@kungfu-tech/buildchain 3.0.5-alpha.5 → 3.0.5-alpha.6

package/dist/site/public-surface-audit.json

@@ -7031,7 +7031,7 @@
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "0db010925d1c60209c3dac8bc2797537f307ab21bc68084263e79004c5c16ff7",
     "workflowRegistryDigest": "4f1b9a933e117abc5fc4212241c83a35609f23477dac98d6cd37c4b40b57ba29",
-    "pageRegistryDigest": "296f5d2e42e07ab8f65791f250e8563e5478cd74e8bb78298f025bfd23072a29"
+    "pageRegistryDigest": "1f715d11aca1124de121006046c07387d8d3d6b14fb868f8542626195285ec24"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-02T07:07:12.421Z",
-  "publishedAt": "2026-08-02T07:07:12.421Z",
+  "generatedAt": "2026-08-02T08:34:45.723Z",
+  "publishedAt": "2026-08-02T08:34:45.723Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "7f32e917c5561a53cf9ffc6e0f8a18df841a1cd9",
+  "sourceRevision": "2b5880a79f169f4a64b193a06a47b990d6585e16",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.5",
+    "version": "3.0.5-alpha.6",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-02T07:07:12.421Z",
-  "publishedAt": "2026-08-02T07:07:12.421Z",
+  "generatedAt": "2026-08-02T08:34:45.723Z",
+  "publishedAt": "2026-08-02T08:34:45.723Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "7f32e917c5561a53cf9ffc6e0f8a18df841a1cd9",
+  "sourceRevision": "2b5880a79f169f4a64b193a06a47b990d6585e16",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.5",
+    "version": "3.0.5-alpha.6",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:62f5633ce6df3db2b92358a078dcc82d935d6fe480b9b4bf99294c0c1ccc39fb"
+      "digest": "sha256:470b65c96353a9f3fac0db7b67bba34058e03bfa7e1a8fc6bec0d6d9f13aa6c4"
     },
     {
       "id": "build-facts",

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -199,6 +199,10 @@ paid launch. Reservations are never refunded: a controller crash, ambiguous
 launch, or successful launch all remain charged to the campaign, favoring a
 false stop over an accidental budget overrun.
 
+Each stack owns a stack-scoped reaper log group, so an independent retained
+one-shot campaign stack can be created without colliding with another
+campaign's audit log resource.
+
 The tag-filtered AWS Budget is defense in depth, not the authoritative launch
 gate. It is disabled by default because a linked account cannot activate a
 cost-allocation tag. Set `EnableTagFilteredBudget=true` only after the AWS
@@ -216,8 +220,9 @@ final job.
 
 `scripts/aws-windows-jit-campaign.mjs` is the one-shot operator boundary.
 Without a mutation mode it emits the arm plan. `arm-campaign` requires the
-campaign id, exact source SHA, state table, and observed prior phase spend to
-be repeated as confirmations, then creates `CONTROL` and `CAMPAIGN#<id>` with
+campaign id, exact source SHA, state table, observed prior phase spend, and a
+bounded one-to-five accepted-instance ceiling to be repeated as confirmations,
+then creates `CONTROL` and `CAMPAIGN#<id>` with
 `attribute_not_exists`
 conditions. DynamoDB therefore refuses a second campaign in the same retained
 state table. The operator can always use `kill-campaign`; there is deliberately
@@ -241,13 +246,15 @@ windows_source=REPLACE_WITH_EXACT_40_CHARACTER_SHA
 windows_state_table=REPLACE_WITH_CAMPAIGN_STATE_TABLE
 windows_expires_at=REPLACE_WITH_ISO_TIMESTAMP_WITHIN_24_HOURS
 windows_phase_spend_baseline_usd=REPLACE_WITH_OBSERVED_PRIOR_WINDOWS_SPEND
+windows_max_accepted_instances=REPLACE_WITH_INTEGER_FROM_1_THROUGH_5
 
 node scripts/aws-windows-jit-campaign.mjs plan-arm \
   --campaign-id "$windows_campaign" \
   --source-sha "$windows_source" \
   --state-table "$windows_state_table" \
   --expires-at "$windows_expires_at" \
-  --phase-spend-baseline-usd "$windows_phase_spend_baseline_usd"
+  --phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
+  --max-accepted-instances "$windows_max_accepted_instances"
 
 node scripts/aws-windows-jit-campaign.mjs arm-campaign \
   --campaign-id "$windows_campaign" \
@@ -258,11 +265,14 @@ node scripts/aws-windows-jit-campaign.mjs arm-campaign \
   --confirm-state-table "$windows_state_table" \
   --expires-at "$windows_expires_at" \
   --phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
-  --confirm-phase-spend-baseline-usd "$windows_phase_spend_baseline_usd"
+  --confirm-phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
+  --max-accepted-instances "$windows_max_accepted_instances" \
+  --confirm-max-accepted-instances "$windows_max_accepted_instances"
 ```
 
-Arming creates a permanent one-shot control record and admits up to five paid
-instances. Its rollback is fail-closed, not deletion: `kill-campaign` first
+Arming creates a permanent one-shot control record and admits only the
+explicitly confirmed number of paid instances, never more than five. Its
+rollback is fail-closed, not deletion: `kill-campaign` first
 persists `KILLED`, then publishes to the dedicated SNS topic so the reaper
 terminates active card-owned instances and removes their JIT parameters. The
 command is idempotent, but the operator must read back DynamoDB, EC2, SSM, and

package/docs/node-api-reference.md

@@ -480,7 +480,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `resolvePropagationChannel` | function: function resolvePropagationChannel(edge, upstreamChannel) | edge, upstreamChannel | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolvePropagationChannel } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation.js:190` |
 | `resolvePublicationCandidateFile` | function: function resolvePublicationCandidateFile(files = [], candidatePath) | files = [], candidatePath | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { resolvePublicationCandidateFile } from "@kungfu-tech/buildchain";` | `packages/core/publication-artifact-candidate.js:23` |
 | `resolveReleasePassportPath` | function: function resolveReleasePassportPath(cwd = process.cwd()) | cwd = process.cwd() | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolveReleasePassportPath } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:92` |
-| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:514` |
+| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:518` |
 | `revokeStableCandidate` | function: function revokeStableCandidate(ledgerInput, versionInput, { reason, actor = "", now = new Date().toISOString() } = {}) | ledgerInput, versionInput, { reason, actor = "", now = new Date().toISOString() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { revokeStableCandidate } from "@kungfu-tech/buildchain";` | `packages/core/stable-candidate-ledger.js:185` |
 | `rollbackReleaseActivationTransaction` | function: function rollbackReleaseActivationTransaction(transaction, { toSiteSourceSha, reason } = {}) | transaction, { toSiteSourceSha, reason } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { rollbackReleaseActivationTransaction } from "@kungfu-tech/buildchain";` | `packages/core/release-activation-transaction.js:290` |
 | `runLifecycleStage` | function: function runLifecycleStage({ cwd = process.cwd(), loadedConfig, name, stage, env: extraEnv, timeoutMinutes }) | { cwd = process.cwd(), loadedConfig, name, stage, env: extraEnv, timeoutMinutes } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { runLifecycleStage } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-config.js:1380` |
@@ -552,7 +552,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain";` | `packages/core/publication-reproducibility.js:869` |
 | `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:124` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain";` | `packages/core/release-passport.js:2743` |
-| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:482` |
+| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:486` |
 | `WEB_SURFACE_PRODUCTION_DECISION_CONTRACT` | constant: const WEB_SURFACE_PRODUCTION_DECISION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PRODUCTION_DECISION_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/web-surface-publication-candidate.js:7` |
 | `WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT` | constant: const WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/web-surface-publication-candidate.js:5` |
 | `webSurfacePublicationDigest` | function: function webSurfacePublicationDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { webSurfacePublicationDigest } from "@kungfu-tech/buildchain";` | `packages/core/web-surface-publication-candidate.js:21` |
@@ -1074,7 +1074,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `resolvePropagationChannel` | function: function resolvePropagationChannel(edge, upstreamChannel) | edge, upstreamChannel | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolvePropagationChannel } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation.js:190` |
 | `resolvePublicationCandidateFile` | function: function resolvePublicationCandidateFile(files = [], candidatePath) | files = [], candidatePath | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { resolvePublicationCandidateFile } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-artifact-candidate.js:23` |
 | `resolveReleasePassportPath` | function: function resolveReleasePassportPath(cwd = process.cwd()) | cwd = process.cwd() | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolveReleasePassportPath } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:92` |
-| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:514` |
+| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:518` |
 | `revokeStableCandidate` | function: function revokeStableCandidate(ledgerInput, versionInput, { reason, actor = "", now = new Date().toISOString() } = {}) | ledgerInput, versionInput, { reason, actor = "", now = new Date().toISOString() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { revokeStableCandidate } from "@kungfu-tech/buildchain/core";` | `packages/core/stable-candidate-ledger.js:185` |
 | `rollbackReleaseActivationTransaction` | function: function rollbackReleaseActivationTransaction(transaction, { toSiteSourceSha, reason } = {}) | transaction, { toSiteSourceSha, reason } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { rollbackReleaseActivationTransaction } from "@kungfu-tech/buildchain/core";` | `packages/core/release-activation-transaction.js:290` |
 | `runLifecycleStage` | function: function runLifecycleStage({ cwd = process.cwd(), loadedConfig, name, stage, env: extraEnv, timeoutMinutes }) | { cwd = process.cwd(), loadedConfig, name, stage, env: extraEnv, timeoutMinutes } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { runLifecycleStage } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-config.js:1380` |
@@ -1146,7 +1146,7 @@ Target: `./packages/core/index.js`. Public symbols: 541.
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-reproducibility.js:869` |
 | `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:124` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain/core";` | `packages/core/release-passport.js:2743` |
-| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:482` |
+| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:486` |
 | `WEB_SURFACE_PRODUCTION_DECISION_CONTRACT` | constant: const WEB_SURFACE_PRODUCTION_DECISION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PRODUCTION_DECISION_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/web-surface-publication-candidate.js:7` |
 | `WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT` | constant: const WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { WEB_SURFACE_PUBLICATION_CANDIDATE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/web-surface-publication-candidate.js:5` |
 | `webSurfacePublicationDigest` | function: function webSurfacePublicationDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { webSurfacePublicationDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/web-surface-publication-candidate.js:21` |
@@ -1911,8 +1911,8 @@ Target: `./packages/core/release-propagation.js`. Public symbols: 25.
 | `RELEASE_PROPAGATION_WORK_STAGES` | constant: const RELEASE_PROPAGATION_WORK_STAGES | none | value | Import does not declare a throw contract. | none-on-import | `import { RELEASE_PROPAGATION_WORK_STAGES } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-constants.js:4` |
 | `repairReleasePropagationWork` | function: function repairReleasePropagationWork({ work, expectedWorkRoot, receipt } = {}) | { work, expectedWorkRoot, receipt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { repairReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-transitions.js:88` |
 | `resolvePropagationChannel` | function: function resolvePropagationChannel(edge, upstreamChannel) | edge, upstreamChannel | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resolvePropagationChannel } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:190` |
-| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:514` |
-| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:482` |
+| `resumeReleasePropagationWork` | function: function resumeReleasePropagationWork(work) | work | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { resumeReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:518` |
+| `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work.js:486` |
 | `writeReleasePropagationLock` | function: function writeReleasePropagationLock({ plan, target = "", cwd = process.cwd(), output = "" } = {}) | { plan, target = "", cwd = process.cwd(), output = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { writeReleasePropagationLock } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:316` |
 
 ## `@kungfu-tech/buildchain/release-activation-transaction`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.5-alpha.5",
+  "version": "3.0.5-alpha.6",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/release-propagation-work.js

@@ -317,8 +317,12 @@ function verifyWorkRelease(work) {
     downstream.executionProfile,
     "release propagation work downstream.executionProfile",
   );
-  if (!profile
-      || JSON.stringify(profile) !== JSON.stringify(downstream.releaseLock.downstream.executionProfile)) {
+  const lockedProfile = normalizeExecutionProfile(
+    downstream.releaseLock.downstream.executionProfile,
+    "release propagation work releaseLock.downstream.executionProfile",
+  );
+  if (!profile || !lockedProfile
+      || sha256Json(profile) !== sha256Json(lockedProfile)) {
     throw new Error("release propagation work execution profile disagrees with the exact release lock");
   }
   return { downstream, profile };
@@ -400,7 +404,7 @@ function verifyWorkPlanAndState(work, downstream, profile) {
     downstream.branch,
     downstream.baseRef,
   );
-  if (JSON.stringify(plan.commands) !== JSON.stringify(expectedCommands)) {
+  if (sha256Json(plan.commands) !== sha256Json(expectedCommands)) {
     throw new Error("release propagation work commands are not canonical");
   }
   const state = assertExactFields(

package/scripts/aws-windows-jit-campaign-core.mjs

@@ -50,6 +50,22 @@ function money(value, label) {
   return Math.round(parsed * 100_000_000) / 100_000_000;
 }
 
+function acceptedInstances(value) {
+  const normalized = String(value ?? "").trim();
+  if (!normalized) return WINDOWS_EC2_JIT.maxAcceptedInstances;
+  const parsed = Number(normalized);
+  if (
+    !Number.isInteger(parsed) ||
+    parsed < 1 ||
+    parsed > WINDOWS_EC2_JIT.maxAcceptedInstances
+  ) {
+    throw new Error(
+      `maxAcceptedInstances must be an integer from 1 through ${WINDOWS_EC2_JIT.maxAcceptedInstances}`,
+    );
+  }
+  return parsed;
+}
+
 function string(value) {
   return { S: String(value) };
 }
@@ -72,8 +88,8 @@ export function createWindowsJitCampaignArmPlan(values = {}) {
     values.phaseSpendBaselineUsd,
     "phaseSpendBaselineUsd",
   );
-  const campaignReservationCeilingUsd =
-    reservationUsd * WINDOWS_EC2_JIT.maxAcceptedInstances;
+  const maxAcceptedInstances = acceptedInstances(values.maxAcceptedInstances);
+  const campaignReservationCeilingUsd = reservationUsd * maxAcceptedInstances;
   const campaignSafetyCeilingUsd =
     campaignReservationCeilingUsd +
     reservationUsd * WINDOWS_EC2_JIT.maxConcurrentInstances;
@@ -103,7 +119,7 @@ export function createWindowsJitCampaignArmPlan(values = {}) {
       stateTable: tableName(values.stateTable),
     },
     limits: {
-      maxAcceptedInstances: WINDOWS_EC2_JIT.maxAcceptedInstances,
+      maxAcceptedInstances,
       reservationUsd,
       budgetLimitUsd: WINDOWS_EC2_JIT.budgetLimitUsd,
       phaseSpendBaselineUsd,

package/scripts/aws-windows-jit-campaign.mjs

@@ -46,10 +46,14 @@ function armPlan() {
     armedAt: arg("armed-at", new Date().toISOString()),
     expiresAt: arg("expires-at"),
     phaseSpendBaselineUsd: arg("phase-spend-baseline-usd"),
+    maxAcceptedInstances: arg("max-accepted-instances"),
   });
 }
 
-function confirm(plan, { phaseSpendBaseline = true } = {}) {
+function confirm(
+  plan,
+  { phaseSpendBaseline = true, maxAcceptedInstances = true } = {},
+) {
   if (arg("confirm-campaign-id") !== plan.campaign.id) {
     throw new Error("--confirm-campaign-id must equal the campaign id");
   }
@@ -71,6 +75,16 @@ function confirm(plan, { phaseSpendBaseline = true } = {}) {
       "--confirm-phase-spend-baseline-usd must equal the phase spend baseline",
     );
   }
+  if (
+    maxAcceptedInstances &&
+    (!arg("confirm-max-accepted-instances").trim() ||
+      Number(arg("confirm-max-accepted-instances")) !==
+        plan.limits.maxAcceptedInstances)
+  ) {
+    throw new Error(
+      "--confirm-max-accepted-instances must equal the campaign slot ceiling",
+    );
+  }
 }
 
 function killSwitchTopic() {
@@ -132,7 +146,10 @@ export function main() {
       expiresAt: new Date(now.getTime() + 1000).toISOString(),
       phaseSpendBaselineUsd: 0,
     });
-    confirm(plan, { phaseSpendBaseline: false });
+    confirm(plan, {
+      phaseSpendBaseline: false,
+      maxAcceptedInstances: false,
+    });
     const topic = killSwitchTopic();
     aws(
       plan,

package/scripts/finalize-native-artifact-signing-result.mjs

@@ -12,6 +12,7 @@ import {
   artifactSigningEvidenceDigest,
   createArtifactSigningResult,
 } from "../packages/core/artifact-signing-result.js";
+import { acceptedMacosCredentialEvidence } from "../actions/macos-credential-island/dmg-assembly.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 function required(value, label) {
@@ -32,15 +33,39 @@ function resolveBelow(root, relative, label) {
   return target;
 }
 
+function expectedCredentialExecution(
+  appBundleResult,
+  expectedRunId,
+  expectedRunAttempt,
+) {
+  if (!appBundleResult) return null;
+  return {
+    runId: required(expectedRunId, "credential execution run id"),
+    runAttempt: required(
+      expectedRunAttempt,
+      "credential execution run attempt",
+    ),
+  };
+}
+
+function acceptedProviderEvidence(evidence, request, expectedExecution) {
+  return expectedExecution
+    ? acceptedMacosCredentialEvidence(evidence, request, expectedExecution)
+    : evidence.status === "passed" &&
+        evidence.provider === request.signature.provider;
+}
+
 export function finalizeNativeArtifactSigningResult({
   requestRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT,
   requestPath = process.env.BUILDCHAIN_SIGNING_REQUEST_PATH,
   signedPayload = process.env.BUILDCHAIN_SIGNED_PAYLOAD,
   evidencePath = process.env.BUILDCHAIN_SIGNING_EVIDENCE,
-  credentialArtifactRoot =
-    process.env.BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
+  credentialArtifactRoot = process.env
+    .BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
   outputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
   checks = process.env.BUILDCHAIN_SIGNING_VERIFICATION_CHECKS,
+  expectedRunId = process.env.GITHUB_RUN_ID,
+  expectedRunAttempt = process.env.GITHUB_RUN_ATTEMPT,
 } = {}) {
   const requests = path.resolve(required(requestRoot, "signing request root"));
   const request = JSON.parse(
@@ -77,19 +102,16 @@ export function finalizeNativeArtifactSigningResult({
   fs.copyFileSync(evidenceSource, evidenceOutput, fs.constants.COPYFILE_EXCL);
   const evidenceDocument = JSON.parse(fs.readFileSync(evidenceOutput, "utf8"));
   const appBundleResult = request.artifact.kind === "app-bundle";
-  const providerEvidencePassed = appBundleResult
-    ? evidenceDocument.schema ===
-        "buildchain.macos-credential-island-evidence/v1" &&
-      evidenceDocument.status === "accepted" &&
-      evidenceDocument.source?.repository === request.source.repository &&
-      evidenceDocument.source?.sha === request.source.sha &&
-      evidenceDocument.source?.treeSha === request.source.treeSha &&
-      evidenceDocument.buildchain?.runtimeSha === request.runtime.sha &&
-      evidenceDocument.app?.architecture === request.artifact.arch &&
-      evidenceDocument.notarization?.application?.status === "Accepted" &&
-      evidenceDocument.notarization?.diskImage?.status === "Accepted"
-    : evidenceDocument.status === "passed" &&
-      evidenceDocument.provider === request.signature.provider;
+  const expectedExecution = expectedCredentialExecution(
+    appBundleResult,
+    expectedRunId,
+    expectedRunAttempt,
+  );
+  const providerEvidencePassed = acceptedProviderEvidence(
+    evidenceDocument,
+    request,
+    expectedExecution,
+  );
   if (!providerEvidencePassed) {
     throw new Error(
       "provider evidence does not prove the requested native signature",