@kungfu-tech/buildchain 3.0.5-alpha.6 → 3.0.5-alpha.7

package/README.md

@@ -1,5 +1,32 @@
 # Buildchain
 
+<!-- buildchain-auditable-demo:start -->
+## Buildchain beginner bootstrap
+
+[![Buildchain beginner bootstrap](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.gif)](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/public-evidence.json)
+
+Animation scenario:
+
+```text
+$ buildchain init --cwd ./starter --type package --package-manager npm
+$ buildchain layout --cwd ./starter --json
+$ buildchain version
+```
+
+Native renditions: [1080p MP4](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.mp4) · [1080p WebM](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.webm) · [720p MP4](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo-720p.mp4) · [720p WebM](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo-720p.webm)
+
+[Static poster / reduced-motion fallback](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/poster.png)
+
+<details>
+<summary>Evidence and claim boundary</summary>
+
+This exact standalone-binary scenario proves deterministic local bootstrap behavior only; it does not grant release, repository, network, or production authority.
+
+[Release Passport](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/release-passport.json) · [auditable evidence](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/public-evidence.json)
+
+</details>
+<!-- buildchain-auditable-demo:end -->
+
 <!-- buildchain:badges:start -->
 
 [![KFD-1: passed](https://buildchain.libkungfu.dev/badges/v1/kfd-1/passed.svg)](https://github.com/kungfu-systems/buildchain/releases/latest/download/buildchain.release.json)
@@ -277,6 +304,10 @@ The active reusable workflow surfaces are:
   qualification, transcript-bound renderer smoke, optional media rendering
   from the exact passing Gate bundle, and opt-in content-addressed web-delivery
   profiles with independently verified rendition roles;
+- `.github/workflows/.declarative-auditable-demo.yml` for standalone binary
+  consumers that provide only a versioned multi-demo argv scenario and exact
+  same-run binary artifact coordinates; Buildchain owns isolated native
+  capture, Gate, Release Passport, materialization, and protected README PRs;
 - `.github/workflows/.build.yml` for deterministic multi-platform build and
   artifact contracts;
 - `.github/workflows/build.yml` for the single-config channel router that uses

package/bin/buildchain.mjs

@@ -1623,7 +1623,7 @@ async function handlePaperCommand(args) {
 }
 
 async function handleReleasePropagationCommand(args) {
-    runReleasePropagationCli(args);
+    await runReleasePropagationCli(args);
     return;
 
 }

package/contracts/auditable-demo-media-profiles-v1.json

@@ -246,6 +246,67 @@
         "responsive-alternate-video"
       ]
     },
+    "responsive-long-form-web-delivery-v1": {
+      "extends": "responsive-web-delivery-v1",
+      "mode": "web-delivery",
+      "renditions": [
+        {
+          "path": "demo.gif",
+          "maximumBytes": 8388608,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.gif",
+            "observedBytes": 40826,
+            "multiplier": 128,
+            "rounding": "next-power-of-two"
+          }
+        },
+        {
+          "path": "demo.mp4",
+          "maximumBytes": 4194304,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.mp4",
+            "observedBytes": 27038,
+            "multiplier": 128,
+            "rounding": "next-power-of-two"
+          }
+        },
+        {
+          "path": "demo.webm",
+          "maximumBytes": 4194304,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.webm",
+            "observedBytes": 23383,
+            "multiplier": 128,
+            "rounding": "next-power-of-two"
+          }
+        },
+        {
+          "path": "demo-720p.mp4",
+          "maximumBytes": 4194304,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.mp4",
+            "observedBytes": 27038,
+            "multiplier": 128,
+            "rounding": "next-power-of-two"
+          }
+        },
+        {
+          "path": "demo-720p.webm",
+          "maximumBytes": 4194304,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.webm",
+            "observedBytes": 23383,
+            "multiplier": 128,
+            "rounding": "next-power-of-two"
+          }
+        }
+      ]
+    },
     "site-hero-v1": {
       "extends": "web-delivery-v1",
       "mode": "web-delivery",

package/contracts/auditable-demo-scenario-v1.schema.json

@@ -0,0 +1,153 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.libkungfu.dev/contracts/auditable-demo-scenario-v1.schema.json",
+  "title": "Buildchain declarative binary auditable demo",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "product", "artifact", "execution", "renditions", "demos", "publication", "authority"],
+  "properties": {
+    "schema": {"const": "buildchain.declarative-binary-demo/v1"},
+    "product": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "displayName", "binaryName"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"},
+        "displayName": {"type": "string", "minLength": 1, "maxLength": 80},
+        "binaryName": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"}
+      }
+    },
+    "artifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["platformId", "binaryPath", "metadataPath", "metadataContract", "runtimeDependencies"],
+      "properties": {
+        "platformId": {"const": "linux-x64"},
+        "binaryPath": {"type": "string", "minLength": 1},
+        "metadataPath": {"type": "string", "minLength": 1},
+        "metadataContract": {"type": "string", "minLength": 1},
+        "runtimeDependencies": {"type": "array", "maxItems": 0}
+      }
+    },
+    "execution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["deterministic", "network", "secrets", "totalTimeoutSeconds", "environment"],
+      "properties": {
+        "deterministic": {"const": true},
+        "network": {"const": "none"},
+        "secrets": {"const": "none"},
+        "durationClass": {"type": "string", "enum": ["standard", "long-form"]},
+        "totalTimeoutSeconds": {"type": "integer", "minimum": 1},
+        "environment": {
+          "type": "object",
+          "propertyNames": {"pattern": "^[A-Z][A-Z0-9_]{0,63}$"},
+          "additionalProperties": {"type": "string", "maxLength": 256}
+        }
+      }
+    },
+    "renditions": {
+      "const": [
+        {"id": "1080p", "role": "primary", "columns": 150, "rows": 36, "width": 1920, "height": 1080},
+        {"id": "720p", "role": "responsive", "columns": 100, "rows": 28, "width": 1280, "height": 720}
+      ]
+    },
+    "demos": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 8,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "title", "claimBoundary", "steps"],
+        "properties": {
+          "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"},
+          "title": {"type": "string", "minLength": 1, "maxLength": 120},
+          "claimBoundary": {"type": "string", "minLength": 1, "maxLength": 500},
+          "steps": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 12,
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["id", "argv", "timeoutSeconds", "expectedExitCodes", "stdoutIncludes", "fileAssertions"],
+              "properties": {
+                "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"},
+                "argv": {"type": "array", "minItems": 1, "maxItems": 64, "items": {"type": "string", "maxLength": 512}},
+                "timeoutSeconds": {"type": "integer", "minimum": 1, "maximum": 180},
+                "expectedExitCodes": {"type": "array", "minItems": 1, "maxItems": 4, "items": {"type": "integer", "minimum": 0, "maximum": 255}},
+                "stdoutIncludes": {"type": "array", "maxItems": 32, "items": {"type": "string", "minLength": 1, "maxLength": 256}},
+                "fileAssertions": {
+                  "type": "array",
+                  "maxItems": 32,
+                  "items": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["path", "jsonEquals"],
+                    "properties": {
+                      "path": {"type": "string", "minLength": 1},
+                      "jsonEquals": {"type": "object"}
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "publication": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["evidencePath", "readmePath", "marker"],
+      "properties": {
+        "evidencePath": {"type": "string", "minLength": 1},
+        "readmePath": {"type": "string", "minLength": 1},
+        "marker": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{0,79}$"}
+      }
+    },
+    "authority": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["grants", "nonAuthorities"],
+      "properties": {
+        "grants": {"type": "array", "maxItems": 0},
+        "nonAuthorities": {"type": "array", "minItems": 8, "uniqueItems": true, "items": {"type": "string"}}
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "execution": {
+            "required": ["durationClass"],
+            "properties": {"durationClass": {"const": "long-form"}}
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "execution": {"properties": {"totalTimeoutSeconds": {"maximum": 180}}}
+        }
+      },
+      "else": {
+        "properties": {
+          "execution": {"properties": {"totalTimeoutSeconds": {"maximum": 60}}},
+          "demos": {
+            "items": {
+              "properties": {
+                "steps": {
+                  "items": {
+                    "properties": {"timeoutSeconds": {"maximum": 60}}
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
+}

package/contracts/evidence/auditable-demo-responsive-web-delivery-v1.json

@@ -1,5 +1,5 @@
 {
-  "evidenceRoot": "sha256:5bebb7ca41b7b509d63293c3c363fbff917d188fe1d6ae19a73d33424ea623ed",
+  "evidenceRoot": "sha256:30417309facd1092631fd1bd3a104c3ec1f607c3310a61814b27d2145448ec36",
   "inputs": {
     "complete-transcript.txt": "sha256:3cc1fc8a46d47fad052143b54ab261f08d007403c4ec00eba37b0a733f7cc615",
     "public-projection.json": "sha256:c5d5ec702189d2e6eed17419f2fd9a659c1b4cbcf7ee1a58ac8507ec2a748180",
@@ -14,12 +14,12 @@
       "production-site-deployment"
     ],
     "profile": {
-      "catalogRoot": "sha256:cf885ac31104a36aa051fb62f47dd79b68bd671f7dfeeb1a458ea7d0cbf0c479",
+      "catalogRoot": "sha256:87578237079330ac2843113af2baff63031dc1363dba43cf3a59127ed2d255a2",
       "id": "responsive-web-delivery-v1",
       "mode": "web-delivery",
       "profileRoot": "sha256:fdbda001970304af935f58af11ccfdb7c32ec466c9dd487cbb81ee1b19dc4556"
     },
-    "qualificationRoot": "sha256:1c588662db5abcc6776a43b3210f43555161b55ddf8aa4aa4530371bc1d26ec8",
+    "qualificationRoot": "sha256:b18547f31c6b00da9215021b6d54197cbda5fbb5dcb30a633161624b8d8d8af1",
     "renditions": [
       {
         "audioStreams": 0,

package/contracts/evidence/auditable-demo-web-delivery-v1.json

@@ -1,5 +1,5 @@
 {
-  "evidenceRoot": "sha256:5a4fced32999b3007628dfaee32206b0f7512032e65fd57be455e59df2f5d877",
+  "evidenceRoot": "sha256:6875cf065ccafda0127c57a17bc81f0f999fb543341e82072bc9b89f0c7a6f0a",
   "inputs": {
     "complete-transcript.txt": "sha256:f3723a3eda614134ab724ce9fbe1e0e5f916d809a8a3096f5e37c1458cb3656c",
     "public-projection.json": "sha256:127f9877f9750a85eada4338f088bee5460c5c71a83302652d3321667002c3c7",
@@ -14,12 +14,12 @@
       "production-site-deployment"
     ],
     "profile": {
-      "catalogRoot": "sha256:cf885ac31104a36aa051fb62f47dd79b68bd671f7dfeeb1a458ea7d0cbf0c479",
+      "catalogRoot": "sha256:87578237079330ac2843113af2baff63031dc1363dba43cf3a59127ed2d255a2",
       "id": "web-delivery-v1",
       "mode": "web-delivery",
       "profileRoot": "sha256:b6fb0a83414d03a7222fc50429e60ed68b6d47758b86ceaa316ecc659a01ae2b"
     },
-    "qualificationRoot": "sha256:a8509982ce43c133ef50bbb651bdba07b5b37bed06841ebb165f23b81e3b9fc1",
+    "qualificationRoot": "sha256:d8b30192c848ba1c7f6e9a59b5dd1c9f38aae835bb94ad05ad55cdad4b6a8a2f",
     "renditions": [
       {
         "audioStreams": 0,

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.6",
+    "version": "3.0.5-alpha.7",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -323,6 +323,57 @@
       "breakingDigest": "sha256:425f8d3d1ba205dd6fe35a20f1dc6dad7d7c563872283e3af79fea4d5c475692",
       "auditDigest": "sha256:4f0051783d637ff25a1154379dc0eb77a246ad7aee18e12a5e8ff0107aa61a90"
     },
+    {
+      "contractVersion": 1,
+      "stability": "stable",
+      "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line",
+      "id": "declarative-auditable-demo",
+      "kind": "workflow",
+      "path": ".github/workflows/.declarative-auditable-demo.yml",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/.declarative-auditable-demo.yml@v3",
+      "requiredInputs": [
+        "binary-artifact-name",
+        "binary-artifact-digest",
+        "renderer-image"
+      ],
+      "requiredOutputs": [
+        "source-sha",
+        "capture-artifact-name",
+        "capture-artifact-digest",
+        "evidence-artifact-name",
+        "evidence-artifact-digest",
+        "publication-pr-url"
+      ],
+      "breakingDefaults": {
+        "scenarioPathDefault": ".buildchain/auditable-demo.json",
+        "renderMediaDefault": false,
+        "materializeDefault": false,
+        "mediaProfileDefault": "responsive-web-delivery-v1",
+        "artifactRetentionDaysDefault": 14,
+        "executionBoundary": "exact-binary-network-none-secret-free-60-seconds"
+      },
+      "optionalInputs": [
+        "buildchain-repository",
+        "source-ref",
+        "scenario-path",
+        "render-media",
+        "media-profile",
+        "materialize",
+        "materialize-base-ref",
+        "artifact-retention-days"
+      ],
+      "guarantees": [
+        "one versioned declaration can contain multiple demos with multiple ordered literal argv steps",
+        "every demo uses the exact same-run standalone binary admitted by producer-owned artifact name and digest",
+        "capture runs without network or inherited secrets and retains independent native 1080p and 720p terminal dimensions",
+        "the generic adapter feeds the required auditable demo Gate and immutable renderer without product-specific glue",
+        "full rendering emits a content-addressed Release Passport and idempotent protected README update pull request",
+        "manual, alpha, and release callers use the same capture, Gate, renderer, passport, and materializer implementation",
+        "identity, compliance, Product System metadata, package metadata, registry history, scans, and generation grant no authority"
+      ],
+      "breakingDigest": "sha256:0bcba689ab5060e12230db4118895242ecb48677ff581ea0360b1833bdac558c",
+      "auditDigest": "sha256:49051fc60effa1d4077f461c841927b5a1ab411956e94b305cbf06d2895ab5d0"
+    },
     {
       "contractVersion": 1,
       "stability": "stable",
@@ -619,7 +670,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:f3be0e8ce65d5860d1ad808990f78a1fd48c18207a9aacf1ba63fd0d0e51be40"
+      "auditDigest": "sha256:9f5a8549d5d7cb42af5720a05ad3d64b6b06f6415013d62e93fcf7d404978495"
     },
     {
       "contractVersion": 1,
@@ -709,7 +760,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:da035e1a7b51adedfb9c06f59959dd08de3f066b563dff865cc87c8498f68c18"
+      "auditDigest": "sha256:b4d64e6a19089520d4d5cdf49c270871f96f668e1d6edab35bb28d8f093fbfa3"
     },
     {
       "contractVersion": 1,
@@ -731,7 +782,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:77635b2759c316e9a2c42f0b5aca8e032037609661003455683cae969241048a"
+      "auditDigest": "sha256:59cbb97c499c5c9573d9b32bb87da7ca13851760ccecec6dfb73fd0166ab11b1"
     },
     {
       "contractVersion": 1,
@@ -3547,6 +3598,6 @@
       "auditDigest": "sha256:d07482cd66413a2fb3781a3b76f960b8151b6231841799647fe237820de2fde6"
     }
   ],
-  "compatibilityDigest": "sha256:3bbcaf835844260ed98414d3bd176667245d12131e13fc748e4c2fae12399691",
-  "contractDigest": "sha256:23e268fdeea59397e457cb27783d1b69ede401566e63ddc7ea975d54c22f0786"
+  "compatibilityDigest": "sha256:76c3dd58a02887ecd6af33d63e749fef0a988a820fea99bdf4cb078cc48caa83",
+  "contractDigest": "sha256:a4d6ba754b6edebe27ca04d9c275ef7f63efa99c7e66dd84b13595cfc0a34b6c"
 }