@kungfu-tech/buildchain 4.0.2-alpha.44 → 4.0.2-alpha.46

package/dist/site/public-surface-audit.json

@@ -6,7 +6,7 @@
     "cliCommandCount": 117,
     "workflowCount": 114,
     "actionCount": 8,
-    "sitePageCount": 87,
+    "sitePageCount": 88,
     "docCommandRefCount": 1050,
     "failureCount": 0
   },
@@ -5518,6 +5518,10 @@
         "id": "manual:observed-evidence-patrol",
         "category": "manual"
       },
+      {
+        "id": "manual:oci-publication",
+        "category": "manual"
+      },
       {
         "id": "manual:ownership",
         "category": "manual"
@@ -10929,8 +10933,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "6391219ad0dae43ff217202a74a7e3d45669799cd142d590e9f0bafecaeb9912",
-    "pageRegistryDigest": "de1ba89591aeb5f0e24f1c5e455c21e8477e1094ec616ffddc2c1163f02c53b9"
+    "workflowRegistryDigest": "cc88d63b25d61394b3bbc28cb81b72f3c7786d85bf7c5f68ab6baa426b9a552b",
+    "pageRegistryDigest": "6c4a4be1b2bc15c7842aa958b128f76ec405b9585f403e5cc604c16781a40afc"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -1356,10 +1356,7 @@
     },
     {
       "path": ".github/workflows/.release-candidate-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -1374,10 +1371,7 @@
     },
     {
       "path": ".github/workflows/.release-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -1723,10 +1717,7 @@
     },
     {
       "path": ".github/workflows/public-release-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -1768,10 +1759,7 @@
     },
     {
       "path": ".github/workflows/release-candidate-promote.yml",
-      "signals": [
-        "write-permission",
-        "oidc"
-      ],
+      "signals": [],
       "classified": true
     },
     {
@@ -2021,5 +2009,5 @@
       "classified": true
     }
   ],
-  "registryDigest": "894cce314366698d41a3ab20172a0b7a05f03f2167667eae51793537b832c811"
+  "registryDigest": "9c343ae9f9e778b608317d973b02cada327bd31e5149482d7f385b173c20ec14"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-06T13:21:07.000Z",
-  "publishedAt": "2026-09-06T13:21:07.000Z",
+  "generatedAt": "2026-09-06T15:52:10.000Z",
+  "publishedAt": "2026-09-06T15:52:10.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "cf1b8e029ee3ef8b615cfc3c3814cfc8b7bf3c5c",
+  "sourceRevision": "53db887810f830c27680040bc35969238b5d2a88",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.44",
+    "version": "4.0.2-alpha.46",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -120,7 +120,8 @@
       "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
       "./site/release-provenance.json": "./dist/site/release-provenance.json",
       "./site/agent-index.json": "./dist/site/agent-index.json",
-      "./package.json": "./package.json"
+      "./package.json": "./package.json",
+      "./oci-publication": "./packages/core/oci-publication-bundle.js"
     }
   },
   "repository": "https://github.com/kungfu-systems/buildchain",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-06T13:21:07.000Z",
-  "publishedAt": "2026-09-06T13:21:07.000Z",
+  "generatedAt": "2026-09-06T15:52:10.000Z",
+  "publishedAt": "2026-09-06T15:52:10.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "cf1b8e029ee3ef8b615cfc3c3814cfc8b7bf3c5c",
+  "sourceRevision": "53db887810f830c27680040bc35969238b5d2a88",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.44",
+    "version": "4.0.2-alpha.46",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:aef677bb3e37882f73daf65b7052989fc549e3b40d70bc4036beb2738b608345"
+      "digest": "sha256:af7bee38e21a9ada99e1731f3576733f2897f9d19bdbf39eb2781650095ae419"
     },
     {
       "id": "getting-started",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:df073c14c12f15c851eb4507cbeb2919add936ac3079b10f222478138720d092"
+      "digest": "sha256:69f4e87e7cbf154f4b3241269e806e7998f9a517fb8ada64f120239c49abbd78"
     },
     {
       "id": "build-facts",
@@ -309,7 +309,7 @@
       "path": "docs/publish-transaction.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:635de0da30769e4e6f956748ec9758338a1ae7921bce73268c2d914ae240693d"
+      "digest": "sha256:713f4fd2b9e67cefdd394170eea49ddb92e803c2e6adac20d6f3b8b1e431b960"
     },
     {
       "id": "release-tail-contract",

package/dist/site/workflow-registry.json

@@ -2746,7 +2746,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.44",
+      "introducedVersion": "4.0.2-alpha.46",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -3943,7 +3943,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.44",
+      "introducedVersion": "4.0.2-alpha.46",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5970,7 +5970,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.44",
+      "introducedVersion": "4.0.2-alpha.46",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6001,7 +6001,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.44",
+      "introducedVersion": "4.0.2-alpha.46",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6032,7 +6032,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.44",
+      "introducedVersion": "4.0.2-alpha.46",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/MAP.md

@@ -38,6 +38,7 @@ running artifact), *use* (consume / extend) - and a **status**:
 | CLI operator or agent | [Generated CLI Reference](cli-reference.md) | [CLI guide](cli.md) for concepts and worked examples |
 | Node toolkit developer | [Generated Node API Reference](node-api-reference.md) | [Core package guide](../packages/core/README.md) for recipes |
 | Workflow contributor | [Workflow Catalog](workflow-catalog.md) | [Contribution rules](../CONTRIBUTING.md#workflow-organization) and the [exact registry](../architecture/workflow-taxonomy.json) |
+| Container image publisher | [OCI image family publication](oci-publication.md) | [Release Flow](release-flow.md) and [Runtime Train Validation](runtime-train-validation.md) |
 | Build/release operator | [Reusable Build Surface](reusable-build-surface.md) | [Release Flow](release-flow.md) and [Release Passport](release-passport.md) |
 | Product/trust reviewer | [Product Mechanism](product-mechanism.md) | [Release Passport](release-passport.md) and [KFD Support](kfd-support.md) |
 

package/docs/node-api-reference.md

@@ -233,7 +233,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `createPublicationControlPlaneAudit` | function: function createPublicationControlPlaneAudit({ repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {}) | { repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationControlPlaneAudit } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:208` |
 | `createPublicationGateDecision` | function: function createPublicationGateDecision({ sourceSha, profile, required = false, rationale, policy = {}, } = {}) | { sourceSha, profile, required = false, rationale, policy = {}, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationGateDecision } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:280` |
 | `createPublicationQualificationReceipt` | function: function createPublicationQualificationReceipt({ capability, gateAggregate, consumerDecision, now = new Date(), } = {}) | { capability, gateAggregate, consumerDecision, now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationQualificationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:1035` |
-| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:84` |
+| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:97` |
 | `createPublicationSourceBundle` | function: function createPublicationSourceBundle({ cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {}) | { cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { createPublicationSourceBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-artifact.js:249` |
 | `createReadmeBadgeEndpointRegistry` | function: function createReadmeBadgeEndpointRegistry({ kfdSpecs = undefined, kfdStandards = undefined } = {}) | { kfdSpecs = undefined, kfdStandards = undefined } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createReadmeBadgeEndpointRegistry } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:133` |
 | `createReleaseActivationReceiptSet` | function: function createReleaseActivationReceiptSet({ transaction, receipts = [], } = {}) | { transaction, receipts = [], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createReleaseActivationReceiptSet } from "@kungfu-tech/buildchain";` | `packages/core/release-activation-transaction.js:311` |
@@ -456,7 +456,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `PUBLICATION_NPM_PACKAGE_CONTRACT` | constant: const PUBLICATION_NPM_PACKAGE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_NPM_PACKAGE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication-package.js:6` |
 | `PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT` | constant: const PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:22` |
 | `PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT` | constant: const PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication-reproducibility.js:12` |
-| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:10` |
+| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:11` |
 | `publicationArtifactCandidateDigest` | function: function publicationArtifactCandidateDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { publicationArtifactCandidateDigest } from "@kungfu-tech/buildchain";` | `packages/core/publication-artifact-candidate.js:19` |
 | `publicationAuthorityDigest` | function: function publicationAuthorityDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { publicationAuthorityDigest } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:72` |
 | `publicationGateAggregateBindings` | function: function publicationGateAggregateBindings(gateAggregate) | gateAggregate | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { publicationGateAggregateBindings } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:408` |
@@ -639,7 +639,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `verifyPublicationAdmission` | function: function verifyPublicationAdmission({ admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {}) | { admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationAdmission } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:791` |
 | `verifyPublicationQualificationReceipt` | function: function verifyPublicationQualificationReceipt({ receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {}) | { receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationQualificationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:1096` |
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain";` | `packages/core/publication-reproducibility.js:869` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:133` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:189` |
 | `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:444` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain";` | `packages/core/release-passport.js:2729` |
 | `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:486` |
@@ -922,7 +922,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `createPublicationControlPlaneAudit` | function: function createPublicationControlPlaneAudit({ repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {}) | { repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationControlPlaneAudit } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:208` |
 | `createPublicationGateDecision` | function: function createPublicationGateDecision({ sourceSha, profile, required = false, rationale, policy = {}, } = {}) | { sourceSha, profile, required = false, rationale, policy = {}, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationGateDecision } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:280` |
 | `createPublicationQualificationReceipt` | function: function createPublicationQualificationReceipt({ capability, gateAggregate, consumerDecision, now = new Date(), } = {}) | { capability, gateAggregate, consumerDecision, now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationQualificationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:1035` |
-| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:84` |
+| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:97` |
 | `createPublicationSourceBundle` | function: function createPublicationSourceBundle({ cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {}) | { cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { createPublicationSourceBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-artifact.js:249` |
 | `createReadmeBadgeEndpointRegistry` | function: function createReadmeBadgeEndpointRegistry({ kfdSpecs = undefined, kfdStandards = undefined } = {}) | { kfdSpecs = undefined, kfdStandards = undefined } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createReadmeBadgeEndpointRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:133` |
 | `createReleaseActivationReceiptSet` | function: function createReleaseActivationReceiptSet({ transaction, receipts = [], } = {}) | { transaction, receipts = [], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createReleaseActivationReceiptSet } from "@kungfu-tech/buildchain/core";` | `packages/core/release-activation-transaction.js:311` |
@@ -1145,7 +1145,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `PUBLICATION_NPM_PACKAGE_CONTRACT` | constant: const PUBLICATION_NPM_PACKAGE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_NPM_PACKAGE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-package.js:6` |
 | `PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT` | constant: const PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:22` |
 | `PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT` | constant: const PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-reproducibility.js:12` |
-| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:10` |
+| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:11` |
 | `publicationArtifactCandidateDigest` | function: function publicationArtifactCandidateDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { publicationArtifactCandidateDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-artifact-candidate.js:19` |
 | `publicationAuthorityDigest` | function: function publicationAuthorityDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { publicationAuthorityDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:72` |
 | `publicationGateAggregateBindings` | function: function publicationGateAggregateBindings(gateAggregate) | gateAggregate | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { publicationGateAggregateBindings } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:408` |
@@ -1328,7 +1328,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `verifyPublicationAdmission` | function: function verifyPublicationAdmission({ admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {}) | { admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationAdmission } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:791` |
 | `verifyPublicationQualificationReceipt` | function: function verifyPublicationQualificationReceipt({ receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {}) | { receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationQualificationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:1096` |
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-reproducibility.js:869` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:133` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:189` |
 | `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:444` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain/core";` | `packages/core/release-passport.js:2729` |
 | `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:486` |
@@ -2315,9 +2315,9 @@ Target: `./packages/core/publication-sealed-bundle.js`. Public symbols: 3.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:84` |
-| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:10` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:133` |
+| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:97` |
+| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:11` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:189` |
 
 ## `@kungfu-tech/buildchain/paper`
 
@@ -2569,10 +2569,10 @@ Target: `./packages/core/next-development-transition.js`. Public symbols: 13.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `advanceNextDevelopmentTransition` | function: function advanceNextDevelopmentTransition(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { advanceNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:344` |
-| `bindNextDevelopmentAnchor` | function: function bindNextDevelopmentAnchor(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { bindNextDevelopmentAnchor } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:305` |
-| `createNextDevelopmentTransition` | function: function createNextDevelopmentTransition(input = {}) | input = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:253` |
-| `materializeNextDevelopmentTransition` | function: function materializeNextDevelopmentTransition({ cwd = process.cwd(), request, write = false, } = {}) | { cwd = process.cwd(), request, write = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { materializeNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:472` |
+| `advanceNextDevelopmentTransition` | function: function advanceNextDevelopmentTransition(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { advanceNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:343` |
+| `bindNextDevelopmentAnchor` | function: function bindNextDevelopmentAnchor(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { bindNextDevelopmentAnchor } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:304` |
+| `createNextDevelopmentTransition` | function: function createNextDevelopmentTransition(input = {}) | input = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:252` |
+| `materializeNextDevelopmentTransition` | function: function materializeNextDevelopmentTransition({ cwd = process.cwd(), request, write = false, } = {}) | { cwd = process.cwd(), request, write = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { materializeNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:471` |
 | `NEXT_DEVELOPMENT_ADR` | constant: const NEXT_DEVELOPMENT_ADR | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_ADR } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:20` |
 | `NEXT_DEVELOPMENT_INVARIANT` | constant: const NEXT_DEVELOPMENT_INVARIANT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_INVARIANT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:22` |
 | `NEXT_DEVELOPMENT_REQUEST_CONTRACT` | constant: const NEXT_DEVELOPMENT_REQUEST_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_REQUEST_CONTRACT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:18` |
@@ -2580,8 +2580,8 @@ Target: `./packages/core/next-development-transition.js`. Public symbols: 13.
 | `NEXT_DEVELOPMENT_TRANSITION_CONTRACT` | constant: const NEXT_DEVELOPMENT_TRANSITION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_TRANSITION_CONTRACT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:16` |
 | `NEXT_DEVELOPMENT_VERSION_MODELS` | constant: const NEXT_DEVELOPMENT_VERSION_MODELS | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_VERSION_MODELS } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:32` |
 | `nextDevelopmentRoot` | function: function nextDevelopmentRoot(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { nextDevelopmentRoot } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:63` |
-| `recordNextDevelopmentMaterialization` | function: function recordNextDevelopmentMaterialization(record, { materialization, evidenceRoot, recordedAt } = {}) | record, { materialization, evidenceRoot, recordedAt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordNextDevelopmentMaterialization } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:416` |
-| `validateNextDevelopmentTransition` | function: function validateNextDevelopmentTransition(record) | record | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:729` |
+| `recordNextDevelopmentMaterialization` | function: function recordNextDevelopmentMaterialization(record, { materialization, evidenceRoot, recordedAt } = {}) | record, { materialization, evidenceRoot, recordedAt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordNextDevelopmentMaterialization } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:415` |
+| `validateNextDevelopmentTransition` | function: function validateNextDevelopmentTransition(record) | record | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:728` |
 
 ## `@kungfu-tech/buildchain/next-development-controller`
 
@@ -2832,3 +2832,14 @@ Target: `./packages/core/buildchain-kfd-claims.js`. Public symbols: 10.
 | `createBuildchainKfdClaimRegistry` | function: function createBuildchainKfdClaimRegistry({ root = process.cwd(), sourceSha = "" } = {}) | { root = process.cwd(), sourceSha = "" } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdClaimRegistry } from "@kungfu-tech/buildchain/buildchain-kfd-claims";` | `packages/core/buildchain-kfd-claims.js:510` |
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain/buildchain-kfd-claims";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain/buildchain-kfd-claims";` | `packages/core/buildchain-kfd-claims.js:226` |
+
+## `@kungfu-tech/buildchain/oci-publication`
+
+Target: `./packages/core/oci-publication-bundle.js`. Public symbols: 4.
+
+| Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| `OCI_FAMILY_SCHEMA` | constant: const OCI_FAMILY_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { OCI_FAMILY_SCHEMA } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:6` |
+| `ociBundleFile` | function: function ociBundleFile(root, relative) | root, relative | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { ociBundleFile } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:29` |
+| `sealOciPublicationBundle` | function: function sealOciPublicationBundle({ bundleRoot, body }) | { bundleRoot, body } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { sealOciPublicationBundle } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:10` |
+| `verifyOciPublicationBundle` | function: function verifyOciPublicationBundle({ bundleRoot, manifest, repository, sourceSha, version, }) | { bundleRoot, manifest, repository, sourceSha, version, } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyOciPublicationBundle } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:114` |

package/docs/oci-publication.md

@@ -0,0 +1,82 @@
+---
+status: draft
+period: ongoing
+theme: oci-publication
+doc_type: technical-reference
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-06
+ai_provenance:
+  model_family: GPT-6
+  product: Codex
+  generated_at: 2026-09-06
+  invisible_context_boundary: No credentials or production registry state inspected.
+---
+
+# OCI image family publication
+
+Buildchain v4 can publish a sealed family of container images to GHCR through
+`publish-artifact-kind: oci` on the public release candidate promotion workflow.
+The candidate build produces the image bytes and smoke evidence. The built-in
+provider verifies and uploads those bytes, reads back every public image digest,
+then allows release references and GitHub Release evidence to converge.
+
+## Candidate contract
+
+Publish exactly one `oci-family.json` alongside OCI layouts and smoke JSON files
+in the Build artifact. Import `sealOciPublicationBundle` from
+`@kungfu-tech/buildchain/oci-publication` to validate and seal the family. Its
+`body` contains:
+
+- `schema: kungfu-buildchain-oci-family/v1`, consumer `repository`, exact Git
+  `sourceSha`, and candidate package `version`.
+- `expectedImages`: the complete set of image names.
+- `images`: one entry for each expected image, with `name`, `repository`,
+  `digest`, `layout`, `platform`, `action`, `content`, and `smoke`.
+
+Destinations must be `ghcr.io/<consumer-owner>/<consumer-repo>/<image-name>`.
+`layout` is a relative OCI layout directory. Each image is a single Linux
+amd64 or arm64 manifest; OCI and Docker schema 2 manifests are supported.
+Layouts may share blobs and an index; each shared index entry identifies its
+image with the `org.opencontainers.image.ref.name` annotation.
+
+`content` records the image's original `sourceSha` and `version`, matching its
+OCI revision/version labels. For `action: built`, both equal the candidate.
+For `action: reused`, they retain the original content provenance while the
+family binds the current candidate. `smoke` records a relative `path` and SHA256
+`sha256`; its JSON must identify the image and record `passed: true`. The
+consumer owns the actual smoke command and must fail the build if it fails.
+
+Sealing verifies all config/layer sizes and digests, platform and provenance
+labels, smoke bytes, and family completeness. Absolute paths, traversal, and
+symlinks are rejected. The resolver derives the exact required image artifacts
+from this sealed family, including when recovering a previous candidate run.
+
+## Authority and publication
+
+The thin caller grants `packages: write` in addition to its existing promotion
+permissions. Reusable promotion wrappers inherit that caller envelope; npm
+consumers do not need to request package registry authority. The provider uses
+the action token only for GHCR, scoped to each declared consumer image.
+No consumer publish command is executed.
+
+The rooted product plan declares version-state materialization, OCI family
+publication, then release reference convergence. Each image uses the exact
+`v<version>` tag. A different existing digest aborts publication; a matching
+existing image is reused. After a partial failure, recovery validates the same
+candidate bytes and publishes only missing images. GHCR does not provide tag
+compare-and-swap: callers must serialize publishers for a version, and external
+writers must not race the publication workflow.
+
+Success requires anonymous readback of every declared image at its expected
+digest. Existing GHCR packages must permit the repository token to write and
+anonymous clients to pull. The provider does not change package visibility or
+access policy. It attaches `oci-publication-readback.json` to the GitHub Release;
+the caller should also include the family and smoke JSON files in
+`github-release-payload-patterns`.
+
+See [Runtime Train Validation](runtime-train-validation.md) for testing an
+unreleased runtime without persisting a train or exact SHA in the workflow.

package/docs/publish-transaction.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-08-06
+last_reviewed: 2026-09-06
 ai_provenance:
-  model_family: GPT-5
+  model_family: GPT-6
   product: Codex
-  generated_at: 2026-07-31
+  generated_at: 2026-09-06
   invisible_context: not asserted
 ---
 
@@ -113,6 +113,39 @@ a missing or different id fails before provider mutation. An absent transaction
 is created only when no expected existing identity was requested. See
 [Release Candidate: Resume from an existing candidate run](release-candidate.md#resume-from-an-existing-candidate-run).
 
+## V4 sealed npm package sets
+
+The v4 alpha provider accepts a sealed set of 2–64 npm tarballs with one main
+package and same-version platform packages. The candidate resolver records each
+package's name, version, role, relative path, size, SHA-256, and npm integrity in
+the candidate root. QUALIFY passes the set into the Rust/WASM publication
+planner, which binds every package to its own operation and orders platform
+packages by name before the main package. A single package retains the existing
+operation identity.
+
+Use `publish-package-main` to name the main package. The optional
+`publish-package-set-order: platforms-first-main-last` input states the same
+ordering. Omit legacy `publish-mode` and `publish-command` inputs: the v4 provider
+publishes the sealed tarballs through npm trusted publishing. It does not run a
+consumer publish command.
+
+Before any provider effect, APPLY checks the complete package inventory,
+tarball package identities, bytes, and integrity against the rooted intent.
+Each package receives independent registry readback and a Release Tail receipt.
+After an interrupted attempt, existing matching versions are observed without
+republishing; conflicting integrity stops the transaction. Release refs follow
+only after every package is confirmed.
+
+Anchored alpha versions such as `22.22.3-kf.5-alpha.4` remain unchanged. For
+`anchored/manual` repositories, successful publication leaves next development
+in `waiting-anchor`; it does not invent the next upstream anchor. Multi-package
+stable rematerialization is not supported by this provider and fails before
+publication. The existing singleton stable flow remains available.
+
+The contract is exercised by `v4-product-publication-topology.test.mjs`,
+`v4-product-provider-adapters.test.mjs`, and
+`v4-alpha-next-development-provider.test.mjs` under `tests/`.
+
 ## Lifecycle
 
 Repositories declare publish work in `.buildchain/buildchain.toml`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.44",
+  "version": "4.0.2-alpha.46",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -123,7 +123,8 @@
     "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
     "./site/release-provenance.json": "./dist/site/release-provenance.json",
     "./site/agent-index.json": "./dist/site/agent-index.json",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./oci-publication": "./packages/core/oci-publication-bundle.js"
   },
   "files": [
     "AGENTS.md",

package/packages/core/next-development-transition.js

@@ -159,15 +159,14 @@ function normalizeModel(value = {}) {
   return model;
 }
 
-function normalizeCompletedAlpha(value = {}) {
+function normalizeCompletedAlpha(value = {}, model) {
   const version = String(value.version || "").trim();
-  if (!ALPHA.test(version))
+  const expression = model?.strategy === "anchored" ? /-alpha\.(0|[1-9]\d*)$/u : ALPHA;
+  if (!SEMVER.test(version) || !expression.test(version))
     throw new Error("completedAlpha.version must be an alpha semantic version");
   const exactTag = String(value.exactTag || "").trim();
   if (exactTag !== `v${version}`)
-    throw new Error(
-      "completedAlpha.exactTag must match completedAlpha.version",
-    );
+    throw new Error("completedAlpha.exactTag must match completedAlpha.version");
   const normalized = {
     outcome: String(value.outcome || "").trim(),
     version,
@@ -251,8 +250,8 @@ function initialStateRoot(status, idempotencyKey) {
 }
 
 export function createNextDevelopmentTransition(input = {}) {
-  const completedAlpha = normalizeCompletedAlpha(input.completedAlpha);
   const model = normalizeModel(input.model);
+  const completedAlpha = normalizeCompletedAlpha(input.completedAlpha, model);
   const adapter = normalizeAdapter(input);
   const declaredPaths = [
     ...adapter.sourcePaths,