@kungfu-tech/buildchain 3.0.5-alpha.6 → 3.0.5-alpha.7

package/dist/site/public-surface-audit.json

@@ -4,10 +4,10 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 112,
-    "workflowCount": 57,
+    "workflowCount": 59,
     "actionCount": 6,
     "sitePageCount": 63,
-    "docCommandRefCount": 813,
+    "docCommandRefCount": 822,
     "failureCount": 0
   },
   "enumerated": {
@@ -490,7 +490,7 @@
       {
         "id": "release-propagation",
         "source": "bin/buildchain.mjs",
-        "usage": "buildchain release-propagation <plan|write-lock> ..."
+        "usage": "buildchain release-propagation <plan|write-lock|work|pickup> ..."
       },
       {
         "id": "release-transaction",
@@ -800,6 +800,38 @@
         "outputs": [],
         "outputCount": 0
       },
+      {
+        "id": ".declarative-auditable-demo",
+        "path": ".github/workflows/.declarative-auditable-demo.yml",
+        "reusable": true,
+        "inputs": [
+          "artifact-retention-days",
+          "binary-artifact-digest",
+          "binary-artifact-name",
+          "buildchain-repository",
+          "materialize",
+          "materialize-base-ref",
+          "media-profile",
+          "render-media",
+          "renderer-image",
+          "scenario-path",
+          "source-ref"
+        ],
+        "inputCount": 11,
+        "secrets": [
+          "DEMO_UPDATE_TOKEN"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "capture-artifact-digest",
+          "capture-artifact-name",
+          "evidence-artifact-digest",
+          "evidence-artifact-name",
+          "publication-pr-url",
+          "source-sha"
+        ],
+        "outputCount": 6
+      },
       {
         "id": ".gate-profile",
         "path": ".github/workflows/.gate-profile.yml",
@@ -1422,6 +1454,17 @@
         "outputs": [],
         "outputCount": 0
       },
+      {
+        "id": "auditable-demo",
+        "path": ".github/workflows/auditable-demo.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
       {
         "id": "binary-distribution",
         "path": ".github/workflows/binary-distribution.yml",
@@ -4033,6 +4076,11 @@
         "path": "docs/lifecycle-protocol.md",
         "command": "buildchain init --type infra-contract"
       },
+      {
+        "id": "init",
+        "path": "README.md",
+        "command": "buildchain init --cwd"
+      },
       {
         "id": "init",
         "path": "README.md",
@@ -5293,6 +5341,11 @@
         "path": "docs/kfd-support.md",
         "command": "buildchain layout --cwd"
       },
+      {
+        "id": "layout",
+        "path": "README.md",
+        "command": "buildchain layout --cwd"
+      },
       {
         "id": "lifecycle",
         "path": "docs/cli-reference.md",
@@ -6313,11 +6366,31 @@
         "path": "docs/cli-reference.md",
         "command": "buildchain release-propagation"
       },
+      {
+        "id": "release-propagation",
+        "path": "docs/cli-reference.md",
+        "command": "buildchain release-propagation"
+      },
+      {
+        "id": "release-propagation",
+        "path": "docs/cli-reference.md",
+        "command": "buildchain release-propagation"
+      },
       {
         "id": "release-propagation",
         "path": "docs/cli-reference.md",
         "command": "buildchain release-propagation --help"
       },
+      {
+        "id": "release-propagation",
+        "path": "docs/cli-reference.md",
+        "command": "buildchain release-propagation pickup"
+      },
+      {
+        "id": "release-propagation",
+        "path": "docs/cli-reference.md",
+        "command": "buildchain release-propagation pickup --help"
+      },
       {
         "id": "release-propagation",
         "path": "docs/cli-reference.md",
@@ -6328,6 +6401,16 @@
         "path": "docs/cli-reference.md",
         "command": "buildchain release-propagation plan --help"
       },
+      {
+        "id": "release-propagation",
+        "path": "docs/cli-reference.md",
+        "command": "buildchain release-propagation work"
+      },
+      {
+        "id": "release-propagation",
+        "path": "docs/cli-reference.md",
+        "command": "buildchain release-propagation work --help"
+      },
       {
         "id": "release-propagation",
         "path": "docs/cli-reference.md",
@@ -6998,6 +7081,11 @@
         "path": "docs/install.md",
         "command": "buildchain version npx buildchain"
       },
+      {
+        "id": "version",
+        "path": "README.md",
+        "command": "buildchain version"
+      },
       {
         "id": "version",
         "path": "README.md",
@@ -7029,9 +7117,9 @@
     "cliRegistryPath": "dist/site/cli-registry.json",
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
-    "cliRegistryDigest": "0db010925d1c60209c3dac8bc2797537f307ab21bc68084263e79004c5c16ff7",
-    "workflowRegistryDigest": "4f1b9a933e117abc5fc4212241c83a35609f23477dac98d6cd37c4b40b57ba29",
-    "pageRegistryDigest": "1f715d11aca1124de121006046c07387d8d3d6b14fb868f8542626195285ec24"
+    "cliRegistryDigest": "c070e7bff9d1cb65a08daacd936f3567871af7844e88fa6ffcb05ea59579c15f",
+    "workflowRegistryDigest": "dff218a0f6f03602912c4f2e238cc79a1304ee2d0f6d1e3f3bae8514302f4706",
+    "pageRegistryDigest": "1270adac7acf01d2d1467feed70432c0d61c581925cad4af503b7db98c224d3f"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -44,6 +44,19 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/.declarative-auditable-demo.yml",
+      "authorityClass": "governance-write",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/.declarative-auditable-demo.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/.publication-authority.yml",
       "authorityClass": "evidence-publication",
@@ -180,6 +193,19 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/auditable-demo.yml",
+      "authorityClass": "governance-write",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/auditable-demo.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/binary-distribution.yml",
       "authorityClass": "evidence-publication",
@@ -602,6 +628,14 @@
       "signals": [],
       "classified": false
     },
+    {
+      "path": ".github/workflows/.declarative-auditable-demo.yml",
+      "signals": [
+        "write-permission",
+        "git-push"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/.gate-profile.yml",
       "signals": [],
@@ -702,6 +736,13 @@
       "signals": [],
       "classified": false
     },
+    {
+      "path": ".github/workflows/auditable-demo.yml",
+      "signals": [
+        "write-permission"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/binary-distribution.yml",
       "signals": [
@@ -958,5 +999,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "0f4705fb7b2afcb72e9136dac44eac7fc47d9440330aa3c72a8ae8bd8f3339c3"
+  "registryDigest": "c4574eaddd6cecd08c24e9125a2767f3126e8fbae894ed71d24cd5cc16e2443b"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-02T08:34:45.723Z",
-  "publishedAt": "2026-08-02T08:34:45.723Z",
+  "generatedAt": "2026-08-02T13:42:28.157Z",
+  "publishedAt": "2026-08-02T13:42:28.157Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "2b5880a79f169f4a64b193a06a47b990d6585e16",
+  "sourceRevision": "b5a8cb26691966378ee01f12e83d362fded9e47c",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.6",
+    "version": "3.0.5-alpha.7",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-02T08:34:45.723Z",
-  "publishedAt": "2026-08-02T08:34:45.723Z",
+  "generatedAt": "2026-08-02T13:42:28.157Z",
+  "publishedAt": "2026-08-02T13:42:28.157Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "2b5880a79f169f4a64b193a06a47b990d6585e16",
+  "sourceRevision": "b5a8cb26691966378ee01f12e83d362fded9e47c",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.6",
+    "version": "3.0.5-alpha.7",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -69,7 +69,7 @@
       "path": "docs/auditable-demo.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:4d32c82b652decfbb26b441c203fe34e70daa86022bb4baed9da02a5d6cf5831"
+      "digest": "sha256:a99175216b3774748b253814c1933683cace8107a34083dd711f639f3e680c61"
     },
     {
       "id": "install",
@@ -229,7 +229,7 @@
       "path": "docs/cli-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:c728fe693ab591ab5b52f4276a817ec5a013c79833f0d20ca2cc137e85ae51ca"
+      "digest": "sha256:94207fa353e87b087ecf53b6cebe6dfffdc1311b2b6bc90b511d83d5757e7827"
     },
     {
       "id": "node-api-reference",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:470b65c96353a9f3fac0db7b67bba34058e03bfa7e1a8fc6bec0d6d9f13aa6c4"
+      "digest": "sha256:c67e43ac62b7771c997c089da1541e573b7bb3202bdef01816a782b876e403c3"
     },
     {
       "id": "build-facts",

package/dist/site/workflow-registry.json

@@ -269,6 +269,48 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": ".declarative-auditable-demo",
+      "path": ".github/workflows/.declarative-auditable-demo.yml",
+      "reusable": true,
+      "inputs": [
+        "artifact-retention-days",
+        "binary-artifact-digest",
+        "binary-artifact-name",
+        "buildchain-repository",
+        "materialize",
+        "materialize-base-ref",
+        "media-profile",
+        "render-media",
+        "renderer-image",
+        "scenario-path",
+        "source-ref"
+      ],
+      "inputCount": 11,
+      "secrets": [
+        "DEMO_UPDATE_TOKEN"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "capture-artifact-digest",
+        "capture-artifact-name",
+        "evidence-artifact-digest",
+        "evidence-artifact-name",
+        "publication-pr-url",
+        "source-sha"
+      ],
+      "outputCount": 6,
+      "surface": "declarative-auditable-demo",
+      "capabilityGroup": "api-cli-reference",
+      "status": "preview",
+      "owner": "buildchain-workflows",
+      "maturity": "preview",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": ".gate-profile",
       "path": ".github/workflows/.gate-profile.yml",
@@ -1051,6 +1093,27 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "auditable-demo",
+      "path": ".github/workflows/auditable-demo.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "binary-distribution",
       "path": ".github/workflows/binary-distribution.yml",

package/docs/auditable-demo.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-07-31
+last_reviewed: 2026-08-02
 ai_provenance:
   model_family: GPT-5
   product: Codex
-  generated_at: 2026-07-31
+  generated_at: 2026-08-02
   invisible_context_boundary: No hidden model build, parameter count, or private corpus is asserted.
 ---
 
@@ -30,6 +30,68 @@ The public reusable workflow is
 does not know how a Kungfu, library, service, or application artifact should be
 interpreted. The consumer owns a small checked-in executable adapter.
 
+For standalone binary CLIs, the higher-level first-class surface is
+`.github/workflows/.declarative-auditable-demo.yml`. A consumer checks in only
+`.buildchain/auditable-demo.json`, builds and uploads its exact same-run binary
+plus metadata, and passes the producer-owned artifact name and digest to that
+workflow. Buildchain then owns capture, Gate adaptation, independent native
+1080p and 720p rendering, Release Passport construction, content-addressed
+materialization, and the protected README update pull request. No
+product-specific capture, adapter, passport, or materializer is required.
+
+## Declarative Standalone Binary Scenarios
+
+The schema is `contracts/auditable-demo-scenario-v1.schema.json`. One scenario
+can declare up to eight demos, and each demo can contain up to twelve ordered
+literal argv steps. Steps in one demo share a disposable workspace; separate
+demos and the two rendition captures do not. Commands are never accepted as a
+shell string. An omitted or explicit `standard` duration class remains bounded
+to 60 seconds. A reviewed `execution.durationClass: long-form` declaration may
+raise the scenario and literal step ceilings to 180 seconds; it does not change
+the default. Both classes retain 4 MiB per step, a clean Home/XDG environment,
+no inherited credentials, and a network-disabled read-only container with
+bounded tmpfs.
+
+The uploaded metadata must bind the executable SHA-256 and declare an empty
+runtime dependency set. Capture rejects an artifact name or upload digest that
+does not resolve to exactly one live artifact from the current workflow run.
+It retains ANSI terminal bytes with the real PTY read timestamps, verifies
+declared stdout and JSON file facts, enforces the total deadline while a step is
+running, and removes the disposable workspace before emitting evidence.
+
+Both manual validation and alpha or release refreshes call the same reusable
+workflow. Manual callers select Gate-only or full rendering and can explicitly
+request a materialization PR. Release callers select full rendering and the
+same materializer automatically; there is no separate release-only recording
+implementation. Publication requires a dedicated update token and target
+branch. The token is an explicit bounded capability, while actor identity,
+first-party/System classification, KFD compliance, Product System metadata,
+package metadata, registry history, scans, and generated evidence grant no
+authority.
+
+```yaml
+jobs:
+  demo:
+    needs: exact-binary
+    uses: kungfu-systems/buildchain/.github/workflows/.declarative-auditable-demo.yml@BUILDCHAIN_EXACT_SHA
+    with:
+      source-ref: ${{ github.sha }}
+      binary-artifact-name: ${{ needs.exact-binary.outputs.artifact-name }}
+      binary-artifact-digest: ${{ needs.exact-binary.outputs.artifact-digest }}
+      scenario-path: .buildchain/auditable-demo.json
+      renderer-image: ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:RENDERER_DIGEST
+      render-media: true
+      media-profile: responsive-web-delivery-v1
+      materialize: true
+      materialize-base-ref: dev/v1/v1.0
+    secrets:
+      DEMO_UPDATE_TOKEN: ${{ secrets.DEMO_UPDATE_TOKEN }}
+```
+
+Buildchain recursively consumes this surface in
+`.github/workflows/auditable-demo.yml` using its own exact standalone binary
+and the beginner bootstrap scenario in `.buildchain/auditable-demo.json`.
+
 ## Authority Boundary
 
 The retained build output is authoritative. The adapter reads that exact
@@ -42,9 +104,10 @@ scene.json
 ```
 
 It may additionally emit one declared `terminal-capture.json` using
-`kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds,
+`kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds by
+default or 180 seconds only when its scene explicitly declares `long-form`,
 fixed 80-200 by 24-80 terminal cells, 10,000 events, and 4 MiB of canonical
-base64 bytes. It must contain a passed completion sentinel and an explicitly
+base64 bytes. It must contain a qualified completion sentinel and an explicitly
 empty authority-grant list. Existing three-file adapters remain valid.
 
 The completion sentinel names a consumer-owned versioned schema, the exact
@@ -151,6 +214,7 @@ shell fragments, arbitrary profile paths, or transcoding instructions.
 | `archive-v1` | Default compatibility contract. Retains the exact renderer outputs and classifies GIF as README compatibility evidence without making a browser-delivery claim. |
 | `web-delivery-v1` | Independently qualifies H.264 MP4 and VP9 WebM playback sources, forbids audio, requires exact scene dimensions and bounded duration/frame-rate drift, checks per-rendition byte ceilings, and proves MP4 `moov` precedes `mdat`. PNG remains the lossless evidence poster. |
 | `responsive-web-delivery-v1` | Extends `web-delivery-v1` with exact 1280x720 H.264 MP4 and VP9 WebM responsive sources plus a 1280x720 README GIF while keeping the primary MP4/WebM and evidence poster at the source scene dimensions. Every declared downscale must preserve the scene aspect ratio and may never upscale. |
+| `responsive-long-form-web-delivery-v1` | Extends the responsive profile for explicitly admitted long-form scenes. Its measured-baseline multipliers raise only the GIF ceiling to 8 MiB and the four video ceilings to 4 MiB; all codec, native-resolution, no-audio, duration, and authority checks remain unchanged. |
 | `site-hero-v1` | Extends `web-delivery-v1` and additionally requires a qualified WebP browser poster. The current Build Images v1 renderer does not emit that member, so selecting this profile fails closed until the producer adds it. |
 
 For web-delivery profiles, Buildchain runs its own fixed `ffprobe` invocation
@@ -185,8 +249,10 @@ Initial byte ceilings are derived from the checked-in
 `auditable-demo-web-delivery-v1` fixture rendered by Build Images
 `v1.3.0-alpha.16` at its exact source SHA and image digest. GIF, MP4, WebM, and
 PNG ceilings are the next power of two above sixteen times the measured member
-bytes. The not-yet-produced WebP poster uses eight times the measured lossless
-PNG as its conservative proxy. The path-scoped qualification workflow
+bytes. The explicit responsive long-form profile derives its 4 MiB video and
+8 MiB GIF ceilings from the same observed bytes at a bounded 128-times
+multiplier; it does not change another profile. The not-yet-produced WebP poster
+uses eight times the measured lossless PNG as its conservative proxy. The path-scoped qualification workflow
 regenerates the content-addressed evidence and fails on any byte or fact drift.
 Its matrix retains the original 1280x720 web-delivery baseline on the renderer
 that produced it and separately measures the responsive profile against a
@@ -242,7 +308,8 @@ build should always call the reusable workflow. Selection policy changes only
 
 Use `web-delivery-v1` only when the rendered bundle is intended to become a
 qualified web-delivery source. Use `site-hero-v1` when an optimized browser
-poster is also required. Profile qualification does not prove browser playback,
+poster is also required. Select `responsive-long-form-web-delivery-v1` only
+with an explicit long-form scenario. Profile qualification does not prove browser playback,
 responsive layout, reduced-motion behavior, accessibility, or production
 deployment; those remain site responsibilities.
 

package/docs/cli-reference.md

@@ -1668,6 +1668,17 @@ buildchain release-governance reconcile --repository <owner/repo> --branch <dev|
 buildchain release-propagation
 ```
 
+### `buildchain release-propagation pickup`
+
+- Help: `buildchain release-propagation pickup --help`
+- Canonical id: `release-propagation`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release-propagation <plan|write-lock|work|pickup> ...
+```
+
 ### `buildchain release-propagation plan`
 
 - Help: `buildchain release-propagation plan --help`
@@ -1676,7 +1687,18 @@ buildchain release-propagation
 - Syntax:
 
 ```text
-buildchain release-propagation <plan|write-lock> ...
+buildchain release-propagation <plan|write-lock|work|pickup> ...
+```
+
+### `buildchain release-propagation work`
+
+- Help: `buildchain release-propagation work --help`
+- Canonical id: `release-propagation`
+- Options: none declared
+- Syntax:
+
+```text
+buildchain release-propagation <plan|write-lock|work|pickup> ...
 ```
 
 ### `buildchain release-propagation write-lock`
@@ -1687,7 +1709,7 @@ buildchain release-propagation <plan|write-lock> ...
 - Syntax:
 
 ```text
-buildchain release-propagation <plan|write-lock> ...
+buildchain release-propagation <plan|write-lock|work|pickup> ...
 ```
 
 ## `sample`