@kungfu-tech/buildchain 4.0.2-alpha.43 → 4.0.2-alpha.45

package/dist/site/public-surface-audit.json

@@ -6,7 +6,7 @@
     "cliCommandCount": 117,
     "workflowCount": 114,
     "actionCount": 8,
-    "sitePageCount": 87,
+    "sitePageCount": 88,
     "docCommandRefCount": 1050,
     "failureCount": 0
   },
@@ -5518,6 +5518,10 @@
         "id": "manual:observed-evidence-patrol",
         "category": "manual"
       },
+      {
+        "id": "manual:oci-publication",
+        "category": "manual"
+      },
       {
         "id": "manual:ownership",
         "category": "manual"
@@ -10929,8 +10933,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "b3235d2cfb6220c9f349cfaffa8a1f1309444798266a70e2fd020effc3f11ff2",
-    "pageRegistryDigest": "48da222775d48a130d729ea7951446259b5cd4db7d4c0bd3234a02f77d5719d9"
+    "workflowRegistryDigest": "e1bacd3ffb652ab8ef5c62986c4048d618e28ff43d4d03b61827adcce0e027be",
+    "pageRegistryDigest": "178bc7609c831a63cecdb5baa817672a53393bb7d40f43b25fc8a736d94e2e9d"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -1356,10 +1356,7 @@
     },
     {
       "path": ".github/workflows/.release-candidate-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -1374,10 +1371,7 @@
     },
     {
       "path": ".github/workflows/.release-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -1723,10 +1717,7 @@
     },
     {
       "path": ".github/workflows/public-release-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -1768,10 +1759,7 @@
     },
     {
       "path": ".github/workflows/release-candidate-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -2021,5 +2009,5 @@
       "classified": true
     }
   ],
-  "registryDigest": "894cce314366698d41a3ab20172a0b7a05f03f2167667eae51793537b832c811"
+  "registryDigest": "9c343ae9f9e778b608317d973b02cada327bd31e5149482d7f385b173c20ec14"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-06T12:32:13.000Z",
-  "publishedAt": "2026-09-06T12:32:13.000Z",
+  "generatedAt": "2026-09-06T14:38:45.000Z",
+  "publishedAt": "2026-09-06T14:38:45.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "2c34aaf899b3921588f53023b350565b63914dce",
+  "sourceRevision": "7f41a21e534d41655d1c956bdc688e3167c2d340",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.43",
+    "version": "4.0.2-alpha.45",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -120,7 +120,8 @@
       "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
       "./site/release-provenance.json": "./dist/site/release-provenance.json",
       "./site/agent-index.json": "./dist/site/agent-index.json",
-      "./package.json": "./package.json"
+      "./package.json": "./package.json",
+      "./oci-publication": "./packages/core/oci-publication-bundle.js"
     }
   },
   "repository": "https://github.com/kungfu-systems/buildchain",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-06T12:32:13.000Z",
-  "publishedAt": "2026-09-06T12:32:13.000Z",
+  "generatedAt": "2026-09-06T14:38:45.000Z",
+  "publishedAt": "2026-09-06T14:38:45.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "2c34aaf899b3921588f53023b350565b63914dce",
+  "sourceRevision": "7f41a21e534d41655d1c956bdc688e3167c2d340",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.43",
+    "version": "4.0.2-alpha.45",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:aef677bb3e37882f73daf65b7052989fc549e3b40d70bc4036beb2738b608345"
+      "digest": "sha256:af7bee38e21a9ada99e1731f3576733f2897f9d19bdbf39eb2781650095ae419"
     },
     {
       "id": "getting-started",
@@ -237,7 +237,7 @@
       "path": "docs/cli.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:cd4e6144d45f4f01b733a728695a9f22acdd7124bd4aba18c6b0146d27f57c44"
+      "digest": "sha256:fc2e0cd3f5718e05101d85f6363cefcd2336609c05dd6626b6a062b44c3a1a0d"
     },
     {
       "id": "cli-reference",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:df79569e33023c30fe010a88acecb45caf769970cda1e83c5fc2657986fa9e33"
+      "digest": "sha256:48232d47023b85063e7f779f053850e38149359ea3b2a5acd5126ff81f423ff4"
     },
     {
       "id": "build-facts",

package/dist/site/workflow-registry.json

@@ -2746,7 +2746,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.43",
+      "introducedVersion": "4.0.2-alpha.45",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -3943,7 +3943,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.43",
+      "introducedVersion": "4.0.2-alpha.45",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5970,7 +5970,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.43",
+      "introducedVersion": "4.0.2-alpha.45",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6001,7 +6001,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.43",
+      "introducedVersion": "4.0.2-alpha.45",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6032,7 +6032,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.43",
+      "introducedVersion": "4.0.2-alpha.45",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/MAP.md

@@ -38,6 +38,7 @@ running artifact), *use* (consume / extend) - and a **status**:
 | CLI operator or agent | [Generated CLI Reference](cli-reference.md) | [CLI guide](cli.md) for concepts and worked examples |
 | Node toolkit developer | [Generated Node API Reference](node-api-reference.md) | [Core package guide](../packages/core/README.md) for recipes |
 | Workflow contributor | [Workflow Catalog](workflow-catalog.md) | [Contribution rules](../CONTRIBUTING.md#workflow-organization) and the [exact registry](../architecture/workflow-taxonomy.json) |
+| Container image publisher | [OCI image family publication](oci-publication.md) | [Release Flow](release-flow.md) and [Runtime Train Validation](runtime-train-validation.md) |
 | Build/release operator | [Reusable Build Surface](reusable-build-surface.md) | [Release Flow](release-flow.md) and [Release Passport](release-passport.md) |
 | Product/trust reviewer | [Product Mechanism](product-mechanism.md) | [Release Passport](release-passport.md) and [KFD Support](kfd-support.md) |
 

package/docs/cli.md

@@ -169,6 +169,9 @@ The safety and authority boundary is explicit:
   and verify callers use `@v4-alpha`; release callers select `@v4-alpha` for
   Alpha and `@v4` for stable releases. Both channel contract locks and their
   distinct resolved source coordinates are bound into provisioning authority.
+  Verify callers grant the reusable Check workflow its required read permissions.
+  Paper agent guidance resolves next-development scripts from the installed
+  Buildchain package and links to the upstream transition ADR.
   Migration reads the other channel from its fetched Git tag. Installed-package
   operators can supply `--stable-buildchain-root` or `--alpha-buildchain-root`
   pointing to the corresponding exact source checkout instead.

package/docs/node-api-reference.md

@@ -2325,11 +2325,11 @@ Target: `./packages/core/paper.js`. Public symbols: 48.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `collectPaperAgentEntry` | function: function collectPaperAgentEntry({ cwd = process.cwd(), buildchainSha = "", mode = "contract", env = process.env, runtimeAdmission, } = {}) | { cwd = process.cwd(), buildchainSha = "", mode = "contract", env = process.env, runtimeAdmission, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectPaperAgentEntry } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:255` |
+| `collectPaperAgentEntry` | function: function collectPaperAgentEntry({ cwd = process.cwd(), buildchainSha = "", mode = "contract", env = process.env, runtimeAdmission, } = {}) | { cwd = process.cwd(), buildchainSha = "", mode = "contract", env = process.env, runtimeAdmission, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectPaperAgentEntry } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:279` |
 | `collectPaperFleetAudit` | function: function collectPaperFleetAudit({ root = process.cwd(), repositories = [], buildchainRoot = process.cwd(), buildchainVersion = "", buildchainSha = "", governance = {}, } = {}) | { root = process.cwd(), repositories = [], buildchainRoot = process.cwd(), buildchainVersion = "", buildchainSha = "", governance = {}, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectPaperFleetAudit } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-fleet.js:158` |
 | `collectPaperPreflight` | function: function collectPaperPreflight({ cwd = process.cwd(), buildchainRoot = process.cwd(), buildchainVersion = "", buildchainRef = "v3", buildchainSha = "", registry = NPM_REGISTRY, offline = false, agentEntryMode = "contract", } = {}) | { cwd = process.cwd(), buildchainRoot = process.cwd(), buildchainVersion = "", buildchainRef = "v3", buildchainSha = "", registry = NPM_REGISTRY, offline = false, agentEntryMode = "contract", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectPaperPreflight } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:2025` |
 | `collectPaperStatus` | function: function collectPaperStatus({ cwd = process.cwd() } = {}) | { cwd = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { collectPaperStatus } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:1124` |
-| `createPaperAgentEntry` | function: function createPaperAgentEntry({ buildchainVersion, buildchainSha, developmentRef, }) | { buildchainVersion, buildchainSha, developmentRef, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperAgentEntry } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:95` |
+| `createPaperAgentEntry` | function: function createPaperAgentEntry({ buildchainVersion, buildchainSha, developmentRef, }) | { buildchainVersion, buildchainSha, developmentRef, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperAgentEntry } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:101` |
 | `createPaperAlphaPlan` | function: function createPaperAlphaPlan({ cwd = process.cwd(), sourceRef = "", targetRef = "", } = {}) | { cwd = process.cwd(), sourceRef = "", targetRef = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperAlphaPlan } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:2267` |
 | `createPaperBuildPlan` | function: function createPaperBuildPlan({ cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {}) | { cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperBuildPlan } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:2204` |
 | `createPaperProvisioningAuthority` | function: function createPaperProvisioningAuthority({ repository, packageName, buildchainVersion, buildchainSha, contractLock, buildWorkflow, verifyWorkflow, releaseWorkflow, agentEntry, agentInstructions, environment = "", }) | { repository, packageName, buildchainVersion, buildchainSha, contractLock, buildWorkflow, verifyWorkflow, releaseWorkflow, agentEntry, agentInstructions, environment = "", } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperProvisioningAuthority } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:511` |
@@ -2340,11 +2340,11 @@ Target: `./packages/core/paper.js`. Public symbols: 48.
 | `executePaperNpmBootstrap` | function: function executePaperNpmBootstrap(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { executePaperNpmBootstrap } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:2452` |
 | `executePaperWorkStart` | function: function executePaperWorkStart(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { executePaperWorkStart } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-work.js:169` |
 | `executePaperWorkSubmitPush` | function: function executePaperWorkSubmitPush(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { executePaperWorkSubmitPush } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-work.js:357` |
-| `mergePaperAgentEntryInstructions` | function: function mergePaperAgentEntryInstructions(current = "", { developmentRef }) | current = "", { developmentRef } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { mergePaperAgentEntryInstructions } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:63` |
-| `PAPER_AGENT_ENTRY_CONTRACT` | constant: const PAPER_AGENT_ENTRY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_AGENT_ENTRY_CONTRACT } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:18` |
-| `PAPER_AGENT_ENTRY_SCHEMA_VERSION` | constant: const PAPER_AGENT_ENTRY_SCHEMA_VERSION | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_AGENT_ENTRY_SCHEMA_VERSION } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:19` |
-| `PAPER_AGENT_ENTRY_SECTION_END` | constant: const PAPER_AGENT_ENTRY_SECTION_END | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_AGENT_ENTRY_SECTION_END } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:22` |
-| `PAPER_AGENT_ENTRY_SECTION_START` | constant: const PAPER_AGENT_ENTRY_SECTION_START | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_AGENT_ENTRY_SECTION_START } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:20` |
+| `mergePaperAgentEntryInstructions` | function: function mergePaperAgentEntryInstructions(current = "", { developmentRef }) | current = "", { developmentRef } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { mergePaperAgentEntryInstructions } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:69` |
+| `PAPER_AGENT_ENTRY_CONTRACT` | constant: const PAPER_AGENT_ENTRY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_AGENT_ENTRY_CONTRACT } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:24` |
+| `PAPER_AGENT_ENTRY_SCHEMA_VERSION` | constant: const PAPER_AGENT_ENTRY_SCHEMA_VERSION | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_AGENT_ENTRY_SCHEMA_VERSION } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:25` |
+| `PAPER_AGENT_ENTRY_SECTION_END` | constant: const PAPER_AGENT_ENTRY_SECTION_END | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_AGENT_ENTRY_SECTION_END } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:28` |
+| `PAPER_AGENT_ENTRY_SECTION_START` | constant: const PAPER_AGENT_ENTRY_SECTION_START | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_AGENT_ENTRY_SECTION_START } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:26` |
 | `PAPER_ALPHA_PLAN_CONTRACT` | constant: const PAPER_ALPHA_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_ALPHA_PLAN_CONTRACT } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:98` |
 | `PAPER_BUILD_PLAN_CONTRACT` | constant: const PAPER_BUILD_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_BUILD_PLAN_CONTRACT } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:97` |
 | `PAPER_FLEET_AUDIT_CONTRACT` | constant: const PAPER_FLEET_AUDIT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_FLEET_AUDIT_CONTRACT } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-fleet.js:19` |
@@ -2361,13 +2361,13 @@ Target: `./packages/core/paper.js`. Public symbols: 48.
 | `PAPER_VISIBILITY_CONTRACT` | constant: const PAPER_VISIBILITY_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_VISIBILITY_CONTRACT } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:100` |
 | `PAPER_WORK_START_PLAN_CONTRACT` | constant: const PAPER_WORK_START_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_WORK_START_PLAN_CONTRACT } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-work.js:17` |
 | `PAPER_WORK_SUBMIT_PLAN_CONTRACT` | constant: const PAPER_WORK_SUBMIT_PLAN_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PAPER_WORK_SUBMIT_PLAN_CONTRACT } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-work.js:19` |
-| `paperAgentEntryFiles` | function: function paperAgentEntryFiles({ cwd, buildchainVersion, buildchainSha, developmentRef = "", }) | { cwd, buildchainVersion, buildchainSha, developmentRef = "", } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { paperAgentEntryFiles } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:152` |
-| `paperAgentEntryInstructions` | function: function paperAgentEntryInstructions({ developmentRef }) | { developmentRef } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { paperAgentEntryInstructions } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:38` |
+| `paperAgentEntryFiles` | function: function paperAgentEntryFiles({ cwd, buildchainVersion, buildchainSha, developmentRef = "", }) | { cwd, buildchainVersion, buildchainSha, developmentRef = "", } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { paperAgentEntryFiles } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:176` |
+| `paperAgentEntryInstructions` | function: function paperAgentEntryInstructions({ developmentRef }) | { developmentRef } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { paperAgentEntryInstructions } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:44` |
 | `paperFleetTransitionWorkspace` | function: function paperFleetTransitionWorkspace(workspaceText, lockText) | workspaceText, lockText | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { paperFleetTransitionWorkspace } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-fleet.js:290` |
 | `planPaperFleetUpdate` | function: function planPaperFleetUpdate(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { planPaperFleetUpdate } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-fleet.js:209` |
 | `planPaperMigration` | value: planPaperMigration | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { planPaperMigration } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:1` |
 | `planPaperScaffold` | value: planPaperScaffold | none | unknown | No narrower error contract was mechanically discoverable. | unknown | `import { planPaperScaffold } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:1` |
-| `resolvePaperBuildchainSha` | function: function resolvePaperBuildchainSha(buildchainRoot, buildchainSha = "") | buildchainRoot, buildchainSha = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolvePaperBuildchainSha } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:181` |
+| `resolvePaperBuildchainSha` | function: function resolvePaperBuildchainSha(buildchainRoot, buildchainSha = "") | buildchainRoot, buildchainSha = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolvePaperBuildchainSha } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-agent-entry.js:205` |
 | `resolvePaperRepository` | function: function resolvePaperRepository(cwd = process.cwd()) | cwd = process.cwd() | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolvePaperRepository } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-repository.js:133` |
 | `resolvePaperRuntimeGitSha` | function: function resolvePaperRuntimeGitSha(buildchainRoot, buildchainVersion = "") | buildchainRoot, buildchainVersion = "" | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { resolvePaperRuntimeGitSha } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper.js:253` |
 | `writePaperFleetUpdate` | function: function writePaperFleetUpdate(plan) | plan | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | may-write-or-invoke-external-actions | `import { writePaperFleetUpdate } from "@kungfu-tech/buildchain/paper";` | `packages/core/paper-fleet.js:271` |
@@ -2832,3 +2832,14 @@ Target: `./packages/core/buildchain-kfd-claims.js`. Public symbols: 10.
 | `createBuildchainKfdClaimRegistry` | function: function createBuildchainKfdClaimRegistry({ root = process.cwd(), sourceSha = "" } = {}) | { root = process.cwd(), sourceSha = "" } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdClaimRegistry } from "@kungfu-tech/buildchain/buildchain-kfd-claims";` | `packages/core/buildchain-kfd-claims.js:510` |
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain/buildchain-kfd-claims";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain/buildchain-kfd-claims";` | `packages/core/buildchain-kfd-claims.js:226` |
+
+## `@kungfu-tech/buildchain/oci-publication`
+
+Target: `./packages/core/oci-publication-bundle.js`. Public symbols: 4.
+
+| Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| `OCI_FAMILY_SCHEMA` | constant: const OCI_FAMILY_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { OCI_FAMILY_SCHEMA } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:6` |
+| `ociBundleFile` | function: function ociBundleFile(root, relative) | root, relative | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { ociBundleFile } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:29` |
+| `sealOciPublicationBundle` | function: function sealOciPublicationBundle({ bundleRoot, body }) | { bundleRoot, body } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { sealOciPublicationBundle } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:10` |
+| `verifyOciPublicationBundle` | function: function verifyOciPublicationBundle({ bundleRoot, manifest, repository, sourceSha, version, }) | { bundleRoot, manifest, repository, sourceSha, version, } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyOciPublicationBundle } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:114` |

package/docs/oci-publication.md

@@ -0,0 +1,82 @@
+---
+status: draft
+period: ongoing
+theme: oci-publication
+doc_type: technical-reference
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-06
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-06
+  invisible_context_boundary: No credentials or production registry state inspected.
+---
+
+# OCI image family publication
+
+Buildchain v4 can publish a sealed family of container images to GHCR through
+`publish-artifact-kind: oci` on the public release candidate promotion workflow.
+The candidate build produces the image bytes and smoke evidence. The built-in
+provider verifies and uploads those bytes, reads back every public image digest,
+then allows release references and GitHub Release evidence to converge.
+
+## Candidate contract
+
+Publish exactly one `oci-family.json` alongside OCI layouts and smoke JSON files
+in the Build artifact. Import `sealOciPublicationBundle` from
+`@kungfu-tech/buildchain/oci-publication` to validate and seal the family. Its
+`body` contains:
+
+- `schema: kungfu-buildchain-oci-family/v1`, consumer `repository`, exact Git
+  `sourceSha`, and candidate package `version`.
+- `expectedImages`: the complete set of image names.
+- `images`: one entry for each expected image, with `name`, `repository`,
+  `digest`, `layout`, `platform`, `action`, `content`, and `smoke`.
+
+Destinations must be `ghcr.io/<consumer-owner>/<consumer-repo>/<image-name>`.
+`layout` is a relative OCI layout directory. Each image is a single Linux
+amd64 or arm64 manifest; OCI and Docker schema 2 manifests are supported.
+Layouts may share blobs and an index; each shared index entry identifies its
+image with the `org.opencontainers.image.ref.name` annotation.
+
+`content` records the image's original `sourceSha` and `version`, matching its
+OCI revision/version labels. For `action: built`, both equal the candidate.
+For `action: reused`, they retain the original content provenance while the
+family binds the current candidate. `smoke` records a relative `path` and SHA256
+`sha256`; its JSON must identify the image and record `passed: true`. The
+consumer owns the actual smoke command and must fail the build if it fails.
+
+Sealing verifies all config/layer sizes and digests, platform and provenance
+labels, smoke bytes, and family completeness. Absolute paths, traversal, and
+symlinks are rejected. The resolver derives the exact required image artifacts
+from this sealed family, including when recovering a previous candidate run.
+
+## Authority and publication
+
+The thin caller grants `packages: write` in addition to its existing promotion
+permissions. Reusable promotion wrappers inherit that caller envelope; npm
+consumers do not need to request package registry authority. The provider uses
+the action token only for GHCR, scoped to each declared consumer image.
+No consumer publish command is executed.
+
+The rooted product plan declares version-state materialization, OCI family
+publication, then release reference convergence. Each image uses the exact
+`v<version>` tag. A different existing digest aborts publication; a matching
+existing image is reused. After a partial failure, recovery validates the same
+candidate bytes and publishes only missing images. GHCR does not provide tag
+compare-and-swap: callers must serialize publishers for a version, and external
+writers must not race the publication workflow.
+
+Success requires anonymous readback of every declared image at its expected
+digest. Existing GHCR packages must permit the repository token to write and
+anonymous clients to pull. The provider does not change package visibility or
+access policy. It attaches `oci-publication-readback.json` to the GitHub Release;
+the caller should also include the family and smoke JSON files in
+`github-release-payload-patterns`.
+
+See [Runtime Train Validation](runtime-train-validation.md) for testing an
+unreleased runtime without persisting a train or exact SHA in the workflow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.43",
+  "version": "4.0.2-alpha.45",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -123,7 +123,8 @@
     "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
     "./site/release-provenance.json": "./dist/site/release-provenance.json",
     "./site/agent-index.json": "./dist/site/agent-index.json",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./oci-publication": "./packages/core/oci-publication-bundle.js"
   },
   "files": [
     "AGENTS.md",