@kungfu-tech/buildchain 3.0.0 → 3.0.1-alpha.1

package/README.md

@@ -224,6 +224,9 @@ The active reusable workflow surfaces are:
 - `.github/workflows/.gate-profile.yml` for project-neutral Shifu Gate profile
   planning, capability-aware runner dispatch, receipt validation, and one
   stable aggregate check;
+- `.github/workflows/.auditable-demo.yml` for exact-artifact demo
+  qualification, transcript-bound renderer smoke, and optional media rendering
+  from the exact passing Gate bundle;
 - `.github/workflows/.build.yml` for deterministic multi-platform build and
   artifact contracts;
 - `.github/workflows/build.yml` for the single-config channel router that uses

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.0",
+    "version": "3.0.1-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -50,7 +50,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:1e1386b49f8f3ea813f8157afb96cecec7609b6efe01f07895c893c097b1ed66"
+      "auditDigest": "sha256:a7041273c13b8f5cfe9bfb881c5d56193ec26559fac1ba29c838fe44aa11afe5"
     },
     {
       "contractVersion": 1,
@@ -89,7 +89,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:1f29079465cb11004db3f1a6ec4f37b1900fdd90d3278d8d0bacb223757bffa5"
+      "auditDigest": "sha256:e0d7c74d69eeec495e8fcd39b232dbfa18af59665a1ebb0b1d373906c1aa474f"
     },
     {
       "contractVersion": 1,
@@ -170,7 +170,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
-      "auditDigest": "sha256:fb1e6e05c16df3e357a9b47d2c8335b99e23b2ccf8d92432b0cbc655fa9196a1"
+      "auditDigest": "sha256:4c9bb53df611d9d224c301f664a8b026284c677a803f488dc24d42b80756df94"
     },
     {
       "contractVersion": 1,
@@ -212,7 +212,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:821aa9a8b69fc2fb0fdea3fe569133b9f084be6bb0e4543e1583372c10d2316f"
+      "auditDigest": "sha256:c3b618429257e3a332f0f9d0827fb17fc7762ec215c64f849f6f51874aa3a1d3"
     },
     {
       "contractVersion": 1,
@@ -256,7 +256,57 @@
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
       ],
       "breakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
-      "auditDigest": "sha256:063dfe24e1ccdd95b4ffbf89a154aa71197c8bd1cb98b4705d8663917c026366"
+      "auditDigest": "sha256:92432be1f049d261434c986f79e55899f2097ca7b66f1261666fc5b85d685889"
+    },
+    {
+      "contractVersion": 1,
+      "stability": "stable",
+      "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line",
+      "id": "auditable-demo",
+      "kind": "workflow",
+      "path": ".github/workflows/.auditable-demo.yml",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/.auditable-demo.yml@v3",
+      "requiredInputs": [
+        "source-artifact-name",
+        "source-artifact-digest",
+        "adapter-path",
+        "renderer-image"
+      ],
+      "requiredOutputs": [
+        "source-sha",
+        "gate-artifact-name",
+        "gate-artifact-id",
+        "gate-artifact-digest",
+        "gate-artifact-url",
+        "gate-root",
+        "media-artifact-name",
+        "media-artifact-id",
+        "media-artifact-digest",
+        "media-artifact-url",
+        "media-root"
+      ],
+      "breakingDefaults": {
+        "trustedEventRequired": true,
+        "renderMediaDefault": false,
+        "artifactRetentionDaysDefault": 14,
+        "gatePolicy": "required-before-selective-render"
+      },
+      "optionalInputs": [
+        "buildchain-repository",
+        "source-ref",
+        "render-media",
+        "artifact-retention-days",
+        "require-trusted-event"
+      ],
+      "guarantees": [
+        "the source GitHub Artifact is admitted by exact same-run name and archive digest",
+        "the checked-in consumer adapter runs from the exact consumer source with a disposable home and reduced environment",
+        "every invocation runs an immutable network-disabled renderer smoke before emitting a qualified Gate bundle",
+        "complete media rendering is optional and consumes only an exact passing Gate bundle",
+        "Gate and media bundles expose both GitHub Artifact archive coordinates and deterministic member roots"
+      ],
+      "breakingDigest": "sha256:a68f34d3dc24e0e0cd0040f978c174b62bf29a0472cebe1c43751e62408e6af6",
+      "auditDigest": "sha256:1969981087ee484411daae60797430d0f762d3a328c438dc723f2794d6d41f51"
     },
     {
       "contractVersion": 1,
@@ -641,7 +691,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:29b45afe77400b5b38872574cdf7ccfcf8abc93b7f78ad32d994a6636a4f9f68"
+      "auditDigest": "sha256:fb9bda6574fabd7ef1a80a14165febaf6e3da636fd409491b341b0f85382369f"
     },
     {
       "contractVersion": 1,
@@ -663,7 +713,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:9e45dffc31b061f2c074cbc50e2d2b61da67250504f20cff475c4648fea4ae65"
+      "auditDigest": "sha256:610a259dc3ac21d1913763f24e6459bacbbf0a62feef4228353e88909052e893"
     },
     {
       "contractVersion": 1,
@@ -714,7 +764,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -873,7 +923,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:a06607b6ebd3fb00b77519098c81d6fb5e9943ec268aebb1e5fdbefef6e598ad",
-        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1179,7 +1229,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
-      "auditDigest": "sha256:1e1386b49f8f3ea813f8157afb96cecec7609b6efe01f07895c893c097b1ed66"
+      "auditDigest": "sha256:a7041273c13b8f5cfe9bfb881c5d56193ec26559fac1ba29c838fe44aa11afe5"
     },
     {
       "contractVersion": 1,
@@ -1297,7 +1347,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:4fc6c33bf5b429f8087ac752d5cf2a19f4a1cc30db01aae927a28cee1cf924f0",
-        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1612,7 +1662,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:1f29079465cb11004db3f1a6ec4f37b1900fdd90d3278d8d0bacb223757bffa5"
+      "auditDigest": "sha256:e0d7c74d69eeec495e8fcd39b232dbfa18af59665a1ebb0b1d373906c1aa474f"
     },
     {
       "contractVersion": 1,
@@ -1671,7 +1721,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:29569f4b754595792a16742d1c4c63838b54601674a2cb6c96261a72c962dece",
-        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1827,6 +1877,7 @@
         "production-release-on-main",
         "production-release-pr-mode",
         "production-release-pr-token",
+        "production-source-sha",
         "publication-admission-json",
         "publication-control-plane-audit-json",
         "publication-expected-json",
@@ -1842,8 +1893,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:65cc01e6d2b622277d67237e4811e82d24d2289d55c2f7d2dfb72325c610b2ea",
-        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
+        "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -1961,6 +2012,10 @@
             "classification": "redacted",
             "source": "workflow-call-input"
           },
+          "production-source-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "publication-admission-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -2018,7 +2073,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27",
-      "auditDigest": "sha256:063dfe24e1ccdd95b4ffbf89a154aa71197c8bd1cb98b4705d8663917c026366"
+      "auditDigest": "sha256:92432be1f049d261434c986f79e55899f2097ca7b66f1261666fc5b85d685889"
     },
     {
       "contractVersion": 1,
@@ -2083,7 +2138,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2265,7 +2320,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2540,10 +2595,14 @@
         "publish-required-artifacts-json",
         "publish-target",
         "publish-transaction-override",
+        "release-activation-command",
+        "release-activation-receipt-set-path",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
         "release-passport-buildchain-self-kfd",
+        "release-passport-evidence-command",
+        "release-passport-evidence-path",
         "release-passport-impact-json",
         "release-passport-invariant-passport-command",
         "release-passport-invariant-passport-jsons",
@@ -2565,8 +2624,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:0fcfcb36cad335e6ffe50b087d17f8bce9d6bd711e285740b28ce05bf9be7c6e",
-        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
+        "digest": "sha256:2bae7310eb27f48a3afc6b7f993872d6b6121cf3f67ad4d6e2da35b254c4d047",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -2836,6 +2895,14 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "release-activation-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "release-activation-receipt-set-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "release-candidate-workflow-file": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2852,6 +2919,14 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "release-passport-evidence-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "release-passport-evidence-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "release-passport-impact-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -2933,7 +3008,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:821aa9a8b69fc2fb0fdea3fe569133b9f084be6bb0e4543e1583372c10d2316f"
+      "auditDigest": "sha256:c3b618429257e3a332f0f9d0827fb17fc7762ec215c64f849f6f51874aa3a1d3"
     },
     {
       "contractVersion": 1,
@@ -2994,7 +3069,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
-        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -3117,7 +3192,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:5dc72042c6cd7d50fc4b77d186e14b676b48be0ac8c88ee85eb54ea1b428e144",
+        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3130,6 +3205,6 @@
       "auditDigest": "sha256:e07a5db56a71bd0ac79c81f12619938055361bf0a0ed8e5891f88ca1c51f1c93"
     }
   ],
-  "compatibilityDigest": "sha256:199fd83a7da33b0f654692ca973b33155e376ed50f0ce1f5864e1b6b18e0500a",
-  "contractDigest": "sha256:914720131f07664cd187a1033f357c4952ef1008f5553cb6b285a75f786a7fbc"
+  "compatibilityDigest": "sha256:008b1c5a90a787cf30106829ac7aca68ab501f6d9c375e415d9c5c6b89039f46",
+  "contractDigest": "sha256:14ac2f1299fc7772aab64917715b391eb9ed9d785f4fcaf2224e57cf4447ed6a"
 }