@kungfu-tech/buildchain 2.12.6 → 2.12.7-alpha.10

package/actions/promote-buildchain-ref/README.md

@@ -341,9 +341,17 @@ set for a controlled repair.
 In strict buildchain promotion, ref movement is also gated by the old ABV
 governance semantics:
 
-- the target channel branch protection details must be readable, must enforce
-  protection for administrators, and must require approving PR review plus the
-  strict `check` job from the `Verify` workflow;
+- when detailed target branch protection is readable, it must enforce
+  protection for administrators and require approving PR review plus the strict
+  `check` job from the `Verify` workflow; when GitHub withholds that
+  administration endpoint from the workflow token, the exact transaction must
+  instead prove a protected current head, same-repository merged PR,
+  independent approval, and the required successful `check` from its configured
+  GitHub App;
+- post-publish channel reconciliation reuses an already qualifying
+  provider-enforced policy when the workflow token cannot read or rewrite the
+  administrative protection document, and fails closed if the public branch
+  summary no longer carries the required check for everyone;
 - alpha promotion must come from a merged same-repository PR
   `dev/vN/vN.M -> alpha/vN/vN.M`, or from a strict same-line
   `publish-gate/alpha/vN/vN.M/<version> -> alpha/vN/vN.M` source-lock PR;

package/bin/buildchain.mjs

@@ -32,6 +32,11 @@ import {
   explainReleasePassport,
   verifyReleasePassport,
 } from "../packages/core/release-passport.js";
+import {
+  createPublicationAdmission,
+  createRunnerProvenance,
+  verifyPublicationAdmission,
+} from "../packages/core/publication-authority.js";
 import {
   explainArtifactPassport,
   verifyArtifactPassport,
@@ -138,7 +143,22 @@ function usage() {
                                     [--base-passport-json <json-or-path>] [--require-base-kfd]
                                     [--release-extra-json <json-or-path>]
                                     [--publish-json <json-or-path>] [--output-dir <dir>] [--json]
+  buildchain create publication-admission --input-json <file-or-json> [--output <file>] [--json]
+  buildchain create runner-provenance --input-json <file-or-json> [--output <file>] [--json]
   buildchain verify release-passport <file-or-url> [--json]
+  buildchain verify publication-admission <file-or-json>
+                          --registry-json <file-or-json>
+                          --runner-json <file-or-json>
+                          --control-plane-audit-json <file-or-json>
+                          --publication-evidence-json <file-or-json>
+                          [--expected-json <file-or-json>] [--used-nonce <nonce>]... [--json]
+  buildchain audit publication-control-plane --repository <owner/repo> --branch <protected-branch>
+                          [--source-sha <merged-branch-sha>] [--workflow-repository <owner/repo>]
+                          [--workflow <path>] [--workflow-ref <sha-or-ref>]
+                          [--job <id>] [--environment <name>] [--package <name>]
+                          [--publisher-mode npm-trusted-publisher|github-token|oidc-role]
+                          [--npm-trust-json <file-or-json>]
+                          [--provider-audit-json <file>] [--output <file>] [--allow-nonqualifying]
   buildchain verify artifact <file|dir|url|npm:...|oci:...|github-release:...>
                              [--passport <file-or-url>] [--locator-config <json>]
                              [--repository <owner/repo>] [--tag <tag>]
@@ -231,7 +251,11 @@ Examples:
   buildchain release line open --major 2 --minor 10 --source-ref release/v2/v2.9 --json
   buildchain span --event native.build -- cmake --build build
   buildchain collect github-release --tag v2.2.0 --assets-dir dist --output-dir .buildchain/release-passport
+  buildchain create publication-admission --input-json admission-input.json --output admission.json
+  buildchain create runner-provenance --input-json runner-input.json --output runner.json
   buildchain verify release-passport .buildchain/release-passport/buildchain.release.json
+  buildchain verify publication-admission admission.json --registry-json publication-authority-registry.json --runner-json runner.json --control-plane-audit-json control-plane.json --expected-json expected.json --json
+  buildchain audit publication-control-plane --repository kungfu-systems/buildchain --branch release/v2/v2.12
   buildchain verify artifact ./dist/buildchain-x86_64-unknown-linux-gnu.tar.gz --passport .buildchain/release-passport/buildchain.release.json
   buildchain verify infra-contract-evidence-bundle .buildchain/infra-contract-evidence-bundle.json
   buildchain verify observability-log .buildchain/logs/events.jsonl --min-events 4 --require-phase build
@@ -1595,6 +1619,23 @@ async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  if (command === "create") {
+    const [subcommand = "", ...createArgs] = args;
+    const inputValue = readFlag(createArgs, "input-json", "");
+    if (!inputValue || !["publication-admission", "runner-provenance"].includes(subcommand)) {
+      throw new Error("usage: buildchain create <publication-admission|runner-provenance> --input-json <file-or-json> [--output <file>]");
+    }
+    const input = readJsonInput(inputValue, { label: "input-json" });
+    const value = subcommand === "publication-admission"
+      ? createPublicationAdmission(input)
+      : createRunnerProvenance(input);
+    const output = readFlag(createArgs, "output", "");
+    if (output) writeJsonFile(path.resolve(output), value);
+    if (!output || readBooleanFlag(createArgs, "json")) printJson(value);
+    else process.stdout.write(`${subcommand}: ${output}\n`);
+    return;
+  }
+
   if (command === "collect") {
     const [subcommand = "", ...collectArgs] = args;
     if (subcommand !== "github-release") {
@@ -1657,6 +1698,34 @@ async function main(argv = process.argv.slice(2)) {
 
   if (command === "verify") {
     const [subcommand = "", location = "", ...verifyArgs] = args;
+    if (subcommand === "publication-admission") {
+      if (!location) {
+        throw new Error("usage: buildchain verify publication-admission <file-or-json> --registry-json <file-or-json> --runner-json <file-or-json> --control-plane-audit-json <file-or-json> --publication-evidence-json <file-or-json>");
+      }
+      const requiredInput = (name) => {
+        const value = readFlag(verifyArgs, name, "");
+        if (!value) throw new Error(`buildchain verify publication-admission requires --${name} <file-or-json>`);
+        return readJsonInput(value, { label: name });
+      };
+      const expectedInput = readFlag(verifyArgs, "expected-json", "");
+      const capability = verifyPublicationAdmission({
+        admission: readJsonInput(location, { label: "publication admission" }),
+        registry: requiredInput("registry-json"),
+        runnerProvenance: requiredInput("runner-json"),
+        controlPlaneAudit: requiredInput("control-plane-audit-json"),
+        publicationEvidence: requiredInput("publication-evidence-json"),
+        expected: expectedInput ? readJsonInput(expectedInput, { label: "expected-json" }) : {},
+        usedNonces: readRepeatedFlag(verifyArgs, "used-nonce"),
+      });
+      if (readBooleanFlag(verifyArgs, "json")) {
+        printJson(capability);
+      } else {
+        process.stdout.write(`publication admission: ${capability.decision}\n`);
+        process.stdout.write(`capability digest: ${capability.capabilityDigest}\n`);
+        process.stdout.write(`expires at: ${capability.expiresAt}\n`);
+      }
+      return;
+    }
     if (subcommand === "artifact") {
       if (!location) {
         throw new Error("usage: buildchain verify artifact <subject>");
@@ -1745,6 +1814,15 @@ async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  if (command === "audit") {
+    const [subcommand = "", ...auditArgs] = args;
+    if (subcommand !== "publication-control-plane") {
+      throw new Error("usage: buildchain audit publication-control-plane --repository <owner/repo> --branch <protected-branch>");
+    }
+    runScript("audit-publication-control-plane.mjs", auditArgs);
+    return;
+  }
+
   if (command === "explain") {
     const [subcommand = "", ...explainArgs] = args;
     if (subcommand === "artifact") {

package/dist/site/agent-index.json

@@ -12,6 +12,7 @@
     "node-api-registry.json",
     "workflow-registry.json",
     "controller-registry.json",
+    "publication-authority-registry.json",
     "public-surface-audit.json",
     "artifact-schemas.json",
     "buildchain-contract.json",

package/dist/site/artifact-schemas.json

@@ -24,6 +24,7 @@
     "node-api-registry.json",
     "workflow-registry.json",
     "controller-registry.json",
+    "publication-authority-registry.json",
     "public-surface-audit.json",
     "release-model.json",
     "artifact-schemas.json",

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.12.6",
+    "version": "2.12.7-alpha.10",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -50,7 +50,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:18b1cdc05272152120fdb52eb98be1d146702664ca8eba29ae92591ae55d5d2a"
+      "auditDigest": "sha256:4dc810c734e3b597297932839d3919219b93c69a985fc1b8ecc91a08299b940e"
     },
     {
       "contractVersion": 1,
@@ -159,7 +159,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:6dbae32ce3d7aab3be6957065105af574794581847b7637314dad45f5349c919",
-      "auditDigest": "sha256:7f513e87fe6c12b34c740261cc6412b9d9c56632537b7538a74ccabe03fe171e"
+      "auditDigest": "sha256:10c3132362feab7e8e3f612eedc2e62b9b90ff0ed2fcf8445ce75caef55c26d5"
     },
     {
       "contractVersion": 1,
@@ -203,7 +203,7 @@
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
       ],
       "breakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
-      "auditDigest": "sha256:465182c56f3fef7463bab7cf2b93931797bad6c5e51c1f3029b71c09d5e42e1d"
+      "auditDigest": "sha256:a849c35accf5a7e756a3782cc3540f13376f3d52ae30efcb4329a65ddb875ab5"
     },
     {
       "contractVersion": 1,
@@ -269,7 +269,7 @@
         "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the public release tag"
       ],
       "breakingDigest": "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874",
-      "auditDigest": "sha256:61edd187a303c33eeef28ccca138e46d7494645b16e6df72719b6d632b0d8e80"
+      "auditDigest": "sha256:0a6b261a43f59477497d99f840e83b11a2cfa6545a3d89c9952f47d7ebed33dc"
     },
     {
       "contractVersion": 1,
@@ -437,7 +437,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:46b22f2970d23ce444c5ae4ecedc2d3d99e65aab8a78af671ab40b847d7e956c"
+      "auditDigest": "sha256:6b388928ae928d679c36bfac7b45987ee7b6761b8ac141b72e4f60155a7110ec"
     },
     {
       "contractVersion": 1,
@@ -527,7 +527,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:89cf8c7d2a1134e747e4456c59c8089132ff4b2be81c6c4de7e485db4427e953"
+      "auditDigest": "sha256:653df5708fa73f074129b3bf1e047f7f204f42e4521e2b0d7521618f01f9f345"
     },
     {
       "contractVersion": 1,
@@ -549,7 +549,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:63874351201e9323e51c011e81cf1d4d1ff0e3f6d733d5a0cef2537eba95228a"
+      "auditDigest": "sha256:6cb094e42fb35ae6a3b166fbe179a4663f019737cd82bad6279ffaf690110737"
     },
     {
       "contractVersion": 1,
@@ -600,7 +600,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:0bd2214618cfa1fb7cdc052b3dcb64fa1ab8b815416bc00bbd27c0c666923363",
+        "registryDigest": "sha256:aeb2d6b05cdd8e8118d6cc2c82cf4b7bf00f934b809479017a12b69c299d0e05",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -746,7 +746,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:ce2ada5daf86cbe6e58327c190fdfe07510952cc8820cf445eb4342daae4da18",
-        "registryDigest": "sha256:0bd2214618cfa1fb7cdc052b3dcb64fa1ab8b815416bc00bbd27c0c666923363",
+        "registryDigest": "sha256:aeb2d6b05cdd8e8118d6cc2c82cf4b7bf00f934b809479017a12b69c299d0e05",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1001,7 +1001,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
-      "auditDigest": "sha256:18b1cdc05272152120fdb52eb98be1d146702664ca8eba29ae92591ae55d5d2a"
+      "auditDigest": "sha256:4dc810c734e3b597297932839d3919219b93c69a985fc1b8ecc91a08299b940e"
     },
     {
       "contractVersion": 1,
@@ -1107,7 +1107,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:0ed17d03e410ca1b7726422716522a5e9096eee7badb197401291d53198518ea",
-        "registryDigest": "sha256:0bd2214618cfa1fb7cdc052b3dcb64fa1ab8b815416bc00bbd27c0c666923363",
+        "registryDigest": "sha256:aeb2d6b05cdd8e8118d6cc2c82cf4b7bf00f934b809479017a12b69c299d0e05",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1433,7 +1433,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:29569f4b754595792a16742d1c4c63838b54601674a2cb6c96261a72c962dece",
-        "registryDigest": "sha256:0bd2214618cfa1fb7cdc052b3dcb64fa1ab8b815416bc00bbd27c0c666923363",
+        "registryDigest": "sha256:aeb2d6b05cdd8e8118d6cc2c82cf4b7bf00f934b809479017a12b69c299d0e05",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1520,7 +1520,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:5f1868478b7ccd9fb79aea76bc771289d2ca6bd2dccd1abf57575426f1eae5fb",
-      "auditDigest": "sha256:2b8db410486b9f572536be9fc68b8819c373ba31bdf8a7379c2770ce5168eb6c"
+      "auditDigest": "sha256:f478f291726cd47d998c37d454d9fc3e97f1d4a45dc60fe756d8c239fa1245bd"
     },
     {
       "contractVersion": 1,
@@ -1550,7 +1550,8 @@
           "web-build",
           "web-verify",
           "deployment-plan",
-          "deployment-apply"
+          "deployment-apply",
+          "publication-authority"
         ],
         "evidenceRequirements": [
           "web-surface-plan",
@@ -1587,6 +1588,11 @@
         "production-release-on-main",
         "production-release-pr-mode",
         "production-release-pr-token",
+        "publication-admission-json",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-runner-provenance-json",
+        "publication-used-nonces-json",
         "release-feedback-actor-privacy",
         "staging-apply",
         "staging-aws-role-arn",
@@ -1596,8 +1602,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:09b4d98c400fb12a87b701eedaaefbf4af2fd0c1fb19b8b44c6219c596430e80",
-        "registryDigest": "sha256:0bd2214618cfa1fb7cdc052b3dcb64fa1ab8b815416bc00bbd27c0c666923363",
+        "digest": "sha256:f08c4970f33c059f8e0b43110f0063172fb1015ac914bdb0c8e9646692fb9f06",
+        "registryDigest": "sha256:aeb2d6b05cdd8e8118d6cc2c82cf4b7bf00f934b809479017a12b69c299d0e05",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -1711,6 +1717,26 @@
             "classification": "redacted",
             "source": "workflow-call-input"
           },
+          "publication-admission-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-control-plane-audit-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-expected-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-runner-provenance-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-used-nonces-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "release-feedback-actor-privacy": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1743,8 +1769,8 @@
         "redacted input values are never serialized and digest-only input values are never emitted in plaintext",
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
-      "breakingDigest": "sha256:b48566da2325d9a6a603fbd444a8cc7deb8abed3e6c70a984259208fb0ed513c",
-      "auditDigest": "sha256:465182c56f3fef7463bab7cf2b93931797bad6c5e51c1f3029b71c09d5e42e1d"
+      "breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27",
+      "auditDigest": "sha256:a849c35accf5a7e756a3782cc3540f13376f3d52ae30efcb4329a65ddb875ab5"
     },
     {
       "contractVersion": 1,
@@ -1794,7 +1820,11 @@
         "buildchain-ref",
         "buildchain-repository",
         "node-version",
+        "package-name",
+        "prepare-paper-package",
+        "publish-dist-tag",
         "setup-node",
+        "target-ref",
         "toolchain-command",
         "toolchain-digest",
         "toolchain-image",
@@ -1804,8 +1834,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:d09d8f4081e7b5b9296487337206111591eeca6f8d7667e90012ac911c1b71cf",
-        "registryDigest": "sha256:0bd2214618cfa1fb7cdc052b3dcb64fa1ab8b815416bc00bbd27c0c666923363",
+        "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
+        "registryDigest": "sha256:aeb2d6b05cdd8e8118d6cc2c82cf4b7bf00f934b809479017a12b69c299d0e05",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1847,10 +1877,26 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "package-name": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "prepare-paper-package": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "publish-dist-tag": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "setup-node": {
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "target-ref": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "toolchain-command": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1884,7 +1930,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:3f76502666069c2727d23efcfdb08fb80f89ced1955a69e29f11525ae88aca1d",
-      "auditDigest": "sha256:4756627241ae819e4796b6ddb3b37096223c62652dbc79ac95c2fce8f1bc74a8"
+      "auditDigest": "sha256:53dfff0c1fbe8b8a06a7536d4f1dee30829db35c266d2b180c8c3ce3f3678b84"
     },
     {
       "contractVersion": 1,
@@ -1909,6 +1955,7 @@
           "resolve-runtime",
           "build",
           "collect",
+          "publication-authority",
           "publish",
           "passport",
           "aggregate"
@@ -1916,6 +1963,7 @@
         "capabilities": [
           "publication-build",
           "artifact-admission",
+          "publication-authority",
           "release-publish",
           "release-passport"
         ],
@@ -1927,7 +1975,6 @@
         "inputClassificationPolicy": "buildchain-controller-input-policy/v1"
       },
       "optionalInputs": [
-        "BUILDCHAIN_PROMOTION_TOKEN",
         "artifact-name",
         "artifact-retention-days",
         "branch-protection-bypass-apps",
@@ -1945,6 +1992,11 @@
         "github-release-title",
         "node-version",
         "package-name",
+        "publication-admission-json",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-runner-provenance-json",
+        "publication-used-nonces-json",
         "publish-dist-tag",
         "publish-package-set-order",
         "release-passport-impact-json",
@@ -1963,13 +2015,9 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:726e94ed5353240289700df7f436e9aa4041783738757dfbdef1a6825acb6bfb",
-        "registryDigest": "sha256:0bd2214618cfa1fb7cdc052b3dcb64fa1ab8b815416bc00bbd27c0c666923363",
+        "digest": "sha256:0613ea545fe2d630f34e665c8e6fe99df3f5333d75051a7176e9cf991e494f59",
+        "registryDigest": "sha256:aeb2d6b05cdd8e8118d6cc2c82cf4b7bf00f934b809479017a12b69c299d0e05",
         "inputClassifications": {
-          "BUILDCHAIN_PROMOTION_TOKEN": {
-            "classification": "redacted",
-            "source": "workflow-call-secret"
-          },
           "artifact-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2038,6 +2086,26 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "publication-admission-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-control-plane-audit-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-expected-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-runner-provenance-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-used-nonces-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "publish-dist-tag": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2106,8 +2174,8 @@
         "redacted input values are never serialized and digest-only input values are never emitted in plaintext",
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
-      "breakingDigest": "sha256:18ed432e8f3dd55a80c7e94dadacc09ab0508f6226a882029ce582d590ac214b",
-      "auditDigest": "sha256:cadb8bc59d3cc58cdc2b6bf7f80c235390a685e947d7c78d24ffcde6b321557a"
+      "breakingDigest": "sha256:0eb318df455ef9cb737a7c2515a2411b685d34ed0bde7b5f5b173a7a42513114",
+      "auditDigest": "sha256:9b810a4120c819dc28021921da243ddcc8d3f832fd610ef9d1be0212d3ba3fa6"
     },
     {
       "contractVersion": 1,
@@ -2131,6 +2199,7 @@
         "requiredStages": [
           "preflight",
           "admit-release-candidate",
+          "publication-authority",
           "publish",
           "passport",
           "aggregate"
@@ -2138,6 +2207,7 @@
         "capabilities": [
           "promotion-preflight",
           "artifact-admission",
+          "publication-authority",
           "publish-transaction",
           "release-passport"
         ],
@@ -2174,6 +2244,17 @@
         "github-release-notes",
         "github-release-title",
         "package-manager",
+        "publication-admission-json",
+        "publication-auto-admission",
+        "publication-control-plane-audit-json",
+        "publication-expected-json",
+        "publication-gate-aggregate-json",
+        "publication-package-name",
+        "publication-product",
+        "publication-publisher-workflow-path",
+        "publication-runner-provenance-json",
+        "publication-target",
+        "publication-used-nonces-json",
         "publish-artifact-kind",
         "publish-command",
         "publish-dist-tag",
@@ -2204,8 +2285,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:f5a295b2d3e8f20ba46c611acaed71ee7ab5cd1ecaa6e7504b4344493271a803",
-        "registryDigest": "sha256:0bd2214618cfa1fb7cdc052b3dcb64fa1ab8b815416bc00bbd27c0c666923363",
+        "digest": "sha256:c2f1fd6e984606b077b27bb243b66077162c2c4be03f99c0d8f917bf7bf4d0d1",
+        "registryDigest": "sha256:aeb2d6b05cdd8e8118d6cc2c82cf4b7bf00f934b809479017a12b69c299d0e05",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -2303,6 +2384,50 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "publication-admission-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-auto-admission": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "publication-control-plane-audit-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-expected-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-gate-aggregate-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-package-name": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "publication-product": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "publication-publisher-workflow-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-runner-provenance-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-target": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "publication-used-nonces-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "publish-artifact-kind": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2419,8 +2544,8 @@
         "redacted input values are never serialized and digest-only input values are never emitted in plaintext",
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
-      "breakingDigest": "sha256:63e4340f090bce35f5ab64f38fe16767725a39819498ed4d24c5c16de4083c23",
-      "auditDigest": "sha256:7f513e87fe6c12b34c740261cc6412b9d9c56632537b7538a74ccabe03fe171e"
+      "breakingDigest": "sha256:46238f8fc3c20924decc57ecad142a462fc4739c6bc21409d5cd2457fc1c3cdd",
+      "auditDigest": "sha256:10c3132362feab7e8e3f612eedc2e62b9b90ff0ed2fcf8445ce75caef55c26d5"
     },
     {
       "contractVersion": 1,
@@ -2478,7 +2603,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:9b9f9a2320c4349903d72ee46e329211b5538ed5ebebaa93559df4eafb835997",
-        "registryDigest": "sha256:0bd2214618cfa1fb7cdc052b3dcb64fa1ab8b815416bc00bbd27c0c666923363",
+        "registryDigest": "sha256:aeb2d6b05cdd8e8118d6cc2c82cf4b7bf00f934b809479017a12b69c299d0e05",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -2548,6 +2673,6 @@
       "auditDigest": "sha256:e7d0cc13b9d6f19e7cd77b650693f0d615b919796d075041d74876e6ca58716f"
     }
   ],
-  "compatibilityDigest": "sha256:2520207c5d6d6a737dd32251a42be9c5299644d9aebf690a8402ead1724ed495",
-  "contractDigest": "sha256:4c369ecd3bf25e43dc44f42c8cdd00924e8585e90c5300cba51b483054effd9d"
+  "compatibilityDigest": "sha256:af162b86ab4506e9b5f1d3c59b41f3fd57fbad79ff4d749a7f12ff16460517f8",
+  "contractDigest": "sha256:b14d7b8b1e52ad3b894234f4cc81554fc901d7c1cfe91d59deae4cc3453d3675"
 }