@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.1

package/packages/core/diagnostics.js

@@ -645,27 +645,84 @@ function observedMetric(unit, value, source, evidenceRoot) {
   };
 }
 
-function cacheStatsCount(stats, names) {
-  return names.reduce((sum, name) => sum + Number(stats?.[name] || 0), 0);
+function numericTotal(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (value && typeof value === "object") {
+    return Object.values(value).reduce((sum, entry) => sum + numericTotal(entry), 0);
+  }
+  return 0;
 }
 
-function compilerCacheOutcome(compilerCaches) {
+function cacheStatsCount(stats, names) {
+  return names.reduce((sum, name) => sum + numericTotal(stats?.[name]), 0);
+}
+
+function compilerCacheObservation(compilerCaches, compilerCachePreparation) {
+  const preparationValid =
+    compilerCachePreparation?.contract ===
+      "kungfu-buildchain-compiler-cache-preparation" &&
+    compilerCachePreparation?.provider === "sccache" &&
+    compilerCachePreparation?.status === "prepared" &&
+    compilerCachePreparation?.action?.statsReset === true &&
+    /^sha256:[0-9a-f]{64}$/.test(compilerCachePreparation?.root || "");
+  const sccache = compilerCaches?.sccache;
+  if (preparationValid && sccache?.available && sccache.stats) {
+    const stats = sccache.stats.stats || sccache.stats;
+    return {
+      provider: "sccache",
+      producer: "sccache",
+      source: "sccache-current-run-stats",
+      stats,
+      hits: cacheStatsCount(stats, [
+        "cache_hits",
+        "cache_hit",
+        "cache_hits_count",
+        "cache_hit_count",
+      ]),
+      misses: cacheStatsCount(stats, [
+        "cache_misses",
+        "cache_miss",
+        "cache_misses_count",
+        "cache_miss_count",
+      ]),
+    };
+  }
   const logStats = compilerCaches?.ccache?.logStats;
-  if (!logStats?.available || !logStats.stats) return "unavailable";
-  const hits = cacheStatsCount(logStats.stats, [
-    "direct_cache_hit",
-    "preprocessed_cache_hit",
-  ]);
-  const misses = cacheStatsCount(logStats.stats, ["cache_miss"]);
-  if (hits > 0 && misses > 0) return "partial";
-  if (hits > 0) return "hit";
-  if (misses > 0) return "miss";
+  if (logStats?.available && logStats.stats) {
+    return {
+      provider: "ccache",
+      producer: "ccache",
+      source: "ccache-current-run-stats-log",
+      stats: logStats.stats,
+      hits: cacheStatsCount(logStats.stats, [
+        "direct_cache_hit",
+        "preprocessed_cache_hit",
+      ]),
+      misses: cacheStatsCount(logStats.stats, ["cache_miss"]),
+    };
+  }
+  return {
+    provider: sccache?.available ? "sccache" : "compiler-cache",
+    producer: "unavailable",
+    source: sccache?.available ? "sccache-cumulative-stats" : "compiler-cache-diagnostics",
+    stats: undefined,
+    hits: 0,
+    misses: 0,
+  };
+}
+
+function compilerCacheOutcome(observation) {
+  if (!observation?.stats) return "unavailable";
+  if (observation.hits > 0 && observation.misses > 0) return "partial";
+  if (observation.hits > 0) return "hit";
+  if (observation.misses > 0) return "miss";
   return "bypassed";
 }
 
-function createStructuredCacheEvidence({
+export function createStructuredCacheEvidence({
   sourceCheckout,
   compilerCaches,
+  compilerCachePreparation,
   platform,
   env = process.env,
 }) {
@@ -696,6 +753,9 @@ function createStructuredCacheEvidence({
       ? { policyRoot: env.BUILDCHAIN_CACHE_POLICY_ROOT }
       : {}),
     ...(policyRoot ? { cacheProfileRoot: policyRoot } : {}),
+    ...(compilerCachePreparation?.root
+      ? { compilerCachePreparationRoot: compilerCachePreparation.root }
+      : {}),
   };
   const operations = [];
   if (sourceCheckout) {
@@ -780,53 +840,65 @@ function createStructuredCacheEvidence({
       }),
     );
   }
-  const compilerEvidenceRoot = cacheEvidenceDigest(compilerCaches || {});
+  const compilerObservation = compilerCacheObservation(
+    compilerCaches,
+    compilerCachePreparation,
+  );
+  const compilerEvidenceRoot = cacheEvidenceDigest({
+    compilerCaches: compilerCaches || {},
+    compilerCachePreparation: compilerCachePreparation || null,
+  });
+  const compilerMetricReason = compilerObservation.stats
+    ? `${compilerObservation.provider} current-run stats do not expose this metric`
+    : compilerObservation.provider === "sccache"
+      ? "sccache stats were not admitted without a current-run reset preparation receipt"
+      : "compiler cache current-run stats were unavailable";
   operations.push(
     createCacheOperationReceipt({
       operationId: `compiler-cache:${platform}`,
       operation: "restore",
-      provider: compilerCaches?.ccache?.available ? "ccache" : "compiler-cache",
-      producer: compilerCaches?.ccache?.available ? "ccache" : "unavailable",
+      provider: compilerObservation.provider,
+      producer: compilerObservation.producer,
       platform,
-      cacheKey: policyRoot || null,
+      cacheKey: compilerCachePreparation?.root || policyRoot || null,
       cacheRoot: policyRoot || null,
-      outcome: compilerCacheOutcome(compilerCaches),
+      outcome: compilerCacheOutcome(compilerObservation),
       bindings,
       metrics: {
         lookupDuration: unavailableMetric(
           "ms",
-          "ccache stats log exposes outcomes but not lookup duration",
-          "ccache-stats-log",
+          compilerMetricReason,
+          compilerObservation.source,
           compilerEvidenceRoot,
         ),
         restoreDuration: unavailableMetric(
           "ms",
-          "ccache stats log exposes outcomes but not transfer duration",
-          "ccache-stats-log",
+          compilerMetricReason,
+          compilerObservation.source,
           compilerEvidenceRoot,
         ),
         saveDuration: unavailableMetric(
           "ms",
-          "ccache stats log exposes writes but not save duration",
-          "ccache-stats-log",
+          compilerMetricReason,
+          compilerObservation.source,
           compilerEvidenceRoot,
         ),
         restoredBytes: unavailableMetric(
           "bytes",
-          "ccache does not expose per-run restored bytes",
-          "ccache-stats-log",
+          compilerMetricReason,
+          compilerObservation.source,
           compilerEvidenceRoot,
         ),
         writtenBytes: unavailableMetric(
           "bytes",
-          "ccache does not expose per-run written bytes",
-          "ccache-stats-log",
+          compilerMetricReason,
+          compilerObservation.source,
           compilerEvidenceRoot,
         ),
         savedTime: unavailableMetric(
           "ms",
-          "ccache does not report evidence-backed compile time saved",
-          "ccache-stats-log",
+          compilerMetricReason,
+          compilerObservation.source,
           compilerEvidenceRoot,
         ),
       },
@@ -1343,6 +1415,7 @@ export function createDiagnosticsArtifact({
   processSummary = undefined,
   requestedParallelism = 0,
   sourceCheckout = undefined,
+  compilerCachePreparation = undefined,
   links = {},
 } = {}) {
   const resolvedCwd = path.resolve(cwd);
@@ -1370,6 +1443,7 @@ export function createDiagnosticsArtifact({
     cacheEvidence: createStructuredCacheEvidence({
       sourceCheckout,
       compilerCaches,
+      compilerCachePreparation,
       platform,
     }),
     nativeCacheDirs: native.cacheDirs || [],
@@ -1377,6 +1451,7 @@ export function createDiagnosticsArtifact({
     lifecycleObservability: lifecycleObservability || summarizeLifecycleObservability({ events, logPath }),
     process: processSummary || summarizeProcessSamples({ samples: processSamples, requestedParallelism }),
     ...(sourceCheckout ? { sourceCheckout } : {}),
+    ...(compilerCachePreparation ? { compilerCachePreparation } : {}),
     links,
   };
 }

package/packages/core/github-governance-authority.js

@@ -34,6 +34,9 @@ const target = (
   allowedBypassActors,
 });
 const PUBLIC_REPOSITORY_TARGETS = Object.freeze({
+  ".github": [
+    target("main", [check("governance")], false),
+  ],
   "agent-hub-demo": [
     target("dev/v0/v0.2", [check("check / check")], true),
     target("alpha/v0/v0.2", [check("check / check")], false),
@@ -60,9 +63,13 @@ const PUBLIC_REPOSITORY_TARGETS = Object.freeze({
     target("alpha/v1/v1.0", [check("check / check")], true),
   ],
   kungfu: [
-    target("dev/v4/v4.0", [check("affected-native / linux")], false),
+    target("dev/v4/v4.0", [
+      check("Candidate source acceptance / check"),
+      check("Queue admission lease", null),
+      check("affected-native / linux"),
+    ], true),
     target("alpha/v4/v4.0", [
-      check("build", null),
+      check("build / Finalize build controller evidence"),
       check("signoff"),
       check("validate"),
     ], true),
@@ -81,6 +88,10 @@ const PUBLIC_REPOSITORY_TARGETS = Object.freeze({
       true,
     ),
   ],
+  "runtime-images": [
+    target("dev/v1/v1.0", [check("Signed-off commits"), check("check")], true),
+    target("alpha/v1/v1.0", [check("Signed-off commits"), check("check")], false),
+  ],
   "paper-episodes-to-primitives": [
     target("main", [check("governance")], false),
     target("dev/v0/v0.1", [check("check / check")], true),
@@ -91,6 +102,11 @@ const PUBLIC_REPOSITORY_TARGETS = Object.freeze({
     target("dev/v0/v0.1", [check("check / check")], true),
     target("alpha/v0/v0.1", [check("check / check")], true),
   ],
+  "paper-kfd-machine-life-roadmap": [
+    target("main", [check("check / check")], false),
+    target("dev/v0/v0.1", [check("check / check")], true),
+    target("alpha/v0/v0.1", [check("check / check")], true),
+  ],
   "paper-kungfu-product-white-paper": [
     target("main", [check("check / check")], false),
     target("dev/v0/v0.1", [check("check / check")], true),
@@ -109,11 +125,6 @@ const PUBLIC_REPOSITORY_TARGETS = Object.freeze({
   ],
 });
 const PUBLIC_REPOSITORIES = Object.freeze(Object.keys(PUBLIC_REPOSITORY_TARGETS).sort());
-const PRIVATE_REPOSITORY_IDENTITIES = Object.freeze([
-  "sha256:581823ab841e1d9a9025c92d0c47b164c6aaa1ea22112fdbc8d73bd2c862a05f",
-  "sha256:b7255e01d10000eb3a2786456b4c558178675ccb6cf28a6e39a74dbfe918df35",
-  "sha256:f41bd767e9c4a0ab429ca2a2f456d29ddefab0e996d75000ba36334689eb177e",
-]);
 const PROTECTED_AUTHORITY_PATHS = Object.freeze([
   ".github/CODEOWNERS",
   ".github/workflows/.publication-authority.yml",
@@ -477,6 +488,7 @@ export function createBuildchainGithubGovernanceAuthority() {
       ],
     },
     repositoryAdmission: {
+      managedVisibilities: ["public"],
       publicRepositories: [...PUBLIC_REPOSITORIES],
       publicAuthoritativeTargets: Object.fromEntries(
         Object.entries(PUBLIC_REPOSITORY_TARGETS).map(([repository, targets]) => [
@@ -493,25 +505,21 @@ export function createBuildchainGithubGovernanceAuthority() {
           })),
         ]),
       ),
-      privateRepositoryIdentities: PRIVATE_REPOSITORY_IDENTITIES.map((identityRoot) => ({
-        identityRoot,
-        targetPolicy: "default-and-current-version-line",
-        requiredCheckPolicies: {},
-      })),
-      privateRepositoryPolicy: "non-authoritative-until-plan-capability-qualifies",
+      privateRepositoryIdentities: [],
+      privateRepositoryPolicy: "excluded-from-managed-zone",
       unknownRepositoryPolicy: "non-authoritative-until-explicit-admission",
       baseline: {
-        observedOn: "2026-07-24",
+        observedOn: "2026-07-30",
         repositoryCount: 16,
-        publicCount: 13,
-        privateCount: 3,
+        publicCount: 16,
+        privateCount: 0,
         authoritativePublicTargetCount: Object.values(PUBLIC_REPOSITORY_TARGETS)
           .reduce((count, targets) => count + targets.length, 0),
       },
     },
     planCapability: {
       publicRepositories: ["free", "team", "enterprise"],
-      privateRepositories: ["team", "enterprise"],
+      privateRepositories: [],
       organizationRulesets: ["team", "enterprise"],
     },
     effectivePolicy: {

package/packages/core/index.js

@@ -157,6 +157,7 @@ export {
 } from "./build-facts.js";
 
 export {
+  FAMILY_RELEASE_EVIDENCE_CONTRACT,
   RELEASE_CANDIDATE_PASSPORT_CONTRACT,
   createReleaseCandidatePassport,
   sha256Json,
@@ -386,6 +387,7 @@ export {
   KFD2_TRUST_PROOF_CONTRACT,
   PRODUCT_MECHANISM_CONTRACT,
   RELEASE_CHECK_REPORT_CONTRACT,
+  RELEASE_EVIDENCE_ATTACHMENT_CONTRACT,
   RELEASE_PASSPORT_CONTRACT,
   collectGitHubReleasePassport,
   createArtifactEvidence,
@@ -592,6 +594,8 @@ export {
   RELEASE_PROPAGATION_GRAPH_CONTRACT,
   RELEASE_PROPAGATION_LOCK_CONTRACT,
   RELEASE_PROPAGATION_PLAN_CONTRACT,
+  RELEASE_PROPAGATION_RECEIPT_CONTRACT,
+  createReleasePropagationReceipt,
   createReleasePropagationLock,
   normalizeReleasePropagationGraph,
   planReleasePropagation,
@@ -614,6 +618,42 @@ export {
   validateReleaseActivationTransaction,
 } from "./release-activation-transaction.js";
 
+export {
+  PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT,
+  verifyPublicationReproducibility,
+} from "./publication-reproducibility.js";
+
+export {
+  PUBLICATION_SEALED_BUNDLE_CONTRACT,
+  createPublicationSealedBundle,
+  verifyPublicationSealedBundle,
+} from "./publication-sealed-bundle.js";
+
+export {
+  PAPER_ALPHA_PLAN_CONTRACT,
+  PAPER_BUILD_PLAN_CONTRACT,
+  PAPER_MIGRATION_CONTRACT,
+  PAPER_NPM_BOOTSTRAP_CONTRACT,
+  PAPER_PATHS,
+  PAPER_PREFLIGHT_CONTRACT,
+  PAPER_RESUME_PLAN_CONTRACT,
+  PAPER_SCAFFOLD_CONTRACT,
+  PAPER_STATE_ORDER,
+  PAPER_STATUS_CONTRACT,
+  PAPER_VISIBILITY_CONTRACT,
+  collectPaperPreflight,
+  collectPaperStatus,
+  createPaperAlphaPlan,
+  createPaperBuildPlan,
+  createPaperResumePlan,
+  executePaperNpmBootstrap,
+  planPaperMigration,
+  planPaperScaffold,
+  resolvePaperRepository,
+  writePaperMigration,
+  writePaperScaffold,
+} from "./paper.js";
+
 export {
   SURFACE_TIMESTAMP_POLICY_CONTRACT,
   applySurfaceTimestampPolicy,