@kungfu-tech/buildchain 2.12.6 → 2.12.7-alpha.10

package/dist/site/kfd-claims.json

@@ -14,20 +14,20 @@
   },
   "runtimeContract": {
     "contract": "kungfu-buildchain-runtime-contract-world",
-    "compatibilityDigest": "sha256:2520207c5d6d6a737dd32251a42be9c5299644d9aebf690a8402ead1724ed495",
+    "compatibilityDigest": "sha256:af162b86ab4506e9b5f1d3c59b41f3fd57fbad79ff4d749a7f12ff16460517f8",
     "majorLine": "v2"
   },
   "publicSurfaceReverseAudit": {
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "da49ee5526b44e5e9baa9aa846c35776aa5fcb64fd76e4b6611a4cd517555034",
+    "sha256": "0201832d7d360c5549c51841e7b3f953743166369e84b53b40755db0cb2452fd",
     "summary": {
-      "cliCommandCount": 76,
-      "workflowCount": 43,
+      "cliCommandCount": 79,
+      "workflowCount": 47,
       "actionCount": 4,
-      "sitePageCount": 48,
-      "docCommandRefCount": 241,
+      "sitePageCount": 49,
+      "docCommandRefCount": 246,
       "failureCount": 0
     },
     "auditBoundary": {
@@ -225,13 +225,13 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "da49ee5526b44e5e9baa9aa846c35776aa5fcb64fd76e4b6611a4cd517555034",
+      "sha256": "0201832d7d360c5549c51841e7b3f953743166369e84b53b40755db0cb2452fd",
       "summary": {
-        "cliCommandCount": 76,
-        "workflowCount": 43,
+        "cliCommandCount": 79,
+        "workflowCount": 47,
         "actionCount": 4,
-        "sitePageCount": 48,
-        "docCommandRefCount": 241,
+        "sitePageCount": 49,
+        "docCommandRefCount": 246,
         "failureCount": 0
       },
       "auditBoundary": {
@@ -473,6 +473,18 @@
           "public": true,
           "plane": "why"
         },
+        {
+          "id": "doc:docs/publication-authority.md",
+          "name": "Sealed publication authority",
+          "kind": "documentation",
+          "sourcePath": "docs/publication-authority.md",
+          "evidencePath": "docs/publication-authority.md",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "plane": "verify"
+        },
         {
           "id": "doc:docs/publish-transaction.md",
           "name": "Publish transaction",
@@ -831,6 +843,39 @@
           "participantFacing": true,
           "public": true
         },
+        {
+          "id": "schema:packages/core/publication-authority.js",
+          "name": "schema:packages/core/publication-authority.js",
+          "kind": "schema",
+          "sourcePath": "packages/core/publication-authority.js",
+          "evidencePath": "packages/core/publication-authority.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true
+        },
+        {
+          "id": "schema:packages/core/publication-control-plane-audit.js",
+          "name": "schema:packages/core/publication-control-plane-audit.js",
+          "kind": "schema",
+          "sourcePath": "packages/core/publication-control-plane-audit.js",
+          "evidencePath": "packages/core/publication-control-plane-audit.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true
+        },
+        {
+          "id": "schema:packages/core/buildchain-publication-authority.js",
+          "name": "schema:packages/core/buildchain-publication-authority.js",
+          "kind": "schema",
+          "sourcePath": "packages/core/buildchain-publication-authority.js",
+          "evidencePath": "packages/core/buildchain-publication-authority.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true
+        },
         {
           "id": "schema:packages/core/buildchain-kfd-claims.js",
           "name": "schema:packages/core/buildchain-kfd-claims.js",
@@ -1150,6 +1195,42 @@
           "public": true,
           "packageExport": "./publication-package"
         },
+        {
+          "id": "export:./publication-authority",
+          "name": "@kungfu-tech/buildchain/publication-authority",
+          "kind": "package-export",
+          "sourcePath": "packages/core/publication-authority.js",
+          "evidencePath": "packages/core/publication-authority.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./publication-authority"
+        },
+        {
+          "id": "export:./publication-control-plane-audit",
+          "name": "@kungfu-tech/buildchain/publication-control-plane-audit",
+          "kind": "package-export",
+          "sourcePath": "packages/core/publication-control-plane-audit.js",
+          "evidencePath": "packages/core/publication-control-plane-audit.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./publication-control-plane-audit"
+        },
+        {
+          "id": "export:./buildchain-publication-authority",
+          "name": "@kungfu-tech/buildchain/buildchain-publication-authority",
+          "kind": "package-export",
+          "sourcePath": "packages/core/buildchain-publication-authority.js",
+          "evidencePath": "packages/core/buildchain-publication-authority.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./buildchain-publication-authority"
+        },
         {
           "id": "export:./kfd-gate",
           "name": "@kungfu-tech/buildchain/kfd-gate",
@@ -1346,6 +1427,17 @@
           "participantFacing": true,
           "public": true
         },
+        {
+          "id": "site:dist/site/publication-authority-registry.json",
+          "name": "site:dist/site/publication-authority-registry.json",
+          "kind": "site-consumption-contract",
+          "sourcePath": "dist/site/publication-authority-registry.json",
+          "evidencePath": "dist/site/publication-authority-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true
+        },
         {
           "id": "site:dist/site/public-surface-audit.json",
           "name": "site:dist/site/public-surface-audit.json",
@@ -1447,6 +1539,18 @@
         }
       ],
       "reverseEnumeratedSurfaces": [
+        {
+          "id": "cli:audit",
+          "name": "buildchain audit publication-control-plane --repository <owner/repo> --branch <protected-branch>",
+          "kind": "cli-command",
+          "sourcePath": "bin/buildchain.mjs",
+          "evidencePath": "bin/buildchain.mjs",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "bin/buildchain.mjs"
+        },
         {
           "id": "cli:badges",
           "name": "buildchain badges",
@@ -1531,6 +1635,18 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
+        {
+          "id": "cli:create",
+          "name": "buildchain create publication-admission --input-json <file-or-json> [--output <file>] [--json]",
+          "kind": "cli-command",
+          "sourcePath": "bin/buildchain.mjs",
+          "evidencePath": "bin/buildchain.mjs",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "bin/buildchain.mjs"
+        },
         {
           "id": "cli:diagnostics",
           "name": "buildchain diagnostics",
@@ -2323,6 +2439,18 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
+        {
+          "id": "cli:verify-publication-admission",
+          "name": "buildchain verify publication-admission <file-or-json>",
+          "kind": "cli-command",
+          "sourcePath": "bin/buildchain.mjs",
+          "evidencePath": "bin/buildchain.mjs",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "bin/buildchain.mjs"
+        },
         {
           "id": "cli:verify-release-passport",
           "name": "buildchain verify release-passport <file-or-url> [--json]",
@@ -2359,6 +2487,30 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
+        {
+          "id": "workflow:.binary-release-assets",
+          "name": "workflow:.binary-release-assets",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.binary-release-assets.yml",
+          "evidencePath": ".github/workflows/.binary-release-assets.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 9,
+          "inputs": [
+            "buildchain-ref",
+            "buildchain-repository",
+            "evidence-run-id",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
+            "release-tag"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:.build",
           "name": "workflow:.build",
@@ -2480,6 +2632,49 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:.publication-authority",
+          "name": "workflow:.publication-authority",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/.publication-authority.yml",
+          "evidencePath": ".github/workflows/.publication-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 28,
+          "inputs": [
+            "admission-json",
+            "authority-workflow-path",
+            "auto-admission",
+            "auto-admission-kind",
+            "buildchain-ref",
+            "buildchain-repository",
+            "control-plane-audit-json",
+            "dry-run",
+            "evidence-controller-artifact",
+            "evidence-manifest-pattern",
+            "evidence-passport-artifact",
+            "evidence-payload-pattern",
+            "evidence-publication-artifact",
+            "evidence-repository",
+            "evidence-run-id",
+            "evidence-summary-artifact",
+            "expected-json",
+            "gate-aggregate-json",
+            "package-name",
+            "product",
+            "publication-target",
+            "publication-version",
+            "publisher-workflow-path",
+            "required-status-check",
+            "runner-provenance-json",
+            "source-sha",
+            "target-ref",
+            "used-nonces-json"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:.release-docker",
           "name": "workflow:.release-docker",
@@ -2707,7 +2902,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 33,
+          "inputCount": 38,
           "inputs": [
             "artifact-path",
             "aws-region",
@@ -2736,6 +2931,11 @@
             "production-release-on-main",
             "production-release-pr-mode",
             "production-release-pr-token",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
             "release-feedback-actor-privacy",
             "staging-apply",
             "staging-aws-role-arn",
@@ -2797,6 +2997,20 @@
           "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:binary-release-assets",
+          "name": "workflow:binary-release-assets",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/binary-release-assets.yml",
+          "evidencePath": ".github/workflows/binary-release-assets.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:build-surface-fixture",
           "name": "workflow:build-surface-fixture",
@@ -3092,6 +3306,46 @@
           "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:paper-release-sealed",
+          "name": "workflow:paper-release-sealed",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/paper-release-sealed.yml",
+          "evidencePath": ".github/workflows/paper-release-sealed.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 25,
+          "inputs": [
+            "artifact-name",
+            "artifact-paths",
+            "artifact-retention-days",
+            "branch-protection-bypass-apps",
+            "branch-protection-bypass-teams",
+            "branch-protection-bypass-users",
+            "buildchain-contract-lock-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "dry-run",
+            "github-release",
+            "github-release-notes",
+            "github-release-title",
+            "package-name",
+            "publish-dist-tag",
+            "publisher-workflow-path",
+            "release-passport-impact-json",
+            "release-passport-output-dir",
+            "release-passport-product-name",
+            "required-status-check",
+            "target-ref",
+            "target-sha",
+            "toolchain-type",
+            "verify-command",
+            "working-directory"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:paper-release",
           "name": "workflow:paper-release",
@@ -3102,7 +3356,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 32,
+          "inputCount": 37,
           "inputs": [
             "artifact-name",
             "artifact-retention-days",
@@ -3121,6 +3375,11 @@
             "github-release-title",
             "node-version",
             "package-name",
+            "publication-admission-json",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-runner-provenance-json",
+            "publication-used-nonces-json",
             "publish-dist-tag",
             "publish-package-set-order",
             "release-passport-impact-json",
@@ -3214,7 +3473,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 17,
+          "inputCount": 21,
           "inputs": [
             "artifact-name",
             "artifact-paths",
@@ -3226,7 +3485,11 @@
             "buildchain-ref",
             "buildchain-repository",
             "node-version",
+            "package-name",
+            "prepare-paper-package",
+            "publish-dist-tag",
             "setup-node",
+            "target-ref",
             "toolchain-command",
             "toolchain-digest",
             "toolchain-image",
@@ -3246,7 +3509,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 44,
+          "inputCount": 55,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -3265,6 +3528,17 @@
             "github-release-notes",
             "github-release-title",
             "package-manager",
+            "publication-admission-json",
+            "publication-auto-admission",
+            "publication-control-plane-audit-json",
+            "publication-expected-json",
+            "publication-gate-aggregate-json",
+            "publication-package-name",
+            "publication-product",
+            "publication-publisher-workflow-path",
+            "publication-runner-provenance-json",
+            "publication-target",
+            "publication-used-nonces-json",
             "publish-artifact-kind",
             "publish-command",
             "publish-dist-tag",
@@ -3447,16 +3721,18 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 52,
+          "inputCount": 54,
           "inputs": [
             "allow-repository",
             "branch-protection-bypass-apps",
             "branch-protection-bypass-teams",
             "branch-protection-bypass-users",
             "dry-run",
+            "expected-publication-version",
             "generated-ref-update-token",
             "generated-status-check-token",
             "github-release",
+            "github-release-artifact-paths",
             "github-release-notes",
             "github-release-title",
             "promote-only-release-candidate",
@@ -3999,6 +4275,18 @@
           "public": true,
           "reverseAuditSource": "dist/site/page-registry.json"
         },
+        {
+          "id": "site-page:manual:publication-authority",
+          "name": "site-page:manual:publication-authority",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:manual:publish-transaction",
           "name": "site-page:manual:publish-transaction",
@@ -4296,6 +4584,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 280
+    "publicSurfaceCount": 296
   }
 }

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.6",
+    "version": "2.12.7-alpha.10",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/manual-registry.json

@@ -9,7 +9,7 @@
       "title": "Buildchain documentation map",
       "path": "docs/MAP.md",
       "plane": "use",
-      "digest": "sha256:223c7e2d20680d4a10c84f6a7c7875602538607217e9dfe291a356bbd21ac4f1",
+      "digest": "sha256:91dc800bafc31bc149680c86272827936c94e0f025d547bbabc10d58fe5f128e",
       "capabilityGroup": "getting-started",
       "audience": [
         "agent",
@@ -60,6 +60,20 @@
       "maturity": "draft",
       "order": 205
     },
+    {
+      "id": "publication-authority",
+      "title": "Sealed publication authority",
+      "path": "docs/publication-authority.md",
+      "plane": "verify",
+      "digest": "sha256:06ba05f9d8a2685a0896334b6013a97c45b7d71163cf6898e5a6274baf7f0296",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "release-operator",
+        "agent"
+      ],
+      "maturity": "preview",
+      "order": 105
+    },
     {
       "id": "release-candidate",
       "title": "Release Candidate Passport",
@@ -315,7 +329,7 @@
       "title": "Release governance",
       "path": "docs/release-governance.md",
       "plane": "why",
-      "digest": "sha256:beba38634bfdde032bb2ff85dc98dd8d755f942dabe227bf9b7aba8127ab7ce9",
+      "digest": "sha256:cce9f80add3c746fe28d8ebf5afb809348694741cb75d19154ed3057a9374c0d",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer",

package/dist/site/node-api-registry.json

@@ -8,7 +8,7 @@
       "specifier": "@kungfu-tech/buildchain",
       "export": ".",
       "target": "./packages/core/index.js",
-      "digest": "sha256:cb4a5547027b38acbffd0359c2c08192b8696f0fff841e24c05ebd887ae05fc5",
+      "digest": "sha256:07013ab68f7947772ec5bee502f97bae4b2c2f87235188f2f28f6fbb2dc5cb23",
       "summary": "Root toolkit export for Buildchain's public Node API.",
       "capabilityGroup": "api-cli-reference",
       "audience": [
@@ -47,7 +47,7 @@
       "specifier": "@kungfu-tech/buildchain/core",
       "export": "./core",
       "target": "./packages/core/index.js",
-      "digest": "sha256:cb4a5547027b38acbffd0359c2c08192b8696f0fff841e24c05ebd887ae05fc5",
+      "digest": "sha256:07013ab68f7947772ec5bee502f97bae4b2c2f87235188f2f28f6fbb2dc5cb23",
       "summary": "Alias for the root public toolkit export.",
       "capabilityGroup": "api-cli-reference",
       "audience": [
@@ -86,7 +86,7 @@
       "specifier": "@kungfu-tech/buildchain/controller-evidence",
       "export": "./controller-evidence",
       "target": "./packages/core/controller-evidence.js",
-      "digest": "sha256:6aba1af5216feaec16581a1ea36fdf318cf4af4e03b22fe5399a8bf597b8c003",
+      "digest": "sha256:3c9cf557ee0e2e4376335bb7d0e61b6e8c9a1d8699962dd8a1e7adc529e13f89",
       "summary": "Project-independent controller descriptors, source/runtime-bound plans, receipts, aggregates, and validation APIs.",
       "capabilityGroup": "reusable-build",
       "audience": [
@@ -238,6 +238,45 @@
       ],
       "maturity": "stable"
     },
+    {
+      "specifier": "@kungfu-tech/buildchain/publication-authority",
+      "export": "./publication-authority",
+      "target": "./packages/core/publication-authority.js",
+      "digest": "sha256:3c95bd9d7abc5048fb7b456e411c08f2875fe1cf65940fa3e50689acb6781a0c",
+      "summary": "Sealed publication authority registry, runner provenance, control-plane audit, admission, and independent verification APIs.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "developer",
+        "agent"
+      ],
+      "maturity": "stable"
+    },
+    {
+      "specifier": "@kungfu-tech/buildchain/publication-control-plane-audit",
+      "export": "./publication-control-plane-audit",
+      "target": "./packages/core/publication-control-plane-audit.js",
+      "digest": "sha256:58baa05440b86259812f370aa9645ba26a4df8e986dd57598412b479589286dc",
+      "summary": "Read-only publication control-plane snapshot evaluation APIs.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "developer",
+        "agent"
+      ],
+      "maturity": "stable"
+    },
+    {
+      "specifier": "@kungfu-tech/buildchain/buildchain-publication-authority",
+      "export": "./buildchain-publication-authority",
+      "target": "./packages/core/buildchain-publication-authority.js",
+      "digest": "sha256:48c5f4cb70cacb75e85b579db686a09f56d1372b8bdfeba112a3ade01524d3f5",
+      "summary": "Buildchain-owned closed-world publication authority descriptor registry.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "developer",
+        "agent"
+      ],
+      "maturity": "stable"
+    },
     {
       "specifier": "@kungfu-tech/buildchain/kfd-gate",
       "export": "./kfd-gate",
@@ -320,7 +359,7 @@
       "specifier": "@kungfu-tech/buildchain/buildchain-kfd-claims",
       "export": "./buildchain-kfd-claims",
       "target": "./packages/core/buildchain-kfd-claims.js",
-      "digest": "sha256:41d5d3257bb7052b44d034fb64fdd6f57c637fbdc7b20c93d9f0abd79844252a",
+      "digest": "sha256:e9178d4fa1d5aba1063aacf3f0b4fa0d9523c2379824386ac65a21c8262ac0b4",
       "summary": "Buildchain self KFD claim registry, witnesses, and public claim APIs.",
       "capabilityGroup": "kfd-trust",
       "audience": [