@kungfu-tech/buildchain 3.0.9-alpha.8 → 4.0.0-alpha.0

package/dist/site/buildchain-contract.json

@@ -4,337 +4,11 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.9-alpha.8",
+    "version": "4.0.0-alpha.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
-  "majorLine": "v3",
+  "majorLine": "v4",
   "compatibilityPolicy": "major-compatible",
-  "compatibilityProofs": [
-    {
-      "schema": "kungfu.buildchain.compatibility-proof/v1",
-      "proofId": "advanced-release-candidate-promote-aa30f2-to-9db8dd",
-      "predicate": "compatible-breaking-digest",
-      "direction": "source-to-target",
-      "operation": "accept-contract-lock",
-      "source": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "advanced-release-candidate-promote",
-        "surfaceKind": "workflow",
-        "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
-      },
-      "target": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "advanced-release-candidate-promote",
-        "surfaceKind": "workflow",
-        "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5"
-      },
-      "scope": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "advanced-release-candidate-promote",
-        "surfaceKind": "workflow",
-        "majorLines": [
-          "v2",
-          "v3"
-        ],
-        "operation": "accept-contract-lock"
-      },
-      "scopeRoot": "sha256:c9746475e09a42adf6e33cf3656d9d7cef8e880ba3efc31b8a3cd599b938a124",
-      "evidence": {
-        "kind": "protected-pull-request-contract-acceptance",
-        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2342",
-        "protectedBase": "dev/v3/v3.0",
-        "sourceCommit": "8870db287a9ee5fb95eebbbe907b1649d84d5b7f",
-        "mergeCommit": "30b605adea1ed33dcf0bbb4cc7b666b64a6ccd18",
-        "contractDigest": "sha256:9c07dbdb9aa8390569cd07ace044af45e6751b91ffe8fcc0cb69a77388b0f72b",
-        "compatibilityDigest": "sha256:80cfdf1786019217c439810f1a80d2866bf8f7ef35a6fa569e1a687fb2bf4cbe"
-      },
-      "evidenceRoot": "sha256:c428bab55d265c91220aa10f7f3d8be508bdc1b412049ca9de48fa6f9898a373",
-      "authority": {
-        "kind": "protected-base-contract-authority",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0"
-      },
-      "authorityRoot": "sha256:6908bf14a35e1ad7d0b865cb776744b789d1b41a0920d2160ef374febb4e24ea",
-      "cut": {
-        "kind": "protected-git-cut",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0",
-        "commit": "ff0f9006be1c8f63be40e67789e0cfd28fd69d46"
-      },
-      "cutRoot": "sha256:4fd5ae0cdad01a09e91bbb3f183ac595510a8f25baf7ba865de7633a7eacb3eb",
-      "proofRoot": "sha256:36c85ba487be1528e85776d2bc5f766a971d42ac238aec30071945f7d60d9fc5"
-    },
-    {
-      "schema": "kungfu.buildchain.compatibility-proof/v1",
-      "proofId": "build-channel-router-d40dd0-to-30549a",
-      "predicate": "compatible-breaking-digest",
-      "direction": "source-to-target",
-      "operation": "accept-contract-lock",
-      "source": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "controller:build-channel-router",
-        "surfaceKind": "controller",
-        "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273"
-      },
-      "target": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "controller:build-channel-router",
-        "surfaceKind": "controller",
-        "breakingDigest": "sha256:30549aa26cd1e1dd81f10fe3529d3c6e3f8438a6efa0100c47ebae4d2f3d71df"
-      },
-      "scope": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "controller:build-channel-router",
-        "surfaceKind": "controller",
-        "majorLines": [
-          "v2",
-          "v3"
-        ],
-        "operation": "accept-contract-lock"
-      },
-      "scopeRoot": "sha256:dc381e72e9cad86293254f8542394f1abc27b4b0f07c122cb4cad5f73b381ccb",
-      "evidence": {
-        "kind": "protected-pull-request-contract-acceptance",
-        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2549",
-        "protectedBase": "dev/v3/v3.0",
-        "sourceCommit": "0d87b772265066f5e6157e1ba6a2ba1021fb5225",
-        "mergeCommit": "34fad9d3a94c450d75c0d06fd6ed00470c992ff7",
-        "contractDigest": "sha256:2584ba36ab54cd5e9bab9e34dfc08d87a55dc57de1be7641492bf7ceb1366350",
-        "compatibilityDigest": "sha256:80f65cc191b1f771475184edf8a1bf9c10dd69bb58060aa09313d0e1e57f508a"
-      },
-      "evidenceRoot": "sha256:e449bdc62832fd18b33d93833207d70e843f066a85aae8b0c717234194ecb497",
-      "authority": {
-        "kind": "protected-base-contract-authority",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0"
-      },
-      "authorityRoot": "sha256:6908bf14a35e1ad7d0b865cb776744b789d1b41a0920d2160ef374febb4e24ea",
-      "cut": {
-        "kind": "protected-git-cut",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0",
-        "commit": "34fad9d3a94c450d75c0d06fd6ed00470c992ff7"
-      },
-      "cutRoot": "sha256:3b83f02e22ca82fc4a099b5f8c4353fffb1423b0a5cba41860b1ba86f7c8cbb7",
-      "proofRoot": "sha256:36d2e188f43385d6191116393aa81ea025ccf61e21a1c5eae1d56be92a203b31"
-    },
-    {
-      "schema": "kungfu.buildchain.compatibility-proof/v1",
-      "proofId": "build-lifecycle-307459-to-6b8d38",
-      "predicate": "compatible-breaking-digest",
-      "direction": "source-to-target",
-      "operation": "accept-contract-lock",
-      "source": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "controller:build-lifecycle",
-        "surfaceKind": "controller",
-        "breakingDigest": "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1"
-      },
-      "target": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "controller:build-lifecycle",
-        "surfaceKind": "controller",
-        "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb"
-      },
-      "scope": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "controller:build-lifecycle",
-        "surfaceKind": "controller",
-        "majorLines": [
-          "v2",
-          "v3"
-        ],
-        "operation": "accept-contract-lock"
-      },
-      "scopeRoot": "sha256:c1a391a06ad2732c09c09fe0a0806569ac066684f5f2cd381a634c7784da6de3",
-      "evidence": {
-        "kind": "protected-pull-request-contract-acceptance",
-        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2058",
-        "protectedBase": "dev/v3/v3.0",
-        "sourceCommit": "c9a86bd1ac17b4fae54b0410498830edad80d831",
-        "mergeCommit": "3991801a7a7d6fe5e31b9a670dfde7ea59e61253",
-        "contractDigest": "sha256:da72850bbd3088f0e9eb20c17382557e0dfb7e68bf4469d352ed870ee8a334e8",
-        "compatibilityDigest": "sha256:32a651504c57829085dc8863f0e41dee98eb60708ff6dec958c9c7e4b1010102"
-      },
-      "evidenceRoot": "sha256:ec5b8374a76dea9fd344cace735f46caa7a8167eef1becd55fbdb0d3cd6f1109",
-      "authority": {
-        "kind": "protected-base-contract-authority",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0"
-      },
-      "authorityRoot": "sha256:6908bf14a35e1ad7d0b865cb776744b789d1b41a0920d2160ef374febb4e24ea",
-      "cut": {
-        "kind": "protected-git-cut",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0",
-        "commit": "ff0f9006be1c8f63be40e67789e0cfd28fd69d46"
-      },
-      "cutRoot": "sha256:4fd5ae0cdad01a09e91bbb3f183ac595510a8f25baf7ba865de7633a7eacb3eb",
-      "proofRoot": "sha256:3bd1c54198b78a462d2005ac66c139ad4d6f1962925c8f0971b4d0a222f1a7c5"
-    },
-    {
-      "schema": "kungfu.buildchain.compatibility-proof/v1",
-      "proofId": "build-lifecycle-e264a7-to-6b8d38",
-      "predicate": "compatible-breaking-digest",
-      "direction": "source-to-target",
-      "operation": "accept-contract-lock",
-      "source": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "controller:build-lifecycle",
-        "surfaceKind": "controller",
-        "breakingDigest": "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be"
-      },
-      "target": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "controller:build-lifecycle",
-        "surfaceKind": "controller",
-        "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb"
-      },
-      "scope": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "controller:build-lifecycle",
-        "surfaceKind": "controller",
-        "majorLines": [
-          "v2",
-          "v3"
-        ],
-        "operation": "accept-contract-lock"
-      },
-      "scopeRoot": "sha256:c1a391a06ad2732c09c09fe0a0806569ac066684f5f2cd381a634c7784da6de3",
-      "evidence": {
-        "kind": "protected-pull-request-contract-acceptance",
-        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2058",
-        "protectedBase": "dev/v3/v3.0",
-        "sourceCommit": "c9a86bd1ac17b4fae54b0410498830edad80d831",
-        "mergeCommit": "3991801a7a7d6fe5e31b9a670dfde7ea59e61253",
-        "contractDigest": "sha256:da72850bbd3088f0e9eb20c17382557e0dfb7e68bf4469d352ed870ee8a334e8",
-        "compatibilityDigest": "sha256:32a651504c57829085dc8863f0e41dee98eb60708ff6dec958c9c7e4b1010102"
-      },
-      "evidenceRoot": "sha256:ec5b8374a76dea9fd344cace735f46caa7a8167eef1becd55fbdb0d3cd6f1109",
-      "authority": {
-        "kind": "protected-base-contract-authority",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0"
-      },
-      "authorityRoot": "sha256:6908bf14a35e1ad7d0b865cb776744b789d1b41a0920d2160ef374febb4e24ea",
-      "cut": {
-        "kind": "protected-git-cut",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0",
-        "commit": "ff0f9006be1c8f63be40e67789e0cfd28fd69d46"
-      },
-      "cutRoot": "sha256:4fd5ae0cdad01a09e91bbb3f183ac595510a8f25baf7ba865de7633a7eacb3eb",
-      "proofRoot": "sha256:9024634cef43a9d695fa224d26be9aeb6370d3c981b003ece3b659dde8e73713"
-    },
-    {
-      "schema": "kungfu.buildchain.compatibility-proof/v1",
-      "proofId": "release-candidate-promote-acd401-to-e60642",
-      "predicate": "compatible-breaking-digest",
-      "direction": "source-to-target",
-      "operation": "accept-contract-lock",
-      "source": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "release-candidate-promote",
-        "surfaceKind": "workflow",
-        "breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf"
-      },
-      "target": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "release-candidate-promote",
-        "surfaceKind": "workflow",
-        "breakingDigest": "sha256:e60642aa298933d2c103284794921a6c340a50aa91ee528b06e58892a2a006bf"
-      },
-      "scope": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "release-candidate-promote",
-        "surfaceKind": "workflow",
-        "majorLines": [
-          "v2",
-          "v3"
-        ],
-        "operation": "accept-contract-lock"
-      },
-      "scopeRoot": "sha256:0b8668413118308004e8ded1e9d051d94c68311c3944791babb9a4ad29d2d50b",
-      "evidence": {
-        "kind": "protected-pull-request-contract-acceptance",
-        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2342",
-        "protectedBase": "dev/v3/v3.0",
-        "sourceCommit": "8870db287a9ee5fb95eebbbe907b1649d84d5b7f",
-        "mergeCommit": "30b605adea1ed33dcf0bbb4cc7b666b64a6ccd18",
-        "contractDigest": "sha256:9c07dbdb9aa8390569cd07ace044af45e6751b91ffe8fcc0cb69a77388b0f72b",
-        "compatibilityDigest": "sha256:80cfdf1786019217c439810f1a80d2866bf8f7ef35a6fa569e1a687fb2bf4cbe"
-      },
-      "evidenceRoot": "sha256:c428bab55d265c91220aa10f7f3d8be508bdc1b412049ca9de48fa6f9898a373",
-      "authority": {
-        "kind": "protected-base-contract-authority",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0"
-      },
-      "authorityRoot": "sha256:6908bf14a35e1ad7d0b865cb776744b789d1b41a0920d2160ef374febb4e24ea",
-      "cut": {
-        "kind": "protected-git-cut",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0",
-        "commit": "ff0f9006be1c8f63be40e67789e0cfd28fd69d46"
-      },
-      "cutRoot": "sha256:4fd5ae0cdad01a09e91bbb3f183ac595510a8f25baf7ba865de7633a7eacb3eb",
-      "proofRoot": "sha256:cb642b68aaf60e9c0eb93d46a2a1fc482810142201c7340ad7efe824b1683921"
-    },
-    {
-      "schema": "kungfu.buildchain.compatibility-proof/v1",
-      "proofId": "promote-buildchain-ref-action-a59f09-to-6147c0",
-      "predicate": "compatible-breaking-digest",
-      "direction": "source-to-target",
-      "operation": "accept-contract-lock",
-      "source": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "promote-buildchain-ref-action",
-        "surfaceKind": "action",
-        "breakingDigest": "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
-      },
-      "target": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "promote-buildchain-ref-action",
-        "surfaceKind": "action",
-        "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda"
-      },
-      "scope": {
-        "contract": "kungfu-buildchain-runtime-contract-world",
-        "surfaceId": "promote-buildchain-ref-action",
-        "surfaceKind": "action",
-        "majorLines": [
-          "v2",
-          "v3"
-        ],
-        "operation": "accept-contract-lock"
-      },
-      "scopeRoot": "sha256:dbf061c2f7608451f0d2ae47e2d7eaa323d7cf61699f20467ac73712748e50c5",
-      "evidence": {
-        "kind": "protected-pull-request-contract-acceptance",
-        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/1556",
-        "protectedBase": "dev/v2/v2.14",
-        "sourceCommit": "f8e2c5d28ef34d711892589331b7e018095a96d7",
-        "mergeCommit": "6e0c29be1489f686a9a3792b46bfaa4466828393",
-        "contractDigest": "sha256:f6dbf5147d9ad3b8c49ba6630cd52b8c7853ead7c921d7e1210a393aebf97d1f",
-        "compatibilityDigest": "sha256:cdf588422ec6b460bd6f631400efa6e361a045e052c8967d6c50fadd7aa4dd90"
-      },
-      "evidenceRoot": "sha256:454c8cf77d6ecb35de2cdb2f8f80832d7fb31b9f9ef300749ac8b1595fd5cf86",
-      "authority": {
-        "kind": "protected-base-contract-authority",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0"
-      },
-      "authorityRoot": "sha256:6908bf14a35e1ad7d0b865cb776744b789d1b41a0920d2160ef374febb4e24ea",
-      "cut": {
-        "kind": "protected-git-cut",
-        "repository": "kungfu-systems/buildchain",
-        "protectedBase": "dev/v3/v3.0",
-        "commit": "ff0f9006be1c8f63be40e67789e0cfd28fd69d46"
-      },
-      "cutRoot": "sha256:4fd5ae0cdad01a09e91bbb3f183ac595510a8f25baf7ba865de7633a7eacb3eb",
-      "proofRoot": "sha256:e6f93f44a6613a9d6de776ebe8f29b1779b0cd18a24bdf126ec6c1a07770fa75"
-    }
-  ],
   "surfaces": [
     {
       "contractVersion": 1,
@@ -343,7 +17,7 @@
       "id": "reusable-build",
       "kind": "workflow",
       "path": ".github/workflows/.build.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/.build.yml@v3",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/.build.yml@v4",
       "requiredInputs": [],
       "requiredOutputs": [
         "buildchain-runtime-sha",
@@ -378,7 +52,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa",
-      "auditDigest": "sha256:e1a045509343ab4e907cae61d40b931b8cd5e126a85296669ab2bd49f7bc8ad3"
+      "auditDigest": "sha256:61494dcde9c16d102b582371ee5ba2336c7fc2f43dfd253a2d427ccbb25e00ef"
     },
     {
       "contractVersion": 1,
@@ -387,7 +61,7 @@
       "id": "channel-build-router",
       "kind": "workflow",
       "path": ".github/workflows/build.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/build.yml@v3",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/build.yml@v4",
       "requiredInputs": [],
       "requiredOutputs": [
         "buildchain-channel",
@@ -417,7 +91,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:789173c7e5508c7e7947a59fbcb3b5bebc3783ed47695d7f5abb468a9b5d4d7d"
+      "auditDigest": "sha256:8cf016da272ea41214f3b17fa6f3bb406130659c4f86c4f6dd84e15d2bd0e9fe"
     },
     {
       "contractVersion": 1,
@@ -426,7 +100,7 @@
       "id": "release-candidate-promote",
       "kind": "workflow",
       "path": ".github/workflows/release-candidate-promote.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v3",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4",
       "requiredInputs": [
         "channel"
       ],
@@ -438,8 +112,8 @@
       ],
       "breakingDefaults": {
         "channelDefault": "auto",
-        "alphaShellDefault": "v3-alpha",
-        "stableShellDefault": "v3",
+        "alphaShellDefault": "v4-alpha",
+        "stableShellDefault": "v4",
         "promoteOnlyReleaseCandidate": true,
         "requiredStatusCheck": "check / check"
       },
@@ -515,14 +189,11 @@
         "publish-gate source locks are created by the wrapper and enforced by promote-buildchain-ref before publish side effects",
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
-      "breakingDigest": "sha256:e60642aa298933d2c103284794921a6c340a50aa91ee528b06e58892a2a006bf",
-      "auditDigest": "sha256:e35e3aeac79be887ae67b630af274d08581920e686f5124c65fc7ac288519721",
       "compatibleBreakingDigests": [
         "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf"
       ],
-      "compatibilityProofRoots": [
-        "sha256:cb642b68aaf60e9c0eb93d46a2a1fc482810142201c7340ad7efe824b1683921"
-      ]
+      "breakingDigest": "sha256:5f10c81d3f80cb417960be682921884639c40b6d875f1a3b1ffae7e652c3f468",
+      "auditDigest": "sha256:13e000bc36e25a972e5c76bafb138cf84361237650ed28529ebd7daf7f2c3025"
     },
     {
       "contractVersion": 1,
@@ -531,7 +202,7 @@
       "id": "advanced-release-candidate-promote",
       "kind": "workflow",
       "path": ".github/workflows/.release-candidate-promote.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v3",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4",
       "requiredInputs": [
         "channel"
       ],
@@ -547,6 +218,8 @@
       },
       "optionalInputs": [
         "buildchain-ref",
+        "buildchain-expected-channel",
+        "buildchain-expected-major",
         "buildchain-contract-lock-path",
         "promotion-router-ref",
         "promotion-router-sha",
@@ -574,14 +247,11 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix",
         "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph"
       ],
-      "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
-      "auditDigest": "sha256:d58c6ca74c7ac1defb9dcc35e26b6dde097b82f6aaea4e2c71e90ea15887158e",
       "compatibleBreakingDigests": [
         "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
       ],
-      "compatibilityProofRoots": [
-        "sha256:36c85ba487be1528e85776d2bc5f766a971d42ac238aec30071945f7d60d9fc5"
-      ]
+      "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
+      "auditDigest": "sha256:adb76e2a8ddd7b8323beb6f2da775aee394c5be6992262ff053a5bc745b2a033"
     },
     {
       "contractVersion": 1,
@@ -590,7 +260,7 @@
       "id": "web-surface",
       "kind": "workflow",
       "path": ".github/workflows/.web-surface.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v3",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v4",
       "requiredInputs": [],
       "requiredOutputs": [
         "buildchain-runtime-sha",
@@ -634,7 +304,7 @@
       "id": "auditable-demo",
       "kind": "workflow",
       "path": ".github/workflows/.auditable-demo.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/.auditable-demo.yml@v3",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/.auditable-demo.yml@v4",
       "requiredInputs": [
         "source-artifact-name",
         "source-artifact-digest",
@@ -692,7 +362,7 @@
       "id": "declarative-auditable-demo",
       "kind": "workflow",
       "path": ".github/workflows/.declarative-auditable-demo.yml",
-      "publicRef": "kungfu-systems/buildchain/.github/workflows/.declarative-auditable-demo.yml@v3",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/.declarative-auditable-demo.yml@v4",
       "requiredInputs": [
         "binary-artifact-name",
         "binary-artifact-digest",
@@ -743,7 +413,7 @@
       "id": "promote-buildchain-ref-action",
       "kind": "action",
       "path": "actions/promote-buildchain-ref/action.yml",
-      "publicRef": "kungfu-systems/buildchain/actions/promote-buildchain-ref@v3",
+      "publicRef": "kungfu-systems/buildchain/actions/promote-buildchain-ref@v4",
       "requiredInputs": [
         "token",
         "sha",
@@ -804,14 +474,11 @@
         "publish transactions can require a resolved publish-gate source lock to prevent floating-ref drift",
         "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata bound to the authoritative publication channel and tag syntax retained as the fallback for ordinary callers"
       ],
-      "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
-      "auditDigest": "sha256:e7386c747ff6282ef128903bcac9f6dcd47581d19ac4f0bafc589c2037e0467c",
       "compatibleBreakingDigests": [
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
       ],
-      "compatibilityProofRoots": [
-        "sha256:e6f93f44a6613a9d6de776ebe8f29b1779b0cd18a24bdf126ec6c1a07770fa75"
-      ]
+      "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
+      "auditDigest": "sha256:8e89dd8296e68d52872ca78ba9d97c4493702eb3c33ab5315faeadbdf10d8c00"
     },
     {
       "contractVersion": 1,
@@ -820,7 +487,7 @@
       "id": "macos-credential-island-action",
       "kind": "action",
       "path": "actions/macos-credential-island/action.yml",
-      "publicRef": "kungfu-systems/buildchain/actions/macos-credential-island@v3",
+      "publicRef": "kungfu-systems/buildchain/actions/macos-credential-island@v4",
       "requiredInputs": [
         "input-root",
         "output-root",
@@ -876,7 +543,7 @@
       "id": "report-buildchain-issue-action",
       "kind": "action",
       "path": "actions/report-buildchain-issue/action.yml",
-      "publicRef": "kungfu-systems/buildchain/actions/report-buildchain-issue@v3",
+      "publicRef": "kungfu-systems/buildchain/actions/report-buildchain-issue@v4",
       "requiredInputs": [
         "token"
       ],
@@ -926,7 +593,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:485c55c362476de980eb35c32c1f58b780520f96c924ac316eb515de60696243"
+      "auditDigest": "sha256:34f8048ea82b0696bfb7fa7d2eba2b09a5e51eaf5ab9a9857e278c7d005427dc"
     },
     {
       "contractVersion": 1,
@@ -951,7 +618,7 @@
         "KFD self contract witnesses record source/artifact hashes, self-hosting boundary, and responsibility state"
       ],
       "breakingDigest": "sha256:f46c1f67b94957ad956cf70db59a73fd5690bd67c91edf9c2d0eb8f3d1e3cf8d",
-      "auditDigest": "sha256:0ee7f76d04f9b77a63ec2cc12cec8e804da47b8ef81075982feb351346ac3d5b"
+      "auditDigest": "sha256:f31691f36f2a7930798805cb470aff7acd3503799cb72b954c7787b1d8b3eb31"
     },
     {
       "contractVersion": 1,
@@ -975,7 +642,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:485c55c362476de980eb35c32c1f58b780520f96c924ac316eb515de60696243"
+      "auditDigest": "sha256:34f8048ea82b0696bfb7fa7d2eba2b09a5e51eaf5ab9a9857e278c7d005427dc"
     },
     {
       "contractVersion": 1,
@@ -1004,7 +671,7 @@
         "KFD-3 passports expose releaseStatus, witness hashes, declared capability verification, reverse audit boundary, residual risk, and responsibility state"
       ],
       "breakingDigest": "sha256:33654f3444c893754aacc42dde3051f0a371bd17c6ef7c657c579a07159cd7c1",
-      "auditDigest": "sha256:0ee7f76d04f9b77a63ec2cc12cec8e804da47b8ef81075982feb351346ac3d5b"
+      "auditDigest": "sha256:f31691f36f2a7930798805cb470aff7acd3503799cb72b954c7787b1d8b3eb31"
     },
     {
       "contractVersion": 1,
@@ -1035,7 +702,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:eb793611ddb1463f4e9414a6d861d9573f737485b4a57ac6e86cc4ed8a928b35"
+      "auditDigest": "sha256:377a975d16ffd1e36f5abd60538107380c3bd9e60337482af6aa5b1384742a1b"
     },
     {
       "contractVersion": 1,
@@ -1125,7 +792,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:68a70c70463b5a5baa36201e17b487c266a3945306eaa90f2afc9f9bc09c76ca"
+      "auditDigest": "sha256:85c040a0ee2e9e65839221e0c7682fefb544e9290a213d57e76baa54ef2add54"
     },
     {
       "contractVersion": 1,
@@ -1147,7 +814,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:60c1db203ba2c8b505bb5dfead664eb1d4c2384958b6f83a66e082a3ab3b64c9"
+      "auditDigest": "sha256:d905e94317be3fccf0f4f627041ba91b68623993ed896d535fda475b69b9b88d"
     },
     {
       "contractVersion": 1,
@@ -1198,7 +865,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:56d9fd27f8e05f1d5c0f5de354b2dfc1cac62155e8ddc555b16e35e9161459c9",
+        "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -1292,6 +959,8 @@
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
         "BUILDCHAIN_PROMOTION_TOKEN",
         "artifact-compression-level",
+        "artifact-finalization-command",
+        "artifact-finalization-on-platform",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -1312,6 +981,8 @@
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
         "buildchain-contract-lock-path",
+        "buildchain-expected-channel",
+        "buildchain-expected-major",
         "buildchain-ref",
         "buildchain-repository",
         "cache-dependency-lock-root",
@@ -1380,8 +1051,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:f986e79241d831f027a0955a35c918f946989176c76555e20f156ed31fb10c94",
-        "registryDigest": "sha256:56d9fd27f8e05f1d5c0f5de354b2dfc1cac62155e8ddc555b16e35e9161459c9",
+        "digest": "sha256:18bd484d8425b54ad533adde64f874c151a0a90de878c5498cfb99709cb53ea3",
+        "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1423,6 +1094,14 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "artifact-finalization-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "artifact-finalization-on-platform": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "artifact-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1503,6 +1182,14 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "buildchain-expected-channel": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "buildchain-expected-major": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "buildchain-ref": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1765,6 +1452,10 @@
           }
         }
       },
+      "compatibleBreakingDigests": [
+        "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
+        "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1"
+      ],
       "guarantees": [
         "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest",
         "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes",
@@ -1772,15 +1463,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
-      "auditDigest": "sha256:e1a045509343ab4e907cae61d40b931b8cd5e126a85296669ab2bd49f7bc8ad3",
-      "compatibleBreakingDigests": [
-        "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
-        "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be"
-      ],
-      "compatibilityProofRoots": [
-        "sha256:3bd1c54198b78a462d2005ac66c139ad4d6f1962925c8f0971b4d0a222f1a7c5",
-        "sha256:9024634cef43a9d695fa224d26be9aeb6370d3c981b003ece3b659dde8e73713"
-      ]
+      "auditDigest": "sha256:61494dcde9c16d102b582371ee5ba2336c7fc2f43dfd253a2d427ccbb25e00ef"
     },
     {
       "contractVersion": 1,
@@ -1827,6 +1510,8 @@
         "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
         "BUILDCHAIN_PROMOTION_TOKEN",
         "artifact-compression-level",
+        "artifact-finalization-command",
+        "artifact-finalization-on-platform",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -1849,6 +1534,8 @@
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
         "buildchain-contract-lock-path",
+        "buildchain-expected-channel",
+        "buildchain-expected-major",
         "buildchain-ref",
         "buildchain-repository",
         "buildchain-stable-contract-lock-path",
@@ -1918,8 +1605,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:6dfa79003f0c92e336c56f07f45f57cc5572921bdb46e432fd809fb19ee823bb",
-        "registryDigest": "sha256:56d9fd27f8e05f1d5c0f5de354b2dfc1cac62155e8ddc555b16e35e9161459c9",
+        "digest": "sha256:47b73fb19d61c06911278ce99f8433596a8539097fdc18fe11f05b0d3c2109c0",
+        "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1961,6 +1648,14 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "artifact-finalization-command": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "artifact-finalization-on-platform": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "artifact-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2049,6 +1744,14 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "buildchain-expected-channel": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "buildchain-expected-major": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "buildchain-ref": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2322,13 +2025,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:30549aa26cd1e1dd81f10fe3529d3c6e3f8438a6efa0100c47ebae4d2f3d71df",
-      "auditDigest": "sha256:789173c7e5508c7e7947a59fbcb3b5bebc3783ed47695d7f5abb468a9b5d4d7d",
-      "compatibleBreakingDigests": [
-        "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273"
-      ],
-      "compatibilityProofRoots": [
-        "sha256:36d2e188f43385d6191116393aa81ea025ccf61e21a1c5eae1d56be92a203b31"
-      ]
+      "auditDigest": "sha256:8cf016da272ea41214f3b17fa6f3bb406130659c4f86c4f6dd84e15d2bd0e9fe"
     },
     {
       "contractVersion": 1,
@@ -2398,7 +2095,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:56d9fd27f8e05f1d5c0f5de354b2dfc1cac62155e8ddc555b16e35e9161459c9",
+        "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2615,7 +2312,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:56d9fd27f8e05f1d5c0f5de354b2dfc1cac62155e8ddc555b16e35e9161459c9",
+        "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2859,7 +2556,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:56d9fd27f8e05f1d5c0f5de354b2dfc1cac62155e8ddc555b16e35e9161459c9",
+        "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -3041,7 +2738,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:56d9fd27f8e05f1d5c0f5de354b2dfc1cac62155e8ddc555b16e35e9161459c9",
+        "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -3265,6 +2962,8 @@
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
         "buildchain-contract-lock-path",
+        "buildchain-expected-channel",
+        "buildchain-expected-major",
         "buildchain-issue-app-id",
         "buildchain-issue-app-private-key",
         "buildchain-issue-token",
@@ -3373,8 +3072,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:4d44d0f729fbc112aa309ed22e74b9f1401b0470b99c1e6061c278babe5e4b8b",
-        "registryDigest": "sha256:56d9fd27f8e05f1d5c0f5de354b2dfc1cac62155e8ddc555b16e35e9161459c9",
+        "digest": "sha256:1e812ddf411c9f4106e5ff88054e1fe6f0eb6bad76c3985d8adbc9ce5dfe345d",
+        "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3440,6 +3139,14 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "buildchain-expected-channel": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "buildchain-expected-major": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "buildchain-issue-app-id": {
             "classification": "redacted",
             "source": "workflow-call-secret"
@@ -3869,7 +3576,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:d58c6ca74c7ac1defb9dcc35e26b6dde097b82f6aaea4e2c71e90ea15887158e"
+      "auditDigest": "sha256:adb76e2a8ddd7b8323beb6f2da775aee394c5be6992262ff053a5bc745b2a033"
     },
     {
       "contractVersion": 1,
@@ -3934,7 +3641,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12",
-        "registryDigest": "sha256:56d9fd27f8e05f1d5c0f5de354b2dfc1cac62155e8ddc555b16e35e9161459c9",
+        "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d",
         "inputClassifications": {
           "agent-work-context-json": {
             "classification": "digest-only",
@@ -4069,7 +3776,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:56d9fd27f8e05f1d5c0f5de354b2dfc1cac62155e8ddc555b16e35e9161459c9",
+        "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -4082,7 +3789,6 @@
       "auditDigest": "sha256:d07482cd66413a2fb3781a3b76f960b8151b6231841799647fe237820de2fde6"
     }
   ],
-  "compatibilityProofRegistryRoot": "sha256:aec674d174461493e3493b3fe3164d62745a9ce18cb6a560f94bd99f2759eb53",
-  "compatibilityDigest": "sha256:eb2fafb181b33002f81102a966f0a801ab1798101446635703ab6acfea51d9aa",
-  "contractDigest": "sha256:bfc0e67dd0efac270aabe73b19183d410da62d3ea446d55fe90ab4c919451dfa"
+  "compatibilityDigest": "sha256:7234ed200c568b1fea0e469de61ec7a67da48ede0af6290fb49b93a9e62e0b65",
+  "contractDigest": "sha256:78bdf3aae75cfafa497efc53775be49ed6e14459073b2534f7619f2e978327e9"
 }