@kungfu-tech/buildchain 3.0.6 → 3.0.7-alpha.1

package/README.md

@@ -278,13 +278,14 @@ plus fail-closed product-evidence gates for KFD-4, KFD-5, and KFD-7. These
 gates preserve product-owned qualification and support decisions; they do not
 turn a schema-valid record into certification or shipped support.
 
-Buildchain's action registry currently contains six active entries. Four are
+Buildchain's action registry currently contains seven active entries. Five are
 direct consumer integration actions:
 
 - `actions/validate-config`
 - `actions/run-lifecycle`
 - `actions/promote-buildchain-ref`
 - `actions/report-buildchain-issue`
+- `actions/release-tail`
 
 Two additional release-authority components are also registered and versioned:
 
@@ -292,7 +293,7 @@ Two additional release-authority components are also registered and versioned:
 - `actions/macos-credential-island`
 
 `dist/site/workflow-registry.json#actions` is the machine-readable inventory;
-this split keeps the older four-action consumer list from being mistaken for
+this split keeps the older four-action consumer snapshot from being mistaken for
 the complete current registry.
 
 The active reusable workflow surfaces are:
@@ -457,4 +458,5 @@ npm pack --dry-run --json --registry=https://registry.npmjs.org/
 - [Release candidate passport](docs/release-candidate.md)
 - [Consumer issue reporting](docs/consumer-issue-reporting.md)
 - [Publish transaction](docs/publish-transaction.md)
+- [Declarative release-tail contract](docs/release-tail-contract.md)
 - [Release governance](docs/release-governance.md)

package/actions/promote-buildchain-ref/README.md

@@ -328,6 +328,7 @@ BUILDCHAIN_SEALED_NPM_TARBALL
 BUILDCHAIN_SEALED_NPM_INTEGRITY
 BUILDCHAIN_SEALED_NPM_SHA256
 BUILDCHAIN_REQUIRED_ARTIFACTS
+BUILDCHAIN_PUBLISH_REQUIRED_ARTIFACTS_PATH
 ```
 
 `BUILDCHAIN_REQUIRED_ARTIFACTS` is the normalized requirement array after the
@@ -337,6 +338,10 @@ declared provenance to the current release coordinate. Template expansion
 happens after exact version selection; ambiguous or unsupported templates fail
 before `lifecycle.publish`. Requirement descriptors may omit `digest`; final
 publish evidence may not.
+The action also writes that normalized array to
+`BUILDCHAIN_PUBLISH_REQUIRED_ARTIFACTS_PATH`. To stay below operating-system
+process environment limits, large arrays are available through the file path
+only; small arrays retain the inline variable for compatibility.
 
 The action outputs `transaction-id`, `transaction-state`,
 `transaction-publication-state`, `transaction-sealed-bundle-root`,
@@ -494,6 +499,11 @@ governance semantics:
 - alpha promotion must come from a merged same-repository PR
   `dev/vN/vN.M -> alpha/vN/vN.M`, or from a strict same-line
   `publish-gate/alpha/vN/vN.M/<version> -> alpha/vN/vN.M` source-lock PR;
+  an immutable recovery receipt may instead admit the exact current alpha
+  channel SHA only when its sealed candidate tree is byte-equivalent and its
+  publication version is bound by that receipt; when administrative protection
+  details are hidden, the provider-visible protected head and required check
+  must still match that exact recovered SHA;
 - release promotion must come from a merged same-repository PR
   `alpha/vN/vN.M -> release/vN/vN.M`, or from a strict same-line
   `publish-gate/release/vN/vN.M/<version> -> release/vN/vN.M` source-lock PR;

package/actions/release-tail/README.md

@@ -0,0 +1,17 @@
+# Declarative Release Tail
+
+This Action restores one content-addressed
+`kungfu.buildchain.publication-rehearsal-capsule/v1` and invokes the same public
+rehearsal runtime used by the local CLI. The capsule binds the versioned
+`buildchain.release-tail/v1` declaration, candidate files, policies, Passport,
+transaction, data-only provider bindings and observations. It does not accept
+a command, script, executable path, plugin, repository callback, implicit
+workspace or GitHub runner semantic input.
+
+Every mutation is preceded and followed by provider readback. Buildchain core,
+not the adapter, compares the observed subject and target roots, owns retry and
+terminal classification, checkpoints state and emits the standardized receipt.
+Tokens remain Action inputs and are never written to the transaction or
+receipt. The wrapper contributes only credentials, GitHub/HTTPS transport and
+real provider observations. The rooted provider transcript and rehearsal
+evidence are retained with the transaction state.

package/bin/buildchain.mjs

@@ -9,6 +9,7 @@ import { npmPublishDryRun } from "../scripts/npm-publish-dry-run.mjs";
 import { runLifecycle } from "../scripts/run-lifecycle-core.mjs";
 import { runReleasePropagationCli } from "../scripts/release-propagation.mjs";
 import { runReleaseGovernanceCli } from "../scripts/reconcile-release-governance.mjs";
+import { runReleaseTailCli } from "../scripts/release-tail.mjs";
 import { runPublicationArtifactCli } from "../scripts/publication-artifact.mjs";
 import { runPublicationPackageCli } from "../scripts/publication-package.mjs";
 import { runPublicationReproducibilityCli } from "../scripts/publication-reproducibility.mjs";
@@ -1646,6 +1647,10 @@ async function handleReleaseGovernanceCommand(args) {
 
 }
 
+async function handleReleaseTailCommand(args) {
+  await runReleaseTailCli(args);
+}
+
 async function handleGitHubGovernanceCommand(args) {
     runScript("reconcile-github-governance.mjs", args);
     return;
@@ -1706,6 +1711,10 @@ async function handlePublishSourceCommand(args) {
 
 }
 
+async function handleArchitectureCommand(args) {
+  runScript("v4-architecture.mjs", args);
+}
+
 const BUILDCHAIN_COMMAND_HANDLERS = Object.freeze({
   "help": handleHelpCommand,
   "version": handleVersionCommand,
@@ -1737,11 +1746,13 @@ const BUILDCHAIN_COMMAND_HANDLERS = Object.freeze({
   "paper": handlePaperCommand,
   "release-propagation": handleReleasePropagationCommand,
   "release-governance": handleReleaseGovernanceCommand,
+  "release-tail": handleReleaseTailCommand,
   "github-governance": handleGitHubGovernanceCommand,
   "badges": handleBadgesCommand,
   "homebrew": handleHomebrewCommand,
   "build-contract": handleBuildContractCommand,
   "publish-source": handlePublishSourceCommand,
+  "architecture": handleArchitectureCommand,
 });
 
 async function main(argv = process.argv.slice(2)) {

package/bin/internal/command-registry.mjs

@@ -32,11 +32,13 @@ const BUILDCHAIN_COMMAND_REGISTRY = Object.freeze([
   { id: "paper", aliases: [] },
   { id: "release-propagation", aliases: [] },
   { id: "release-governance", aliases: [] },
+  { id: "release-tail", aliases: [] },
   { id: "github-governance", aliases: [] },
   { id: "badges", aliases: [] },
   { id: "homebrew", aliases: [] },
   { id: "build-contract", aliases: [] },
   { id: "publish-source", aliases: [] },
+  { id: "architecture", aliases: [] },
 ]);
 
 function buildCommandLookup(registry = BUILDCHAIN_COMMAND_REGISTRY) {

package/contracts/auditable-demo-scenario-v1.schema.json

@@ -112,7 +112,7 @@
     "renditions": {
       "const": [
         {"id": "1080p", "role": "primary", "columns": 150, "rows": 36, "width": 1920, "height": 1080},
-        {"id": "720p", "role": "responsive", "columns": 100, "rows": 28, "width": 1280, "height": 720}
+        {"id": "720p", "role": "responsive", "columns": 150, "rows": 28, "width": 1280, "height": 720}
       ]
     },
     "demos": {

package/contracts/engineering-housekeeper-v1.schema.json

@@ -0,0 +1,143 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.kungfu.ai/contracts/engineering-housekeeper-v1.schema.json",
+  "title": "Buildchain Engineering Housekeeper contract",
+  "oneOf": [{ "$ref": "#/$defs/plan" }, { "$ref": "#/$defs/receipt" }],
+  "$defs": {
+    "root": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+    "oid": { "type": "string", "pattern": "^[0-9a-f]{40,64}$" },
+    "target": {
+      "type": "object",
+      "required": ["name", "headOid"],
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "headOid": { "$ref": "#/$defs/oid" }
+      },
+      "additionalProperties": false
+    },
+    "policy": {
+      "type": "object",
+      "required": ["protectedPatterns", "retainedPatterns", "pullRequests"],
+      "properties": {
+        "protectedPatterns": {
+          "type": "array",
+          "items": { "type": "string" },
+          "uniqueItems": true
+        },
+        "retainedPatterns": {
+          "type": "array",
+          "items": { "type": "string" },
+          "uniqueItems": true
+        },
+        "pullRequests": {
+          "type": "object",
+          "required": ["reportStale", "label", "autoClose"],
+          "properties": {
+            "reportStale": { "type": "boolean" },
+            "label": { "type": "string" },
+            "autoClose": { "const": false }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "inventory": {
+      "type": "object",
+      "required": ["kind", "repository", "headOid", "reasonCodes"],
+      "properties": {
+        "kind": { "enum": ["branch", "pull-request"] },
+        "repository": { "type": "string", "pattern": "^[^/]+/[^/]+$" },
+        "name": { "type": "string" },
+        "number": { "type": "integer", "minimum": 1 },
+        "headRepository": { "type": "string" },
+        "headRef": { "type": "string" },
+        "headOid": { "$ref": "#/$defs/oid" },
+        "target": { "$ref": "#/$defs/target" },
+        "eligible": { "type": "boolean" },
+        "decision": { "enum": ["delete", "retain"] },
+        "state": { "enum": ["open", "draft", "closed", "merged"] },
+        "actions": {
+          "type": "array",
+          "items": { "enum": ["report", "label"] },
+          "uniqueItems": true
+        },
+        "reasonCodes": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string" },
+          "uniqueItems": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "action": {
+      "type": "object",
+      "required": ["kind"],
+      "properties": {
+        "kind": {
+          "enum": ["delete-branch", "report-pull-request", "label-pull-request"]
+        },
+        "name": { "type": "string", "minLength": 1 },
+        "number": { "type": "integer", "minimum": 1 },
+        "expectedHeadOid": { "$ref": "#/$defs/oid" },
+        "targetName": { "type": "string", "minLength": 1 },
+        "expectedTargetHeadOid": { "$ref": "#/$defs/oid" }
+      },
+      "additionalProperties": false
+    },
+    "plan": {
+      "type": "object",
+      "required": [
+        "contract",
+        "schemaVersion",
+        "mode",
+        "repository",
+        "target",
+        "observedAt",
+        "policy",
+        "inventory",
+        "actions",
+        "planRoot"
+      ],
+      "properties": {
+        "contract": { "const": "kungfu-buildchain-engineering-housekeeper/v1" },
+        "schemaVersion": { "const": 1 },
+        "mode": { "const": "plan" },
+        "repository": { "type": "string", "pattern": "^[^/]+/[^/]+$" },
+        "target": { "$ref": "#/$defs/target" },
+        "observedAt": { "type": "string", "format": "date-time" },
+        "policy": { "$ref": "#/$defs/policy" },
+        "inventory": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/inventory" }
+        },
+        "actions": { "type": "array", "items": { "$ref": "#/$defs/action" } },
+        "planRoot": { "$ref": "#/$defs/root" }
+      },
+      "additionalProperties": false
+    },
+    "receipt": {
+      "type": "object",
+      "required": [
+        "contract",
+        "schemaVersion",
+        "mode",
+        "planRoot",
+        "appliedAt",
+        "outcomes",
+        "receiptRoot"
+      ],
+      "properties": {
+        "contract": { "const": "kungfu-buildchain-engineering-housekeeper/v1" },
+        "schemaVersion": { "const": 1 },
+        "mode": { "const": "receipt" },
+        "planRoot": { "$ref": "#/$defs/root" },
+        "appliedAt": { "type": "string", "format": "date-time" },
+        "outcomes": { "type": "array", "items": { "type": "object" } },
+        "receiptRoot": { "$ref": "#/$defs/root" }
+      },
+      "additionalProperties": false
+    }
+  }
+}

package/contracts/fixtures/engineering-housekeeper-v1/cases.json

@@ -0,0 +1,68 @@
+{
+  "contract": "kungfu-buildchain-engineering-housekeeper-fixtures/v1",
+  "cases": [
+    {
+      "id": "active",
+      "branch": {
+        "name": "feature/active",
+        "ancestry": "ancestor",
+        "openPullRequestNumbers": [11]
+      },
+      "eligible": false,
+      "reason": "branch.open-pr-head"
+    },
+    {
+      "id": "merged",
+      "branch": {
+        "name": "feature/merged",
+        "ancestry": "ancestor",
+        "openPullRequestNumbers": []
+      },
+      "eligible": true,
+      "reason": "eligible.merged-branch"
+    },
+    {
+      "id": "stale",
+      "branch": {
+        "name": "feature/stale",
+        "ancestry": "diverged",
+        "openPullRequestNumbers": []
+      },
+      "eligible": false,
+      "reason": "branch.not-merged"
+    },
+    {
+      "id": "advanced",
+      "revalidation": "head",
+      "reason": "branch.head-advanced"
+    },
+    { "id": "renamed", "revalidation": "name", "reason": "branch.renamed" },
+    {
+      "id": "protected",
+      "branch": {
+        "name": "dev/v3/v3.0",
+        "ancestry": "ancestor",
+        "openPullRequestNumbers": []
+      },
+      "eligible": false,
+      "reason": "branch.protected"
+    },
+    {
+      "id": "forked",
+      "branch": {
+        "name": "feature/forked",
+        "ancestry": "ancestor",
+        "openPullRequestNumbers": [],
+        "sourceRepository": "fork/buildchain"
+      },
+      "eligible": false,
+      "reason": "branch.cross-repository"
+    },
+    {
+      "id": "permission-denied",
+      "outcome": "denied",
+      "reason": "branch.permission-denied"
+    },
+    { "id": "repeated", "replay": true, "reason": "replay.already-applied" }
+  ]
+}

package/contracts/fixtures/release-tail-capabilities-v1/kungfu-alpha.json

@@ -0,0 +1,273 @@
+{
+  "contract": "kungfu-buildchain-release-tail-capabilities",
+  "schemaVersion": 1,
+  "transactionPolicy": "buildchain.release-tail/v1",
+  "subject": {
+    "repository": "kungfu-systems/kungfu",
+    "sourceSha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "version": "4.0.0-alpha.1",
+    "tag": "v4.0.0-alpha.1",
+    "channel": "alpha"
+  },
+  "capabilities": [
+    {
+      "id": "artifact.publish",
+      "executor": "provider-adapter",
+      "adapter": "github-release-assets",
+      "artifactRoles": [
+        {
+          "role": "installable-product",
+          "root": "sha256:1111111111111111111111111111111111111111111111111111111111111111"
+        },
+        {
+          "role": "release-passport",
+          "root": "sha256:2222222222222222222222222222222222222222222222222222222222222222"
+        }
+      ],
+      "destination": {
+        "kind": "github-release",
+        "locator": "github-release:kungfu-systems/kungfu@v4.0.0-alpha.1"
+      },
+      "channelPolicy": {
+        "channel": "alpha",
+        "tagPattern": "^v4\\.0\\.0-alpha\\.[0-9]+$",
+        "authorityMove": "verified-ref"
+      },
+      "activationPolicy": { "mode": "none", "environment": "none" },
+      "readbackPredicates": [
+        {
+          "id": "release-assets-match-roots",
+          "kind": "provider-assets",
+          "expected": "all declared artifact roots are publicly readable"
+        }
+      ],
+      "effect": {
+        "kind": "artifact-publication",
+        "schema": "kungfu.buildchain.release-tail.effect/v1"
+      },
+      "observation": {
+        "kind": "artifact-publication-readback",
+        "schema": "kungfu.buildchain.release-tail.observation/v1"
+      },
+      "receipt": {
+        "kind": "artifact-publication",
+        "schema": "kungfu.buildchain.release-tail.receipt/v1"
+      },
+      "operationIdentity": {
+        "transactionRoot": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+        "capabilityId": "artifact.publish",
+        "subjectRoot": "sha256:3333333333333333333333333333333333333333333333333333333333333333",
+        "targetRoot": "sha256:4444444444444444444444444444444444444444444444444444444444444444",
+        "attemptKey": "artifact.publish/1"
+      },
+      "idempotency": {
+        "scope": "subject-target",
+        "duplicate": "readback-before-retry"
+      },
+      "retry": {
+        "class": "provider-transient",
+        "localAttempts": 2,
+        "exhausted": "repair-required"
+      },
+      "evidenceRequirements": [
+        "kungfu-buildchain-publish-evidence",
+        "kungfu-buildchain-release-passport"
+      ]
+    },
+    {
+      "id": "signed-channel.commit",
+      "executor": "provider-adapter",
+      "adapter": "signed-static-channel",
+      "artifactRoles": [
+        {
+          "role": "signed-channel-index",
+          "root": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+        },
+        {
+          "role": "installer-publication-bundle",
+          "root": "sha256:6666666666666666666666666666666666666666666666666666666666666666"
+        }
+      ],
+      "destination": {
+        "kind": "well-known-signed-channel",
+        "locator": "https://kungfu.tech/.well-known/kungfu/alpha.json"
+      },
+      "channelPolicy": {
+        "channel": "alpha",
+        "tagPattern": "^v4\\.0\\.0-alpha\\.[0-9]+$",
+        "authorityMove": "signed-cas"
+      },
+      "activationPolicy": { "mode": "none", "environment": "none" },
+      "readbackPredicates": [
+        {
+          "id": "signed-channel-root",
+          "kind": "public-signed-document",
+          "expected": "signature, payload root, source SHA, tag, and previous authority match"
+        }
+      ],
+      "effect": {
+        "kind": "signed-channel-commit",
+        "schema": "kungfu.buildchain.release-tail.effect/v1"
+      },
+      "observation": {
+        "kind": "signed-channel-readback",
+        "schema": "kungfu.buildchain.release-tail.observation/v1"
+      },
+      "receipt": {
+        "kind": "publication-commit",
+        "schema": "kungfu.buildchain.release-tail.receipt/v1"
+      },
+      "operationIdentity": {
+        "transactionRoot": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+        "capabilityId": "signed-channel.commit",
+        "subjectRoot": "sha256:7777777777777777777777777777777777777777777777777777777777777777",
+        "targetRoot": "sha256:8888888888888888888888888888888888888888888888888888888888888888",
+        "attemptKey": "signed-channel.commit/1"
+      },
+      "idempotency": {
+        "scope": "subject-target",
+        "duplicate": "return-observed-receipt"
+      },
+      "retry": {
+        "class": "readback",
+        "localAttempts": 2,
+        "exhausted": "repair-required"
+      },
+      "evidenceRequirements": [
+        "kungfu-buildchain-publication-commit-evidence/v1"
+      ]
+    },
+    {
+      "id": "release.activate",
+      "executor": "provider-adapter",
+      "adapter": "site-release-activation",
+      "artifactRoles": [
+        {
+          "role": "activation-receipt-set",
+          "root": "sha256:9999999999999999999999999999999999999999999999999999999999999999"
+        }
+      ],
+      "destination": {
+        "kind": "production-site",
+        "locator": "https://kungfu.tech/.well-known/kungfu-release-status.json"
+      },
+      "channelPolicy": {
+        "channel": "alpha",
+        "tagPattern": "^v4\\.0\\.0-alpha\\.[0-9]+$",
+        "authorityMove": "verified-ref"
+      },
+      "activationPolicy": {
+        "mode": "receipt-set",
+        "environment": "production"
+      },
+      "readbackPredicates": [
+        {
+          "id": "release-status-current",
+          "kind": "public-json",
+          "expected": "source, site source, version, tag, channel, and Passport roots match"
+        },
+        {
+          "id": "installable-product-qualified",
+          "kind": "public-product-qualification",
+          "expected": "a public qualification asset matches an admitted artifact root"
+        }
+      ],
+      "effect": {
+        "kind": "release-activation",
+        "schema": "kungfu.buildchain.release-tail.effect/v1"
+      },
+      "observation": {
+        "kind": "production-readback",
+        "schema": "kungfu.buildchain.release-tail.observation/v1"
+      },
+      "receipt": {
+        "kind": "activation-receipt-set",
+        "schema": "kungfu.buildchain.release-tail.receipt/v1"
+      },
+      "operationIdentity": {
+        "transactionRoot": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+        "capabilityId": "release.activate",
+        "subjectRoot": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "targetRoot": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+        "attemptKey": "release.activate/1"
+      },
+      "idempotency": {
+        "scope": "operation",
+        "duplicate": "readback-before-retry"
+      },
+      "retry": {
+        "class": "provider-transient",
+        "localAttempts": 2,
+        "exhausted": "blocked"
+      },
+      "evidenceRequirements": [
+        "kungfu-buildchain-release-activation-receipt-set/v1",
+        "kungfu.release-public-readback/v1",
+        "kungfu.cli-installed-product-qualification/v1"
+      ]
+    },
+    {
+      "id": "released-evidence.synthesize",
+      "executor": "buildchain-core",
+      "adapter": "activation-receipt-projector",
+      "artifactRoles": [
+        {
+          "role": "activation-receipt-set",
+          "root": "sha256:9999999999999999999999999999999999999999999999999999999999999999"
+        }
+      ],
+      "destination": {
+        "kind": "release-passport-attachment",
+        "locator": ".buildchain/release-evidence/ungfu-public-use.json"
+      },
+      "channelPolicy": {
+        "channel": "alpha",
+        "tagPattern": "^v4\\.0\\.0-alpha\\.[0-9]+$",
+        "authorityMove": "none"
+      },
+      "activationPolicy": {
+        "mode": "receipt-only",
+        "environment": "production"
+      },
+      "readbackPredicates": [
+        {
+          "id": "five-canonical-receipts",
+          "kind": "rooted-receipt-set",
+          "expected": "artifact, Passport, site, public readback, and product qualification receipts share one binding root"
+        }
+      ],
+      "effect": {
+        "kind": "released-evidence-projection",
+        "schema": "kungfu.buildchain.release-tail.effect/v1"
+      },
+      "observation": {
+        "kind": "released-evidence-validation",
+        "schema": "kungfu.buildchain.release-tail.observation/v1"
+      },
+      "receipt": {
+        "kind": "released-evidence",
+        "schema": "kungfu.buildchain.release-tail.receipt/v1"
+      },
+      "operationIdentity": {
+        "transactionRoot": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+        "capabilityId": "released-evidence.synthesize",
+        "subjectRoot": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+        "targetRoot": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "attemptKey": "released-evidence.synthesize/1"
+      },
+      "idempotency": {
+        "scope": "operation",
+        "duplicate": "return-observed-receipt"
+      },
+      "retry": {
+        "class": "never",
+        "localAttempts": 0,
+        "exhausted": "terminal-failure"
+      },
+      "evidenceRequirements": [
+        "kungfu-buildchain-release-activation-receipt-set/v1",
+        "kungfu-ungfu-release-evidence-index"
+      ]
+    }
+  ]
+}