@kungfu-tech/buildchain 4.0.2-alpha.18 → 4.0.2-alpha.19

package/architecture/v4-universal-workflow-bootstrap.json

@@ -19,6 +19,7 @@
     "exactShaExecutionAuthority": true,
     "consumerSourceMutationPerIncident": false,
     "consumerAdmission": "verified-caller-exact-repository-workflow-and-source",
+    "reviewRuntimeBinding": "reviewed-head-or-protected-alpha-merge-to-exact-runtime",
     "buildchainReleasePromotionPerIncident": false,
     "selfDogfoodUsesPublicContract": true
   },

package/architecture/v4-universal-workflow-train-admission.json

@@ -23,12 +23,12 @@
     "statuses": "write"
   },
   "contractRoots": [
-    "sha256:00609cb90d5abb76801ff66235606da025c6be5b071a6e69c1f87dda69cc45e6",
-    "sha256:0b3e13541e5e1b11b1f6f719ee45fa5828f17de41cd832895ff9b15add03a98b",
     "sha256:65a0c2fc3faecaddf5076fff086b5d6e12eb9ba27796efc10aed19f2d93b9457",
-    "sha256:7ca5dffff9eaff8b9265d35c7d8573b8cedd56a69dc26c12e4a5c26e723412b0",
+    "sha256:82c1924f4573f35a895361f9134df66a1868dc921d2c1db8707890b8ca06d61e",
     "sha256:83d6b141d3c60ac5b861029a7c6241ee0ca8e6674dd346d27d476151dd16ea6c",
     "sha256:b6737ed958e8f53f7770b1c214c092591573ad63af41e05797117d9b7b212ed8",
+    "sha256:ca0592275354f0690756e3f11accdd23615987827c346618c50c2e8a2807ad4d",
+    "sha256:cf3c5a79de580525953e1fc02b2b2937a1d1a50219b4464510dd5b4725ca9ca5",
     "sha256:d6ad9cf661c0ba3825cabdc7185fd122a60fc1929dfc799cda3352650588663f"
   ],
   "targetRef": "dev/v4/v4.0",

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.18",
+    "version": "4.0.2-alpha.19",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -5444,5 +5444,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:20411029d83211dff426fb6535a608902129844a5ccb4788db77d3f81becb839",
-  "contractDigest": "sha256:c4229b90af47dcb0c9185125eccf3f7efce2864193a9965c33bc3265e5e7443d"
+  "contractDigest": "sha256:c2b9ad11851e7dd02ac71124b936e302ed5f1bd44a93442c0f447b3207e1f7c8"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-09-02T08:40:46.000Z",
-  "publishedAt": "2026-09-02T08:40:46.000Z",
+  "generatedAt": "2026-09-02T11:40:32.000Z",
+  "publishedAt": "2026-09-02T11:40:32.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "22de41c1a85ebce3c1b97eb74e900f42539023de",
+  "sourceRevision": "8e04604d6eca3d33cdcf08bc2ebab7cf9846d02b",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.18",
+    "version": "4.0.2-alpha.19",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "11894452f93a79ae1fa288151026d1deb1a28386b19676cce7ffffbedf5a4dab",
+    "sha256": "fc6a90595c540584eb3b8250611a4188c60d429403d7aa090fee2267fe8d5af6",
     "summary": {
       "cliCommandCount": 117,
       "workflowCount": 74,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "11894452f93a79ae1fa288151026d1deb1a28386b19676cce7ffffbedf5a4dab",
+      "sha256": "fc6a90595c540584eb3b8250611a4188c60d429403d7aa090fee2267fe8d5af6",
       "summary": {
         "cliCommandCount": 117,
         "workflowCount": 74,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.18",
+    "version": "4.0.2-alpha.19",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/public-surface-audit.json

@@ -8904,7 +8904,7 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "9456d5097ff8a07fbb4d711c0c2b738349f2cb89efcfcad180018779c2986790",
+    "workflowRegistryDigest": "646fd4e2fdb5b774648fd2a05b2579436069c8dfa42a846e423ed82b281d7c64",
     "pageRegistryDigest": "ae0b1b9c7b883027cf53403221ff2fe2e41ad1aa4d16851d4550e89947d6d6d7"
   },
   "comparison": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-02T08:40:46.000Z",
-  "publishedAt": "2026-09-02T08:40:46.000Z",
+  "generatedAt": "2026-09-02T11:40:32.000Z",
+  "publishedAt": "2026-09-02T11:40:32.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "22de41c1a85ebce3c1b97eb74e900f42539023de",
+  "sourceRevision": "8e04604d6eca3d33cdcf08bc2ebab7cf9846d02b",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.18",
+    "version": "4.0.2-alpha.19",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-02T08:40:46.000Z",
-  "publishedAt": "2026-09-02T08:40:46.000Z",
+  "generatedAt": "2026-09-02T11:40:32.000Z",
+  "publishedAt": "2026-09-02T11:40:32.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "22de41c1a85ebce3c1b97eb74e900f42539023de",
+  "sourceRevision": "8e04604d6eca3d33cdcf08bc2ebab7cf9846d02b",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.18",
+    "version": "4.0.2-alpha.19",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -1926,7 +1926,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.18",
+      "introducedVersion": "4.0.2-alpha.19",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1947,7 +1947,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.18",
+      "introducedVersion": "4.0.2-alpha.19",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1968,7 +1968,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.18",
+      "introducedVersion": "4.0.2-alpha.19",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2019,7 +2019,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.18",
+      "introducedVersion": "4.0.2-alpha.19",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.18",
+  "version": "4.0.2-alpha.19",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/v4-universal-workflow-bootstrap.js

@@ -345,69 +345,55 @@ function validatePolicy(value) {
 }
 
 function validateReviewEvidence(value) {
-  exactKeys(
-    value,
-    [
-      "repository",
-      "pullRequest",
-      "headSha",
-      "baseRef",
-      "approvals",
-      "checks",
-      "observedAt",
-    ],
-    "reviewEvidence",
-  );
+  const hasBinding = Object.hasOwn(value || {}, "runtimeBinding");
+  exactKeys(value, ["repository", "pullRequest", "headSha", "baseRef", "approvals", "checks", "observedAt", ...(hasBinding ? ["runtimeBinding"] : [])], "reviewEvidence");
   const approvals = value.approvals.map((approval, index) => {
-    exactKeys(
-      approval,
-      ["reviewer", "commitSha", "submittedAt"],
-      `reviewEvidence.approvals[${index}]`,
-    );
+    exactKeys(approval, ["reviewer", "commitSha", "submittedAt"], `reviewEvidence.approvals[${index}]`);
     return {
-      reviewer: nonEmpty(
-        approval.reviewer,
-        `reviewEvidence.approvals[${index}].reviewer`,
-      ),
-      commitSha: exactSha(
-        approval.commitSha,
-        `reviewEvidence.approvals[${index}].commitSha`,
-      ),
-      submittedAt: timestamp(
-        approval.submittedAt,
-        `reviewEvidence.approvals[${index}].submittedAt`,
-      ),
+      reviewer: nonEmpty(approval.reviewer, `reviewEvidence.approvals[${index}].reviewer`),
+      commitSha: exactSha(approval.commitSha, `reviewEvidence.approvals[${index}].commitSha`),
+      submittedAt: timestamp(approval.submittedAt, `reviewEvidence.approvals[${index}].submittedAt`),
     };
   });
   const checks = value.checks.map((check, index) => {
-    exactKeys(
-      check,
-      ["name", "status", "conclusion"],
-      `reviewEvidence.checks[${index}]`,
-    );
+    const hasCommit = Object.hasOwn(check || {}, "commitSha");
+    exactKeys(check, ["name", "status", "conclusion", ...(hasCommit ? ["commitSha"] : [])], `reviewEvidence.checks[${index}]`);
     return {
       name: nonEmpty(check.name, `reviewEvidence.checks[${index}].name`),
       status: nonEmpty(check.status, `reviewEvidence.checks[${index}].status`),
-      conclusion: nonEmpty(
-        check.conclusion,
-        `reviewEvidence.checks[${index}].conclusion`,
-      ),
+      conclusion: nonEmpty(check.conclusion, `reviewEvidence.checks[${index}].conclusion`),
+      ...(hasCommit ? { commitSha: exactSha(check.commitSha, `reviewEvidence.checks[${index}].commitSha`) } : {}),
     };
   });
+  let runtimeBinding;
+  if (hasBinding) {
+    exactKeys(value.runtimeBinding, ["kind", "runtimeSha", "parentShas", "mergedAt"], "reviewEvidence.runtimeBinding");
+    const kind = nonEmpty(value.runtimeBinding.kind, "reviewEvidence.runtimeBinding.kind");
+    if (!new Set(["reviewed-head", "protected-alpha-merge"]).has(kind)) fail("invalid-runtime-binding", "review evidence runtime binding kind is unsupported");
+    const parentShas = value.runtimeBinding.parentShas.map((parent, index) => exactSha(parent, `reviewEvidence.runtimeBinding.parentShas[${index}]`));
+    if (new Set(parentShas).size !== parentShas.length) fail("invalid-runtime-binding", "review evidence runtime parents must be duplicate-free");
+    runtimeBinding = { kind, runtimeSha: exactSha(value.runtimeBinding.runtimeSha, "reviewEvidence.runtimeBinding.runtimeSha"), parentShas, mergedAt: value.runtimeBinding.mergedAt === null ? null : timestamp(value.runtimeBinding.mergedAt, "reviewEvidence.runtimeBinding.mergedAt") };
+  }
   return {
     repository: repository(value.repository, "reviewEvidence.repository"),
-    pullRequest: positiveInteger(
-      value.pullRequest,
-      "reviewEvidence.pullRequest",
-    ),
+    pullRequest: positiveInteger(value.pullRequest, "reviewEvidence.pullRequest"),
     headSha: exactSha(value.headSha, "reviewEvidence.headSha"),
     baseRef: nonEmpty(value.baseRef, "reviewEvidence.baseRef"),
-    approvals,
-    checks,
+    approvals, checks,
     observedAt: timestamp(value.observedAt, "reviewEvidence.observedAt"),
+    ...(runtimeBinding ? { runtimeBinding } : {}),
   };
 }
 
+function reviewedRuntimeSha(request, policy, evidence, runtimeSha) {
+  const binding = evidence.runtimeBinding || { kind: "reviewed-head", runtimeSha: evidence.headSha, parentShas: [], mergedAt: null };
+  if (binding.runtimeSha !== runtimeSha) fail("review-runtime-mismatch", "review evidence runtime binding does not match the candidate");
+  const direct = binding.kind === "reviewed-head" && evidence.headSha === runtimeSha && evidence.baseRef === policy.targetRef && binding.mergedAt === null;
+  const alphaMerge = binding.kind === "protected-alpha-merge" && request.mode === "alpha" && evidence.baseRef === "alpha/v4/v4.0" && binding.parentShas.length === 2 && binding.parentShas.includes(evidence.headSha) && binding.mergedAt !== null && Date.parse(binding.mergedAt) <= Date.parse(evidence.observedAt);
+  if (!direct && !alphaMerge) fail("review-identity-mismatch", "review evidence does not bind the candidate runtime");
+  return evidence.headSha;
+}
+
 export function v4UniversalWorkflowAdmissionRoot(value) {
   return documentRoot("universal-workflow-admission", validatePolicy(value));
 }
@@ -478,17 +464,16 @@ export function admitV4UniversalWorkflow({
   const reviewEvidence = validateReviewEvidence(reviewEvidenceValue);
   if (
     reviewEvidence.repository !== request.candidate.repository ||
-    reviewEvidence.pullRequest !== request.candidate.reviewPullRequest ||
-    reviewEvidence.headSha !== runtimeSha ||
-    reviewEvidence.baseRef !== policy.targetRef
+    reviewEvidence.pullRequest !== request.candidate.reviewPullRequest
   )
     fail(
       "review-identity-mismatch",
       "review evidence does not bind the candidate",
     );
+  const reviewedSha = reviewedRuntimeSha(request, policy, reviewEvidence, runtimeSha);
   const approvedReviewers = new Set(
     reviewEvidence.approvals
-      .filter((approval) => approval.commitSha === runtimeSha)
+      .filter((approval) => approval.commitSha === reviewedSha)
       .map((approval) => approval.reviewer),
   );
   const admittedApprovalCount = policy.allowedReviewers.filter((reviewer) =>
@@ -512,7 +497,8 @@ export function admitV4UniversalWorkflow({
         checks.length === 0 ||
         checks.some(
           (check) =>
-            check.status !== "completed" || check.conclusion !== "success",
+            check.status !== "completed" || check.conclusion !== "success" ||
+            (check.commitSha !== undefined && check.commitSha !== runtimeSha),
         )
       );
     })

package/scripts/check-v4-universal-workflow-bootstrap.mjs

@@ -118,6 +118,10 @@ assert.equal(contract.bootstrap.consumerSourceMutationPerIncident, false);
 assert.equal(contract.bootstrap.buildchainReleasePromotionPerIncident, false);
 assert.equal(contract.bootstrap.selfDogfoodUsesPublicContract, true);
 assert.equal(contract.bootstrap.recoveryDependsOnPublishedBuildchain, false);
+assert.equal(
+  contract.bootstrap.reviewRuntimeBinding,
+  "reviewed-head-or-protected-alpha-merge-to-exact-runtime",
+);
 assert.deepEqual(
   contract.capabilityAdapters.map(({ id }) => id).sort(),
   [...admissionPolicy.allowedCapabilities].sort(),
@@ -168,6 +172,10 @@ assert.match(
   bootstrapSource,
   /ascii_downcase\) == "kungfu-origin"[\s\S]*\.name == "check"[\s\S]*map\(select\(\.status == "completed" and \(\.conclusion \/\/ ""\) != ""\)\)[\s\S]*candidate\/architecture\/v4-universal-workflow-train-admission\.json/u,
 );
+assert.match(
+  bootstrapSource,
+  /CANDIDATE_MODE:[\s\S]*\.merged == true[\s\S]*\.merge_commit_sha == \$expected[\s\S]*\.base\.ref == "alpha\/v4\/v4\.0"[\s\S]*commitSha: \$expected[\s\S]*runtimeBinding:/u,
+);
 const consumerTemplate = fs.readFileSync(
   path.join(root, contract.bootstrap.consumerTemplate),
   "utf8",