@kungfu-tech/buildchain 4.0.1-alpha.34 → 4.0.1-alpha.36

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.34",
+    "version": "4.0.1-alpha.36",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -1646,7 +1646,7 @@
         "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph"
       ],
       "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
-      "auditDigest": "sha256:9113ee5ba1b58ce2dbe51ae284a2915cb04a1cad27a9560142421df37a0eb4fb",
+      "auditDigest": "sha256:6d18173f1048d68196da4729a078f77b85781ecbae0e34aadc1f862a5d83897a",
       "compatibleBreakingDigests": [
         "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
       ],
@@ -5082,7 +5082,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:9113ee5ba1b58ce2dbe51ae284a2915cb04a1cad27a9560142421df37a0eb4fb"
+      "auditDigest": "sha256:6d18173f1048d68196da4729a078f77b85781ecbae0e34aadc1f862a5d83897a"
     },
     {
       "contractVersion": 1,
@@ -5308,5 +5308,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:5de1c69386510b74b17eb70141b8bdd07063d62c504f91db5e84b67c6d4b64a2",
-  "contractDigest": "sha256:1cd711c4379d653bd154dc8fd781282fb3497aa68480b35054e9eff336f4a58d"
+  "contractDigest": "sha256:08da7cb857e3c977a4dd0a918af9659de8628a9404c6a5a907593d8f89d294ae"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-08-23T23:30:13.157Z",
-  "publishedAt": "2026-08-23T23:30:13.157Z",
+  "generatedAt": "2026-08-24T04:04:36.516Z",
+  "publishedAt": "2026-08-24T04:04:36.516Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "411fd491bb0b21c8fc28a6e2f505b3e4e4a133d0",
+  "sourceRevision": "975c93b1e33d04d6c27e2879651f8dcfd9b5fe42",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.34",
+    "version": "4.0.1-alpha.36",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "d52aad240b46495a2a930ba48847adc17159d1d0ca2751759f62570e0f332865",
+    "sha256": "94f0e944155b53b68186da6ff5edaad13f23514e0207e2a9516a8c402f7f44a9",
     "summary": {
       "cliCommandCount": 117,
       "workflowCount": 76,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "d52aad240b46495a2a930ba48847adc17159d1d0ca2751759f62570e0f332865",
+      "sha256": "94f0e944155b53b68186da6ff5edaad13f23514e0207e2a9516a8c402f7f44a9",
       "summary": {
         "cliCommandCount": 117,
         "workflowCount": 76,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.34",
+    "version": "4.0.1-alpha.36",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/public-surface-audit.json

@@ -8846,7 +8846,7 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "ea47a31ce7ef3577f23e22055ab7be7715c3af494bcef63f76b426f2883086aa",
-    "workflowRegistryDigest": "ba26bf58130e1b70b3a4f38f5d87313797c77d700d407f949fc62faf45287104",
+    "workflowRegistryDigest": "1b21627d15c546740ad5fbf98df3c0ea989009193f86b55a15cf139f45934439",
     "pageRegistryDigest": "619910e5c57fb8e94ea1525de1fb7699c412a8dafd7269bc9354cc6c4fe83f48"
   },
   "comparison": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-23T23:30:13.157Z",
-  "publishedAt": "2026-08-23T23:30:13.157Z",
+  "generatedAt": "2026-08-24T04:04:36.516Z",
+  "publishedAt": "2026-08-24T04:04:36.516Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "411fd491bb0b21c8fc28a6e2f505b3e4e4a133d0",
+  "sourceRevision": "975c93b1e33d04d6c27e2879651f8dcfd9b5fe42",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.34",
+    "version": "4.0.1-alpha.36",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-23T23:30:13.157Z",
-  "publishedAt": "2026-08-23T23:30:13.157Z",
+  "generatedAt": "2026-08-24T04:04:36.516Z",
+  "publishedAt": "2026-08-24T04:04:36.516Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "411fd491bb0b21c8fc28a6e2f505b3e4e4a133d0",
+  "sourceRevision": "975c93b1e33d04d6c27e2879651f8dcfd9b5fe42",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.34",
+    "version": "4.0.1-alpha.36",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -2027,7 +2027,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.34",
+      "introducedVersion": "4.0.1-alpha.36",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2048,7 +2048,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.34",
+      "introducedVersion": "4.0.1-alpha.36",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2069,7 +2069,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.34",
+      "introducedVersion": "4.0.1-alpha.36",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2119,7 +2119,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.34",
+      "introducedVersion": "4.0.1-alpha.36",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.1-alpha.34",
+  "version": "4.0.1-alpha.36",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/resume-from-candidate-run.mjs

@@ -700,13 +700,21 @@ export function resolveRecoveredPublicationVersion({ artifactVersion, channel, r
   if (!match) throw new Error(`recovered npm artifact has invalid publication version: ${version || "<empty>"}`);
   return channel === "release" && rematerializeOnResume ? match[1] : version;
 }
-export function createRecoveredPublication({ downloads, bundleRoot, repository, passport, candidateRuntimeSha, publishArtifactKind, publishPackageMain, releasePatterns, platformManifests, channel, rematerializeOnResume = false }) {
-  const allFiles = downloads.flatMap((download) => download.files.map((file) => ({
-    path: path.relative(bundleRoot, file.absolutePath).split(path.sep).join("/"),
-    size: file.size,
-    sha256: file.sha256.replace(/^sha256:/, ""),
-    absolutePath: file.absolutePath,
-  }))).sort((left, right) => left.path.localeCompare(right.path));
+export function resolveRecoveredCandidateVersion({ artifactVersion, publicationVersion, channel, rematerializeOnResume = false, targetRef = "", candidateRef = "" } = {}) {
+  const version = String(artifactVersion || "").trim(), target = String(targetRef || "").replace(/^refs\/heads\//u, ""), candidate = String(candidateRef || "").replace(/^refs\/heads\//u, "");
+  if (channel !== "release" || !rematerializeOnResume) return version;
+  const prefix = `publish-gate/${target}/`;
+  if (!target || !candidate.startsWith(prefix)) throw new Error(`stable recovery candidate ref must descend from ${prefix || "publish-gate/<target>/"}`);
+  const candidateVersion = candidate.slice(prefix.length);
+  if (!/^\d+\.\d+\.\d+-alpha\.\d+$/u.test(candidateVersion)) throw new Error(`stable recovery candidate ref must bind an exact alpha version, got ${candidateVersion || "<empty>"}`);
+  if (candidateVersion.replace(/-alpha\.\d+$/u, "") !== publicationVersion) throw new Error(`stable recovery candidate ${candidateVersion} does not match publication ${publicationVersion || "<empty>"}`);
+  if ((version.match(/^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u)?.[1] || "") !== publicationVersion) throw new Error(`recovered npm artifact version ${version || "<empty>"} does not match publication ${publicationVersion}`);
+  return candidateVersion;
+}
+export function createRecoveredPublication({ downloads, bundleRoot, repository, passport, candidateRuntimeSha, publishArtifactKind, publishPackageMain, releasePatterns, platformManifests, channel, targetRef = "", candidateRef = "", rematerializeOnResume = false }) {
+  const allFiles = downloads.flatMap((download) => download.files.map((file) => ({ path: path.relative(bundleRoot, file.absolutePath).split(path.sep).join("/"),
+    size: file.size, sha256: file.sha256.replace(/^sha256:/, ""), absolutePath: file.absolutePath })))
+    .sort((left, right) => left.path.localeCompare(right.path));
   const kind = String(publishArtifactKind || "npm");
   const releaseMatchers = splitPatterns(releasePatterns).map(patternMatcher);
   const releaseAssets = allFiles.filter((file) => releaseMatchers.some((matcher) => matcher.test(path.basename(file.path))));
@@ -714,12 +722,8 @@ export function createRecoveredPublication({ downloads, bundleRoot, repository,
     createRecoveredPublicationCandidate({ allFiles, repository, passport, candidateRuntimeSha });
     const version = String(passport.target?.version || "").trim();
     if (!version) throw new Error("candidate recovery requires a passport publication version");
-    return {
-      manifest: undefined,
-      npmArtifacts: [],
-      allFiles,
-      releaseAssets,
-      version,
+    return { manifest: undefined, npmArtifacts: [], allFiles, releaseAssets,
+      version, candidateVersion: version,
       publishRequiredArtifacts: generatePublishRequiredArtifacts({ manifests: platformManifests, version, kind }),
     };
   }
@@ -732,12 +736,8 @@ export function createRecoveredPublication({ downloads, bundleRoot, repository,
     ? releaseMatchers.some((matcher) => matcher.test(path.basename(file.path)))
     : file.path.toLowerCase().endsWith(".tgz"));
   const publicationVersion = resolveRecoveredPublicationVersion({ artifactVersion: main.metadata.ref, channel, rematerializeOnResume });
-  const candidate = createRecoveredPublicationCandidate({
-    allFiles,
-    repository,
-    passport,
-    candidateRuntimeSha,
-  });
+  const candidateVersion = resolveRecoveredCandidateVersion({ artifactVersion: main.metadata.ref, publicationVersion, channel, rematerializeOnResume, targetRef, candidateRef });
+  const candidate = createRecoveredPublicationCandidate({ allFiles, repository, passport, candidateRuntimeSha });
   const manifest = createPublicationSealedBundle({
     candidate,
     packageName: main.metadata.name,
@@ -751,7 +751,7 @@ export function createRecoveredPublication({ downloads, bundleRoot, repository,
     npmArtifacts,
     allFiles,
     releaseAssets: npmReleaseAssets,
-    version: publicationVersion,
+    version: publicationVersion, candidateVersion,
     publishRequiredArtifacts: generatePublishRequiredArtifacts({
       kind: "npm",
       tarballPaths: npmArtifacts.map((entry) => entry.file.absolutePath),
@@ -832,9 +832,9 @@ export async function resolveRecoveryTransaction({
       })
     : undefined;
   if (!transaction) {
-    transaction = await readExistingTransactionById({
-      repoInfo, apiUrl, token, fetchImpl, transactionId,
-    });
+    transaction = transactionId
+      ? await readExistingTransactionById({ repoInfo, apiUrl, token, fetchImpl, transactionId })
+      : undefined;
   }
   return { version: transaction?.version || publicationVersion, transaction };
 }
@@ -908,7 +908,7 @@ export async function resumeFromCandidateRun({
       publishArtifactKind,
       publishPackageMain,
       releasePatterns,
-      platformManifests: platformManifestEvidence.manifests, channel, rematerializeOnResume,
+      platformManifests: platformManifestEvidence.manifests, channel, targetRef, candidateRef: pullRequest.head?.ref || "", rematerializeOnResume,
     });
     const stageCapsules = resolveRecoveredStageCapsules({
       candidateRuntimeSha,
@@ -918,7 +918,7 @@ export async function resumeFromCandidateRun({
       downloads,
     });
     const {
-      version: candidateVersion,
+      version: publicationVersion,
       transaction: existingTransaction,
     } = await resolveRecoveryTransaction({
       repoInfo,
@@ -976,7 +976,7 @@ export async function resumeFromCandidateRun({
       platformManifestEvidence: platformManifestEvidence.evidence,
       productPayloadManifests,
       artifacts: downloads.map((download) => download.record),
-      publicationVersion: candidateVersion,
+      publicationVersion,
       currentToolingSha: runtimeSha,
       recoveryRunId,
     });
@@ -992,7 +992,7 @@ export async function resumeFromCandidateRun({
           repoInfo,
           targetRef,
           runtimeSha,
-          version: candidateVersion,
+          version: publicationVersion,
           passport,
           sidecar: stageCapsuleSidecar,
           stageCapsules,
@@ -1007,7 +1007,7 @@ export async function resumeFromCandidateRun({
       repository: repoInfo.fullName,
       run: { id: runId, url: run.html_url || "", name: run.name },
       artifacts: { passport: selected.passport.name, summary: selected.summary.name, payloads: chosen.map((artifact) => artifact.name), sourceSha: selected.sourceSha },
-      version: candidateVersion,
+      version: publicationVersion, candidateVersion: publication.candidateVersion,
       candidateRoot: recovery.receipt.recovered.candidateRoot,
       artifactRoot: recovery.receipt.recovered.artifactRoot,
       receipt: recovery.receipt,
@@ -1062,7 +1062,7 @@ export async function resumeFromCandidateRunCli() {
       "release-candidate-action": result.action,
       "release-candidate-passport-path": result.paths.passport,
       "release-candidate-build-summary-path": result.paths.buildSummary,
-      "release-candidate-version": result.version,
+      "release-candidate-version": result.candidateVersion, "release-candidate-publication-version": result.version,
       "release-candidate-source-sha": result.artifacts.sourceSha,
       "release-candidate-artifact": result.artifacts.passport,
       "release-candidate-build-summary-artifact": result.artifacts.summary,