@kungfu-tech/buildchain 3.0.2-alpha.1 → 3.0.2-alpha.10

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.2-alpha.1",
+    "version": "3.0.2-alpha.10",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -34,6 +34,8 @@
         "runner-preset",
         "platforms-json",
         "release-candidate",
+        "github-artifact-attestation-subject-path",
+        "github-artifact-attestation-platform-id",
         "artifact-transfer-mode",
         "checkout-cache-mode",
         "checkout-cache-fallback",
@@ -50,7 +52,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:4dc9a093dbc5e0010e0845610a05db2cf7fb2c2301c5d780ea437b1f9e91da27"
+      "auditDigest": "sha256:5ada21e27d49afb2718bb687fa3dc17ffd1042665f3c00c18935ca4e46584fae"
     },
     {
       "contractVersion": 1,
@@ -89,7 +91,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:b8122b68422dbf3ac5cf828de1122902655aee5cfe4881a3530799ec00bc59ad"
+      "auditDigest": "sha256:6f7a097f70558ddff5867e3aaf6be0a0a56eb1838232eebe3ec6e7d071591746"
     },
     {
       "contractVersion": 1,
@@ -129,6 +131,9 @@
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-invariant-passport-jsons",
         "release-passport-invariant-passport-command",
+        "github-artifact-attestation-policy-json",
+        "github-artifact-attestation-environment",
+        "github-artifact-attestation-retention-days",
         "buildchain-contract-lock-path",
         "buildchain-contract-drift-issue-mode",
         "github-release",
@@ -170,7 +175,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
-      "auditDigest": "sha256:26993d90db926a0e086947a28359242cdaba042f0ceacee75f680216d6143ab7"
+      "auditDigest": "sha256:68f3ad7a1d880a26be48263d9d1d12c38ff89beb08e4f744509b1ca196a889c9"
     },
     {
       "contractVersion": 1,
@@ -212,7 +217,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:126ee323c031e318ca5d3623a834d5a39263e7b38e1ef349a239084ae1aff116"
+      "auditDigest": "sha256:54bf2db92237cad97da1dc740780330e6175b97352523db732c8650560f1a9fd"
     },
     {
       "contractVersion": 1,
@@ -283,11 +288,14 @@
         "media-artifact-id",
         "media-artifact-digest",
         "media-artifact-url",
-        "media-root"
+        "media-root",
+        "media-profile",
+        "media-qualification-root"
       ],
       "breakingDefaults": {
         "trustedEventRequired": true,
         "renderMediaDefault": false,
+        "mediaProfileDefault": "archive-v1",
         "artifactRetentionDaysDefault": 14,
         "gatePolicy": "required-before-selective-render"
       },
@@ -295,6 +303,7 @@
         "buildchain-repository",
         "source-ref",
         "render-media",
+        "media-profile",
         "artifact-retention-days",
         "require-trusted-event"
       ],
@@ -303,10 +312,14 @@
         "the checked-in consumer adapter runs from the exact consumer source with a disposable home and reduced environment",
         "every invocation runs an immutable network-disabled renderer smoke before emitting a qualified Gate bundle",
         "complete media rendering is optional and consumes only an exact passing Gate bundle",
-        "Gate and media bundles expose both GitHub Artifact archive coordinates and deterministic member roots"
-      ],
-      "breakingDigest": "sha256:a68f34d3dc24e0e0cd0040f978c174b62bf29a0472cebe1c43751e62408e6af6",
-      "auditDigest": "sha256:1969981087ee484411daae60797430d0f762d3a328c438dc723f2794d6d41f51"
+        "Gate and media bundles expose both GitHub Artifact archive coordinates and deterministic member roots",
+        "explicit web-delivery profiles independently verify codec, container, audio, dimensions, duration, byte budgets, rendition roles, and MP4 fast-start evidence",
+        "media receipts expose content-addressed rendition facts without requiring consumers to infer roles from filenames",
+        "Build Images owns encoding, Buildchain owns qualification and receipts, and site repositories own browser loading and accessibility behavior",
+        "media qualification does not claim browser playback, responsive layout, reduced-motion behavior, accessibility, or production deployment"
+      ],
+      "breakingDigest": "sha256:425f8d3d1ba205dd6fe35a20f1dc6dad7d7c563872283e3af79fea4d5c475692",
+      "auditDigest": "sha256:d043897d3d2bd242a83a362fccac408b4bd38e1e2fb50e7cae6a2145a6c0bd51"
     },
     {
       "contractVersion": 1,
@@ -340,6 +353,7 @@
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-invariant-passport-jsons",
         "release-passport-invariant-passport-command",
+        "release-passport-github-artifact-attestation-policy-jsons",
         "github-release",
         "github-release-title",
         "github-release-notes"
@@ -377,7 +391,7 @@
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
       ],
       "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
-      "auditDigest": "sha256:e4bcbd5a232626b3bdc87213cc1733d05a64ba9465a4915122b30735a53b1f90"
+      "auditDigest": "sha256:d1a4803f908b87c66ab6e9a5dca935366192fbda0bd6c23d784c9e037afb89be"
     },
     {
       "contractVersion": 1,
@@ -492,7 +506,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:842f7f1e60a8de253225ada03cf238948ce527481eb640bc6f14c6cc0ef38880"
+      "auditDigest": "sha256:aad90c2b39ce3fd7d2d4df5833f388c3090f5eeaecfd97d03276d375eed9459b"
     },
     {
       "contractVersion": 1,
@@ -541,7 +555,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:842f7f1e60a8de253225ada03cf238948ce527481eb640bc6f14c6cc0ef38880"
+      "auditDigest": "sha256:aad90c2b39ce3fd7d2d4df5833f388c3090f5eeaecfd97d03276d375eed9459b"
     },
     {
       "contractVersion": 1,
@@ -601,7 +615,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:abd77ee71465c9da3f0c234aea2aec900d1629bf74c13e954e0ee31dfcf00801"
+      "auditDigest": "sha256:4afc2879c3ede97d4123ec2536209b57ecb077f658a09f748e5ae088b1c92bc8"
     },
     {
       "contractVersion": 1,
@@ -691,7 +705,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:66bd60ea31bd0b103c77149f7242ba670ae8913b6aeae3f032254b598ed02dce"
+      "auditDigest": "sha256:63522fa4397a62566c0f24de10d0fd91bf040c98410b5ccd1cdcf4b4d4756549"
     },
     {
       "contractVersion": 1,
@@ -713,7 +727,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:7e1d0269cb7bbdc308595a5ad87cbd7190187ba3363f2dd07bc02ba8d5c7c5da"
+      "auditDigest": "sha256:4d201b7021ab28d7999f6ce88b4aacae5eb57e187d220e10a1e3e5ae5544a7d8"
     },
     {
       "contractVersion": 1,
@@ -764,7 +778,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:fcd7a66644c922460625b5bce0b3ceaa20bc84e87681bf949e807bd8c358fcf4",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -854,6 +868,7 @@
         "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -891,6 +906,9 @@
         "expected-artifacts-json",
         "fail-fast",
         "gate-profile-aggregate-json",
+        "github-artifact-attestation-platform-id",
+        "github-artifact-attestation-signer-sha",
+        "github-artifact-attestation-subject-path",
         "install-command",
         "kfd-agent-hub",
         "lifecycle-timeout-minutes",
@@ -926,8 +944,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:7ab36c233a4a448f3894e19c3e6a3b5f765095d2a8628cbbe421e4b82fe3e4b9",
-        "registryDigest": "sha256:fcd7a66644c922460625b5bce0b3ceaa20bc84e87681bf949e807bd8c358fcf4",
+        "digest": "sha256:146718143cc50e48ac57154aade4a4b06a8df4e036708a150233098d3c1cb6f7",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -961,6 +979,10 @@
             "classification": "redacted",
             "source": "workflow-call-secret"
           },
+          "BUILDCHAIN_PROMOTION_TOKEN": {
+            "classification": "redacted",
+            "source": "workflow-call-secret"
+          },
           "artifact-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1109,6 +1131,18 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "github-artifact-attestation-platform-id": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "github-artifact-attestation-signer-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "github-artifact-attestation-subject-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "install-command": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1249,7 +1283,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
-      "auditDigest": "sha256:4dc9a093dbc5e0010e0845610a05db2cf7fb2c2301c5d780ea437b1f9e91da27"
+      "auditDigest": "sha256:5ada21e27d49afb2718bb687fa3dc17ffd1042665f3c00c18935ca4e46584fae"
     },
     {
       "contractVersion": 1,
@@ -1295,6 +1329,7 @@
         "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -1335,6 +1370,9 @@
         "expected-artifacts-json",
         "fail-fast",
         "gate-profile-aggregate-json",
+        "github-artifact-attestation-platform-id",
+        "github-artifact-attestation-signer-sha",
+        "github-artifact-attestation-subject-path",
         "install-command",
         "kfd-agent-hub",
         "lifecycle-timeout-minutes",
@@ -1370,8 +1408,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:9e5d5244c54d6613024beb43613afcae8d9cfb5cae7799c7a83a2799034ad64f",
-        "registryDigest": "sha256:fcd7a66644c922460625b5bce0b3ceaa20bc84e87681bf949e807bd8c358fcf4",
+        "digest": "sha256:55b3189412e7da7769a8de60bd1ba4cf52d726d8b79c0a720598e49742aa72a0",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1405,6 +1443,10 @@
             "classification": "redacted",
             "source": "workflow-call-secret"
           },
+          "BUILDCHAIN_PROMOTION_TOKEN": {
+            "classification": "redacted",
+            "source": "workflow-call-secret"
+          },
           "artifact-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1565,6 +1607,18 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "github-artifact-attestation-platform-id": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "github-artifact-attestation-signer-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "github-artifact-attestation-subject-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "install-command": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1702,7 +1756,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:b8122b68422dbf3ac5cf828de1122902655aee5cfe4881a3530799ec00bc59ad"
+      "auditDigest": "sha256:6f7a097f70558ddff5867e3aaf6be0a0a56eb1838232eebe3ec6e7d071591746"
     },
     {
       "contractVersion": 1,
@@ -1772,7 +1826,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:fcd7a66644c922460625b5bce0b3ceaa20bc84e87681bf949e807bd8c358fcf4",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1989,7 +2043,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:fcd7a66644c922460625b5bce0b3ceaa20bc84e87681bf949e807bd8c358fcf4",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2233,7 +2287,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:fcd7a66644c922460625b5bce0b3ceaa20bc84e87681bf949e807bd8c358fcf4",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2415,7 +2469,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:fcd7a66644c922460625b5bce0b3ceaa20bc84e87681bf949e807bd8c358fcf4",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2646,6 +2700,9 @@
         "buildchain-repository",
         "channel",
         "dry-run",
+        "github-artifact-attestation-environment",
+        "github-artifact-attestation-policy-json",
+        "github-artifact-attestation-retention-days",
         "github-governance-receipt-json",
         "github-release",
         "github-release-notes",
@@ -2721,8 +2778,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:4bd94f0bb1790c87af758b71aa592a3e22fdcd84a9851931d252e3f60cba8d40",
-        "registryDigest": "sha256:fcd7a66644c922460625b5bce0b3ceaa20bc84e87681bf949e807bd8c358fcf4",
+        "digest": "sha256:00baae93d9ed75129fdaed6fcc33285e515b8c7de84816831a39e660941dd7ae",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -2816,6 +2873,18 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "github-artifact-attestation-environment": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "github-artifact-attestation-policy-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "github-artifact-attestation-retention-days": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "github-governance-receipt-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -3113,7 +3182,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:126ee323c031e318ca5d3623a834d5a39263e7b38e1ef349a239084ae1aff116"
+      "auditDigest": "sha256:54bf2db92237cad97da1dc740780330e6175b97352523db732c8650560f1a9fd"
     },
     {
       "contractVersion": 1,
@@ -3174,7 +3243,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
-        "registryDigest": "sha256:fcd7a66644c922460625b5bce0b3ceaa20bc84e87681bf949e807bd8c358fcf4",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -3297,7 +3366,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:fcd7a66644c922460625b5bce0b3ceaa20bc84e87681bf949e807bd8c358fcf4",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3310,6 +3379,6 @@
       "auditDigest": "sha256:e07a5db56a71bd0ac79c81f12619938055361bf0a0ed8e5891f88ca1c51f1c93"
     }
   ],
-  "compatibilityDigest": "sha256:008b1c5a90a787cf30106829ac7aca68ab501f6d9c375e415d9c5c6b89039f46",
-  "contractDigest": "sha256:b267a2e659ab75433deca4d8f257cee075ca764497132be34c6d2c2f0a0a47c3"
+  "compatibilityDigest": "sha256:9770baa99ba374e9dbd743ca9624a72137513b8c4e65af1fbf2160cb3ef51d9d",
+  "contractDigest": "sha256:1fd7622e04ae83532fcc9e0f7a9fe43f86998caadd398f78f1460c9052bb591b"
 }