@kungfu-tech/buildchain 3.0.1-alpha.2 → 3.0.1-alpha.4

package/AGENTS.md

@@ -20,14 +20,14 @@ to `auto`; repositories only add channel configuration when they intentionally
 override that policy:
 
 ```yaml
-uses: kungfu-systems/buildchain/.github/workflows/build.yml@v2
+uses: kungfu-systems/buildchain/.github/workflows/build.yml@v3
 ```
 
 During the v2.12 alpha evaluation window, canaries call the same router through
 the matching prerelease ref:
 
 ```yaml
-uses: kungfu-systems/buildchain/.github/workflows/build.yml@v2-alpha
+uses: kungfu-systems/buildchain/.github/workflows/build.yml@v3-alpha
 ```
 
 The default policy selects `vN-alpha` for pull requests, development, nightly,
@@ -40,7 +40,7 @@ For new repositories, prefer the CLI:
 ```sh
 npx @kungfu-tech/buildchain init --type package
 npx @kungfu-tech/buildchain validate --require-version-state
-npx @kungfu-tech/buildchain release --dry-run --target-ref alpha/v2/v2.2
+npx @kungfu-tech/buildchain release --dry-run --target-ref alpha/v3/v3.0
 ```
 
 See [`docs/cli.md`](docs/cli.md), [`docs/lifecycle-protocol.md`](docs/lifecycle-protocol.md),
@@ -48,7 +48,7 @@ and [`docs/reusable-build-surface.md`](docs/reusable-build-surface.md) for the
 consumer contract.
 
 For temporary validation of an unreleased Buildchain runtime, keep the committed
-workflow ref on `@v2` and use the trusted `workflow_dispatch` `buildchain-ref`
+workflow ref on `@v3` and use the trusted `workflow_dispatch` `buildchain-ref`
 pass-through. See [`docs/runtime-train-validation.md`](docs/runtime-train-validation.md).
 
 ## Building this repo
@@ -72,7 +72,7 @@ handoff in
 
 - Open pull requests against the relevant `dev/*` channel branch.
 - If a Buildchain change needs downstream validation before stable refs move,
-  publish a `train/v2/v2.3/<capability>` ref and include the validation request
+  publish a `train/v3/v3.0/<capability>` ref and include the validation request
   described in [`docs/runtime-train-validation.md`](docs/runtime-train-validation.md).
   After validation succeeds, do not leave the train as a pending merge item:
   merge the pull request into the active `dev/*` mainline and run the requested

package/README.md

@@ -48,21 +48,19 @@ or protocol evidence through the repository issue tracker.
 
 ## Install and Verify
 
-For standalone use, install a platform archive from a GitHub Release and verify
-the release passport before trusting the binary:
+For v3, use the published npm package and verify the release passport before
+trusting release evidence:
 
 ```bash
-# Example for Linux x64. Use the archive that matches your platform.
-curl -LO https://github.com/kungfu-systems/buildchain/releases/download/v2.2.1/buildchain-x86_64-unknown-linux-gnu.tar.gz
-curl -LO https://github.com/kungfu-systems/buildchain/releases/download/v2.2.1/buildchain.release.json
-curl -LO https://github.com/kungfu-systems/buildchain/releases/download/v2.2.1/artifact-evidence.json
-npx @kungfu-tech/buildchain verify release-passport buildchain.release.json
-tar -xzf buildchain-x86_64-unknown-linux-gnu.tar.gz
-./buildchain version
+curl -LO https://github.com/kungfu-systems/buildchain/releases/download/v3.0.0/buildchain.release.json
+curl -LO https://github.com/kungfu-systems/buildchain/releases/download/v3.0.0/artifact-evidence.json
+npx @kungfu-tech/buildchain@3.0.0 verify release-passport buildchain.release.json
+npx @kungfu-tech/buildchain@3.0.0 version
 ```
 
-Release pages publish platform archives, checksums, release passport files, and
-a single evidence bundle:
+The v3.0.0 release publishes evidence assets but no standalone platform archives.
+The names below describe the optional archive contract used by legacy release
+lines:
 
 - `buildchain-x86_64-unknown-linux-gnu.tar.gz`
 - `buildchain-aarch64-apple-darwin.tar.gz`
@@ -168,13 +166,13 @@ Consumers can report Buildchain-owned workflow failures directly to the
 Buildchain repository with a scoped issue-write token:
 
 ```yaml
-- uses: kungfu-systems/buildchain/actions/report-buildchain-issue@v2
+- uses: kungfu-systems/buildchain/actions/report-buildchain-issue@v3
   if: failure()
   with:
     token: ${{ steps.buildchain-issue-token.outputs.token }}
     summary: "Reusable build failed before artifact finalization"
     failure-code: reusable-build-failed
-    buildchain-ref: v2
+    buildchain-ref: v3
     diagnostics-path: .buildchain/artifacts/diagnostics.json
 ```
 
@@ -190,7 +188,7 @@ Bootstrap a repository:
 ```bash
 npx @kungfu-tech/buildchain init --type package --package-manager pnpm
 npx @kungfu-tech/buildchain validate --require-version-state
-npx @kungfu-tech/buildchain release --dry-run --target-ref alpha/v2/v2.2
+npx @kungfu-tech/buildchain release --dry-run --target-ref alpha/v3/v3.0
 ```
 
 Buildchain supports package and non-package projects through
@@ -245,15 +243,15 @@ Stable consumers should reference actions and workflows through floating major
 refs after reviewing the exact release passport:
 
 ```yaml
-uses: kungfu-systems/buildchain/actions/validate-config@v2
+uses: kungfu-systems/buildchain/actions/validate-config@v3
 ```
 
 ```yaml
-uses: kungfu-systems/buildchain/.github/workflows/build.yml@v2
+uses: kungfu-systems/buildchain/.github/workflows/build.yml@v3
 ```
 
 ```yaml
-uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v2
+uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v3
 ```
 
 ## Release Model

package/actions/promote-buildchain-ref/README.md

@@ -6,13 +6,13 @@ compatibility refs from buildchain release channels:
 - `alpha/v2/v2.0` creates or reuses the next exact prerelease tag such as
   `v2.0.1-alpha.0`, writes that version into package version state, points the
   alpha and dev channel branches at the version commit, then promotes
-  `v2.0-alpha` and, when this is the highest published alpha minor, `v2-alpha`;
+  `v2.0-alpha` and, when this is the highest published alpha minor, `v3-alpha`;
 - `release/v2/v2.0` creates or reuses the next exact release tag such as
   `v2.0.0`, writes that version into package version state, points the release
   channel branch and release tags at the release commit, then prepares a second
   source commit for the next exact prerelease tag such as `v2.0.1-alpha.0` and
   points the alpha/dev channel branches plus `v2.0-alpha` at that prerelease
-  commit, and moves `v2-alpha` only if no higher v2 minor has published an alpha;
+  commit, and moves `v3-alpha` only if no higher v2 minor has published an alpha;
 - `publish-gate/major` accepts a reviewed PR from a production release line such
   as `release/v2/v2.0`, writes the next major production version such as
   `v3.0.0`, points `publish-gate/major`, `release/v3/v3.0`, `v3.0`, and `v3`
@@ -129,7 +129,7 @@ Promotion can also own external publish side effects. Enable this only from a
 trusted channel workflow:
 
 ```yaml
-- uses: kungfu-systems/buildchain/actions/promote-buildchain-ref@v2
+- uses: kungfu-systems/buildchain/actions/promote-buildchain-ref@v3
   with:
     token: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
     generated-ref-update-token: ${{ github.token }}
@@ -140,7 +140,7 @@ trusted channel workflow:
     publish-auth: trusted-publishing
     publish-required-artifacts-json: >-
       [
-        {"kind":"npm","name":"@kungfu-tech/buildchain","ref":"2.0.0","digest":"sha256:..."}
+        {"kind":"npm","name":"@kungfu-tech/buildchain","ref":"3.0.0","digest":"sha256:..."}
       ]
 ```
 
@@ -149,7 +149,7 @@ workflow, keep the publish entrypoint on the `publish-gate/*` source-lock
 contract:
 
 ```yaml
-- uses: kungfu-systems/buildchain/actions/promote-buildchain-ref@v2
+- uses: kungfu-systems/buildchain/actions/promote-buildchain-ref@v3
   with:
     token: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
     sha: ${{ needs.build.outputs.publish-source-sha }}
@@ -211,7 +211,7 @@ For promote-only release candidates, attach the PR-stage reusable build evidence
 and fail before publish-gate side effects if it no longer matches:
 
 ```yaml
-- uses: kungfu-systems/buildchain/actions/promote-buildchain-ref@v2
+- uses: kungfu-systems/buildchain/actions/promote-buildchain-ref@v3
   with:
     token: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
     sha: ${{ needs.build.outputs.publish-source-sha }}
@@ -434,13 +434,13 @@ The tag names intentionally follow the old ABV release semantics:
 exact release tags are `vX.Y.Z`, exact alpha tags are `vX.Y.Z-alpha.N`, floating
 release tags are minor/major tags such as `v2.0` and `v2`, and floating alpha
 tags are minor-line tags such as `v2.0-alpha` plus cross-minor major tags such
-as `v2-alpha`. A major alpha tag only moves for the highest minor in that major
+as `v3-alpha`. A major alpha tag only moves for the highest minor in that major
 with a published alpha, so older-line maintenance cannot roll consumers back.
 Bare tags such as `1.0.0` are not
 maintained as buildchain release entrypoints.
 
 Repository rulesets should protect exact tags, not every `v*` tag. A ruleset
-such as `refs/tags/v*` also protects floating channel tags like `v2.0-alpha` and `v2-alpha`,
+such as `refs/tags/v*` also protects floating channel tags like `v2.0-alpha` and `v3-alpha`,
 which Buildchain must update after exact tags and publish evidence are durable.
 Use an exact-tag rule such as `refs/tags/v*.*.*` for immutable evidence tags and
 leave floating channel tags mutable for the promotion token.

package/actions/report-buildchain-issue/README.md

@@ -19,7 +19,7 @@ organization.
     owner: kungfu-systems
     repositories: buildchain
 
-- uses: kungfu-systems/buildchain/actions/report-buildchain-issue@v2
+- uses: kungfu-systems/buildchain/actions/report-buildchain-issue@v3
   if: failure()
   with:
     token: ${{ steps.buildchain-issue-token.outputs.token }}
@@ -66,7 +66,7 @@ steps:
       owner: kungfu-systems
       repositories: buildchain
 
-  - uses: kungfu-systems/buildchain/actions/report-buildchain-issue@v2
+  - uses: kungfu-systems/buildchain/actions/report-buildchain-issue@v3
     if: failure()
     with:
       token: ${{ steps.buildchain-issue-token.outputs.token || secrets.BUILDCHAIN_ISSUE_TOKEN || secrets.BUILDCHAIN_PROMOTION_TOKEN || github.token }}

package/actions/run-lifecycle/README.md

@@ -4,7 +4,7 @@ Run a Buildchain lifecycle stage or an explicit command and write a deterministi
 artifact manifest.
 
 ```yaml
-- uses: kungfu-systems/buildchain/actions/run-lifecycle@v2
+- uses: kungfu-systems/buildchain/actions/run-lifecycle@v3
   with:
     stage: build
     required: "true"

package/actions/validate-config/README.md

@@ -10,7 +10,7 @@ the actual build should not run yet.
 ## Usage
 
 ```yaml
-- uses: kungfu-systems/buildchain/actions/validate-config@v2
+- uses: kungfu-systems/buildchain/actions/validate-config@v3
   with:
     require-version-state: "true"
     require-lifecycle-stages: "install,build,verify"

package/bin/buildchain.mjs

@@ -296,15 +296,15 @@ Examples:
   buildchain validate --require-version-state --require-lifecycle-stages build,verify
   buildchain lifecycle run build --artifact-path dist --artifact-name "{repo}-{version}-{platform}"
   buildchain npm dry-run --json
-  buildchain release --dry-run --target-ref alpha/v2/v2.0
-  buildchain release line open --major 2 --minor 10 --source-ref release/v2/v2.9 --json
+  buildchain release --dry-run --target-ref alpha/v3/v3.0
+  buildchain release line open --major 3 --minor 1 --source-ref release/v3/v3.0 --json
   buildchain span --event native.build -- cmake --build build
-  buildchain collect github-release --tag v2.2.0 --assets-dir dist --output-dir .buildchain/release-passport
+  buildchain collect github-release --tag v3.0.0 --assets-dir dist --output-dir .buildchain/release-passport
   buildchain create publication-admission --input-json admission-input.json --output admission.json
   buildchain create runner-provenance --input-json runner-input.json --output runner.json
   buildchain verify release-passport .buildchain/release-passport/buildchain.release.json
   buildchain verify publication-admission admission.json --registry-json publication-authority-registry.json --runner-json runner.json --control-plane-audit-json control-plane.json --expected-json expected.json --json
-  buildchain audit publication-control-plane --repository kungfu-systems/buildchain --branch release/v2/v2.12
+  buildchain audit publication-control-plane --repository kungfu-systems/buildchain --branch release/v3/v3.0
   buildchain verify artifact ./dist/buildchain-x86_64-unknown-linux-gnu.tar.gz --passport .buildchain/release-passport/buildchain.release.json
   buildchain verify artifact-envelope .buildchain/kfx/artifact-verification-envelope.json --json
   buildchain project kfx-admission .buildchain/kfx/artifact-verification-envelope.json --json
@@ -1542,6 +1542,13 @@ async function main(argv = process.argv.slice(2)) {
         process.stdout.write(`buildchain log summary: ${summary.eventCount} events\n`);
         process.stdout.write(`sources: ${Object.keys(summary.sources).join(", ") || "none"}\n`);
         process.stdout.write(`phases: ${Object.keys(summary.phases).join(", ") || "none"}\n`);
+        if (summary.controlPlane.eventCount > 0) {
+          process.stdout.write(
+            `control plane: ${summary.controlPlane.eventCount} events, ` +
+            `incident reuse ${summary.controlPlane.workflowFriction.incidentReuseRate ?? "n/a"}, ` +
+            `release-intent suppression ${summary.controlPlane.releaseIntent.suppressionRate ?? "n/a"}\n`,
+          );
+        }
       }
       return;
     }

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.1-alpha.2",
+    "version": "3.0.1-alpha.4",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -50,7 +50,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:0c76b29023bd0044fb89846e8b8c88990654fdd55f4f26bbc9cd61ad34c07d68"
+      "auditDigest": "sha256:dcb2a0e383c6cced598ec198f8eacb9c6c141967624864eba81ca8f392a04326"
     },
     {
       "contractVersion": 1,
@@ -212,7 +212,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:c3b618429257e3a332f0f9d0827fb17fc7762ec215c64f849f6f51874aa3a1d3"
+      "auditDigest": "sha256:e7d185bca91ebc65d7c42f6bbe72e1466c3be2b651143d75af6af08711f51b8c"
     },
     {
       "contractVersion": 1,
@@ -256,7 +256,7 @@
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
       ],
       "breakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
-      "auditDigest": "sha256:92432be1f049d261434c986f79e55899f2097ca7b66f1261666fc5b85d685889"
+      "auditDigest": "sha256:6277559c749bcc9ae6c737b068b44c478e796377273acc9fc22ab9804be409d1"
     },
     {
       "contractVersion": 1,
@@ -468,7 +468,7 @@
         "missing issue permissions produce a copyable summary fallback"
       ],
       "breakingDigest": "sha256:575a2cb02cdb2e61bb2e84d5bbaaf64b430aa5d7936645660b592de4549d81b0",
-      "auditDigest": "sha256:512ccfeb7deedd950da87b112d25aa8667e081775b3b604f121374d25420eec1"
+      "auditDigest": "sha256:10b766e026f8089235dfd6a9356cdbfa42c5dd290ba3003e5fcfd886432a0a34"
     },
     {
       "contractVersion": 1,
@@ -601,7 +601,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:a6f8915ef3ade05f04efff98c1723f7562e2b4fc83dcdb1e7decead0e5ac7533"
+      "auditDigest": "sha256:c9cc2c172d70619e814e10a4cef551b93e52c3b35ae27d288c87d3c7f323eb51"
     },
     {
       "contractVersion": 1,
@@ -691,7 +691,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:fb9bda6574fabd7ef1a80a14165febaf6e3da636fd409491b341b0f85382369f"
+      "auditDigest": "sha256:b12d87db5c06a7012a5056485924861f9de85e157bc5e70ca415bec4ab23c28d"
     },
     {
       "contractVersion": 1,
@@ -713,7 +713,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:610a259dc3ac21d1913763f24e6459bacbbf0a62feef4228353e88909052e893"
+      "auditDigest": "sha256:8f22ca61a4569c22388182994b26527132998dc57f5e4801fe64fafe8f72e08b"
     },
     {
       "contractVersion": 1,
@@ -764,7 +764,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
+        "registryDigest": "sha256:282fc61919afefc041c020fdf2ef10f5c00e504fd459fa5bf588867b5a81ed4e",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -923,7 +923,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:a06607b6ebd3fb00b77519098c81d6fb5e9943ec268aebb1e5fdbefef6e598ad",
-        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
+        "registryDigest": "sha256:282fc61919afefc041c020fdf2ef10f5c00e504fd459fa5bf588867b5a81ed4e",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1229,7 +1229,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
-      "auditDigest": "sha256:0c76b29023bd0044fb89846e8b8c88990654fdd55f4f26bbc9cd61ad34c07d68"
+      "auditDigest": "sha256:dcb2a0e383c6cced598ec198f8eacb9c6c141967624864eba81ca8f392a04326"
     },
     {
       "contractVersion": 1,
@@ -1347,7 +1347,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:4fc6c33bf5b429f8087ac752d5cf2a19f4a1cc30db01aae927a28cee1cf924f0",
-        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
+        "registryDigest": "sha256:282fc61919afefc041c020fdf2ef10f5c00e504fd459fa5bf588867b5a81ed4e",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1702,6 +1702,13 @@
         "artifact-retention-days",
         "buildchain-ref",
         "buildchain-repository",
+        "checkout-cache-fallback",
+        "checkout-cache-fetch-attempts",
+        "checkout-cache-github-timeout-seconds",
+        "checkout-cache-mirror-url-template",
+        "checkout-cache-mode",
+        "checkout-cache-reference-repository-template",
+        "checkout-cache-timeout-seconds",
         "gate-command-json",
         "gate-environment-json",
         "gate-plan-command-json",
@@ -1720,8 +1727,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:29569f4b754595792a16742d1c4c63838b54601674a2cb6c96261a72c962dece",
-        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
+        "digest": "sha256:bd2d12e2cda0802ab00d8964b4bd36f1630442b8d1bff83865840acd2d74f428",
+        "registryDigest": "sha256:282fc61919afefc041c020fdf2ef10f5c00e504fd459fa5bf588867b5a81ed4e",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1739,6 +1746,34 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "checkout-cache-fallback": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "checkout-cache-fetch-attempts": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "checkout-cache-github-timeout-seconds": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "checkout-cache-mirror-url-template": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "checkout-cache-mode": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "checkout-cache-reference-repository-template": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "checkout-cache-timeout-seconds": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "gate-command-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1808,7 +1843,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:5f1868478b7ccd9fb79aea76bc771289d2ca6bd2dccd1abf57575426f1eae5fb",
-      "auditDigest": "sha256:f478f291726cd47d998c37d454d9fc3e97f1d4a45dc60fe756d8c239fa1245bd"
+      "auditDigest": "sha256:f57fabd5dd63bfd2640f0d1841c8c6c239009ea3f291a28670074b5742f99bb6"
     },
     {
       "contractVersion": 1,
@@ -1894,7 +1929,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
+        "registryDigest": "sha256:282fc61919afefc041c020fdf2ef10f5c00e504fd459fa5bf588867b5a81ed4e",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2073,7 +2108,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27",
-      "auditDigest": "sha256:92432be1f049d261434c986f79e55899f2097ca7b66f1261666fc5b85d685889"
+      "auditDigest": "sha256:6277559c749bcc9ae6c737b068b44c478e796377273acc9fc22ab9804be409d1"
     },
     {
       "contractVersion": 1,
@@ -2138,7 +2173,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
+        "registryDigest": "sha256:282fc61919afefc041c020fdf2ef10f5c00e504fd459fa5bf588867b5a81ed4e",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2320,7 +2355,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
+        "registryDigest": "sha256:282fc61919afefc041c020fdf2ef10f5c00e504fd459fa5bf588867b5a81ed4e",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2625,7 +2660,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:2bae7310eb27f48a3afc6b7f993872d6b6121cf3f67ad4d6e2da35b254c4d047",
-        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
+        "registryDigest": "sha256:282fc61919afefc041c020fdf2ef10f5c00e504fd459fa5bf588867b5a81ed4e",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3008,7 +3043,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:c3b618429257e3a332f0f9d0827fb17fc7762ec215c64f849f6f51874aa3a1d3"
+      "auditDigest": "sha256:e7d185bca91ebc65d7c42f6bbe72e1466c3be2b651143d75af6af08711f51b8c"
     },
     {
       "contractVersion": 1,
@@ -3069,7 +3104,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
-        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
+        "registryDigest": "sha256:282fc61919afefc041c020fdf2ef10f5c00e504fd459fa5bf588867b5a81ed4e",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -3192,7 +3227,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:4b5425a3111fa55d3c9244c4af08effa9045362680bd0833a30d718aba256600",
+        "registryDigest": "sha256:282fc61919afefc041c020fdf2ef10f5c00e504fd459fa5bf588867b5a81ed4e",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3206,5 +3241,5 @@
     }
   ],
   "compatibilityDigest": "sha256:008b1c5a90a787cf30106829ac7aca68ab501f6d9c375e415d9c5c6b89039f46",
-  "contractDigest": "sha256:956fb4092387d065d20db30ec0c03e6f7575acf7c40a9304dec2b77706b54d16"
+  "contractDigest": "sha256:0cd86ea80b137c5f5a43e8ca14565773fa8958fd946bdcff71856fde940d4e6b"
 }