@kungfu-tech/buildchain 3.0.6-alpha.0 → 3.0.6-alpha.10

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.0",
+    "version": "3.0.6-alpha.10",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -52,7 +52,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa",
-      "auditDigest": "sha256:ca0c1a541903015852be934f01d68c248c438a7ae2ac4727fd7fce3b861d9997"
+      "auditDigest": "sha256:ee92538b49ee91606c21f54f2ae1e5165228ff4dc7c64d8b8a6e073b8e033365"
     },
     {
       "contractVersion": 1,
@@ -91,7 +91,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:e67bec5b6e49f69a79f652ea7d7452d0dbd1a59f53ab1e9603e929ecf1a305f4"
+      "auditDigest": "sha256:af415d283c9f7706d93c2c3df0b330c59487097364aa2ebc6e139a7275bcb635"
     },
     {
       "contractVersion": 1,
@@ -107,7 +107,8 @@
       "requiredOutputs": [
         "promoted-sha",
         "built-source-sha",
-        "release-candidate-artifact"
+        "release-candidate-artifact",
+        "release-candidate-action"
       ],
       "breakingDefaults": {
         "channelDefault": "auto",
@@ -123,6 +124,15 @@
         "buildchain-stable-contract-lock-path",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-expected-source-tree",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-buildchain-runtime-sha",
+        "resume-transaction-id",
         "publish-required-artifacts-json",
         "release-passport-kfd-1-witness-jsons",
         "release-passport-kfd-2-claim-jsons",
@@ -171,13 +181,19 @@
         "train and exact-SHA runtime overrides remain limited to trusted workflow_dispatch actors",
         "promotion reuses PR-stage release-candidate artifacts",
         "promotion does not run the heavy native build matrix",
+        "a fresh workflow event can recover an exact successful candidate run after startup or router failure",
+        "recovery validates repository, workflow, PR, ancestry, tree, candidate roots, controller evidence, manifests, archive digests, and payload bytes before mutation",
+        "recovery emits action reused and never silently falls back to a full build",
         "built source and promotion channel SHA are recorded separately",
         "contract drift is checked before release-candidate resolution and publish",
         "publish-gate source locks are created by the wrapper and enforced by promote-buildchain-ref before publish side effects",
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
-      "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
-      "auditDigest": "sha256:45f72dc26b1620b0f79558922b44449bda28b25ebc051a737137b5b01c220995"
+      "compatibleBreakingDigests": [
+        "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf"
+      ],
+      "breakingDigest": "sha256:e60642aa298933d2c103284794921a6c340a50aa91ee528b06e58892a2a006bf",
+      "auditDigest": "sha256:72f3222d7a603ede6e26caf30dfeee3545b62454d0c99e369ab5717db5468e7d"
     },
     {
       "contractVersion": 1,
@@ -193,7 +209,8 @@
       "requiredOutputs": [
         "promoted-sha",
         "built-source-sha",
-        "release-candidate-artifact"
+        "release-candidate-artifact",
+        "release-candidate-action"
       ],
       "breakingDefaults": {
         "promoteOnlyReleaseCandidate": true,
@@ -212,14 +229,27 @@
         "promotion-contract-lock-digest",
         "promotion-publication-channel",
         "promotion-target-ref",
-        "promotion-override-used"
+        "promotion-override-used",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-expected-source-tree",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-buildchain-runtime-sha",
+        "resume-transaction-id"
       ],
       "guarantees": [
         "advanced promotion verifies routed shell, runtime, lock, publication channel, and target bindings before candidate resolution",
-        "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
+        "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix",
+        "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph"
+      ],
+      "compatibleBreakingDigests": [
+        "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
       ],
-      "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:727d8fe9b0cce68e4808cc3b31b6cf95876a96bad4b5afc8fd441c669d71a1b1"
+      "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
+      "auditDigest": "sha256:c0b8f67226c571ea3d75416e71890f47f8b43e780ec093173df48cf26052c414"
     },
     {
       "contractVersion": 1,
@@ -372,7 +402,7 @@
         "identity, compliance, Product System metadata, package metadata, registry history, scans, and generation grant no authority"
       ],
       "breakingDigest": "sha256:0bcba689ab5060e12230db4118895242ecb48677ff581ea0360b1833bdac558c",
-      "auditDigest": "sha256:e7e67b9d7bf9cee6103d3cf65686fa428f1d364109c95342cd20c4801a646e02"
+      "auditDigest": "sha256:da366842e8943c88a4f12520faf2d19c555b7530d8f6d44cf75a37b94200960d"
     },
     {
       "contractVersion": 1,
@@ -670,7 +700,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:9f5a8549d5d7cb42af5720a05ad3d64b6b06f6415013d62e93fcf7d404978495"
+      "auditDigest": "sha256:327d268736cb8d474ad0a5e43d14c62575ed95a3dbc9651f3b31a5e176f8775e"
     },
     {
       "contractVersion": 1,
@@ -760,7 +790,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:b0f8aab2e5f92242e5538ea75733113249e61f2e4eec22812267712007be4c15"
+      "auditDigest": "sha256:7d5d9ac8317397aec3593bd446ebc053ab47af448f441216f011ae303e5ba2ee"
     },
     {
       "contractVersion": 1,
@@ -782,7 +812,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:2a9cedc7a6cceacb5a9864c97b87b825329ffe5115bb580c90b3e2127f813ad1"
+      "auditDigest": "sha256:75313c5cc605d977c8f3272a55d43d6adc8c641b61c713ed5b9e3772a5e70572"
     },
     {
       "contractVersion": 1,
@@ -833,7 +863,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -1010,12 +1040,13 @@
         "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
+        "verify-substage-evidence-path",
         "working-directory"
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:ba530907e57984abd47974cf3a9bab124f04629563676a4e37cfa302549789d6",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "digest": "sha256:9c0aacca910cef4619a797898ff5c24027c1583f84431a93a5efc854925326e7",
+        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1389,6 +1420,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "verify-substage-evidence-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "working-directory": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1406,7 +1441,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
-      "auditDigest": "sha256:ca0c1a541903015852be934f01d68c248c438a7ae2ac4727fd7fce3b861d9997"
+      "auditDigest": "sha256:ee92538b49ee91606c21f54f2ae1e5165228ff4dc7c64d8b8a6e073b8e033365"
     },
     {
       "contractVersion": 1,
@@ -1540,12 +1575,13 @@
         "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
+        "verify-substage-evidence-path",
         "working-directory"
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:0e0888527d7319a7603620520cdd76eb3e4434f80dbc92fffa0eb0d90f88b3e4",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "digest": "sha256:48545554883888862984cdf1b6b4b56341531cdd6192600782a76b92ad22fd36",
+        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1931,6 +1967,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "verify-substage-evidence-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "working-directory": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1944,7 +1984,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:e67bec5b6e49f69a79f652ea7d7452d0dbd1a59f53ab1e9603e929ecf1a305f4"
+      "auditDigest": "sha256:af415d283c9f7706d93c2c3df0b330c59487097364aa2ebc6e139a7275bcb635"
     },
     {
       "contractVersion": 1,
@@ -2014,7 +2054,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2145,7 +2185,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:5f1868478b7ccd9fb79aea76bc771289d2ca6bd2dccd1abf57575426f1eae5fb",
-      "auditDigest": "sha256:81ecbba803625efc00fba9aadd98c0baa3f6477a105db29f1db366853a464028"
+      "auditDigest": "sha256:9c22dc647886a67250485185810978775f4eaa2efdbfdc4f959b918e3ec1e312"
     },
     {
       "contractVersion": 1,
@@ -2231,7 +2271,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2475,7 +2515,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2657,7 +2697,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2918,6 +2958,8 @@
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
+        "publication-gate-command",
+        "publication-gate-controller-sha",
         "publication-package-name",
         "publication-product",
         "publication-publisher-workflow-path",
@@ -2941,6 +2983,7 @@
         "release-candidate-family-evidence-required",
         "release-candidate-family-evidence-root",
         "release-candidate-family-initiative-id",
+        "release-candidate-wait-seconds",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
@@ -2965,6 +3008,15 @@
         "release-propagation-config-path",
         "required-artifact-count",
         "required-status-check",
+        "resume-buildchain-runtime-sha",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-expected-source-tree",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-transaction-id",
         "runner-preset",
         "standalone-binary-distribution",
         "target-ref",
@@ -2973,8 +3025,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:220710d81a41b50edb4dc65cea3e1e5d20805406eaaced65bc006718700696b9",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "digest": "sha256:bb49305be1f2176c47920532d414954e1d058156abf3411ae66cc97ba526d186",
+        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3188,6 +3240,14 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "publication-gate-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "publication-gate-controller-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "publication-package-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -3280,6 +3340,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "release-candidate-wait-seconds": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "release-candidate-workflow-file": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -3376,6 +3440,42 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "resume-buildchain-runtime-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-candidate-repository": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-candidate-run-id": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-candidate-root": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-candidate-runtime-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-source-tree": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-workflow-file": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-workflow-name": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-transaction-id": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "runner-preset": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -3405,7 +3505,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:727d8fe9b0cce68e4808cc3b31b6cf95876a96bad4b5afc8fd441c669d71a1b1"
+      "auditDigest": "sha256:c0b8f67226c571ea3d75416e71890f47f8b43e780ec093173df48cf26052c414"
     },
     {
       "contractVersion": 1,
@@ -3470,7 +3570,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
         "inputClassifications": {
           "agent-work-context-json": {
             "classification": "digest-only",
@@ -3605,7 +3705,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3618,6 +3718,6 @@
       "auditDigest": "sha256:d07482cd66413a2fb3781a3b76f960b8151b6231841799647fe237820de2fde6"
     }
   ],
-  "compatibilityDigest": "sha256:76c3dd58a02887ecd6af33d63e749fef0a988a820fea99bdf4cb078cc48caa83",
-  "contractDigest": "sha256:a431132a3c7e5ce0c45f16c42d5b9e3e0670a76fa74c9aa78e39a063f51b104f"
+  "compatibilityDigest": "sha256:80cfdf1786019217c439810f1a80d2866bf8f7ef35a6fa569e1a687fb2bf4cbe",
+  "contractDigest": "sha256:48884a9ff4c2d6f9714083e0ddf3eb5cf28de182699b510eccc06108c8d47a57"
 }