@kungfu-tech/buildchain 4.0.1-alpha.16 → 4.0.1-alpha.17

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.16",
+    "version": "4.0.1-alpha.17",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -2012,7 +2012,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:7b433d34f87651d8fb187d06b83113e93cbc0243a0f93ce33f375a4737f144f6"
+      "auditDigest": "sha256:2988f713a00099a83b76302bff589c355502c90854c53f608d004e64e9ee7302"
     },
     {
       "contractVersion": 1,
@@ -2061,7 +2061,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:7b433d34f87651d8fb187d06b83113e93cbc0243a0f93ce33f375a4737f144f6"
+      "auditDigest": "sha256:2988f713a00099a83b76302bff589c355502c90854c53f608d004e64e9ee7302"
     },
     {
       "contractVersion": 1,
@@ -2233,7 +2233,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:5d9041bc69c11daa40a5e682cf4ac66f85fc706537970d6c5c5773288e5fcb01"
+      "auditDigest": "sha256:faab536c4d343dcda528bef9fe3c1646dba922c64d8fd39a85fde543f3bab0de"
     },
     {
       "contractVersion": 1,
@@ -5308,5 +5308,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:5de1c69386510b74b17eb70141b8bdd07063d62c504f91db5e84b67c6d4b64a2",
-  "contractDigest": "sha256:ef3e4d5c123bbc7cf4fe62e6d84b08d54ce8b87de0c6b2f7af92ba8b4161ba09"
+  "contractDigest": "sha256:03b746ccd219a4507dd85d97fa0fd8f3739f33aa0f67db38b8c7fcb57688d073"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-08-22T21:16:23.467Z",
-  "publishedAt": "2026-08-22T21:16:23.467Z",
+  "generatedAt": "2026-08-22T22:46:52.216Z",
+  "publishedAt": "2026-08-22T22:46:52.216Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "3f16e16bfe8ccb6ca2bae7e095aedc6fc5a140d2",
+  "sourceRevision": "77ca1c875ca2c02ba55b09932e05d227445462d4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.16",
+    "version": "4.0.1-alpha.17",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "9b9215aa74419a85a52e7cad966b56297a6b5751f6258163e1d8ac3bbcb2b52e",
+    "sha256": "10450d725d7397da00e3563dd5cdaeb5c4973f24562ef318260f38407a6558ad",
     "summary": {
       "cliCommandCount": 117,
       "workflowCount": 76,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "9b9215aa74419a85a52e7cad966b56297a6b5751f6258163e1d8ac3bbcb2b52e",
+      "sha256": "10450d725d7397da00e3563dd5cdaeb5c4973f24562ef318260f38407a6558ad",
       "summary": {
         "cliCommandCount": 117,
         "workflowCount": 76,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.16",
+    "version": "4.0.1-alpha.17",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -29521,7 +29521,7 @@
       "specifier": "@kungfu-tech/buildchain/release-passport",
       "export": "./release-passport",
       "target": "./packages/core/release-passport.js",
-      "digest": "sha256:7b433d34f87651d8fb187d06b83113e93cbc0243a0f93ce33f375a4737f144f6",
+      "digest": "sha256:2988f713a00099a83b76302bff589c355502c90854c53f608d004e64e9ee7302",
       "summary": "Release passport collection, verification, explanation, and evidence APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/public-surface-audit.json

@@ -8846,7 +8846,7 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "ea47a31ce7ef3577f23e22055ab7be7715c3af494bcef63f76b426f2883086aa",
-    "workflowRegistryDigest": "d9c7193d3e6ad62b58a06931cccb3c4ee24285e75a705dd390cbf3ccd88645ad",
+    "workflowRegistryDigest": "03d89259ecfd441286fb87e1be364c139c163ae3921bf901237583d609b1d510",
     "pageRegistryDigest": "9d9d0590c8d3110fc5a95978852ee25337567f93980b2562cc1159f0d5219ade"
   },
   "comparison": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-22T21:16:23.467Z",
-  "publishedAt": "2026-08-22T21:16:23.467Z",
+  "generatedAt": "2026-08-22T22:46:52.216Z",
+  "publishedAt": "2026-08-22T22:46:52.216Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "3f16e16bfe8ccb6ca2bae7e095aedc6fc5a140d2",
+  "sourceRevision": "77ca1c875ca2c02ba55b09932e05d227445462d4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.16",
+    "version": "4.0.1-alpha.17",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-22T21:16:23.467Z",
-  "publishedAt": "2026-08-22T21:16:23.467Z",
+  "generatedAt": "2026-08-22T22:46:52.216Z",
+  "publishedAt": "2026-08-22T22:46:52.216Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "3f16e16bfe8ccb6ca2bae7e095aedc6fc5a140d2",
+  "sourceRevision": "77ca1c875ca2c02ba55b09932e05d227445462d4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.16",
+    "version": "4.0.1-alpha.17",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -2027,7 +2027,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.16",
+      "introducedVersion": "4.0.1-alpha.17",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2048,7 +2048,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.16",
+      "introducedVersion": "4.0.1-alpha.17",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2069,7 +2069,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.16",
+      "introducedVersion": "4.0.1-alpha.17",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2119,7 +2119,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.16",
+      "introducedVersion": "4.0.1-alpha.17",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.1-alpha.16",
+  "version": "4.0.1-alpha.17",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/release-passport.js

@@ -1120,7 +1120,7 @@ function normalizePromotionEvidence({
 }) {
   const routing = normalizePromotionRouting(release.promotionRouting);
   const identity = resolveV4ConsumerPolicyCertificationIdentity({
-    release,
+    release: { ...release, certification },
     routing,
     runtimeResume: v4RuntimeResumeEvidence,
     sourceSha,

package/packages/core/v4-floating-consumer-release-passport.js

@@ -76,7 +76,6 @@ function normalizeCertification(value, expected) {
   }
   return { certificationRoot: verification.certificationRoot, certification };
 }
-
 export function resolveV4ConsumerPolicyCertificationIdentity({
   release = {},
   routing = {},
@@ -85,9 +84,10 @@ export function resolveV4ConsumerPolicyCertificationIdentity({
 } = {}) {
   const builtSourceSha =
     release?.builtSourceSha || release?.built_source_sha || "";
+  const retainsCaller = release?.certification?.caller?.sourceSha === sourceSha;
   return {
     sourceSha:
-      release?.treeEquivalent === true && builtSourceSha
+      release?.treeEquivalent === true && builtSourceSha && !retainsCaller
         ? builtSourceSha
         : sourceSha,
     runtimeSha:
@@ -134,7 +134,7 @@ export function releasePassportCertificationVerificationOptions({
 }) {
   const authority = evidence?.certification?.authority || {};
   const identity = resolveV4ConsumerPolicyCertificationIdentity({
-    release: passport?.release,
+    release: { ...passport?.release, certification: evidence?.certification },
     routing,
     runtimeResume: passport?.v4RuntimeResume,
     sourceSha: passport?.release?.sourceSha || "",