@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/packages/core/publication-sealed-bundle.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
@@ -19,7 +20,10 @@ function requiredString(value, label) {
 
 function safeRelativePath(value, label) {
   const normalized = requiredString(value, label).replaceAll("\\", "/");
-  if (normalized.startsWith("/") || normalized.split("/").some((part) => part === ".." || part === "")) {
+  if (
+    normalized.startsWith("/") ||
+    normalized.split("/").some((part) => part === ".." || part === "")
+  ) {
     throw new Error(`${label} must be a safe relative path`);
   }
   return normalized;
@@ -41,7 +45,8 @@ function sha256File(filePath) {
   const chunk = Buffer.allocUnsafe(8 * 1024 * 1024);
   try {
     let bytesRead = 0;
-    while ((bytesRead = fs.readSync(descriptor, chunk, 0, chunk.length, null)) > 0) hash.update(chunk.subarray(0, bytesRead));
+    while ((bytesRead = fs.readSync(descriptor, chunk, 0, chunk.length, null)) > 0)
+      hash.update(chunk.subarray(0, bytesRead));
   } finally {
     fs.closeSync(descriptor);
   }
@@ -60,8 +65,16 @@ function normalizeFile(entry, label) {
   };
 }
 
+function fileInventory(files, label) {
+  return (files || []).map((entry, index) => normalizeFile(entry, `${label}[${index}]`))
+    .sort((left, right) => left.path.localeCompare(right.path));
+}
+
 function candidatePayload(candidate) {
-  if (candidate?.contract !== PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT || Number(candidate?.schemaVersion) !== 1) {
+  if (
+    candidate?.contract !== PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT ||
+    Number(candidate?.schemaVersion) !== 1
+  ) {
     throw new Error("publication artifact candidate contract mismatch");
   }
   const { candidateDigest: _candidateDigest, ...payload } = candidate;
@@ -91,9 +104,7 @@ export function createPublicationSealedBundle({
   githubReleaseRequired = true,
 } = {}) {
   const { digest } = candidatePayload(candidate);
-  const files = (candidate.files || [])
-    .map((entry, index) => normalizeFile(entry, `candidate.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
+  const files = fileInventory(candidate.files, "candidate.files");
   if (new Set(files.map((entry) => entry.path)).size !== files.length) {
     throw new Error("publication sealed bundle candidate paths must be unique");
   }
@@ -119,6 +130,7 @@ export function createPublicationSealedBundle({
       sha256: npmTarball.sha256,
       integrity: requiredString(npmIntegrity, "npmIntegrity"),
     },
+    ...(candidate.npmPackages ? { npmPackages: candidate.npmPackages } : {}),
     releaseAssets,
     completion: {
       githubReleaseRequired: Boolean(githubReleaseRequired),
@@ -130,8 +142,56 @@ export function createPublicationSealedBundle({
   };
 }
 
+function verifyNpmPackageSet(manifest, files, resolvedRoot) {
+  const npmPackages = manifest.npmPackages;
+  if (JSON.stringify(npmPackages) !== JSON.stringify(manifest.candidate.npmPackages)) {
+    throw new Error("publication sealed bundle npm package inventory differs from candidate");
+  }
+  if (npmPackages) {
+    if (
+      !Array.isArray(npmPackages) ||
+      npmPackages.length < 2 ||
+      new Set(npmPackages.map((entry) => entry.name)).size !== npmPackages.length ||
+      new Set(npmPackages.map((entry) => entry.path)).size !== npmPackages.length
+    ) {
+      throw new Error("publication sealed bundle npm package inventory must be unique");
+    }
+    for (const entry of npmPackages) {
+      const file = selectFile(files, entry.path, "npmPackages.path");
+      const absolutePath = path.resolve(resolvedRoot, file.path);
+      const metadata = JSON.parse(
+        execFileSync("tar", ["-xOf", path.basename(absolutePath), "package/package.json"], {
+          cwd: path.dirname(absolutePath),
+          encoding: "utf8",
+        }),
+      );
+      const integrity = `sha512-${crypto.createHash("sha512").update(fs.readFileSync(absolutePath)).digest("base64")}`;
+      if (
+        entry.name !== metadata.name ||
+        entry.version !== metadata.version ||
+        entry.size !== file.size ||
+        entry.sha256 !== file.sha256 ||
+        entry.integrity !== integrity
+      ) {
+        throw new Error("publication sealed bundle npm package identity or integrity mismatch");
+      }
+    }
+    const main = npmPackages.filter((entry) => entry.role === "main");
+    if (
+      main.length !== 1 ||
+      Object.keys(manifest.npm).some((key) => main[0][key] !== manifest.npm[key])
+    ) {
+      throw new Error("publication sealed bundle npm main package mismatch");
+    }
+  }
+  return npmPackages;
+}
+
 export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
-  if (manifest?.contract !== PUBLICATION_SEALED_BUNDLE_CONTRACT || Number(manifest?.schemaVersion) !== 1) {
+  if (
+    manifest?.contract !== PUBLICATION_SEALED_BUNDLE_CONTRACT ||
+    Number(manifest?.schemaVersion) !== 1
+  ) {
     throw new Error("publication sealed bundle contract mismatch");
   }
   const resolvedRoot = path.resolve(requiredString(bundleRoot, "bundleRoot"));
@@ -139,12 +199,8 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
   if (normalizeSha256(manifest.root, "manifest.root") !== digest) {
     throw new Error("publication sealed bundle root mismatch");
   }
-  const files = (manifest.files || [])
-    .map((entry, index) => normalizeFile(entry, `manifest.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
-  const candidateFiles = (manifest.candidate.files || [])
-    .map((entry, index) => normalizeFile(entry, `candidate.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
+  const files = fileInventory(manifest.files, "manifest.files");
+  const candidateFiles = fileInventory(manifest.candidate.files, "candidate.files");
   if (JSON.stringify(files) !== JSON.stringify(candidateFiles)) {
     throw new Error("publication sealed bundle file inventory differs from candidate");
   }
@@ -169,6 +225,7 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
   ) {
     throw new Error("publication sealed bundle npm tarball inventory mismatch");
   }
+  const npmPackages = verifyNpmPackageSet(manifest, files, resolvedRoot);
   const releaseAssets = (manifest.releaseAssets || []).map((entry, index) => {
     const selected = selectFile(files, entry.path, `manifest.releaseAssets[${index}].path`);
     const normalized = normalizeFile(entry, `manifest.releaseAssets[${index}]`);
@@ -194,6 +251,14 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
       ...entry,
       absolutePath: path.resolve(resolvedRoot, entry.path),
     })),
+    ...(npmPackages
+      ? {
+          npmPackages: npmPackages.map((entry) => ({
+            ...entry,
+            absolutePath: path.resolve(resolvedRoot, entry.path),
+          })),
+        }
+      : {}),
     manifest,
   };
 }

package/packages/core/release-activation-shadow.js

@@ -0,0 +1,32 @@
+import { ContractFault } from "./canonical-contracts.js";
+import { DomainWasmFault, invokeDomainWasm } from "./domain-wasm.js";
+
+export const RELEASE_ACTIVATION_REQUEST_CONTRACT =
+  "buildchain-v4-release-activation-request/v1";
+export const RELEASE_ACTIVATION_PLAN_CONTRACT =
+  "buildchain-v4-release-activation-plan/v1";
+export const RELEASE_ACTIVATION_STATE_CONTRACT =
+  "buildchain-v4-release-activation-state/v1";
+
+function project(request) {
+  try {
+    return invokeDomainWasm("release-activation", request);
+  } catch (error) {
+    if (error instanceof DomainWasmFault) {
+      throw new ContractFault(error.code, error.path, error.message);
+    }
+    throw error;
+  }
+}
+
+export function planReleaseActivation(request) {
+  return project(request).plan;
+}
+
+export function foldReleaseActivation(request) {
+  return project(request).state;
+}
+
+export function projectReleaseActivation(request) {
+  return project(request);
+}

package/packages/core/release-candidate.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { verifyV4FloatingConsumerPolicyReceipt } from "./v4-floating-consumer-policy.js";
+import { verifyFloatingConsumerPolicyReceipt } from "./floating-consumer-policy.js";
 import { normalizeControllerReceiptReferences, validateControllerReceiptReference } from "./controller-evidence.js";
 
 export const RELEASE_CANDIDATE_PASSPORT_CONTRACT = "kungfu-buildchain-release-candidate-passport";
@@ -172,7 +172,7 @@ function normalizeGateProfileEvidence(gateAggregate = undefined) {
   };
 }
 
-function isV4BuildchainRuntime(buildchain = {}) {
+function isBuildchainRuntime(buildchain = {}) {
   return [buildchain.ref, buildchain.workflowShellRef]
     .some((value) => /^v4(?:-alpha)?$/u.test(String(value || "")))
     || /^4\./u.test(String(buildchain.version || ""));
@@ -184,7 +184,7 @@ function normalizeConsumerPolicyEvidence(value, expected = {}) {
     throw new Error("consumerPolicyReceipt must be an object");
   }
   const receipt = value.receipt || value;
-  const verification = verifyV4FloatingConsumerPolicyReceipt({
+  const verification = verifyFloatingConsumerPolicyReceipt({
     receipt,
     receiptRoot: value.receiptRoot || "",
     repository: expected.repository,
@@ -198,11 +198,11 @@ function normalizeConsumerPolicyEvidence(value, expected = {}) {
 }
 
 function validateConsumerPolicyEvidence(passport, check) {
-  if (isV4BuildchainRuntime(passport.buildchain)) {
+  if (isBuildchainRuntime(passport.buildchain)) {
     check(Boolean(passport.consumerPolicy), "Buildchain v4 release candidate requires consumer policy evidence");
   }
   if (!passport.consumerPolicy) return;
-  const verification = verifyV4FloatingConsumerPolicyReceipt({
+  const verification = verifyFloatingConsumerPolicyReceipt({
     receipt: passport.consumerPolicy.receipt,
     receiptRoot: passport.consumerPolicy.receiptRoot,
     repository: passport.repository,
@@ -406,7 +406,7 @@ export function createReleaseCandidatePassport({
     sourceSha: normalizedSummary.publishSource?.ref === "publish-gate/anchor" ? (consumerPolicyReceipt?.receipt || consumerPolicyReceipt)?.caller?.sourceSha : sourceSha,
     runtimeSha: resolvedBuildchain.sha,
   });
-  if (isV4BuildchainRuntime(resolvedBuildchain) && !normalizedConsumerPolicy) {
+  if (isBuildchainRuntime(resolvedBuildchain) && !normalizedConsumerPolicy) {
     throw new Error("Buildchain v4 release candidate passport requires a valid floating consumer policy receipt");
   }
   const controllerReceiptEvidence = normalizeControllerReceiptReferences({

package/packages/core/release-invocation.js

@@ -0,0 +1,64 @@
+import { ContractFault } from "./canonical-contracts.js";
+import { DomainWasmFault, invokeDomainWasm } from "./domain-wasm.js";
+
+export const RELEASE_INVOCATION_CONTRACT =
+  "kungfu-buildchain-v4-release-invocation/v1";
+export const RELEASE_INVOCATION_ADAPTER_CONTRACT =
+  "kungfu-buildchain-v4-release-invocation-adapter/v1";
+export const RELEASE_TRANSACTION_CONTRACT =
+  "kungfu-buildchain-v4-release-transaction/v1";
+export const RELEASE_RECEIPT_CONTRACT =
+  "kungfu-buildchain-v4-release-receipt/v1";
+export const RELEASE_PROVIDER_CONTRACT =
+  "kungfu-buildchain-release-tail-provider/v1";
+
+function invoke(operation, payload) {
+  try {
+    return invokeDomainWasm(operation, payload);
+  } catch (error) {
+    if (error instanceof DomainWasmFault) {
+      throw new ContractFault(error.code, error.path, error.message);
+    }
+    throw error;
+  }
+}
+
+export function createReleaseInvocation(value) {
+  const projected = invoke("release-invocation", value);
+  return { ...projected, invocation: value };
+}
+
+export function adaptReleaseInvocation(value) {
+  const projected = invoke("release-invocation-adapter", value);
+  return { ...projected, invocation: value.invocation };
+}
+
+export function planReleaseRoute({
+  requestedSha,
+  observedSha,
+  comparisonStatus,
+  requestedChannel = "",
+  targetRef,
+  dryRun = false,
+  resume = false,
+}) {
+  return Object.freeze(
+    invoke("release-route", {
+      requestedSha,
+      observedSha,
+      comparisonStatus,
+      requestedChannel,
+      targetRef,
+      dryRun,
+      resume,
+    }),
+  );
+}
+
+export function createDomainReleaseTransaction(value) {
+  return invoke("release-transaction", value);
+}
+
+export function createReleaseReceipt(value) {
+  return invoke("release-receipt", value);
+}

package/packages/core/release-line-dry-run.js

@@ -201,7 +201,7 @@ function explainReleaseLineDryRun({
     );
     plan.branchUpdates.push(
       { ref: targetRef, action: "would move to alpha version-state commit" },
-      { ref: `dev/v${rule.major}/v${rule.major}.${rule.minor}`, action: "would align dev with the published alpha state" },
+      { ref: `dev/v${rule.major}/v${rule.major}.${rule.minor}`, action: rule.major === 4 ? "would prepare the next alpha version on dev through a separate protected PR after publication" : "would align dev with the published alpha state" },
     );
     plan.versionState.targetVersions = [exactAlpha.replace(/^next v?/, "").replace(/^v/, "")];
     plan.notes.push("Alpha promotion opens or advances the test channel; it does not move production refs.");

package/packages/core/release-passport-contract.js

@@ -405,7 +405,7 @@ export function prepareReleasePassportKfdSections({ kfd1, kfd2Claims, kfd3, kfdA
   };
 }
 
-export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], comparisonMatrix, sourceSha = "", checkedAt } = {}) {
+export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], comparisonMatrix, expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", sourceSha = "", checkedAt } = {}) {
   if (!manifest) {
     if (comparisonMatrix || gateResults.length > 0) {
       throw new Error("KFD support and product-gate inputs require --kfd-adopter-manifest-json; --kfd-support-matrix-json is comparison-only");
@@ -414,7 +414,7 @@ export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], c
   }
   const manifestGate = createKfdAdopterManifestGate({
     manifest, packageArtifactRoot: installedKfdPackageArtifactRoot(), gateResults,
-    expectedSourceSha: sourceSha, checkedAt,
+    expectedAdopterId, expectedSourceRepository, expectedSourceSha: sourceSha, checkedAt,
   });
   const legacyProjection = createKfdLegacySupportMatrixProjection({ manifest, manifestGate });
   if (comparisonMatrix) {
@@ -425,18 +425,18 @@ export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], c
   }
   return {
     manifest, manifestGate, legacyProjection,
-    binding: createKfdAdopterReleaseBinding({ manifest, manifestGate, legacyProjection, expectedSourceSha: sourceSha }),
+    binding: createKfdAdopterReleaseBinding({ manifest, manifestGate, legacyProjection, expectedAdopterId, expectedSourceRepository, expectedSourceSha: sourceSha }),
   };
 }
 
-export function validateKfdAdopterReleaseEvidence({ binding, artifactBinding, manifest, manifestGate, legacyProjection, passportLegacyProjection, expectedSourceSha = "" } = {}) {
+export function validateKfdAdopterReleaseEvidence({ binding, artifactBinding, manifest, manifestGate, legacyProjection, passportLegacyProjection, expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "" } = {}) {
   if (!binding) {
     return passportLegacyProjection
       ? [{ code: "kfdSupport.authority", message: "legacy KFD support projection requires the standard adopter manifest binding" }]
       : [];
   }
   const issues = validateKfdAdopterReleaseBinding(binding, {
-    manifest, manifestGate, legacyProjection, expectedSourceSha,
+    manifest, manifestGate, legacyProjection, expectedAdopterId, expectedSourceRepository, expectedSourceSha,
   }).issues.map((entry) => ({ code: `kfdAdopter.${entry.path || entry.code}`, message: entry.message, details: entry }));
   if (!artifactBinding || passportStableJson(artifactBinding) !== passportStableJson(binding)) {
     issues.push({ code: "kfdAdopter.artifactEvidence", message: "release passport and artifact evidence must bind the same exact KFD adopter closure" });

package/packages/core/release-passport.js

@@ -33,20 +33,20 @@ import { normalizeControllerReceiptReferences } from "./controller-evidence.js";
 import {
   normalizeGitHubArtifactAttestationPolicy,
 } from "./github-artifact-attestation.js";
-import { verifyV4FloatingConsumerPolicyCertification } from "./v4-floating-consumer-evidence.js";
+import { verifyFloatingConsumerPolicyCertification } from "./floating-consumer-evidence.js";
 import {
   normalizePromotionEvidence,
   normalizePromotionRouting,
-  normalizeV4RuntimeResumeEvidence,
-  isV4PromotionRouting,
+  normalizeRuntimeResumeEvidence,
+  isPromotionRouting,
   releasePassportCertificationVerificationOptions,
-  requireV4ConsumerPolicyCertification,
-  resolveV4ConsumerPolicyCertificationIdentity,
-} from "./v4-floating-consumer-release-passport.js";
+  requireConsumerPolicyCertification,
+  resolveConsumerPolicyCertificationIdentity,
+} from "./floating-consumer-release-passport.js";
 import {
-  verifyV4RuntimeAuthorizationReceipt,
-  verifyV4RuntimeResumeLineage,
-} from "./v4-runtime-ref-resume-authority.js";
+  verifyRuntimeAuthorizationReceipt,
+  verifyRuntimeResumeLineage,
+} from "./runtime-ref-resume-authority.js";
 
 export { RELEASE_CHECK_REPORT_CONTRACT, RELEASE_PASSPORT_CONTRACT };
 export const ARTIFACT_EVIDENCE_CONTRACT = "kungfu-buildchain-artifact-evidence";
@@ -1204,9 +1204,9 @@ export function createReleasePassport(options = {}) {
   kfdSupportEvidencePath = "",
   invariantPassports = undefined,
   releaseEvidence = [],
-  v4ConsumerPolicyCertification = undefined,
-  v4ConsumerPolicyCertificationRoot = "",
-  v4RuntimeResumeEvidence = undefined,
+  v4ConsumerPolicyCertification: domainConsumerPolicyCertification = undefined,
+  v4ConsumerPolicyCertificationRoot: domainConsumerPolicyCertificationRoot = "",
+  domainRuntimeResumeEvidence = undefined,
   kfdAgentHubEvidence = undefined,
   kfdAgentHubEvidencePath = "",
   controllerReceipts = [],
@@ -1223,9 +1223,9 @@ export function createReleasePassport(options = {}) {
   const normalizedTrustedPublishing = normalizeTrustedPublishing(trustedPublishing, { workflow, publish });
   const normalizedTransaction = normalizeTransaction(transaction);
   const { promotion, buildEvidence } = preparePromotionBuild(options);
-  const normalizedV4RuntimeResume = normalizeV4RuntimeResumeEvidence(v4RuntimeResumeEvidence, {
+  const normalizedRuntimeResume = normalizeRuntimeResumeEvidence(domainRuntimeResumeEvidence, {
     repository,
-    sourceSha: v4RuntimeResumeSourceSha(release, sourceSha),
+    sourceSha: runtimeResumeSourceSha(release, sourceSha),
     resumeRuntimeSha: promotion.routing?.runtime?.resolvedSha || "",
     consumerPolicyReceiptRoot: promotion.consumerPolicy?.certification?.receiptRoot || "",
   });
@@ -1374,7 +1374,7 @@ export function createReleasePassport(options = {}) {
       ["invariantPassports", invariantPassports],
       ["releaseEvidence", releaseEvidence],
       ["v4ConsumerPolicy", promotion.consumerPolicy],
-      ["v4RuntimeResume", normalizedV4RuntimeResume],
+      ["v4RuntimeResume", normalizedRuntimeResume],
       ["controllerReceipts", normalizedControllerReceipts],
       ["githubArtifactAttestations", normalizedGitHubArtifactAttestations],
     ]),
@@ -1431,7 +1431,7 @@ export function createReleasePassport(options = {}) {
   };
 }
 
-function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson, productGateJsons, sourceSha, checkedAt }) {
+function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson, productGateJsons, repository, sourceSha, checkedAt }) {
   const manifestMeta = parseJsonInputWithMeta(manifestJson, undefined, { cwd, label: "kfdAdopterManifestJson" });
   const supportMatrixMeta = parseJsonInputWithMeta(supportMatrixJson, undefined, { cwd, label: "kfdSupportMatrixJson" });
   const productGateMetas = (productGateJsons || [])
@@ -1442,7 +1442,7 @@ function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson,
     manifest: manifestMeta.value,
     gateResults: productGateMetas.map((meta) => meta.value),
     comparisonMatrix: supportMatrixMeta.value,
-    sourceSha,
+    expectedAdopterId: repository || "kungfu-systems/buildchain", expectedSourceRepository: repository, sourceSha,
     checkedAt,
   });
 }
@@ -1497,9 +1497,9 @@ export function collectGitHubReleasePassport({
   invariantPassportJsons = [],
   invariantPassportCommand = "",
   releaseEvidenceJsons = [],
-  v4ConsumerPolicyCertificationJson = "",
-  v4ConsumerPolicyCertificationRoot = "",
-  v4RuntimeResumeEvidenceJson = "",
+  v4ConsumerPolicyCertificationJson: domainConsumerPolicyCertificationJson = "",
+  v4ConsumerPolicyCertificationRoot: domainConsumerPolicyCertificationRoot = "",
+  v4RuntimeResumeEvidenceJson: domainRuntimeResumeEvidenceJson = "",
   kfdAgentHubEvidenceJson = "",
   controllerReceiptReferences = [],
   githubArtifactAttestationPolicyJsons = [],
@@ -1575,9 +1575,9 @@ export function collectGitHubReleasePassport({
       }),
     )
     .filter((meta) => meta.value);
-  const v4ConsumerPolicyCertificationMeta =
-    parseV4ConsumerPolicyCertification(v4ConsumerPolicyCertificationJson, cwd);
-  const v4RuntimeResumeEvidence = parseJsonInput(v4RuntimeResumeEvidenceJson, undefined, {
+  const consumerPolicyCertificationMeta =
+    parseConsumerPolicyCertification(domainConsumerPolicyCertificationJson, cwd);
+  const domainRuntimeResumeEvidence = parseJsonInput(domainRuntimeResumeEvidenceJson, undefined, {
     cwd,
     label: "v4RuntimeResumeEvidenceJson",
   });
@@ -1620,7 +1620,7 @@ export function collectGitHubReleasePassport({
   const productMechanism = defaultProductMechanism({ repository, productName });
   const kfdAdopterEvidence = collectKfdAdopterReleaseInputs({
     cwd, manifestJson: kfdAdopterManifestJson, supportMatrixJson: kfdSupportMatrixJson,
-    productGateJsons: kfdProductGateJsons, sourceSha, checkedAt: resolvedCheckedAt,
+    productGateJsons: kfdProductGateJsons, repository, sourceSha, checkedAt: resolvedCheckedAt,
   });
   const {
     manifest: kfdAdopterManifest,
@@ -1706,9 +1706,9 @@ export function collectGitHubReleasePassport({
     kfdSupportEvidencePath: kfdSupport ? "kfd-support.json" : "",
     invariantPassports,
     releaseEvidence: releaseEvidenceAttachments.map(({ reference }) => reference),
-    v4ConsumerPolicyCertification: v4ConsumerPolicyCertificationMeta.value,
-    v4ConsumerPolicyCertificationRoot,
-    v4RuntimeResumeEvidence,
+    v4ConsumerPolicyCertification: consumerPolicyCertificationMeta.value,
+    v4ConsumerPolicyCertificationRoot: domainConsumerPolicyCertificationRoot,
+    domainRuntimeResumeEvidence,
     kfdAgentHubEvidence: kfdAgentHubEvidenceMeta.value
       ? { ...kfdAgentHubEvidenceMeta, path: "kfd-agent-hub-evidence.json" }
       : undefined,
@@ -2060,7 +2060,8 @@ function validateReleaseEvidenceContracts({
     manifestGate: kfdAdopterManifestGate,
     legacyProjection: kfdSupportEvidence,
     passportLegacyProjection: passport?.kfdSupport,
-    expectedSourceSha: optionalString(passport?.release?.sourceSha),
+    expectedAdopterId: optionalString(passport?.product?.repository) || "kungfu-systems/buildchain",
+    expectedSourceRepository: optionalString(passport?.product?.repository), expectedSourceSha: optionalString(passport?.release?.sourceSha),
   })) {
     issues.push(issue("error", entry.code, entry.message, entry.details));
   }
@@ -2649,8 +2650,8 @@ export function createReleaseCheckReport({
     releaseEvidenceDocuments,
     issues,
   });
-  validateV4ConsumerPolicyPassportSection({ passport, issues });
-  validateV4RuntimeResumePassportSection({ passport, issues });
+  validateConsumerPolicyPassportSection({ passport, issues });
+  validateRuntimeResumePassportSection({ passport, issues });
   validatePublishEvidenceSection({ passport, publishEvidence, normalizedPublishEvidence, issues });
   const evidenceIndex = indexEvidenceArtifacts(evidenceArtifacts);
   validateReleaseArtifacts({ artifacts, evidenceIndex, issues });
@@ -2804,14 +2805,14 @@ export function makeReleasePassportFixtureAssets(dir) {
 export function validateKnownReleasePassportContracts() {
   return [...CONTRACTS];
 }
-function parseV4ConsumerPolicyCertification(input, cwd) {
+function parseConsumerPolicyCertification(input, cwd) {
   return parseJsonInputWithMeta(input, undefined, {
     cwd,
     label: "v4ConsumerPolicyCertificationJson",
   });
 }
 
-function v4RuntimeResumeSourceSha(release, fallback = "") {
+function runtimeResumeSourceSha(release, fallback = "") {
   const builtSourceSha = releaseField(
     release || {},
     "builtSourceSha",
@@ -2823,10 +2824,10 @@ function v4RuntimeResumeSourceSha(release, fallback = "") {
 }
 
 
-function validateV4ConsumerPolicyPassportSection({ passport, issues }) {
+function validateConsumerPolicyPassportSection({ passport, issues }) {
   const routing = passport?.promotionRouting;
   const evidence = passport?.v4ConsumerPolicy;
-  if (isV4PromotionRouting(routing) && !evidence) {
+  if (isPromotionRouting(routing) && !evidence) {
     issues.push(issue(
       "error",
       "v4ConsumerPolicy.missing",
@@ -2835,7 +2836,7 @@ function validateV4ConsumerPolicyPassportSection({ passport, issues }) {
     return;
   }
   if (!evidence) return;
-  const verification = verifyV4FloatingConsumerPolicyCertification(
+  const verification = verifyFloatingConsumerPolicyCertification(
     releasePassportCertificationVerificationOptions({
       evidence,
       passport,
@@ -2847,26 +2848,26 @@ function validateV4ConsumerPolicyPassportSection({ passport, issues }) {
   }
 }
 
-function validateV4RuntimeResumePassportSection({ passport, issues }) {
+function validateRuntimeResumePassportSection({ passport, issues }) {
   const evidence = passport?.v4RuntimeResume;
   if (!evidence) return;
   const consumerPolicyReceiptRoot = passport?.v4ConsumerPolicy?.certification?.receiptRoot || "";
-  const authorization = verifyV4RuntimeAuthorizationReceipt({
+  const authorization = verifyRuntimeAuthorizationReceipt({
     receipt: evidence.authorization,
     receiptRoot: evidence.authorizationRoot,
     repository: passport?.product?.repository || "",
-    sourceSha: v4RuntimeResumeSourceSha(passport?.release, passport?.release?.sourceSha || ""),
+    sourceSha: runtimeResumeSourceSha(passport?.release, passport?.release?.sourceSha || ""),
     runtimeSha: passport?.promotionRouting?.runtime?.resolvedSha || "",
     consumerPolicyReceiptRoot,
   });
   for (const failure of authorization.failures) {
     issues.push(issue("error", `v4RuntimeResume.authorization.${failure}`, failure));
   }
-  const lineage = verifyV4RuntimeResumeLineage({
+  const lineage = verifyRuntimeResumeLineage({
     lineage: evidence.lineage,
     lineageRoot: evidence.lineageRoot,
     repository: passport?.product?.repository || "",
-    sourceSha: v4RuntimeResumeSourceSha(passport?.release, passport?.release?.sourceSha || ""),
+    sourceSha: runtimeResumeSourceSha(passport?.release, passport?.release?.sourceSha || ""),
     resumeRuntimeSha: passport?.promotionRouting?.runtime?.resolvedSha || "",
     consumerPolicyReceiptRoot,
   });

package/packages/core/release-tail-product-capabilities.js

@@ -17,6 +17,15 @@ export const RELEASE_TAIL_PRODUCT_CAPABILITIES = Object.freeze([
     receiptKind: "product-package-publication",
     transactionState: "publishing",
   }),
+  Object.freeze({
+    id: "product.oci.publish",
+    executor: "provider-adapter",
+    adapter: "oci-image-family",
+    effectKind: "oci-family-publication",
+    observationKind: "oci-family-readback",
+    receiptKind: "oci-family-publication",
+    transactionState: "publishing",
+  }),
   Object.freeze({
     id: "product.release-refs.converge",
     executor: "provider-adapter",