@kungfu-tech/buildchain 2.14.17-alpha.9 → 2.14.17

package/dist/site/public-surface-audit.json

@@ -5,8 +5,8 @@
   "summary": {
     "cliCommandCount": 86,
     "workflowCount": 51,
-    "actionCount": 5,
-    "sitePageCount": 53,
+    "actionCount": 4,
+    "sitePageCount": 52,
     "docCommandRefCount": 265,
     "failureCount": 0
   },
@@ -501,11 +501,7 @@
           "checkout-cache-mode",
           "checkout-cache-reference-repository-template",
           "checkout-cache-timeout-seconds",
-          "credential-island-environment",
-          "credential-island-macos-app-path",
-          "credential-island-macos-platform-id",
           "expected-artifacts-json",
-          "fail-fast",
           "gate-profile-aggregate-json",
           "install-command",
           "kfd-agent-hub",
@@ -540,18 +536,13 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 64,
+        "inputCount": 60,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
-          "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
-          "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
-          "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
-          "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+          "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN"
         ],
-        "secretCount": 8,
+        "secretCount": 3,
         "outputs": [
           "build-diagnostics-summary-artifact",
           "build-diagnostics-summary-json",
@@ -572,8 +563,6 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
-          "credential-island-macos-artifact",
-          "credential-island-macos-manifest-artifact",
           "linux-container-enabled",
           "linux-container-image",
           "platform-count",
@@ -595,7 +584,7 @@
           "runner-preset",
           "trusted-event"
         ],
-        "outputCount": 41
+        "outputCount": 39
       },
       {
         "id": ".bump-minor-version",
@@ -760,7 +749,6 @@
           "publish-mode",
           "publish-package-main",
           "publish-package-set-order",
-          "publish-rematerialize-on-resume",
           "publish-required-artifacts-json",
           "publish-target",
           "release-candidate-workflow-file",
@@ -786,7 +774,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 74,
+        "inputCount": 73,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1228,11 +1216,7 @@
           "checkout-cache-mode",
           "checkout-cache-reference-repository-template",
           "checkout-cache-timeout-seconds",
-          "credential-island-environment",
-          "credential-island-macos-app-path",
-          "credential-island-macos-platform-id",
           "expected-artifacts-json",
-          "fail-fast",
           "gate-profile-aggregate-json",
           "install-command",
           "kfd-agent-hub",
@@ -1267,18 +1251,13 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 67,
+        "inputCount": 63,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
-          "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
-          "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
-          "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
-          "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+          "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN"
         ],
-        "secretCount": 8,
+        "secretCount": 3,
         "outputs": [
           "build-diagnostics-summary-artifact",
           "build-diagnostics-summary-json",
@@ -1302,8 +1281,6 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
-          "credential-island-macos-artifact",
-          "credential-island-macos-manifest-artifact",
           "linux-container-enabled",
           "linux-container-image",
           "platform-count",
@@ -1325,7 +1302,7 @@
           "runner-preset",
           "trusted-event"
         ],
-        "outputCount": 44
+        "outputCount": 42
       },
       {
         "id": "buildchain-alpha-self-dogfood",
@@ -1844,7 +1821,6 @@
           "publish-mode",
           "publish-package-main",
           "publish-package-set-order",
-          "publish-rematerialize-on-resume",
           "publish-required-artifacts-json",
           "publish-target",
           "release-candidate-workflow-file",
@@ -1870,7 +1846,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 66,
+        "inputCount": 65,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2070,33 +2046,6 @@
       }
     ],
     "actionInputs": [
-      {
-        "id": "macos-credential-island",
-        "path": "actions/macos-credential-island/action.yml",
-        "inputs": [
-          "artifact-name",
-          "artifact-relative-output",
-          "artifact-stem",
-          "buildchain-runtime-sha",
-          "certificate-p12-base64",
-          "certificate-password",
-          "certificate-sha1",
-          "entitlements-profile",
-          "expected-bundle-id",
-          "expected-team-id",
-          "input-root",
-          "notary-api-issuer",
-          "notary-api-key-id",
-          "notary-api-key-p8-base64",
-          "output-root",
-          "platform-id",
-          "source-ref",
-          "source-repository",
-          "source-sha",
-          "source-tree-sha"
-        ],
-        "inputCount": 20
-      },
       {
         "id": "promote-buildchain-ref",
         "path": "actions/promote-buildchain-ref/action.yml",
@@ -2125,7 +2074,6 @@
           "publish-mode",
           "publish-package-main",
           "publish-package-set-order",
-          "publish-rematerialize-on-resume",
           "publish-required-artifacts-json",
           "publish-source-locked",
           "publish-source-ref",
@@ -2165,7 +2113,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 63
+        "inputCount": 62
       },
       {
         "id": "report-buildchain-issue",
@@ -2257,10 +2205,6 @@
       }
     ],
     "sitePages": [
-      {
-        "id": "action:macos-credential-island",
-        "category": "action"
-      },
       {
         "id": "action:promote-buildchain-ref",
         "category": "action"
@@ -3803,8 +3747,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "cc76cd0f061103d8ab78ee97dd0b7f0d28d64489f79b7ed06c94d8fef28bc200",
-    "workflowRegistryDigest": "3a444436846b336459e4ee7e968f820e442a170b642d7b73ea19eaa28ed7da6c",
-    "pageRegistryDigest": "47fb460187d5775db272b95f59ce44d89fce89d10301d52a815b00eebebbadca"
+    "workflowRegistryDigest": "a954f67672292e16be1f4f663a98d0c69285f7359a43d5d6333b3ffcf6463c35",
+    "pageRegistryDigest": "683eb0c1a92cb0f03ae8c31c514adb468bbdeaa9b4b9b3618c34f830bd4c6e88"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -520,7 +520,6 @@
       "signals": [
         "write-permission",
         "oidc",
-        "environment",
         "cloud-credential"
       ],
       "classified": true
@@ -850,5 +849,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "afd9a121b15d4965c55fcbe2c6c4d59b94e96536179c145f246d8fd0517aad7b"
+  "registryDigest": "5f3d4759ffd0dda1addde124221238f8c1a9b6cf07005419d68a0ab946b2841e"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-23T19:23:55.508Z",
-  "publishedAt": "2026-07-23T19:23:55.508Z",
+  "generatedAt": "2026-07-23T20:15:49.277Z",
+  "publishedAt": "2026-07-23T20:15:49.277Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "7ad5dfc32b449dbdd6bac06846d63fccdbbda245",
+  "sourceRevision": "28126ef585164dbb5315d098c39a8f3f9f7363e8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.17-alpha.9",
+    "version": "2.14.17",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-23T19:23:55.508Z",
-  "publishedAt": "2026-07-23T19:23:55.508Z",
+  "generatedAt": "2026-07-23T20:15:49.277Z",
+  "publishedAt": "2026-07-23T20:15:49.277Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "7ad5dfc32b449dbdd6bac06846d63fccdbbda245",
+  "sourceRevision": "28126ef585164dbb5315d098c39a8f3f9f7363e8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.17-alpha.9",
+    "version": "2.14.17",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -205,7 +205,7 @@
       "path": "docs/kfd-support.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:58a60b3e54bc47d4bc9b6e08a432ba4ff75ed2275ef056d04c44cc2bc25046da"
+      "digest": "sha256:ab15de33a1a9e292b6da74c00b8b96b7c46330d0553a454d1de4c24c672fc025"
     },
     {
       "id": "kfd-agent-hub",
@@ -229,7 +229,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:069ba73cf32b9f55a62fd5f4bfaec00608498019b53e8ae1387d7dc9de26bc29"
+      "digest": "sha256:9c125f6d2b519c96718f45da62ac1a891ab618bcb331d3b14c4b88b5158fc4a9"
     },
     {
       "id": "publish-transaction",
@@ -269,7 +269,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:199ed8e83c988836f757c9a16b58ec441e0bd04a4f3465f21cc73ed7f530e610"
+      "digest": "sha256:10ec868fcb3fd58ae35b54ecd8ccd9a4556516f460c262f0c1ee41c81bdbc264"
     },
     {
       "id": "web-surface-deployments",

package/dist/site/workflow-registry.json

@@ -63,11 +63,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
-        "credential-island-environment",
-        "credential-island-macos-app-path",
-        "credential-island-macos-platform-id",
         "expected-artifacts-json",
-        "fail-fast",
         "gate-profile-aggregate-json",
         "install-command",
         "kfd-agent-hub",
@@ -102,18 +98,13 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 64,
+      "inputCount": 60,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
-        "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
-        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
-        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
-        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+        "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN"
       ],
-      "secretCount": 8,
+      "secretCount": 3,
       "outputs": [
         "build-diagnostics-summary-artifact",
         "build-diagnostics-summary-json",
@@ -134,8 +125,6 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
-        "credential-island-macos-artifact",
-        "credential-island-macos-manifest-artifact",
         "linux-container-enabled",
         "linux-container-image",
         "platform-count",
@@ -157,7 +146,7 @@
         "runner-preset",
         "trusted-event"
       ],
-      "outputCount": 41,
+      "outputCount": 39,
       "surface": "reusable-build",
       "capabilityGroup": "api-cli-reference",
       "status": "active"
@@ -334,7 +323,6 @@
         "publish-mode",
         "publish-package-main",
         "publish-package-set-order",
-        "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
         "publish-target",
         "release-candidate-workflow-file",
@@ -360,7 +348,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 74,
+      "inputCount": 73,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -847,11 +835,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
-        "credential-island-environment",
-        "credential-island-macos-app-path",
-        "credential-island-macos-platform-id",
         "expected-artifacts-json",
-        "fail-fast",
         "gate-profile-aggregate-json",
         "install-command",
         "kfd-agent-hub",
@@ -886,18 +870,13 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 67,
+      "inputCount": 63,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
-        "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
-        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
-        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
-        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+        "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN"
       ],
-      "secretCount": 8,
+      "secretCount": 3,
       "outputs": [
         "build-diagnostics-summary-artifact",
         "build-diagnostics-summary-json",
@@ -921,8 +900,6 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
-        "credential-island-macos-artifact",
-        "credential-island-macos-manifest-artifact",
         "linux-container-enabled",
         "linux-container-image",
         "platform-count",
@@ -944,7 +921,7 @@
         "runner-preset",
         "trusted-event"
       ],
-      "outputCount": 44,
+      "outputCount": 42,
       "surface": "channel-build-router",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -1526,7 +1503,6 @@
         "publish-mode",
         "publish-package-main",
         "publish-package-set-order",
-        "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
         "publish-target",
         "release-candidate-workflow-file",
@@ -1552,7 +1528,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 66,
+      "inputCount": 65,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1783,35 +1759,6 @@
   ],
   "actionSource": "actions/*/action.yml reverse input enumeration",
   "actions": [
-    {
-      "id": "macos-credential-island",
-      "path": "actions/macos-credential-island/action.yml",
-      "inputs": [
-        "artifact-name",
-        "artifact-relative-output",
-        "artifact-stem",
-        "buildchain-runtime-sha",
-        "certificate-p12-base64",
-        "certificate-password",
-        "certificate-sha1",
-        "entitlements-profile",
-        "expected-bundle-id",
-        "expected-team-id",
-        "input-root",
-        "notary-api-issuer",
-        "notary-api-key-id",
-        "notary-api-key-p8-base64",
-        "output-root",
-        "platform-id",
-        "source-ref",
-        "source-repository",
-        "source-sha",
-        "source-tree-sha"
-      ],
-      "inputCount": 20,
-      "capabilityGroup": "api-cli-reference",
-      "status": "active"
-    },
     {
       "id": "promote-buildchain-ref",
       "path": "actions/promote-buildchain-ref/action.yml",
@@ -1840,7 +1787,6 @@
         "publish-mode",
         "publish-package-main",
         "publish-package-set-order",
-        "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
         "publish-source-locked",
         "publish-source-ref",
@@ -1880,7 +1826,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 63,
+      "inputCount": 62,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/kfd-support.md

@@ -322,12 +322,6 @@ Buildchain validates this shape whenever a KFD-3 registry is read or written.
 Repositories that do not declare the registrar remain outside Shifu's
 distribution jurisdiction.
 
-KFD-3 surface audits also bind a detected artifact to its owning declared
-surface when the detected kind and path match one of these distribution
-artifacts. This lets one participant-facing CLI remain the declared interface
-while its platform binaries are proved as distributions of that interface,
-instead of being reported as unrelated unregistered surfaces.
-
 ## Detected, Declared, Enforced
 
 KFD-3 surface registration uses three states.

package/docs/reusable-build-surface.md

@@ -115,13 +115,6 @@ Only include platforms that should run. GitHub schedules matrix jobs before
 steps execute, so a disabled entry with unavailable runner labels can still
 block the workflow queue.
 
-`fail-fast` defaults to `false`, preserving the diagnostic behavior that
-collects every platform result. Required promotion callers can set it to `true`
-to cancel sibling native, container, and relay matrix lanes after the first
-failure. This input changes scheduling only: it does not reduce the declared
-platform matrix, turn cancellation into a pass, or alter artifact and release
-admission.
-
 ## Linux Job Containers
 
 Linux build platforms can run inside a digest-pinned job container while macOS
@@ -516,47 +509,6 @@ release jobs can detect drifting diagnostics JSON contracts and missing or
 drifting diagnostics sidecar manifests without downloading the per-platform
 diagnostics artifacts first.
 
-## macOS Credential Island
-
-Alpha consumers can ask the build controller to seal one exact macOS app and
-hand it to a separate protected signing job:
-
-```yaml
-with:
-  credential-island-macos-app-path: product/dist/desktop/mac-arm64/Kungfu Episodes.app
-  credential-island-environment: alpha-macos-signing
-  credential-island-macos-platform-id: macos-arm64
-```
-
-The ordinary matrix uploads
-`credential-island-input-<platform>-<source-sha>`, containing a `ditto`
-archive and a manifest bound to the caller repository, source commit, source
-tree, bundle identity, version, size, and digest. The pinned reusable workflow
-then starts a separate GitHub-hosted macOS job that names the caller
-environment. That job has no source checkout or package-manager step: it
-downloads the immutable Buildchain action runtime plus the sealed app and never
-invokes consumer code.
-
-The protected environment supplies these non-secret variables:
-
-- `BUILDCHAIN_MACOS_EXPECTED_BUNDLE_ID`
-- `BUILDCHAIN_MACOS_EXPECTED_TEAM_ID`
-- `BUILDCHAIN_MACOS_CERTIFICATE_SHA1`
-
-and these secrets:
-
-- `BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64`
-- `BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD`
-- `BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64`
-- `BUILDCHAIN_MACOS_NOTARY_API_KEY_ID`
-- `BUILDCHAIN_MACOS_NOTARY_API_ISSUER`
-
-The signed DMG, signed app ZIP, credential evidence, and their source-bound
-platform manifest form one additional release-candidate platform. Reviewers can
-therefore verify the exact caller source and immutable Buildchain runtime that
-entered the credential island before admitting or publishing the signed
-artifacts.
-
 ## Artifact Transfer Relay
 
 By default, platform jobs upload payloads, manifests, and diagnostics directly

package/docs/versioning.md

@@ -61,7 +61,6 @@ repository changes are patch".
 
 | Date | Action | Line | Faces | Class | Rationale | PR |
 | --- | --- | --- | --- | --- | --- | --- |
-| 2026-07-23 | extend-minor | `v2.14` | credential-island-macos-input, protected-signer-job, macos-signing-evidence, action-subpaths | additive | The reusable build surface can seal an exact source-bound macOS app and hand it to a protected caller environment, where an immutable Buildchain action signs, notarizes, staples, Gatekeeper-assesses, and returns an auditable additional release-candidate platform without exposing credentials to consumer lifecycle jobs. | |
 | 2026-07-20 | extend-minor | `v2.14` | anchored-derived-version-material, build-controller-evidence, release-passport, package-subpaths, release-propagation-controller | additive | Anchored/manual consumers can declare derived version witnesses that Buildchain regenerates and verifies before heavy builds, binds to exact alpha/release trees and passports, and admits during protected promotion; propagation receipts now model their existing optional consumer stages. | |
 | 2026-07-17 | extend-minor | `v2.14` | merge-queue-config, release-line-governance-inheritance | additive | Buildchain config can explicitly enable, inherit, or disable exact dev-channel merge queues, and release-line bootstrap reconciles the declared or inherited policy before moving the repository default branch. | |
 | 2026-07-16 | open-minor | `v2.14` | dev-merge-queue-governance | additive | The public CLI adds a dry-run-first, idempotent merge-queue governance command that verifies required workflow event compatibility before applying an exact dev-channel ruleset and removing the strict up-to-date race. | |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.17-alpha.9",
+  "version": "2.14.17",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-contract.js

@@ -355,57 +355,6 @@ export function createBuildchainContractWorld({
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874",
       ],
     }),
-    surface(root, {
-      id: "macos-credential-island-action",
-      kind: "action",
-      path: "actions/macos-credential-island/action.yml",
-      publicRef: `kungfu-systems/buildchain/actions/macos-credential-island@${majorLine}`,
-      requiredInputs: [
-        "input-root",
-        "output-root",
-        "source-repository",
-        "source-sha",
-        "source-tree-sha",
-        "buildchain-runtime-sha",
-        "artifact-name",
-        "expected-bundle-id",
-        "expected-team-id",
-        "certificate-sha1",
-        "certificate-p12-base64",
-        "certificate-password",
-        "notary-api-key-p8-base64",
-        "notary-api-key-id",
-        "notary-api-issuer",
-      ],
-      requiredOutputs: [
-        "evidence-path",
-        "manifest-path",
-        "artifact-root",
-        "dmg-path",
-        "zip-path",
-        "dmg-sha256",
-        "zip-sha256",
-      ],
-      breakingDefaults: {
-        entitlementsProfile: "electron-desktop-v1",
-        credentialBoundary: "protected-caller-job",
-        consumerCodeExecution: "forbidden",
-      },
-      optionalInputs: [
-        "source-ref",
-        "platform-id",
-        "entitlements-profile",
-        "artifact-stem",
-        "artifact-relative-output",
-      ],
-      guarantees: [
-        "the action validates a source-bound sealed app before credentials are imported",
-        "the action accepts one exact Developer ID Application fingerprint and a Buildchain-owned entitlements profile",
-        "consumer source and artifact-contained executables are never invoked",
-        "the app and DMG are notarized, stapled, Gatekeeper assessed, and bound to retained evidence",
-        "temporary keychain and API key material are cleaned in both main and post phases",
-      ],
-    }),
     surface(root, {
       id: "report-buildchain-issue-action",
       kind: "action",
@@ -629,13 +578,6 @@ export function createBuildchainContractWorld({
         registryDigest: resolvedControllerRegistry.digest,
         inputClassifications: descriptor.inputs,
       },
-      ...(descriptor.id === "build-lifecycle"
-        ? {
-            compatibleBreakingDigests: [
-              "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
-            ],
-          }
-        : {}),
       guarantees: [
         "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest",
         "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes",

package/packages/core/buildchain-kfd-claims.js

@@ -87,8 +87,6 @@ const WORKFLOW_AND_ACTION_FILES = Object.freeze([
   ".github/workflows/release-candidate-promote.yml",
   ".github/workflows/buildchain-ref-promotion.yml",
   ".github/workflows/release-propagation.yml",
-  "actions/macos-credential-island/action.yml",
-  "actions/macos-credential-island/index.js",
   "actions/promote-buildchain-ref/action.yml",
   "actions/promote-buildchain-ref/index.js",
 ]);