@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.1

package/docs/versioning.md

@@ -1,3 +1,21 @@
+---
+status: draft
+period: ongoing
+theme: buildchain-versioning
+doc_type: policy
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: unreviewed
+last_reviewed: 2026-07-31
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-07-30
+  invisible_context_boundary: Live release and provider state must be verified independently.
+---
+
 # Buildchain Versioning
 
 Buildchain uses semantic version lines to describe public contracts, not only
@@ -7,15 +25,15 @@ on.
 
 ## Lines
 
-| Line | Meaning |
-| --- | --- |
-| Patch | Compatible fix, hardening, documentation correction, or implementation repair inside an existing surface. |
+| Line  | Meaning                                                                                                                                                                      |
+| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Patch | Compatible fix, hardening, documentation correction, or implementation repair inside an existing surface.                                                                    |
 | Minor | New compatible welded surface: reusable workflow output, CLI command family, config protocol, published subpath, evidence file, runner contract, or agent-readable artifact. |
-| Major | Breaking semantic change, removed stable surface, changed branch/tag governance, or incompatible protocol rewrite. |
+| Major | Breaking semantic change, removed stable surface, changed branch/tag governance, or incompatible protocol rewrite.                                                           |
 
-Kungfu minor lines are long-lived trains. `v2.0`, `v2.1`, and `v2.2` can each
-receive many patch releases. The major ref, such as `v2`, points at the
-selected stable major entrypoint; the minor ref, such as `v2.2`, points at the
+Kungfu minor lines are long-lived trains. `v3.0`, `v3.1`, and `v3.2` can each
+receive many patch releases. The major ref, such as `v3`, points at the
+selected stable major entrypoint; the minor ref, such as `v3.2`, points at the
 latest stable production patch for that minor line.
 
 ## Welded Surfaces
@@ -59,23 +77,27 @@ repository changes are patch".
 
 ## Decision Log
 
-| Date | Action | Line | Faces | Class | Rationale | PR |
-| --- | --- | --- | --- | --- | --- | --- |
-| 2026-07-28 | extend-minor | `v3.0` | auditable-demo-workflow, auditable-demo-media-profile, auditable-demo-media-receipt | additive | Add opt-in archive, web-delivery, and site-hero profiles; independently bind codec, container, audio, layout, byte-budget, role, and fast-start facts into a v2 media receipt while preserving the existing archive default. | |
-| 2026-07-26 | extend-minor | `v3.0` | auditable-demo-workflow, auditable-demo-evidence | additive | Forward-port the consumer-neutral reusable Gate that binds exact same-run GitHub Artifacts to checked-in adapters and immutable renderer evidence, with optional media rendering only from the exact passing Gate bundle. | #1862 |
-| 2026-07-23 | extend-minor | `v2.14` | credential-island-macos-input, protected-signer-job, macos-signing-evidence, action-subpaths | additive | The reusable build surface can seal an exact source-bound macOS app and hand it to a protected caller environment, where an immutable Buildchain action signs, notarizes, staples, Gatekeeper-assesses, and returns an auditable additional release-candidate platform without exposing credentials to consumer lifecycle jobs. | |
-| 2026-07-20 | extend-minor | `v2.14` | anchored-derived-version-material, build-controller-evidence, release-passport, package-subpaths, release-propagation-controller | additive | Anchored/manual consumers can declare derived version witnesses that Buildchain regenerates and verifies before heavy builds, binds to exact alpha/release trees and passports, and admits during protected promotion; propagation receipts now model their existing optional consumer stages. | |
-| 2026-07-17 | extend-minor | `v2.14` | merge-queue-config, release-line-governance-inheritance | additive | Buildchain config can explicitly enable, inherit, or disable exact dev-channel merge queues, and release-line bootstrap reconciles the declared or inherited policy before moving the repository default branch. | |
-| 2026-07-16 | open-minor | `v2.14` | dev-merge-queue-governance | additive | The public CLI adds a dry-run-first, idempotent merge-queue governance command that verifies required workflow event compatibility before applying an exact dev-channel ruleset and removing the strict up-to-date race. | |
-| 2026-07-15 | open-minor | `v2.13` | artifact-verification-envelope, package-subpaths | additive | The public envelope seals exact artifact, provenance, identity, lifecycle, revocation, and existing KFD assessment roots into one consumer-ready KFX admission input, with a dedicated Node API export and fail-closed verifier. | |
-| 2026-07-11 | open-minor | `v2.12` | channel-build-router, channel-selection-protocol | additive | The public `build.yml` reusable workflow lets consumers declare one build job while Buildchain selects generic major alpha for development/prerelease intent and stable major for production release intent, with explicit overrides, separate locks, and fail-closed ambiguity handling. | |
-| 2026-07-08 | open-minor | `v2.9` | build-facts-contract | additive | Build Facts add a public CLI command family, Node API export, config protocol, module/product fact contracts, release-passport evidence section, and Kungfu legacy buildinfo projection from the same source facts. | |
-| 2026-07-06 | open-minor | `v2.8` | kfd-1-contract-world-release-gate, kfd-2-release-trust-passport-audit, kfd-3-collaboration-interface-trust-proof, publish-source-lock-enforcement, required-check-protection | additive | KFD release gates add KFD-1 self contract verification, KFD-2 public release trust claim audit, KFD-3 collaboration-interface trust proofs, publish-side source-lock enforcement for promote-only wrappers, and protected channel required checks repaired to bind GitHub Actions check runs instead of legacy commit status contexts. | |
-| 2026-07-04 | open-minor | `v2.5` | scheduled-integration-governance | additive | Scheduled integration governance adds scheduled feature-branch discovery, conflict-free integration, reporting, and agent-visible governance automation for dev-line maintenance. | |
-| 2026-07-03 | open-minor | `v2.4` | infra-contract-lifecycle | additive | Infra contract lifecycle adds the provider-neutral `infra-contract` CLI command family, project type, adapter capability contract, lifecycle evidence bundle, propagation evidence, CI evidence mode, and consumer-facing contract artifacts. | |
-| 2026-07-02 | open-minor | `v2.3` | web-surface-host-mapping | additive | Web surface host mapping adds first-class multi-host surface bindings, reusable workflow URL outputs, per-surface deployment overrides, and an agent-readable fixture contract. | |
-| 2026-07-02 | open-minor | `v2.2` | release-passport, binary-distribution | additive | Release passport and binary distribution add agent-readable release passport files, artifact evidence, impact ledger, agent index, GitHub Release collection and verification commands, and standalone binary assets. | |
-| 2026-07-02 | open-minor | `v2.1` | logging-sdk, cli-observability, package-subpaths | additive | Buildchain toolkit observability adds the public logging SDK, CLI observability commands, and package subpaths that consumers can import. | |
+| Date       | Action       | Line    | Faces                                                                                                                                                                        | Class    | Rationale                                                                                                                                                                                                                                                                                                                              | PR    |
+| ---------- | ------------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
+| 2026-07-31 | extend-minor | `v3.0`  | auditable-demo-workflow, auditable-demo-media-profile, auditable-demo-media-receipt                                                                                          | additive | Add an opt-in responsive profile that binds source-resolution and exact 1280x720 MP4/WebM/GIF renditions to one Gate and receipt while rejecting upscales, aspect-ratio drift, and profile changes between Gate-only and full-render paths.                                                                                              |       |
+| 2026-07-31 | extend-minor | `v3.0`  | release-candidate-family-evidence, release-passport-evidence-attachment, promotion-action, release-passport-cli                                                             | additive | Restore all-ref v2 parity for optional Initiative-family candidate binding and typed product-owned release evidence attachments while retaining Kungfu native Family State authority and the newer v3 post-activation released-evidence stage.                                                                                         | #2089 |
+| 2026-07-30 | extend-minor | `v3.0`  | reusable-build-workflow, observed-evidence-bundle, release-passport-json-reader, web-surface-release-governance                                                               | additive | Add bounded artifact compression and remote-read controls plus transactional derived evidence projections while repairing release-PR runtime handoff so production remains protected-main-only.                                                                                                                                       |       |
+| 2026-07-29 | extend-minor | `v3.0`  | artifact-signing-config, apple-developer-id-authority, artifact-signing-evidence                                                                                             | additive | Extend the consumer-neutral signing declaration to macOS compound archives, including nested wheel Mach-O signing, PEP 427 RECORD repair, safe archive reconstruction, and whole-product notarization under the same protected authority.                                                                                              |       |
+| 2026-07-28 | extend-minor | `v3.0`  | auditable-demo-workflow, auditable-demo-media-profile, auditable-demo-media-receipt                                                                                          | additive | Add opt-in archive, web-delivery, and site-hero profiles; independently bind codec, container, audio, layout, byte-budget, role, and fast-start facts into a v2 media receipt while preserving the existing archive default.                                                                                                           |       |
+| 2026-07-26 | extend-minor | `v3.0`  | auditable-demo-workflow, auditable-demo-evidence                                                                                                                             | additive | Forward-port the consumer-neutral reusable Gate that binds exact same-run GitHub Artifacts to checked-in adapters and immutable renderer evidence, with optional media rendering only from the exact passing Gate bundle.                                                                                                              | #1862 |
+| 2026-07-23 | extend-minor | `v2.14` | credential-island-macos-input, protected-signer-job, macos-signing-evidence, action-subpaths                                                                                 | additive | The reusable build surface can seal an exact source-bound macOS app and hand it to a protected caller environment, where an immutable Buildchain action signs, notarizes, staples, Gatekeeper-assesses, and returns an auditable additional release-candidate platform without exposing credentials to consumer lifecycle jobs.        |       |
+| 2026-07-20 | extend-minor | `v2.14` | anchored-derived-version-material, build-controller-evidence, release-passport, package-subpaths, release-propagation-controller                                             | additive | Anchored/manual consumers can declare derived version witnesses that Buildchain regenerates and verifies before heavy builds, binds to exact alpha/release trees and passports, and admits during protected promotion; propagation receipts now model their existing optional consumer stages.                                         |       |
+| 2026-07-17 | extend-minor | `v2.14` | merge-queue-config, release-line-governance-inheritance                                                                                                                      | additive | Buildchain config can explicitly enable, inherit, or disable exact dev-channel merge queues, and release-line bootstrap reconciles the declared or inherited policy before moving the repository default branch.                                                                                                                       |       |
+| 2026-07-16 | open-minor   | `v2.14` | dev-merge-queue-governance                                                                                                                                                   | additive | The public CLI adds a dry-run-first, idempotent merge-queue governance command that verifies required workflow event compatibility before applying an exact dev-channel ruleset and removing the strict up-to-date race.                                                                                                               |       |
+| 2026-07-15 | open-minor   | `v2.13` | artifact-verification-envelope, package-subpaths                                                                                                                             | additive | The public envelope seals exact artifact, provenance, identity, lifecycle, revocation, and existing KFD assessment roots into one consumer-ready KFX admission input, with a dedicated Node API export and fail-closed verifier.                                                                                                       |       |
+| 2026-07-11 | open-minor   | `v2.12` | channel-build-router, channel-selection-protocol                                                                                                                             | additive | The public `build.yml` reusable workflow lets consumers declare one build job while Buildchain selects generic major alpha for development/prerelease intent and stable major for production release intent, with explicit overrides, separate locks, and fail-closed ambiguity handling.                                              |       |
+| 2026-07-08 | open-minor   | `v2.9`  | build-facts-contract                                                                                                                                                         | additive | Build Facts add a public CLI command family, Node API export, config protocol, module/product fact contracts, release-passport evidence section, and Kungfu legacy buildinfo projection from the same source facts.                                                                                                                    |       |
+| 2026-07-06 | open-minor   | `v2.8`  | kfd-1-contract-world-release-gate, kfd-2-release-trust-passport-audit, kfd-3-collaboration-interface-trust-proof, publish-source-lock-enforcement, required-check-protection | additive | KFD release gates add KFD-1 self contract verification, KFD-2 public release trust claim audit, KFD-3 collaboration-interface trust proofs, publish-side source-lock enforcement for promote-only wrappers, and protected channel required checks repaired to bind GitHub Actions check runs instead of legacy commit status contexts. |       |
+| 2026-07-04 | open-minor   | `v2.5`  | scheduled-integration-governance                                                                                                                                             | additive | Scheduled integration governance adds scheduled feature-branch discovery, conflict-free integration, reporting, and agent-visible governance automation for dev-line maintenance.                                                                                                                                                      |       |
+| 2026-07-03 | open-minor   | `v2.4`  | infra-contract-lifecycle                                                                                                                                                     | additive | Infra contract lifecycle adds the provider-neutral `infra-contract` CLI command family, project type, adapter capability contract, lifecycle evidence bundle, propagation evidence, CI evidence mode, and consumer-facing contract artifacts.                                                                                          |       |
+| 2026-07-02 | open-minor   | `v2.3`  | web-surface-host-mapping                                                                                                                                                     | additive | Web surface host mapping adds first-class multi-host surface bindings, reusable workflow URL outputs, per-surface deployment overrides, and an agent-readable fixture contract.                                                                                                                                                        |       |
+| 2026-07-02 | open-minor   | `v2.2`  | release-passport, binary-distribution                                                                                                                                        | additive | Release passport and binary distribution add agent-readable release passport files, artifact evidence, impact ledger, agent index, GitHub Release collection and verification commands, and standalone binary assets.                                                                                                                  |       |
+| 2026-07-02 | open-minor   | `v2.1`  | logging-sdk, cli-observability, package-subpaths                                                                                                                             | additive | Buildchain toolkit observability adds the public logging SDK, CLI observability commands, and package subpaths that consumers can import.                                                                                                                                                                                              |       |
 
 ## Runner Policy
 

package/docs/web-surface-deployments.md

@@ -1,3 +1,21 @@
+---
+status: draft
+period: ongoing
+theme: web-surface-deployments
+doc_type: contract
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: unreviewed
+last_reviewed: 2026-07-30
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-07-30
+  invisible_context_boundary: No credentials, private logs, or unpublished deployment values are included.
+---
+
 # Web-Surface Deployment Contract
 
 Buildchain supports `project.type = "web-surface"` for repositories that publish
@@ -441,6 +459,68 @@ the owning and parent surface syncs carried their required delete exclusions.
 The runner must provide an AWS CLI version whose `s3 sync` supports
 `--no-overwrite`.
 
+### Qualified publication package-pin fast path
+
+A consumer may narrow one deployment to the exact paper version introduced by
+a package-pin-only PR. The artifact root `manifest.json` must carry a
+consumer-owned qualification envelope:
+
+```json
+{
+  "publicationFastPath": {
+    "contract": "kungfu-buildchain-publication-package-pin-fast-path",
+    "mode": "package-pin-only",
+    "targetSurface": "papers",
+    "qualificationRoot": "sha256:...",
+    "immutablePrefixes": [
+      "archive/observer-declared-timelines/v0.1.0-alpha.10"
+    ],
+    "mutableFiles": [
+      "archive/index.html",
+      "index.html",
+      "manifest.json",
+      "observer-declared-timelines/index.html",
+      "observer-declared-timelines/latest/index.html",
+      "registry.json"
+    ],
+    "invalidationPaths": [
+      "/",
+      "/archive/",
+      "/archive/observer-declared-timelines/v0.1.0-alpha.10*",
+      "/observer-declared-timelines/",
+      "/observer-declared-timelines/latest/",
+      "/manifest.json",
+      "/registry.json"
+    ]
+  }
+}
+```
+
+Buildchain validates that the target surface exists, every immutable prefix is
+declared by that surface's archive manifest, every mutable file exists outside
+those prefixes, and the qualification root is exact. A qualified plan:
+
+- selects only `targetSurface`;
+- verifies/uploads only the declared immutable prefixes with the normal
+  no-overwrite digest safeguards;
+- copies only the declared mutable files;
+- skips full `sync --delete` and directory-index alias writes;
+- invalidates only the declared viewer paths plus the deployment manifest.
+
+Any missing, malformed, or unqualified envelope keeps the normal full-surface
+plan. The fast path narrows bytes; it does not weaken channel controls.
+`package-published`, `alpha-complete`, `staging-visible`, and
+`production-visible` remain separate facts, and a package qualification never
+authorizes production by itself.
+
+Publication manifests may retain release history without rematerializing every
+historical package into the current site artifact. When at least one version
+declares `immutableIndex`, Buildchain treats that field as the materialization
+envelope: all declared version prefixes remain protected from deletion, while
+only prefixes with `immutableIndex` must exist locally and are eligible for
+upload. Manifests without the envelope retain the legacy rule that every
+declared prefix must exist.
+
 For multi-surface sites, each surface host is treated as a root-relative view
 of that surface's artifact path prefix. For example, a `buildchain` surface with
 `path = "/buildchain/"` and preview URL
@@ -680,8 +760,9 @@ The reusable workflow maps GitHub events to Buildchain web-surface semantics:
 | --- | --- |
 | `pull_request` opened / synchronized / reopened | validate, build, verify, and plan `preview` for `pr-N` |
 | `pull_request` closed | plan apply-mode cleanup for the `pr-N` preview alias and manifest |
+| `pull_request` closed for a matching release PR | verify the release intent and exact workflow-shell runtime, then wait for the protected `main` push; do not plan or apply production from `refs/pull/*/merge` |
 | `push` to `main` | validate, build, verify, plan and apply `staging` from the merged `main` SHA, then optionally open a production release PR |
-| `push` to `main` from a matching release PR merge | validate the associated release PR, plan `production`, and enter the configured GitHub Environment gate |
+| `push` to `main` from a matching release PR merge | validate the associated release PR, plan `production`, and enter the configured GitHub Environment gate from the protected mainline ref |
 | `workflow_dispatch` with `production-approved = true` | plan `production` and enter the configured GitHub Environment gate |
 
 The optional `buildchain-ref` input is empty by default. Empty keeps the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.2",
+  "version": "3.0.3-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",
@@ -41,6 +41,9 @@
     "./portable-dev-cache": "./packages/core/portable-dev-cache.js",
     "./publication-artifact": "./packages/core/publication-artifact.js",
     "./publication-package": "./packages/core/publication-package.js",
+    "./publication-reproducibility": "./packages/core/publication-reproducibility.js",
+    "./publication-sealed-bundle": "./packages/core/publication-sealed-bundle.js",
+    "./paper": "./packages/core/paper.js",
     "./publication-authority": "./packages/core/publication-authority.js",
     "./publication-control-plane-audit": "./packages/core/publication-control-plane-audit.js",
     "./buildchain-publication-authority": "./packages/core/buildchain-publication-authority.js",
@@ -105,7 +108,8 @@
   },
   "packageManager": "pnpm@11.7.0",
   "scripts": {
-    "check": "node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && node scripts/check-action-bundles.mjs",
+    "check": "pnpm run check:static && node scripts/check-maintainability.mjs && node scripts/check-internal-architecture.mjs && node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && node scripts/check-action-bundles.mjs",
+    "check:static": "node scripts/check-javascript-syntax.mjs && prettier --check architecture/*.json bin/internal/command-registry.mjs scripts/authorize-promotion-runtime-override.cjs scripts/check-javascript-syntax.mjs scripts/check-maintainability.mjs scripts/maintainability-metrics.mjs tests/authorize-promotion-runtime-override.test.mjs tests/command-registry.test.mjs tests/maintainability.test.mjs tests/promotion-responsibilities.test.mjs",
     "check:workflows": "bash scripts/check-workflows.sh",
     "generate:site": "node scripts/generate-site-bundle.mjs",
     "check:site": "node scripts/generate-site-bundle.mjs --check",
@@ -116,11 +120,9 @@
     "pack:check": "npm pack --dry-run --json --registry=https://registry.npmjs.org/"
   },
   "devDependencies": {
-    "@types/node": "^24.0.0",
     "prettier": "^3.9.0",
     "tsup": "^8.5.0",
-    "typescript": "^5.9.0",
-    "vitest": "^4.1.9"
+    "typescript": "^5.9.0"
   },
   "dependencies": {
     "@kungfu-tech/kfd": "1.0.0-alpha.47",

package/packages/core/README.md

@@ -24,6 +24,12 @@ Current shared surfaces:
   through `@kungfu-tech/buildchain/badges`.
 - publication artifact manifests, source bundles, and publication artifact
   passports through `@kungfu-tech/buildchain/publication-artifact`.
+- two-clean-build byte reproducibility receipts through
+  `@kungfu-tech/buildchain/publication-reproducibility`.
+- build-once publication bundle manifests and exact-byte verification through
+  `@kungfu-tech/buildchain/publication-sealed-bundle`.
+- governed paper scaffold, preflight, status, npm bootstrap, build, Alpha, and
+  resume plans through `@kungfu-tech/buildchain/paper`.
 
 ## Toolkit Imports
 
@@ -56,15 +62,20 @@ import {
 CommonJS scripts can use dynamic imports for the same package surfaces:
 
 ```js
-const { createBuildchainLogger } = await import("@kungfu-tech/buildchain/logging");
-const { collectRunnerDiagnostics } = await import("@kungfu-tech/buildchain/diagnostics");
+const { createBuildchainLogger } =
+  await import("@kungfu-tech/buildchain/logging");
+const { collectRunnerDiagnostics } =
+  await import("@kungfu-tech/buildchain/diagnostics");
 ```
 
 Build facts consumers can collect source-bound module/product facts before
 publishing and pass those facts into the release passport:
 
 ```js
-import { collectModuleBuildFacts, writeBuildFacts } from "@kungfu-tech/buildchain/build-facts";
+import {
+  collectModuleBuildFacts,
+  writeBuildFacts,
+} from "@kungfu-tech/buildchain/build-facts";
 
 const fact = collectModuleBuildFacts({ moduleId: "native-core" });
 writeBuildFacts({ fact, output: ".buildchain/facts/native-core.json" });
@@ -94,6 +105,48 @@ import { writePublicationArtifact } from "@kungfu-tech/buildchain/publication-ar
 writePublicationArtifact({ sourceSha: process.env.GITHUB_SHA });
 ```
 
+Before publication admission, prove the exact PDF, source bundle, manifests,
+and npm tarball twice from the same Git commit:
+
+```js
+import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain/publication-reproducibility";
+
+const receipt = verifyPublicationReproducibility({
+  sourceSha: process.env.GITHUB_SHA,
+  promote: true,
+});
+if (!receipt.qualifying) throw new Error("publication is not reproducible");
+```
+
+Bind the promoted bytes into the durable build-once publication envelope:
+
+```js
+import {
+  createPublicationSealedBundle,
+  verifyPublicationSealedBundle,
+} from "@kungfu-tech/buildchain/publication-sealed-bundle";
+```
+
+The sealed manifest names the exact npm tarball and release assets. Promotion
+persists those binary files before registry publication and verifies them again
+when a fresh runner resumes.
+
+Paper automation can use the same typed contracts as the CLI:
+
+```js
+import {
+  collectPaperPreflight,
+  collectPaperStatus,
+  planPaperMigration,
+  planPaperScaffold,
+  writePaperMigration,
+} from "@kungfu-tech/buildchain/paper";
+```
+
+Planning and observation are side-effect free. `writePaperScaffold()` and
+`writePaperMigration()` perform the bounded local writes, while external
+mutations remain explicit CLI operations guarded by `--execute`.
+
 Web-surface validation stays in core because both local scripts and GitHub
 Actions need the same fail-closed interpretation of project, channel, deploy,
 retention, and staging security declarations.
@@ -102,7 +155,10 @@ README badge consumers should import the public badge subpath and treat
 Markdown as a projection of the returned facts:
 
 ```js
-import { collectBadgeBundleFacts, renderBadgeBundleBlock } from "@kungfu-tech/buildchain/badges";
+import {
+  collectBadgeBundleFacts,
+  renderBadgeBundleBlock,
+} from "@kungfu-tech/buildchain/badges";
 
 const facts = await collectBadgeBundleFacts({ cwd: process.cwd() });
 const markdown = renderBadgeBundleBlock(facts);

package/packages/core/artifact-signing.js

@@ -25,6 +25,7 @@ const PROFILE_REGISTRY = Object.freeze({
       "plugin-bundle",
       "xpc-bundle",
       "dylib",
+      "archive",
       "pkg",
       "dmg",
     ],

package/packages/core/buildchain-contract.js

@@ -69,7 +69,7 @@ function surface(root, value) {
 
 function majorLineFromPackageVersion(version = "") {
   const match = String(version || "").match(/^(\d+)\./);
-  return match ? `v${match[1]}` : "v2";
+  return match ? `v${match[1]}` : "v3";
 }
 
 export function createBuildchainContractWorld({
@@ -113,7 +113,7 @@ export function createBuildchainContractWorld({
         "release-candidate-artifact",
       ],
       breakingDefaults: {
-        buildchainRefDefault: "workflow-shell-ref-or-v2",
+        buildchainRefDefault: "workflow-shell-ref-or-v3",
         promoteOnlyHeavyBuildPolicy: "pr-stage-only",
       },
       optionalInputs: [
@@ -198,6 +198,8 @@ export function createBuildchainContractWorld({
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-invariant-passport-jsons",
         "release-passport-invariant-passport-command",
+        "release-passport-evidence-jsons",
+        "release-passport-attachment-command",
         "github-artifact-attestation-policy-json",
         "github-artifact-attestation-environment",
         "github-artifact-attestation-retention-days",
@@ -280,7 +282,7 @@ export function createBuildchainContractWorld({
         "web-surface-manifest-json",
       ],
       breakingDefaults: {
-        buildchainRefDefault: "workflow-shell-ref-or-v2",
+        buildchainRefDefault: "workflow-shell-ref-or-v3",
         contractCompatibilityPolicy: "major-compatible",
         breakingDriftPolicy: "fail-closed-before-build",
       },
@@ -382,6 +384,8 @@ export function createBuildchainContractWorld({
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-invariant-passport-jsons",
         "release-passport-invariant-passport-command",
+        "release-passport-evidence-jsons",
+        "release-passport-attachment-command",
         "release-passport-github-artifact-attestation-policy-jsons",
         "github-release",
         "github-release-title",
@@ -692,6 +696,7 @@ export function createBuildchainContractWorld({
         ? {
             compatibleBreakingDigests: [
               "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
+              "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
             ],
           }
         : {}),
@@ -745,7 +750,7 @@ export function finalizeBuildchainContractWorld(contractWorld) {
 }
 
 export function createBuildchainContractLock({
-  buildchainRef = "v2",
+  buildchainRef = "v3",
   resolvedSha = "",
   contractWorld,
   compatibilityPolicy = DEFAULT_POLICY,

package/packages/core/cache-evidence.js

@@ -88,6 +88,7 @@ function normalizeBindings(bindings = {}) {
       "policyRoot",
       "platformRoot",
       "cacheProfileRoot",
+      "compilerCachePreparationRoot",
     ]),
     "bindings",
   );

package/packages/core/controller-evidence.js

@@ -25,6 +25,7 @@ const CONTROLLER_SPECS = [
     capabilities: [
       "source-lock",
       "lifecycle-build",
+      "artifact-signing-finalization",
       "credential-island",
       "lifecycle-verify",
       "artifact-admission",
@@ -34,6 +35,7 @@ const CONTROLLER_SPECS = [
       "resolve-source",
       "anchored-release-preflight",
       "build",
+      "signing-finalization",
       "credential-island",
       "verify",
       "aggregate",