@kungfu-tech/buildchain 4.0.1-alpha.2 → 4.0.1-alpha.3

package/dist/site/artifact-schemas.json

@@ -7,6 +7,7 @@
     "schemas/release-passport-v1.schema.json",
     "schemas/kfd-agent-hub-adoption.schema.json",
     "schemas/kfd-product-gate-input-v1.schema.json",
+    "schemas/dev-delivery-authority-v2.schema.json",
     "kfd-support.json",
     "artifact-evidence.json",
     "product-mechanism.json",
@@ -41,6 +42,7 @@
     "schemas/release-passport-v1.schema.json",
     "schemas/kfd-agent-hub-adoption.schema.json",
     "schemas/kfd-product-gate-input-v1.schema.json",
+    "schemas/dev-delivery-authority-v2.schema.json",
     "buildchain-contract.json",
     "kfd-claims.json",
     "product-mechanism.json",

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.2",
+    "version": "4.0.1-alpha.3",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -93,6 +93,89 @@
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
       "auditDigest": "sha256:97fa61f0e97641edd3b1b435ace06c621e702f0b8b406c4f3998c148a337c74a"
     },
+    {
+      "contractVersion": 1,
+      "stability": "stable",
+      "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line",
+      "id": "dev-pr-auto-merge",
+      "kind": "workflow",
+      "path": ".github/workflows/dev-pr-auto-merge.yml",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/dev-pr-auto-merge.yml@v4-alpha",
+      "requiredInputs": [
+        "target-branch",
+        "expected-pr-number",
+        "expected-head-sha"
+      ],
+      "requiredOutputs": [
+        "admission-receipt-root",
+        "warrant-state-root",
+        "provider-heartbeat-receipt-root",
+        "provider-finalizer-boundary-root"
+      ],
+      "breakingDefaults": {
+        "runtimeSelectorDefault": "v4",
+        "authorityMode": "two-phase-delivery-warrant",
+        "boundedAuthorityWorkflowIntegration": "not-advertised",
+        "boundedAuthoritySupportedSurfaces": [
+          "cli",
+          "node-api",
+          "schema"
+        ],
+        "publicFloatingCaller": "v4-alpha",
+        "durableSelfDeliveryRef": "v4-alpha",
+        "independentHeartbeatRunner": "macos-15",
+        "candidateCredentialAccess": "forbidden"
+      },
+      "optionalInputs": [
+        "buildchain-repository",
+        "buildchain-ref",
+        "source-workflow-run-id",
+        "legacy-active-owner-binding-json",
+        "delivery-warrant-mode",
+        "handoff-workflow-id",
+        "source-workflow-id",
+        "assignment-root",
+        "initiative-root",
+        "source-identity-root",
+        "source-patch-root",
+        "plan-root",
+        "closure-root",
+        "dependency-root",
+        "toolchain-root",
+        "environment-root",
+        "affected-paths-json",
+        "shard-evidence-roots-json",
+        "release-blocker-priority-json",
+        "native-proof-json",
+        "native-command",
+        "native-command-root",
+        "native-heartbeat-seconds",
+        "delivery-class",
+        "delivery-priority",
+        "required-status-checks",
+        "queue-admission-context",
+        "active-lease-context",
+        "ready-label",
+        "block-labels",
+        "allowed-head-prefixes",
+        "require-approval",
+        "same-repository-only",
+        "max-merges",
+        "merge-method",
+        "landing-mode",
+        "dry-run"
+      ],
+      "guarantees": [
+        "this reusable workflow executes the single-flight v1 Delivery Warrant and does not advertise bounded v2 Landing integration",
+        "bounded v2 authority is a separate opt-in CLI, Node API, and schema surface whose controller deployment must be explicit",
+        "candidate execution and evidence sealing receive no provider write credentials",
+        "a separate credentialed hosted runner durably heartbeats the exact fence through provider-confirmed native and seal completion",
+        "the finalizer validates rooted heartbeat continuity and latest durable state before qualification, failure settlement, or landing",
+        "durable consumers call the public floating workflow and may route a train or exact runtime only through trusted non-persistent dispatch input"
+      ],
+      "breakingDigest": "sha256:21b65d0746d2e8b3e8a7df4c6fab295a85c8fd42cc405ec3bc5df5cdab0421f0",
+      "auditDigest": "sha256:65dd95900973fec345043d1ce92fc7625719fc9b7312f319a03a75a4c3705b0c"
+    },
     {
       "contractVersion": 1,
       "stability": "stable",
@@ -702,7 +785,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:377a975d16ffd1e36f5abd60538107380c3bd9e60337482af6aa5b1384742a1b"
+      "auditDigest": "sha256:35f1f62be899e4c0ddf0f7c830f6a081496d16c016278fdef35b1c2b92cc8216"
     },
     {
       "contractVersion": 1,
@@ -792,7 +875,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:e55862ef0e7e4c93238c953d01c758846fd72f73fbf0d1c99a589fc900142127"
+      "auditDigest": "sha256:e1c02b90fdc73130294dcbf6719cc8b24d43a197b34200177a120cd7f3e6c15e"
     },
     {
       "contractVersion": 1,
@@ -814,7 +897,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:67fa2bad84b1c726e71b9a22c8ca3fe80864b044476fd6fe18d776bfb3b21cc0"
+      "auditDigest": "sha256:971498b4f91c2361ab7eb8ce7a9c32ce20b310509e56cd8b4a517a47062f6589"
     },
     {
       "contractVersion": 1,
@@ -3859,6 +3942,6 @@
       "auditDigest": "sha256:d07482cd66413a2fb3781a3b76f960b8151b6231841799647fe237820de2fde6"
     }
   ],
-  "compatibilityDigest": "sha256:7234ed200c568b1fea0e469de61ec7a67da48ede0af6290fb49b93a9e62e0b65",
-  "contractDigest": "sha256:969638b160fb3df24759937f155b07ea5316a3d35f40b80563f50f7bf2b92ae7"
+  "compatibilityDigest": "sha256:c8407195cafe42cb62ac2a4f5ff5b2c3f9b8aa65c27cc678efd46240cb3f0ecc",
+  "contractDigest": "sha256:bd2c8f4ccf3cb9593aa5dcdd8b02f9ad12e4bc211915804585198df418e099bf"
 }