@kungfu-tech/buildchain 4.0.1-alpha.2 → 4.0.1-alpha.21

package/packages/core/buildchain-compatibility-fact.js

@@ -0,0 +1,394 @@
+import {
+  devDeliveryClone as clone,
+  devDeliveryContentRoot as contentRoot,
+  devDeliveryExactRoot as exactRoot,
+  devDeliveryExactSha as exactSha,
+  devDeliveryProtectedBase as protectedBase,
+  devDeliveryRepository as repository,
+  devDeliveryText as text,
+} from "./dev-delivery-common.js";
+import compatibilityFactSource from "./buildchain-compatibility-facts.json" with { type: "json" };
+import {
+  KUNGFU_FACT_ROOT_PROTOCOL,
+  KUNGFU_TEMPORAL_BUNDLE_SCHEMA,
+  createKungfuTemporalEntry,
+} from "./kungfu-temporal-fact.js";
+
+export const BUILDCHAIN_COMPATIBILITY_PROOF_SCHEMA =
+  "kungfu.buildchain.compatibility-proof/v1";
+export const BUILDCHAIN_COMPATIBILITY_PROOF_REGISTRY_SCHEMA =
+  "kungfu.buildchain.compatibility-proof-registry/v1";
+export const BUILDCHAIN_COMPATIBILITY_FACT_SCHEMA =
+  "kungfu.buildchain.compatibility-fact/v1";
+export const BUILDCHAIN_COMPATIBILITY_FACT_REGISTRY_SCHEMA =
+  "kungfu.buildchain.compatibility-fact-registry/v1";
+export const BUILDCHAIN_COMPATIBILITY_RELEASE_EVIDENCE_SCHEMA =
+  "kungfu.buildchain.compatibility-fact-release-evidence/v1";
+
+const BUILDCHAIN_CONTRACT = "kungfu-buildchain-runtime-contract-world";
+const COMPATIBILITY_PREDICATE = "compatible-breaking-digest";
+const COMPATIBILITY_OPERATION = "accept-contract-lock";
+const COMPATIBILITY_DIRECTION = "source-to-target";
+const COMPATIBILITY_PREDICATE_ID =
+  "kungfu.buildchain.compatibility:accept-contract-lock/v1";
+const CURRENT_AUTHORITY = compatibilityFactSource.authority;
+const CURRENT_PROOF_CUT = compatibilityFactSource.registryCut;
+
+function exactText(value, label) {
+  const normalized = text(value);
+  if (!normalized) throw new Error(`${label} must not be empty`);
+  return normalized;
+}
+
+function majorLines(values) {
+  const normalized = [
+    ...new Set((values || []).map((value) => exactText(value, "majorLine"))),
+  ].sort();
+  if (
+    normalized.length === 0 ||
+    normalized.some((value) => !/^v\d+$/.test(value))
+  ) {
+    throw new Error("scope.majorLines must contain version-major identifiers");
+  }
+  return normalized;
+}
+
+function normalizeEvidence(value = {}) {
+  return {
+    kind: exactText(value.kind, "evidence.kind"),
+    pullRequest: exactText(value.pullRequest, "evidence.pullRequest"),
+    protectedBase: protectedBase(value.protectedBase),
+    sourceCommit: exactSha(value.sourceCommit, "evidence.sourceCommit"),
+    mergeCommit: exactSha(value.mergeCommit, "evidence.mergeCommit"),
+    contractDigest: exactRoot(value.contractDigest, "evidence.contractDigest"),
+    compatibilityDigest: exactRoot(
+      value.compatibilityDigest,
+      "evidence.compatibilityDigest",
+    ),
+  };
+}
+
+function normalizeAuthority(value = {}) {
+  return {
+    kind: exactText(value.kind, "authority.kind"),
+    repository: repository(value.repository),
+    protectedBase: protectedBase(value.protectedBase),
+  };
+}
+
+function normalizeCut(value = {}) {
+  return {
+    kind: exactText(value.kind, "cut.kind"),
+    repository: repository(value.repository),
+    protectedBase: protectedBase(value.protectedBase),
+    commit: exactSha(value.commit, "cut.commit"),
+  };
+}
+
+export function createBuildchainCompatibilityProof(input = {}) {
+  const surfaceId = exactText(input.surfaceId, "surfaceId");
+  const surfaceKind = exactText(input.surfaceKind, "surfaceKind");
+  const sourceBreakingDigest = exactRoot(
+    input.sourceBreakingDigest,
+    "sourceBreakingDigest",
+  );
+  const targetBreakingDigest = exactRoot(
+    input.targetBreakingDigest,
+    "targetBreakingDigest",
+  );
+  if (sourceBreakingDigest === targetBreakingDigest) {
+    throw new Error("compatibility proof source and target must differ");
+  }
+  const scope = {
+    contract: BUILDCHAIN_CONTRACT,
+    surfaceId,
+    surfaceKind,
+    majorLines: majorLines(input.scope?.majorLines || ["v2", "v3"]),
+    operation: COMPATIBILITY_OPERATION,
+  };
+  const evidence = normalizeEvidence(input.evidence);
+  const authority = normalizeAuthority(input.authority || CURRENT_AUTHORITY);
+  const cut = normalizeCut(input.cut || CURRENT_PROOF_CUT);
+  const body = {
+    schema: BUILDCHAIN_COMPATIBILITY_PROOF_SCHEMA,
+    proofId: exactText(input.proofId, "proofId"),
+    predicate: COMPATIBILITY_PREDICATE,
+    direction: COMPATIBILITY_DIRECTION,
+    operation: COMPATIBILITY_OPERATION,
+    source: {
+      contract: BUILDCHAIN_CONTRACT,
+      surfaceId,
+      surfaceKind,
+      breakingDigest: sourceBreakingDigest,
+    },
+    target: {
+      contract: BUILDCHAIN_CONTRACT,
+      surfaceId,
+      surfaceKind,
+      breakingDigest: targetBreakingDigest,
+    },
+    scope,
+    scopeRoot: contentRoot(scope),
+    evidence,
+    evidenceRoot: contentRoot(evidence),
+    authority,
+    authorityRoot: contentRoot(authority),
+    cut,
+    cutRoot: contentRoot(cut),
+  };
+  return { ...body, proofRoot: contentRoot(body) };
+}
+
+export function verifyBuildchainCompatibilityProof(proofInput, expected = {}) {
+  try {
+    const proof = clone(proofInput || {});
+    if (proof.schema !== BUILDCHAIN_COMPATIBILITY_PROOF_SCHEMA)
+      return { ok: false, reason: "unsupported-schema" };
+    const normalized = createBuildchainCompatibilityProof({
+      ...proof,
+      proofId: proof.proofId,
+      surfaceId: proof.source?.surfaceId,
+      surfaceKind: proof.source?.surfaceKind,
+      sourceBreakingDigest: proof.source?.breakingDigest,
+      targetBreakingDigest: proof.target?.breakingDigest,
+      scope: proof.scope,
+    });
+    if (normalized.proofRoot !== proof.proofRoot)
+      return { ok: false, reason: "proof-root-drift" };
+    if (JSON.stringify(normalized) !== JSON.stringify(proof))
+      return { ok: false, reason: "non-canonical-proof" };
+    for (const [field, value] of Object.entries(expected)) {
+      if (value !== undefined && normalized[field] !== value)
+        return { ok: false, reason: `${field}-mismatch` };
+    }
+    return {
+      ok: true,
+      reason: "exact-compatibility-proof",
+      proofRoot: normalized.proofRoot,
+      proof: normalized,
+    };
+  } catch (error) {
+    return { ok: false, reason: "invalid-proof", error: error.message };
+  }
+}
+
+function factInputFromProof(proof) {
+  return {
+    proofId: proof.proofId,
+    surfaceId: proof.source.surfaceId,
+    surfaceKind: proof.source.surfaceKind,
+    sourceBreakingDigest: proof.source.breakingDigest,
+    targetBreakingDigest: proof.target.breakingDigest,
+    scope: proof.scope,
+    evidence: proof.evidence,
+    authority: proof.authority,
+    cut: proof.cut,
+  };
+}
+
+export function createBuildchainCompatibilityFact(input = {}) {
+  const proof = createBuildchainCompatibilityProof(input);
+  const predicate = {
+    schema: "kungfu.fact.temporal-predicate/v1",
+    predicateId: COMPATIBILITY_PREDICATE_ID,
+    operations: [COMPATIBILITY_OPERATION],
+    direction: COMPATIBILITY_DIRECTION,
+    pathPolicy: "explicit-bounded",
+    cyclePolicy: "forbid",
+    authorityRoot: proof.authorityRoot,
+  };
+  const predicateEntry = createKungfuTemporalEntry(predicate);
+  const relation = {
+    schema: "kungfu.fact.temporal-relation/v1",
+    relationId: `buildchain:compatibility:${proof.proofId}`,
+    predicateRoot: predicateEntry.root,
+    sourceRoot: contentRoot(proof.source),
+    targetRoot: contentRoot(proof.target),
+    validFromCutRoot: proof.cutRoot,
+    scopeRoot: proof.scopeRoot,
+    authorityRoot: proof.authorityRoot,
+    admissionRoots: [proof.evidenceRoot],
+  };
+  const relationEntry = createKungfuTemporalEntry(relation);
+  return {
+    schema: BUILDCHAIN_COMPATIBILITY_FACT_SCHEMA,
+    factId: proof.proofId,
+    factRoot: relationEntry.root,
+    sourceRoot: relation.sourceRoot,
+    targetRoot: relation.targetRoot,
+    predicate: predicateEntry,
+    relation: relationEntry,
+    proof,
+  };
+}
+
+export function verifyBuildchainCompatibilityFact(factInput) {
+  try {
+    const fact = clone(factInput || {});
+    if (fact.schema !== BUILDCHAIN_COMPATIBILITY_FACT_SCHEMA)
+      return { ok: false, reason: "unsupported-schema" };
+    const normalized = createBuildchainCompatibilityFact(
+      factInputFromProof(fact.proof),
+    );
+    if (normalized.factRoot !== fact.factRoot)
+      return { ok: false, reason: "fact-root-drift" };
+    if (JSON.stringify(normalized) !== JSON.stringify(fact))
+      return { ok: false, reason: "non-canonical-fact" };
+    return {
+      ok: true,
+      reason: "exact-cut-bound-compatibility-fact",
+      fact: normalized,
+      factRoot: normalized.factRoot,
+    };
+  } catch (error) {
+    return { ok: false, reason: "invalid-fact", error: error.message };
+  }
+}
+
+export function createBuildchainCompatibilityFactRegistry({
+  factInputs = compatibilityFactSource.facts.map((entry) => ({
+    ...entry,
+    authority: compatibilityFactSource.authority,
+  })),
+  registryCut = compatibilityFactSource.registryCut,
+  supersessions = compatibilityFactSource.supersessions,
+  revocations = compatibilityFactSource.revocations,
+} = {}) {
+  if (
+    compatibilityFactSource.schema !==
+    "kungfu.buildchain.compatibility-fact-source/v1"
+  ) {
+    throw new Error("compatibility Fact source schema is unsupported");
+  }
+  if (compatibilityFactSource.rootProtocol !== KUNGFU_FACT_ROOT_PROTOCOL) {
+    throw new Error("compatibility Fact source root protocol mismatch");
+  }
+  const facts = factInputs
+    .map(createBuildchainCompatibilityFact)
+    .sort((left, right) => left.factRoot.localeCompare(right.factRoot));
+  if (new Set(facts.map((fact) => fact.factId)).size !== facts.length)
+    throw new Error("duplicate compatibility Fact id");
+  if (new Set(facts.map((fact) => fact.factRoot)).size !== facts.length)
+    throw new Error("duplicate compatibility Fact root");
+  for (const fact of facts) {
+    const verification = verifyBuildchainCompatibilityFact(fact);
+    if (!verification.ok)
+      throw new Error(`invalid compatibility Fact: ${verification.reason}`);
+  }
+  const predicates = [
+    ...new Map(
+      facts.map((fact) => [fact.predicate.root, fact.predicate]),
+    ).values(),
+  ].sort((left, right) => left.root.localeCompare(right.root));
+  const relationEntries = facts
+    .map((fact) => fact.relation)
+    .sort((left, right) => left.root.localeCompare(right.root));
+  const leafCuts = new Map();
+  for (const fact of facts) {
+    const cutRoot = fact.proof.cutRoot;
+    const current = leafCuts.get(cutRoot) || {
+      root: cutRoot,
+      parentCutRoots: [],
+      activeRelationRoots: [],
+      declarationRoots: predicates.map((entry) => entry.root),
+    };
+    current.activeRelationRoots.push(fact.factRoot);
+    current.activeRelationRoots.sort();
+    leafCuts.set(cutRoot, current);
+  }
+  const currentCut = normalizeCut(registryCut);
+  const currentCutRoot = contentRoot(currentCut);
+  const cuts = [...leafCuts.values()].sort((left, right) =>
+    left.root.localeCompare(right.root),
+  );
+  if (leafCuts.has(currentCutRoot)) {
+    const cut = leafCuts.get(currentCutRoot);
+    cut.activeRelationRoots = facts.map((fact) => fact.factRoot).sort();
+  } else {
+    cuts.push({
+      root: currentCutRoot,
+      parentCutRoots: [...leafCuts.keys()].sort(),
+      activeRelationRoots: facts.map((fact) => fact.factRoot).sort(),
+      declarationRoots: predicates.map((entry) => entry.root),
+    });
+  }
+  const supersessionEntries = (supersessions || [])
+    .map(createKungfuTemporalEntry)
+    .sort((left, right) => left.root.localeCompare(right.root));
+  const revocationEntries = (revocations || [])
+    .map(createKungfuTemporalEntry)
+    .sort((left, right) => left.root.localeCompare(right.root));
+  const temporalBundle = {
+    schema: KUNGFU_TEMPORAL_BUNDLE_SCHEMA,
+    cuts,
+    predicates,
+    relations: relationEntries,
+    supersessions: supersessionEntries,
+    revocations: revocationEntries,
+    authorityProofs: [],
+    provenanceObjects: [],
+  };
+  const identity = {
+    schema: BUILDCHAIN_COMPATIBILITY_FACT_REGISTRY_SCHEMA,
+    rootProtocol: KUNGFU_FACT_ROOT_PROTOCOL,
+    currentCutRoot,
+    predicateRoots: predicates.map((entry) => entry.root),
+    factRoots: facts.map((fact) => fact.factRoot),
+    supersessionRoots: supersessionEntries.map((entry) => entry.root),
+    revocationRoots: revocationEntries.map((entry) => entry.root),
+    legacyProofRoots: facts.map((fact) => fact.proof.proofRoot).sort(),
+    temporalBundleRoot: contentRoot(temporalBundle),
+  };
+  return {
+    ...identity,
+    facts,
+    legacyProofs: facts
+      .map((fact) => fact.proof)
+      .sort((left, right) => left.proofRoot.localeCompare(right.proofRoot)),
+    currentCut,
+    temporalBundle,
+    registryRoot: contentRoot(identity),
+  };
+}
+
+export function createHistoricalBuildchainCompatibilityFacts() {
+  return createBuildchainCompatibilityFactRegistry().facts;
+}
+
+export function createHistoricalBuildchainCompatibilityProofs() {
+  return createBuildchainCompatibilityFactRegistry().legacyProofs;
+}
+
+export function verifyBuildchainCompatibilityFactRegistry(registryInput) {
+  try {
+    const registry = clone(registryInput || {});
+    if (registry.schema !== BUILDCHAIN_COMPATIBILITY_FACT_REGISTRY_SCHEMA) {
+      return { ok: false, reason: "unsupported-schema" };
+    }
+    const normalized = createBuildchainCompatibilityFactRegistry({
+      factInputs: (registry.legacyProofs || []).map(factInputFromProof),
+      registryCut: registry.currentCut,
+      supersessions: (registry.temporalBundle?.supersessions || []).map(
+        (entry) => entry.record,
+      ),
+      revocations: (registry.temporalBundle?.revocations || []).map(
+        (entry) => entry.record,
+      ),
+    });
+    if (normalized.registryRoot !== registry.registryRoot) {
+      return { ok: false, reason: "registry-root-drift" };
+    }
+    if (JSON.stringify(normalized) !== JSON.stringify(registry)) {
+      return { ok: false, reason: "non-canonical-registry" };
+    }
+    return {
+      ok: true,
+      reason: "exact-append-only-compatibility-Fact-registry",
+      registryRoot: normalized.registryRoot,
+      currentCutRoot: normalized.currentCutRoot,
+      factCount: normalized.facts.length,
+    };
+  } catch (error) {
+    return { ok: false, reason: "invalid-registry", error: error.message };
+  }
+}

package/packages/core/buildchain-compatibility-facts.json

@@ -0,0 +1,217 @@
+{
+  "schema": "kungfu.buildchain.compatibility-fact-source/v1",
+  "rootProtocol": "kungfu.fact-root.canonical/v2",
+  "authority": {
+    "kind": "protected-base-contract-authority",
+    "repository": "kungfu-systems/buildchain",
+    "protectedBase": "dev/v3/v3.0"
+  },
+  "registryCut": {
+    "kind": "protected-git-cut",
+    "repository": "kungfu-systems/buildchain",
+    "protectedBase": "dev/v3/v3.0",
+    "commit": "888e87fec88cad41d225c32615e80a87744d4b6d"
+  },
+  "facts": [
+    {
+      "proofId": "release-candidate-promote-acd401-to-e60642",
+      "surfaceId": "release-candidate-promote",
+      "surfaceKind": "workflow",
+      "sourceBreakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
+      "targetBreakingDigest": "sha256:e60642aa298933d2c103284794921a6c340a50aa91ee528b06e58892a2a006bf",
+      "evidence": {
+        "kind": "protected-pull-request-contract-acceptance",
+        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2342",
+        "protectedBase": "dev/v3/v3.0",
+        "sourceCommit": "8870db287a9ee5fb95eebbbe907b1649d84d5b7f",
+        "mergeCommit": "30b605adea1ed33dcf0bbb4cc7b666b64a6ccd18",
+        "contractDigest": "sha256:9c07dbdb9aa8390569cd07ace044af45e6751b91ffe8fcc0cb69a77388b0f72b",
+        "compatibilityDigest": "sha256:80cfdf1786019217c439810f1a80d2866bf8f7ef35a6fa569e1a687fb2bf4cbe"
+      },
+      "cut": {
+        "kind": "protected-git-cut",
+        "repository": "kungfu-systems/buildchain",
+        "protectedBase": "dev/v3/v3.0",
+        "commit": "ff0f9006be1c8f63be40e67789e0cfd28fd69d46"
+      }
+    },
+    {
+      "proofId": "advanced-release-candidate-promote-aa30f2-to-9db8dd",
+      "surfaceId": "advanced-release-candidate-promote",
+      "surfaceKind": "workflow",
+      "sourceBreakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
+      "targetBreakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
+      "evidence": {
+        "kind": "protected-pull-request-contract-acceptance",
+        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2342",
+        "protectedBase": "dev/v3/v3.0",
+        "sourceCommit": "8870db287a9ee5fb95eebbbe907b1649d84d5b7f",
+        "mergeCommit": "30b605adea1ed33dcf0bbb4cc7b666b64a6ccd18",
+        "contractDigest": "sha256:9c07dbdb9aa8390569cd07ace044af45e6751b91ffe8fcc0cb69a77388b0f72b",
+        "compatibilityDigest": "sha256:80cfdf1786019217c439810f1a80d2866bf8f7ef35a6fa569e1a687fb2bf4cbe"
+      },
+      "cut": {
+        "kind": "protected-git-cut",
+        "repository": "kungfu-systems/buildchain",
+        "protectedBase": "dev/v3/v3.0",
+        "commit": "ff0f9006be1c8f63be40e67789e0cfd28fd69d46"
+      }
+    },
+    {
+      "proofId": "promote-buildchain-ref-action-a59f09-to-6147c0",
+      "surfaceId": "promote-buildchain-ref-action",
+      "surfaceKind": "action",
+      "sourceBreakingDigest": "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874",
+      "targetBreakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
+      "evidence": {
+        "kind": "protected-pull-request-contract-acceptance",
+        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/1556",
+        "protectedBase": "dev/v2/v2.14",
+        "sourceCommit": "f8e2c5d28ef34d711892589331b7e018095a96d7",
+        "mergeCommit": "6e0c29be1489f686a9a3792b46bfaa4466828393",
+        "contractDigest": "sha256:f6dbf5147d9ad3b8c49ba6630cd52b8c7853ead7c921d7e1210a393aebf97d1f",
+        "compatibilityDigest": "sha256:cdf588422ec6b460bd6f631400efa6e361a045e052c8967d6c50fadd7aa4dd90"
+      },
+      "cut": {
+        "kind": "protected-git-cut",
+        "repository": "kungfu-systems/buildchain",
+        "protectedBase": "dev/v3/v3.0",
+        "commit": "ff0f9006be1c8f63be40e67789e0cfd28fd69d46"
+      }
+    },
+    {
+      "proofId": "build-lifecycle-e264a7-to-6b8d38",
+      "surfaceId": "controller:build-lifecycle",
+      "surfaceKind": "controller",
+      "sourceBreakingDigest": "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
+      "targetBreakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
+      "evidence": {
+        "kind": "protected-pull-request-contract-acceptance",
+        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2058",
+        "protectedBase": "dev/v3/v3.0",
+        "sourceCommit": "c9a86bd1ac17b4fae54b0410498830edad80d831",
+        "mergeCommit": "3991801a7a7d6fe5e31b9a670dfde7ea59e61253",
+        "contractDigest": "sha256:da72850bbd3088f0e9eb20c17382557e0dfb7e68bf4469d352ed870ee8a334e8",
+        "compatibilityDigest": "sha256:32a651504c57829085dc8863f0e41dee98eb60708ff6dec958c9c7e4b1010102"
+      },
+      "cut": {
+        "kind": "protected-git-cut",
+        "repository": "kungfu-systems/buildchain",
+        "protectedBase": "dev/v3/v3.0",
+        "commit": "ff0f9006be1c8f63be40e67789e0cfd28fd69d46"
+      }
+    },
+    {
+      "proofId": "build-lifecycle-307459-to-6b8d38",
+      "surfaceId": "controller:build-lifecycle",
+      "surfaceKind": "controller",
+      "sourceBreakingDigest": "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
+      "targetBreakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
+      "evidence": {
+        "kind": "protected-pull-request-contract-acceptance",
+        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2058",
+        "protectedBase": "dev/v3/v3.0",
+        "sourceCommit": "c9a86bd1ac17b4fae54b0410498830edad80d831",
+        "mergeCommit": "3991801a7a7d6fe5e31b9a670dfde7ea59e61253",
+        "contractDigest": "sha256:da72850bbd3088f0e9eb20c17382557e0dfb7e68bf4469d352ed870ee8a334e8",
+        "compatibilityDigest": "sha256:32a651504c57829085dc8863f0e41dee98eb60708ff6dec958c9c7e4b1010102"
+      },
+      "cut": {
+        "kind": "protected-git-cut",
+        "repository": "kungfu-systems/buildchain",
+        "protectedBase": "dev/v3/v3.0",
+        "commit": "ff0f9006be1c8f63be40e67789e0cfd28fd69d46"
+      }
+    },
+    {
+      "proofId": "build-channel-router-d40dd0-to-30549a",
+      "surfaceId": "controller:build-channel-router",
+      "surfaceKind": "controller",
+      "sourceBreakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
+      "targetBreakingDigest": "sha256:30549aa26cd1e1dd81f10fe3529d3c6e3f8438a6efa0100c47ebae4d2f3d71df",
+      "evidence": {
+        "kind": "protected-pull-request-contract-acceptance",
+        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2549",
+        "protectedBase": "dev/v3/v3.0",
+        "sourceCommit": "0d87b772265066f5e6157e1ba6a2ba1021fb5225",
+        "mergeCommit": "34fad9d3a94c450d75c0d06fd6ed00470c992ff7",
+        "contractDigest": "sha256:2584ba36ab54cd5e9bab9e34dfc08d87a55dc57de1be7641492bf7ceb1366350",
+        "compatibilityDigest": "sha256:80f65cc191b1f771475184edf8a1bf9c10dd69bb58060aa09313d0e1e57f508a"
+      },
+      "cut": {
+        "kind": "protected-git-cut",
+        "repository": "kungfu-systems/buildchain",
+        "protectedBase": "dev/v3/v3.0",
+        "commit": "34fad9d3a94c450d75c0d06fd6ed00470c992ff7"
+      }
+    },
+    {
+      "proofId": "reusable-build-a6a353-to-dfbedd",
+      "surfaceId": "reusable-build",
+      "surfaceKind": "workflow",
+      "sourceBreakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
+      "targetBreakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa",
+      "evidence": {
+        "kind": "protected-pull-request-contract-acceptance",
+        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2089",
+        "protectedBase": "dev/v3/v3.0",
+        "sourceCommit": "1a6cb874bc6f1611f3eef607e711d3532798e9e7",
+        "mergeCommit": "71a75f21159b994241ec7cb2c50f7a150c5d440b",
+        "contractDigest": "sha256:7c2a7c132a2b2722f70f148b81048147047d4d2c46cf33f7cd2dc158aec092e0",
+        "compatibilityDigest": "sha256:61af7d0871220bc0909008bdc571905ad500cccf853e7841bc5d462a34b2d436"
+      },
+      "cut": {
+        "kind": "protected-git-cut",
+        "repository": "kungfu-systems/buildchain",
+        "protectedBase": "dev/v3/v3.0",
+        "commit": "71a75f21159b994241ec7cb2c50f7a150c5d440b"
+      }
+    },
+    {
+      "proofId": "web-surface-da569f-to-27f0cb",
+      "surfaceId": "web-surface",
+      "surfaceKind": "workflow",
+      "sourceBreakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
+      "targetBreakingDigest": "sha256:27f0cb9c7d97288850d215be8696b323471c41fd1cdf3a2ff3ebf21f62541960",
+      "evidence": {
+        "kind": "protected-pull-request-contract-acceptance",
+        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2089",
+        "protectedBase": "dev/v3/v3.0",
+        "sourceCommit": "1a6cb874bc6f1611f3eef607e711d3532798e9e7",
+        "mergeCommit": "71a75f21159b994241ec7cb2c50f7a150c5d440b",
+        "contractDigest": "sha256:7c2a7c132a2b2722f70f148b81048147047d4d2c46cf33f7cd2dc158aec092e0",
+        "compatibilityDigest": "sha256:61af7d0871220bc0909008bdc571905ad500cccf853e7841bc5d462a34b2d436"
+      },
+      "cut": {
+        "kind": "protected-git-cut",
+        "repository": "kungfu-systems/buildchain",
+        "protectedBase": "dev/v3/v3.0",
+        "commit": "71a75f21159b994241ec7cb2c50f7a150c5d440b"
+      }
+    },
+    {
+      "proofId": "release-propagation-d7a1f1-to-b873ce",
+      "surfaceId": "controller:release-propagation",
+      "surfaceKind": "controller",
+      "sourceBreakingDigest": "sha256:d7a1f15990ce8bd13149474888232c7d4451dd2a49bebf4d4ce1336695da430e",
+      "targetBreakingDigest": "sha256:b873ceb65618972bea615afcb9c616c138ce834b3246ec7237ef87c1618d68bd",
+      "evidence": {
+        "kind": "protected-pull-request-contract-acceptance",
+        "pullRequest": "https://github.com/kungfu-systems/buildchain/pull/2143",
+        "protectedBase": "dev/v3/v3.0",
+        "sourceCommit": "b63aff4dd63ad6017b8f48e1c690f595a9c832a2",
+        "mergeCommit": "487ee09ca4832ffd15607db00060df4c0839fbae",
+        "contractDigest": "sha256:00c37f8a663387831ba4d066056d0b21d4f3c5f3ea5b0cf84456af332cf8d87e",
+        "compatibilityDigest": "sha256:3bbcaf835844260ed98414d3bd176667245d12131e13fc748e4c2fae12399691"
+      },
+      "cut": {
+        "kind": "protected-git-cut",
+        "repository": "kungfu-systems/buildchain",
+        "protectedBase": "dev/v3/v3.0",
+        "commit": "487ee09ca4832ffd15607db00060df4c0839fbae"
+      }
+    }
+  ],
+  "supersessions": [],
+  "revocations": []
+}