@kungfu-tech/buildchain 3.0.6-alpha.1 → 3.0.6-alpha.3

package/README.md

@@ -3,7 +3,7 @@
 <!-- buildchain-auditable-demo:start -->
 ## Buildchain beginner bootstrap
 
-[![Buildchain beginner bootstrap](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.gif)](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/public-evidence.json)
+[![Buildchain beginner bootstrap](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/demo.gif)](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/public-evidence.json)
 
 Animation scenario:
 
@@ -13,16 +13,16 @@ $ buildchain layout --cwd ./starter --json
 $ buildchain version
 ```
 
-Native renditions: [1080p MP4](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.mp4) · [1080p WebM](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo.webm) · [720p MP4](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo-720p.mp4) · [720p WebM](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/demo-720p.webm)
+Native renditions: [1080p MP4](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/demo.mp4) · [1080p WebM](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/demo.webm) · [720p MP4](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/demo-720p.mp4) · [720p WebM](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/demo-720p.webm)
 
-[Static poster / reduced-motion fallback](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/poster.png)
+[Static poster / reduced-motion fallback](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/poster.png)
 
 <details>
 <summary>Evidence and claim boundary</summary>
 
 This exact standalone-binary scenario proves deterministic local bootstrap behavior only; it does not grant release, repository, network, or production authority.
 
-[Release Passport](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/release-passport.json) · [auditable evidence](docs/evidence/auditable-demo/f0413dc57e2b658fb75e82c4b7736ef87f4a573f6d6cbc1d690b52b723006492/beginner-bootstrap/public-evidence.json)
+[Release Passport](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/release-passport.json) · [auditable evidence](docs/evidence/auditable-demo/aa5cc40f4a62ed516e163e7e2c9dae0bcf32b3c77143a17105dfc4e5eaf9f01a/beginner-bootstrap/public-evidence.json)
 
 </details>
 <!-- buildchain-auditable-demo:end -->

package/actions/promote-buildchain-ref/README.md

@@ -80,6 +80,14 @@ publish npm packages. The GitHub action dry-run still calls GitHub APIs to
 resolve the current target SHA and concrete pending ref updates, but every
 write is reported as a dry-run update.
 
+When the requested version already matches every declared version-state file,
+dry-run planning still runs `lifecycle.version-state` and any explicit
+`verification-command` so it can discover declared derived material. It does
+not fall back to the repository-wide `lifecycle.verify` in that no-op case;
+full product verification can require candidate artifacts that are deliberately
+not present until the later admission phase. Non-dry-run version-state writes
+continue to require the configured verification lifecycle before any ref moves.
+
 Repositories whose package version is anchored to an explicitly selected
 upstream release can opt into manual next-anchor behavior:
 

package/bin/buildchain.mjs

@@ -1368,8 +1368,20 @@ async function handleDoctorCommand(args) {
 
 async function handleDevCommand(args) {
     const [subcommand = "", ...devArgs] = args;
+    if (subcommand === "pr-admit") {
+      runScript("dev-pr-auto-merge.mjs", devArgs);
+      return;
+    }
+    if (subcommand === "warrant") {
+      runScript("dev-delivery-warrant.mjs", devArgs);
+      return;
+    }
+    if (subcommand === "proof") {
+      runScript("dev-delivery-proof.mjs", devArgs);
+      return;
+    }
     if (subcommand !== "merge-queue") {
-      throw new Error("usage: buildchain dev merge-queue --repository <owner/repo> --branch <dev/vN/vN.M> [--from-config | --workflow <path>...]");
+      throw new Error("usage: buildchain dev <pr-admit|merge-queue|warrant|proof> [options]");
     }
     runScript("dev-merge-queue.mjs", devArgs);
     return;

package/contracts/auditable-demo-scenario-v1.schema.json

@@ -7,6 +7,22 @@
   "required": ["schema", "product", "artifact", "execution", "renditions", "demos", "publication", "authority"],
   "properties": {
     "schema": {"const": "buildchain.declarative-binary-demo/v1"},
+    "compositionMode": {
+      "type": "string",
+      "enum": ["presentation-framed", "terminal-fill"],
+      "default": "presentation-framed"
+    },
+    "playback": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "mode", "activeDurationMs", "finalHoldMs"],
+      "properties": {
+        "schema": {"const": "buildchain.declarative-demo-playback/v1"},
+        "mode": {"const": "deterministic-readable"},
+        "activeDurationMs": {"type": "integer", "minimum": 1000, "maximum": 179750},
+        "finalHoldMs": {"type": "integer", "minimum": 250, "maximum": 5000}
+      }
+    },
     "product": {
       "type": "object",
       "additionalProperties": false,
@@ -57,6 +73,42 @@
         "stdoutIncludes": {"type": "array", "maxItems": 32, "items": {"type": "string", "minLength": 1, "maxLength": 256}}
       }
     },
+    "presentation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "proofs", "materialization"],
+      "properties": {
+        "schema": {"const": "buildchain.declarative-demo-presentation/v1"},
+        "proofs": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["demoId", "label", "question", "summary"],
+            "properties": {
+              "demoId": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"},
+              "label": {"type": "string", "minLength": 1, "maxLength": 80},
+              "question": {"type": "string", "minLength": 1, "maxLength": 120},
+              "summary": {"type": "string", "minLength": 1, "maxLength": 500},
+              "transitionAfter": {"type": "string", "minLength": 1, "maxLength": 500}
+            }
+          }
+        },
+        "materialization": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["readmeMode", "technicalSpecPath", "technicalSpecTitle", "technicalMarker"],
+          "properties": {
+            "readmeMode": {"type": "string", "enum": ["full", "media-only"]},
+            "technicalSpecPath": {"type": "string", "minLength": 1},
+            "technicalSpecTitle": {"type": "string", "minLength": 1, "maxLength": 120},
+            "technicalMarker": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{0,79}$"}
+          }
+        }
+      }
+    },
     "renditions": {
       "const": [
         {"id": "1080p", "role": "primary", "columns": 150, "rows": 36, "width": 1920, "height": 1080},

package/contracts/release-candidate-recovery-v1.schema.json

@@ -0,0 +1,102 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.libkungfu.dev/schemas/release-candidate-recovery-v1.schema.json",
+  "title": "Buildchain Release Candidate Recovery Receipt v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "contract",
+    "action",
+    "createdAt",
+    "repository",
+    "recoveryRunId",
+    "originalCandidate",
+    "target",
+    "recovered",
+    "skippedBuildStages",
+    "payloadBytes",
+    "buildchainToolingSha",
+    "transaction",
+    "root"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "contract": { "const": "kungfu-buildchain-release-candidate-recovery/v1" },
+    "action": { "const": "reused" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "repository": { "type": "string", "pattern": "^[^/\\s]+/[^/\\s]+$" },
+    "recoveryRunId": { "type": "string" },
+    "originalCandidate": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["runId", "workflowFile", "workflowName", "pullRequest", "sourceSha", "mergeSha", "tree"],
+      "properties": {
+        "runId": { "type": "string", "pattern": "^[0-9]+$" },
+        "workflowFile": { "type": "string" },
+        "workflowName": { "type": "string" },
+        "pullRequest": { "type": "integer", "minimum": 1 },
+        "sourceSha": { "$ref": "#/$defs/gitSha" },
+        "mergeSha": { "type": "string", "pattern": "^(?:[0-9a-f]{40})?$" },
+        "tree": { "$ref": "#/$defs/gitSha" }
+      }
+    },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["channel", "ref", "sha", "tree"],
+      "properties": {
+        "channel": { "enum": ["alpha", "release", "major"] },
+        "ref": { "type": "string" },
+        "sha": { "$ref": "#/$defs/gitSha" },
+        "tree": { "$ref": "#/$defs/gitSha" }
+      }
+    },
+    "recovered": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["candidateRoot", "buildSummaryRoot", "artifactRoot", "artifactArchiveRoot", "artifactCount", "artifacts"],
+      "properties": {
+        "candidateRoot": { "$ref": "#/$defs/sha256" },
+        "buildSummaryRoot": { "$ref": "#/$defs/sha256" },
+        "artifactRoot": { "$ref": "#/$defs/sha256" },
+        "artifactArchiveRoot": { "$ref": "#/$defs/sha256" },
+        "artifactCount": { "type": "integer", "minimum": 1 },
+        "artifacts": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name", "size", "digest"],
+            "properties": {
+              "name": { "type": "string", "minLength": 1 },
+              "size": { "type": "integer", "minimum": 0 },
+              "digest": { "$ref": "#/$defs/sha256" }
+            }
+          }
+        }
+      }
+    },
+    "skippedBuildStages": {
+      "const": ["install", "build", "verify", "platform-matrix"]
+    },
+    "payloadBytes": { "const": "unchanged" },
+    "buildchainToolingSha": { "$ref": "#/$defs/gitSha" },
+    "transaction": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["identity", "state", "publicationState"],
+      "properties": {
+        "identity": { "type": "string" },
+        "state": { "enum": ["absent", "prepared", "sealed", "publishing", "publish_failed", "published", "finalizing", "complete", "repair_required", "abandoned", "failed_permanently"] },
+        "publicationState": { "type": "string", "minLength": 1 }
+      }
+    },
+    "root": { "$ref": "#/$defs/sha256" }
+  },
+  "$defs": {
+    "gitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "sha256": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
+  }
+}

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.1",
+    "version": "3.0.6-alpha.3",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -52,7 +52,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa",
-      "auditDigest": "sha256:0c8c6f781e8c2490f10d70def2c16e753298c15d05e6ead916e67d2714cd5583"
+      "auditDigest": "sha256:ee92538b49ee91606c21f54f2ae1e5165228ff4dc7c64d8b8a6e073b8e033365"
     },
     {
       "contractVersion": 1,
@@ -91,7 +91,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:e67bec5b6e49f69a79f652ea7d7452d0dbd1a59f53ab1e9603e929ecf1a305f4"
+      "auditDigest": "sha256:af415d283c9f7706d93c2c3df0b330c59487097364aa2ebc6e139a7275bcb635"
     },
     {
       "contractVersion": 1,
@@ -107,7 +107,8 @@
       "requiredOutputs": [
         "promoted-sha",
         "built-source-sha",
-        "release-candidate-artifact"
+        "release-candidate-artifact",
+        "release-candidate-action"
       ],
       "breakingDefaults": {
         "channelDefault": "auto",
@@ -123,6 +124,15 @@
         "buildchain-stable-contract-lock-path",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-expected-source-tree",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-buildchain-runtime-sha",
+        "resume-transaction-id",
         "publish-required-artifacts-json",
         "release-passport-kfd-1-witness-jsons",
         "release-passport-kfd-2-claim-jsons",
@@ -171,13 +181,19 @@
         "train and exact-SHA runtime overrides remain limited to trusted workflow_dispatch actors",
         "promotion reuses PR-stage release-candidate artifacts",
         "promotion does not run the heavy native build matrix",
+        "a fresh workflow event can recover an exact successful candidate run after startup or router failure",
+        "recovery validates repository, workflow, PR, ancestry, tree, candidate roots, controller evidence, manifests, archive digests, and payload bytes before mutation",
+        "recovery emits action reused and never silently falls back to a full build",
         "built source and promotion channel SHA are recorded separately",
         "contract drift is checked before release-candidate resolution and publish",
         "publish-gate source locks are created by the wrapper and enforced by promote-buildchain-ref before publish side effects",
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
-      "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
-      "auditDigest": "sha256:45f72dc26b1620b0f79558922b44449bda28b25ebc051a737137b5b01c220995"
+      "compatibleBreakingDigests": [
+        "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf"
+      ],
+      "breakingDigest": "sha256:e60642aa298933d2c103284794921a6c340a50aa91ee528b06e58892a2a006bf",
+      "auditDigest": "sha256:952ff4870c1e682ea62141b0c848c33825767212111ef26110617dbdaeacac5b"
     },
     {
       "contractVersion": 1,
@@ -193,7 +209,8 @@
       "requiredOutputs": [
         "promoted-sha",
         "built-source-sha",
-        "release-candidate-artifact"
+        "release-candidate-artifact",
+        "release-candidate-action"
       ],
       "breakingDefaults": {
         "promoteOnlyReleaseCandidate": true,
@@ -212,14 +229,27 @@
         "promotion-contract-lock-digest",
         "promotion-publication-channel",
         "promotion-target-ref",
-        "promotion-override-used"
+        "promotion-override-used",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-expected-source-tree",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-buildchain-runtime-sha",
+        "resume-transaction-id"
       ],
       "guarantees": [
         "advanced promotion verifies routed shell, runtime, lock, publication channel, and target bindings before candidate resolution",
-        "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
+        "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix",
+        "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph"
+      ],
+      "compatibleBreakingDigests": [
+        "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
       ],
-      "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:727d8fe9b0cce68e4808cc3b31b6cf95876a96bad4b5afc8fd441c669d71a1b1"
+      "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
+      "auditDigest": "sha256:2bc947b42da3c5b06cf75c498658c76d58b0205e7ad408011c3d1ecb4ecfa415"
     },
     {
       "contractVersion": 1,
@@ -372,7 +402,7 @@
         "identity, compliance, Product System metadata, package metadata, registry history, scans, and generation grant no authority"
       ],
       "breakingDigest": "sha256:0bcba689ab5060e12230db4118895242ecb48677ff581ea0360b1833bdac558c",
-      "auditDigest": "sha256:e7e67b9d7bf9cee6103d3cf65686fa428f1d364109c95342cd20c4801a646e02"
+      "auditDigest": "sha256:da366842e8943c88a4f12520faf2d19c555b7530d8f6d44cf75a37b94200960d"
     },
     {
       "contractVersion": 1,
@@ -670,7 +700,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:9f5a8549d5d7cb42af5720a05ad3d64b6b06f6415013d62e93fcf7d404978495"
+      "auditDigest": "sha256:327d268736cb8d474ad0a5e43d14c62575ed95a3dbc9651f3b31a5e176f8775e"
     },
     {
       "contractVersion": 1,
@@ -760,7 +790,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:5024e0362ee5b652967984cc49232bac6f2d882972f7c6acccdf8bf2e665ff39"
+      "auditDigest": "sha256:583fd7b1f584669efe06d6148d0bfe40d6c00dfefd98fd7b6737373f75adedce"
     },
     {
       "contractVersion": 1,
@@ -782,7 +812,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:2a9cedc7a6cceacb5a9864c97b87b825329ffe5115bb580c90b3e2127f813ad1"
+      "auditDigest": "sha256:b8d7bf9d0cb43c55924b93bb20bf3b500f98c6b1f486f10c174cc8420783b4f6"
     },
     {
       "contractVersion": 1,
@@ -833,7 +863,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -1010,12 +1040,13 @@
         "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
+        "verify-substage-evidence-path",
         "working-directory"
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:ba530907e57984abd47974cf3a9bab124f04629563676a4e37cfa302549789d6",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "digest": "sha256:9c0aacca910cef4619a797898ff5c24027c1583f84431a93a5efc854925326e7",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1389,6 +1420,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "verify-substage-evidence-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "working-directory": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1406,7 +1441,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
-      "auditDigest": "sha256:0c8c6f781e8c2490f10d70def2c16e753298c15d05e6ead916e67d2714cd5583"
+      "auditDigest": "sha256:ee92538b49ee91606c21f54f2ae1e5165228ff4dc7c64d8b8a6e073b8e033365"
     },
     {
       "contractVersion": 1,
@@ -1540,12 +1575,13 @@
         "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
+        "verify-substage-evidence-path",
         "working-directory"
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:0e0888527d7319a7603620520cdd76eb3e4434f80dbc92fffa0eb0d90f88b3e4",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "digest": "sha256:48545554883888862984cdf1b6b4b56341531cdd6192600782a76b92ad22fd36",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1931,6 +1967,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "verify-substage-evidence-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "working-directory": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1944,7 +1984,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:e67bec5b6e49f69a79f652ea7d7452d0dbd1a59f53ab1e9603e929ecf1a305f4"
+      "auditDigest": "sha256:af415d283c9f7706d93c2c3df0b330c59487097364aa2ebc6e139a7275bcb635"
     },
     {
       "contractVersion": 1,
@@ -2014,7 +2054,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2145,7 +2185,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:5f1868478b7ccd9fb79aea76bc771289d2ca6bd2dccd1abf57575426f1eae5fb",
-      "auditDigest": "sha256:81ecbba803625efc00fba9aadd98c0baa3f6477a105db29f1db366853a464028"
+      "auditDigest": "sha256:9c22dc647886a67250485185810978775f4eaa2efdbfdc4f959b918e3ec1e312"
     },
     {
       "contractVersion": 1,
@@ -2231,7 +2271,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2475,7 +2515,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2657,7 +2697,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2918,6 +2958,7 @@
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
+        "publication-gate-command",
         "publication-package-name",
         "publication-product",
         "publication-publisher-workflow-path",
@@ -2941,6 +2982,7 @@
         "release-candidate-family-evidence-required",
         "release-candidate-family-evidence-root",
         "release-candidate-family-initiative-id",
+        "release-candidate-wait-seconds",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
@@ -2965,6 +3007,15 @@
         "release-propagation-config-path",
         "required-artifact-count",
         "required-status-check",
+        "resume-buildchain-runtime-sha",
+        "resume-candidate-repository",
+        "resume-candidate-run-id",
+        "resume-expected-candidate-root",
+        "resume-expected-candidate-runtime-sha",
+        "resume-expected-source-tree",
+        "resume-expected-workflow-file",
+        "resume-expected-workflow-name",
+        "resume-transaction-id",
         "runner-preset",
         "standalone-binary-distribution",
         "target-ref",
@@ -2973,8 +3024,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:220710d81a41b50edb4dc65cea3e1e5d20805406eaaced65bc006718700696b9",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "digest": "sha256:bc03b3ac295e33b738fe5168e14ebf4d0fabf2325b4ae4a3d2b3c12afe816068",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3188,6 +3239,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "publication-gate-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "publication-package-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -3280,6 +3335,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "release-candidate-wait-seconds": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "release-candidate-workflow-file": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -3376,6 +3435,42 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "resume-buildchain-runtime-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-candidate-repository": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-candidate-run-id": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-candidate-root": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-candidate-runtime-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-source-tree": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-workflow-file": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-expected-workflow-name": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "resume-transaction-id": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "runner-preset": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -3405,7 +3500,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:727d8fe9b0cce68e4808cc3b31b6cf95876a96bad4b5afc8fd441c669d71a1b1"
+      "auditDigest": "sha256:2bc947b42da3c5b06cf75c498658c76d58b0205e7ad408011c3d1ecb4ecfa415"
     },
     {
       "contractVersion": 1,
@@ -3470,7 +3565,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {
           "agent-work-context-json": {
             "classification": "digest-only",
@@ -3605,7 +3700,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:bbe99942ee5b4f333470525bf9ae7c4c9c66875ab384ba6a05700dac139bf5b1",
+        "registryDigest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3618,6 +3713,6 @@
       "auditDigest": "sha256:d07482cd66413a2fb3781a3b76f960b8151b6231841799647fe237820de2fde6"
     }
   ],
-  "compatibilityDigest": "sha256:76c3dd58a02887ecd6af33d63e749fef0a988a820fea99bdf4cb078cc48caa83",
-  "contractDigest": "sha256:3e34234237c55bc2908fca99e06598888cc2804a150d42c9551e428265c58a8f"
+  "compatibilityDigest": "sha256:80cfdf1786019217c439810f1a80d2866bf8f7ef35a6fa569e1a687fb2bf4cbe",
+  "contractDigest": "sha256:6a5dbfb2beaa4600c0979e33a8e756230f20c690ca63a873314eb496dd9ee9db"
 }