@kungfu-tech/buildchain 4.0.1-alpha.8 → 4.0.1

package/bin/internal/trust-release-release-handlers.mjs

@@ -185,6 +185,11 @@ async function handleCollectCommand({ args, runScript, packageVersion }) {
     runnerArch: process.env.RUNNER_ARCH || process.arch,
     runnerImage: process.env.ImageOS || "",
   };
+  if (readFlag(collectArgs, "adopter-delivery-json", "")) {
+    throw new Error(
+      "buildchain-v3-v4-public-surface-migration/v1: --adopter-delivery-json is non-authoritative in v4; use --kfd-adopter-manifest-json with --kfd-product-gate-json",
+    );
+  }
   const result = collectGitHubReleasePassport({
     cwd: readFlag(collectArgs, "cwd", process.cwd()),
     tag: readFlag(collectArgs, "tag", ""),

package/contracts/fixtures/v4-tail-reseal-v1/valid.json

@@ -22,7 +22,7 @@
     "ref": "v4-alpha",
     "sha": "dddddddddddddddddddddddddddddddddddddddd",
     "contractRoot": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
-    "consumerPolicyReceiptRoot": "sha256:83e75f961e61f5a6ed3648898836076afa5561a0b25bfc07ff6d3f2d4b7405d6"
+    "consumerPolicyReceiptRoot": "sha256:e545cb7dc918ba14b02e9a557623edb7aaadeee180b211b8a3164d67af03e789"
   },
   "warrant": {
     "candidateId": "candidate-alpha-2",

package/contracts/v4-publication-qualification-v1.schema.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://kungfu.link/schemas/buildchain/v4-publication-qualification-v1.schema.json",
+  "title": "Buildchain v4 Publication Qualification Receipt",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "repository",
+    "candidateRoot",
+    "sourceSha",
+    "sourceRoot",
+    "policyDigest",
+    "artifacts",
+    "issuedAt",
+    "expiresAt",
+    "artifactRoot",
+    "receiptRoot"
+  ],
+  "properties": {
+    "schema": { "const": "kungfu.buildchain.v4-publication-qualification/v1" },
+    "repository": { "type": "string", "pattern": "^[^/\\s]+/[^/\\s]+$" },
+    "candidateRoot": { "$ref": "#/$defs/root" },
+    "sourceSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "sourceRoot": { "$ref": "#/$defs/root" },
+    "policyDigest": { "$ref": "#/$defs/root" },
+    "artifacts": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/artifact" }
+    },
+    "issuedAt": { "type": "string", "format": "date-time" },
+    "expiresAt": { "type": "string", "format": "date-time" },
+    "artifactRoot": { "$ref": "#/$defs/root" },
+    "receiptRoot": { "$ref": "#/$defs/root" }
+  },
+  "$defs": {
+    "root": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+    "artifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["role", "platform", "artifactRoot", "manifestRoot"],
+      "properties": {
+        "role": { "type": "string", "minLength": 1 },
+        "platform": { "type": "string", "minLength": 1 },
+        "artifactRoot": { "$ref": "#/$defs/root" },
+        "manifestRoot": { "$ref": "#/$defs/root" }
+      }
+    }
+  }
+}

package/dist/site/agent-index.json

@@ -24,6 +24,7 @@
     "schemas/v4-publication-rehearsal-capsule-v1.schema.json",
     "schemas/v4-adopter-delivery-v1.schema.json",
     "schemas/release-tail-capabilities-v1.schema.json",
+    "schemas/v4-publication-qualification-v1.schema.json",
     "buildchain-contract.json",
     "kfd-upstream-aggregate.json",
     "kfd-claims.json",

package/dist/site/artifact-schemas.json

@@ -12,6 +12,7 @@
     "schemas/v4-publication-rehearsal-capsule-v1.schema.json",
     "schemas/v4-adopter-delivery-v1.schema.json",
     "schemas/release-tail-capabilities-v1.schema.json",
+    "schemas/v4-publication-qualification-v1.schema.json",
     "kfd-support.json",
     "artifact-evidence.json",
     "product-mechanism.json",
@@ -51,6 +52,7 @@
     "schemas/v4-publication-rehearsal-capsule-v1.schema.json",
     "schemas/v4-adopter-delivery-v1.schema.json",
     "schemas/release-tail-capabilities-v1.schema.json",
+    "schemas/v4-publication-qualification-v1.schema.json",
     "buildchain-contract.json",
     "kfd-claims.json",
     "product-mechanism.json",

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.8",
+    "version": "4.0.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -1361,7 +1361,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa",
-      "auditDigest": "sha256:6cf134f8bc0c0ab488cb159ef2bb9f7a94b454c4f7adee134ce7dee00d84c5d3",
+      "auditDigest": "sha256:3b1346cb6a1499a2c49c05f28f1c9c0092692b66dcacf478266b413c9c508f31",
       "compatibleBreakingDigests": [
         "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650"
       ],
@@ -1409,7 +1409,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:97fa61f0e97641edd3b1b435ace06c621e702f0b8b406c4f3998c148a337c74a"
+      "auditDigest": "sha256:7a0a0e8983ebd565c522ebb6eec25fb3cd8bfe9c55541650c0d36165b4db0134"
     },
     {
       "contractVersion": 1,
@@ -1492,7 +1492,7 @@
         "durable consumers call the public floating workflow and may route a train or exact runtime only through trusted non-persistent dispatch input"
       ],
       "breakingDigest": "sha256:21b65d0746d2e8b3e8a7df4c6fab295a85c8fd42cc405ec3bc5df5cdab0421f0",
-      "auditDigest": "sha256:1392bc85e8aef8c19161b06764900c2cdb0f0cd57bf65dc95ad578040add7bea"
+      "auditDigest": "sha256:bcfd872260c754e68cabe183c8c1c3acb2b2196e1601208bf7bc846b8e32af74"
     },
     {
       "contractVersion": 1,
@@ -1591,7 +1591,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:5f10c81d3f80cb417960be682921884639c40b6d875f1a3b1ffae7e652c3f468",
-      "auditDigest": "sha256:0fc3f61d5a10b76dcc03aba4e1d4eea2a25b0de4921929d5c86d27db00d08da6"
+      "auditDigest": "sha256:d9821bf071e83386e596e1d460c1adc46808451fce44b6586ae26fb11e535991"
     },
     {
       "contractVersion": 1,
@@ -1646,7 +1646,7 @@
         "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph"
       ],
       "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
-      "auditDigest": "sha256:fc62e34e4fde50da0bf5bf2f9e0b455a8ff1ccea62f7348d1a132567e2c829e1",
+      "auditDigest": "sha256:1b505fd44a452b01e0516c9da45994cf7edb33c7f4c3bc01b2f3155ed3d3feb0",
       "compatibleBreakingDigests": [
         "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
       ],
@@ -1699,7 +1699,7 @@
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
       ],
       "breakingDigest": "sha256:27f0cb9c7d97288850d215be8696b323471c41fd1cdf3a2ff3ebf21f62541960",
-      "auditDigest": "sha256:748e1d69ca28b631e86788de0ff359b11164b3ac1edda1b146ca49f3ac3856dc",
+      "auditDigest": "sha256:fd7952e3ab411e83cad7ba5de9349babf3475dab8fdc1b80c3c062af7602466c",
       "compatibleBreakingDigests": [
         "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace"
       ],
@@ -1819,6 +1819,52 @@
       "breakingDigest": "sha256:0bcba689ab5060e12230db4118895242ecb48677ff581ea0360b1833bdac558c",
       "auditDigest": "sha256:da366842e8943c88a4f12520faf2d19c555b7530d8f6d44cf75a37b94200960d"
     },
+    {
+      "contractVersion": 1,
+      "stability": "stable",
+      "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line",
+      "id": "v4-release-candidate-promote-action",
+      "kind": "action",
+      "path": "actions/v4-release-candidate-promote/action.yml",
+      "publicRef": "kungfu-systems/buildchain/actions/v4-release-candidate-promote@v4",
+      "requiredInputs": [
+        "token",
+        "repository",
+        "source-sha",
+        "version",
+        "tag",
+        "channel",
+        "candidate-passport-path",
+        "stage-capsules-path",
+        "publication-qualification-path"
+      ],
+      "requiredOutputs": [
+        "release-passport-path",
+        "release-passport-root",
+        "transaction-state",
+        "declaration-root",
+        "transaction-root",
+        "state-root",
+        "receipt-roots-json"
+      ],
+      "breakingDefaults": {
+        "statePath": ".buildchain/release-tail/state.json",
+        "executionBoundary": "built-in-provider-plane-only"
+      },
+      "optionalInputs": [
+        "artifact-paths",
+        "state-path",
+        "failure-after-capability"
+      ],
+      "guarantees": [
+        "v4 promotion consumes only sealed candidate, Stage Capsule, qualification, and artifact evidence",
+        "GitHub Release, signed-channel commit, activation, readback, and released-evidence synthesis use built-in provider adapters",
+        "durable provider checkpoints resume completed capabilities without replay",
+        "no consumer command, script, shell, checkout, or executable tail hook is accepted"
+      ],
+      "breakingDigest": "sha256:9229eb3a000fb408feb6b8793c209c77afbf9327026467d68954470e22e4f8f4",
+      "auditDigest": "sha256:83fd394419851e6da877c50018e879b447497db52b0ac871dfd83e074f5459a8"
+    },
     {
       "contractVersion": 1,
       "stability": "stable",
@@ -1888,7 +1934,7 @@
         "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata bound to the authoritative publication channel and tag syntax retained as the fallback for ordinary callers"
       ],
       "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
-      "auditDigest": "sha256:3c34606573df2ff29c4bc9b959f0b842ca7653427139c4bf8d600f152d5fe1a4",
+      "auditDigest": "sha256:2422f86979d2ce521a39e0f19db23cac4bd251bc21f701237a0105fb802e453b",
       "compatibleBreakingDigests": [
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
       ],
@@ -2012,7 +2058,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:7b433d34f87651d8fb187d06b83113e93cbc0243a0f93ce33f375a4737f144f6"
+      "auditDigest": "sha256:4932b0ef2ea1c62101347789ef233c77142630a69762d325688269fe29c230c5"
     },
     {
       "contractVersion": 1,
@@ -2061,7 +2107,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:7b433d34f87651d8fb187d06b83113e93cbc0243a0f93ce33f375a4737f144f6"
+      "auditDigest": "sha256:4932b0ef2ea1c62101347789ef233c77142630a69762d325688269fe29c230c5"
     },
     {
       "contractVersion": 1,
@@ -2211,7 +2257,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:9ac244b89ab685df5c1d43ebcb9195c9133261b77d2ce948e3d4083e8651f086"
+      "auditDigest": "sha256:dd80914275c60efcf95b29d44e861aeba5075ee7da9094adaa5cdb5714b59bf6"
     },
     {
       "contractVersion": 1,
@@ -2233,7 +2279,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:14c116689f571b197fad4632683335bc13718abd17276f3da0ffbf1e85a74483"
+      "auditDigest": "sha256:dab7be33bf7d0c36fd59b55f74b3cb964ae24f348b95cd863f276c70e6d3db6e"
     },
     {
       "contractVersion": 1,
@@ -2289,7 +2335,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:91aeff9ffcc598918626c24850a00063a79ddf26aa48702fa22e7dce8c761968",
-        "registryDigest": "sha256:eb9eb918b763f303baf313e153076e9d3158ca28a2e6cc558834a06e49d9d9cf",
+        "registryDigest": "sha256:e9fe5b78abb43be3daeebf5a6c214f0c53e6519e96edb76b284bb8b737e57474",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -2424,6 +2470,8 @@
         "build-command",
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
+        "buildchain-contract-expected-channel",
+        "buildchain-contract-expected-major",
         "buildchain-contract-lock-path",
         "buildchain-expected-channel",
         "buildchain-expected-major",
@@ -2496,8 +2544,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:03677ba50080b3813a20004c41802e340368e4d225782fae194e3722c763bd01",
-        "registryDigest": "sha256:eb9eb918b763f303baf313e153076e9d3158ca28a2e6cc558834a06e49d9d9cf",
+        "digest": "sha256:c36f7dcd859a460ce757bc080132e9bf1be6875ff90e0a44308b414198a494fe",
+        "registryDigest": "sha256:e9fe5b78abb43be3daeebf5a6c214f0c53e6519e96edb76b284bb8b737e57474",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -2623,6 +2671,14 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "buildchain-contract-expected-channel": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "buildchain-contract-expected-major": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "buildchain-contract-lock-path": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -2908,7 +2964,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
-      "auditDigest": "sha256:6cf134f8bc0c0ab488cb159ef2bb9f7a94b454c4f7adee134ce7dee00d84c5d3",
+      "auditDigest": "sha256:3b1346cb6a1499a2c49c05f28f1c9c0092692b66dcacf478266b413c9c508f31",
       "compatibleBreakingDigests": [
         "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
         "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be"
@@ -2990,6 +3046,8 @@
         "buildchain-channel",
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
+        "buildchain-contract-expected-channel",
+        "buildchain-contract-expected-major",
         "buildchain-contract-lock-path",
         "buildchain-expected-channel",
         "buildchain-expected-major",
@@ -3063,8 +3121,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:45978a572cf3ce57b48e5c3190761ad4fbeedc8e75ea0dae2e66ea5a980282df",
-        "registryDigest": "sha256:eb9eb918b763f303baf313e153076e9d3158ca28a2e6cc558834a06e49d9d9cf",
+        "digest": "sha256:a653e831202898143b5e46cc42120a22290f416b9dc851c1bec7088eb42bcb17",
+        "registryDigest": "sha256:e9fe5b78abb43be3daeebf5a6c214f0c53e6519e96edb76b284bb8b737e57474",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -3198,6 +3256,14 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "buildchain-contract-expected-channel": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "buildchain-contract-expected-major": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "buildchain-contract-lock-path": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -3487,7 +3553,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:30549aa26cd1e1dd81f10fe3529d3c6e3f8438a6efa0100c47ebae4d2f3d71df",
-      "auditDigest": "sha256:97fa61f0e97641edd3b1b435ace06c621e702f0b8b406c4f3998c148a337c74a",
+      "auditDigest": "sha256:7a0a0e8983ebd565c522ebb6eec25fb3cd8bfe9c55541650c0d36165b4db0134",
       "compatibleBreakingDigests": [
         "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273"
       ],
@@ -3566,7 +3632,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:eb9eb918b763f303baf313e153076e9d3158ca28a2e6cc558834a06e49d9d9cf",
+        "registryDigest": "sha256:e9fe5b78abb43be3daeebf5a6c214f0c53e6519e96edb76b284bb8b737e57474",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -3742,6 +3808,8 @@
         "build-command",
         "buildchain-contract-compatibility-policy",
         "buildchain-contract-drift-issue-mode",
+        "buildchain-contract-expected-channel",
+        "buildchain-contract-expected-major",
         "buildchain-contract-lock-path",
         "buildchain-ref",
         "buildchain-repository",
@@ -3782,8 +3850,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:eb9eb918b763f303baf313e153076e9d3158ca28a2e6cc558834a06e49d9d9cf",
+        "digest": "sha256:834c08b0099b646075b1850548454986b7c150f808019c6ec7d8eae377214a19",
+        "registryDigest": "sha256:e9fe5b78abb43be3daeebf5a6c214f0c53e6519e96edb76b284bb8b737e57474",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -3805,6 +3873,14 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "buildchain-contract-expected-channel": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "buildchain-contract-expected-major": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "buildchain-contract-lock-path": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -3962,7 +4038,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27",
-      "auditDigest": "sha256:748e1d69ca28b631e86788de0ff359b11164b3ac1edda1b146ca49f3ac3856dc"
+      "auditDigest": "sha256:fd7952e3ab411e83cad7ba5de9349babf3475dab8fdc1b80c3c062af7602466c"
     },
     {
       "contractVersion": 1,
@@ -4029,7 +4105,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:e48bb7719886d3949d63ec69d638264b20c7de8a70ee2db3cca78d4369f5a41e",
-        "registryDigest": "sha256:eb9eb918b763f303baf313e153076e9d3158ca28a2e6cc558834a06e49d9d9cf",
+        "registryDigest": "sha256:e9fe5b78abb43be3daeebf5a6c214f0c53e6519e96edb76b284bb8b737e57474",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -4219,7 +4295,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:eb9eb918b763f303baf313e153076e9d3158ca28a2e6cc558834a06e49d9d9cf",
+        "registryDigest": "sha256:e9fe5b78abb43be3daeebf5a6c214f0c53e6519e96edb76b284bb8b737e57474",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -4477,6 +4553,7 @@
         "promotion-shell-ref",
         "promotion-shell-sha",
         "promotion-target-ref",
+        "provider-failure-after-capability",
         "publication-admission-json",
         "publication-authority-workflow-path",
         "publication-auto-admission",
@@ -4518,6 +4595,7 @@
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
+        "release-passport-adopter-delivery-json",
         "release-passport-attachment-command",
         "release-passport-buildchain-self-kfd",
         "release-passport-evidence-command",
@@ -4531,6 +4609,7 @@
         "release-passport-kfd-3-artifact-verify-command",
         "release-passport-kfd-3-artifact-witness-jsons",
         "release-passport-kfd-3-prebuild-witness-jsons",
+        "release-passport-kfd-adopter-manifest-gate-json",
         "release-passport-kfd-adopter-manifest-json",
         "release-passport-kfd-product-gate-jsons",
         "release-passport-kfd-support-matrix-json",
@@ -4558,8 +4637,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:3c83524f650a4d04004400d3821dbbd081b8802035dc6004464cdcfd0b5cdfc3",
-        "registryDigest": "sha256:eb9eb918b763f303baf313e153076e9d3158ca28a2e6cc558834a06e49d9d9cf",
+        "digest": "sha256:f4d2d311fa07f70310f1538c6274ddf17a78392db716687c25171c3ba495d21f",
+        "registryDigest": "sha256:e9fe5b78abb43be3daeebf5a6c214f0c53e6519e96edb76b284bb8b737e57474",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -4761,6 +4840,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "provider-failure-after-capability": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "publication-admission-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -4925,6 +5008,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "release-passport-adopter-delivery-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "release-passport-attachment-command": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -4977,6 +5064,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "release-passport-kfd-adopter-manifest-gate-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "release-passport-kfd-adopter-manifest-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -5082,7 +5173,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:fc62e34e4fde50da0bf5bf2f9e0b455a8ff1ccea62f7348d1a132567e2c829e1"
+      "auditDigest": "sha256:1b505fd44a452b01e0516c9da45994cf7edb33c7f4c3bc01b2f3155ed3d3feb0"
     },
     {
       "contractVersion": 1,
@@ -5147,7 +5238,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12",
-        "registryDigest": "sha256:eb9eb918b763f303baf313e153076e9d3158ca28a2e6cc558834a06e49d9d9cf",
+        "registryDigest": "sha256:e9fe5b78abb43be3daeebf5a6c214f0c53e6519e96edb76b284bb8b737e57474",
         "inputClassifications": {
           "agent-work-context-json": {
             "classification": "digest-only",
@@ -5291,7 +5382,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:eb9eb918b763f303baf313e153076e9d3158ca28a2e6cc558834a06e49d9d9cf",
+        "registryDigest": "sha256:e9fe5b78abb43be3daeebf5a6c214f0c53e6519e96edb76b284bb8b737e57474",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -5307,6 +5398,6 @@
   "compatibilityFactRegistryRoot": "sha256:232fd556a2372b29db586bbc2acbdfce6464a68c93902797ff527f75f7816c42",
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
-  "compatibilityDigest": "sha256:5de1c69386510b74b17eb70141b8bdd07063d62c504f91db5e84b67c6d4b64a2",
-  "contractDigest": "sha256:5174492f4e44f42e3e5b6869eb8a6226542ebb772b3928494efafc168b4fa5f5"
+  "compatibilityDigest": "sha256:20411029d83211dff426fb6535a608902129844a5ccb4788db77d3f81becb839",
+  "contractDigest": "sha256:766fa56a71450d75897ca1040098b5acce8851cb3f1ab76dadc7abc2364bd763"
 }