@kungfu-tech/buildchain 3.0.2-alpha.0 → 3.0.2-alpha.10

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-26T15:42:26.745Z",
-  "publishedAt": "2026-07-26T15:42:26.745Z",
+  "generatedAt": "2026-07-28T18:18:43.092Z",
+  "publishedAt": "2026-07-28T18:18:43.092Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ed47430f8cadfc327c52004aae9e5ef62aaa6e37",
+  "sourceRevision": "6d22340e3c2ab0202ce8d830cf1f85400ada5ae7",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.2-alpha.0",
+    "version": "3.0.2-alpha.10",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:fc8f7c63b8427e513f9524b8e22e4b0dcd8981fcc724417a29b942fe237fc0a9"
+      "digest": "sha256:cc32692e8d04816e8de94f208e43c2d5c5c7a8425cec8b32edc73ab78591fbbf"
     },
     {
       "id": "auditable-demo",
@@ -61,7 +61,7 @@
       "path": "docs/auditable-demo.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:cff9786d4de098c84ea7e494b523627d6431909f15c82940e2193dbda1ef10e9"
+      "digest": "sha256:0e8cf2162c2e1f83cfe3a6171e3055f494cab5f03fdcbec3854e1793678e6908"
     },
     {
       "id": "install",
@@ -77,7 +77,15 @@
       "path": "docs/release-passport.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:ed29d25882cbf4ec062abc21e7d069a6377eaf7e3171c24642dfe08da2e4c05b"
+      "digest": "sha256:d698078075700e60bafb9677bc4c35d49970136b98caaecfc51d38344285cdd5"
+    },
+    {
+      "id": "github-artifact-attestation",
+      "title": "GitHub-native Linux artifact attestation",
+      "path": "docs/github-artifact-attestation.md",
+      "plane": "verify",
+      "exists": true,
+      "digest": "sha256:51f28b0b01fae4e3f80a7433f6c491d0c795bd091bff64ca1264c5cc0819c545"
     },
     {
       "id": "controller-evidence",
@@ -141,7 +149,7 @@
       "path": "docs/binary-distribution.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:ae0f8e6cafbb4c39732e6a7252d46b523b0a69e8e05d3ce7ee0b51a916b1b027"
+      "digest": "sha256:b1611dcf0e6825e53921e4c9d31d1afe16fca81e6868360bfad1902587cd52ef"
     },
     {
       "id": "consumer-issue-reporting",
@@ -205,7 +213,7 @@
       "path": "docs/cli.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:47be88f5e5fd14124d03510b807722215034d34eefcebdfe2599a310350b7697"
+      "digest": "sha256:49da688f9f8b726a9169a3e4b246cb6ef07c6c626ea15c22f0b26ba1a37a58b4"
     },
     {
       "id": "build-facts",
@@ -245,7 +253,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:6a739755239e5592299f6f8789cf6f9091350bb945b5db5df11edff3496df026"
+      "digest": "sha256:ea36ec722f811f5156735aa7471ed080cdc7e87d71c20c300243b226e233e675"
     },
     {
       "id": "publish-transaction",
@@ -261,7 +269,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:a77c2bb1d2245e1ee2318f650ad64ada6c8cdd3292a62a028e3ccc7517fb4e12"
+      "digest": "sha256:42a45f51db7ea11658431718835e1a430959db2a5cc80fc4651681502fe6fb7c"
     },
     {
       "id": "release-flow",
@@ -277,7 +285,7 @@
       "path": "docs/runtime-train-validation.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:1315fe264d0e22215183122fc05e287be974751a78268642076898b689e435e6"
+      "digest": "sha256:c9ebf451294f92a2be3aa2ac4b2ec7afb3cc17bbeae2ece7879b800c0f274a40"
     },
     {
       "id": "versioning",
@@ -285,7 +293,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:f3665f2f173bdcb287cf8aa509035164e818b20088849f4a2bce098951c84ea3"
+      "digest": "sha256:4b40cb8675c111b7588297102a61cb241630f2b707a67a0384a6df7527b2c64c"
     },
     {
       "id": "web-surface-deployments",

package/dist/site/workflow-registry.json

@@ -11,6 +11,7 @@
         "adapter-path",
         "artifact-retention-days",
         "buildchain-repository",
+        "media-profile",
         "render-media",
         "renderer-image",
         "require-trusted-event",
@@ -18,7 +19,7 @@
         "source-artifact-name",
         "source-ref"
       ],
-      "inputCount": 9,
+      "inputCount": 10,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -31,10 +32,12 @@
         "media-artifact-id",
         "media-artifact-name",
         "media-artifact-url",
+        "media-profile",
+        "media-qualification-root",
         "media-root",
         "source-sha"
       ],
-      "outputCount": 11,
+      "outputCount": 13,
       "surface": "auditable-demo",
       "capabilityGroup": "api-cli-reference",
       "status": "preview"
@@ -92,6 +95,9 @@
         "buildchain-contract-lock-path",
         "buildchain-ref",
         "buildchain-repository",
+        "cache-dependency-lock-root",
+        "cache-policy-root",
+        "cache-toolchain-root",
         "cargo-registry-index",
         "checkout-cache-fallback",
         "checkout-cache-fetch-attempts",
@@ -108,6 +114,9 @@
         "expected-artifacts-json",
         "fail-fast",
         "gate-profile-aggregate-json",
+        "github-artifact-attestation-platform-id",
+        "github-artifact-attestation-signer-sha",
+        "github-artifact-attestation-subject-path",
         "install-command",
         "kfd-agent-hub",
         "lifecycle-timeout-minutes",
@@ -141,7 +150,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 66,
+      "inputCount": 72,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -150,9 +159,10 @@
         "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
         "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN"
       ],
-      "secretCount": 8,
+      "secretCount": 9,
       "outputs": [
         "artifact-coordinates-json",
         "build-diagnostics-summary-artifact",
@@ -352,6 +362,9 @@
         "buildchain-repository",
         "channel",
         "dry-run",
+        "github-artifact-attestation-environment",
+        "github-artifact-attestation-policy-json",
+        "github-artifact-attestation-retention-days",
         "github-governance-receipt-json",
         "github-release",
         "github-release-notes",
@@ -425,7 +438,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 85,
+      "inputCount": 88,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -448,6 +461,10 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
+        "github-artifact-attestation-evidence-root",
+        "github-artifact-attestation-id",
+        "github-artifact-attestation-publication-receipt-digest",
+        "github-artifact-attestation-url",
         "promoted-sha",
         "publication-capability-digest",
         "publication-commit-evidence-digest",
@@ -456,7 +473,7 @@
         "publication-commit-url",
         "release-candidate-artifact"
       ],
-      "outputCount": 15,
+      "outputCount": 19,
       "surface": "reusable-workflow",
       "capabilityGroup": "api-cli-reference",
       "status": "active"
@@ -845,6 +862,34 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": "artifact-signing-authority",
+      "path": ".github/workflows/artifact-signing-authority.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
+    {
+      "id": "auditable-demo-media-profile-qualification",
+      "path": ".github/workflows/auditable-demo-media-profile-qualification.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": "binary-distribution",
       "path": ".github/workflows/binary-distribution.yml",
@@ -913,6 +958,9 @@
         "buildchain-ref",
         "buildchain-repository",
         "buildchain-stable-contract-lock-path",
+        "cache-dependency-lock-root",
+        "cache-policy-root",
+        "cache-toolchain-root",
         "cargo-registry-index",
         "checkout-cache-fallback",
         "checkout-cache-fetch-attempts",
@@ -929,6 +977,9 @@
         "expected-artifacts-json",
         "fail-fast",
         "gate-profile-aggregate-json",
+        "github-artifact-attestation-platform-id",
+        "github-artifact-attestation-signer-sha",
+        "github-artifact-attestation-subject-path",
         "install-command",
         "kfd-agent-hub",
         "lifecycle-timeout-minutes",
@@ -962,7 +1013,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 69,
+      "inputCount": 75,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -971,9 +1022,10 @@
         "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
         "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN"
       ],
-      "secretCount": 8,
+      "secretCount": 9,
       "outputs": [
         "artifact-coordinates-json",
         "build-diagnostics-summary-artifact",
@@ -1207,6 +1259,44 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": "dev-alpha-candidate-patrol",
+      "path": ".github/workflows/dev-alpha-candidate-patrol.yml",
+      "reusable": true,
+      "inputs": [
+        "alpha-workflow-path",
+        "buildchain-ref",
+        "buildchain-repository",
+        "create-pull-request",
+        "dev-workflow-path",
+        "dry-run",
+        "max-age-seconds",
+        "pull-request-body-prefix",
+        "settlement-authorized",
+        "source-branch",
+        "target-branch"
+      ],
+      "inputCount": 11,
+      "secrets": [
+        "promotion-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "active-candidate-pr",
+        "controller-state",
+        "eligible",
+        "next-candidate-sha",
+        "promotion-pr",
+        "result-path",
+        "selected-sha",
+        "settlement-action",
+        "source-lock-ref"
+      ],
+      "outputCount": 9,
+      "surface": "repository-patrol",
+      "capabilityGroup": "governance-versioning",
+      "status": "active"
+    },
     {
       "id": "dev-merge-queue-governance",
       "path": ".github/workflows/dev-merge-queue-governance.yml",
@@ -1258,6 +1348,40 @@
       "capabilityGroup": "governance-versioning",
       "status": "active"
     },
+    {
+      "id": "github-artifact-attestation",
+      "path": ".github/workflows/github-artifact-attestation.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "environment",
+        "evidence-artifact-name",
+        "evidence-run-id",
+        "platform-manifest-artifact-name",
+        "platform-manifest-relative-path",
+        "policy-json",
+        "release-passport-artifact-name",
+        "release-passport-relative-path",
+        "retention-days",
+        "source-sha",
+        "subject-artifact-name",
+        "subject-relative-path"
+      ],
+      "inputCount": 13,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [
+        "attestation-id",
+        "attestation-url",
+        "bundle-digest",
+        "evidence-artifact-name",
+        "evidence-root"
+      ],
+      "outputCount": 5,
+      "surface": "release-passport",
+      "capabilityGroup": "release-passport-trust",
+      "status": "active"
+    },
     {
       "id": "github-governance-audit",
       "path": ".github/workflows/github-governance-audit.yml",
@@ -1594,6 +1718,9 @@
         "buildchain-stable-contract-lock-path",
         "channel",
         "dry-run",
+        "github-artifact-attestation-environment",
+        "github-artifact-attestation-policy-json",
+        "github-artifact-attestation-retention-days",
         "github-governance-receipt-json",
         "github-release",
         "github-release-notes",
@@ -1656,7 +1783,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 77,
+      "inputCount": 80,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1680,6 +1807,10 @@
         "controller-receipt-digest",
         "controller-receipt-json",
         "controller-receipt-status",
+        "github-artifact-attestation-evidence-root",
+        "github-artifact-attestation-id",
+        "github-artifact-attestation-publication-receipt-digest",
+        "github-artifact-attestation-url",
         "promoted-sha",
         "promotion-contract-lock-digest",
         "promotion-contract-lock-path",
@@ -1699,7 +1830,7 @@
         "publication-commit-url",
         "release-candidate-artifact"
       ],
-      "outputCount": 27,
+      "outputCount": 31,
       "surface": "release-governance",
       "capabilityGroup": "reusable-build",
       "status": "active"
@@ -1894,6 +2025,28 @@
   ],
   "actionSource": "actions/*/action.yml reverse input enumeration",
   "actions": [
+    {
+      "id": "github-artifact-attestation",
+      "path": "actions/github-artifact-attestation/action.yml",
+      "inputs": [
+        "attestation-id",
+        "attestation-url",
+        "bundle-path",
+        "expected-buildchain-ref",
+        "expected-caller-repository",
+        "expected-source-sha",
+        "mode",
+        "output-dir",
+        "platform-manifest-path",
+        "policy-json",
+        "preparation-json",
+        "release-passport-path",
+        "subject-path"
+      ],
+      "inputCount": 13,
+      "capabilityGroup": "release-passport-trust",
+      "status": "active"
+    },
     {
       "id": "macos-credential-island",
       "path": "actions/macos-credential-island/action.yml",
@@ -1968,6 +2121,7 @@
         "release-passport",
         "release-passport-build-summary-path",
         "release-passport-buildchain-self-kfd",
+        "release-passport-github-artifact-attestation-policy-jsons",
         "release-passport-impact-json",
         "release-passport-invariant-passport-command",
         "release-passport-invariant-passport-jsons",
@@ -1994,7 +2148,7 @@
         "transaction-state-path",
         "verification-command"
       ],
-      "inputCount": 66,
+      "inputCount": 67,
       "capabilityGroup": "release-passport-trust",
       "status": "active"
     },

package/docs/MAP.md

@@ -27,7 +27,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Capability group | Primary facts | Primary manuals |
 | --- | --- | --- |
 | Getting Started | `capability-registry.json`, `product-mechanism.json` | [`install.md`](install.md), [`product-mechanism.md`](product-mechanism.md), [`cli.md`](cli.md) |
-| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`publish-transaction.md`](publish-transaction.md), [`binary-distribution.md`](binary-distribution.md) |
+| Release Passport and Trust | `release-model.json`, `artifact-schemas.json`, `publication-authority-registry.json`, `kfd-claims.json` | [`release-passport.md`](release-passport.md), [`github-artifact-attestation.md`](github-artifact-attestation.md), [`publication-authority.md`](publication-authority.md), [`release-candidate.md`](release-candidate.md), [`publish-transaction.md`](publish-transaction.md), [`binary-distribution.md`](binary-distribution.md) |
 | Reusable Build and Lifecycle | `workflow-registry.json`, `controller-registry.json`, `release-model.json` | [`reusable-build-surface.md`](reusable-build-surface.md), [`controller-evidence.md`](controller-evidence.md), [`shifu-gate-profiles.md`](shifu-gate-profiles.md), [`lifecycle-protocol.md`](lifecycle-protocol.md) |
 | KFD Trust and Surface Closure | `kfd-claims.json`, `public-surface-audit.json`, `cli-registry.json`, `node-api-registry.json` | [`kfd-support.md`](kfd-support.md), [`release-passport.md`](release-passport.md) |
 | Site Bundle, Web Surfaces, and Propagation | `buildchain-site.json`, `site-manifest.json`, `page-registry.json`, `release-model.json` | [`site-bundle-contract.md`](site-bundle-contract.md), [`web-surface-deployments.md`](web-surface-deployments.md), [`release-propagation.md`](release-propagation.md) |
@@ -42,6 +42,8 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | Capability-grouped KFD navigation | `dist/site/capability-registry.json`, `dist/site/page-registry.json`, `dist/site/manual-registry.json`, `dist/site/cli-registry.json`, `dist/site/node-api-registry.json` | this map, [`site-bundle-contract.md`](site-bundle-contract.md), [`kfd-support.md`](kfd-support.md) |
 | KFD-1 / KFD-2 / KFD-3 release-passport gates | `dist/site/kfd-claims.json`, `dist/site/buildchain-contract.json`, `dist/site/artifact-schemas.json` | [`release-passport.md`](release-passport.md) |
 | Product invariant Passport release gate | `buildchain.release.json#invariantPassports`, `dist/site/buildchain-contract.json` | [`release-passport.md`](release-passport.md) |
+| GitHub keyless Linux artifact attestation | `buildchain.release.json#githubArtifactAttestations`, `dist/site/workflow-registry.json`, `dist/site/artifact-schemas.json` | [`github-artifact-attestation.md`](github-artifact-attestation.md) |
+| Declarative cross-platform artifact signing | `kungfu-buildchain-artifact-signing-request/v1`, `kungfu-buildchain-artifact-signing-result/v1` | [`reusable-build-surface.md`](reusable-build-surface.md#artifact-signing-authority) |
 | KFD-3 public surface reverse audit | `dist/site/public-surface-audit.json`, `dist/site/cli-registry.json`, `dist/site/workflow-registry.json`, `dist/site/page-registry.json` | [`cli.md`](cli.md), [`site-bundle-contract.md`](site-bundle-contract.md) |
 | KFD-1 / KFD-2 / KFD-3 first-class CLI and Node API | `.buildchain/kfd/kfd-3/surfaces.json`, `dist/site/kfd-claims.json`, `buildchain.release.json`, KFD schemas from `@kungfu-tech/kfd` | [`kfd-support.md`](kfd-support.md), [`cli.md`](cli.md#commands) |
 | Declarative KFD Agent Hub adapter conformance and Passport evidence | `.buildchain/kfd/agent-hub.json`, `.buildchain/artifacts/kfd-agent-hub/evidence.json`, `buildchain.release.json#kfdAgentHub` | [`kfd-agent-hub.md`](kfd-agent-hub.md) |
@@ -85,6 +87,8 @@ replace them.
 | How does publish evidence, recovery, and finalization work? | [`publish-transaction.md`](publish-transaction.md) | verify | stable |
 | How do I collect and verify module/product build facts from Git source, version files, and outputs? | [`build-facts.md`](build-facts.md) + [`cli.md`](cli.md) | use/verify | stable |
 | How do I publish or verify release passport artifacts? | [`release-passport.md`](release-passport.md) | use | stable |
+| How do I keylessly attest Linux release artifacts with GitHub and bind them to a Release Passport? | [`github-artifact-attestation.md`](github-artifact-attestation.md) | verify/use | preview |
+| How do I request detached, Developer ID, or Authenticode signing without consumer credentials? | [`reusable-build-surface.md`](reusable-build-surface.md#artifact-signing-authority) | verify/use | preview |
 | How do I seal exact artifact, identity, lifecycle, and KFD assessment roots for KFX admission? | [`artifact-verification-envelope.md`](artifact-verification-envelope.md) | verify/use | preview |
 | How is product publication authority sealed to an exact workflow, runner, control plane, nonce, and artifact? | [`publication-authority.md`](publication-authority.md) | verify | preview |
 | How are GitHub ownership, independent review, effective protection, and plan capability audited fail-closed? | [`github-governance-authority.md`](github-governance-authority.md) | verify | preview |

package/docs/auditable-demo.md

@@ -8,7 +8,7 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-07-25
+last_reviewed: 2026-07-28
 ai_provenance:
   model_family: GPT-5
   product: Codex
@@ -100,8 +100,53 @@ the exact source SHA and renderer digest, and only then renders the complete
 qualified scene.
 
 The media bundle contains MP4, WebM, GIF, poster, probe, renderer manifest,
-renderer checksums, passed Gate receipt, media receipt, and distribution
-checksums. `render-media: false` does not weaken or skip the Gate.
+renderer checksums, passed Gate receipt, a versioned media receipt, and
+distribution checksums. A web-delivery profile also retains
+`media-inspection.json`, whose content root is bound into the receipt.
+`render-media: false` does not weaken or skip the Gate.
+
+## Media Qualification Profiles
+
+The single machine-readable source is
+`contracts/auditable-demo-media-profiles-v1.json`. Callers select one reviewed
+profile through `media-profile`; they cannot pass ffmpeg commands, codec flags,
+shell fragments, arbitrary profile paths, or transcoding instructions.
+
+| Profile | Meaning |
+| --- | --- |
+| `archive-v1` | Default compatibility contract. Retains the exact renderer outputs and classifies GIF as README compatibility evidence without making a browser-delivery claim. |
+| `web-delivery-v1` | Independently qualifies H.264 MP4 and VP9 WebM playback sources, forbids audio, requires exact scene dimensions and bounded duration/frame-rate drift, checks per-rendition byte ceilings, and proves MP4 `moov` precedes `mdat`. PNG remains the lossless evidence poster. |
+| `site-hero-v1` | Extends `web-delivery-v1` and additionally requires a qualified WebP browser poster. The current Build Images v1 renderer does not emit that member, so selecting this profile fails closed until the producer adds it. |
+
+For web-delivery profiles, Buildchain runs its own fixed `ffprobe` invocation
+inside the same immutable, network-disabled renderer image. That command is
+Buildchain-controlled; the producer cannot inject flags. The resulting witness
+records exact roots and byte counts plus container, codec, pixel format,
+dimensions, duration, frame rate, audio stream count, and progressive-download
+evidence. Finalization re-hashes the retained bytes, rechecks the witness root,
+and parses MP4 top-level boxes itself. The producer's `media-probe.json.passed`
+field remains supporting evidence, never sufficient authority.
+
+The default `archive-v1` path preserves the existing v1 media receipt exactly.
+An explicitly selected web-delivery profile emits a v2 media receipt with a
+content-addressed rendition list and explicit roles and MIME types. Agents and
+site builds select `primary-video`,
+`alternate-video`, `browser-poster`, or evidence-only roles from that receipt;
+they do not infer semantics from extensions or filenames. Additional responsive
+renditions are accepted only when the immutable renderer manifest declares the
+bounded `build-images.auditable-demo-web-delivery/v1` role and MIME metadata and
+the selected Buildchain profile supplies the byte ceiling; producer metadata
+cannot raise that ceiling. Unbound outputs,
+duplicate singleton roles, unknown profiles, or unsupported required versions
+fail closed.
+
+Initial byte ceilings are derived from the checked-in
+`auditable-demo-web-delivery-v1` fixture rendered by Build Images
+`v1.3.0-alpha.16` at its exact source SHA and image digest. GIF, MP4, WebM, and
+PNG ceilings are the next power of two above sixteen times the measured member
+bytes. The not-yet-produced WebP poster uses eight times the measured lossless
+PNG as its conservative proxy. The path-scoped qualification workflow
+regenerates the content-addressed evidence and fails on any byte or fact drift.
 
 ## Consumer Example
 
@@ -140,12 +185,19 @@ jobs:
       adapter-path: scripts/auditable-demo-adapter
       renderer-image: ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:RENDERER_DIGEST
       render-media: false
+      media-profile: archive-v1
 ```
 
 Replace both placeholders with reviewed immutable SHAs or digests. An eligible
 build should always call the reusable workflow. Selection policy changes only
 `render-media`; it must never condition away the Gate job.
 
+Use `web-delivery-v1` only when the rendered bundle is intended to become a
+qualified web-delivery source. Use `site-hero-v1` when an optimized browser
+poster is also required. Profile qualification does not prove browser playback,
+responsive layout, reduced-motion behavior, accessibility, or production
+deployment; those remain site responsibilities.
+
 ## Failure Evidence
 
 Gate and render jobs use bounded timeouts and non-cancelling concurrency.

package/docs/binary-distribution.md

@@ -47,6 +47,13 @@ Each archive is accompanied by:
 - `buildchain-release-bundle.tar.gz`;
 - `buildchain-release-bundle.json`.
 
+Linux archives may also be accompanied by a GitHub/Sigstore bundle and
+`buildchain.github-artifact-attestation-evidence/v1`. These prove the exact
+GitHub signer workflow and source digest while preserving the original compiler
+runner in the platform manifest. The GitHub-hosted signer does not rebuild or
+execute consumer source. See
+[`github-artifact-attestation.md`](github-artifact-attestation.md).
+
 ## KFD-3 Distribution Declaration
 
 Buildchain self-describes this release lane in `dist/site/kfd-claims.json` as

package/docs/cli.md

@@ -74,6 +74,7 @@ import { verifyKfd1ReleaseGate } from "@kungfu-tech/buildchain/kfd-gate";
 import { collectBadgeBundleFacts } from "@kungfu-tech/buildchain/badges";
 import { collectReadmeBadgeFacts } from "@kungfu-tech/buildchain/readme-badges";
 import { verifyReleasePassport } from "@kungfu-tech/buildchain/release-passport";
+import { verifyGitHubArtifactAttestationEvidence } from "@kungfu-tech/buildchain/github-artifact-attestation";
 import { createReleasePropagationPlan } from "@kungfu-tech/buildchain/release-propagation";
 import { planReleaseLineBootstrap } from "@kungfu-tech/buildchain/release-line-bootstrap";
 import { collectPublicSurfaceReverseAudit } from "@kungfu-tech/buildchain/public-surface-audit";
@@ -92,6 +93,14 @@ floating-ref contract world for a runtime such as `@v3`.
 
 ## Commands
 
+`buildchain create github-artifact-attestation-policy` seals the expected
+artifact, caller source, original Linux build, immutable Buildchain signer, and
+GitHub permission set before the Release Passport is collected.
+`buildchain verify github-artifact-attestation` invokes `gh attestation verify`
+with the exact signer/source policy and then verifies the retained bundle,
+predicate, platform manifest, Passport, and Buildchain evidence locally. See
+[`github-artifact-attestation.md`](github-artifact-attestation.md).
+
 `buildchain layout` is the stable machine question for repository layout. Tools
 such as Shifu should call it instead of copying `.buildchain/` path constants: