@kungfu-tech/buildchain 3.0.2-alpha.7 → 3.0.2-alpha.9

package/dist/site/capability-registry.json

@@ -50,7 +50,7 @@
         "manualCount": 5,
         "pageCount": 5,
         "cliCommandCount": 22,
-        "nodeApiCount": 9,
+        "nodeApiCount": 11,
         "workflowCount": 3,
         "actionCount": 2
       },
@@ -85,7 +85,7 @@
         "manualCount": 5,
         "pageCount": 17,
         "cliCommandCount": 4,
-        "nodeApiCount": 5,
+        "nodeApiCount": 6,
         "workflowCount": 4,
         "actionCount": 2
       },
@@ -291,7 +291,7 @@
         "pageCount": 8,
         "cliCommandCount": 0,
         "nodeApiCount": 2,
-        "workflowCount": 35,
+        "workflowCount": 37,
         "actionCount": 1
       },
       "manuals": [

package/dist/site/controller-registry.json

@@ -118,6 +118,10 @@
           "classification": "redacted",
           "source": "workflow-call-secret"
         },
+        "BUILDCHAIN_PROMOTION_TOKEN": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
         "artifact-name": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -451,7 +455,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:16c0a2506088fc5a4e3337c7c23f5cc7d14f30e9cde23c1d39fc335d05b4a4f9"
+      "digest": "sha256:146718143cc50e48ac57154aade4a4b06a8df4e036708a150233098d3c1cb6f7"
     },
     {
       "schemaVersion": 1,
@@ -495,6 +499,10 @@
           "classification": "redacted",
           "source": "workflow-call-secret"
         },
+        "BUILDCHAIN_PROMOTION_TOKEN": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
         "artifact-name": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -821,7 +829,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:529f68186a49a8df1f2012fc4a38058548d1cc93eb06b6bed35befddd72519ef"
+      "digest": "sha256:55b3189412e7da7769a8de60bd1ba4cf52d726d8b79c0a720598e49742aa72a0"
     },
     {
       "schemaVersion": 1,
@@ -2168,5 +2176,5 @@
       "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555"
     }
   ],
-  "digest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f"
+  "digest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4"
 }

package/dist/site/kfd-claims.json

@@ -14,17 +14,17 @@
   },
   "runtimeContract": {
     "contract": "kungfu-buildchain-runtime-contract-world",
-    "compatibilityDigest": "sha256:008b1c5a90a787cf30106829ac7aca68ab501f6d9c375e415d9c5c6b89039f46",
+    "compatibilityDigest": "sha256:9770baa99ba374e9dbd743ca9624a72137513b8c4e65af1fbf2160cb3ef51d9d",
     "majorLine": "v3"
   },
   "publicSurfaceReverseAudit": {
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "6d778d2a4d04a1b93ed21622719e08b3fa1e149af2941e09675c66582a3ebcdd",
+    "sha256": "5d48015039ed4e6885acc9a0057d492f48e0b8b31b853a482af41ebae525d801",
     "summary": {
       "cliCommandCount": 97,
-      "workflowCount": 55,
+      "workflowCount": 57,
       "actionCount": 6,
       "sitePageCount": 59,
       "docCommandRefCount": 291,
@@ -228,10 +228,10 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "6d778d2a4d04a1b93ed21622719e08b3fa1e149af2941e09675c66582a3ebcdd",
+      "sha256": "5d48015039ed4e6885acc9a0057d492f48e0b8b31b853a482af41ebae525d801",
       "summary": {
         "cliCommandCount": 97,
-        "workflowCount": 55,
+        "workflowCount": 57,
         "actionCount": 6,
         "sitePageCount": 59,
         "docCommandRefCount": 291,
@@ -1160,6 +1160,42 @@
           "public": true,
           "packageExport": "./github-artifact-attestation"
         },
+        {
+          "id": "export:./artifact-signing",
+          "name": "@kungfu-tech/buildchain/artifact-signing",
+          "kind": "package-export",
+          "sourcePath": "packages/core/artifact-signing.js",
+          "evidencePath": "packages/core/artifact-signing.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./artifact-signing"
+        },
+        {
+          "id": "export:./artifact-signing-result",
+          "name": "@kungfu-tech/buildchain/artifact-signing-result",
+          "kind": "package-export",
+          "sourcePath": "packages/core/artifact-signing-result.js",
+          "evidencePath": "packages/core/artifact-signing-result.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./artifact-signing-result"
+        },
+        {
+          "id": "export:./detached-artifact-signature",
+          "name": "@kungfu-tech/buildchain/detached-artifact-signature",
+          "kind": "package-export",
+          "sourcePath": "packages/core/detached-artifact-signature.js",
+          "evidencePath": "packages/core/detached-artifact-signature.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./detached-artifact-signature"
+        },
         {
           "id": "export:./anchored-version-material",
           "name": "@kungfu-tech/buildchain/anchored-version-material",
@@ -2954,11 +2990,12 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 9,
+          "inputCount": 10,
           "inputs": [
             "adapter-path",
             "artifact-retention-days",
             "buildchain-repository",
+            "media-profile",
             "render-media",
             "renderer-image",
             "require-trusted-event",
@@ -3606,6 +3643,34 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:artifact-signing-authority",
+          "name": "workflow:artifact-signing-authority",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/artifact-signing-authority.yml",
+          "evidencePath": ".github/workflows/artifact-signing-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:auditable-demo-media-profile-qualification",
+          "name": "workflow:auditable-demo-media-profile-qualification",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/auditable-demo-media-profile-qualification.yml",
+          "evidencePath": ".github/workflows/auditable-demo-media-profile-qualification.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:binary-distribution",
           "name": "workflow:binary-distribution",
@@ -3913,7 +3978,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 10,
+          "inputCount": 11,
           "inputs": [
             "alpha-workflow-path",
             "buildchain-ref",
@@ -3922,6 +3987,7 @@
             "dev-workflow-path",
             "dry-run",
             "max-age-seconds",
+            "pull-request-body-prefix",
             "settlement-authorized",
             "source-branch",
             "target-branch"
@@ -5644,6 +5710,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 360
+    "publicSurfaceCount": 365
   }
 }

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.2-alpha.7",
+    "version": "3.0.2-alpha.9",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/manual-registry.json

@@ -9,7 +9,7 @@
       "title": "Buildchain documentation map",
       "path": "docs/MAP.md",
       "plane": "use",
-      "digest": "sha256:23158252e5d2bd09b9b54dc08a0a452562e4b3a6ec3861b991632a34199d9820",
+      "digest": "sha256:cc32692e8d04816e8de94f208e43c2d5c5c7a8425cec8b32edc73ab78591fbbf",
       "capabilityGroup": "getting-started",
       "audience": [
         "agent",
@@ -23,7 +23,7 @@
       "title": "Auditable demo artifact pipeline",
       "path": "docs/auditable-demo.md",
       "plane": "verify",
-      "digest": "sha256:cff9786d4de098c84ea7e494b523627d6431909f15c82940e2193dbda1ef10e9",
+      "digest": "sha256:0e8cf2162c2e1f83cfe3a6171e3055f494cab5f03fdcbec3854e1793678e6908",
       "capabilityGroup": "reusable-build",
       "audience": [
         "consumer",
@@ -64,7 +64,7 @@
       "title": "GitHub-native Linux artifact attestation",
       "path": "docs/github-artifact-attestation.md",
       "plane": "verify",
-      "digest": "sha256:afdb8172bc41b9a20c0d18f4ddcc55ee287ac56db05e67e55d12de1843b724e1",
+      "digest": "sha256:51f28b0b01fae4e3f80a7433f6c491d0c795bd091bff64ca1264c5cc0819c545",
       "capabilityGroup": "release-passport-trust",
       "audience": [
         "release-operator",
@@ -360,7 +360,7 @@
       "title": "Reusable build surface",
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
-      "digest": "sha256:5d46d0f5e6e03541c187ffea154dcce703ef78e59d16bd0e4fa7c175da940480",
+      "digest": "sha256:ea36ec722f811f5156735aa7471ed080cdc7e87d71c20c300243b226e233e675",
       "capabilityGroup": "reusable-build",
       "audience": [
         "consumer",
@@ -387,7 +387,7 @@
       "title": "Release governance",
       "path": "docs/release-governance.md",
       "plane": "why",
-      "digest": "sha256:a77c2bb1d2245e1ee2318f650ad64ada6c8cdd3292a62a028e3ccc7517fb4e12",
+      "digest": "sha256:42a45f51db7ea11658431718835e1a430959db2a5cc80fc4651681502fe6fb7c",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer",
@@ -415,7 +415,7 @@
       "title": "Runtime train validation",
       "path": "docs/runtime-train-validation.md",
       "plane": "verify",
-      "digest": "sha256:1315fe264d0e22215183122fc05e287be974751a78268642076898b689e435e6",
+      "digest": "sha256:c9ebf451294f92a2be3aa2ac4b2ec7afb3cc17bbeae2ece7879b800c0f274a40",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer",
@@ -429,7 +429,7 @@
       "title": "Versioning",
       "path": "docs/versioning.md",
       "plane": "why",
-      "digest": "sha256:f3665f2f173bdcb287cf8aa509035164e818b20088849f4a2bce098951c84ea3",
+      "digest": "sha256:4b40cb8675c111b7588297102a61cb241630f2b707a67a0384a6df7527b2c64c",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer"

package/dist/site/node-api-registry.json

@@ -8,7 +8,7 @@
       "specifier": "@kungfu-tech/buildchain",
       "export": ".",
       "target": "./packages/core/index.js",
-      "digest": "sha256:204601094084ab5e9a6d6738d64bf3f89f97fc23567a79d2c5dcc718d281555a",
+      "digest": "sha256:d9ae3dea43788f32b8a65bcc50044bb29fb268a354b5b1fe3558cb4250e2b83b",
       "summary": "Root toolkit export for Buildchain's public Node API.",
       "capabilityGroup": "api-cli-reference",
       "audience": [
@@ -47,7 +47,7 @@
       "specifier": "@kungfu-tech/buildchain/core",
       "export": "./core",
       "target": "./packages/core/index.js",
-      "digest": "sha256:204601094084ab5e9a6d6738d64bf3f89f97fc23567a79d2c5dcc718d281555a",
+      "digest": "sha256:d9ae3dea43788f32b8a65bcc50044bb29fb268a354b5b1fe3558cb4250e2b83b",
       "summary": "Alias for the root public toolkit export.",
       "capabilityGroup": "api-cli-reference",
       "audience": [
@@ -95,6 +95,45 @@
       ],
       "maturity": "stable"
     },
+    {
+      "specifier": "@kungfu-tech/buildchain/artifact-signing",
+      "export": "./artifact-signing",
+      "target": "./packages/core/artifact-signing.js",
+      "digest": "sha256:2314a3858214ea7f573510208b97042545931d4b6c505575f62bc46168de757c",
+      "summary": "Credential-free artifact signing declarations, source-bound requests, authority receipts, profile resolution, and fail-closed validation APIs.",
+      "capabilityGroup": "reusable-build",
+      "audience": [
+        "developer",
+        "agent"
+      ],
+      "maturity": "stable"
+    },
+    {
+      "specifier": "@kungfu-tech/buildchain/artifact-signing-result",
+      "export": "./artifact-signing-result",
+      "target": "./packages/core/artifact-signing-result.js",
+      "digest": "sha256:6ae646862ccddb717f59d29549e518ca698cb56dc68556775b6bb49ae4b0435c",
+      "summary": "Immutable signed-result, final-payload, receipt, evidence-root, and provider-verification binding APIs.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "developer",
+        "agent"
+      ],
+      "maturity": "stable"
+    },
+    {
+      "specifier": "@kungfu-tech/buildchain/detached-artifact-signature",
+      "export": "./detached-artifact-signature",
+      "target": "./packages/core/detached-artifact-signature.js",
+      "digest": "sha256:336bc9e1386b2252ade7ce91af21eb2e53072768db4cb8f20c4e79b23c4fd945",
+      "summary": "Buildchain-authority Ed25519 detached signature and verification APIs for arbitrary binary artifacts.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "developer",
+        "agent"
+      ],
+      "maturity": "stable"
+    },
     {
       "specifier": "@kungfu-tech/buildchain/anchored-version-material",
       "export": "./anchored-version-material",
@@ -112,7 +151,7 @@
       "specifier": "@kungfu-tech/buildchain/buildchain-contract",
       "export": "./buildchain-contract",
       "target": "./packages/core/buildchain-contract.js",
-      "digest": "sha256:415c04c33c1ba957420866943603f2b642751386cf55ac650d86884cad1842a1",
+      "digest": "sha256:79a3b4109777e3e13ac936a04e09e2d71fd8f93f50544ead4d51ed41f3fdf3e8",
       "summary": "Runtime contract world and compatibility digest APIs for floating-ref drift checks.",
       "capabilityGroup": "governance-versioning",
       "audience": [
@@ -385,7 +424,7 @@
       "specifier": "@kungfu-tech/buildchain/buildchain-publication-authority",
       "export": "./buildchain-publication-authority",
       "target": "./packages/core/buildchain-publication-authority.js",
-      "digest": "sha256:ae2d9310b0276c21715020d7cb43ea180e555740ac8ef1c073a88206d2f74b39",
+      "digest": "sha256:0e5db6d66ed48d5eb57be1e4f1c3de92a2fc4c72a70b5764df6b21f78026a731",
       "summary": "Buildchain-owned closed-world publication authority descriptor registry.",
       "capabilityGroup": "release-passport-trust",
       "audience": [
@@ -398,7 +437,7 @@
       "specifier": "@kungfu-tech/buildchain/github-governance-authority",
       "export": "./github-governance-authority",
       "target": "./packages/core/github-governance-authority.js",
-      "digest": "sha256:68f1bca0873f715f4909994c81a97bdc0559879972b1f2026d4e5bbdaf304251",
+      "digest": "sha256:548c64ca8f23945cdbdd6c06bc6ed85854a46ea308c490376a8736677d7c1936",
       "summary": "Fail-closed GitHub ownership, effective-policy, managed-zone admission, rollout-plan, and immutable receipt APIs.",
       "capabilityGroup": "governance-versioning",
       "audience": [