@kungfu-tech/buildchain 2.14.17 → 2.14.18-alpha.1

package/dist/site/public-surface-audit.json

@@ -5,8 +5,8 @@
   "summary": {
     "cliCommandCount": 86,
     "workflowCount": 51,
-    "actionCount": 4,
-    "sitePageCount": 52,
+    "actionCount": 5,
+    "sitePageCount": 53,
     "docCommandRefCount": 265,
     "failureCount": 0
   },
@@ -501,7 +501,11 @@
           "checkout-cache-mode",
           "checkout-cache-reference-repository-template",
           "checkout-cache-timeout-seconds",
+          "credential-island-environment",
+          "credential-island-macos-app-path",
+          "credential-island-macos-platform-id",
           "expected-artifacts-json",
+          "fail-fast",
           "gate-profile-aggregate-json",
           "install-command",
           "kfd-agent-hub",
@@ -536,13 +540,18 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 60,
+        "inputCount": 64,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
-          "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN"
+          "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
+          "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
+          "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
+          "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
         ],
-        "secretCount": 3,
+        "secretCount": 8,
         "outputs": [
           "build-diagnostics-summary-artifact",
           "build-diagnostics-summary-json",
@@ -563,6 +572,8 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
+          "credential-island-macos-artifact",
+          "credential-island-macos-manifest-artifact",
           "linux-container-enabled",
           "linux-container-image",
           "platform-count",
@@ -584,7 +595,7 @@
           "runner-preset",
           "trusted-event"
         ],
-        "outputCount": 39
+        "outputCount": 41
       },
       {
         "id": ".bump-minor-version",
@@ -749,6 +760,7 @@
           "publish-mode",
           "publish-package-main",
           "publish-package-set-order",
+          "publish-rematerialize-on-resume",
           "publish-required-artifacts-json",
           "publish-target",
           "release-candidate-workflow-file",
@@ -774,7 +786,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 73,
+        "inputCount": 74,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1216,7 +1228,11 @@
           "checkout-cache-mode",
           "checkout-cache-reference-repository-template",
           "checkout-cache-timeout-seconds",
+          "credential-island-environment",
+          "credential-island-macos-app-path",
+          "credential-island-macos-platform-id",
           "expected-artifacts-json",
+          "fail-fast",
           "gate-profile-aggregate-json",
           "install-command",
           "kfd-agent-hub",
@@ -1251,13 +1267,18 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 63,
+        "inputCount": 67,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
-          "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN"
+          "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
+          "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
+          "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
+          "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
         ],
-        "secretCount": 3,
+        "secretCount": 8,
         "outputs": [
           "build-diagnostics-summary-artifact",
           "build-diagnostics-summary-json",
@@ -1281,6 +1302,8 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
+          "credential-island-macos-artifact",
+          "credential-island-macos-manifest-artifact",
           "linux-container-enabled",
           "linux-container-image",
           "platform-count",
@@ -1302,7 +1325,7 @@
           "runner-preset",
           "trusted-event"
         ],
-        "outputCount": 42
+        "outputCount": 44
       },
       {
         "id": "buildchain-alpha-self-dogfood",
@@ -1821,6 +1844,7 @@
           "publish-mode",
           "publish-package-main",
           "publish-package-set-order",
+          "publish-rematerialize-on-resume",
           "publish-required-artifacts-json",
           "publish-target",
           "release-candidate-workflow-file",
@@ -1846,7 +1870,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 65,
+        "inputCount": 66,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2046,6 +2070,33 @@
       }
     ],
     "actionInputs": [
+      {
+        "id": "macos-credential-island",
+        "path": "actions/macos-credential-island/action.yml",
+        "inputs": [
+          "artifact-name",
+          "artifact-relative-output",
+          "artifact-stem",
+          "buildchain-runtime-sha",
+          "certificate-p12-base64",
+          "certificate-password",
+          "certificate-sha1",
+          "entitlements-profile",
+          "expected-bundle-id",
+          "expected-team-id",
+          "input-root",
+          "notary-api-issuer",
+          "notary-api-key-id",
+          "notary-api-key-p8-base64",
+          "output-root",
+          "platform-id",
+          "source-ref",
+          "source-repository",
+          "source-sha",
+          "source-tree-sha"
+        ],
+        "inputCount": 20
+      },
       {
         "id": "promote-buildchain-ref",
         "path": "actions/promote-buildchain-ref/action.yml",
@@ -2074,6 +2125,7 @@
           "publish-mode",
           "publish-package-main",
           "publish-package-set-order",
+          "publish-rematerialize-on-resume",
           "publish-required-artifacts-json",
           "publish-source-locked",
           "publish-source-ref",
@@ -2113,7 +2165,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 62
+        "inputCount": 63
       },
       {
         "id": "report-buildchain-issue",
@@ -2205,6 +2257,10 @@
       }
     ],
     "sitePages": [
+      {
+        "id": "action:macos-credential-island",
+        "category": "action"
+      },
       {
         "id": "action:promote-buildchain-ref",
         "category": "action"
@@ -3747,8 +3803,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "cc76cd0f061103d8ab78ee97dd0b7f0d28d64489f79b7ed06c94d8fef28bc200",
-    "workflowRegistryDigest": "a954f67672292e16be1f4f663a98d0c69285f7359a43d5d6333b3ffcf6463c35",
-    "pageRegistryDigest": "683eb0c1a92cb0f03ae8c31c514adb468bbdeaa9b4b9b3618c34f830bd4c6e88"
+    "workflowRegistryDigest": "3a444436846b336459e4ee7e968f820e442a170b642d7b73ea19eaa28ed7da6c",
+    "pageRegistryDigest": "47fb460187d5775db272b95f59ce44d89fce89d10301d52a815b00eebebbadca"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -520,6 +520,7 @@
       "signals": [
         "write-permission",
         "oidc",
+        "environment",
         "cloud-credential"
       ],
       "classified": true
@@ -849,5 +850,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "5f3d4759ffd0dda1addde124221238f8c1a9b6cf07005419d68a0ab946b2841e"
+  "registryDigest": "afd9a121b15d4965c55fcbe2c6c4d59b94e96536179c145f246d8fd0517aad7b"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-23T20:15:49.277Z",
-  "publishedAt": "2026-07-23T20:15:49.277Z",
+  "generatedAt": "2026-07-24T00:28:32.040Z",
+  "publishedAt": "2026-07-24T00:28:32.040Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "28126ef585164dbb5315d098c39a8f3f9f7363e8",
+  "sourceRevision": "ac97c62bfce8d1c686718519ccf2fd8f974142e1",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.17",
+    "version": "2.14.18-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-23T20:15:49.277Z",
-  "publishedAt": "2026-07-23T20:15:49.277Z",
+  "generatedAt": "2026-07-24T00:28:32.040Z",
+  "publishedAt": "2026-07-24T00:28:32.040Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "28126ef585164dbb5315d098c39a8f3f9f7363e8",
+  "sourceRevision": "ac97c62bfce8d1c686718519ccf2fd8f974142e1",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.17",
+    "version": "2.14.18-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -205,7 +205,7 @@
       "path": "docs/kfd-support.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:ab15de33a1a9e292b6da74c00b8b96b7c46330d0553a454d1de4c24c672fc025"
+      "digest": "sha256:58a60b3e54bc47d4bc9b6e08a432ba4ff75ed2275ef056d04c44cc2bc25046da"
     },
     {
       "id": "kfd-agent-hub",
@@ -229,7 +229,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:9c125f6d2b519c96718f45da62ac1a891ab618bcb331d3b14c4b88b5158fc4a9"
+      "digest": "sha256:069ba73cf32b9f55a62fd5f4bfaec00608498019b53e8ae1387d7dc9de26bc29"
     },
     {
       "id": "publish-transaction",
@@ -269,7 +269,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:10ec868fcb3fd58ae35b54ecd8ccd9a4556516f460c262f0c1ee41c81bdbc264"
+      "digest": "sha256:199ed8e83c988836f757c9a16b58ec441e0bd04a4f3465f21cc73ed7f530e610"
     },
     {
       "id": "web-surface-deployments",

package/dist/site/workflow-registry.json

@@ -63,7 +63,11 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "credential-island-environment",
+        "credential-island-macos-app-path",
+        "credential-island-macos-platform-id",
         "expected-artifacts-json",
+        "fail-fast",
         "gate-profile-aggregate-json",
         "install-command",
         "kfd-agent-hub",
@@ -98,13 +102,18 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 60,
+      "inputCount": 64,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
-        "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN"
+        "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
+        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
+        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
+        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
       ],
-      "secretCount": 3,
+      "secretCount": 8,
       "outputs": [
         "build-diagnostics-summary-artifact",
         "build-diagnostics-summary-json",
@@ -125,6 +134,8 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
+        "credential-island-macos-artifact",
+        "credential-island-macos-manifest-artifact",
         "linux-container-enabled",
         "linux-container-image",
         "platform-count",
@@ -146,7 +157,7 @@
         "runner-preset",
         "trusted-event"
       ],
-      "outputCount": 39,
+      "outputCount": 41,
       "surface": "reusable-build",
       "capabilityGroup": "api-cli-reference",
       "status": "active"
@@ -323,6 +334,7 @@
         "publish-mode",
         "publish-package-main",
         "publish-package-set-order",
+        "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
         "publish-target",
         "release-candidate-workflow-file",
@@ -348,7 +360,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 73,
+      "inputCount": 74,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -835,7 +847,11 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "credential-island-environment",
+        "credential-island-macos-app-path",
+        "credential-island-macos-platform-id",
         "expected-artifacts-json",
+        "fail-fast",
         "gate-profile-aggregate-json",
         "install-command",
         "kfd-agent-hub",
@@ -870,13 +886,18 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 63,
+      "inputCount": 67,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
-        "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN"
+        "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
+        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
+        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
+        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
       ],
-      "secretCount": 3,
+      "secretCount": 8,
       "outputs": [
         "build-diagnostics-summary-artifact",
         "build-diagnostics-summary-json",
@@ -900,6 +921,8 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
+        "credential-island-macos-artifact",
+        "credential-island-macos-manifest-artifact",
         "linux-container-enabled",
         "linux-container-image",
         "platform-count",
@@ -921,7 +944,7 @@
         "runner-preset",
         "trusted-event"
       ],
-      "outputCount": 42,
+      "outputCount": 44,
       "surface": "channel-build-router",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -1503,6 +1526,7 @@
         "publish-mode",
         "publish-package-main",
         "publish-package-set-order",
+        "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
         "publish-target",
         "release-candidate-workflow-file",
@@ -1528,7 +1552,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 65,
+      "inputCount": 66,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1759,6 +1783,35 @@
   ],
   "actionSource": "actions/*/action.yml reverse input enumeration",
   "actions": [
+    {
+      "id": "macos-credential-island",
+      "path": "actions/macos-credential-island/action.yml",
+      "inputs": [
+        "artifact-name",
+        "artifact-relative-output",
+        "artifact-stem",
+        "buildchain-runtime-sha",
+        "certificate-p12-base64",
+        "certificate-password",
+        "certificate-sha1",
+        "entitlements-profile",
+        "expected-bundle-id",
+        "expected-team-id",
+        "input-root",
+        "notary-api-issuer",
+        "notary-api-key-id",
+        "notary-api-key-p8-base64",
+        "output-root",
+        "platform-id",
+        "source-ref",
+        "source-repository",
+        "source-sha",
+        "source-tree-sha"
+      ],
+      "inputCount": 20,
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": "promote-buildchain-ref",
       "path": "actions/promote-buildchain-ref/action.yml",
@@ -1787,6 +1840,7 @@
         "publish-mode",
         "publish-package-main",
         "publish-package-set-order",
+        "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
         "publish-source-locked",
         "publish-source-ref",
@@ -1826,7 +1880,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 62,
+      "inputCount": 63,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/kfd-support.md

@@ -322,6 +322,12 @@ Buildchain validates this shape whenever a KFD-3 registry is read or written.
 Repositories that do not declare the registrar remain outside Shifu's
 distribution jurisdiction.
 
+KFD-3 surface audits also bind a detected artifact to its owning declared
+surface when the detected kind and path match one of these distribution
+artifacts. This lets one participant-facing CLI remain the declared interface
+while its platform binaries are proved as distributions of that interface,
+instead of being reported as unrelated unregistered surfaces.
+
 ## Detected, Declared, Enforced
 
 KFD-3 surface registration uses three states.

package/docs/reusable-build-surface.md

@@ -115,6 +115,13 @@ Only include platforms that should run. GitHub schedules matrix jobs before
 steps execute, so a disabled entry with unavailable runner labels can still
 block the workflow queue.
 
+`fail-fast` defaults to `false`, preserving the diagnostic behavior that
+collects every platform result. Required promotion callers can set it to `true`
+to cancel sibling native, container, and relay matrix lanes after the first
+failure. This input changes scheduling only: it does not reduce the declared
+platform matrix, turn cancellation into a pass, or alter artifact and release
+admission.
+
 ## Linux Job Containers
 
 Linux build platforms can run inside a digest-pinned job container while macOS
@@ -509,6 +516,47 @@ release jobs can detect drifting diagnostics JSON contracts and missing or
 drifting diagnostics sidecar manifests without downloading the per-platform
 diagnostics artifacts first.
 
+## macOS Credential Island
+
+Alpha consumers can ask the build controller to seal one exact macOS app and
+hand it to a separate protected signing job:
+
+```yaml
+with:
+  credential-island-macos-app-path: product/dist/desktop/mac-arm64/Kungfu Episodes.app
+  credential-island-environment: alpha-macos-signing
+  credential-island-macos-platform-id: macos-arm64
+```
+
+The ordinary matrix uploads
+`credential-island-input-<platform>-<source-sha>`, containing a `ditto`
+archive and a manifest bound to the caller repository, source commit, source
+tree, bundle identity, version, size, and digest. The pinned reusable workflow
+then starts a separate GitHub-hosted macOS job that names the caller
+environment. That job has no source checkout or package-manager step: it
+downloads the immutable Buildchain action runtime plus the sealed app and never
+invokes consumer code.
+
+The protected environment supplies these non-secret variables:
+
+- `BUILDCHAIN_MACOS_EXPECTED_BUNDLE_ID`
+- `BUILDCHAIN_MACOS_EXPECTED_TEAM_ID`
+- `BUILDCHAIN_MACOS_CERTIFICATE_SHA1`
+
+and these secrets:
+
+- `BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64`
+- `BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD`
+- `BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64`
+- `BUILDCHAIN_MACOS_NOTARY_API_KEY_ID`
+- `BUILDCHAIN_MACOS_NOTARY_API_ISSUER`
+
+The signed DMG, signed app ZIP, credential evidence, and their source-bound
+platform manifest form one additional release-candidate platform. Reviewers can
+therefore verify the exact caller source and immutable Buildchain runtime that
+entered the credential island before admitting or publishing the signed
+artifacts.
+
 ## Artifact Transfer Relay
 
 By default, platform jobs upload payloads, manifests, and diagnostics directly

package/docs/versioning.md

@@ -61,6 +61,7 @@ repository changes are patch".
 
 | Date | Action | Line | Faces | Class | Rationale | PR |
 | --- | --- | --- | --- | --- | --- | --- |
+| 2026-07-23 | extend-minor | `v2.14` | credential-island-macos-input, protected-signer-job, macos-signing-evidence, action-subpaths | additive | The reusable build surface can seal an exact source-bound macOS app and hand it to a protected caller environment, where an immutable Buildchain action signs, notarizes, staples, Gatekeeper-assesses, and returns an auditable additional release-candidate platform without exposing credentials to consumer lifecycle jobs. | |
 | 2026-07-20 | extend-minor | `v2.14` | anchored-derived-version-material, build-controller-evidence, release-passport, package-subpaths, release-propagation-controller | additive | Anchored/manual consumers can declare derived version witnesses that Buildchain regenerates and verifies before heavy builds, binds to exact alpha/release trees and passports, and admits during protected promotion; propagation receipts now model their existing optional consumer stages. | |
 | 2026-07-17 | extend-minor | `v2.14` | merge-queue-config, release-line-governance-inheritance | additive | Buildchain config can explicitly enable, inherit, or disable exact dev-channel merge queues, and release-line bootstrap reconciles the declared or inherited policy before moving the repository default branch. | |
 | 2026-07-16 | open-minor | `v2.14` | dev-merge-queue-governance | additive | The public CLI adds a dry-run-first, idempotent merge-queue governance command that verifies required workflow event compatibility before applying an exact dev-channel ruleset and removing the strict up-to-date race. | |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.17",
+  "version": "2.14.18-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-contract.js

@@ -355,6 +355,57 @@ export function createBuildchainContractWorld({
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874",
       ],
     }),
+    surface(root, {
+      id: "macos-credential-island-action",
+      kind: "action",
+      path: "actions/macos-credential-island/action.yml",
+      publicRef: `kungfu-systems/buildchain/actions/macos-credential-island@${majorLine}`,
+      requiredInputs: [
+        "input-root",
+        "output-root",
+        "source-repository",
+        "source-sha",
+        "source-tree-sha",
+        "buildchain-runtime-sha",
+        "artifact-name",
+        "expected-bundle-id",
+        "expected-team-id",
+        "certificate-sha1",
+        "certificate-p12-base64",
+        "certificate-password",
+        "notary-api-key-p8-base64",
+        "notary-api-key-id",
+        "notary-api-issuer",
+      ],
+      requiredOutputs: [
+        "evidence-path",
+        "manifest-path",
+        "artifact-root",
+        "dmg-path",
+        "zip-path",
+        "dmg-sha256",
+        "zip-sha256",
+      ],
+      breakingDefaults: {
+        entitlementsProfile: "electron-desktop-v1",
+        credentialBoundary: "protected-caller-job",
+        consumerCodeExecution: "forbidden",
+      },
+      optionalInputs: [
+        "source-ref",
+        "platform-id",
+        "entitlements-profile",
+        "artifact-stem",
+        "artifact-relative-output",
+      ],
+      guarantees: [
+        "the action validates a source-bound sealed app before credentials are imported",
+        "the action accepts one exact Developer ID Application fingerprint and a Buildchain-owned entitlements profile",
+        "consumer source and artifact-contained executables are never invoked",
+        "the app and DMG are notarized, stapled, Gatekeeper assessed, and bound to retained evidence",
+        "temporary keychain and API key material are cleaned in both main and post phases",
+      ],
+    }),
     surface(root, {
       id: "report-buildchain-issue-action",
       kind: "action",
@@ -578,6 +629,13 @@ export function createBuildchainContractWorld({
         registryDigest: resolvedControllerRegistry.digest,
         inputClassifications: descriptor.inputs,
       },
+      ...(descriptor.id === "build-lifecycle"
+        ? {
+            compatibleBreakingDigests: [
+              "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
+            ],
+          }
+        : {}),
       guarantees: [
         "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest",
         "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes",