@kungfu-tech/buildchain 4.0.2-alpha.28 → 4.0.2-alpha.29

package/architecture/agent-change-map.md

@@ -175,6 +175,7 @@ Safe change route: Reduce one owned responsibility behind the stable facade, run
 - `actions/promote-buildchain-ref/lib.js`
 - `actions/v4-release-candidate-promote/index.js`
 - `actions/v4-release-candidate-promote/product-provider.js`
+- `tests/v4-release-candidate-promote.test.mjs`
 - `scripts/check-inventory.mjs`
 - `tests/promote-buildchain-ref.test.mjs`
 - `tests/promotion-channel-router.test.mjs`

package/architecture/maintainability-debt.json

@@ -3118,6 +3118,7 @@
     "actions/promote-buildchain-ref/lib.js",
     "actions/v4-release-candidate-promote/index.js",
     "actions/v4-release-candidate-promote/product-provider.js",
+    "tests/v4-release-candidate-promote.test.mjs",
     "scripts/check-inventory.mjs",
     "tests/promote-buildchain-ref.test.mjs",
     "tests/promotion-channel-router.test.mjs",

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.28",
+    "version": "4.0.2-alpha.29",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -5444,5 +5444,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:20411029d83211dff426fb6535a608902129844a5ccb4788db77d3f81becb839",
-  "contractDigest": "sha256:a20ed3dbffe4211e82a368c28a78d3ddea7d147d0034482508e078af674e16fb"
+  "contractDigest": "sha256:201d1b48e3e3cf0c76ca5eef6d6ffb4910f7de3643611dc449d82d142d4070bd"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-09-03T11:14:58.000Z",
-  "publishedAt": "2026-09-03T11:14:58.000Z",
+  "generatedAt": "2026-09-04T03:02:25.000Z",
+  "publishedAt": "2026-09-04T03:02:25.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "6b0935c5663d38893a9ff4688fed4cbbe6b9f0ac",
+  "sourceRevision": "3452a92adad2d00baabefdb1a047438e2a9d1fa6",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.28",
+    "version": "4.0.2-alpha.29",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "976d0c0c6c20b2c98342de9a7cabd7df9c242ae3f47a58b2144621c25b433d85",
+    "sha256": "016364bee9c2d291008b462c2706a997921aeb2b18b9a3ad2f25b301bcbc89df",
     "summary": {
       "cliCommandCount": 117,
       "workflowCount": 74,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "976d0c0c6c20b2c98342de9a7cabd7df9c242ae3f47a58b2144621c25b433d85",
+      "sha256": "016364bee9c2d291008b462c2706a997921aeb2b18b9a3ad2f25b301bcbc89df",
       "summary": {
         "cliCommandCount": 117,
         "workflowCount": 74,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.28",
+    "version": "4.0.2-alpha.29",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/public-surface-audit.json

@@ -8905,7 +8905,7 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "d89f5d875f63d04ba2ab055fe3741acb72c5a537e53db8af9df3fe3170317d52",
+    "workflowRegistryDigest": "e6ac88f0161e613faf8a7aabe5ee9b8d6eb32e398be790e78f89affdc1c657f2",
     "pageRegistryDigest": "ae0b1b9c7b883027cf53403221ff2fe2e41ad1aa4d16851d4550e89947d6d6d7"
   },
   "comparison": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-03T11:14:58.000Z",
-  "publishedAt": "2026-09-03T11:14:58.000Z",
+  "generatedAt": "2026-09-04T03:02:25.000Z",
+  "publishedAt": "2026-09-04T03:02:25.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "6b0935c5663d38893a9ff4688fed4cbbe6b9f0ac",
+  "sourceRevision": "3452a92adad2d00baabefdb1a047438e2a9d1fa6",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.28",
+    "version": "4.0.2-alpha.29",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-03T11:14:58.000Z",
-  "publishedAt": "2026-09-03T11:14:58.000Z",
+  "generatedAt": "2026-09-04T03:02:25.000Z",
+  "publishedAt": "2026-09-04T03:02:25.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "6b0935c5663d38893a9ff4688fed4cbbe6b9f0ac",
+  "sourceRevision": "3452a92adad2d00baabefdb1a047438e2a9d1fa6",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.28",
+    "version": "4.0.2-alpha.29",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -1926,7 +1926,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.28",
+      "introducedVersion": "4.0.2-alpha.29",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1947,7 +1947,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.28",
+      "introducedVersion": "4.0.2-alpha.29",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1968,7 +1968,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.28",
+      "introducedVersion": "4.0.2-alpha.29",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2019,7 +2019,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.28",
+      "introducedVersion": "4.0.2-alpha.29",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.28",
+  "version": "4.0.2-alpha.29",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/release-candidate-resolver.mjs

@@ -263,17 +263,17 @@ export function selectReleaseAssetPaths({
       `release candidate payload patterns matched no files: ${splitPatterns(patterns).join(", ")}`,
     );
   }
-  const basenames = new Set();
+  const selectedByBasename = new Map();
+  const digest = (filePath) => digestFileSync(filePath, "sha256", "hex");
   for (const filePath of files) {
     const basename = path.basename(filePath);
-    if (basenames.has(basename)) {
-      throw new Error(
-        `release candidate public asset basename is not unique: ${basename}`,
-      );
-    }
-    basenames.add(basename);
+    const existing = selectedByBasename.get(basename);
+    if (!existing) selectedByBasename.set(basename, filePath);
+    else if (digest(existing) !== digest(filePath))
+      throw new Error(`release candidate public asset basename is not unique: ${basename}`);
   }
-  return files;
+  // Repeated paths are safe only when they name the same immutable bytes.
+  return [...selectedByBasename.values()];
 }
 
 function packageNameFromArtifactPath(filePath) {