@kungfu-tech/buildchain 3.0.5 → 3.0.6-alpha.1

package/README.md

@@ -1,5 +1,32 @@
 # Buildchain
 
+<!-- buildchain-auditable-demo:start -->
+## Buildchain beginner bootstrap
+
+[![Buildchain beginner bootstrap](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.gif)](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/public-evidence.json)
+
+Animation scenario:
+
+```text
+$ buildchain init --cwd ./starter --type package --package-manager npm
+$ buildchain layout --cwd ./starter --json
+$ buildchain version
+```
+
+Native renditions: [1080p MP4](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.mp4) · [1080p WebM](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.webm) · [720p MP4](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo-720p.mp4) · [720p WebM](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo-720p.webm)
+
+[Static poster / reduced-motion fallback](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/poster.png)
+
+<details>
+<summary>Evidence and claim boundary</summary>
+
+This exact standalone-binary scenario proves deterministic local bootstrap behavior only; it does not grant release, repository, network, or production authority.
+
+[Release Passport](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/release-passport.json) · [auditable evidence](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/public-evidence.json)
+
+</details>
+<!-- buildchain-auditable-demo:end -->
+
 <!-- buildchain:badges:start -->
 
 [![KFD-1: passed](https://buildchain.libkungfu.dev/badges/v1/kfd-1/passed.svg)](https://github.com/kungfu-systems/buildchain/releases/latest/download/buildchain.release.json)
@@ -277,6 +304,10 @@ The active reusable workflow surfaces are:
   qualification, transcript-bound renderer smoke, optional media rendering
   from the exact passing Gate bundle, and opt-in content-addressed web-delivery
   profiles with independently verified rendition roles;
+- `.github/workflows/.declarative-auditable-demo.yml` for standalone binary
+  consumers that provide only a versioned multi-demo argv scenario and exact
+  same-run binary artifact coordinates; Buildchain owns isolated native
+  capture, Gate, Release Passport, materialization, and protected README PRs;
 - `.github/workflows/.build.yml` for deterministic multi-platform build and
   artifact contracts;
 - `.github/workflows/build.yml` for the single-config channel router that uses

package/actions/macos-credential-island/README.md

@@ -7,6 +7,14 @@ exact Developer ID Application identity into a temporary keychain, signs the
 application, submits Apple notarization, staples the application and DMG,
 verifies Gatekeeper, and writes bounded JSON evidence.
 
+DMG assembly uses a unique execution- and attempt-bound image path and volume
+name. Only the exact `hdiutil: create failed - Resource busy` failure is retried,
+with three attempts and a total retry delay of seven seconds. Certificate,
+entitlement, signature, notarization, provenance, and policy failures remain
+terminal. Attempt artifacts stay below the owned temporary root, and successful
+evidence binds the request, unsigned archive, runtime, runner attempt, toolchain,
+retry history, cleanup result, and signed output digests.
+
 The reusable Buildchain workflow invokes this action from a job bound to the
 caller's protected GitHub Environment. The job downloads the exact sealed
 Buildchain input and immutable action runtime, then uploads the signed payload

package/bin/buildchain.mjs

@@ -1623,7 +1623,7 @@ async function handlePaperCommand(args) {
 }
 
 async function handleReleasePropagationCommand(args) {
-    runReleasePropagationCli(args);
+    await runReleasePropagationCli(args);
     return;
 
 }

package/contracts/auditable-demo-media-profiles-v1.json

@@ -246,6 +246,67 @@
         "responsive-alternate-video"
       ]
     },
+    "responsive-long-form-web-delivery-v1": {
+      "extends": "responsive-web-delivery-v1",
+      "mode": "web-delivery",
+      "renditions": [
+        {
+          "path": "demo.gif",
+          "maximumBytes": 8388608,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.gif",
+            "observedBytes": 40826,
+            "multiplier": 128,
+            "rounding": "next-power-of-two"
+          }
+        },
+        {
+          "path": "demo.mp4",
+          "maximumBytes": 4194304,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.mp4",
+            "observedBytes": 27038,
+            "multiplier": 128,
+            "rounding": "next-power-of-two"
+          }
+        },
+        {
+          "path": "demo.webm",
+          "maximumBytes": 4194304,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.webm",
+            "observedBytes": 23383,
+            "multiplier": 128,
+            "rounding": "next-power-of-two"
+          }
+        },
+        {
+          "path": "demo-720p.mp4",
+          "maximumBytes": 4194304,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.mp4",
+            "observedBytes": 27038,
+            "multiplier": 128,
+            "rounding": "next-power-of-two"
+          }
+        },
+        {
+          "path": "demo-720p.webm",
+          "maximumBytes": 4194304,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.webm",
+            "observedBytes": 23383,
+            "multiplier": 128,
+            "rounding": "next-power-of-two"
+          }
+        }
+      ]
+    },
     "site-hero-v1": {
       "extends": "web-delivery-v1",
       "mode": "web-delivery",

package/contracts/auditable-demo-scenario-v1.schema.json

@@ -0,0 +1,164 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.libkungfu.dev/contracts/auditable-demo-scenario-v1.schema.json",
+  "title": "Buildchain declarative binary auditable demo",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "product", "artifact", "execution", "renditions", "demos", "publication", "authority"],
+  "properties": {
+    "schema": {"const": "buildchain.declarative-binary-demo/v1"},
+    "product": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "displayName", "binaryName"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"},
+        "displayName": {"type": "string", "minLength": 1, "maxLength": 80},
+        "binaryName": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"}
+      }
+    },
+    "artifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["platformId", "binaryPath", "metadataPath", "metadataContract", "runtimeDependencies"],
+      "properties": {
+        "platformId": {"const": "linux-x64"},
+        "binaryPath": {"type": "string", "minLength": 1},
+        "metadataPath": {"type": "string", "minLength": 1},
+        "metadataContract": {"type": "string", "minLength": 1},
+        "runtimeDependencies": {"type": "array", "maxItems": 0}
+      }
+    },
+    "execution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["deterministic", "network", "secrets", "totalTimeoutSeconds", "environment"],
+      "properties": {
+        "deterministic": {"const": true},
+        "network": {"const": "none"},
+        "secrets": {"const": "none"},
+        "durationClass": {"type": "string", "enum": ["standard", "long-form"]},
+        "totalTimeoutSeconds": {"type": "integer", "minimum": 1},
+        "environment": {
+          "type": "object",
+          "propertyNames": {"pattern": "^[A-Z][A-Z0-9_]{0,63}$"},
+          "additionalProperties": {"type": "string", "maxLength": 256}
+        }
+      }
+    },
+    "transportSmoke": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["argv", "timeoutSeconds", "expectedExitCodes", "stdoutIncludes"],
+      "properties": {
+        "argv": {"type": "array", "minItems": 1, "maxItems": 64, "items": {"type": "string", "maxLength": 512}},
+        "timeoutSeconds": {"type": "integer", "minimum": 1, "maximum": 60},
+        "expectedExitCodes": {"type": "array", "minItems": 1, "maxItems": 4, "items": {"type": "integer", "minimum": 0, "maximum": 255}},
+        "stdoutIncludes": {"type": "array", "maxItems": 32, "items": {"type": "string", "minLength": 1, "maxLength": 256}}
+      }
+    },
+    "renditions": {
+      "const": [
+        {"id": "1080p", "role": "primary", "columns": 150, "rows": 36, "width": 1920, "height": 1080},
+        {"id": "720p", "role": "responsive", "columns": 100, "rows": 28, "width": 1280, "height": 720}
+      ]
+    },
+    "demos": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 8,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "title", "claimBoundary", "steps"],
+        "properties": {
+          "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"},
+          "title": {"type": "string", "minLength": 1, "maxLength": 120},
+          "claimBoundary": {"type": "string", "minLength": 1, "maxLength": 500},
+          "steps": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 12,
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["id", "argv", "timeoutSeconds", "expectedExitCodes", "stdoutIncludes", "fileAssertions"],
+              "properties": {
+                "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"},
+                "argv": {"type": "array", "minItems": 1, "maxItems": 64, "items": {"type": "string", "maxLength": 512}},
+                "timeoutSeconds": {"type": "integer", "minimum": 1, "maximum": 180},
+                "expectedExitCodes": {"type": "array", "minItems": 1, "maxItems": 4, "items": {"type": "integer", "minimum": 0, "maximum": 255}},
+                "stdoutIncludes": {"type": "array", "maxItems": 32, "items": {"type": "string", "minLength": 1, "maxLength": 256}},
+                "fileAssertions": {
+                  "type": "array",
+                  "maxItems": 32,
+                  "items": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["path", "jsonEquals"],
+                    "properties": {
+                      "path": {"type": "string", "minLength": 1},
+                      "jsonEquals": {"type": "object"}
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "publication": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["evidencePath", "readmePath", "marker"],
+      "properties": {
+        "evidencePath": {"type": "string", "minLength": 1},
+        "readmePath": {"type": "string", "minLength": 1},
+        "marker": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{0,79}$"}
+      }
+    },
+    "authority": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["grants", "nonAuthorities"],
+      "properties": {
+        "grants": {"type": "array", "maxItems": 0},
+        "nonAuthorities": {"type": "array", "minItems": 8, "uniqueItems": true, "items": {"type": "string"}}
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "execution": {
+            "required": ["durationClass"],
+            "properties": {"durationClass": {"const": "long-form"}}
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "execution": {"properties": {"totalTimeoutSeconds": {"maximum": 180}}}
+        }
+      },
+      "else": {
+        "properties": {
+          "execution": {"properties": {"totalTimeoutSeconds": {"maximum": 60}}},
+          "demos": {
+            "items": {
+              "properties": {
+                "steps": {
+                  "items": {
+                    "properties": {"timeoutSeconds": {"maximum": 60}}
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
+}

package/contracts/evidence/auditable-demo-responsive-web-delivery-v1.json

@@ -1,5 +1,5 @@
 {
-  "evidenceRoot": "sha256:5bebb7ca41b7b509d63293c3c363fbff917d188fe1d6ae19a73d33424ea623ed",
+  "evidenceRoot": "sha256:30417309facd1092631fd1bd3a104c3ec1f607c3310a61814b27d2145448ec36",
   "inputs": {
     "complete-transcript.txt": "sha256:3cc1fc8a46d47fad052143b54ab261f08d007403c4ec00eba37b0a733f7cc615",
     "public-projection.json": "sha256:c5d5ec702189d2e6eed17419f2fd9a659c1b4cbcf7ee1a58ac8507ec2a748180",
@@ -14,12 +14,12 @@
       "production-site-deployment"
     ],
     "profile": {
-      "catalogRoot": "sha256:cf885ac31104a36aa051fb62f47dd79b68bd671f7dfeeb1a458ea7d0cbf0c479",
+      "catalogRoot": "sha256:87578237079330ac2843113af2baff63031dc1363dba43cf3a59127ed2d255a2",
       "id": "responsive-web-delivery-v1",
       "mode": "web-delivery",
       "profileRoot": "sha256:fdbda001970304af935f58af11ccfdb7c32ec466c9dd487cbb81ee1b19dc4556"
     },
-    "qualificationRoot": "sha256:1c588662db5abcc6776a43b3210f43555161b55ddf8aa4aa4530371bc1d26ec8",
+    "qualificationRoot": "sha256:b18547f31c6b00da9215021b6d54197cbda5fbb5dcb30a633161624b8d8d8af1",
     "renditions": [
       {
         "audioStreams": 0,

package/contracts/evidence/auditable-demo-web-delivery-v1.json

@@ -1,5 +1,5 @@
 {
-  "evidenceRoot": "sha256:5a4fced32999b3007628dfaee32206b0f7512032e65fd57be455e59df2f5d877",
+  "evidenceRoot": "sha256:6875cf065ccafda0127c57a17bc81f0f999fb543341e82072bc9b89f0c7a6f0a",
   "inputs": {
     "complete-transcript.txt": "sha256:f3723a3eda614134ab724ce9fbe1e0e5f916d809a8a3096f5e37c1458cb3656c",
     "public-projection.json": "sha256:127f9877f9750a85eada4338f088bee5460c5c71a83302652d3321667002c3c7",
@@ -14,12 +14,12 @@
       "production-site-deployment"
     ],
     "profile": {
-      "catalogRoot": "sha256:cf885ac31104a36aa051fb62f47dd79b68bd671f7dfeeb1a458ea7d0cbf0c479",
+      "catalogRoot": "sha256:87578237079330ac2843113af2baff63031dc1363dba43cf3a59127ed2d255a2",
       "id": "web-delivery-v1",
       "mode": "web-delivery",
       "profileRoot": "sha256:b6fb0a83414d03a7222fc50429e60ed68b6d47758b86ceaa316ecc659a01ae2b"
     },
-    "qualificationRoot": "sha256:a8509982ce43c133ef50bbb651bdba07b5b37bed06841ebb165f23b81e3b9fc1",
+    "qualificationRoot": "sha256:d8b30192c848ba1c7f6e9a59b5dd1c9f38aae835bb94ad05ad55cdad4b6a8a2f",
     "renditions": [
       {
         "audioStreams": 0,