@kungfu-tech/buildchain 2.11.13 → 2.11.14-alpha.0

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-10T09:18:45.930Z",
-  "publishedAt": "2026-07-10T09:18:45.930Z",
+  "generatedAt": "2026-07-10T10:14:07.465Z",
+  "publishedAt": "2026-07-10T10:14:07.465Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "63d9161fc169f9073d63822de74ed41517daab6f",
+  "sourceRevision": "06c518d7c00527f0964e6c6eefd91532783565fe",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.13",
+    "version": "2.11.14-alpha.0",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-10T09:18:45.930Z",
-  "publishedAt": "2026-07-10T09:18:45.930Z",
+  "generatedAt": "2026-07-10T10:14:07.465Z",
+  "publishedAt": "2026-07-10T10:14:07.465Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "63d9161fc169f9073d63822de74ed41517daab6f",
+  "sourceRevision": "06c518d7c00527f0964e6c6eefd91532783565fe",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.13",
+    "version": "2.11.14-alpha.0",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:886d073bd37ac655e1ad9659baf161c72ef796b6032c5c3332218ac8198c2aeb"
+      "digest": "sha256:7dc5b9adc5f23456ddc3a3f7c46f2cdf3ddd38d9546a45267291ba3fe567e0c9"
     },
     {
       "id": "install",
@@ -173,7 +173,7 @@
       "path": "docs/cli.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:81624885888c9e357db128f644f93dcab2286910df426b532730b0141d7cb00d"
+      "digest": "sha256:133a7921163fecda050d772827bd498f35f11b1a3514e303dbfe89bb7a220f5d"
     },
     {
       "id": "build-facts",
@@ -189,7 +189,7 @@
       "path": "docs/kfd-support.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:ce1bbf5c085a69649ee2e6ae76a52419eef94304e59efc0d0dcd4466c714709e"
+      "digest": "sha256:456eef9dbb71df3842613083054942436e763c6aa5ca3ff8a51c5a4e8cc186e7"
     },
     {
       "id": "lifecycle-protocol",

package/docs/MAP.md

@@ -82,7 +82,7 @@ replace them.
 | How do I collect and verify module/product build facts from Git source, version files, and outputs? | [`build-facts.md`](build-facts.md) + [`cli.md`](cli.md) | use/verify | stable |
 | How do I publish or verify release passport artifacts? | [`release-passport.md`](release-passport.md) | use | stable |
 | How do I gate release artifacts with KFD-1 contract-world witnesses? | [`release-passport.md`](release-passport.md#kfd-1-contract-world-release-gate) | verify/use | stable |
-| How do I audit public KFD-2 release trust claims? | [`release-passport.md`](release-passport.md#kfd-2-release-trust-passport-audit) + [`cli.md`](cli.md) | verify/use | stable |
+| How do I declare, render, and audit product KFD-2 release trust claims? | [`kfd-support.md`](kfd-support.md#kfd-2) + [`release-passport.md`](release-passport.md#kfd-2-release-trust-passport-audit) + [`cli.md`](cli.md) | verify/use | stable |
 | How do I gate KFD-3 collaboration-interface releases? | [`release-passport.md`](release-passport.md#kfd-3-collaboration-interface-release-gate) + [`cli.md`](cli.md) | verify/use | stable |
 | How do I detect, register, audit, witness, or query KFD-3 product surfaces? | [`kfd-support.md`](kfd-support.md) + [`cli.md`](cli.md) | verify/use | stable |
 | How do I keep `@v2` floating refs while detecting Buildchain contract drift? | [`reusable-build-surface.md`](reusable-build-surface.md#floating-ref-contract-lock) | verify/use | stable |

package/docs/cli.md

@@ -203,14 +203,25 @@ buildchain kfd 1 verify --gate-json kfd-1-gate.json --json
 ```
 
 KFD-2 commands validate trust taxonomy entries and generate Buildchain's public
-claim evidence:
+claim evidence. Product repositories use the `product-claims` subcommand to
+validate and render their own declared KFD-2 release claims under the canonical
+Buildchain KFD layout:
 
 ```bash
 buildchain kfd 2 schema --json
 buildchain kfd 2 taxonomy --entry-json residual-risk.json --kind residualRisk --json
 buildchain kfd 2 claims --json
+buildchain kfd 2 product-claims check --json
+buildchain kfd 2 product-claims write --json
+buildchain kfd 2 product-claims render --json
 ```
 
+The default source is `.buildchain/kfd/kfd-2/registry.json`; outputs are
+`.buildchain/kfd/kfd-2/release-claims.json`, per-claim release-passport inputs
+under `claims/`, and `buildchain-claim-args.txt`. Use `--registry` or
+`--output-dir` only for an explicit product packaging projection. `check` never
+writes and exits non-zero when outputs drift.
+
 KFD-3 commands are separate from Buildchain's self reverse audit: products can
 detect standard public surfaces, register the accepted boundary, audit the
 current source or artifact tree, generate a release-passport-compatible witness,

package/docs/kfd-support.md

@@ -10,6 +10,8 @@ facts, not as README prose. The machine-readable sources are:
 - `buildchain.release.json` for release-specific KFD-1, KFD-2, and KFD-3
   passport results;
 - `.buildchain/buildchain.toml` for repository-owned Buildchain configuration;
+- `.buildchain/kfd/kfd-2/registry.json` for product-owned KFD-2 public claim
+  declarations;
 - `.buildchain/kfd/kfd-3/surfaces.json` for product-owned KFD-3 surface
   registration;
 - `.buildchain/contract-lock.json` for accepted floating runtime contracts.
@@ -87,10 +89,41 @@ Buildchain exposes KFD-2 through:
 buildchain kfd 2 schema --json
 buildchain kfd 2 taxonomy --entry-json residual-risk.json --kind residualRisk --json
 buildchain kfd 2 claims --json
+buildchain kfd 2 product-claims check --json
+buildchain kfd 2 product-claims write --json
+buildchain kfd 2 product-claims render --json
 buildchain kfd 2 trust-claims --json
 buildchain kfd 2 trust-assessment --json
 ```
 
+Products declare their own public trust intent once in the canonical tracked
+registry:
+
+```text
+.buildchain/kfd/kfd-2/registry.json
+```
+
+The registry uses
+`kungfu-buildchain-kfd-2-product-claims-registry/v1` and binds each claim to a
+source, machine-readable evidence, artifact coordinates, verification command,
+audit boundary, responsibility, residual risk, and canonical status. Buildchain
+does not invent product claims from prose. It validates the declaration, hashes
+the referenced files, and renders the release-facing outputs:
+
+```text
+.buildchain/kfd/kfd-2/release-claims.json
+.buildchain/kfd/kfd-2/claims/<claim-id>.json
+.buildchain/kfd/kfd-2/buildchain-claim-args.txt
+```
+
+`product-claims check` is read-only and fails on missing, stale, or unexpected
+claim projections. `write` updates only the declared KFD-2 output set and
+removes stale generated claim JSON files; unrelated files are preserved.
+`render` prints the expected document set without writing it. Version is read
+from the repository's configured Buildchain version state unless explicitly
+overridden. Release pipelines may override channel, tag, or source SHA while
+the registry remains the stable product-intent source.
+
 `claims` generates Buildchain's release-passport public claim inputs. The
 `trust-claims` and `trust-assessment` commands expose the latest KFD package's
 foundation KFD-2 facts from `@kungfu-tech/kfd` and validate their taxonomy

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.11.13",
+  "version": "2.11.14-alpha.0",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-layout.js

@@ -14,6 +14,7 @@ export const BUILDCHAIN_KFD4_DIR = ".buildchain/kfd/kfd-4";
 export const BUILDCHAIN_KFD1_CONTRACT_WORLD_WITNESS_PATH = ".buildchain/kfd/kfd-1/contract-world.witness.json";
 export const BUILDCHAIN_KFD1_RELEASE_GATE_PATH = ".buildchain/kfd/kfd-1/release-gate.json";
 export const BUILDCHAIN_KFD1_VERIFY_RESULT_PATH = ".buildchain/kfd/kfd-1/verify-result.json";
+export const BUILDCHAIN_KFD2_REGISTRY_PATH = ".buildchain/kfd/kfd-2/registry.json";
 export const BUILDCHAIN_KFD2_RELEASE_CLAIMS_PATH = ".buildchain/kfd/kfd-2/release-claims.json";
 export const BUILDCHAIN_KFD2_CLAIM_ARGS_PATH = ".buildchain/kfd/kfd-2/buildchain-claim-args.txt";
 export const BUILDCHAIN_KFD2_CLAIMS_DIR = ".buildchain/kfd/kfd-2/claims";
@@ -75,6 +76,10 @@ export function resolveBuildchainContractLockPath(cwd = process.cwd()) {
   ]);
 }
 
+export function resolveKfd2ProductClaimsRegistryPath(cwd = process.cwd()) {
+  return firstExistingRepoPath(cwd, [BUILDCHAIN_KFD2_REGISTRY_PATH]);
+}
+
 export function resolveKfd3SurfaceRegistryPath(cwd = process.cwd()) {
   return firstExistingRepoPath(cwd, [
     BUILDCHAIN_KFD3_SURFACE_REGISTRY_PATH,
@@ -130,6 +135,12 @@ export function discoverBuildchainRepoFiles(cwd = process.cwd()) {
       legacy: [".buildchain/kfd-1/verify-result.json"],
       tracked: false,
     },
+    {
+      kind: "kfd-2-product-claims-registry",
+      canonical: BUILDCHAIN_KFD2_REGISTRY_PATH,
+      legacy: [],
+      tracked: true,
+    },
     {
       kind: "kfd-2-release-claims",
       canonical: BUILDCHAIN_KFD2_RELEASE_CLAIMS_PATH,

package/packages/core/index.js

@@ -286,6 +286,7 @@ export {
   BUILDCHAIN_KFD2_CLAIMS_DIR,
   BUILDCHAIN_KFD2_CLAIM_ARGS_PATH,
   BUILDCHAIN_KFD2_DIR,
+  BUILDCHAIN_KFD2_REGISTRY_PATH,
   BUILDCHAIN_KFD2_RELEASE_CLAIMS_PATH,
   BUILDCHAIN_KFD3_ARTIFACT_WITNESS_PATH,
   BUILDCHAIN_KFD3_CAPABILITY_QUERY_PATH,
@@ -305,9 +306,20 @@ export {
   planBuildchainLayoutMigration,
   resolveBuildchainConfigPath,
   resolveBuildchainContractLockPath,
+  resolveKfd2ProductClaimsRegistryPath,
   resolveKfd3SurfaceRegistryPath,
   resolveReleasePassportPath,
 } from "./buildchain-layout.js";
+export {
+  KFD2_PRODUCT_CLAIMS_OUTPUT_CONTRACT,
+  KFD2_PRODUCT_CLAIMS_REGISTRY_CONTRACT,
+  KFD2_PRODUCT_CLAIMS_VALIDATION_CONTRACT,
+  checkKfd2ProductClaimOutputs,
+  readKfd2ProductClaimsRegistry,
+  renderKfd2ProductClaimOutputs,
+  validateKfd2ProductClaimsRegistry,
+  writeKfd2ProductClaimOutputs,
+} from "./kfd2-product-claims.js";
 export {
   buildchainKfdClaims,
   collectKfdStatus,

package/packages/core/kfd.js

@@ -17,9 +17,17 @@ import {
   planBuildchainLayoutMigration,
   resolveBuildchainConfigPath,
   resolveBuildchainContractLockPath,
+  resolveKfd2ProductClaimsRegistryPath,
   resolveKfd3SurfaceRegistryPath,
   resolveReleasePassportPath,
 } from "./buildchain-layout.js";
+import {
+  checkKfd2ProductClaimOutputs,
+  readKfd2ProductClaimsRegistry,
+  renderKfd2ProductClaimOutputs,
+  validateKfd2ProductClaimsRegistry,
+  writeKfd2ProductClaimOutputs,
+} from "./kfd2-product-claims.js";
 import {
   createKfd1ReleaseGateEvidence,
   createKfd3CollaborationInterfaceReleaseGateEvidence,
@@ -555,6 +563,11 @@ export const kfd2 = Object.freeze({
   validateTrustTaxonomyEntry: validateKfd2TrustTaxonomyEntry,
   createBuildchainClaims: createBuildchainKfd2Claims,
   createBuildchainPublicClaimDefinitions,
+  readProductClaimsRegistry: readKfd2ProductClaimsRegistry,
+  validateProductClaimsRegistry: validateKfd2ProductClaimsRegistry,
+  renderProductClaimOutputs: renderKfd2ProductClaimOutputs,
+  checkProductClaimOutputs: checkKfd2ProductClaimOutputs,
+  writeProductClaimOutputs: writeKfd2ProductClaimOutputs,
   readFoundationTrustClaims: () => readJsonPackageExport("@kungfu-tech/kfd/buildchain/kfd-2/kfd-foundation.trust-claims.json"),
   readFoundationTrustAssessment: () => readJsonPackageExport("@kungfu-tech/kfd/buildchain/kfd-2/kfd-foundation.trust-assessment.json"),
   validateTaxonomyEntries: ({ entries = [], kind = "residualRisk" } = {}) => entries.map((entry, index) => validateKfd2TrustTaxonomyEntry(entry, {
@@ -893,6 +906,7 @@ export function collectKfdStatus({ cwd = process.cwd() } = {}) {
   const paths = {
     config: resolveBuildchainConfigPath(resolvedCwd),
     contractLock: resolveBuildchainContractLockPath(resolvedCwd),
+    kfd2ProductClaimsRegistry: resolveKfd2ProductClaimsRegistryPath(resolvedCwd),
     kfd3SurfaceRegistry: resolveKfd3SurfaceRegistryPath(resolvedCwd),
     releasePassport: resolveReleasePassportPath(resolvedCwd),
   };
@@ -924,7 +938,7 @@ export function collectKfdStatus({ cwd = process.cwd() } = {}) {
     }, {}),
     support: {
       "kfd-1": ["schema", "witness", "gate", "verify"],
-      "kfd-2": ["schema", "taxonomy", "claims", "trust-claims", "trust-assessment", "upstream"],
+      "kfd-2": ["schema", "taxonomy", "claims", "product-claims", "trust-claims", "trust-assessment", "upstream"],
       "kfd-3": ["schema", "detect", "register", "audit", "witness", "query", "aggregate"],
       "kfd-4": ["schema"],
     },
@@ -937,6 +951,7 @@ export const layout = Object.freeze({
   migrate: migrateBuildchainLayout,
   resolveConfigPath: resolveBuildchainConfigPath,
   resolveContractLockPath: resolveBuildchainContractLockPath,
+  resolveKfd2ProductClaimsRegistryPath,
   resolveKfd3SurfaceRegistryPath,
   resolveReleasePassportPath,
 });