@kungfu-tech/buildchain 3.0.5 → 3.0.6-alpha.0

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.5",
+    "version": "3.0.6-alpha.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -52,7 +52,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa",
-      "auditDigest": "sha256:1fff20be18b0ed638a02c2ae00258ee5a0052f466dd2338fe6f4935a31f94dfe"
+      "auditDigest": "sha256:ca0c1a541903015852be934f01d68c248c438a7ae2ac4727fd7fce3b861d9997"
     },
     {
       "contractVersion": 1,
@@ -91,7 +91,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:752ef03f5cbfb4a74e21081a8a09d2e292c255af25776eb1d20b317317608425"
+      "auditDigest": "sha256:e67bec5b6e49f69a79f652ea7d7452d0dbd1a59f53ab1e9603e929ecf1a305f4"
     },
     {
       "contractVersion": 1,
@@ -177,7 +177,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
-      "auditDigest": "sha256:9f7f7d80f3790df7e35b8214557bcfc94903259b07f130ddab582f523e0eafc4"
+      "auditDigest": "sha256:45f72dc26b1620b0f79558922b44449bda28b25ebc051a737137b5b01c220995"
     },
     {
       "contractVersion": 1,
@@ -219,7 +219,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:cb3776ccf4d09a4197da7f894c6c2f72b15d982b9e3c8e7c3576cc1607e2241b"
+      "auditDigest": "sha256:727d8fe9b0cce68e4808cc3b31b6cf95876a96bad4b5afc8fd441c669d71a1b1"
     },
     {
       "contractVersion": 1,
@@ -323,6 +323,57 @@
       "breakingDigest": "sha256:425f8d3d1ba205dd6fe35a20f1dc6dad7d7c563872283e3af79fea4d5c475692",
       "auditDigest": "sha256:4f0051783d637ff25a1154379dc0eb77a246ad7aee18e12a5e8ff0107aa61a90"
     },
+    {
+      "contractVersion": 1,
+      "stability": "stable",
+      "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line",
+      "id": "declarative-auditable-demo",
+      "kind": "workflow",
+      "path": ".github/workflows/.declarative-auditable-demo.yml",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/.declarative-auditable-demo.yml@v3",
+      "requiredInputs": [
+        "binary-artifact-name",
+        "binary-artifact-digest",
+        "renderer-image"
+      ],
+      "requiredOutputs": [
+        "source-sha",
+        "capture-artifact-name",
+        "capture-artifact-digest",
+        "evidence-artifact-name",
+        "evidence-artifact-digest",
+        "publication-pr-url"
+      ],
+      "breakingDefaults": {
+        "scenarioPathDefault": ".buildchain/auditable-demo.json",
+        "renderMediaDefault": false,
+        "materializeDefault": false,
+        "mediaProfileDefault": "responsive-web-delivery-v1",
+        "artifactRetentionDaysDefault": 14,
+        "executionBoundary": "exact-binary-network-none-secret-free-60-seconds"
+      },
+      "optionalInputs": [
+        "buildchain-repository",
+        "source-ref",
+        "scenario-path",
+        "render-media",
+        "media-profile",
+        "materialize",
+        "materialize-base-ref",
+        "artifact-retention-days"
+      ],
+      "guarantees": [
+        "one versioned declaration can contain multiple demos with multiple ordered literal argv steps",
+        "every demo uses the exact same-run standalone binary admitted by producer-owned artifact name and digest",
+        "capture runs without network or inherited secrets and retains independent native 1080p and 720p terminal dimensions",
+        "the generic adapter feeds the required auditable demo Gate and immutable renderer without product-specific glue",
+        "full rendering emits a content-addressed Release Passport and idempotent protected README update pull request",
+        "manual, alpha, and release callers use the same capture, Gate, renderer, passport, and materializer implementation",
+        "identity, compliance, Product System metadata, package metadata, registry history, scans, and generation grant no authority"
+      ],
+      "breakingDigest": "sha256:0bcba689ab5060e12230db4118895242ecb48677ff581ea0360b1833bdac558c",
+      "auditDigest": "sha256:e7e67b9d7bf9cee6103d3cf65686fa428f1d364109c95342cd20c4801a646e02"
+    },
     {
       "contractVersion": 1,
       "stability": "stable",
@@ -619,7 +670,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:f3be0e8ce65d5860d1ad808990f78a1fd48c18207a9aacf1ba63fd0d0e51be40"
+      "auditDigest": "sha256:9f5a8549d5d7cb42af5720a05ad3d64b6b06f6415013d62e93fcf7d404978495"
     },
     {
       "contractVersion": 1,
@@ -709,7 +760,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:9d0c9ef674ac63470098f25c1fab6e5c64b632751d7aaa5d537970b07be7b84b"
+      "auditDigest": "sha256:b0f8aab2e5f92242e5538ea75733113249e61f2e4eec22812267712007be4c15"
     },
     {
       "contractVersion": 1,
@@ -731,7 +782,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:31e9f080b8ea31513ec1cc0db8d3cfd8cebf63d1ec6dd31048f77cfe4808fa2c"
+      "auditDigest": "sha256:2a9cedc7a6cceacb5a9864c97b87b825329ffe5115bb580c90b3e2127f813ad1"
     },
     {
       "contractVersion": 1,
@@ -782,7 +833,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:56e91795341365ea7684caed8f2d6fd81b1d5bd669b004545caefdbe63c0f98d",
+        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -909,6 +960,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "checkout-history-mode",
         "compiler-cache-platforms-json",
         "compiler-cache-provider",
         "compiler-cache-required",
@@ -930,6 +982,8 @@
         "linux-container-preset",
         "node-version",
         "platforms-json",
+        "pre-upload-transport-smoke-artifact-root",
+        "pre-upload-transport-smoke-scenario-path",
         "process-sample-interval-ms",
         "process-summary-path",
         "publish-anchor-request-json",
@@ -960,8 +1014,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:2e4c9e9af2162de2333c9b57bffcff77a76e9ed384b9f001ab8ef63d527197f9",
-        "registryDigest": "sha256:56e91795341365ea7684caed8f2d6fd81b1d5bd669b004545caefdbe63c0f98d",
+        "digest": "sha256:ba530907e57984abd47974cf3a9bab124f04629563676a4e37cfa302549789d6",
+        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1135,6 +1189,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "checkout-history-mode": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "compiler-cache-platforms-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1219,6 +1277,14 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "pre-upload-transport-smoke-artifact-root": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "pre-upload-transport-smoke-scenario-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "process-sample-interval-ms": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1340,7 +1406,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
-      "auditDigest": "sha256:1fff20be18b0ed638a02c2ae00258ee5a0052f466dd2338fe6f4935a31f94dfe"
+      "auditDigest": "sha256:ca0c1a541903015852be934f01d68c248c438a7ae2ac4727fd7fce3b861d9997"
     },
     {
       "contractVersion": 1,
@@ -1424,6 +1490,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "checkout-history-mode",
         "compiler-cache-platforms-json",
         "compiler-cache-provider",
         "compiler-cache-required",
@@ -1445,6 +1512,8 @@
         "linux-container-preset",
         "node-version",
         "platforms-json",
+        "pre-upload-transport-smoke-artifact-root",
+        "pre-upload-transport-smoke-scenario-path",
         "process-sample-interval-ms",
         "process-summary-path",
         "publish-anchor-request-json",
@@ -1475,8 +1544,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:105eed3eb8f772d4ed93d43e7da404d849b92eafab1b461c7a9b7cb94a8a6b3b",
-        "registryDigest": "sha256:56e91795341365ea7684caed8f2d6fd81b1d5bd669b004545caefdbe63c0f98d",
+        "digest": "sha256:0e0888527d7319a7603620520cdd76eb3e4434f80dbc92fffa0eb0d90f88b3e4",
+        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1662,6 +1731,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "checkout-history-mode": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "compiler-cache-platforms-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1746,6 +1819,14 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "pre-upload-transport-smoke-artifact-root": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "pre-upload-transport-smoke-scenario-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "process-sample-interval-ms": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1863,7 +1944,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:752ef03f5cbfb4a74e21081a8a09d2e292c255af25776eb1d20b317317608425"
+      "auditDigest": "sha256:e67bec5b6e49f69a79f652ea7d7452d0dbd1a59f53ab1e9603e929ecf1a305f4"
     },
     {
       "contractVersion": 1,
@@ -1933,7 +2014,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:56e91795341365ea7684caed8f2d6fd81b1d5bd669b004545caefdbe63c0f98d",
+        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2064,7 +2145,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:5f1868478b7ccd9fb79aea76bc771289d2ca6bd2dccd1abf57575426f1eae5fb",
-      "auditDigest": "sha256:b1da0c381cfa2d9ed8d39857b2ef12b1652f9c6be43e76a6944122de9b3f7481"
+      "auditDigest": "sha256:81ecbba803625efc00fba9aadd98c0baa3f6477a105db29f1db366853a464028"
     },
     {
       "contractVersion": 1,
@@ -2150,7 +2231,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:56e91795341365ea7684caed8f2d6fd81b1d5bd669b004545caefdbe63c0f98d",
+        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2394,7 +2475,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:56e91795341365ea7684caed8f2d6fd81b1d5bd669b004545caefdbe63c0f98d",
+        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2576,7 +2657,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:56e91795341365ea7684caed8f2d6fd81b1d5bd669b004545caefdbe63c0f98d",
+        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2893,7 +2974,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:220710d81a41b50edb4dc65cea3e1e5d20805406eaaced65bc006718700696b9",
-        "registryDigest": "sha256:56e91795341365ea7684caed8f2d6fd81b1d5bd669b004545caefdbe63c0f98d",
+        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3324,7 +3405,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:cb3776ccf4d09a4197da7f894c6c2f72b15d982b9e3c8e7c3576cc1607e2241b"
+      "auditDigest": "sha256:727d8fe9b0cce68e4808cc3b31b6cf95876a96bad4b5afc8fd441c669d71a1b1"
     },
     {
       "contractVersion": 1,
@@ -3389,7 +3470,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12",
-        "registryDigest": "sha256:56e91795341365ea7684caed8f2d6fd81b1d5bd669b004545caefdbe63c0f98d",
+        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
         "inputClassifications": {
           "agent-work-context-json": {
             "classification": "digest-only",
@@ -3524,7 +3605,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:56e91795341365ea7684caed8f2d6fd81b1d5bd669b004545caefdbe63c0f98d",
+        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3537,6 +3618,6 @@
       "auditDigest": "sha256:d07482cd66413a2fb3781a3b76f960b8151b6231841799647fe237820de2fde6"
     }
   ],
-  "compatibilityDigest": "sha256:3bbcaf835844260ed98414d3bd176667245d12131e13fc748e4c2fae12399691",
-  "contractDigest": "sha256:3f1edac6e6118619eece886cccfcf91c511c15be9ff97463a44cb97ec02886ce"
+  "compatibilityDigest": "sha256:76c3dd58a02887ecd6af33d63e749fef0a988a820fea99bdf4cb078cc48caa83",
+  "contractDigest": "sha256:a431132a3c7e5ce0c45f16c42d5b9e3e0670a76fa74c9aa78e39a063f51b104f"
 }