@kungfu-tech/buildchain 4.1.3-alpha.2 → 4.1.3-alpha.3

package/architecture/release-topology.json

@@ -14,6 +14,7 @@
       ".github/workflows/.release-authority.yml",
       ".github/workflows/.release-binary-assets.yml",
       ".github/workflows/.release-pipeline-products.yml",
+      ".github/workflows/.release-pipeline-version.yml",
       ".github/workflows/.release-promote.yml",
       ".github/workflows/build.yml",
       ".github/workflows/public-build-demo.yml",
@@ -116,7 +117,8 @@
         "packages/core/release/next-development/actions.js",
         "packages/core/publication/oci/preview-actions.js",
         "packages/core/publication/settlement/actions.js",
-        "packages/core/publication/pipeline/actions.js"
+        "packages/core/publication/pipeline/actions.js",
+        "packages/core/publication/pipeline/version-actions.js"
       ],
       "modules": [
         "packages/core/adoption/kfd-adopter-manifest.js",
@@ -134,6 +136,7 @@
         "packages/core/consumer/contract/identity.js",
         "packages/core/consumer/contract/plan.js",
         "packages/core/consumer/contract/products.js",
+        "packages/core/consumer/contract/reader.js",
         "packages/core/consumer/contract/shape.js",
         "packages/core/consumer/floating-consumer-evidence.js",
         "packages/core/consumer/floating-consumer-policy.js",
@@ -189,14 +192,19 @@
         "packages/core/providers/github/discussions/transport.js",
         "packages/core/providers/github/graphql-errors.js",
         "packages/core/providers/github/json-client.js",
+        "packages/core/providers/github/pipeline-entry-runs.js",
         "packages/core/providers/github/pipeline-integration.js",
         "packages/core/providers/github/pipeline-policy.js",
         "packages/core/providers/github/pipeline-product-payload.js",
         "packages/core/providers/github/pipeline-product-release.js",
         "packages/core/providers/github/pipeline-publication-artifacts.js",
+        "packages/core/providers/github/pipeline-release-evidence.js",
         "packages/core/providers/github/pipeline-run-entry.js",
         "packages/core/providers/github/pipeline-runs.js",
         "packages/core/providers/github/pipeline-source.js",
+        "packages/core/providers/github/pipeline-stable-source.js",
+        "packages/core/providers/github/pipeline-version-artifacts.js",
+        "packages/core/providers/github/pipeline-version-readback.js",
         "packages/core/providers/github/pipeline-version.js",
         "packages/core/providers/github/pipeline-worker.js",
         "packages/core/providers/github/release-assets.js",
@@ -258,7 +266,19 @@
         "packages/core/publication/pipeline/settle.js",
         "packages/core/publication/pipeline/signing.js",
         "packages/core/publication/pipeline/source-plan.js",
+        "packages/core/publication/pipeline/stable-entry.js",
+        "packages/core/publication/pipeline/stable-products.js",
+        "packages/core/publication/pipeline/stable-wait.js",
+        "packages/core/publication/pipeline/stable.js",
+        "packages/core/publication/pipeline/version-actions.js",
+        "packages/core/publication/pipeline/version-build.js",
+        "packages/core/publication/pipeline/version-context.js",
+        "packages/core/publication/pipeline/version-material.js",
+        "packages/core/publication/pipeline/version-preparation.js",
+        "packages/core/publication/pipeline/version-regeneration.js",
+        "packages/core/publication/pipeline/version-source-guard.js",
         "packages/core/publication/pipeline/version.js",
+        "packages/core/publication/pipeline/worker.js",
         "packages/core/publication/publication-artifact-candidate.js",
         "packages/core/publication/publication-authority.js",
         "packages/core/publication/publication-development.js",
@@ -345,6 +365,7 @@
         "packages/core/release/release-tail-provider-plane.js",
         "packages/core/release/release-train.js",
         "packages/core/release/reuse-complete-release.js",
+        "packages/core/release/stable-release-gate.js",
         "packages/core/release/version-state.js",
         "packages/core/release/version-state/verification.js",
         "packages/core/runtime/action-process.mjs",
@@ -389,7 +410,7 @@
         "packages/core/workflow/pipeline/wake.js",
         "packages/core/workflow/pipeline/web-status.js"
       ],
-      "root": "sha256:c043e16d6f8995cbecbdaa3d24466b47c9624bee0b7227c0e1842f37138b2508"
+      "root": "sha256:5d735b6117bdc114550e736cec02b396e51a3cc284d59d704e906ae8aaceb7c1"
     },
     "rustWasmAuthority": {
       "loader": "packages/core/runtime/domain-wasm.js",
@@ -529,11 +550,11 @@
       }
     ],
     "metrics": {
-      "workflowCount": 38,
-      "jobCount": 111,
-      "reusableEdgeCount": 24,
-      "mutationRelevantNodeCount": 73,
-      "contentsWriteJobCount": 34,
+      "workflowCount": 39,
+      "jobCount": 116,
+      "reusableEdgeCount": 26,
+      "mutationRelevantNodeCount": 77,
+      "contentsWriteJobCount": 38,
       "oidcWriteJobCount": 25
     },
     "semanticMetrics": {
@@ -590,15 +611,16 @@
       ".github/workflows/.release-pipeline-products.yml",
       ".github/workflows/public-ops-pipeline.yml",
       ".github/workflows/public-ops-recover.yml",
-      ".github/workflows/.ops-pipeline-execute.yml"
+      ".github/workflows/.ops-pipeline-execute.yml",
+      ".github/workflows/.release-pipeline-version.yml"
     ],
     "authority": "retained-protected-source-qualified-sealed-products-and-live-provider-readback",
     "maximumMetrics": {
-      "workflowCount": 4,
-      "jobCount": 16,
-      "reusableEdgeCount": 4,
-      "mutationRelevantNodeCount": 12,
-      "contentsWriteJobCount": 12,
+      "workflowCount": 5,
+      "jobCount": 21,
+      "reusableEdgeCount": 6,
+      "mutationRelevantNodeCount": 16,
+      "contentsWriteJobCount": 16,
       "oidcWriteJobCount": 6
     },
     "observedTopology": {
@@ -616,13 +638,18 @@
           "path": ".github/workflows/.release-pipeline-products.yml",
           "triggers": ["workflow_call"],
           "jobs": [
-            "apply|runner|-|write|write|-|contents-write,oidc-write",
+            "apply|runner|-|write|write|jobOutput|contents-write,oidc-write",
             "build|runner|-|read|-|-|-",
+            "development|reusable-call|./.github/workflows/.release-pipeline-version.yml|write|-|-|contents-write",
+            "materialize|reusable-call|./.github/workflows/.release-pipeline-version.yml|write|-|-|contents-write",
             "prepare|runner|-|write|-|jobOutput|contents-write",
             "qualify|runner|-|write|write|-|contents-write,oidc-write",
-            "settle|runner|-|write|write|-|contents-write,oidc-write"
+            "settle|runner|-|write|write|jobOutput|contents-write,oidc-write"
           ],
-          "reusableEdges": []
+          "reusableEdges": [
+            "./.github/workflows/.release-pipeline-version.yml",
+            "./.github/workflows/.release-pipeline-version.yml"
+          ]
         },
         {
           "path": ".github/workflows/public-ops-pipeline.yml",
@@ -652,26 +679,36 @@
             "delivery|reusable-call|./.github/workflows/.ops-pipeline-delivery.yml|write|-|-|contents-write",
             "publication|reusable-call|./.github/workflows/.release-pipeline-products.yml|write|write|-|contents-write,oidc-write",
             "record-build|runner|-|write|-|-|contents-write",
-            "record-delivery|runner|-|write|-|-|contents-write"
+            "record-delivery|runner|-|write|-|-|contents-write",
+            "stable-recheck|runner|-|write|-|-|contents-write"
           ],
           "reusableEdges": [
             "./.github/workflows/.ops-pipeline-delivery.yml",
             "./.github/workflows/.release-pipeline-products.yml"
           ]
+        },
+        {
+          "path": ".github/workflows/.release-pipeline-version.yml",
+          "triggers": ["workflow_call"],
+          "jobs": [
+            "build|runner|-|read|-|-|-",
+            "materialize|runner|-|write|-|jobOutput|contents-write"
+          ],
+          "reusableEdges": []
         }
       ],
       "metrics": {
-        "workflowCount": 4,
-        "jobCount": 16,
-        "reusableEdgeCount": 4,
-        "mutationRelevantNodeCount": 12,
-        "contentsWriteJobCount": 12,
+        "workflowCount": 5,
+        "jobCount": 21,
+        "reusableEdgeCount": 6,
+        "mutationRelevantNodeCount": 16,
+        "contentsWriteJobCount": 16,
         "oidcWriteJobCount": 6
       },
       "semanticMetrics": {
-        "workflowCount": 4,
-        "mutationRelevantNodeCount": 12,
-        "contentsWriteJobCount": 8,
+        "workflowCount": 5,
+        "mutationRelevantNodeCount": 16,
+        "contentsWriteJobCount": 10,
         "oidcWriteJobCount": 3
       }
     }

package/architecture/universal-workflow-bootstrap.json

@@ -121,6 +121,7 @@
     ".github/workflows/.release-authority.yml",
     ".github/workflows/.release-binary-assets.yml",
     ".github/workflows/.release-pipeline-products.yml",
+    ".github/workflows/.release-pipeline-version.yml",
     ".github/workflows/.release-promote.yml",
     ".github/workflows/build.yml",
     ".github/workflows/public-build-adopter-qualification.yml",
@@ -168,6 +169,7 @@
     ".github/workflows/.release-authority.yml",
     ".github/workflows/.release-binary-assets.yml",
     ".github/workflows/.release-pipeline-products.yml",
+    ".github/workflows/.release-pipeline-version.yml",
     ".github/workflows/.release-promote.yml",
     ".github/workflows/build.yml",
     ".github/workflows/public-build-adopter-qualification.yml",

package/architecture/universal-workflow-capability-policy.json

@@ -59,7 +59,7 @@
     "sha256:dd9ae24a7a586c616a7b3b2b733eb38bfd3f8b19e5faec9e16851719be6abd61",
     "sha256:deee1c61c9731de6e2120abd4c30d3ce760df2ff3f7afb4dd84973543b353660",
     "sha256:e207436baa946b3d25d0159a510b7da474cac8d33701c2e66c089117c05f473d",
-    "sha256:f1ddf715b9524abd78eddabfd20cc73a9e22453d3736a30b30203cdfe1687650",
+    "sha256:e42c7878242188da76b146480ae7b1d1cc454eb93942d2071e97e458b2c12e2f",
     "sha256:f780070e235bffdee96fc355d7ed5e2fd4188482c41b24e2558a32086634a87c"
   ],
   "validFrom": "2026-08-30T00:00:00.000Z",

package/architecture/workflow-taxonomy.json

@@ -797,6 +797,17 @@
       "status": "active",
       "invocation": "reusable",
       "rationale": "Share credentialless product execution and protected delivery between normal and recovery public entries."
+    },
+    {
+      "id": ".pipeline-version",
+      "role": "component",
+      "category": "release",
+      "purpose": "pipeline-version",
+      "summary": "Internal pipeline version preparation",
+      "owner": "kungfu-origin",
+      "status": "active",
+      "invocation": "reusable",
+      "rationale": "Regenerate declared version material in credentialless product jobs and independently qualify it before publication or protected next-development Git writes."
     }
   ]
 }

package/dist/readers/business-attempt.cjs

@@ -366,7 +366,7 @@ function pipelineIntent({
     source: { kind: "pipeline", repositoryId, pullRequest, targetBranch }
   });
 }
-function sourceGeneration(intent, source, baseCommit) {
+function validateConsumerSource(source, repository) {
   object(
     source,
     [
@@ -382,12 +382,16 @@ function sourceGeneration(intent, source, baseCommit) {
     [],
     "source"
   );
-  if (source.schema !== "buildchain.consumer-source/v1" || source.contract !== CONSUMER_CONTRACT || source.repository !== intent.repository)
+  if (source.schema !== "buildchain.consumer-source/v1" || source.contract !== CONSUMER_CONTRACT || source.repository !== repository)
     throw new Error("Generation requires the admitted consumer source");
   for (const key of ["commit", "tree", "configBlob"])
     text(source[key], `source.${key}`, /^[0-9a-f]{40}$/u);
   relativePath(source.configPath, "source.configPath");
   text(source.configDigest, "source.configDigest", ROOT);
+  return source;
+}
+function sourceGeneration(intent, source, baseCommit) {
+  validateConsumerSource(source, intent.repository);
   text(baseCommit, "baseCommit", /^[0-9a-f]{40}$/u);
   const value = {
     schema: SOURCE_GENERATION,

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.1.3-alpha.2",
+    "version": "4.1.3-alpha.3",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -987,7 +987,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:322840eda7f9e9bd33ab1007bd8a2a4714631792e6fd6fe4672591f3a721f47d"
+      "auditDigest": "sha256:6b99a17ba7daa7c1827aa4ec7c09fa257a83f6d2d757c792b7a8ad6f715ea3a5"
     },
     {
       "contractVersion": 1,
@@ -1009,7 +1009,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:4a6dd2078fb883c9164e2d3f0641aa997075cf85a88477ce45c1d547a787ba54"
+      "auditDigest": "sha256:f2a284495f978223d736f0a1af59383d53b4e67262ebe480256ab7929ecebe65"
     },
     {
       "contractVersion": 1,
@@ -2410,5 +2410,5 @@
   "compatibilityFactCutRoot": "sha256:58f33e498596505a26b6fc3c7ae5acef847ff699eee6c7e17a7b318a40bdf0d6",
   "compatibilityProofRegistryRoot": "sha256:2f6477405c7891b754b33ad6515d55618bd320e7cdc59330d7cc645e17201e72",
   "compatibilityDigest": "sha256:14368a3f99f38a8c9c1e053f7ec3651766e3535237f4c551cc75417cf7ef97b3",
-  "contractDigest": "sha256:ab435d6329deb3887fab5b5383694aece33c6af49129ccef3e05b87bb2472634"
+  "contractDigest": "sha256:b00c1b80a72da4ab13d19687870f70251e651e0823f62fd3b34787f1ecab2a12"
 }