@kungfu-tech/buildchain 3.0.1 → 3.0.2-alpha.0

package/packages/core/kfd.js

@@ -266,12 +266,12 @@ function normalizeKfdSupport(component = {}) {
   const support = component.kfd && typeof component.kfd === "object" && !Array.isArray(component.kfd)
     ? { ...component.kfd }
     : {};
-  for (const [key, aliases] of Object.entries({
-    kfd1: ["kfd1", "kfd_1", "kfd-1"],
-    kfd2: ["kfd2", "kfd_2", "kfd-2"],
-    kfd3: ["kfd3", "kfd_3", "kfd-3"],
-    kfd4: ["kfd4", "kfd_4", "kfd-4"],
-  })) {
+  for (const [key, aliases] of Object.entries(Object.fromEntries(
+    Array.from({ length: 13 }, (_, index) => {
+      const number = index + 1;
+      return [`kfd${number}`, [`kfd${number}`, `kfd_${number}`, `kfd-${number}`]];
+    }),
+  ))) {
     const found = aliases.map((alias) => component[alias] ?? support[alias]).find((value) => value !== undefined);
     support[key] = found === undefined ? support[key] || "declared" : String(found);
   }
@@ -940,7 +940,16 @@ export function collectKfdStatus({ cwd = process.cwd() } = {}) {
       "kfd-1": ["schema", "witness", "gate", "verify"],
       "kfd-2": ["schema", "taxonomy", "claims", "product-claims", "trust-claims", "trust-assessment", "upstream"],
       "kfd-3": ["schema", "detect", "register", "audit", "witness", "query", "aggregate"],
-      "kfd-4": ["schema"],
+      "kfd-4": ["schema", "product-gate", "verify", "support-projection"],
+      "kfd-5": ["schema", "product-gate", "verify", "support-projection"],
+      "kfd-6": ["schema", "unsupported-claim-barrier"],
+      "kfd-7": ["schema", "product-gate", "verify", "support-projection"],
+      "kfd-8": ["schema", "draft-claim-barrier"],
+      "kfd-9": ["schema", "draft-claim-barrier"],
+      "kfd-10": ["schema", "draft-claim-barrier"],
+      "kfd-11": ["schema", "draft-claim-barrier"],
+      "kfd-12": ["schema", "draft-claim-barrier"],
+      "kfd-13": ["schema", "draft-claim-barrier"],
     },
     paths: pathStatus,
   };

package/packages/core/kfd3-surface-register.js

@@ -20,6 +20,9 @@ const KIND_ALIASES = Object.freeze({
   command: "cli",
   binary: "binary",
   "standalone-binary": "binary",
+  app: "binary",
+  appimage: "binary",
+  installer: "binary",
   docs: "documentation",
   documentation: "documentation",
   site: "site-bundle",
@@ -602,6 +605,100 @@ export function auditKfd3Surfaces({
   };
 }
 
+function auditProductDeclaredKfd3Surfaces({ cwd, registry }) {
+  const issues = [];
+  const ids = new Set();
+  for (const [index, entry] of registry.surfaces.entries()) {
+    const label = `surfaces[${index}]`;
+    if (!entry.id || ids.has(entry.id)) {
+      issues.push({
+        level: "error",
+        code: "declared-surface-id",
+        surfaceId: entry.id || "",
+        message: `${label}.id must be non-empty and unique`,
+      });
+    }
+    ids.add(entry.id);
+    for (const field of ["kind", "name", "sourcePath"]) {
+      if (!String(entry[field] || "").trim()) {
+        issues.push({
+          level: "error",
+          code: "declared-surface-field",
+          surfaceId: entry.id || "",
+          message: `${label}.${field} is required`,
+        });
+      }
+    }
+    const evidencePath = String(entry.evidencePath || entry.artifactPath || "").trim();
+    if (!evidencePath) {
+      issues.push({
+        level: "error",
+        code: "declared-surface-evidence",
+        surfaceId: entry.id || "",
+        message: `${label} must bind evidencePath or artifactPath`,
+      });
+    }
+    for (const [field, relativePath] of [
+      ["sourcePath", entry.sourcePath],
+      ["evidencePath", evidencePath],
+    ]) {
+      const normalized = String(relativePath || "").replaceAll("\\", "/");
+      const filePath = path.resolve(cwd, normalized);
+      const relative = path.relative(path.resolve(cwd), filePath);
+      if (
+        !normalized ||
+        path.isAbsolute(normalized) ||
+        relative.startsWith("..") ||
+        path.isAbsolute(relative) ||
+        !fs.existsSync(filePath)
+      ) {
+        issues.push({
+          level: "error",
+          code: "declared-surface-evidence-missing",
+          surfaceId: entry.id || "",
+          message: `${label}.${field} must resolve inside the product repository`,
+        });
+      }
+    }
+  }
+  const ok = issues.length === 0;
+  return {
+    schemaVersion: 1,
+    contract: KFD3_SURFACE_AUDIT_CONTRACT,
+    ok,
+    status: ok ? "passed" : "failed",
+    registryPath: registry.registryPath,
+    detection: {
+      schemaVersion: 1,
+      contract: KFD3_SURFACE_DETECTION_CONTRACT,
+      cwd: path.resolve(cwd),
+      artifactPath: "",
+      detectedAt: new Date().toISOString(),
+      kinds: [...new Set(registry.surfaces.map((entry) => entry.kind))].sort(),
+      summary: {
+        surfaceCount: registry.surfaces.length,
+        byKind: Object.fromEntries(
+          [...new Set(registry.surfaces.map((entry) => entry.kind))]
+            .sort()
+            .map((kind) => [kind, registry.surfaces.filter((entry) => entry.kind === kind).length]),
+        ),
+      },
+      surfaces: registry.surfaces,
+    },
+    registry,
+    summary: {
+      detected: registry.surfaces.length,
+      declared: registry.surfaces.length,
+      enforced: registry.surfaces.filter((entry) => entry.state === "enforced" || entry.enforcement === "enforced").length,
+      detectedButUnregistered: 0,
+      declaredButMissing: issues.length,
+    },
+    issues,
+    verificationMode: "product-declared-registry",
+    verifier: String(registry.policy?.customSurfaceDetection || ""),
+  };
+}
+
 export function createKfd3SurfaceWitness({
   cwd = process.cwd(),
   registryPath = "",
@@ -766,7 +863,13 @@ export async function queryKfd3Capabilities({
   const effectiveRegistryPath = resolveRegistryPath(cwd, registryPath);
   const registry = readKfd3SurfaceRegistry({ cwd, registryPath: effectiveRegistryPath });
   const hasRegistry = fs.existsSync(path.resolve(cwd, effectiveRegistryPath));
-  const audit = hasRegistry ? auditKfd3Surfaces({ cwd, registryPath: effectiveRegistryPath, artifactPath }) : null;
+  const audit = hasRegistry
+    ? (
+        registry.policy?.customSurfaceDetection
+          ? auditProductDeclaredKfd3Surfaces({ cwd, registry })
+          : auditKfd3Surfaces({ cwd, registryPath: effectiveRegistryPath, artifactPath })
+      )
+    : null;
   if (hasRegistry) {
     return {
       schemaVersion: 1,
@@ -774,6 +877,7 @@ export async function queryKfd3Capabilities({
       product: product || registry.product?.name || registry.product?.id || "local-product",
       source: { type: "surface-registry", path: effectiveRegistryPath },
       status: audit.status,
+      verificationMode: audit.verificationMode || "buildchain-detected-surface-audit",
       summary: audit.summary,
       capabilities: capabilitiesFromRegistry({ registry, audit }),
       kfd: {

package/packages/core/public-surface-audit.js

@@ -85,6 +85,11 @@ function commandId(first = "", second = "", third = "") {
 
 export function enumerateCliCommandsFromBin({ root = process.cwd(), binPath = "bin/buildchain.mjs" } = {}) {
   const source = readText(root, binPath);
+  const dispatchSource = [
+    source,
+    ...listFiles(root, "bin/internal", (name) => name.endsWith(".mjs"))
+      .map((relPath) => readText(root, relPath)),
+  ].join("\n");
   const usageMatch = source.match(/return `Usage:\n([\s\S]*?)`;\n}/);
   const usage = usageMatch?.[1] || "";
   const usageCommands = [];
@@ -96,7 +101,7 @@ export function enumerateCliCommandsFromBin({ root = process.cwd(), binPath = "b
       usage: line.trim().replace(/\s+/g, " "),
     });
   }
-  const dispatchCommands = [...source.matchAll(/if\s*\(\s*command\s*===\s*"([^"]+)"/g)]
+  const dispatchCommands = [...dispatchSource.matchAll(/if\s*\(\s*command\s*===\s*"([^"]+)"/g)]
     .map((match) => commandId(match[1]));
   return uniqueSorted([
     ...usageCommands.map((entry) => entry.id),

package/packages/core/release-passport-contract.js

@@ -99,6 +99,7 @@ export const RELEASE_PASSPORT_SCHEMA = {
     "kfd-1": OBJECT,
     "kfd-2": OBJECT,
     "kfd-3": OBJECT,
+    kfdSupport: OBJECT,
   },
   additionalProperties: true,
 };
@@ -121,6 +122,7 @@ const BUILDCHAIN_AGGREGATION_FIELDS = [
   "platformArtifactManifests",
   "distTagPromotion",
   "controllerReceipts",
+  "kfdSupport",
   "artifacts",
   "evidence",
   "recovery",
@@ -158,6 +160,13 @@ export function createReleasePassportCheckManifest({ standards = kfdStandards }
         nodeApi: "@kungfu-tech/buildchain/release-passport#verifyReleasePassport",
         result: "check-report.json",
       },
+      kfdSupportProjection: {
+        inputSchema: "schemas/kfd-product-gate-input-v1.schema.json",
+        projectionSchema: "schemas/kfd-support-projection-v1.schema.json",
+        evidence: "kfd-support.json",
+        rule:
+          "The passport mirrors one product-owned support matrix and validated product-gate results without widening any claim state.",
+      },
     },
     ownership: {
       envelopeOwner: "Buildchain",
@@ -184,6 +193,10 @@ export function createReleasePassportCheckManifest({ standards = kfdStandards }
           when: "evidence.transactionState is present",
           pointer: "evidence.transactionState",
         },
+        {
+          when: "kfdSupport is present",
+          pointer: "evidence.kfdSupport",
+        },
       ],
       rule:
         "The normative checker resolves every declared sibling relative to the passport and fails closed on missing required evidence, digest drift, or semantic mismatch.",

package/packages/core/release-passport.js

@@ -14,6 +14,10 @@ import {
   validateKfd1ReleaseGateEvidence,
   validateKfd3CollaborationInterfaceReleaseGateEvidence,
 } from "./kfd-gate.js";
+import {
+  createKfdSupportProjection,
+  validateKfdSupportProjection,
+} from "./kfd-product-gates.js";
 import { createSurfaceTimestampPolicy } from "./surface-manifest.js";
 import { validatePublishEvidence as validateTransactionPublishEvidence } from "./publish-transaction.js";
 import { normalizeControllerReceiptReferences } from "./controller-evidence.js";
@@ -1155,6 +1159,8 @@ export function createReleasePassport({
   kfd1 = undefined,
   kfd2Claims = [],
   kfd3 = undefined,
+  kfdSupport = undefined,
+  kfdSupportEvidencePath = "",
   invariantPassports = undefined,
   kfdAgentHubEvidence = undefined,
   kfdAgentHubEvidencePath = "",
@@ -1183,6 +1189,16 @@ export function createReleasePassport({
   const kfd1Metadata = resolveKfd1Metadata();
   const normalizedKfd1 = kfd1?.passportSection ? kfd1 : undefined;
   const normalizedKfd3 = kfd3?.passportSection ? kfd3 : undefined;
+  const normalizedKfdSupport = kfdSupport ? structuredClone(kfdSupport) : undefined;
+  if (normalizedKfdSupport) {
+    const validation = validateKfdSupportProjection(normalizedKfdSupport, {
+      expectedSourceSha: optionalString(sourceSha),
+      checkedAt: generatedAt,
+    });
+    if (!validation.valid) {
+      throw new Error(`KFD support projection is invalid: ${validation.issues.map((entry) => `${entry.path}: ${entry.message}`).join("; ")}`);
+    }
+  }
   const normalizedKfdAgentHub = normalizeKfdAgentHubEvidence(kfdAgentHubEvidence);
   const normalizedKfd2 = createKfd2ReleaseTrustPassportAudit({
     explicitClaims: kfd2Claims,
@@ -1190,13 +1206,27 @@ export function createReleasePassport({
     kfd3Section: normalizedKfd3?.passportSection,
   });
   const builtSourceSha = optionalString(release.builtSourceSha || release.built_source_sha);
+  const builtSourceTreeSha = optionalString(
+    release.builtSourceTreeSha || release.built_source_tree_sha,
+  );
   const promotionChannelSha = optionalString(release.promotionChannelSha || release.promotion_channel_sha);
+  const promotionChannelTreeSha = optionalString(
+    release.promotionChannelTreeSha || release.promotion_channel_tree_sha,
+  );
   const treeEquivalent = release.treeEquivalent === true;
+  const recoveryTreeEquivalent = Boolean(
+    treeEquivalent &&
+    builtSourceTreeSha &&
+    promotionChannelTreeSha &&
+    builtSourceTreeSha === promotionChannelTreeSha,
+  );
   const normalizedControllerReceipts = normalizeControllerReceiptReferences({
     receipts: controllerReceipts,
     references: controllerReceiptReferences,
     expectedSourceSha: sourceSha,
-    acceptedSourceShas: treeEquivalent && promotionChannelSha === sourceSha && builtSourceSha
+    acceptedSourceShas: treeEquivalent && builtSourceSha && (
+      promotionChannelSha === sourceSha || recoveryTreeEquivalent
+    )
       ? [builtSourceSha]
       : [],
     requirePassed: true,
@@ -1279,9 +1309,9 @@ export function createReleasePassport({
       releaseSha,
       releaseMaterialSha,
       builtSourceSha: optionalString(release.builtSourceSha || release.built_source_sha),
-      builtSourceTreeSha: optionalString(release.builtSourceTreeSha || release.built_source_tree_sha),
+      builtSourceTreeSha,
       promotionChannelSha: optionalString(release.promotionChannelSha || release.promotion_channel_sha),
-      promotionChannelTreeSha: optionalString(release.promotionChannelTreeSha || release.promotion_channel_tree_sha),
+      promotionChannelTreeSha,
       treeEquivalent: release.treeEquivalent === undefined ? undefined : Boolean(release.treeEquivalent),
       publishToolingSha: optionalString(
         release.publishToolingSha ||
@@ -1326,6 +1356,7 @@ export function createReleasePassport({
     ...(normalizedKfd1 ? { [normalizedKfd1.key || kfd1Metadata.key]: normalizedKfd1.passportSection } : {}),
     ...(normalizedKfd2 ? { "kfd-2": normalizedKfd2 } : {}),
     ...(normalizedKfd3 ? { [normalizedKfd3.key || "kfd-3"]: normalizedKfd3.passportSection } : {}),
+    ...(normalizedKfdSupport ? { kfdSupport: normalizedKfdSupport } : {}),
     ...(normalizedKfdAgentHub ? { kfdAgentHub: normalizedKfdAgentHub } : {}),
     ...(invariantPassports ? { invariantPassports } : {}),
     ...(normalizedControllerReceipts.length > 0 ? { controllerReceipts: normalizedControllerReceipts } : {}),
@@ -1370,6 +1401,7 @@ export function createReleasePassport({
       kfd1: normalizedKfd1 ? `${normalizedKfd1.key || kfd1Metadata.key}` : "",
       kfd2: normalizedKfd2 ? "kfd-2" : "",
       kfd3: normalizedKfd3 ? `${normalizedKfd3.key || "kfd-3"}` : "",
+      kfdSupport: normalizedKfdSupport ? optionalString(kfdSupportEvidencePath || "kfd-support.json") : "",
       kfdAgentHub: normalizedKfdAgentHub ? optionalString(kfdAgentHubEvidencePath || "kfd-agent-hub-evidence.json") : "",
       invariantPassports: invariantPassports ? "invariantPassports" : "",
       impact: impactPath,
@@ -1412,6 +1444,8 @@ export function collectGitHubReleasePassport({
   kfd3PrebuildWitnessJsons = [],
   kfd3ArtifactWitnessJsons = [],
   kfd3ArtifactVerifyCommand = "",
+  kfdSupportMatrixJson = "",
+  kfdProductGateJsons = [],
   invariantPassportJsons = [],
   invariantPassportCommand = "",
   kfdAgentHubEvidenceJson = "",
@@ -1461,6 +1495,15 @@ export function collectGitHubReleasePassport({
     .filter(Boolean)
     .map((witnessJson) => parseJsonInputWithMeta(witnessJson, undefined, { cwd, label: "kfd3ArtifactWitnessJsons entry" }))
     .filter((meta) => meta.value);
+  const kfdSupportMatrixMeta = parseJsonInputWithMeta(
+    kfdSupportMatrixJson,
+    undefined,
+    { cwd, label: "kfdSupportMatrixJson" },
+  );
+  const kfdProductGateMetas = (kfdProductGateJsons || [])
+    .filter(Boolean)
+    .map((gateJson) => parseJsonInputWithMeta(gateJson, undefined, { cwd, label: "kfdProductGateJsons entry" }))
+    .filter((meta) => meta.value);
   const basePassportMeta = parseJsonInputWithMeta(basePassportJson, undefined, { cwd, label: "basePassportJson" });
   const kfd3ArtifactCommandMeta = parseJsonCommandOutput({
     command: kfd3ArtifactVerifyCommand,
@@ -1487,6 +1530,9 @@ export function collectGitHubReleasePassport({
     ...kfd3ArtifactWitnessMetas.map((meta) => meta.value),
     ...(kfd3ArtifactCommandMeta.value ? [kfd3ArtifactCommandMeta.value] : []),
   ];
+  if (!kfdSupportMatrixMeta.value && kfdProductGateMetas.length > 0) {
+    throw new Error("KFD product gate inputs require --kfd-support-matrix-json");
+  }
   const publish = parseJsonInput(publishJson, {}, { cwd, label: "publishJson" });
   const assets = [
     ...(Array.isArray(release.assets) ? release.assets : []),
@@ -1516,6 +1562,15 @@ export function collectGitHubReleasePassport({
     artifactWitnessMetas: kfd3ArtifactWitnessMetas,
     artifactCommandMeta: kfd3ArtifactCommandMeta.value ? kfd3ArtifactCommandMeta : undefined,
   });
+  const kfdSupport = kfdSupportMatrixMeta.value
+    ? createKfdSupportProjection({
+        matrix: kfdSupportMatrixMeta.value,
+        matrixRoot: kfdSupportMatrixMeta.sha256 ? `sha256:${kfdSupportMatrixMeta.sha256}` : "",
+        gateResults: kfdProductGateMetas.map((meta) => meta.value),
+        expectedSourceSha: sourceSha,
+        checkedAt: nowIso(),
+      })
+    : undefined;
   const passport = mergeAuthoritativePassportBase(createReleasePassport({
     cwd,
     repository,
@@ -1560,6 +1615,8 @@ export function collectGitHubReleasePassport({
     kfd1,
     kfd2Claims: kfd2ClaimMetas.map((meta) => meta.value),
     kfd3,
+    kfdSupport,
+    kfdSupportEvidencePath: kfdSupport ? "kfd-support.json" : "",
     invariantPassports,
     kfdAgentHubEvidence: kfdAgentHubEvidenceMeta.value
       ? { ...kfdAgentHubEvidenceMeta, path: "kfd-agent-hub-evidence.json" }
@@ -1581,6 +1638,7 @@ export function collectGitHubReleasePassport({
     agentIndex,
     productMechanism,
     kfdAgentHubEvidence: kfdAgentHubEvidenceMeta.value,
+    kfdSupportEvidence: kfdSupport,
     checkedAt: nowIso(),
   });
   const files = {
@@ -1590,6 +1648,7 @@ export function collectGitHubReleasePassport({
     "impact.json": impact,
     "agent-index.json": agentIndex,
     ...(kfdAgentHubEvidenceMeta.value ? { "kfd-agent-hub-evidence.json": kfdAgentHubEvidenceMeta.value } : {}),
+    ...(kfdSupport ? { "kfd-support.json": kfdSupport } : {}),
     "buildchain.release.json": passport,
     "check-report.json": checkReport,
   };
@@ -1884,6 +1943,7 @@ export function createReleaseCheckReport({
   agentIndex,
   productMechanism,
   kfdAgentHubEvidence,
+  kfdSupportEvidence,
   checkedAt = nowIso(),
 } = {}) {
   const issues = [];
@@ -1893,6 +1953,24 @@ export function createReleaseCheckReport({
   validateContract(agentIndex, AGENT_INDEX_CONTRACT, "agentIndex", issues);
   validateContract(productMechanism, PRODUCT_MECHANISM_CONTRACT, "productMechanism", issues);
   validateKfdAgentHubReleaseEvidence(passport?.kfdAgentHub, kfdAgentHubEvidence, issues);
+  if (passport?.kfdSupport) {
+    const validation = validateKfdSupportProjection(passport.kfdSupport, {
+      expectedSourceSha: optionalString(passport?.release?.sourceSha),
+      checkedAt,
+    });
+    for (const entry of validation.issues) {
+      issues.push(issue("error", `kfdSupport.${entry.path || entry.code}`, entry.message, entry));
+    }
+    if (!kfdSupportEvidence || stableJson(kfdSupportEvidence) !== stableJson(passport.kfdSupport)) {
+      issues.push(issue(
+        "error",
+        "kfdSupport.evidence",
+        "release passport KFD support projection must exactly match its sibling evidence",
+      ));
+    }
+  } else if (kfdSupportEvidence) {
+    issues.push(issue("error", "kfdSupport.section", "KFD support evidence is present without a release-passport projection"));
+  }
 
   const tag = passport?.release?.tag || "";
   if (!tag) {
@@ -2343,6 +2421,7 @@ export async function verifyReleasePassport({
   agentIndexLocation = "",
   productMechanismLocation = "",
   kfdAgentHubEvidenceLocation = "",
+  kfdSupportEvidenceLocation = "",
 } = {}) {
   const passport = await readJsonFromLocation(passportLocation);
   const basePath = /^https?:\/\//.test(passportLocation) ? passportLocation : path.resolve(passportLocation);
@@ -2370,6 +2449,10 @@ export async function verifyReleasePassport({
     kfdAgentHubEvidenceLocation
       ? await readJsonFromLocation(kfdAgentHubEvidenceLocation)
       : await resolveSiblingJson(basePath, passport.evidence?.kfdAgentHub) || undefined;
+  const kfdSupportEvidence =
+    kfdSupportEvidenceLocation
+      ? await readJsonFromLocation(kfdSupportEvidenceLocation)
+      : await resolveSiblingJson(basePath, passport.evidence?.kfdSupport) || undefined;
   return createReleaseCheckReport({
     passport,
     artifactEvidence,
@@ -2378,6 +2461,7 @@ export async function verifyReleasePassport({
     agentIndex,
     productMechanism,
     kfdAgentHubEvidence,
+    kfdSupportEvidence,
   });
 }
 

package/scripts/check-internal-architecture.mjs

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const implementationExtensions = new Set([".js", ".mjs", ".cjs", ".sh"]);
+const importPattern =
+  /(?:\bimport\s*(?:\([^)]*?\)|[^"'\n]*?\s+from\s+)?|\bexport\s+[^"'\n]*?\s+from\s+)(["'])([^"'\n]+)\1/g;
+
+function normalizeRelative(root, value) {
+  return path.relative(root, path.resolve(root, value)).split(path.sep).join("/");
+}
+
+function isInside(relativePath, prefix) {
+  return relativePath === prefix || relativePath.startsWith(`${prefix}/`);
+}
+
+function collectImplementationFiles(root, entry) {
+  const absolute = path.resolve(root, entry);
+  if (!fs.existsSync(absolute)) {
+    throw new Error(`internal architecture path is missing: ${entry}`);
+  }
+  if (fs.statSync(absolute).isFile()) {
+    return implementationExtensions.has(path.extname(absolute)) ? [absolute] : [];
+  }
+  return fs.readdirSync(absolute, { withFileTypes: true }).flatMap((item) =>
+    collectImplementationFiles(root, path.join(entry, item.name))
+  );
+}
+
+function relativeImports(source) {
+  const imports = [];
+  for (const match of source.matchAll(importPattern)) {
+    if (match[2].startsWith(".")) imports.push(match[2]);
+  }
+  return imports;
+}
+
+function resolveImportTarget(root, sourcePath, specifier) {
+  const absolute = path.resolve(path.dirname(path.resolve(root, sourcePath)), specifier);
+  return normalizeRelative(root, absolute);
+}
+
+function assertIndexShape(index) {
+  if (index?.schemaVersion !== 1) {
+    throw new Error("internal architecture index schemaVersion must be 1");
+  }
+  for (const field of ["coverageRoots", "dependencyRules", "capabilities"]) {
+    if (!Array.isArray(index[field]) || index[field].length === 0) {
+      throw new Error(`internal architecture index requires non-empty ${field}`);
+    }
+  }
+}
+
+function checkInternalArchitecture({
+  root = process.cwd(),
+  index = JSON.parse(
+    fs.readFileSync(
+      path.join(root, "architecture", "internal-capabilities.json"),
+      "utf8",
+    ),
+  ),
+  sourceOverrides = new Map(),
+} = {}) {
+  assertIndexShape(index);
+  const issues = [];
+  const capabilityIds = new Set();
+  const coveredImplementation = new Map();
+
+  for (const capability of index.capabilities) {
+    if (!capability?.id || capabilityIds.has(capability.id)) {
+      issues.push(`capability id must be present and unique: ${capability?.id || "<empty>"}`);
+      continue;
+    }
+    capabilityIds.add(capability.id);
+    if (!Array.isArray(capability.implementation) || capability.implementation.length === 0) {
+      issues.push(`${capability.id}: implementation mapping is empty`);
+    }
+    if (!Array.isArray(capability.tests) || capability.tests.length === 0) {
+      issues.push(`${capability.id}: test mapping is empty`);
+    }
+    for (const field of ["implementation", "tests", "contracts"]) {
+      for (const relativePath of capability[field] || []) {
+        const absolutePath = path.resolve(root, relativePath);
+        if (!fs.existsSync(absolutePath)) {
+          issues.push(`${capability.id}: ${field} path is missing: ${relativePath}`);
+        }
+        if (field === "implementation") {
+          const owner = coveredImplementation.get(relativePath);
+          if (owner) {
+            issues.push(
+              `${relativePath}: implementation is mapped by both ${owner} and ${capability.id}`,
+            );
+          } else {
+            coveredImplementation.set(relativePath, capability.id);
+          }
+        }
+      }
+    }
+  }
+
+  const expectedImplementation = new Set(
+    index.coverageRoots.flatMap((entry) =>
+      collectImplementationFiles(root, entry).map((absolutePath) =>
+        normalizeRelative(root, absolutePath)
+      )
+    ),
+  );
+  for (const relativePath of expectedImplementation) {
+    if (!coveredImplementation.has(relativePath)) {
+      issues.push(`capability-to-test mapping is missing implementation: ${relativePath}`);
+    }
+  }
+  for (const relativePath of coveredImplementation.keys()) {
+    if (!expectedImplementation.has(relativePath)) {
+      issues.push(`capability implementation is outside coverageRoots: ${relativePath}`);
+    }
+  }
+
+  for (const rule of index.dependencyRules) {
+    const allowed = rule.allowedRelativeTargets || [];
+    for (const sourceEntry of rule.sources || []) {
+      for (const absoluteSource of collectImplementationFiles(root, sourceEntry)) {
+        if (![".js", ".mjs", ".cjs"].includes(path.extname(absoluteSource))) continue;
+        const sourcePath = normalizeRelative(root, absoluteSource);
+        const source = sourceOverrides.has(sourcePath)
+          ? sourceOverrides.get(sourcePath)
+          : fs.readFileSync(absoluteSource, "utf8");
+        for (const specifier of relativeImports(source)) {
+          const target = resolveImportTarget(root, sourcePath, specifier);
+          if (!allowed.some((prefix) => isInside(target, prefix))) {
+            issues.push(
+              `${rule.id}: ${sourcePath} imports ${target}, outside allowed dependency direction`,
+            );
+          }
+        }
+      }
+    }
+  }
+
+  if (issues.length > 0) {
+    throw new Error(
+      `internal architecture check failed:\n- ${issues.join("\n- ")}`,
+    );
+  }
+  return {
+    schemaVersion: index.schemaVersion,
+    capabilities: index.capabilities.length,
+    implementations: expectedImplementation.size,
+    dependencyRules: index.dependencyRules.length,
+  };
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href
+) {
+  try {
+    const report = checkInternalArchitecture();
+    console.log(
+      `internal architecture check passed: ${report.capabilities} capabilities, ` +
+        `${report.implementations} implementations, ${report.dependencyRules} dependency rules`,
+    );
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
+
+export { checkInternalArchitecture, relativeImports };

package/scripts/check-inventory.mjs

@@ -924,6 +924,10 @@ for (const requiredSnippet of [
   "release-passport-kfd-3-artifact-witness-jsons:",
   "release-passport-kfd-3-artifact-witness-jsons: ${{ inputs.release-passport-kfd-3-artifact-witness-jsons }}",
   "release-passport-kfd-3-artifact-verify-command:",
+  "release-passport-kfd-support-matrix-json:",
+  "release-passport-kfd-support-matrix-json: ${{ inputs.release-passport-kfd-support-matrix-json }}",
+  "release-passport-kfd-product-gate-jsons:",
+  "release-passport-kfd-product-gate-jsons: ${{ inputs.release-passport-kfd-product-gate-jsons }}",
   "release-passport-invariant-passport-jsons:",
   "release-passport-invariant-passport-jsons: ${{ inputs.release-passport-invariant-passport-jsons }}",
   "release-passport-invariant-passport-command:",