@kungfu-tech/buildchain 3.0.5-alpha.7 → 3.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +0 -31
- package/actions/macos-credential-island/README.md +0 -8
- package/bin/buildchain.mjs +1 -1
- package/contracts/auditable-demo-media-profiles-v1.json +0 -61
- package/contracts/evidence/auditable-demo-responsive-web-delivery-v1.json +3 -3
- package/contracts/evidence/auditable-demo-web-delivery-v1.json +3 -3
- package/dist/site/buildchain-contract.json +25 -86
- package/dist/site/buildchain-site.json +38 -64
- package/dist/site/capability-registry.json +1 -1
- package/dist/site/cli-registry.json +2 -6
- package/dist/site/controller-registry.json +3 -11
- package/dist/site/kfd-claims.json +11 -53
- package/dist/site/kfd-upstream-aggregate.json +1 -1
- package/dist/site/manual-registry.json +7 -7
- package/dist/site/node-api-registry.json +31 -213
- package/dist/site/page-registry.json +20 -50
- package/dist/site/public-surface-audit.json +8 -98
- package/dist/site/publication-authority-registry.json +1 -42
- package/dist/site/publication-registry.json +4 -4
- package/dist/site/site-manifest.json +11 -11
- package/dist/site/workflow-registry.json +2 -67
- package/docs/auditable-demo.md +7 -74
- package/docs/aws-us-elastic-runner-burst-plane.md +16 -151
- package/docs/cli-reference.md +2 -24
- package/docs/node-api-reference.md +72 -90
- package/docs/publish-transaction.md +5 -7
- package/docs/release-flow.md +0 -4
- package/docs/release-governance.md +0 -39
- package/docs/reusable-build-surface.md +0 -9
- package/package.json +1 -1
- package/packages/core/buildchain-contract.js +1 -36
- package/packages/core/buildchain-publication-authority.js +0 -2
- package/packages/core/public-surface-audit.js +35 -4
- package/packages/core/release-propagation-release.js +18 -61
- package/packages/core/release-propagation-work.js +3 -7
- package/packages/core/release-propagation.js +2 -12
- package/scripts/auditable-demo-renditions.mjs +2 -7
- package/scripts/auditable-demo.mjs +21 -27
- package/scripts/aws-windows-jit-controller-core.mjs +2 -20
- package/scripts/aws-windows-jit-controller.mjs +109 -184
- package/scripts/aws-windows-jit-core.mjs +3 -21
- package/scripts/aws-windows-jit.mjs +0 -2
- package/scripts/build-standalone-binary.mjs +0 -4
- package/scripts/buildchain-cli-help.mjs +1 -2
- package/scripts/capture-package-release-propagation.mjs +1 -24
- package/scripts/check-inventory.mjs +0 -5
- package/scripts/finalize-native-artifact-signing-result.mjs +15 -37
- package/scripts/generate-site-bundle.mjs +0 -2
- package/scripts/locked-source-checkout.mjs +3 -17
- package/scripts/release-propagation.mjs +2 -77
- package/contracts/auditable-demo-scenario-v1.schema.json +0 -153
- package/packages/core/release-propagation-pickup.js +0 -386
- package/packages/core/workflow-call-contract.js +0 -308
- package/packages/core/workflow-yaml-contract.js +0 -272
- package/scripts/auditable-demo-platform.mjs +0 -506
- package/scripts/aws-macos-jit-controller-core.mjs +0 -389
- package/scripts/aws-macos-jit-controller-runtime.mjs +0 -82
- package/scripts/aws-macos-jit-controller.mjs +0 -558
- package/scripts/aws-macos-jit-job-controller.mjs +0 -401
- package/scripts/aws-windows-jit-campaign-core.mjs +0 -296
- package/scripts/aws-windows-jit-campaign.mjs +0 -202
- package/scripts/workflow-call-contract.mjs +0 -133
|
@@ -4,10 +4,10 @@
|
|
|
4
4
|
"status": "passed",
|
|
5
5
|
"summary": {
|
|
6
6
|
"cliCommandCount": 112,
|
|
7
|
-
"workflowCount":
|
|
7
|
+
"workflowCount": 57,
|
|
8
8
|
"actionCount": 6,
|
|
9
9
|
"sitePageCount": 63,
|
|
10
|
-
"docCommandRefCount":
|
|
10
|
+
"docCommandRefCount": 813,
|
|
11
11
|
"failureCount": 0
|
|
12
12
|
},
|
|
13
13
|
"enumerated": {
|
|
@@ -490,7 +490,7 @@
|
|
|
490
490
|
{
|
|
491
491
|
"id": "release-propagation",
|
|
492
492
|
"source": "bin/buildchain.mjs",
|
|
493
|
-
"usage": "buildchain release-propagation <plan|write-lock
|
|
493
|
+
"usage": "buildchain release-propagation <plan|write-lock> ..."
|
|
494
494
|
},
|
|
495
495
|
{
|
|
496
496
|
"id": "release-transaction",
|
|
@@ -677,7 +677,6 @@
|
|
|
677
677
|
"checkout-cache-mode",
|
|
678
678
|
"checkout-cache-reference-repository-template",
|
|
679
679
|
"checkout-cache-timeout-seconds",
|
|
680
|
-
"checkout-history-mode",
|
|
681
680
|
"compiler-cache-platforms-json",
|
|
682
681
|
"compiler-cache-provider",
|
|
683
682
|
"compiler-cache-required",
|
|
@@ -727,7 +726,7 @@
|
|
|
727
726
|
"verify-command",
|
|
728
727
|
"working-directory"
|
|
729
728
|
],
|
|
730
|
-
"inputCount":
|
|
729
|
+
"inputCount": 82,
|
|
731
730
|
"secrets": [
|
|
732
731
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
|
|
733
732
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
|
|
@@ -800,38 +799,6 @@
|
|
|
800
799
|
"outputs": [],
|
|
801
800
|
"outputCount": 0
|
|
802
801
|
},
|
|
803
|
-
{
|
|
804
|
-
"id": ".declarative-auditable-demo",
|
|
805
|
-
"path": ".github/workflows/.declarative-auditable-demo.yml",
|
|
806
|
-
"reusable": true,
|
|
807
|
-
"inputs": [
|
|
808
|
-
"artifact-retention-days",
|
|
809
|
-
"binary-artifact-digest",
|
|
810
|
-
"binary-artifact-name",
|
|
811
|
-
"buildchain-repository",
|
|
812
|
-
"materialize",
|
|
813
|
-
"materialize-base-ref",
|
|
814
|
-
"media-profile",
|
|
815
|
-
"render-media",
|
|
816
|
-
"renderer-image",
|
|
817
|
-
"scenario-path",
|
|
818
|
-
"source-ref"
|
|
819
|
-
],
|
|
820
|
-
"inputCount": 11,
|
|
821
|
-
"secrets": [
|
|
822
|
-
"DEMO_UPDATE_TOKEN"
|
|
823
|
-
],
|
|
824
|
-
"secretCount": 1,
|
|
825
|
-
"outputs": [
|
|
826
|
-
"capture-artifact-digest",
|
|
827
|
-
"capture-artifact-name",
|
|
828
|
-
"evidence-artifact-digest",
|
|
829
|
-
"evidence-artifact-name",
|
|
830
|
-
"publication-pr-url",
|
|
831
|
-
"source-sha"
|
|
832
|
-
],
|
|
833
|
-
"outputCount": 6
|
|
834
|
-
},
|
|
835
802
|
{
|
|
836
803
|
"id": ".gate-profile",
|
|
837
804
|
"path": ".github/workflows/.gate-profile.yml",
|
|
@@ -1454,17 +1421,6 @@
|
|
|
1454
1421
|
"outputs": [],
|
|
1455
1422
|
"outputCount": 0
|
|
1456
1423
|
},
|
|
1457
|
-
{
|
|
1458
|
-
"id": "auditable-demo",
|
|
1459
|
-
"path": ".github/workflows/auditable-demo.yml",
|
|
1460
|
-
"reusable": false,
|
|
1461
|
-
"inputs": [],
|
|
1462
|
-
"inputCount": 0,
|
|
1463
|
-
"secrets": [],
|
|
1464
|
-
"secretCount": 0,
|
|
1465
|
-
"outputs": [],
|
|
1466
|
-
"outputCount": 0
|
|
1467
|
-
},
|
|
1468
1424
|
{
|
|
1469
1425
|
"id": "binary-distribution",
|
|
1470
1426
|
"path": ".github/workflows/binary-distribution.yml",
|
|
@@ -1540,7 +1496,6 @@
|
|
|
1540
1496
|
"checkout-cache-mode",
|
|
1541
1497
|
"checkout-cache-reference-repository-template",
|
|
1542
1498
|
"checkout-cache-timeout-seconds",
|
|
1543
|
-
"checkout-history-mode",
|
|
1544
1499
|
"compiler-cache-platforms-json",
|
|
1545
1500
|
"compiler-cache-provider",
|
|
1546
1501
|
"compiler-cache-required",
|
|
@@ -1590,7 +1545,7 @@
|
|
|
1590
1545
|
"verify-command",
|
|
1591
1546
|
"working-directory"
|
|
1592
1547
|
],
|
|
1593
|
-
"inputCount":
|
|
1548
|
+
"inputCount": 85,
|
|
1594
1549
|
"secrets": [
|
|
1595
1550
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
|
|
1596
1551
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
|
|
@@ -4076,11 +4031,6 @@
|
|
|
4076
4031
|
"path": "docs/lifecycle-protocol.md",
|
|
4077
4032
|
"command": "buildchain init --type infra-contract"
|
|
4078
4033
|
},
|
|
4079
|
-
{
|
|
4080
|
-
"id": "init",
|
|
4081
|
-
"path": "README.md",
|
|
4082
|
-
"command": "buildchain init --cwd"
|
|
4083
|
-
},
|
|
4084
4034
|
{
|
|
4085
4035
|
"id": "init",
|
|
4086
4036
|
"path": "README.md",
|
|
@@ -5341,11 +5291,6 @@
|
|
|
5341
5291
|
"path": "docs/kfd-support.md",
|
|
5342
5292
|
"command": "buildchain layout --cwd"
|
|
5343
5293
|
},
|
|
5344
|
-
{
|
|
5345
|
-
"id": "layout",
|
|
5346
|
-
"path": "README.md",
|
|
5347
|
-
"command": "buildchain layout --cwd"
|
|
5348
|
-
},
|
|
5349
5294
|
{
|
|
5350
5295
|
"id": "lifecycle",
|
|
5351
5296
|
"path": "docs/cli-reference.md",
|
|
@@ -6366,31 +6311,11 @@
|
|
|
6366
6311
|
"path": "docs/cli-reference.md",
|
|
6367
6312
|
"command": "buildchain release-propagation"
|
|
6368
6313
|
},
|
|
6369
|
-
{
|
|
6370
|
-
"id": "release-propagation",
|
|
6371
|
-
"path": "docs/cli-reference.md",
|
|
6372
|
-
"command": "buildchain release-propagation"
|
|
6373
|
-
},
|
|
6374
|
-
{
|
|
6375
|
-
"id": "release-propagation",
|
|
6376
|
-
"path": "docs/cli-reference.md",
|
|
6377
|
-
"command": "buildchain release-propagation"
|
|
6378
|
-
},
|
|
6379
6314
|
{
|
|
6380
6315
|
"id": "release-propagation",
|
|
6381
6316
|
"path": "docs/cli-reference.md",
|
|
6382
6317
|
"command": "buildchain release-propagation --help"
|
|
6383
6318
|
},
|
|
6384
|
-
{
|
|
6385
|
-
"id": "release-propagation",
|
|
6386
|
-
"path": "docs/cli-reference.md",
|
|
6387
|
-
"command": "buildchain release-propagation pickup"
|
|
6388
|
-
},
|
|
6389
|
-
{
|
|
6390
|
-
"id": "release-propagation",
|
|
6391
|
-
"path": "docs/cli-reference.md",
|
|
6392
|
-
"command": "buildchain release-propagation pickup --help"
|
|
6393
|
-
},
|
|
6394
6319
|
{
|
|
6395
6320
|
"id": "release-propagation",
|
|
6396
6321
|
"path": "docs/cli-reference.md",
|
|
@@ -6401,16 +6326,6 @@
|
|
|
6401
6326
|
"path": "docs/cli-reference.md",
|
|
6402
6327
|
"command": "buildchain release-propagation plan --help"
|
|
6403
6328
|
},
|
|
6404
|
-
{
|
|
6405
|
-
"id": "release-propagation",
|
|
6406
|
-
"path": "docs/cli-reference.md",
|
|
6407
|
-
"command": "buildchain release-propagation work"
|
|
6408
|
-
},
|
|
6409
|
-
{
|
|
6410
|
-
"id": "release-propagation",
|
|
6411
|
-
"path": "docs/cli-reference.md",
|
|
6412
|
-
"command": "buildchain release-propagation work --help"
|
|
6413
|
-
},
|
|
6414
6329
|
{
|
|
6415
6330
|
"id": "release-propagation",
|
|
6416
6331
|
"path": "docs/cli-reference.md",
|
|
@@ -7081,11 +6996,6 @@
|
|
|
7081
6996
|
"path": "docs/install.md",
|
|
7082
6997
|
"command": "buildchain version npx buildchain"
|
|
7083
6998
|
},
|
|
7084
|
-
{
|
|
7085
|
-
"id": "version",
|
|
7086
|
-
"path": "README.md",
|
|
7087
|
-
"command": "buildchain version"
|
|
7088
|
-
},
|
|
7089
6999
|
{
|
|
7090
7000
|
"id": "version",
|
|
7091
7001
|
"path": "README.md",
|
|
@@ -7117,9 +7027,9 @@
|
|
|
7117
7027
|
"cliRegistryPath": "dist/site/cli-registry.json",
|
|
7118
7028
|
"workflowRegistryPath": "dist/site/workflow-registry.json",
|
|
7119
7029
|
"pageRegistryPath": "dist/site/page-registry.json",
|
|
7120
|
-
"cliRegistryDigest": "
|
|
7121
|
-
"workflowRegistryDigest": "
|
|
7122
|
-
"pageRegistryDigest": "
|
|
7030
|
+
"cliRegistryDigest": "0db010925d1c60209c3dac8bc2797537f307ab21bc68084263e79004c5c16ff7",
|
|
7031
|
+
"workflowRegistryDigest": "b5b860965abf645e1618d7840db544d638fd8ea3d0ee04ed00ccd4c8f8ccaabb",
|
|
7032
|
+
"pageRegistryDigest": "fda54ffd3528f81630f0fabf91ab777a471f9d6bbd89f5f995d1dc383e077264"
|
|
7123
7033
|
},
|
|
7124
7034
|
"comparison": {
|
|
7125
7035
|
"missingCliRegistry": [],
|
|
@@ -44,19 +44,6 @@
|
|
|
44
44
|
"runnerPolicy": "unqualified",
|
|
45
45
|
"notes": ""
|
|
46
46
|
},
|
|
47
|
-
{
|
|
48
|
-
"workflowPath": ".github/workflows/.declarative-auditable-demo.yml",
|
|
49
|
-
"authorityClass": "governance-write",
|
|
50
|
-
"publicationCapable": false,
|
|
51
|
-
"capabilityIds": [],
|
|
52
|
-
"credentialMode": "none",
|
|
53
|
-
"publisherWorkflowMode": "fixed",
|
|
54
|
-
"publisherWorkflowPath": ".github/workflows/.declarative-auditable-demo.yml",
|
|
55
|
-
"environment": "",
|
|
56
|
-
"environmentMode": "fixed",
|
|
57
|
-
"runnerPolicy": "unqualified",
|
|
58
|
-
"notes": ""
|
|
59
|
-
},
|
|
60
47
|
{
|
|
61
48
|
"workflowPath": ".github/workflows/.publication-authority.yml",
|
|
62
49
|
"authorityClass": "evidence-publication",
|
|
@@ -193,19 +180,6 @@
|
|
|
193
180
|
"runnerPolicy": "unqualified",
|
|
194
181
|
"notes": ""
|
|
195
182
|
},
|
|
196
|
-
{
|
|
197
|
-
"workflowPath": ".github/workflows/auditable-demo.yml",
|
|
198
|
-
"authorityClass": "governance-write",
|
|
199
|
-
"publicationCapable": false,
|
|
200
|
-
"capabilityIds": [],
|
|
201
|
-
"credentialMode": "none",
|
|
202
|
-
"publisherWorkflowMode": "fixed",
|
|
203
|
-
"publisherWorkflowPath": ".github/workflows/auditable-demo.yml",
|
|
204
|
-
"environment": "",
|
|
205
|
-
"environmentMode": "fixed",
|
|
206
|
-
"runnerPolicy": "unqualified",
|
|
207
|
-
"notes": ""
|
|
208
|
-
},
|
|
209
183
|
{
|
|
210
184
|
"workflowPath": ".github/workflows/binary-distribution.yml",
|
|
211
185
|
"authorityClass": "evidence-publication",
|
|
@@ -628,14 +602,6 @@
|
|
|
628
602
|
"signals": [],
|
|
629
603
|
"classified": false
|
|
630
604
|
},
|
|
631
|
-
{
|
|
632
|
-
"path": ".github/workflows/.declarative-auditable-demo.yml",
|
|
633
|
-
"signals": [
|
|
634
|
-
"write-permission",
|
|
635
|
-
"git-push"
|
|
636
|
-
],
|
|
637
|
-
"classified": true
|
|
638
|
-
},
|
|
639
605
|
{
|
|
640
606
|
"path": ".github/workflows/.gate-profile.yml",
|
|
641
607
|
"signals": [],
|
|
@@ -736,13 +702,6 @@
|
|
|
736
702
|
"signals": [],
|
|
737
703
|
"classified": false
|
|
738
704
|
},
|
|
739
|
-
{
|
|
740
|
-
"path": ".github/workflows/auditable-demo.yml",
|
|
741
|
-
"signals": [
|
|
742
|
-
"write-permission"
|
|
743
|
-
],
|
|
744
|
-
"classified": true
|
|
745
|
-
},
|
|
746
705
|
{
|
|
747
706
|
"path": ".github/workflows/binary-distribution.yml",
|
|
748
707
|
"signals": [
|
|
@@ -999,5 +958,5 @@
|
|
|
999
958
|
"classified": false
|
|
1000
959
|
}
|
|
1001
960
|
],
|
|
1002
|
-
"registryDigest": "
|
|
961
|
+
"registryDigest": "0f4705fb7b2afcb72e9136dac44eac7fc47d9440330aa3c72a8ae8bd8f3339c3"
|
|
1003
962
|
}
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 1,
|
|
3
3
|
"contract": "kungfu-buildchain-publication-release-registry",
|
|
4
|
-
"generatedAt": "2026-08-
|
|
5
|
-
"publishedAt": "2026-08-
|
|
4
|
+
"generatedAt": "2026-08-02T20:15:33.433Z",
|
|
5
|
+
"publishedAt": "2026-08-02T20:15:33.433Z",
|
|
6
6
|
"reproducible": true,
|
|
7
7
|
"timestampPolicy": "ci-injected",
|
|
8
8
|
"deterministicInputs": [
|
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
"declared Buildchain surface manifest contract"
|
|
20
20
|
],
|
|
21
21
|
"sourceDateEpoch": "0",
|
|
22
|
-
"sourceRevision": "
|
|
22
|
+
"sourceRevision": "3725ea866d37e1b72b607e3621ce0e9f425c3cf3",
|
|
23
23
|
"timestampPolicyDetails": {
|
|
24
24
|
"contract": "kungfu-buildchain-surface-timestamp-policy",
|
|
25
25
|
"timestampFields": [
|
|
@@ -32,7 +32,7 @@
|
|
|
32
32
|
},
|
|
33
33
|
"package": {
|
|
34
34
|
"name": "@kungfu-tech/buildchain",
|
|
35
|
-
"version": "3.0.5
|
|
35
|
+
"version": "3.0.5",
|
|
36
36
|
"versionSource": "package.json#version"
|
|
37
37
|
},
|
|
38
38
|
"sourceKind": "package-site-bundle",
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 1,
|
|
3
3
|
"contract": "kungfu-buildchain-site-manifest",
|
|
4
|
-
"generatedAt": "2026-08-
|
|
5
|
-
"publishedAt": "2026-08-
|
|
4
|
+
"generatedAt": "2026-08-02T20:15:33.433Z",
|
|
5
|
+
"publishedAt": "2026-08-02T20:15:33.433Z",
|
|
6
6
|
"reproducible": true,
|
|
7
7
|
"timestampPolicy": "ci-injected",
|
|
8
8
|
"deterministicInputs": [
|
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
"declared Buildchain surface manifest contract"
|
|
20
20
|
],
|
|
21
21
|
"sourceDateEpoch": "0",
|
|
22
|
-
"sourceRevision": "
|
|
22
|
+
"sourceRevision": "3725ea866d37e1b72b607e3621ce0e9f425c3cf3",
|
|
23
23
|
"timestampPolicyDetails": {
|
|
24
24
|
"contract": "kungfu-buildchain-surface-timestamp-policy",
|
|
25
25
|
"timestampFields": [
|
|
@@ -37,7 +37,7 @@
|
|
|
37
37
|
},
|
|
38
38
|
"package": {
|
|
39
39
|
"name": "@kungfu-tech/buildchain",
|
|
40
|
-
"version": "3.0.5
|
|
40
|
+
"version": "3.0.5",
|
|
41
41
|
"versionSource": "package.json#version"
|
|
42
42
|
},
|
|
43
43
|
"entrypoint": "buildchain-site.json",
|
|
@@ -69,7 +69,7 @@
|
|
|
69
69
|
"path": "docs/auditable-demo.md",
|
|
70
70
|
"plane": "verify",
|
|
71
71
|
"exists": true,
|
|
72
|
-
"digest": "sha256:
|
|
72
|
+
"digest": "sha256:4d32c82b652decfbb26b441c203fe34e70daa86022bb4baed9da02a5d6cf5831"
|
|
73
73
|
},
|
|
74
74
|
{
|
|
75
75
|
"id": "install",
|
|
@@ -229,7 +229,7 @@
|
|
|
229
229
|
"path": "docs/cli-reference.md",
|
|
230
230
|
"plane": "use",
|
|
231
231
|
"exists": true,
|
|
232
|
-
"digest": "sha256:
|
|
232
|
+
"digest": "sha256:c728fe693ab591ab5b52f4276a817ec5a013c79833f0d20ca2cc137e85ae51ca"
|
|
233
233
|
},
|
|
234
234
|
{
|
|
235
235
|
"id": "node-api-reference",
|
|
@@ -237,7 +237,7 @@
|
|
|
237
237
|
"path": "docs/node-api-reference.md",
|
|
238
238
|
"plane": "use",
|
|
239
239
|
"exists": true,
|
|
240
|
-
"digest": "sha256:
|
|
240
|
+
"digest": "sha256:38f051f579fb93dc7d8b4f2c70acd622c020e867394344b5e932568cd8d2ad83"
|
|
241
241
|
},
|
|
242
242
|
{
|
|
243
243
|
"id": "build-facts",
|
|
@@ -277,7 +277,7 @@
|
|
|
277
277
|
"path": "docs/reusable-build-surface.md",
|
|
278
278
|
"plane": "use",
|
|
279
279
|
"exists": true,
|
|
280
|
-
"digest": "sha256:
|
|
280
|
+
"digest": "sha256:8908e1f1589537ac8ef82ee1dacdd24072ca871e3e245825669e7cfbdebd2e3d"
|
|
281
281
|
},
|
|
282
282
|
{
|
|
283
283
|
"id": "publish-transaction",
|
|
@@ -285,7 +285,7 @@
|
|
|
285
285
|
"path": "docs/publish-transaction.md",
|
|
286
286
|
"plane": "verify",
|
|
287
287
|
"exists": true,
|
|
288
|
-
"digest": "sha256:
|
|
288
|
+
"digest": "sha256:9b830727e5b0d2192c937f19106c11ea5064dde77e30d290825f343df47f291b"
|
|
289
289
|
},
|
|
290
290
|
{
|
|
291
291
|
"id": "release-governance",
|
|
@@ -293,7 +293,7 @@
|
|
|
293
293
|
"path": "docs/release-governance.md",
|
|
294
294
|
"plane": "why",
|
|
295
295
|
"exists": true,
|
|
296
|
-
"digest": "sha256:
|
|
296
|
+
"digest": "sha256:60ec90d3294818d3c53e403312801a8ab47be7c0f34810002676fbfcdbceaa60"
|
|
297
297
|
},
|
|
298
298
|
{
|
|
299
299
|
"id": "release-flow",
|
|
@@ -301,7 +301,7 @@
|
|
|
301
301
|
"path": "docs/release-flow.md",
|
|
302
302
|
"plane": "verify",
|
|
303
303
|
"exists": true,
|
|
304
|
-
"digest": "sha256:
|
|
304
|
+
"digest": "sha256:bac959565c36cf39c3cd30dfce00dbbb59b73ed21b852a8f24a6cae281cb5f05"
|
|
305
305
|
},
|
|
306
306
|
{
|
|
307
307
|
"id": "runtime-train-validation",
|
|
@@ -126,7 +126,6 @@
|
|
|
126
126
|
"checkout-cache-mode",
|
|
127
127
|
"checkout-cache-reference-repository-template",
|
|
128
128
|
"checkout-cache-timeout-seconds",
|
|
129
|
-
"checkout-history-mode",
|
|
130
129
|
"compiler-cache-platforms-json",
|
|
131
130
|
"compiler-cache-provider",
|
|
132
131
|
"compiler-cache-required",
|
|
@@ -176,7 +175,7 @@
|
|
|
176
175
|
"verify-command",
|
|
177
176
|
"working-directory"
|
|
178
177
|
],
|
|
179
|
-
"inputCount":
|
|
178
|
+
"inputCount": 82,
|
|
180
179
|
"secrets": [
|
|
181
180
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
|
|
182
181
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
|
|
@@ -269,48 +268,6 @@
|
|
|
269
268
|
"sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
|
|
270
269
|
"nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
|
|
271
270
|
},
|
|
272
|
-
{
|
|
273
|
-
"id": ".declarative-auditable-demo",
|
|
274
|
-
"path": ".github/workflows/.declarative-auditable-demo.yml",
|
|
275
|
-
"reusable": true,
|
|
276
|
-
"inputs": [
|
|
277
|
-
"artifact-retention-days",
|
|
278
|
-
"binary-artifact-digest",
|
|
279
|
-
"binary-artifact-name",
|
|
280
|
-
"buildchain-repository",
|
|
281
|
-
"materialize",
|
|
282
|
-
"materialize-base-ref",
|
|
283
|
-
"media-profile",
|
|
284
|
-
"render-media",
|
|
285
|
-
"renderer-image",
|
|
286
|
-
"scenario-path",
|
|
287
|
-
"source-ref"
|
|
288
|
-
],
|
|
289
|
-
"inputCount": 11,
|
|
290
|
-
"secrets": [
|
|
291
|
-
"DEMO_UPDATE_TOKEN"
|
|
292
|
-
],
|
|
293
|
-
"secretCount": 1,
|
|
294
|
-
"outputs": [
|
|
295
|
-
"capture-artifact-digest",
|
|
296
|
-
"capture-artifact-name",
|
|
297
|
-
"evidence-artifact-digest",
|
|
298
|
-
"evidence-artifact-name",
|
|
299
|
-
"publication-pr-url",
|
|
300
|
-
"source-sha"
|
|
301
|
-
],
|
|
302
|
-
"outputCount": 6,
|
|
303
|
-
"surface": "declarative-auditable-demo",
|
|
304
|
-
"capabilityGroup": "api-cli-reference",
|
|
305
|
-
"status": "preview",
|
|
306
|
-
"owner": "buildchain-workflows",
|
|
307
|
-
"maturity": "preview",
|
|
308
|
-
"introducedVersion": "pre-3.0.2-alpha.4",
|
|
309
|
-
"compatibilityPromise": "preserved-through-the-v3-major-line",
|
|
310
|
-
"deprecationReplacement": "",
|
|
311
|
-
"sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
|
|
312
|
-
"nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
|
|
313
|
-
},
|
|
314
271
|
{
|
|
315
272
|
"id": ".gate-profile",
|
|
316
273
|
"path": ".github/workflows/.gate-profile.yml",
|
|
@@ -1093,27 +1050,6 @@
|
|
|
1093
1050
|
"sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
|
|
1094
1051
|
"nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
|
|
1095
1052
|
},
|
|
1096
|
-
{
|
|
1097
|
-
"id": "auditable-demo",
|
|
1098
|
-
"path": ".github/workflows/auditable-demo.yml",
|
|
1099
|
-
"reusable": false,
|
|
1100
|
-
"inputs": [],
|
|
1101
|
-
"inputCount": 0,
|
|
1102
|
-
"secrets": [],
|
|
1103
|
-
"secretCount": 0,
|
|
1104
|
-
"outputs": [],
|
|
1105
|
-
"outputCount": 0,
|
|
1106
|
-
"surface": "repository-workflow",
|
|
1107
|
-
"capabilityGroup": "api-cli-reference",
|
|
1108
|
-
"status": "active",
|
|
1109
|
-
"owner": "buildchain-workflows",
|
|
1110
|
-
"maturity": "active",
|
|
1111
|
-
"introducedVersion": "pre-3.0.2-alpha.4",
|
|
1112
|
-
"compatibilityPromise": "preserved-through-the-v3-major-line",
|
|
1113
|
-
"deprecationReplacement": "",
|
|
1114
|
-
"sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
|
|
1115
|
-
"nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
|
|
1116
|
-
},
|
|
1117
1053
|
{
|
|
1118
1054
|
"id": "binary-distribution",
|
|
1119
1055
|
"path": ".github/workflows/binary-distribution.yml",
|
|
@@ -1219,7 +1155,6 @@
|
|
|
1219
1155
|
"checkout-cache-mode",
|
|
1220
1156
|
"checkout-cache-reference-repository-template",
|
|
1221
1157
|
"checkout-cache-timeout-seconds",
|
|
1222
|
-
"checkout-history-mode",
|
|
1223
1158
|
"compiler-cache-platforms-json",
|
|
1224
1159
|
"compiler-cache-provider",
|
|
1225
1160
|
"compiler-cache-required",
|
|
@@ -1269,7 +1204,7 @@
|
|
|
1269
1204
|
"verify-command",
|
|
1270
1205
|
"working-directory"
|
|
1271
1206
|
],
|
|
1272
|
-
"inputCount":
|
|
1207
|
+
"inputCount": 85,
|
|
1273
1208
|
"secrets": [
|
|
1274
1209
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
|
|
1275
1210
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
|
package/docs/auditable-demo.md
CHANGED
|
@@ -8,11 +8,11 @@ confidence: high
|
|
|
8
8
|
sensitivity: public
|
|
9
9
|
evidence_grade: A
|
|
10
10
|
review_state: self-reviewed
|
|
11
|
-
last_reviewed: 2026-
|
|
11
|
+
last_reviewed: 2026-07-31
|
|
12
12
|
ai_provenance:
|
|
13
13
|
model_family: GPT-5
|
|
14
14
|
product: Codex
|
|
15
|
-
generated_at: 2026-
|
|
15
|
+
generated_at: 2026-07-31
|
|
16
16
|
invisible_context_boundary: No hidden model build, parameter count, or private corpus is asserted.
|
|
17
17
|
---
|
|
18
18
|
|
|
@@ -30,68 +30,6 @@ The public reusable workflow is
|
|
|
30
30
|
does not know how a Kungfu, library, service, or application artifact should be
|
|
31
31
|
interpreted. The consumer owns a small checked-in executable adapter.
|
|
32
32
|
|
|
33
|
-
For standalone binary CLIs, the higher-level first-class surface is
|
|
34
|
-
`.github/workflows/.declarative-auditable-demo.yml`. A consumer checks in only
|
|
35
|
-
`.buildchain/auditable-demo.json`, builds and uploads its exact same-run binary
|
|
36
|
-
plus metadata, and passes the producer-owned artifact name and digest to that
|
|
37
|
-
workflow. Buildchain then owns capture, Gate adaptation, independent native
|
|
38
|
-
1080p and 720p rendering, Release Passport construction, content-addressed
|
|
39
|
-
materialization, and the protected README update pull request. No
|
|
40
|
-
product-specific capture, adapter, passport, or materializer is required.
|
|
41
|
-
|
|
42
|
-
## Declarative Standalone Binary Scenarios
|
|
43
|
-
|
|
44
|
-
The schema is `contracts/auditable-demo-scenario-v1.schema.json`. One scenario
|
|
45
|
-
can declare up to eight demos, and each demo can contain up to twelve ordered
|
|
46
|
-
literal argv steps. Steps in one demo share a disposable workspace; separate
|
|
47
|
-
demos and the two rendition captures do not. Commands are never accepted as a
|
|
48
|
-
shell string. An omitted or explicit `standard` duration class remains bounded
|
|
49
|
-
to 60 seconds. A reviewed `execution.durationClass: long-form` declaration may
|
|
50
|
-
raise the scenario and literal step ceilings to 180 seconds; it does not change
|
|
51
|
-
the default. Both classes retain 4 MiB per step, a clean Home/XDG environment,
|
|
52
|
-
no inherited credentials, and a network-disabled read-only container with
|
|
53
|
-
bounded tmpfs.
|
|
54
|
-
|
|
55
|
-
The uploaded metadata must bind the executable SHA-256 and declare an empty
|
|
56
|
-
runtime dependency set. Capture rejects an artifact name or upload digest that
|
|
57
|
-
does not resolve to exactly one live artifact from the current workflow run.
|
|
58
|
-
It retains ANSI terminal bytes with the real PTY read timestamps, verifies
|
|
59
|
-
declared stdout and JSON file facts, enforces the total deadline while a step is
|
|
60
|
-
running, and removes the disposable workspace before emitting evidence.
|
|
61
|
-
|
|
62
|
-
Both manual validation and alpha or release refreshes call the same reusable
|
|
63
|
-
workflow. Manual callers select Gate-only or full rendering and can explicitly
|
|
64
|
-
request a materialization PR. Release callers select full rendering and the
|
|
65
|
-
same materializer automatically; there is no separate release-only recording
|
|
66
|
-
implementation. Publication requires a dedicated update token and target
|
|
67
|
-
branch. The token is an explicit bounded capability, while actor identity,
|
|
68
|
-
first-party/System classification, KFD compliance, Product System metadata,
|
|
69
|
-
package metadata, registry history, scans, and generated evidence grant no
|
|
70
|
-
authority.
|
|
71
|
-
|
|
72
|
-
```yaml
|
|
73
|
-
jobs:
|
|
74
|
-
demo:
|
|
75
|
-
needs: exact-binary
|
|
76
|
-
uses: kungfu-systems/buildchain/.github/workflows/.declarative-auditable-demo.yml@BUILDCHAIN_EXACT_SHA
|
|
77
|
-
with:
|
|
78
|
-
source-ref: ${{ github.sha }}
|
|
79
|
-
binary-artifact-name: ${{ needs.exact-binary.outputs.artifact-name }}
|
|
80
|
-
binary-artifact-digest: ${{ needs.exact-binary.outputs.artifact-digest }}
|
|
81
|
-
scenario-path: .buildchain/auditable-demo.json
|
|
82
|
-
renderer-image: ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:RENDERER_DIGEST
|
|
83
|
-
render-media: true
|
|
84
|
-
media-profile: responsive-web-delivery-v1
|
|
85
|
-
materialize: true
|
|
86
|
-
materialize-base-ref: dev/v1/v1.0
|
|
87
|
-
secrets:
|
|
88
|
-
DEMO_UPDATE_TOKEN: ${{ secrets.DEMO_UPDATE_TOKEN }}
|
|
89
|
-
```
|
|
90
|
-
|
|
91
|
-
Buildchain recursively consumes this surface in
|
|
92
|
-
`.github/workflows/auditable-demo.yml` using its own exact standalone binary
|
|
93
|
-
and the beginner bootstrap scenario in `.buildchain/auditable-demo.json`.
|
|
94
|
-
|
|
95
33
|
## Authority Boundary
|
|
96
34
|
|
|
97
35
|
The retained build output is authoritative. The adapter reads that exact
|
|
@@ -104,10 +42,9 @@ scene.json
|
|
|
104
42
|
```
|
|
105
43
|
|
|
106
44
|
It may additionally emit one declared `terminal-capture.json` using
|
|
107
|
-
`kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds
|
|
108
|
-
default or 180 seconds only when its scene explicitly declares `long-form`,
|
|
45
|
+
`kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds,
|
|
109
46
|
fixed 80-200 by 24-80 terminal cells, 10,000 events, and 4 MiB of canonical
|
|
110
|
-
base64 bytes. It must contain a
|
|
47
|
+
base64 bytes. It must contain a passed completion sentinel and an explicitly
|
|
111
48
|
empty authority-grant list. Existing three-file adapters remain valid.
|
|
112
49
|
|
|
113
50
|
The completion sentinel names a consumer-owned versioned schema, the exact
|
|
@@ -214,7 +151,6 @@ shell fragments, arbitrary profile paths, or transcoding instructions.
|
|
|
214
151
|
| `archive-v1` | Default compatibility contract. Retains the exact renderer outputs and classifies GIF as README compatibility evidence without making a browser-delivery claim. |
|
|
215
152
|
| `web-delivery-v1` | Independently qualifies H.264 MP4 and VP9 WebM playback sources, forbids audio, requires exact scene dimensions and bounded duration/frame-rate drift, checks per-rendition byte ceilings, and proves MP4 `moov` precedes `mdat`. PNG remains the lossless evidence poster. |
|
|
216
153
|
| `responsive-web-delivery-v1` | Extends `web-delivery-v1` with exact 1280x720 H.264 MP4 and VP9 WebM responsive sources plus a 1280x720 README GIF while keeping the primary MP4/WebM and evidence poster at the source scene dimensions. Every declared downscale must preserve the scene aspect ratio and may never upscale. |
|
|
217
|
-
| `responsive-long-form-web-delivery-v1` | Extends the responsive profile for explicitly admitted long-form scenes. Its measured-baseline multipliers raise only the GIF ceiling to 8 MiB and the four video ceilings to 4 MiB; all codec, native-resolution, no-audio, duration, and authority checks remain unchanged. |
|
|
218
154
|
| `site-hero-v1` | Extends `web-delivery-v1` and additionally requires a qualified WebP browser poster. The current Build Images v1 renderer does not emit that member, so selecting this profile fails closed until the producer adds it. |
|
|
219
155
|
|
|
220
156
|
For web-delivery profiles, Buildchain runs its own fixed `ffprobe` invocation
|
|
@@ -249,10 +185,8 @@ Initial byte ceilings are derived from the checked-in
|
|
|
249
185
|
`auditable-demo-web-delivery-v1` fixture rendered by Build Images
|
|
250
186
|
`v1.3.0-alpha.16` at its exact source SHA and image digest. GIF, MP4, WebM, and
|
|
251
187
|
PNG ceilings are the next power of two above sixteen times the measured member
|
|
252
|
-
bytes. The
|
|
253
|
-
|
|
254
|
-
multiplier; it does not change another profile. The not-yet-produced WebP poster
|
|
255
|
-
uses eight times the measured lossless PNG as its conservative proxy. The path-scoped qualification workflow
|
|
188
|
+
bytes. The not-yet-produced WebP poster uses eight times the measured lossless
|
|
189
|
+
PNG as its conservative proxy. The path-scoped qualification workflow
|
|
256
190
|
regenerates the content-addressed evidence and fails on any byte or fact drift.
|
|
257
191
|
Its matrix retains the original 1280x720 web-delivery baseline on the renderer
|
|
258
192
|
that produced it and separately measures the responsive profile against a
|
|
@@ -308,8 +242,7 @@ build should always call the reusable workflow. Selection policy changes only
|
|
|
308
242
|
|
|
309
243
|
Use `web-delivery-v1` only when the rendered bundle is intended to become a
|
|
310
244
|
qualified web-delivery source. Use `site-hero-v1` when an optimized browser
|
|
311
|
-
poster is also required.
|
|
312
|
-
with an explicit long-form scenario. Profile qualification does not prove browser playback,
|
|
245
|
+
poster is also required. Profile qualification does not prove browser playback,
|
|
313
246
|
responsive layout, reduced-motion behavior, accessibility, or production
|
|
314
247
|
deployment; those remain site responsibilities.
|
|
315
248
|
|