@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.1

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.2",
+    "version": "3.0.3-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -26,7 +26,7 @@
         "release-candidate-artifact"
       ],
       "breakingDefaults": {
-        "buildchainRefDefault": "workflow-shell-ref-or-v2",
+        "buildchainRefDefault": "workflow-shell-ref-or-v3",
         "promoteOnlyHeavyBuildPolicy": "pr-stage-only"
       },
       "optionalInputs": [
@@ -51,8 +51,8 @@
         "contract drift is checked before heavy build jobs for stable floating refs",
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
-      "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:5ada21e27d49afb2718bb687fa3dc17ffd1042665f3c00c18935ca4e46584fae"
+      "breakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa",
+      "auditDigest": "sha256:8d0ef9c8048a107dc6fb418d93d9a799e27bf8f94dc008cbe4001255c54004f8"
     },
     {
       "contractVersion": 1,
@@ -91,7 +91,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:6f7a097f70558ddff5867e3aaf6be0a0a56eb1838232eebe3ec6e7d071591746"
+      "auditDigest": "sha256:752ef03f5cbfb4a74e21081a8a09d2e292c255af25776eb1d20b317317608425"
     },
     {
       "contractVersion": 1,
@@ -131,6 +131,8 @@
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-invariant-passport-jsons",
         "release-passport-invariant-passport-command",
+        "release-passport-evidence-jsons",
+        "release-passport-attachment-command",
         "github-artifact-attestation-policy-json",
         "github-artifact-attestation-environment",
         "github-artifact-attestation-retention-days",
@@ -175,7 +177,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
-      "auditDigest": "sha256:68f3ad7a1d880a26be48263d9d1d12c38ff89beb08e4f744509b1ca196a889c9"
+      "auditDigest": "sha256:96a41b4a1d03b01e5fe3d25d0d13df32880a24586a1efeeeeb754eeb0d96e1cd"
     },
     {
       "contractVersion": 1,
@@ -217,7 +219,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:54bf2db92237cad97da1dc740780330e6175b97352523db732c8650560f1a9fd"
+      "auditDigest": "sha256:83074ab14eaa59d14b411740668c77298da824bcf801c99aaa33d97ec6c8232d"
     },
     {
       "contractVersion": 1,
@@ -235,7 +237,7 @@
         "web-surface-manifest-json"
       ],
       "breakingDefaults": {
-        "buildchainRefDefault": "workflow-shell-ref-or-v2",
+        "buildchainRefDefault": "workflow-shell-ref-or-v3",
         "contractCompatibilityPolicy": "major-compatible",
         "breakingDriftPolicy": "fail-closed-before-build"
       },
@@ -260,8 +262,8 @@
         "effective channel and preview alias are injected before caller build and verify commands",
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
       ],
-      "breakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
-      "auditDigest": "sha256:6277559c749bcc9ae6c737b068b44c478e796377273acc9fc22ab9804be409d1"
+      "breakingDigest": "sha256:27f0cb9c7d97288850d215be8696b323471c41fd1cdf3a2ff3ebf21f62541960",
+      "auditDigest": "sha256:b54c067c31c4c76da44d63fff8945229f7afab262f9fc9131915abeadca56e4f"
     },
     {
       "contractVersion": 1,
@@ -319,7 +321,7 @@
         "media qualification does not claim browser playback, responsive layout, reduced-motion behavior, accessibility, or production deployment"
       ],
       "breakingDigest": "sha256:425f8d3d1ba205dd6fe35a20f1dc6dad7d7c563872283e3af79fea4d5c475692",
-      "auditDigest": "sha256:d043897d3d2bd242a83a362fccac408b4bd38e1e2fb50e7cae6a2145a6c0bd51"
+      "auditDigest": "sha256:38353cc5dc5520e6de84e387abafc6086a4b236e18be6521b00d43ad651582e4"
     },
     {
       "contractVersion": 1,
@@ -353,6 +355,8 @@
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-invariant-passport-jsons",
         "release-passport-invariant-passport-command",
+        "release-passport-evidence-jsons",
+        "release-passport-attachment-command",
         "release-passport-github-artifact-attestation-policy-jsons",
         "github-release",
         "github-release-title",
@@ -391,7 +395,7 @@
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
       ],
       "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
-      "auditDigest": "sha256:d1a4803f908b87c66ab6e9a5dca935366192fbda0bd6c23d784c9e037afb89be"
+      "auditDigest": "sha256:aa8231b2ba3574663f4a03882fdccecd792e04979bd9a52adac6b558c8a10081"
     },
     {
       "contractVersion": 1,
@@ -447,7 +451,7 @@
         "temporary keychain and API key material are cleaned in both main and post phases"
       ],
       "breakingDigest": "sha256:61866985864205770c70cbe14c3c60f479512a32c0b007b5fd6d8d65132ff8be",
-      "auditDigest": "sha256:efbc4a3641ab7e7137da5a197f5a9414c40a070bf75c6bf9fcb98ddcbf621e73"
+      "auditDigest": "sha256:60c44e35de1788c4c4c2529cb491914054df0b604539758e230ff31ad6dfdab2"
     },
     {
       "contractVersion": 1,
@@ -506,7 +510,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:aad90c2b39ce3fd7d2d4df5833f388c3090f5eeaecfd97d03276d375eed9459b"
+      "auditDigest": "sha256:f177e3a60a1463db9a83b04a00f5cf0a015d68281da0d545245760856f6dfaf0"
     },
     {
       "contractVersion": 1,
@@ -555,7 +559,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:aad90c2b39ce3fd7d2d4df5833f388c3090f5eeaecfd97d03276d375eed9459b"
+      "auditDigest": "sha256:f177e3a60a1463db9a83b04a00f5cf0a015d68281da0d545245760856f6dfaf0"
     },
     {
       "contractVersion": 1,
@@ -615,7 +619,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:4afc2879c3ede97d4123ec2536209b57ecb077f658a09f748e5ae088b1c92bc8"
+      "auditDigest": "sha256:d05fb5cd9c99ee3765b83727b96d9fea15ab166443e91744da88cabd11b214a0"
     },
     {
       "contractVersion": 1,
@@ -705,7 +709,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:63522fa4397a62566c0f24de10d0fd91bf040c98410b5ccd1cdcf4b4d4756549"
+      "auditDigest": "sha256:a1b7fd11b698523b408f4395cd2fc766596cca7ec1723ea48291a509e9352f09"
     },
     {
       "contractVersion": 1,
@@ -727,7 +731,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:4d201b7021ab28d7999f6ce88b4aacae5eb57e187d220e10a1e3e5ae5544a7d8"
+      "auditDigest": "sha256:74658c9b6795f7ba88421e13e1ddfdd3e25884b35d680a5b8ba1cf699f09c2a4"
     },
     {
       "contractVersion": 1,
@@ -778,7 +782,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
+        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -817,7 +821,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d4bd0f2a1921bfed71a4d9104d45934555bde74a5c189f93ad79f37074c02b87",
-      "auditDigest": "sha256:aa1727de29ad42d50ccc6e6cb8923a7b532da0f6ce6e53372d63801a120de65e"
+      "auditDigest": "sha256:bb008ca3b34f02ad6ee7596eefd596d181d4f50b634c00aa80137c9e4e8da11c"
     },
     {
       "contractVersion": 1,
@@ -842,12 +846,14 @@
           "resolve-runtime",
           "resolve-source",
           "build",
+          "signing-finalization",
           "verify",
           "aggregate"
         ],
         "capabilities": [
           "source-lock",
           "lifecycle-build",
+          "artifact-signing-finalization",
           "credential-island",
           "lifecycle-verify",
           "artifact-admission"
@@ -869,6 +875,7 @@
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
         "BUILDCHAIN_PROMOTION_TOKEN",
+        "artifact-compression-level",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -880,7 +887,11 @@
         "artifact-relay-s3-role-arn",
         "artifact-relay-s3-upload-role-arn",
         "artifact-retention-days",
+        "artifact-signing-request-upload-no-proxy",
         "artifact-transfer-mode",
+        "aws-codebuild-project",
+        "aws-ec2-macos-runner-label",
+        "aws-ec2-windows-runner-label",
         "build-command",
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
@@ -898,6 +909,9 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "compiler-cache-platforms-json",
+        "compiler-cache-provider",
+        "compiler-cache-required",
         "control-runner-json",
         "credential-island-caller-owned",
         "credential-island-environment",
@@ -924,6 +938,7 @@
         "publish-registry",
         "publish-source-ref",
         "release-candidate",
+        "release-candidate-family-evidence-json",
         "requested-parallelism",
         "require-build",
         "require-install",
@@ -934,6 +949,7 @@
         "rustup-dist-server",
         "rustup-update-root",
         "sample-process-tree",
+        "self-hosted-offline-fallback",
         "setup-node",
         "setup-rust",
         "shifu-cache-profile-digest",
@@ -944,8 +960,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:146718143cc50e48ac57154aade4a4b06a8df4e036708a150233098d3c1cb6f7",
-        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
+        "digest": "sha256:2e4c9e9af2162de2333c9b57bffcff77a76e9ed384b9f001ab8ef63d527197f9",
+        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -983,6 +999,10 @@
             "classification": "redacted",
             "source": "workflow-call-secret"
           },
+          "artifact-compression-level": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "artifact-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1027,10 +1047,26 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "artifact-signing-request-upload-no-proxy": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "artifact-transfer-mode": {
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "aws-codebuild-project": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "aws-ec2-macos-runner-label": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "aws-ec2-windows-runner-label": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "build-command": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1099,6 +1135,18 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "compiler-cache-platforms-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "compiler-cache-provider": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "compiler-cache-required": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "control-runner-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1203,6 +1251,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "release-candidate-family-evidence-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "requested-parallelism": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1243,6 +1295,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "self-hosted-offline-fallback": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "setup-node": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1274,7 +1330,8 @@
         }
       },
       "compatibleBreakingDigests": [
-        "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be"
+        "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
+        "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1"
       ],
       "guarantees": [
         "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest",
@@ -1282,8 +1339,8 @@
         "redacted input values are never serialized and digest-only input values are never emitted in plaintext",
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
-      "breakingDigest": "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
-      "auditDigest": "sha256:5ada21e27d49afb2718bb687fa3dc17ffd1042665f3c00c18935ca4e46584fae"
+      "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
+      "auditDigest": "sha256:8d0ef9c8048a107dc6fb418d93d9a799e27bf8f94dc008cbe4001255c54004f8"
     },
     {
       "contractVersion": 1,
@@ -1330,6 +1387,7 @@
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
         "BUILDCHAIN_PROMOTION_TOKEN",
+        "artifact-compression-level",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -1341,7 +1399,11 @@
         "artifact-relay-s3-role-arn",
         "artifact-relay-s3-upload-role-arn",
         "artifact-retention-days",
+        "artifact-signing-request-upload-no-proxy",
         "artifact-transfer-mode",
+        "aws-codebuild-project",
+        "aws-ec2-macos-runner-label",
+        "aws-ec2-windows-runner-label",
         "build-command",
         "buildchain-alpha-contract-lock-path",
         "buildchain-channel",
@@ -1362,6 +1424,9 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "compiler-cache-platforms-json",
+        "compiler-cache-provider",
+        "compiler-cache-required",
         "control-runner-json",
         "credential-island-caller-owned",
         "credential-island-environment",
@@ -1388,6 +1453,7 @@
         "publish-registry",
         "publish-source-ref",
         "release-candidate",
+        "release-candidate-family-evidence-json",
         "requested-parallelism",
         "require-build",
         "require-install",
@@ -1398,6 +1464,7 @@
         "rustup-dist-server",
         "rustup-update-root",
         "sample-process-tree",
+        "self-hosted-offline-fallback",
         "setup-node",
         "setup-rust",
         "shifu-cache-profile-digest",
@@ -1408,8 +1475,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:55b3189412e7da7769a8de60bd1ba4cf52d726d8b79c0a720598e49742aa72a0",
-        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
+        "digest": "sha256:105eed3eb8f772d4ed93d43e7da404d849b92eafab1b461c7a9b7cb94a8a6b3b",
+        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1447,6 +1514,10 @@
             "classification": "redacted",
             "source": "workflow-call-secret"
           },
+          "artifact-compression-level": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "artifact-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1491,10 +1562,26 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "artifact-signing-request-upload-no-proxy": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "artifact-transfer-mode": {
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "aws-codebuild-project": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "aws-ec2-macos-runner-label": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "aws-ec2-windows-runner-label": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "build-command": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1575,6 +1662,18 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "compiler-cache-platforms-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "compiler-cache-provider": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "compiler-cache-required": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "control-runner-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1679,6 +1778,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "release-candidate-family-evidence-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "requested-parallelism": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1719,6 +1822,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "self-hosted-offline-fallback": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "setup-node": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1756,7 +1863,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:6f7a097f70558ddff5867e3aaf6be0a0a56eb1838232eebe3ec6e7d071591746"
+      "auditDigest": "sha256:752ef03f5cbfb4a74e21081a8a09d2e292c255af25776eb1d20b317317608425"
     },
     {
       "contractVersion": 1,
@@ -1826,7 +1933,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
+        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1957,7 +2064,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:5f1868478b7ccd9fb79aea76bc771289d2ca6bd2dccd1abf57575426f1eae5fb",
-      "auditDigest": "sha256:7b4b93c66fbe4bc0933a3e2514d1d07c5955a4c088286a2172f20af9fe00375b"
+      "auditDigest": "sha256:b1da0c381cfa2d9ed8d39857b2ef12b1652f9c6be43e76a6944122de9b3f7481"
     },
     {
       "contractVersion": 1,
@@ -2043,7 +2150,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
+        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2222,7 +2329,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27",
-      "auditDigest": "sha256:6277559c749bcc9ae6c737b068b44c478e796377273acc9fc22ab9804be409d1"
+      "auditDigest": "sha256:b54c067c31c4c76da44d63fff8945229f7afab262f9fc9131915abeadca56e4f"
     },
     {
       "contractVersion": 1,
@@ -2287,7 +2394,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
+        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2382,7 +2489,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:3f76502666069c2727d23efcfdb08fb80f89ced1955a69e29f11525ae88aca1d",
-      "auditDigest": "sha256:f83405748e500d31a237240438f7f410c1bb2b4ef39ab7323131fa54f38c1a59"
+      "auditDigest": "sha256:2cf66d8c40760900284c8417622b11120602a29016a55347a2ee709aafe4b3d5"
     },
     {
       "contractVersion": 1,
@@ -2469,7 +2576,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
+        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2632,7 +2739,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:0eb318df455ef9cb737a7c2515a2411b685d34ed0bde7b5f5b173a7a42513114",
-      "auditDigest": "sha256:fd939f9dcce745f3e1b8063b68715460cb8e1af6d2b813a96b37a741740122b9"
+      "auditDigest": "sha256:7467fb0651dae2f5463f8dd07e3c28690f7a2aa63b9560810f8e3e0f4a49a970"
     },
     {
       "contractVersion": 1,
@@ -2749,11 +2856,17 @@
         "publish-transaction-override",
         "release-activation-command",
         "release-activation-receipt-set-path",
+        "release-candidate-family-assignment-id",
+        "release-candidate-family-evidence-required",
+        "release-candidate-family-evidence-root",
+        "release-candidate-family-initiative-id",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
+        "release-passport-attachment-command",
         "release-passport-buildchain-self-kfd",
         "release-passport-evidence-command",
+        "release-passport-evidence-jsons",
         "release-passport-evidence-path",
         "release-passport-impact-json",
         "release-passport-invariant-passport-command",
@@ -2778,8 +2891,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:00baae93d9ed75129fdaed6fcc33285e515b8c7de84816831a39e660941dd7ae",
-        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
+        "digest": "sha256:f54bccee97644d190b450e4ed810b516af64ed5d265ea76cd541a11cbbd51cdb",
+        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3069,6 +3182,22 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "release-candidate-family-assignment-id": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "release-candidate-family-evidence-required": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "release-candidate-family-evidence-root": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "release-candidate-family-initiative-id": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "release-candidate-workflow-file": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -3081,6 +3210,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "release-passport-attachment-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "release-passport-buildchain-self-kfd": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -3089,6 +3222,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "release-passport-evidence-jsons": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "release-passport-evidence-path": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -3182,7 +3319,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:54bf2db92237cad97da1dc740780330e6175b97352523db732c8650560f1a9fd"
+      "auditDigest": "sha256:83074ab14eaa59d14b411740668c77298da824bcf801c99aaa33d97ec6c8232d"
     },
     {
       "contractVersion": 1,
@@ -3229,6 +3366,7 @@
         "downstream-prepare-command",
         "downstream-repository",
         "downstream-target",
+        "downstream-update-command",
         "downstream-verify-command",
         "dry-run",
         "graph-json",
@@ -3242,8 +3380,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
-        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
+        "digest": "sha256:aff7a9f6bcf96d7a9d406e490868288f3acef104e53eddddc5782b8a2b5b4fa5",
+        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -3273,6 +3411,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "downstream-update-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "downstream-verify-command": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -3322,7 +3464,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d7a1f15990ce8bd13149474888232c7d4451dd2a49bebf4d4ce1336695da430e",
-      "auditDigest": "sha256:43fd4da155c701d4c5078373c1f47b50bebc6a46556b8db5e3c4d502c113fa95"
+      "auditDigest": "sha256:9304ed3bc65ab5a0082554889796201fd8d2f4f290a4137ca92905f5ff696e52"
     },
     {
       "contractVersion": 1,
@@ -3366,7 +3508,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
+        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3376,9 +3518,9 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:7c18fdd3df180db9e1f043a2286ef3f02fae60b84e42b76cd50da9cfeb77883d",
-      "auditDigest": "sha256:e07a5db56a71bd0ac79c81f12619938055361bf0a0ed8e5891f88ca1c51f1c93"
+      "auditDigest": "sha256:d07482cd66413a2fb3781a3b76f960b8151b6231841799647fe237820de2fde6"
     }
   ],
-  "compatibilityDigest": "sha256:9770baa99ba374e9dbd743ca9624a72137513b8c4e65af1fbf2160cb3ef51d9d",
-  "contractDigest": "sha256:352b63ea24a156f7de288cbb6aae794fbda61de0912720851e9dcbbcc3cb64bc"
+  "compatibilityDigest": "sha256:61af7d0871220bc0909008bdc571905ad500cccf853e7841bc5d462a34b2d436",
+  "contractDigest": "sha256:a4093c16e292085ad013b11424a4432c3fa6c22ec0d9cd9fe412ec8a42359a7c"
 }