@kungfu-tech/buildchain 2.13.0-alpha.0 → 2.13.0-alpha.1

package/actions/promote-buildchain-ref/README.md

@@ -161,6 +161,19 @@ contract:
 specific package publication. Direct `alpha/*` or `release/*` channel refs are
 not valid publish source locks when `require-publish-source-lock` is enabled,
 and a mismatched `publish-source-sha` fails before any promotion or publish side effects begin.
+
+Consumers that opt in to a product-owned final predicate set
+`require-publication-qualification: "true"` and pass the exact sealed
+`publication-capability-json`, complete `publication-gate-aggregate-json`, and
+`publication-qualification-receipt-json`. The action validates their canonical
+digests, predicate identity, freshness, nonce, source, version, channel, target,
+and evidence bindings both before provider access and immediately before the
+publish transaction. Missing or drifted receipts fail before mutation. The
+reusable `release-candidate-promote.yml` workflow creates these values in a
+separate credentialless consumer job; direct callers must preserve the same
+contract and may pass previously consumed nonces through
+`publication-used-qualification-nonces-json`.
+
 The reusable promote workflow serializes non-dry-run promotion intents per
 repository and re-reads `target-ref` before checkout, dependency installation,
 release-candidate resolution, or publish-gate writes. If a queued intent asks

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.13.0-alpha.0",
+    "version": "2.13.0-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -159,7 +159,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:6dbae32ce3d7aab3be6957065105af574794581847b7637314dad45f5349c919",
-      "auditDigest": "sha256:3d3eec3ea3ed1b2621056f551a20543fb2b01eab985ac70c15a304e7a4bac7cc"
+      "auditDigest": "sha256:0a5691beb2469a71e22b0b7ecd3d32af539fa14dd6af6e14bf47d692a1788070"
     },
     {
       "contractVersion": 1,
@@ -269,7 +269,7 @@
         "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the public release tag"
       ],
       "breakingDigest": "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874",
-      "auditDigest": "sha256:2ee7b15a8f2e04ecb798d315c99c29dbb7ad857b87256f8f09a2cb4c024e7cf6"
+      "auditDigest": "sha256:d4fd25131a275abafdbb22b91b82fa8e04ff86850fdbb80a619e6615bb4eb716"
     },
     {
       "contractVersion": 1,
@@ -527,7 +527,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:7c9ecc33a15ecee16159175770f04ad8c9b7712e4c244b5fd9478c5eaa03cab7"
+      "auditDigest": "sha256:33efeb0f62e2aaf9d33f0763d7f3914dae78bbfd469e2a28f32b42158c58a0e8"
     },
     {
       "contractVersion": 1,
@@ -549,7 +549,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:5bb037f6e40d185df0573fa0323e8f9337d2c809d172afeecf1935dd24101e53"
+      "auditDigest": "sha256:8a00371d5676377bbcd9281e957b8c7338be6da0da08e892f2d6c2351e732f8a"
     },
     {
       "contractVersion": 1,
@@ -600,7 +600,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:710205201c2f18c442bdda7247d70e34da81c9bdb151658af93be73b29f1d90f",
+        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -747,7 +747,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:367be236280f2597ffefc49680feb106b4cf9e8f5fb9420713351f075a168c4a",
-        "registryDigest": "sha256:710205201c2f18c442bdda7247d70e34da81c9bdb151658af93be73b29f1d90f",
+        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1113,7 +1113,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:2e113607af3cb0a17b4da64b8758652a4bee4a162656ce7256a8e06de3d4cf2f",
-        "registryDigest": "sha256:710205201c2f18c442bdda7247d70e34da81c9bdb151658af93be73b29f1d90f",
+        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1443,7 +1443,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:29569f4b754595792a16742d1c4c63838b54601674a2cb6c96261a72c962dece",
-        "registryDigest": "sha256:710205201c2f18c442bdda7247d70e34da81c9bdb151658af93be73b29f1d90f",
+        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1613,7 +1613,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f08c4970f33c059f8e0b43110f0063172fb1015ac914bdb0c8e9646692fb9f06",
-        "registryDigest": "sha256:710205201c2f18c442bdda7247d70e34da81c9bdb151658af93be73b29f1d90f",
+        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -1845,7 +1845,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:710205201c2f18c442bdda7247d70e34da81c9bdb151658af93be73b29f1d90f",
+        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2026,7 +2026,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:0613ea545fe2d630f34e665c8e6fe99df3f5333d75051a7176e9cf991e494f59",
-        "registryDigest": "sha256:710205201c2f18c442bdda7247d70e34da81c9bdb151658af93be73b29f1d90f",
+        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2257,6 +2257,8 @@
         "publication-admission-json",
         "publication-auto-admission",
         "publication-auto-no-gate",
+        "publication-consumer-predicate-id",
+        "publication-consumer-qualification-command",
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
@@ -2266,6 +2268,7 @@
         "publication-runner-provenance-json",
         "publication-target",
         "publication-used-nonces-json",
+        "publication-used-qualification-nonces-json",
         "publish-artifact-kind",
         "publish-command",
         "publish-dist-tag",
@@ -2296,8 +2299,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:c5dfeb63bbe3507e3c58f74e2a5792e6558002e3aafab6453cc8b8837db2a729",
-        "registryDigest": "sha256:710205201c2f18c442bdda7247d70e34da81c9bdb151658af93be73b29f1d90f",
+        "digest": "sha256:2507d132710f66d3ae6ffdb18f5e66172707b8e0f9ad9e888f7422fdacc99133",
+        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -2407,6 +2410,14 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "publication-consumer-predicate-id": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "publication-consumer-qualification-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "publication-control-plane-audit-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -2443,6 +2454,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "publication-used-qualification-nonces-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "publish-artifact-kind": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2560,7 +2575,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:46238f8fc3c20924decc57ecad142a462fc4739c6bc21409d5cd2457fc1c3cdd",
-      "auditDigest": "sha256:3d3eec3ea3ed1b2621056f551a20543fb2b01eab985ac70c15a304e7a4bac7cc"
+      "auditDigest": "sha256:0a5691beb2469a71e22b0b7ecd3d32af539fa14dd6af6e14bf47d692a1788070"
     },
     {
       "contractVersion": 1,
@@ -2618,7 +2633,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:9b9f9a2320c4349903d72ee46e329211b5538ed5ebebaa93559df4eafb835997",
-        "registryDigest": "sha256:710205201c2f18c442bdda7247d70e34da81c9bdb151658af93be73b29f1d90f",
+        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -2689,5 +2704,5 @@
     }
   ],
   "compatibilityDigest": "sha256:af162b86ab4506e9b5f1d3c59b41f3fd57fbad79ff4d749a7f12ff16460517f8",
-  "contractDigest": "sha256:94eae2beada1653ee57a21b440cb8b3b1a29da07b9723c691dcea919ae121ffa"
+  "contractDigest": "sha256:afa3181c15449d073112738ad5cfc1ad2581d3d2629c24bfcc952ed8df137fa6"
 }