@kungfu-tech/buildchain 3.0.9-alpha.13 → 3.0.9-alpha.15

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.13",
+    "version": "3.0.9-alpha.15",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -684,7 +684,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:e60642aa298933d2c103284794921a6c340a50aa91ee528b06e58892a2a006bf",
-      "auditDigest": "sha256:9c9efb4fa3f6c75c25ebd6100ceaf4a4e3aea2e8f72d5eea118972a3d042731a",
+      "auditDigest": "sha256:7cb902bedd4f7bdf03bd8b9736e43cb105661046e7bed78eccef367e6f7caece",
       "compatibleBreakingDigests": [
         "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf"
       ],
@@ -4269,5 +4269,5 @@
   ],
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:57d37609068590238f547a133b6b69ee994b452825030447d20529683ba61fbd",
-  "contractDigest": "sha256:c74a89b3bd36d52b093259b43ecfaf776f8eb93edadf3417b61e7b668192a577"
+  "contractDigest": "sha256:5952e1766dc136a4c405efc5f50d5227cacfe89c151d5a6287b1744c2a90a53c"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-08-13T12:00:11.000Z",
-  "publishedAt": "2026-08-13T12:00:11.000Z",
+  "generatedAt": "2026-08-13T17:47:25.000Z",
+  "publishedAt": "2026-08-13T17:47:25.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "0052ce9b07f86ea3dd6eaf81e75ae1751ee79494",
+  "sourceRevision": "5e2d41bab6c50155bd407bd2d7558c174c44e66f",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.13",
+    "version": "3.0.9-alpha.15",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "a2fe19958218563d996e433a92ca680cc9e56040e28e9cfec4bae1743f21f62b",
+    "sha256": "a9d60e93977fa6a58d83afa111f0941ea2768dfbf396bf716e7aead28afa819e",
     "summary": {
       "cliCommandCount": 114,
       "workflowCount": 69,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "a2fe19958218563d996e433a92ca680cc9e56040e28e9cfec4bae1743f21f62b",
+      "sha256": "a9d60e93977fa6a58d83afa111f0941ea2768dfbf396bf716e7aead28afa819e",
       "summary": {
         "cliCommandCount": 114,
         "workflowCount": 69,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.13",
+    "version": "3.0.9-alpha.15",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/public-surface-audit.json

@@ -8351,7 +8351,7 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "613ca42d3fe36e953603221d1cf16478ba84e6cf27dd6d11ddb2c1caea42ec3b",
-    "workflowRegistryDigest": "0f5c0541b3784df88d2908aa88623e5adb48891bc2f9e701eac62785cfd1f600",
+    "workflowRegistryDigest": "9c6353b322571a7cd66408dbb751ba53d0e286eabd5a0dfb829c9f2a8e248c8e",
     "pageRegistryDigest": "278318ddd3f832a3681ff805eff19f9a1e3d7da382c62db10a8be663cdc99139"
   },
   "comparison": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-13T12:00:11.000Z",
-  "publishedAt": "2026-08-13T12:00:11.000Z",
+  "generatedAt": "2026-08-13T17:47:25.000Z",
+  "publishedAt": "2026-08-13T17:47:25.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "0052ce9b07f86ea3dd6eaf81e75ae1751ee79494",
+  "sourceRevision": "5e2d41bab6c50155bd407bd2d7558c174c44e66f",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.13",
+    "version": "3.0.9-alpha.15",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-13T12:00:11.000Z",
-  "publishedAt": "2026-08-13T12:00:11.000Z",
+  "generatedAt": "2026-08-13T17:47:25.000Z",
+  "publishedAt": "2026-08-13T17:47:25.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "0052ce9b07f86ea3dd6eaf81e75ae1751ee79494",
+  "sourceRevision": "5e2d41bab6c50155bd407bd2d7558c174c44e66f",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.13",
+    "version": "3.0.9-alpha.15",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -1970,7 +1970,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.13",
+      "introducedVersion": "3.0.9-alpha.15",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1991,7 +1991,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.13",
+      "introducedVersion": "3.0.9-alpha.15",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2012,7 +2012,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.13",
+      "introducedVersion": "3.0.9-alpha.15",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2062,7 +2062,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.13",
+      "introducedVersion": "3.0.9-alpha.15",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.9-alpha.13",
+  "version": "3.0.9-alpha.15",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/audit-publication-control-plane.mjs

@@ -10,18 +10,12 @@ import {
 } from "../packages/core/publication-control-plane-audit.js";
 
 const GITHUB_JSON_MAX_BUFFER = 16 * 1024 * 1024;
+const GITHUB_COMMAND_OPTIONS = Object.freeze({ encoding: "utf8", timeout: 60_000, maxBuffer: GITHUB_JSON_MAX_BUFFER });
 
-function flag(name, fallback = "") {
-  const index = process.argv.indexOf(`--${name}`);
-  return index === -1 ? fallback : String(process.argv[index + 1] || "");
-}
+function flag(name, fallback = "") { const index = process.argv.indexOf(`--${name}`); return index === -1 ? fallback : String(process.argv[index + 1] || ""); }
 
 function commandJson(command, args, label) {
-  const result = spawnSync(command, args, {
-    encoding: "utf8",
-    timeout: 60_000,
-    maxBuffer: GITHUB_JSON_MAX_BUFFER,
-  });
+  const result = spawnSync(command, args, GITHUB_COMMAND_OPTIONS);
   if (result.status !== 0) {
     const category = /401|E401|unauthorized/i.test(result.stderr) ? "unauthorized" : "unavailable";
     throw new Error(`${label} is ${category}; publication control-plane audit fails closed`);
@@ -33,16 +27,28 @@ function commandJson(command, args, label) {
   }
 }
 
-function githubJson(apiPath, label) {
-  return commandJson("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], label);
+function githubJson(apiPath, label) { return commandJson("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], label); }
+
+function exactWorkflowText({ repository, workflowPath, workflowRef }) {
+  const encodedWorkflow = workflowPath.split("/").map(encodeURIComponent).join("/");
+  try {
+    const workflowFile = githubJson(
+      `repos/${repository}/contents/${encodedWorkflow}${workflowRef ? `?ref=${encodeURIComponent(workflowRef)}` : ""}`,
+      "publication workflow source",
+    );
+    return Buffer.from(String(workflowFile.content || ""), "base64").toString("utf8");
+  } catch (error) {
+    if (!/^[0-9a-fA-F]{40}$/.test(workflowRef)) throw error;
+    const checkoutHead = spawnSync("git", ["rev-parse", "HEAD"], GITHUB_COMMAND_OPTIONS);
+    if (checkoutHead.status !== 0 || checkoutHead.stdout.trim().toLowerCase() !== workflowRef.toLowerCase()) throw error;
+    const localWorkflow = spawnSync("git", ["show", `${workflowRef}:${workflowPath}`], GITHUB_COMMAND_OPTIONS);
+    if (localWorkflow.status !== 0 || !localWorkflow.stdout) throw error;
+    return localWorkflow.stdout;
+  }
 }
 
 function githubJsonOptional(apiPath, label, fallback) {
-  const result = spawnSync("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], {
-    encoding: "utf8",
-    timeout: 60_000,
-    maxBuffer: GITHUB_JSON_MAX_BUFFER,
-  });
+  const result = spawnSync("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], GITHUB_COMMAND_OPTIONS);
   if (result.status !== 0) {
     if (/404|not found/i.test(`${result.stdout}\n${result.stderr}`)) return fallback;
     const category = /401|403|unauthorized|forbidden/i.test(`${result.stdout}\n${result.stderr}`) ? "unauthorized" : "unavailable";
@@ -56,11 +62,7 @@ function githubJsonOptional(apiPath, label, fallback) {
 }
 
 function githubJsonReadLimited(apiPath, label, fallback) {
-  const result = spawnSync("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], {
-    encoding: "utf8",
-    timeout: 60_000,
-    maxBuffer: GITHUB_JSON_MAX_BUFFER,
-  });
+  const result = spawnSync("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], GITHUB_COMMAND_OPTIONS);
   if (result.status !== 0) {
     if (/401|403|404|unauthorized|forbidden|not found/i.test(`${result.stdout}\n${result.stderr}`)) return fallback;
     throw new Error(`${label} is unavailable; publication control-plane audit fails closed`);
@@ -217,12 +219,11 @@ function main() {
   const allowReleaseReconciliation = process.argv.includes("--allow-release-reconciliation");
   if (!repository || !branch) throw new Error("--repository and --branch are required");
 
-  const encodedWorkflow = workflowPath.split("/").map(encodeURIComponent).join("/");
-  const workflowFile = githubJson(
-    `repos/${workflowRepository}/contents/${encodedWorkflow}${workflowRef ? `?ref=${encodeURIComponent(workflowRef)}` : ""}`,
-    "publication workflow source",
-  );
-  const workflowText = Buffer.from(String(workflowFile.content || ""), "base64").toString("utf8");
+  const workflowText = exactWorkflowText({
+    repository: workflowRepository,
+    workflowPath,
+    workflowRef,
+  });
   const block = jobBlock(workflowText, jobId);
   if (!block) throw new Error(`publication workflow job is missing: ${workflowPath}#${jobId}`);
   const jobsOffset = workflowText.search(/^jobs:\s*$/m);

package/scripts/auditable-demo-platform.mjs

@@ -7,7 +7,7 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { materializeDemoPresentation, validateDemoPresentation } from "./auditable-demo-presentation.mjs";
 import { copyVerifiedRegular, verifyBundleChecksums } from "./auditable-demo-bundle-verification.mjs";
-
+import { boundedLongFormFps, LONG_FORM_MAX_DURATION_MS } from "./auditable-demo-renditions.mjs";
 const DIGEST = /^sha256:[0-9a-f]{64}$/u;
 const SAFE_ID = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
 const SAFE_MARKER = /^[a-z0-9][a-z0-9._:-]{0,79}$/u;
@@ -26,7 +26,7 @@ const RENDITIONS = [
   { id: "720p", role: "responsive", columns: 150, rows: 28, width: 1280, height: 720 },
 ];
 const STANDARD_MAX_SECONDS = 60;
-const LONG_FORM_MAX_SECONDS = 360;
+const LONG_FORM_MAX_SECONDS = LONG_FORM_MAX_DURATION_MS / 1000;
 const PRESENTATION_FRAMED = "presentation-framed";
 const TERMINAL_FILL = "terminal-fill";
 const MAX_EXECUTABLE_FILES = 32;
@@ -305,7 +305,7 @@ function projection(capture, transcript, demo, rendition, durationClass, sharedC
     id: `${demo.id}-${rendition.id}`.slice(0, 64),
     width: rendition.width,
     height: rendition.height,
-    fps: policy.durationClass === "long-form" ? 10 : 15,
+    fps: policy.durationClass === "long-form" ? boundedLongFormFps(durationMs) : 15,
     ...(policy.durationClass === "long-form" ? { durationClass: "long-form" } : {}),
     compositionMode,
     durationMs,

package/scripts/auditable-demo-renditions.mjs

@@ -18,10 +18,17 @@ const RENDITION_SET_NON_AUTHORITIES = [
 ];
 const MAX_BUNDLE_MEMBER_BYTES = 8 * 1024 * 1024;
 export const MAX_LONG_FORM_RENDERER_MANIFEST_BYTES = 64 * 1024 * 1024;
+export const LONG_FORM_MAX_DURATION_MS = 360_000;
+export const LONG_FORM_MAX_FPS = 10;
+export const MAX_RENDER_FRAMES = 1_800;
 const PRESENTATION_FRAMED = "presentation-framed";
 const TERMINAL_FILL = "terminal-fill";
 const GEOMETRY_TOLERANCE = 0.001;
 
+export function boundedLongFormFps(durationMs) {
+  return Math.max(1, Math.min(LONG_FORM_MAX_FPS, Math.floor((MAX_RENDER_FRAMES * 1000) / durationMs)));
+}
+
 function closeEnough(left, right, tolerance = GEOMETRY_TOLERANCE) {
   return Number.isFinite(left) && Number.isFinite(right) && Math.abs(left - right) <= tolerance;
 }
@@ -238,10 +245,11 @@ function validateLongFormManifestRendition(entry, declaration, index, helpers) {
       && scene?.height === declaration.height
       && Number.isInteger(scene?.durationMs)
       && scene.durationMs >= 500
-      && scene.durationMs <= 180000
+      && scene.durationMs <= LONG_FORM_MAX_DURATION_MS
       && Number.isInteger(scene?.fps)
       && scene.fps >= 1
-      && scene.fps <= 10
+      && scene.fps <= LONG_FORM_MAX_FPS
+      && Math.ceil((scene.durationMs / 1000) * scene.fps) <= MAX_RENDER_FRAMES
       && capture?.schema === "kungfu.terminal-capture/v1"
       && digestPattern.test(capture?.root)
       && Number.isInteger(capture?.durationMs)
@@ -293,7 +301,7 @@ export function validateTerminalCapture(value, scene, helpers) {
   exactKeys(value.dimensions, ["columns", "rows"], [], "terminalCapture.dimensions");
   integer(value.dimensions.columns, 80, 200, "terminalCapture.dimensions.columns");
   integer(value.dimensions.rows, 24, 80, "terminalCapture.dimensions.rows");
-  const maximumDurationMs = scene.durationClass === "long-form" ? 180000 : 60000;
+  const maximumDurationMs = scene.durationClass === "long-form" ? LONG_FORM_MAX_DURATION_MS : 60000;
   const durationMs = integer(value.durationMs, 500, maximumDurationMs, "terminalCapture.durationMs");
   invariant(
     durationMs <= scene.durationMs && scene.durationMs - durationMs <= 2000,

package/scripts/auditable-demo.mjs

@@ -7,7 +7,16 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { MAX_LONG_FORM_RENDERER_MANIFEST_BYTES, readRendererManifest, validateRendererCompositionInputs, validateRenditionSet, validateTerminalCapture } from "./auditable-demo-renditions.mjs";
+import {
+  LONG_FORM_MAX_DURATION_MS,
+  LONG_FORM_MAX_FPS,
+  MAX_LONG_FORM_RENDERER_MANIFEST_BYTES,
+  MAX_RENDER_FRAMES,
+  readRendererManifest,
+  validateRendererCompositionInputs,
+  validateRenditionSet,
+  validateTerminalCapture,
+} from "./auditable-demo-renditions.mjs";
 
 const UTF8 = new TextDecoder("utf-8", { fatal: true });
 const IMAGE_PATTERN = /^[a-z0-9][a-z0-9./_-]*@sha256:[0-9a-f]{64}$/;
@@ -34,9 +43,6 @@ const OPTIONAL_ADAPTER_FILES = [
 const MAX_TERMINAL_CAPTURE_BYTES = 4 * 1024 * 1024;
 const MAX_TERMINAL_CAPTURE_EVENTS = 10_000;
 const STANDARD_MAX_DURATION_MS = 60_000;
-const LONG_FORM_MAX_DURATION_MS = 180_000;
-const LONG_FORM_MAX_FPS = 10;
-const MAX_RENDER_FRAMES = 1_800;
 
 function invariant(condition, message) {
   if (!condition) throw new Error(message);