@kungfu-tech/buildchain 3.0.2-alpha.0 → 3.0.2-alpha.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (83) hide show
  1. package/README.md +4 -2
  2. package/actions/github-artifact-attestation/README.md +10 -0
  3. package/actions/promote-buildchain-ref/README.md +7 -0
  4. package/bin/buildchain.mjs +5 -0
  5. package/bin/internal/trust-release-cli.mjs +74 -3
  6. package/contracts/auditable-demo-media-profiles-v1.json +168 -0
  7. package/contracts/evidence/auditable-demo-web-delivery-v1.json +103 -0
  8. package/contracts/fixtures/auditable-demo-web-delivery-v1/complete-transcript.txt +2 -0
  9. package/contracts/fixtures/auditable-demo-web-delivery-v1/public-projection.json +16 -0
  10. package/contracts/fixtures/auditable-demo-web-delivery-v1/scene.json +12 -0
  11. package/dist/site/artifact-schemas.json +5 -1
  12. package/dist/site/buildchain-contract.json +133 -34
  13. package/dist/site/buildchain-site.json +159 -40
  14. package/dist/site/capability-registry.json +14 -13
  15. package/dist/site/cli-registry.json +12 -0
  16. package/dist/site/controller-registry.json +72 -4
  17. package/dist/site/kfd-claims.json +338 -20
  18. package/dist/site/kfd-upstream-aggregate.json +1 -1
  19. package/dist/site/manual-registry.json +24 -9
  20. package/dist/site/node-api-registry.json +89 -11
  21. package/dist/site/page-registry.json +135 -25
  22. package/dist/site/public-surface-audit.json +203 -21
  23. package/dist/site/publication-authority-registry.json +72 -2
  24. package/dist/site/publication-registry.json +4 -4
  25. package/dist/site/release-model.json +2 -1
  26. package/dist/site/release-passport-check-manifest.json +1 -0
  27. package/dist/site/release-provenance.json +6 -0
  28. package/dist/site/schemas/release-passport-v1.schema.json +6 -0
  29. package/dist/site/site-manifest.json +21 -13
  30. package/dist/site/workflow-registry.json +167 -13
  31. package/docs/MAP.md +5 -1
  32. package/docs/auditable-demo.md +55 -3
  33. package/docs/binary-distribution.md +7 -0
  34. package/docs/cli.md +9 -0
  35. package/docs/dev-alpha-candidate-patrol.md +111 -0
  36. package/docs/github-artifact-attestation.md +219 -0
  37. package/docs/release-governance.md +32 -0
  38. package/docs/release-passport.md +13 -0
  39. package/docs/reusable-build-surface.md +83 -61
  40. package/docs/runtime-train-validation.md +21 -0
  41. package/docs/versioning.md +1 -0
  42. package/package.json +8 -1
  43. package/packages/core/artifact-signing-result.js +228 -0
  44. package/packages/core/artifact-signing.js +412 -0
  45. package/packages/core/buildchain-config.js +58 -0
  46. package/packages/core/buildchain-contract.js +14 -0
  47. package/packages/core/buildchain-kfd-claims.js +5 -0
  48. package/packages/core/buildchain-publication-authority.js +3 -0
  49. package/packages/core/cache-evidence.js +288 -0
  50. package/packages/core/channel-candidate.js +186 -0
  51. package/packages/core/detached-artifact-signature.js +121 -0
  52. package/packages/core/diagnostics.js +276 -10
  53. package/packages/core/github-artifact-attestation.js +642 -0
  54. package/packages/core/github-governance-authority.js +77 -16
  55. package/packages/core/index.js +62 -0
  56. package/packages/core/publication-authority.js +1 -1
  57. package/packages/core/release-passport-contract.js +2 -0
  58. package/packages/core/release-passport.js +60 -3
  59. package/scripts/auditable-demo.mjs +520 -28
  60. package/scripts/build-contract-core.mjs +31 -0
  61. package/scripts/buildchain-channel-router.mjs +8 -2
  62. package/scripts/check-inventory.mjs +9 -0
  63. package/scripts/create-github-artifact-attestation-policy.mjs +62 -0
  64. package/scripts/dev-alpha-candidate-patrol.mjs +864 -0
  65. package/scripts/dispatch-artifact-signing-authority.mjs +152 -0
  66. package/scripts/finalize-native-artifact-signing-result.mjs +96 -0
  67. package/scripts/generate-channel-promotion-workflow.mjs +6 -0
  68. package/scripts/generate-site-bundle.mjs +20 -0
  69. package/scripts/import-artifact-signing-results.mjs +76 -0
  70. package/scripts/inspect-artifact-signing-requests.mjs +101 -0
  71. package/scripts/locked-source-checkout.mjs +48 -0
  72. package/scripts/materialize-artifact-signing-request.mjs +66 -0
  73. package/scripts/merge-artifact-signing-results.mjs +76 -0
  74. package/scripts/publish-github-artifact-attestation-evidence.mjs +201 -0
  75. package/scripts/reconcile-github-governance.mjs +158 -25
  76. package/scripts/release-candidate-resolver.mjs +12 -0
  77. package/scripts/release-line-policy.mjs +27 -0
  78. package/scripts/runtime-ref-core.mjs +10 -6
  79. package/scripts/seal-artifact-signing-requests.mjs +368 -0
  80. package/scripts/shifu-gate-profile.mjs +26 -20
  81. package/scripts/sign-detached-artifact-requests.mjs +237 -0
  82. package/scripts/stage-github-artifact-attestation-inputs.mjs +65 -0
  83. package/scripts/verify-artifact-signing-results.mjs +99 -0
package/dist/site/node-api-registry.json CHANGED
@@ -8,7 +8,7 @@
8
8
  "specifier": "@kungfu-tech/buildchain",
9
9
  "export": ".",
10
10
  "target": "./packages/core/index.js",
11
- "digest": "sha256:47761a66474e783b4defb0de8a6df8fb9b73f61b766152c323099354e8a42517",
11
+ "digest": "sha256:d9ae3dea43788f32b8a65bcc50044bb29fb268a354b5b1fe3558cb4250e2b83b",
12
12
  "summary": "Root toolkit export for Buildchain's public Node API.",
13
13
  "capabilityGroup": "api-cli-reference",
14
14
  "audience": [
@@ -47,7 +47,7 @@
47
47
  "specifier": "@kungfu-tech/buildchain/core",
48
48
  "export": "./core",
49
49
  "target": "./packages/core/index.js",
50
- "digest": "sha256:47761a66474e783b4defb0de8a6df8fb9b73f61b766152c323099354e8a42517",
50
+ "digest": "sha256:d9ae3dea43788f32b8a65bcc50044bb29fb268a354b5b1fe3558cb4250e2b83b",
51
51
  "summary": "Alias for the root public toolkit export.",
52
52
  "capabilityGroup": "api-cli-reference",
53
53
  "audience": [
@@ -82,6 +82,58 @@
82
82
  ],
83
83
  "maturity": "stable"
84
84
  },
85
+ {
86
+ "specifier": "@kungfu-tech/buildchain/github-artifact-attestation",
87
+ "export": "./github-artifact-attestation",
88
+ "target": "./packages/core/github-artifact-attestation.js",
89
+ "digest": "sha256:f71887cd7d73e11a763153720c6242e700ce49e66a6e5ca01ea6cf488948e265",
90
+ "summary": "GitHub keyless artifact attestation policy, predicate, provider evidence, and fail-closed verification APIs.",
91
+ "capabilityGroup": "release-passport-trust",
92
+ "audience": [
93
+ "developer",
94
+ "agent"
95
+ ],
96
+ "maturity": "stable"
97
+ },
98
+ {
99
+ "specifier": "@kungfu-tech/buildchain/artifact-signing",
100
+ "export": "./artifact-signing",
101
+ "target": "./packages/core/artifact-signing.js",
102
+ "digest": "sha256:2314a3858214ea7f573510208b97042545931d4b6c505575f62bc46168de757c",
103
+ "summary": "Credential-free artifact signing declarations, source-bound requests, authority receipts, profile resolution, and fail-closed validation APIs.",
104
+ "capabilityGroup": "reusable-build",
105
+ "audience": [
106
+ "developer",
107
+ "agent"
108
+ ],
109
+ "maturity": "stable"
110
+ },
111
+ {
112
+ "specifier": "@kungfu-tech/buildchain/artifact-signing-result",
113
+ "export": "./artifact-signing-result",
114
+ "target": "./packages/core/artifact-signing-result.js",
115
+ "digest": "sha256:6ae646862ccddb717f59d29549e518ca698cb56dc68556775b6bb49ae4b0435c",
116
+ "summary": "Immutable signed-result, final-payload, receipt, evidence-root, and provider-verification binding APIs.",
117
+ "capabilityGroup": "release-passport-trust",
118
+ "audience": [
119
+ "developer",
120
+ "agent"
121
+ ],
122
+ "maturity": "stable"
123
+ },
124
+ {
125
+ "specifier": "@kungfu-tech/buildchain/detached-artifact-signature",
126
+ "export": "./detached-artifact-signature",
127
+ "target": "./packages/core/detached-artifact-signature.js",
128
+ "digest": "sha256:336bc9e1386b2252ade7ce91af21eb2e53072768db4cb8f20c4e79b23c4fd945",
129
+ "summary": "Buildchain-authority Ed25519 detached signature and verification APIs for arbitrary binary artifacts.",
130
+ "capabilityGroup": "release-passport-trust",
131
+ "audience": [
132
+ "developer",
133
+ "agent"
134
+ ],
135
+ "maturity": "stable"
136
+ },
85
137
  {
86
138
  "specifier": "@kungfu-tech/buildchain/anchored-version-material",
87
139
  "export": "./anchored-version-material",
@@ -99,7 +151,7 @@
99
151
  "specifier": "@kungfu-tech/buildchain/buildchain-contract",
100
152
  "export": "./buildchain-contract",
101
153
  "target": "./packages/core/buildchain-contract.js",
102
- "digest": "sha256:5772ad10d66e8fbbc07c06f4df521c7d60b631b0505b47540ce05804bcb576b0",
154
+ "digest": "sha256:79a3b4109777e3e13ac936a04e09e2d71fd8f93f50544ead4d51ed41f3fdf3e8",
103
155
  "summary": "Runtime contract world and compatibility digest APIs for floating-ref drift checks.",
104
156
  "capabilityGroup": "governance-versioning",
105
157
  "audience": [
@@ -121,6 +173,32 @@
121
173
  ],
122
174
  "maturity": "stable"
123
175
  },
176
+ {
177
+ "specifier": "@kungfu-tech/buildchain/channel-candidate",
178
+ "export": "./channel-candidate",
179
+ "target": "./packages/core/channel-candidate.js",
180
+ "digest": "sha256:4f667440dc1d3df1663fba13afe68358aa3fc0c9316d1393e760bd932cec8a45",
181
+ "summary": "Exact-source channel candidate decisions, same-SHA workflow evidence validation, and deterministic source-lock reference APIs.",
182
+ "capabilityGroup": "governance-versioning",
183
+ "audience": [
184
+ "developer",
185
+ "agent"
186
+ ],
187
+ "maturity": "stable"
188
+ },
189
+ {
190
+ "specifier": "@kungfu-tech/buildchain/cache-evidence",
191
+ "export": "./cache-evidence",
192
+ "target": "./packages/core/cache-evidence.js",
193
+ "digest": "sha256:9f8453c53d7f31bccbfc9cdf5c5e62578d531c08fd213416845f753f92ee1d2e",
194
+ "summary": "Content-addressed cache operation receipts and source/platform-bound evidence-set verification APIs.",
195
+ "capabilityGroup": "observability-diagnostics",
196
+ "audience": [
197
+ "developer",
198
+ "agent"
199
+ ],
200
+ "maturity": "stable"
201
+ },
124
202
  {
125
203
  "specifier": "@kungfu-tech/buildchain/controller-evidence",
126
204
  "export": "./controller-evidence",
@@ -138,7 +216,7 @@
138
216
  "specifier": "@kungfu-tech/buildchain/diagnostics",
139
217
  "export": "./diagnostics",
140
218
  "target": "./packages/core/diagnostics.js",
141
- "digest": "sha256:a0e54f60ec24d9c15529a8dbad33129c8ec537e9f34203119d876d1e2fb26fe7",
219
+ "digest": "sha256:be62d59d4a6e18e8fe96a98539012cd8db82976eea2593540db80a8522d52e73",
142
220
  "summary": "Native diagnostics collection, summarization, cache, compiler, and process-sampler APIs.",
143
221
  "capabilityGroup": "observability-diagnostics",
144
222
  "audience": [
@@ -320,7 +398,7 @@
320
398
  "specifier": "@kungfu-tech/buildchain/publication-authority",
321
399
  "export": "./publication-authority",
322
400
  "target": "./packages/core/publication-authority.js",
323
- "digest": "sha256:10a33dae7768c9fced757c7d75c673adbd016b149064dce39d9f42df5c84073e",
401
+ "digest": "sha256:c1b9e696669d4e6ee661ec0528244509b6b0f832ec4fad16386344b90ad91367",
324
402
  "summary": "Sealed publication authority registry, runner provenance, control-plane audit, admission, and independent verification APIs.",
325
403
  "capabilityGroup": "release-passport-trust",
326
404
  "audience": [
@@ -346,7 +424,7 @@
346
424
  "specifier": "@kungfu-tech/buildchain/buildchain-publication-authority",
347
425
  "export": "./buildchain-publication-authority",
348
426
  "target": "./packages/core/buildchain-publication-authority.js",
349
- "digest": "sha256:85f524a61cfc9931cae24158f8ff718ef0eae3a2a839670ab01744cbdfdd10c3",
427
+ "digest": "sha256:0e5db6d66ed48d5eb57be1e4f1c3de92a2fc4c72a70b5764df6b21f78026a731",
350
428
  "summary": "Buildchain-owned closed-world publication authority descriptor registry.",
351
429
  "capabilityGroup": "release-passport-trust",
352
430
  "audience": [
@@ -359,7 +437,7 @@
359
437
  "specifier": "@kungfu-tech/buildchain/github-governance-authority",
360
438
  "export": "./github-governance-authority",
361
439
  "target": "./packages/core/github-governance-authority.js",
362
- "digest": "sha256:63f3ce1520edf99e4f877b1dd28afa33d85150266940cd60f82c2aadba38c50d",
440
+ "digest": "sha256:548c64ca8f23945cdbdd6c06bc6ed85854a46ea308c490376a8736677d7c1936",
363
441
  "summary": "Fail-closed GitHub ownership, effective-policy, managed-zone admission, rollout-plan, and immutable receipt APIs.",
364
442
  "capabilityGroup": "governance-versioning",
365
443
  "audience": [
@@ -411,7 +489,7 @@
411
489
  "specifier": "@kungfu-tech/buildchain/release-passport",
412
490
  "export": "./release-passport",
413
491
  "target": "./packages/core/release-passport.js",
414
- "digest": "sha256:842f7f1e60a8de253225ada03cf238948ce527481eb640bc6f14c6cc0ef38880",
492
+ "digest": "sha256:aad90c2b39ce3fd7d2d4df5833f388c3090f5eeaecfd97d03276d375eed9459b",
415
493
  "summary": "Release passport collection, verification, explanation, and evidence APIs.",
416
494
  "capabilityGroup": "release-passport-trust",
417
495
  "audience": [
@@ -424,7 +502,7 @@
424
502
  "specifier": "@kungfu-tech/buildchain/release-passport-contract",
425
503
  "export": "./release-passport-contract",
426
504
  "target": "./packages/core/release-passport-contract.js",
427
- "digest": "sha256:5623da00b6355cfafc7564deb9206d36f7b2dafb24e29fec77c35deee5de5f6b",
505
+ "digest": "sha256:d633f8037d43db2c72662186f797d0914471540077d7163368c22779aae7eee9",
428
506
  "summary": "Standalone release passport JSON Schema, ownership/check manifest, and structural validation APIs.",
429
507
  "capabilityGroup": "release-passport-trust",
430
508
  "audience": [
@@ -476,7 +554,7 @@
476
554
  "specifier": "@kungfu-tech/buildchain/buildchain-kfd-claims",
477
555
  "export": "./buildchain-kfd-claims",
478
556
  "target": "./packages/core/buildchain-kfd-claims.js",
479
- "digest": "sha256:f3a719c64881e650a6ef68e3e0d4acd40878722b0eb76b88d30081db77ad92c8",
557
+ "digest": "sha256:14c595f8ab51f64c2fcde3c46729fe3ba6e7b20fcd89159780aa55e341013f75",
480
558
  "summary": "Buildchain self KFD claim registry, witnesses, and public claim APIs.",
481
559
  "capabilityGroup": "kfd-trust",
482
560
  "audience": [
@@ -490,7 +568,7 @@
490
568
  {
491
569
  "id": "cli-and-node-package",
492
570
  "path": "docs/cli.md",
493
- "digest": "sha256:47be88f5e5fd14124d03510b807722215034d34eefcebdfe2599a310350b7697"
571
+ "digest": "sha256:49da688f9f8b726a9169a3e4b246cb6ef07c6c626ea15c22f0b26ba1a37a58b4"
494
572
  },
495
573
  {
496
574
  "id": "build-facts",