@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.1

package/scripts/finalize-native-artifact-signing-result.mjs

@@ -4,8 +4,14 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-import { createArtifactSigningReceipt, validateArtifactSigningRequest } from "../packages/core/artifact-signing.js";
-import { artifactSigningEvidenceDigest, createArtifactSigningResult } from "../packages/core/artifact-signing-result.js";
+import {
+  createArtifactSigningReceipt,
+  validateArtifactSigningRequest,
+} from "../packages/core/artifact-signing.js";
+import {
+  artifactSigningEvidenceDigest,
+  createArtifactSigningResult,
+} from "../packages/core/artifact-signing-result.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 function required(value, label) {
@@ -21,7 +27,8 @@ function sha256File(filePath) {
 function resolveBelow(root, relative, label) {
   const target = path.resolve(root, required(relative, label));
   const rel = path.relative(path.resolve(root), target);
-  if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`${label} escapes its root`);
+  if (rel.startsWith("..") || path.isAbsolute(rel))
+    throw new Error(`${label} escapes its root`);
   return target;
 }
 
@@ -30,67 +37,214 @@ export function finalizeNativeArtifactSigningResult({
   requestPath = process.env.BUILDCHAIN_SIGNING_REQUEST_PATH,
   signedPayload = process.env.BUILDCHAIN_SIGNED_PAYLOAD,
   evidencePath = process.env.BUILDCHAIN_SIGNING_EVIDENCE,
+  credentialArtifactRoot =
+    process.env.BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
   outputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
   checks = process.env.BUILDCHAIN_SIGNING_VERIFICATION_CHECKS,
 } = {}) {
   const requests = path.resolve(required(requestRoot, "signing request root"));
-  const request = JSON.parse(fs.readFileSync(resolveBelow(requests, requestPath, "request path"), "utf8"));
+  const request = JSON.parse(
+    fs.readFileSync(
+      resolveBelow(requests, requestPath, "request path"),
+      "utf8",
+    ),
+  );
   const requestCheck = validateArtifactSigningRequest(request);
-  if (!requestCheck.ok) throw new Error(`invalid signing request: ${requestCheck.issues.join(", ")}`);
+  if (!requestCheck.ok)
+    throw new Error(
+      `invalid signing request: ${requestCheck.issues.join(", ")}`,
+    );
   if (request.signature.semantics !== "native-platform-signature") {
-    throw new Error("native result finalizer rejects non-native signature profiles");
+    throw new Error(
+      "native result finalizer rejects non-native signature profiles",
+    );
   }
   const payloadSource = path.resolve(required(signedPayload, "signed payload"));
-  const evidenceSource = path.resolve(required(evidencePath, "signing evidence"));
-  const resultDirectory = path.resolve(required(outputRoot, "signing result root"));
+  const evidenceSource = path.resolve(
+    required(evidencePath, "signing evidence"),
+  );
+  const resultDirectory = path.resolve(
+    required(outputRoot, "signing result root"),
+  );
   fs.mkdirSync(path.join(resultDirectory, "payload"), { recursive: true });
-  const payloadPath = path.join(resultDirectory, "payload", path.basename(payloadSource));
+  const payloadPath = path.join(
+    resultDirectory,
+    "payload",
+    path.basename(payloadSource),
+  );
   fs.copyFileSync(payloadSource, payloadPath, fs.constants.COPYFILE_EXCL);
   const evidenceOutput = path.join(resultDirectory, "provider-evidence.json");
   fs.copyFileSync(evidenceSource, evidenceOutput, fs.constants.COPYFILE_EXCL);
   const evidenceDocument = JSON.parse(fs.readFileSync(evidenceOutput, "utf8"));
-  if (evidenceDocument.status !== "passed" || evidenceDocument.provider !== request.signature.provider) {
-    throw new Error("provider evidence does not prove the requested native signature");
+  const appBundleResult = request.artifact.kind === "app-bundle";
+  const providerEvidencePassed = appBundleResult
+    ? evidenceDocument.schema ===
+        "buildchain.macos-credential-island-evidence/v1" &&
+      evidenceDocument.status === "accepted" &&
+      evidenceDocument.source?.repository === request.source.repository &&
+      evidenceDocument.source?.sha === request.source.sha &&
+      evidenceDocument.source?.treeSha === request.source.treeSha &&
+      evidenceDocument.buildchain?.runtimeSha === request.runtime.sha &&
+      evidenceDocument.app?.architecture === request.artifact.arch &&
+      evidenceDocument.notarization?.application?.status === "Accepted" &&
+      evidenceDocument.notarization?.diskImage?.status === "Accepted"
+    : evidenceDocument.status === "passed" &&
+      evidenceDocument.provider === request.signature.provider;
+  if (!providerEvidencePassed) {
+    throw new Error(
+      "provider evidence does not prove the requested native signature",
+    );
   }
-  const evidence = [{ kind: `${request.signature.profile}-verification`, path: "provider-evidence.json", digest: sha256File(evidenceOutput) }];
+  let credentialOutput = "";
+  let credentialEvidence = [];
+  if (appBundleResult) {
+    const credentialSource = path.resolve(
+      required(
+        credentialArtifactRoot,
+        "credential artifact root for app-bundle result",
+      ),
+    );
+    const credentialManifest = path.join(credentialSource, "manifest.json");
+    if (!fs.statSync(credentialManifest).isFile())
+      throw new Error("credential artifact manifest is missing");
+    credentialOutput = path.join(resultDirectory, "credential-artifact");
+    fs.cpSync(credentialSource, credentialOutput, {
+      recursive: true,
+      force: false,
+      errorOnExist: true,
+    });
+    const manifestOutput = path.join(credentialOutput, "manifest.json");
+    const manifest = JSON.parse(fs.readFileSync(manifestOutput, "utf8"));
+    if (!Array.isArray(manifest.files) || manifest.files.length === 0)
+      throw new Error("credential artifact manifest contains no files");
+    credentialEvidence = [
+      {
+        kind: "credential-artifact-manifest",
+        path: "credential-artifact/manifest.json",
+        digest: sha256File(manifestOutput),
+      },
+      ...manifest.files.map((file, index) => {
+        const filePath = resolveBelow(
+          credentialOutput,
+          file.path,
+          `credential artifact file ${index}`,
+        );
+        const observed = sha256File(filePath);
+        if (observed !== `sha256:${String(file.sha256 || "").toLowerCase()}`)
+          throw new Error(
+            `credential artifact file digest mismatch: ${file.path}`,
+          );
+        return {
+          kind: `credential-artifact-${index}`,
+          path: `credential-artifact/${String(file.path).replaceAll("\\", "/")}`,
+          digest: observed,
+        };
+      }),
+    ];
+  }
+  const evidence = [
+    {
+      kind: `${request.signature.profile}-verification`,
+      path: "provider-evidence.json",
+      digest: sha256File(evidenceOutput),
+    },
+    ...credentialEvidence,
+  ];
   const payloadDigest = sha256File(payloadPath);
   const receipt = createArtifactSigningReceipt({
     request,
-    result: { artifactDigest: payloadDigest, evidenceDigest: artifactSigningEvidenceDigest(evidence) },
-    signatures: [{ kind: request.signature.profile, digest: evidence[0].digest }],
+    result: {
+      artifactDigest: payloadDigest,
+      evidenceDigest: artifactSigningEvidenceDigest(evidence),
+    },
+    signatures: [
+      { kind: request.signature.profile, digest: evidence[0].digest },
+    ],
   });
-  fs.writeFileSync(path.join(resultDirectory, "receipt.json"), `${JSON.stringify(receipt, null, 2)}\n`);
-  const verificationChecks = String(checks || "").split(",").map((value) => value.trim()).filter(Boolean);
+  fs.writeFileSync(
+    path.join(resultDirectory, "receipt.json"),
+    `${JSON.stringify(receipt, null, 2)}\n`,
+  );
+  const verificationChecks = String(checks || "")
+    .split(",")
+    .map((value) => value.trim())
+    .filter(Boolean);
+  if (
+    verificationChecks.length === 0 &&
+    Array.isArray(evidenceDocument.checks)
+  ) {
+    verificationChecks.push(
+      ...evidenceDocument.checks
+        .map((value) => String(value).trim())
+        .filter(Boolean),
+    );
+  }
+  if (verificationChecks.length === 0 && appBundleResult) {
+    verificationChecks.push(
+      ...Object.entries(evidenceDocument.verification || {})
+        .filter(([, passed]) => passed === true)
+        .map(([name]) => name),
+      "application-notarytool-accepted",
+      "disk-image-notarytool-accepted",
+    );
+  }
+  if (verificationChecks.length === 0)
+    throw new Error("provider evidence contains no verification checks");
   const result = createArtifactSigningResult({
     request,
     receipt,
-    payload: { path: `payload/${path.basename(payloadPath)}`, bytes: fs.statSync(payloadPath).size, digest: payloadDigest },
+    payload: {
+      path: `payload/${path.basename(payloadPath)}`,
+      bytes: fs.statSync(payloadPath).size,
+      digest: payloadDigest,
+    },
     evidence,
-    verification: { status: "passed", provider: request.signature.provider, checks: verificationChecks },
+    verification: {
+      status: "passed",
+      provider: request.signature.provider,
+      checks: verificationChecks,
+    },
   });
-  fs.writeFileSync(path.join(resultDirectory, "result.json"), `${JSON.stringify(result, null, 2)}\n`);
+  fs.writeFileSync(
+    path.join(resultDirectory, "result.json"),
+    `${JSON.stringify(result, null, 2)}\n`,
+  );
   const index = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-artifact-signing-result-index/v1",
-    results: [{
-      id: request.artifact.id,
-      requestDigest: request.digest,
-      resultDigest: result.digest,
-      result: "result.json",
-      payload: result.artifact.path,
-      receipt: "receipt.json",
-    }],
+    results: [
+      {
+        id: request.artifact.id,
+        requestDigest: request.digest,
+        resultDigest: result.digest,
+        result: "result.json",
+        payload: result.artifact.path,
+        receipt: "receipt.json",
+      },
+    ],
   };
-  fs.writeFileSync(path.join(resultDirectory, "index.json"), `${JSON.stringify(index, null, 2)}\n`);
-  writeGitHubOutputs({ "result-root": resultDirectory, "result-index": path.join(resultDirectory, "index.json") });
+  fs.writeFileSync(
+    path.join(resultDirectory, "index.json"),
+    `${JSON.stringify(index, null, 2)}\n`,
+  );
+  writeGitHubOutputs({
+    "result-root": resultDirectory,
+    "result-index": path.join(resultDirectory, "index.json"),
+    "credential-artifact-root": credentialOutput,
+  });
   return index;
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
   try {
     finalizeNativeArtifactSigningResult();
   } catch (error) {
-    console.error(`::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`);
+    console.error(
+      `::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`,
+    );
     process.exitCode = 1;
   }
 }

package/scripts/gate-profile-core.mjs

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 
 export const GATE_MATRIX_CONTRACT = "buildchain.shifu-gate-matrix/v1";
 export const GATE_AGGREGATE_CONTRACT = "buildchain.shifu-gate-aggregate/v1";
+export const GATE_JOB_CONTROL_PLANE_OVERHEAD_MINUTES = 30;
 
 function stableValue(value) {
   if (Array.isArray(value)) return value.map(stableValue);
@@ -265,7 +266,11 @@ export function createGateExecutionMatrix({
       planDigest: inspected.planDigest,
       timeoutMinutes: Math.max(
         1,
-        Math.min(360, Math.ceil(timeoutSeconds / 60)),
+        Math.min(
+          360,
+          Math.ceil(timeoutSeconds / 60) +
+            GATE_JOB_CONTROL_PLANE_OVERHEAD_MINUTES,
+        ),
       ),
       gates: inspected.gates.map((gate) => ({
         id: gate.id,

package/scripts/generate-channel-promotion-workflow.mjs

@@ -284,24 +284,15 @@ jobs:
           --publication-channel "\${{ inputs.channel }}"
           --target-ref "\${{ inputs.target-ref || github.ref_name }}"
           --router-ref "\${{ steps.router.outputs.ref }}"
+          --router-sha "\${{ steps.router.outputs.sha }}"
 
       - name: Authorize trusted runtime override
         if: \${{ steps.route.outputs.override-used == 'true' }}
         uses: actions/github-script@v8
         with:
           script: |
-            if (context.eventName !== "workflow_dispatch") {
-              throw new Error("promotion runtime override is only allowed for trusted workflow_dispatch runs");
-            }
-            const permission = await github.rest.repos.getCollaboratorPermissionLevel({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              username: context.actor,
-            });
-            const level = permission.data.user?.permissions || permission.data.permission || "none";
-            if (!["write", "maintain", "admin"].includes(level)) {
-              throw new Error(\`promotion runtime override requires write, maintain, or admin permission; actor has \${level}\`);
-            }
+            const script = require(process.env.GITHUB_WORKSPACE + "/.buildchain/router/scripts/authorize-promotion-runtime-override.cjs");
+            await script.authorizePromotionRuntimeOverride({ github, context });
 
       - name: Resolve immutable promotion identities
         id: identities

package/scripts/generate-release-candidate-passport.mjs

@@ -29,6 +29,8 @@ export function generateReleaseCandidatePassportCli() {
   const gateAggregate = gateAggregateJson ? JSON.parse(gateAggregateJson) : undefined;
   const controllerReceiptJson = env("BUILDCHAIN_CONTROLLER_RECEIPT_JSON");
   const controllerReceipts = controllerReceiptJson ? [JSON.parse(controllerReceiptJson)] : [];
+  const familyEvidenceJson = env("BUILDCHAIN_RC_FAMILY_EVIDENCE_JSON");
+  const familyEvidence = familyEvidenceJson ? JSON.parse(familyEvidenceJson) : undefined;
   const passport = createReleaseCandidatePassport({
     repository: env("GITHUB_REPOSITORY", buildSummary.git?.repository || ""),
     pullRequest: {
@@ -51,6 +53,7 @@ export function generateReleaseCandidatePassportCli() {
       workflowShellRef: env("BUILDCHAIN_WORKFLOW_SHELL_REF", buildSummary.runtime?.workflowShellRef || ""),
     },
     gateAggregate,
+    familyEvidence,
     controllerReceipts,
     workflow: {
       name: env("GITHUB_WORKFLOW"),
@@ -80,6 +83,7 @@ export function generateReleaseCandidatePassportCli() {
       candidateHash: passport.candidateHash,
       platformCount: passport.platformMatrix.length,
       gateProfileEvidence: passport.gateProfileEvidence,
+      familyEvidence: passport.familyEvidence,
       controllerReceipts: passport.controllerReceipts || [],
     }),
   });

package/scripts/generate-site-bundle.mjs

@@ -34,6 +34,10 @@ import {
 } from "../packages/core/public-surface-audit.js";
 import { createSurfaceTimestampPolicy } from "../packages/core/surface-manifest.js";
 import { projectHomepageIntro } from "./site-bundle-homepage.mjs";
+import {
+  BUILDCHAIN_COMMAND_REGISTRY,
+  resolveBuildchainCommand,
+} from "../bin/internal/command-registry.mjs";
 
 const SITE_BUNDLE_CONTRACT = "kungfu-buildchain-site-bundle";
 const PUBLICATION_RELEASE_REGISTRY_CONTRACT = "kungfu-buildchain-publication-release-registry";
@@ -322,6 +326,18 @@ function capabilityGroup(id) {
   return id;
 }
 
+function publicSurfaceLifecycle({ owner, maturity, nonDuplicationRationale }) {
+  return {
+    owner,
+    maturity,
+    introducedVersion: "pre-3.0.2-alpha.4",
+    compatibilityPromise: "preserved-through-the-v3-major-line",
+    deprecationReplacement: "",
+    sunsetCondition: "explicit-breaking-change-review-in-a-future-major-line",
+    nonDuplicationRationale,
+  };
+}
+
 const manualMetaById = new Map(Object.entries({
   map: { capabilityGroup: "getting-started", audience: ["agent", "consumer"], maturity: "stable", order: 10 },
   install: { capabilityGroup: "getting-started", audience: ["consumer"], maturity: "stable", order: 20 },
@@ -477,12 +493,22 @@ function cliCommandMeta(id) {
     "portable-cache-plan": { group: "observability-diagnostics", purpose: "Validate a consumer-neutral cache manifest and emit exact GitHub Actions cache inputs." },
     "portable-cache-receipt": { group: "observability-diagnostics", purpose: "Seal exact, compatible, miss, or corrupt provider evidence against one cache plan." },
     "npm-dry-run": { group: "release-passport-trust", purpose: "Verify npm publish shape before a release transaction." },
+    paper: { group: "reusable-build", purpose: "Inspect the unified paper repository and publication command families." },
+    "paper-alpha": { group: "release-passport-trust", purpose: "Plan or open the protected dev-to-alpha paper publication PR without direct publication." },
+    "paper-bootstrap-npm": { group: "release-passport-trust", purpose: "Dry-run or explicitly bootstrap the public npm package and bind GitHub Trusted Publishing." },
+    "paper-build": { group: "reusable-build", purpose: "Plan or execute the existing two-clean-build reproducibility gate for a paper." },
+    "paper-migrate": { group: "getting-started", purpose: "Plan or write the bounded Buildchain-owned control-file migration for an existing paper repository." },
+    "paper-preflight": { group: "reusable-build", purpose: "Report exact source, runtime, permission, npm trust, deterministic build, and release-state readiness." },
+    "paper-resume": { group: "release-passport-trust", purpose: "Plan or dispatch recovery of the exact existing sealed paper release transaction." },
+    "paper-scaffold": { group: "getting-started", purpose: "Plan or write an idempotent, no-overwrite, release-ready paper repository scaffold." },
+    "paper-status": { group: "reusable-build", purpose: "Report explicit evidence for every paper lifecycle state without unsupported inference." },
     "publish-source": { group: "release-passport-trust", purpose: "Create, inspect, or verify publish-gate source-lock refs." },
     "publication-artifact": { group: "reusable-build", purpose: "Generate publication artifact manifests, passports, and source bundles for paper/report repositories." },
     "publication-artifact-manifest": { group: "reusable-build", purpose: "Write a site-consumable publication artifact manifest, publication passport, and source bundle." },
     "publication-artifact-npm-package": { group: "reusable-build", purpose: "Synthesize the declared npm paper package from a publication artifact manifest, passport, registry, source bundle, and primary artifact." },
     project: { group: "release-passport-trust", purpose: "Inspect read-only consumer projection command families." },
     "project-kfx-admission": { group: "release-passport-trust", purpose: "Project one verified sealed envelope into direct KFX admission inputs without reconstructing evidence." },
+    "publication-artifact-reproducibility": { group: "reusable-build", purpose: "Prove exact PDF, source bundle, publication evidence, and npm tarball bytes across two independent clean builds." },
     "release-dry-run": { group: "governance-versioning", purpose: "Explain what a channel merge would publish before the PR is merged." },
     "release-line-open": { group: "governance-versioning", purpose: "Plan or write the initial version-state commit for a new minor release line." },
     "release-governance": { group: "governance-versioning", purpose: "Reconcile a managed branch's Buildchain aggregate check to an already-tested pull request SHA." },
@@ -527,6 +553,9 @@ function nodeApiMeta(exportName) {
     "./portable-dev-cache": { group: "observability-diagnostics", summary: "Portable dependency/compiler cache plan, exact-root verification, and provider receipt APIs." },
     "./publication-artifact": { group: "reusable-build", summary: "Publication artifact manifest, source bundle, and publication passport APIs." },
     "./publication-package": { group: "reusable-build", summary: "Publication npm package synthesis APIs for Buildchain-managed paper release presets." },
+    "./publication-reproducibility": { group: "reusable-build", summary: "Two-clean-build publication byte reproducibility receipt APIs." },
+    "./publication-sealed-bundle": { group: "reusable-build", summary: "Build-once publication bundle manifests and exact-byte resume verification APIs." },
+    "./paper": { group: "reusable-build", summary: "Unified paper scaffold, preflight, npm bootstrap, build, Alpha, status, and resume planning APIs." },
     "./publication-authority": { group: "release-passport-trust", summary: "Sealed publication authority registry, runner provenance, control-plane audit, admission, and independent verification APIs." },
     "./publication-control-plane-audit": { group: "release-passport-trust", summary: "Read-only publication control-plane snapshot evaluation APIs." },
     "./buildchain-publication-authority": { group: "release-passport-trust", summary: "Buildchain-owned closed-world publication authority descriptor registry." },
@@ -564,6 +593,45 @@ function nodeApiMeta(exportName) {
   return { capabilityGroup: capabilityGroup(meta.group), summary: meta.summary, audience: ["developer", "agent"], maturity: "stable" };
 }
 
+function createCliRegistry(packageJson) {
+  const commands = enumerateCliCommandsFromBin({ root });
+  const documentedTopLevelCommands = new Set();
+  for (const entry of commands) {
+    const command = entry.usage.split(/\s+/)[1] || "";
+    const registration = resolveBuildchainCommand(command);
+    if (!registration) {
+      throw new Error(`CLI help documents an unregistered top-level command: ${command}`);
+    }
+    documentedTopLevelCommands.add(registration.id);
+  }
+  for (const entry of BUILDCHAIN_COMMAND_REGISTRY) {
+    if (!documentedTopLevelCommands.has(entry.id)) {
+      throw new Error(`CLI runtime command is absent from help enumeration: ${entry.id}`);
+    }
+  }
+  return {
+    schemaVersion: 1,
+    contract: "kungfu-buildchain-cli-registry",
+    binary: "buildchain",
+    npmPackage: packageJson.name,
+    commandSource: "bin/internal/command-registry.mjs plus bin/buildchain.mjs help enumeration",
+    commands: commands.map((entry) => {
+      const meta = cliCommandMeta(entry.id);
+      return {
+        ...entry,
+        purpose: meta.purpose,
+        capabilityGroup: meta.capabilityGroup,
+        audience: meta.audience,
+        ...publicSurfaceLifecycle({
+          owner: "buildchain-cli",
+          maturity: meta.maturity,
+          nonDuplicationRationale: "Existing command identity retained for CLI compatibility and discoverability.",
+        }),
+      };
+    }),
+  };
+}
+
 function buildCapabilityRegistry({ docs, pages, cliRegistry, manualRegistry, nodeApiRegistry, workflowRegistry }) {
   const groupCounts = new Map(CAPABILITY_GROUPS.map((group) => [group.id, {
     manualCount: 0,
@@ -779,23 +847,7 @@ function buildSiteBundle() {
     artifactDigestScope: "npm package dist/site JSON files",
   });
 
-  const cliRegistry = {
-    schemaVersion: 1,
-    contract: "kungfu-buildchain-cli-registry",
-    binary: "buildchain",
-    npmPackage: packageJson.name,
-    commandSource: "bin/buildchain.mjs reverse enumeration",
-    commands: enumerateCliCommandsFromBin({ root }).map((entry) => {
-      const meta = cliCommandMeta(entry.id);
-      return {
-        ...entry,
-        purpose: meta.purpose,
-        capabilityGroup: meta.capabilityGroup,
-        audience: meta.audience,
-        maturity: meta.maturity,
-      };
-    }),
-  };
+  const cliRegistry = createCliRegistry(packageJson);
 
   const manualRegistry = {
     schemaVersion: 1,
@@ -874,7 +926,11 @@ function buildSiteBundle() {
           summary: meta.summary,
           capabilityGroup: meta.capabilityGroup,
           audience: meta.audience,
-          maturity: meta.maturity,
+          ...publicSurfaceLifecycle({
+            owner: "buildchain-core",
+            maturity: meta.maturity,
+            nonDuplicationRationale: "Existing package subpath retained as the canonical API boundary for this capability.",
+          }),
         };
       }),
     docs: [
@@ -937,6 +993,11 @@ function buildSiteBundle() {
           status: statusById.get(entry.id) || "active",
         }),
         status: statusById.get(entry.id) || "active",
+        ...publicSurfaceLifecycle({
+          owner: "buildchain-workflows",
+          maturity: statusById.get(entry.id) || "active",
+          nonDuplicationRationale: "Existing workflow identity retained for caller compatibility and repository orchestration.",
+        }),
       };
     }),
     actionSource: "actions/*/action.yml reverse input enumeration",
@@ -944,6 +1005,11 @@ function buildSiteBundle() {
       ...entry,
       capabilityGroup: actionCapabilityGroup(entry.id),
       status: "active",
+      ...publicSurfaceLifecycle({
+        owner: "buildchain-actions",
+        maturity: "stable",
+        nonDuplicationRationale: "Existing action identity retained as the canonical composite or JavaScript action boundary.",
+      }),
     })),
   };
   const controllerRegistry = createControllerRegistry({ workflows: workflowRegistry.workflows });

package/scripts/import-artifact-signing-results.mjs

@@ -20,6 +20,30 @@ function resolveBelow(root, relative, label) {
   return target;
 }
 
+function projectCredentialArtifact(source, destination) {
+  const manifest = JSON.parse(
+    fs.readFileSync(path.join(source, "manifest.json"), "utf8"),
+  );
+  if (!Array.isArray(manifest.files) || manifest.files.length === 0)
+    throw new Error("credential artifact manifest contains no files");
+  for (const [index, file] of manifest.files.entries()) {
+    const from = resolveBelow(
+      source,
+      file.path,
+      `credential artifact file ${index}`,
+    );
+    if (!fs.statSync(from).isFile() || fs.lstatSync(from).isSymbolicLink())
+      throw new Error(`credential artifact file is not regular: ${file.path}`);
+    const to = resolveBelow(
+      destination,
+      file.path,
+      `credential artifact projection ${index}`,
+    );
+    fs.mkdirSync(path.dirname(to), { recursive: true });
+    fs.copyFileSync(from, to, fs.constants.COPYFILE_EXCL);
+  }
+}
+
 export function importArtifactSigningResults({
   workspace = process.env.GITHUB_WORKSPACE || process.cwd(),
   cwd = process.env.BUILDCHAIN_SIGNING_CWD || ".",
@@ -41,29 +65,64 @@ export function importArtifactSigningResults({
     byId.set(entry.id, request);
   }
   const imported = [];
+  const credentialArtifacts = [];
   for (const entry of resultIndex.results || []) {
     const request = byId.get(entry.id);
     if (!request) throw new Error(`result has no local sealed request: ${entry.id}`);
     const resultPath = resolveBelow(results, entry.result, "result path");
     const result = JSON.parse(fs.readFileSync(resultPath, "utf8"));
     const payload = resolveBelow(path.dirname(resultPath), result.artifact.path, "signed payload");
-    const target = resolveBelow(sourceRoot, request.artifact.path, "consumer artifact path");
-    const mode = fs.statSync(target).mode;
-    fs.copyFileSync(payload, target);
-    fs.chmodSync(target, mode);
+    if (request.artifact.kind === "app-bundle") {
+      const credentialArtifact = path.join(
+        path.dirname(resultPath),
+        "credential-artifact",
+      );
+      if (!fs.statSync(credentialArtifact).isDirectory())
+        throw new Error("native app signing result has no credential artifact");
+      projectCredentialArtifact(credentialArtifact, sourceRoot);
+    } else {
+      const target = resolveBelow(
+        sourceRoot,
+        request.artifact.path,
+        "consumer artifact path",
+      );
+      const mode = fs.statSync(target).mode;
+      fs.copyFileSync(payload, target);
+      fs.chmodSync(target, mode);
+    }
     const destination = path.resolve(sourceRoot, evidenceRoot, entry.id);
     const rel = path.relative(sourceRoot, destination);
     if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error("imported signing evidence escapes consumer source root");
     fs.mkdirSync(path.dirname(destination), { recursive: true });
     fs.cpSync(path.dirname(resultPath), destination, { recursive: true, force: false, errorOnExist: true });
+    if (request.artifact.kind === "app-bundle") {
+      credentialArtifacts.push({
+        id: entry.id,
+        root: path.join(destination, "credential-artifact"),
+        manifest: path.join(
+          destination,
+          "credential-artifact",
+          "manifest.json",
+        ),
+      });
+    }
     imported.push({ id: entry.id, path: request.artifact.path, resultDigest: result.digest });
   }
+  if (credentialArtifacts.length > 1)
+    throw new Error(
+      "one platform artifact may project at most one native app release payload",
+    );
   writeGitHubOutputs({
     "imported-count": String(imported.length),
     "imported-json": JSON.stringify(imported),
     "evidence-root": path.resolve(sourceRoot, evidenceRoot),
+    "credential-artifact-count": String(credentialArtifacts.length),
+    "credential-artifact-root":
+      credentialArtifacts.length === 1 ? credentialArtifacts[0].root : "",
+    "credential-manifest-path":
+      credentialArtifacts.length === 1 ? credentialArtifacts[0].manifest : "",
   });
-  return { ...verification, imported };
+  return { ...verification, imported, credentialArtifacts };
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {