@kungfu-tech/buildchain 3.0.9-alpha.1 → 3.0.9-alpha.10

package/docs/release-governance.md

@@ -263,9 +263,11 @@ semantics and fail-closed verification requirements.
 The authority verifies the complete result set on GitHub-hosted infrastructure
 before delivery. The consumer controller also performs final result verification,
 exact-byte import, manifest recomputation, and deterministic-artifact replacement
-on a GitHub-hosted lane. Self-hosted build runners do not download authority
-result payloads, and aggregate/release evidence fails closed until this
-finalization succeeds.
+on a GitHub-hosted lane. macOS results finalize on a GitHub-hosted macOS runner so
+the consumer lifecycle can perform native post-sign checks before publication;
+other platforms retain the GitHub-hosted Ubuntu control lane. Self-hosted build
+runners do not download authority result payloads, and aggregate/release evidence
+fails closed until this finalization succeeds.
 
 The central `buildchain-artifact-signing` environment reuses the established
 macOS Credential Island names (`BUILDCHAIN_MACOS_CERTIFICATE_*`,
@@ -491,10 +493,11 @@ GitHub Merge Queue does not by itself decide which candidate may spend a long
 native proof before enqueue. Repositories with that workload use the
 [Dev Delivery Warrant Queue](dev-delivery-warrant.md) as the durable,
 FIFO-aging scheduling and fencing authority before native queue admission. A
-selected Warrant owns one complete delivery attempt and later candidates remain
-visibly queued; GitHub still owns the exact `merge_group` proof and final ref
-mutation. Workflow concurrency remains only a process critical section and is
-not fairness or ownership authority.
+provisional Warrant reserves the landing order before native shards, while only
+its atomic qualified upgrade can authorize enqueue. Later candidates remain
+visibly queued and continue source/CI work; GitHub still owns the exact
+`merge_group` proof and final ref mutation. Workflow concurrency remains only a
+process critical section and is not fairness or ownership authority.
 
 Every required workflow must handle both `pull_request` and `merge_group`
 before the queue is enabled. Queue runs do not provide

package/docs/release-passport.md

@@ -410,8 +410,14 @@ Pass the standard full-cut declaration with `--kfd-adopter-manifest-json`
 together with three `--kfd-product-gate-json` arguments for KFD-4, KFD-5, and
 KFD-7. The collector invokes the verifier from the exact installed
 `@kungfu-tech/kfd` package, binds the package artifact, registry and verifier
-roots, the exact Buildchain source, the manifest/report/bundle witness roots,
-and the existing product-gate roots. It emits `kfd-adopter-manifest.json`,
+roots, the collector's exact product repository and source, the
+manifest/report/bundle witness roots, and the existing product-gate roots. A
+non-Buildchain adopter is accepted only when its manifest identity, artifact
+coordinate, and all three product-gate repositories match the collector's
+`--repository` value. The lower-level Node API exposes the same boundary as
+`expectedAdopterId`, `expectedSourceRepository`, and `expectedSourceSha`, while
+omitted identity/repository values retain the Buildchain self-release default.
+It emits `kfd-adopter-manifest.json`,
 `kfd-adopter-manifest-gate.json`, and a legacy `kfd-support.json` projection.
 The release passport and `artifact-evidence.json` carry the same rooted
 `kfdAdopter` binding.

package/docs/versioning.md

@@ -79,7 +79,10 @@ repository changes are patch".
 
 | Date       | Action       | Line    | Faces                                                                                                                                                                        | Class    | Rationale                                                                                                                                                                                                                                                                                                                              | PR    |
 | ---------- | ------------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
-| 2026-08-11 | extend-minor | `v3.0`  | release-blocker-repair-contract, release-blocker-priority-claim, release-train-node-export, dev-delivery-warrant-node-export                                                 | additive | Add rooted successor candidate generations on a frozen Release Cut, exact semantic patch identity across cut and Dev landings, publication blocking through conflict or mismatch, and a narrow non-preemptive Warrant blocker lane.                                                                                                    |       |
+| 2026-08-11 | extend-minor | `v3.0`  | provisional-delivery-warrant, qualified-delivery-warrant, native-qualification-proof, native-proof-reuse-decision, generated-native-delivery-workflow                         | additive | Reserve protected-dev order after exact source acceptance and approval, then require an atomic native-proof-bound qualification before merge-queue admission. Reuse is limited to stable semantic source, closure, dependencies, and toolchain with a fully attributed disjoint base delta; overlap and uncertainty fail closed to revalidation. |       |
+| 2026-08-12 | extend-minor | `v3.0`  | bounded-qualification-lease, exclusive-landing-warrant, dev-delivery-authority-v2                                                                                               | additive | Add an explicit opt-in v2 state that permits bounded qualification-only leases while retaining one exclusive merge-group Landing Warrant. The v1 single-flight Warrant state and commands remain the byte- and behavior-compatible default.                                                                       |       |
+| 2026-08-12 | extend-minor | `v3.0`  | native-qualification-proof-v2, native-proof-base-delta, idempotent-native-proof-resume                                                                                          | additive | Bind native proof to the execution environment and a rooted complete Dev-delta/rename attribution, persist completed proof before final classification, and make duplicate qualified-controller dispatch an effect-free replay. Legacy v1 proof remains verifiable but cannot be reused without the v2 environment binding. |       |
+| 2026-08-11 | extend-minor | `v3.0`  | release-blocker-repair-contract, release-blocker-priority-claim, release-train-node-export, dev-delivery-warrant-node-export, next-development-transition, next-development-projection | additive | Add rooted successor candidate generations on a frozen Release Cut, exact semantic patch identity across cut and Dev landings, publication blocking through conflict or mismatch, a narrow non-preemptive Warrant blocker lane, and a separate rooted transition that preserves completed Alpha success while the following development version is materialized. |       |
 | 2026-08-10 | extend-minor | `v3.0`  | release-cut-contract, release-train-state-machine, release-train-node-export                                                                                                 | additive | Add a provider-neutral rooted Release Cut and idempotent Release Train state contract that freezes candidate, tree, Alpha base, runtime, generation, and authority while treating later Dev movement as observation rather than implicit supersession.                                                                                 |       |
 | 2026-08-05 | extend-minor | `v3.0`  | auditable-demo-scenario, auditable-demo-capture, auditable-demo-adapter                                                                                                      | additive | Add an opt-in deterministic readable-playback declaration that preserves captured terminal payloads and order while normalizing only presentation timing; omitted playback continues to use observed PTY timestamps, and existing composition modes remain unchanged.                                                                  |       |
 | 2026-08-04 | extend-minor | `v3.0`  | dev-delivery-warrant-queue, source-qualification-proof, integration-delivery-proof, dev-delivery-cli, reusable-dev-delivery-workflows                                        | additive | Add durable fair and fenced protected-dev scheduling plus split source/integration proof contracts. Existing PR admission remains available through explicit `off` and `shadow` rollout modes; no existing command, export, or release flow is removed.                                                                                |       |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.9-alpha.1",
+  "version": "3.0.9-alpha.10",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -28,12 +28,20 @@
     "./cache-evidence": "./packages/core/cache-evidence.js",
     "./controller-evidence": "./packages/core/controller-evidence.js",
     "./diagnostics": "./packages/core/diagnostics.js",
+    "./dev-delivery-authority": "./packages/core/dev-delivery-authority.js",
     "./dev-delivery-warrant": "./packages/core/dev-delivery-warrant.js",
     "./homebrew": "./packages/core/homebrew.js",
     "./issue-reporting": "./packages/core/issue-reporting.js",
     "./kfd": "./packages/core/kfd.js",
     "./kfd-product-gates": "./packages/core/kfd-product-gates.js",
     "./kfd-adopter-manifest": "./packages/core/kfd-adopter-manifest.js",
+    "./adopter-delivery-gate": "./packages/core/adopter-delivery-gate.js",
+    "./kfd-adopter-category-driver": "./packages/core/kfd-adopter-category-driver.js",
+    "./buildchain-delivery-infrastructure": "./packages/core/buildchain-delivery-infrastructure.js",
+    "./buildchain-delivery-bootstrap": "./packages/core/buildchain-delivery-bootstrap.js",
+    "./legacy-kfd-adopter-driver": "./packages/core/legacy-kfd-adopter-driver.js",
+    "./adopter-delivery-passport": "./packages/core/adopter-delivery-passport.js",
+    "./adopter-delivery-vectors": "./packages/core/adopter-delivery-vectors.js",
     "./kfd-adopter-release-binding": "./packages/core/artifact-verification-envelope.js",
     "./kfd-agent-hub": "./packages/core/kfd-agent-hub.js",
     "./buildchain-layout": "./packages/core/buildchain-layout.js",
@@ -57,6 +65,9 @@
     "./release-candidate": "./packages/core/release-candidate.js",
     "./release-candidate-recovery": "./packages/core/release-candidate-recovery.js",
     "./release-train": "./packages/core/release-train.js",
+    "./next-development-transition": "./packages/core/next-development-transition.js",
+    "./next-development-controller": "./packages/core/next-development-controller.js",
+    "./next-development-projection": "./packages/core/next-development-projection.js",
     "./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",
     "./release-passport": "./packages/core/release-passport.js",
     "./release-passport-contract": "./packages/core/release-passport-contract.js",
@@ -89,6 +100,7 @@
     "./site/schemas/release-passport-v1.schema.json": "./dist/site/schemas/release-passport-v1.schema.json",
     "./site/schemas/kfd-agent-hub-adoption.schema.json": "./dist/site/schemas/kfd-agent-hub-adoption.schema.json",
     "./site/schemas/kfd-product-gate-input-v1.schema.json": "./dist/site/schemas/kfd-product-gate-input-v1.schema.json",
+    "./site/schemas/dev-delivery-authority-v2.schema.json": "./dist/site/schemas/dev-delivery-authority-v2.schema.json",
     "./site/buildchain-contract.json": "./dist/site/buildchain-contract.json",
     "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
     "./site/release-provenance.json": "./dist/site/release-provenance.json",
@@ -108,7 +120,8 @@
     "SECURITY.md",
     "docs/*.md",
     "actions/*/README.md",
-    "fixtures/*/README.md"
+    "fixtures/*/README.md",
+    "templates/"
   ],
   "engines": {
     "node": ">=22.14.0"
@@ -121,12 +134,14 @@
   "scripts": {
     "operator:windows-jit": "bash scripts/aws-windows-jit-operator.sh",
     "check": "pnpm run check:static && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && node scripts/check-core-mechanism-inventory.mjs && node scripts/check-release-tail-contract.mjs && node scripts/v4-architecture.mjs validate && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && pnpm run check:golden-path && node scripts/check-action-bundles.mjs",
-    "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/release-tail-capabilities-v1.schema.json contracts/release-tail-provider-bindings-v1.schema.json contracts/publication-rehearsal-capsule-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json bin/internal/command-registry.mjs scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/maintainability-metrics.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs",
+    "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json contracts/dev-delivery-authority-v2.schema.json contracts/release-tail-capabilities-v1.schema.json contracts/release-tail-provider-bindings-v1.schema.json contracts/publication-rehearsal-capsule-v1.schema.json contracts/fixtures/release-tail-capabilities-v1/*.json bin/internal/command-registry.mjs scripts/authorize-promotion-runtime-override.cjs scripts/check-core-mechanism-inventory.mjs scripts/check-release-tail-contract.mjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/maintainability-metrics.mjs scripts/public-reference.mjs scripts/site-reference-registry.mjs scripts/generate-public-reference.mjs scripts/v4-architecture.mjs scripts/verify-golden-path.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/core-mechanism-inventory.test.mjs tests/release-tail-contract.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs tests/public-reference.test.mjs tests/v4-architecture.test.mjs",
     "check:workflows": "bash scripts/check-workflows.sh",
     "generate:reference": "node scripts/generate-public-reference.mjs",
     "check:reference": "node scripts/generate-public-reference.mjs --check",
-    "generate:site": "pnpm run generate:reference && node scripts/generate-site-bundle.mjs",
-    "check:site": "pnpm run check:reference && node scripts/generate-site-bundle.mjs --check",
+    "generate:next-development": "node scripts/generate-next-development-guidance.mjs",
+    "check:next-development": "node scripts/generate-next-development-guidance.mjs --check",
+    "generate:site": "pnpm run generate:next-development && pnpm run generate:reference && node scripts/generate-site-bundle.mjs",
+    "check:site": "pnpm run check:next-development && pnpm run check:reference && node scripts/generate-site-bundle.mjs --check",
     "check:golden-path": "node scripts/verify-golden-path.mjs",
     "test:unit": "node --test tests/*.test.mjs",
     "build": "pnpm -r --filter \"./actions/**\" build",
@@ -140,7 +155,7 @@
     "typescript": "^5.9.0"
   },
   "dependencies": {
-    "@kungfu-tech/kfd": "1.0.0-alpha.60",
+    "@kungfu-tech/kfd": "1.0.0-alpha.62",
     "ajv": "8.20.0",
     "smol-toml": "1.7.0"
   }

package/packages/core/README.md

@@ -16,6 +16,9 @@ Current shared surfaces:
   `@kungfu-tech/buildchain/build-facts`;
 - release passport creation and verification through
   `@kungfu-tech/buildchain/release-passport`.
+- protocol-neutral adopter delivery gating, published KFD category verification,
+  explicit legacy adaptation, Release Passport binding, and rooted offline vectors
+  through the `@kungfu-tech/buildchain/adopter-delivery-*` subpaths.
 - anchored/manual derived witness preflight and exact-tree evidence through
   `@kungfu-tech/buildchain/anchored-version-material`.
 - sealed exact-root and KFD assessment inputs for KFX admission through
@@ -82,6 +85,28 @@ const fact = collectModuleBuildFacts({ moduleId: "native-core" });
 writeBuildFacts({ fact, output: ".buildchain/facts/native-core.json" });
 ```
 
+Adopter delivery consumers compose an exact protocol driver with an explicit
+artifact profile. Buildchain does not infer a driver from project identity:
+
+```js
+import {
+  createAdopterDeliveryGate,
+  createPackageArtifactProfile,
+} from "@kungfu-tech/buildchain/adopter-delivery-gate";
+import { createKfdAdopterCategoryProtocolDriver } from "@kungfu-tech/buildchain/kfd-adopter-category-driver";
+
+const gate = createAdopterDeliveryGate({
+  drivers: [createKfdAdopterCategoryProtocolDriver()],
+  artifactProfiles: [createPackageArtifactProfile()],
+});
+const result = gate.evaluate(request, exactPublishedKfdContext);
+```
+
+The returned result remains non-qualifying and non-self-certifying. Bind it to
+Release Passport and artifact evidence only after `status === "passed"`; use the
+rooted suite from `@kungfu-tech/buildchain/adopter-delivery-vectors` for offline
+consumer replay.
+
 KFX producers can seal one passing artifact verification with exact roots,
 identity, lifecycle, revocation, and an existing ADR-0052 assessment. Consumers
 verify or project the same envelope instead of reconstructing bindings: