@kungfu-tech/buildchain 2.12.6 → 2.12.7-alpha.10

package/dist/site/capability-registry.json

@@ -47,15 +47,16 @@
       ],
       "maturity": "stable",
       "counts": {
-        "manualCount": 3,
-        "pageCount": 3,
-        "cliCommandCount": 16,
-        "nodeApiCount": 2,
+        "manualCount": 4,
+        "pageCount": 4,
+        "cliCommandCount": 19,
+        "nodeApiCount": 5,
         "workflowCount": 2,
         "actionCount": 1
       },
       "manuals": [
         "docs/release-passport.md",
+        "docs/publication-authority.md",
         "docs/binary-distribution.md",
         "docs/publish-transaction.md"
       ],
@@ -286,7 +287,7 @@
         "pageCount": 6,
         "cliCommandCount": 0,
         "nodeApiCount": 2,
-        "workflowCount": 26,
+        "workflowCount": 30,
         "actionCount": 0
       },
       "manuals": [

package/dist/site/cli-registry.json

@@ -5,6 +5,18 @@
   "npmPackage": "@kungfu-tech/buildchain",
   "commandSource": "bin/buildchain.mjs reverse enumeration",
   "commands": [
+    {
+      "id": "audit",
+      "source": "bin/buildchain.mjs",
+      "usage": "buildchain audit publication-control-plane --repository <owner/repo> --branch <protected-branch>",
+      "purpose": "Inspect read-only publication authority audit commands.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "agent",
+        "operator"
+      ],
+      "maturity": "stable"
+    },
     {
       "id": "badges",
       "source": "bin/buildchain.mjs",
@@ -89,6 +101,18 @@
       ],
       "maturity": "stable"
     },
+    {
+      "id": "create",
+      "source": "bin/buildchain.mjs",
+      "usage": "buildchain create publication-admission --input-json <file-or-json> [--output <file>] [--json]",
+      "purpose": "Create canonical sealed publication evidence documents.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "agent",
+        "operator"
+      ],
+      "maturity": "stable"
+    },
     {
       "id": "diagnostics",
       "source": "bin/buildchain.mjs",
@@ -881,6 +905,18 @@
       ],
       "maturity": "stable"
     },
+    {
+      "id": "verify-publication-admission",
+      "source": "bin/buildchain.mjs",
+      "usage": "buildchain verify publication-admission <file-or-json>",
+      "purpose": "Independently verify sealed publication admission, runner provenance, control-plane audit, nonce freshness, and exact artifact bindings.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "agent",
+        "operator"
+      ],
+      "maturity": "stable"
+    },
     {
       "id": "verify-release-passport",
       "source": "bin/buildchain.mjs",

package/dist/site/controller-registry.json

@@ -897,6 +897,26 @@
           "classification": "redacted",
           "source": "workflow-call-input"
         },
+        "publication-admission-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-control-plane-audit-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-expected-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-runner-provenance-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-used-nonces-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "release-feedback-actor-privacy": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -940,6 +960,10 @@
             "id": "verify",
             "required": false
           },
+          {
+            "id": "publication-authority",
+            "required": false
+          },
           {
             "id": "apply",
             "required": false
@@ -953,14 +977,15 @@
           "web-build",
           "web-verify",
           "deployment-plan",
-          "deployment-apply"
+          "deployment-apply",
+          "publication-authority"
         ],
         "evidence": [
           "web-surface-plan",
           "controller-receipt"
         ]
       },
-      "digest": "sha256:09b4d98c400fb12a87b701eedaaefbf4af2fd0c1fb19b8b44c6219c596430e80"
+      "digest": "sha256:f08c4970f33c059f8e0b43110f0063172fb1015ac914bdb0c8e9646692fb9f06"
     },
     {
       "schemaVersion": 1,
@@ -1012,10 +1037,26 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "package-name": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "prepare-paper-package": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "publish-dist-tag": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "setup-node": {
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "target-ref": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "toolchain-command": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -1075,7 +1116,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:d09d8f4081e7b5b9296487337206111591eeca6f8d7667e90012ac911c1b71cf"
+      "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd"
     },
     {
       "schemaVersion": 1,
@@ -1087,10 +1128,6 @@
         "path": ".github/workflows/paper-release.yml"
       },
       "inputs": {
-        "BUILDCHAIN_PROMOTION_TOKEN": {
-          "classification": "redacted",
-          "source": "workflow-call-secret"
-        },
         "artifact-name": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1159,6 +1196,26 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "publication-admission-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-control-plane-audit-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-expected-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-runner-provenance-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-used-nonces-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "publish-dist-tag": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1238,6 +1295,10 @@
             "id": "collect",
             "required": true
           },
+          {
+            "id": "publication-authority",
+            "required": true
+          },
           {
             "id": "publish",
             "required": true
@@ -1254,6 +1315,7 @@
         "capabilities": [
           "publication-build",
           "artifact-admission",
+          "publication-authority",
           "release-publish",
           "release-passport"
         ],
@@ -1263,7 +1325,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:726e94ed5353240289700df7f436e9aa4041783738757dfbdef1a6825acb6bfb"
+      "digest": "sha256:0613ea545fe2d630f34e665c8e6fe99df3f5333d75051a7176e9cf991e494f59"
     },
     {
       "schemaVersion": 1,
@@ -1371,6 +1433,50 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "publication-admission-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-auto-admission": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "publication-control-plane-audit-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-expected-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-gate-aggregate-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-package-name": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "publication-product": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "publication-publisher-workflow-path": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-runner-provenance-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-target": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "publication-used-nonces-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "publish-artifact-kind": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1490,6 +1596,10 @@
             "id": "admit-release-candidate",
             "required": true
           },
+          {
+            "id": "publication-authority",
+            "required": true
+          },
           {
             "id": "publish",
             "required": true
@@ -1506,6 +1616,7 @@
         "capabilities": [
           "promotion-preflight",
           "artifact-admission",
+          "publication-authority",
           "publish-transaction",
           "release-passport"
         ],
@@ -1516,7 +1627,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:f5a295b2d3e8f20ba46c611acaed71ee7ab5cd1ecaa6e7504b4344493271a803"
+      "digest": "sha256:c2f1fd6e984606b077b27bb243b66077162c2c4be03f99c0d8f917bf7bf4d0d1"
     },
     {
       "schemaVersion": 1,
@@ -1622,5 +1733,5 @@
       "digest": "sha256:9b9f9a2320c4349903d72ee46e329211b5538ed5ebebaa93559df4eafb835997"
     }
   ],
-  "digest": "sha256:0bd2214618cfa1fb7cdc052b3dcb64fa1ab8b815416bc00bbd27c0c666923363"
+  "digest": "sha256:aeb2d6b05cdd8e8118d6cc2c82cf4b7bf00f934b809479017a12b69c299d0e05"
 }