@kungfu-tech/buildchain 2.11.13 → 2.11.14-alpha.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -3,11 +3,11 @@
3
3
  "contract": "kungfu-buildchain-public-surface-reverse-audit",
4
4
  "status": "passed",
5
5
  "summary": {
6
- "cliCommandCount": 74,
6
+ "cliCommandCount": 75,
7
7
  "workflowCount": 37,
8
8
  "actionCount": 4,
9
9
  "sitePageCount": 45,
10
- "docCommandRefCount": 231,
10
+ "docCommandRefCount": 237,
11
11
  "failureCount": 0
12
12
  },
13
13
  "enumerated": {
@@ -157,6 +157,11 @@
157
157
  "source": "bin/buildchain.mjs",
158
158
  "usage": "buildchain kfd 2 claims [--cwd <dir>] [--output-dir <dir>] [--json]"
159
159
  },
160
+ {
161
+ "id": "kfd-2-product-claims",
162
+ "source": "bin/buildchain.mjs",
163
+ "usage": "buildchain kfd 2 product-claims <check|write|render> [--cwd <dir>] [--registry <path>]"
164
+ },
160
165
  {
161
166
  "id": "kfd-2-schema",
162
167
  "source": "bin/buildchain.mjs",
@@ -1816,6 +1821,36 @@
1816
1821
  "path": "docs/kfd-support.md",
1817
1822
  "command": "buildchain kfd 2 claims"
1818
1823
  },
1824
+ {
1825
+ "id": "kfd-2-product-claims",
1826
+ "path": "docs/cli.md",
1827
+ "command": "buildchain kfd 2 product-claims"
1828
+ },
1829
+ {
1830
+ "id": "kfd-2-product-claims",
1831
+ "path": "docs/cli.md",
1832
+ "command": "buildchain kfd 2 product-claims"
1833
+ },
1834
+ {
1835
+ "id": "kfd-2-product-claims",
1836
+ "path": "docs/cli.md",
1837
+ "command": "buildchain kfd 2 product-claims"
1838
+ },
1839
+ {
1840
+ "id": "kfd-2-product-claims",
1841
+ "path": "docs/kfd-support.md",
1842
+ "command": "buildchain kfd 2 product-claims"
1843
+ },
1844
+ {
1845
+ "id": "kfd-2-product-claims",
1846
+ "path": "docs/kfd-support.md",
1847
+ "command": "buildchain kfd 2 product-claims"
1848
+ },
1849
+ {
1850
+ "id": "kfd-2-product-claims",
1851
+ "path": "docs/kfd-support.md",
1852
+ "command": "buildchain kfd 2 product-claims"
1853
+ },
1819
1854
  {
1820
1855
  "id": "kfd-2-schema",
1821
1856
  "path": "docs/cli.md",
@@ -2502,9 +2537,9 @@
2502
2537
  "cliRegistryPath": "dist/site/cli-registry.json",
2503
2538
  "workflowRegistryPath": "dist/site/workflow-registry.json",
2504
2539
  "pageRegistryPath": "dist/site/page-registry.json",
2505
- "cliRegistryDigest": "fb33fe38423f56ebf95919e2b58e13dc2f544aee10169bc87d7afe980bc1b142",
2540
+ "cliRegistryDigest": "3c0729f5351eb82fe26625fa5aabf30903f45f68af2431e02860f85ada468ac9",
2506
2541
  "workflowRegistryDigest": "4041321df08640a802a87ff0fbe8584d95dc416945b43778727adb820cab9097",
2507
- "pageRegistryDigest": "0da18f8e3164359afadc261bbac828b4edc84fffc076bef97c5ebfb9ed5e3d03"
2542
+ "pageRegistryDigest": "172c596669f7793af188430bde105d1e940c4927ba6446dc9f7ecf0456f1a4e1"
2508
2543
  },
2509
2544
  "comparison": {
2510
2545
  "missingCliRegistry": [],
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
3
  "contract": "kungfu-buildchain-publication-release-registry",
4
- "generatedAt": "2026-07-10T09:18:45.930Z",
5
- "publishedAt": "2026-07-10T09:18:45.930Z",
4
+ "generatedAt": "2026-07-10T11:01:58.300Z",
5
+ "publishedAt": "2026-07-10T11:01:58.300Z",
6
6
  "reproducible": true,
7
7
  "timestampPolicy": "ci-injected",
8
8
  "deterministicInputs": [
@@ -19,7 +19,7 @@
19
19
  "declared Buildchain surface manifest contract"
20
20
  ],
21
21
  "sourceDateEpoch": "0",
22
- "sourceRevision": "63d9161fc169f9073d63822de74ed41517daab6f",
22
+ "sourceRevision": "5a95cdcb4e1114635046a0765aec1ea1ecc60dcd",
23
23
  "timestampPolicyDetails": {
24
24
  "contract": "kungfu-buildchain-surface-timestamp-policy",
25
25
  "timestampFields": [
@@ -32,7 +32,7 @@
32
32
  },
33
33
  "package": {
34
34
  "name": "@kungfu-tech/buildchain",
35
- "version": "2.11.13",
35
+ "version": "2.11.14-alpha.1",
36
36
  "versionSource": "package.json#version"
37
37
  },
38
38
  "sourceKind": "package-site-bundle",
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
3
  "contract": "kungfu-buildchain-site-manifest",
4
- "generatedAt": "2026-07-10T09:18:45.930Z",
5
- "publishedAt": "2026-07-10T09:18:45.930Z",
4
+ "generatedAt": "2026-07-10T11:01:58.300Z",
5
+ "publishedAt": "2026-07-10T11:01:58.300Z",
6
6
  "reproducible": true,
7
7
  "timestampPolicy": "ci-injected",
8
8
  "deterministicInputs": [
@@ -19,7 +19,7 @@
19
19
  "declared Buildchain surface manifest contract"
20
20
  ],
21
21
  "sourceDateEpoch": "0",
22
- "sourceRevision": "63d9161fc169f9073d63822de74ed41517daab6f",
22
+ "sourceRevision": "5a95cdcb4e1114635046a0765aec1ea1ecc60dcd",
23
23
  "timestampPolicyDetails": {
24
24
  "contract": "kungfu-buildchain-surface-timestamp-policy",
25
25
  "timestampFields": [
@@ -37,7 +37,7 @@
37
37
  },
38
38
  "package": {
39
39
  "name": "@kungfu-tech/buildchain",
40
- "version": "2.11.13",
40
+ "version": "2.11.14-alpha.1",
41
41
  "versionSource": "package.json#version"
42
42
  },
43
43
  "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
53
53
  "path": "docs/MAP.md",
54
54
  "plane": "use",
55
55
  "exists": true,
56
- "digest": "sha256:886d073bd37ac655e1ad9659baf161c72ef796b6032c5c3332218ac8198c2aeb"
56
+ "digest": "sha256:7dc5b9adc5f23456ddc3a3f7c46f2cdf3ddd38d9546a45267291ba3fe567e0c9"
57
57
  },
58
58
  {
59
59
  "id": "install",
@@ -173,7 +173,7 @@
173
173
  "path": "docs/cli.md",
174
174
  "plane": "use",
175
175
  "exists": true,
176
- "digest": "sha256:81624885888c9e357db128f644f93dcab2286910df426b532730b0141d7cb00d"
176
+ "digest": "sha256:133a7921163fecda050d772827bd498f35f11b1a3514e303dbfe89bb7a220f5d"
177
177
  },
178
178
  {
179
179
  "id": "build-facts",
@@ -189,7 +189,7 @@
189
189
  "path": "docs/kfd-support.md",
190
190
  "plane": "verify",
191
191
  "exists": true,
192
- "digest": "sha256:ce1bbf5c085a69649ee2e6ae76a52419eef94304e59efc0d0dcd4466c714709e"
192
+ "digest": "sha256:456eef9dbb71df3842613083054942436e763c6aa5ca3ff8a51c5a4e8cc186e7"
193
193
  },
194
194
  {
195
195
  "id": "lifecycle-protocol",
@@ -221,7 +221,7 @@
221
221
  "path": "docs/release-governance.md",
222
222
  "plane": "why",
223
223
  "exists": true,
224
- "digest": "sha256:9c8e3f096d314b2d0ea9a6badfdf263006e190aaa6e861489bdd05c93d3eaf04"
224
+ "digest": "sha256:f2eae65a8b678203da26e223bda9cffd7939852deea406f7328ce9e617da3c6f"
225
225
  },
226
226
  {
227
227
  "id": "release-flow",
@@ -229,7 +229,7 @@
229
229
  "path": "docs/release-flow.md",
230
230
  "plane": "verify",
231
231
  "exists": true,
232
- "digest": "sha256:feb1e056975a4ffb714d8fc0583a0f6fd8ed774c30ca168c27d5e6baf02f1cde"
232
+ "digest": "sha256:5b855ab3863e197b2ab257536b1f3ff85c79bca1fe962c45089b3f4c5ab81189"
233
233
  },
234
234
  {
235
235
  "id": "runtime-train-validation",
package/docs/MAP.md CHANGED
@@ -82,7 +82,7 @@ replace them.
82
82
  | How do I collect and verify module/product build facts from Git source, version files, and outputs? | [`build-facts.md`](build-facts.md) + [`cli.md`](cli.md) | use/verify | stable |
83
83
  | How do I publish or verify release passport artifacts? | [`release-passport.md`](release-passport.md) | use | stable |
84
84
  | How do I gate release artifacts with KFD-1 contract-world witnesses? | [`release-passport.md`](release-passport.md#kfd-1-contract-world-release-gate) | verify/use | stable |
85
- | How do I audit public KFD-2 release trust claims? | [`release-passport.md`](release-passport.md#kfd-2-release-trust-passport-audit) + [`cli.md`](cli.md) | verify/use | stable |
85
+ | How do I declare, render, and audit product KFD-2 release trust claims? | [`kfd-support.md`](kfd-support.md#kfd-2) + [`release-passport.md`](release-passport.md#kfd-2-release-trust-passport-audit) + [`cli.md`](cli.md) | verify/use | stable |
86
86
  | How do I gate KFD-3 collaboration-interface releases? | [`release-passport.md`](release-passport.md#kfd-3-collaboration-interface-release-gate) + [`cli.md`](cli.md) | verify/use | stable |
87
87
  | How do I detect, register, audit, witness, or query KFD-3 product surfaces? | [`kfd-support.md`](kfd-support.md) + [`cli.md`](cli.md) | verify/use | stable |
88
88
  | How do I keep `@v2` floating refs while detecting Buildchain contract drift? | [`reusable-build-surface.md`](reusable-build-surface.md#floating-ref-contract-lock) | verify/use | stable |
package/docs/cli.md CHANGED
@@ -203,14 +203,25 @@ buildchain kfd 1 verify --gate-json kfd-1-gate.json --json
203
203
  ```
204
204
 
205
205
  KFD-2 commands validate trust taxonomy entries and generate Buildchain's public
206
- claim evidence:
206
+ claim evidence. Product repositories use the `product-claims` subcommand to
207
+ validate and render their own declared KFD-2 release claims under the canonical
208
+ Buildchain KFD layout:
207
209
 
208
210
  ```bash
209
211
  buildchain kfd 2 schema --json
210
212
  buildchain kfd 2 taxonomy --entry-json residual-risk.json --kind residualRisk --json
211
213
  buildchain kfd 2 claims --json
214
+ buildchain kfd 2 product-claims check --json
215
+ buildchain kfd 2 product-claims write --json
216
+ buildchain kfd 2 product-claims render --json
212
217
  ```
213
218
 
219
+ The default source is `.buildchain/kfd/kfd-2/registry.json`; outputs are
220
+ `.buildchain/kfd/kfd-2/release-claims.json`, per-claim release-passport inputs
221
+ under `claims/`, and `buildchain-claim-args.txt`. Use `--registry` or
222
+ `--output-dir` only for an explicit product packaging projection. `check` never
223
+ writes and exits non-zero when outputs drift.
224
+
214
225
  KFD-3 commands are separate from Buildchain's self reverse audit: products can
215
226
  detect standard public surfaces, register the accepted boundary, audit the
216
227
  current source or artifact tree, generate a release-passport-compatible witness,
@@ -10,6 +10,8 @@ facts, not as README prose. The machine-readable sources are:
10
10
  - `buildchain.release.json` for release-specific KFD-1, KFD-2, and KFD-3
11
11
  passport results;
12
12
  - `.buildchain/buildchain.toml` for repository-owned Buildchain configuration;
13
+ - `.buildchain/kfd/kfd-2/registry.json` for product-owned KFD-2 public claim
14
+ declarations;
13
15
  - `.buildchain/kfd/kfd-3/surfaces.json` for product-owned KFD-3 surface
14
16
  registration;
15
17
  - `.buildchain/contract-lock.json` for accepted floating runtime contracts.
@@ -87,10 +89,41 @@ Buildchain exposes KFD-2 through:
87
89
  buildchain kfd 2 schema --json
88
90
  buildchain kfd 2 taxonomy --entry-json residual-risk.json --kind residualRisk --json
89
91
  buildchain kfd 2 claims --json
92
+ buildchain kfd 2 product-claims check --json
93
+ buildchain kfd 2 product-claims write --json
94
+ buildchain kfd 2 product-claims render --json
90
95
  buildchain kfd 2 trust-claims --json
91
96
  buildchain kfd 2 trust-assessment --json
92
97
  ```
93
98
 
99
+ Products declare their own public trust intent once in the canonical tracked
100
+ registry:
101
+
102
+ ```text
103
+ .buildchain/kfd/kfd-2/registry.json
104
+ ```
105
+
106
+ The registry uses
107
+ `kungfu-buildchain-kfd-2-product-claims-registry/v1` and binds each claim to a
108
+ source, machine-readable evidence, artifact coordinates, verification command,
109
+ audit boundary, responsibility, residual risk, and canonical status. Buildchain
110
+ does not invent product claims from prose. It validates the declaration, hashes
111
+ the referenced files, and renders the release-facing outputs:
112
+
113
+ ```text
114
+ .buildchain/kfd/kfd-2/release-claims.json
115
+ .buildchain/kfd/kfd-2/claims/<claim-id>.json
116
+ .buildchain/kfd/kfd-2/buildchain-claim-args.txt
117
+ ```
118
+
119
+ `product-claims check` is read-only and fails on missing, stale, or unexpected
120
+ claim projections. `write` updates only the declared KFD-2 output set and
121
+ removes stale generated claim JSON files; unrelated files are preserved.
122
+ `render` prints the expected document set without writing it. Version is read
123
+ from the repository's configured Buildchain version state unless explicitly
124
+ overridden. Release pipelines may override channel, tag, or source SHA while
125
+ the registry remains the stable product-intent source.
126
+
94
127
  `claims` generates Buildchain's release-passport public claim inputs. The
95
128
  `trust-claims` and `trust-assessment` commands expose the latest KFD package's
96
129
  foundation KFD-2 facts from `@kungfu-tech/kfd` and validate their taxonomy
@@ -12,6 +12,8 @@ flowchart TD
12
12
  Review["Protected branch review"]
13
13
  Merge["Merge PR into alpha or release"]
14
14
  Promotion["Buildchain Ref Promotion"]
15
+ StableDecision{"Release channel?"}
16
+ StableGate["Stable only: exact-alpha canaries + soak + cooldown"]
15
17
  Action["promote-buildchain-ref action"]
16
18
  VersionState["Version-state commit"]
17
19
  ExactTag["Exact tag"]
@@ -22,7 +24,10 @@ flowchart TD
22
24
  Verify --> Review
23
25
  Review --> Merge
24
26
  Merge --> Promotion
25
- Promotion --> Action
27
+ Promotion --> StableDecision
28
+ StableDecision -->|yes| StableGate
29
+ StableDecision -->|no: alpha| Action
30
+ StableGate --> Action
26
31
  Action --> VersionState
27
32
  Action --> ExactTag
28
33
  Action --> FloatingRefs
@@ -33,6 +38,10 @@ flowchart TD
33
38
  Buildchain treats the PR merge as release intent and the promotion action as the
34
39
  only component allowed to turn that intent into release refs.
35
40
 
41
+ `StableGate` applies only to Buildchain's release channel. Alpha and train
42
+ iteration bypass it. See [Stable Release Throttle And Canary Gate](release-governance.md#stable-release-throttle-and-canary-gate)
43
+ for the versioned policy and evidence contract.
44
+
36
45
  ## Ref State
37
46
 
38
47
  | Ref kind | Example | Mutability | Purpose |
@@ -206,6 +206,41 @@ The production channel and the test channel therefore intentionally diverge
206
206
  after release: production stays on the release commit, while alpha/dev continue
207
207
  at the next prerelease commit.
208
208
 
209
+ ### Stable Release Throttle And Canary Gate
210
+
211
+ Buildchain's own stable channel has an additional pre-publication gate. It is
212
+ evaluated after the PR-stage release candidate has been resolved and before the
213
+ publish-gate ref, package registry, exact stable tag, or floating stable refs
214
+ are mutated. Train refs and alpha promotion do not execute this gate.
215
+
216
+ The policy is versioned in `.buildchain/stable-release-policy.json`. A stable
217
+ candidate is allowed only when all of these facts are true:
218
+
219
+ - the candidate resolves to an immutable exact alpha tag and its GitHub
220
+ prerelease timestamp;
221
+ - at least 24 hours have passed since the preceding stable patch on the same
222
+ minor line;
223
+ - the preceding stable-to-alpha comparison contains a product or public
224
+ contract path, not only version, test, evidence, or retrospective changes;
225
+ - the version-bound impact record has a non-empty summary and at least one
226
+ surface impact;
227
+ - the `Build Surface Fixture` release-candidate run succeeded;
228
+ - `site-libkungfu-dev` completed its no-apply `Buildchain Stable Canary` and an allowed
229
+ maintainer attested that successful run on the exact alpha SHA through the
230
+ `buildchain-canary/site-libkungfu-dev` commit-status context;
231
+ - at least one hour has elapsed after the last required canary completed.
232
+
233
+ The machine report is written to
234
+ `.buildchain/release-passport/stable-release-gate.json`. A passing report is
235
+ uploaded with the stable release passport. A blocked run writes the same report
236
+ before failing, so the missing or stale condition is inspectable without
237
+ opening a publication transaction.
238
+
239
+ The cooldown is a minimum interval, not an instruction to release every day.
240
+ Compatible work should still be batched until a stable release has a concrete
241
+ consumer need. Changing the interval, canary set, attestors, product path
242
+ boundary, or soak time is a reviewed policy change.
243
+
209
244
  If release finalization is resumed after generated version-state bookkeeping was
210
245
  partially applied, Buildchain applies the same recovery rule: the current
211
246
  release head may be the generated commit, or a historical merge commit that
@@ -213,6 +248,13 @@ contains the recorded release material, existing exact tags and alpha/dev refs
213
248
  are accepted when they match the transaction, and missing floating `vX.Y` or
214
249
  `vX` tags are retried idempotently before completion.
215
250
 
251
+ Once the durable release transaction is `complete` and the exact/floating
252
+ stable refs have moved, next-alpha preparation is post-release bookkeeping. A
253
+ failure there records `deferred-post-release-bookkeeping` and
254
+ `next-anchor-required` instead of retroactively reporting the stable release as
255
+ failed. Generated next-alpha merges use the current dev tree as their base and
256
+ overlay only declared version-state paths, preserving concurrent dev changes.
257
+
216
258
  ## Major Gate Semantics
217
259
 
218
260
  A major gate merge is:
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@kungfu-tech/buildchain",
3
- "version": "2.11.13",
3
+ "version": "2.11.14-alpha.1",
4
4
  "private": false,
5
5
  "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
6
6
  "repository": "https://github.com/kungfu-systems/buildchain",
@@ -14,6 +14,7 @@ export const BUILDCHAIN_KFD4_DIR = ".buildchain/kfd/kfd-4";
14
14
  export const BUILDCHAIN_KFD1_CONTRACT_WORLD_WITNESS_PATH = ".buildchain/kfd/kfd-1/contract-world.witness.json";
15
15
  export const BUILDCHAIN_KFD1_RELEASE_GATE_PATH = ".buildchain/kfd/kfd-1/release-gate.json";
16
16
  export const BUILDCHAIN_KFD1_VERIFY_RESULT_PATH = ".buildchain/kfd/kfd-1/verify-result.json";
17
+ export const BUILDCHAIN_KFD2_REGISTRY_PATH = ".buildchain/kfd/kfd-2/registry.json";
17
18
  export const BUILDCHAIN_KFD2_RELEASE_CLAIMS_PATH = ".buildchain/kfd/kfd-2/release-claims.json";
18
19
  export const BUILDCHAIN_KFD2_CLAIM_ARGS_PATH = ".buildchain/kfd/kfd-2/buildchain-claim-args.txt";
19
20
  export const BUILDCHAIN_KFD2_CLAIMS_DIR = ".buildchain/kfd/kfd-2/claims";
@@ -75,6 +76,10 @@ export function resolveBuildchainContractLockPath(cwd = process.cwd()) {
75
76
  ]);
76
77
  }
77
78
 
79
+ export function resolveKfd2ProductClaimsRegistryPath(cwd = process.cwd()) {
80
+ return firstExistingRepoPath(cwd, [BUILDCHAIN_KFD2_REGISTRY_PATH]);
81
+ }
82
+
78
83
  export function resolveKfd3SurfaceRegistryPath(cwd = process.cwd()) {
79
84
  return firstExistingRepoPath(cwd, [
80
85
  BUILDCHAIN_KFD3_SURFACE_REGISTRY_PATH,
@@ -130,6 +135,12 @@ export function discoverBuildchainRepoFiles(cwd = process.cwd()) {
130
135
  legacy: [".buildchain/kfd-1/verify-result.json"],
131
136
  tracked: false,
132
137
  },
138
+ {
139
+ kind: "kfd-2-product-claims-registry",
140
+ canonical: BUILDCHAIN_KFD2_REGISTRY_PATH,
141
+ legacy: [],
142
+ tracked: true,
143
+ },
133
144
  {
134
145
  kind: "kfd-2-release-claims",
135
146
  canonical: BUILDCHAIN_KFD2_RELEASE_CLAIMS_PATH,
@@ -286,6 +286,7 @@ export {
286
286
  BUILDCHAIN_KFD2_CLAIMS_DIR,
287
287
  BUILDCHAIN_KFD2_CLAIM_ARGS_PATH,
288
288
  BUILDCHAIN_KFD2_DIR,
289
+ BUILDCHAIN_KFD2_REGISTRY_PATH,
289
290
  BUILDCHAIN_KFD2_RELEASE_CLAIMS_PATH,
290
291
  BUILDCHAIN_KFD3_ARTIFACT_WITNESS_PATH,
291
292
  BUILDCHAIN_KFD3_CAPABILITY_QUERY_PATH,
@@ -305,9 +306,20 @@ export {
305
306
  planBuildchainLayoutMigration,
306
307
  resolveBuildchainConfigPath,
307
308
  resolveBuildchainContractLockPath,
309
+ resolveKfd2ProductClaimsRegistryPath,
308
310
  resolveKfd3SurfaceRegistryPath,
309
311
  resolveReleasePassportPath,
310
312
  } from "./buildchain-layout.js";
313
+ export {
314
+ KFD2_PRODUCT_CLAIMS_OUTPUT_CONTRACT,
315
+ KFD2_PRODUCT_CLAIMS_REGISTRY_CONTRACT,
316
+ KFD2_PRODUCT_CLAIMS_VALIDATION_CONTRACT,
317
+ checkKfd2ProductClaimOutputs,
318
+ readKfd2ProductClaimsRegistry,
319
+ renderKfd2ProductClaimOutputs,
320
+ validateKfd2ProductClaimsRegistry,
321
+ writeKfd2ProductClaimOutputs,
322
+ } from "./kfd2-product-claims.js";
311
323
  export {
312
324
  buildchainKfdClaims,
313
325
  collectKfdStatus,
@@ -17,9 +17,17 @@ import {
17
17
  planBuildchainLayoutMigration,
18
18
  resolveBuildchainConfigPath,
19
19
  resolveBuildchainContractLockPath,
20
+ resolveKfd2ProductClaimsRegistryPath,
20
21
  resolveKfd3SurfaceRegistryPath,
21
22
  resolveReleasePassportPath,
22
23
  } from "./buildchain-layout.js";
24
+ import {
25
+ checkKfd2ProductClaimOutputs,
26
+ readKfd2ProductClaimsRegistry,
27
+ renderKfd2ProductClaimOutputs,
28
+ validateKfd2ProductClaimsRegistry,
29
+ writeKfd2ProductClaimOutputs,
30
+ } from "./kfd2-product-claims.js";
23
31
  import {
24
32
  createKfd1ReleaseGateEvidence,
25
33
  createKfd3CollaborationInterfaceReleaseGateEvidence,
@@ -555,6 +563,11 @@ export const kfd2 = Object.freeze({
555
563
  validateTrustTaxonomyEntry: validateKfd2TrustTaxonomyEntry,
556
564
  createBuildchainClaims: createBuildchainKfd2Claims,
557
565
  createBuildchainPublicClaimDefinitions,
566
+ readProductClaimsRegistry: readKfd2ProductClaimsRegistry,
567
+ validateProductClaimsRegistry: validateKfd2ProductClaimsRegistry,
568
+ renderProductClaimOutputs: renderKfd2ProductClaimOutputs,
569
+ checkProductClaimOutputs: checkKfd2ProductClaimOutputs,
570
+ writeProductClaimOutputs: writeKfd2ProductClaimOutputs,
558
571
  readFoundationTrustClaims: () => readJsonPackageExport("@kungfu-tech/kfd/buildchain/kfd-2/kfd-foundation.trust-claims.json"),
559
572
  readFoundationTrustAssessment: () => readJsonPackageExport("@kungfu-tech/kfd/buildchain/kfd-2/kfd-foundation.trust-assessment.json"),
560
573
  validateTaxonomyEntries: ({ entries = [], kind = "residualRisk" } = {}) => entries.map((entry, index) => validateKfd2TrustTaxonomyEntry(entry, {
@@ -893,6 +906,7 @@ export function collectKfdStatus({ cwd = process.cwd() } = {}) {
893
906
  const paths = {
894
907
  config: resolveBuildchainConfigPath(resolvedCwd),
895
908
  contractLock: resolveBuildchainContractLockPath(resolvedCwd),
909
+ kfd2ProductClaimsRegistry: resolveKfd2ProductClaimsRegistryPath(resolvedCwd),
896
910
  kfd3SurfaceRegistry: resolveKfd3SurfaceRegistryPath(resolvedCwd),
897
911
  releasePassport: resolveReleasePassportPath(resolvedCwd),
898
912
  };
@@ -924,7 +938,7 @@ export function collectKfdStatus({ cwd = process.cwd() } = {}) {
924
938
  }, {}),
925
939
  support: {
926
940
  "kfd-1": ["schema", "witness", "gate", "verify"],
927
- "kfd-2": ["schema", "taxonomy", "claims", "trust-claims", "trust-assessment", "upstream"],
941
+ "kfd-2": ["schema", "taxonomy", "claims", "product-claims", "trust-claims", "trust-assessment", "upstream"],
928
942
  "kfd-3": ["schema", "detect", "register", "audit", "witness", "query", "aggregate"],
929
943
  "kfd-4": ["schema"],
930
944
  },
@@ -937,6 +951,7 @@ export const layout = Object.freeze({
937
951
  migrate: migrateBuildchainLayout,
938
952
  resolveConfigPath: resolveBuildchainConfigPath,
939
953
  resolveContractLockPath: resolveBuildchainContractLockPath,
954
+ resolveKfd2ProductClaimsRegistryPath,
940
955
  resolveKfd3SurfaceRegistryPath,
941
956
  resolveReleasePassportPath,
942
957
  });