@kungfu-tech/buildchain 3.0.5-alpha.8 → 3.0.5

package/docs/publish-transaction.md

@@ -415,10 +415,9 @@ first run can stop at `finalizing` after registry publication. If the reviewed
 merge commit later contains that exact transaction release material but the
 exact tag is still absent, a retry performs finalization only: it reloads the
 same durable source, release material, tooling, evidence, version, and target
-bindings; creates the exact tag at the transaction source SHA; moves floating
-refs to the transaction release SHA; and completes the passport from the
-transaction source tree. It does not rerun the provider mutation and does not
-authorize the newer composite channel tree
+bindings; creates the exact and floating tags at the transaction release SHA;
+and completes the passport from the transaction source tree. It does not rerun
+the provider mutation and does not authorize the newer composite channel tree
 as published material. A different source tree still requires a new version and
 a fresh release candidate.
 
@@ -537,9 +536,8 @@ inside the mutation boundary.
 
 If finalization fails after an exact Git tag is created, the next run reads the
 durable `finalizing` state, verifies the exact tag points at the recorded
-source SHA (while accepting legacy release/material targets for recovery), and
-retries the remaining floating refs. An exact tag at an unrelated SHA is a
-material conflict and blocks recovery.
+release SHA, and retries the remaining floating refs. An exact tag at a
+different SHA is a material conflict and blocks recovery.
 
 ## CLI Recovery
 

package/docs/release-flow.md

@@ -96,10 +96,6 @@ published artifacts are already durable.
 The intended governance split is:
 
 - exact tags such as `v3.0.2` and `v3.0.3-alpha.0` are immutable audit refs;
-- for publish transactions, the exact tag points to the transaction
-  `source_sha`, matching package-registry source metadata such as npm
-  `gitHead`; generated version-state commits remain on protected branches and
-  floating channel refs;
 - floating tags such as `v3`, `v3.0`, `v3.0-alpha`, and `v3-alpha` are mutable channel refs
   owned by the Buildchain promotion token;
 - protected branches still require reviewed channel PRs before Buildchain can

package/docs/release-governance.md

@@ -575,38 +575,6 @@ context shape into the other. Consumer repositories can keep their context
 stable while changing the actual verification command declaratively in
 `buildchain.toml`:
 
-Before a release caller is merged, consumers should also verify its exact
-reusable-workflow call contract. The checker reads the caller and an already
-checked-out exact Buildchain commit; it never resolves a floating ref or starts
-a release. It rejects unknown or missing inputs and secrets, literal type
-drift, insufficient permissions, untrusted event classes, and a caller pin that
-does not equal the checked callee commit. Defaults, workflow bytes, and the
-complete interface are bound into `contractRoot`; the receipt additionally
-binds the caller commit/tree and both workflow digests.
-
-```sh
-node .buildchain/workflow-contract-runtime/scripts/workflow-call-contract.mjs check \
-  --caller-root . \
-  --caller-workflow .github/workflows/release-new-version.yml \
-  --caller-repository kungfu-systems/example \
-  --job promote \
-  --callee-root .buildchain/workflow-contract-runtime \
-  --callee-workflow .github/workflows/release-candidate-promote.yml \
-  --callee-repository kungfu-systems/buildchain \
-  --trusted-event workflow_dispatch \
-  --trusted-event pull_request:closed \
-  --expected-contract-root "$(cat .buildchain/release-call-contract-root)" \
-  --output .buildchain/workflow-call-receipts/release-new-version.json
-```
-
-The checkout at `.buildchain/workflow-contract-runtime` must use the same
-40-character SHA written in the caller's `uses:` edge. To accept an intentional
-contract change, first run without `--expected-contract-root`, review the full
-diagnostic and exact coordinates, then replace only the committed root. The
-ordinary PR check runs this command before any candidate or promotion dispatch.
-Local pre-commit rehearsal may add `--allow-dirty`; that result is marked
-`receiptReusable: false` and cannot replace the clean exact-source receipt.
-
 ```toml
 [lifecycle.install]
 command = "cargo fetch --locked"
@@ -863,13 +831,6 @@ must be absent or already point at accepted release material. This preserves an
 immutable tag that represents a completed transaction while allowing a tag
 collision discovered after registry publication to recover without republishing.
 
-For package publish transactions, the immutable public version tag points to
-the transaction `source_sha`, so registry source metadata such as npm `gitHead`
-and the Git tag identify the same source commit. Protected branches and mutable
-channel tags continue to point to the generated `release_sha`. Recovery accepts
-older completed transactions whose exact tags already point to recorded release
-or release-material SHAs, but new tags are source-bound.
-
 Every Buildchain publish model that can run registry side effects must bind the
 publish entrypoint to an immutable `publish-gate/*` source lock. The reusable
 `release-candidate-promote.yml@v3` wrapper creates or updates that gate ref and

package/docs/reusable-build-surface.md

@@ -439,7 +439,6 @@ jobs:
       checkout-cache-timeout-seconds: 60
       checkout-cache-github-timeout-seconds: 600
       checkout-cache-fetch-attempts: 3
-      checkout-history-mode: shallow
 ```
 
 `checkout-cache-mode` accepts:
@@ -450,14 +449,6 @@ jobs:
 | `auto`    | Try the trusted cache first; on miss, record the miss and fall back according to `checkout-cache-fallback`. |
 | `require` | Require the cache to provide the locked commit and fail before lifecycle work if unavailable.               |
 
-`checkout-history-mode` defaults to `shallow`, preserving the bounded single-
-commit transport used by ordinary builds. Set it to `full` only when a
-consumer gate must inspect source ancestry, for example when an Alpha pull
-request qualifies GitHub's synthetic merge ref while retained evidence is
-bound to an ancestor of the source-lock head. Full mode still verifies the
-resolved immutable `HEAD` and tree; it changes only whether the advertised
-source ref is fetched with depth one or with its reachable history.
-
 The cache can be a local/LAN mirror URL template or a runner-local bare
 reference repository template. Templates support `{owner}`, `{repo}`,
 `{repository}`, `{repositorySlug}`, and `{sha}`. The workflow also reads

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.5-alpha.8",
+  "version": "3.0.5",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-contract.js

@@ -72,41 +72,6 @@ function majorLineFromPackageVersion(version = "") {
   return match ? `v${match[1]}` : "v3";
 }
 
-function declarativeAuditableDemoSurface(root, pkg, majorLine) {
-  return surface(root, {
-    id: "declarative-auditable-demo",
-    kind: "workflow",
-    path: ".github/workflows/.declarative-auditable-demo.yml",
-    publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.declarative-auditable-demo.yml@${majorLine}`,
-    requiredInputs: ["binary-artifact-name", "binary-artifact-digest", "renderer-image"],
-    requiredOutputs: [
-      "source-sha", "capture-artifact-name", "capture-artifact-digest",
-      "evidence-artifact-name", "evidence-artifact-digest", "publication-pr-url",
-    ],
-    breakingDefaults: {
-      scenarioPathDefault: ".buildchain/auditable-demo.json",
-      renderMediaDefault: false,
-      materializeDefault: false,
-      mediaProfileDefault: "responsive-web-delivery-v1",
-      artifactRetentionDaysDefault: 14,
-      executionBoundary: "exact-binary-network-none-secret-free-60-seconds",
-    },
-    optionalInputs: [
-      "buildchain-repository", "source-ref", "scenario-path", "render-media",
-      "media-profile", "materialize", "materialize-base-ref", "artifact-retention-days",
-    ],
-    guarantees: [
-      "one versioned declaration can contain multiple demos with multiple ordered literal argv steps",
-      "every demo uses the exact same-run standalone binary admitted by producer-owned artifact name and digest",
-      "capture runs without network or inherited secrets and retains independent native 1080p and 720p terminal dimensions",
-      "the generic adapter feeds the required auditable demo Gate and immutable renderer without product-specific glue",
-      "full rendering emits a content-addressed Release Passport and idempotent protected README update pull request",
-      "manual, alpha, and release callers use the same capture, Gate, renderer, passport, and materializer implementation",
-      "identity, compliance, Product System metadata, package metadata, registry history, scans, and generation grant no authority",
-    ],
-  });
-}
-
 export function createBuildchainContractWorld({
   root = process.cwd(),
   packageJson = undefined,
@@ -395,7 +360,7 @@ export function createBuildchainContractWorld({
         "Build Images owns encoding, Buildchain owns qualification and receipts, and site repositories own browser loading and accessibility behavior",
         "media qualification does not claim browser playback, responsive layout, reduced-motion behavior, accessibility, or production deployment",
       ],
-    }), declarativeAuditableDemoSurface(root, pkg, majorLine),
+    }),
     surface(root, {
       id: "promote-buildchain-ref-action",
       kind: "action",

package/packages/core/buildchain-publication-authority.js

@@ -5,7 +5,6 @@ import { createPublicationAuthorityRegistry } from "./publication-authority.js";
 
 const DESCRIPTORS = Object.freeze([
   [".github/workflows/.auditable-demo.yml", "non-publication-oidc"],
-  [".github/workflows/.declarative-auditable-demo.yml", "governance-write"],
   [".github/workflows/.build.yml", "non-publication-oidc"],
   [".github/workflows/.release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/.publication-authority.yml", "evidence-publication"],
@@ -20,7 +19,6 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/binary-distribution.yml", "evidence-publication"],
   [".github/workflows/binary-release-assets.yml", "governance-write"],
   [".github/workflows/artifact-signing-authority.yml", "evidence-publication"],
-  [".github/workflows/auditable-demo.yml", "governance-write"],
   [".github/workflows/build-surface-fixture.yml", "non-publication-oidc"],
   [".github/workflows/build.yml", "non-publication-oidc"],
   [".github/workflows/buildchain-alpha-self-dogfood.yml", "non-publication-oidc"],

package/packages/core/public-surface-audit.js

@@ -5,7 +5,6 @@ import {
   commandId,
   enumerateCliCommandsFromBin,
 } from "./public-surface-cli.js";
-import { parseReusableWorkflowInterface } from "./workflow-yaml-contract.js";
 
 export { enumerateCliCommandsFromBin } from "./public-surface-cli.js";
 
@@ -47,6 +46,38 @@ function listDirectories(root, dir) {
     .sort();
 }
 
+function parseYamlWorkflowCall(text) {
+  const lines = text.split(/\r?\n/);
+  const result = { reusable: false, inputs: [], secrets: [], outputs: [] };
+  const workflowCallIndex = lines.findIndex((line) => /^(\s*)workflow_call:\s*$/.test(line));
+  if (workflowCallIndex === -1) return result;
+  result.reusable = true;
+  const workflowCallIndent = lines[workflowCallIndex].match(/^(\s*)/)?.[1].length || 0;
+  let section = "";
+  for (const line of lines.slice(workflowCallIndex + 1)) {
+    const currentIndent = line.match(/^(\s*)/)?.[1].length || 0;
+    if (line.trim() && currentIndent <= workflowCallIndent) break;
+    const sectionMatch = line.match(new RegExp(`^\\s{${workflowCallIndent + 2}}(inputs|secrets|outputs):\\s*$`));
+    if (sectionMatch) {
+      section = sectionMatch[1];
+      continue;
+    }
+    if (line.trim() && currentIndent <= workflowCallIndent + 2) {
+      section = "";
+      continue;
+    }
+    if (!section) continue;
+    const fieldMatch = line.match(new RegExp(`^\\s{${workflowCallIndent + 4}}([A-Za-z0-9_-]+):\\s*$`));
+    if (fieldMatch) result[section].push(fieldMatch[1]);
+  }
+  return {
+    reusable: result.reusable,
+    inputs: uniqueSorted(result.inputs),
+    secrets: uniqueSorted(result.secrets),
+    outputs: uniqueSorted(result.outputs),
+  };
+}
+
 function parseYamlTopLevelInputs(text) {
   const lines = text.split(/\r?\n/);
   const inputs = [];
@@ -73,14 +104,14 @@ function parseYamlTopLevelInputs(text) {
 
 export function enumerateWorkflowInputs({ root = process.cwd() } = {}) {
   return listFiles(root, ".github/workflows", (name) => /\.ya?ml$/.test(name)).map((relPath) => {
-    const contract = parseReusableWorkflowInterface(readText(root, relPath));
+    const contract = parseYamlWorkflowCall(readText(root, relPath));
     return {
       id: relPath.replace(/^\.github\/workflows\//, "").replace(/\.ya?ml$/, ""),
       path: relPath,
       reusable: contract.reusable,
-      inputs: contract.inputs.map((entry) => entry.name),
+      inputs: contract.inputs,
       inputCount: contract.inputs.length,
-      secrets: contract.secrets.map((entry) => entry.name),
+      secrets: contract.secrets,
       secretCount: contract.secrets.length,
       outputs: contract.outputs,
       outputCount: contract.outputs.length,

package/packages/core/release-propagation-release.js

@@ -31,9 +31,7 @@ function normalizePackageFact(pkg = {}) {
     name: assertString(pkg.name, "upstreamRelease.package.name"),
     version: assertString(pkg.version, "upstreamRelease.package.version"),
     integrity: assertString(pkg.integrity, "upstreamRelease.package.integrity"),
-    gitHead: pkg.gitHead || pkg.git_head
-      ? assertCommitSha(pkg.gitHead || pkg.git_head, "upstreamRelease.package.gitHead")
-      : "",
+    gitHead: assertCommitSha(pkg.gitHead || pkg.git_head, "upstreamRelease.package.gitHead"),
   };
   if (!/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(normalized.integrity)) {
     throw new Error("upstreamRelease.package.integrity must be an exact sha512 SRI value");
@@ -41,57 +39,6 @@ function normalizePackageFact(pkg = {}) {
   return normalized;
 }
 
-function normalizeRegistryProvenance(value, packageFact, repository, sourceSha) {
-  if (!value) return undefined;
-  if (!packageFact) throw new Error("upstreamRelease.registryProvenance requires package");
-  const input = assertPlainObject(value, "upstreamRelease.registryProvenance");
-  const normalized = {
-    registry: assertString(input.registry, "upstreamRelease.registryProvenance.registry"),
-    attestationUrl: assertString(input.attestationUrl || input.attestation_url, "upstreamRelease.registryProvenance.attestationUrl"),
-    predicateType: assertString(input.predicateType || input.predicate_type, "upstreamRelease.registryProvenance.predicateType"),
-    subjectSha512: assertString(input.subjectSha512 || input.subject_sha512, "upstreamRelease.registryProvenance.subjectSha512"),
-    repository: assertString(input.repository, "upstreamRelease.registryProvenance.repository"),
-    sourceSha: assertCommitSha(input.sourceSha || input.source_sha, "upstreamRelease.registryProvenance.sourceSha"),
-    workflowPath: assertString(input.workflowPath || input.workflow_path, "upstreamRelease.registryProvenance.workflowPath"),
-    workflowRef: assertString(input.workflowRef || input.workflow_ref, "upstreamRelease.registryProvenance.workflowRef"),
-    runUrl: assertString(input.runUrl || input.run_url, "upstreamRelease.registryProvenance.runUrl"),
-  };
-  if (normalized.registry !== "https://registry.npmjs.org") throw new Error("upstreamRelease.registryProvenance.registry must be the public npm registry");
-  if (!normalized.attestationUrl.startsWith("https://registry.npmjs.org/-/npm/v1/attestations/")) throw new Error("upstreamRelease.registryProvenance.attestationUrl must use the npm attestation API");
-  if (normalized.predicateType !== "https://slsa.dev/provenance/v1") throw new Error("upstreamRelease.registryProvenance must use SLSA provenance v1");
-  if (!/^[0-9a-f]{128}$/.test(normalized.subjectSha512)) throw new Error("upstreamRelease.registryProvenance.subjectSha512 must be an exact SHA-512 digest");
-  const sriDigest = Buffer.from(packageFact.integrity.slice("sha512-".length), "base64").toString("hex");
-  if (normalized.subjectSha512 !== sriDigest) throw new Error("upstreamRelease registry provenance subject must match package integrity");
-  if (normalized.repository !== repository || normalized.sourceSha !== sourceSha) throw new Error("upstreamRelease registry provenance source must match the release envelope");
-  return normalized;
-}
-
-function normalizeReleaseEvidence(release, packageFact, repository, sourceSha, version) {
-  const registryProvenance = normalizeRegistryProvenance(
-    release.registryProvenance || release.registry_provenance,
-    packageFact,
-    repository,
-    sourceSha,
-  );
-  const tag = optionalString(release.tag);
-  const target = release.tagTargetSha || release.tag_target_sha;
-  const tagTargetSha = target ? assertCommitSha(target, "upstreamRelease.tagTargetSha") : "";
-  if (!registryProvenance) {
-    if (tag !== `v${version}`) throw new Error("upstreamRelease.tag must exactly match the published version");
-    if (tagTargetSha !== sourceSha) throw new Error("upstreamRelease tag target must match sourceSha");
-    if (packageFact && packageFact.gitHead !== sourceSha) throw new Error("upstreamRelease package gitHead must match sourceSha");
-  } else if ((tag && tag !== `v${version}`) || (tagTargetSha && tagTargetSha !== sourceSha)) {
-    throw new Error("upstreamRelease optional tag evidence must match the provenance source");
-  }
-  const passportInput = release.releasePassport || release.release_passport;
-  return {
-    tag,
-    tagTargetSha,
-    registryProvenance,
-    releasePassport: passportInput ? normalizeReleasePassport(passportInput) : undefined,
-  };
-}
-
 function normalizeDigestUrlFact(value = {}, label) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`${label} must be an object`);
@@ -170,22 +117,33 @@ export function normalizeUpstreamRelease(input) {
     throw new Error("upstreamRelease.repository must be owner/repo");
   }
   const sourceSha = assertCommitSha(release.sourceSha || release.source_sha, "upstreamRelease.sourceSha");
+  const tagTargetSha = assertCommitSha(
+    release.tagTargetSha || release.tag_target_sha,
+    "upstreamRelease.tagTargetSha",
+  );
   const version = packageFact?.version || publicationArtifact?.version || "";
-  const evidence = normalizeReleaseEvidence(release, packageFact, repository, sourceSha, version);
-  if (!evidence.registryProvenance && !evidence.releasePassport) normalizeReleasePassport();
+  const tag = assertString(release.tag, "upstreamRelease.tag");
+  if (tag !== `v${version}`) {
+    throw new Error("upstreamRelease.tag must exactly match the published version");
+  }
+  if (tagTargetSha !== sourceSha) {
+    throw new Error("upstreamRelease tag target must match sourceSha");
+  }
+  if (packageFact && packageFact.gitHead !== sourceSha) {
+    throw new Error("upstreamRelease package gitHead must match sourceSha");
+  }
   if (packageFact && publicationArtifact && packageFact.version !== publicationArtifact.version) {
     throw new Error("upstreamRelease package and publication artifact versions must match");
   }
   return {
     repository,
     channel: normalizeChannel(release.channel, "upstreamRelease.channel"),
-    tag: evidence.tag,
-    tagTargetSha: evidence.tagTargetSha,
+    tag,
+    tagTargetSha,
     sourceSha,
     package: packageFact,
     publicationArtifact,
-    releasePassport: evidence.releasePassport,
-    registryProvenance: evidence.registryProvenance,
+    releasePassport: normalizeReleasePassport(release.releasePassport || release.release_passport),
     siteBundle: release.siteBundle || release.site_bundle
       ? {
         manifestSha256: assertString(
@@ -208,7 +166,6 @@ export function verifyReleaseLockBinding({ release, lock, downstream, propagatio
     package: lock.upstream?.package,
     publicationArtifact: lock.upstream?.publicationArtifact,
     releasePassport: lock.upstream?.releasePassport,
-    registryProvenance: lock.upstream?.registryProvenance,
     siteBundle: lock.upstream?.siteBundle,
   });
   if (JSON.stringify(lockRelease) !== JSON.stringify(normalizedRelease)) {

package/packages/core/release-propagation-work.js

@@ -317,12 +317,8 @@ function verifyWorkRelease(work) {
     downstream.executionProfile,
     "release propagation work downstream.executionProfile",
   );
-  const lockedProfile = normalizeExecutionProfile(
-    downstream.releaseLock.downstream.executionProfile,
-    "release propagation work releaseLock.downstream.executionProfile",
-  );
-  if (!profile || !lockedProfile
-      || sha256Json(profile) !== sha256Json(lockedProfile)) {
+  if (!profile
+      || JSON.stringify(profile) !== JSON.stringify(downstream.releaseLock.downstream.executionProfile)) {
     throw new Error("release propagation work execution profile disagrees with the exact release lock");
   }
   return { downstream, profile };
@@ -404,7 +400,7 @@ function verifyWorkPlanAndState(work, downstream, profile) {
     downstream.branch,
     downstream.baseRef,
   );
-  if (sha256Json(plan.commands) !== sha256Json(expectedCommands)) {
+  if (JSON.stringify(plan.commands) !== JSON.stringify(expectedCommands)) {
     throw new Error("release propagation work commands are not canonical");
   }
   const state = assertExactFields(

package/packages/core/release-propagation.js

@@ -219,7 +219,6 @@ export function createReleasePropagationLock({
       package: upstreamRelease.package,
       publicationArtifact: upstreamRelease.publicationArtifact,
       releasePassport: upstreamRelease.releasePassport,
-      registryProvenance: upstreamRelease.registryProvenance,
       siteBundle: upstreamRelease.siteBundle,
     },
     downstream: {
@@ -407,7 +406,7 @@ export function createReleasePropagationReceipt({
             name: upstreamRelease.package.name,
             version: upstreamRelease.package.version,
             integrity: upstreamRelease.package.integrity,
-            gitHead: upstreamRelease.package.gitHead || null,
+            gitHead: upstreamRelease.package.gitHead,
           }
         : null,
     },
@@ -415,8 +414,7 @@ export function createReleasePropagationReceipt({
       state: release.channel === "alpha" ? "complete" : "not-applicable",
       evidence: release.channel === "alpha"
         ? {
-            releasePassportSha256: upstreamRelease.releasePassport?.sha256 || null,
-            registryProvenance: upstreamRelease.registryProvenance || null,
+            releasePassportSha256: upstreamRelease.releasePassport.sha256,
             tag: upstreamRelease.tag,
           }
         : null,
@@ -478,11 +476,3 @@ export {
   createPackageReleasePropagationCapture,
   normalizePackageReleasePropagationConfig,
 } from "./release-propagation-capture.js";
-export {
-  MANUAL_UPSTREAM_PICKUP_CONFIG_CONTRACT,
-  MANUAL_UPSTREAM_PICKUP_PLAN_CONTRACT,
-  createManualUpstreamPickupCapture,
-  createManualUpstreamPickupPlan,
-  normalizeManualUpstreamPickupConfig,
-  resolveNpmRegistryRelease,
-} from "./release-propagation-pickup.js";

package/scripts/auditable-demo-renditions.mjs

@@ -29,8 +29,7 @@ export function validateTerminalCapture(value, scene, helpers) {
   exactKeys(value.dimensions, ["columns", "rows"], [], "terminalCapture.dimensions");
   integer(value.dimensions.columns, 80, 200, "terminalCapture.dimensions.columns");
   integer(value.dimensions.rows, 24, 80, "terminalCapture.dimensions.rows");
-  const maximumDurationMs = scene.durationClass === "long-form" ? 180000 : 60000;
-  const durationMs = integer(value.durationMs, 500, maximumDurationMs, "terminalCapture.durationMs");
+  const durationMs = integer(value.durationMs, 500, 60000, "terminalCapture.durationMs");
   invariant(
     durationMs <= scene.durationMs && scene.durationMs - durationMs <= 2000,
     "terminal capture duration must end within two seconds of the scene",
@@ -115,13 +114,9 @@ export function validateRenditionSet(output, helpers) {
     const captureBytes = readRegular(path.join(output, entry.terminalCapture), `${label} terminal capture`, maxBytes);
     const capture = validateTerminalCapture(JSON.parse(decodeUtf8(captureBytes, `${label} terminal capture`)), scene, helpers);
     invariant(entry.captureRoot === sha256(captureBytes), `${label}.captureRoot mismatch`);
-    return { ...entry, files: Object.fromEntries(["transcript", "projection", "scene", "terminalCapture"].map((key) => [key, entry[key]])), transcript, lines, scene, projection, capture };
+    return { ...entry, transcript, lines, scene, projection, capture };
   });
   invariant(normalized[0].captureRoot !== normalized[1].captureRoot, "native rendition capture roots must be distinct");
-  invariant(
-    (normalized[0].scene.durationClass ?? "standard") === (normalized[1].scene.durationClass ?? "standard"),
-    "native rendition duration classes must match",
-  );
   invariant(
     JSON.stringify(normalized[0].capture.dimensions) !== JSON.stringify(normalized[1].capture.dimensions),
     "native rendition PTY dimensions must be distinct",

package/scripts/auditable-demo.mjs

@@ -36,10 +36,6 @@ const OPTIONAL_ADAPTER_FILES = [
 ];
 const MAX_TERMINAL_CAPTURE_BYTES = 4 * 1024 * 1024;
 const MAX_TERMINAL_CAPTURE_EVENTS = 10_000;
-const STANDARD_MAX_DURATION_MS = 60_000;
-const LONG_FORM_MAX_DURATION_MS = 180_000;
-const LONG_FORM_MAX_FPS = 10;
-const MAX_RENDER_FRAMES = 1_800;
 
 function invariant(condition, message) {
   if (!condition) throw new Error(message);
@@ -190,20 +186,15 @@ function validateScene(value) {
   exactKeys(
     value,
     ["schema", "id", "width", "height", "fps", "durationMs", "title"],
-    ["durationClass", "commandLabel", "background", "accent"],
+    ["commandLabel", "background", "accent"],
     "scene",
   );
   invariant(value.schema === "build-images.demo-scene/v1", "unsupported scene schema");
   invariant(/^[a-z0-9][a-z0-9._-]{0,63}$/.test(value.id), "scene.id is invalid");
   integer(value.width, 640, 1920, "scene.width");
   integer(value.height, 360, 1080, "scene.height");
-  const durationClass = value.durationClass ?? "standard";
-  invariant(durationClass === "standard" || durationClass === "long-form", "scene.durationClass is invalid");
-  const maximumDurationMs = durationClass === "long-form" ? LONG_FORM_MAX_DURATION_MS : STANDARD_MAX_DURATION_MS;
-  const maximumFps = durationClass === "long-form" ? LONG_FORM_MAX_FPS : 30;
-  integer(value.fps, 1, maximumFps, "scene.fps");
-  integer(value.durationMs, 500, maximumDurationMs, "scene.durationMs");
-  invariant(Math.ceil((value.durationMs / 1000) * value.fps) <= MAX_RENDER_FRAMES, "scene exceeds the deterministic source-frame bound");
+  integer(value.fps, 1, 30, "scene.fps");
+  integer(value.durationMs, 500, 60000, "scene.durationMs");
   text(value.title, 1, 120, "scene.title");
   if (value.commandLabel !== undefined) text(value.commandLabel, 0, 160, "scene.commandLabel");
   for (const key of ["background", "accent"]) {
@@ -215,7 +206,6 @@ function validateScene(value) {
     width: value.width,
     height: value.height,
     fps: value.fps,
-    ...(value.durationClass === undefined ? {} : { durationClass }),
     durationMs: value.durationMs,
     title: value.title,
     commandLabel: value.commandLabel ?? "",
@@ -534,7 +524,7 @@ function validateBudgetBasis(entry, label) {
     MAX_BUNDLE_MEMBER_BYTES,
     `${label}.budgetBasis.observedBytes`,
   );
-  const multiplier = integer(entry.budgetBasis.multiplier, 1, 128, `${label}.budgetBasis.multiplier`);
+  const multiplier = integer(entry.budgetBasis.multiplier, 1, 64, `${label}.budgetBasis.multiplier`);
   invariant(entry.budgetBasis.rounding === "next-power-of-two", `${label}.budgetBasis.rounding is unsupported`);
   const expected = 2 ** Math.ceil(Math.log2(observedBytes * multiplier));
   invariant(entry.maximumBytes === expected, `${label}.maximumBytes does not match its measured budget basis`);
@@ -1027,15 +1017,6 @@ function verifyRendererOutput(renderOutput, expectedImage, expectedInputs, optio
   return { manifest, probe, qualification };
 }
 
-function renditionInputRoots(root, renditions) {
-  return renditions.map((rendition) => ({
-    id: rendition.id, role: rendition.role, captureRoot: rendition.captureRoot,
-    sceneRoot: sha256(readRegular(path.join(root, rendition.files.scene), `${rendition.id} scene`)),
-    transcriptRoot: sha256(readRegular(path.join(root, rendition.files.transcript), `${rendition.id} transcript`)),
-    projectionRoot: sha256(readRegular(path.join(root, rendition.files.projection), `${rendition.id} projection`)),
-  }));
-}
-
 function finalizeGate(values) {
   const adapterOutput = path.resolve(required(values, "--adapter-output"));
   const smokeInput = path.resolve(required(values, "--smoke-input"));
@@ -1128,7 +1109,14 @@ function finalizeGate(values) {
           renditionSet: {
             schema: normalized.renditionSet.schema,
             root: sha256(readRegular(path.join(output, "rendition-set.json"), "rendition set")),
-            renditions: renditionInputRoots(output, normalized.renditionSet.renditions),
+            renditions: normalized.renditionSet.renditions.map((rendition) => ({
+              id: rendition.id,
+              role: rendition.role,
+              captureRoot: rendition.captureRoot,
+              sceneRoot: sha256(readRegular(path.join(output, rendition.scene), `${rendition.id} scene`)),
+              transcriptRoot: sha256(readRegular(path.join(output, rendition.transcript), `${rendition.id} transcript`)),
+              projectionRoot: sha256(readRegular(path.join(output, rendition.projection), `${rendition.id} projection`)),
+            })),
           },
         }
         : {}),
@@ -1191,8 +1179,15 @@ function verifyGate(values) {
     invariant(
       qualifiedRenditionSet.schema === normalized.renditionSet.schema
         && qualifiedRenditionSet.root === sha256(readRegular(path.join(bundle, "rendition-set.json"), "rendition set"))
-        && stableJson(qualifiedRenditionSet.renditions)
-          === stableJson(renditionInputRoots(bundle, normalized.renditionSet.renditions)),
+        && JSON.stringify(qualifiedRenditionSet.renditions)
+          === JSON.stringify(normalized.renditionSet.renditions.map((rendition) => ({
+            id: rendition.id,
+            role: rendition.role,
+            captureRoot: rendition.captureRoot,
+            sceneRoot: sha256(readRegular(path.join(bundle, rendition.scene), `${rendition.id} scene`)),
+            transcriptRoot: sha256(readRegular(path.join(bundle, rendition.transcript), `${rendition.id} transcript`)),
+            projectionRoot: sha256(readRegular(path.join(bundle, rendition.projection), `${rendition.id} projection`)),
+          }))),
       "gate native rendition roots mismatch",
     );
   }
@@ -1316,7 +1311,6 @@ export {
   inspectRendererMedia,
   parseAdapterArguments,
   qualifyMediaFixture,
-  renditionInputRoots,
   prepareSmoke,
   runAdapter,
   sha256,