@kungfu-tech/buildchain 2.14.14-alpha.1 → 2.14.14-alpha.2

package/actions/promote-buildchain-ref/README.md

@@ -287,10 +287,12 @@ bookkeeping, not a consumer-authored release change.
 Set `github-release: "true"` when the semver promotion should also publish the
 public GitHub Release. After the release transaction reaches `complete` and
 `finalization-needed` is false, the action creates or updates the GitHub Release
-for `public-release-tag`, applies deterministic semver metadata
-(`prerelease=true` and `make_latest=false` for prerelease tags, latest for stable
-tags), and uploads the publish evidence file plus generated release passport
-assets. For anchored/manual package releases, `public-release-tag` is derived
+for `public-release-tag`, applies deterministic metadata from the authoritative
+publication channel (`alpha` is a prerelease and never latest; `release`,
+`stable`, and `major` are stable and latest), and uploads the publish evidence
+file plus generated release passport assets. Tag syntax remains the fallback for
+ordinary callers that do not supply publication intent. For anchored/manual
+package releases, `public-release-tag` is derived
 from the published package version, while `transaction-exact-tag` remains the
 internal Buildchain transaction ref for recovery and audit. If the transaction is
 not complete yet, the action defers GitHub Release publication to the next

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.14-alpha.1",
+    "version": "2.14.14-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -50,7 +50,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:8bcdb5e04678bcfc17be4576bc444308756bcd84d671f2ba7fc76cade3004d2b"
+      "auditDigest": "sha256:e7506e0ad026d9e74247be48b6caf66d8c4c3e6426a31aaa452326fc017f06ae"
     },
     {
       "contractVersion": 1,
@@ -170,7 +170,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:1f476fb9a4854b362c4b24cef89a3c7675d7d63baf3bc828d7b8ae7d2787cead",
-      "auditDigest": "sha256:52e4d610d45d3d8efc701f9a3f9f4a921954dbc473f73c1a5986b41e366d9a81"
+      "auditDigest": "sha256:5b676e52b74a698f10a33ec4b70e92b34e018d1bf4ca7258c8ce69d3897953aa"
     },
     {
       "contractVersion": 1,
@@ -212,7 +212,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:9f4d8d0d8837ef2d06352113c1262f2611e6460faea95d969142385e964306e2"
+      "auditDigest": "sha256:d2637850f9c0eab444b49df87d108b21938f7ef0cd315fd1ee961418cb10c88a"
     },
     {
       "contractVersion": 1,
@@ -321,9 +321,9 @@
         "protected release refs and durable release-state are finalized by Buildchain",
         "release passport finalization is idempotent after publish side effects",
         "publish transactions can require a resolved publish-gate source lock to prevent floating-ref drift",
-        "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the public release tag"
+        "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata bound to the authoritative publication channel and tag syntax retained as the fallback for ordinary callers"
       ],
-      "breakingDigest": "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874",
+      "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
       "auditDigest": "sha256:ff220542fd1cb21fc4780d0bb31eb9f78d44d70746b6c4364483e104b48ae083"
     },
     {
@@ -582,7 +582,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:fb61cc49e5349bedc67aff71e53ea76d82161f6ffbb9fd4c6b5ca162aad7744f"
+      "auditDigest": "sha256:e103fa6a6bf7ca8e22f20d9f181ce03835903eb9c3d519577e96dbd436e051df"
     },
     {
       "contractVersion": 1,
@@ -604,7 +604,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:f21c257df947179c660265755b05086916af7ae3e20e9f2bc7abb866e974988a"
+      "auditDigest": "sha256:d70fa5214ffff09b793aff3708368179f5dd38b57ef0a8aee50302efaefb2322"
     },
     {
       "contractVersion": 1,
@@ -655,7 +655,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:89d6ba121382c2ba6c81cf1170e5c2e66256d893ee3fbb131af93a018950b891",
+        "registryDigest": "sha256:dcc7a1c660fa1544357156327b5ca3ab15eaec894393ba62493aed755373d3a8",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -802,7 +802,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:0dd7ebe7b7543ca4f295e0634ed1434bb4571d2ffb2f4b6ab25794eb2ee5c431",
-        "registryDigest": "sha256:89d6ba121382c2ba6c81cf1170e5c2e66256d893ee3fbb131af93a018950b891",
+        "registryDigest": "sha256:dcc7a1c660fa1544357156327b5ca3ab15eaec894393ba62493aed755373d3a8",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1061,7 +1061,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
-      "auditDigest": "sha256:8bcdb5e04678bcfc17be4576bc444308756bcd84d671f2ba7fc76cade3004d2b"
+      "auditDigest": "sha256:e7506e0ad026d9e74247be48b6caf66d8c4c3e6426a31aaa452326fc017f06ae"
     },
     {
       "contractVersion": 1,
@@ -1168,7 +1168,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:2e113607af3cb0a17b4da64b8758652a4bee4a162656ce7256a8e06de3d4cf2f",
-        "registryDigest": "sha256:89d6ba121382c2ba6c81cf1170e5c2e66256d893ee3fbb131af93a018950b891",
+        "registryDigest": "sha256:dcc7a1c660fa1544357156327b5ca3ab15eaec894393ba62493aed755373d3a8",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1498,7 +1498,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:29569f4b754595792a16742d1c4c63838b54601674a2cb6c96261a72c962dece",
-        "registryDigest": "sha256:89d6ba121382c2ba6c81cf1170e5c2e66256d893ee3fbb131af93a018950b891",
+        "registryDigest": "sha256:dcc7a1c660fa1544357156327b5ca3ab15eaec894393ba62493aed755373d3a8",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1669,7 +1669,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:7e6283c8fbeab7a680bae57c9ab9c8eb94aab7400d3ee01c5b9dfdd03f149edb",
-        "registryDigest": "sha256:89d6ba121382c2ba6c81cf1170e5c2e66256d893ee3fbb131af93a018950b891",
+        "registryDigest": "sha256:dcc7a1c660fa1544357156327b5ca3ab15eaec894393ba62493aed755373d3a8",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -1905,7 +1905,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:89d6ba121382c2ba6c81cf1170e5c2e66256d893ee3fbb131af93a018950b891",
+        "registryDigest": "sha256:dcc7a1c660fa1544357156327b5ca3ab15eaec894393ba62493aed755373d3a8",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2086,7 +2086,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:0613ea545fe2d630f34e665c8e6fe99df3f5333d75051a7176e9cf991e494f59",
-        "registryDigest": "sha256:89d6ba121382c2ba6c81cf1170e5c2e66256d893ee3fbb131af93a018950b891",
+        "registryDigest": "sha256:dcc7a1c660fa1544357156327b5ca3ab15eaec894393ba62493aed755373d3a8",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2373,7 +2373,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:fe4bb0bd543e7db7ef38950354764608639f5b11677a4b8e02caa097900d6898",
-        "registryDigest": "sha256:89d6ba121382c2ba6c81cf1170e5c2e66256d893ee3fbb131af93a018950b891",
+        "registryDigest": "sha256:dcc7a1c660fa1544357156327b5ca3ab15eaec894393ba62493aed755373d3a8",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -2700,7 +2700,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:9f4d8d0d8837ef2d06352113c1262f2611e6460faea95d969142385e964306e2"
+      "auditDigest": "sha256:d2637850f9c0eab444b49df87d108b21938f7ef0cd315fd1ee961418cb10c88a"
     },
     {
       "contractVersion": 1,
@@ -2761,7 +2761,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
-        "registryDigest": "sha256:89d6ba121382c2ba6c81cf1170e5c2e66256d893ee3fbb131af93a018950b891",
+        "registryDigest": "sha256:dcc7a1c660fa1544357156327b5ca3ab15eaec894393ba62493aed755373d3a8",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -2841,8 +2841,62 @@
       ],
       "breakingDigest": "sha256:d7a1f15990ce8bd13149474888232c7d4451dd2a49bebf4d4ce1336695da430e",
       "auditDigest": "sha256:43fd4da155c701d4c5078373c1f47b50bebc6a46556b8db5e3c4d502c113fa95"
+    },
+    {
+      "contractVersion": 1,
+      "stability": "stable",
+      "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line",
+      "id": "controller:binary-distribution",
+      "kind": "controller",
+      "path": ".github/workflows/binary-distribution.yml",
+      "requiredInputs": [],
+      "requiredOutputs": [
+        "controller-plan-json",
+        "controller-plan-digest",
+        "controller-receipt-json",
+        "controller-receipt-digest",
+        "controller-receipt-status"
+      ],
+      "breakingDefaults": {
+        "evidenceContract": "buildchain.controller-evidence/v1",
+        "descriptorVersion": 1,
+        "workflowPath": ".github/workflows/binary-distribution.yml",
+        "requiredStages": [
+          "resolve-runtime",
+          "build",
+          "verify",
+          "bundle",
+          "aggregate"
+        ],
+        "capabilities": [
+          "standalone-binary-build",
+          "release-evidence-bundle",
+          "artifact-admission"
+        ],
+        "evidenceRequirements": [
+          "release-evidence-bundle",
+          "release-passport",
+          "controller-receipt"
+        ],
+        "inputClassificationPolicy": "buildchain-controller-input-policy/v1"
+      },
+      "optionalInputs": [],
+      "controllerDescriptor": {
+        "contract": "buildchain.controller-descriptor/v1",
+        "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
+        "registryDigest": "sha256:dcc7a1c660fa1544357156327b5ca3ab15eaec894393ba62493aed755373d3a8",
+        "inputClassifications": {}
+      },
+      "guarantees": [
+        "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest",
+        "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes",
+        "redacted input values are never serialized and digest-only input values are never emitted in plaintext",
+        "missing receipts are non-qualifying and must not be represented as a successful controller run"
+      ],
+      "breakingDigest": "sha256:7c18fdd3df180db9e1f043a2286ef3f02fae60b84e42b76cd50da9cfeb77883d",
+      "auditDigest": "sha256:f610b45dbd09692c08aa17c5dcfeaa76677e52cbeb0f7728b83675e7622fdca5"
     }
   ],
-  "compatibilityDigest": "sha256:edc3653e5cb34efd97065a6941db16140bbf375a565bbcf329d9d795bb07676f",
-  "contractDigest": "sha256:258754eda5a226613f7de25885817f18f98b370073eade2c73e295b8179cd3ae"
+  "compatibilityDigest": "sha256:cdf588422ec6b460bd6f631400efa6e361a045e052c8967d6c50fadd7aa4dd90",
+  "contractDigest": "sha256:a4efdf326492081d7e015eb2c04355c54c9b68bd45d32a102b8879d112db72a0"
 }