@kungfu-tech/buildchain 3.0.9-alpha.1 → 3.0.9-alpha.11

package/packages/core/paper-agent-entry.js

@@ -13,6 +13,7 @@ import {
   workCheck,
 } from "./paper-repository.js";
 import { mergePublicationRehearsalAgentInstructions } from "./publication-rehearsal-projection.js";
+import { mergeNextDevelopmentAgentInstructions } from "./next-development-projection.js";
 
 export const PAPER_AGENT_ENTRY_CONTRACT = "kungfu-buildchain-paper-agent-entry";
 export const PAPER_AGENT_ENTRY_SCHEMA_VERSION = 1;
@@ -168,10 +169,12 @@ export function paperAgentEntryFiles({
     [PAPER_PATHS.agentEntry, jsonText(entry)],
     [
       PAPER_PATHS.agentInstructions,
-      mergePublicationRehearsalAgentInstructions(
-        mergePaperAgentEntryInstructions(currentAgents, {
-          developmentRef: resolvedDevelopmentRef,
-        }),
+      mergeNextDevelopmentAgentInstructions(
+        mergePublicationRehearsalAgentInstructions(
+          mergePaperAgentEntryInstructions(currentAgents, {
+            developmentRef: resolvedDevelopmentRef,
+          }),
+        ),
       ),
     ],
   ]);

package/packages/core/paper.js

@@ -51,6 +51,11 @@ import {
   projectPublicationRehearsalToml,
   publicationRehearsalWorkflow,
 } from "./publication-rehearsal-projection.js";
+import {
+  appendNextDevelopmentToml,
+  nextDevelopmentWorkflowHeader,
+  projectNextDevelopmentToml,
+} from "./next-development-projection.js";
 
 export { PAPER_PATHS, resolvePaperRepository } from "./paper-repository.js";
 export {
@@ -356,7 +361,7 @@ immutable_base_url = ${tomlString(joinUrl(siteBaseUrl, "archive").replace(/\/$/,
 registry_path = ".buildchain/publication/publication-registry.json"
 `
     : "";
-  return appendPublicationRehearsalToml(`schema = 1
+  return appendNextDevelopmentToml(appendPublicationRehearsalToml(`schema = 1
 
 [project]
 type = "publication-artifact"
@@ -390,14 +395,14 @@ command = "make pdf"
 
 [lifecycle.verify]
 command = "make check"
-`);
+`));
 }
 
 function scaffoldBuildWorkflow(
   buildchainSha,
   { artifactName = "paper-publication" } = {},
 ) {
-  return `name: Build
+  return `${nextDevelopmentWorkflowHeader()}name: Build
 
 on:
   workflow_dispatch:
@@ -425,7 +430,7 @@ jobs:
 }
 
 function scaffoldVerifyWorkflow(buildchainSha) {
-  return `name: Verify
+  return `${nextDevelopmentWorkflowHeader()}name: Verify
 
 on:
   pull_request:
@@ -456,7 +461,7 @@ function scaffoldReleaseWorkflow(
   const passportInput = releasePassportProductName
     ? `      release-passport-product-name: ${JSON.stringify(releasePassportProductName)}\n`
     : "";
-  return `name: Paper Release
+  return `${nextDevelopmentWorkflowHeader()}name: Paper Release
 
 on:
   workflow_dispatch:
@@ -1017,8 +1022,10 @@ function migrationFiles({
   const files = new Map([
     [
       PAPER_PATHS.config,
-      projectPublicationRehearsalToml(
-        fs.readFileSync(path.resolve(cwd, PAPER_PATHS.config), "utf8"),
+      projectNextDevelopmentToml(
+        projectPublicationRehearsalToml(
+          fs.readFileSync(path.resolve(cwd, PAPER_PATHS.config), "utf8"),
+        ),
       ),
     ],
     [PAPER_PATHS.contractLock, contractLockText],

package/packages/core/published-delivery-authority.js

@@ -0,0 +1,247 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { mkdir, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { pathToFileURL } from "node:url";
+import { execFile } from "node:child_process";
+
+import { adopterDeliveryGateDigest } from "./adopter-delivery-gate.js";
+
+export const PUBLISHED_DELIVERY_AUTHORITY_CONTRACT =
+  "kungfu-buildchain-published-delivery-authority/v1";
+
+const execFileAsync = promisify(execFile);
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const PACKAGES = [
+  {
+    key: "buildchain",
+    name: "@kungfu-tech/buildchain",
+    packageRoot: "archive",
+    modules: {
+      adopterDeliveryGate: "packages/core/adopter-delivery-gate.js",
+      bootstrap: "packages/core/buildchain-delivery-bootstrap.js",
+      infrastructure: "packages/core/buildchain-delivery-infrastructure.js",
+      kfdCategoryDriver: "packages/core/kfd-adopter-category-driver.js",
+    },
+  },
+  {
+    key: "kfd",
+    name: "@kungfu-tech/kfd",
+    packageRoot: "profiles/adopter-conformance/adopters/kfd/manifest.json",
+    modules: {},
+  },
+];
+
+async function sha256File(file) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(file)) hash.update(chunk);
+  return `sha256:${hash.digest("hex")}`;
+}
+
+function exactDeclaration(value, expectedName, label) {
+  if (
+    value?.name !== expectedName ||
+    typeof value.version !== "string" ||
+    value.version.length === 0 ||
+    typeof value.archivePath !== "string" ||
+    value.archivePath.length === 0 ||
+    !ROOT_PATTERN.test(value.archiveRoot ?? "") ||
+    !ROOT_PATTERN.test(value.artifactRoot ?? "")
+  ) {
+    throw new TypeError(`${label} package declaration is incomplete`);
+  }
+  return structuredClone(value);
+}
+
+function safeArchiveEntries(listing, verboseListing, label) {
+  const entries = listing.split("\n").filter(Boolean);
+  const types = verboseListing.split("\n").filter(Boolean);
+  if (entries.length === 0 || entries.length !== types.length) {
+    throw new Error(`${label} archive listing is incomplete`);
+  }
+  for (let index = 0; index < entries.length; index += 1) {
+    const entry = entries[index];
+    const parts = entry.split("/");
+    if (
+      parts[0] !== "package" ||
+      parts.some((part, partIndex) =>
+        partIndex === parts.length - 1 && part === ""
+          ? false
+          : part === "" || part === "." || part === "..",
+      )
+    ) {
+      throw new Error(`${label} archive contains an unsafe path`);
+    }
+    if (!["-", "d"].includes(types[index][0])) {
+      throw new Error(`${label} archive contains a non-file entry`);
+    }
+  }
+}
+
+async function extractPackage(declaration, destination, definition, label) {
+  const observedRoot = await sha256File(declaration.archivePath);
+  if (observedRoot !== declaration.archiveRoot) {
+    throw new Error(`${label} archive bytes do not match archiveRoot`);
+  }
+  const [{ stdout: listing }, { stdout: verboseListing }] = await Promise.all([
+    execFileAsync("tar", ["-tzf", declaration.archivePath], {
+      maxBuffer: 16 * 1024 * 1024,
+    }),
+    execFileAsync("tar", ["-tvzf", declaration.archivePath], {
+      maxBuffer: 16 * 1024 * 1024,
+    }),
+  ]);
+  safeArchiveEntries(listing, verboseListing, label);
+  await mkdir(destination, { recursive: true });
+  await execFileAsync(
+    "tar",
+    [
+      "-xzf",
+      declaration.archivePath,
+      "--strip-components",
+      "1",
+      "-C",
+      destination,
+    ],
+    { maxBuffer: 16 * 1024 * 1024 },
+  );
+  const packageJsonPath = path.join(destination, "package.json");
+  const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
+  if (
+    packageJson.name !== declaration.name ||
+    packageJson.version !== declaration.version
+  ) {
+    throw new Error(`${label} extracted package identity does not match`);
+  }
+  if (definition.packageRoot === "archive") {
+    if (declaration.artifactRoot !== declaration.archiveRoot) {
+      throw new Error(`${label} package artifactRoot must match archiveRoot`);
+    }
+  } else {
+    const packageManifest = JSON.parse(
+      await readFile(path.join(destination, definition.packageRoot), "utf8"),
+    );
+    const packageCut = packageManifest?.kfdCut?.package;
+    if (
+      packageCut?.name !== declaration.name ||
+      packageCut?.version !== declaration.version ||
+      packageCut?.artifactRoot !== declaration.artifactRoot
+    ) {
+      throw new Error(`${label} semantic package identity does not match`);
+    }
+  }
+  const destinationRoot = await realpath(destination);
+  if (!destinationRoot.endsWith(path.join(...declaration.name.split("/")))) {
+    throw new Error(`${label} extraction escaped its package coordinate`);
+  }
+  return {
+    name: declaration.name,
+    version: declaration.version,
+    archiveRoot: declaration.archiveRoot,
+    artifactRoot: declaration.artifactRoot,
+  };
+}
+
+async function importAuthorityRuntime(buildchainRoot) {
+  const definition = PACKAGES[0];
+  const imported = {};
+  for (const [key, relativePath] of Object.entries(definition.modules)) {
+    imported[key] = await import(
+      pathToFileURL(path.join(buildchainRoot, relativePath)).href
+    );
+  }
+  const runtime = {
+    createAdopterDeliveryGate:
+      imported.adopterDeliveryGate.createAdopterDeliveryGate,
+    createPackageArtifactProfile:
+      imported.adopterDeliveryGate.createPackageArtifactProfile,
+    qualifyBuildchainDeliveryInfrastructureBootstrap:
+      imported.bootstrap.qualifyBuildchainDeliveryInfrastructureBootstrap,
+    createBuildchainDeliveryInfrastructureInstanceManifest:
+      imported.infrastructure
+        .createBuildchainDeliveryInfrastructureInstanceManifest,
+    verifyBuildchainDeliveryInfrastructureInstance:
+      imported.infrastructure.verifyBuildchainDeliveryInfrastructureInstance,
+    createKfdAdopterCategoryProtocolDriver:
+      imported.kfdCategoryDriver.createKfdAdopterCategoryProtocolDriver,
+  };
+  for (const [name, implementation] of Object.entries(runtime)) {
+    if (typeof implementation !== "function") {
+      throw new Error(`published Buildchain authority is missing ${name}`);
+    }
+  }
+  return runtime;
+}
+
+export async function loadPublishedBuildchainDeliveryAuthority({
+  buildchain,
+  kfd,
+} = {}) {
+  const declarations = {
+    buildchain: exactDeclaration(
+      buildchain,
+      "@kungfu-tech/buildchain",
+      "Buildchain authority",
+    ),
+    kfd: exactDeclaration(kfd, "@kungfu-tech/kfd", "KFD authority"),
+  };
+  const temporaryRoot = await mkdtemp(
+    path.join(tmpdir(), "buildchain-published-delivery-authority-"),
+  );
+  let retained = false;
+  try {
+    const identities = {};
+    for (const definition of PACKAGES) {
+      identities[definition.key] = await extractPackage(
+        declarations[definition.key],
+        path.join(temporaryRoot, "node_modules", ...definition.name.split("/")),
+        definition,
+        `${definition.key} authority`,
+      );
+    }
+    const authorityRuntime = await importAuthorityRuntime(
+      path.join(temporaryRoot, "node_modules", ...PACKAGES[0].name.split("/")),
+    );
+    const authority = {
+      schemaVersion: 1,
+      contract: PUBLISHED_DELIVERY_AUTHORITY_CONTRACT,
+      packages: identities,
+      moduleCoordinates: structuredClone(PACKAGES[0].modules),
+      qualifying: false,
+      selfCertified: false,
+      releaseAuthorized: false,
+      finalAuthority:
+        "caller-bound-public-npm-archive-bytes-and-package-identity",
+    };
+    authority.authorityRoot = adopterDeliveryGateDigest(authority);
+    retained = true;
+    return {
+      ...authority,
+      authorityRuntime,
+      temporaryRoot,
+      async dispose() {
+        await rm(temporaryRoot, { recursive: true, force: true });
+      },
+    };
+  } finally {
+    if (!retained) await rm(temporaryRoot, { recursive: true, force: true });
+  }
+}
+
+export async function withPublishedBuildchainDeliveryAuthority(
+  declarations,
+  operation,
+) {
+  if (typeof operation !== "function") {
+    throw new TypeError("published authority operation must be a function");
+  }
+  const authority =
+    await loadPublishedBuildchainDeliveryAuthority(declarations);
+  try {
+    return await operation(authority);
+  } finally {
+    await authority.dispose();
+  }
+}

package/packages/core/release-passport-contract.js

@@ -10,6 +10,7 @@ import {
   installedKfdPackageArtifactRoot,
   validateKfdAdopterReleaseBinding,
 } from "./artifact-verification-envelope.js";
+import { normalizeAdopterDeliveryPassportBinding } from "./adopter-delivery-passport.js";
 
 export const RELEASE_PASSPORT_CONTRACT = "kungfu-buildchain-release-passport";
 export const RELEASE_CHECK_REPORT_CONTRACT = "kungfu-buildchain-release-check-report";
@@ -110,6 +111,7 @@ export const RELEASE_PASSPORT_SCHEMA = {
     "kfd-1": OBJECT,
     "kfd-2": OBJECT,
     "kfd-3": OBJECT,
+    adopterDelivery: OBJECT,
     kfdAdopter: OBJECT,
     kfdSupport: OBJECT,
   },
@@ -134,6 +136,7 @@ const BUILDCHAIN_AGGREGATION_FIELDS = [
   "platformArtifactManifests",
   "distTagPromotion",
   "controllerReceipts",
+  "adopterDelivery",
   "kfdAdopter",
   "kfdSupport",
   "githubArtifactAttestations",
@@ -356,7 +359,7 @@ export function defaultReleaseLlmsText({ tag = "", passportPath = "buildchain.re
   ].join("\n");
 }
 
-export function buildReleaseArtifactEvidence({ normalizedAssets = [], repository = "", tag = "", sourceSha = "", workflow = {}, kfdAdopter } = {}) {
+export function buildReleaseArtifactEvidence({ normalizedAssets = [], repository = "", tag = "", sourceSha = "", workflow = {}, adopterDelivery, kfdAdopter } = {}) {
   return {
     schemaVersion: 1,
     contract: "kungfu-buildchain-artifact-evidence",
@@ -381,6 +384,7 @@ export function buildReleaseArtifactEvidence({ normalizedAssets = [], repository
       sha256: asset.sha256, url: asset.url, githubAssetId: asset.githubAssetId,
       attestation: passportOptional(asset.attestation || ""),
     })),
+    ...(adopterDelivery ? { adopterDelivery: normalizeAdopterDeliveryPassportBinding(adopterDelivery) } : {}),
     ...(kfdAdopter ? { kfdAdopter: structuredClone(kfdAdopter) } : {}),
   };
 }
@@ -405,7 +409,7 @@ export function prepareReleasePassportKfdSections({ kfd1, kfd2Claims, kfd3, kfdA
   };
 }
 
-export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], comparisonMatrix, sourceSha = "", checkedAt } = {}) {
+export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], comparisonMatrix, expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", sourceSha = "", checkedAt } = {}) {
   if (!manifest) {
     if (comparisonMatrix || gateResults.length > 0) {
       throw new Error("KFD support and product-gate inputs require --kfd-adopter-manifest-json; --kfd-support-matrix-json is comparison-only");
@@ -414,7 +418,7 @@ export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], c
   }
   const manifestGate = createKfdAdopterManifestGate({
     manifest, packageArtifactRoot: installedKfdPackageArtifactRoot(), gateResults,
-    expectedSourceSha: sourceSha, checkedAt,
+    authorityPath: "kfd-adopter-manifest.json", expectedAdopterId, expectedSourceRepository, expectedSourceSha: sourceSha, checkedAt,
   });
   const legacyProjection = createKfdLegacySupportMatrixProjection({ manifest, manifestGate });
   if (comparisonMatrix) {
@@ -425,18 +429,18 @@ export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], c
   }
   return {
     manifest, manifestGate, legacyProjection,
-    binding: createKfdAdopterReleaseBinding({ manifest, manifestGate, legacyProjection, expectedSourceSha: sourceSha }),
+    binding: createKfdAdopterReleaseBinding({ manifest, manifestGate, legacyProjection, expectedAdopterId, expectedSourceRepository, expectedSourceSha: sourceSha }),
   };
 }
 
-export function validateKfdAdopterReleaseEvidence({ binding, artifactBinding, manifest, manifestGate, legacyProjection, passportLegacyProjection, expectedSourceSha = "" } = {}) {
+export function validateKfdAdopterReleaseEvidence({ binding, artifactBinding, manifest, manifestGate, legacyProjection, passportLegacyProjection, expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "" } = {}) {
   if (!binding) {
     return passportLegacyProjection
       ? [{ code: "kfdSupport.authority", message: "legacy KFD support projection requires the standard adopter manifest binding" }]
       : [];
   }
   const issues = validateKfdAdopterReleaseBinding(binding, {
-    manifest, manifestGate, legacyProjection, expectedSourceSha,
+    manifest, manifestGate, legacyProjection, expectedAdopterId, expectedSourceRepository, expectedSourceSha,
   }).issues.map((entry) => ({ code: `kfdAdopter.${entry.path || entry.code}`, message: entry.message, details: entry }));
   if (!artifactBinding || passportStableJson(artifactBinding) !== passportStableJson(binding)) {
     issues.push({ code: "kfdAdopter.artifactEvidence", message: "release passport and artifact evidence must bind the same exact KFD adopter closure" });

package/packages/core/release-passport.js

@@ -33,6 +33,10 @@ import { normalizeControllerReceiptReferences } from "./controller-evidence.js";
 import {
   normalizeGitHubArtifactAttestationPolicy,
 } from "./github-artifact-attestation.js";
+import {
+  normalizeAdopterDeliveryPassportBinding,
+  validateAdopterDeliveryReleaseEvidence,
+} from "./adopter-delivery-passport.js";
 
 export { RELEASE_CHECK_REPORT_CONTRACT, RELEASE_PASSPORT_CONTRACT };
 export const ARTIFACT_EVIDENCE_CONTRACT = "kungfu-buildchain-artifact-evidence";
@@ -1160,9 +1164,9 @@ function normalizePromotionRouting(value = undefined) {
   return JSON.parse(JSON.stringify(value));
 }
 
-export function createArtifactEvidence({ assets = [], repository = "", tag = "", sourceSha = "", workflow = {}, kfdAdopter = undefined } = {}) {
+export function createArtifactEvidence({ assets = [], repository = "", tag = "", sourceSha = "", workflow = {}, adopterDelivery = undefined, kfdAdopter = undefined } = {}) {
   const normalizedAssets = assets.map((asset, index) => normalizeAsset(asset, index));
-  return buildReleaseArtifactEvidence({ normalizedAssets, repository, tag, sourceSha, workflow, kfdAdopter });
+  return buildReleaseArtifactEvidence({ normalizedAssets, repository, tag, sourceSha, workflow, adopterDelivery, kfdAdopter });
 }
 
 function firstTruthy(...values) {
@@ -1187,11 +1191,13 @@ function acceptedControllerSourceShas(input) {
     : [];
 }
 
-function prepareReleaseKfdAdopterArtifacts({ kfdAdopter, assets, repository, tag, sourceSha, workflow }) {
-  const normalized = kfdAdopter ? structuredClone(kfdAdopter) : undefined;
+function prepareReleaseAdopterArtifacts({ adopterDelivery, kfdAdopter, assets, repository, tag, sourceSha, workflow }) {
+  const normalizedAdopterDelivery = normalizeAdopterDeliveryPassportBinding(adopterDelivery);
+  const normalizedKfdAdopter = kfdAdopter ? structuredClone(kfdAdopter) : undefined;
   return {
-    normalized,
-    artifactEvidence: createArtifactEvidence({ assets, repository, tag, sourceSha, workflow, kfdAdopter: normalized }),
+    normalizedAdopterDelivery,
+    normalizedKfdAdopter,
+    artifactEvidence: createArtifactEvidence({ assets, repository, tag, sourceSha, workflow, adopterDelivery: normalizedAdopterDelivery, kfdAdopter: normalizedKfdAdopter }),
   };
 }
 
@@ -1229,6 +1235,7 @@ export function createReleasePassport({
   kfd1 = undefined,
   kfd2Claims = [],
   kfd3 = undefined,
+  adopterDelivery = undefined,
   kfdAdopter = undefined,
   kfdAdopterManifestEvidencePath = "",
   kfdAdopterGateEvidencePath = "",
@@ -1244,8 +1251,8 @@ export function createReleasePassport({
   checkedAt = "",
 } = {}) {
   const normalizedTag = nonEmptyString(tag, "tag");
-  const { normalized: normalizedKfdAdopter, artifactEvidence } = prepareReleaseKfdAdopterArtifacts({
-    kfdAdopter, assets, repository, tag: normalizedTag, sourceSha, workflow,
+  const { normalizedAdopterDelivery, normalizedKfdAdopter, artifactEvidence } = prepareReleaseAdopterArtifacts({
+    adopterDelivery, kfdAdopter, assets, repository, tag: normalizedTag, sourceSha, workflow,
   });
   const normalizedPublishEvidence = normalizePublishEvidence(publishEvidence);
   const normalizedPackageSet = normalizePackageSet(packageSet, { packageName, packageVersion, publish });
@@ -1405,6 +1412,7 @@ export function createReleasePassport({
       ["buildFacts", normalizedBuildFacts],
       ["platformArtifactManifests", normalizedPlatformArtifactManifests],
       ["distTagPromotion", normalizedDistTagPromotionEvidence],
+      ["adopterDelivery", normalizedAdopterDelivery],
       ...kfdParts.sectionEntries,
       ["kfdAgentHub", normalizedKfdAgentHub],
       ["invariantPassports", invariantPassports],
@@ -1465,7 +1473,7 @@ export function createReleasePassport({
   };
 }
 
-function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson, productGateJsons, sourceSha, checkedAt }) {
+function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson, productGateJsons, repository, sourceSha, checkedAt }) {
   const manifestMeta = parseJsonInputWithMeta(manifestJson, undefined, { cwd, label: "kfdAdopterManifestJson" });
   const supportMatrixMeta = parseJsonInputWithMeta(supportMatrixJson, undefined, { cwd, label: "kfdSupportMatrixJson" });
   const productGateMetas = (productGateJsons || [])
@@ -1476,7 +1484,7 @@ function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson,
     manifest: manifestMeta.value,
     gateResults: productGateMetas.map((meta) => meta.value),
     comparisonMatrix: supportMatrixMeta.value,
-    sourceSha,
+    expectedAdopterId: repository || "kungfu-systems/buildchain", expectedSourceRepository: repository, sourceSha,
     checkedAt,
   });
 }
@@ -1525,7 +1533,7 @@ export function collectGitHubReleasePassport({
   kfd2ClaimJsons = [],
   kfd3PrebuildWitnessJsons = [],
   kfd3ArtifactWitnessJsons = [],
-  kfd3ArtifactVerifyCommand = "",
+  kfd3ArtifactVerifyCommand = "", adopterDeliveryJson = "",
   kfdAdopterManifestJson = "",
   kfdSupportMatrixJson = "",
   kfdProductGateJsons = [],
@@ -1586,6 +1594,11 @@ export function collectGitHubReleasePassport({
     cwd,
     label: "KFD-3 artifact verify command",
   });
+  const adopterDelivery = parseJsonInput(
+    adopterDeliveryJson,
+    undefined,
+    { cwd, label: "adopterDeliveryJson" },
+  );
   const basePassportMeta = parseJsonInputWithMeta(basePassportJson, undefined, { cwd, label: "basePassportJson" });
   const invariantPassportMetas = (invariantPassportJsons || [])
     .filter(Boolean)
@@ -1662,7 +1675,7 @@ export function collectGitHubReleasePassport({
   const productMechanism = defaultProductMechanism({ repository, productName });
   const kfdAdopterEvidence = collectKfdAdopterReleaseInputs({
     cwd, manifestJson: kfdAdopterManifestJson, supportMatrixJson: kfdSupportMatrixJson,
-    productGateJsons: kfdProductGateJsons, sourceSha, checkedAt: resolvedCheckedAt,
+    productGateJsons: kfdProductGateJsons, repository, sourceSha, checkedAt: resolvedCheckedAt,
   });
   const {
     manifest: kfdAdopterManifest,
@@ -1676,6 +1689,7 @@ export function collectGitHubReleasePassport({
     tag: resolvedTag,
     sourceSha,
     workflow,
+    adopterDelivery,
     kfdAdopter,
   });
   const bundledPublishEvidencePath = publishEvidenceMeta.value ? "evidence.json" : "";
@@ -1742,6 +1756,7 @@ export function collectGitHubReleasePassport({
     kfd1,
     kfd2Claims: kfd2ClaimMetas.map((meta) => meta.value),
     kfd3,
+    adopterDelivery,
     kfdAdopter,
     kfdAdopterManifestEvidencePath: kfdAdopter ? "kfd-adopter-manifest.json" : "",
     kfdAdopterGateEvidencePath: kfdAdopter ? "kfd-adopter-manifest-gate.json" : "",
@@ -2094,6 +2109,13 @@ function validateReleaseEvidenceContracts({
   validateContract(agentIndex, AGENT_INDEX_CONTRACT, "agentIndex", issues);
   validateContract(productMechanism, PRODUCT_MECHANISM_CONTRACT, "productMechanism", issues);
   validateKfdAgentHubReleaseEvidence(passport?.kfdAgentHub, kfdAgentHubEvidence, issues);
+  for (const entry of validateAdopterDeliveryReleaseEvidence({
+    binding: passport?.adopterDelivery,
+    artifactBinding: artifactEvidence?.adopterDelivery,
+    expectedProjectRepository: optionalString(passport?.product?.repository),
+  })) {
+    issues.push(issue("error", entry.code, entry.message, entry.details));
+  }
   for (const entry of validateKfdAdopterReleaseEvidence({
     binding: passport?.kfdAdopter,
     artifactBinding: artifactEvidence?.kfdAdopter,
@@ -2101,7 +2123,8 @@ function validateReleaseEvidenceContracts({
     manifestGate: kfdAdopterManifestGate,
     legacyProjection: kfdSupportEvidence,
     passportLegacyProjection: passport?.kfdSupport,
-    expectedSourceSha: optionalString(passport?.release?.sourceSha),
+    expectedAdopterId: optionalString(passport?.product?.repository) || "kungfu-systems/buildchain",
+    expectedSourceRepository: optionalString(passport?.product?.repository), expectedSourceSha: optionalString(passport?.release?.sourceSha),
   })) {
     issues.push(issue("error", entry.code, entry.message, entry.details));
   }
@@ -2650,6 +2673,7 @@ function buildReleaseCheckReport({
         ? passport.platformArtifactManifests.length
         : 0,
       distTagPromotionEvidencePresent: Boolean(passport?.distTagPromotion),
+      adopterDeliveryPresent: Boolean(passport?.adopterDelivery),
       impactPresent: Boolean(impact),
       agentIndexPresent: Boolean(agentIndex),
       productMechanismPresent: Boolean(productMechanism),