@kungfu-tech/buildchain 4.0.1-alpha.23 → 4.0.1-alpha.25

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.23",
+    "version": "4.0.1-alpha.25",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -1361,7 +1361,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa",
-      "auditDigest": "sha256:6cf134f8bc0c0ab488cb159ef2bb9f7a94b454c4f7adee134ce7dee00d84c5d3",
+      "auditDigest": "sha256:a47ff1abbe625befbf2f7558b8fb0bed6ab1e474156df81ce9f4b3746a8986f0",
       "compatibleBreakingDigests": [
         "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650"
       ],
@@ -2908,7 +2908,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
-      "auditDigest": "sha256:6cf134f8bc0c0ab488cb159ef2bb9f7a94b454c4f7adee134ce7dee00d84c5d3",
+      "auditDigest": "sha256:a47ff1abbe625befbf2f7558b8fb0bed6ab1e474156df81ce9f4b3746a8986f0",
       "compatibleBreakingDigests": [
         "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
         "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be"
@@ -5308,5 +5308,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:5de1c69386510b74b17eb70141b8bdd07063d62c504f91db5e84b67c6d4b64a2",
-  "contractDigest": "sha256:b308f25a9545ae57b7a9cb29ba9ceef81fbafe692b8bfa322e1226d6d9887017"
+  "contractDigest": "sha256:6814ef89c310377a349fd8d1c99aca48430cd7e8d516cf2228dffaf2f0f414be"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-08-23T06:22:24.669Z",
-  "publishedAt": "2026-08-23T06:22:24.669Z",
+  "generatedAt": "2026-08-23T09:59:28.512Z",
+  "publishedAt": "2026-08-23T09:59:28.512Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "9f6a768d481790664778d10fc66af0b07485aa77",
+  "sourceRevision": "4eabb9490c224931c539873a7a1cfa871c19b0a4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.23",
+    "version": "4.0.1-alpha.25",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "99c6a100ff204f0f01b9debb82b758e8113867b7ad0f345bf9228c2b962aa816",
+    "sha256": "a6c4772940868cd1c9cd60c47ec95025cd6de52c82ea0c348336742e7bb1c67b",
     "summary": {
       "cliCommandCount": 117,
       "workflowCount": 76,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "99c6a100ff204f0f01b9debb82b758e8113867b7ad0f345bf9228c2b962aa816",
+      "sha256": "a6c4772940868cd1c9cd60c47ec95025cd6de52c82ea0c348336742e7bb1c67b",
       "summary": {
         "cliCommandCount": 117,
         "workflowCount": 76,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.23",
+    "version": "4.0.1-alpha.25",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/public-surface-audit.json

@@ -8846,7 +8846,7 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "ea47a31ce7ef3577f23e22055ab7be7715c3af494bcef63f76b426f2883086aa",
-    "workflowRegistryDigest": "f963f11c7c340953fd08174d86e7409f22e7eb18a52898c34828b4dc95846704",
+    "workflowRegistryDigest": "df99098875d2ff1758cf351440a4736f398e0cc4bed6c11ba36c6abba9dde707",
     "pageRegistryDigest": "9d9d0590c8d3110fc5a95978852ee25337567f93980b2562cc1159f0d5219ade"
   },
   "comparison": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-23T06:22:24.669Z",
-  "publishedAt": "2026-08-23T06:22:24.669Z",
+  "generatedAt": "2026-08-23T09:59:28.512Z",
+  "publishedAt": "2026-08-23T09:59:28.512Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "9f6a768d481790664778d10fc66af0b07485aa77",
+  "sourceRevision": "4eabb9490c224931c539873a7a1cfa871c19b0a4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.23",
+    "version": "4.0.1-alpha.25",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-23T06:22:24.669Z",
-  "publishedAt": "2026-08-23T06:22:24.669Z",
+  "generatedAt": "2026-08-23T09:59:28.512Z",
+  "publishedAt": "2026-08-23T09:59:28.512Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "9f6a768d481790664778d10fc66af0b07485aa77",
+  "sourceRevision": "4eabb9490c224931c539873a7a1cfa871c19b0a4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.23",
+    "version": "4.0.1-alpha.25",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -2027,7 +2027,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.23",
+      "introducedVersion": "4.0.1-alpha.25",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2048,7 +2048,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.23",
+      "introducedVersion": "4.0.1-alpha.25",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2069,7 +2069,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.23",
+      "introducedVersion": "4.0.1-alpha.25",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2119,7 +2119,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.23",
+      "introducedVersion": "4.0.1-alpha.25",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.1-alpha.23",
+  "version": "4.0.1-alpha.25",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/v4-floating-consumer-release-passport.js

@@ -4,7 +4,6 @@ import {
   v4FloatingConsumerDocumentRoot,
   verifyV4FloatingConsumerPolicyCertification,
 } from "./v4-floating-consumer-evidence.js";
-
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
 export function isV4PromotionRouting(value = undefined) {
   return [
@@ -13,7 +12,6 @@ export function isV4PromotionRouting(value = undefined) {
     value?.runtime?.requestedRef,
   ].some((ref) => /^v4(?:-alpha)?$/u.test(String(ref || "")));
 }
-
 function resolveInside(root, relative, label) {
   const resolvedRoot = path.resolve(root);
   const file = path.resolve(resolvedRoot, relative);
@@ -22,7 +20,6 @@ function resolveInside(root, relative, label) {
   }
   return file;
 }
-
 function resolveCallerLock(root, relative, label) {
   const file = resolveInside(root, relative, `${label} contract lock`);
   if (!fs.existsSync(file)) {
@@ -81,20 +78,22 @@ export function resolveV4ConsumerPolicyCertificationIdentity({
   runtimeResume = undefined,
   sourceSha = "",
 } = {}) {
-  const builtSourceSha =
-    release?.builtSourceSha || release?.built_source_sha || "";
-  const certification =
-    release?.certification?.certification || release?.certification;
-  const retainsCaller = certification?.caller?.sourceSha === sourceSha;
+  const certifiedSourceSha =
+    (release?.certification?.certification || release?.certification)?.caller
+      ?.sourceSha || "";
+  const treeEquivalentSources = [
+    release?.builtSourceSha || release?.built_source_sha,
+    release?.promotionChannelSha || release?.promotion_channel_sha,
+  ];
+  const buildRuntimeSha = runtimeResume?.lineage?.attempts?.build?.runtimeSha;
   return {
     sourceSha:
-      release?.treeEquivalent === true && builtSourceSha && !retainsCaller
-        ? builtSourceSha
+      certifiedSourceSha === sourceSha ||
+      (release?.treeEquivalent === true &&
+        treeEquivalentSources.includes(certifiedSourceSha))
+        ? certifiedSourceSha
         : sourceSha,
-    runtimeSha:
-      runtimeResume?.lineage?.attempts?.build?.runtimeSha ||
-      routing?.runtime?.resolvedSha ||
-      "",
+    runtimeSha: buildRuntimeSha || routing?.runtime?.resolvedSha || "",
   };
 }
 export function requireV4ConsumerPolicyCertification({

package/scripts/artifact-signing-controller-core.mjs

@@ -374,6 +374,7 @@ export function assertArtifactSigningControlRequestContext(
 export function artifactSigningControlRequestOutputs(request) {
   const value = validateArtifactSigningControlRequest(request);
   return {
+    "source-run-attempt": String(value.source.runAttempt),
     "request-count": String(value.request.count),
     "request-artifact": value.request.artifact,
     "request-root": value.request.root,
@@ -384,7 +385,6 @@ export function artifactSigningControlRequestOutputs(request) {
     "runtime-sha": value.runtime.sha,
   };
 }
-
 export function normalizeControllerStatus(value) {
   const normalized = required(value, "authority status");
   if (