@kungfu-tech/buildchain 3.0.6-alpha.0 → 3.0.6-alpha.2

package/README.md

@@ -3,7 +3,7 @@
 <!-- buildchain-auditable-demo:start -->
 ## Buildchain beginner bootstrap
 
-[![Buildchain beginner bootstrap](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.gif)](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/public-evidence.json)
+[![Buildchain beginner bootstrap](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/demo.gif)](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/public-evidence.json)
 
 Animation scenario:
 
@@ -13,16 +13,16 @@ $ buildchain layout --cwd ./starter --json
 $ buildchain version
 ```
 
-Native renditions: [1080p MP4](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.mp4) · [1080p WebM](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.webm) · [720p MP4](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo-720p.mp4) · [720p WebM](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo-720p.webm)
+Native renditions: [1080p MP4](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/demo.mp4) · [1080p WebM](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/demo.webm) · [720p MP4](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/demo-720p.mp4) · [720p WebM](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/demo-720p.webm)
 
-[Static poster / reduced-motion fallback](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/poster.png)
+[Static poster / reduced-motion fallback](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/poster.png)
 
 <details>
 <summary>Evidence and claim boundary</summary>
 
 This exact standalone-binary scenario proves deterministic local bootstrap behavior only; it does not grant release, repository, network, or production authority.
 
-[Release Passport](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/release-passport.json) · [auditable evidence](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/public-evidence.json)
+[Release Passport](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/release-passport.json) · [auditable evidence](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/public-evidence.json)
 
 </details>
 <!-- buildchain-auditable-demo:end -->

package/actions/promote-buildchain-ref/README.md

@@ -80,6 +80,14 @@ publish npm packages. The GitHub action dry-run still calls GitHub APIs to
 resolve the current target SHA and concrete pending ref updates, but every
 write is reported as a dry-run update.
 
+When the requested version already matches every declared version-state file,
+dry-run planning still runs `lifecycle.version-state` and any explicit
+`verification-command` so it can discover declared derived material. It does
+not fall back to the repository-wide `lifecycle.verify` in that no-op case;
+full product verification can require candidate artifacts that are deliberately
+not present until the later admission phase. Non-dry-run version-state writes
+continue to require the configured verification lifecycle before any ref moves.
+
 Repositories whose package version is anchored to an explicitly selected
 upstream release can opt into manual next-anchor behavior:
 

package/bin/buildchain.mjs

@@ -1368,8 +1368,20 @@ async function handleDoctorCommand(args) {
 
 async function handleDevCommand(args) {
     const [subcommand = "", ...devArgs] = args;
+    if (subcommand === "pr-admit") {
+      runScript("dev-pr-auto-merge.mjs", devArgs);
+      return;
+    }
+    if (subcommand === "warrant") {
+      runScript("dev-delivery-warrant.mjs", devArgs);
+      return;
+    }
+    if (subcommand === "proof") {
+      runScript("dev-delivery-proof.mjs", devArgs);
+      return;
+    }
     if (subcommand !== "merge-queue") {
-      throw new Error("usage: buildchain dev merge-queue --repository <owner/repo> --branch <dev/vN/vN.M> [--from-config | --workflow <path>...]");
+      throw new Error("usage: buildchain dev <pr-admit|merge-queue|warrant|proof> [options]");
     }
     runScript("dev-merge-queue.mjs", devArgs);
     return;

package/contracts/auditable-demo-scenario-v1.schema.json

@@ -7,6 +7,22 @@
   "required": ["schema", "product", "artifact", "execution", "renditions", "demos", "publication", "authority"],
   "properties": {
     "schema": {"const": "buildchain.declarative-binary-demo/v1"},
+    "compositionMode": {
+      "type": "string",
+      "enum": ["presentation-framed", "terminal-fill"],
+      "default": "presentation-framed"
+    },
+    "playback": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "mode", "activeDurationMs", "finalHoldMs"],
+      "properties": {
+        "schema": {"const": "buildchain.declarative-demo-playback/v1"},
+        "mode": {"const": "deterministic-readable"},
+        "activeDurationMs": {"type": "integer", "minimum": 1000, "maximum": 179750},
+        "finalHoldMs": {"type": "integer", "minimum": 250, "maximum": 5000}
+      }
+    },
     "product": {
       "type": "object",
       "additionalProperties": false,
@@ -57,6 +73,42 @@
         "stdoutIncludes": {"type": "array", "maxItems": 32, "items": {"type": "string", "minLength": 1, "maxLength": 256}}
       }
     },
+    "presentation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "proofs", "materialization"],
+      "properties": {
+        "schema": {"const": "buildchain.declarative-demo-presentation/v1"},
+        "proofs": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["demoId", "label", "question", "summary"],
+            "properties": {
+              "demoId": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"},
+              "label": {"type": "string", "minLength": 1, "maxLength": 80},
+              "question": {"type": "string", "minLength": 1, "maxLength": 120},
+              "summary": {"type": "string", "minLength": 1, "maxLength": 500},
+              "transitionAfter": {"type": "string", "minLength": 1, "maxLength": 500}
+            }
+          }
+        },
+        "materialization": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["readmeMode", "technicalSpecPath", "technicalSpecTitle", "technicalMarker"],
+          "properties": {
+            "readmeMode": {"type": "string", "enum": ["full", "media-only"]},
+            "technicalSpecPath": {"type": "string", "minLength": 1},
+            "technicalSpecTitle": {"type": "string", "minLength": 1, "maxLength": 120},
+            "technicalMarker": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{0,79}$"}
+          }
+        }
+      }
+    },
     "renditions": {
       "const": [
         {"id": "1080p", "role": "primary", "columns": 150, "rows": 36, "width": 1920, "height": 1080},

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.0",
+    "version": "3.0.6-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -52,7 +52,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa",
-      "auditDigest": "sha256:ca0c1a541903015852be934f01d68c248c438a7ae2ac4727fd7fce3b861d9997"
+      "auditDigest": "sha256:ee92538b49ee91606c21f54f2ae1e5165228ff4dc7c64d8b8a6e073b8e033365"
     },
     {
       "contractVersion": 1,
@@ -91,7 +91,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:e67bec5b6e49f69a79f652ea7d7452d0dbd1a59f53ab1e9603e929ecf1a305f4"
+      "auditDigest": "sha256:af415d283c9f7706d93c2c3df0b330c59487097364aa2ebc6e139a7275bcb635"
     },
     {
       "contractVersion": 1,
@@ -177,7 +177,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
-      "auditDigest": "sha256:45f72dc26b1620b0f79558922b44449bda28b25ebc051a737137b5b01c220995"
+      "auditDigest": "sha256:39e885f508cfc6a51817a982ccb14d575782d44650b5da50d8e9e3afbb16eb72"
     },
     {
       "contractVersion": 1,
@@ -219,7 +219,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:727d8fe9b0cce68e4808cc3b31b6cf95876a96bad4b5afc8fd441c669d71a1b1"
+      "auditDigest": "sha256:09d9eaeb13eaa8468b261e7de085d3025f0a1b8b53472292073e02fca182433d"
     },
     {
       "contractVersion": 1,
@@ -372,7 +372,7 @@
         "identity, compliance, Product System metadata, package metadata, registry history, scans, and generation grant no authority"
       ],
       "breakingDigest": "sha256:0bcba689ab5060e12230db4118895242ecb48677ff581ea0360b1833bdac558c",
-      "auditDigest": "sha256:e7e67b9d7bf9cee6103d3cf65686fa428f1d364109c95342cd20c4801a646e02"
+      "auditDigest": "sha256:da366842e8943c88a4f12520faf2d19c555b7530d8f6d44cf75a37b94200960d"
     },
     {
       "contractVersion": 1,
@@ -670,7 +670,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:9f5a8549d5d7cb42af5720a05ad3d64b6b06f6415013d62e93fcf7d404978495"
+      "auditDigest": "sha256:327d268736cb8d474ad0a5e43d14c62575ed95a3dbc9651f3b31a5e176f8775e"
     },
     {
       "contractVersion": 1,
@@ -760,7 +760,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:b0f8aab2e5f92242e5538ea75733113249e61f2e4eec22812267712007be4c15"
+      "auditDigest": "sha256:565f31c93c6f5dacd0d027832e2a291da997dfc71cd9beaf394c8b3512257a45"
     },
     {
       "contractVersion": 1,
@@ -782,7 +782,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:2a9cedc7a6cceacb5a9864c97b87b825329ffe5115bb580c90b3e2127f813ad1"
+      "auditDigest": "sha256:4ff63adedbf139619bcdf840b76c6380f9714a5b120598f5a43b38beb16a111f"
     },
     {
       "contractVersion": 1,
@@ -833,7 +833,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -1010,12 +1010,13 @@
         "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
+        "verify-substage-evidence-path",
         "working-directory"
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:ba530907e57984abd47974cf3a9bab124f04629563676a4e37cfa302549789d6",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "digest": "sha256:9c0aacca910cef4619a797898ff5c24027c1583f84431a93a5efc854925326e7",
+        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1389,6 +1390,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "verify-substage-evidence-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "working-directory": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1406,7 +1411,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
-      "auditDigest": "sha256:ca0c1a541903015852be934f01d68c248c438a7ae2ac4727fd7fce3b861d9997"
+      "auditDigest": "sha256:ee92538b49ee91606c21f54f2ae1e5165228ff4dc7c64d8b8a6e073b8e033365"
     },
     {
       "contractVersion": 1,
@@ -1540,12 +1545,13 @@
         "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
+        "verify-substage-evidence-path",
         "working-directory"
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:0e0888527d7319a7603620520cdd76eb3e4434f80dbc92fffa0eb0d90f88b3e4",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "digest": "sha256:48545554883888862984cdf1b6b4b56341531cdd6192600782a76b92ad22fd36",
+        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1931,6 +1937,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "verify-substage-evidence-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "working-directory": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1944,7 +1954,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:e67bec5b6e49f69a79f652ea7d7452d0dbd1a59f53ab1e9603e929ecf1a305f4"
+      "auditDigest": "sha256:af415d283c9f7706d93c2c3df0b330c59487097364aa2ebc6e139a7275bcb635"
     },
     {
       "contractVersion": 1,
@@ -2014,7 +2024,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2145,7 +2155,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:5f1868478b7ccd9fb79aea76bc771289d2ca6bd2dccd1abf57575426f1eae5fb",
-      "auditDigest": "sha256:81ecbba803625efc00fba9aadd98c0baa3f6477a105db29f1db366853a464028"
+      "auditDigest": "sha256:9c22dc647886a67250485185810978775f4eaa2efdbfdc4f959b918e3ec1e312"
     },
     {
       "contractVersion": 1,
@@ -2231,7 +2241,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2475,7 +2485,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2657,7 +2667,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2918,6 +2928,7 @@
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
+        "publication-gate-command",
         "publication-package-name",
         "publication-product",
         "publication-publisher-workflow-path",
@@ -2941,6 +2952,7 @@
         "release-candidate-family-evidence-required",
         "release-candidate-family-evidence-root",
         "release-candidate-family-initiative-id",
+        "release-candidate-wait-seconds",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
@@ -2973,8 +2985,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:220710d81a41b50edb4dc65cea3e1e5d20805406eaaced65bc006718700696b9",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "digest": "sha256:a13b820669b162ab2f39d213164e7b7ab4e24c65f93cd3265a977fcd667c1303",
+        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3188,6 +3200,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "publication-gate-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "publication-package-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -3280,6 +3296,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "release-candidate-wait-seconds": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "release-candidate-workflow-file": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -3405,7 +3425,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:727d8fe9b0cce68e4808cc3b31b6cf95876a96bad4b5afc8fd441c669d71a1b1"
+      "auditDigest": "sha256:09d9eaeb13eaa8468b261e7de085d3025f0a1b8b53472292073e02fca182433d"
     },
     {
       "contractVersion": 1,
@@ -3470,7 +3490,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
         "inputClassifications": {
           "agent-work-context-json": {
             "classification": "digest-only",
@@ -3605,7 +3625,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:e7d02924b5f42f513e6f6a3b2cdbccdcd92b594b63ebc7aa8dd8cd3d8376283e",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3619,5 +3639,5 @@
     }
   ],
   "compatibilityDigest": "sha256:76c3dd58a02887ecd6af33d63e749fef0a988a820fea99bdf4cb078cc48caa83",
-  "contractDigest": "sha256:a431132a3c7e5ce0c45f16c42d5b9e3e0670a76fa74c9aa78e39a063f51b104f"
+  "contractDigest": "sha256:eae7908098d9561b5a149f8b79e9e4ed484db7f205ee6864b0b70db17edccbe8"
 }