@kungfu-tech/buildchain 2.12.9-alpha.1 → 2.13.0-alpha.1

package/dist/site/capability-registry.json

@@ -15,7 +15,7 @@
       "maturity": "stable",
       "counts": {
         "manualCount": 3,
-        "pageCount": 7,
+        "pageCount": 8,
         "cliCommandCount": 5,
         "nodeApiCount": 0,
         "workflowCount": 0,
@@ -49,8 +49,8 @@
       "counts": {
         "manualCount": 4,
         "pageCount": 4,
-        "cliCommandCount": 19,
-        "nodeApiCount": 5,
+        "cliCommandCount": 21,
+        "nodeApiCount": 6,
         "workflowCount": 2,
         "actionCount": 1
       },

package/dist/site/cli-registry.json

@@ -701,6 +701,18 @@
       ],
       "maturity": "stable"
     },
+    {
+      "id": "project",
+      "source": "bin/buildchain.mjs",
+      "usage": "buildchain project kfx-admission <file-or-json> [--assessment-time <epoch>]",
+      "purpose": "Inspect read-only consumer projection command families.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "agent",
+        "operator"
+      ],
+      "maturity": "stable"
+    },
     {
       "id": "publication-artifact",
       "source": "bin/buildchain.mjs",
@@ -881,6 +893,18 @@
       ],
       "maturity": "stable"
     },
+    {
+      "id": "verify-artifact-envelope",
+      "source": "bin/buildchain.mjs",
+      "usage": "buildchain verify artifact-envelope <file-or-json> [--assessment-time <epoch>]",
+      "purpose": "Verify exact roots, identity, lifecycle, revocation, and an existing KFD assessment in a sealed artifact envelope.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "agent",
+        "operator"
+      ],
+      "maturity": "stable"
+    },
     {
       "id": "verify-infra-contract-evidence-bundle",
       "source": "bin/buildchain.mjs",

package/dist/site/controller-registry.json

@@ -214,6 +214,10 @@
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "lifecycle-timeout-minutes": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "linux-container-image": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -366,7 +370,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:ce2ada5daf86cbe6e58327c190fdfe07510952cc8820cf445eb4342daae4da18"
+      "digest": "sha256:367be236280f2597ffefc49680feb106b4cf9e8f5fb9420713351f075a168c4a"
     },
     {
       "schemaVersion": 1,
@@ -518,6 +522,10 @@
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "lifecycle-timeout-minutes": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "linux-container-image": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -660,7 +668,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:0ed17d03e410ca1b7726422716522a5e9096eee7badb197401291d53198518ea"
+      "digest": "sha256:2e113607af3cb0a17b4da64b8758652a4bee4a162656ce7256a8e06de3d4cf2f"
     },
     {
       "schemaVersion": 1,
@@ -1445,6 +1453,14 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "publication-consumer-predicate-id": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "publication-consumer-qualification-command": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "publication-control-plane-audit-json": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -1481,6 +1497,10 @@
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "publication-used-qualification-nonces-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "publish-artifact-kind": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1631,7 +1651,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:c5dfeb63bbe3507e3c58f74e2a5792e6558002e3aafab6453cc8b8837db2a729"
+      "digest": "sha256:2507d132710f66d3ae6ffdb18f5e66172707b8e0f9ad9e888f7422fdacc99133"
     },
     {
       "schemaVersion": 1,
@@ -1737,5 +1757,5 @@
       "digest": "sha256:9b9f9a2320c4349903d72ee46e329211b5538ed5ebebaa93559df4eafb835997"
     }
   ],
-  "digest": "sha256:22be9d05109396f2b5c44a74fb0f67e4a554c462662c5a41e44e466c4d90ed04"
+  "digest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51"
 }

package/dist/site/kfd-claims.json

@@ -21,13 +21,13 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "e40255bbd8afd23bf6c1e3fb4688db9871b3f4cacefbf6dee7dc9c9bb60dfbd9",
+    "sha256": "c4e0d2bb8dbb4380574e7c9a65766ca50f003753a50cda7be70ff0b7c5408e1b",
     "summary": {
-      "cliCommandCount": 79,
+      "cliCommandCount": 81,
       "workflowCount": 47,
       "actionCount": 4,
-      "sitePageCount": 49,
-      "docCommandRefCount": 246,
+      "sitePageCount": 50,
+      "docCommandRefCount": 250,
       "failureCount": 0
     },
     "auditBoundary": {
@@ -225,13 +225,13 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "e40255bbd8afd23bf6c1e3fb4688db9871b3f4cacefbf6dee7dc9c9bb60dfbd9",
+      "sha256": "c4e0d2bb8dbb4380574e7c9a65766ca50f003753a50cda7be70ff0b7c5408e1b",
       "summary": {
-        "cliCommandCount": 79,
+        "cliCommandCount": 81,
         "workflowCount": 47,
         "actionCount": 4,
-        "sitePageCount": 49,
-        "docCommandRefCount": 246,
+        "sitePageCount": 50,
+        "docCommandRefCount": 250,
         "failureCount": 0
       },
       "auditBoundary": {
@@ -1039,6 +1039,18 @@
           "public": true,
           "packageExport": "./artifact-passport"
         },
+        {
+          "id": "export:./artifact-verification-envelope",
+          "name": "@kungfu-tech/buildchain/artifact-verification-envelope",
+          "kind": "package-export",
+          "sourcePath": "packages/core/artifact-verification-envelope.js",
+          "evidencePath": "packages/core/artifact-verification-envelope.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./artifact-verification-envelope"
+        },
         {
           "id": "export:./buildchain-contract",
           "name": "@kungfu-tech/buildchain/buildchain-contract",
@@ -2235,6 +2247,18 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
+        {
+          "id": "cli:project",
+          "name": "buildchain project kfx-admission <file-or-json> [--assessment-time <epoch>]",
+          "kind": "cli-command",
+          "sourcePath": "bin/buildchain.mjs",
+          "evidencePath": "bin/buildchain.mjs",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "bin/buildchain.mjs"
+        },
         {
           "id": "cli:publication-artifact",
           "name": "buildchain publication-artifact",
@@ -2415,6 +2439,18 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
+        {
+          "id": "cli:verify-artifact-envelope",
+          "name": "buildchain verify artifact-envelope <file-or-json> [--assessment-time <epoch>]",
+          "kind": "cli-command",
+          "sourcePath": "bin/buildchain.mjs",
+          "evidencePath": "bin/buildchain.mjs",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "bin/buildchain.mjs"
+        },
         {
           "id": "cli:verify-infra-contract-evidence-bundle",
           "name": "buildchain verify infra-contract-evidence-bundle <file> [--json]",
@@ -2521,7 +2557,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 58,
+          "inputCount": 59,
           "inputs": [
             "artifact-name",
             "artifact-name-template",
@@ -2552,6 +2588,7 @@
             "expected-artifacts-json",
             "gate-profile-aggregate-json",
             "install-command",
+            "lifecycle-timeout-minutes",
             "linux-container-image",
             "linux-container-preset",
             "node-version",
@@ -2642,7 +2679,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 29,
+          "inputCount": 32,
           "inputs": [
             "admission-json",
             "authority-workflow-path",
@@ -2651,6 +2688,9 @@
             "auto-no-gate",
             "buildchain-ref",
             "buildchain-repository",
+            "consumer-predicate-digest",
+            "consumer-predicate-id",
+            "consumer-qualification-required",
             "control-plane-audit-json",
             "dry-run",
             "evidence-controller-artifact",
@@ -3036,7 +3076,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 61,
+          "inputCount": 62,
           "inputs": [
             "artifact-name",
             "artifact-name-template",
@@ -3070,6 +3110,7 @@
             "expected-artifacts-json",
             "gate-profile-aggregate-json",
             "install-command",
+            "lifecycle-timeout-minutes",
             "linux-container-image",
             "linux-container-preset",
             "node-version",
@@ -3510,7 +3551,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 56,
+          "inputCount": 59,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -3532,6 +3573,8 @@
             "publication-admission-json",
             "publication-auto-admission",
             "publication-auto-no-gate",
+            "publication-consumer-predicate-id",
+            "publication-consumer-qualification-command",
             "publication-control-plane-audit-json",
             "publication-expected-json",
             "publication-gate-aggregate-json",
@@ -3541,6 +3584,7 @@
             "publication-runner-provenance-json",
             "publication-target",
             "publication-used-nonces-json",
+            "publication-used-qualification-nonces-json",
             "publish-artifact-kind",
             "publish-command",
             "publish-dist-tag",
@@ -3723,7 +3767,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 54,
+          "inputCount": 59,
           "inputs": [
             "allow-repository",
             "branch-protection-bypass-apps",
@@ -3738,6 +3782,10 @@
             "github-release-notes",
             "github-release-title",
             "promote-only-release-candidate",
+            "publication-capability-json",
+            "publication-gate-aggregate-json",
+            "publication-qualification-receipt-json",
+            "publication-used-qualification-nonces-json",
             "publish-auth",
             "publish-command",
             "publish-dist-tag",
@@ -3770,6 +3818,7 @@
             "release-passport-platform-manifest-paths",
             "release-passport-product-name",
             "require-governance",
+            "require-publication-qualification",
             "require-publish-source-lock",
             "require-version-state",
             "required-status-check",
@@ -3850,7 +3899,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 20,
+          "inputCount": 21,
           "inputs": [
             "artifact-name",
             "artifact-paths",
@@ -3871,7 +3920,8 @@
             "required",
             "sample-process-tree",
             "stage",
-            "summary-path"
+            "summary-path",
+            "timeout-minutes"
           ],
           "reverseAuditSource": "actions/*/action.yml"
         },
@@ -4097,6 +4147,18 @@
           "public": true,
           "reverseAuditSource": "dist/site/page-registry.json"
         },
+        {
+          "id": "site-page:manual:artifact-verification-envelope",
+          "name": "site-page:manual:artifact-verification-envelope",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:manual:binary-distribution",
           "name": "site-page:manual:binary-distribution",
@@ -4586,6 +4648,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 296
+    "publicSurfaceCount": 300
   }
 }

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.9-alpha.1",
+    "version": "2.13.0-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/manual-registry.json

@@ -9,7 +9,7 @@
       "title": "Buildchain documentation map",
       "path": "docs/MAP.md",
       "plane": "use",
-      "digest": "sha256:91dc800bafc31bc149680c86272827936c94e0f025d547bbabc10d58fe5f128e",
+      "digest": "sha256:ce439062d4ed9d8213499e607825afdcf8a65f825343a657d0438f3e229a0af0",
       "capabilityGroup": "getting-started",
       "audience": [
         "agent",
@@ -23,7 +23,7 @@
       "title": "Install and verify Buildchain",
       "path": "docs/install.md",
       "plane": "use",
-      "digest": "sha256:1879849c01f82b8820f2d9aeb09faed0931954cb7fe6939176a5eb69110cee59",
+      "digest": "sha256:2600738a92b5853bc26d4e01211f0c07b8b36a21d4d72ca809bc6032dff5dc5f",
       "capabilityGroup": "getting-started",
       "audience": [
         "consumer"
@@ -65,7 +65,7 @@
       "title": "Sealed publication authority",
       "path": "docs/publication-authority.md",
       "plane": "verify",
-      "digest": "sha256:05bc22c7e5885e591bc121fc43f588e5d49ccf0a8de6a642811c1d0d03dcee1e",
+      "digest": "sha256:920d4f14902ded1999f46d39f6d02db8cb5be6f22e376f6f2d456b3a1cc0c674",
       "capabilityGroup": "release-passport-trust",
       "audience": [
         "release-operator",
@@ -79,7 +79,7 @@
       "title": "Release Candidate Passport",
       "path": "docs/release-candidate.md",
       "plane": "verify",
-      "digest": "sha256:6a20c6e3e483327d5ccbe70271f7fb4752731bd0523eeddb96f27b2b6ebf1cf8",
+      "digest": "sha256:1fc581cf1b4e4a202464c8d6671b3bff12d0b349760246a951e88ef524f99e6b",
       "capabilityGroup": "reusable-build",
       "audience": [
         "release-operator",
@@ -93,7 +93,7 @@
       "title": "Release propagation",
       "path": "docs/release-propagation.md",
       "plane": "use",
-      "digest": "sha256:c8085445fcd0ffd6a55197ac2db1e34fa4aaa94df9107e8e7b216b925fc3bddc",
+      "digest": "sha256:55895694a32b76dfaf5ed0eb9e32f1e10bd859fb590d6f4504d36692ebe61ea9",
       "capabilityGroup": "site-and-propagation",
       "audience": [
         "release-operator",
@@ -246,7 +246,7 @@
       "title": "CLI and npm package",
       "path": "docs/cli.md",
       "plane": "use",
-      "digest": "sha256:3b3ac97c353f7549229f1102cca38236e734ec8d08c219d4a6e5ef2a48fc0e16",
+      "digest": "sha256:ef5be4484da8628b9e027f00fe0fdb5b295665ed23eeceefac48e63581f12c0c",
       "capabilityGroup": "api-cli-reference",
       "audience": [
         "agent",
@@ -302,7 +302,7 @@
       "title": "Reusable build surface",
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
-      "digest": "sha256:6916d88ae0f25fa129308354b04d339552b72796d4d7d7938015e0e2f4dcaa6a",
+      "digest": "sha256:a2092c8064332cec9a4be852b24d94f90625cb45f885c4c3208f7068a643a3f0",
       "capabilityGroup": "reusable-build",
       "audience": [
         "consumer",
@@ -316,7 +316,7 @@
       "title": "Publish transaction",
       "path": "docs/publish-transaction.md",
       "plane": "verify",
-      "digest": "sha256:9e77030dbd69e27c2402d855980f7560a465270cac1f3225c0470523ab4a8ddf",
+      "digest": "sha256:8d5d7075cf8b4280a4c5097726f5c51ae40db83e2652eafefe4fa5e487794f57",
       "capabilityGroup": "release-passport-trust",
       "audience": [
         "release-operator"
@@ -329,7 +329,7 @@
       "title": "Release governance",
       "path": "docs/release-governance.md",
       "plane": "why",
-      "digest": "sha256:d85ac78b7c73b85b0a59a4a39131230522ae65225fa1b52f9dfe6939f1bb839c",
+      "digest": "sha256:82160f0fd9e45f08dbfbaf8037e0895cbeecf251feca8bdaff607dcc030b3e28",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer",
@@ -371,7 +371,7 @@
       "title": "Versioning",
       "path": "docs/versioning.md",
       "plane": "why",
-      "digest": "sha256:400027d5e34d5c22752f7664bb9ca9ce99c04e7be298183d0303f3fb04fa7747",
+      "digest": "sha256:280d30e15552ab6a362cb121a7a1cafc3b907913cdc7d4d8a9e8e1930d856f7e",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer"

package/dist/site/node-api-registry.json

@@ -8,7 +8,7 @@
       "specifier": "@kungfu-tech/buildchain",
       "export": ".",
       "target": "./packages/core/index.js",
-      "digest": "sha256:07013ab68f7947772ec5bee502f97bae4b2c2f87235188f2f28f6fbb2dc5cb23",
+      "digest": "sha256:a5c904aad95b55a3a83f9753c291418ee7cfa16a0455598d4a0c5c7e57fc19eb",
       "summary": "Root toolkit export for Buildchain's public Node API.",
       "capabilityGroup": "api-cli-reference",
       "audience": [
@@ -47,7 +47,7 @@
       "specifier": "@kungfu-tech/buildchain/core",
       "export": "./core",
       "target": "./packages/core/index.js",
-      "digest": "sha256:07013ab68f7947772ec5bee502f97bae4b2c2f87235188f2f28f6fbb2dc5cb23",
+      "digest": "sha256:a5c904aad95b55a3a83f9753c291418ee7cfa16a0455598d4a0c5c7e57fc19eb",
       "summary": "Alias for the root public toolkit export.",
       "capabilityGroup": "api-cli-reference",
       "audience": [
@@ -60,7 +60,7 @@
       "specifier": "@kungfu-tech/buildchain/artifact-passport",
       "export": "./artifact-passport",
       "target": "./packages/core/artifact-passport.js",
-      "digest": "sha256:cb3f66539792f4df8e43379850de428f6d1431785e6265948f80bbdea46e8296",
+      "digest": "sha256:15a43745e337b94431734c2da28b4263cabe3584f1caf9d31802721e561f03c4",
       "summary": "Artifact passport digest and evidence helper APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [
@@ -69,6 +69,19 @@
       ],
       "maturity": "stable"
     },
+    {
+      "specifier": "@kungfu-tech/buildchain/artifact-verification-envelope",
+      "export": "./artifact-verification-envelope",
+      "target": "./packages/core/artifact-verification-envelope.js",
+      "digest": "sha256:c8cc0b031fc1e78fe25b3034854b038f75eb2ea046734d32323707a4085dbbe4",
+      "summary": "Sealed exact-root, lifecycle, identity, and existing KFD assessment inputs for KFX admission.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "developer",
+        "agent"
+      ],
+      "maturity": "stable"
+    },
     {
       "specifier": "@kungfu-tech/buildchain/buildchain-contract",
       "export": "./buildchain-contract",
@@ -86,7 +99,7 @@
       "specifier": "@kungfu-tech/buildchain/controller-evidence",
       "export": "./controller-evidence",
       "target": "./packages/core/controller-evidence.js",
-      "digest": "sha256:eb4541a6b184b8332448b594b70b367f2231e7fd57a69d5c54329998ee265b90",
+      "digest": "sha256:3c9cf557ee0e2e4376335bb7d0e61b6e8c9a1d8699962dd8a1e7adc529e13f89",
       "summary": "Project-independent controller descriptors, source/runtime-bound plans, receipts, aggregates, and validation APIs.",
       "capabilityGroup": "reusable-build",
       "audience": [
@@ -164,7 +177,7 @@
       "specifier": "@kungfu-tech/buildchain/release-line-bootstrap",
       "export": "./release-line-bootstrap",
       "target": "./packages/core/release-line-bootstrap.js",
-      "digest": "sha256:7c42519975f8a653ca7bae4f0b33baf34d7e1dcb6dd4e87be9ed27de2d252e55",
+      "digest": "sha256:9f44e3f9c6be058a797a69cd43f539491a8c85e9ee937a8e91001b8fd138e626",
       "summary": "Semver release-line bootstrap planning and version-state APIs.",
       "capabilityGroup": "governance-versioning",
       "audience": [
@@ -242,7 +255,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-authority",
       "export": "./publication-authority",
       "target": "./packages/core/publication-authority.js",
-      "digest": "sha256:3c95bd9d7abc5048fb7b456e411c08f2875fe1cf65940fa3e50689acb6781a0c",
+      "digest": "sha256:2563676499d75f637a47a56b7c98756c7886a327e8d539a4638446e6c4396d1a",
       "summary": "Sealed publication authority registry, runner provenance, control-plane audit, admission, and independent verification APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [
@@ -373,7 +386,7 @@
     {
       "id": "cli-and-node-package",
       "path": "docs/cli.md",
-      "digest": "sha256:3b3ac97c353f7549229f1102cca38236e734ec8d08c219d4a6e5ef2a48fc0e16"
+      "digest": "sha256:ef5be4484da8628b9e027f00fe0fdb5b295665ed23eeceefac48e63581f12c0c"
     },
     {
       "id": "build-facts",