@kungfu-tech/buildchain 3.0.9-alpha.16 → 3.0.9-alpha.17

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-13T19:32:43.000Z",
-  "publishedAt": "2026-08-13T19:32:43.000Z",
+  "generatedAt": "2026-08-14T01:22:22.000Z",
+  "publishedAt": "2026-08-14T01:22:22.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "45d01565d7039cb8c7bb71ddd4e9f8f43085aea3",
+  "sourceRevision": "17cb4259831b34ba382b0211500cbb1ef26efd11",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.16",
+    "version": "3.0.9-alpha.17",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -333,7 +333,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:889955042854bb95bc5dd58d2bdd26bdc8259c096e15c0a8d479289ff51448b8"
+      "digest": "sha256:66eca6c682edd21deeeaae769bcd6882f8fc70b6f9448abec9ed922d2a47ad97"
     },
     {
       "id": "release-flow",

package/dist/site/workflow-registry.json

@@ -1970,7 +1970,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.16",
+      "introducedVersion": "3.0.9-alpha.17",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1991,7 +1991,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.16",
+      "introducedVersion": "3.0.9-alpha.17",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2012,7 +2012,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.16",
+      "introducedVersion": "3.0.9-alpha.17",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2062,7 +2062,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.16",
+      "introducedVersion": "3.0.9-alpha.17",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/dev-delivery-warrant.md

@@ -294,9 +294,15 @@ The reusable `dev-pr-auto-merge.yml` supports three explicit rollout modes:
   reuses semantic native proof under heartbeat, atomically qualifies the same
   fence, and refuses GitHub enqueue unless the immutable queue commit, state root, active Warrant, and
   selected candidate all pass exact readback validation. Immediately before
-  enqueue, the controller also rereads the current protected state ref and
-  verifies the active candidate, fencing token, generation, pull request, and
-  exact head. A previously valid result is not authority after terminal
+  enqueue, the controller writes and then reads back both the exact-head queue
+  admission status and active lease status. Only after those statuses are
+  visible at their required states does it reread the pull request head,
+  protected base, native merge queue, and current protected Warrant state. The
+  final rooted admission transaction binds the frozen base, source head,
+  candidate, fencing token, generation, native proof roots, Project Cut proof,
+  and both status contexts. Status propagation is retried before enqueue;
+  base, head, queue-predecessor, lease, or Warrant drift revokes both statuses
+  without attempting enqueue. A previously valid result is not authority after terminal
   closeout. Re-running qualification for the same selected head may regenerate
   timestamped proof bytes, but it retains the immutable active Warrant and its
   originally selected proof instead of rewriting or rejecting that attempt.

package/docs/release-governance.md

@@ -113,6 +113,9 @@ The implementation is intentionally stricter than a local release script:
   `dev/vX/vX.Y` to `alpha/vX/vX.Y`;
 - release promotion must come from a merged same-repository PR from
   `alpha/vX/vX.Y` to `release/vX/vX.Y`;
+- an exact SHA that is itself the merge commit of a reviewed same-repository PR
+  into the protected target is equivalent lineage evidence; a commit merely
+  contained by an unrelated PR is not;
 - major promotion must come from a merged same-repository PR from
   `release/vX/vX.Y` to `publish-gate/major`;
 - release promotion requires an existing same-patch alpha tag and checks the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.9-alpha.16",
+  "version": "3.0.9-alpha.17",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -157,7 +157,7 @@
     "typescript": "^5.9.0"
   },
   "dependencies": {
-    "@kungfu-tech/kfd": "1.0.0-alpha.62",
+    "@kungfu-tech/kfd": "1.0.0-alpha.65",
     "ajv": "8.20.0",
     "smol-toml": "1.7.0"
   }

package/packages/core/adopter-delivery-vectors.json

@@ -3,7 +3,7 @@
   "contract": "kungfu-buildchain-adopter-delivery-vectors/v1",
   "rootAlgorithm": "sha256-buildchain-canonical-json-v1",
   "authorities": {
-    "kfdPackage": "@kungfu-tech/kfd@1.0.0-alpha.62",
+    "kfdPackage": "@kungfu-tech/kfd@1.0.0-alpha.65",
     "categoryProfileVectors": "@kungfu-tech/kfd/adopter-conformance/category-profile-vectors.json",
     "categoryInstanceVectors": "@kungfu-tech/kfd/adopter-conformance/category-instance-vectors.json"
   },
@@ -73,5 +73,5 @@
       }
     }
   ],
-  "suiteRoot": "sha256:cf329805d928a9883cbafbdfdf21ef66c6a0889ed8dfe14356b4e0d25d6738f9"
+  "suiteRoot": "sha256:c978707556406ffda4ef4192032332c01c2da1cebb6ad8c4f0edfc65d5cef0c7"
 }

package/scripts/dev-pr-auto-merge.mjs

@@ -4,7 +4,7 @@ import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { verifyProjectCutReplayProof } from "../packages/core/dev-delivery-warrant.js";
-import { admitExistingQueueEntry, createDevPrAdmissionReceipt, enqueueAfterStatusPropagation, readDeliveryWarrantResult, runSourceQualification, runTargetedQueueAdmission, verifyCurrentDeliveryWarrant } from "./dev-pr-delivery-warrant.mjs";
+import { admitExistingQueueEntry, createDevPrAdmissionReceipt, qualifyAtomicQueueAdmission, readDeliveryWarrantResult, runSourceQualification, runTargetedQueueAdmission, verifyCurrentDeliveryWarrant } from "./dev-pr-delivery-warrant.mjs";
 const DEFAULT_BLOCK_LABELS = ["blocked", "do-not-merge", "work-in-progress"];
 const DEFAULT_ALLOWED_HEAD_PREFIXES = ["feature/", "fix/", "chore/", "docs/", "ci/", "refactor/"];
 const DEFAULT_REQUIRED_CHECKS = ["check"];
@@ -88,6 +88,7 @@ function normalizeOptions(options = {}) {
     projectCutProofPath: String(options.projectCutProofPath || "").trim(),
     sourcePatchRoot: String(options.sourcePatchRoot || "").trim().toLowerCase(),
     qualificationOnly: boolOption(options.qualificationOnly, false),
+    verifiedDeliveryWarrant: options.verifiedDeliveryWarrant || null,
   };
 }
 
@@ -924,8 +925,9 @@ async function reconcileEnqueueError({ client, options, pr, expectedHeadSha, ent
   entry.queueAdmissionStatus = await setQueueAdmissionStatus(client, options.repository, expectedHeadSha, options.queueAdmissionContext, "failure");
   entry.activeLeaseStatus = await setActiveLeaseStatus(client, options.repository, expectedHeadSha, options.activeLeaseContext, "failure");
   entry.action = "skip";
-  entry.reason = "enqueue-rejected";
+  entry.reason = error.preEnqueue ? (error.code || "pre-enqueue-qualification-failed") : "enqueue-rejected";
   entry.enqueueError = {
+    phase: error.preEnqueue ? "pre-enqueue" : "enqueue",
     status: error.status || null,
     message: error.message || "GitHub rejected merge queue admission",
   };
@@ -1088,17 +1090,15 @@ export async function runDevPrAutoMerge(optionsInput = {}, clientInput) {
           result.skipped.push(entry);
         } else {
           try {
-            entry.activeLeaseStatus = await setActiveLeaseStatus(client, options.repository, expectedHeadSha, options.activeLeaseContext, "pending");
-            entry.queueAdmissionStatus = await setQueueAdmissionStatus(client, options.repository, expectedHeadSha, options.queueAdmissionContext, "success");
-            const queueEntry = await enqueueAfterStatusPropagation({
-              enqueue: (input) => client.enqueuePullRequest(input),
-              input: { pullRequestId: decision.pullRequestId, expectedHeadOid: expectedHeadSha },
-              attempts: options.pollMergeableAttempts,
-              delayMs: options.pollMergeableDelayMs,
-              sleep: delay,
+            const atomicAdmission = await qualifyAtomicQueueAdmission({
+              client, options, pullRequest: pr, expectedBaseSha: initialBaseSha, expectedHeadSha, projectCut: decision.projectCut, sleep: delay, mergeableAccepted, root: contentRoot,
+              setActiveLeaseStatus: (state) => setActiveLeaseStatus(client, options.repository, expectedHeadSha, options.activeLeaseContext, state),
+              setQueueAdmissionStatus: (state) => setQueueAdmissionStatus(client, options.repository, expectedHeadSha, options.queueAdmissionContext, state),
             });
+            Object.assign(entry, atomicAdmission.entryFields);
+            const queueEntry = atomicAdmission.exactEntry || await client.enqueuePullRequest({ pullRequestId: decision.pullRequestId, expectedHeadOid: expectedHeadSha });
             entry.action = "enqueued";
-            entry.reason = "enqueued-with-expected-head";
+            entry.reason = atomicAdmission.exactEntry ? "already-enqueued-exact-head" : "enqueued-with-expected-head";
             entry.queueEntry = queueEntry;
             entry.admissionReceipt.reason = entry.reason;
             result.actions.push(entry);

package/scripts/dev-pr-delivery-warrant.mjs

@@ -60,44 +60,20 @@ function exactWarrantBinding({ result, warrant, candidate, options, pullRequest
 
 export function createDevPrAdmissionReceipt({ options, pr = {}, state, reason, readiness, decision = {}, queue = null, warrant = null, labels = [], nextAction }) {
   const observedHeadSha = String(pr.head?.sha || "").toLowerCase();
+  const { readyLabel, blockLabels, allowedHeadPrefixes, requiredChecks, requireApproval, sameRepositoryOnly, landingMode, queueAdmissionContext, diagnosticContext } = options;
   return {
-    schema: ADMISSION_SCHEMA,
-    repository: options.repository.fullName,
-    targetBranch: options.targetBranch,
+    schema: ADMISSION_SCHEMA, repository: options.repository.fullName, targetBranch: options.targetBranch,
     pullRequestNumber: options.targetPullRequestNumber,
     pullRequestUrl: pr.html_url || `https://github.com/${options.repository.fullName}/pull/${options.targetPullRequestNumber}`,
-    expectedHeadSha: options.expectedHeadSha,
-    observedHeadSha,
-    observedBaseBranch: pr.base?.ref || "",
-    headRepository: pr.head?.repo?.full_name || "",
-    headRef: pr.head?.ref || "",
-    observedLabels: [...labels].sort(),
-    policy: {
-      readyLabel: options.readyLabel,
-      blockLabels: options.blockLabels,
-      allowedHeadPrefixes: options.allowedHeadPrefixes,
-      requiredChecks: options.requiredChecks,
-      requireApproval: options.requireApproval,
-      sameRepositoryOnly: options.sameRepositoryOnly,
-      landingMode: options.landingMode,
-      queueAdmissionContext: options.queueAdmissionContext,
-      diagnosticContext: options.diagnosticContext,
-    },
-    readiness: {
-      label: options.readyLabel,
-      observed: readiness?.observed === true,
-      established: readiness?.established === true,
-      mutationAuthorized: !options.dryRun,
-    },
+    expectedHeadSha: options.expectedHeadSha, observedHeadSha, observedBaseBranch: pr.base?.ref || "",
+    headRepository: pr.head?.repo?.full_name || "", headRef: pr.head?.ref || "", observedLabels: [...labels].sort(),
+    policy: { readyLabel, blockLabels, allowedHeadPrefixes, requiredChecks, requireApproval, sameRepositoryOnly, landingMode, queueAdmissionContext, diagnosticContext },
+    readiness: { label: readyLabel, observed: readiness?.observed === true, established: readiness?.established === true, mutationAuthorized: !options.dryRun },
     approval: decision.approval || { required: options.requireApproval, passed: false },
     checks: decision.checks || { required: options.requiredChecks, entries: [], passed: false },
-    projectCut: decision.projectCut || null,
-    queue,
-    deliveryWarrant: warrant,
+    projectCut: decision.projectCut || null, queue, deliveryWarrant: warrant,
     autoMergeEnabled: Boolean(pr.auto_merge || pr.autoMergeRequest),
-    state,
-    reason,
-    decision: state,
+    state, reason, decision: state,
     qualification: ["ready", "queued"].includes(state),
     nextAction: nextAction({ options, state, reason, observedHeadSha }),
   };
@@ -110,35 +86,23 @@ export function readDeliveryWarrantResult(options, pullRequest) {
   const { warrant, candidate } = exactActiveReadback(result);
   exactWarrantBinding({ result, warrant, candidate, options, pullRequest });
   return {
-    stateRef: result.stateRef || "",
-    stateCommit: result.after.commitSha,
-    stateRoot: result.after.stateRoot,
-    receiptRoot: result.receiptRoot,
-    candidateId: warrant.candidateId,
-    fencingToken: warrant.fencingToken,
-    generation: warrant.generation,
-    issuedAt: warrant.issuedAt,
-    expiresAt: warrant.expiresAt,
+    stateRef: result.stateRef || "", stateCommit: result.after.commitSha, stateRoot: result.after.stateRoot, receiptRoot: result.receiptRoot,
+    candidateId: warrant.candidateId, fencingToken: warrant.fencingToken, generation: warrant.generation,
+    issuedAt: warrant.issuedAt, expiresAt: warrant.expiresAt,
+    repository: warrant.repository, protectedBase: warrant.protectedBase, pullRequestNumber: warrant.pullRequestNumber, sourceHead: warrant.sourceHead,
+    nativeProofRoot: warrant.nativeProofRoot || "", nativeProofReuseRoot: warrant.nativeProofReuseRoot || "",
   };
 }
 
 export async function readCurrentDeliveryQueueState(client, repository, targetBranch) {
   if (typeof client.getDevDeliveryQueueState === "function") return client.getDevDeliveryQueueState(targetBranch);
-  const store = new GitHubDevDeliveryStore({
-    repository: `${repository.owner}/${repository.repo}`,
-    token: client.token,
-    apiUrl: client.apiUrl,
-    fetchImpl: client.fetch,
-  });
-  const { queue } = await store.read({
-    stateRef: defaultDevDeliveryStateRef(targetBranch),
-    protectedBase: targetBranch,
-  });
+  const store = new GitHubDevDeliveryStore({ repository: `${repository.owner}/${repository.repo}`, token: client.token, apiUrl: client.apiUrl, fetchImpl: client.fetch });
+  const { queue } = await store.read({ stateRef: defaultDevDeliveryStateRef(targetBranch), protectedBase: targetBranch });
   return queue;
 }
 
 export async function verifyCurrentDeliveryWarrant(client, options, pullRequest, warrant) {
-  if (!warrant) return;
+  if (!warrant) return null;
   let queue;
   try {
     queue = await readCurrentDeliveryQueueState(client, options.repository, options.targetBranch);
@@ -152,23 +116,79 @@ export async function verifyCurrentDeliveryWarrant(client, options, pullRequest,
   requireMatch(Number(active?.generation) === Number(warrant.generation), "delivery-warrant-current-generation-mismatch");
   requireMatch(Number(active?.pullRequestNumber) === Number(pullRequest.number), "delivery-warrant-current-pr-mismatch");
   requireMatch(String(active?.sourceHead || "").toLowerCase() === options.expectedHeadSha, "delivery-warrant-current-head-mismatch");
+  requireMatch(Number.isFinite(Date.parse(active?.expiresAt)) && Date.parse(active.expiresAt) > Date.now(), "delivery-warrant-current-expired");
   requireMatch(["selected", "proving", "waiting", "blocked", "qualified"].includes(candidate?.status), "delivery-warrant-current-candidate-not-selected");
   requireMatch(candidate?.sourceHead === active.sourceHead, "delivery-warrant-current-candidate-head-mismatch");
+  return { activeWarrant: active, activeCandidate: candidate };
+}
+
+function latestStatusForContext(statuses, context) { return (statuses || []).find((status) => String(status.context || "") === context) || null; }
+
+function preEnqueueMismatch(code, details = {}) {
+  const error = new Error(code);
+  error.code = code;
+  Object.assign(error, details);
+  throw error;
 }
 
-export async function enqueueAfterStatusPropagation({ enqueue, input, attempts, delayMs, sleep }) {
-  let lastError;
+async function readBackAdmissionStatuses(client, options, expectedHeadSha, sleep) {
+  let last = { queueAdmission: null, activeLease: null };
+  const attempts = Math.max(1, options.pollMergeableAttempts);
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    try {
-      return await enqueue(input);
-    } catch (error) {
-      lastError = error;
-      const propagation = /required status(?:es| check).*failing|failing required status|cannot change this locked branch/i.test(String(error?.message || ""));
-      if (!propagation || attempt === attempts) throw error;
-      await sleep(delayMs);
+    const checks = await client.listCommitChecks(expectedHeadSha);
+    last = { queueAdmission: latestStatusForContext(checks?.statuses, options.queueAdmissionContext), activeLease: latestStatusForContext(checks?.statuses, options.activeLeaseContext) };
+    if ((!options.queueAdmissionContext || last.queueAdmission?.state === "success") && (!options.activeLeaseContext || last.activeLease?.state === "pending")) return { ...last, attempts: attempt };
+    if (attempt < attempts) await sleep(options.pollMergeableDelayMs);
+  }
+  preEnqueueMismatch("queue-admission-lease-readback-mismatch", { readback: last });
+}
+
+export async function qualifyAtomicQueueAdmission({ client, options, pullRequest, expectedBaseSha, expectedHeadSha, projectCut, setActiveLeaseStatus, setQueueAdmissionStatus, sleep, mergeableAccepted, root }) {
+  try {
+    if (options.warrantMode === "required") {
+      if (!options.verifiedDeliveryWarrant) preEnqueueMismatch("delivery-warrant-pre-enqueue-readback-missing");
+      if (!options.queueAdmissionContext) preEnqueueMismatch("queue-admission-context-required");
+      if (!options.activeLeaseContext) preEnqueueMismatch("active-lease-context-required");
     }
+    const activeLeaseStatus = await setActiveLeaseStatus("pending");
+    const queueAdmissionStatus = await setQueueAdmissionStatus("success");
+    const statusReadback = await readBackAdmissionStatuses(client, options, expectedHeadSha, sleep);
+    const finalReadback = await Promise.all([
+      client.getPullRequest(pullRequest.number, { attempts: options.pollMergeableAttempts, delayMs: options.pollMergeableDelayMs }), client.getBranchSha(options.targetBranch),
+      client.getMergeQueueState(options.targetBranch), verifyCurrentDeliveryWarrant(client, options, pullRequest, options.verifiedDeliveryWarrant),
+    ]);
+    const [observedPullRequest, observedBaseSha, observedQueueState, currentWarrant] = finalReadback;
+    const observedHeadSha = String(observedPullRequest.head?.sha || "").toLowerCase();
+    if (observedBaseSha !== expectedBaseSha) preEnqueueMismatch("base-sha-drift-after-lease-readback", { observedBaseSha });
+    if (observedHeadSha !== expectedHeadSha) preEnqueueMismatch("head-sha-drift-after-lease-readback", { observedHeadSha });
+    if (!mergeableAccepted(observedPullRequest, "queue", projectCut?.ok === true)) preEnqueueMismatch("not-mergeable-after-lease-readback");
+    const exactEntry = observedQueueState.entries.find((candidate) =>
+      candidate.pullRequestNumber === pullRequest.number && candidate.pullRequestHeadSha === expectedHeadSha);
+    const predecessor = observedQueueState.entries.find((candidate) => candidate !== exactEntry) || null;
+    if (predecessor) preEnqueueMismatch("queue-predecessor-after-lease-readback", { predecessor });
+    const transaction = {
+      schema: "kungfu.buildchain.dev-queue-admission-transaction/v1", repository: options.repository.fullName,
+      protectedBase: options.targetBranch, pullRequestNumber: pullRequest.number,
+      sourceHead: expectedHeadSha, frozenBase: expectedBaseSha,
+      queueAdmission: { context: options.queueAdmissionContext, state: statusReadback.queueAdmission?.state || "" },
+      activeLease: { context: options.activeLeaseContext, state: statusReadback.activeLease?.state || "" },
+      warrant: options.verifiedDeliveryWarrant,
+      currentWarrant: currentWarrant ? {
+        candidateId: currentWarrant.activeWarrant.candidateId, fencingToken: currentWarrant.activeWarrant.fencingToken,
+        generation: currentWarrant.activeWarrant.generation, sourceHead: currentWarrant.activeWarrant.sourceHead, expiresAt: currentWarrant.activeWarrant.expiresAt,
+      } : null,
+      projectCutProofRoot: projectCut?.proofRoot || "", decision: exactEntry ? "already-enqueued" : "qualified",
+    };
+    const entryFields = { activeLeaseStatus, queueAdmissionStatus, atomicAdmissionReceipt: transaction, atomicAdmissionReceiptRoot: root(transaction), atomicAdmissionReadbackAttempts: statusReadback.attempts };
+    return { exactEntry, entryFields };
+  } catch (error) {
+    error.preEnqueue = true;
+    throw error;
   }
-  throw lastError;
+}
+
+function admissionResult(options, receipt, root, ok, outcome, controller = null) {
+  return { schema: "kungfu.buildchain.dev-pr-admission-result/v1", ok, mode: options.dryRun ? "plan" : "execute", outcome, receipt, receiptRoot: root(receipt), diagnostic: null, ...(controller ? { controller } : {}) };
 }
 
 export async function runSourceQualification({ options, pullRequest, readiness, client, evaluate, admissionState, createReceipt, root, publishDiagnostic, reject }) {
@@ -187,15 +207,7 @@ export async function runSourceQualification({ options, pullRequest, readiness,
     queue: null,
     warrant: null,
   });
-  const result = {
-    schema: "kungfu.buildchain.dev-pr-admission-result/v1",
-    ok: state === "ready",
-    mode: options.dryRun ? "plan" : "execute",
-    outcome: state === "ready" ? "source-qualified" : "targeted-admission-failed",
-    receipt,
-    receiptRoot: root(receipt),
-    diagnostic: null,
-  };
+  const result = admissionResult(options, receipt, root, state === "ready", state === "ready" ? "source-qualified" : "targeted-admission-failed");
   if (!options.dryRun) result.diagnostic = await publishDiagnostic(client, options, receipt, result.receiptRoot);
   return result;
 }
@@ -211,15 +223,7 @@ export async function admitExistingQueueEntry({ options, pullRequest, readiness,
     queue: { enabled: true, entry },
     warrant,
   });
-  const result = {
-    schema: "kungfu.buildchain.dev-pr-admission-result/v1",
-    ok: true,
-    mode: options.dryRun ? "plan" : "execute",
-    outcome: "admitted",
-    receipt,
-    receiptRoot: root(receipt),
-    diagnostic: null,
-  };
+  const result = admissionResult(options, receipt, root, true, "admitted");
   if (!options.dryRun) result.diagnostic = await publishDiagnostic(client, options, receipt, result.receiptRoot);
   return result;
 }
@@ -227,7 +231,7 @@ export async function admitExistingQueueEntry({ options, pullRequest, readiness,
 export async function runTargetedQueueAdmission({ options, pullRequest, readiness, client, warrant, runController, admissionState, createReceipt, root, publishDiagnostic }) {
   const targetedClient = Object.create(client);
   targetedClient.listPullRequests = async () => [pullRequest];
-  const controller = await runController({ ...options, targetPullRequestNumber: 0 }, targetedClient);
+  const controller = await runController({ ...options, targetPullRequestNumber: 0, verifiedDeliveryWarrant: warrant }, targetedClient);
   controller.runKind = "targeted-admission-evaluation";
   controller.outcome = controller.actions.length === 0 ? "target-not-admitted" : "target-action-selected";
   controller.qualification = false;
@@ -245,20 +249,13 @@ export async function runTargetedQueueAdmission({ options, pullRequest, readines
       enabled: controller.mergeQueue?.enabled === true,
       predecessor: entry.admissionReceipt?.predecessor || null,
       entry: entry.queueEntry || null,
+      admissionTransaction: entry.atomicAdmissionReceipt || null,
+      admissionTransactionRoot: entry.atomicAdmissionReceiptRoot || "",
     },
     warrant,
   });
   const admitted = ["ready", "queued"].includes(state);
-  const result = {
-    schema: "kungfu.buildchain.dev-pr-admission-result/v1",
-    ok: admitted,
-    mode: options.dryRun ? "plan" : "execute",
-    outcome: admitted ? "admitted" : "targeted-admission-failed",
-    receipt,
-    receiptRoot: root(receipt),
-    diagnostic: null,
-    controller,
-  };
+  const result = admissionResult(options, receipt, root, admitted, admitted ? "admitted" : "targeted-admission-failed", controller);
   if (!options.dryRun) result.diagnostic = await publishDiagnostic(client, options, receipt, result.receiptRoot);
   return result;
 }