@kungfu-tech/buildchain 3.0.1 → 3.0.2-alpha.1

package/dist/site/workflow-registry.json

@@ -92,6 +92,9 @@
         "buildchain-contract-lock-path",
         "buildchain-ref",
         "buildchain-repository",
+        "cache-dependency-lock-root",
+        "cache-policy-root",
+        "cache-toolchain-root",
         "cargo-registry-index",
         "checkout-cache-fallback",
         "checkout-cache-fetch-attempts",
@@ -141,7 +144,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 66,
+      "inputCount": 69,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -412,6 +415,8 @@
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-kfd-3-artifact-witness-jsons",
         "release-passport-kfd-3-prebuild-witness-jsons",
+        "release-passport-kfd-product-gate-jsons",
+        "release-passport-kfd-support-matrix-json",
         "release-passport-output-dir",
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
@@ -423,7 +428,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 83,
+      "inputCount": 85,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -911,6 +916,9 @@
         "buildchain-ref",
         "buildchain-repository",
         "buildchain-stable-contract-lock-path",
+        "cache-dependency-lock-root",
+        "cache-policy-root",
+        "cache-toolchain-root",
         "cargo-registry-index",
         "checkout-cache-fallback",
         "checkout-cache-fetch-attempts",
@@ -960,7 +968,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 69,
+      "inputCount": 72,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1641,6 +1649,8 @@
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-kfd-3-artifact-witness-jsons",
         "release-passport-kfd-3-prebuild-witness-jsons",
+        "release-passport-kfd-product-gate-jsons",
+        "release-passport-kfd-support-matrix-json",
         "release-passport-output-dir",
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
@@ -1652,7 +1662,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 75,
+      "inputCount": 77,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1972,6 +1982,8 @@
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-kfd-3-artifact-witness-jsons",
         "release-passport-kfd-3-prebuild-witness-jsons",
+        "release-passport-kfd-product-gate-jsons",
+        "release-passport-kfd-support-matrix-json",
         "release-passport-output-dir",
         "release-passport-platform-manifest-paths",
         "release-passport-product-name",
@@ -1988,7 +2000,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 64,
+      "inputCount": 66,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/cli.md

@@ -281,8 +281,9 @@ assertPublicSurfaceReverseAudit(collectPublicSurfaceReverseAudit({ root: process
 `buildchain kfd` is the product-facing KFD namespace. Schema commands expose the
 machine-readable KFD standards shipped by `@kungfu-tech/kfd`, while versioned
 subcommands host concrete product workflows. KFD-1, KFD-2, and KFD-3 are
-first-class Buildchain surfaces. KFD-4 is schema-only until Buildchain has a
-real verification protocol for it.
+first-class Buildchain surfaces. KFD-4, KFD-5, and KFD-7 expose fail-closed
+product-evidence gate and verification protocols; passing those protocols does
+not itself qualify, certify, activate, or ship support.
 
 `status` reports implemented support and the active repo-owned file layout.
 `migrate-layout` moves legacy root files into `.buildchain/`:
@@ -290,6 +291,12 @@ real verification protocol for it.
 ```bash
 buildchain kfd status --json
 buildchain kfd migrate-layout --write
+buildchain kfd 4 gate --input-json kfd-4-gate-input.json --output kfd-4-gate.json
+buildchain kfd 5 gate --input-json kfd-5-gate-input.json --output kfd-5-gate.json
+buildchain kfd 7 gate --input-json kfd-7-gate-input.json --output kfd-7-gate.json
+buildchain kfd support project --matrix-json support-matrix.json \
+  --gate-json kfd-4-gate.json --gate-json kfd-5-gate.json \
+  --gate-json kfd-7-gate.json --output kfd-support.json
 ```
 
 KFD-1 commands generate and validate contract-world release evidence:

package/docs/kfd-support.md

@@ -7,8 +7,9 @@ facts, not as README prose. The machine-readable sources are:
   collaboration surfaces;
 - `dist/site/public-surface-audit.json` for reverse enumeration of exposed CLI,
   workflow, action, site, and documented command surfaces;
-- `buildchain.release.json` for release-specific KFD-1, KFD-2, and KFD-3
-  passport results;
+- `buildchain.release.json` plus its `kfd-support.json` sibling for
+  release-specific KFD-1/2/3 evidence and the exact KFD-1..13 support
+  projection;
 - `.buildchain/buildchain.toml` for repository-owned Buildchain configuration;
 - `.buildchain/kfd/kfd-2/registry.json` for product-owned KFD-2 public claim
   declarations;
@@ -41,11 +42,43 @@ buildchain kfd upstream check --json
 buildchain kfd aggregate --json
 buildchain kfd 3 query buildchain --json
 buildchain kfd 4 schema --json
+buildchain kfd 4 gate --input-json kfd-4-gate-input.json --json
+buildchain kfd 5 gate --input-json kfd-5-gate-input.json --json
+buildchain kfd 7 gate --input-json kfd-7-gate-input.json --json
+buildchain kfd support project --matrix-json support-matrix.json \
+  --gate-json kfd-4-gate.json --gate-json kfd-5-gate.json \
+  --gate-json kfd-7-gate.json --json
 ```
 
-KFD-1, KFD-2, and KFD-3 have concrete Buildchain workflows. KFD-4 is currently
-schema-only in Buildchain: agents can discover and read the KFD-4 schema from
-`@kungfu-tech/kfd`, but Buildchain does not claim KFD-4 verification.
+KFD-1, KFD-2, and KFD-3 have concrete Buildchain workflows. KFD-4, KFD-5, and
+KFD-7 additionally have product-evidence gates backed by the installed KFD
+package and its offline WASM verifier. These gates verify exact source,
+freshness, record bytes, negative evidence, and product-owned responsibility;
+they do not self-qualify, self-certify, activate, or silently widen support.
+KFD-6 remains an explicit unsupported barrier. KFD-8 through KFD-13 remain
+draft adopter-evidence barriers until their standards and product gates mature.
+
+## KFD-4 / KFD-5 / KFD-7 Product Gates
+
+Each gate input uses
+`kungfu-buildchain-kfd-product-gate-input` version 1 and binds repository-relative
+KFD records and evidence by SHA-256. The result uses
+`kungfu-buildchain-kfd-product-gate` version 1 and always records
+`qualifying: false` and `selfCertified: false`.
+
+- KFD-4 requires a verified observer perspective, contrastive perspective
+  replay, declared loss, preserved evidence boundaries, projection fsck, and a
+  negative fixture.
+- KFD-5 requires an accepted Primitive discovery record whose minimum-closure,
+  deletion, fuse, and dogfood tests pass with retained evidence, plus explicit
+  falsifiers and a negative fixture.
+- KFD-7 requires a qualified and activated Domain Profile, independent review,
+  product witnesses, all 13 evidence obligations, and negative evidence.
+
+`buildchain kfd support project` joins the three gate results with the
+product-owned KFD-1..13 matrix. It rejects normative metadata drift, source or
+freshness mismatch, gate/matrix disagreement, KFD-4/5 candidate widening,
+KFD-6 support, KFD-8..13 promotion, or any unsupported shipped-support claim.
 
 ## KFD-1
 
@@ -349,12 +382,15 @@ Inspect KFD-owned schema facts:
 buildchain kfd schema list --json
 buildchain kfd schema show kfd-1 --json
 buildchain kfd 4 schema --json
+buildchain kfd 5 schema --json
+buildchain kfd 7 schema --json
 ```
 
 The KFD schema namespace is discovered from `@kungfu-tech/kfd/standards.json`.
 For KFD-2 this includes `trustClaims`, `trustAssessment`, `trustTaxonomy`,
-`releaseClaims`, and `releaseTrustPassport`. For KFD-4 Buildchain currently
-exposes the KFD-owned `observerPerspective` schema only.
+`releaseClaims`, and `releaseTrustPassport`. KFD-4 exposes both
+`observerPerspective` and `perspectiveReplay`; KFD-5 exposes
+`primitiveDiscovery`; KFD-7 exposes `domainProfileDeclaration`.
 
 Detect public surface candidates:
 

package/docs/release-passport.md

@@ -380,6 +380,21 @@ inspect `buildchain.release.json` and know whether the released package
 actually exposes no more and no less than the declared collaboration interface,
 instead of trusting docs or release notes.
 
+### KFD support projection
+
+Pass `--kfd-support-matrix-json` together with three
+`--kfd-product-gate-json` arguments for KFD-4, KFD-5, and KFD-7. The collector
+verifies the product-owned KFD-1..13 matrix against the installed
+`@kungfu-tech/kfd` standards, binds each gate to the exact release source and
+fresh evidence cut, and emits `kfd-support.json`. The identical projection is
+embedded as `kfdSupport` in `buildchain.release.json`.
+
+Release verification fails closed when the sibling is missing or differs,
+when a gate expires, when matrix and gate status disagree, or when a matrix
+widens KFD-4/5 candidate, KFD-6 unsupported, KFD-8..13 draft, or any non-shipped
+state. A passed projection is release evidence only; product qualification,
+activation, certification, and support ownership remain outside Buildchain.
+
 ### Floating Buildchain contract lock
 
 KFD-1 protects release payload surfaces. Floating ref contract locks protect the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.1",
+  "version": "3.0.2-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -20,11 +20,13 @@
     "./anchored-version-material": "./packages/core/anchored-version-material.js",
     "./buildchain-contract": "./packages/core/buildchain-contract.js",
     "./candidate-timeline": "./packages/core/candidate-timeline.js",
+    "./cache-evidence": "./packages/core/cache-evidence.js",
     "./controller-evidence": "./packages/core/controller-evidence.js",
     "./diagnostics": "./packages/core/diagnostics.js",
     "./homebrew": "./packages/core/homebrew.js",
     "./issue-reporting": "./packages/core/issue-reporting.js",
     "./kfd": "./packages/core/kfd.js",
+    "./kfd-product-gates": "./packages/core/kfd-product-gates.js",
     "./kfd-agent-hub": "./packages/core/kfd-agent-hub.js",
     "./buildchain-layout": "./packages/core/buildchain-layout.js",
     "./release-line-bootstrap": "./packages/core/release-line-bootstrap.js",
@@ -66,6 +68,8 @@
     "./site/release-passport-check-manifest.json": "./dist/site/release-passport-check-manifest.json",
     "./site/schemas/release-passport-v1.schema.json": "./dist/site/schemas/release-passport-v1.schema.json",
     "./site/schemas/kfd-agent-hub-adoption.schema.json": "./dist/site/schemas/kfd-agent-hub-adoption.schema.json",
+    "./site/schemas/kfd-product-gate-input-v1.schema.json": "./dist/site/schemas/kfd-product-gate-input-v1.schema.json",
+    "./site/schemas/kfd-support-projection-v1.schema.json": "./dist/site/schemas/kfd-support-projection-v1.schema.json",
     "./site/buildchain-contract.json": "./dist/site/buildchain-contract.json",
     "./site/product-mechanism.json": "./dist/site/product-mechanism.json",
     "./site/release-provenance.json": "./dist/site/release-provenance.json",
@@ -95,7 +99,7 @@
   },
   "packageManager": "pnpm@11.7.0",
   "scripts": {
-    "check": "node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && node scripts/check-action-bundles.mjs",
+    "check": "node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && node scripts/check-action-bundles.mjs",
     "check:workflows": "bash scripts/check-workflows.sh",
     "generate:site": "node scripts/generate-site-bundle.mjs",
     "check:site": "node scripts/generate-site-bundle.mjs --check",
@@ -113,7 +117,7 @@
     "vitest": "^4.1.9"
   },
   "dependencies": {
-    "@kungfu-tech/kfd": "1.0.0-alpha.41",
+    "@kungfu-tech/kfd": "1.0.0-alpha.47",
     "smol-toml": "1.7.0"
   }
 }

package/packages/core/cache-evidence.js

@@ -0,0 +1,288 @@
+import crypto from "node:crypto";
+
+export const BUILDCHAIN_CACHE_OPERATION_RECEIPT_CONTRACT =
+  "buildchain.cache-operation-receipt/v1";
+export const BUILDCHAIN_CACHE_EVIDENCE_SET_CONTRACT =
+  "buildchain.cache-evidence-set/v1";
+
+const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+const OUTCOMES = new Set([
+  "hit",
+  "miss",
+  "partial",
+  "bypassed",
+  "poisoned",
+  "unavailable",
+]);
+const METRIC_UNITS = Object.freeze({
+  lookupDuration: "ms",
+  restoreDuration: "ms",
+  saveDuration: "ms",
+  restoredBytes: "bytes",
+  writtenBytes: "bytes",
+  savedTime: "ms",
+});
+const METRIC_STATUSES = new Set(["observed", "unavailable", "not-applicable"]);
+const SAVED_TIME_METHODS = new Set(["producer-measured", "provider-reported"]);
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+function ordered(value) {
+  if (Array.isArray(value)) return value.map(ordered);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value)
+        .sort()
+        .map((key) => [key, ordered(value[key])]),
+    );
+  }
+  return value;
+}
+
+function stableJson(value) {
+  return JSON.stringify(ordered(value));
+}
+
+export function cacheEvidenceDigest(value) {
+  return `sha256:${crypto
+    .createHash("sha256")
+    .update(typeof value === "string" ? value : stableJson(value))
+    .digest("hex")}`;
+}
+
+function exactKeys(value, allowed, label) {
+  assert(
+    value && typeof value === "object" && !Array.isArray(value),
+    `${label} must be an object`,
+  );
+  for (const key of Object.keys(value)) {
+    assert(allowed.has(key), `${label}.${key} is not allowed`);
+  }
+}
+
+function text(value, label) {
+  assert(
+    typeof value === "string" && value.trim() === value && value.length > 0,
+    `${label} is required`,
+  );
+  assert(!/[\r\n\0]/.test(value), `${label} contains control characters`);
+  return value;
+}
+
+function digest(value, label) {
+  assert(DIGEST_RE.test(value), `${label} must be a sha256 digest`);
+  return value;
+}
+
+function normalizeBindings(bindings = {}) {
+  exactKeys(
+    bindings,
+    new Set([
+      "sourceCommit",
+      "sourceTree",
+      "runtimeCommit",
+      "dependencyLockRoot",
+      "toolchainRoot",
+      "policyRoot",
+      "platformRoot",
+      "cacheProfileRoot",
+    ]),
+    "bindings",
+  );
+  return Object.fromEntries(
+    Object.entries(bindings)
+      .filter(([, value]) => value !== null && value !== undefined && value !== "")
+      .map(([key, value]) => [key, text(value, `bindings.${key}`)]),
+  );
+}
+
+function normalizeMetric(metric, name) {
+  exactKeys(
+    metric,
+    new Set([
+      "status",
+      "unit",
+      "value",
+      "source",
+      "reason",
+      "evidenceRoot",
+      "method",
+    ]),
+    `metrics.${name}`,
+  );
+  const status = text(metric.status, `metrics.${name}.status`);
+  assert(
+    METRIC_STATUSES.has(status),
+    `metrics.${name}.status must be observed, unavailable, or not-applicable`,
+  );
+  assert(
+    metric.unit === METRIC_UNITS[name],
+    `metrics.${name}.unit must be ${METRIC_UNITS[name]}`,
+  );
+  if (status === "observed") {
+    assert(
+      Number.isFinite(metric.value) && metric.value >= 0,
+      `metrics.${name}.value must be a non-negative finite number`,
+    );
+    const normalized = {
+      status,
+      unit: metric.unit,
+      value: metric.value,
+      source: text(metric.source, `metrics.${name}.source`),
+      reason: null,
+      evidenceRoot: digest(
+        metric.evidenceRoot,
+        `metrics.${name}.evidenceRoot`,
+      ),
+    };
+    if (name === "savedTime") {
+      assert(
+        typeof metric.method === "string" &&
+          SAVED_TIME_METHODS.has(metric.method),
+        "observed saved time requires producer-measured or provider-reported evidence",
+      );
+      normalized.method = metric.method;
+    } else if (metric.method) {
+      normalized.method = text(metric.method, `metrics.${name}.method`);
+    }
+    return normalized;
+  }
+  assert(
+    metric.value === null || metric.value === undefined,
+    `metrics.${name}.value must be null when ${status}`,
+  );
+  return {
+    status,
+    unit: metric.unit,
+    value: null,
+    source: metric.source ? text(metric.source, `metrics.${name}.source`) : null,
+    reason: text(metric.reason, `metrics.${name}.reason`),
+    evidenceRoot: metric.evidenceRoot
+      ? digest(metric.evidenceRoot, `metrics.${name}.evidenceRoot`)
+      : null,
+  };
+}
+
+export function createCacheOperationReceipt({
+  operationId,
+  operation,
+  provider,
+  producer,
+  platform,
+  cacheKey,
+  cacheRoot,
+  outcome,
+  bindings = {},
+  metrics,
+  evidence,
+} = {}) {
+  assert(
+    ["restore", "save", "lookup"].includes(operation),
+    "operation must be restore, save, or lookup",
+  );
+  assert(OUTCOMES.has(outcome), "unsupported cache outcome");
+  exactKeys(
+    metrics,
+    new Set(Object.keys(METRIC_UNITS)),
+    "metrics",
+  );
+  for (const name of Object.keys(METRIC_UNITS)) {
+    assert(metrics[name], `metrics.${name} is required`);
+  }
+  exactKeys(
+    evidence,
+    new Set(["kind", "root", "locator"]),
+    "evidence",
+  );
+  const receipt = {
+    schema: BUILDCHAIN_CACHE_OPERATION_RECEIPT_CONTRACT,
+    operationId: text(operationId, "operationId"),
+    operation,
+    provider: text(provider, "provider"),
+    producer: text(producer, "producer"),
+    platform: text(platform, "platform"),
+    cacheKey: cacheKey ? text(cacheKey, "cacheKey") : null,
+    cacheRoot: cacheRoot ? text(cacheRoot, "cacheRoot") : null,
+    outcome,
+    bindings: normalizeBindings(bindings),
+    metrics: Object.fromEntries(
+      Object.keys(METRIC_UNITS).map((name) => [
+        name,
+        normalizeMetric(metrics[name], name),
+      ]),
+    ),
+    evidence: {
+      kind: text(evidence.kind, "evidence.kind"),
+      root: digest(evidence.root, "evidence.root"),
+      locator: text(evidence.locator, "evidence.locator"),
+    },
+  };
+  return { ...receipt, receiptRoot: cacheEvidenceDigest(receipt) };
+}
+
+export function verifyCacheOperationReceipt(receipt) {
+  assert(
+    receipt?.schema === BUILDCHAIN_CACHE_OPERATION_RECEIPT_CONTRACT,
+    "cache operation receipt schema mismatch",
+  );
+  const { receiptRoot, ...body } = receipt;
+  assert(
+    receiptRoot === cacheEvidenceDigest(body),
+    "cache operation receipt root mismatch",
+  );
+  const rebuilt = createCacheOperationReceipt(body);
+  assert(
+    stableJson(rebuilt) === stableJson(receipt),
+    "cache operation receipt normalization drift",
+  );
+  return true;
+}
+
+export function createCacheEvidenceSet({
+  repository,
+  sourceCommit,
+  sourceTree = "",
+  runtimeCommit = "",
+  platform,
+  operations = [],
+} = {}) {
+  assert(Array.isArray(operations), "cache evidence operations must be an array");
+  operations.forEach(verifyCacheOperationReceipt);
+  const operationIds = operations.map(({ operationId }) => operationId);
+  assert(
+    operationIds.length === new Set(operationIds).size,
+    "cache evidence operation ids must be unique",
+  );
+  const value = {
+    schema: BUILDCHAIN_CACHE_EVIDENCE_SET_CONTRACT,
+    repository: text(repository, "repository"),
+    sourceCommit: text(sourceCommit, "sourceCommit"),
+    sourceTree: sourceTree ? text(sourceTree, "sourceTree") : null,
+    runtimeCommit: runtimeCommit ? text(runtimeCommit, "runtimeCommit") : null,
+    platform: text(platform, "platform"),
+    operations: [...operations].sort((left, right) =>
+      left.operationId.localeCompare(right.operationId),
+    ),
+  };
+  return { ...value, evidenceRoot: cacheEvidenceDigest(value) };
+}
+
+export function verifyCacheEvidenceSet(receipt) {
+  assert(
+    receipt?.schema === BUILDCHAIN_CACHE_EVIDENCE_SET_CONTRACT,
+    "cache evidence set schema mismatch",
+  );
+  const { evidenceRoot, ...body } = receipt;
+  assert(
+    evidenceRoot === cacheEvidenceDigest(body),
+    "cache evidence set root mismatch",
+  );
+  const rebuilt = createCacheEvidenceSet(body);
+  assert(
+    stableJson(rebuilt) === stableJson(receipt),
+    "cache evidence set normalization drift",
+  );
+  return true;
+}