@kungfu-tech/buildchain 4.0.2-alpha.48 → 4.0.2-alpha.49

package/dist/site/public-surface-audit.json

@@ -4,7 +4,7 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 117,
-    "workflowCount": 114,
+    "workflowCount": 115,
     "actionCount": 8,
     "sitePageCount": 88,
     "docCommandRefCount": 1050,
@@ -3807,6 +3807,21 @@
         ],
         "outputCount": 5
       },
+      {
+        "id": "public-release-oci-compose-preview",
+        "path": ".github/workflows/public-release-oci-compose-preview.yml",
+        "reusable": true,
+        "inputs": [
+          "universal-request-json"
+        ],
+        "inputCount": 1,
+        "secrets": [
+          "BUILDCHAIN_PROMOTION_TOKEN"
+        ],
+        "secretCount": 1,
+        "outputs": [],
+        "outputCount": 0
+      },
       {
         "id": "public-release-paper-sealed",
         "path": ".github/workflows/public-release-paper-sealed.yml",
@@ -10933,8 +10948,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "7974d731c520cac8ba5825aed01c7f891f28bb7bac217fb3373f5f230d5f2c89",
-    "pageRegistryDigest": "decc7df0ff93d3befe128f88cea33a616f6b2ca4caebf4ce3c62ab70a2a348fc"
+    "workflowRegistryDigest": "2a7365a6d6a2a418650106289e309e598a77851158abf237d13276a38654178e",
+    "pageRegistryDigest": "0a523efc8b3f009003cb9005636f7c1eb754909610a29d47386afef4e9d94fe3"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -752,6 +752,21 @@
       "runnerPolicy": "qualified-measured",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/public-release-oci-compose-preview.yml",
+      "authorityClass": "product-publication",
+      "publicationCapable": true,
+      "capabilityIds": [
+        "oci-compose-preview"
+      ],
+      "credentialMode": "caller-secrets",
+      "publisherWorkflowMode": "caller-bound",
+      "publisherWorkflowPath": ".github/workflows/public-release-oci-compose-preview.yml",
+      "environment": "none",
+      "environmentMode": "fixed",
+      "runnerPolicy": "qualified-measured",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/public-release-paper-sealed.yml",
       "authorityClass": "product-publication",
@@ -1699,6 +1714,13 @@
       ],
       "classified": true
     },
+    {
+      "path": ".github/workflows/public-release-oci-compose-preview.yml",
+      "signals": [
+        "write-permission"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/public-release-paper-sealed.yml",
       "signals": [
@@ -2009,5 +2031,5 @@
       "classified": true
     }
   ],
-  "registryDigest": "9c343ae9f9e778b608317d973b02cada327bd31e5149482d7f385b173c20ec14"
+  "registryDigest": "e5eb0d7ee3cce4a25674909154f6bd0bf736d5b93df41c1d435c468aad50c32a"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-06T19:18:56.000Z",
-  "publishedAt": "2026-09-06T19:18:56.000Z",
+  "generatedAt": "2026-09-06T21:59:58.000Z",
+  "publishedAt": "2026-09-06T21:59:58.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e204709c1378e1a441806da1cea2663591a7968a",
+  "sourceRevision": "0eb5a97907da10cfc6f69b4f12f492bef351a105",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.48",
+    "version": "4.0.2-alpha.49",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-06T19:18:56.000Z",
-  "publishedAt": "2026-09-06T19:18:56.000Z",
+  "generatedAt": "2026-09-06T21:59:58.000Z",
+  "publishedAt": "2026-09-06T21:59:58.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "e204709c1378e1a441806da1cea2663591a7968a",
+  "sourceRevision": "0eb5a97907da10cfc6f69b4f12f492bef351a105",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.48",
+    "version": "4.0.2-alpha.49",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:3c90865d8814e238135c365c3d8f54279ce44bf06c35d907ad3957b862a3a51e"
+      "digest": "sha256:1a5e35c8cdd891208525085d21ee7caad873dc156fa54db15cc38c1bf17080c0"
     },
     {
       "id": "build-facts",

package/dist/site/workflow-registry.json

@@ -2746,7 +2746,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.48",
+      "introducedVersion": "4.0.2-alpha.49",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -3943,7 +3943,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.48",
+      "introducedVersion": "4.0.2-alpha.49",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -4484,6 +4484,40 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "public-release-oci-compose-preview",
+      "path": ".github/workflows/public-release-oci-compose-preview.yml",
+      "reusable": true,
+      "inputs": [
+        "universal-request-json"
+      ],
+      "inputCount": 1,
+      "secrets": [
+        "BUILDCHAIN_PROMOTION_TOKEN"
+      ],
+      "secretCount": 1,
+      "outputs": [],
+      "outputCount": 0,
+      "taxonomy": {
+        "id": "oci-compose-preview",
+        "role": "public",
+        "category": "release",
+        "purpose": "oci-compose-preview",
+        "status": "active",
+        "canonicalPath": ".github/workflows/public-release-oci-compose-preview.yml",
+        "compatibilityAlias": false
+      },
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "public-release-paper-sealed",
       "path": ".github/workflows/public-release-paper-sealed.yml",
@@ -5970,7 +6004,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.48",
+      "introducedVersion": "4.0.2-alpha.49",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6001,7 +6035,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.48",
+      "introducedVersion": "4.0.2-alpha.49",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6032,7 +6066,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.48",
+      "introducedVersion": "4.0.2-alpha.49",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/node-api-reference.md

@@ -117,7 +117,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain";` | `packages/core/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:65` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:66` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain";` | `packages/core/build-facts.js:45` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain";` | `packages/core/issue-reporting.js:199` |
@@ -188,7 +188,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain";` | `packages/core/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:104` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-publication-authority.js:105` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain";` | `packages/core/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain";` | `packages/core/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/cache-evidence.js:169` |
@@ -806,7 +806,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `BUILDCHAIN_VERSION_PIN_PATH` | constant: const BUILDCHAIN_VERSION_PIN_PATH | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_VERSION_PIN_PATH } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:5` |
 | `BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT` | constant: const BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { BUILDCHAIN_WORKFLOW_FRICTION_ISSUE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:5` |
 | `buildchainKfdClaims` | constant: const buildchainKfdClaims | none | value | Import does not declare a throw contract. | none-on-import | `import { buildchainKfdClaims } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd.js:896` |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:65` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:66` |
 | `buildConsumerIssueReport` | function: function buildConsumerIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildConsumerIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:104` |
 | `buildFactsDigest` | function: function buildFactsDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { buildFactsDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/build-facts.js:45` |
 | `buildWorkflowFrictionIssueReport` | function: function buildWorkflowFrictionIssueReport(options = {}) | options = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { buildWorkflowFrictionIssueReport } from "@kungfu-tech/buildchain/core";` | `packages/core/issue-reporting.js:199` |
@@ -877,7 +877,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `createBuildchainKfdSurfaceRegistry` | function: function createBuildchainKfdSurfaceRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainKfdSurfaceRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-kfd-claims.js:411` |
 | `createBuildchainLayoutDiscovery` | function: function createBuildchainLayoutDiscovery({ cwd = process.cwd(), buildchainVersion = "", } = {}) | { cwd = process.cwd(), buildchainVersion = "", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainLayoutDiscovery } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-layout.js:99` |
 | `createBuildchainLogger` | function: function createBuildchainLogger(options = {}) | options = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createBuildchainLogger } from "@kungfu-tech/buildchain/core";` | `packages/core/logging.js:300` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:104` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-publication-authority.js:105` |
 | `createBuildchainPublicClaimDefinitions` | function: function createBuildchainPublicClaimDefinitions() | none | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicClaimDefinitions } from "@kungfu-tech/buildchain/core";` | `packages/core/buildchain-kfd-claims.js:226` |
 | `createCacheEvidenceSet` | function: function createCacheEvidenceSet({ repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {}) | { repository, sourceCommit, sourceTree = "", runtimeCommit = "", platform, operations = [], } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheEvidenceSet } from "@kungfu-tech/buildchain/core";` | `packages/core/cache-evidence.js:244` |
 | `createCacheOperationReceipt` | function: function createCacheOperationReceipt({ operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {}) | { operationId, operation, provider, producer, platform, cacheKey, cacheRoot, outcome, bindings = {}, metrics, evidence, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createCacheOperationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/cache-evidence.js:169` |
@@ -2422,8 +2422,8 @@ Target: `./packages/core/buildchain-publication-authority.js`. Public symbols: 2
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:65` |
-| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:104` |
+| `buildchainPublicationAuthorityDescriptors` | function: function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { buildchainPublicationAuthorityDescriptors } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:66` |
+| `createBuildchainPublicationAuthorityRegistry` | function: function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) | { root = process.cwd() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createBuildchainPublicationAuthorityRegistry } from "@kungfu-tech/buildchain/buildchain-publication-authority";` | `packages/core/buildchain-publication-authority.js:105` |
 
 ## `@kungfu-tech/buildchain/github-governance-authority`
 
@@ -2839,7 +2839,7 @@ Target: `./packages/core/oci-publication-bundle.js`. Public symbols: 4.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `OCI_FAMILY_SCHEMA` | constant: const OCI_FAMILY_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { OCI_FAMILY_SCHEMA } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:6` |
-| `ociBundleFile` | function: function ociBundleFile(root, relative) | root, relative | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { ociBundleFile } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:29` |
-| `sealOciPublicationBundle` | function: function sealOciPublicationBundle({ bundleRoot, body }) | { bundleRoot, body } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { sealOciPublicationBundle } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:10` |
-| `verifyOciPublicationBundle` | function: function verifyOciPublicationBundle({ bundleRoot, manifest, repository, sourceSha, version, }) | { bundleRoot, manifest, repository, sourceSha, version, } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyOciPublicationBundle } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:114` |
+| `OCI_FAMILY_SCHEMA` | constant: const OCI_FAMILY_SCHEMA | none | value | Import does not declare a throw contract. | none-on-import | `import { OCI_FAMILY_SCHEMA } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:10` |
+| `ociBundleFile` | function: function ociBundleFile(root, relative) | root, relative | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { ociBundleFile } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:33` |
+| `sealOciPublicationBundle` | function: function sealOciPublicationBundle({ bundleRoot, body }) | { bundleRoot, body } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { sealOciPublicationBundle } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:14` |
+| `verifyOciPublicationBundle` | function: function verifyOciPublicationBundle({ bundleRoot, manifest, repository, sourceSha, version, }) | { bundleRoot, manifest, repository, sourceSha, version, } | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyOciPublicationBundle } from "@kungfu-tech/buildchain/oci-publication";` | `packages/core/oci-publication-bundle.js:118` |

package/docs/oci-publication.md

@@ -8,7 +8,7 @@ confidence: high
 sensitivity: public
 evidence_grade: B
 review_state: unreviewed
-last_reviewed: 2026-09-06
+last_reviewed: 2026-09-07
 ai_provenance:
   model_family: GPT-6
   product: Codex
@@ -80,3 +80,77 @@ the caller should also include the family and smoke JSON files in
 
 See [Runtime Train Validation](runtime-train-validation.md) for testing an
 unreleased runtime without persisting a train or exact SHA in the workflow.
+
+## Multi-platform images and Compose applications
+
+Use `schema: kungfu-buildchain-oci-family/v2` when the family includes an OCI
+index or a Compose application. Existing v1 families keep their published
+single-platform contract.
+
+An index entry declares `platform: multi-platform` and the complete `platforms`
+array, for example `["linux/amd64", "linux/arm64"]`. Every runnable child must
+have matching platform and content labels. Descriptor sizes, digests and media
+types are verified recursively; nested manifests are uploaded before their
+parent index. BuildKit attestation manifests must identify a runnable child and
+contain matching in-toto subjects. Missing platforms, duplicate platforms,
+foreign URLs, inline descriptor data and broken blob references fail sealing.
+
+A Compose entry declares `kind: compose`, `platform: compose`, and `targetImage`
+pointing to an image in the same family. Its unique family name may differ from
+that image, but its destination repository must match it. The immutable tag is
+`compose-v<version>`; image entries retain `v<version>`.
+
+The bounded Compose representation is an OCI 1.1 image manifest with
+`artifactType: application/vnd.docker.compose.project`, an empty JSON config
+and one `application/vnd.docker.compose.file+yaml` layer. That layer contains
+JSON, a YAML subset, so structural verification needs no executable YAML loader.
+Every service image is pinned to a digest and at least one uses the exact
+family image. Environment interpolation inside other fields can remain intact.
+These media types follow the [Docker Compose publisher](https://github.com/docker/compose/blob/v5.1.2/internal/oci/push.go).
+
+Candidate smoke evidence describes its actual pre-publication checks. It must
+not claim that an unpublished public Compose reference was installed. Public
+installation qualification occurs after immutable publication and before a
+preview alias moves.
+
+## Evidence-gated Compose preview
+
+An optional Compose `preview` declaration contains exactly the supported alias
+`compose-preview`, the previously accepted `previousDigest` (or `none`), and
+`qualificationWorkflow`, a repository workflow path. The immutable family seals
+this policy before any publication effect.
+
+After v4 publication is complete, dispatch that qualification workflow on the
+exact published alpha tag. It must pull the immutable public image and Compose,
+run fresh installation, restart, account-isolation, runtime-hardening, upgrade
+and rollback checks, and qualify both Linux architectures. The workflow has no
+registry write authority. Upload one artifact named
+`oci-compose-qualification-<run-id>-<run-attempt>` containing `qualification.json`
+and its hash-bound JSON evidence files.
+
+The receipt uses `schema: kungfu-buildchain-compose-qualification/v1` and binds
+`repository`, `tag`, published `sourceSha`, sealed `familyRoot`, `runId`,
+`runAttempt`, exact `image` and `application` repository/digest references,
+`previousDigest`, and `passed: true`. Its `checks` object requires all of
+`freshInstall`, `restartPersistence`, `upgradePersistence`, `rollbackPersistence`,
+`accountIsolation`, and `hardenedRuntime` to be true. Its `platforms` object
+requires `linux/amd64` and `linux/arm64` entries with `passed: true`; `evidence`
+contains nonempty `{path, sha256}` bindings to the actual JSON results.
+
+A thin consumer workflow listens to completion of that qualification workflow
+and calls `public-release-oci-compose-preview.yml@v4-alpha`, passing
+`BUILDCHAIN_PROMOTION_TOKEN`. The reusable workflow resolves its own exact
+runtime, enforces the dual floating-channel locks, verifies the public v4
+settlement, family and provider readback roots, and checks the live GitHub run's
+repository, source, workflow, event, attempt and successful conclusion. It never
+executes the consumer's artifact files. Only then does it copy the exact Compose
+manifest bytes to the declared alias and verify the public digest.
+
+The expected-old digest is checked immediately before mutation. An already
+matching target is an idempotent success; any other drift blocks the move.
+Publishers for this alias share repository-level concurrency. GHCR has no atomic
+tag compare-and-swap, so external writers must also avoid racing this workflow.
+The immutable release retains the appended
+`buildchain-compose-preview-<run-id>-<run-attempt>.json` receipt. A failed
+qualification leaves the existing preview intact, while the immutable alpha
+and its original publication evidence remain available for diagnosis.

package/docs/workflow-catalog.md

@@ -90,6 +90,7 @@ all related declarations. Run `pnpm run generate:workflows` and
 | [public-ops-warrant-cancel.yml](../.github/workflows/public-ops-warrant-cancel.yml) | ops | reusable | active | Dev Delivery Warrant Queued Candidate Cancel | `dev-delivery-warrant-cancel.yml` |
 | [public-ops-warrant-close.yml](../.github/workflows/public-ops-warrant-close.yml) | ops | reusable | active | Dev Delivery Warrant Close | `dev-delivery-warrant-close.yml` |
 | [public-release-artifact-attestation.yml](../.github/workflows/public-release-artifact-attestation.yml) | release | reusable | active | Buildchain GitHub Artifact Attestation | `github-artifact-attestation.yml` |
+| [public-release-oci-compose-preview.yml](../.github/workflows/public-release-oci-compose-preview.yml) | release | reusable | active | Buildchain OCI Compose Preview | — |
 | [public-release-paper-sealed.yml](../.github/workflows/public-release-paper-sealed.yml) | release | reusable | active | Buildchain Sealed Paper Release | `paper-release-sealed.yml` |
 | [public-release-paper.yml](../.github/workflows/public-release-paper.yml) | release | reusable | active | Buildchain Paper Release | `paper-release.yml` |
 | [public-release-promote.yml](../.github/workflows/public-release-promote.yml) | release | reusable | active | Release Candidate Promote | `release-candidate-promote.yml` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.48",
+  "version": "4.0.2-alpha.49",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-publication-authority.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { createPublicationAuthorityRegistry } from "./publication-authority.js";
 
 const DESCRIPTORS = Object.freeze([
+  [".github/workflows/public-release-oci-compose-preview.yml", "product-publication", true, ["oci-compose-preview"], "caller-secrets", "none", "fixed", "caller-bound"],
   [".github/workflows/.auditable-demo.yml", "non-publication-oidc"],
   [".github/workflows/.declarative-auditable-demo.yml", "governance-write"],
   [".github/workflows/.build.yml", "non-publication-oidc"],

package/packages/core/oci-compose-qualification.js

@@ -0,0 +1,140 @@
+import { v4ContentRoot } from "./v4-canonical-contracts.js";
+import { releaseTailRoot } from "./release-tail-provider-plane.js";
+import { ociPublicationTag } from "./oci-publication-graph.js";
+
+function check(condition, message) {
+  if (!condition) throw new Error(`Compose preview: ${message}`);
+}
+
+export function verifyComposePublication({
+  family,
+  readback,
+  documents,
+  repository,
+  tag,
+}) {
+  const { root, ...body } = family;
+  const version = tag.replace(/^v/u, "");
+  const operation = documents.productState.operations.find(
+    (entry) => entry.capabilityId === "product.oci.publish",
+  );
+  check(
+    family.schema === "kungfu-buildchain-oci-family/v2" &&
+      root === v4ContentRoot("oci-publication-family", body) &&
+      family.repository === repository &&
+      family.version === version &&
+      family.sourceSha === documents.invocation.candidate.commit &&
+      readback.familyRoot === root &&
+      readback.version === version &&
+      readback.candidateSourceSha === family.sourceSha &&
+      operation?.receipt.evidenceRoots.includes(releaseTailRoot(readback)),
+    "unbound public OCI family",
+  );
+  const applications = family.images.filter(
+    (entry) => entry.kind === "compose" && entry.preview,
+  );
+  check(applications.length === 1, "expected one declared Compose preview");
+  const application = applications[0],
+    policy = application.preview;
+  check(
+    policy.alias === "compose-preview" &&
+      /^\.github\/workflows\/[a-z0-9-]+\.yml$/u.test(
+        policy.qualificationWorkflow,
+      ) &&
+      /^(none|sha256:[0-9a-f]{64})$/u.test(policy.previousDigest),
+    "invalid preview policy",
+  );
+  const image = family.images.find(
+    (entry) =>
+      entry.name === application.targetImage && entry.kind !== "compose",
+  );
+  check(
+    image &&
+      application.repository === image.repository &&
+      image.repository === `ghcr.io/${repository}/${image.name}` &&
+      /^[a-z0-9][a-z0-9._-]*$/u.test(image.name),
+    "foreign application destination",
+  );
+  for (const entry of [image, application])
+    check(
+      readback.images.some(
+        (observed) =>
+          observed.name === entry.name &&
+          observed.repository === entry.repository &&
+          observed.digest === entry.digest &&
+          observed.ref === ociPublicationTag(entry, version) &&
+          observed.anonymous === true,
+      ),
+      "missing public artifact readback",
+    );
+  return {
+    application,
+    image,
+    policy,
+    familyRoot: root,
+    repository,
+    tag,
+    sourceSha: documents.product.publication.releaseSha,
+    publicationReceiptRoot: documents.receipt.receiptRoot,
+  };
+}
+
+export function verifyComposeQualification(context, run, receipt) {
+  const { application, image, policy, repository, tag, sourceSha, familyRoot } =
+    context;
+  check(
+    run.repository?.full_name === repository &&
+      run.head_repository?.full_name === repository &&
+      run.event === "workflow_dispatch" &&
+      run.status === "completed" &&
+      run.conclusion === "success" &&
+      run.head_sha === sourceSha &&
+      run.path.split("@")[0] === policy.qualificationWorkflow,
+    "qualification run is not the exact published source",
+  );
+  if (!receipt) return;
+  check(
+    receipt.schema === "kungfu-buildchain-compose-qualification/v1" &&
+      receipt.repository === repository &&
+      receipt.tag === tag &&
+      receipt.sourceSha === sourceSha &&
+      receipt.familyRoot === familyRoot &&
+      String(receipt.runId) === String(run.id) &&
+      Number(receipt.runAttempt) === run.run_attempt &&
+      receipt.image === `${image.repository}@${image.digest}` &&
+      receipt.application ===
+        `${application.repository}@${application.digest}` &&
+      receipt.previousDigest === policy.previousDigest &&
+      receipt.passed === true,
+    "qualification receipt identity mismatch",
+  );
+  for (const name of [
+    "freshInstall",
+    "restartPersistence",
+    "upgradePersistence",
+    "rollbackPersistence",
+    "accountIsolation",
+    "hardenedRuntime",
+  ])
+    check(receipt.checks?.[name] === true, `qualification lacks ${name}`);
+  check(
+    Array.isArray(image.platforms) &&
+      image.platforms.length === 2 &&
+      JSON.stringify([...image.platforms].sort()) ===
+        JSON.stringify(["linux/amd64", "linux/arm64"]) &&
+      image.platforms.every(
+        (platform) => receipt.platforms?.[platform]?.passed === true,
+      ),
+    "qualification lacks both platforms",
+  );
+  check(
+    Array.isArray(receipt.evidence) &&
+      receipt.evidence.length > 0 &&
+      receipt.evidence.every(
+        (entry) =>
+          /^[a-zA-Z0-9][a-zA-Z0-9._-]*\.json$/u.test(entry.path) &&
+          /^sha256:[0-9a-f]{64}$/u.test(entry.sha256),
+      ),
+    "missing qualification evidence bindings",
+  );
+}