@kungfu-tech/buildchain 3.0.2-alpha.7 → 3.0.2-alpha.9

package/dist/site/public-surface-audit.json

@@ -4,7 +4,7 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 97,
-    "workflowCount": 55,
+    "workflowCount": 57,
     "actionCount": 6,
     "sitePageCount": 59,
     "docCommandRefCount": 291,
@@ -507,6 +507,7 @@
           "adapter-path",
           "artifact-retention-days",
           "buildchain-repository",
+          "media-profile",
           "render-media",
           "renderer-image",
           "require-trusted-event",
@@ -514,7 +515,7 @@
           "source-artifact-name",
           "source-ref"
         ],
-        "inputCount": 9,
+        "inputCount": 10,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
@@ -527,10 +528,12 @@
           "media-artifact-id",
           "media-artifact-name",
           "media-artifact-url",
+          "media-profile",
+          "media-qualification-root",
           "media-root",
           "source-sha"
         ],
-        "outputCount": 11
+        "outputCount": 13
       },
       {
         "id": ".binary-release-assets",
@@ -646,9 +649,10 @@
           "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
           "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
           "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+          "BUILDCHAIN_PROMOTION_TOKEN"
         ],
-        "secretCount": 8,
+        "secretCount": 9,
         "outputs": [
           "artifact-coordinates-json",
           "build-diagnostics-summary-artifact",
@@ -1300,6 +1304,28 @@
         "outputs": [],
         "outputCount": 0
       },
+      {
+        "id": "artifact-signing-authority",
+        "path": ".github/workflows/artifact-signing-authority.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "auditable-demo-media-profile-qualification",
+        "path": ".github/workflows/auditable-demo-media-profile-qualification.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
       {
         "id": "binary-distribution",
         "path": ".github/workflows/binary-distribution.yml",
@@ -1423,9 +1449,10 @@
           "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
           "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
           "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+          "BUILDCHAIN_PROMOTION_TOKEN"
         ],
-        "secretCount": 8,
+        "secretCount": 9,
         "outputs": [
           "artifact-coordinates-json",
           "build-diagnostics-summary-artifact",
@@ -1638,11 +1665,12 @@
           "dev-workflow-path",
           "dry-run",
           "max-age-seconds",
+          "pull-request-body-prefix",
           "settlement-authorized",
           "source-branch",
           "target-branch"
         ],
-        "inputCount": 10,
+        "inputCount": 11,
         "secrets": [
           "promotion-token"
         ],
@@ -4232,8 +4260,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "0be723caa314a36a1a36b03522527eb5b13e9b741e6566ff7f6ee06958df02ca",
-    "workflowRegistryDigest": "18405fac6ddfebd647c2ba7d3927ec666e6d43dc1913043b0334c91e2bf143f1",
-    "pageRegistryDigest": "b453877a28760e2446d5b58ee2bcbb3edd1059731a4046166ce1a4fc6649624b"
+    "workflowRegistryDigest": "01792ad09bcdcd3c12d018e6ee9613a09b5a1b87525d6f643a18f963f0d973a1",
+    "pageRegistryDigest": "56583b14046754bc0c02c512602c4e1c4e9ecdf68e6e639fcab8d550c3e082b4"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -167,6 +167,19 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/artifact-signing-authority.yml",
+      "authorityClass": "evidence-publication",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/artifact-signing-authority.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/binary-distribution.yml",
       "authorityClass": "evidence-publication",
@@ -677,6 +690,18 @@
       ],
       "classified": true
     },
+    {
+      "path": ".github/workflows/artifact-signing-authority.yml",
+      "signals": [
+        "environment"
+      ],
+      "classified": true
+    },
+    {
+      "path": ".github/workflows/auditable-demo-media-profile-qualification.yml",
+      "signals": [],
+      "classified": false
+    },
     {
       "path": ".github/workflows/binary-distribution.yml",
       "signals": [
@@ -933,5 +958,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "26c309e610d1d8885cfd7d78fb7a574be903bf9085d5db929f9b41005c4f682b"
+  "registryDigest": "0f4705fb7b2afcb72e9136dac44eac7fc47d9440330aa3c72a8ae8bd8f3339c3"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-27T12:02:17.639Z",
-  "publishedAt": "2026-07-27T12:02:17.639Z",
+  "generatedAt": "2026-07-28T14:38:17.137Z",
+  "publishedAt": "2026-07-28T14:38:17.137Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "c0ccc4b25d65ad0e007e36d8545dfdf06853bb89",
+  "sourceRevision": "b609f2cf8e7ab3e98685c434add4913d5220f509",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.2-alpha.7",
+    "version": "3.0.2-alpha.9",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -15,6 +15,9 @@
       "./artifact-passport": "./packages/core/artifact-passport.js",
       "./artifact-verification-envelope": "./packages/core/artifact-verification-envelope.js",
       "./github-artifact-attestation": "./packages/core/github-artifact-attestation.js",
+      "./artifact-signing": "./packages/core/artifact-signing.js",
+      "./artifact-signing-result": "./packages/core/artifact-signing-result.js",
+      "./detached-artifact-signature": "./packages/core/detached-artifact-signature.js",
       "./anchored-version-material": "./packages/core/anchored-version-material.js",
       "./buildchain-contract": "./packages/core/buildchain-contract.js",
       "./candidate-timeline": "./packages/core/candidate-timeline.js",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-27T12:02:17.639Z",
-  "publishedAt": "2026-07-27T12:02:17.639Z",
+  "generatedAt": "2026-07-28T14:38:17.137Z",
+  "publishedAt": "2026-07-28T14:38:17.137Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "c0ccc4b25d65ad0e007e36d8545dfdf06853bb89",
+  "sourceRevision": "b609f2cf8e7ab3e98685c434add4913d5220f509",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.2-alpha.7",
+    "version": "3.0.2-alpha.9",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:23158252e5d2bd09b9b54dc08a0a452562e4b3a6ec3861b991632a34199d9820"
+      "digest": "sha256:cc32692e8d04816e8de94f208e43c2d5c5c7a8425cec8b32edc73ab78591fbbf"
     },
     {
       "id": "auditable-demo",
@@ -61,7 +61,7 @@
       "path": "docs/auditable-demo.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:cff9786d4de098c84ea7e494b523627d6431909f15c82940e2193dbda1ef10e9"
+      "digest": "sha256:0e8cf2162c2e1f83cfe3a6171e3055f494cab5f03fdcbec3854e1793678e6908"
     },
     {
       "id": "install",
@@ -85,7 +85,7 @@
       "path": "docs/github-artifact-attestation.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:afdb8172bc41b9a20c0d18f4ddcc55ee287ac56db05e67e55d12de1843b724e1"
+      "digest": "sha256:51f28b0b01fae4e3f80a7433f6c491d0c795bd091bff64ca1264c5cc0819c545"
     },
     {
       "id": "controller-evidence",
@@ -253,7 +253,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:5d46d0f5e6e03541c187ffea154dcce703ef78e59d16bd0e4fa7c175da940480"
+      "digest": "sha256:ea36ec722f811f5156735aa7471ed080cdc7e87d71c20c300243b226e233e675"
     },
     {
       "id": "publish-transaction",
@@ -269,7 +269,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:a77c2bb1d2245e1ee2318f650ad64ada6c8cdd3292a62a028e3ccc7517fb4e12"
+      "digest": "sha256:42a45f51db7ea11658431718835e1a430959db2a5cc80fc4651681502fe6fb7c"
     },
     {
       "id": "release-flow",
@@ -285,7 +285,7 @@
       "path": "docs/runtime-train-validation.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:1315fe264d0e22215183122fc05e287be974751a78268642076898b689e435e6"
+      "digest": "sha256:c9ebf451294f92a2be3aa2ac4b2ec7afb3cc17bbeae2ece7879b800c0f274a40"
     },
     {
       "id": "versioning",
@@ -293,7 +293,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:f3665f2f173bdcb287cf8aa509035164e818b20088849f4a2bce098951c84ea3"
+      "digest": "sha256:4b40cb8675c111b7588297102a61cb241630f2b707a67a0384a6df7527b2c64c"
     },
     {
       "id": "web-surface-deployments",

package/dist/site/workflow-registry.json

@@ -11,6 +11,7 @@
         "adapter-path",
         "artifact-retention-days",
         "buildchain-repository",
+        "media-profile",
         "render-media",
         "renderer-image",
         "require-trusted-event",
@@ -18,7 +19,7 @@
         "source-artifact-name",
         "source-ref"
       ],
-      "inputCount": 9,
+      "inputCount": 10,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -31,10 +32,12 @@
         "media-artifact-id",
         "media-artifact-name",
         "media-artifact-url",
+        "media-profile",
+        "media-qualification-root",
         "media-root",
         "source-sha"
       ],
-      "outputCount": 11,
+      "outputCount": 13,
       "surface": "auditable-demo",
       "capabilityGroup": "api-cli-reference",
       "status": "preview"
@@ -156,9 +159,10 @@
         "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
         "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN"
       ],
-      "secretCount": 8,
+      "secretCount": 9,
       "outputs": [
         "artifact-coordinates-json",
         "build-diagnostics-summary-artifact",
@@ -858,6 +862,34 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": "artifact-signing-authority",
+      "path": ".github/workflows/artifact-signing-authority.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
+    {
+      "id": "auditable-demo-media-profile-qualification",
+      "path": ".github/workflows/auditable-demo-media-profile-qualification.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": "binary-distribution",
       "path": ".github/workflows/binary-distribution.yml",
@@ -990,9 +1022,10 @@
         "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
         "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+        "BUILDCHAIN_PROMOTION_TOKEN"
       ],
-      "secretCount": 8,
+      "secretCount": 9,
       "outputs": [
         "artifact-coordinates-json",
         "build-diagnostics-summary-artifact",
@@ -1238,11 +1271,12 @@
         "dev-workflow-path",
         "dry-run",
         "max-age-seconds",
+        "pull-request-body-prefix",
         "settlement-authorized",
         "source-branch",
         "target-branch"
       ],
-      "inputCount": 10,
+      "inputCount": 11,
       "secrets": [
         "promotion-token"
       ],

package/docs/MAP.md

@@ -43,6 +43,7 @@ workflow, action, and Node API export also carries a `capabilityGroup`,
 | KFD-1 / KFD-2 / KFD-3 release-passport gates | `dist/site/kfd-claims.json`, `dist/site/buildchain-contract.json`, `dist/site/artifact-schemas.json` | [`release-passport.md`](release-passport.md) |
 | Product invariant Passport release gate | `buildchain.release.json#invariantPassports`, `dist/site/buildchain-contract.json` | [`release-passport.md`](release-passport.md) |
 | GitHub keyless Linux artifact attestation | `buildchain.release.json#githubArtifactAttestations`, `dist/site/workflow-registry.json`, `dist/site/artifact-schemas.json` | [`github-artifact-attestation.md`](github-artifact-attestation.md) |
+| Declarative cross-platform artifact signing | `kungfu-buildchain-artifact-signing-request/v1`, `kungfu-buildchain-artifact-signing-result/v1` | [`reusable-build-surface.md`](reusable-build-surface.md#artifact-signing-authority) |
 | KFD-3 public surface reverse audit | `dist/site/public-surface-audit.json`, `dist/site/cli-registry.json`, `dist/site/workflow-registry.json`, `dist/site/page-registry.json` | [`cli.md`](cli.md), [`site-bundle-contract.md`](site-bundle-contract.md) |
 | KFD-1 / KFD-2 / KFD-3 first-class CLI and Node API | `.buildchain/kfd/kfd-3/surfaces.json`, `dist/site/kfd-claims.json`, `buildchain.release.json`, KFD schemas from `@kungfu-tech/kfd` | [`kfd-support.md`](kfd-support.md), [`cli.md`](cli.md#commands) |
 | Declarative KFD Agent Hub adapter conformance and Passport evidence | `.buildchain/kfd/agent-hub.json`, `.buildchain/artifacts/kfd-agent-hub/evidence.json`, `buildchain.release.json#kfdAgentHub` | [`kfd-agent-hub.md`](kfd-agent-hub.md) |
@@ -87,6 +88,7 @@ replace them.
 | How do I collect and verify module/product build facts from Git source, version files, and outputs? | [`build-facts.md`](build-facts.md) + [`cli.md`](cli.md) | use/verify | stable |
 | How do I publish or verify release passport artifacts? | [`release-passport.md`](release-passport.md) | use | stable |
 | How do I keylessly attest Linux release artifacts with GitHub and bind them to a Release Passport? | [`github-artifact-attestation.md`](github-artifact-attestation.md) | verify/use | preview |
+| How do I request detached, Developer ID, or Authenticode signing without consumer credentials? | [`reusable-build-surface.md`](reusable-build-surface.md#artifact-signing-authority) | verify/use | preview |
 | How do I seal exact artifact, identity, lifecycle, and KFD assessment roots for KFX admission? | [`artifact-verification-envelope.md`](artifact-verification-envelope.md) | verify/use | preview |
 | How is product publication authority sealed to an exact workflow, runner, control plane, nonce, and artifact? | [`publication-authority.md`](publication-authority.md) | verify | preview |
 | How are GitHub ownership, independent review, effective protection, and plan capability audited fail-closed? | [`github-governance-authority.md`](github-governance-authority.md) | verify | preview |

package/docs/auditable-demo.md

@@ -8,7 +8,7 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-07-25
+last_reviewed: 2026-07-28
 ai_provenance:
   model_family: GPT-5
   product: Codex
@@ -100,8 +100,53 @@ the exact source SHA and renderer digest, and only then renders the complete
 qualified scene.
 
 The media bundle contains MP4, WebM, GIF, poster, probe, renderer manifest,
-renderer checksums, passed Gate receipt, media receipt, and distribution
-checksums. `render-media: false` does not weaken or skip the Gate.
+renderer checksums, passed Gate receipt, a versioned media receipt, and
+distribution checksums. A web-delivery profile also retains
+`media-inspection.json`, whose content root is bound into the receipt.
+`render-media: false` does not weaken or skip the Gate.
+
+## Media Qualification Profiles
+
+The single machine-readable source is
+`contracts/auditable-demo-media-profiles-v1.json`. Callers select one reviewed
+profile through `media-profile`; they cannot pass ffmpeg commands, codec flags,
+shell fragments, arbitrary profile paths, or transcoding instructions.
+
+| Profile | Meaning |
+| --- | --- |
+| `archive-v1` | Default compatibility contract. Retains the exact renderer outputs and classifies GIF as README compatibility evidence without making a browser-delivery claim. |
+| `web-delivery-v1` | Independently qualifies H.264 MP4 and VP9 WebM playback sources, forbids audio, requires exact scene dimensions and bounded duration/frame-rate drift, checks per-rendition byte ceilings, and proves MP4 `moov` precedes `mdat`. PNG remains the lossless evidence poster. |
+| `site-hero-v1` | Extends `web-delivery-v1` and additionally requires a qualified WebP browser poster. The current Build Images v1 renderer does not emit that member, so selecting this profile fails closed until the producer adds it. |
+
+For web-delivery profiles, Buildchain runs its own fixed `ffprobe` invocation
+inside the same immutable, network-disabled renderer image. That command is
+Buildchain-controlled; the producer cannot inject flags. The resulting witness
+records exact roots and byte counts plus container, codec, pixel format,
+dimensions, duration, frame rate, audio stream count, and progressive-download
+evidence. Finalization re-hashes the retained bytes, rechecks the witness root,
+and parses MP4 top-level boxes itself. The producer's `media-probe.json.passed`
+field remains supporting evidence, never sufficient authority.
+
+The default `archive-v1` path preserves the existing v1 media receipt exactly.
+An explicitly selected web-delivery profile emits a v2 media receipt with a
+content-addressed rendition list and explicit roles and MIME types. Agents and
+site builds select `primary-video`,
+`alternate-video`, `browser-poster`, or evidence-only roles from that receipt;
+they do not infer semantics from extensions or filenames. Additional responsive
+renditions are accepted only when the immutable renderer manifest declares the
+bounded `build-images.auditable-demo-web-delivery/v1` role and MIME metadata and
+the selected Buildchain profile supplies the byte ceiling; producer metadata
+cannot raise that ceiling. Unbound outputs,
+duplicate singleton roles, unknown profiles, or unsupported required versions
+fail closed.
+
+Initial byte ceilings are derived from the checked-in
+`auditable-demo-web-delivery-v1` fixture rendered by Build Images
+`v1.3.0-alpha.16` at its exact source SHA and image digest. GIF, MP4, WebM, and
+PNG ceilings are the next power of two above sixteen times the measured member
+bytes. The not-yet-produced WebP poster uses eight times the measured lossless
+PNG as its conservative proxy. The path-scoped qualification workflow
+regenerates the content-addressed evidence and fails on any byte or fact drift.
 
 ## Consumer Example
 
@@ -140,12 +185,19 @@ jobs:
       adapter-path: scripts/auditable-demo-adapter
       renderer-image: ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:RENDERER_DIGEST
       render-media: false
+      media-profile: archive-v1
 ```
 
 Replace both placeholders with reviewed immutable SHAs or digests. An eligible
 build should always call the reusable workflow. Selection policy changes only
 `render-media`; it must never condition away the Gate job.
 
+Use `web-delivery-v1` only when the rendered bundle is intended to become a
+qualified web-delivery source. Use `site-hero-v1` when an optimized browser
+poster is also required. Profile qualification does not prove browser playback,
+responsive layout, reduced-motion behavior, accessibility, or production
+deployment; those remain site responsibilities.
+
 ## Failure Evidence
 
 Gate and render jobs use bounded timeouts and non-cancelling concurrency.

package/docs/dev-alpha-candidate-patrol.md

@@ -76,6 +76,15 @@ exact same-SHA evidence, it may set `settlement-authorized: true` and
 `dry-run: false`. The older `create-pull-request` input remains a compatibility
 alias for settlement authorization.
 
+Repositories whose promotion policy requires a machine-readable PR declaration
+can pass it through `pull-request-body-prefix`. Buildchain prepends that trusted,
+repository-owned text only when it creates the candidate PR and preserves it
+when later controller observations update the managed state marker. Keep the
+declaration source-controlled in the caller workflow and update it whenever the
+qualified development delta changes its release or architecture settlement.
+Buildchain rejects a prefix that attempts to inject its managed controller
+marker.
+
 The separately permissioned `settle` job re-runs the exact observation before
 any write. With no active managed candidate, it creates one branch named from
 the target branch and the first 12 characters of the full source SHA. An

package/docs/github-artifact-attestation.md

@@ -198,7 +198,7 @@ created the build and release evidence.
 
 ```bash
 buildchain verify github-artifact-attestation \
-  --artifact libnode-linux-x64.tar.gz \
+  libnode-linux-x64.tar.gz \
   --platform-manifest manifest.json \
   --release-passport buildchain.release.json \
   --bundle attestation.sigstore.json \

package/docs/release-governance.md

@@ -1,3 +1,21 @@
+---
+status: draft
+period: ongoing
+theme: buildchain-release-governance
+doc_type: technical-reference
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: unreviewed
+last_reviewed: 2026-07-27
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-07-27
+  invisible_context: not asserted
+---
+
 # Release Governance
 
 Buildchain v2 preserves the release semantics of the older ABV workflow while
@@ -235,6 +253,20 @@ declared install, build, and verify fixture, proving that a single consumer
 surface routes to distinct released runtimes without duplicating lifecycle
 configuration in the consumer.
 
+Buildchain's generic artifact-signing contract seals source-, tree-, runtime-,
+platform-, and digest-bound requests from ordinary credential-free build jobs.
+Provider-specific authority jobs consume only those sealed payloads. Apple
+Developer ID, Windows Authenticode, and detached cryptographic signatures share
+the request/receipt model, while each profile retains its honest platform
+semantics and fail-closed verification requirements.
+
+The central `buildchain-artifact-signing` environment reuses the established
+macOS Credential Island names (`BUILDCHAIN_MACOS_CERTIFICATE_*`,
+`BUILDCHAIN_MACOS_NOTARY_API_*`, and
+`BUILDCHAIN_MACOS_EXPECTED_TEAM_ID`). Those authority-only values are never
+declared by or forwarded through a consumer repository. Windows and detached
+providers follow the same central-environment boundary.
+
 The reusable build trust gate reads `job.workflow_ref`, which identifies the
 called workflow and its selected ref. It does not infer the runtime from
 `github.workflow_ref`, because GitHub defines that context as the caller