@kungfu-tech/buildchain 2.14.18-alpha.1 → 2.14.18-alpha.11

package/README.md

@@ -362,6 +362,7 @@ npm pack --dry-run --json --registry=https://registry.npmjs.org/
 - [Documentation map](docs/MAP.md)
 - [Product mechanism](docs/product-mechanism.md)
 - [Release Passport and binary distribution](docs/release-passport.md)
+- [GitHub governance authority](docs/github-governance-authority.md)
 - [Binary distribution details](docs/binary-distribution.md)
 - [Toolkit observability](docs/toolkit-observability.md)
 - [Site bundle contract](docs/site-bundle-contract.md)

package/actions/promote-buildchain-ref/README.md

@@ -82,17 +82,18 @@ explicitly, then run the normal channel promotion flow for that line.
 
 When branch protection requires pull requests, generated version-state commits
 still run through promotion automation first. The action updates
-Buildchain-managed channel protection before generated bookkeeping, adds the
-authenticated promotion token user or app to the bypass allowlist, creates
+Buildchain-managed channel protection before generated bookkeeping, admits only
+the exact `github-actions` App to the target-bound bypass allowlist, creates
 every configured required check on the exact generated version-state commit, then
 tries to apply that commit directly. If GitHub still rejects release
 finalization bookkeeping, Buildchain creates or reuses a same-repository
 `buildchain/version-state/*` PR based on the current target channel head and
 returns `finalization-needed=true`; a later idempotent promotion run can resume
-from the durable transaction state. Strict alpha promotion still fails with a
-configuration diagnostic instead of opening a post-publish human PR. Reusable
-wrapper callers should allow `checks: write` so the generated checks are owned by
-GitHub Actions and matches the managed branch protection rule.
+from the durable transaction state. Strict alpha uses the same protected
+version-state PR recovery for its target and dev bookkeeping, and does not move
+tags until those provider-enforced transactions land. Reusable wrapper callers
+should allow `checks: write` so the generated checks are owned by GitHub Actions
+and match the managed branch protection rule.
 
 Stable promotion also protects concurrent development work. The reusable
 wrapper checks out the exact current `dev/vN/vN.M` head as a reconciliation
@@ -104,17 +105,23 @@ This prevents generated projections from an older release tree from replacing
 capabilities that reached dev while the release was in progress.
 
 For Buildchain-owned automation, callers may pass
-`branch-protection-bypass-apps`, `branch-protection-bypass-users`, or
-`branch-protection-bypass-teams`. The action still configures managed
+`branch-protection-bypass-apps: github-actions`. The action rejects every other
+App slug and all user or team bypass actors. It configures managed
 `dev/vN/vN.M`, `alpha/vN/vN.M`, and `release/vN/vN.M` branches with one
-required approving review, strict GitHub Actions checks, admin enforcement,
+required approving review, Code Owner review, stale-review dismissal,
+latest-push approval, exact App-bound GitHub Actions checks, admin enforcement,
 conversation resolution, no force pushes, and no deletions; the bypass
 allowance only lets the named automation identity apply generated version-state
 or channel bookkeeping without a second human review after the reviewed channel
-PR has already merged. Direct action calls automatically include the current
-promotion token's authenticated user or app when GitHub exposes it; explicit
-inputs are supplemental allowlist entries for less discoverable release
-authorities.
+PR has already merged.
+
+GitHub may return either `403` or a deliberately opaque `404` when a
+non-administrator token reads the full branch-protection endpoint. In that
+case, promotion reads the provider's branch summary and accepts only an
+already-protected branch that enforces the exact required check for everyone.
+It does not interpret the opaque response as missing protection or try to
+rewrite policy with a developer token. The independent publication-authority
+audit remains responsible for the complete read-only governance proof.
 
 ## Publish Transactions
 
@@ -125,7 +132,7 @@ trusted channel workflow:
 - uses: kungfu-systems/buildchain/actions/promote-buildchain-ref@v2
   with:
     token: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
-    generated-ref-update-token: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
+    generated-ref-update-token: ${{ github.token }}
     sha: ${{ github.sha }}
     target-ref: release/v2/v2.0
     publish-transaction: "true"
@@ -406,26 +413,22 @@ governance semantics:
   with either the `verification-command` input or `buildchain.toml`
   `lifecycle.verify` before any tags or channel refs move.
 
-The promotion workflow should use `BUILDCHAIN_PROMOTION_TOKEN` for non-dry-run
-promotion. The token is the buildchain equivalent of the old ABV runner release
-authority: protected branch review and check rules guard human channel merges,
-while the reusable build trust gate now checks the source-lock channel HEAD and
-merged same-repository PR lineage before heavy build runners start. This action
-still independently rechecks PR lineage, alpha/release tree equivalence, and
-generated version-state verification before moving channel refs and tags.
-Generated version-state direct ref updates can use a separate
-`generated-ref-update-token`; the reusable wrapper defaults it to
-`secrets.BUILDCHAIN_PROMOTION_TOKEN || github.token`. Consumers that protect
-`dev/*`, `alpha/*`, or `release/*` with one required review should configure
-`BUILDCHAIN_PROMOTION_TOKEN` as the bypass-capable release authority, so
-post-publish dev/alpha/release bookkeeping completes without a human PR.
+The reusable promotion workflow keeps governance reads, generated status checks,
+and generated ref updates on the run-scoped `github.token`. When branch
+protection rejects generated bookkeeping, it supplies `BUILDCHAIN_PROMOTION_TOKEN`
+only through `generated-pull-request-token` so the same-repository recovery PR can
+be listed or created without broadening the governance client. Protected branch
+review and check rules guard human channel merges, while the reusable build trust
+gate checks the source-lock channel HEAD and merged same-repository PR lineage
+before heavy build runners start. This action still independently rechecks PR
+lineage, alpha/release tree equivalence, and generated version-state verification
+before moving channel refs and tags.
 The reusable `release-candidate-promote.yml` wrapper defaults
 `branch-protection-bypass-apps` to `github-actions`, so flow-internal promotion
 can complete generated `dev`/`alpha`/`release` bookkeeping while ordinary human
 pushes and PR merges remain governed by the one-review branch protection rule.
-The promotion action also auto-discovers the current token's authenticated user
-or app and adds it to the managed bypass allowlist, so consumers do not have to
-declare the same release authority twice.
+The promotion action rejects alternate App slugs and every user or team bypass,
+so the mutation path cannot widen the authority descriptor.
 
 The tag names intentionally follow the old ABV release semantics:
 exact release tags are `vX.Y.Z`, exact alpha tags are `vX.Y.Z-alpha.N`, floating

package/bin/buildchain.mjs

@@ -148,6 +148,7 @@ function usage() {
   buildchain release-governance reconcile --repository <owner/repo>
                                --branch <dev|alpha|release/vN/vN.N>
                                --candidate-sha <sha> [--apply] [--json]
+  buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...
   buildchain release <inspect|recover|finalize|abort> ...
   buildchain transaction inspect ...
   buildchain collect github-release --tag <tag> [--repository <owner/repo>]
@@ -184,6 +185,8 @@ function usage() {
                           --publication-evidence-json <file-or-json>
                           [--expected-json <file-or-json>] [--used-nonce <nonce>]... [--json]
   buildchain audit publication-control-plane --repository <owner/repo> --branch <protected-branch>
+  buildchain audit github-governance [--organization <owner>] [--repository <owner/repo>]
+                                     [--output <file>] [--require-qualifying] [--json]
                           [--source-sha <merged-branch-sha>] [--workflow-repository <owner/repo>]
                           [--workflow <path>] [--workflow-ref <sha-or-ref>]
                           [--job <id>] [--environment <name>] [--package <name>]
@@ -2024,11 +2027,15 @@ async function main(argv = process.argv.slice(2)) {
 
   if (command === "audit") {
     const [subcommand = "", ...auditArgs] = args;
-    if (subcommand !== "publication-control-plane") {
-      throw new Error("usage: buildchain audit publication-control-plane --repository <owner/repo> --branch <protected-branch>");
+    if (subcommand === "publication-control-plane") {
+      runScript("audit-publication-control-plane.mjs", auditArgs);
+      return;
     }
-    runScript("audit-publication-control-plane.mjs", auditArgs);
-    return;
+    if (subcommand === "github-governance") {
+      runScript("audit-github-governance.mjs", auditArgs);
+      return;
+    }
+    throw new Error("usage: buildchain audit <publication-control-plane|github-governance> ...");
   }
 
   if (command === "explain") {
@@ -2149,6 +2156,11 @@ async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  if (command === "github-governance") {
+    runScript("reconcile-github-governance.mjs", args);
+    return;
+  }
+
   if (command === "badges") {
     await runReadmeBadgesCli(args);
     return;

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.1",
+    "version": "2.14.18-alpha.11",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -50,7 +50,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:c745bc1ae44adec6f5fb7e4f7c31eee2543e978bbf0021102634a9efd4cb0f81"
+      "auditDigest": "sha256:1e1386b49f8f3ea813f8157afb96cecec7609b6efe01f07895c893c097b1ed66"
     },
     {
       "contractVersion": 1,
@@ -89,7 +89,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:50baf9fb6743b74d4c2489941dbc1e2e917a6df8e053258a4a4414e4868ec0cc"
+      "auditDigest": "sha256:1f29079465cb11004db3f1a6ec4f37b1900fdd90d3278d8d0bacb223757bffa5"
     },
     {
       "contractVersion": 1,
@@ -170,7 +170,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:1f476fb9a4854b362c4b24cef89a3c7675d7d63baf3bc828d7b8ae7d2787cead",
-      "auditDigest": "sha256:069b7e2f83dea972b139ccee42876b4cb4644fcff2e7931696b9d0c9e8d98f09"
+      "auditDigest": "sha256:5a5cbec0b5382c34101623ed11f264797b618920d8c98c78e0d14af9f07a1f6b"
     },
     {
       "contractVersion": 1,
@@ -212,7 +212,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:ce4cdad0b0165349fe2fa1377f10a7625faa90fa2fb858d7603640b19de0de06"
+      "auditDigest": "sha256:ba3117f22b343d5f18cd48d327bffaa8ed442cb6150b6c2f95d091808cd009a7"
     },
     {
       "contractVersion": 1,
@@ -256,7 +256,7 @@
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
       ],
       "breakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
-      "auditDigest": "sha256:4a7c696ec399c14aa3170fdd24adac0d624bd33db6a2639c489e2b58726c190b"
+      "auditDigest": "sha256:063dfe24e1ccdd95b4ffbf89a154aa71197c8bd1cb98b4705d8663917c026366"
     },
     {
       "contractVersion": 1,
@@ -327,7 +327,7 @@
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
       ],
       "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
-      "auditDigest": "sha256:cfb90e83dd459200534dbabeabce0effbc143e1e2578313c849743d009864d86"
+      "auditDigest": "sha256:c23298988d29d6dbf99c65fd7d5567d704f012cc7a061c46a848c26814cab4b9"
     },
     {
       "contractVersion": 1,
@@ -551,7 +551,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:0e33a9c24a2a23e5657d06ee7013454ada97b141a3dbae0c10490554bb74bf1f"
+      "auditDigest": "sha256:a6f8915ef3ade05f04efff98c1723f7562e2b4fc83dcdb1e7decead0e5ac7533"
     },
     {
       "contractVersion": 1,
@@ -641,7 +641,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:eba91f08a1327fc7465029e7788d8da9b909531581ddb2bc402a46452f54e17e"
+      "auditDigest": "sha256:29b45afe77400b5b38872574cdf7ccfcf8abc93b7f78ad32d994a6636a4f9f68"
     },
     {
       "contractVersion": 1,
@@ -663,7 +663,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:0e17c4d3fd07e8c4b4db81efa6757cf7554449139dfe9657aeaaf81dc79f8c0d"
+      "auditDigest": "sha256:4572769775450f49fa37a72e6dda211eea0af0a4dd73ad1d188dbb34782a35a9"
     },
     {
       "contractVersion": 1,
@@ -714,7 +714,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -830,6 +830,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "credential-island-caller-owned",
         "credential-island-environment",
         "credential-island-macos-app-path",
         "credential-island-macos-platform-id",
@@ -871,8 +872,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:fd1519f97e045331a21454da1132385d3f4e68f21479b311f0f3569618fe62b1",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "digest": "sha256:a06607b6ebd3fb00b77519098c81d6fb5e9943ec268aebb1e5fdbefef6e598ad",
+        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1010,6 +1011,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "credential-island-caller-owned": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "credential-island-environment": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1174,7 +1179,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
-      "auditDigest": "sha256:c745bc1ae44adec6f5fb7e4f7c31eee2543e978bbf0021102634a9efd4cb0f81"
+      "auditDigest": "sha256:1e1386b49f8f3ea813f8157afb96cecec7609b6efe01f07895c893c097b1ed66"
     },
     {
       "contractVersion": 1,
@@ -1249,6 +1254,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "credential-island-caller-owned",
         "credential-island-environment",
         "credential-island-macos-app-path",
         "credential-island-macos-platform-id",
@@ -1290,8 +1296,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:1f6bc118b79876ecab5760356676a3b5076da44f4ba763a6b110f9b1d6fdfb38",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "digest": "sha256:4fc6c33bf5b429f8087ac752d5cf2a19f4a1cc30db01aae927a28cee1cf924f0",
+        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1441,6 +1447,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "credential-island-caller-owned": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "credential-island-environment": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1602,7 +1612,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:50baf9fb6743b74d4c2489941dbc1e2e917a6df8e053258a4a4414e4868ec0cc"
+      "auditDigest": "sha256:1f29079465cb11004db3f1a6ec4f37b1900fdd90d3278d8d0bacb223757bffa5"
     },
     {
       "contractVersion": 1,
@@ -1661,7 +1671,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:29569f4b754595792a16742d1c4c63838b54601674a2cb6c96261a72c962dece",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1797,6 +1807,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "fail-on-release-pr-error",
+        "github-governance-receipt-json",
         "node-version",
         "preview-apply",
         "preview-aws-role-arn",
@@ -1831,8 +1842,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:7e6283c8fbeab7a680bae57c9ab9c8eb94aab7400d3ee01c5b9dfdd03f149edb",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "digest": "sha256:65cc01e6d2b622277d67237e4811e82d24d2289d55c2f7d2dfb72325c610b2ea",
+        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -1870,6 +1881,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "github-governance-receipt-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "node-version": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2003,7 +2018,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27",
-      "auditDigest": "sha256:4a7c696ec399c14aa3170fdd24adac0d624bd33db6a2639c489e2b58726c190b"
+      "auditDigest": "sha256:063dfe24e1ccdd95b4ffbf89a154aa71197c8bd1cb98b4705d8663917c026366"
     },
     {
       "contractVersion": 1,
@@ -2068,7 +2083,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2220,6 +2235,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "dry-run",
+        "github-governance-receipt-json",
         "github-release",
         "github-release-notes",
         "github-release-title",
@@ -2248,8 +2264,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:0613ea545fe2d630f34e665c8e6fe99df3f5333d75051a7176e9cf991e494f59",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
+        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2299,6 +2315,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "github-governance-receipt-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "github-release": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2408,7 +2428,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:0eb318df455ef9cb737a7c2515a2411b685d34ed0bde7b5f5b173a7a42513114",
-      "auditDigest": "sha256:9b810a4120c819dc28021921da243ddcc8d3f832fd610ef9d1be0212d3ba3fa6"
+      "auditDigest": "sha256:fd939f9dcce745f3e1b8063b68715460cb8e1af6d2b813a96b37a741740122b9"
     },
     {
       "contractVersion": 1,
@@ -2457,6 +2477,9 @@
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
         "BUILDCHAIN_ISSUE_TOKEN",
         "BUILDCHAIN_PROMOTION_TOKEN",
+        "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY",
+        "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN",
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY",
         "allow-repository",
         "artifact-name",
         "artifact-patterns",
@@ -2473,8 +2496,10 @@
         "buildchain-repository",
         "channel",
         "dry-run",
+        "github-governance-receipt-json",
         "github-release",
         "github-release-notes",
+        "github-release-payload-patterns",
         "github-release-title",
         "package-manager",
         "promotion-contract-lock-digest",
@@ -2491,6 +2516,8 @@
         "publication-admission-json",
         "publication-auto-admission",
         "publication-auto-no-gate",
+        "publication-commit-command",
+        "publication-commit-evidence-path",
         "publication-consumer-predicate-id",
         "publication-consumer-qualification-command",
         "publication-control-plane-audit-json",
@@ -2537,8 +2564,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:bde6769a31f35ea89e8bdc67a4ca37175f24028b2b3975ff795ba5b2fb95d3a5",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "digest": "sha256:98e2676d01470992d7b4ca9c2a1e12b0e6c816c0586a8e8e1736f4b58a1360a9",
+        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -2556,6 +2583,18 @@
             "classification": "redacted",
             "source": "workflow-call-secret"
           },
+          "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY": {
+            "classification": "redacted",
+            "source": "workflow-call-secret"
+          },
+          "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN": {
+            "classification": "redacted",
+            "source": "workflow-call-secret"
+          },
+          "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY": {
+            "classification": "redacted",
+            "source": "workflow-call-secret"
+          },
           "allow-repository": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2620,6 +2659,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "github-governance-receipt-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "github-release": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2628,6 +2671,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "github-release-payload-patterns": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "github-release-title": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2692,6 +2739,14 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "publication-commit-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-commit-evidence-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "publication-consumer-predicate-id": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2873,7 +2928,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:ce4cdad0b0165349fe2fa1377f10a7625faa90fa2fb858d7603640b19de0de06"
+      "auditDigest": "sha256:ba3117f22b343d5f18cd48d327bffaa8ed442cb6150b6c2f95d091808cd009a7"
     },
     {
       "contractVersion": 1,
@@ -2934,7 +2989,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -3057,7 +3112,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3071,5 +3126,5 @@
     }
   ],
   "compatibilityDigest": "sha256:df13c3b8066068925ce847b31002201d533034d10d342542422db3a665c10475",
-  "contractDigest": "sha256:171f367853e2346388feb9df902bafbe67970bd21c86212d3563731fb0ec2b83"
+  "contractDigest": "sha256:4ab4fe71bad2b757c8ec3cc7545245eabaa6f9e440a9c34f8af113804d02067d"
 }