@kungfu-tech/buildchain 3.0.9-alpha.6 → 3.0.9-alpha.7

package/dist/site/public-surface-audit.json

@@ -8123,8 +8123,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "2db0002dc06d97c6ab975f3ba395d23a0c6d7fe2796ded9852a7a127e52637cd",
-    "workflowRegistryDigest": "c088fe6df30d1c4c1b1bf3d3d483074814dfd68811c0d8c9cac2ae0cc37e2bf0",
-    "pageRegistryDigest": "7ae6094713bb4f601df84367c0e681fae2df68681ffa299c0e634626b44e5245"
+    "workflowRegistryDigest": "14fa5b4a29f03f337f1502bd852771d72a1c7af25684ef23c3b5be990f748acf",
+    "pageRegistryDigest": "f8cbbdc8e411ef8c753107476adebf7d6e69b83089c7a7e814cbe47c5b7f0a95"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-11T19:43:47.000Z",
-  "publishedAt": "2026-08-11T19:43:47.000Z",
+  "generatedAt": "2026-08-12T01:33:49.000Z",
+  "publishedAt": "2026-08-12T01:33:49.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "c05d3c359fc356f8ab5dfbeffa35a2059e254c46",
+  "sourceRevision": "1080aeadc49281f991bde9a0b53dc399242702ff",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.6",
+    "version": "3.0.9-alpha.7",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-11T19:43:47.000Z",
-  "publishedAt": "2026-08-11T19:43:47.000Z",
+  "generatedAt": "2026-08-12T01:33:49.000Z",
+  "publishedAt": "2026-08-12T01:33:49.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "c05d3c359fc356f8ab5dfbeffa35a2059e254c46",
+  "sourceRevision": "1080aeadc49281f991bde9a0b53dc399242702ff",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.6",
+    "version": "3.0.9-alpha.7",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:4663cf32a0116a8605e7b8a475fc4b38e02b81ca21af59e49be0043f3eb99a02"
+      "digest": "sha256:37102c168f1eb23f2e9d5a86a4e2df366a755ef102626088232c8599d9cdf91e"
     },
     {
       "id": "build-facts",

package/dist/site/workflow-registry.json

@@ -1967,7 +1967,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.6",
+      "introducedVersion": "3.0.9-alpha.7",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -1988,7 +1988,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.6",
+      "introducedVersion": "3.0.9-alpha.7",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2009,7 +2009,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.6",
+      "introducedVersion": "3.0.9-alpha.7",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2059,7 +2059,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "3.0.9-alpha.6",
+      "introducedVersion": "3.0.9-alpha.7",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -343,6 +343,11 @@ JIT SecureString under `/kungfu/burst/macos/`, then runs GitHub Actions Runner
 2.336.0 for exactly one job. The runner archive is pinned to the official
 macOS ARM64 SHA256. No GitHub, signing, notarization, publication, SSH, or
 static AWS credential is admitted to the instance.
+The provider provenance step explicitly disables artifact-signing request
+sealing for these qualification jobs, so consumer signing declarations cannot
+turn a runner-profile smoke or full qualification into a signing-authority
+dispatch. All other Buildchain lanes retain the default fail-closed signing
+declaration behavior.
 
 The instance uses the exact retained Amazon EC2 macOS AMI, IMDSv2, an encrypted
 delete-on-termination root volume, no inbound security-group rule, and the

package/docs/node-api-reference.md

@@ -164,7 +164,7 @@ Target: `./packages/core/index.js`. Public symbols: 608.
 | `computeConsumerIssueFingerprint` | function: function computeConsumerIssueFingerprint(fields = {}) | fields = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { computeConsumerIssueFingerprint } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:64` |
 | `CONSUMER_PUBLICATION_DECISION_CONTRACT` | constant: const CONSUMER_PUBLICATION_DECISION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { CONSUMER_PUBLICATION_DECISION_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:20` |
 | `consumerIssueMarker` | function: function consumerIssueMarker(fingerprint) | fingerprint | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { consumerIssueMarker } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:76` |
-| `contractSummary` | function: function contractSummary(contractWorld, runtimeRef = "", runtimeSha = "") | contractWorld, runtimeRef = "", runtimeSha = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { contractSummary } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-compatibility-proof.js:360` |
+| `contractSummary` | function: function contractSummary(contractWorld, runtimeRef = "", runtimeSha = "") | contractWorld, runtimeRef = "", runtimeSha = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { contractSummary } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-compatibility-proof.js:382` |
 | `controllerEvidenceDigest` | function: function controllerEvidenceDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { controllerEvidenceDigest } from "@kungfu-tech/buildchain";` | `packages/core/controller-evidence.js:152` |
 | `createActivationReceiptProjectorAdapter` | function: function createActivationReceiptProjectorAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createActivationReceiptProjectorAdapter } from "@kungfu-tech/buildchain";` | `packages/core/release-tail-provider-adapters.js:181` |
 | `createAnchoredVersionMaterialEvidence` | function: function createAnchoredVersionMaterialEvidence({ cwd = process.cwd(), targetChannel = "", targetRef = "", alphaRef = "", releaseRef = "HEAD", runLifecycle = true, } = {}) | { cwd = process.cwd(), targetChannel = "", targetRef = "", alphaRef = "", releaseRef = "HEAD", runLifecycle = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createAnchoredVersionMaterialEvidence } from "@kungfu-tech/buildchain";` | `packages/core/anchored-version-material.js:118` |
@@ -280,7 +280,7 @@ Target: `./packages/core/index.js`. Public symbols: 608.
 | `enumerateDocCommandRefs` | function: function enumerateDocCommandRefs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateDocCommandRefs } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:115` |
 | `enumerateSitePages` | function: function enumerateSitePages({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateSitePages } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:106` |
 | `enumerateWorkflowInputs` | function: function enumerateWorkflowInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateWorkflowInputs } from "@kungfu-tech/buildchain";` | `packages/core/public-surface-audit.js:74` |
-| `evaluateBuildchainContractLock` | function: function evaluateBuildchainContractLock({ lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {}) | { lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateBuildchainContractLock } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-compatibility-proof.js:454` |
+| `evaluateBuildchainContractLock` | function: function evaluateBuildchainContractLock({ lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {}) | { lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateBuildchainContractLock } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-compatibility-proof.js:476` |
 | `evaluateCodeownersAuthority` | function: function evaluateCodeownersAuthority({ source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {}) | { source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateCodeownersAuthority } from "@kungfu-tech/buildchain";` | `packages/core/github-governance-authority.js:425` |
 | `evaluateGithubGovernanceSnapshot` | function: function evaluateGithubGovernanceSnapshot({ descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {}) | { descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateGithubGovernanceSnapshot } from "@kungfu-tech/buildchain";` | `packages/core/github-governance-authority.js:694` |
 | `evaluateKfdProductGate` | function: async function evaluateKfdProductGate({ cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateKfdProductGate } from "@kungfu-tech/buildchain";` | `packages/core/kfd-product-gates.js:419` |
@@ -519,7 +519,7 @@ Target: `./packages/core/index.js`. Public symbols: 608.
 | `releaseTailRoot` | function: function releaseTailRoot(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { releaseTailRoot } from "@kungfu-tech/buildchain";` | `packages/core/release-tail-provider-plane.js:164` |
 | `releaseTailStableJson` | function: function releaseTailStableJson(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { releaseTailStableJson } from "@kungfu-tech/buildchain";` | `packages/core/release-tail-provider-plane.js:149` |
 | `renderBadgeBundleBlock` | function: function renderBadgeBundleBlock(facts) | facts | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBadgeBundleBlock } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:840` |
-| `renderBuildchainContractDriftIssueBody` | function: function renderBuildchainContractDriftIssueBody({ repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {}) | { repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBuildchainContractDriftIssueBody } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-compatibility-proof.js:592` |
+| `renderBuildchainContractDriftIssueBody` | function: function renderBuildchainContractDriftIssueBody({ repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {}) | { repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBuildchainContractDriftIssueBody } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-compatibility-proof.js:614` |
 | `renderHomebrewFormula` | function: function renderHomebrewFormula(facts) | facts | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { renderHomebrewFormula } from "@kungfu-tech/buildchain";` | `packages/core/homebrew.js:290` |
 | `renderKfd2ProductClaimOutputs` | function: function renderKfd2ProductClaimOutputs({ cwd = process.cwd(), registryPath = BUILDCHAIN_KFD2_REGISTRY_PATH, outputDir = BUILDCHAIN_KFD2_DIR, version = "", channel = "", tag = "", sourceSha = "", } = {}) | { cwd = process.cwd(), registryPath = BUILDCHAIN_KFD2_REGISTRY_PATH, outputDir = BUILDCHAIN_KFD2_DIR, version = "", channel = "", tag = "", sourceSha = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { renderKfd2ProductClaimOutputs } from "@kungfu-tech/buildchain";` | `packages/core/kfd2-product-claims.js:321` |
 | `renderReadmeBadgeBlock` | function: function renderReadmeBadgeBlock(facts) | facts | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderReadmeBadgeBlock } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:836` |
@@ -825,7 +825,7 @@ Target: `./packages/core/index.js`. Public symbols: 608.
 | `computeConsumerIssueFingerprint` | function: function computeConsumerIssueFingerprint(fields = {}) | fields = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { computeConsumerIssueFingerprint } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:64` |
 | `CONSUMER_PUBLICATION_DECISION_CONTRACT` | constant: const CONSUMER_PUBLICATION_DECISION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { CONSUMER_PUBLICATION_DECISION_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:20` |
 | `consumerIssueMarker` | function: function consumerIssueMarker(fingerprint) | fingerprint | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { consumerIssueMarker } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:76` |
-| `contractSummary` | function: function contractSummary(contractWorld, runtimeRef = "", runtimeSha = "") | contractWorld, runtimeRef = "", runtimeSha = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { contractSummary } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-compatibility-proof.js:360` |
+| `contractSummary` | function: function contractSummary(contractWorld, runtimeRef = "", runtimeSha = "") | contractWorld, runtimeRef = "", runtimeSha = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { contractSummary } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-compatibility-proof.js:382` |
 | `controllerEvidenceDigest` | function: function controllerEvidenceDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { controllerEvidenceDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/controller-evidence.js:152` |
 | `createActivationReceiptProjectorAdapter` | function: function createActivationReceiptProjectorAdapter(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createActivationReceiptProjectorAdapter } from "@kungfu-tech/buildchain/core";` | `packages/core/release-tail-provider-adapters.js:181` |
 | `createAnchoredVersionMaterialEvidence` | function: function createAnchoredVersionMaterialEvidence({ cwd = process.cwd(), targetChannel = "", targetRef = "", alphaRef = "", releaseRef = "HEAD", runLifecycle = true, } = {}) | { cwd = process.cwd(), targetChannel = "", targetRef = "", alphaRef = "", releaseRef = "HEAD", runLifecycle = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createAnchoredVersionMaterialEvidence } from "@kungfu-tech/buildchain/core";` | `packages/core/anchored-version-material.js:118` |
@@ -941,7 +941,7 @@ Target: `./packages/core/index.js`. Public symbols: 608.
 | `enumerateDocCommandRefs` | function: function enumerateDocCommandRefs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateDocCommandRefs } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:115` |
 | `enumerateSitePages` | function: function enumerateSitePages({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateSitePages } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:106` |
 | `enumerateWorkflowInputs` | function: function enumerateWorkflowInputs({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { enumerateWorkflowInputs } from "@kungfu-tech/buildchain/core";` | `packages/core/public-surface-audit.js:74` |
-| `evaluateBuildchainContractLock` | function: function evaluateBuildchainContractLock({ lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {}) | { lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateBuildchainContractLock } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-compatibility-proof.js:454` |
+| `evaluateBuildchainContractLock` | function: function evaluateBuildchainContractLock({ lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {}) | { lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateBuildchainContractLock } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-compatibility-proof.js:476` |
 | `evaluateCodeownersAuthority` | function: function evaluateCodeownersAuthority({ source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {}) | { source = "", sourcePath = "", reviewAuthority = "kungfu-origin", protectedPaths = PROTECTED_AUTHORITY_PATHS, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateCodeownersAuthority } from "@kungfu-tech/buildchain/core";` | `packages/core/github-governance-authority.js:425` |
 | `evaluateGithubGovernanceSnapshot` | function: function evaluateGithubGovernanceSnapshot({ descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {}) | { descriptor = createBuildchainGithubGovernanceAuthority(), repository, targetRef, organizationPlan, codeowners, effectivePolicy, memberships, apiEvidence = {}, observedAt, expiresAt, verifier = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateGithubGovernanceSnapshot } from "@kungfu-tech/buildchain/core";` | `packages/core/github-governance-authority.js:694` |
 | `evaluateKfdProductGate` | function: async function evaluateKfdProductGate({ cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { cwd = process.cwd(), input, expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateKfdProductGate } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd-product-gates.js:419` |
@@ -1180,7 +1180,7 @@ Target: `./packages/core/index.js`. Public symbols: 608.
 | `releaseTailRoot` | function: function releaseTailRoot(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { releaseTailRoot } from "@kungfu-tech/buildchain/core";` | `packages/core/release-tail-provider-plane.js:164` |
 | `releaseTailStableJson` | function: function releaseTailStableJson(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { releaseTailStableJson } from "@kungfu-tech/buildchain/core";` | `packages/core/release-tail-provider-plane.js:149` |
 | `renderBadgeBundleBlock` | function: function renderBadgeBundleBlock(facts) | facts | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBadgeBundleBlock } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:840` |
-| `renderBuildchainContractDriftIssueBody` | function: function renderBuildchainContractDriftIssueBody({ repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {}) | { repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBuildchainContractDriftIssueBody } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-compatibility-proof.js:592` |
+| `renderBuildchainContractDriftIssueBody` | function: function renderBuildchainContractDriftIssueBody({ repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {}) | { repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBuildchainContractDriftIssueBody } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-compatibility-proof.js:614` |
 | `renderHomebrewFormula` | function: function renderHomebrewFormula(facts) | facts | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { renderHomebrewFormula } from "@kungfu-tech/buildchain/core";` | `packages/core/homebrew.js:290` |
 | `renderKfd2ProductClaimOutputs` | function: function renderKfd2ProductClaimOutputs({ cwd = process.cwd(), registryPath = BUILDCHAIN_KFD2_REGISTRY_PATH, outputDir = BUILDCHAIN_KFD2_DIR, version = "", channel = "", tag = "", sourceSha = "", } = {}) | { cwd = process.cwd(), registryPath = BUILDCHAIN_KFD2_REGISTRY_PATH, outputDir = BUILDCHAIN_KFD2_DIR, version = "", channel = "", tag = "", sourceSha = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { renderKfd2ProductClaimOutputs } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd2-product-claims.js:321` |
 | `renderReadmeBadgeBlock` | function: function renderReadmeBadgeBlock(facts) | facts | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderReadmeBadgeBlock } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:836` |
@@ -1412,32 +1412,32 @@ Target: `./packages/core/buildchain-contract.js`. Public symbols: 26.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `assertBuildchainCompatibilityProjection` | function: function assertBuildchainCompatibilityProjection(contractWorld) | contractWorld | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { assertBuildchainCompatibilityProjection } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:277` |
+| `assertBuildchainCompatibilityProjection` | function: function assertBuildchainCompatibilityProjection(contractWorld) | contractWorld | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { assertBuildchainCompatibilityProjection } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:299` |
 | `BUILDCHAIN_CHANNELS` | constant: const BUILDCHAIN_CHANNELS | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_CHANNELS } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-channel-identity.js:8` |
 | `BUILDCHAIN_COMPATIBILITY_PROOF_REGISTRY_SCHEMA` | constant: const BUILDCHAIN_COMPATIBILITY_PROOF_REGISTRY_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_COMPATIBILITY_PROOF_REGISTRY_SCHEMA } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:13` |
 | `BUILDCHAIN_COMPATIBILITY_PROOF_SCHEMA` | constant: const BUILDCHAIN_COMPATIBILITY_PROOF_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_COMPATIBILITY_PROOF_SCHEMA } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:12` |
 | `BUILDCHAIN_COMPATIBILITY_VERIFICATION_RECEIPT_SCHEMA` | constant: const BUILDCHAIN_COMPATIBILITY_VERIFICATION_RECEIPT_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_COMPATIBILITY_VERIFICATION_RECEIPT_SCHEMA } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:14` |
 | `BUILDCHAIN_CONTRACT_LOCK` | constant: const BUILDCHAIN_CONTRACT_LOCK | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_CONTRACT_LOCK } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-contract.js:36` |
 | `BUILDCHAIN_RUNTIME_CONTRACT_WORLD` | constant: const BUILDCHAIN_RUNTIME_CONTRACT_WORLD | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_RUNTIME_CONTRACT_WORLD } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-contract.js:35` |
-| `contractSummary` | function: function contractSummary(contractWorld, runtimeRef = "", runtimeSha = "") | contractWorld, runtimeRef = "", runtimeSha = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { contractSummary } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:360` |
-| `createBuildchainCompatibilityProof` | function: function createBuildchainCompatibilityProof(input = {}) | input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createBuildchainCompatibilityProof } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:158` |
-| `createBuildchainCompatibilityProofRegistry` | function: function createBuildchainCompatibilityProofRegistry({ proofs = createHistoricalBuildchainCompatibilityProofs(), surfaces = [], majorLine = "" } = {}) | { proofs = createHistoricalBuildchainCompatibilityProofs(), surfaces = [], majorLine = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createBuildchainCompatibilityProofRegistry } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:253` |
-| `createBuildchainCompatibilityVerificationReceipt` | function: function createBuildchainCompatibilityVerificationReceipt(input = {}) | input = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainCompatibilityVerificationReceipt } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:323` |
+| `contractSummary` | function: function contractSummary(contractWorld, runtimeRef = "", runtimeSha = "") | contractWorld, runtimeRef = "", runtimeSha = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { contractSummary } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:382` |
+| `createBuildchainCompatibilityProof` | function: function createBuildchainCompatibilityProof(input = {}) | input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createBuildchainCompatibilityProof } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:180` |
+| `createBuildchainCompatibilityProofRegistry` | function: function createBuildchainCompatibilityProofRegistry({ proofs = createHistoricalBuildchainCompatibilityProofs(), surfaces = [], majorLine = "" } = {}) | { proofs = createHistoricalBuildchainCompatibilityProofs(), surfaces = [], majorLine = "" } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createBuildchainCompatibilityProofRegistry } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:275` |
+| `createBuildchainCompatibilityVerificationReceipt` | function: function createBuildchainCompatibilityVerificationReceipt(input = {}) | input = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainCompatibilityVerificationReceipt } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:345` |
 | `createBuildchainContractLock` | function: function createBuildchainContractLock({ buildchainRef = "v3", resolvedSha = "", contractWorld, compatibilityPolicy = DEFAULT_POLICY, acceptedAt = new Date().toISOString(), } = {}) | { buildchainRef = "v3", resolvedSha = "", contractWorld, compatibilityPolicy = DEFAULT_POLICY, acceptedAt = new Date().toISOString(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createBuildchainContractLock } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-contract.js:846` |
 | `createBuildchainContractWorld` | function: function createBuildchainContractWorld({ root = process.cwd(), packageJson = undefined, controllerRegistry = undefined, } = {}) | { root = process.cwd(), packageJson = undefined, controllerRegistry = undefined, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainContractWorld } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-contract.js:137` |
-| `createHistoricalBuildchainCompatibilityProofs` | function: function createHistoricalBuildchainCompatibilityProofs() | none | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createHistoricalBuildchainCompatibilityProofs } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:230` |
+| `createHistoricalBuildchainCompatibilityProofs` | function: function createHistoricalBuildchainCompatibilityProofs() | none | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createHistoricalBuildchainCompatibilityProofs } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:252` |
 | `evaluateBuildchainChannelBinding` | function: function evaluateBuildchainChannelBinding({ workflowShellRef = "", runtimeRef = "", lockRef = "", lockMajorLine = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false } = {}) | { workflowShellRef = "", runtimeRef = "", lockRef = "", lockMajorLine = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { evaluateBuildchainChannelBinding } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-channel-identity.js:97` |
-| `evaluateBuildchainContractLock` | function: function evaluateBuildchainContractLock({ lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {}) | { lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateBuildchainContractLock } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:454` |
+| `evaluateBuildchainContractLock` | function: function evaluateBuildchainContractLock({ lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {}) | { lock, current, runtimeRef = "", runtimeSha = "", runtimeClass = "", compatibilityPolicy = "", workflowShellRef = "", expectedChannel = "", expectedMajor = "", allowOpaqueRuntime = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { evaluateBuildchainContractLock } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:476` |
 | `finalizeBuildchainContractWorld` | function: function finalizeBuildchainContractWorld(contractWorld) | contractWorld | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { finalizeBuildchainContractWorld } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-contract.js:801` |
 | `normalizeBuildchainRef` | function: function normalizeBuildchainRef(ref = "") | ref = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { normalizeBuildchainRef } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-channel-identity.js:10` |
 | `parseBuildchainRefIdentity` | function: function parseBuildchainRefIdentity(ref = "") | ref = "" | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { parseBuildchainRefIdentity } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-channel-identity.js:16` |
 | `readBuildchainContractLock` | function: function readBuildchainContractLock(filePath) | filePath | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { readBuildchainContractLock } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-contract.js:900` |
 | `readBuildchainContractWorld` | function: function readBuildchainContractWorld(filePath) | filePath | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { readBuildchainContractWorld } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-contract.js:879` |
-| `renderBuildchainContractDriftIssueBody` | function: function renderBuildchainContractDriftIssueBody({ repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {}) | { repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBuildchainContractDriftIssueBody } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:592` |
+| `renderBuildchainContractDriftIssueBody` | function: function renderBuildchainContractDriftIssueBody({ repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {}) | { repository = "", workflow = "", runUrl = "", lockPath = "", evaluation } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { renderBuildchainContractDriftIssueBody } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:614` |
 | `sha256File` | function: function sha256File(filePath) | filePath | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { sha256File } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-contract.js:61` |
 | `sha256Json` | function: function sha256Json(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { sha256Json } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-contract.js:57` |
-| `verifyBuildchainCompatibilityProof` | function: function verifyBuildchainCompatibilityProof(proofInput, expected = {}) | proofInput, expected = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyBuildchainCompatibilityProof } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:206` |
-| `verifyBuildchainCompatibilityVerificationReceipt` | function: function verifyBuildchainCompatibilityVerificationReceipt(receiptInput) | receiptInput | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyBuildchainCompatibilityVerificationReceipt } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:347` |
+| `verifyBuildchainCompatibilityProof` | function: function verifyBuildchainCompatibilityProof(proofInput, expected = {}) | proofInput, expected = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyBuildchainCompatibilityProof } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:228` |
+| `verifyBuildchainCompatibilityVerificationReceipt` | function: function verifyBuildchainCompatibilityVerificationReceipt(receiptInput) | receiptInput | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyBuildchainCompatibilityVerificationReceipt } from "@kungfu-tech/buildchain/buildchain-contract";` | `packages/core/buildchain-compatibility-proof.js:369` |
 
 ## `@kungfu-tech/buildchain/candidate-timeline`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.9-alpha.6",
+  "version": "3.0.9-alpha.7",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-compatibility-proof.js

@@ -110,6 +110,28 @@ const HISTORICAL_ACCEPTANCES = [
       compatibilityDigest: "sha256:32a651504c57829085dc8863f0e41dee98eb60708ff6dec958c9c7e4b1010102",
     },
   },
+  {
+    proofId: "build-channel-router-d40dd0-to-30549a",
+    surfaceId: "controller:build-channel-router",
+    surfaceKind: "controller",
+    sourceBreakingDigest: "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
+    targetBreakingDigest: "sha256:30549aa26cd1e1dd81f10fe3529d3c6e3f8438a6efa0100c47ebae4d2f3d71df",
+    evidence: {
+      kind: "protected-pull-request-contract-acceptance",
+      pullRequest: "https://github.com/kungfu-systems/buildchain/pull/2549",
+      protectedBase: "dev/v3/v3.0",
+      sourceCommit: "0d87b772265066f5e6157e1ba6a2ba1021fb5225",
+      mergeCommit: "34fad9d3a94c450d75c0d06fd6ed00470c992ff7",
+      contractDigest: "sha256:2584ba36ab54cd5e9bab9e34dfc08d87a55dc57de1be7641492bf7ceb1366350",
+      compatibilityDigest: "sha256:80f65cc191b1f771475184edf8a1bf9c10dd69bb58060aa09313d0e1e57f508a",
+    },
+    cut: {
+      kind: "protected-git-cut",
+      repository: "kungfu-systems/buildchain",
+      protectedBase: "dev/v3/v3.0",
+      commit: "34fad9d3a94c450d75c0d06fd6ed00470c992ff7",
+    },
+  },
 ];
 
 function exactText(value, label) {

package/scripts/aws-macos-jit-controller-core.mjs

@@ -101,6 +101,20 @@ function preflightFailureRunIds(value) {
   return [...normalized].sort((left, right) => Number(left) - Number(right));
 }
 
+function successfulRunIds(value) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value)) {
+    throw new Error("successfulRunIds must be an array");
+  }
+  const normalized = value.map((entry) =>
+    exact(entry, /^[1-9]\d*$/, "successfulRunId"),
+  );
+  if (new Set(normalized).size !== normalized.length) {
+    throw new Error("successfulRunIds must be unique");
+  }
+  return [...normalized].sort((left, right) => Number(left) - Number(right));
+}
+
 function startupFailureRuns(value) {
   if (value === undefined) return [];
   if (!Array.isArray(value)) {
@@ -139,6 +153,25 @@ function historicalTerminalFailureRuns(value) {
   );
 }
 
+function historicalPreflightFailureRuns(value) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value)) {
+    throw new Error("historicalPreflightFailureRuns must be an array");
+  }
+  const normalized = value.map((entry) => ({
+    runId: exact(entry?.runId, /^[1-9]\d*$/, "historicalPreflightFailureRunId"),
+    sourceSha: exactSha(entry?.sourceSha),
+  }));
+  if (
+    new Set(normalized.map(({ runId }) => runId)).size !== normalized.length
+  ) {
+    throw new Error("historicalPreflightFailureRuns must use unique run ids");
+  }
+  return [...normalized].sort(
+    (left, right) => Number(left.runId) - Number(right.runId),
+  );
+}
+
 function commonAws(values) {
   const region = exact(
     values.region || MACOS_EC2_JIT.region,
@@ -386,6 +419,10 @@ export function createMacosJitSourceRebindPlan(values = {}) {
   const historicalTerminalRuns = historicalTerminalFailureRuns(
     values.historicalTerminalFailureRuns,
   );
+  const historicalPreflightRuns = historicalPreflightFailureRuns(
+    values.historicalPreflightFailureRuns,
+  );
+  const successfulRuns = successfulRunIds(values.successfulRunIds);
   if (priorRunPolicy === "unused" && startupRuns.length !== 0) {
     throw new Error("startupFailureRuns require a failed priorRunPolicy");
   }
@@ -394,6 +431,14 @@ export function createMacosJitSourceRebindPlan(values = {}) {
       "historicalTerminalFailureRuns require a failed priorRunPolicy",
     );
   }
+  if (priorRunPolicy === "unused" && historicalPreflightRuns.length !== 0) {
+    throw new Error(
+      "historicalPreflightFailureRuns require a failed priorRunPolicy",
+    );
+  }
+  if (priorRunPolicy === "unused" && successfulRuns.length !== 0) {
+    throw new Error("successfulRunIds require a failed priorRunPolicy");
+  }
   const plan = {
     schemaVersion: 1,
     contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
@@ -413,6 +458,8 @@ export function createMacosJitSourceRebindPlan(values = {}) {
       preflightFailureRunIds: preflightRunIds,
       startupFailureRuns: startupRuns,
       historicalTerminalFailureRuns: historicalTerminalRuns,
+      historicalPreflightFailureRuns: historicalPreflightRuns,
+      successfulRunIds: successfulRuns,
     },
     aws: {
       ...aws,
@@ -433,6 +480,9 @@ export function createMacosJitSourceRebindPlan(values = {}) {
       startupFailureEvidencePreserved: startupRuns.length !== 0,
       historicalTerminalFailureEvidencePreserved:
         historicalTerminalRuns.length !== 0,
+      historicalPreflightFailureEvidencePreserved:
+        historicalPreflightRuns.length !== 0,
+      successfulRunEvidencePreserved: successfulRuns.length !== 0,
       zeroJitResidueRequired: true,
       zeroEvidenceRequired: true,
       exactCampaignResourcesRequired: true,

package/scripts/aws-macos-jit-controller.mjs

@@ -508,6 +508,20 @@ function commonValues(execute) {
   };
 }
 
+function confirmHistoricalPreflightFailures(plan) {
+  const confirmed = flag("confirm-historical-preflight-failure-runs-json")
+    ? jsonArrayArg("confirm-historical-preflight-failure-runs-json")
+    : [];
+  if (
+    JSON.stringify(confirmed) !==
+    JSON.stringify(plan.github.historicalPreflightFailureRuns)
+  ) {
+    throw new Error(
+      "--confirm-historical-preflight-failure-runs-json must equal the exact historical preflight failure inventory",
+    );
+  }
+}
+
 function confirm(plan) {
   if (arg("confirm-source-sha") !== plan.source.sha) {
     throw new Error("--confirm-source-sha must equal the exact source SHA");
@@ -566,6 +580,17 @@ function confirm(plan) {
           "--confirm-historical-terminal-failure-runs-json must equal the exact historical terminal failure inventory",
         );
       }
+      const confirmedSuccessfulRuns = flag("confirm-successful-run-ids-json")
+        ? jsonArrayArg("confirm-successful-run-ids-json").map(String)
+        : [];
+      if (
+        JSON.stringify(confirmedSuccessfulRuns) !==
+        JSON.stringify(plan.github.successfulRunIds)
+      ) {
+        throw new Error(
+          "--confirm-successful-run-ids-json must equal the exact successful run inventory",
+        );
+      }
     } else if (plan.github.priorRunPolicy === "preflight-failure") {
       const confirmed = jsonArrayArg(
         "confirm-preflight-failure-run-ids-json",
@@ -602,7 +627,19 @@ function confirm(plan) {
           "--confirm-historical-terminal-failure-runs-json must equal the exact historical terminal failure inventory",
         );
       }
+      const confirmedSuccessfulRuns = flag("confirm-successful-run-ids-json")
+        ? jsonArrayArg("confirm-successful-run-ids-json").map(String)
+        : [];
+      if (
+        JSON.stringify(confirmedSuccessfulRuns) !==
+        JSON.stringify(plan.github.successfulRunIds)
+      ) {
+        throw new Error(
+          "--confirm-successful-run-ids-json must equal the exact successful run inventory",
+        );
+      }
     }
+    confirmHistoricalPreflightFailures(plan);
   }
   if (plan.kind === "instance-rehydrate-plan") {
     if (arg("confirm-host-id") !== plan.aws.hostId) {
@@ -696,6 +733,16 @@ export function main() {
         flag("historical-terminal-failure-runs-json")
           ? jsonArrayArg("historical-terminal-failure-runs-json")
           : [],
+      historicalPreflightFailureRuns:
+        (afterFailure || afterPreflightFailure) &&
+        flag("historical-preflight-failure-runs-json")
+          ? jsonArrayArg("historical-preflight-failure-runs-json")
+          : [],
+      successfulRunIds:
+        (afterFailure || afterPreflightFailure) &&
+        flag("successful-run-ids-json")
+          ? jsonArrayArg("successful-run-ids-json")
+          : [],
     });
     return emit(plan, mode, execute, () =>
       executeMacosJitSourceRebind(plan, { profile: arg("aws-profile") }),

package/scripts/aws-macos-jit-source-rebind.mjs

@@ -89,6 +89,20 @@ function assertExactStartupFailure(run, jobCount, artifactCount) {
   }
 }
 
+function assertExactSuccessfulRun(run, jobs, jobCount, artifactCount) {
+  if (
+    run.status !== "completed" ||
+    run.conclusion !== "success" ||
+    jobCount === 0 ||
+    artifactCount === 0 ||
+    (jobs.jobs || []).some((job) => job.status !== "completed")
+  ) {
+    throw new Error(
+      `macOS campaign run ${run.id} is not a terminal successful run with retained evidence`,
+    );
+  }
+}
+
 function classifyCampaignRun(plan, run) {
   const startupFailure = plan.github.startupFailureRuns.find(
     ({ runId }) => runId === String(run.id),
@@ -97,23 +111,35 @@ function classifyCampaignRun(plan, run) {
     plan.github.historicalTerminalFailureRuns.find(
       ({ runId }) => runId === String(run.id),
     );
+  const historicalPreflightFailure =
+    plan.github.historicalPreflightFailureRuns.find(
+      ({ runId }) => runId === String(run.id),
+    );
   const preflightFailure = plan.github.preflightFailureRunIds.includes(
     String(run.id),
   );
+  const successfulRun = plan.github.successfulRunIds.includes(String(run.id));
   return {
     startupFailure,
     historicalTerminalFailure,
+    historicalPreflightFailure,
+    successfulRun,
     expectedSourceSha:
       startupFailure?.sourceSha ||
       historicalTerminalFailure?.sourceSha ||
+      historicalPreflightFailure?.sourceSha ||
       plan.previousSource.sha,
     classification: startupFailure
       ? "startup-failure"
       : historicalTerminalFailure
         ? "historical-terminal-failure"
-        : preflightFailure
-          ? "preflight-failure"
-          : plan.github.priorRunPolicy,
+        : historicalPreflightFailure
+          ? "historical-preflight-failure"
+          : successfulRun
+            ? "successful-run"
+            : preflightFailure
+              ? "preflight-failure"
+              : plan.github.priorRunPolicy,
   };
 }
 
@@ -137,12 +163,18 @@ function assertExactReceiptInventories(plan, receipts) {
   const inventories = [
     ["terminal-failure", plan.github.terminalFailureRunIds, false],
     ["preflight-failure", plan.github.preflightFailureRunIds, false],
+    ["successful-run", plan.github.successfulRunIds, false],
     ["startup-failure", plan.github.startupFailureRuns, true],
     [
       "historical-terminal-failure",
       plan.github.historicalTerminalFailureRuns,
       true,
     ],
+    [
+      "historical-preflight-failure",
+      plan.github.historicalPreflightFailureRuns,
+      true,
+    ],
   ];
   for (const [classification, expected, withSource] of inventories) {
     const observed = exactReceiptInventory(
@@ -201,11 +233,15 @@ function campaignRunReceipts(plan) {
     );
     if (classification.startupFailure) {
       assertExactStartupFailure(run, jobCount, artifactCount);
+    } else if (classification.successfulRun) {
+      assertExactSuccessfulRun(run, jobs, jobCount, artifactCount);
     } else {
       assertRunMatchesPolicy(
         classification.historicalTerminalFailure
           ? "terminal-failure"
-          : plan.github.priorRunPolicy,
+          : classification.historicalPreflightFailure
+            ? "preflight-failure"
+            : plan.github.priorRunPolicy,
         run,
         jobs,
         jobCount,
@@ -438,10 +474,15 @@ function assertZeroCampaignResidue(plan, profile) {
   const evidenceObjects = {};
   const historicalTerminalSources =
     plan.github.historicalTerminalFailureRuns.map(({ sourceSha }) => sourceSha);
+  const historicalPreflightSources =
+    plan.github.historicalPreflightFailureRuns.map(
+      ({ sourceSha }) => sourceSha,
+    );
   const evidenceSources = [
     ...new Set([
       plan.previousSource.sha,
       ...historicalTerminalSources,
+      ...historicalPreflightSources,
       plan.source.sha,
     ]),
   ];

package/scripts/aws-macos-jit.mjs

@@ -25,6 +25,17 @@ function writeJson(file, value) {
   return resolved;
 }
 
+export function writeMacosJitQualificationEnvironment(
+  githubEnv = process.env.GITHUB_ENV,
+) {
+  if (!githubEnv) return false;
+  fs.appendFileSync(
+    path.resolve(githubEnv),
+    "BUILDCHAIN_SIGNING_REQUESTS_ENABLED=false\n",
+  );
+  return true;
+}
+
 export function main() {
   const mode = process.argv[2] || "plan";
   if (mode === "plan") {
@@ -64,6 +75,7 @@ export function main() {
         ".buildchain/aws-macos-jit.json",
       result,
     );
+    writeMacosJitQualificationEnvironment();
     process.stdout.write(`${output}\n`);
     return result;
   }