@kungfu-tech/buildchain 3.0.4-alpha.4 → 3.0.4-alpha.6

package/docs/cli-reference.md

@@ -0,0 +1,1936 @@
+---
+status: active
+period: ongoing
+theme: buildchain-generated-reference
+doc_type: technical-reference
+source_level: local-files
+confidence: high
+sensitivity: public
+evidence_grade: A
+review_state: generated
+last_reviewed: 2026-08-01
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-01
+  invisible_context: not asserted
+---
+
+# Buildchain CLI Reference
+
+> Generated from `BUILDCHAIN_USAGE` and the runtime command registry. Do not edit this file by hand.
+
+Every listed help command is intercepted before dispatch, exits zero, and performs no command side effects.
+
+## `audit`
+
+### `buildchain audit`
+
+- Help: `buildchain audit --help`
+- Canonical id: `audit`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain audit
+```
+
+### `buildchain audit github-governance`
+
+- Help: `buildchain audit github-governance --help`
+- Canonical id: `audit`
+- Options: `--allow-nonqualifying`, `--environment`, `--job`, `--json`, `--npm-trust-json`, `--organization`, `--output`, `--package`, `--provider-audit-json`, `--publisher-mode`, `--repository`, `--require-qualifying`, `--source-sha`, `--workflow`, `--workflow-ref`, `--workflow-repository`
+- Syntax:
+
+```text
+buildchain audit github-governance [--organization <owner>] [--repository <owner/repo>] [--output <file>] [--require-qualifying] [--json] [--source-sha <merged-branch-sha>] [--workflow-repository <owner/repo>] [--workflow <path>] [--workflow-ref <sha-or-ref>] [--job <id>] [--environment <name>] [--package <name>] [--publisher-mode npm-trusted-publisher|github-token|oidc-role] [--npm-trust-json <file-or-json>] [--provider-audit-json <file>] [--output <file>] [--allow-nonqualifying]
+```
+
+### `buildchain audit publication-control-plane`
+
+- Help: `buildchain audit publication-control-plane --help`
+- Canonical id: `audit`
+- Options: `--branch`, `--repository`
+- Syntax:
+
+```text
+buildchain audit publication-control-plane --repository <owner/repo> --branch <protected-branch>
+```
+
+## `badges`
+
+### `buildchain badges`
+
+- Help: `buildchain badges --help`
+- Canonical id: `badges`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain badges
+```
+
+### `buildchain badges bundle`
+
+- Help: `buildchain badges bundle --help`
+- Canonical id: `badges-bundle`
+- Options: `--check`, `--claims`, `--cwd`, `--json`, `--readme`, `--write`
+- Syntax:
+
+```text
+buildchain badges bundle [--cwd <dir>] [--readme <path>] [--claims <csv>] [--check] [--write] [--json]
+```
+
+### `buildchain badges readme`
+
+- Help: `buildchain badges readme --help`
+- Canonical id: `badges-readme`
+- Options: `--check`, `--cwd`, `--json`, `--readme`, `--write`
+- Syntax:
+
+```text
+buildchain badges readme [--cwd <dir>] [--readme <path>] [--check] [--write] [--json]
+```
+
+## `build-contract`
+
+### `buildchain build-contract`
+
+- Help: `buildchain build-contract --help`
+- Canonical id: `build-contract`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain build-contract ...
+```
+
+## `candidate`
+
+### `buildchain candidate`
+
+- Help: `buildchain candidate --help`
+- Canonical id: `candidate`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain candidate
+```
+
+### `buildchain candidate timeline`
+
+- Help: `buildchain candidate timeline --help`
+- Canonical id: `candidate`
+- Options: `--input`, `--json`, `--output`
+- Syntax:
+
+```text
+buildchain candidate timeline --input <file-or-json> [--output <file>] [--json]
+```
+
+## `collect`
+
+### `buildchain collect`
+
+- Help: `buildchain collect --help`
+- Canonical id: `collect`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain collect
+```
+
+### `buildchain collect github-release`
+
+- Help: `buildchain collect github-release --help`
+- Canonical id: `collect-github-release`
+- Options: `--anchor-manifest-json`, `--assets-dir`, `--assets-json`, `--base-passport-json`, `--build-facts-json`, `--build-summary-json`, `--dist-tag-evidence-json`, `--github-artifact-attestation-policy-json`, `--impact-json`, `--invariant-passport-cmd`, `--invariant-passport-json`, `--json`, `--kfd-1-witness-json`, `--kfd-2-claim-json`, `--kfd-3-artifact-verify-cmd`, `--kfd-3-artifact-witness-json`, `--kfd-3-prebuild-witness-json`, `--kfd-agent-hub-evidence-json`, `--kfd-product-gate-json`, `--kfd-support-matrix-json`, `--output-dir`, `--package-set-json`, `--platform-manifest-json`, `--product-name`, `--publish-evidence-json`, `--publish-json`, `--release-evidence-json`, `--release-extra-json`, `--release-json`, `--repository`, `--require-base-kfd`, `--tag`, `--transaction-json`, `--trusted-publishing-json`
+- Syntax:
+
+```text
+buildchain collect github-release --tag <tag> [--repository <owner/repo>] [--assets-dir <dir>] [--assets-json <json-or-path>] [--release-json <json-or-path>] [--package-set-json <json-or-path>] [--product-name <name>] [--publish-evidence-json <json-or-path>] [--trusted-publishing-json <json-or-path>] [--transaction-json <json-or-path>] [--anchor-manifest-json <json-or-path>] [--impact-json <json-or-path>] [--build-summary-json <json-or-path>] [--build-facts-json <json-or-path>]... [--platform-manifest-json <json-or-path>]... [--dist-tag-evidence-json <json-or-path>] [--kfd-1-witness-json <json-or-path>]... [--kfd-2-claim-json <json-or-path>]... [--kfd-3-prebuild-witness-json <json-or-path>]... [--kfd-3-artifact-witness-json <json-or-path>]... [--kfd-3-artifact-verify-cmd <command>] [--kfd-support-matrix-json <json-or-path>] [--kfd-product-gate-json <json-or-path>]... [--invariant-passport-json <json-or-path>]... [--invariant-passport-cmd <command>] [--release-evidence-json <json-or-path>]... [--github-artifact-attestation-policy-json <json-or-path>]... [--kfd-agent-hub-evidence-json <json-or-path>] [--base-passport-json <json-or-path>] [--require-base-kfd] [--release-extra-json <json-or-path>] [--publish-json <json-or-path>] [--output-dir <dir>] [--json]
+```
+
+## `create`
+
+### `buildchain create`
+
+- Help: `buildchain create --help`
+- Canonical id: `create`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain create
+```
+
+### `buildchain create github-artifact-attestation-policy`
+
+- Help: `buildchain create github-artifact-attestation-policy --help`
+- Canonical id: `create`
+- Options: `--input-json`, `--json`, `--output`
+- Syntax:
+
+```text
+buildchain create github-artifact-attestation-policy --input-json <file-or-json> [--output <file>] [--json]
+```
+
+### `buildchain create publication-admission`
+
+- Help: `buildchain create publication-admission --help`
+- Canonical id: `create`
+- Options: `--input-json`, `--json`, `--output`
+- Syntax:
+
+```text
+buildchain create publication-admission --input-json <file-or-json> [--output <file>] [--json]
+```
+
+### `buildchain create runner-provenance`
+
+- Help: `buildchain create runner-provenance --help`
+- Canonical id: `create`
+- Options: `--input-json`, `--json`, `--output`
+- Syntax:
+
+```text
+buildchain create runner-provenance --input-json <file-or-json> [--output <file>] [--json]
+```
+
+## `dev`
+
+### `buildchain dev`
+
+- Help: `buildchain dev --help`
+- Canonical id: `dev`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain dev
+```
+
+### `buildchain dev merge-queue`
+
+- Help: `buildchain dev merge-queue --help`
+- Canonical id: `dev`
+- Options: `--apply`, `--branch`, `--check-response-timeout-minutes`, `--cwd`, `--from-config`, `--max-entries-to-build`, `--repository`, `--workflow`
+- Syntax:
+
+```text
+buildchain dev merge-queue --repository <owner/repo> --branch <dev/vN/vN.M> [--from-config | --workflow <required-workflow.yml>...] [--cwd <dir>] [--check-response-timeout-minutes <n>] [--max-entries-to-build <n>] [--apply]
+```
+
+## `diagnostics`
+
+### `buildchain diagnostics`
+
+- Help: `buildchain diagnostics --help`
+- Canonical id: `diagnostics`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain diagnostics
+```
+
+### `buildchain diagnostics summary`
+
+- Help: `buildchain diagnostics summary --help`
+- Canonical id: `diagnostics-summary`
+- Options: `--artifact`, `--json`, `--output`
+- Syntax:
+
+```text
+buildchain diagnostics summary <diagnostics.json>... [--artifact <file>]... [--output <file>] [--json]
+```
+
+## `doctor`
+
+### `buildchain doctor`
+
+- Help: `buildchain doctor --help`
+- Canonical id: `doctor`
+- Options: `--cwd`, `--json`, `--require-publish-source-lock`
+- Syntax:
+
+```text
+buildchain doctor [--cwd <dir>] [--require-publish-source-lock] [--json]
+```
+
+## `explain`
+
+### `buildchain explain`
+
+- Help: `buildchain explain --help`
+- Canonical id: `explain`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain explain
+```
+
+### `buildchain explain artifact`
+
+- Help: `buildchain explain artifact --help`
+- Canonical id: `explain-artifact`
+- Options: `--for`, `--json`, `--npm-registry`, `--passport`
+- Syntax:
+
+```text
+buildchain explain artifact <subject> [--passport <file-or-url>] [--npm-registry <url>] [--for human|agent] [--json]
+```
+
+### `buildchain explain release`
+
+- Help: `buildchain explain release --help`
+- Canonical id: `explain-release`
+- Options: `--for`, `--json`, `--passport`
+- Syntax:
+
+```text
+buildchain explain release --passport <file-or-url> [--for human|agent] [--json]
+```
+
+## `facts`
+
+### `buildchain facts`
+
+- Help: `buildchain facts --help`
+- Canonical id: `facts`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain facts
+```
+
+### `buildchain facts aggregate`
+
+- Help: `buildchain facts aggregate --help`
+- Canonical id: `build-facts`
+- Options: `--artifact`, `--cwd`, `--json`, `--module-fact`, `--output`, `--product`
+- Syntax:
+
+```text
+buildchain facts aggregate [--cwd <dir>] [--product <id>] [--module-fact <file>]... [--artifact <path>]... [--output <file>] [--json]
+```
+
+### `buildchain facts module`
+
+- Help: `buildchain facts module --help`
+- Canonical id: `build-facts`
+- Options: `--cwd`, `--json`, `--legacy-kungfu-buildinfo`, `--module`, `--module-root`, `--output`, `--output-path`, `--version-source`
+- Syntax:
+
+```text
+buildchain facts module [--cwd <dir>] [--module <id>] [--module-root <path>] [--version-source <id>] [--output <file>] [--output-path <path>]... [--legacy-kungfu-buildinfo <file>] [--json]
+```
+
+### `buildchain facts verify`
+
+- Help: `buildchain facts verify --help`
+- Canonical id: `build-facts`
+- Options: `--cwd`, `--fact`, `--json`
+- Syntax:
+
+```text
+buildchain facts verify [--cwd <dir>] --fact <file> [--json]
+```
+
+## `github-governance`
+
+### `buildchain github-governance`
+
+- Help: `buildchain github-governance --help`
+- Canonical id: `github-governance`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain github-governance
+```
+
+### `buildchain github-governance apply`
+
+- Help: `buildchain github-governance apply --help`
+- Canonical id: `github-governance`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...
+```
+
+### `buildchain github-governance plan`
+
+- Help: `buildchain github-governance plan --help`
+- Canonical id: `github-governance`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...
+```
+
+### `buildchain github-governance protection-policy-plan`
+
+- Help: `buildchain github-governance protection-policy-plan --help`
+- Canonical id: `github-governance`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...
+```
+
+### `buildchain github-governance rollback`
+
+- Help: `buildchain github-governance rollback --help`
+- Canonical id: `github-governance`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...
+```
+
+### `buildchain github-governance ruleset-policy-plan`
+
+- Help: `buildchain github-governance ruleset-policy-plan --help`
+- Canonical id: `github-governance`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...
+```
+
+## `help`
+
+### `buildchain help`
+
+- Help: `buildchain help --help`
+- Canonical id: `help`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain help
+```
+
+## `homebrew`
+
+### `buildchain homebrew`
+
+- Help: `buildchain homebrew --help`
+- Canonical id: `homebrew`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain homebrew
+```
+
+### `buildchain homebrew check`
+
+- Help: `buildchain homebrew check --help`
+- Canonical id: `homebrew-check`
+- Options: `--cwd`, `--json`, `--package`, `--release-passport`
+- Syntax:
+
+```text
+buildchain homebrew check [--cwd <dir>] [--package <name>] [--release-passport <file-or-url>] [--json]
+```
+
+### `buildchain homebrew update-formula`
+
+- Help: `buildchain homebrew update-formula --help`
+- Canonical id: `homebrew-update-formula`
+- Options: `--json`, `--package`, `--release-passport`, `--write`
+- Syntax:
+
+```text
+buildchain homebrew update-formula --package <name> --release-passport <file-or-url> [--write] [--json]
+```
+
+## `infra-contract`
+
+### `buildchain infra-contract`
+
+- Help: `buildchain infra-contract --help`
+- Canonical id: `infra-contract`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain infra-contract ...
+```
+
+## `init`
+
+### `buildchain init`
+
+- Help: `buildchain init --help`
+- Canonical id: `init`
+- Options: `--artifact-name`, `--cwd`, `--force`, `--package-manager`, `--runner-preset`, `--type`
+- Syntax:
+
+```text
+buildchain init [--cwd <dir>] [--type package|native|web-surface|infra-contract|publication-artifact|anchored-package] [--force] [--package-manager pnpm|npm|yarn] [--runner-preset <preset>] [--artifact-name <template>]
+```
+
+## `inspect`
+
+### `buildchain inspect`
+
+- Help: `buildchain inspect --help`
+- Canonical id: `inspect`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain inspect
+```
+
+### `buildchain inspect artifact`
+
+- Help: `buildchain inspect artifact --help`
+- Canonical id: `inspect-artifact`
+- Options: `--json`, `--npm-registry`, `--passport`
+- Syntax:
+
+```text
+buildchain inspect artifact <subject> [--passport <file-or-url>] [--npm-registry <url>] [--json]
+```
+
+### `buildchain inspect release`
+
+- Help: `buildchain inspect release --help`
+- Canonical id: `inspect-release`
+- Options: `--json`, `--passport`
+- Syntax:
+
+```text
+buildchain inspect release --passport <file-or-url> [--json]
+```
+
+## `kfd`
+
+### `buildchain kfd`
+
+- Help: `buildchain kfd --help`
+- Canonical id: `kfd`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain kfd ...
+```
+
+### `buildchain kfd 1 gate`
+
+- Help: `buildchain kfd 1 gate --help`
+- Canonical id: `kfd-1-gate`
+- Options: `--artifact-root`, `--cwd`, `--json`, `--output`, `--witness-json`
+- Syntax:
+
+```text
+buildchain kfd 1 gate --witness-json <file-or-json>... [--cwd <dir>] [--artifact-root <dir>] [--output <file>] [--json]
+```
+
+### `buildchain kfd 1 schema`
+
+- Help: `buildchain kfd 1 schema --help`
+- Canonical id: `kfd-1-schema`
+- Options: `--json`, `--schema`
+- Syntax:
+
+```text
+buildchain kfd 1 schema [--schema <name>] [--json]
+```
+
+### `buildchain kfd 1 verify`
+
+- Help: `buildchain kfd 1 verify --help`
+- Canonical id: `kfd-1-verify`
+- Options: `--gate-json`, `--json`
+- Syntax:
+
+```text
+buildchain kfd 1 verify --gate-json <file-or-json> [--json]
+```
+
+### `buildchain kfd 1 witness`
+
+- Help: `buildchain kfd 1 witness --help`
+- Canonical id: `kfd-1-witness`
+- Options: `--cwd`, `--json`, `--output`, `--source-sha`
+- Syntax:
+
+```text
+buildchain kfd 1 witness [--cwd <dir>] [--source-sha <sha>] [--output <file>] [--json]
+```
+
+### `buildchain kfd 2 claims`
+
+- Help: `buildchain kfd 2 claims --help`
+- Canonical id: `kfd-2-claims`
+- Options: `--cwd`, `--json`, `--output-dir`
+- Syntax:
+
+```text
+buildchain kfd 2 claims [--cwd <dir>] [--output-dir <dir>] [--json]
+```
+
+### `buildchain kfd 2 product-claims check`
+
+- Help: `buildchain kfd 2 product-claims check --help`
+- Canonical id: `kfd-2-product-claims`
+- Options: `--channel`, `--cwd`, `--json`, `--output-dir`, `--registry`, `--source-sha`, `--tag`, `--version`
+- Syntax:
+
+```text
+buildchain kfd 2 product-claims <check|write|render> [--cwd <dir>] [--registry <path>] [--output-dir <dir>] [--version <version>] [--channel <channel>] [--tag <tag>] [--source-sha <sha>] [--json]
+```
+
+### `buildchain kfd 2 product-claims render`
+
+- Help: `buildchain kfd 2 product-claims render --help`
+- Canonical id: `kfd-2-product-claims`
+- Options: `--channel`, `--cwd`, `--json`, `--output-dir`, `--registry`, `--source-sha`, `--tag`, `--version`
+- Syntax:
+
+```text
+buildchain kfd 2 product-claims <check|write|render> [--cwd <dir>] [--registry <path>] [--output-dir <dir>] [--version <version>] [--channel <channel>] [--tag <tag>] [--source-sha <sha>] [--json]
+```
+
+### `buildchain kfd 2 product-claims write`
+
+- Help: `buildchain kfd 2 product-claims write --help`
+- Canonical id: `kfd-2-product-claims`
+- Options: `--channel`, `--cwd`, `--json`, `--output-dir`, `--registry`, `--source-sha`, `--tag`, `--version`
+- Syntax:
+
+```text
+buildchain kfd 2 product-claims <check|write|render> [--cwd <dir>] [--registry <path>] [--output-dir <dir>] [--version <version>] [--channel <channel>] [--tag <tag>] [--source-sha <sha>] [--json]
+```
+
+### `buildchain kfd 2 schema`
+
+- Help: `buildchain kfd 2 schema --help`
+- Canonical id: `kfd-2-schema`
+- Options: `--json`, `--schema`
+- Syntax:
+
+```text
+buildchain kfd 2 schema [--schema <name>] [--json]
+```
+
+### `buildchain kfd 2 taxonomy`
+
+- Help: `buildchain kfd 2 taxonomy --help`
+- Canonical id: `kfd-2-taxonomy`
+- Options: `--entry-json`, `--json`, `--kind`
+- Syntax:
+
+```text
+buildchain kfd 2 taxonomy --entry-json <file-or-json>... [--kind residualRisk|downgradeReason] [--json]
+```
+
+### `buildchain kfd 2 trust-assessment`
+
+- Help: `buildchain kfd 2 trust-assessment --help`
+- Canonical id: `kfd-2-trust-assessment`
+- Options: `--assessment-json`, `--json`
+- Syntax:
+
+```text
+buildchain kfd 2 trust-assessment [--assessment-json <file-or-json>] [--json]
+```
+
+### `buildchain kfd 2 trust-claims`
+
+- Help: `buildchain kfd 2 trust-claims --help`
+- Canonical id: `kfd-2-trust-claims`
+- Options: `--claims-json`, `--json`
+- Syntax:
+
+```text
+buildchain kfd 2 trust-claims [--claims-json <file-or-json>] [--json]
+```
+
+### `buildchain kfd 3`
+
+- Help: `buildchain kfd 3 --help`
+- Canonical id: `kfd-3`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain kfd 3 ...
+```
+
+### `buildchain kfd 3 audit`
+
+- Help: `buildchain kfd 3 audit --help`
+- Canonical id: `kfd-3-audit`
+- Options: `--artifact`, `--cwd`, `--json`, `--registry`
+- Syntax:
+
+```text
+buildchain kfd 3 audit [--cwd <dir>] [--registry <path>] [--artifact <path>] [--json]
+```
+
+### `buildchain kfd 3 detect`
+
+- Help: `buildchain kfd 3 detect --help`
+- Canonical id: `kfd-3-detect`
+- Options: `--artifact`, `--cwd`, `--json`, `--kind`
+- Syntax:
+
+```text
+buildchain kfd 3 detect [--cwd <dir>] [--kind <kind>]... [--artifact <path>] [--json]
+```
+
+### `buildchain kfd 3 query`
+
+- Help: `buildchain kfd 3 query --help`
+- Canonical id: `kfd-3-query`
+- Options: `--artifact`, `--cwd`, `--json`, `--passport`, `--registry`
+- Syntax:
+
+```text
+buildchain kfd 3 query [<product>] [--cwd <dir>] [--registry <path>] [--passport <file-or-url>] [--artifact <path>] [--json]
+```
+
+### `buildchain kfd 3 register binary`
+
+- Help: `buildchain kfd 3 register binary --help`
+- Canonical id: `kfd-3-register`
+- Options: `--artifact`, `--cwd`, `--json`, `--product`, `--registry`
+- Syntax:
+
+```text
+buildchain kfd 3 register <node-api|python-api|cli|binary|documentation|site-bundle> [--cwd <dir>] [--registry <path>] [--artifact <path>] [--product <name>] [--json]
+```
+
+### `buildchain kfd 3 register cli`
+
+- Help: `buildchain kfd 3 register cli --help`
+- Canonical id: `kfd-3-register`
+- Options: `--artifact`, `--cwd`, `--json`, `--product`, `--registry`
+- Syntax:
+
+```text
+buildchain kfd 3 register <node-api|python-api|cli|binary|documentation|site-bundle> [--cwd <dir>] [--registry <path>] [--artifact <path>] [--product <name>] [--json]
+```
+
+### `buildchain kfd 3 register documentation`
+
+- Help: `buildchain kfd 3 register documentation --help`
+- Canonical id: `kfd-3-register`
+- Options: `--artifact`, `--cwd`, `--json`, `--product`, `--registry`
+- Syntax:
+
+```text
+buildchain kfd 3 register <node-api|python-api|cli|binary|documentation|site-bundle> [--cwd <dir>] [--registry <path>] [--artifact <path>] [--product <name>] [--json]
+```
+
+### `buildchain kfd 3 register node-api`
+
+- Help: `buildchain kfd 3 register node-api --help`
+- Canonical id: `kfd-3-register`
+- Options: `--artifact`, `--cwd`, `--json`, `--product`, `--registry`
+- Syntax:
+
+```text
+buildchain kfd 3 register <node-api|python-api|cli|binary|documentation|site-bundle> [--cwd <dir>] [--registry <path>] [--artifact <path>] [--product <name>] [--json]
+```
+
+### `buildchain kfd 3 register python-api`
+
+- Help: `buildchain kfd 3 register python-api --help`
+- Canonical id: `kfd-3-register`
+- Options: `--artifact`, `--cwd`, `--json`, `--product`, `--registry`
+- Syntax:
+
+```text
+buildchain kfd 3 register <node-api|python-api|cli|binary|documentation|site-bundle> [--cwd <dir>] [--registry <path>] [--artifact <path>] [--product <name>] [--json]
+```
+
+### `buildchain kfd 3 register site-bundle`
+
+- Help: `buildchain kfd 3 register site-bundle --help`
+- Canonical id: `kfd-3-register`
+- Options: `--artifact`, `--cwd`, `--json`, `--product`, `--registry`
+- Syntax:
+
+```text
+buildchain kfd 3 register <node-api|python-api|cli|binary|documentation|site-bundle> [--cwd <dir>] [--registry <path>] [--artifact <path>] [--product <name>] [--json]
+```
+
+### `buildchain kfd 3 witness`
+
+- Help: `buildchain kfd 3 witness --help`
+- Canonical id: `kfd-3-witness`
+- Options: `--artifact`, `--cwd`, `--json`, `--kind`, `--output`, `--registry`, `--source-sha`
+- Syntax:
+
+```text
+buildchain kfd 3 witness [--cwd <dir>] [--registry <path>] [--kind prebuild|artifact] [--source-sha <sha>] [--artifact <path>] [--output <file>] [--json]
+```
+
+### `buildchain kfd 4 gate`
+
+- Help: `buildchain kfd 4 gate --help`
+- Canonical id: `kfd-4-gate`
+- Options: `--cwd`, `--input-json`, `--json`, `--output`
+- Syntax:
+
+```text
+buildchain kfd 4 gate --input-json <file-or-json> [--cwd <dir>] [--output <file>] [--json]
+```
+
+### `buildchain kfd 4 schema`
+
+- Help: `buildchain kfd 4 schema --help`
+- Canonical id: `kfd-4-schema`
+- Options: `--json`, `--schema`
+- Syntax:
+
+```text
+buildchain kfd 4 schema [--schema <name>] [--json]
+```
+
+### `buildchain kfd 4 verify`
+
+- Help: `buildchain kfd 4 verify --help`
+- Canonical id: `kfd-4-verify`
+- Options: `--expected-source-sha`, `--gate-json`, `--json`
+- Syntax:
+
+```text
+buildchain kfd 4 verify --gate-json <file-or-json> [--expected-source-sha <sha>] [--json]
+```
+
+### `buildchain kfd 5 gate`
+
+- Help: `buildchain kfd 5 gate --help`
+- Canonical id: `kfd-5-gate`
+- Options: `--cwd`, `--input-json`, `--json`, `--output`
+- Syntax:
+
+```text
+buildchain kfd 5 gate --input-json <file-or-json> [--cwd <dir>] [--output <file>] [--json]
+```
+
+### `buildchain kfd 5 schema`
+
+- Help: `buildchain kfd 5 schema --help`
+- Canonical id: `kfd-5-schema`
+- Options: `--json`, `--schema`
+- Syntax:
+
+```text
+buildchain kfd 5 schema [--schema <name>] [--json]
+```
+
+### `buildchain kfd 5 verify`
+
+- Help: `buildchain kfd 5 verify --help`
+- Canonical id: `kfd-5-verify`
+- Options: `--expected-source-sha`, `--gate-json`, `--json`
+- Syntax:
+
+```text
+buildchain kfd 5 verify --gate-json <file-or-json> [--expected-source-sha <sha>] [--json]
+```
+
+### `buildchain kfd 7 gate`
+
+- Help: `buildchain kfd 7 gate --help`
+- Canonical id: `kfd-7-gate`
+- Options: `--cwd`, `--input-json`, `--json`, `--output`
+- Syntax:
+
+```text
+buildchain kfd 7 gate --input-json <file-or-json> [--cwd <dir>] [--output <file>] [--json]
+```
+
+### `buildchain kfd 7 schema`
+
+- Help: `buildchain kfd 7 schema --help`
+- Canonical id: `kfd-7-schema`
+- Options: `--json`, `--schema`
+- Syntax:
+
+```text
+buildchain kfd 7 schema [--schema <name>] [--json]
+```
+
+### `buildchain kfd 7 verify`
+
+- Help: `buildchain kfd 7 verify --help`
+- Canonical id: `kfd-7-verify`
+- Options: `--expected-source-sha`, `--gate-json`, `--json`
+- Syntax:
+
+```text
+buildchain kfd 7 verify --gate-json <file-or-json> [--expected-source-sha <sha>] [--json]
+```
+
+### `buildchain kfd aggregate`
+
+- Help: `buildchain kfd aggregate --help`
+- Canonical id: `kfd-aggregate`
+- Options: `--cwd`, `--json`
+- Syntax:
+
+```text
+buildchain kfd aggregate [--cwd <dir>] [--json]
+```
+
+### `buildchain kfd hub explain`
+
+- Help: `buildchain kfd hub explain --help`
+- Canonical id: `kfd-hub`
+- Options: `--cwd`, `--declaration`, `--for`, `--force`, `--json`, `--output-dir`, `--write`
+- Syntax:
+
+```text
+buildchain kfd hub <init|inspect|test|explain> [--cwd <dir>] [--declaration <path>] [--output-dir <path>] [--write] [--force] [--for agent] [--json]
+```
+
+### `buildchain kfd hub init`
+
+- Help: `buildchain kfd hub init --help`
+- Canonical id: `kfd-hub`
+- Options: `--cwd`, `--declaration`, `--for`, `--force`, `--json`, `--output-dir`, `--write`
+- Syntax:
+
+```text
+buildchain kfd hub <init|inspect|test|explain> [--cwd <dir>] [--declaration <path>] [--output-dir <path>] [--write] [--force] [--for agent] [--json]
+```
+
+### `buildchain kfd hub inspect`
+
+- Help: `buildchain kfd hub inspect --help`
+- Canonical id: `kfd-hub`
+- Options: `--cwd`, `--declaration`, `--for`, `--force`, `--json`, `--output-dir`, `--write`
+- Syntax:
+
+```text
+buildchain kfd hub <init|inspect|test|explain> [--cwd <dir>] [--declaration <path>] [--output-dir <path>] [--write] [--force] [--for agent] [--json]
+```
+
+### `buildchain kfd hub test`
+
+- Help: `buildchain kfd hub test --help`
+- Canonical id: `kfd-hub`
+- Options: `--cwd`, `--declaration`, `--for`, `--force`, `--json`, `--output-dir`, `--write`
+- Syntax:
+
+```text
+buildchain kfd hub <init|inspect|test|explain> [--cwd <dir>] [--declaration <path>] [--output-dir <path>] [--write] [--force] [--for agent] [--json]
+```
+
+### `buildchain kfd migrate-layout`
+
+- Help: `buildchain kfd migrate-layout --help`
+- Canonical id: `kfd-migrate-layout`
+- Options: `--cwd`, `--force`, `--json`, `--write`
+- Syntax:
+
+```text
+buildchain kfd migrate-layout [--cwd <dir>] [--write] [--force] [--json]
+```
+
+### `buildchain kfd schema list`
+
+- Help: `buildchain kfd schema list --help`
+- Canonical id: `kfd-schema-list`
+- Options: `--json`, `--standard`
+- Syntax:
+
+```text
+buildchain kfd schema list [--standard kfd-1|kfd-2|kfd-3|kfd-4] [--json]
+```
+
+### `buildchain kfd schema show kfd-1`
+
+- Help: `buildchain kfd schema show kfd-1 --help`
+- Canonical id: `kfd-schema-show`
+- Options: `--json`, `--schema`
+- Syntax:
+
+```text
+buildchain kfd schema show <kfd-1|kfd-2|kfd-3|kfd-4> [--schema <name>] [--json]
+```
+
+### `buildchain kfd schema show kfd-2`
+
+- Help: `buildchain kfd schema show kfd-2 --help`
+- Canonical id: `kfd-schema-show`
+- Options: `--json`, `--schema`
+- Syntax:
+
+```text
+buildchain kfd schema show <kfd-1|kfd-2|kfd-3|kfd-4> [--schema <name>] [--json]
+```
+
+### `buildchain kfd schema show kfd-3`
+
+- Help: `buildchain kfd schema show kfd-3 --help`
+- Canonical id: `kfd-schema-show`
+- Options: `--json`, `--schema`
+- Syntax:
+
+```text
+buildchain kfd schema show <kfd-1|kfd-2|kfd-3|kfd-4> [--schema <name>] [--json]
+```
+
+### `buildchain kfd schema show kfd-4`
+
+- Help: `buildchain kfd schema show kfd-4 --help`
+- Canonical id: `kfd-schema-show`
+- Options: `--json`, `--schema`
+- Syntax:
+
+```text
+buildchain kfd schema show <kfd-1|kfd-2|kfd-3|kfd-4> [--schema <name>] [--json]
+```
+
+### `buildchain kfd status`
+
+- Help: `buildchain kfd status --help`
+- Canonical id: `kfd-status`
+- Options: `--cwd`, `--json`
+- Syntax:
+
+```text
+buildchain kfd status [--cwd <dir>] [--json]
+```
+
+### `buildchain kfd support project`
+
+- Help: `buildchain kfd support project --help`
+- Canonical id: `kfd-support`
+- Options: `--checked-at`, `--expected-source-sha`, `--gate-json`, `--json`, `--matrix-json`, `--output`
+- Syntax:
+
+```text
+buildchain kfd support project --matrix-json <file-or-json> --gate-json <file-or-json>... [--expected-source-sha <sha>] [--checked-at <date-time>] [--output <file>] [--json]
+```
+
+### `buildchain kfd support verify`
+
+- Help: `buildchain kfd support verify --help`
+- Canonical id: `kfd-support`
+- Options: `--checked-at`, `--expected-source-sha`, `--json`, `--projection-json`
+- Syntax:
+
+```text
+buildchain kfd support verify --projection-json <file-or-json> [--expected-source-sha <sha>] [--checked-at <date-time>] [--json]
+```
+
+### `buildchain kfd upstream check`
+
+- Help: `buildchain kfd upstream check --help`
+- Canonical id: `kfd-upstream-check`
+- Options: `--aggregate-json`, `--cwd`, `--json`
+- Syntax:
+
+```text
+buildchain kfd upstream check [--cwd <dir>] [--aggregate-json <file-or-json>] [--json]
+```
+
+### `buildchain kfd upstream collect`
+
+- Help: `buildchain kfd upstream collect --help`
+- Canonical id: `kfd-upstream-collect`
+- Options: `--cwd`, `--json`, `--output`
+- Syntax:
+
+```text
+buildchain kfd upstream collect [--cwd <dir>] [--output <file>] [--json]
+```
+
+### `buildchain kfd upstream roles`
+
+- Help: `buildchain kfd upstream roles --help`
+- Canonical id: `kfd-upstream-roles`
+- Options: `--json`
+- Syntax:
+
+```text
+buildchain kfd upstream roles [--json]
+```
+
+## `layout`
+
+### `buildchain layout`
+
+- Help: `buildchain layout --help`
+- Canonical id: `layout`
+- Options: `--cwd`, `--json`
+- Syntax:
+
+```text
+buildchain layout [--cwd <dir>] [--json]
+```
+
+## `lifecycle`
+
+### `buildchain lifecycle`
+
+- Help: `buildchain lifecycle --help`
+- Canonical id: `lifecycle`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain lifecycle
+```
+
+### `buildchain lifecycle run`
+
+- Help: `buildchain lifecycle run --help`
+- Canonical id: `lifecycle`
+- Options: `--artifact-name`, `--artifact-path`, `--cwd`, `--manifest-path`, `--process-summary`, `--required`, `--summary-path`
+- Syntax:
+
+```text
+buildchain lifecycle run <stage> [--cwd <dir>] [--required] [--artifact-name <name>] [--artifact-path <path>]... [--manifest-path <path>] [--summary-path <path>] [--process-summary <json>]
+```
+
+## `log`
+
+### `buildchain log`
+
+- Help: `buildchain log --help`
+- Canonical id: `log`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain log
+```
+
+### `buildchain log error`
+
+- Help: `buildchain log error --help`
+- Canonical id: `logging`
+- Options: `--attribute`, `--component`, `--event`, `--json`, `--path`, `--phase`, `--source`
+- Syntax:
+
+```text
+buildchain log <info|warn|error> --event <name> [--phase <phase>] [--component <name>] [--source <name>] [--attribute key=value]... [--path <jsonl>] [--json]
+```
+
+### `buildchain log info`
+
+- Help: `buildchain log info --help`
+- Canonical id: `logging`
+- Options: `--attribute`, `--component`, `--event`, `--json`, `--path`, `--phase`, `--source`
+- Syntax:
+
+```text
+buildchain log <info|warn|error> --event <name> [--phase <phase>] [--component <name>] [--source <name>] [--attribute key=value]... [--path <jsonl>] [--json]
+```
+
+### `buildchain log summary`
+
+- Help: `buildchain log summary --help`
+- Canonical id: `logging`
+- Options: `--json`, `--path`
+- Syntax:
+
+```text
+buildchain log summary [--path <jsonl>] [--json]
+```
+
+### `buildchain log warn`
+
+- Help: `buildchain log warn --help`
+- Canonical id: `logging`
+- Options: `--attribute`, `--component`, `--event`, `--json`, `--path`, `--phase`, `--source`
+- Syntax:
+
+```text
+buildchain log <info|warn|error> --event <name> [--phase <phase>] [--component <name>] [--source <name>] [--attribute key=value]... [--path <jsonl>] [--json]
+```
+
+## `mark`
+
+### `buildchain mark`
+
+- Help: `buildchain mark --help`
+- Canonical id: `mark`
+- Options: `--attribute`, `--component`, `--event`, `--json`, `--path`, `--phase`
+- Syntax:
+
+```text
+buildchain mark --event <name> [--phase <phase>] [--component <name>] [--attribute key=value]... [--path <jsonl>] [--json]
+```
+
+## `npm`
+
+### `buildchain npm`
+
+- Help: `buildchain npm --help`
+- Canonical id: `npm`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain npm
+```
+
+### `buildchain npm dry-run`
+
+- Help: `buildchain npm dry-run --help`
+- Canonical id: `npm-dry-run`
+- Options: `--cwd`, `--dist-tag`, `--expected-tag`, `--json`, `--registry`, `--skip-npm-publish-dry-run`
+- Syntax:
+
+```text
+buildchain npm dry-run [--cwd <dir>] [--expected-tag <tag>] [--registry <url>] [--dist-tag <tag>] [--skip-npm-publish-dry-run] [--json]
+```
+
+## `paper`
+
+### `buildchain paper`
+
+- Help: `buildchain paper --help`
+- Canonical id: `paper`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain paper
+```
+
+### `buildchain paper agent verify`
+
+- Help: `buildchain paper agent verify --help`
+- Canonical id: `paper-agent`
+- Options: `--cwd`, `--json`, `--offline`
+- Syntax:
+
+```text
+buildchain paper agent verify [--cwd <dir>] [--offline] [--json]
+```
+
+### `buildchain paper alpha`
+
+- Help: `buildchain paper alpha --help`
+- Canonical id: `paper-alpha`
+- Options: `--cwd`, `--execute`, `--json`, `--source-ref`, `--target-ref`
+- Syntax:
+
+```text
+buildchain paper alpha [--cwd <dir>] [--source-ref <ref>] [--target-ref <ref>] [--execute] [--json]
+```
+
+### `buildchain paper bootstrap npm`
+
+- Help: `buildchain paper bootstrap npm --help`
+- Canonical id: `paper-bootstrap-npm`
+- Options: `--confirm-public-package`, `--cwd`, `--execute`, `--json`
+- Syntax:
+
+```text
+buildchain paper bootstrap npm [--cwd <dir>] [--execute] [--confirm-public-package <name>] [--json]
+```
+
+### `buildchain paper build`
+
+- Help: `buildchain paper build --help`
+- Canonical id: `paper-build`
+- Options: `--cwd`, `--execute`, `--json`
+- Syntax:
+
+```text
+buildchain paper build [--cwd <dir>] [--execute] [--json]
+```
+
+### `buildchain paper fleet audit`
+
+- Help: `buildchain paper fleet audit --help`
+- Canonical id: `paper-fleet-audit`
+- Options: `--json`, `--offline`, `--root`
+- Syntax:
+
+```text
+buildchain paper fleet audit [--root <dir>] [--offline] [--json]
+```
+
+### `buildchain paper fleet update`
+
+- Help: `buildchain paper fleet update --help`
+- Canonical id: `paper-fleet-update`
+- Options: `--json`, `--root`, `--write`
+- Syntax:
+
+```text
+buildchain paper fleet update [--root <dir>] [--write] [--json]
+```
+
+### `buildchain paper migrate`
+
+- Help: `buildchain paper migrate --help`
+- Canonical id: `paper-migrate`
+- Options: `--cwd`, `--json`, `--write`
+- Syntax:
+
+```text
+buildchain paper migrate [--cwd <dir>] [--write] [--json]
+```
+
+### `buildchain paper preflight`
+
+- Help: `buildchain paper preflight --help`
+- Canonical id: `paper-preflight`
+- Options: `--cwd`, `--json`, `--offline`
+- Syntax:
+
+```text
+buildchain paper preflight [--cwd <dir>] [--offline] [--json]
+```
+
+### `buildchain paper resume`
+
+- Help: `buildchain paper resume --help`
+- Canonical id: `paper-resume`
+- Options: `--buildchain-ref`, `--cwd`, `--execute`, `--json`
+- Syntax:
+
+```text
+buildchain paper resume [--cwd <dir>] [--buildchain-ref <ref>] [--execute] [--json]
+```
+
+### `buildchain paper scaffold`
+
+- Help: `buildchain paper scaffold --help`
+- Canonical id: `paper-scaffold`
+- Options: `--json`, `--package`, `--repository`, `--write`
+- Syntax:
+
+```text
+buildchain paper scaffold --package <name> --repository <owner/repo> [--write] [--json]
+```
+
+### `buildchain paper status`
+
+- Help: `buildchain paper status --help`
+- Canonical id: `paper-status`
+- Options: `--cwd`, `--json`
+- Syntax:
+
+```text
+buildchain paper status [--cwd <dir>] [--json]
+```
+
+### `buildchain paper work start`
+
+- Help: `buildchain paper work start --help`
+- Canonical id: `paper-work-start`
+- Options: `--branch`, `--cwd`, `--execute`, `--json`
+- Syntax:
+
+```text
+buildchain paper work start <topic> [--cwd <dir>] [--branch <branch>] [--execute] [--json]
+```
+
+### `buildchain paper work submit`
+
+- Help: `buildchain paper work submit --help`
+- Canonical id: `paper-work-submit`
+- Options: `--body`, `--cwd`, `--execute`, `--json`, `--title`
+- Syntax:
+
+```text
+buildchain paper work submit [--cwd <dir>] [--title <title>] [--body <body>] [--execute] [--json]
+```
+
+## `portable-cache`
+
+### `buildchain portable-cache`
+
+- Help: `buildchain portable-cache --help`
+- Canonical id: `portable-cache`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain portable-cache
+```
+
+### `buildchain portable-cache plan`
+
+- Help: `buildchain portable-cache plan --help`
+- Canonical id: `portable-cache`
+- Options: `--github-output`, `--json`, `--manifest`, `--output`
+- Syntax:
+
+```text
+buildchain portable-cache plan --manifest <file-or-json> [--output <file>] [--github-output <file>] [--json]
+```
+
+### `buildchain portable-cache receipt`
+
+- Help: `buildchain portable-cache receipt --help`
+- Canonical id: `portable-cache`
+- Options: `--cache-hit`, `--cold-fallback-status`, `--json`, `--matched-key`, `--output`, `--plan`, `--validation-reason`, `--validation-status`
+- Syntax:
+
+```text
+buildchain portable-cache receipt --plan <file-or-json> [--matched-key <key>] [--cache-hit true|false] [--validation-status pass|fail] [--validation-reason <text>] [--cold-fallback-status not-run|passed|failed] [--output <file>] [--json]
+```
+
+## `project`
+
+### `buildchain project`
+
+- Help: `buildchain project --help`
+- Canonical id: `project`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain project
+```
+
+### `buildchain project kfx-admission`
+
+- Help: `buildchain project kfx-admission --help`
+- Canonical id: `project`
+- Options: `--assessment-time`, `--expected-contract`, `--expected-issuer`, `--expected-publisher`, `--expected-root`, `--json`
+- Syntax:
+
+```text
+buildchain project kfx-admission <file-or-json> [--assessment-time <epoch>] [--expected-root <sha256:...>] [--expected-issuer <issuer>] [--expected-publisher <publisher>] [--expected-contract <version>] [--json]
+```
+
+## `publication-artifact`
+
+### `buildchain publication-artifact`
+
+- Help: `buildchain publication-artifact --help`
+- Canonical id: `publication-artifact`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain publication-artifact
+```
+
+### `buildchain publication-artifact manifest`
+
+- Help: `buildchain publication-artifact manifest --help`
+- Canonical id: `publication-artifact-manifest`
+- Options: `--cwd`, `--json`, `--no-source-bundle`, `--output`, `--passport-output`, `--registry-output`, `--source-bundle`, `--source-sha`
+- Syntax:
+
+```text
+buildchain publication-artifact manifest [--cwd <dir>] [--source-sha <sha>] [--output <file>] [--passport-output <file>] [--registry-output <file>] [--source-bundle <file>] [--no-source-bundle] [--json]
+```
+
+### `buildchain publication-artifact npm-package`
+
+- Help: `buildchain publication-artifact npm-package --help`
+- Canonical id: `publication-artifact-npm-package`
+- Options: `--cwd`, `--json`, `--output-dir`, `--package-name`
+- Syntax:
+
+```text
+buildchain publication-artifact npm-package [--cwd <dir>] [--output-dir <dir>] [--package-name <name>] [--json]
+```
+
+### `buildchain publication-artifact reproducibility`
+
+- Help: `buildchain publication-artifact reproducibility --help`
+- Canonical id: `publication-artifact-reproducibility`
+- Options: `--allow-unpinned-toolchain`, `--cwd`, `--json`, `--no-toolchain-pull`, `--output`, `--promote`, `--source-sha`
+- Syntax:
+
+```text
+buildchain publication-artifact reproducibility [--cwd <dir>] [--source-sha <sha>] [--output <file>] [--promote] [--no-toolchain-pull] [--allow-unpinned-toolchain] [--json]
+```
+
+## `publish-source`
+
+### `buildchain publish-source`
+
+- Help: `buildchain publish-source --help`
+- Canonical id: `publish-source`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain publish-source
+```
+
+### `buildchain publish-source lock`
+
+- Help: `buildchain publish-source lock --help`
+- Canonical id: `publish-source`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain publish-source <lock|manifest|verify-lock|verify-channel-ref|validate-anchored-release> ...
+```
+
+### `buildchain publish-source manifest`
+
+- Help: `buildchain publish-source manifest --help`
+- Canonical id: `publish-source`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain publish-source <lock|manifest|verify-lock|verify-channel-ref|validate-anchored-release> ...
+```
+
+### `buildchain publish-source validate-anchored-release`
+
+- Help: `buildchain publish-source validate-anchored-release --help`
+- Canonical id: `publish-source`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain publish-source <lock|manifest|verify-lock|verify-channel-ref|validate-anchored-release> ...
+```
+
+### `buildchain publish-source verify-channel-ref`
+
+- Help: `buildchain publish-source verify-channel-ref --help`
+- Canonical id: `publish-source`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain publish-source <lock|manifest|verify-lock|verify-channel-ref|validate-anchored-release> ...
+```
+
+### `buildchain publish-source verify-lock`
+
+- Help: `buildchain publish-source verify-lock --help`
+- Canonical id: `publish-source`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain publish-source <lock|manifest|verify-lock|verify-channel-ref|validate-anchored-release> ...
+```
+
+## `release`
+
+### `buildchain release`
+
+- Help: `buildchain release --help`
+- Canonical id: `release-transaction`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release
+```
+
+### `buildchain release --dry-run`
+
+- Help: `buildchain release --dry-run --help`
+- Canonical id: `release-dry-run`
+- Options: `--dry-run`, `--json`, `--sha`, `--source-ref`, `--tags`, `--target-ref`
+- Syntax:
+
+```text
+buildchain release --dry-run --target-ref <ref> [--sha <sha>] [--source-ref <ref>] [--tags <comma-list>] [--json]
+```
+
+### `buildchain release abort`
+
+- Help: `buildchain release abort --help`
+- Canonical id: `release-transaction`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release <inspect|recover|finalize|abort> ...
+```
+
+### `buildchain release dry-run`
+
+- Help: `buildchain release dry-run --help`
+- Canonical id: `release-dry-run`
+- Options: `--json`, `--sha`, `--source-ref`, `--tags`, `--target-ref`
+- Syntax:
+
+```text
+buildchain release dry-run --target-ref <ref> [--sha <sha>] [--source-ref <ref>] [--tags <comma-list>] [--json]
+```
+
+### `buildchain release explain`
+
+- Help: `buildchain release explain --help`
+- Canonical id: `release-dry-run`
+- Options: `--json`, `--sha`, `--source-ref`, `--tags`, `--target-ref`
+- Syntax:
+
+```text
+buildchain release explain --target-ref <ref> [--sha <sha>] [--source-ref <ref>] [--tags <comma-list>] [--json]
+```
+
+### `buildchain release finalize`
+
+- Help: `buildchain release finalize --help`
+- Canonical id: `release-transaction`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release <inspect|recover|finalize|abort> ...
+```
+
+### `buildchain release inspect`
+
+- Help: `buildchain release inspect --help`
+- Canonical id: `release-transaction`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release <inspect|recover|finalize|abort> ...
+```
+
+### `buildchain release line open`
+
+- Help: `buildchain release line open --help`
+- Canonical id: `release-line-open`
+- Options: `--initial-version`, `--json`, `--major`, `--minor`, `--source-ref`, `--write`
+- Syntax:
+
+```text
+buildchain release line open --major <n> --minor <n> [--source-ref <ref>] [--initial-version <version>] [--write] [--json]
+```
+
+### `buildchain release recover`
+
+- Help: `buildchain release recover --help`
+- Canonical id: `release-transaction`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release <inspect|recover|finalize|abort> ...
+```
+
+## `release-governance`
+
+### `buildchain release-governance`
+
+- Help: `buildchain release-governance --help`
+- Canonical id: `release-governance`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release-governance
+```
+
+### `buildchain release-governance reconcile`
+
+- Help: `buildchain release-governance reconcile --help`
+- Canonical id: `release-governance`
+- Options: `--apply`, `--branch`, `--candidate-sha`, `--json`, `--repository`
+- Syntax:
+
+```text
+buildchain release-governance reconcile --repository <owner/repo> --branch <dev|alpha|release/vN/vN.N> --candidate-sha <sha> [--apply] [--json]
+```
+
+## `release-propagation`
+
+### `buildchain release-propagation`
+
+- Help: `buildchain release-propagation --help`
+- Canonical id: `release-propagation`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release-propagation
+```
+
+### `buildchain release-propagation plan`
+
+- Help: `buildchain release-propagation plan --help`
+- Canonical id: `release-propagation`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release-propagation <plan|write-lock> ...
+```
+
+### `buildchain release-propagation write-lock`
+
+- Help: `buildchain release-propagation write-lock --help`
+- Canonical id: `release-propagation`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release-propagation <plan|write-lock> ...
+```
+
+## `sample`
+
+### `buildchain sample`
+
+- Help: `buildchain sample --help`
+- Canonical id: `sample`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain sample
+```
+
+### `buildchain sample process-tree`
+
+- Help: `buildchain sample process-tree --help`
+- Canonical id: `sample-process-tree`
+- Options: `--interval-ms`, `--json`, `--label`, `--output`, `--requested-parallelism`, `--summary-output`
+- Syntax:
+
+```text
+buildchain sample process-tree [--interval-ms <n>] [--label <name>] [--output <jsonl>] [--summary-output <json>] [--requested-parallelism <n>] [--json] -- <command> [args...]
+```
+
+## `span`
+
+### `buildchain span`
+
+- Help: `buildchain span --help`
+- Canonical id: `span`
+- Options: `--component`, `--event`, `--path`, `--phase`
+- Syntax:
+
+```text
+buildchain span --event <name> [--phase <phase>] [--component <name>] [--path <jsonl>] -- <command> [args...]
+```
+
+## `transaction`
+
+### `buildchain transaction`
+
+- Help: `buildchain transaction --help`
+- Canonical id: `transaction-inspect`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain transaction
+```
+
+### `buildchain transaction inspect`
+
+- Help: `buildchain transaction inspect --help`
+- Canonical id: `transaction-inspect`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain transaction inspect ...
+```
+
+## `validate`
+
+### `buildchain validate`
+
+- Help: `buildchain validate --help`
+- Canonical id: `validate`
+- Options: `--cwd`, `--require-lifecycle-stages`, `--require-version-state`
+- Syntax:
+
+```text
+buildchain validate [--cwd <dir>] [--require-version-state] [--require-lifecycle-stages <comma-list>]
+```
+
+## `verify`
+
+### `buildchain verify`
+
+- Help: `buildchain verify --help`
+- Canonical id: `verify`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain verify
+```
+
+### `buildchain verify artifact dir`
+
+- Help: `buildchain verify artifact dir --help`
+- Canonical id: `verify-artifact`
+- Options: `--json`, `--locator-config`, `--npm-registry`, `--passport`, `--repository`, `--tag`
+- Syntax:
+
+```text
+buildchain verify artifact <file|dir|url|npm:...|oci:...|github-release:...> [--passport <file-or-url>] [--locator-config <json>] [--repository <owner/repo>] [--tag <tag>] [--npm-registry <url>] [--json]
+```
+
+### `buildchain verify artifact file`
+
+- Help: `buildchain verify artifact file --help`
+- Canonical id: `verify-artifact`
+- Options: `--json`, `--locator-config`, `--npm-registry`, `--passport`, `--repository`, `--tag`
+- Syntax:
+
+```text
+buildchain verify artifact <file|dir|url|npm:...|oci:...|github-release:...> [--passport <file-or-url>] [--locator-config <json>] [--repository <owner/repo>] [--tag <tag>] [--npm-registry <url>] [--json]
+```
+
+### `buildchain verify artifact github-release:...`
+
+- Help: `buildchain verify artifact github-release:... --help`
+- Canonical id: `verify-artifact`
+- Options: `--json`, `--locator-config`, `--npm-registry`, `--passport`, `--repository`, `--tag`
+- Syntax:
+
+```text
+buildchain verify artifact <file|dir|url|npm:...|oci:...|github-release:...> [--passport <file-or-url>] [--locator-config <json>] [--repository <owner/repo>] [--tag <tag>] [--npm-registry <url>] [--json]
+```
+
+### `buildchain verify artifact npm:...`
+
+- Help: `buildchain verify artifact npm:... --help`
+- Canonical id: `verify-artifact`
+- Options: `--json`, `--locator-config`, `--npm-registry`, `--passport`, `--repository`, `--tag`
+- Syntax:
+
+```text
+buildchain verify artifact <file|dir|url|npm:...|oci:...|github-release:...> [--passport <file-or-url>] [--locator-config <json>] [--repository <owner/repo>] [--tag <tag>] [--npm-registry <url>] [--json]
+```
+
+### `buildchain verify artifact oci:...`
+
+- Help: `buildchain verify artifact oci:... --help`
+- Canonical id: `verify-artifact`
+- Options: `--json`, `--locator-config`, `--npm-registry`, `--passport`, `--repository`, `--tag`
+- Syntax:
+
+```text
+buildchain verify artifact <file|dir|url|npm:...|oci:...|github-release:...> [--passport <file-or-url>] [--locator-config <json>] [--repository <owner/repo>] [--tag <tag>] [--npm-registry <url>] [--json]
+```
+
+### `buildchain verify artifact url`
+
+- Help: `buildchain verify artifact url --help`
+- Canonical id: `verify-artifact`
+- Options: `--json`, `--locator-config`, `--npm-registry`, `--passport`, `--repository`, `--tag`
+- Syntax:
+
+```text
+buildchain verify artifact <file|dir|url|npm:...|oci:...|github-release:...> [--passport <file-or-url>] [--locator-config <json>] [--repository <owner/repo>] [--tag <tag>] [--npm-registry <url>] [--json]
+```
+
+### `buildchain verify artifact-envelope`
+
+- Help: `buildchain verify artifact-envelope --help`
+- Canonical id: `verify-artifact-envelope`
+- Options: `--assessment-time`, `--expected-contract`, `--expected-issuer`, `--expected-publisher`, `--expected-root`, `--json`
+- Syntax:
+
+```text
+buildchain verify artifact-envelope <file-or-json> [--assessment-time <epoch>] [--expected-root <sha256:...>] [--expected-issuer <issuer>] [--expected-publisher <publisher>] [--expected-contract <version>] [--json]
+```
+
+### `buildchain verify github-artifact-attestation`
+
+- Help: `buildchain verify github-artifact-attestation --help`
+- Canonical id: `verify-github-artifact-attestation`
+- Options: `--bundle`, `--evidence`, `--json`, `--platform-manifest`, `--release-passport`
+- Syntax:
+
+```text
+buildchain verify github-artifact-attestation <artifact> --evidence <file> --bundle <file> --platform-manifest <file> --release-passport <file> [--json]
+```
+
+### `buildchain verify infra-contract-evidence-bundle`
+
+- Help: `buildchain verify infra-contract-evidence-bundle --help`
+- Canonical id: `verify-infra-contract-evidence-bundle`
+- Options: `--json`
+- Syntax:
+
+```text
+buildchain verify infra-contract-evidence-bundle <file> [--json]
+```
+
+### `buildchain verify observability-log`
+
+- Help: `buildchain verify observability-log --help`
+- Canonical id: `verify-observability-log`
+- Options: `--allow-errors`, `--json`, `--min-events`, `--require-component`, `--require-event`, `--require-phase`
+- Syntax:
+
+```text
+buildchain verify observability-log <jsonl> [--min-events <n>] [--require-phase <csv>] [--require-component <csv>] [--require-event <csv>] [--allow-errors] [--json]
+```
+
+### `buildchain verify publication-admission`
+
+- Help: `buildchain verify publication-admission --help`
+- Canonical id: `verify-publication-admission`
+- Options: `--control-plane-audit-json`, `--expected-json`, `--json`, `--publication-evidence-json`, `--registry-json`, `--runner-json`, `--used-nonce`
+- Syntax:
+
+```text
+buildchain verify publication-admission <file-or-json> --registry-json <file-or-json> --runner-json <file-or-json> --control-plane-audit-json <file-or-json> --publication-evidence-json <file-or-json> [--expected-json <file-or-json>] [--used-nonce <nonce>]... [--json]
+```
+
+### `buildchain verify release-passport`
+
+- Help: `buildchain verify release-passport --help`
+- Canonical id: `verify-release-passport`
+- Options: `--json`
+- Syntax:
+
+```text
+buildchain verify release-passport <file-or-url> [--json]
+```
+
+## `version`
+
+### `buildchain version`
+
+- Help: `buildchain version --help`
+- Canonical id: `version`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain version
+```
+
+## `web-surface`
+
+### `buildchain web-surface`
+
+- Help: `buildchain web-surface --help`
+- Canonical id: `web-surface`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain web-surface ...
+```