@kungfu-tech/buildchain 3.0.3-alpha.0 → 3.0.3-alpha.2

package/bin/buildchain.mjs

@@ -11,6 +11,9 @@ import { runReleasePropagationCli } from "../scripts/release-propagation.mjs";
 import { runReleaseGovernanceCli } from "../scripts/reconcile-release-governance.mjs";
 import { runPublicationArtifactCli } from "../scripts/publication-artifact.mjs";
 import { runPublicationPackageCli } from "../scripts/publication-package.mjs";
+import { runPublicationReproducibilityCli } from "../scripts/publication-reproducibility.mjs";
+import { runPaperCli } from "../scripts/paper.mjs";
+import { BUILDCHAIN_USAGE } from "../scripts/buildchain-cli-help.mjs";
 import { validateBuildchainConfig } from "../packages/core/buildchain-config.js";
 import { detectPackageManager } from "../packages/core/package-manager.js";
 import {
@@ -99,247 +102,14 @@ import {
   TRUST_RELEASE_COMMANDS,
   dispatchTrustReleaseCommand,
 } from "./internal/trust-release-cli.mjs";
+import {
+  BUILDCHAIN_COMMAND_REGISTRY,
+  dispatchRegisteredCommand,
+} from "./internal/command-registry.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const embeddedPackageVersion = process.env.BUILDCHAIN_EMBEDDED_PACKAGE_VERSION || "";
-
-function usage() {
-  return `Usage:
-  buildchain --help
-  buildchain version
-  buildchain layout [--cwd <dir>] [--json]
-  buildchain portable-cache plan --manifest <file-or-json> [--output <file>]
-                                 [--github-output <file>] [--json]
-  buildchain portable-cache receipt --plan <file-or-json> [--matched-key <key>]
-                                    [--cache-hit true|false]
-                                    [--validation-status pass|fail]
-                                    [--validation-reason <text>]
-                                    [--cold-fallback-status not-run|passed|failed]
-                                    [--output <file>] [--json]
-  buildchain candidate timeline --input <file-or-json> [--output <file>] [--json]
-  buildchain init [--cwd <dir>] [--type package|native|web-surface|infra-contract|publication-artifact|anchored-package] [--force]
-                  [--package-manager pnpm|npm|yarn] [--runner-preset <preset>]
-                  [--artifact-name <template>]
-  buildchain validate [--cwd <dir>] [--require-version-state]
-                      [--require-lifecycle-stages <comma-list>]
-  buildchain lifecycle run <stage> [--cwd <dir>] [--required]
-                             [--artifact-name <name>] [--artifact-path <path>]...
-                             [--manifest-path <path>] [--summary-path <path>]
-                             [--process-summary <json>]
-  buildchain npm dry-run [--cwd <dir>] [--expected-tag <tag>] [--registry <url>]
-                         [--dist-tag <tag>] [--skip-npm-publish-dry-run] [--json]
-  buildchain release --dry-run --target-ref <ref> [--sha <sha>] [--source-ref <ref>]
-                                 [--tags <comma-list>] [--json]
-  buildchain release explain --target-ref <ref> [--sha <sha>] [--source-ref <ref>]
-                                     [--tags <comma-list>] [--json]
-  buildchain release dry-run --target-ref <ref> [--sha <sha>] [--source-ref <ref>]
-                                      [--tags <comma-list>] [--json]
-  buildchain release line open --major <n> --minor <n> [--source-ref <ref>]
-                               [--initial-version <version>] [--write] [--json]
-  buildchain release-governance reconcile --repository <owner/repo>
-                               --branch <dev|alpha|release/vN/vN.N>
-                               --candidate-sha <sha> [--apply] [--json]
-  buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...
-  buildchain release <inspect|recover|finalize|abort> ...
-  buildchain transaction inspect ...
-  buildchain collect github-release --tag <tag> [--repository <owner/repo>]
-                                    [--assets-dir <dir>] [--assets-json <json-or-path>]
-                                    [--release-json <json-or-path>] [--package-set-json <json-or-path>]
-                                    [--product-name <name>]
-                                    [--publish-evidence-json <json-or-path>]
-                                    [--trusted-publishing-json <json-or-path>]
-                                    [--transaction-json <json-or-path>]
-                                    [--anchor-manifest-json <json-or-path>]
-                                    [--impact-json <json-or-path>]
-                                    [--build-summary-json <json-or-path>]
-                                    [--build-facts-json <json-or-path>]...
-                                    [--platform-manifest-json <json-or-path>]...
-                                    [--dist-tag-evidence-json <json-or-path>]
-                                    [--kfd-1-witness-json <json-or-path>]...
-                                    [--kfd-2-claim-json <json-or-path>]...
-                                    [--kfd-3-prebuild-witness-json <json-or-path>]...
-                                    [--kfd-3-artifact-witness-json <json-or-path>]...
-                                    [--kfd-3-artifact-verify-cmd <command>]
-                                    [--kfd-support-matrix-json <json-or-path>]
-                                    [--kfd-product-gate-json <json-or-path>]...
-                                    [--invariant-passport-json <json-or-path>]...
-                                    [--invariant-passport-cmd <command>]
-                                    [--github-artifact-attestation-policy-json <json-or-path>]...
-                                    [--kfd-agent-hub-evidence-json <json-or-path>]
-                                    [--base-passport-json <json-or-path>] [--require-base-kfd]
-                                    [--release-extra-json <json-or-path>]
-                                    [--publish-json <json-or-path>] [--output-dir <dir>] [--json]
-  buildchain create publication-admission --input-json <file-or-json> [--output <file>] [--json]
-  buildchain create runner-provenance --input-json <file-or-json> [--output <file>] [--json]
-  buildchain create github-artifact-attestation-policy --input-json <file-or-json> [--output <file>] [--json]
-  buildchain verify release-passport <file-or-url> [--json]
-  buildchain verify github-artifact-attestation <artifact>
-                          --evidence <file> --bundle <file>
-                          --platform-manifest <file> --release-passport <file> [--json]
-  buildchain verify publication-admission <file-or-json>
-                          --registry-json <file-or-json>
-                          --runner-json <file-or-json>
-                          --control-plane-audit-json <file-or-json>
-                          --publication-evidence-json <file-or-json>
-                          [--expected-json <file-or-json>] [--used-nonce <nonce>]... [--json]
-  buildchain audit publication-control-plane --repository <owner/repo> --branch <protected-branch>
-  buildchain audit github-governance [--organization <owner>] [--repository <owner/repo>]
-                                     [--output <file>] [--require-qualifying] [--json]
-                          [--source-sha <merged-branch-sha>] [--workflow-repository <owner/repo>]
-                          [--workflow <path>] [--workflow-ref <sha-or-ref>]
-                          [--job <id>] [--environment <name>] [--package <name>]
-                          [--publisher-mode npm-trusted-publisher|github-token|oidc-role]
-                          [--npm-trust-json <file-or-json>]
-                          [--provider-audit-json <file>] [--output <file>] [--allow-nonqualifying]
-  buildchain verify artifact <file|dir|url|npm:...|oci:...|github-release:...>
-                             [--passport <file-or-url>] [--locator-config <json>]
-                             [--repository <owner/repo>] [--tag <tag>]
-                             [--npm-registry <url>] [--json]
-  buildchain verify artifact-envelope <file-or-json> [--assessment-time <epoch>]
-                             [--expected-root <sha256:...>] [--expected-issuer <issuer>]
-                             [--expected-publisher <publisher>]
-                             [--expected-contract <version>] [--json]
-  buildchain project kfx-admission <file-or-json> [--assessment-time <epoch>]
-                             [--expected-root <sha256:...>] [--expected-issuer <issuer>]
-                             [--expected-publisher <publisher>]
-                             [--expected-contract <version>] [--json]
-  buildchain verify infra-contract-evidence-bundle <file> [--json]
-  buildchain verify observability-log <jsonl> [--min-events <n>]
-                                             [--require-phase <csv>]
-                                             [--require-component <csv>]
-                                             [--require-event <csv>] [--allow-errors] [--json]
-  buildchain explain release --passport <file-or-url> [--for human|agent] [--json]
-  buildchain explain artifact <subject> [--passport <file-or-url>] [--npm-registry <url>] [--for human|agent] [--json]
-  buildchain inspect release --passport <file-or-url> [--json]
-  buildchain inspect artifact <subject> [--passport <file-or-url>] [--npm-registry <url>] [--json]
-  buildchain doctor [--cwd <dir>] [--require-publish-source-lock] [--json]
-  buildchain dev merge-queue --repository <owner/repo> --branch <dev/vN/vN.M>
-                             [--from-config | --workflow <required-workflow.yml>...] [--cwd <dir>]
-                             [--check-response-timeout-minutes <n>]
-                             [--max-entries-to-build <n>] [--apply]
-  buildchain log <info|warn|error> --event <name> [--phase <phase>]
-                 [--component <name>] [--source <name>] [--attribute key=value]...
-                 [--path <jsonl>] [--json]
-  buildchain log summary [--path <jsonl>] [--json]
-  buildchain diagnostics summary <diagnostics.json>... [--artifact <file>]...
-                                      [--output <file>] [--json]
-  buildchain facts module [--cwd <dir>] [--module <id>] [--module-root <path>]
-                          [--version-source <id>] [--output <file>]
-                          [--output-path <path>]... [--legacy-kungfu-buildinfo <file>] [--json]
-  buildchain facts aggregate [--cwd <dir>] [--product <id>]
-                             [--module-fact <file>]... [--artifact <path>]...
-                             [--output <file>] [--json]
-  buildchain facts verify [--cwd <dir>] --fact <file> [--json]
-  buildchain kfd ...
-  buildchain kfd hub <init|inspect|test|explain> [--cwd <dir>]
-                     [--declaration <path>] [--output-dir <path>]
-                     [--write] [--force] [--for agent] [--json]
-  buildchain kfd status [--cwd <dir>] [--json]
-  buildchain kfd migrate-layout [--cwd <dir>] [--write] [--force] [--json]
-  buildchain kfd schema list [--standard kfd-1|kfd-2|kfd-3|kfd-4] [--json]
-  buildchain kfd schema show <kfd-1|kfd-2|kfd-3|kfd-4> [--schema <name>] [--json]
-  buildchain kfd upstream roles [--json]
-  buildchain kfd upstream collect [--cwd <dir>] [--output <file>] [--json]
-  buildchain kfd upstream check [--cwd <dir>] [--aggregate-json <file-or-json>] [--json]
-  buildchain kfd aggregate [--cwd <dir>] [--json]
-  buildchain kfd 1 schema [--schema <name>] [--json]
-  buildchain kfd 1 witness [--cwd <dir>] [--source-sha <sha>] [--output <file>] [--json]
-  buildchain kfd 1 gate --witness-json <file-or-json>... [--cwd <dir>] [--artifact-root <dir>]
-                        [--output <file>] [--json]
-  buildchain kfd 1 verify --gate-json <file-or-json> [--json]
-  buildchain kfd 2 schema [--schema <name>] [--json]
-  buildchain kfd 2 taxonomy --entry-json <file-or-json>... [--kind residualRisk|downgradeReason] [--json]
-  buildchain kfd 2 claims [--cwd <dir>] [--output-dir <dir>] [--json]
-  buildchain kfd 2 product-claims <check|write|render> [--cwd <dir>] [--registry <path>]
-                                      [--output-dir <dir>] [--version <version>]
-                                      [--channel <channel>] [--tag <tag>] [--source-sha <sha>] [--json]
-  buildchain kfd 2 trust-claims [--claims-json <file-or-json>] [--json]
-  buildchain kfd 2 trust-assessment [--assessment-json <file-or-json>] [--json]
-  buildchain kfd 3 ...
-  buildchain kfd 3 detect [--cwd <dir>] [--kind <kind>]... [--artifact <path>] [--json]
-  buildchain kfd 3 register <node-api|python-api|cli|binary|documentation|site-bundle>
-                           [--cwd <dir>] [--registry <path>] [--artifact <path>]
-                           [--product <name>] [--json]
-  buildchain kfd 3 audit [--cwd <dir>] [--registry <path>] [--artifact <path>] [--json]
-  buildchain kfd 3 witness [--cwd <dir>] [--registry <path>] [--kind prebuild|artifact]
-                            [--source-sha <sha>] [--artifact <path>] [--output <file>] [--json]
-  buildchain kfd 3 query [<product>] [--cwd <dir>] [--registry <path>]
-                          [--passport <file-or-url>] [--artifact <path>] [--json]
-  buildchain kfd 4 schema [--schema <name>] [--json]
-  buildchain kfd 4 gate --input-json <file-or-json> [--cwd <dir>] [--output <file>] [--json]
-  buildchain kfd 4 verify --gate-json <file-or-json> [--expected-source-sha <sha>] [--json]
-  buildchain kfd 5 schema [--schema <name>] [--json]
-  buildchain kfd 5 gate --input-json <file-or-json> [--cwd <dir>] [--output <file>] [--json]
-  buildchain kfd 5 verify --gate-json <file-or-json> [--expected-source-sha <sha>] [--json]
-  buildchain kfd 7 schema [--schema <name>] [--json]
-  buildchain kfd 7 gate --input-json <file-or-json> [--cwd <dir>] [--output <file>] [--json]
-  buildchain kfd 7 verify --gate-json <file-or-json> [--expected-source-sha <sha>] [--json]
-  buildchain kfd support project --matrix-json <file-or-json> --gate-json <file-or-json>...
-                                  [--expected-source-sha <sha>] [--checked-at <date-time>]
-                                  [--output <file>] [--json]
-  buildchain kfd support verify --projection-json <file-or-json>
-                                  [--expected-source-sha <sha>] [--checked-at <date-time>] [--json]
-  buildchain sample process-tree [--interval-ms <n>] [--label <name>]
-                                 [--output <jsonl>] [--summary-output <json>]
-                                 [--requested-parallelism <n>] [--json]
-                                 -- <command> [args...]
-  buildchain mark --event <name> [--phase <phase>] [--component <name>]
-                  [--attribute key=value]... [--path <jsonl>] [--json]
-  buildchain span --event <name> [--phase <phase>] [--component <name>]
-                  [--path <jsonl>] -- <command> [args...]
-  buildchain web-surface ...
-  buildchain infra-contract ...
-  buildchain publication-artifact manifest [--cwd <dir>] [--source-sha <sha>]
-                                           [--output <file>] [--passport-output <file>]
-                                           [--registry-output <file>] [--source-bundle <file>]
-                                           [--no-source-bundle] [--json]
-  buildchain publication-artifact npm-package [--cwd <dir>] [--output-dir <dir>] [--package-name <name>] [--json]
-  buildchain release-propagation <plan|write-lock> ...
-  buildchain badges readme [--cwd <dir>] [--readme <path>] [--check] [--write] [--json]
-  buildchain badges bundle [--cwd <dir>] [--readme <path>] [--claims <csv>] [--check] [--write] [--json]
-  buildchain homebrew update-formula --package <name> --release-passport <file-or-url> [--write] [--json]
-  buildchain homebrew check [--cwd <dir>] [--package <name>] [--release-passport <file-or-url>] [--json]
-  buildchain publish-source <lock|manifest|verify-lock|verify-channel-ref|validate-anchored-release> ...
-  buildchain build-contract ...
-
-Examples:
-  buildchain init --type package --package-manager pnpm
-  buildchain validate --require-version-state --require-lifecycle-stages build,verify
-  buildchain lifecycle run build --artifact-path dist --artifact-name "{repo}-{version}-{platform}"
-  buildchain npm dry-run --json
-  buildchain release --dry-run --target-ref alpha/v3/v3.0
-  buildchain release line open --major 3 --minor 1 --source-ref release/v3/v3.0 --json
-  buildchain span --event native.build -- cmake --build build
-  buildchain collect github-release --tag v3.0.0 --assets-dir dist --output-dir .buildchain/release-passport
-  buildchain create publication-admission --input-json admission-input.json --output admission.json
-  buildchain create runner-provenance --input-json runner-input.json --output runner.json
-  buildchain verify release-passport .buildchain/release-passport/buildchain.release.json
-  buildchain verify publication-admission admission.json --registry-json publication-authority-registry.json --runner-json runner.json --control-plane-audit-json control-plane.json --expected-json expected.json --json
-  buildchain audit publication-control-plane --repository kungfu-systems/buildchain --branch release/v3/v3.0
-  buildchain verify artifact ./dist/buildchain-x86_64-unknown-linux-gnu.tar.gz --passport .buildchain/release-passport/buildchain.release.json
-  buildchain verify artifact-envelope .buildchain/kfx/artifact-verification-envelope.json --json
-  buildchain project kfx-admission .buildchain/kfx/artifact-verification-envelope.json --json
-  buildchain verify infra-contract-evidence-bundle .buildchain/infra-contract-evidence-bundle.json
-  buildchain verify observability-log .buildchain/logs/events.jsonl --min-events 4 --require-phase build
-  buildchain infra-contract --mode plan --source-sha <sha>
-  buildchain infra-contract --mode ci --source-sha <sha>
-  buildchain infra-contract --mode plan --source-sha <sha> --execute-adapter-commands true
-  buildchain infra-contract --mode apply --plan <plan.json> --source-sha <sha> --approval-id <id>
-  buildchain infra-contract --mode apply --plan <plan.json> --source-sha <sha> --approval-id <id> --dry-run false --execute-adapter-commands true
-  buildchain infra-contract --mode propagation-apply --propagation-plan <plan.json> --dry-run true
-  buildchain infra-contract --mode evidence-bundle --artifact <artifact.json> --propagation-result <result.json>
-  buildchain publication-artifact manifest --source-sha <sha> --json
-  buildchain release-propagation plan --graph graph.json --upstream-release release.json --json
-  buildchain kfd status --json
-  buildchain kfd schema list --json
-  buildchain kfd 1 witness --json
-  buildchain kfd 2 claims --json
-  buildchain kfd 2 trust-assessment --json
-  buildchain kfd upstream collect --json
-  buildchain kfd aggregate --json
-  buildchain kfd 3 query buildchain --json
-`;
-}
+const embeddedSourceSha = process.env.BUILDCHAIN_EMBEDDED_SOURCE_SHA || "";
 
 function readAttributes(args) {
   const attributes = {};
@@ -1456,10 +1226,9 @@ async function runProcessTreeSample(sampleArgs = []) {
   return report;
 }
 
-async function main(argv = process.argv.slice(2)) {
-  const [command, ...args] = argv;
+async function runRegisteredCommand(command, args) {
   if (!command || command === "-h" || command === "--help" || command === "help") {
-    process.stdout.write(usage());
+    process.stdout.write(BUILDCHAIN_USAGE);
     return;
   }
 
@@ -1814,10 +1583,25 @@ async function main(argv = process.argv.slice(2)) {
       runPublicationPackageCli(args.slice(1));
       return;
     }
+    if (args[0] === "reproducibility" || args[0] === "reproducible") {
+      runPublicationReproducibilityCli(args.slice(1));
+      return;
+    }
     runPublicationArtifactCli(args);
     return;
   }
 
+  if (command === "paper") {
+    await runPaperCli(args, {
+      buildchainRoot: root,
+      buildchainVersion: packageVersion(),
+      buildchainRef: process.env.BUILDCHAIN_RUNTIME_REF || "v3",
+      buildchainSha:
+        process.env.BUILDCHAIN_RUNTIME_SHA || embeddedSourceSha || "",
+    });
+    return;
+  }
+
   if (command === "release-propagation") {
     runReleasePropagationCli(args);
     return;
@@ -1886,6 +1670,22 @@ async function main(argv = process.argv.slice(2)) {
   throw new Error(`unsupported buildchain command: ${command}`);
 }
 
+const BUILDCHAIN_COMMAND_HANDLERS = Object.freeze(Object.fromEntries(
+  BUILDCHAIN_COMMAND_REGISTRY.map((entry) => [
+    entry.id,
+    (args) => runRegisteredCommand(entry.id, args),
+  ]),
+));
+
+async function main(argv = process.argv.slice(2)) {
+  const [command = "help", ...args] = argv;
+  return dispatchRegisteredCommand({
+    command,
+    args,
+    handlers: BUILDCHAIN_COMMAND_HANDLERS,
+  });
+}
+
 main().catch((error) => {
   console.error(`buildchain: ${error.message}`);
   process.exitCode = 1;

package/bin/internal/command-registry.mjs

@@ -0,0 +1,82 @@
+const BUILDCHAIN_COMMAND_REGISTRY = Object.freeze([
+  { id: "help", aliases: ["-h", "--help"] },
+  { id: "version", aliases: ["-v", "--version"] },
+  { id: "layout", aliases: [] },
+  { id: "portable-cache", aliases: [] },
+  { id: "candidate", aliases: [] },
+  { id: "init", aliases: [] },
+  { id: "validate", aliases: [] },
+  { id: "doctor", aliases: [] },
+  { id: "dev", aliases: [] },
+  { id: "log", aliases: [] },
+  { id: "diagnostics", aliases: [] },
+  { id: "facts", aliases: [] },
+  { id: "kfd", aliases: [] },
+  { id: "sample", aliases: [] },
+  { id: "mark", aliases: [] },
+  { id: "span", aliases: [] },
+  { id: "lifecycle", aliases: [] },
+  { id: "npm", aliases: [] },
+  { id: "audit", aliases: [] },
+  { id: "collect", aliases: [] },
+  { id: "create", aliases: [] },
+  { id: "explain", aliases: [] },
+  { id: "inspect", aliases: [] },
+  { id: "project", aliases: [] },
+  { id: "release", aliases: [] },
+  { id: "transaction", aliases: [] },
+  { id: "verify", aliases: [] },
+  { id: "web-surface", aliases: [] },
+  { id: "infra-contract", aliases: [] },
+  { id: "publication-artifact", aliases: ["publication"] },
+  { id: "paper", aliases: [] },
+  { id: "release-propagation", aliases: [] },
+  { id: "release-governance", aliases: [] },
+  { id: "github-governance", aliases: [] },
+  { id: "badges", aliases: [] },
+  { id: "homebrew", aliases: [] },
+  { id: "build-contract", aliases: [] },
+  { id: "publish-source", aliases: [] },
+]);
+
+function buildCommandLookup(registry = BUILDCHAIN_COMMAND_REGISTRY) {
+  const lookup = new Map();
+  for (const entry of registry) {
+    for (const name of [entry.id, ...entry.aliases]) {
+      if (lookup.has(name)) {
+        throw new Error(
+          `duplicate Buildchain CLI command registration: ${name}`,
+        );
+      }
+      lookup.set(name, entry);
+    }
+  }
+  return lookup;
+}
+
+const BUILDCHAIN_COMMAND_LOOKUP = buildCommandLookup();
+
+function resolveBuildchainCommand(command) {
+  return BUILDCHAIN_COMMAND_LOOKUP.get(command || "help");
+}
+
+async function dispatchRegisteredCommand({ command, args = [], handlers }) {
+  const registration = resolveBuildchainCommand(command);
+  if (!registration) {
+    throw new Error(`unsupported buildchain command: ${command}`);
+  }
+  const handler = handlers?.[registration.id];
+  if (typeof handler !== "function") {
+    throw new Error(
+      `Buildchain CLI command has no registered handler: ${registration.id}`,
+    );
+  }
+  return handler(args, { command, registration });
+}
+
+export {
+  BUILDCHAIN_COMMAND_REGISTRY,
+  buildCommandLookup,
+  dispatchRegisteredCommand,
+  resolveBuildchainCommand,
+};

package/bin/internal/trust-release-cli.mjs

@@ -202,6 +202,7 @@ async function dispatchTrustReleaseCommand({ command, args, runScript, packageVe
       kfdProductGateJsons: readRepeatedFlag(collectArgs, "kfd-product-gate-json"),
       invariantPassportJsons: readRepeatedFlag(collectArgs, "invariant-passport-json"),
       invariantPassportCommand: readFlag(collectArgs, "invariant-passport-cmd", ""),
+      releaseEvidenceJsons: readRepeatedFlag(collectArgs, "release-evidence-json"),
       githubArtifactAttestationPolicyJsons: readRepeatedFlag(
         collectArgs,
         "github-artifact-attestation-policy-json",

package/contracts/auditable-demo-media-profiles-v1.json

@@ -131,6 +131,121 @@
         }
       }
     },
+    "responsive-web-delivery-v1": {
+      "extends": "web-delivery-v1",
+      "mode": "web-delivery",
+      "renditions": [
+        {
+          "path": "demo.gif",
+          "role": "readme-compatibility",
+          "mimeType": "image/gif",
+          "container": "gif",
+          "videoCodec": "gif",
+          "audioStreams": 0,
+          "maximumBytes": 1048576,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.gif",
+            "observedBytes": 40826,
+            "multiplier": 16,
+            "rounding": "next-power-of-two"
+          },
+          "dimensions": {
+            "policy": "exact-downscale-same-aspect",
+            "width": 1280,
+            "height": 720
+          }
+        },
+        {
+          "path": "demo.mp4",
+          "role": "primary-video",
+          "mimeType": "video/mp4",
+          "container": "mp4",
+          "videoCodec": "h264",
+          "pixelFormat": "yuv420p",
+          "audioStreams": 0,
+          "maximumBytes": 2097152,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.mp4",
+            "observedBytes": 27038,
+            "multiplier": 64,
+            "rounding": "next-power-of-two"
+          },
+          "progressiveDownload": "moov-before-mdat",
+          "frameRatePolicy": "scene-exact"
+        },
+        {
+          "path": "demo.webm",
+          "role": "alternate-video",
+          "mimeType": "video/webm",
+          "container": "webm",
+          "videoCodec": "vp9",
+          "pixelFormat": "yuv420p",
+          "audioStreams": 0,
+          "maximumBytes": 2097152,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.webm",
+            "observedBytes": 23383,
+            "multiplier": 64,
+            "rounding": "next-power-of-two"
+          },
+          "frameRatePolicy": "scene-exact"
+        },
+        {
+          "path": "demo-720p.mp4",
+          "role": "responsive-primary-video",
+          "mimeType": "video/mp4",
+          "container": "mp4",
+          "videoCodec": "h264",
+          "pixelFormat": "yuv420p",
+          "audioStreams": 0,
+          "maximumBytes": 2097152,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.mp4",
+            "observedBytes": 27038,
+            "multiplier": 64,
+            "rounding": "next-power-of-two"
+          },
+          "progressiveDownload": "moov-before-mdat",
+          "frameRatePolicy": "scene-exact",
+          "dimensions": {
+            "policy": "exact-downscale-same-aspect",
+            "width": 1280,
+            "height": 720
+          }
+        },
+        {
+          "path": "demo-720p.webm",
+          "role": "responsive-alternate-video",
+          "mimeType": "video/webm",
+          "container": "webm",
+          "videoCodec": "vp9",
+          "pixelFormat": "yuv420p",
+          "audioStreams": 0,
+          "maximumBytes": 2097152,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.webm",
+            "observedBytes": 23383,
+            "multiplier": 64,
+            "rounding": "next-power-of-two"
+          },
+          "frameRatePolicy": "scene-exact",
+          "dimensions": {
+            "policy": "exact-downscale-same-aspect",
+            "width": 1280,
+            "height": 720
+          }
+        }
+      ],
+      "singletonRoles": [
+        "responsive-primary-video",
+        "responsive-alternate-video"
+      ]
+    },
     "site-hero-v1": {
       "extends": "web-delivery-v1",
       "mode": "web-delivery",
@@ -155,7 +270,7 @@
     }
   },
   "qualification": {
-    "dimensions": "exact-scene",
+    "dimensions": "exact-scene-or-profile-declared-downscale",
     "durationToleranceMs": 600,
     "memberRootAlgorithm": "sha256",
     "nonClaims": [

package/contracts/buildchain-v2-residuals-v1.json

@@ -7,24 +7,6 @@
     "unclassifiedV2TokensAllowed": false
   },
   "entries": [
-    {
-      "path": ".github/workflows/.build.yml",
-      "token": "BUILDCHAIN_DEFAULT_REF: v2",
-      "expectedOccurrences": 1,
-      "classification": "public-contract-compatibility-fallback",
-      "callerStatus": "fallback-only-when-workflow-shell-ref-is-unavailable",
-      "owner": "buildchain-maintainers",
-      "sunsetCondition": "Change only at a governed major contract boundary after consumer migration."
-    },
-    {
-      "path": ".github/workflows/.build.yml",
-      "token": "BUILDCHAIN_DEFAULT_REF || \"v2\"",
-      "expectedOccurrences": 1,
-      "classification": "public-contract-compatibility-fallback",
-      "callerStatus": "fallback-only-when-workflow-shell-ref-is-unavailable",
-      "owner": "buildchain-maintainers",
-      "sunsetCondition": "Change only at a governed major contract boundary after consumer migration."
-    },
     {
       "path": ".github/workflows/.bump-minor-version.yml",
       "token": "kungfu-systems/buildchain/actions/bump-version@v2",
@@ -115,24 +97,6 @@
       "owner": "buildchain-maintainers",
       "sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
     },
-    {
-      "path": ".github/workflows/.web-surface.yml",
-      "token": "BUILDCHAIN_DEFAULT_REF: v2",
-      "expectedOccurrences": 1,
-      "classification": "public-contract-compatibility-fallback",
-      "callerStatus": "fallback-only-when-workflow-shell-ref-is-unavailable",
-      "owner": "buildchain-maintainers",
-      "sunsetCondition": "Change only at a governed major contract boundary after consumer migration."
-    },
-    {
-      "path": ".github/workflows/.web-surface.yml",
-      "token": "BUILDCHAIN_DEFAULT_REF || \"v2\"",
-      "expectedOccurrences": 1,
-      "classification": "public-contract-compatibility-fallback",
-      "callerStatus": "fallback-only-when-workflow-shell-ref-is-unavailable",
-      "owner": "buildchain-maintainers",
-      "sunsetCondition": "Change only at a governed major contract boundary after consumer migration."
-    },
     {
       "path": ".github/workflows/.wheel-release.yml",
       "token": "workflows v2 wheel release path is retired",
@@ -160,15 +124,6 @@
       "owner": "buildchain-maintainers",
       "sunsetCondition": "Remove after wheel consumers migrate to the lifecycle version command."
     },
-    {
-      "path": ".github/workflows/binary-distribution.yml",
-      "token": "v2.2.0-alpha.0",
-      "expectedOccurrences": 1,
-      "classification": "artifact-version-example",
-      "callerStatus": "manual-input",
-      "owner": "buildchain-maintainers",
-      "sunsetCondition": "Replace when the binary-distribution manual default is refreshed independently of runtime routing."
-    },
     {
       "path": ".github/workflows/candidate-lab.yml",
       "token": "default: \"v2\"",