@kungfu-tech/buildchain 4.0.2-alpha.39 → 4.0.2-alpha.40

package/actions/v4-release-candidate-promote/README.md

@@ -1,3 +1,31 @@
+---
+status: active
+period: ongoing
+theme: protected-publication-source
+doc_type: reference
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-06
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-06
+  visible_context: Publication adapter, regression tests, and public GitHub commit metadata.
+  invisible_context_boundary: No credentials or private runtime state inspected.
+---
+
 # v4 release-candidate promote action
 
 This internal action validates a sealed v4 publication qualification receipt, aggregates the Buildchain Release Passport, and executes the fixed four-capability Release Tail Provider Plane. It has no command or shell extension input and is invoked by the v4 branch of the reusable `release-candidate-promote` workflow.
+
+The protected publication source must match the qualified candidate's exact
+Git tree. An exact commit is accepted directly; a final PR merge may also bind
+through identical ordered parents. For repositories requiring linear history,
+`squash-equivalent` requires a protected commit with one parent, a qualified
+merge candidate with two parents, and the same first parent. GitHub must report
+the exact PR as merged into the protected commit, and its head must equal the
+candidate's second parent. Candidate qualification, workflow and repository
+provenance, and artifact verification remain required before publication.

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.39",
+    "version": "4.0.2-alpha.40",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -5444,5 +5444,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:20411029d83211dff426fb6535a608902129844a5ccb4788db77d3f81becb839",
-  "contractDigest": "sha256:79921c4ffaa63b962a747ea2d6748dd73a0b01dda58cb596b4c18fb43634ab42"
+  "contractDigest": "sha256:d255326bba602066d36fe883834521278f08da64de01849dbf5fe47a6ac43530"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-09-06T03:37:46.000Z",
-  "publishedAt": "2026-09-06T03:37:46.000Z",
+  "generatedAt": "2026-09-06T06:41:17.000Z",
+  "publishedAt": "2026-09-06T06:41:17.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "54a23658004304d6eec29107ba6f843fa7dc0867",
+  "sourceRevision": "89ab54a52311f442b988647fc97ffc292dbceba2",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.39",
+    "version": "4.0.2-alpha.40",
     "versionSource": "package.json#version"
   },
   "source": {
@@ -331,7 +331,7 @@
       ],
       "maturity": "stable",
       "sourcePath": "actions/v4-release-candidate-promote/README.md",
-      "digest": "sha256:3b3c3f01ca12069ba2fd67afa8e23d1aec19bf5e1d048bc4975e7503f9eb43bc",
+      "digest": "sha256:b50fc4f13ea9c680142df79c5ab984522cd85893f1ce12f1427e094569329746",
       "headings": [
         {
           "level": 1,
@@ -339,7 +339,7 @@
           "anchor": "v4-release-candidate-promote-action"
         }
       ],
-      "markdown": "# v4 release-candidate promote action\n\nThis internal action validates a sealed v4 publication qualification receipt, aggregates the Buildchain Release Passport, and executes the fixed four-capability Release Tail Provider Plane. It has no command or shell extension input and is invoked by the v4 branch of the reusable `release-candidate-promote` workflow."
+      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: protected-publication-source\ndoc_type: reference\nsource_level: local-files\nconfidence: high\nsensitivity: public\nevidence_grade: B\nreview_state: unreviewed\nlast_reviewed: 2026-09-06\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-06\n  visible_context: Publication adapter, regression tests, and public GitHub commit metadata.\n  invisible_context_boundary: No credentials or private runtime state inspected.\n---\n\n# v4 release-candidate promote action\n\nThis internal action validates a sealed v4 publication qualification receipt, aggregates the Buildchain Release Passport, and executes the fixed four-capability Release Tail Provider Plane. It has no command or shell extension input and is invoked by the v4 branch of the reusable `release-candidate-promote` workflow.\n\nThe protected publication source must match the qualified candidate's exact\nGit tree. An exact commit is accepted directly; a final PR merge may also bind\nthrough identical ordered parents. For repositories requiring linear history,\n`squash-equivalent` requires a protected commit with one parent, a qualified\nmerge candidate with two parents, and the same first parent. GitHub must report\nthe exact PR as merged into the protected commit, and its head must equal the\ncandidate's second parent. Candidate qualification, workflow and repository\nprovenance, and artifact verification remain required before publication."
     },
     {
       "id": "action:validate-config",

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "835f4de92b2901ad73894c302d74d2af6d3a33df3fa090efbaa782424ed4c359",
+    "sha256": "6db59a4c0acdd8d063bec9be6a766419f6fe7b9c8e2936730849f28b2535efc6",
     "summary": {
       "cliCommandCount": 117,
       "workflowCount": 114,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "835f4de92b2901ad73894c302d74d2af6d3a33df3fa090efbaa782424ed4c359",
+      "sha256": "6db59a4c0acdd8d063bec9be6a766419f6fe7b9c8e2936730849f28b2535efc6",
       "summary": {
         "cliCommandCount": 117,
         "workflowCount": 114,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.39",
+    "version": "4.0.2-alpha.40",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/page-registry.json

@@ -265,7 +265,7 @@
       ],
       "maturity": "stable",
       "sourcePath": "actions/v4-release-candidate-promote/README.md",
-      "digest": "sha256:3b3c3f01ca12069ba2fd67afa8e23d1aec19bf5e1d048bc4975e7503f9eb43bc",
+      "digest": "sha256:b50fc4f13ea9c680142df79c5ab984522cd85893f1ce12f1427e094569329746",
       "headings": [
         {
           "level": 1,
@@ -273,7 +273,7 @@
           "anchor": "v4-release-candidate-promote-action"
         }
       ],
-      "markdown": "# v4 release-candidate promote action\n\nThis internal action validates a sealed v4 publication qualification receipt, aggregates the Buildchain Release Passport, and executes the fixed four-capability Release Tail Provider Plane. It has no command or shell extension input and is invoked by the v4 branch of the reusable `release-candidate-promote` workflow."
+      "markdown": "---\nstatus: active\nperiod: ongoing\ntheme: protected-publication-source\ndoc_type: reference\nsource_level: local-files\nconfidence: high\nsensitivity: public\nevidence_grade: B\nreview_state: unreviewed\nlast_reviewed: 2026-09-06\nai_provenance:\n  model_family: GPT-6\n  product: Codex\n  generated_at: 2026-09-06\n  visible_context: Publication adapter, regression tests, and public GitHub commit metadata.\n  invisible_context_boundary: No credentials or private runtime state inspected.\n---\n\n# v4 release-candidate promote action\n\nThis internal action validates a sealed v4 publication qualification receipt, aggregates the Buildchain Release Passport, and executes the fixed four-capability Release Tail Provider Plane. It has no command or shell extension input and is invoked by the v4 branch of the reusable `release-candidate-promote` workflow.\n\nThe protected publication source must match the qualified candidate's exact\nGit tree. An exact commit is accepted directly; a final PR merge may also bind\nthrough identical ordered parents. For repositories requiring linear history,\n`squash-equivalent` requires a protected commit with one parent, a qualified\nmerge candidate with two parents, and the same first parent. GitHub must report\nthe exact PR as merged into the protected commit, and its head must equal the\ncandidate's second parent. Candidate qualification, workflow and repository\nprovenance, and artifact verification remain required before publication."
     },
     {
       "id": "action:validate-config",

package/dist/site/public-surface-audit.json

@@ -10929,8 +10929,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "da65c24d1ca58d393cff163356f09261a9cd3392080caa49690c65b3786f0e74",
-    "pageRegistryDigest": "094908397a02731893e7dd90ad6d3d50e2af07de51ec62c617249e82691fe828"
+    "workflowRegistryDigest": "da116382d57fad02e09e5e846f808560f731fc56a814bc385b156bed28cc46f8",
+    "pageRegistryDigest": "3be2a3d02eeb4d4561022fd81de41c9853c9e196c3ced7466d88ce6766b24456"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-06T03:37:46.000Z",
-  "publishedAt": "2026-09-06T03:37:46.000Z",
+  "generatedAt": "2026-09-06T06:41:17.000Z",
+  "publishedAt": "2026-09-06T06:41:17.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "54a23658004304d6eec29107ba6f843fa7dc0867",
+  "sourceRevision": "89ab54a52311f442b988647fc97ffc292dbceba2",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.39",
+    "version": "4.0.2-alpha.40",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-06T03:37:46.000Z",
-  "publishedAt": "2026-09-06T03:37:46.000Z",
+  "generatedAt": "2026-09-06T06:41:17.000Z",
+  "publishedAt": "2026-09-06T06:41:17.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "54a23658004304d6eec29107ba6f843fa7dc0867",
+  "sourceRevision": "89ab54a52311f442b988647fc97ffc292dbceba2",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.39",
+    "version": "4.0.2-alpha.40",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -2746,7 +2746,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.39",
+      "introducedVersion": "4.0.2-alpha.40",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -3943,7 +3943,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.39",
+      "introducedVersion": "4.0.2-alpha.40",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5970,7 +5970,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.39",
+      "introducedVersion": "4.0.2-alpha.40",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6001,7 +6001,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.39",
+      "introducedVersion": "4.0.2-alpha.40",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6032,7 +6032,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.39",
+      "introducedVersion": "4.0.2-alpha.40",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.39",
+  "version": "4.0.2-alpha.40",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/v4-protected-publication-source.js

@@ -4,10 +4,8 @@ const SHA_PATTERN = /^[0-9a-f]{40}$/u;
 
 function exactSha(value, label) {
   const normalized = String(value || "").toLowerCase();
-  if (!SHA_PATTERN.test(normalized)) {
-    throw new Error(`${label} must be an exact Git SHA`);
-  }
-  return normalized;
+  if (SHA_PATTERN.test(normalized)) return normalized;
+  throw new Error(`${label} must be an exact Git SHA`);
 }
 
 function exactParents(value, label) {
@@ -26,16 +24,14 @@ export function bindV4ProtectedPublicationSource({
   if (!/^[^/\s]+\/[^/\s]+$/u.test(String(repository || ""))) {
     throw new Error("protected publication source requires owner/repository");
   }
-  const protectedSource = {
-    sha: exactSha(protectedCommit?.sha, "protected source SHA"),
-    tree: exactSha(protectedCommit?.tree, "protected source tree"),
-    parents: exactParents(protectedCommit?.parents, "protected source parents"),
-  };
-  const candidateSource = {
-    sha: exactSha(candidateCommit?.sha, "candidate source SHA"),
-    tree: exactSha(candidateCommit?.tree, "candidate source tree"),
-    parents: exactParents(candidateCommit?.parents, "candidate source parents"),
-  };
+  const [protectedSource, candidateSource] = [
+    ["protected", protectedCommit],
+    ["candidate", candidateCommit],
+  ].map(([kind, commit]) => ({
+    sha: exactSha(commit?.sha, `${kind} source SHA`),
+    tree: exactSha(commit?.tree, `${kind} source tree`),
+    parents: exactParents(commit?.parents, `${kind} source parents`),
+  }));
   if (protectedSource.tree !== candidateSource.tree) {
     throw new Error(
       "protected publication source tree does not match the qualified candidate tree",
@@ -45,13 +41,13 @@ export function bindV4ProtectedPublicationSource({
   let mode = "exact-commit";
   let pullRequestNumber = null;
   if (protectedSource.sha !== candidateSource.sha) {
-    mode = "merge-equivalent";
     const sameParents =
-      protectedSource.parents.length === candidateSource.parents.length &&
-      protectedSource.parents.every(
-        (parent, index) => parent === candidateSource.parents[index],
-      );
-    if (!sameParents) {
+      protectedSource.parents.join(",") === candidateSource.parents.join(",");
+    const squashParents =
+      protectedSource.parents.length === 1 &&
+      candidateSource.parents.length === 2 &&
+      protectedSource.parents[0] === candidateSource.parents[0];
+    if (!sameParents && !squashParents) {
       throw new Error(
         "protected publication source is not parent-equivalent to the qualified merge candidate",
       );
@@ -70,12 +66,14 @@ export function bindV4ProtectedPublicationSource({
       pullRequestNumber <= 0 ||
       pullRequest?.merged !== true ||
       pullRequestMerge !== protectedSource.sha ||
-      !candidateSource.parents.includes(pullRequestHead)
+      !candidateSource.parents.includes(pullRequestHead) ||
+      (squashParents && candidateSource.parents[1] !== pullRequestHead)
     ) {
       throw new Error(
         "protected publication source does not match the merged pull request and qualified merge candidate",
       );
     }
+    mode = sameParents ? "merge-equivalent" : "squash-equivalent";
   }
 
   const binding = {