@kungfu-tech/buildchain 3.0.1 → 3.0.2-alpha.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (64) hide show
  1. package/README.md +5 -3
  2. package/actions/promote-buildchain-ref/README.md +7 -0
  3. package/bin/buildchain.mjs +173 -513
  4. package/bin/internal/cli-options.mjs +79 -0
  5. package/bin/internal/trust-release-cli.mjs +469 -0
  6. package/dist/site/agent-index.json +2 -0
  7. package/dist/site/artifact-schemas.json +5 -0
  8. package/dist/site/badge-endpoint-registry.json +18 -18
  9. package/dist/site/badges/v1/kfd-12/aligned.json +1 -1
  10. package/dist/site/badges/v1/kfd-12/declared.json +1 -1
  11. package/dist/site/badges/v1/kfd-12/downgraded.json +1 -1
  12. package/dist/site/badges/v1/kfd-12/draft.json +1 -1
  13. package/dist/site/badges/v1/kfd-12/failed.json +1 -1
  14. package/dist/site/badges/v1/kfd-12/missing.json +1 -1
  15. package/dist/site/badges/v1/kfd-12/passed.json +1 -1
  16. package/dist/site/badges/v1/kfd-12/planned.json +1 -1
  17. package/dist/site/badges/v1/kfd-13/aligned.json +1 -1
  18. package/dist/site/badges/v1/kfd-13/declared.json +1 -1
  19. package/dist/site/badges/v1/kfd-13/downgraded.json +1 -1
  20. package/dist/site/badges/v1/kfd-13/draft.json +1 -1
  21. package/dist/site/badges/v1/kfd-13/failed.json +1 -1
  22. package/dist/site/badges/v1/kfd-13/missing.json +1 -1
  23. package/dist/site/badges/v1/kfd-13/passed.json +1 -1
  24. package/dist/site/badges/v1/kfd-13/planned.json +1 -1
  25. package/dist/site/buildchain-contract.json +68 -28
  26. package/dist/site/buildchain-site.json +28 -18
  27. package/dist/site/capability-registry.json +3 -3
  28. package/dist/site/cli-registry.json +108 -0
  29. package/dist/site/controller-registry.json +36 -4
  30. package/dist/site/kfd-claims.json +156 -12
  31. package/dist/site/kfd-upstream-aggregate.json +20 -11
  32. package/dist/site/manual-registry.json +3 -3
  33. package/dist/site/node-api-registry.json +36 -10
  34. package/dist/site/page-registry.json +20 -10
  35. package/dist/site/public-surface-audit.json +122 -10
  36. package/dist/site/publication-registry.json +4 -4
  37. package/dist/site/release-passport-check-manifest.json +11 -0
  38. package/dist/site/release-provenance.json +4 -0
  39. package/dist/site/schemas/kfd-product-gate-input-v1.schema.json +164 -0
  40. package/dist/site/schemas/kfd-support-projection-v1.schema.json +106 -0
  41. package/dist/site/schemas/release-passport-v1.schema.json +3 -0
  42. package/dist/site/site-manifest.json +7 -7
  43. package/dist/site/workflow-registry.json +17 -5
  44. package/docs/cli.md +9 -2
  45. package/docs/kfd-support.md +43 -7
  46. package/docs/release-passport.md +15 -0
  47. package/package.json +7 -3
  48. package/packages/core/cache-evidence.js +288 -0
  49. package/packages/core/diagnostics.js +276 -10
  50. package/packages/core/github-governance-authority.js +71 -16
  51. package/packages/core/index.js +27 -0
  52. package/packages/core/kfd-product-gates.js +865 -0
  53. package/packages/core/kfd.js +16 -7
  54. package/packages/core/kfd3-surface-register.js +105 -1
  55. package/packages/core/public-surface-audit.js +6 -1
  56. package/packages/core/release-passport-contract.js +13 -0
  57. package/packages/core/release-passport.js +87 -3
  58. package/scripts/check-internal-architecture.mjs +171 -0
  59. package/scripts/check-inventory.mjs +4 -0
  60. package/scripts/generate-site-bundle.mjs +24 -0
  61. package/scripts/locked-source-checkout.mjs +48 -0
  62. package/scripts/promotion-routing-evidence.mjs +73 -0
  63. package/scripts/reconcile-github-governance.mjs +158 -25
  64. package/scripts/shifu-gate-profile.mjs +26 -20
package/README.md CHANGED
@@ -206,9 +206,11 @@ readable, but new consumers should keep Buildchain-owned files under
206
206
  Lifecycle commands can call pnpm, npm, yarn, pip, Conan, CMake, Make, custom
207
207
  scripts, or any other command that can run in the repository checkout.
208
208
 
209
- The KFD entrypoint is `buildchain kfd`. Buildchain currently provides concrete
210
- KFD-1 contract-world, KFD-2 trust-claim, and KFD-3 collaboration-surface
211
- workflows; KFD-4 is exposed as schema-only until a verification protocol exists.
209
+ The KFD entrypoint is `buildchain kfd`. Buildchain provides concrete KFD-1
210
+ contract-world, KFD-2 trust-claim, and KFD-3 collaboration-surface workflows,
211
+ plus fail-closed product-evidence gates for KFD-4, KFD-5, and KFD-7. These
212
+ gates preserve product-owned qualification and support decisions; they do not
213
+ turn a schema-valid record into certification or shipped support.
212
214
 
213
215
  Buildchain's active GitHub Action surface is deliberately small:
214
216
 
package/actions/promote-buildchain-ref/README.md CHANGED
@@ -336,6 +336,13 @@ product-owned `release-passport-kfd-3-artifact-verify-command` such as
336
336
  `kungfu agent verify --json`. Buildchain compares declared shipped public
337
337
  surfaces with artifact-exposed public surfaces and writes the result under the
338
338
  KFD-provided `kfd-3` passport section.
339
+ Set `release-passport-kfd-support-matrix-json` to the product-owned KFD-1..13
340
+ support matrix and `release-passport-kfd-product-gate-jsons` to the
341
+ newline-separated KFD-4, KFD-5, and KFD-7 gate results. Buildchain verifies
342
+ their exact source, freshness, KFD package revision, matrix barriers, and
343
+ gate/matrix agreement, then writes the immutable `kfd-support.json` sibling and
344
+ embeds the same projection in `buildchain.release.json`. This projection cannot
345
+ self-qualify or widen candidate, unsupported, draft, or non-shipped states.
339
346
  Set `release-passport-invariant-passport-jsons` to one or more product-owned
340
347
  invariant Passport paths, or set `release-passport-invariant-passport-command`
341
348
  to a command that emits one canonical Passport JSON document. Buildchain does