@kungfu-tech/buildchain 2.8.2-alpha.0 → 2.8.2-alpha.1

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.8.2-alpha.0",
+    "version": "2.8.2-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -185,7 +185,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:9668f3e01cfe8ce5b94ebdda24aeeaddbd609d8f4cc7cca33d82cbc59aae66f5"
+      "auditDigest": "sha256:22017d4cbe0d89aecfcada7b93f5cdf2935837b2236ae4aeff23f19dbf3d26cb"
     },
     {
       "contractVersion": 1,
@@ -234,7 +234,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:9668f3e01cfe8ce5b94ebdda24aeeaddbd609d8f4cc7cca33d82cbc59aae66f5"
+      "auditDigest": "sha256:22017d4cbe0d89aecfcada7b93f5cdf2935837b2236ae4aeff23f19dbf3d26cb"
     },
     {
       "contractVersion": 1,
@@ -294,5 +294,5 @@
     }
   ],
   "compatibilityDigest": "sha256:ca668f3f73ab0d84db0d489efccf6cd556704b069990a37a0c6c77a6519f754b",
-  "contractDigest": "sha256:1ac1817722fee5509f584cdd02e1553c4162ddd2c89b49465144e5a436344fb3"
+  "contractDigest": "sha256:315ea2dcc1d77b75b04475cfef85c627b31186edca1e4ddb929bb758c9de9576"
 }

package/docs/release-passport.md

@@ -249,9 +249,11 @@ The generated release passport records the result under the KFD-provided
 top-level key currently named `kfd-3`. The section includes the KFD package
 version, schema ids/paths, pre-build witness digest, artifact witness digest,
 declared/exposed surface counts, missing declared shipped surfaces, and
-unclassified artifact public surfaces. It also records the KFD-2 trust proof
-view of that evidence: `releaseStatus`, witness file hashes and canonical
-hashes, declared capability verification, reverse audit boundary, residual
+unclassified artifact public surfaces. Buildchain also projects the same
+collaboration-interface evidence into the top-level `kfd-2` audit as a
+machine-readable `trustProof` object on the generated `kfd-3:*` public claim.
+That proof carries `releaseStatus`, witness file hashes and canonical hashes,
+declared capability verification, reverse audit result and boundary, residual
 risk, and responsibility state.
 
 The trust proof makes the strongest claim only when the witnesses justify it:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.8.2-alpha.0",
+  "version": "2.8.2-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/index.js

@@ -142,6 +142,7 @@ export {
   ARTIFACT_EVIDENCE_CONTRACT,
   IMPACT_LEDGER_CONTRACT,
   KFD2_RELEASE_TRUST_PASSPORT_CONTRACT,
+  KFD2_TRUST_PROOF_CONTRACT,
   PRODUCT_MECHANISM_CONTRACT,
   RELEASE_CHECK_REPORT_CONTRACT,
   RELEASE_PASSPORT_CONTRACT,

package/packages/core/release-passport.js

@@ -21,6 +21,7 @@ export const AGENT_INDEX_CONTRACT = "kungfu-buildchain-agent-index";
 export const PRODUCT_MECHANISM_CONTRACT = "kungfu-buildchain-product-mechanism";
 export const RELEASE_CHECK_REPORT_CONTRACT = "kungfu-buildchain-release-check-report";
 export const KFD2_RELEASE_TRUST_PASSPORT_CONTRACT = "kungfu-buildchain-kfd-2-release-trust-passport-audit";
+export const KFD2_TRUST_PROOF_CONTRACT = "kungfu-buildchain-kfd-2-trust-proof";
 
 const CONTRACTS = new Set([
   RELEASE_PASSPORT_CONTRACT,
@@ -571,6 +572,9 @@ function normalizeKfd2Claim(raw = {}, index = 0) {
       : {};
   const responsibility = claim.responsibility && typeof claim.responsibility === "object" && !Array.isArray(claim.responsibility) ? claim.responsibility : {};
   const residualRisk = arrayOrEmpty(claim.residualRisk || claim.residual_risk);
+  const trustProof = claim.trustProof && typeof claim.trustProof === "object" && !Array.isArray(claim.trustProof)
+    ? claim.trustProof
+    : undefined;
   const missingBindings = [];
   if (sourceBindings.length === 0) missingBindings.push("declared-sources");
   if (machineEvidence.length === 0) missingBindings.push("machine-readable-evidence");
@@ -597,6 +601,7 @@ function normalizeKfd2Claim(raw = {}, index = 0) {
     auditBoundary,
     responsibility,
     residualRisk,
+    ...(trustProof ? { trustProof } : {}),
     proseOnly,
     missingBindings,
     status,
@@ -642,6 +647,17 @@ function kfd2ClaimFromKfd1World(world = {}, index = 0) {
 }
 
 function kfd2ClaimFromKfd3Interface(entry = {}, index = 0) {
+  const witnessHashes = {
+    prebuildWitnessSha256: entry.preBuildWitnessSha256,
+    artifactWitnessSha256: entry.artifactWitnessSha256,
+    prebuildCanonicalSha256: entry.witnessEvidence?.prebuild?.canonicalSha256 || "",
+    artifactCanonicalSha256: entry.witnessEvidence?.artifact?.canonicalSha256 || "",
+  };
+  const reverseAuditBoundary = entry.reverseAudit?.auditBoundary || entry.auditBoundary;
+  const residualRisk = arrayOrEmpty(entry.residualRisk);
+  const proofResult = entry.trustProof?.result === "pass"
+    ? (residualRisk.length > 0 ? "downgraded" : "passed")
+    : "failed";
   return normalizeKfd2Claim({
     id: `kfd-3:${entry.id || index + 1}`,
     public: true,
@@ -658,10 +674,7 @@ function kfd2ClaimFromKfd3Interface(entry = {}, index = 0) {
       { id: "reverse-audit", result: entry.reverseAudit?.status || "" },
     ],
     hashes: {
-      prebuildWitnessSha256: entry.preBuildWitnessSha256,
-      artifactWitnessSha256: entry.artifactWitnessSha256,
-      prebuildCanonicalSha256: entry.witnessEvidence?.prebuild?.canonicalSha256 || "",
-      artifactCanonicalSha256: entry.witnessEvidence?.artifact?.canonicalSha256 || "",
+      ...witnessHashes,
     },
     artifacts: entry.artifactWitness?.artifact?.name || entry.artifactWitness?.artifact?.path
       ? [entry.artifactWitness.artifact]
@@ -673,10 +686,25 @@ function kfd2ClaimFromKfd3Interface(entry = {}, index = 0) {
     },
     auditBoundary: entry.auditBoundary,
     responsibility: entry.responsibility,
-    residualRisk: entry.residualRisk,
-    status: entry.trustProof?.result === "pass"
-      ? (arrayOrEmpty(entry.residualRisk).length > 0 ? "downgraded" : "passed")
-      : "failed",
+    residualRisk,
+    trustProof: {
+      contract: KFD2_TRUST_PROOF_CONTRACT,
+      source: "kfd-3-collaboration-interface-release-gate",
+      result: proofResult,
+      statement: entry.trustProof?.statement || "",
+      kfd3TrustProof: {
+        contract: entry.trustProof?.contract || "",
+        result: entry.trustProof?.result || "",
+        releaseStatus: entry.trustProof?.releaseStatus || entry.releaseStatus || "",
+      },
+      witnessHashes,
+      declaredCapabilityVerification: entry.declaredCapabilityVerification,
+      reverseAudit: entry.reverseAudit,
+      reverseAuditBoundary,
+      residualRisk,
+      responsibility: entry.responsibility,
+    },
+    status: proofResult,
   }, index);
 }
 
@@ -1220,6 +1248,48 @@ function validateKfd2ReleaseTrustPassportAudit(section, issues) {
         proseOnly: Boolean(claim.proseOnly),
       }));
     }
+    if (String(claim.id || "").startsWith("kfd-3:")) {
+      const trustProof = claim.trustProof && typeof claim.trustProof === "object" && !Array.isArray(claim.trustProof)
+        ? claim.trustProof
+        : undefined;
+      if (!trustProof || trustProof.contract !== KFD2_TRUST_PROOF_CONTRACT) {
+        issues.push(issue("error", `kfd-2.claims[${index}].trustProof`, "KFD-3 generated public claims must include a KFD-2 trust proof", {
+          id: claim.id || "",
+          expectedContract: KFD2_TRUST_PROOF_CONTRACT,
+        }));
+      } else {
+        if (!trustProof.witnessHashes?.prebuildWitnessSha256 || !trustProof.witnessHashes?.artifactWitnessSha256) {
+          issues.push(issue("error", `kfd-2.claims[${index}].trustProof.witnessHashes`, "KFD-2 trust proof must preserve KFD-3 witness hashes", {
+            id: claim.id || "",
+          }));
+        }
+        if (!trustProof.declaredCapabilityVerification?.result) {
+          issues.push(issue("error", `kfd-2.claims[${index}].trustProof.declaredCapabilityVerification`, "KFD-2 trust proof must preserve declared capability verification", {
+            id: claim.id || "",
+          }));
+        }
+        if (!trustProof.reverseAudit?.status) {
+          issues.push(issue("error", `kfd-2.claims[${index}].trustProof.reverseAudit`, "KFD-2 trust proof must preserve reverse audit result", {
+            id: claim.id || "",
+          }));
+        }
+        if (!trustProof.reverseAuditBoundary || typeof trustProof.reverseAuditBoundary !== "object" || Array.isArray(trustProof.reverseAuditBoundary)) {
+          issues.push(issue("error", `kfd-2.claims[${index}].trustProof.reverseAuditBoundary`, "KFD-2 trust proof must preserve the reverse audit boundary", {
+            id: claim.id || "",
+          }));
+        }
+        if (!Array.isArray(trustProof.residualRisk)) {
+          issues.push(issue("error", `kfd-2.claims[${index}].trustProof.residualRisk`, "KFD-2 trust proof must preserve residual risk as an array", {
+            id: claim.id || "",
+          }));
+        }
+        if (!trustProof.responsibility?.registryFactsOwner || !trustProof.responsibility?.artifactVerificationOwner || !trustProof.responsibility?.releasePassportProofOwner) {
+          issues.push(issue("error", `kfd-2.claims[${index}].trustProof.responsibility`, "KFD-2 trust proof must preserve KFD-3 responsibility state", {
+            id: claim.id || "",
+          }));
+        }
+      }
+    }
   }
   if (section.status === "failed") {
     issues.push(issue("error", "kfd-2.status", "kfd-2 release trust passport audit must not contain failed public claims"));

package/scripts/check-inventory.mjs

@@ -150,6 +150,9 @@ if (!coreIndexSource.includes("createBuildchainContractWorld")) {
 if (!coreIndexSource.includes("KFD2_RELEASE_TRUST_PASSPORT_CONTRACT")) {
   throw new Error("packages/core/index.js must export KFD-2 release trust passport contract");
 }
+if (!coreIndexSource.includes("KFD2_TRUST_PROOF_CONTRACT")) {
+  throw new Error("packages/core/index.js must export KFD-2 trust proof contract");
+}
 for (const requiredSnippet of [
   "createKfd1ReleaseGateEvidence",
   "resolveKfd1Metadata",