@kungfu-tech/buildchain 3.0.7-alpha.0 → 3.0.7

package/actions/promote-buildchain-ref/README.md

@@ -328,6 +328,7 @@ BUILDCHAIN_SEALED_NPM_TARBALL
 BUILDCHAIN_SEALED_NPM_INTEGRITY
 BUILDCHAIN_SEALED_NPM_SHA256
 BUILDCHAIN_REQUIRED_ARTIFACTS
+BUILDCHAIN_PUBLISH_REQUIRED_ARTIFACTS_PATH
 ```
 
 `BUILDCHAIN_REQUIRED_ARTIFACTS` is the normalized requirement array after the
@@ -337,6 +338,10 @@ declared provenance to the current release coordinate. Template expansion
 happens after exact version selection; ambiguous or unsupported templates fail
 before `lifecycle.publish`. Requirement descriptors may omit `digest`; final
 publish evidence may not.
+The action also writes that normalized array to
+`BUILDCHAIN_PUBLISH_REQUIRED_ARTIFACTS_PATH`. To stay below operating-system
+process environment limits, large arrays are available through the file path
+only; small arrays retain the inline variable for compatibility.
 
 The action outputs `transaction-id`, `transaction-state`,
 `transaction-publication-state`, `transaction-sealed-bundle-root`,
@@ -494,6 +499,11 @@ governance semantics:
 - alpha promotion must come from a merged same-repository PR
   `dev/vN/vN.M -> alpha/vN/vN.M`, or from a strict same-line
   `publish-gate/alpha/vN/vN.M/<version> -> alpha/vN/vN.M` source-lock PR;
+  an immutable recovery receipt may instead admit the exact current alpha
+  channel SHA only when its sealed candidate tree is byte-equivalent and its
+  publication version is bound by that receipt; when administrative protection
+  details are hidden, the provider-visible protected head and required check
+  must still match that exact recovered SHA;
 - release promotion must come from a merged same-repository PR
   `alpha/vN/vN.M -> release/vN/vN.M`, or from a strict same-line
   `publish-gate/release/vN/vN.M/<version> -> release/vN/vN.M` source-lock PR;

package/contracts/auditable-demo-scenario-v1.schema.json

@@ -112,7 +112,7 @@
     "renditions": {
       "const": [
         {"id": "1080p", "role": "primary", "columns": 150, "rows": 36, "width": 1920, "height": 1080},
-        {"id": "720p", "role": "responsive", "columns": 100, "rows": 28, "width": 1280, "height": 720}
+        {"id": "720p", "role": "responsive", "columns": 150, "rows": 28, "width": 1280, "height": 720}
       ]
     },
     "demos": {

package/contracts/engineering-housekeeper-v1.schema.json

@@ -0,0 +1,143 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.kungfu.ai/contracts/engineering-housekeeper-v1.schema.json",
+  "title": "Buildchain Engineering Housekeeper contract",
+  "oneOf": [{ "$ref": "#/$defs/plan" }, { "$ref": "#/$defs/receipt" }],
+  "$defs": {
+    "root": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+    "oid": { "type": "string", "pattern": "^[0-9a-f]{40,64}$" },
+    "target": {
+      "type": "object",
+      "required": ["name", "headOid"],
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "headOid": { "$ref": "#/$defs/oid" }
+      },
+      "additionalProperties": false
+    },
+    "policy": {
+      "type": "object",
+      "required": ["protectedPatterns", "retainedPatterns", "pullRequests"],
+      "properties": {
+        "protectedPatterns": {
+          "type": "array",
+          "items": { "type": "string" },
+          "uniqueItems": true
+        },
+        "retainedPatterns": {
+          "type": "array",
+          "items": { "type": "string" },
+          "uniqueItems": true
+        },
+        "pullRequests": {
+          "type": "object",
+          "required": ["reportStale", "label", "autoClose"],
+          "properties": {
+            "reportStale": { "type": "boolean" },
+            "label": { "type": "string" },
+            "autoClose": { "const": false }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "inventory": {
+      "type": "object",
+      "required": ["kind", "repository", "headOid", "reasonCodes"],
+      "properties": {
+        "kind": { "enum": ["branch", "pull-request"] },
+        "repository": { "type": "string", "pattern": "^[^/]+/[^/]+$" },
+        "name": { "type": "string" },
+        "number": { "type": "integer", "minimum": 1 },
+        "headRepository": { "type": "string" },
+        "headRef": { "type": "string" },
+        "headOid": { "$ref": "#/$defs/oid" },
+        "target": { "$ref": "#/$defs/target" },
+        "eligible": { "type": "boolean" },
+        "decision": { "enum": ["delete", "retain"] },
+        "state": { "enum": ["open", "draft", "closed", "merged"] },
+        "actions": {
+          "type": "array",
+          "items": { "enum": ["report", "label"] },
+          "uniqueItems": true
+        },
+        "reasonCodes": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string" },
+          "uniqueItems": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "action": {
+      "type": "object",
+      "required": ["kind"],
+      "properties": {
+        "kind": {
+          "enum": ["delete-branch", "report-pull-request", "label-pull-request"]
+        },
+        "name": { "type": "string", "minLength": 1 },
+        "number": { "type": "integer", "minimum": 1 },
+        "expectedHeadOid": { "$ref": "#/$defs/oid" },
+        "targetName": { "type": "string", "minLength": 1 },
+        "expectedTargetHeadOid": { "$ref": "#/$defs/oid" }
+      },
+      "additionalProperties": false
+    },
+    "plan": {
+      "type": "object",
+      "required": [
+        "contract",
+        "schemaVersion",
+        "mode",
+        "repository",
+        "target",
+        "observedAt",
+        "policy",
+        "inventory",
+        "actions",
+        "planRoot"
+      ],
+      "properties": {
+        "contract": { "const": "kungfu-buildchain-engineering-housekeeper/v1" },
+        "schemaVersion": { "const": 1 },
+        "mode": { "const": "plan" },
+        "repository": { "type": "string", "pattern": "^[^/]+/[^/]+$" },
+        "target": { "$ref": "#/$defs/target" },
+        "observedAt": { "type": "string", "format": "date-time" },
+        "policy": { "$ref": "#/$defs/policy" },
+        "inventory": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/inventory" }
+        },
+        "actions": { "type": "array", "items": { "$ref": "#/$defs/action" } },
+        "planRoot": { "$ref": "#/$defs/root" }
+      },
+      "additionalProperties": false
+    },
+    "receipt": {
+      "type": "object",
+      "required": [
+        "contract",
+        "schemaVersion",
+        "mode",
+        "planRoot",
+        "appliedAt",
+        "outcomes",
+        "receiptRoot"
+      ],
+      "properties": {
+        "contract": { "const": "kungfu-buildchain-engineering-housekeeper/v1" },
+        "schemaVersion": { "const": 1 },
+        "mode": { "const": "receipt" },
+        "planRoot": { "$ref": "#/$defs/root" },
+        "appliedAt": { "type": "string", "format": "date-time" },
+        "outcomes": { "type": "array", "items": { "type": "object" } },
+        "receiptRoot": { "$ref": "#/$defs/root" }
+      },
+      "additionalProperties": false
+    }
+  }
+}

package/contracts/fixtures/engineering-housekeeper-v1/cases.json

@@ -0,0 +1,68 @@
+{
+  "contract": "kungfu-buildchain-engineering-housekeeper-fixtures/v1",
+  "cases": [
+    {
+      "id": "active",
+      "branch": {
+        "name": "feature/active",
+        "ancestry": "ancestor",
+        "openPullRequestNumbers": [11]
+      },
+      "eligible": false,
+      "reason": "branch.open-pr-head"
+    },
+    {
+      "id": "merged",
+      "branch": {
+        "name": "feature/merged",
+        "ancestry": "ancestor",
+        "openPullRequestNumbers": []
+      },
+      "eligible": true,
+      "reason": "eligible.merged-branch"
+    },
+    {
+      "id": "stale",
+      "branch": {
+        "name": "feature/stale",
+        "ancestry": "diverged",
+        "openPullRequestNumbers": []
+      },
+      "eligible": false,
+      "reason": "branch.not-merged"
+    },
+    {
+      "id": "advanced",
+      "revalidation": "head",
+      "reason": "branch.head-advanced"
+    },
+    { "id": "renamed", "revalidation": "name", "reason": "branch.renamed" },
+    {
+      "id": "protected",
+      "branch": {
+        "name": "dev/v3/v3.0",
+        "ancestry": "ancestor",
+        "openPullRequestNumbers": []
+      },
+      "eligible": false,
+      "reason": "branch.protected"
+    },
+    {
+      "id": "forked",
+      "branch": {
+        "name": "feature/forked",
+        "ancestry": "ancestor",
+        "openPullRequestNumbers": [],
+        "sourceRepository": "fork/buildchain"
+      },
+      "eligible": false,
+      "reason": "branch.cross-repository"
+    },
+    {
+      "id": "permission-denied",
+      "outcome": "denied",
+      "reason": "branch.permission-denied"
+    },
+    { "id": "repeated", "replay": true, "reason": "replay.already-applied" }
+  ]
+}

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.7-alpha.0",
+    "version": "3.0.7",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -52,7 +52,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa",
-      "auditDigest": "sha256:ee92538b49ee91606c21f54f2ae1e5165228ff4dc7c64d8b8a6e073b8e033365"
+      "auditDigest": "sha256:8ea77f06f35c5ea0eae0a06625e397c49dcf9863d05d05dcf4d2d80369f58dff"
     },
     {
       "contractVersion": 1,
@@ -249,7 +249,7 @@
         "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
       ],
       "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
-      "auditDigest": "sha256:0ec19f4776537254017dbc30e35dbc10dc3fdf3c3c747d3c18beb0389fc9db7f"
+      "auditDigest": "sha256:61a7d1f319232454d79c96b277f9feb5e0b8b7842f96985dc8bdf89e3a57e3fa"
     },
     {
       "contractVersion": 1,
@@ -476,7 +476,7 @@
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
       ],
       "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
-      "auditDigest": "sha256:7b1fa951846a7386261e1c52d1191b17421a0dd5a60edee675926dfa9c085126"
+      "auditDigest": "sha256:b86906f63640ffdbae3fcd9eec4c4b234c8e8e6e906b7857d576b9d1cf5c78be"
     },
     {
       "contractVersion": 1,
@@ -591,7 +591,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:7d91592c518277646154ef5c7fde27d7101c87a0d7f69c90911ac0c7583c20ec"
+      "auditDigest": "sha256:dfebb115f842e83a189868c3ef06fa72e5e8043327e5f1c7d5d918f87cd2c74e"
     },
     {
       "contractVersion": 1,
@@ -616,7 +616,7 @@
         "KFD self contract witnesses record source/artifact hashes, self-hosting boundary, and responsibility state"
       ],
       "breakingDigest": "sha256:f46c1f67b94957ad956cf70db59a73fd5690bd67c91edf9c2d0eb8f3d1e3cf8d",
-      "auditDigest": "sha256:f31691f36f2a7930798805cb470aff7acd3503799cb72b954c7787b1d8b3eb31"
+      "auditDigest": "sha256:0ee7f76d04f9b77a63ec2cc12cec8e804da47b8ef81075982feb351346ac3d5b"
     },
     {
       "contractVersion": 1,
@@ -640,7 +640,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:7d91592c518277646154ef5c7fde27d7101c87a0d7f69c90911ac0c7583c20ec"
+      "auditDigest": "sha256:dfebb115f842e83a189868c3ef06fa72e5e8043327e5f1c7d5d918f87cd2c74e"
     },
     {
       "contractVersion": 1,
@@ -669,7 +669,7 @@
         "KFD-3 passports expose releaseStatus, witness hashes, declared capability verification, reverse audit boundary, residual risk, and responsibility state"
       ],
       "breakingDigest": "sha256:33654f3444c893754aacc42dde3051f0a371bd17c6ef7c657c579a07159cd7c1",
-      "auditDigest": "sha256:f31691f36f2a7930798805cb470aff7acd3503799cb72b954c7787b1d8b3eb31"
+      "auditDigest": "sha256:0ee7f76d04f9b77a63ec2cc12cec8e804da47b8ef81075982feb351346ac3d5b"
     },
     {
       "contractVersion": 1,
@@ -790,7 +790,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:441c5107570d729a6ec95d76a288a69d6119455baf44cfed48cae62625ca19c6"
+      "auditDigest": "sha256:6489e53ab9e207a89b8282de6d9e220fb0790282f03df9ef05a422d4ce864050"
     },
     {
       "contractVersion": 1,
@@ -812,7 +812,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:a68025579bc0cb1e1bbd2db13bfddd9926891ba5eb6f981cc254a4af604cc869"
+      "auditDigest": "sha256:c1efa246a44ed993579047f8427f68c5ce8cb8d64b7c2df3eddd444c19d910aa"
     },
     {
       "contractVersion": 1,
@@ -863,7 +863,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
+        "registryDigest": "sha256:e9f5716c5298730bcab51a9e2f2316df8b4a7cec7ce609a7a8808928a48edd1e",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -1045,8 +1045,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:9c0aacca910cef4619a797898ff5c24027c1583f84431a93a5efc854925326e7",
-        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
+        "digest": "sha256:f986e79241d831f027a0955a35c918f946989176c76555e20f156ed31fb10c94",
+        "registryDigest": "sha256:e9f5716c5298730bcab51a9e2f2316df8b4a7cec7ce609a7a8808928a48edd1e",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1441,7 +1441,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
-      "auditDigest": "sha256:ee92538b49ee91606c21f54f2ae1e5165228ff4dc7c64d8b8a6e073b8e033365"
+      "auditDigest": "sha256:8ea77f06f35c5ea0eae0a06625e397c49dcf9863d05d05dcf4d2d80369f58dff"
     },
     {
       "contractVersion": 1,
@@ -1581,7 +1581,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:48545554883888862984cdf1b6b4b56341531cdd6192600782a76b92ad22fd36",
-        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
+        "registryDigest": "sha256:e9f5716c5298730bcab51a9e2f2316df8b4a7cec7ce609a7a8808928a48edd1e",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -2054,7 +2054,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
+        "registryDigest": "sha256:e9f5716c5298730bcab51a9e2f2316df8b4a7cec7ce609a7a8808928a48edd1e",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2271,7 +2271,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
+        "registryDigest": "sha256:e9f5716c5298730bcab51a9e2f2316df8b4a7cec7ce609a7a8808928a48edd1e",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2515,7 +2515,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
+        "registryDigest": "sha256:e9f5716c5298730bcab51a9e2f2316df8b4a7cec7ce609a7a8808928a48edd1e",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2697,7 +2697,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
+        "registryDigest": "sha256:e9f5716c5298730bcab51a9e2f2316df8b4a7cec7ce609a7a8808928a48edd1e",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -3029,7 +3029,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:83bc2f7d57ad3500e0b2983314aa5fdaa0dff1f78ef011af94cde760b86a010f",
-        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
+        "registryDigest": "sha256:e9f5716c5298730bcab51a9e2f2316df8b4a7cec7ce609a7a8808928a48edd1e",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3520,7 +3520,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:0ec19f4776537254017dbc30e35dbc10dc3fdf3c3c747d3c18beb0389fc9db7f"
+      "auditDigest": "sha256:61a7d1f319232454d79c96b277f9feb5e0b8b7842f96985dc8bdf89e3a57e3fa"
     },
     {
       "contractVersion": 1,
@@ -3585,7 +3585,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12",
-        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
+        "registryDigest": "sha256:e9f5716c5298730bcab51a9e2f2316df8b4a7cec7ce609a7a8808928a48edd1e",
         "inputClassifications": {
           "agent-work-context-json": {
             "classification": "digest-only",
@@ -3720,7 +3720,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:4610d5ecdd42984fef782af010ed6978f4a40438134b3d962698854978fd0095",
+        "registryDigest": "sha256:e9f5716c5298730bcab51a9e2f2316df8b4a7cec7ce609a7a8808928a48edd1e",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3734,5 +3734,5 @@
     }
   ],
   "compatibilityDigest": "sha256:80cfdf1786019217c439810f1a80d2866bf8f7ef35a6fa569e1a687fb2bf4cbe",
-  "contractDigest": "sha256:15d9f6feaa7f774b7223943de4326285d4a02db459e8ddda4a20418552e65d96"
+  "contractDigest": "sha256:8e9a161653c40611ffd76aa878ae348fc215506c1caa88347111fb122cfe7c12"
 }