@kungfu-tech/buildchain 3.0.5-alpha.2 → 3.0.5-alpha.4

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.2",
+    "version": "3.0.5-alpha.4",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -177,7 +177,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
-      "auditDigest": "sha256:d0e9128f5e46d0c4f439d5e1e4aa7a1ab84bdeb8c43c5d46887871004cb79b26"
+      "auditDigest": "sha256:45f72dc26b1620b0f79558922b44449bda28b25ebc051a737137b5b01c220995"
     },
     {
       "contractVersion": 1,
@@ -219,7 +219,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:cb3776ccf4d09a4197da7f894c6c2f72b15d982b9e3c8e7c3576cc1607e2241b"
+      "auditDigest": "sha256:727d8fe9b0cce68e4808cc3b31b6cf95876a96bad4b5afc8fd441c669d71a1b1"
     },
     {
       "contractVersion": 1,
@@ -3334,7 +3334,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:cb3776ccf4d09a4197da7f894c6c2f72b15d982b9e3c8e7c3576cc1607e2241b"
+      "auditDigest": "sha256:727d8fe9b0cce68e4808cc3b31b6cf95876a96bad4b5afc8fd441c669d71a1b1"
     },
     {
       "contractVersion": 1,
@@ -3548,5 +3548,5 @@
     }
   ],
   "compatibilityDigest": "sha256:3bbcaf835844260ed98414d3bd176667245d12131e13fc748e4c2fae12399691",
-  "contractDigest": "sha256:f6ae61e93292ec8de2c910686175f31d1f28de405730dfba94b775abdc2cf5cf"
+  "contractDigest": "sha256:f54d61463d316487dba2d08b0f69f1781557007902eb53d167381527ad22e860"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-08-02T03:31:24.457Z",
-  "publishedAt": "2026-08-02T03:31:24.457Z",
+  "generatedAt": "2026-08-02T05:24:51.211Z",
+  "publishedAt": "2026-08-02T05:24:51.211Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "1d2c6f6f9571f0417063c9814e5ad0e6fd61bb81",
+  "sourceRevision": "0e42df038cdb688330156635bbcad37e362a8345",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.2",
+    "version": "3.0.5-alpha.4",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.2",
+    "version": "3.0.5-alpha.4",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-02T03:31:24.457Z",
-  "publishedAt": "2026-08-02T03:31:24.457Z",
+  "generatedAt": "2026-08-02T05:24:51.211Z",
+  "publishedAt": "2026-08-02T05:24:51.211Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "1d2c6f6f9571f0417063c9814e5ad0e6fd61bb81",
+  "sourceRevision": "0e42df038cdb688330156635bbcad37e362a8345",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.2",
+    "version": "3.0.5-alpha.4",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-02T03:31:24.457Z",
-  "publishedAt": "2026-08-02T03:31:24.457Z",
+  "generatedAt": "2026-08-02T05:24:51.211Z",
+  "publishedAt": "2026-08-02T05:24:51.211Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "1d2c6f6f9571f0417063c9814e5ad0e6fd61bb81",
+  "sourceRevision": "0e42df038cdb688330156635bbcad37e362a8345",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.2",
+    "version": "3.0.5-alpha.4",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.5-alpha.2",
+  "version": "3.0.5-alpha.4",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/auditable-demo-renditions.mjs

@@ -114,7 +114,7 @@ export function validateRenditionSet(output, helpers) {
     const captureBytes = readRegular(path.join(output, entry.terminalCapture), `${label} terminal capture`, maxBytes);
     const capture = validateTerminalCapture(JSON.parse(decodeUtf8(captureBytes, `${label} terminal capture`)), scene, helpers);
     invariant(entry.captureRoot === sha256(captureBytes), `${label}.captureRoot mismatch`);
-    return { ...entry, transcript, lines, scene, projection, capture };
+    return { ...entry, files: Object.fromEntries(["transcript", "projection", "scene", "terminalCapture"].map((key) => [key, entry[key]])), transcript, lines, scene, projection, capture };
   });
   invariant(normalized[0].captureRoot !== normalized[1].captureRoot, "native rendition capture roots must be distinct");
   invariant(

package/scripts/auditable-demo.mjs

@@ -1017,6 +1017,15 @@ function verifyRendererOutput(renderOutput, expectedImage, expectedInputs, optio
   return { manifest, probe, qualification };
 }
 
+function renditionInputRoots(root, renditions) {
+  return renditions.map((rendition) => ({
+    id: rendition.id, role: rendition.role, captureRoot: rendition.captureRoot,
+    sceneRoot: sha256(readRegular(path.join(root, rendition.files.scene), `${rendition.id} scene`)),
+    transcriptRoot: sha256(readRegular(path.join(root, rendition.files.transcript), `${rendition.id} transcript`)),
+    projectionRoot: sha256(readRegular(path.join(root, rendition.files.projection), `${rendition.id} projection`)),
+  }));
+}
+
 function finalizeGate(values) {
   const adapterOutput = path.resolve(required(values, "--adapter-output"));
   const smokeInput = path.resolve(required(values, "--smoke-input"));
@@ -1109,14 +1118,7 @@ function finalizeGate(values) {
           renditionSet: {
             schema: normalized.renditionSet.schema,
             root: sha256(readRegular(path.join(output, "rendition-set.json"), "rendition set")),
-            renditions: normalized.renditionSet.renditions.map((rendition) => ({
-              id: rendition.id,
-              role: rendition.role,
-              captureRoot: rendition.captureRoot,
-              sceneRoot: sha256(readRegular(path.join(output, rendition.scene), `${rendition.id} scene`)),
-              transcriptRoot: sha256(readRegular(path.join(output, rendition.transcript), `${rendition.id} transcript`)),
-              projectionRoot: sha256(readRegular(path.join(output, rendition.projection), `${rendition.id} projection`)),
-            })),
+            renditions: renditionInputRoots(output, normalized.renditionSet.renditions),
           },
         }
         : {}),
@@ -1179,15 +1181,8 @@ function verifyGate(values) {
     invariant(
       qualifiedRenditionSet.schema === normalized.renditionSet.schema
         && qualifiedRenditionSet.root === sha256(readRegular(path.join(bundle, "rendition-set.json"), "rendition set"))
-        && JSON.stringify(qualifiedRenditionSet.renditions)
-          === JSON.stringify(normalized.renditionSet.renditions.map((rendition) => ({
-            id: rendition.id,
-            role: rendition.role,
-            captureRoot: rendition.captureRoot,
-            sceneRoot: sha256(readRegular(path.join(bundle, rendition.scene), `${rendition.id} scene`)),
-            transcriptRoot: sha256(readRegular(path.join(bundle, rendition.transcript), `${rendition.id} transcript`)),
-            projectionRoot: sha256(readRegular(path.join(bundle, rendition.projection), `${rendition.id} projection`)),
-          }))),
+        && stableJson(qualifiedRenditionSet.renditions)
+          === stableJson(renditionInputRoots(bundle, normalized.renditionSet.renditions)),
       "gate native rendition roots mismatch",
     );
   }
@@ -1311,6 +1306,7 @@ export {
   inspectRendererMedia,
   parseAdapterArguments,
   qualifyMediaFixture,
+  renditionInputRoots,
   prepareSmoke,
   runAdapter,
   sha256,