@kungfu-tech/kfd 1.0.0-alpha.13 → 1.0.0-alpha.14

package/.buildchain/kfd-1/contract-world.witness.json

@@ -144,9 +144,9 @@
     {
       "name": "kfd-doc-map",
       "sourcePath": "docs/MAP.md",
-      "sourceSha256": "c53b0d7bdc83c7e7c335e4aa23f54a76c9874908ea4d9e5d7861be3b0875bd8d",
+      "sourceSha256": "abeae72bda8c0b2e2ae79a5caa1537961d4737188758e86be9d9d1a3f0c2188c",
       "artifactPath": "docs/MAP.md",
-      "expectedSha256": "c53b0d7bdc83c7e7c335e4aa23f54a76c9874908ea4d9e5d7861be3b0875bd8d",
+      "expectedSha256": "abeae72bda8c0b2e2ae79a5caa1537961d4737188758e86be9d9d1a3f0c2188c",
       "byteForByte": true
     },
     {
@@ -200,9 +200,9 @@
     {
       "name": "buildchain-ref-promotion-workflow",
       "sourcePath": ".github/workflows/buildchain-ref-promotion.yml",
-      "sourceSha256": "046ce8fd237b34548b9479367066503829cd0e1927403efe0776c5c5fc4b227c",
+      "sourceSha256": "0e0afb510b9a59ed771b17a3671301f02fa8abe85c1562a1013988a0e835b251",
       "artifactPath": ".github/workflows/buildchain-ref-promotion.yml",
-      "expectedSha256": "046ce8fd237b34548b9479367066503829cd0e1927403efe0776c5c5fc4b227c",
+      "expectedSha256": "0e0afb510b9a59ed771b17a3671301f02fa8abe85c1562a1013988a0e835b251",
       "byteForByte": true
     },
     {
@@ -224,25 +224,25 @@
     {
       "name": "kfd-package-manifest",
       "sourcePath": "package.json",
-      "sourceSha256": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6",
+      "sourceSha256": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804",
       "artifactPath": "package.json",
-      "expectedSha256": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6",
+      "expectedSha256": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804",
       "byteForByte": true
     },
     {
       "name": "kfd-release-anchor",
       "sourcePath": "kfd.release.json",
-      "sourceSha256": "fefebbaaac172609ce0a22b505d15556739c89971e7fdac2c9ef3c4ca4776a68",
+      "sourceSha256": "a41c19ff95062e940e4ff8de433847d997ad31e5f64c816e3b7296ea6f553dd1",
       "artifactPath": "kfd.release.json",
-      "expectedSha256": "fefebbaaac172609ce0a22b505d15556739c89971e7fdac2c9ef3c4ca4776a68",
+      "expectedSha256": "a41c19ff95062e940e4ff8de433847d997ad31e5f64c816e3b7296ea6f553dd1",
       "byteForByte": true
     },
     {
       "name": "kfd-2-public-release-trust-claim",
       "sourcePath": ".buildchain/kfd-2/public-release-trust.claim.json",
-      "sourceSha256": "71986f6fd5d73a1fd74c1b6b68bcf6fe16bf67c2cea9cb3595bdbeebee10182c",
+      "sourceSha256": "9bfbffba45f1b9077cbd1db728baa00aa2803d3e205eba9e05160e1f6b2b20c5",
       "artifactPath": ".buildchain/kfd-2/public-release-trust.claim.json",
-      "expectedSha256": "71986f6fd5d73a1fd74c1b6b68bcf6fe16bf67c2cea9cb3595bdbeebee10182c",
+      "expectedSha256": "9bfbffba45f1b9077cbd1db728baa00aa2803d3e205eba9e05160e1f6b2b20c5",
       "byteForByte": true
     }
   ]

package/.buildchain/kfd-2/public-release-trust.claim.json

@@ -5,12 +5,12 @@
   "sourceBindings": [
     {
       "path": "package.json",
-      "sha256": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6",
+      "sha256": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804",
       "id": "package-version-and-exports"
     },
     {
       "path": "kfd.release.json",
-      "sha256": "fefebbaaac172609ce0a22b505d15556739c89971e7fdac2c9ef3c4ca4776a68",
+      "sha256": "a41c19ff95062e940e4ff8de433847d997ad31e5f64c816e3b7296ea6f553dd1",
       "id": "anchored-release-version"
     },
     {
@@ -47,7 +47,7 @@
     },
     {
       "path": ".github/workflows/buildchain-ref-promotion.yml",
-      "sha256": "046ce8fd237b34548b9479367066503829cd0e1927403efe0776c5c5fc4b227c",
+      "sha256": "0e0afb510b9a59ed771b17a3671301f02fa8abe85c1562a1013988a0e835b251",
       "id": "buildchain-promotion-workflow"
     },
     {
@@ -67,15 +67,15 @@
     }
   ],
   "hashes": {
-    "package-version-and-exports": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6",
-    "anchored-release-version": "fefebbaaac172609ce0a22b505d15556739c89971e7fdac2c9ef3c4ca4776a68",
+    "package-version-and-exports": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804",
+    "anchored-release-version": "a41c19ff95062e940e4ff8de433847d997ad31e5f64c816e3b7296ea6f553dd1",
     "decision-registry": "f58ec6929da6a5daada78265b937b9d0aebec7cbfb42325b279bb6ae77df830f",
     "standards-metadata": "7ac1410e182f5e66e5723c46f914ab652b2b4fad5b8fe5411172230c9ef146fc",
     "release-impact-ledger": "ae55c7758d53f7e57593e0ddec72142babd9a8ff7c9003e98f8b468b953e0d7e",
     "buildchain-release-contract": "0dc1179d59b634df364871ea18a66251781321c80a6f7bcb9e3fcf5a48ef738a",
     "self-verification-command": "c541d7fd8318c225fd99e042f2c8adee4be8723505c28b79acd017c7eff23d46",
     "buildchain-build-workflow": "c39f1e09e98346a130763b230f2ee28891a2a24476f0bf366803e7096229daff",
-    "buildchain-promotion-workflow": "046ce8fd237b34548b9479367066503829cd0e1927403efe0776c5c5fc4b227c",
+    "buildchain-promotion-workflow": "0e0afb510b9a59ed771b17a3671301f02fa8abe85c1562a1013988a0e835b251",
     "kfd-2-trust-taxonomy-schema": "a663d301a663cadb8567e3010361f5a630b76b6518ed7603dfd58cbd4e64a658",
     "kfd-2-release-claims-schema": "0f52c4a9949f62163a0fbe14fefc2f2f93f548ae18b6b5c07eb87aedca4c0be0",
     "kfd-2-release-trust-passport-schema": "df7f828605f680f3ff52fe3468cbf8f5e20151fac0d5c31cd9a0de9765efecc1"
@@ -83,15 +83,15 @@
   "artifacts": [
     {
       "name": "@kungfu-tech/kfd",
-      "version": "1.0.0-alpha.13",
+      "version": "1.0.0-alpha.14",
       "path": "package.json",
-      "sha256": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6"
+      "sha256": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804"
     },
     {
       "name": "kfd-release-anchor",
-      "version": "1.0.0-alpha.13",
+      "version": "1.0.0-alpha.14",
       "path": "kfd.release.json",
-      "sha256": "fefebbaaac172609ce0a22b505d15556739c89971e7fdac2c9ef3c4ca4776a68"
+      "sha256": "a41c19ff95062e940e4ff8de433847d997ad31e5f64c816e3b7296ea6f553dd1"
     }
   ],
   "verification": {

package/.buildchain/kfd-3/collaboration-interface.artifact.json

@@ -253,7 +253,7 @@
     {
       "id": "doc:docs-map",
       "sourcePath": "docs/MAP.md",
-      "sha256": "c53b0d7bdc83c7e7c335e4aa23f54a76c9874908ea4d9e5d7861be3b0875bd8d"
+      "sha256": "abeae72bda8c0b2e2ae79a5caa1537961d4737188758e86be9d9d1a3f0c2188c"
     },
     {
       "id": "doc:kfd-2-release-trust",
@@ -342,24 +342,24 @@
     {
       "id": "metadata:release-anchor",
       "sourcePath": "kfd.release.json",
-      "sha256": "fefebbaaac172609ce0a22b505d15556739c89971e7fdac2c9ef3c4ca4776a68"
+      "sha256": "a41c19ff95062e940e4ff8de433847d997ad31e5f64c816e3b7296ea6f553dd1"
     },
     {
       "id": "metadata:kfd-2-public-release-trust-claim",
       "sourcePath": ".buildchain/kfd-2/public-release-trust.claim.json",
-      "sha256": "71986f6fd5d73a1fd74c1b6b68bcf6fe16bf67c2cea9cb3595bdbeebee10182c"
+      "sha256": "9bfbffba45f1b9077cbd1db728baa00aa2803d3e205eba9e05160e1f6b2b20c5"
     }
   ],
   "packageExports": [
     {
       "id": "export:package-json",
       "sourcePath": "package.json#exports",
-      "sha256": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6"
+      "sha256": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804"
     },
     {
       "id": "export:npm-files",
       "sourcePath": "package.json#files",
-      "sha256": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6"
+      "sha256": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804"
     }
   ],
   "siteConsumptionContracts": [
@@ -383,7 +383,7 @@
       },
       {
         "path": "docs/MAP.md",
-        "sha256": "c53b0d7bdc83c7e7c335e4aa23f54a76c9874908ea4d9e5d7861be3b0875bd8d",
+        "sha256": "abeae72bda8c0b2e2ae79a5caa1537961d4737188758e86be9d9d1a3f0c2188c",
         "description": "Route readers and agents to the right KFD document or machine surface."
       },
       {
@@ -403,17 +403,17 @@
       },
       {
         "path": "package.json#exports",
-        "sha256": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6",
+        "sha256": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804",
         "description": "Consume the shipped npm package surfaces."
       },
       {
         "path": "kfd.release.json",
-        "sha256": "fefebbaaac172609ce0a22b505d15556739c89971e7fdac2c9ef3c4ca4776a68",
+        "sha256": "a41c19ff95062e940e4ff8de433847d997ad31e5f64c816e3b7296ea6f553dd1",
         "description": "Inspect the explicit KFD package version anchor for the current Buildchain release line."
       },
       {
         "path": ".buildchain/kfd-2/public-release-trust.claim.json",
-        "sha256": "71986f6fd5d73a1fd74c1b6b68bcf6fe16bf67c2cea9cb3595bdbeebee10182c",
+        "sha256": "9bfbffba45f1b9077cbd1db728baa00aa2803d3e205eba9e05160e1f6b2b20c5",
         "description": "Inspect the explicit public KFD-2 claim passed into Buildchain release passport generation."
       },
       {
@@ -435,7 +435,7 @@
       },
       {
         "path": "docs/MAP.md",
-        "sha256": "c53b0d7bdc83c7e7c335e4aa23f54a76c9874908ea4d9e5d7861be3b0875bd8d",
+        "sha256": "abeae72bda8c0b2e2ae79a5caa1537961d4737188758e86be9d9d1a3f0c2188c",
         "description": "Documentation routing entrypoint"
       },
       {
@@ -450,12 +450,12 @@
       },
       {
         "path": ".buildchain/kfd-2/public-release-trust.claim.json",
-        "sha256": "71986f6fd5d73a1fd74c1b6b68bcf6fe16bf67c2cea9cb3595bdbeebee10182c",
+        "sha256": "9bfbffba45f1b9077cbd1db728baa00aa2803d3e205eba9e05160e1f6b2b20c5",
         "description": "KFD-2 public release trust claim"
       },
       {
         "path": "package.json",
-        "sha256": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6",
+        "sha256": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804",
         "description": "Package export map"
       },
       {
@@ -504,19 +504,19 @@
       },
       {
         "path": ".buildchain/kfd-2/public-release-trust.claim.json",
-        "sha256": "71986f6fd5d73a1fd74c1b6b68bcf6fe16bf67c2cea9cb3595bdbeebee10182c",
+        "sha256": "9bfbffba45f1b9077cbd1db728baa00aa2803d3e205eba9e05160e1f6b2b20c5",
         "description": "Agent release trust claim path"
       },
       {
         "path": "package.json",
-        "sha256": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6",
+        "sha256": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804",
         "description": "Package consumption path"
       }
     ],
     "manuals": [
       {
         "path": "docs/MAP.md",
-        "sha256": "c53b0d7bdc83c7e7c335e4aa23f54a76c9874908ea4d9e5d7861be3b0875bd8d"
+        "sha256": "abeae72bda8c0b2e2ae79a5caa1537961d4737188758e86be9d9d1a3f0c2188c"
       },
       {
         "path": "TRADEMARKS.md",

package/.buildchain/kfd-3/collaboration-interface.prebuild.json

@@ -735,7 +735,7 @@
     {
       "id": "doc:docs-map",
       "sourcePath": "docs/MAP.md",
-      "sha256": "c53b0d7bdc83c7e7c335e4aa23f54a76c9874908ea4d9e5d7861be3b0875bd8d"
+      "sha256": "abeae72bda8c0b2e2ae79a5caa1537961d4737188758e86be9d9d1a3f0c2188c"
     },
     {
       "id": "doc:kfd-2-release-trust",
@@ -824,24 +824,24 @@
     {
       "id": "metadata:release-anchor",
       "sourcePath": "kfd.release.json",
-      "sha256": "fefebbaaac172609ce0a22b505d15556739c89971e7fdac2c9ef3c4ca4776a68"
+      "sha256": "a41c19ff95062e940e4ff8de433847d997ad31e5f64c816e3b7296ea6f553dd1"
     },
     {
       "id": "metadata:kfd-2-public-release-trust-claim",
       "sourcePath": ".buildchain/kfd-2/public-release-trust.claim.json",
-      "sha256": "71986f6fd5d73a1fd74c1b6b68bcf6fe16bf67c2cea9cb3595bdbeebee10182c"
+      "sha256": "9bfbffba45f1b9077cbd1db728baa00aa2803d3e205eba9e05160e1f6b2b20c5"
     }
   ],
   "packageExports": [
     {
       "id": "export:package-json",
       "sourcePath": "package.json#exports",
-      "sha256": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6"
+      "sha256": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804"
     },
     {
       "id": "export:npm-files",
       "sourcePath": "package.json#files",
-      "sha256": "c082af3754b3b382219e8fb1973a228f0f38ab8846178ade639488be2626cdb6"
+      "sha256": "0e6f3f7f59704314f11e50c9bd3676f5de726de0617359bf81a7d97273fbc804"
     }
   ],
   "siteConsumptionContracts": [

package/docs/MAP.md

@@ -22,5 +22,6 @@
 | How do decisions change over time? | [`../CONTRIBUTING.md`](../CONTRIBUTING.md) — append-only; explicit supersession mints a new number |
 | How is this package versioned and released? | [KFD-1](../decisions/kfd-1.md) applied to itself; Buildchain governs releases |
 | What release impact ledger should Buildchain consume for production passports? | [`../release-impact.json`](../release-impact.json) |
+| What release provenance path must alpha promotion use? | [`release-governance.md`](release-governance.md) |
 | How do I verify registry/document agreement? | `node scripts/check.mjs` |
 | How do I report a vulnerability? | [`../SECURITY.md`](../SECURITY.md) |

package/docs/release-governance.md

@@ -0,0 +1,28 @@
+# Release Governance Notes
+
+KFD releases are governed by Buildchain channel promotion. The package version
+line stays fixed at `v1.0`; alpha and production releases move through
+protected channel branches.
+
+For alpha promotion, Buildchain treats the provenance path as part of the
+release contract:
+
+```text
+dev/v1/v1.0 -> alpha/v1/v1.0
+```
+
+The alpha branch must be updated by a merged same-repository pull request whose
+head is `dev/v1/v1.0` and whose base is `alpha/v1/v1.0`. A temporary promotion
+branch may satisfy GitHub freshness rules, but it is not a valid Buildchain
+release source for KFD alpha publishing.
+
+The protected branch required status check must also name the status emitted by
+the current Verify workflow. As of the alpha.14 line, that required check is:
+
+```text
+check / check
+```
+
+Keeping the branch protection rule and the workflow-emitted status name aligned
+is part of KFD-1's "facts must not drift" requirement: the release gate cannot
+depend on a stale status context that no current workflow can produce.

package/kfd.release.json

@@ -4,7 +4,7 @@
   "line": "v1.0",
   "channel": "alpha",
   "npmPackage": "@kungfu-tech/kfd",
-  "npmVersion": "1.0.0-alpha.13",
+  "npmVersion": "1.0.0-alpha.14",
   "source": {
     "repository": "kungfu-systems/kfd",
     "branch": "alpha/v1/v1.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/kfd",
-  "version": "1.0.0-alpha.13",
+  "version": "1.0.0-alpha.14",
   "description": "Kung Fu Decisions (KFD): the kungfu-systems organization-wide decision registry, as a consumable artifact",
   "license": "Apache-2.0",
   "files": [