 3.0.9-alpha.2

package/docs/release-governance.md

@@ -263,9 +263,11 @@ semantics and fail-closed verification requirements.
 The authority verifies the complete result set on GitHub-hosted infrastructure
 before delivery. The consumer controller also performs final result verification,
 exact-byte import, manifest recomputation, and deterministic-artifact replacement
-on a GitHub-hosted lane. Self-hosted build runners do not download authority
-result payloads, and aggregate/release evidence fails closed until this
-finalization succeeds.
+on a GitHub-hosted lane. macOS results finalize on a GitHub-hosted macOS runner so
+the consumer lifecycle can perform native post-sign checks before publication;
+other platforms retain the GitHub-hosted Ubuntu control lane. Self-hosted build
+runners do not download authority result payloads, and aggregate/release evidence
+fails closed until this finalization succeeds.
 
 The central `buildchain-artifact-signing` environment reuses the established
 macOS Credential Island names (`BUILDCHAIN_MACOS_CERTIFICATE_*`,

package/docs/release-passport.md

@@ -313,6 +313,13 @@ fails closed if any claim is missing source bindings, machine evidence, hashes,
 artifact coordinates, verification result, audit boundary, responsibility, or
 residual risk.
 
+The same self-promotion boundary extends the Buildchain-owned KFD witness
+generator against the transaction's exact source SHA. It produces the standard
+full-cut adopter manifest, the non-qualifying KFD-4/5/7 product gates, and the
+one-way legacy projection before the final passport is collected. An explicitly
+supplied adopter manifest still takes precedence; an omitted self-release
+manifest no longer silently produces a KFD-1/2/3-only passport.
+
 ### KFD-3 collaboration-interface release gate
 
 KFD-3 asks a different release question than KFD-1. KFD-1 proves that named

package/docs/release-train.md

@@ -8,12 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-08-10
+last_reviewed: 2026-08-11
 ai_provenance:
   model_family: GPT-5
   product: Codex
-  generated_at: 2026-08-10
-  visible_context: Buildchain v3 release candidate, recovery, Dev to Alpha Candidate Patrol, Warrant, publication transaction, and release governance sources.
+  generated_at: 2026-08-11
+  visible_context: Buildchain v3 release candidate, recovery, Dev to Alpha Candidate Patrol, rooted blocker repair, Warrant, publication transaction, and release governance sources.
   invisible_context_boundary: Live provider state and credentials were not read.
 ---
 
@@ -38,8 +38,9 @@ own those effects and persist the rooted contract in their declared store.
 - a canonical creation timestamp.
 
 The resulting `cutRoot` covers all of those fields. A generation greater than
-one must name the prior cut root and one of four supersession causes:
+one must name the prior cut root and one of five supersession causes:
 
+- `release-blocker-repair` (reserved for the rooted repair contract below);
 - `incompatible-semantics`;
 - `alpha-base-incompatibility`;
 - `invalid-authority`; or
@@ -74,6 +75,23 @@ an invalid transition fails closed.
 changing `trainRoot`, `cutRoot`, candidate identity, generation, or state. The
 same exact observation is idempotent.
 
+## Rooted release-blocker repair
+
+`createReleaseBlockerRepair()` starts only from the active train's exact
+`repair-required` state root. It creates generation N+1 from the frozen cut,
+changing only the candidate commit and tree while preserving the original Dev
+cut, Alpha base, runtime, route, and prior cut root. The prior train receives an
+explicit `release-blocker-repair` supersession transition; later Dev movement
+alone still cannot advance a generation.
+
+The repair binds one semantic patch root to a cut landing and a Dev
+forward-port. A successful cut landing makes the successor candidate buildable
+even while the Dev forward-port is in conflict. Publication remains blocked
+until `settleReleaseBlockerDevLanding()` compare-and-swap checks the repair root
+and records a Dev landing with the same patch root. A landed but different Dev
+patch produces a rooted `cut-dev-patch-root-mismatch` gate rather than
+publication authority.
+
 Buildchain v3 Candidate Patrol resolves the open managed candidate's persisted
 train before it considers a new qualified development head. It reads back the
 candidate ref and tree, Alpha base, and exact Buildchain runtime. Matching
@@ -82,6 +100,30 @@ single rooted observation. Candidate, tree, base, runtime, or route drift emits
 a rooted hold and stops settlement. Only a validated train already carrying an
 enumerated `superseded` transition is reported as superseded.
 
+## Buildchain self-dogfood campaign
+
+Buildchain qualifies the complete v3 mechanism with
+`scripts/release-train-self-dogfood.mjs`. The campaign composes one frozen
+Release Cut, moving-dev observation, deterministic failed build, successor
+repair, cut/dev patch-root settlement, publication gate, and bounded Delivery
+Warrant priority. It also proves that an active Warrant is not preempted and
+that duplicate events, invalid authority, and unrelated priority claims fail
+closed.
+
+The command accepts an exact evidence input and emits a replayable rooted
+report:
+
+```sh
+node scripts/release-train-self-dogfood.mjs \
+  --input /path/to/exact-protected-delivery.json \
+  --output /tmp/buildchain-release-train-self-dogfood.json
+```
+
+A passing report requires a merged protected PR, exact-head approval,
+merge-group CI success, tree-equivalent merge readback, artifact evidence, and
+installed-product evidence. Synthetic or unit-only evidence is useful for
+negative tests but is not sufficient for release qualification.
+
 ## Readback and legacy state
 
 `validateReleaseCut()` checks the standalone immutable cut and its canonical

package/docs/reusable-build-surface.md

@@ -66,10 +66,25 @@ release events, and non-semver release-like tags fail before the build matrix;
 they never guess alpha for a stable release.
 
 The router automatically selects `.buildchain/alpha-contract-lock.json` for
-alpha and `.buildchain/contract-lock.json` for stable. A repository can override
-the common path with `buildchain-contract-lock-path`, or override one channel
-with `buildchain-alpha-contract-lock-path` /
-`buildchain-stable-contract-lock-path`.
+alpha and `.buildchain/contract-lock.json` for stable. The generated workflow
+uses two static advanced-workflow calls: `@vN-alpha` for alpha and `@vN` for
+stable. A repository can override the common path with
+`buildchain-contract-lock-path`, or override one channel with
+`buildchain-alpha-contract-lock-path` / `buildchain-stable-contract-lock-path`,
+but the path is never channel authority. The selected file's
+`buildchain.ref` must prove the same channel and major as the workflow shell and
+runtime.
+
+Channel binding is independent of the current Buildchain major. Every
+channel-bound run validates the complete triad before compatibility drift:
+
+- stable = shell `vN` + runtime `vN` + a lock whose ref is stable `vN`;
+- alpha = shell `vN-alpha` + runtime `vN-alpha` + a lock whose ref is alpha
+  `vN-alpha`.
+
+Exact release refs are classified the same way. A missing lock, an ambiguous
+identity, a major mismatch, or any stable/alpha mixture fails even when the
+contract digest is unchanged or the drift would otherwise be additive.
 
 Only repositories changing the default policy need extra routing input:
 
@@ -279,7 +294,8 @@ shell. The full train validation protocol is documented in
 [`runtime-train-validation.md`](runtime-train-validation.md).
 
 For one-off manual validation, a trusted maintainer can run the caller workflow
-with a temporary runtime override:
+with a temporary runtime override. The override inherits the caller's declared
+alpha or stable lane; trust authorizes the opaque ref, not cross-channel use:
 
 ```yaml
 on:
@@ -1092,10 +1108,11 @@ jobs:
 ```
 
 Existing callers may keep `buildchain-contract-lock-path`; a non-empty explicit
-path overrides channel-specific selection for compatibility. Migration only
-requires adding the two channel lock inputs and may retain the remaining common
-promotion declaration unchanged. Consumers must not call the dot-prefixed
-advanced workflow directly.
+path overrides channel-specific path selection only. Its lock content must
+still prove the selected channel and major. Migration only requires adding the
+two channel lock inputs and may retain the remaining common promotion
+declaration unchanged. Consumers must not call the dot-prefixed advanced
+workflow directly.
 
 `buildchain-issue-app-id` and `buildchain-issue-app-private-key` are optional
 but recommended for cross-repository consumers. They should identify a GitHub

package/docs/runtime-train-validation.md

@@ -165,6 +165,12 @@ maintain, or admin permission on the caller repository. Pull requests,
 including fork-originated pull requests, cannot use train or exact-SHA
 overrides.
 
+That permission does not create a third channel. A train, authority ref, or
+exact SHA must be bound to an alpha or stable shell lane, and the consumer lock
+must prove that same lane and major. Trusted overrides can replace the runtime
+coordinate for validation; they cannot combine a stable shell or lock with an
+alpha runtime, or the reverse.
+
 Runtime train validation covers Buildchain runtime scripts, CLI code, local
 actions, configuration parsing, and lifecycle behavior. It cannot validate
 changes that require the outer reusable workflow YAML itself to change, such as

package/docs/versioning.md

@@ -79,8 +79,9 @@ repository changes are patch".
 
 | Date       | Action       | Line    | Faces                                                                                                                                                                        | Class    | Rationale                                                                                                                                                                                                                                                                                                                              | PR    |
 | ---------- | ------------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
-| 2026-08-10 | extend-minor | `v3.0`  | release-cut-contract, release-train-state-machine, release-train-node-export                                                                                                | additive | Add a provider-neutral rooted Release Cut and idempotent Release Train state contract that freezes candidate, tree, Alpha base, runtime, generation, and authority while treating later Dev movement as observation rather than implicit supersession.                                                                                 |       |
-| 2026-08-05 | extend-minor | `v3.0`  | auditable-demo-scenario, auditable-demo-capture, auditable-demo-adapter                                                                                                      | additive | Add an opt-in deterministic readable-playback declaration that preserves captured terminal payloads and order while normalizing only presentation timing; omitted playback continues to use observed PTY timestamps, and existing composition modes remain unchanged.                                                                 |       |
+| 2026-08-11 | extend-minor | `v3.0`  | release-blocker-repair-contract, release-blocker-priority-claim, release-train-node-export, dev-delivery-warrant-node-export                                                 | additive | Add rooted successor candidate generations on a frozen Release Cut, exact semantic patch identity across cut and Dev landings, publication blocking through conflict or mismatch, and a narrow non-preemptive Warrant blocker lane.                                                                                                    |       |
+| 2026-08-10 | extend-minor | `v3.0`  | release-cut-contract, release-train-state-machine, release-train-node-export                                                                                                 | additive | Add a provider-neutral rooted Release Cut and idempotent Release Train state contract that freezes candidate, tree, Alpha base, runtime, generation, and authority while treating later Dev movement as observation rather than implicit supersession.                                                                                 |       |
+| 2026-08-05 | extend-minor | `v3.0`  | auditable-demo-scenario, auditable-demo-capture, auditable-demo-adapter                                                                                                      | additive | Add an opt-in deterministic readable-playback declaration that preserves captured terminal payloads and order while normalizing only presentation timing; omitted playback continues to use observed PTY timestamps, and existing composition modes remain unchanged.                                                                  |       |
 | 2026-08-04 | extend-minor | `v3.0`  | dev-delivery-warrant-queue, source-qualification-proof, integration-delivery-proof, dev-delivery-cli, reusable-dev-delivery-workflows                                        | additive | Add durable fair and fenced protected-dev scheduling plus split source/integration proof contracts. Existing PR admission remains available through explicit `off` and `shadow` rollout modes; no existing command, export, or release flow is removed.                                                                                |       |
 | 2026-08-01 | extend-minor | `v3.0`  | cli-reference-registry, node-api-symbol-registry, golden-path-manual                                                                                                         | additive | Add generated, drift-checked CLI and Node API reference registries to the public site bundle, plus a package-tested first-user Golden Path; existing command execution and import semantics remain unchanged.                                                                                                                          |       |
 | 2026-07-31 | extend-minor | `v3.0`  | auditable-demo-workflow, auditable-demo-media-profile, auditable-demo-media-receipt                                                                                          | additive | Add an opt-in responsive profile that binds source-resolution and exact 1280x720 MP4/WebM/GIF renditions to one Gate and receipt while rejecting upscales, aspect-ratio drift, and profile changes between Gate-only and full-render paths.                                                                                            |       |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.9-alpha.0",
+  "version": "3.0.9-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-channel-identity.js

@@ -0,0 +1,119 @@
+const EXACT_SHA_RE = /^[0-9a-f]{40}$/i;
+const OFFICIAL_REF_RE = /^v(\d+)(?:\.\d+)?(-alpha)?$/;
+const STABLE_RELEASE_RE = /^v(\d+)\.\d+\.\d+$/;
+const ALPHA_RELEASE_RE = /^v(\d+)\.\d+\.\d+-alpha\.\d+$/;
+const TRAIN_REF_RE = /^train\/v(\d+)\/v(\d+)\.\d+\/[A-Za-z0-9._/-]+$/;
+const AUTHORITY_REF_RE = /^authority\/v(\d+)\/v(\d+)\.\d+\/[A-Za-z0-9._/-]+$/;
+
+export const BUILDCHAIN_CHANNELS = new Set(["stable", "alpha"]);
+
+export function normalizeBuildchainRef(ref = "") {
+  const value = String(ref || "").trim();
+  const workflowRef = value.includes("/.github/workflows/") ? value.split("@").pop() || "" : value;
+  return workflowRef.replace(/^refs\/(?:heads|tags)\//, "");
+}
+
+export function parseBuildchainRefIdentity(ref = "") {
+  const value = normalizeBuildchainRef(ref);
+  if (!value) return { ref: value, kind: "missing", channel: null, major: null };
+  if (EXACT_SHA_RE.test(value)) return { ref: value, kind: "exact-sha", channel: null, major: null };
+
+  for (const [pattern, channel, kind] of [
+    [OFFICIAL_REF_RE, null, "official-channel"],
+    [STABLE_RELEASE_RE, "stable", "release"],
+    [ALPHA_RELEASE_RE, "alpha", "release"],
+  ]) {
+    const match = value.match(pattern);
+    if (match) {
+      return {
+        ref: value,
+        kind,
+        channel: channel || (match[2] ? "alpha" : "stable"),
+        major: Number(match[1]),
+      };
+    }
+  }
+
+  for (const [pattern, kind] of [
+    [TRAIN_REF_RE, "train"],
+    [AUTHORITY_REF_RE, "authority"],
+  ]) {
+    const match = value.match(pattern);
+    if (match) {
+      return {
+        ref: value,
+        kind,
+        channel: null,
+        major: Number(match[1]),
+        coherentMajor: match[1] === match[2],
+      };
+    }
+  }
+  return { ref: value, kind: "development", channel: null, major: null };
+}
+
+function expectedIdentity({ workflowShellRef, expectedChannel, expectedMajor }) {
+  const shell = parseBuildchainRefIdentity(workflowShellRef);
+  const channel =
+    String(expectedChannel || "")
+      .trim()
+      .toLowerCase() || shell.channel;
+  const majorText = String(expectedMajor ?? "").trim();
+  const major = majorText ? Number(majorText.replace(/^v/, "")) : shell.major;
+  return { shell, channel, major };
+}
+
+function expectedReasons(expected, { expectedChannel, expectedMajor }) {
+  const reasons = [];
+  if (!BUILDCHAIN_CHANNELS.has(expected.channel)) reasons.push("Buildchain channel is missing or ambiguous");
+  if (!Number.isInteger(expected.major) || expected.major < 1) reasons.push("Buildchain major is missing or ambiguous");
+  if (expected.shell.channel && expected.shell.channel !== expected.channel) {
+    reasons.push(`workflow shell ${expected.shell.ref} is ${expected.shell.channel}, expected ${expected.channel}`);
+  }
+  if (Number.isInteger(expected.shell.major) && expected.shell.major !== expected.major) {
+    reasons.push(`workflow shell ${expected.shell.ref} is v${expected.shell.major}, expected v${expected.major}`);
+  }
+  if (!expected.shell.channel && (!expectedChannel || !expectedMajor)) {
+    reasons.push(`workflow shell ${expected.shell.ref || "(missing)"} does not declare a stable or alpha channel`);
+  }
+  return reasons;
+}
+
+function runtimeReasons(expected, runtime, allowOpaqueRuntime) {
+  if (runtime.channel) {
+    return [runtime.channel !== expected.channel ? `runtime ${runtime.ref} is ${runtime.channel}, expected ${expected.channel}` : "", runtime.major !== expected.major ? `runtime ${runtime.ref} is v${runtime.major}, expected v${expected.major}` : ""].filter(Boolean);
+  }
+  if (new Set(["train", "authority", "exact-sha"]).has(runtime.kind) && allowOpaqueRuntime) {
+    return [runtime.coherentMajor === false ? `runtime ${runtime.ref} has inconsistent major segments` : "", Number.isInteger(runtime.major) && runtime.major !== expected.major ? `runtime ${runtime.ref} is v${runtime.major}, expected v${expected.major}` : ""].filter(Boolean);
+  }
+  return [`runtime ${runtime.ref || "(missing)"} does not prove the ${expected.channel || "selected"} channel`];
+}
+
+function lockReasons(expected, lock, lockMajor, lockMajorLine) {
+  if (!lock.ref) return ["Buildchain contract lock is required for a channel-bound run"];
+  return [lock.channel !== expected.channel ? `contract lock ref ${lock.ref} does not prove the ${expected.channel} channel` : "", lock.major !== expected.major ? `contract lock ref ${lock.ref} does not prove major v${expected.major}` : "", lockMajorLine && lockMajor.major !== expected.major ? `contract lock major line ${lockMajor.ref} does not match v${expected.major}` : ""].filter(Boolean);
+}
+
+export function evaluateBuildchainChannelBinding({ workflowShellRef = "", runtimeRef = "", lockRef = "", lockMajorLine = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false } = {}) {
+  const expected = expectedIdentity({
+    workflowShellRef,
+    expectedChannel,
+    expectedMajor,
+  });
+  const runtime = parseBuildchainRefIdentity(runtimeRef);
+  const lock = parseBuildchainRefIdentity(lockRef);
+  const lockMajor = parseBuildchainRefIdentity(lockMajorLine);
+  const reasons = [...expectedReasons(expected, { expectedChannel, expectedMajor }), ...runtimeReasons(expected, runtime, allowOpaqueRuntime), ...lockReasons(expected, lock, lockMajor, lockMajorLine)];
+
+  return {
+    ok: reasons.length === 0,
+    status: reasons.length === 0 ? "channel-bound" : "channel-binding-mismatch",
+    channel: expected.channel || null,
+    major: Number.isInteger(expected.major) ? expected.major : null,
+    shell: expected.shell,
+    runtime,
+    lock,
+    lockMajor,
+    reasons,
+  };
+}

package/packages/core/buildchain-compatibility-proof.js

@@ -7,6 +7,7 @@ import {
   devDeliveryRepository as repository,
   devDeliveryText as text,
 } from "./dev-delivery-common.js";
+import { evaluateBuildchainChannelBinding } from "./buildchain-channel-identity.js";
 
 export const BUILDCHAIN_COMPATIBILITY_PROOF_SCHEMA = "kungfu.buildchain.compatibility-proof/v1";
 export const BUILDCHAIN_COMPATIBILITY_PROOF_REGISTRY_SCHEMA = "kungfu.buildchain.compatibility-proof-registry/v1";
@@ -437,6 +438,19 @@ function evaluateSurfaceRelation({ oldSurface, nextSurface, proofRegistry, major
   };
 }
 
+function evaluateChannelBinding({ lock, workflowShellRef, runtimeRef, expectedChannel, expectedMajor, allowOpaqueRuntime }) {
+  if (!workflowShellRef && !expectedChannel && !expectedMajor) return null;
+  return evaluateBuildchainChannelBinding({
+    workflowShellRef,
+    runtimeRef,
+    lockRef: lock?.buildchain?.ref || "",
+    lockMajorLine: lock?.buildchain?.majorLine || "",
+    expectedChannel,
+    expectedMajor,
+    allowOpaqueRuntime,
+  });
+}
+
 export function evaluateBuildchainContractLock({
   lock,
   current,
@@ -444,11 +458,29 @@ export function evaluateBuildchainContractLock({
   runtimeSha = "",
   runtimeClass = "",
   compatibilityPolicy = "",
+  workflowShellRef = "",
+  expectedChannel = "",
+  expectedMajor = "",
+  allowOpaqueRuntime = false,
 } = {}) {
   if (!current || current.contract !== BUILDCHAIN_CONTRACT) {
     throw new Error("current must be a Buildchain runtime contract world");
   }
   assertBuildchainCompatibilityProjection(current);
+  const binding = evaluateChannelBinding({
+    lock, workflowShellRef, runtimeRef, expectedChannel, expectedMajor, allowOpaqueRuntime,
+  });
+  if (binding?.ok === false) {
+    return {
+      ok: false,
+      status: binding.status,
+      drift: false,
+      compatible: false,
+      issueRecommended: false,
+      reasons: binding.reasons,
+      channelBinding: binding,
+    };
+  }
   if (!new Set(["stable", "alpha"]).has(runtimeClass)) {
     return {
       ok: true,

package/packages/core/buildchain-contract.js

@@ -9,6 +9,13 @@ import {
 import { createControllerRegistry } from "./controller-evidence.js";
 import { enumerateWorkflowInputs } from "./public-surface-audit.js";
 
+export {
+  BUILDCHAIN_CHANNELS,
+  evaluateBuildchainChannelBinding,
+  normalizeBuildchainRef,
+  parseBuildchainRefIdentity,
+} from "./buildchain-channel-identity.js";
+
 export {
   BUILDCHAIN_COMPATIBILITY_PROOF_REGISTRY_SCHEMA,
   BUILDCHAIN_COMPATIBILITY_PROOF_SCHEMA,

package/packages/core/controller-evidence.js

@@ -53,7 +53,8 @@ const CONTROLLER_SPECS = [
     workflowId: "build",
     version: 1,
     capabilities: ["channel-selection", "runtime-selection", "build-delegation"],
-    stages: ["resolve-channel", "build", "aggregate"],
+    stages: ["resolve-channel", "alpha", "stable", "aggregate"],
+    optionalStages: ["alpha", "stable"],
     evidence: ["nested-controller-receipt", "controller-receipt"],
   },
   {

package/packages/core/dev-delivery-warrant.js

@@ -2,7 +2,9 @@ import { devDeliveryClone as clone, devDeliveryContentRoot, devDeliveryExactRoot
 import { chainedDevDeliveryAttemptInput, createDevDeliveryCandidateIdentity, validateDevDeliveryCandidateChain } from "./dev-delivery-candidate-identity.js";
 import { DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA, createCancelQueuedDevDeliveryCandidate } from "./dev-delivery-warrant-cancellation.js";
 import { DEV_DELIVERY_SETTLEMENT_RECEIPT_SCHEMA, createDevDeliveryTerminalSettler } from "./dev-delivery-warrant-settlement.js";
+import { compareReleaseBlockerPriority, normalizeReleaseBlockerPriorityClaim } from "./release-blocker-priority.js";
 export { devDeliveryContentRoot } from "./dev-delivery-common.js";
+export { RELEASE_BLOCKER_PRIORITY_CLAIM_SCHEMA, createReleaseBlockerPriorityClaim } from "./release-blocker-priority.js";
 export { SOURCE_QUALIFICATION_PROOF_SCHEMA, PROJECT_CUT_REPLAY_PROOF_SCHEMA, INTEGRATION_DELIVERY_PROOF_SCHEMA, classifyDevDeliveryDelta, createIntegrationDeliveryProof, createProjectCutReplayPlan, createProjectCutReplayProof, createSourceQualificationProof, verifyIntegrationDeliveryProof, verifyProjectCutReplayProof, verifySourceQualificationProof } from "./dev-delivery-proof.js";
 export { DEV_DELIVERY_CANCELLATION_RECEIPT_SCHEMA };
 export const DEV_DELIVERY_QUEUE_CONTRACT = "kungfu-buildchain-dev-delivery-warrant-queue";
@@ -60,7 +62,7 @@ function normalizeCandidate(input, expected) {
   if (!["queued", "selected", "proving", "waiting", "blocked", ...TERMINAL_STATES].includes(status)) {
     throw new Error(`unsupported candidate status ${status || "<empty>"}`);
   }
-  return {
+  const candidate = {
     ...identity,
     sourceHead: exactSha(input.sourceHead, "sourceHead"),
     sourcePatchRoot: exactRoot(input.sourcePatchRoot, "sourcePatchRoot"),
@@ -78,6 +80,8 @@ function normalizeCandidate(input, expected) {
     status,
     terminal: input.terminal || null,
   };
+  if (Object.hasOwn(input, "releaseBlockerPriority")) candidate.releaseBlockerPriority = normalizeReleaseBlockerPriorityClaim(input.releaseBlockerPriority, candidate, expected);
+  return candidate;
 }
 
 function queueBody(queue) {
@@ -140,6 +144,7 @@ export function normalizeDevDeliveryQueue(input, expected = {}) {
     if (activeCandidates.length !== 1 || activeCandidates[0].candidateId !== warrant.candidateId) {
       throw new Error("exactly one active candidate must match the active Warrant");
     }
+    if (warrant.releaseBlockerPriority?.claimRoot !== activeCandidates[0].releaseBlockerPriority?.claimRoot) throw new Error("active Warrant release-blocker priority drift");
   } else if (queue.candidates.some((candidate) => ["selected", "proving", "waiting", "blocked"].includes(candidate.status))) {
     throw new Error("active candidate exists without an active Warrant");
   }
@@ -180,6 +185,7 @@ function submissionReceipt({ before, after, candidate, action, now }) {
     dependencyRoot: candidate.dependencyRoot,
     toolchainRoot: candidate.toolchainRoot,
     sourceWorkflowRunId: candidate.sourceWorkflowRunId,
+    ...(Object.hasOwn(candidate, "releaseBlockerPriority") ? { releaseBlockerPriority: candidate.releaseBlockerPriority } : {}),
     deliveryClass: candidate.deliveryClass,
     priority: candidate.priority,
     retainedEnqueuedAt: candidate.enqueuedAt,
@@ -219,7 +225,7 @@ export function submitDevDeliveryCandidate(queueInput, input, { now = new Date()
           throw new Error(`candidate ${attemptedCandidate.candidateId} is terminal and cannot be resubmitted`);
         }
         const exactProofFields = ["sourcePatchRoot", "sourceProofRoot", "planRoot", "closureRoot", "dependencyRoot", "toolchainRoot"];
-        const exactProofMatches = exactProofFields.every((field) => existing[field] === attemptedCandidate[field]);
+        const exactProofMatches = exactProofFields.every((field) => existing[field] === attemptedCandidate[field]) && existing.releaseBlockerPriority?.claimRoot === attemptedCandidate.releaseBlockerPriority?.claimRoot;
         if (existing.sourceHead === attemptedCandidate.sourceHead && exactProofMatches) {
           action = "duplicate-noop";
           selected = existing;
@@ -235,6 +241,8 @@ export function submitDevDeliveryCandidate(queueInput, input, { now = new Date()
           const headChanged = existing.sourceHead !== attemptedCandidate.sourceHead;
           existing.sourceHead = attemptedCandidate.sourceHead;
           for (const field of exactProofFields) existing[field] = attemptedCandidate[field];
+          if (Object.hasOwn(attemptedCandidate, "releaseBlockerPriority")) existing.releaseBlockerPriority = attemptedCandidate.releaseBlockerPriority;
+          else delete existing.releaseBlockerPriority;
           existing.updatedAt = currentTime;
           existing.attempts += 1;
           existing.status = "queued";
@@ -270,6 +278,7 @@ function effectivePriority(candidate, policy, now) {
     basePriority: DEV_DELIVERY_PRIORITIES[candidate.priority],
     agingBoost,
     score: Math.min(policy.maxPriority, DEV_DELIVERY_PRIORITIES[candidate.priority] + agingBoost),
+    releaseBlocker: Boolean(candidate.releaseBlockerPriority),
   };
 }
 
@@ -282,7 +291,7 @@ export function rankDevDeliveryCandidates(queueInput, { now = new Date().toISOSt
       candidate,
       priority: effectivePriority(candidate, queue.policy, currentTime),
     }))
-    .sort((left, right) => right.priority.score - left.priority.score || left.candidate.enqueuedAt.localeCompare(right.candidate.enqueuedAt) || left.candidate.candidateId.localeCompare(right.candidate.candidateId));
+    .sort((left, right) => compareReleaseBlockerPriority(left, right) || right.priority.score - left.priority.score || left.candidate.enqueuedAt.localeCompare(right.candidate.enqueuedAt) || left.candidate.candidateId.localeCompare(right.candidate.candidateId));
 }
 
 function warrantToken(input) {
@@ -371,6 +380,7 @@ export function selectDevDeliveryWarrant(queueInput, { now = new Date().toISOStr
         dependencyRoot: candidate.dependencyRoot,
         toolchainRoot: candidate.toolchainRoot,
         sourceWorkflowRunId: candidate.sourceWorkflowRunId,
+        ...(Object.hasOwn(candidate, "releaseBlockerPriority") ? { releaseBlockerPriority: candidate.releaseBlockerPriority } : {}),
         deliveryClass: candidate.deliveryClass,
         generation: next.fencingCounter,
         expectedOldStateRoot: before.stateRoot,
@@ -390,7 +400,7 @@ export function selectDevDeliveryWarrant(queueInput, { now = new Date().toISOStr
   const receipt = {
     schema: DEV_DELIVERY_SELECTION_RECEIPT_SCHEMA,
     selected: true,
-    reason: selected.priority.agingBoost > 0 ? "fifo-aging-bounded-priority" : "fifo-bounded-priority",
+    reason: selected.priority.releaseBlocker ? "release-blocker-bounded-priority" : selected.priority.agingBoost > 0 ? "fifo-aging-bounded-priority" : "fifo-bounded-priority",
     repository: transaction.after.repository,
     protectedBase: transaction.after.protectedBase,
     candidateId: transaction.result.candidate.candidateId,
@@ -406,6 +416,7 @@ export function selectDevDeliveryWarrant(queueInput, { now = new Date().toISOStr
     dependencyRoot: transaction.result.candidate.dependencyRoot,
     toolchainRoot: transaction.result.candidate.toolchainRoot,
     sourceWorkflowRunId: transaction.result.candidate.sourceWorkflowRunId,
+    ...(Object.hasOwn(transaction.result.candidate, "releaseBlockerPriority") ? { releaseBlockerPriority: transaction.result.candidate.releaseBlockerPriority } : {}),
     deliveryClass: transaction.result.candidate.deliveryClass,
     queueAgeSeconds: selected.priority.ageSeconds,
     basePriority: selected.priority.basePriority,

package/packages/core/kfd-adopter-manifest.js

@@ -25,7 +25,7 @@ const SHA_PATTERN = /^[0-9a-f]{40}$/;
 const REQUIRED_DECISIONS = Object.freeze(["KFD-1", "KFD-2", "KFD-3", "KFD-4", "KFD-5", "KFD-7"]);
 const PRODUCT_GATE_STANDARDS = Object.freeze(["kfd-4", "kfd-5", "kfd-7"]);
 const PRODUCT_GATE_SET = new Set(PRODUCT_GATE_STANDARDS);
-const require = createRequire(import.meta.url);
+const require = createRequire(import.meta.url), installedKfdPackageOptions = (options) => { try { return { ...options, packageRoot: require.resolve("@kungfu-tech/kfd/package.json").replace(/[\\/]package\.json$/, "") }; } catch { return options; } };
 
 function issue(code, path, message, detail = {}) {
   return { level: "error", code, path, message, ...detail };
@@ -63,14 +63,14 @@ function decisionWitnessRow(row) {
 
 function verifyPublishedManifest(manifest, packageOptions, issues) {
   try {
-    const report = verifyAdopterManifestFromPackage(manifest, packageOptions);
+    const report = verifyAdopterManifestFromPackage(manifest, installedKfdPackageOptions(packageOptions));
     if (!report.valid) {
       issues.push(issue("adopter-manifest-invalid", "manifest", "published KFD adopter verifier rejected the manifest", {
         manifestIssues: report.issues,
       }));
       return null;
     }
-    return bundleAdopterManifest(manifest, packageOptions);
+    return bundleAdopterManifest(manifest, installedKfdPackageOptions(packageOptions));
   } catch (error) {
     issues.push(issue("adopter-manifest-invalid", "manifest", error.message));
     return null;