Release activation transaction

Release activation transaction

Buildchain exposes release-activation-transaction as the final cross-repository contract between a qualified product release, its public web surface, and the product-owned released-evidence projection.

The canonical order is:

1. candidate-qualified
2. artifacts-published
3. passport-sealed
4. site-published
5. public-readback
6. evidence-synthesized

packages/core/release-activation-transaction.js is the executable authority. Every transaction binds an exact product source SHA, exact reviewed site source SHA, tag, channel, version, environment, artifact-set root, and the three repository owners. A later phase cannot pass while an earlier phase is incomplete. Replaying a passed phase is idempotent only when its retained receipt roots are unchanged.

Released evidence must be synthesized from a canonical receipt set containing exactly one artifact-publication, release-passport, site-publication, public-readback, and product-qualification receipt. Every receipt repeats the same binding root. Missing, duplicated, stale, or substituted roots fail closed.

Shadow rehearsal uses mode=shadow, environment=shadow, and always emits releasedUseClaim=false. It is suitable for protected PR qualification and must never be published as real release evidence. Activation mode requires the production environment; actual channel mutation remains the caller’s protected publication responsibility.

The web-surface workflow accepts production-source-sha only for an explicitly approved workflow_dispatch. It checks out and plans the exact reviewed consumer commit, while the production environment and normal publication authority gates remain intact.