@kungfu-tech/buildchain 2.3.2-alpha.0 → 2.4.0-alpha.1

package/bin/buildchain.mjs

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import { initBuildchainRepo } from "../scripts/init-repo.mjs";
 import { npmPublishDryRun } from "../scripts/npm-publish-dry-run.mjs";
 import { runLifecycle } from "../scripts/run-lifecycle-core.mjs";
+import { verifyInfraContractEvidenceBundle } from "../scripts/infra-contract-core.mjs";
 import { validateBuildchainConfig } from "../packages/core/buildchain-config.js";
 import { detectPackageManager } from "../packages/core/package-manager.js";
 import {
@@ -40,7 +41,7 @@ function usage() {
   return `Usage:
   buildchain --help
   buildchain version
-  buildchain init [--cwd <dir>] [--type package|native|web-surface|anchored-package] [--force]
+  buildchain init [--cwd <dir>] [--type package|native|web-surface|infra-contract|anchored-package] [--force]
                   [--package-manager pnpm|npm|yarn] [--runner-preset <preset>]
                   [--artifact-name <template>]
   buildchain validate [--cwd <dir>] [--require-version-state]
@@ -72,6 +73,7 @@ function usage() {
                                     [--release-extra-json <json-or-path>]
                                     [--publish-json <json-or-path>] [--output-dir <dir>] [--json]
   buildchain verify release-passport <file-or-url> [--json]
+  buildchain verify infra-contract-evidence-bundle <file> [--json]
   buildchain verify observability-log <jsonl> [--min-events <n>]
                                              [--require-phase <csv>]
                                              [--require-component <csv>]
@@ -94,6 +96,7 @@ function usage() {
   buildchain span --event <name> [--phase <phase>] [--component <name>]
                   [--path <jsonl>] -- <command> [args...]
   buildchain web-surface ...
+  buildchain infra-contract ...
   buildchain publish-source <lock|manifest|verify-lock|validate-anchored-release> ...
   buildchain build-contract ...
 
@@ -106,7 +109,15 @@ Examples:
   buildchain span --event native.build -- cmake --build build
   buildchain collect github-release --tag v2.2.0 --assets-dir dist --output-dir .buildchain/release-passport
   buildchain verify release-passport .buildchain/release-passport/buildchain.release.json
+  buildchain verify infra-contract-evidence-bundle .buildchain/infra-contract-evidence-bundle.json
   buildchain verify observability-log .buildchain/logs/events.jsonl --min-events 4 --require-phase build
+  buildchain infra-contract --mode plan --source-sha <sha>
+  buildchain infra-contract --mode ci --source-sha <sha>
+  buildchain infra-contract --mode plan --source-sha <sha> --execute-adapter-commands true
+  buildchain infra-contract --mode apply --plan <plan.json> --source-sha <sha> --approval-id <id>
+  buildchain infra-contract --mode apply --plan <plan.json> --source-sha <sha> --approval-id <id> --dry-run false --execute-adapter-commands true
+  buildchain infra-contract --mode propagation-apply --propagation-plan <plan.json> --dry-run true
+  buildchain infra-contract --mode evidence-bundle --artifact <artifact.json> --propagation-result <result.json>
 `;
 }
 
@@ -712,6 +723,24 @@ async function main(argv = process.argv.slice(2)) {
       process.exitCode = report.ok ? 0 : 1;
       return;
     }
+    if (subcommand === "infra-contract-evidence-bundle") {
+      if (!location) {
+        throw new Error("usage: buildchain verify infra-contract-evidence-bundle <file>");
+      }
+      const bundle = JSON.parse(fs.readFileSync(path.resolve(location), "utf8"));
+      const report = verifyInfraContractEvidenceBundle(bundle);
+      if (readBooleanFlag(verifyArgs, "json")) {
+        printJson(report);
+      } else {
+        process.stdout.write(`infra contract evidence bundle: ${report.ok ? "ok" : "failed"}\n`);
+        process.stdout.write(`artifact: ${report.artifactHash || "unknown"}\n`);
+        for (const entry of report.issues) {
+          process.stdout.write(`- ${entry.level}: ${entry.code}: ${entry.message}\n`);
+        }
+      }
+      process.exitCode = report.ok ? 0 : 1;
+      return;
+    }
     if (subcommand !== "release-passport" || !location) {
       throw new Error("usage: buildchain verify release-passport <file-or-url>");
     }
@@ -774,6 +803,11 @@ async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  if (command === "infra-contract") {
+    runScript("infra-contract.mjs", args);
+    return;
+  }
+
   if (command === "build-contract") {
     runScript("resolve-build-contract.mjs", args);
     return;

package/dist/site/artifact-schemas.json

@@ -22,5 +22,10 @@
     "product-mechanism.json",
     "release-provenance.json",
     "agent-index.json"
+  ],
+  "infraContract": [
+    "infra-contract-plan.json",
+    "buildchain.infra-contract.json",
+    "infra-contract-propagation.json"
   ]
 }

package/dist/site/buildchain-site.json

@@ -121,6 +121,13 @@
       "path": "docs/web-surface-deployments.md",
       "plane": "use",
       "exists": true
+    },
+    {
+      "id": "infra-contract",
+      "title": "Infra Contract",
+      "path": "docs/infra-contract.md",
+      "plane": "use",
+      "exists": true
     }
   ],
   "releaseModel": {

package/dist/site/cli-registry.json

@@ -11,7 +11,7 @@
     },
     {
       "id": "init",
-      "usage": "buildchain init [--type package|native|web-surface|anchored-package]",
+      "usage": "buildchain init [--type package|native|web-surface|infra-contract|anchored-package]",
       "purpose": "Bootstrap a repository with Buildchain configuration and caller workflow files."
     },
     {
@@ -44,6 +44,11 @@
       "usage": "buildchain verify release-passport <file-or-url>",
       "purpose": "Fail closed unless a release passport and its evidence are complete."
     },
+    {
+      "id": "verify-infra-contract-evidence-bundle",
+      "usage": "buildchain verify infra-contract-evidence-bundle <file>",
+      "purpose": "Fail closed unless an infra-contract lifecycle evidence bundle is complete, hash-bound, and validation-consistent."
+    },
     {
       "id": "logging",
       "usage": "buildchain log|mark|span|verify observability-log",
@@ -58,6 +63,11 @@
       "id": "npm-dry-run",
       "usage": "buildchain npm dry-run --json",
       "purpose": "Verify npm publish shape before a release transaction."
+    },
+    {
+      "id": "infra-contract",
+      "usage": "buildchain infra-contract --mode validate|ci|plan|contract|propagation-plan|propagation-apply|apply|evidence-bundle",
+      "purpose": "Validate and publish provider-neutral infrastructure contract evidence with a mutation-free CI evidence chain, provider command plans, configured provider command execution, saved-plan apply gates, dry-run-first propagation, and lifecycle evidence bundles."
     }
   ]
 }

package/dist/site/site-manifest.json

@@ -109,6 +109,13 @@
       "path": "docs/web-surface-deployments.md",
       "plane": "use",
       "exists": true
+    },
+    {
+      "id": "infra-contract",
+      "title": "Infra Contract",
+      "path": "docs/infra-contract.md",
+      "plane": "use",
+      "exists": true
     }
   ],
   "facts": [

package/docs/MAP.md

@@ -37,6 +37,7 @@ running artifact), *use* (consume / extend) - and a **status**:
 | How do I call the reusable build workflow? | [`reusable-build-surface.md`](reusable-build-surface.md) | use | stable |
 | How do I validate an unreleased Buildchain runtime train while keeping `@v2`? | [`runtime-train-validation.md`](runtime-train-validation.md) | use | stable |
 | How do I deploy a site/app preview, staging, or production surface? | [`web-surface-deployments.md`](web-surface-deployments.md) | use | stable |
+| How do I publish observed infrastructure contracts for downstream consumers? | [`infra-contract.md`](infra-contract.md) | use | preview |
 | How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md) | use | stable |
 | What do the fixture repositories demonstrate? | [`../fixtures/libnode-shaped/README.md`](../fixtures/libnode-shaped/README.md), [`../fixtures/publish-transaction-shaped/README.md`](../fixtures/publish-transaction-shaped/README.md), [`../fixtures/web-surface-shaped/README.md`](../fixtures/web-surface-shaped/README.md) | verify | stable |
 | What license and contribution terms apply? | [`../LICENSE`](../LICENSE) + [`../LICENSE-POLICY.md`](../LICENSE-POLICY.md) | use | stable |
@@ -63,6 +64,8 @@ running artifact), *use* (consume / extend) - and a **status**:
 - **runtime train validation / temporary `buildchain-ref` override** ->
   [`runtime-train-validation.md`](runtime-train-validation.md) and
   [`reusable-build-surface.md`](reusable-build-surface.md).
+- **infra contract / observed infrastructure outputs / downstream contract propagation** ->
+  [`infra-contract.md`](infra-contract.md).
 - **standalone binary install / platform archives / GitHub Release bundle** ->
   [`install.md`](install.md), [`binary-distribution.md`](binary-distribution.md),
   and [`release-passport.md`](release-passport.md).

package/docs/cli.md

@@ -61,6 +61,10 @@ Supported presets:
 - `--type package` for Node package repositories with pnpm, npm, or yarn.
 - `--type native` for CMake-style native projects.
 - `--type web-surface` for preview/staging/production site or app deployments.
+- `--type infra-contract` for provider-agnostic infrastructure contract
+  validation, observation, contract publication, and downstream propagation
+  planning without default mutation. Provider adapters expose built-in command
+  plans by default, and only configured `[infra.commands]` hooks can execute.
 - `--type anchored-package` for packages whose version is anchored to an
   explicit upstream release manifest.
 
@@ -214,8 +218,8 @@ reusable build workflow outputs. It fails closed for direct `alpha/*` or
 version against configured version files and the anchor manifest. The JSON
 result is shaped for future `buildchain.libkungfu.dev` fact ingestion.
 
-`buildchain release`, `buildchain web-surface`, `buildchain publish-source`,
-and `buildchain build-contract` route to the same scripts used by Buildchain's
+`buildchain release`, `buildchain web-surface`, `buildchain infra-contract`,
+`buildchain publish-source`, and `buildchain build-contract` route to the same scripts used by Buildchain's
 GitHub Actions workflows. This keeps local inspection and CI behavior on the
 same implementation path.
 
@@ -288,6 +292,24 @@ The verifier fails closed when required protocol files are absent, artifacts are
 not covered by evidence, or digests disagree. The explanation output is shaped
 for agents: trust, completeness, impact, recovery route, and next action.
 
+Verify infra-contract lifecycle evidence bundles:
+
+```bash
+buildchain infra-contract --mode ci --source-sha "$GITHUB_SHA"
+buildchain verify infra-contract-evidence-bundle .buildchain/infra-contract-evidence-bundle.json
+```
+
+The infra-contract `ci` mode is mutation-free. It writes validate, plan,
+contract, propagation dry-run, evidence bundle, and verification JSON artifacts
+under `.buildchain/`, giving reusable workflows one standard responsibility
+chain instead of hand-written command sequences.
+
+The infra-contract verifier is read-only. It recomputes the bundle hash and
+checks that desired, plan, approval, apply, observe, contract, and propagate
+evidence remain bound to the same contract artifact. It also recomputes the
+bundle validation summary, so stale or misleading summary booleans fail closed
+even when the bundle hash has been refreshed.
+
 `buildchain release --dry-run` explains the release-line state machine before a
 maintainer opens or merges a channel PR:
 

package/docs/infra-contract.md

@@ -0,0 +1,208 @@
+# Infra Contract
+
+`project.type = "infra-contract"` models infrastructure release responsibility
+without binding Buildchain core to one infrastructure tool. The state machine is:
+
+```text
+desired -> validate -> plan -> approval -> apply -> observe -> contract -> propagate
+```
+
+The first supported surface is mutation-free: Buildchain validates declarations,
+creates a normalized plan, reads reviewed or adapter-shaped observed outputs,
+publishes a deterministic contract artifact, and plans downstream consumer pull
+requests. Propagation execution is also dry-run by default. Real infrastructure
+mutation and real consumer pull request creation are not PR or ordinary push side
+effects.
+
+After apply and propagation produce their own result JSON, Buildchain can also
+write a lifecycle evidence bundle. The bundle references the immutable contract
+artifact by `artifactHash`, verifies that any apply result matches the artifact's
+`sourceSha` and plan hash, verifies that propagation results target the same
+artifact, and then hashes the combined desired, plan, approval, apply, observe,
+contract, and propagation evidence.
+
+## Configuration
+
+```toml
+schema = 1
+
+[project]
+type = "infra-contract"
+name = "infra-kungfu-sites"
+
+[infra]
+adapter = "manual-observed"
+adoption_mode = "manual-observed"
+apply = "disabled"
+environment = "staging"
+desired = ["desired/site-kungfu-tech.json"]
+contract = ["outputs/site-kungfu-tech.json"]
+
+[[consumers]]
+repo = "kungfu-systems/site-kungfu-tech"
+path = "infra/outputs.json"
+source = "outputs/site-kungfu-tech.json"
+```
+
+Supported adapters:
+
+```text
+manual-observed
+aws-cloudformation
+terraform
+opentofu
+pulumi
+aws-cdk
+aws-cli
+custom-command
+```
+
+Buildchain's safe fixture set covers the provider-neutral shape without live
+provider calls:
+
+- `manual-observed` for existing reviewed resources;
+- `aws-cloudformation` for template plus stack output shapes;
+- `terraform` for plan/output JSON shapes;
+- `opentofu` for plan/output JSON shapes;
+- `pulumi` for preview/output JSON shapes;
+- `aws-cdk` for synthesized assembly plus stack output shapes;
+- `aws-cli` for generic desired request plus observed response shapes;
+- `custom-command` for user-defined validate, plan, observe, and approved apply
+  hooks.
+
+For built-in provider adapters, Buildchain records planned adapter command
+evidence for `validate`, `plan`, `apply`, and `observe` when a stage is
+supported. These entries are command plans, not execution. They make the
+adapter handoff auditable before a repository opts in to concrete commands,
+and they stay `executed: false` even when `--execute-adapter-commands true` is
+passed.
+
+Any adapter can declare concrete command hooks under `[infra.commands]`.
+Configured commands are the only executable provider surface. Buildchain records
+them as planned adapter evidence by default. Passing
+`--execute-adapter-commands true` to `plan` or `contract` executes the
+non-mutating `validate`, `plan`, or `observe` hooks and stores their exit
+status, stdout/stderr, and JSON stdout when present. The `apply` hook is only
+available through the saved-plan apply path and is never executed by ordinary
+PR validation.
+
+Supported adoption modes:
+
+```text
+validate-only
+plan-only
+observe-only
+manual-observed
+import-planned
+managed-apply
+```
+
+`apply = "disabled"` is the default. Non-disabled apply requires
+`adoption_mode = "managed-apply"`, a non-empty `environment`, a non-empty
+`identity_ref`, and an explicit approval id before mutation. `identity_ref` is a
+provider-neutral reference to the runtime role, service account, or environment
+credential name; it is not a secret value. Apply also requires a saved plan
+artifact whose `sourceSha`, `plannedAt`, and input hash still match the current
+repository. Real apply execution requires a configured `[infra.commands].apply`
+command, `--dry-run false`, and `--execute-adapter-commands true`. Without a
+configured apply command, built-in provider adapters still fail closed before
+mutation execution.
+
+For managed apply, bind the target and runtime identity explicitly:
+
+```toml
+adoption_mode = "managed-apply"
+apply = "manual-approval"
+environment = "preview"
+identity_ref = "AWS_ROLE_ARN"
+```
+
+## CLI
+
+```sh
+buildchain infra-contract --mode validate
+buildchain infra-contract --mode ci --source-sha "$GITHUB_SHA"
+buildchain infra-contract --mode plan --source-sha "$GITHUB_SHA" \
+  --output .buildchain/infra-contract-plan.json
+buildchain infra-contract --mode plan --source-sha "$GITHUB_SHA" \
+  --execute-adapter-commands true \
+  --output .buildchain/infra-contract-plan.json
+buildchain infra-contract --mode contract \
+  --plan .buildchain/infra-contract-plan.json \
+  --source-sha "$GITHUB_SHA" \
+  --output .buildchain/buildchain.infra-contract.json
+buildchain infra-contract --mode propagation-plan \
+  --artifact .buildchain/buildchain.infra-contract.json \
+  --output .buildchain/infra-contract-propagation.json
+buildchain infra-contract --mode propagation-apply \
+  --propagation-plan .buildchain/infra-contract-propagation.json \
+  --dry-run true \
+  --output .buildchain/infra-contract-propagation-apply.json
+buildchain infra-contract --mode apply \
+  --plan .buildchain/infra-contract-plan.json \
+  --source-sha "$GITHUB_SHA" \
+  --approval-id "$APPROVAL_ID" \
+  --dry-run true \
+  --output .buildchain/infra-contract-apply.json
+buildchain infra-contract --mode apply \
+  --plan .buildchain/infra-contract-plan.json \
+  --source-sha "$GITHUB_SHA" \
+  --approval-id "$APPROVAL_ID" \
+  --dry-run false \
+  --execute-adapter-commands true \
+  --output .buildchain/infra-contract-apply.json
+buildchain infra-contract --mode evidence-bundle \
+  --artifact .buildchain/buildchain.infra-contract.json \
+  --apply-result .buildchain/infra-contract-apply.json \
+  --propagation-result .buildchain/infra-contract-propagation-apply.json \
+  --output .buildchain/infra-contract-evidence-bundle.json
+buildchain verify infra-contract-evidence-bundle \
+  .buildchain/infra-contract-evidence-bundle.json
+```
+
+`ci` is the default mutation-free lifecycle entrypoint for repositories created
+with `buildchain init --type infra-contract`. It validates the project, writes a
+plan, writes an observed contract artifact, writes a propagation plan, runs
+propagation apply in dry-run mode, creates an evidence bundle, and verifies that
+bundle. It does not execute provider apply commands or open consumer PRs.
+
+For projects where apply is disabled, omit `--apply-result`. For projects with
+no consumers, omit `--propagation-result`.
+
+The evidence-bundle verifier is read-only. It recomputes the bundle hash,
+checks the contract artifact hash, verifies that desired, plan, approval,
+apply, observe, contract, and propagate evidence are all present, recomputes
+the bundle validation summary, and fails closed when apply or propagation
+results are not bound to the same artifact.
+
+## Safety
+
+- PR validation is mutation-free.
+- `buildchain infra-contract --mode ci` is mutation-free by default and produces
+  auditable `.buildchain/infra-contract*.json` evidence for reusable workflow
+  artifacts.
+- `manual-observed` and observe-only modes cannot apply.
+- Apply fails before mutation unless approval, target environment, identity
+  reference, adapter capability, and ownership mode are explicit.
+- Apply rejects missing, stale, source-mismatched, or input-drifted plan
+  artifacts before any adapter mutation can run.
+- Built-in provider adapter command evidence is planned-only unless the
+  repository declares a concrete command for that stage under `[infra.commands]`.
+- Provider apply requires saved plan freshness, an approval id, target
+  environment, identity reference, a configured apply command,
+  `--dry-run false`, and `--execute-adapter-commands true`; nonzero adapter
+  exits fail closed and are recorded as adapter evidence.
+- Terraform/OpenTofu state files and Pulumi state or secret JSON files are not
+  accepted as contract inputs.
+- Consumers are represented as pull request plans. `propagation-apply` defaults
+  to dry-run; real PR creation requires `--dry-run false`, `--approval-id`, and
+  explicit `--consumer-workspace owner/repo=/path/to/checkout` mappings.
+- Buildchain never pushes mirrored contract files directly to consumer main
+  branches. Real propagation creates reviewable branches and calls
+  `gh pr create`.
+- Evidence bundles do not execute adapters, mutate infrastructure, or open PRs.
+  They only verify and hash already saved contract, apply, and propagation
+  outputs.
+- `buildchain verify infra-contract-evidence-bundle` is read-only and fails
+  closed when the lifecycle evidence chain is incomplete, tampered, or carries
+  a stale validation summary.

package/docs/lifecycle-protocol.md

@@ -352,6 +352,18 @@ See [Web-surface deployments](web-surface-deployments.md) for named surface host
 mappings, the manifest, preview alias, retention, cleanup, and dry-run deploy
 contract.
 
+## Infra-Contract Projects
+
+`project.type = "infra-contract"` is for infrastructure contract repositories
+that need provider-neutral desired, plan, approval, apply, observe, contract,
+and propagation evidence. `buildchain init --type infra-contract` wires
+`lifecycle.verify` to `buildchain infra-contract --mode ci`, which writes
+mutation-free plan, contract, propagation dry-run, evidence bundle, and
+verification artifacts under `.buildchain/`. The surface supports
+manual-observed, observe-only, and mocked adapter fixtures without reading
+cloud state files or executing live infrastructure mutation. See
+[Infra Contract](infra-contract.md).
+
 ## Examples
 
 ### Node Workspace

package/docs/versioning.md

@@ -43,6 +43,7 @@ expected ref flow requires a major bump.
 | 2026-07-02 | Buildchain toolkit observability is a minor surface. | `v2.1` | It adds the public logging SDK, CLI observability commands, and package subpaths that consumers can import. |
 | 2026-07-02 | Release passport and binary distribution are a minor surface. | `v2.2` | They add agent-readable release passport files, artifact evidence, impact ledger, agent index, GitHub Release collection and verification commands, and standalone binary assets. |
 | 2026-07-02 | Web surface host mapping is a minor surface. | `v2.3` | It adds first-class multi-host surface bindings, reusable workflow URL outputs, per-surface deployment overrides, and an agent-readable fixture contract. |
+| 2026-07-03 | Infra contract lifecycle is a minor surface. | `v2.4` | It adds the provider-neutral `infra-contract` CLI command family, project type, adapter capability contract, lifecycle evidence bundle, propagation evidence, CI evidence mode, and consumer-facing contract artifacts. |
 
 ## Runner Policy
 

package/fixtures/infra-contract-aws-cdk-shaped/README.md

@@ -0,0 +1,8 @@
+# AWS CDK-shaped Infra Contract Fixture
+
+This fixture proves the infra-contract model can represent AWS CDK synthesized
+assembly metadata and observed CloudFormation output shapes without deploying a
+stack.
+
+It is static evidence only: no `cdk deploy` command is executed and no AWS
+credentials are required.

package/fixtures/infra-contract-aws-cli-shaped/README.md

@@ -0,0 +1,7 @@
+# AWS CLI-shaped Infra Contract Fixture
+
+This fixture proves the infra-contract model can represent a generic AWS CLI
+desired request and observed response shape without calling a live AWS service.
+
+It is static evidence only: no AWS CLI command is executed and no AWS
+credentials are required.

package/fixtures/infra-contract-cloudformation-shaped/README.md

@@ -0,0 +1,7 @@
+# CloudFormation-shaped Infra Contract Fixture
+
+This fixture proves the infra-contract model can represent CloudFormation
+desired templates and observed stack outputs without making live AWS calls.
+
+It is static evidence only: no change set is created, no stack is updated, and
+no AWS credentials are required.

package/fixtures/infra-contract-opentofu-shaped/README.md

@@ -0,0 +1,7 @@
+# OpenTofu-shaped Infra Contract Fixture
+
+This fixture proves the infra-contract model can represent OpenTofu desired
+configuration and observed output shapes without reading OpenTofu state files.
+
+It is static evidence only: no `tofu apply` command is executed and no provider
+credentials are required.

package/fixtures/infra-contract-pulumi-shaped/README.md

@@ -0,0 +1,7 @@
+# Pulumi-shaped Infra Contract Fixture
+
+This fixture proves the infra-contract model can represent Pulumi preview and
+stack output shapes without reading Pulumi state or secrets files.
+
+It is static evidence only: no `pulumi up` command is executed and no Pulumi
+secrets material is committed.

package/fixtures/infra-contract-shaped/README.md

@@ -0,0 +1,8 @@
+# Infra Contract Shaped Fixture
+
+This fixture models an infrastructure repository that already has live resources
+and wants to publish observed output contracts before full IaC ownership exists.
+
+It proves that `project.type = "infra-contract"` can validate desired files,
+read reviewed observed outputs, publish a deterministic contract artifact, and
+plan downstream consumer pull requests without mutating cloud infrastructure.

package/fixtures/infra-contract-terraform-shaped/README.md

@@ -0,0 +1,5 @@
+# Terraform-shaped Infra Contract Fixture
+
+This fixture proves the infra-contract model is not CloudFormation-specific.
+It uses Terraform-shaped desired and output JSON fixtures as static evidence.
+No Terraform state file is read and no provider command is executed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.3.2-alpha.0",
+  "version": "2.4.0-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -41,6 +41,7 @@
     "docs/binary-distribution.md",
     "docs/cli.md",
     "docs/install.md",
+    "docs/infra-contract.md",
     "docs/lifecycle-protocol.md",
     "docs/migration-inventory.md",
     "docs/ownership.md",