@kungfu-tech/buildchain 3.0.1 → 3.0.2-alpha.0

package/docs/cli.md

@@ -281,8 +281,9 @@ assertPublicSurfaceReverseAudit(collectPublicSurfaceReverseAudit({ root: process
 `buildchain kfd` is the product-facing KFD namespace. Schema commands expose the
 machine-readable KFD standards shipped by `@kungfu-tech/kfd`, while versioned
 subcommands host concrete product workflows. KFD-1, KFD-2, and KFD-3 are
-first-class Buildchain surfaces. KFD-4 is schema-only until Buildchain has a
-real verification protocol for it.
+first-class Buildchain surfaces. KFD-4, KFD-5, and KFD-7 expose fail-closed
+product-evidence gate and verification protocols; passing those protocols does
+not itself qualify, certify, activate, or ship support.
 
 `status` reports implemented support and the active repo-owned file layout.
 `migrate-layout` moves legacy root files into `.buildchain/`:
@@ -290,6 +291,12 @@ real verification protocol for it.
 ```bash
 buildchain kfd status --json
 buildchain kfd migrate-layout --write
+buildchain kfd 4 gate --input-json kfd-4-gate-input.json --output kfd-4-gate.json
+buildchain kfd 5 gate --input-json kfd-5-gate-input.json --output kfd-5-gate.json
+buildchain kfd 7 gate --input-json kfd-7-gate-input.json --output kfd-7-gate.json
+buildchain kfd support project --matrix-json support-matrix.json \
+  --gate-json kfd-4-gate.json --gate-json kfd-5-gate.json \
+  --gate-json kfd-7-gate.json --output kfd-support.json
 ```
 
 KFD-1 commands generate and validate contract-world release evidence:

package/docs/kfd-support.md

@@ -7,8 +7,9 @@ facts, not as README prose. The machine-readable sources are:
   collaboration surfaces;
 - `dist/site/public-surface-audit.json` for reverse enumeration of exposed CLI,
   workflow, action, site, and documented command surfaces;
-- `buildchain.release.json` for release-specific KFD-1, KFD-2, and KFD-3
-  passport results;
+- `buildchain.release.json` plus its `kfd-support.json` sibling for
+  release-specific KFD-1/2/3 evidence and the exact KFD-1..13 support
+  projection;
 - `.buildchain/buildchain.toml` for repository-owned Buildchain configuration;
 - `.buildchain/kfd/kfd-2/registry.json` for product-owned KFD-2 public claim
   declarations;
@@ -41,11 +42,43 @@ buildchain kfd upstream check --json
 buildchain kfd aggregate --json
 buildchain kfd 3 query buildchain --json
 buildchain kfd 4 schema --json
+buildchain kfd 4 gate --input-json kfd-4-gate-input.json --json
+buildchain kfd 5 gate --input-json kfd-5-gate-input.json --json
+buildchain kfd 7 gate --input-json kfd-7-gate-input.json --json
+buildchain kfd support project --matrix-json support-matrix.json \
+  --gate-json kfd-4-gate.json --gate-json kfd-5-gate.json \
+  --gate-json kfd-7-gate.json --json
 ```
 
-KFD-1, KFD-2, and KFD-3 have concrete Buildchain workflows. KFD-4 is currently
-schema-only in Buildchain: agents can discover and read the KFD-4 schema from
-`@kungfu-tech/kfd`, but Buildchain does not claim KFD-4 verification.
+KFD-1, KFD-2, and KFD-3 have concrete Buildchain workflows. KFD-4, KFD-5, and
+KFD-7 additionally have product-evidence gates backed by the installed KFD
+package and its offline WASM verifier. These gates verify exact source,
+freshness, record bytes, negative evidence, and product-owned responsibility;
+they do not self-qualify, self-certify, activate, or silently widen support.
+KFD-6 remains an explicit unsupported barrier. KFD-8 through KFD-13 remain
+draft adopter-evidence barriers until their standards and product gates mature.
+
+## KFD-4 / KFD-5 / KFD-7 Product Gates
+
+Each gate input uses
+`kungfu-buildchain-kfd-product-gate-input` version 1 and binds repository-relative
+KFD records and evidence by SHA-256. The result uses
+`kungfu-buildchain-kfd-product-gate` version 1 and always records
+`qualifying: false` and `selfCertified: false`.
+
+- KFD-4 requires a verified observer perspective, contrastive perspective
+  replay, declared loss, preserved evidence boundaries, projection fsck, and a
+  negative fixture.
+- KFD-5 requires an accepted Primitive discovery record whose minimum-closure,
+  deletion, fuse, and dogfood tests pass with retained evidence, plus explicit
+  falsifiers and a negative fixture.
+- KFD-7 requires a qualified and activated Domain Profile, independent review,
+  product witnesses, all 13 evidence obligations, and negative evidence.
+
+`buildchain kfd support project` joins the three gate results with the
+product-owned KFD-1..13 matrix. It rejects normative metadata drift, source or
+freshness mismatch, gate/matrix disagreement, KFD-4/5 candidate widening,
+KFD-6 support, KFD-8..13 promotion, or any unsupported shipped-support claim.
 
 ## KFD-1
 
@@ -349,12 +382,15 @@ Inspect KFD-owned schema facts:
 buildchain kfd schema list --json
 buildchain kfd schema show kfd-1 --json
 buildchain kfd 4 schema --json
+buildchain kfd 5 schema --json
+buildchain kfd 7 schema --json
 ```
 
 The KFD schema namespace is discovered from `@kungfu-tech/kfd/standards.json`.
 For KFD-2 this includes `trustClaims`, `trustAssessment`, `trustTaxonomy`,
-`releaseClaims`, and `releaseTrustPassport`. For KFD-4 Buildchain currently
-exposes the KFD-owned `observerPerspective` schema only.
+`releaseClaims`, and `releaseTrustPassport`. KFD-4 exposes both
+`observerPerspective` and `perspectiveReplay`; KFD-5 exposes
+`primitiveDiscovery`; KFD-7 exposes `domainProfileDeclaration`.
 
 Detect public surface candidates:
 

package/docs/release-passport.md

@@ -380,6 +380,21 @@ inspect `buildchain.release.json` and know whether the released package
 actually exposes no more and no less than the declared collaboration interface,
 instead of trusting docs or release notes.
 
+### KFD support projection
+
+Pass `--kfd-support-matrix-json` together with three
+`--kfd-product-gate-json` arguments for KFD-4, KFD-5, and KFD-7. The collector
+verifies the product-owned KFD-1..13 matrix against the installed
+`@kungfu-tech/kfd` standards, binds each gate to the exact release source and
+fresh evidence cut, and emits `kfd-support.json`. The identical projection is
+embedded as `kfdSupport` in `buildchain.release.json`.
+
+Release verification fails closed when the sibling is missing or differs,
+when a gate expires, when matrix and gate status disagree, or when a matrix
+widens KFD-4/5 candidate, KFD-6 unsupported, KFD-8..13 draft, or any non-shipped
+state. A passed projection is release evidence only; product qualification,
+activation, certification, and support ownership remain outside Buildchain.
+
 ### Floating Buildchain contract lock
 
 KFD-1 protects release payload surfaces. Floating ref contract locks protect the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.1",
+  "version": "3.0.2-alpha.0",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -25,6 +25,7 @@
     "./homebrew": "./packages/core/homebrew.js",
     "./issue-reporting": "./packages/core/issue-reporting.js",
     "./kfd": "./packages/core/kfd.js",
+    "./kfd-product-gates": "./packages/core/kfd-product-gates.js",
     "./kfd-agent-hub": "./packages/core/kfd-agent-hub.js",
     "./buildchain-layout": "./packages/core/buildchain-layout.js",
     "./release-line-bootstrap": "./packages/core/release-line-bootstrap.js",
@@ -66,6 +67,8 @@
     "./site/release-passport-check-manifest.json": "./dist/site/release-passport-check-manifest.json",
     "./site/schemas/release-passport-v1.schema.json": "./dist/site/schemas/release-passport-v1.schema.json",
     "./site/schemas/kfd-agent-hub-adoption.schema.json": "./dist/site/schemas/kfd-agent-hub-adoption.schema.json",
+    "./site/schemas/kfd-product-gate-input-v1.schema.json": "./dist/site/schemas/kfd-product-gate-input-v1.schema.json",
+    "./site/schemas/kfd-support-projection-v1.schema.json": "./dist/site/schemas/kfd-support-projection-v1.schema.json",
     "./site/buildchain-contract.json": "./dist/site/buildchain-contract.json",
     "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
     "./site/release-provenance.json": "./dist/site/release-provenance.json",
@@ -95,7 +98,7 @@
   },
   "packageManager": "pnpm@11.7.0",
   "scripts": {
-    "check": "node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && node scripts/check-action-bundles.mjs",
+    "check": "node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && node scripts/check-action-bundles.mjs",
     "check:workflows": "bash scripts/check-workflows.sh",
     "generate:site": "node scripts/generate-site-bundle.mjs",
     "check:site": "node scripts/generate-site-bundle.mjs --check",
@@ -113,7 +116,7 @@
     "vitest": "^4.1.9"
   },
   "dependencies": {
-    "@kungfu-tech/kfd": "1.0.0-alpha.41",
+    "@kungfu-tech/kfd": "1.0.0-alpha.47",
     "smol-toml": "1.7.0"
   }
 }

package/packages/core/index.js

@@ -370,6 +370,23 @@ export {
   testKfdAgentHub,
 } from "./kfd-agent-hub.js";
 
+export {
+  KFD_PRODUCT_GATE_CONTRACT,
+  KFD_PRODUCT_GATE_INPUT_CONTRACT,
+  KFD_PRODUCT_GATE_INPUT_SCHEMA,
+  KFD_PRODUCT_GATE_INPUT_SCHEMA_ID,
+  KFD_SUPPORT_PROJECTION_CONTRACT,
+  KFD_SUPPORT_PROJECTION_SCHEMA,
+  KFD_SUPPORT_PROJECTION_SCHEMA_ID,
+  createKfdSupportProjection,
+  evaluateKfdProductGate,
+  kfdProductGateDigest,
+  kfdProductGates,
+  validateKfdProductGateResult,
+  validateKfdSupportProjection,
+  verifyKfdRecord,
+} from "./kfd-product-gates.js";
+
 export {
   RELEASE_PASSPORT_CHECK_MANIFEST_CONTRACT,
   RELEASE_PASSPORT_SCHEMA,