@kungfu-tech/buildchain 4.0.1-alpha.20 → 4.0.1-alpha.22

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.20",
+    "version": "4.0.1-alpha.22",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -5308,5 +5308,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:5de1c69386510b74b17eb70141b8bdd07063d62c504f91db5e84b67c6d4b64a2",
-  "contractDigest": "sha256:60d147cd9822082d40118af74840510b4f26dec29a8316855a06a12a6ce855d4"
+  "contractDigest": "sha256:e65aac67dd6571c61badfbbe5beb47b504c6973d696047c95f12955149911bc5"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-08-23T03:02:01.541Z",
-  "publishedAt": "2026-08-23T03:02:01.541Z",
+  "generatedAt": "2026-08-23T05:29:03.118Z",
+  "publishedAt": "2026-08-23T05:29:03.118Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "498d822822d352cce5c71ef21f3f12ae67c0cb68",
+  "sourceRevision": "403ed0fb1805899292067e6eea6cee48468594e1",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.20",
+    "version": "4.0.1-alpha.22",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "1250f1c595c4dddc1c8fbd5b3b3070673267ddc86628cd9ace1c119e2ce45114",
+    "sha256": "0ed832b670bbff7588d73520698f981cd8d98f58378b53d68def2bcc7d9bfb44",
     "summary": {
       "cliCommandCount": 117,
       "workflowCount": 76,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "1250f1c595c4dddc1c8fbd5b3b3070673267ddc86628cd9ace1c119e2ce45114",
+      "sha256": "0ed832b670bbff7588d73520698f981cd8d98f58378b53d68def2bcc7d9bfb44",
       "summary": {
         "cliCommandCount": 117,
         "workflowCount": 76,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.20",
+    "version": "4.0.1-alpha.22",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/public-surface-audit.json

@@ -8846,7 +8846,7 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "ea47a31ce7ef3577f23e22055ab7be7715c3af494bcef63f76b426f2883086aa",
-    "workflowRegistryDigest": "7be3308092b1e0666e0fce6a7fd246e952d3b03c1ebe74c895a83e6d7829fa16",
+    "workflowRegistryDigest": "64e90e170742621cb64818554a05430919127d4484aa909aef6b767b5c9376d3",
     "pageRegistryDigest": "9d9d0590c8d3110fc5a95978852ee25337567f93980b2562cc1159f0d5219ade"
   },
   "comparison": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-23T03:02:01.541Z",
-  "publishedAt": "2026-08-23T03:02:01.541Z",
+  "generatedAt": "2026-08-23T05:29:03.118Z",
+  "publishedAt": "2026-08-23T05:29:03.118Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "498d822822d352cce5c71ef21f3f12ae67c0cb68",
+  "sourceRevision": "403ed0fb1805899292067e6eea6cee48468594e1",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.20",
+    "version": "4.0.1-alpha.22",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-23T03:02:01.541Z",
-  "publishedAt": "2026-08-23T03:02:01.541Z",
+  "generatedAt": "2026-08-23T05:29:03.118Z",
+  "publishedAt": "2026-08-23T05:29:03.118Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "498d822822d352cce5c71ef21f3f12ae67c0cb68",
+  "sourceRevision": "403ed0fb1805899292067e6eea6cee48468594e1",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.20",
+    "version": "4.0.1-alpha.22",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -2027,7 +2027,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.20",
+      "introducedVersion": "4.0.1-alpha.22",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2048,7 +2048,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.20",
+      "introducedVersion": "4.0.1-alpha.22",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2069,7 +2069,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.20",
+      "introducedVersion": "4.0.1-alpha.22",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2119,7 +2119,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.20",
+      "introducedVersion": "4.0.1-alpha.22",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.1-alpha.20",
+  "version": "4.0.1-alpha.22",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/resume-from-candidate-run.mjs

@@ -7,6 +7,7 @@ import { execFileSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
+import { compareSemver } from "./publication-registry-hydrate.mjs";
 import { normalizeAnchorProvenance, normalizeCandidateRun, recoverCandidateProvenance } from "./release-candidate-anchor-provenance.mjs";
 export { resolveAnchorRecoveryRequest } from "./release-candidate-anchor-provenance.mjs";
 import {
@@ -203,23 +204,36 @@ export function verifyReleaseCandidateStageCapsules({ sidecar, passport, downloa
 export function validateV4RuntimeResumePublicReadback({
   targetRef,
   targetSha,
+  targetVersion,
   alphaSha,
   exactTagSha,
   tagLineage,
+  runtimeLineage,
+  floatingTargetLineage,
   runtimeSha,
   version,
   transaction,
   main,
   npm,
 }) {
+  const channelVersion = npm["dist-tags"]?.alpha;
+  let channelDidNotRegress = false;
+  try {
+    channelDidNotRegress = compareSemver(channelVersion, version) >= 0;
+  } catch { channelDidNotRegress = false; }
   if (
     transaction?.target_ref !== targetRef ||
     transaction?.version !== version ||
     exactTagSha !== transaction?.source_sha ||
     !["ahead", "identical"].includes(tagLineage?.status) ||
-    alphaSha !== runtimeSha ||
+    !["ahead", "identical"].includes(runtimeLineage?.status) ||
+    !["ahead", "identical"].includes(floatingTargetLineage?.status) ||
+    !alphaSha ||
     !targetSha ||
-    npm["dist-tags"]?.alpha !== version ||
+    !runtimeSha ||
+    channelVersion !== targetVersion ||
+    !channelDidNotRegress ||
+    !npm.versions?.[channelVersion]?.dist?.integrity ||
     npm.versions?.[version]?.dist?.integrity !== main.digest
   ) {
     throw new Error(
@@ -238,21 +252,12 @@ export async function readPublicResumeState({
   apiUrl,
   fetchImpl,
 }) {
-  const readRef = async (ref) =>
-    (await githubJson({
-      apiUrl,
-      token,
-      fetchImpl,
-      path: `/repos/${repoInfo.owner}/${repoInfo.repo}/git/ref/${ref}`,
-    })).object?.sha || "";
+  const readRef = async (ref) => (await githubJson({ apiUrl, token, fetchImpl,
+    path: `/repos/${repoInfo.owner}/${repoInfo.repo}/git/ref/${ref}` })).object?.sha || "";
   const main = transaction?.artifacts?.find((entry) => entry.kind === "npm" && entry.required !== false);
-  if (!main || main.ref !== version || !main.digest) {
-    throw new Error(
-      "cross-runtime recovery requires exact durable npm publication evidence",
-    );
-  }
-  const packageUrl =
-    `https://registry.npmjs.org/${encodeURIComponent(main.name)}`;
+  if (!main || main.ref !== version || !main.digest)
+    throw new Error("cross-runtime recovery requires exact durable npm publication evidence");
+  const packageUrl = `https://registry.npmjs.org/${encodeURIComponent(main.name)}`;
   const exactTag = transaction.exact_tag || `v${version}`;
   const [targetSha, alphaSha, exactTagSha, npmResponse] = await Promise.all([
     readRef(`heads/${targetRef}`),
@@ -264,24 +269,18 @@ export async function readPublicResumeState({
     throw new Error(`npm public readback failed with HTTP ${npmResponse.status}`);
   }
   const npm = await npmResponse.json();
-  const tagLineage = await githubJson({
-    apiUrl,
-    token,
-    fetchImpl,
-    path: `/repos/${repoInfo.owner}/${repoInfo.repo}/compare/${exactTagSha}...${targetSha}`,
-  });
-  validateV4RuntimeResumePublicReadback({
-    targetRef,
-    targetSha,
-    alphaSha,
-    exactTagSha,
-    tagLineage,
-    runtimeSha,
-    version,
-    transaction,
-    main,
-    npm,
-  });
+  const [tagLineage, runtimeLineage, floatingTargetLineage, targetPackageFile] = await Promise.all([
+    githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/compare/${exactTagSha}...${targetSha}` }),
+    githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/compare/${runtimeSha}...${alphaSha}` }),
+    githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/compare/${alphaSha}...${targetSha}` }),
+    githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/contents/package.json?ref=${encodeURIComponent(targetSha)}` }),
+  ]);
+  if (targetPackageFile?.type !== "file" || targetPackageFile.encoding !== "base64" || !targetPackageFile.content)
+    throw new Error("cross-runtime recovery requires protected target version state");
+  const targetVersion = JSON.parse(Buffer.from(String(targetPackageFile.content).replace(/\s/g, ""), "base64").toString("utf8")).version;
+  validateV4RuntimeResumePublicReadback({ targetRef, targetSha, targetVersion, alphaSha,
+    exactTagSha, tagLineage, runtimeLineage, floatingTargetLineage, runtimeSha,
+    version, transaction, main, npm });
   const body = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-v4-runtime-resume-public-readback/v1",
@@ -298,6 +297,8 @@ export async function readPublicResumeState({
       version,
       distTag: "alpha",
       integrity: npm.versions[version].dist.integrity,
+      targetVersion, distTagVersion: npm["dist-tags"].alpha,
+      distTagIntegrity: npm.versions[npm["dist-tags"].alpha].dist.integrity,
     },
   };
   return { ...body, root: v4RuntimeResumeDocumentRoot(body) };
@@ -456,7 +457,7 @@ export async function finalizeRuntimeResumeEvidence({
     resumePlanRoot: material.resumePlanRoot,
     finalPublicReadbackRoot: readback.root,
     floatingRefBefore: material.floatingRefBefore,
-    floatingRefAfter: { ref: "v4-alpha", sha: material.runtimeSha },
+    floatingRefAfter: { ref: "v4-alpha", sha: readback.refs.floating.sha },
   });
   const evidence = {
     authorization: material.authorization,