@kungfu-tech/buildchain 3.0.5-alpha.8 → 3.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (62) hide show
  1. package/README.md +0 -31
  2. package/actions/macos-credential-island/README.md +0 -8
  3. package/bin/buildchain.mjs +1 -1
  4. package/contracts/auditable-demo-media-profiles-v1.json +0 -61
  5. package/contracts/evidence/auditable-demo-responsive-web-delivery-v1.json +3 -3
  6. package/contracts/evidence/auditable-demo-web-delivery-v1.json +3 -3
  7. package/dist/site/buildchain-contract.json +25 -86
  8. package/dist/site/buildchain-site.json +38 -64
  9. package/dist/site/capability-registry.json +1 -1
  10. package/dist/site/cli-registry.json +2 -6
  11. package/dist/site/controller-registry.json +3 -11
  12. package/dist/site/kfd-claims.json +11 -53
  13. package/dist/site/kfd-upstream-aggregate.json +1 -1
  14. package/dist/site/manual-registry.json +7 -7
  15. package/dist/site/node-api-registry.json +31 -213
  16. package/dist/site/page-registry.json +20 -50
  17. package/dist/site/public-surface-audit.json +8 -98
  18. package/dist/site/publication-authority-registry.json +1 -42
  19. package/dist/site/publication-registry.json +4 -4
  20. package/dist/site/site-manifest.json +11 -11
  21. package/dist/site/workflow-registry.json +2 -67
  22. package/docs/auditable-demo.md +7 -74
  23. package/docs/aws-us-elastic-runner-burst-plane.md +16 -151
  24. package/docs/cli-reference.md +2 -24
  25. package/docs/node-api-reference.md +72 -90
  26. package/docs/publish-transaction.md +5 -7
  27. package/docs/release-flow.md +0 -4
  28. package/docs/release-governance.md +0 -39
  29. package/docs/reusable-build-surface.md +0 -9
  30. package/package.json +1 -1
  31. package/packages/core/buildchain-contract.js +1 -36
  32. package/packages/core/buildchain-publication-authority.js +0 -2
  33. package/packages/core/public-surface-audit.js +35 -4
  34. package/packages/core/release-propagation-release.js +18 -61
  35. package/packages/core/release-propagation-work.js +3 -7
  36. package/packages/core/release-propagation.js +2 -12
  37. package/scripts/auditable-demo-renditions.mjs +2 -7
  38. package/scripts/auditable-demo.mjs +21 -27
  39. package/scripts/aws-windows-jit-controller-core.mjs +2 -20
  40. package/scripts/aws-windows-jit-controller.mjs +109 -184
  41. package/scripts/aws-windows-jit-core.mjs +3 -21
  42. package/scripts/aws-windows-jit.mjs +0 -2
  43. package/scripts/build-standalone-binary.mjs +0 -4
  44. package/scripts/buildchain-cli-help.mjs +1 -2
  45. package/scripts/capture-package-release-propagation.mjs +1 -24
  46. package/scripts/check-inventory.mjs +0 -5
  47. package/scripts/finalize-native-artifact-signing-result.mjs +15 -37
  48. package/scripts/generate-site-bundle.mjs +0 -2
  49. package/scripts/locked-source-checkout.mjs +3 -17
  50. package/scripts/release-propagation.mjs +2 -77
  51. package/contracts/auditable-demo-scenario-v1.schema.json +0 -153
  52. package/packages/core/release-propagation-pickup.js +0 -387
  53. package/packages/core/workflow-call-contract.js +0 -308
  54. package/packages/core/workflow-yaml-contract.js +0 -272
  55. package/scripts/auditable-demo-platform.mjs +0 -506
  56. package/scripts/aws-macos-jit-controller-core.mjs +0 -389
  57. package/scripts/aws-macos-jit-controller-runtime.mjs +0 -82
  58. package/scripts/aws-macos-jit-controller.mjs +0 -558
  59. package/scripts/aws-macos-jit-job-controller.mjs +0 -401
  60. package/scripts/aws-windows-jit-campaign-core.mjs +0 -296
  61. package/scripts/aws-windows-jit-campaign.mjs +0 -202
  62. package/scripts/workflow-call-contract.mjs +0 -133
@@ -4,10 +4,10 @@
4
4
  "status": "passed",
5
5
  "summary": {
6
6
  "cliCommandCount": 112,
7
- "workflowCount": 59,
7
+ "workflowCount": 57,
8
8
  "actionCount": 6,
9
9
  "sitePageCount": 63,
10
- "docCommandRefCount": 822,
10
+ "docCommandRefCount": 813,
11
11
  "failureCount": 0
12
12
  },
13
13
  "enumerated": {
@@ -490,7 +490,7 @@
490
490
  {
491
491
  "id": "release-propagation",
492
492
  "source": "bin/buildchain.mjs",
493
- "usage": "buildchain release-propagation <plan|write-lock|work|pickup> ..."
493
+ "usage": "buildchain release-propagation <plan|write-lock> ..."
494
494
  },
495
495
  {
496
496
  "id": "release-transaction",
@@ -677,7 +677,6 @@
677
677
  "checkout-cache-mode",
678
678
  "checkout-cache-reference-repository-template",
679
679
  "checkout-cache-timeout-seconds",
680
- "checkout-history-mode",
681
680
  "compiler-cache-platforms-json",
682
681
  "compiler-cache-provider",
683
682
  "compiler-cache-required",
@@ -727,7 +726,7 @@
727
726
  "verify-command",
728
727
  "working-directory"
729
728
  ],
730
- "inputCount": 83,
729
+ "inputCount": 82,
731
730
  "secrets": [
732
731
  "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
733
732
  "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -800,38 +799,6 @@
800
799
  "outputs": [],
801
800
  "outputCount": 0
802
801
  },
803
- {
804
- "id": ".declarative-auditable-demo",
805
- "path": ".github/workflows/.declarative-auditable-demo.yml",
806
- "reusable": true,
807
- "inputs": [
808
- "artifact-retention-days",
809
- "binary-artifact-digest",
810
- "binary-artifact-name",
811
- "buildchain-repository",
812
- "materialize",
813
- "materialize-base-ref",
814
- "media-profile",
815
- "render-media",
816
- "renderer-image",
817
- "scenario-path",
818
- "source-ref"
819
- ],
820
- "inputCount": 11,
821
- "secrets": [
822
- "DEMO_UPDATE_TOKEN"
823
- ],
824
- "secretCount": 1,
825
- "outputs": [
826
- "capture-artifact-digest",
827
- "capture-artifact-name",
828
- "evidence-artifact-digest",
829
- "evidence-artifact-name",
830
- "publication-pr-url",
831
- "source-sha"
832
- ],
833
- "outputCount": 6
834
- },
835
802
  {
836
803
  "id": ".gate-profile",
837
804
  "path": ".github/workflows/.gate-profile.yml",
@@ -1454,17 +1421,6 @@
1454
1421
  "outputs": [],
1455
1422
  "outputCount": 0
1456
1423
  },
1457
- {
1458
- "id": "auditable-demo",
1459
- "path": ".github/workflows/auditable-demo.yml",
1460
- "reusable": false,
1461
- "inputs": [],
1462
- "inputCount": 0,
1463
- "secrets": [],
1464
- "secretCount": 0,
1465
- "outputs": [],
1466
- "outputCount": 0
1467
- },
1468
1424
  {
1469
1425
  "id": "binary-distribution",
1470
1426
  "path": ".github/workflows/binary-distribution.yml",
@@ -1540,7 +1496,6 @@
1540
1496
  "checkout-cache-mode",
1541
1497
  "checkout-cache-reference-repository-template",
1542
1498
  "checkout-cache-timeout-seconds",
1543
- "checkout-history-mode",
1544
1499
  "compiler-cache-platforms-json",
1545
1500
  "compiler-cache-provider",
1546
1501
  "compiler-cache-required",
@@ -1590,7 +1545,7 @@
1590
1545
  "verify-command",
1591
1546
  "working-directory"
1592
1547
  ],
1593
- "inputCount": 86,
1548
+ "inputCount": 85,
1594
1549
  "secrets": [
1595
1550
  "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
1596
1551
  "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -4076,11 +4031,6 @@
4076
4031
  "path": "docs/lifecycle-protocol.md",
4077
4032
  "command": "buildchain init --type infra-contract"
4078
4033
  },
4079
- {
4080
- "id": "init",
4081
- "path": "README.md",
4082
- "command": "buildchain init --cwd"
4083
- },
4084
4034
  {
4085
4035
  "id": "init",
4086
4036
  "path": "README.md",
@@ -5341,11 +5291,6 @@
5341
5291
  "path": "docs/kfd-support.md",
5342
5292
  "command": "buildchain layout --cwd"
5343
5293
  },
5344
- {
5345
- "id": "layout",
5346
- "path": "README.md",
5347
- "command": "buildchain layout --cwd"
5348
- },
5349
5294
  {
5350
5295
  "id": "lifecycle",
5351
5296
  "path": "docs/cli-reference.md",
@@ -6366,31 +6311,11 @@
6366
6311
  "path": "docs/cli-reference.md",
6367
6312
  "command": "buildchain release-propagation"
6368
6313
  },
6369
- {
6370
- "id": "release-propagation",
6371
- "path": "docs/cli-reference.md",
6372
- "command": "buildchain release-propagation"
6373
- },
6374
- {
6375
- "id": "release-propagation",
6376
- "path": "docs/cli-reference.md",
6377
- "command": "buildchain release-propagation"
6378
- },
6379
6314
  {
6380
6315
  "id": "release-propagation",
6381
6316
  "path": "docs/cli-reference.md",
6382
6317
  "command": "buildchain release-propagation --help"
6383
6318
  },
6384
- {
6385
- "id": "release-propagation",
6386
- "path": "docs/cli-reference.md",
6387
- "command": "buildchain release-propagation pickup"
6388
- },
6389
- {
6390
- "id": "release-propagation",
6391
- "path": "docs/cli-reference.md",
6392
- "command": "buildchain release-propagation pickup --help"
6393
- },
6394
6319
  {
6395
6320
  "id": "release-propagation",
6396
6321
  "path": "docs/cli-reference.md",
@@ -6401,16 +6326,6 @@
6401
6326
  "path": "docs/cli-reference.md",
6402
6327
  "command": "buildchain release-propagation plan --help"
6403
6328
  },
6404
- {
6405
- "id": "release-propagation",
6406
- "path": "docs/cli-reference.md",
6407
- "command": "buildchain release-propagation work"
6408
- },
6409
- {
6410
- "id": "release-propagation",
6411
- "path": "docs/cli-reference.md",
6412
- "command": "buildchain release-propagation work --help"
6413
- },
6414
6329
  {
6415
6330
  "id": "release-propagation",
6416
6331
  "path": "docs/cli-reference.md",
@@ -7081,11 +6996,6 @@
7081
6996
  "path": "docs/install.md",
7082
6997
  "command": "buildchain version npx buildchain"
7083
6998
  },
7084
- {
7085
- "id": "version",
7086
- "path": "README.md",
7087
- "command": "buildchain version"
7088
- },
7089
6999
  {
7090
7000
  "id": "version",
7091
7001
  "path": "README.md",
@@ -7117,9 +7027,9 @@
7117
7027
  "cliRegistryPath": "dist/site/cli-registry.json",
7118
7028
  "workflowRegistryPath": "dist/site/workflow-registry.json",
7119
7029
  "pageRegistryPath": "dist/site/page-registry.json",
7120
- "cliRegistryDigest": "c070e7bff9d1cb65a08daacd936f3567871af7844e88fa6ffcb05ea59579c15f",
7121
- "workflowRegistryDigest": "dff218a0f6f03602912c4f2e238cc79a1304ee2d0f6d1e3f3bae8514302f4706",
7122
- "pageRegistryDigest": "fcc0611c778caa08e36f91d3d5bd36f61aa90a165fb98388ade07d3ac236716f"
7030
+ "cliRegistryDigest": "0db010925d1c60209c3dac8bc2797537f307ab21bc68084263e79004c5c16ff7",
7031
+ "workflowRegistryDigest": "b5b860965abf645e1618d7840db544d638fd8ea3d0ee04ed00ccd4c8f8ccaabb",
7032
+ "pageRegistryDigest": "fda54ffd3528f81630f0fabf91ab777a471f9d6bbd89f5f995d1dc383e077264"
7123
7033
  },
7124
7034
  "comparison": {
7125
7035
  "missingCliRegistry": [],
@@ -44,19 +44,6 @@
44
44
  "runnerPolicy": "unqualified",
45
45
  "notes": ""
46
46
  },
47
- {
48
- "workflowPath": ".github/workflows/.declarative-auditable-demo.yml",
49
- "authorityClass": "governance-write",
50
- "publicationCapable": false,
51
- "capabilityIds": [],
52
- "credentialMode": "none",
53
- "publisherWorkflowMode": "fixed",
54
- "publisherWorkflowPath": ".github/workflows/.declarative-auditable-demo.yml",
55
- "environment": "",
56
- "environmentMode": "fixed",
57
- "runnerPolicy": "unqualified",
58
- "notes": ""
59
- },
60
47
  {
61
48
  "workflowPath": ".github/workflows/.publication-authority.yml",
62
49
  "authorityClass": "evidence-publication",
@@ -193,19 +180,6 @@
193
180
  "runnerPolicy": "unqualified",
194
181
  "notes": ""
195
182
  },
196
- {
197
- "workflowPath": ".github/workflows/auditable-demo.yml",
198
- "authorityClass": "governance-write",
199
- "publicationCapable": false,
200
- "capabilityIds": [],
201
- "credentialMode": "none",
202
- "publisherWorkflowMode": "fixed",
203
- "publisherWorkflowPath": ".github/workflows/auditable-demo.yml",
204
- "environment": "",
205
- "environmentMode": "fixed",
206
- "runnerPolicy": "unqualified",
207
- "notes": ""
208
- },
209
183
  {
210
184
  "workflowPath": ".github/workflows/binary-distribution.yml",
211
185
  "authorityClass": "evidence-publication",
@@ -628,14 +602,6 @@
628
602
  "signals": [],
629
603
  "classified": false
630
604
  },
631
- {
632
- "path": ".github/workflows/.declarative-auditable-demo.yml",
633
- "signals": [
634
- "write-permission",
635
- "git-push"
636
- ],
637
- "classified": true
638
- },
639
605
  {
640
606
  "path": ".github/workflows/.gate-profile.yml",
641
607
  "signals": [],
@@ -736,13 +702,6 @@
736
702
  "signals": [],
737
703
  "classified": false
738
704
  },
739
- {
740
- "path": ".github/workflows/auditable-demo.yml",
741
- "signals": [
742
- "write-permission"
743
- ],
744
- "classified": true
745
- },
746
705
  {
747
706
  "path": ".github/workflows/binary-distribution.yml",
748
707
  "signals": [
@@ -999,5 +958,5 @@
999
958
  "classified": false
1000
959
  }
1001
960
  ],
1002
- "registryDigest": "c4574eaddd6cecd08c24e9125a2767f3126e8fbae894ed71d24cd5cc16e2443b"
961
+ "registryDigest": "0f4705fb7b2afcb72e9136dac44eac7fc47d9440330aa3c72a8ae8bd8f3339c3"
1003
962
  }
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
3
  "contract": "kungfu-buildchain-publication-release-registry",
4
- "generatedAt": "2026-08-02T14:27:56.260Z",
5
- "publishedAt": "2026-08-02T14:27:56.260Z",
4
+ "generatedAt": "2026-08-02T20:15:33.433Z",
5
+ "publishedAt": "2026-08-02T20:15:33.433Z",
6
6
  "reproducible": true,
7
7
  "timestampPolicy": "ci-injected",
8
8
  "deterministicInputs": [
@@ -19,7 +19,7 @@
19
19
  "declared Buildchain surface manifest contract"
20
20
  ],
21
21
  "sourceDateEpoch": "0",
22
- "sourceRevision": "4e62e4e0e7e2dec5316b12ab0ca7bef3e7804fbc",
22
+ "sourceRevision": "3725ea866d37e1b72b607e3621ce0e9f425c3cf3",
23
23
  "timestampPolicyDetails": {
24
24
  "contract": "kungfu-buildchain-surface-timestamp-policy",
25
25
  "timestampFields": [
@@ -32,7 +32,7 @@
32
32
  },
33
33
  "package": {
34
34
  "name": "@kungfu-tech/buildchain",
35
- "version": "3.0.5-alpha.8",
35
+ "version": "3.0.5",
36
36
  "versionSource": "package.json#version"
37
37
  },
38
38
  "sourceKind": "package-site-bundle",
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
3
  "contract": "kungfu-buildchain-site-manifest",
4
- "generatedAt": "2026-08-02T14:27:56.260Z",
5
- "publishedAt": "2026-08-02T14:27:56.260Z",
4
+ "generatedAt": "2026-08-02T20:15:33.433Z",
5
+ "publishedAt": "2026-08-02T20:15:33.433Z",
6
6
  "reproducible": true,
7
7
  "timestampPolicy": "ci-injected",
8
8
  "deterministicInputs": [
@@ -19,7 +19,7 @@
19
19
  "declared Buildchain surface manifest contract"
20
20
  ],
21
21
  "sourceDateEpoch": "0",
22
- "sourceRevision": "4e62e4e0e7e2dec5316b12ab0ca7bef3e7804fbc",
22
+ "sourceRevision": "3725ea866d37e1b72b607e3621ce0e9f425c3cf3",
23
23
  "timestampPolicyDetails": {
24
24
  "contract": "kungfu-buildchain-surface-timestamp-policy",
25
25
  "timestampFields": [
@@ -37,7 +37,7 @@
37
37
  },
38
38
  "package": {
39
39
  "name": "@kungfu-tech/buildchain",
40
- "version": "3.0.5-alpha.8",
40
+ "version": "3.0.5",
41
41
  "versionSource": "package.json#version"
42
42
  },
43
43
  "entrypoint": "buildchain-site.json",
@@ -69,7 +69,7 @@
69
69
  "path": "docs/auditable-demo.md",
70
70
  "plane": "verify",
71
71
  "exists": true,
72
- "digest": "sha256:a99175216b3774748b253814c1933683cace8107a34083dd711f639f3e680c61"
72
+ "digest": "sha256:4d32c82b652decfbb26b441c203fe34e70daa86022bb4baed9da02a5d6cf5831"
73
73
  },
74
74
  {
75
75
  "id": "install",
@@ -229,7 +229,7 @@
229
229
  "path": "docs/cli-reference.md",
230
230
  "plane": "use",
231
231
  "exists": true,
232
- "digest": "sha256:94207fa353e87b087ecf53b6cebe6dfffdc1311b2b6bc90b511d83d5757e7827"
232
+ "digest": "sha256:c728fe693ab591ab5b52f4276a817ec5a013c79833f0d20ca2cc137e85ae51ca"
233
233
  },
234
234
  {
235
235
  "id": "node-api-reference",
@@ -237,7 +237,7 @@
237
237
  "path": "docs/node-api-reference.md",
238
238
  "plane": "use",
239
239
  "exists": true,
240
- "digest": "sha256:deab508284ed365a830894205a4d293c524281d6da7126094cf8e9eea8efe223"
240
+ "digest": "sha256:38f051f579fb93dc7d8b4f2c70acd622c020e867394344b5e932568cd8d2ad83"
241
241
  },
242
242
  {
243
243
  "id": "build-facts",
@@ -277,7 +277,7 @@
277
277
  "path": "docs/reusable-build-surface.md",
278
278
  "plane": "use",
279
279
  "exists": true,
280
- "digest": "sha256:baadd0c0ef61d877b409d2bdf0e696e218971eb541c5f51a1a8e88e75af4904d"
280
+ "digest": "sha256:8908e1f1589537ac8ef82ee1dacdd24072ca871e3e245825669e7cfbdebd2e3d"
281
281
  },
282
282
  {
283
283
  "id": "publish-transaction",
@@ -285,7 +285,7 @@
285
285
  "path": "docs/publish-transaction.md",
286
286
  "plane": "verify",
287
287
  "exists": true,
288
- "digest": "sha256:3a9ef099d5d93d9b558c7b6a0aa4403dfcce1479ce5d6fc36ecb3e34cdd5bb6d"
288
+ "digest": "sha256:9b830727e5b0d2192c937f19106c11ea5064dde77e30d290825f343df47f291b"
289
289
  },
290
290
  {
291
291
  "id": "release-governance",
@@ -293,7 +293,7 @@
293
293
  "path": "docs/release-governance.md",
294
294
  "plane": "why",
295
295
  "exists": true,
296
- "digest": "sha256:a38eca4d8ada75aed5cb60f2ef23ffe4ba36b1c804ea1ee7f74b3271765b7a1c"
296
+ "digest": "sha256:60ec90d3294818d3c53e403312801a8ab47be7c0f34810002676fbfcdbceaa60"
297
297
  },
298
298
  {
299
299
  "id": "release-flow",
@@ -301,7 +301,7 @@
301
301
  "path": "docs/release-flow.md",
302
302
  "plane": "verify",
303
303
  "exists": true,
304
- "digest": "sha256:dc54b8a264489341984ca6157b07d1956e934366f937b7412a21df7f025d2d8d"
304
+ "digest": "sha256:bac959565c36cf39c3cd30dfce00dbbb59b73ed21b852a8f24a6cae281cb5f05"
305
305
  },
306
306
  {
307
307
  "id": "runtime-train-validation",
@@ -126,7 +126,6 @@
126
126
  "checkout-cache-mode",
127
127
  "checkout-cache-reference-repository-template",
128
128
  "checkout-cache-timeout-seconds",
129
- "checkout-history-mode",
130
129
  "compiler-cache-platforms-json",
131
130
  "compiler-cache-provider",
132
131
  "compiler-cache-required",
@@ -176,7 +175,7 @@
176
175
  "verify-command",
177
176
  "working-directory"
178
177
  ],
179
- "inputCount": 83,
178
+ "inputCount": 82,
180
179
  "secrets": [
181
180
  "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
182
181
  "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -269,48 +268,6 @@
269
268
  "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
270
269
  "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
271
270
  },
272
- {
273
- "id": ".declarative-auditable-demo",
274
- "path": ".github/workflows/.declarative-auditable-demo.yml",
275
- "reusable": true,
276
- "inputs": [
277
- "artifact-retention-days",
278
- "binary-artifact-digest",
279
- "binary-artifact-name",
280
- "buildchain-repository",
281
- "materialize",
282
- "materialize-base-ref",
283
- "media-profile",
284
- "render-media",
285
- "renderer-image",
286
- "scenario-path",
287
- "source-ref"
288
- ],
289
- "inputCount": 11,
290
- "secrets": [
291
- "DEMO_UPDATE_TOKEN"
292
- ],
293
- "secretCount": 1,
294
- "outputs": [
295
- "capture-artifact-digest",
296
- "capture-artifact-name",
297
- "evidence-artifact-digest",
298
- "evidence-artifact-name",
299
- "publication-pr-url",
300
- "source-sha"
301
- ],
302
- "outputCount": 6,
303
- "surface": "declarative-auditable-demo",
304
- "capabilityGroup": "api-cli-reference",
305
- "status": "preview",
306
- "owner": "buildchain-workflows",
307
- "maturity": "preview",
308
- "introducedVersion": "pre-3.0.2-alpha.4",
309
- "compatibilityPromise": "preserved-through-the-v3-major-line",
310
- "deprecationReplacement": "",
311
- "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
312
- "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
313
- },
314
271
  {
315
272
  "id": ".gate-profile",
316
273
  "path": ".github/workflows/.gate-profile.yml",
@@ -1093,27 +1050,6 @@
1093
1050
  "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
1094
1051
  "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
1095
1052
  },
1096
- {
1097
- "id": "auditable-demo",
1098
- "path": ".github/workflows/auditable-demo.yml",
1099
- "reusable": false,
1100
- "inputs": [],
1101
- "inputCount": 0,
1102
- "secrets": [],
1103
- "secretCount": 0,
1104
- "outputs": [],
1105
- "outputCount": 0,
1106
- "surface": "repository-workflow",
1107
- "capabilityGroup": "api-cli-reference",
1108
- "status": "active",
1109
- "owner": "buildchain-workflows",
1110
- "maturity": "active",
1111
- "introducedVersion": "pre-3.0.2-alpha.4",
1112
- "compatibilityPromise": "preserved-through-the-v3-major-line",
1113
- "deprecationReplacement": "",
1114
- "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
1115
- "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
1116
- },
1117
1053
  {
1118
1054
  "id": "binary-distribution",
1119
1055
  "path": ".github/workflows/binary-distribution.yml",
@@ -1219,7 +1155,6 @@
1219
1155
  "checkout-cache-mode",
1220
1156
  "checkout-cache-reference-repository-template",
1221
1157
  "checkout-cache-timeout-seconds",
1222
- "checkout-history-mode",
1223
1158
  "compiler-cache-platforms-json",
1224
1159
  "compiler-cache-provider",
1225
1160
  "compiler-cache-required",
@@ -1269,7 +1204,7 @@
1269
1204
  "verify-command",
1270
1205
  "working-directory"
1271
1206
  ],
1272
- "inputCount": 86,
1207
+ "inputCount": 85,
1273
1208
  "secrets": [
1274
1209
  "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
1275
1210
  "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -8,11 +8,11 @@ confidence: high
8
8
  sensitivity: public
9
9
  evidence_grade: A
10
10
  review_state: self-reviewed
11
- last_reviewed: 2026-08-02
11
+ last_reviewed: 2026-07-31
12
12
  ai_provenance:
13
13
  model_family: GPT-5
14
14
  product: Codex
15
- generated_at: 2026-08-02
15
+ generated_at: 2026-07-31
16
16
  invisible_context_boundary: No hidden model build, parameter count, or private corpus is asserted.
17
17
  ---
18
18
 
@@ -30,68 +30,6 @@ The public reusable workflow is
30
30
  does not know how a Kungfu, library, service, or application artifact should be
31
31
  interpreted. The consumer owns a small checked-in executable adapter.
32
32
 
33
- For standalone binary CLIs, the higher-level first-class surface is
34
- `.github/workflows/.declarative-auditable-demo.yml`. A consumer checks in only
35
- `.buildchain/auditable-demo.json`, builds and uploads its exact same-run binary
36
- plus metadata, and passes the producer-owned artifact name and digest to that
37
- workflow. Buildchain then owns capture, Gate adaptation, independent native
38
- 1080p and 720p rendering, Release Passport construction, content-addressed
39
- materialization, and the protected README update pull request. No
40
- product-specific capture, adapter, passport, or materializer is required.
41
-
42
- ## Declarative Standalone Binary Scenarios
43
-
44
- The schema is `contracts/auditable-demo-scenario-v1.schema.json`. One scenario
45
- can declare up to eight demos, and each demo can contain up to twelve ordered
46
- literal argv steps. Steps in one demo share a disposable workspace; separate
47
- demos and the two rendition captures do not. Commands are never accepted as a
48
- shell string. An omitted or explicit `standard` duration class remains bounded
49
- to 60 seconds. A reviewed `execution.durationClass: long-form` declaration may
50
- raise the scenario and literal step ceilings to 180 seconds; it does not change
51
- the default. Both classes retain 4 MiB per step, a clean Home/XDG environment,
52
- no inherited credentials, and a network-disabled read-only container with
53
- bounded tmpfs.
54
-
55
- The uploaded metadata must bind the executable SHA-256 and declare an empty
56
- runtime dependency set. Capture rejects an artifact name or upload digest that
57
- does not resolve to exactly one live artifact from the current workflow run.
58
- It retains ANSI terminal bytes with the real PTY read timestamps, verifies
59
- declared stdout and JSON file facts, enforces the total deadline while a step is
60
- running, and removes the disposable workspace before emitting evidence.
61
-
62
- Both manual validation and alpha or release refreshes call the same reusable
63
- workflow. Manual callers select Gate-only or full rendering and can explicitly
64
- request a materialization PR. Release callers select full rendering and the
65
- same materializer automatically; there is no separate release-only recording
66
- implementation. Publication requires a dedicated update token and target
67
- branch. The token is an explicit bounded capability, while actor identity,
68
- first-party/System classification, KFD compliance, Product System metadata,
69
- package metadata, registry history, scans, and generated evidence grant no
70
- authority.
71
-
72
- ```yaml
73
- jobs:
74
- demo:
75
- needs: exact-binary
76
- uses: kungfu-systems/buildchain/.github/workflows/.declarative-auditable-demo.yml@BUILDCHAIN_EXACT_SHA
77
- with:
78
- source-ref: ${{ github.sha }}
79
- binary-artifact-name: ${{ needs.exact-binary.outputs.artifact-name }}
80
- binary-artifact-digest: ${{ needs.exact-binary.outputs.artifact-digest }}
81
- scenario-path: .buildchain/auditable-demo.json
82
- renderer-image: ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:RENDERER_DIGEST
83
- render-media: true
84
- media-profile: responsive-web-delivery-v1
85
- materialize: true
86
- materialize-base-ref: dev/v1/v1.0
87
- secrets:
88
- DEMO_UPDATE_TOKEN: ${{ secrets.DEMO_UPDATE_TOKEN }}
89
- ```
90
-
91
- Buildchain recursively consumes this surface in
92
- `.github/workflows/auditable-demo.yml` using its own exact standalone binary
93
- and the beginner bootstrap scenario in `.buildchain/auditable-demo.json`.
94
-
95
33
  ## Authority Boundary
96
34
 
97
35
  The retained build output is authoritative. The adapter reads that exact
@@ -104,10 +42,9 @@ scene.json
104
42
  ```
105
43
 
106
44
  It may additionally emit one declared `terminal-capture.json` using
107
- `kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds by
108
- default or 180 seconds only when its scene explicitly declares `long-form`,
45
+ `kungfu.terminal-capture/v1`. The optional capture is bounded to 60 seconds,
109
46
  fixed 80-200 by 24-80 terminal cells, 10,000 events, and 4 MiB of canonical
110
- base64 bytes. It must contain a qualified completion sentinel and an explicitly
47
+ base64 bytes. It must contain a passed completion sentinel and an explicitly
111
48
  empty authority-grant list. Existing three-file adapters remain valid.
112
49
 
113
50
  The completion sentinel names a consumer-owned versioned schema, the exact
@@ -214,7 +151,6 @@ shell fragments, arbitrary profile paths, or transcoding instructions.
214
151
  | `archive-v1` | Default compatibility contract. Retains the exact renderer outputs and classifies GIF as README compatibility evidence without making a browser-delivery claim. |
215
152
  | `web-delivery-v1` | Independently qualifies H.264 MP4 and VP9 WebM playback sources, forbids audio, requires exact scene dimensions and bounded duration/frame-rate drift, checks per-rendition byte ceilings, and proves MP4 `moov` precedes `mdat`. PNG remains the lossless evidence poster. |
216
153
  | `responsive-web-delivery-v1` | Extends `web-delivery-v1` with exact 1280x720 H.264 MP4 and VP9 WebM responsive sources plus a 1280x720 README GIF while keeping the primary MP4/WebM and evidence poster at the source scene dimensions. Every declared downscale must preserve the scene aspect ratio and may never upscale. |
217
- | `responsive-long-form-web-delivery-v1` | Extends the responsive profile for explicitly admitted long-form scenes. Its measured-baseline multipliers raise only the GIF ceiling to 8 MiB and the four video ceilings to 4 MiB; all codec, native-resolution, no-audio, duration, and authority checks remain unchanged. |
218
154
  | `site-hero-v1` | Extends `web-delivery-v1` and additionally requires a qualified WebP browser poster. The current Build Images v1 renderer does not emit that member, so selecting this profile fails closed until the producer adds it. |
219
155
 
220
156
  For web-delivery profiles, Buildchain runs its own fixed `ffprobe` invocation
@@ -249,10 +185,8 @@ Initial byte ceilings are derived from the checked-in
249
185
  `auditable-demo-web-delivery-v1` fixture rendered by Build Images
250
186
  `v1.3.0-alpha.16` at its exact source SHA and image digest. GIF, MP4, WebM, and
251
187
  PNG ceilings are the next power of two above sixteen times the measured member
252
- bytes. The explicit responsive long-form profile derives its 4 MiB video and
253
- 8 MiB GIF ceilings from the same observed bytes at a bounded 128-times
254
- multiplier; it does not change another profile. The not-yet-produced WebP poster
255
- uses eight times the measured lossless PNG as its conservative proxy. The path-scoped qualification workflow
188
+ bytes. The not-yet-produced WebP poster uses eight times the measured lossless
189
+ PNG as its conservative proxy. The path-scoped qualification workflow
256
190
  regenerates the content-addressed evidence and fails on any byte or fact drift.
257
191
  Its matrix retains the original 1280x720 web-delivery baseline on the renderer
258
192
  that produced it and separately measures the responsive profile against a
@@ -308,8 +242,7 @@ build should always call the reusable workflow. Selection policy changes only
308
242
 
309
243
  Use `web-delivery-v1` only when the rendered bundle is intended to become a
310
244
  qualified web-delivery source. Use `site-hero-v1` when an optimized browser
311
- poster is also required. Select `responsive-long-form-web-delivery-v1` only
312
- with an explicit long-form scenario. Profile qualification does not prove browser playback,
245
+ poster is also required. Profile qualification does not prove browser playback,
313
246
  responsive layout, reduced-motion behavior, accessibility, or production
314
247
  deployment; those remain site responsibilities.
315
248