@kungfu-tech/buildchain 2.12.6 → 2.12.7-alpha.1

package/dist/site/controller-registry.json

@@ -897,6 +897,26 @@
           "classification": "redacted",
           "source": "workflow-call-input"
         },
+        "publication-admission-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-control-plane-audit-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-expected-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-runner-provenance-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-used-nonces-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "release-feedback-actor-privacy": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -940,6 +960,10 @@
             "id": "verify",
             "required": false
           },
+          {
+            "id": "publication-authority",
+            "required": false
+          },
           {
             "id": "apply",
             "required": false
@@ -953,14 +977,15 @@
           "web-build",
           "web-verify",
           "deployment-plan",
-          "deployment-apply"
+          "deployment-apply",
+          "publication-authority"
         ],
         "evidence": [
           "web-surface-plan",
           "controller-receipt"
         ]
       },
-      "digest": "sha256:09b4d98c400fb12a87b701eedaaefbf4af2fd0c1fb19b8b44c6219c596430e80"
+      "digest": "sha256:f08c4970f33c059f8e0b43110f0063172fb1015ac914bdb0c8e9646692fb9f06"
     },
     {
       "schemaVersion": 1,
@@ -1087,10 +1112,6 @@
         "path": ".github/workflows/paper-release.yml"
       },
       "inputs": {
-        "BUILDCHAIN_PROMOTION_TOKEN": {
-          "classification": "redacted",
-          "source": "workflow-call-secret"
-        },
         "artifact-name": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1159,6 +1180,26 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "publication-admission-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-control-plane-audit-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-expected-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-runner-provenance-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-used-nonces-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "publish-dist-tag": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1238,6 +1279,10 @@
             "id": "collect",
             "required": true
           },
+          {
+            "id": "publication-authority",
+            "required": true
+          },
           {
             "id": "publish",
             "required": true
@@ -1254,6 +1299,7 @@
         "capabilities": [
           "publication-build",
           "artifact-admission",
+          "publication-authority",
           "release-publish",
           "release-passport"
         ],
@@ -1263,7 +1309,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:726e94ed5353240289700df7f436e9aa4041783738757dfbdef1a6825acb6bfb"
+      "digest": "sha256:0613ea545fe2d630f34e665c8e6fe99df3f5333d75051a7176e9cf991e494f59"
     },
     {
       "schemaVersion": 1,
@@ -1287,10 +1333,6 @@
           "classification": "redacted",
           "source": "workflow-call-secret"
         },
-        "BUILDCHAIN_PROMOTION_TOKEN": {
-          "classification": "redacted",
-          "source": "workflow-call-secret"
-        },
         "allow-repository": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1371,6 +1413,50 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "publication-admission-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-auto-admission": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "publication-control-plane-audit-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-expected-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-gate-aggregate-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-package-name": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "publication-product": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "publication-publisher-workflow-path": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-runner-provenance-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-target": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "publication-used-nonces-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "publish-artifact-kind": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1490,6 +1576,10 @@
             "id": "admit-release-candidate",
             "required": true
           },
+          {
+            "id": "publication-authority",
+            "required": true
+          },
           {
             "id": "publish",
             "required": true
@@ -1506,6 +1596,7 @@
         "capabilities": [
           "promotion-preflight",
           "artifact-admission",
+          "publication-authority",
           "publish-transaction",
           "release-passport"
         ],
@@ -1516,7 +1607,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:f5a295b2d3e8f20ba46c611acaed71ee7ab5cd1ecaa6e7504b4344493271a803"
+      "digest": "sha256:380a550c76a7a0c884d0519b5e6e605ad3e04e86f637ba846c20b546faec4a0f"
     },
     {
       "schemaVersion": 1,
@@ -1622,5 +1713,5 @@
       "digest": "sha256:9b9f9a2320c4349903d72ee46e329211b5538ed5ebebaa93559df4eafb835997"
     }
   ],
-  "digest": "sha256:0bd2214618cfa1fb7cdc052b3dcb64fa1ab8b815416bc00bbd27c0c666923363"
+  "digest": "sha256:f4ea94c3590360ef21ade53056129f0183356de3d1997e43c49a0494d0acd34a"
 }

package/dist/site/kfd-claims.json

@@ -14,20 +14,20 @@
   },
   "runtimeContract": {
     "contract": "kungfu-buildchain-runtime-contract-world",
-    "compatibilityDigest": "sha256:2520207c5d6d6a737dd32251a42be9c5299644d9aebf690a8402ead1724ed495",
+    "compatibilityDigest": "sha256:af162b86ab4506e9b5f1d3c59b41f3fd57fbad79ff4d749a7f12ff16460517f8",
     "majorLine": "v2"
   },
   "publicSurfaceReverseAudit": {
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "da49ee5526b44e5e9baa9aa846c35776aa5fcb64fd76e4b6611a4cd517555034",
+    "sha256": "58bc630f5a8e5cb46eab9e874b7bd9cbdc45ce49f238385c289f749244e3ac1c",
     "summary": {
-      "cliCommandCount": 76,
-      "workflowCount": 43,
+      "cliCommandCount": 79,
+      "workflowCount": 46,
       "actionCount": 4,
-      "sitePageCount": 48,
-      "docCommandRefCount": 241,
+      "sitePageCount": 49,
+      "docCommandRefCount": 246,
       "failureCount": 0
     },
     "auditBoundary": {
@@ -225,13 +225,13 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "da49ee5526b44e5e9baa9aa846c35776aa5fcb64fd76e4b6611a4cd517555034",
+      "sha256": "58bc630f5a8e5cb46eab9e874b7bd9cbdc45ce49f238385c289f749244e3ac1c",
       "summary": {
-        "cliCommandCount": 76,
-        "workflowCount": 43,
+        "cliCommandCount": 79,
+        "workflowCount": 46,
         "actionCount": 4,
-        "sitePageCount": 48,
-        "docCommandRefCount": 241,
+        "sitePageCount": 49,
+        "docCommandRefCount": 246,
         "failureCount": 0
       },
       "auditBoundary": {
@@ -473,6 +473,18 @@
           "public": true,
           "plane": "why"
         },
+        {
+          "id": "doc:docs/publication-authority.md",
+          "name": "Sealed publication authority",
+          "kind": "documentation",
+          "sourcePath": "docs/publication-authority.md",
+          "evidencePath": "docs/publication-authority.md",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "plane": "verify"
+        },
         {
           "id": "doc:docs/publish-transaction.md",
           "name": "Publish transaction",
@@ -831,6 +843,39 @@
           "participantFacing": true,
           "public": true
         },
+        {
+          "id": "schema:packages/core/publication-authority.js",
+          "name": "schema:packages/core/publication-authority.js",
+          "kind": "schema",
+          "sourcePath": "packages/core/publication-authority.js",
+          "evidencePath": "packages/core/publication-authority.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true
+        },
+        {
+          "id": "schema:packages/core/publication-control-plane-audit.js",
+          "name": "schema:packages/core/publication-control-plane-audit.js",
+          "kind": "schema",
+          "sourcePath": "packages/core/publication-control-plane-audit.js",
+          "evidencePath": "packages/core/publication-control-plane-audit.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true
+        },
+        {
+          "id": "schema:packages/core/buildchain-publication-authority.js",
+          "name": "schema:packages/core/buildchain-publication-authority.js",
+          "kind": "schema",
+          "sourcePath": "packages/core/buildchain-publication-authority.js",
+          "evidencePath": "packages/core/buildchain-publication-authority.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true
+        },
         {
           "id": "schema:packages/core/buildchain-kfd-claims.js",
           "name": "schema:packages/core/buildchain-kfd-claims.js",
@@ -1150,6 +1195,42 @@
           "public": true,
           "packageExport": "./publication-package"
         },
+        {
+          "id": "export:./publication-authority",
+          "name": "@kungfu-tech/buildchain/publication-authority",
+          "kind": "package-export",
+          "sourcePath": "packages/core/publication-authority.js",
+          "evidencePath": "packages/core/publication-authority.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./publication-authority"
+        },
+        {
+          "id": "export:./publication-control-plane-audit",
+          "name": "@kungfu-tech/buildchain/publication-control-plane-audit",
+          "kind": "package-export",
+          "sourcePath": "packages/core/publication-control-plane-audit.js",
+          "evidencePath": "packages/core/publication-control-plane-audit.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./publication-control-plane-audit"
+        },
+        {
+          "id": "export:./buildchain-publication-authority",
+          "name": "@kungfu-tech/buildchain/buildchain-publication-authority",
+          "kind": "package-export",
+          "sourcePath": "packages/core/buildchain-publication-authority.js",
+          "evidencePath": "packages/core/buildchain-publication-authority.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./buildchain-publication-authority"
+        },
         {
           "id": "export:./kfd-gate",
           "name": "@kungfu-tech/buildchain/kfd-gate",
@@ -1346,6 +1427,17 @@
           "participantFacing": true,
           "public": true
         },
+        {
+          "id": "site:dist/site/publication-authority-registry.json",
+          "name": "site:dist/site/publication-authority-registry.json",
+          "kind": "site-consumption-contract",
+          "sourcePath": "dist/site/publication-authority-registry.json",
+          "evidencePath": "dist/site/publication-authority-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true
+        },
         {
           "id": "site:dist/site/public-surface-audit.json",
           "name": "site:dist/site/public-surface-audit.json",
@@ -1447,6 +1539,18 @@
         }
       ],
       "reverseEnumeratedSurfaces": [
+        {
+          "id": "cli:audit",
+          "name": "buildchain audit publication-control-plane --repository <owner/repo> --branch <protected-branch>",
+          "kind": "cli-command",
+          "sourcePath": "bin/buildchain.mjs",
+          "evidencePath": "bin/buildchain.mjs",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "bin/buildchain.mjs"
+        },
         {
           "id": "cli:badges",
           "name": "buildchain badges",
@@ -1531,6 +1635,18 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
+        {
+          "id": "cli:create",
+          "name": "buildchain create publication-admission --input-json <file-or-json> [--output <file>] [--json]",
+          "kind": "cli-command",
+          "sourcePath": "bin/buildchain.mjs",
+          "evidencePath": "bin/buildchain.mjs",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "bin/buildchain.mjs"
+        },
         {
           "id": "cli:diagnostics",
           "name": "buildchain diagnostics",
@@ -2323,6 +2439,18 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
+        {
+          "id": "cli:verify-publication-admission",
+          "name": "buildchain verify publication-admission <file-or-json>",
+          "kind": "cli-command",
+          "sourcePath": "bin/buildchain.mjs",
+          "evidencePath": "bin/buildchain.mjs",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "bin/buildchain.mjs"
+        },
         {
           "id": "cli:verify-release-passport",
           "name": "buildchain verify release-passport <file-or-url> [--json]",
@@ -2359,6 +2487,30 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
+        {
+          "id": "workflow:.binary-release-assets",
+          "name": "workflow:.binary-release-assets",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.binary-release-assets.yml",
+          "evidencePath": ".github/workflows/.binary-release-assets.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 9,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "evidence-run-id",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "release-tag"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:.build",
           "name": "workflow:.build",
@@ -2480,6 +2632,43 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:.publication-authority",
+          "name": "workflow:.publication-authority",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.publication-authority.yml",
+          "evidencePath": ".github/workflows/.publication-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 22,
+          "inputs": [
+            "admission-json",
+            "auto-admission",
+            "buildchain-ref",
+            "buildchain-repository",
+            "control-plane-audit-json",
+            "dry-run",
+            "evidence-manifest-pattern",
+            "evidence-passport-artifact",
+            "evidence-payload-pattern",
+            "evidence-repository",
+            "evidence-run-id",
+            "evidence-summary-artifact",
+            "expected-json",
+            "gate-aggregate-json",
+            "package-name",
+            "product",
+            "publication-target",
+            "publisher-workflow-path",
+            "runner-provenance-json",
+            "source-sha",
+            "target-ref",
+            "used-nonces-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:.release-docker",
           "name": "workflow:.release-docker",
@@ -2707,7 +2896,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 33,
+          "inputCount": 38,
           "inputs": [
             "artifact-path",
             "aws-region",
@@ -2736,6 +2925,11 @@
             "production-release-on-main",
             "production-release-pr-mode",
             "production-release-pr-token",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
             "release-feedback-actor-privacy",
             "staging-apply",
             "staging-aws-role-arn",
@@ -2797,6 +2991,20 @@
           "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:binary-release-assets",
+          "name": "workflow:binary-release-assets",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/binary-release-assets.yml",
+          "evidencePath": ".github/workflows/binary-release-assets.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:build-surface-fixture",
           "name": "workflow:build-surface-fixture",
@@ -3102,7 +3310,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 32,
+          "inputCount": 37,
           "inputs": [
             "artifact-name",
             "artifact-retention-days",
@@ -3121,6 +3329,11 @@
             "github-release-title",
             "node-version",
             "package-name",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
             "publish-dist-tag",
             "publish-package-set-order",
             "release-passport-impact-json",
@@ -3246,7 +3459,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 44,
+          "inputCount": 55,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -3265,6 +3478,17 @@
             "github-release-notes",
             "github-release-title",
             "package-manager",
+            "publication-admission-json",
+            "publication-auto-admission",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-package-name",
+            "publication-product",
+            "publication-publisher-workflow-path",
+            "publication-runner-provenance-json",
+            "publication-target",
+            "publication-used-nonces-json",
             "publish-artifact-kind",
             "publish-command",
             "publish-dist-tag",
@@ -3999,6 +4223,18 @@
           "public": true,
           "reverseAuditSource": "dist/site/page-registry.json"
         },
+        {
+          "id": "site-page:manual:publication-authority",
+          "name": "site-page:manual:publication-authority",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:manual:publish-transaction",
           "name": "site-page:manual:publish-transaction",
@@ -4296,6 +4532,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 280
+    "publicSurfaceCount": 295
   }
 }

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.6",
+    "version": "2.12.7-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/manual-registry.json

@@ -9,7 +9,7 @@
       "title": "Buildchain documentation map",
       "path": "docs/MAP.md",
       "plane": "use",
-      "digest": "sha256:223c7e2d20680d4a10c84f6a7c7875602538607217e9dfe291a356bbd21ac4f1",
+      "digest": "sha256:91dc800bafc31bc149680c86272827936c94e0f025d547bbabc10d58fe5f128e",
       "capabilityGroup": "getting-started",
       "audience": [
         "agent",
@@ -60,6 +60,20 @@
       "maturity": "draft",
       "order": 205
     },
+    {
+      "id": "publication-authority",
+      "title": "Sealed publication authority",
+      "path": "docs/publication-authority.md",
+      "plane": "verify",
+      "digest": "sha256:fc08e6657a1b586b6b8b5618ca4f49dfaa85955687f5bba8e2e69e7513fe6c71",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "release-operator",
+        "agent"
+      ],
+      "maturity": "preview",
+      "order": 105
+    },
     {
       "id": "release-candidate",
       "title": "Release Candidate Passport",