@kungfu-tech/buildchain 3.0.6 → 3.0.7-alpha.0

package/contracts/release-tail-capabilities-v1.schema.json

@@ -0,0 +1,199 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.kungfu.ai/contracts/release-tail-capabilities-v1.schema.json",
+  "title": "Buildchain release-tail capability declaration",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "contract",
+    "schemaVersion",
+    "transactionPolicy",
+    "subject",
+    "capabilities"
+  ],
+  "properties": {
+    "contract": {
+      "const": "kungfu-buildchain-release-tail-capabilities"
+    },
+    "schemaVersion": {
+      "const": 1
+    },
+    "transactionPolicy": {
+      "const": "buildchain.release-tail/v1"
+    },
+    "subject": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "sourceSha", "version", "tag", "channel"],
+      "properties": {
+        "repository": { "type": "string", "minLength": 1 },
+        "sourceSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+        "version": { "type": "string", "minLength": 1 },
+        "tag": { "type": "string", "minLength": 1 },
+        "channel": { "enum": ["alpha", "release", "stable"] }
+      }
+    },
+    "capabilities": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/capability" }
+    }
+  },
+  "$defs": {
+    "root": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "capability": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "executor",
+        "adapter",
+        "artifactRoles",
+        "destination",
+        "channelPolicy",
+        "activationPolicy",
+        "readbackPredicates",
+        "effect",
+        "observation",
+        "receipt",
+        "operationIdentity",
+        "idempotency",
+        "retry",
+        "evidenceRequirements"
+      ],
+      "properties": {
+        "id": {
+          "enum": [
+            "artifact.publish",
+            "signed-channel.commit",
+            "release.activate",
+            "released-evidence.synthesize"
+          ]
+        },
+        "executor": { "enum": ["buildchain-core", "provider-adapter"] },
+        "adapter": { "type": "string", "minLength": 1 },
+        "artifactRoles": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["role", "root"],
+            "properties": {
+              "role": { "type": "string", "minLength": 1 },
+              "root": { "$ref": "#/$defs/root" }
+            }
+          }
+        },
+        "destination": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "locator"],
+          "properties": {
+            "kind": { "type": "string", "minLength": 1 },
+            "locator": { "type": "string", "minLength": 1 }
+          }
+        },
+        "channelPolicy": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["channel", "tagPattern", "authorityMove"],
+          "properties": {
+            "channel": { "enum": ["alpha", "release", "stable"] },
+            "tagPattern": { "type": "string", "minLength": 1 },
+            "authorityMove": { "enum": ["none", "signed-cas", "verified-ref"] }
+          }
+        },
+        "activationPolicy": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["mode", "environment"],
+          "properties": {
+            "mode": { "enum": ["none", "receipt-set", "receipt-only"] },
+            "environment": { "enum": ["none", "shadow", "production"] }
+          }
+        },
+        "readbackPredicates": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["id", "kind", "expected"],
+            "properties": {
+              "id": { "type": "string", "minLength": 1 },
+              "kind": { "type": "string", "minLength": 1 },
+              "expected": { "type": "string", "minLength": 1 }
+            }
+          }
+        },
+        "effect": { "$ref": "#/$defs/message" },
+        "observation": { "$ref": "#/$defs/message" },
+        "receipt": { "$ref": "#/$defs/message" },
+        "operationIdentity": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "transactionRoot",
+            "capabilityId",
+            "subjectRoot",
+            "targetRoot",
+            "attemptKey"
+          ],
+          "properties": {
+            "transactionRoot": { "$ref": "#/$defs/root" },
+            "capabilityId": {
+              "enum": [
+                "artifact.publish",
+                "signed-channel.commit",
+                "release.activate",
+                "released-evidence.synthesize"
+              ]
+            },
+            "subjectRoot": { "$ref": "#/$defs/root" },
+            "targetRoot": { "$ref": "#/$defs/root" },
+            "attemptKey": { "type": "string", "minLength": 1 }
+          }
+        },
+        "idempotency": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["scope", "duplicate"],
+          "properties": {
+            "scope": { "enum": ["operation", "subject-target"] },
+            "duplicate": {
+              "enum": ["return-observed-receipt", "readback-before-retry"]
+            }
+          }
+        },
+        "retry": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["class", "localAttempts", "exhausted"],
+          "properties": {
+            "class": { "enum": ["never", "readback", "provider-transient"] },
+            "localAttempts": { "type": "integer", "minimum": 0, "maximum": 3 },
+            "exhausted": {
+              "enum": ["blocked", "repair-required", "terminal-failure"]
+            }
+          }
+        },
+        "evidenceRequirements": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "message": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "schema"],
+      "properties": {
+        "kind": { "type": "string", "minLength": 1 },
+        "schema": { "type": "string", "minLength": 1 }
+      }
+    }
+  }
+}

package/contracts/release-tail-provider-bindings-v1.schema.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.kungfu.ai/contracts/release-tail-provider-bindings-v1.schema.json",
+  "title": "Buildchain release-tail provider bindings",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "artifacts", "documents", "evidence"],
+  "properties": {
+    "schema": {
+      "const": "kungfu.buildchain.release-tail.provider-bindings/v1"
+    },
+    "artifacts": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "name"],
+        "properties": {
+          "path": { "type": "string", "minLength": 1 },
+          "name": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "documents": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "signed-channel.commit": { "$ref": "#/$defs/document" },
+        "release.activate": { "$ref": "#/$defs/document" }
+      }
+    },
+    "evidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["inputs", "output"],
+      "properties": {
+        "inputs": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "output": { "type": "string", "minLength": 1 }
+      }
+    }
+  },
+  "$defs": {
+    "document": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "method"],
+      "properties": {
+        "path": { "type": "string", "minLength": 1 },
+        "method": { "enum": ["PUT", "POST"] }
+      }
+    }
+  }
+}

package/dist/site/agent-index.json

@@ -17,6 +17,9 @@
     "artifact-schemas.json",
     "release-passport-check-manifest.json",
     "schemas/release-passport-v1.schema.json",
+    "schemas/publication-rehearsal-capsule-v1.schema.json",
+    "schemas/release-tail-capabilities-v1.schema.json",
+    "schemas/release-tail-provider-bindings-v1.schema.json",
     "schemas/kfd-agent-hub-adoption.schema.json",
     "schemas/kfd-product-gate-input-v1.schema.json",
     "schemas/kfd-support-projection-v1.schema.json",

package/dist/site/artifact-schemas.json

@@ -5,6 +5,9 @@
     "buildchain.release.json",
     "release-passport-check-manifest.json",
     "schemas/release-passport-v1.schema.json",
+    "schemas/publication-rehearsal-capsule-v1.schema.json",
+    "schemas/release-tail-capabilities-v1.schema.json",
+    "schemas/release-tail-provider-bindings-v1.schema.json",
     "schemas/kfd-agent-hub-adoption.schema.json",
     "schemas/kfd-product-gate-input-v1.schema.json",
     "schemas/kfd-support-projection-v1.schema.json",
@@ -40,6 +43,9 @@
     "artifact-schemas.json",
     "release-passport-check-manifest.json",
     "schemas/release-passport-v1.schema.json",
+    "schemas/publication-rehearsal-capsule-v1.schema.json",
+    "schemas/release-tail-capabilities-v1.schema.json",
+    "schemas/release-tail-provider-bindings-v1.schema.json",
     "schemas/kfd-agent-hub-adoption.schema.json",
     "schemas/kfd-product-gate-input-v1.schema.json",
     "schemas/kfd-support-projection-v1.schema.json",

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.6",
+    "version": "3.0.7-alpha.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -193,7 +193,7 @@
         "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf"
       ],
       "breakingDigest": "sha256:e60642aa298933d2c103284794921a6c340a50aa91ee528b06e58892a2a006bf",
-      "auditDigest": "sha256:72f3222d7a603ede6e26caf30dfeee3545b62454d0c99e369ab5717db5468e7d"
+      "auditDigest": "sha256:4ed6cce4c1a90f179bf9ba3bff4b08093dd80f11e7e271fcb6f1bd80b3cecdb8"
     },
     {
       "contractVersion": 1,
@@ -249,7 +249,7 @@
         "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
       ],
       "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
-      "auditDigest": "sha256:c0b8f67226c571ea3d75416e71890f47f8b43e780ec093173df48cf26052c414"
+      "auditDigest": "sha256:0ec19f4776537254017dbc30e35dbc10dc3fdf3c3c747d3c18beb0389fc9db7f"
     },
     {
       "contractVersion": 1,
@@ -476,7 +476,7 @@
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
       ],
       "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
-      "auditDigest": "sha256:aa8231b2ba3574663f4a03882fdccecd792e04979bd9a52adac6b558c8a10081"
+      "auditDigest": "sha256:7b1fa951846a7386261e1c52d1191b17421a0dd5a60edee675926dfa9c085126"
     },
     {
       "contractVersion": 1,
@@ -700,7 +700,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:327d268736cb8d474ad0a5e43d14c62575ed95a3dbc9651f3b31a5e176f8775e"
+      "auditDigest": "sha256:e4d2246720efbd74c0cca5adb59160568ba55e41a04b9d752a52edec28ca39be"
     },
     {
       "contractVersion": 1,
@@ -790,7 +790,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:7d5d9ac8317397aec3593bd446ebc053ab47af448f441216f011ae303e5ba2ee"
+      "auditDigest": "sha256:441c5107570d729a6ec95d76a288a69d6119455baf44cfed48cae62625ca19c6"
     },
     {
       "contractVersion": 1,
@@ -812,7 +812,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:75313c5cc605d977c8f3272a55d43d6adc8c641b61c713ed5b9e3772a5e70572"
+      "auditDigest": "sha256:a68025579bc0cb1e1bbd2db13bfddd9926891ba5eb6f981cc254a4af604cc869"
     },
     {
       "contractVersion": 1,
@@ -863,7 +863,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
+        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -1046,7 +1046,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:9c0aacca910cef4619a797898ff5c24027c1583f84431a93a5efc854925326e7",
-        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
+        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1581,7 +1581,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:48545554883888862984cdf1b6b4b56341531cdd6192600782a76b92ad22fd36",
-        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
+        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -2054,7 +2054,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
+        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2271,7 +2271,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
+        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2515,7 +2515,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
+        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2697,7 +2697,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
+        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2927,6 +2927,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "channel",
+        "declarative-release-tail",
         "dry-run",
         "github-artifact-attestation-environment",
         "github-artifact-attestation-policy-json",
@@ -2949,12 +2950,14 @@
         "promotion-shell-sha",
         "promotion-target-ref",
         "publication-admission-json",
+        "publication-authority-workflow-path",
         "publication-auto-admission",
         "publication-auto-no-gate",
         "publication-commit-command",
         "publication-commit-evidence-path",
         "publication-consumer-predicate-id",
         "publication-consumer-qualification-command",
+        "publication-consumer-qualification-controller-sha",
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
@@ -3025,8 +3028,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:bb49305be1f2176c47920532d414954e1d058156abf3411ae66cc97ba526d186",
-        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
+        "digest": "sha256:83bc2f7d57ad3500e0b2983314aa5fdaa0dff1f78ef011af94cde760b86a010f",
+        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3116,6 +3119,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "declarative-release-tail": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "dry-run": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -3204,6 +3211,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "publication-authority-workflow-path": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "publication-auto-admission": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -3228,6 +3239,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "publication-consumer-qualification-controller-sha": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "publication-control-plane-audit-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -3505,7 +3520,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:c0b8f67226c571ea3d75416e71890f47f8b43e780ec093173df48cf26052c414"
+      "auditDigest": "sha256:0ec19f4776537254017dbc30e35dbc10dc3fdf3c3c747d3c18beb0389fc9db7f"
     },
     {
       "contractVersion": 1,
@@ -3570,7 +3585,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12",
-        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
+        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
         "inputClassifications": {
           "agent-work-context-json": {
             "classification": "digest-only",
@@ -3705,7 +3720,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c",
+        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3719,5 +3734,5 @@
     }
   ],
   "compatibilityDigest": "sha256:80cfdf1786019217c439810f1a80d2866bf8f7ef35a6fa569e1a687fb2bf4cbe",
-  "contractDigest": "sha256:900b03120a2ae9b7e7e67fdb854039849339f96bd6285a13c2ced30b9b02f2c0"
+  "contractDigest": "sha256:15d9f6feaa7f774b7223943de4326285d4a02db459e8ddda4a20418552e65d96"
 }