@kungfu-tech/buildchain 3.0.9-alpha.15 → 3.0.9-alpha.16

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.15",
+    "version": "3.0.9-alpha.16",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -4269,5 +4269,5 @@
   ],
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:57d37609068590238f547a133b6b69ee994b452825030447d20529683ba61fbd",
-  "contractDigest": "sha256:5952e1766dc136a4c405efc5f50d5227cacfe89c151d5a6287b1744c2a90a53c"
+  "contractDigest": "sha256:ee1ae2589f8006fb5cc18734ad5adc6c3d69e2cd0747467808c15248111c6d39"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-08-13T17:47:25.000Z",
-  "publishedAt": "2026-08-13T17:47:25.000Z",
+  "generatedAt": "2026-08-13T19:32:43.000Z",
+  "publishedAt": "2026-08-13T19:32:43.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "5e2d41bab6c50155bd407bd2d7558c174c44e66f",
+  "sourceRevision": "45d01565d7039cb8c7bb71ddd4e9f8f43085aea3",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.15",
+    "version": "3.0.9-alpha.16",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "a9d60e93977fa6a58d83afa111f0941ea2768dfbf396bf716e7aead28afa819e",
+    "sha256": "a9e3be76609998e26b02f436a2a033005878e6f6313554cbdac87b3edadb95b6",
     "summary": {
       "cliCommandCount": 114,
       "workflowCount": 69,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "a9d60e93977fa6a58d83afa111f0941ea2768dfbf396bf716e7aead28afa819e",
+      "sha256": "a9e3be76609998e26b02f436a2a033005878e6f6313554cbdac87b3edadb95b6",
       "summary": {
         "cliCommandCount": 114,
         "workflowCount": 69,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.15",
+    "version": "3.0.9-alpha.16",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/public-surface-audit.json

@@ -8351,7 +8351,7 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "613ca42d3fe36e953603221d1cf16478ba84e6cf27dd6d11ddb2c1caea42ec3b",
-    "workflowRegistryDigest": "9c6353b322571a7cd66408dbb751ba53d0e286eabd5a0dfb829c9f2a8e248c8e",
+    "workflowRegistryDigest": "b2ade24ee445b041ad32e95415b574a29ef8f6ece55fc1b07e09e5c9bcdc5859",
     "pageRegistryDigest": "278318ddd3f832a3681ff805eff19f9a1e3d7da382c62db10a8be663cdc99139"
   },
   "comparison": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-13T17:47:25.000Z",
-  "publishedAt": "2026-08-13T17:47:25.000Z",
+  "generatedAt": "2026-08-13T19:32:43.000Z",
+  "publishedAt": "2026-08-13T19:32:43.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "5e2d41bab6c50155bd407bd2d7558c174c44e66f",
+  "sourceRevision": "45d01565d7039cb8c7bb71ddd4e9f8f43085aea3",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.15",
+    "version": "3.0.9-alpha.16",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-13T17:47:25.000Z",
-  "publishedAt": "2026-08-13T17:47:25.000Z",
+  "generatedAt": "2026-08-13T19:32:43.000Z",
+  "publishedAt": "2026-08-13T19:32:43.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "5e2d41bab6c50155bd407bd2d7558c174c44e66f",
+  "sourceRevision": "45d01565d7039cb8c7bb71ddd4e9f8f43085aea3",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.15",
+    "version": "3.0.9-alpha.16",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -1970,7 +1970,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.15",
+      "introducedVersion": "3.0.9-alpha.16",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1991,7 +1991,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.15",
+      "introducedVersion": "3.0.9-alpha.16",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2012,7 +2012,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.15",
+      "introducedVersion": "3.0.9-alpha.16",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2062,7 +2062,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.15",
+      "introducedVersion": "3.0.9-alpha.16",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.9-alpha.15",
+  "version": "3.0.9-alpha.16",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/check-inventory.mjs

@@ -1003,7 +1003,7 @@ for (const forbiddenSnippet of [
 for (const requiredSnippet of [
   "id-token: write",
   "actions: write",
-  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@15db8a9d7c39f7a649a0e3971af68490356dd9ac\n",
+  "uses: ./.github/workflows/.release-candidate-promote.yml\n",
   "github.event.workflow_run.event == 'push'",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
@@ -1152,10 +1152,7 @@ for (const requiredSnippet of [
     throw new Error(`promote-buildchain-ref index missing semver GitHub Release implementation: ${requiredSnippet}`);
   }
 }
-for (const forbiddenSnippet of [
-  "uses: ./.github/workflows/.release-candidate-promote.yml",
-  "uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@",
-]) {
+for (const forbiddenSnippet of ["uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@"]) {
   if (buildchainRefPromotionWorkflow.includes(forbiddenSnippet)) {
     throw new Error(`buildchain ref promotion workflow must use the declarative wrapper, found manual snippet: ${forbiddenSnippet}`);
   }

package/scripts/workflow-call-contract.mjs

@@ -26,29 +26,33 @@ export function selfReleaseRouteIdentity(workflowText, jobId = "promote") {
     (entry) => entry.id === jobId,
   );
   if (!job) parityFailure(`reusable workflow job is missing: ${jobId}`);
+  const exactSelfBootstrap = job.uses === "./.github/workflows/.release-candidate-promote.yml";
   if (
-    job.uses.startsWith("./") ||
+    (job.uses.startsWith("./") && !exactSelfBootstrap) ||
     job.uses.includes("/.release-candidate-promote.yml@")
   ) {
     parityFailure(
       `authoritative caller uses an internal or checkout-relative route: ${job.uses}`,
     );
   }
-  if (job.uses !== SELF_RELEASE_PUBLIC_WORKFLOW) {
+  if (!exactSelfBootstrap && job.uses !== SELF_RELEASE_PUBLIC_WORKFLOW) {
     parityFailure(
       `caller uses ${job.uses}, expected ${SELF_RELEASE_PUBLIC_WORKFLOW}`,
     );
   }
-  if (literal(job, "buildchain-ref") !== SELF_RELEASE_REF) {
+  if (!exactSelfBootstrap && literal(job, "buildchain-ref") !== SELF_RELEASE_REF) {
     parityFailure("caller runtime ref differs from the public workflow ref");
   }
+  if (exactSelfBootstrap && (job?.with?.["buildchain-ref"]?.kind !== "expression" ||
+    !String(job?.with?.["buildchain-contract-lock-path"]?.value).includes(".buildchain/alpha-contract-lock.json")))
+    parityFailure("self-bootstrap must bind exact runtime and Alpha contract identities");
   if (literal(job, "declarative-release-tail") !== true) {
     parityFailure(
       "caller does not require the declarative release-tail provider plane",
     );
   }
   return {
-    publicWorkflow: job.uses,
+    publicWorkflow: SELF_RELEASE_PUBLIC_WORKFLOW,
     runtimeRef: SELF_RELEASE_REF,
     declarationContract: "kungfu-buildchain-release-tail-capabilities/v1",
     declarationCompiler: