@kungfu-tech/buildchain 2.14.19-alpha.0 → 2.14.19-alpha.2

package/dist/site/public-surface-audit.json

@@ -4,9 +4,9 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 87,
-    "workflowCount": 52,
+    "workflowCount": 53,
     "actionCount": 5,
-    "sitePageCount": 55,
+    "sitePageCount": 56,
     "docCommandRefCount": 276,
     "failureCount": 0
   },
@@ -449,6 +449,39 @@
       }
     ],
     "workflowInputs": [
+      {
+        "id": ".auditable-demo",
+        "path": ".github/workflows/.auditable-demo.yml",
+        "reusable": true,
+        "inputs": [
+          "adapter-path",
+          "artifact-retention-days",
+          "buildchain-repository",
+          "render-media",
+          "renderer-image",
+          "require-trusted-event",
+          "source-artifact-digest",
+          "source-artifact-name",
+          "source-ref"
+        ],
+        "inputCount": 9,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "gate-artifact-digest",
+          "gate-artifact-id",
+          "gate-artifact-name",
+          "gate-artifact-url",
+          "gate-root",
+          "media-artifact-digest",
+          "media-artifact-id",
+          "media-artifact-name",
+          "media-artifact-url",
+          "media-root",
+          "source-sha"
+        ],
+        "outputCount": 11
+      },
       {
         "id": ".binary-release-assets",
         "path": ".github/workflows/.binary-release-assets.yml",
@@ -560,6 +593,7 @@
         ],
         "secretCount": 8,
         "outputs": [
+          "artifact-coordinates-json",
           "build-diagnostics-summary-artifact",
           "build-diagnostics-summary-json",
           "build-summary-artifact",
@@ -602,7 +636,7 @@
           "runner-preset",
           "trusted-event"
         ],
-        "outputCount": 41
+        "outputCount": 42
       },
       {
         "id": ".bump-minor-version",
@@ -1309,6 +1343,7 @@
         ],
         "secretCount": 8,
         "outputs": [
+          "artifact-coordinates-json",
           "build-diagnostics-summary-artifact",
           "build-diagnostics-summary-json",
           "build-summary-artifact",
@@ -1354,7 +1389,7 @@
           "runner-preset",
           "trusted-event"
         ],
-        "outputCount": 44
+        "outputCount": 45
       },
       {
         "id": "buildchain-alpha-self-dogfood",
@@ -2392,6 +2427,10 @@
         "id": "manual:artifact-verification-envelope",
         "category": "manual"
       },
+      {
+        "id": "manual:auditable-demo",
+        "category": "manual"
+      },
       {
         "id": "manual:binary-distribution",
         "category": "manual"
@@ -3925,8 +3964,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "5ba7fd93a13993b05767b6f02d0626a7347f25c3d7cd4589ed4f70028c1f1bd1",
-    "workflowRegistryDigest": "4289e5a54fd0ef2f683636bb24337fec6456fb9fa8fb50155fa3b35c323e7c70",
-    "pageRegistryDigest": "23aacdefa707c4b4c0a0911741c44294411f0508d36695e7c717cfd77a4c8fb5"
+    "workflowRegistryDigest": "4a627dcf07131d07095d5e6bf0a3373e55c62cf325b3f81bb156c43d31367d62",
+    "pageRegistryDigest": "76226870160a4e17ebde9e166bb9d3ffe4ce4aa6f6276e992778ffee52ab9a55"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -3,6 +3,19 @@
   "contract": "kungfu-buildchain-publication-authority-registry",
   "defaultDecision": "deny",
   "entries": [
+    {
+      "workflowPath": ".github/workflows/.auditable-demo.yml",
+      "authorityClass": "non-publication-oidc",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/.auditable-demo.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/.binary-release-assets.yml",
       "authorityClass": "product-publication",
@@ -519,6 +532,11 @@
     }
   ],
   "workflowFacts": [
+    {
+      "path": ".github/workflows/.auditable-demo.yml",
+      "signals": [],
+      "classified": true
+    },
     {
       "path": ".github/workflows/.binary-release-assets.yml",
       "signals": [
@@ -870,5 +888,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "5487944a7dcac3931faeec5cde33a00254b9fdd8023ef0d21e1569c43d65e1bf"
+  "registryDigest": "cb18522c1957f0cb2e03c525847602a6163d3b276c106a8bce5b8028d8b9a011"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-25T09:03:07.729Z",
-  "publishedAt": "2026-07-25T09:03:07.729Z",
+  "generatedAt": "2026-07-25T15:55:27.133Z",
+  "publishedAt": "2026-07-25T15:55:27.133Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "22974861f653c475febd15dd67dcc5cc01fb6f83",
+  "sourceRevision": "1af0d85e3b72750f2e38107573d4e16c1dc6fcb5",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.19-alpha.0",
+    "version": "2.14.19-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-25T09:03:07.729Z",
-  "publishedAt": "2026-07-25T09:03:07.729Z",
+  "generatedAt": "2026-07-25T15:55:27.133Z",
+  "publishedAt": "2026-07-25T15:55:27.133Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "22974861f653c475febd15dd67dcc5cc01fb6f83",
+  "sourceRevision": "1af0d85e3b72750f2e38107573d4e16c1dc6fcb5",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.19-alpha.0",
+    "version": "2.14.19-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,15 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:c9eb92eb02601e1e36cb38d7df93097c582dec2b8dc34f769f58c30fc5190bbe"
+      "digest": "sha256:11ccb0a90cc0583a1a67da36609a8b07207f259815ac9ac0926c2ec8d7a8764a"
+    },
+    {
+      "id": "auditable-demo",
+      "title": "Auditable demo artifact pipeline",
+      "path": "docs/auditable-demo.md",
+      "plane": "verify",
+      "exists": true,
+      "digest": "sha256:cff9786d4de098c84ea7e494b523627d6431909f15c82940e2193dbda1ef10e9"
     },
     {
       "id": "install",
@@ -277,7 +285,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:199ed8e83c988836f757c9a16b58ec441e0bd04a4f3465f21cc73ed7f530e610"
+      "digest": "sha256:0e79392cebea5a19c2bca5d6b3b36738a41ed61d2f61c1f09f09a5c8a28e9540"
     },
     {
       "id": "web-surface-deployments",

package/dist/site/workflow-registry.json

@@ -3,6 +3,42 @@
   "contract": "kungfu-buildchain-workflow-registry",
   "workflowSource": ".github/workflows reverse input enumeration",
   "workflows": [
+    {
+      "id": ".auditable-demo",
+      "path": ".github/workflows/.auditable-demo.yml",
+      "reusable": true,
+      "inputs": [
+        "adapter-path",
+        "artifact-retention-days",
+        "buildchain-repository",
+        "render-media",
+        "renderer-image",
+        "require-trusted-event",
+        "source-artifact-digest",
+        "source-artifact-name",
+        "source-ref"
+      ],
+      "inputCount": 9,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "gate-artifact-digest",
+        "gate-artifact-id",
+        "gate-artifact-name",
+        "gate-artifact-url",
+        "gate-root",
+        "media-artifact-digest",
+        "media-artifact-id",
+        "media-artifact-name",
+        "media-artifact-url",
+        "media-root",
+        "source-sha"
+      ],
+      "outputCount": 11,
+      "surface": "auditable-demo",
+      "capabilityGroup": "api-cli-reference",
+      "status": "preview"
+    },
     {
       "id": ".binary-release-assets",
       "path": ".github/workflows/.binary-release-assets.yml",
@@ -117,6 +153,7 @@
       ],
       "secretCount": 8,
       "outputs": [
+        "artifact-coordinates-json",
         "build-diagnostics-summary-artifact",
         "build-diagnostics-summary-json",
         "build-summary-artifact",
@@ -159,7 +196,7 @@
         "runner-preset",
         "trusted-event"
       ],
-      "outputCount": 41,
+      "outputCount": 42,
       "surface": "reusable-build",
       "capabilityGroup": "api-cli-reference",
       "status": "active"
@@ -923,6 +960,7 @@
       ],
       "secretCount": 8,
       "outputs": [
+        "artifact-coordinates-json",
         "build-diagnostics-summary-artifact",
         "build-diagnostics-summary-json",
         "build-summary-artifact",
@@ -968,7 +1006,7 @@
         "runner-preset",
         "trusted-event"
       ],
-      "outputCount": 44,
+      "outputCount": 45,
       "surface": "channel-build-router",
       "capabilityGroup": "reusable-build",
       "status": "active"

package/docs/MAP.md

@@ -105,6 +105,7 @@ replace them.
 | What package-owned facts should buildchain.libkungfu.dev render? | [`site-bundle-contract.md`](site-bundle-contract.md) | use | stable |
 | How do I call the reusable build workflow? | [`reusable-build-surface.md`](reusable-build-surface.md) | use | stable |
 | How does Buildchain schedule and aggregate a project-owned Shifu Gate profile? | [`shifu-gate-profiles.md`](shifu-gate-profiles.md) | use/verify | draft |
+| How do exact build artifacts become qualified, transcript-traceable demo media? | [`auditable-demo.md`](auditable-demo.md) | use/verify | draft |
 | How do I use one build job that follows alpha during development and stable for releases? | [`reusable-build-surface.md`](reusable-build-surface.md#automatic-channel-router) | use | preview |
 | How do self-hosted runners relay large artifacts through S3 before GitHub artifacts? | [`reusable-build-surface.md`](reusable-build-surface.md#artifact-transfer-relay) | use | stable |
 | How do self-hosted runners reuse local Git checkout caches without weakening source locks? | [`reusable-build-surface.md`](reusable-build-surface.md#locked-source-checkout-cache) | use | stable |

package/docs/auditable-demo.md

@@ -0,0 +1,155 @@
+---
+status: draft
+period: 2026-07
+theme: auditable-demo-pipeline
+doc_type: technical-contract
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: self-reviewed
+last_reviewed: 2026-07-25
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-07-25
+  invisible_context_boundary: No hidden model build, parameter count, or private corpus is asserted.
+---
+
+# Auditable Demo Pipeline
+
+Buildchain's auditable demo workflow turns an exact GitHub build artifact into
+two distinct evidence products:
+
+1. a required qualified Gate bundle; and
+2. an optional rendered media bundle that can exist only after that exact Gate
+   bundle passes.
+
+The public reusable workflow is
+`.github/workflows/.auditable-demo.yml`. It is consumer-neutral: Buildchain
+does not know how a Kungfu, library, service, or application artifact should be
+interpreted. The consumer owns a small checked-in executable adapter.
+
+## Authority Boundary
+
+The retained build output is authoritative. The adapter reads that exact
+artifact and projects three files:
+
+```text
+complete-transcript.txt
+public-projection.json
+scene.json
+```
+
+The adapter must not rebuild or rerun the product. It receives:
+
+```text
+--artifact-root PATH
+--output PATH
+--source-coordinate PATH
+```
+
+`--source-coordinate` identifies the caller repository, run, artifact id,
+artifact name, upload digest, expiry, and exact source SHA. The workflow finds
+exactly one live artifact with the requested name in the current caller run and
+rejects a digest mismatch before invoking the adapter. Callers must pass the
+digest emitted by their own `upload-artifact` step; a name resolved later from
+the Actions API is discovery evidence, not a substitute for that producer
+output.
+
+Buildchain's reusable build workflow exposes `artifact-coordinates-json` after
+all resolved platform uploads complete. That producer-owned output binds every
+platform id to its same-run artifact id, name, upload digest, URL, and expiry,
+so a consumer that delegates its build to Buildchain can pass an exact
+coordinate without rediscovering authority in a downstream job. The build
+aggregate fails closed if any declared platform lacks one live, digest-bearing
+artifact coordinate. The compact coordinate set is sorted by platform id so
+downstream machine consumers do not depend on matrix completion order.
+
+The adapter runs with a disposable Home/XDG/npm prefix, a minimal environment,
+and no GitHub, npm, or cloud credential injection. It must be a regular,
+non-symlink, executable file inside the exact checked-out consumer source.
+
+## Required Gate
+
+The Gate:
+
+- checks out the exact consumer source and exact called-workflow SHA;
+- resolves and downloads one exact same-run GitHub Artifact;
+- invokes the checked-in adapter by argv, never as an evaluated shell string;
+- rejects undeclared adapter outputs, symlinks, invalid UTF-8, invalid scene or
+  projection schemas, out-of-range transcript references, and oversized input;
+- derives a one-second compatibility scene from the consumer projection;
+- anonymously pulls an immutable `image@sha256:digest` renderer;
+- runs it as non-root with `--network none`, a read-only root filesystem, and a
+  bounded tmpfs;
+- verifies the renderer manifest, media probe, exact input roots, exact output
+  member set, and complete checksums;
+- uploads a content-addressed qualified bundle plus an independent GitHub
+  Artifact id, URL, archive digest, and expiry-bearing source coordinate.
+
+The Gate bundle contains the complete consumer transcript/projection/scene,
+source artifact coordinate, adapter identity, bounded renderer evidence, a
+passed gate receipt, and checksums covering every member exactly once.
+
+## Selective Render
+
+`render-media: true` enables the second job. It downloads the just-uploaded Gate
+bundle by its content-addressed name, recomputes the Gate member root, verifies
+the exact source SHA and renderer digest, and only then renders the complete
+qualified scene.
+
+The media bundle contains MP4, WebM, GIF, poster, probe, renderer manifest,
+renderer checksums, passed Gate receipt, media receipt, and distribution
+checksums. `render-media: false` does not weaken or skip the Gate.
+
+## Consumer Example
+
+The build job must expose both the exact artifact name and the digest returned
+by `upload-artifact`:
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    outputs:
+      artifact-name: product-linux-${{ github.sha }}
+      artifact-digest: ${{ steps.upload.outputs.artifact-digest }}
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - run: ./scripts/build-product
+      - id: upload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: product-linux-${{ github.sha }}
+          path: dist
+          if-no-files-found: error
+          retention-days: 14
+          compression-level: 0
+
+  auditable-demo:
+    needs: build
+    permissions:
+      actions: read
+      contents: read
+    uses: kungfu-systems/buildchain/.github/workflows/.auditable-demo.yml@BUILDCHAIN_EXACT_SHA
+    with:
+      source-ref: ${{ github.sha }}
+      source-artifact-name: ${{ needs.build.outputs.artifact-name }}
+      source-artifact-digest: ${{ needs.build.outputs.artifact-digest }}
+      adapter-path: scripts/auditable-demo-adapter
+      renderer-image: ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:RENDERER_DIGEST
+      render-media: false
+```
+
+Replace both placeholders with reviewed immutable SHAs or digests. An eligible
+build should always call the reusable workflow. Selection policy changes only
+`render-media`; it must never condition away the Gate job.
+
+## Failure Evidence
+
+Gate and render jobs use bounded timeouts and non-cancelling concurrency.
+Diagnostics artifacts are attempted with `always()` so adapter stdout/stderr
+and the resolved source coordinate remain available when qualification fails.
+No production deployment, publication authority, token, or provider mutation
+is part of this workflow.

package/docs/versioning.md

@@ -61,6 +61,7 @@ repository changes are patch".
 
 | Date | Action | Line | Faces | Class | Rationale | PR |
 | --- | --- | --- | --- | --- | --- | --- |
+| 2026-07-25 | extend-minor | `v2.14` | auditable-demo-workflow, auditable-demo-evidence | additive | Add a consumer-neutral reusable Gate that binds exact same-run GitHub Artifacts to checked-in adapters and immutable renderer evidence, with optional media rendering only from the exact passing Gate bundle. | [#1841](https://github.com/kungfu-systems/buildchain/pull/1841) |
 | 2026-07-23 | extend-minor | `v2.14` | credential-island-macos-input, protected-signer-job, macos-signing-evidence, action-subpaths | additive | The reusable build surface can seal an exact source-bound macOS app and hand it to a protected caller environment, where an immutable Buildchain action signs, notarizes, staples, Gatekeeper-assesses, and returns an auditable additional release-candidate platform without exposing credentials to consumer lifecycle jobs. | |
 | 2026-07-20 | extend-minor | `v2.14` | anchored-derived-version-material, build-controller-evidence, release-passport, package-subpaths, release-propagation-controller | additive | Anchored/manual consumers can declare derived version witnesses that Buildchain regenerates and verifies before heavy builds, binds to exact alpha/release trees and passports, and admits during protected promotion; propagation receipts now model their existing optional consumer stages. | |
 | 2026-07-17 | extend-minor | `v2.14` | merge-queue-config, release-line-governance-inheritance | additive | Buildchain config can explicitly enable, inherit, or disable exact dev-channel merge queues, and release-line bootstrap reconciles the declared or inherited policy before moving the repository default branch. | |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.19-alpha.0",
+  "version": "2.14.19-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-contract.js

@@ -301,6 +301,51 @@ export function createBuildchainContractWorld({
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects",
       ],
     }),
+    surface(root, {
+      id: "auditable-demo",
+      kind: "workflow",
+      path: ".github/workflows/.auditable-demo.yml",
+      publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.auditable-demo.yml@${majorLine}`,
+      requiredInputs: [
+        "source-artifact-name",
+        "source-artifact-digest",
+        "adapter-path",
+        "renderer-image",
+      ],
+      requiredOutputs: [
+        "source-sha",
+        "gate-artifact-name",
+        "gate-artifact-id",
+        "gate-artifact-digest",
+        "gate-artifact-url",
+        "gate-root",
+        "media-artifact-name",
+        "media-artifact-id",
+        "media-artifact-digest",
+        "media-artifact-url",
+        "media-root",
+      ],
+      breakingDefaults: {
+        trustedEventRequired: true,
+        renderMediaDefault: false,
+        artifactRetentionDaysDefault: 14,
+        gatePolicy: "required-before-selective-render",
+      },
+      optionalInputs: [
+        "buildchain-repository",
+        "source-ref",
+        "render-media",
+        "artifact-retention-days",
+        "require-trusted-event",
+      ],
+      guarantees: [
+        "the source GitHub Artifact is admitted by exact same-run name and archive digest",
+        "the checked-in consumer adapter runs from the exact consumer source with a disposable home and reduced environment",
+        "every invocation runs an immutable network-disabled renderer smoke before emitting a qualified Gate bundle",
+        "complete media rendering is optional and consumes only an exact passing Gate bundle",
+        "Gate and media bundles expose both GitHub Artifact archive coordinates and deterministic member roots",
+      ],
+    }),
     surface(root, {
       id: "promote-buildchain-ref-action",
       kind: "action",

package/packages/core/buildchain-kfd-claims.js

@@ -13,6 +13,7 @@ export const BUILDCHAIN_KFD_COLLABORATION_INTERFACE_CONTRACT = "kungfu-buildchai
 
 export const BUILDCHAIN_AGENT_MANUALS = Object.freeze([
   { id: "map", title: "Buildchain documentation map", path: "docs/MAP.md", plane: "use" },
+  { id: "auditable-demo", title: "Auditable demo artifact pipeline", path: "docs/auditable-demo.md", plane: "verify" },
   { id: "install", title: "Install and verify Buildchain", path: "docs/install.md", plane: "use" },
   { id: "release-passport", title: "Release Passport protocol", path: "docs/release-passport.md", plane: "verify" },
   { id: "controller-evidence", title: "Controller evidence contract", path: "docs/controller-evidence.md", plane: "verify" },

package/packages/core/buildchain-publication-authority.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { createPublicationAuthorityRegistry } from "./publication-authority.js";
 
 const DESCRIPTORS = Object.freeze([
+  [".github/workflows/.auditable-demo.yml", "non-publication-oidc"],
   [".github/workflows/.build.yml", "non-publication-oidc"],
   [".github/workflows/.release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/.publication-authority.yml", "evidence-publication"],