@kungfu-tech/buildchain 3.0.2-alpha.6 → 3.0.2-alpha.8

package/README.md

@@ -225,8 +225,9 @@ The active reusable workflow surfaces are:
   planning, capability-aware runner dispatch, receipt validation, and one
   stable aggregate check;
 - `.github/workflows/.auditable-demo.yml` for exact-artifact demo
-  qualification, transcript-bound renderer smoke, and optional media rendering
-  from the exact passing Gate bundle;
+  qualification, transcript-bound renderer smoke, optional media rendering
+  from the exact passing Gate bundle, and opt-in content-addressed web-delivery
+  profiles with independently verified rendition roles;
 - `.github/workflows/.build.yml` for deterministic multi-platform build and
   artifact contracts;
 - `.github/workflows/build.yml` for the single-config channel router that uses

package/contracts/auditable-demo-media-profiles-v1.json

@@ -0,0 +1,168 @@
+{
+  "schema": "buildchain.auditable-demo-media-profiles/v1",
+  "profiles": {
+    "archive-v1": {
+      "mode": "archive",
+      "renditions": [
+        {
+          "path": "demo.gif",
+          "role": "readme-compatibility",
+          "mimeType": "image/gif"
+        },
+        {
+          "path": "demo.mp4",
+          "role": "archive-video",
+          "mimeType": "video/mp4"
+        },
+        {
+          "path": "demo.webm",
+          "role": "archive-video-alternate",
+          "mimeType": "video/webm"
+        },
+        {
+          "path": "poster.png",
+          "role": "evidence-poster",
+          "mimeType": "image/png"
+        }
+      ],
+      "singletonRoles": [
+        "evidence-poster",
+        "readme-compatibility"
+      ]
+    },
+    "web-delivery-v1": {
+      "extends": "archive-v1",
+      "mode": "web-delivery",
+      "renditions": [
+        {
+          "path": "demo.gif",
+          "role": "readme-compatibility",
+          "mimeType": "image/gif",
+          "container": "gif",
+          "videoCodec": "gif",
+          "audioStreams": 0,
+          "maximumBytes": 1048576,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.gif",
+            "observedBytes": 40826,
+            "multiplier": 16,
+            "rounding": "next-power-of-two"
+          }
+        },
+        {
+          "path": "demo.mp4",
+          "role": "primary-video",
+          "mimeType": "video/mp4",
+          "container": "mp4",
+          "videoCodec": "h264",
+          "pixelFormat": "yuv420p",
+          "audioStreams": 0,
+          "maximumBytes": 524288,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.mp4",
+            "observedBytes": 27038,
+            "multiplier": 16,
+            "rounding": "next-power-of-two"
+          },
+          "progressiveDownload": "moov-before-mdat",
+          "frameRatePolicy": "scene-exact"
+        },
+        {
+          "path": "demo.webm",
+          "role": "alternate-video",
+          "mimeType": "video/webm",
+          "container": "webm",
+          "videoCodec": "vp9",
+          "pixelFormat": "yuv420p",
+          "audioStreams": 0,
+          "maximumBytes": 524288,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.webm",
+            "observedBytes": 23383,
+            "multiplier": 16,
+            "rounding": "next-power-of-two"
+          },
+          "frameRatePolicy": "scene-exact"
+        },
+        {
+          "path": "poster.png",
+          "role": "evidence-poster",
+          "mimeType": "image/png",
+          "container": "png",
+          "videoCodec": "png",
+          "audioStreams": 0,
+          "maximumBytes": 1048576,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "poster.png",
+            "observedBytes": 34769,
+            "multiplier": 16,
+            "rounding": "next-power-of-two"
+          }
+        }
+      ],
+      "singletonRoles": [
+        "primary-video",
+        "alternate-video",
+        "evidence-poster",
+        "readme-compatibility",
+        "browser-poster"
+      ],
+      "additionalRenditions": {
+        "allowedRoles": [
+          "primary-video",
+          "responsive-video",
+          "browser-poster"
+        ],
+        "allowedMimeTypes": [
+          "video/mp4",
+          "video/webm",
+          "image/webp",
+          "image/avif"
+        ],
+        "maximumBytesByMimeType": {
+          "video/mp4": 524288,
+          "video/webm": 524288,
+          "image/webp": 524288,
+          "image/avif": 524288
+        }
+      }
+    },
+    "site-hero-v1": {
+      "extends": "web-delivery-v1",
+      "mode": "web-delivery",
+      "renditions": [
+        {
+          "path": "poster.webp",
+          "role": "browser-poster",
+          "mimeType": "image/webp",
+          "container": "webp",
+          "videoCodec": "webp",
+          "audioStreams": 0,
+          "maximumBytes": 524288,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "poster.png",
+            "observedBytes": 34769,
+            "multiplier": 8,
+            "rounding": "next-power-of-two"
+          }
+        }
+      ]
+    }
+  },
+  "qualification": {
+    "dimensions": "exact-scene",
+    "durationToleranceMs": 600,
+    "memberRootAlgorithm": "sha256",
+    "nonClaims": [
+      "browser-playback-success",
+      "responsive-layout",
+      "reduced-motion-behavior",
+      "production-site-deployment"
+    ]
+  }
+}

package/contracts/evidence/auditable-demo-web-delivery-v1.json

@@ -0,0 +1,103 @@
+{
+  "evidenceRoot": "sha256:451adc20c423fbf680caeb14dcc4850990a3317dd5a77f94ee451a7a26edf3fb",
+  "inputs": {
+    "complete-transcript.txt": "sha256:f3723a3eda614134ab724ce9fbe1e0e5f916d809a8a3096f5e37c1458cb3656c",
+    "public-projection.json": "sha256:127f9877f9750a85eada4338f088bee5460c5c71a83302652d3321667002c3c7",
+    "scene.json": "sha256:ea65ec39177aac7e5341d330d61e81fcd523c9f2c7a7d4dd5ac43fb457a51977"
+  },
+  "qualification": {
+    "inspectionRoot": "sha256:3cf9f7c710f4fcbd307b116cf279675a37210905d6d0fc7459d11933e98e6ea4",
+    "nonClaims": [
+      "browser-playback-success",
+      "responsive-layout",
+      "reduced-motion-behavior",
+      "production-site-deployment"
+    ],
+    "profile": {
+      "catalogRoot": "sha256:b2cf52c7b087be73ea852bbbe574e1a50bb7d64d26b8bc211a2c7d53e2ff9cae",
+      "id": "web-delivery-v1",
+      "mode": "web-delivery",
+      "profileRoot": "sha256:b6fb0a83414d03a7222fc50429e60ed68b6d47758b86ceaa316ecc659a01ae2b"
+    },
+    "qualificationRoot": "sha256:f2133bab4a3a5937ec3863972049d0a7247a8e108681d4bd247f47d766c461ae",
+    "renditions": [
+      {
+        "audioStreams": 0,
+        "bytes": 40826,
+        "container": "gif",
+        "durationMs": 2500,
+        "frameRate": 12.5,
+        "height": 720,
+        "maximumBytes": 1048576,
+        "mimeType": "image/gif",
+        "path": "demo.gif",
+        "pixelFormat": "bgra",
+        "progressiveDownload": "not-applicable",
+        "role": "readme-compatibility",
+        "root": "sha256:d835fbd3068f672b3aaffc904d1488540f661c48e0429c8887397d1ae531880f",
+        "videoCodec": "gif",
+        "width": 1280
+      },
+      {
+        "audioStreams": 0,
+        "bytes": 27038,
+        "container": "mp4",
+        "durationMs": 2533,
+        "frameRate": 15,
+        "height": 720,
+        "maximumBytes": 524288,
+        "mimeType": "video/mp4",
+        "path": "demo.mp4",
+        "pixelFormat": "yuv420p",
+        "progressiveDownload": "moov-before-mdat",
+        "role": "primary-video",
+        "root": "sha256:a82c3ed61b101528a07689227dc8af65e8c809aa6de2b749fd53915d97c99ac9",
+        "videoCodec": "h264",
+        "width": 1280
+      },
+      {
+        "audioStreams": 0,
+        "bytes": 23383,
+        "container": "webm",
+        "durationMs": 2534,
+        "frameRate": 15,
+        "height": 720,
+        "maximumBytes": 524288,
+        "mimeType": "video/webm",
+        "path": "demo.webm",
+        "pixelFormat": "yuv420p",
+        "progressiveDownload": "not-applicable",
+        "role": "alternate-video",
+        "root": "sha256:935deb66eb4734371b21c2fc8c55acd596e79c832a9a7963ab0922b3925564c3",
+        "videoCodec": "vp9",
+        "width": 1280
+      },
+      {
+        "audioStreams": 0,
+        "bytes": 34769,
+        "container": "png",
+        "durationMs": 0,
+        "frameRate": 25,
+        "height": 720,
+        "maximumBytes": 1048576,
+        "mimeType": "image/png",
+        "path": "poster.png",
+        "pixelFormat": "rgb24",
+        "progressiveDownload": "not-applicable",
+        "role": "evidence-poster",
+        "root": "sha256:7141a41c2b84d074477844d9c8d12e6f44173074829796cefdf8119b21be2de9",
+        "videoCodec": "png",
+        "width": 1280
+      }
+    ],
+    "schema": "buildchain.auditable-demo-media-qualification/v1"
+  },
+  "renderer": {
+    "image": "ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:cb5e1dec368d21c7d4e8baded99ac75f12f7eff0d19505751888cf974086efa6",
+    "sourceRef": "refs/tags/v1.3.0-alpha.16",
+    "sourceRepository": "kungfu-systems/build-images",
+    "sourceSha": "999b370743f3e64e4f0b634d5131bd1d3d6b83ba"
+  },
+  "rendererManifestRoot": "sha256:2d3e4e2fcdfd17419e866e99d5e29cef65166b594cc5a5bdf2e5d9454cfb3a49",
+  "schema": "buildchain.auditable-demo-media-profile-fixture/v1"
+}

package/contracts/fixtures/auditable-demo-web-delivery-v1/complete-transcript.txt

@@ -0,0 +1,2 @@
+buildchain auditable demo media profile qualification
+immutable renderer fixture completed

package/contracts/fixtures/auditable-demo-web-delivery-v1/public-projection.json

@@ -0,0 +1,16 @@
+{
+  "schema": "build-images.demo-projection/v1",
+  "evidenceClass": "qualified-build-output",
+  "claimBoundary": "Fixture media qualifies delivery properties only; it does not prove a production deployment.",
+  "cues": [
+    {
+      "startMs": 0,
+      "endMs": 2500,
+      "transcriptLines": [
+        1,
+        2
+      ],
+      "annotation": "fixed qualification fixture"
+    }
+  ]
+}

package/contracts/fixtures/auditable-demo-web-delivery-v1/scene.json

@@ -0,0 +1,12 @@
+{
+  "schema": "build-images.demo-scene/v1",
+  "id": "buildchain-web-delivery-qualification",
+  "width": 1280,
+  "height": 720,
+  "fps": 15,
+  "durationMs": 2500,
+  "title": "Buildchain web delivery qualification",
+  "commandLabel": "buildchain qualify-media-fixture",
+  "background": "#0B1020",
+  "accent": "#67E8A5"
+}

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.2-alpha.6",
+    "version": "3.0.2-alpha.8",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -52,7 +52,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:dbee3ce7db7a6a79138e8b5c6698fb2ba12a0594ba17dcb570d6230f44db6b09"
+      "auditDigest": "sha256:e6f26755ff082c9116b68fe199879a482a424938cc308033aaf05a0d31dc8cee"
     },
     {
       "contractVersion": 1,
@@ -91,7 +91,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:158aa13c7954762e1a7ab6e5efffc7edbdf5d380208157ce9bd0fbec50dc6190"
+      "auditDigest": "sha256:6f7a097f70558ddff5867e3aaf6be0a0a56eb1838232eebe3ec6e7d071591746"
     },
     {
       "contractVersion": 1,
@@ -175,7 +175,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
-      "auditDigest": "sha256:df3ae042d9715119eb82d0295ee9a22f1c1fb2e603f96a52ae233db8c628b5a8"
+      "auditDigest": "sha256:68f3ad7a1d880a26be48263d9d1d12c38ff89beb08e4f744509b1ca196a889c9"
     },
     {
       "contractVersion": 1,
@@ -288,11 +288,14 @@
         "media-artifact-id",
         "media-artifact-digest",
         "media-artifact-url",
-        "media-root"
+        "media-root",
+        "media-profile",
+        "media-qualification-root"
       ],
       "breakingDefaults": {
         "trustedEventRequired": true,
         "renderMediaDefault": false,
+        "mediaProfileDefault": "archive-v1",
         "artifactRetentionDaysDefault": 14,
         "gatePolicy": "required-before-selective-render"
       },
@@ -300,6 +303,7 @@
         "buildchain-repository",
         "source-ref",
         "render-media",
+        "media-profile",
         "artifact-retention-days",
         "require-trusted-event"
       ],
@@ -308,10 +312,14 @@
         "the checked-in consumer adapter runs from the exact consumer source with a disposable home and reduced environment",
         "every invocation runs an immutable network-disabled renderer smoke before emitting a qualified Gate bundle",
         "complete media rendering is optional and consumes only an exact passing Gate bundle",
-        "Gate and media bundles expose both GitHub Artifact archive coordinates and deterministic member roots"
-      ],
-      "breakingDigest": "sha256:a68f34d3dc24e0e0cd0040f978c174b62bf29a0472cebe1c43751e62408e6af6",
-      "auditDigest": "sha256:1969981087ee484411daae60797430d0f762d3a328c438dc723f2794d6d41f51"
+        "Gate and media bundles expose both GitHub Artifact archive coordinates and deterministic member roots",
+        "explicit web-delivery profiles independently verify codec, container, audio, dimensions, duration, byte budgets, rendition roles, and MP4 fast-start evidence",
+        "media receipts expose content-addressed rendition facts without requiring consumers to infer roles from filenames",
+        "Build Images owns encoding, Buildchain owns qualification and receipts, and site repositories own browser loading and accessibility behavior",
+        "media qualification does not claim browser playback, responsive layout, reduced-motion behavior, accessibility, or production deployment"
+      ],
+      "breakingDigest": "sha256:425f8d3d1ba205dd6fe35a20f1dc6dad7d7c563872283e3af79fea4d5c475692",
+      "auditDigest": "sha256:d043897d3d2bd242a83a362fccac408b4bd38e1e2fb50e7cae6a2145a6c0bd51"
     },
     {
       "contractVersion": 1,
@@ -697,7 +705,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:8bb23e95ad68832eb554145905a29242a06875baf22ac62c4e7302e447872f3c"
+      "auditDigest": "sha256:63522fa4397a62566c0f24de10d0fd91bf040c98410b5ccd1cdcf4b4d4756549"
     },
     {
       "contractVersion": 1,
@@ -719,7 +727,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:f9d8d42ea1aaa81e127ad0aeaacf846f944369f49d06f5ee749078aae320e0ee"
+      "auditDigest": "sha256:4d201b7021ab28d7999f6ce88b4aacae5eb57e187d220e10a1e3e5ae5544a7d8"
     },
     {
       "contractVersion": 1,
@@ -770,7 +778,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -860,6 +868,7 @@
         "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -935,8 +944,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:16c0a2506088fc5a4e3337c7c23f5cc7d14f30e9cde23c1d39fc335d05b4a4f9",
-        "registryDigest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f",
+        "digest": "sha256:146718143cc50e48ac57154aade4a4b06a8df4e036708a150233098d3c1cb6f7",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -970,6 +979,10 @@
             "classification": "redacted",
             "source": "workflow-call-secret"
           },
+          "BUILDCHAIN_PROMOTION_TOKEN": {
+            "classification": "redacted",
+            "source": "workflow-call-secret"
+          },
           "artifact-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1270,7 +1283,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
-      "auditDigest": "sha256:dbee3ce7db7a6a79138e8b5c6698fb2ba12a0594ba17dcb570d6230f44db6b09"
+      "auditDigest": "sha256:e6f26755ff082c9116b68fe199879a482a424938cc308033aaf05a0d31dc8cee"
     },
     {
       "contractVersion": 1,
@@ -1316,6 +1329,7 @@
         "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -1394,8 +1408,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:529f68186a49a8df1f2012fc4a38058548d1cc93eb06b6bed35befddd72519ef",
-        "registryDigest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f",
+        "digest": "sha256:55b3189412e7da7769a8de60bd1ba4cf52d726d8b79c0a720598e49742aa72a0",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1429,6 +1443,10 @@
             "classification": "redacted",
             "source": "workflow-call-secret"
           },
+          "BUILDCHAIN_PROMOTION_TOKEN": {
+            "classification": "redacted",
+            "source": "workflow-call-secret"
+          },
           "artifact-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1738,7 +1756,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:158aa13c7954762e1a7ab6e5efffc7edbdf5d380208157ce9bd0fbec50dc6190"
+      "auditDigest": "sha256:6f7a097f70558ddff5867e3aaf6be0a0a56eb1838232eebe3ec6e7d071591746"
     },
     {
       "contractVersion": 1,
@@ -1808,7 +1826,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2025,7 +2043,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2269,7 +2287,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2451,7 +2469,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2761,7 +2779,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:00baae93d9ed75129fdaed6fcc33285e515b8c7de84816831a39e660941dd7ae",
-        "registryDigest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3225,7 +3243,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
-        "registryDigest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -3348,7 +3366,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f",
+        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3361,6 +3379,6 @@
       "auditDigest": "sha256:e07a5db56a71bd0ac79c81f12619938055361bf0a0ed8e5891f88ca1c51f1c93"
     }
   ],
-  "compatibilityDigest": "sha256:008b1c5a90a787cf30106829ac7aca68ab501f6d9c375e415d9c5c6b89039f46",
-  "contractDigest": "sha256:741a9262d51445d776077265081fbf7acac549dea1a624e9728861eabf66cc6e"
+  "compatibilityDigest": "sha256:9770baa99ba374e9dbd743ca9624a72137513b8c4e65af1fbf2160cb3ef51d9d",
+  "contractDigest": "sha256:5b75cb3c3f376e023497d3374b338b1f9622c6c24e7d5fc197ffa9ae7ce66c08"
 }