@kungfu-tech/buildchain 4.0.2-alpha.0 → 4.0.2-alpha.2

package/architecture/v3-v4-live-capability-inventory.json

@@ -16518,7 +16518,7 @@
         "evidence": {
           "path": ".buildchain/release-impact.json",
           "selector": "$",
-          "valueRoot": "sha256:86635418114935d03650376b734aeb2e081648ba519d1f2ae9eece184934a7a3"
+          "valueRoot": "sha256:8411804d1efba911b09a0e83494c68affe7cfede5bc5134f12cbede12be1f655"
         }
       }
     },
@@ -17266,7 +17266,7 @@
         "evidence": {
           "path": "dist/site/node-api-registry.json",
           "selector": "exports[export=\"./github-governance-authority\"]",
-          "valueRoot": "sha256:e8fd60fb66ceef4dc83a727c98eec0df00824a2bb5b3cb151b659c022b0acbee"
+          "valueRoot": "sha256:c840ddeacf5eb8da14aee3e6879f0827aa965aa0187aecc36ca776d07bb6cdab"
         }
       }
     },
@@ -17596,7 +17596,7 @@
         "evidence": {
           "path": "dist/site/node-api-registry.json",
           "selector": "exports[export=\"./paper\"]",
-          "valueRoot": "sha256:cfcd0b854e3301c651106bb9e1a85980d8d1fdc143b52f197d6cb4722682585e"
+          "valueRoot": "sha256:e86f76742a70d77039c39d9fb106de20c99458ccc07b65fc674328d2a952f819"
         }
       }
     },
@@ -17706,7 +17706,7 @@
         "evidence": {
           "path": "dist/site/node-api-registry.json",
           "selector": "exports[export=\"./publication-control-plane-audit\"]",
-          "valueRoot": "sha256:cf82832e74c4e7ae5e5d5ae1c0ec867e6eedefbeebd0a60d803dcd2df68e8813"
+          "valueRoot": "sha256:1bb25a02f8d3ef0148c3e2a4ad9b6a94a841adc1ff1daf94f98d5e34c195fd56"
         }
       }
     },
@@ -17926,7 +17926,7 @@
         "evidence": {
           "path": "dist/site/node-api-registry.json",
           "selector": "exports[export=\"./release-candidate-recovery\"]",
-          "valueRoot": "sha256:01261a72dc7d43e61d5a9ec649ce4d7dfee1ab1c0148bd6cff0edad40aba008b"
+          "valueRoot": "sha256:131e9c0f108a311b8246d8dfc55ff9d347cb9255162452f392874d6b01acf203"
         }
       }
     },
@@ -17970,7 +17970,7 @@
         "evidence": {
           "path": "dist/site/node-api-registry.json",
           "selector": "exports[export=\"./release-passport\"]",
-          "valueRoot": "sha256:252874ae31215dc568e4184ec199c985b6a7cb8e887c5a89dcb3d73bfe960f02"
+          "valueRoot": "sha256:6a7403eb6020c6af989a721021aa6b9715df7db70c9f5da89f2b689c3ba767ae"
         }
       }
     },
@@ -18168,7 +18168,7 @@
         "evidence": {
           "path": "dist/site/buildchain-contract.json",
           "selector": "$",
-          "valueRoot": "sha256:9b6a3e20dc4e4170c22306b8ac4a7ee67aabd2be51646872a1bfdfecb83fff64"
+          "valueRoot": "sha256:5373a6b746a389305d55d58d93b9aebf1ca61e2b13e32aab309e98f41a89b13c"
         }
       }
     },
@@ -18256,7 +18256,7 @@
         "evidence": {
           "path": "dist/site/kfd-claims.json",
           "selector": "$",
-          "valueRoot": "sha256:f80363cd21046e7aff9ac3893ece8d8b1684de96ff5119fb0ca9fe8dd4e342bb"
+          "valueRoot": "sha256:94d546cec054e24f53841af5a46808cd452d0005f5bfcf8f7d370711ae446f0b"
         }
       }
     },
@@ -18278,7 +18278,7 @@
         "evidence": {
           "path": "dist/site/manual-registry.json",
           "selector": "$",
-          "valueRoot": "sha256:b59b28864798f61c0c893afd23c9a234ef9bafae98fe579bc7a3d160dd89c46b"
+          "valueRoot": "sha256:b446b41f1342623ad5189850985553a9044dd14f3c4a24aa44cfc54db95ce876"
         }
       }
     },
@@ -18300,7 +18300,7 @@
         "evidence": {
           "path": "dist/site/node-api-registry.json",
           "selector": "$",
-          "valueRoot": "sha256:872cc8fb9f34546c2f031c2adc04c164196895c4fa039b110546116b826405b8"
+          "valueRoot": "sha256:9b173aa7390cc94d24b9a2b5711a367b15771b73773cd8f0a78f5c71ed054701"
         }
       }
     },
@@ -18322,7 +18322,7 @@
         "evidence": {
           "path": "dist/site/page-registry.json",
           "selector": "$",
-          "valueRoot": "sha256:21b32f318518e79b75f1097128c582a27db32934cc0a7d6d625d2bc3c5b9696c"
+          "valueRoot": "sha256:e01f49540ad858f2289ed212bdae9dab01be495f6c57d7d14ab07d3639201d3f"
         }
       }
     },
@@ -18344,7 +18344,7 @@
         "evidence": {
           "path": "dist/site/public-surface-audit.json",
           "selector": "$",
-          "valueRoot": "sha256:de1e9d5d7272dab92d5c9190859095facb34493ece6f37a1955aba2c6d7d1aed"
+          "valueRoot": "sha256:dfdf7e6d38ea9b2cfec280831472ba61a825b88578437bc3b4965b61c656e0b1"
         }
       }
     },
@@ -18564,7 +18564,7 @@
         "evidence": {
           "path": "dist/site/site-manifest.json",
           "selector": "$",
-          "valueRoot": "sha256:82fa02f7b83f5edcaf93288122d0e653795ed3301b0b6c2ca8ebcd23eddbdeec"
+          "valueRoot": "sha256:52413ce389353ea7fd83598a6f5c2ebbb5a88f163cff60ec4227324384d96fd8"
         }
       }
     },
@@ -18586,7 +18586,7 @@
         "evidence": {
           "path": "dist/site/workflow-registry.json",
           "selector": "$",
-          "valueRoot": "sha256:09480a4485d410fb1a073178eea6448258b6c9e22200d22ac1f0519c78beecc7"
+          "valueRoot": "sha256:590efe0d07ae20987f36056835f21e2a17fe40c242eb55032776b9bc4c0c7735"
         }
       }
     },
@@ -68879,7 +68879,7 @@
         "evidence": {
           "path": "architecture/v4-runtime-semantic-closure.json",
           "selector": "capability[id=\"publish-transaction\"]",
-          "valueRoot": "sha256:6917cce13c939d813f2ddcf099cf22fbbc2a601ed94bcc3ac56b7e495fc0610a"
+          "valueRoot": "sha256:4e24bcc1f070542ed22f3892d6f75f0d437e3242bfdee770c08788eca4407900"
         }
       }
     },
@@ -102360,9 +102360,9 @@
     },
     "liveV4": {
       "branch": "origin/dev/v4/v4.0",
-      "commit": "11b4ab21405cdffcc9d6dc10cd947618d9d1bf9c",
+      "commit": "97edd5b93eb67e5bf36ad55726e08231b47b70c0",
       "role": "execution-time-protected-target",
-      "tree": "e427a70d932d1bf9575841c0e89974e70a8f6e23"
+      "tree": "05b14410fd3350bc6a621fe2c1bef575fef9b5fd"
     },
     "priorFamilyV3": {
       "branch": "origin/dev/v3/v3.0",

package/architecture/v4-release-invocation-fixtures.json

@@ -0,0 +1,119 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-release-invocation-fixtures/v1",
+  "invocations": {
+    "alpha": {
+      "schema": "kungfu-buildchain-v4-release-invocation/v1",
+      "publisher": {
+        "repository": "kungfu-systems/buildchain",
+        "workflow": ".github/workflows/.release-candidate-promote.yml",
+        "workflowSha": "30cbbc46870871a0eacbe952935ea753e473ff25",
+        "job": "apply"
+      },
+      "runtime": {
+        "repository": "kungfu-systems/buildchain",
+        "commit": "30cbbc46870871a0eacbe952935ea753e473ff25",
+        "tree": "b86fea30cb92a32215206f159708a8ea1d10d462"
+      },
+      "candidate": {
+        "repository": "kungfu-systems/kungfu",
+        "commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "tree": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+        "version": "4.0.0-alpha.9"
+      },
+      "target": {
+        "channel": "alpha",
+        "tag": "v4.0.0-alpha.9",
+        "expectedOldSha": "cccccccccccccccccccccccccccccccccccccccc"
+      },
+      "authority": {
+        "policyRoot": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "qualificationRoot": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+        "warrantRoot": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+      }
+    },
+    "stable": {
+      "schema": "kungfu-buildchain-v4-release-invocation/v1",
+      "publisher": {
+        "repository": "kungfu-systems/buildchain",
+        "workflow": ".github/workflows/.release-candidate-promote.yml",
+        "workflowSha": "30cbbc46870871a0eacbe952935ea753e473ff25",
+        "job": "apply"
+      },
+      "runtime": {
+        "repository": "kungfu-systems/buildchain",
+        "commit": "30cbbc46870871a0eacbe952935ea753e473ff25",
+        "tree": "b86fea30cb92a32215206f159708a8ea1d10d462"
+      },
+      "candidate": {
+        "repository": "kungfu-systems/kungfu",
+        "commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "tree": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+        "version": "4.0.0"
+      },
+      "target": {
+        "channel": "stable",
+        "tag": "v4.0.0",
+        "expectedOldSha": "cccccccccccccccccccccccccccccccccccccccc"
+      },
+      "authority": {
+        "policyRoot": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "qualificationRoot": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+        "warrantRoot": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+      }
+    }
+  },
+  "cases": [
+    {
+      "id": "alpha-fresh",
+      "invocation": "alpha",
+      "route": { "surface": "alpha", "execution": "fresh" }
+    },
+    {
+      "id": "alpha-resume",
+      "invocation": "alpha",
+      "route": { "surface": "alpha", "execution": "resume" }
+    },
+    {
+      "id": "public-alpha",
+      "invocation": "alpha",
+      "route": { "surface": "public", "execution": "fresh" }
+    },
+    {
+      "id": "private-alpha",
+      "invocation": "alpha",
+      "route": { "surface": "private", "execution": "resume" }
+    },
+    {
+      "id": "declarative-alpha",
+      "invocation": "alpha",
+      "route": { "surface": "declarative", "execution": "fresh" }
+    },
+    {
+      "id": "legacy-alpha",
+      "invocation": "alpha",
+      "route": { "surface": "legacy-compatible", "execution": "resume" }
+    },
+    {
+      "id": "stable-fresh",
+      "invocation": "stable",
+      "route": { "surface": "stable", "execution": "fresh" }
+    },
+    {
+      "id": "stable-resume",
+      "invocation": "stable",
+      "route": { "surface": "stable", "execution": "resume" }
+    }
+  ],
+  "equivalenceGroups": [
+    [
+      "alpha-fresh",
+      "alpha-resume",
+      "public-alpha",
+      "private-alpha",
+      "declarative-alpha",
+      "legacy-alpha"
+    ],
+    ["stable-fresh", "stable-resume"]
+  ]
+}

package/architecture/v4-release-topology.json

@@ -0,0 +1,238 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-release-topology/v1",
+  "sourceCut": {
+    "branch": "dev/v4/v4.0",
+    "commit": "30cbbc46870871a0eacbe952935ea753e473ff25",
+    "tree": "b86fea30cb92a32215206f159708a8ea1d10d462"
+  },
+  "enforcement": "converged",
+  "closedWorld": {
+    "workflowPaths": [
+      ".github/workflows/.publication-authority.yml",
+      ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/.release-elastic-beanstalk.yml",
+      ".github/workflows/.release-new-version.yml",
+      ".github/workflows/.sam-release.yml",
+      ".github/workflows/.wheel-release.yml",
+      ".github/workflows/buildchain-ref-promotion-recovery.yml",
+      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/npm-publish.yml",
+      ".github/workflows/paper-release-sealed.yml",
+      ".github/workflows/paper-release.yml",
+      ".github/workflows/release-candidate-promote.yml",
+      ".github/workflows/release-new-version.yml",
+      ".github/workflows/release-tail.yml",
+      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+    ],
+    "unknownTopologyPolicy": "fail-closed"
+  },
+  "semanticScope": {
+    "workflowPaths": [
+      ".github/workflows/.release-candidate-promote.yml",
+      ".github/workflows/buildchain-ref-promotion-recovery.yml",
+      ".github/workflows/buildchain-ref-promotion.yml",
+      ".github/workflows/release-candidate-promote.yml",
+      ".github/workflows/v4-declarative-release-tail-dogfood.yml"
+    ],
+    "excludedMechanisms": [
+      "Paper product release",
+      "npm dry-run",
+      "v3 rollback workflows",
+      "retired compatibility workflows"
+    ]
+  },
+  "baselineMetrics": {
+    "workflowCount": 15,
+    "jobCount": 38,
+    "reusableEdgeCount": 11,
+    "mutationRelevantNodeCount": 25,
+    "contentsWriteJobCount": 10,
+    "oidcWriteJobCount": 9,
+    "semanticMutationRelevantNodeCount": 17
+  },
+  "targetBudgets": {
+    "semanticBoundaries": ["QUALIFY", "APPLY", "SETTLE"],
+    "maximumMutationRelevantNodeCount": 8,
+    "contentsWriteJobCount": 1,
+    "oidcWriteJobCount": 1,
+    "publisherIdentityCount": 1,
+    "runtimeIdentityCount": 1,
+    "terminalReceiptAuthorityCount": 1
+  },
+  "authorityClassification": {
+    "publisher": {
+      "current": [
+        ".github/workflows/.release-candidate-promote.yml#legacy-promote",
+        ".github/workflows/.release-candidate-promote.yml#v4-declarative-promote"
+      ],
+      "target": ".github/workflows/.release-candidate-promote.yml#apply"
+    },
+    "runtimeSelectors": {
+      "discoveryOnly": ["v4-alpha", "v4", "alpha/v4/v4.0"],
+      "postAdmissionPolicy": "exact-sha-only"
+    },
+    "engines": {
+      "current": ["legacy-promote", "v4-declarative-promote"],
+      "target": "release-transaction"
+    },
+    "terminalProjections": {
+      "current": ["promote", "controller-receipt", "release-tail receipt"],
+      "target": "ReleaseReceipt"
+    }
+  },
+  "observedTopology": {
+    "jobRecordFields": [
+      "id",
+      "kind",
+      "uses",
+      "contentsPermission",
+      "oidcPermission",
+      "carriers",
+      "mutationSignals"
+    ],
+    "workflows": [
+      {
+        "path": ".github/workflows/.publication-authority.yml",
+        "triggers": ["workflow_call"],
+        "jobs": [
+          "verify|runner|-|read|-|artifactDownload,artifactUpload,jobOutput|-"
+        ],
+        "reusableEdges": []
+      },
+      {
+        "path": ".github/workflows/.release-candidate-promote.yml",
+        "triggers": ["workflow_call"],
+        "jobs": [
+          "apply|runner|-|write|write|artifactDownload,artifactUpload|contents-write,oidc-write,promotion-runtime",
+          "qualify|runner|-|read|-|artifactUpload,jobOutput|-",
+          "settle|runner|-|read|-|artifactDownload,artifactUpload,jobOutput|-"
+        ],
+        "reusableEdges": []
+      },
+      {
+        "path": ".github/workflows/.release-elastic-beanstalk.yml",
+        "triggers": ["workflow_call"],
+        "jobs": ["retired|runner|-|-|-|-|-"],
+        "reusableEdges": []
+      },
+      {
+        "path": ".github/workflows/.release-new-version.yml",
+        "triggers": ["workflow_call"],
+        "jobs": ["retired|runner|-|-|-|-|-"],
+        "reusableEdges": []
+      },
+      {
+        "path": ".github/workflows/.sam-release.yml",
+        "triggers": ["workflow_call"],
+        "jobs": ["retired|runner|-|-|-|-|-"],
+        "reusableEdges": []
+      },
+      {
+        "path": ".github/workflows/.wheel-release.yml",
+        "triggers": ["workflow_call"],
+        "jobs": ["retired|runner|-|-|-|-|-"],
+        "reusableEdges": []
+      },
+      {
+        "path": ".github/workflows/buildchain-ref-promotion-recovery.yml",
+        "triggers": ["workflow_dispatch"],
+        "jobs": [
+          "resume|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha"
+        ]
+      },
+      {
+        "path": ".github/workflows/buildchain-ref-promotion.yml",
+        "triggers": ["workflow_dispatch", "workflow_run:completed"],
+        "jobs": [
+          "promote|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
+          "reject-invalid-candidate-recovery|runner|-|read|-|-|-",
+          "reject-invalid-durable-recovery|runner|-|read|-|-|-",
+          "reject-manual-apply|runner|-|read|-|-|-"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha"
+        ]
+      },
+      {
+        "path": ".github/workflows/npm-publish.yml",
+        "triggers": ["workflow_dispatch"],
+        "jobs": ["dry-run|runner|-|-|-|-|direct-publication-command"],
+        "reusableEdges": []
+      },
+      {
+        "path": ".github/workflows/paper-release-sealed.yml",
+        "triggers": ["workflow_call"],
+        "jobs": [
+          "publication-authority|reusable-call|./.github/workflows/.publication-authority.yml|read|-|-|-",
+          "publication-candidate|reusable-call|./.github/workflows/publication-artifact.yml|read|-|-|-",
+          "publish|runner|-|read|write|artifactDownload,artifactUpload,jobOutput|contents-write,oidc-write,promotion-runtime"
+        ],
+        "reusableEdges": [
+          "./.github/workflows/.publication-authority.yml",
+          "./.github/workflows/publication-artifact.yml"
+        ]
+      },
+      {
+        "path": ".github/workflows/paper-release.yml",
+        "triggers": ["workflow_call"],
+        "jobs": [
+          "paper-release|runner|-|write|write|artifactUpload,jobOutput|contents-write,oidc-write,promotion-runtime",
+          "publication-authority|reusable-call|./.github/workflows/.publication-authority.yml|read|-|-|-"
+        ],
+        "reusableEdges": ["./.github/workflows/.publication-authority.yml"]
+      },
+      {
+        "path": ".github/workflows/release-candidate-promote.yml",
+        "triggers": ["workflow_call"],
+        "jobs": [
+          "consumer-admission|runner|-|read|-|artifactUpload|-",
+          "invoke|reusable-call|kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha|write|write|-|contents-write,oidc-write",
+          "resolve-promotion|runner|-|read|-|jobOutput|-"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha"
+        ]
+      },
+      {
+        "path": ".github/workflows/release-new-version.yml",
+        "triggers": ["pull_request:closed"],
+        "jobs": ["buildchain-self-release|runner|-|-|-|-|-"],
+        "reusableEdges": []
+      },
+      {
+        "path": ".github/workflows/release-tail.yml",
+        "triggers": ["workflow_call"],
+        "jobs": ["release-tail|runner|-|-|-|artifactUpload|-"],
+        "reusableEdges": []
+      },
+      {
+        "path": ".github/workflows/v4-declarative-release-tail-dogfood.yml",
+        "triggers": ["workflow_dispatch"],
+        "jobs": [
+          "publish|reusable-call|kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha|-|-|-|-"
+        ],
+        "reusableEdges": [
+          "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha"
+        ]
+      }
+    ],
+    "metrics": {
+      "workflowCount": 15,
+      "jobCount": 25,
+      "reusableEdgeCount": 7,
+      "mutationRelevantNodeCount": 16,
+      "contentsWriteJobCount": 6,
+      "oidcWriteJobCount": 6
+    },
+    "semanticMetrics": {
+      "workflowCount": 5,
+      "mutationRelevantNodeCount": 8,
+      "contentsWriteJobCount": 1,
+      "oidcWriteJobCount": 1
+    }
+  }
+}

package/contracts/buildchain-v2-residuals-v1.json

@@ -16,15 +16,6 @@
       "owner": "buildchain-maintainers",
       "sunsetCondition": "Remove after every known caller migrates to the lifecycle version command."
     },
-    {
-      "path": ".github/workflows/.release-candidate-promote.yml",
-      "token": "actions/create-github-app-token@v2",
-      "expectedOccurrences": 1,
-      "classification": "third-party-action-version",
-      "callerStatus": "active",
-      "owner": "actions/create-github-app-token maintainers",
-      "sunsetCondition": "Upgrade through normal dependency review when a compatible successor is adopted."
-    },
     {
       "path": ".github/workflows/.release-docker.yml",
       "token": "workflows v2 Docker release path is retired",

package/contracts/fixtures/v4-tail-reseal-v1/valid.json

@@ -22,7 +22,7 @@
     "ref": "v4-alpha",
     "sha": "dddddddddddddddddddddddddddddddddddddddd",
     "contractRoot": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
-    "consumerPolicyReceiptRoot": "sha256:e545cb7dc918ba14b02e9a557623edb7aaadeee180b211b8a3164d67af03e789"
+    "consumerPolicyReceiptRoot": "sha256:8d8e55a4ae07a57a2a262e138f55148b05916c364b3d086530e1392c982b886f"
   },
   "warrant": {
     "candidateId": "candidate-alpha-2",

package/contracts/v4-release-invocation-v1.schema.json

@@ -0,0 +1,86 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.libkungfu.dev/schema/v4-release-invocation-v1.schema.json",
+  "title": "Buildchain v4 canonical ReleaseInvocation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "publisher",
+    "runtime",
+    "candidate",
+    "target",
+    "authority"
+  ],
+  "properties": {
+    "schema": { "const": "kungfu-buildchain-v4-release-invocation/v1" },
+    "publisher": { "$ref": "#/$defs/publisher" },
+    "runtime": { "$ref": "#/$defs/runtime" },
+    "candidate": { "$ref": "#/$defs/candidate" },
+    "target": { "$ref": "#/$defs/target" },
+    "authority": { "$ref": "#/$defs/authority" }
+  },
+  "$defs": {
+    "sha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "root": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+    "publisher": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "workflow", "workflowSha", "job"],
+      "properties": {
+        "repository": { "const": "kungfu-systems/buildchain" },
+        "workflow": {
+          "const": ".github/workflows/.release-candidate-promote.yml"
+        },
+        "workflowSha": { "$ref": "#/$defs/sha" },
+        "job": { "const": "apply" }
+      }
+    },
+    "runtime": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "commit", "tree"],
+      "properties": {
+        "repository": { "const": "kungfu-systems/buildchain" },
+        "commit": { "$ref": "#/$defs/sha" },
+        "tree": { "$ref": "#/$defs/sha" }
+      }
+    },
+    "candidate": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "commit", "tree", "version"],
+      "properties": {
+        "repository": { "type": "string", "pattern": "^[ -~]+$" },
+        "commit": { "$ref": "#/$defs/sha" },
+        "tree": { "$ref": "#/$defs/sha" },
+        "version": { "type": "string", "pattern": "^[ -~]+$" }
+      }
+    },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["channel", "tag", "expectedOldSha"],
+      "properties": {
+        "channel": { "enum": ["alpha", "stable"] },
+        "tag": {
+          "type": "string",
+          "pattern": "^v[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?$"
+        },
+        "expectedOldSha": {
+          "oneOf": [{ "$ref": "#/$defs/sha" }, { "type": "null" }]
+        }
+      }
+    },
+    "authority": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["policyRoot", "qualificationRoot", "warrantRoot"],
+      "properties": {
+        "policyRoot": { "$ref": "#/$defs/root" },
+        "qualificationRoot": { "$ref": "#/$defs/root" },
+        "warrantRoot": { "$ref": "#/$defs/root" }
+      }
+    }
+  }
+}