@kungfu-tech/buildchain 4.1.3-alpha.9 → 4.1.4-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (205) hide show
  1. package/AGENTS.md +11 -13
  2. package/CONTRIBUTING.md +32 -9
  3. package/README.md +56 -140
  4. package/actions/release/promotion/ref/README.md +1 -1
  5. package/architecture/action-taxonomy.json +1 -1
  6. package/architecture/agent-change-map.md +32 -45
  7. package/architecture/build-orchestration.json +1 -1
  8. package/architecture/capability-state-machine-manifest.json +5 -5
  9. package/architecture/ci-lane-change-budget.json +92 -92
  10. package/architecture/code-layout.json +2 -12
  11. package/architecture/core-mechanisms.json +38 -39
  12. package/architecture/cross-platform-adopter-qualification.json +1 -1
  13. package/architecture/dev-delivery-orchestration.json +2 -2
  14. package/architecture/floating-consumer-policy.json +3 -3
  15. package/architecture/internal-capabilities.json +27 -28
  16. package/architecture/maintainability-debt.json +60 -94
  17. package/architecture/maintainability-policy.json +7 -13
  18. package/architecture/minimal-consumer-migration.json +43 -5014
  19. package/architecture/platform-stage-checkpoints.json +1 -1
  20. package/architecture/release-tail-contract.json +2 -2
  21. package/architecture/release-topology.json +33 -25
  22. package/architecture/stage-capsule-qualification.json +1 -1
  23. package/architecture/universal-workflow-bootstrap.json +60 -60
  24. package/architecture/universal-workflow-capability-policy.json +3 -3
  25. package/architecture/universal-workflow-fault-campaign.json +7 -7
  26. package/architecture/workflow-taxonomy.json +59 -60
  27. package/contracts/fixtures/v4-tail-reseal-v1/valid.json +1 -1
  28. package/dist/site/buildchain-contract.json +138 -66
  29. package/dist/site/buildchain-site.json +257 -331
  30. package/dist/site/capability-registry.json +4 -4
  31. package/dist/site/cli-registry.json +6 -142
  32. package/dist/site/controller-registry.json +19 -19
  33. package/dist/site/kfd-claims.json +481 -529
  34. package/dist/site/kfd-upstream-aggregate.json +1 -1
  35. package/dist/site/manual-registry.json +22 -22
  36. package/dist/site/node-api-registry.json +82 -339
  37. package/dist/site/page-registry.json +229 -304
  38. package/dist/site/public-surface-audit.json +544 -754
  39. package/dist/site/publication-authority-registry.json +316 -316
  40. package/dist/site/publication-registry.json +1 -1
  41. package/dist/site/site-manifest.json +23 -23
  42. package/dist/site/workflow-registry.json +1071 -1027
  43. package/docs/MAP.md +28 -20
  44. package/docs/auditable-demo.md +17 -49
  45. package/docs/bootstrap-recovery.md +46 -37
  46. package/docs/cli-reference.md +2 -46
  47. package/docs/cli.md +97 -186
  48. package/docs/code-organization.md +7 -5
  49. package/docs/dev-alpha-candidate-patrol.md +19 -42
  50. package/docs/dev-delivery-orchestration.md +15 -11
  51. package/docs/dev-delivery-qualification-landing-adr.md +10 -9
  52. package/docs/dev-delivery-warrant.md +17 -16
  53. package/docs/dev-qualification-patrol.md +25 -20
  54. package/docs/getting-started.md +80 -139
  55. package/docs/github-artifact-attestation.md +31 -81
  56. package/docs/install.md +66 -30
  57. package/docs/lifecycle-protocol.md +19 -57
  58. package/docs/migration-inventory.md +17 -45
  59. package/docs/next-development-transition.md +13 -13
  60. package/docs/node-api-reference.md +122 -138
  61. package/docs/oci-publication.md +13 -10
  62. package/docs/publication-artifacts.md +128 -486
  63. package/docs/publication-authority.md +15 -45
  64. package/docs/publish-transaction.md +13 -11
  65. package/docs/release-candidate.md +126 -355
  66. package/docs/release-discussions.md +36 -67
  67. package/docs/release-flow.md +80 -339
  68. package/docs/release-governance.md +114 -962
  69. package/docs/release-promotion-request.md +45 -43
  70. package/docs/release-propagation.md +13 -27
  71. package/docs/release-tail-provider-plane.md +38 -65
  72. package/docs/reusable-build-surface.md +78 -196
  73. package/docs/runtime-train-validation.md +8 -6
  74. package/docs/stable-candidate-patrol.md +13 -66
  75. package/docs/v4-adopter-delivery.md +15 -15
  76. package/docs/v4-declarative-release-tail-migration.md +19 -17
  77. package/docs/v4-production-release.md +11 -6
  78. package/docs/v4-publication-rehearsal.md +12 -27
  79. package/docs/v4-stage-capsule.md +14 -20
  80. package/docs/v4-tail-reseal.md +34 -20
  81. package/docs/web-surface-deployments.md +26 -264
  82. package/docs/workflow-catalog.md +31 -31
  83. package/docs/workflow-path-migration.md +10 -4
  84. package/package.json +5 -4
  85. package/packages/core/adoption/buildchain-kfd-claims.js +7 -7
  86. package/packages/core/adoption/cli/output.mjs +1 -9
  87. package/packages/core/adoption/cli/product-gate.mjs +1 -15
  88. package/packages/core/adoption/cli/project.mjs +9 -10
  89. package/packages/core/adoption/cli/standards.mjs +1 -14
  90. package/packages/core/adoption/cli/support.mjs +0 -2
  91. package/packages/core/adoption/cli/surface-register.mjs +0 -2
  92. package/packages/core/adoption/commands/init-repo.mjs +77 -485
  93. package/packages/core/adoption/consumer-init.js +279 -0
  94. package/packages/core/adoption/qualification/admission.js +1 -1
  95. package/packages/core/build/cli/cache.mjs +0 -2
  96. package/packages/core/build/cli/facts.mjs +0 -3
  97. package/packages/core/build/cli/homebrew.mjs +0 -4
  98. package/packages/core/build/cli/lifecycle.mjs +0 -3
  99. package/packages/core/build/github-artifact-attestation.js +2 -2
  100. package/packages/core/build/platform-stage-checkpoints.js +1 -1
  101. package/packages/core/build/signing/dispatch.js +1 -1
  102. package/packages/core/consumer/buildchain-config.js +9 -0
  103. package/packages/core/consumer/contract/inspection.js +351 -9
  104. package/packages/core/consumer/contract/javascript-syntax.js +439 -0
  105. package/packages/core/consumer/contract/javascript-values.js +61 -0
  106. package/packages/core/consumer/contract/javascript.js +555 -0
  107. package/packages/core/consumer/contract/local-validation.js +84 -0
  108. package/packages/core/contracts/buildchain-contract.js +39 -8
  109. package/packages/core/contracts/cli/introspection.mjs +1 -9
  110. package/packages/core/contracts/public-surface-cli.js +0 -1
  111. package/packages/core/dev-delivery/dev-delivery-contract-surface.js +2 -2
  112. package/packages/core/governance/buildchain-publication-authority.js +24 -24
  113. package/packages/core/governance/cli/doctor.mjs +58 -42
  114. package/packages/core/governance/commands/architecture.mjs +6 -1
  115. package/packages/core/governance/commands/audit-publication-control-plane.mjs +1 -1
  116. package/packages/core/governance/commands/workflow-friction-report.mjs +1 -1
  117. package/packages/core/governance/github-governance-authority.js +2 -2
  118. package/packages/core/governance/publication/collection.js +1 -1
  119. package/packages/core/index.js +1 -3
  120. package/packages/core/observability/cli/candidate.mjs +0 -2
  121. package/packages/core/observability/cli/context.mjs +0 -5
  122. package/packages/core/observability/cli/diagnostics.mjs +0 -7
  123. package/packages/core/observability/cli/events.mjs +2 -10
  124. package/packages/core/paper/commands/paper-work-fleet-cli.mjs +1 -1
  125. package/packages/core/paper/commands/paper.mjs +33 -422
  126. package/packages/core/paper/consumer-status.js +72 -0
  127. package/packages/core/paper/operations/identity.js +0 -3
  128. package/packages/core/paper/operations/migration.js +460 -0
  129. package/packages/core/paper/operations/preflight-checks.js +8 -68
  130. package/packages/core/paper/operations/scaffold.js +16 -326
  131. package/packages/core/paper/operations/status.js +27 -53
  132. package/packages/core/paper/paper-agent-entry.js +36 -147
  133. package/packages/core/paper/paper-fleet.js +24 -39
  134. package/packages/core/paper/paper-repository.js +16 -0
  135. package/packages/core/paper/paper-runtime-channels.js +1 -1
  136. package/packages/core/paper/paper-scaffold-content.js +153 -162
  137. package/packages/core/paper/paper-work.js +3 -10
  138. package/packages/core/paper/paper.js +43 -5
  139. package/packages/core/providers/github/artifact-attestation.js +1 -1
  140. package/packages/core/providers/github/pipeline-context-artifacts.js +172 -0
  141. package/packages/core/providers/github/pipeline-release-evidence.js +17 -98
  142. package/packages/core/providers/github/pipeline-stable-baseline.js +86 -0
  143. package/packages/core/providers/github/pipeline-stable-source.js +22 -4
  144. package/packages/core/providers/github/release-evidence-assets.js +97 -0
  145. package/packages/core/publication/authority/control-plane.js +2 -2
  146. package/packages/core/publication/authority/seal.js +1 -1
  147. package/packages/core/publication/cli/dispatch.mjs +1 -12
  148. package/packages/core/publication/pipeline/actions.js +16 -9
  149. package/packages/core/publication/pipeline/apply.js +17 -9
  150. package/packages/core/publication/pipeline/context.js +29 -0
  151. package/packages/core/publication/pipeline/journal.js +13 -1
  152. package/packages/core/publication/pipeline/prepare.js +15 -6
  153. package/packages/core/publication/pipeline/recovery-import.js +1 -1
  154. package/packages/core/publication/pipeline/recovery-materials.js +63 -1
  155. package/packages/core/publication/pipeline/recovery-prepare.js +21 -9
  156. package/packages/core/publication/pipeline/stable-entry.js +12 -3
  157. package/packages/core/publication/pipeline/stable-products.js +21 -19
  158. package/packages/core/publication/pipeline/version-actions.js +15 -6
  159. package/packages/core/publication/publication-rehearsal-projection.js +0 -9
  160. package/packages/core/release/cli/dispatch.mjs +1 -4
  161. package/packages/core/release/cli/inspection-handlers.mjs +1 -33
  162. package/packages/core/release/cli/release-handlers.mjs +2 -19
  163. package/packages/core/release/cli/verification-handlers.mjs +4 -25
  164. package/packages/core/release/next-development-projection.js +13 -13
  165. package/packages/core/release/passport/locations.js +13 -8
  166. package/packages/core/release/release-passport.js +70 -5
  167. package/packages/core/web/cli/badges.mjs +0 -4
  168. package/packages/core/web/publication-admission.js +1 -1
  169. package/packages/core/web/publication-capability.js +1 -1
  170. package/packages/core/web/readme-badges.js +1 -1
  171. package/packages/core/workflow/cli/main.mjs +1 -4
  172. package/packages/core/workflow/cli/process.mjs +1 -1
  173. package/packages/core/workflow/commands/buildchain-cli-help.mjs +2 -8
  174. package/packages/core/workflow/engine/conformance.js +1 -1
  175. package/packages/core/workflow/pipeline/build.js +21 -1
  176. package/packages/core/workflow/pipeline/delivery-observation.js +6 -2
  177. package/packages/core/workflow/workflow-taxonomy.mjs +61 -17
  178. package/scripts/check-code-layout.mjs +2 -0
  179. package/scripts/check-core-mechanism-inventory.mjs +29 -13
  180. package/scripts/check-floating-consumer-policy-contract.mjs +3 -3
  181. package/scripts/check-inventory.mjs +27 -27
  182. package/scripts/check-maintainability.mjs +28 -5
  183. package/scripts/check-public-dogfood-contract.mjs +3 -3
  184. package/scripts/check-release-topology.mjs +1 -1
  185. package/scripts/check-self-consumer-contract.mjs +7 -7
  186. package/scripts/check-universal-workflow-bootstrap.mjs +1 -1
  187. package/scripts/generate-channel-promotion-workflow.mjs +1 -1
  188. package/scripts/generate-minimal-consumer-contract.mjs +21 -1
  189. package/scripts/generate-site-bundle.mjs +2 -1
  190. package/scripts/generate-tail-reseal-fixture.mjs +3 -3
  191. package/scripts/inventory/promotion.mjs +1 -1
  192. package/scripts/next-development-self-dogfood-harness.mjs +1 -1
  193. package/scripts/next-development-self-dogfood.mjs +4 -4
  194. package/scripts/site-capability-metadata.mjs +2 -6
  195. package/scripts/source-metric-lineage.mjs +62 -7
  196. package/scripts/verify-golden-path.mjs +31 -35
  197. package/templates/native-dev-delivery.yml +1 -1
  198. package/templates/universal-buildchain-bootstrap.yml +1 -1
  199. package/packages/core/paper/operations/bootstrap.js +0 -75
  200. package/packages/core/paper/operations/plans.js +0 -213
  201. package/packages/core/paper/operations/provisioning.js +0 -113
  202. package/packages/core/paper/operations/scaffold-config.js +0 -77
  203. package/packages/core/paper/operations/scaffold-workflows.js +0 -116
  204. package/packages/core/paper/operations/workspace.js +0 -60
  205. package/packages/core/paper/paper-npm-bootstrap.js +0 -492
package/dist/site/publication-authority-registry.json CHANGED
@@ -3,6 +3,19 @@
3
3
  "contract": "kungfu-buildchain-publication-authority-registry",
4
4
  "defaultDecision": "deny",
5
5
  "entries": [
6
+ {
7
+ "workflowPath": ".github/workflows/.build-candidate.yml",
8
+ "authorityClass": "non-publication-oidc",
9
+ "publicationCapable": false,
10
+ "capabilityIds": [],
11
+ "credentialMode": "none",
12
+ "publisherWorkflowMode": "fixed",
13
+ "publisherWorkflowPath": ".github/workflows/.build-candidate.yml",
14
+ "environment": "",
15
+ "environmentMode": "fixed",
16
+ "runnerPolicy": "unqualified",
17
+ "notes": ""
18
+ },
6
19
  {
7
20
  "workflowPath": ".github/workflows/.build-demo-adapter.yml",
8
21
  "authorityClass": "non-publication-oidc",
@@ -17,401 +30,392 @@
17
30
  "notes": ""
18
31
  },
19
32
  {
20
- "workflowPath": ".github/workflows/.build-release-verify-compat.yml",
33
+ "workflowPath": ".github/workflows/.build-demo.yml",
21
34
  "authorityClass": "governance-write",
22
35
  "publicationCapable": false,
23
36
  "capabilityIds": [],
24
37
  "credentialMode": "none",
25
38
  "publisherWorkflowMode": "fixed",
26
- "publisherWorkflowPath": ".github/workflows/.build-release-verify-compat.yml",
39
+ "publisherWorkflowPath": ".github/workflows/.build-demo.yml",
27
40
  "environment": "",
28
41
  "environmentMode": "fixed",
29
42
  "runnerPolicy": "unqualified",
30
43
  "notes": ""
31
44
  },
32
45
  {
33
- "workflowPath": ".github/workflows/.build-sam-verify-compat.yml",
34
- "authorityClass": "retired-deny",
46
+ "workflowPath": ".github/workflows/.build-publication.yml",
47
+ "authorityClass": "evidence-publication",
35
48
  "publicationCapable": false,
36
49
  "capabilityIds": [],
37
50
  "credentialMode": "none",
38
51
  "publisherWorkflowMode": "fixed",
39
- "publisherWorkflowPath": ".github/workflows/.build-sam-verify-compat.yml",
52
+ "publisherWorkflowPath": ".github/workflows/.build-publication.yml",
40
53
  "environment": "",
41
54
  "environmentMode": "fixed",
42
55
  "runnerPolicy": "unqualified",
43
56
  "notes": ""
44
57
  },
45
58
  {
46
- "workflowPath": ".github/workflows/.build-wheel-verify-compat.yml",
59
+ "workflowPath": ".github/workflows/.build-release-verify-compat.yml",
60
+ "authorityClass": "governance-write",
61
+ "publicationCapable": false,
62
+ "capabilityIds": [],
63
+ "credentialMode": "none",
64
+ "publisherWorkflowMode": "fixed",
65
+ "publisherWorkflowPath": ".github/workflows/.build-release-verify-compat.yml",
66
+ "environment": "",
67
+ "environmentMode": "fixed",
68
+ "runnerPolicy": "unqualified",
69
+ "notes": ""
70
+ },
71
+ {
72
+ "workflowPath": ".github/workflows/.build-sam-verify-compat.yml",
47
73
  "authorityClass": "retired-deny",
48
74
  "publicationCapable": false,
49
75
  "capabilityIds": [],
50
76
  "credentialMode": "none",
51
77
  "publisherWorkflowMode": "fixed",
52
- "publisherWorkflowPath": ".github/workflows/.build-wheel-verify-compat.yml",
78
+ "publisherWorkflowPath": ".github/workflows/.build-sam-verify-compat.yml",
53
79
  "environment": "",
54
80
  "environmentMode": "fixed",
55
81
  "runnerPolicy": "unqualified",
56
82
  "notes": ""
57
83
  },
58
84
  {
59
- "workflowPath": ".github/workflows/.build.yml",
60
- "authorityClass": "non-publication-oidc",
85
+ "workflowPath": ".github/workflows/.build-wheel-verify-compat.yml",
86
+ "authorityClass": "retired-deny",
61
87
  "publicationCapable": false,
62
88
  "capabilityIds": [],
63
89
  "credentialMode": "none",
64
90
  "publisherWorkflowMode": "fixed",
65
- "publisherWorkflowPath": ".github/workflows/.build.yml",
91
+ "publisherWorkflowPath": ".github/workflows/.build-wheel-verify-compat.yml",
66
92
  "environment": "",
67
93
  "environmentMode": "fixed",
68
94
  "runnerPolicy": "unqualified",
69
95
  "notes": ""
70
96
  },
71
97
  {
72
- "workflowPath": ".github/workflows/.ops-git-sync.yml",
73
- "authorityClass": "governance-write",
98
+ "workflowPath": ".github/workflows/.build.yml",
99
+ "authorityClass": "non-publication-oidc",
74
100
  "publicationCapable": false,
75
101
  "capabilityIds": [],
76
102
  "credentialMode": "none",
77
103
  "publisherWorkflowMode": "fixed",
78
- "publisherWorkflowPath": ".github/workflows/.ops-git-sync.yml",
104
+ "publisherWorkflowPath": ".github/workflows/.build.yml",
79
105
  "environment": "",
80
106
  "environmentMode": "fixed",
81
107
  "runnerPolicy": "unqualified",
82
108
  "notes": ""
83
109
  },
84
110
  {
85
- "workflowPath": ".github/workflows/.ops-pipeline-delivery.yml",
111
+ "workflowPath": ".github/workflows/.ops-alpha-candidate-patrol.yml",
86
112
  "authorityClass": "governance-write",
87
113
  "publicationCapable": false,
88
114
  "capabilityIds": [],
89
115
  "credentialMode": "none",
90
116
  "publisherWorkflowMode": "fixed",
91
- "publisherWorkflowPath": ".github/workflows/.ops-pipeline-delivery.yml",
117
+ "publisherWorkflowPath": ".github/workflows/.ops-alpha-candidate-patrol.yml",
92
118
  "environment": "",
93
119
  "environmentMode": "fixed",
94
120
  "runnerPolicy": "unqualified",
95
121
  "notes": ""
96
122
  },
97
123
  {
98
- "workflowPath": ".github/workflows/.ops-pipeline-execute.yml",
124
+ "workflowPath": ".github/workflows/.ops-bootstrap.yml",
99
125
  "authorityClass": "product-publication",
100
126
  "publicationCapable": true,
101
127
  "capabilityIds": [
102
- "channel-ref",
103
- "github-release",
104
- "npm-publish"
128
+ "universal-candidate-execution"
105
129
  ],
106
- "credentialMode": "trusted-publishing",
107
- "publisherWorkflowMode": "fixed",
108
- "publisherWorkflowPath": ".github/workflows/.release-pipeline-products.yml",
130
+ "credentialMode": "caller-secrets",
131
+ "publisherWorkflowMode": "caller-bound",
132
+ "publisherWorkflowPath": ".github/workflows/.ops-bootstrap.yml",
109
133
  "environment": "none",
110
134
  "environmentMode": "fixed",
111
135
  "runnerPolicy": "qualified-measured",
112
136
  "notes": ""
113
137
  },
114
138
  {
115
- "workflowPath": ".github/workflows/.release-authority.yml",
116
- "authorityClass": "evidence-publication",
139
+ "workflowPath": ".github/workflows/.ops-dev-auto-merge.yml",
140
+ "authorityClass": "governance-write",
117
141
  "publicationCapable": false,
118
142
  "capabilityIds": [],
119
143
  "credentialMode": "none",
120
144
  "publisherWorkflowMode": "fixed",
121
- "publisherWorkflowPath": ".github/workflows/.release-authority.yml",
145
+ "publisherWorkflowPath": ".github/workflows/.ops-dev-auto-merge.yml",
122
146
  "environment": "",
123
147
  "environmentMode": "fixed",
124
148
  "runnerPolicy": "unqualified",
125
149
  "notes": ""
126
150
  },
127
151
  {
128
- "workflowPath": ".github/workflows/.release-binary-assets.yml",
129
- "authorityClass": "product-publication",
130
- "publicationCapable": true,
131
- "capabilityIds": [
132
- "github-release"
133
- ],
134
- "credentialMode": "github-token",
152
+ "workflowPath": ".github/workflows/.ops-dev-qualification-patrol.yml",
153
+ "authorityClass": "governance-write",
154
+ "publicationCapable": false,
155
+ "capabilityIds": [],
156
+ "credentialMode": "none",
135
157
  "publisherWorkflowMode": "fixed",
136
- "publisherWorkflowPath": ".github/workflows/.release-binary-assets.yml",
137
- "environment": "buildchain-release-assets",
158
+ "publisherWorkflowPath": ".github/workflows/.ops-dev-qualification-patrol.yml",
159
+ "environment": "",
138
160
  "environmentMode": "fixed",
139
- "runnerPolicy": "qualified-measured",
161
+ "runnerPolicy": "unqualified",
140
162
  "notes": ""
141
163
  },
142
164
  {
143
- "workflowPath": ".github/workflows/.release-pipeline-products.yml",
144
- "authorityClass": "product-publication",
145
- "publicationCapable": true,
146
- "capabilityIds": [
147
- "channel-ref",
148
- "github-release",
149
- "npm-publish"
150
- ],
151
- "credentialMode": "trusted-publishing",
165
+ "workflowPath": ".github/workflows/.ops-git-sync.yml",
166
+ "authorityClass": "governance-write",
167
+ "publicationCapable": false,
168
+ "capabilityIds": [],
169
+ "credentialMode": "none",
152
170
  "publisherWorkflowMode": "fixed",
153
- "publisherWorkflowPath": ".github/workflows/.release-pipeline-products.yml",
154
- "environment": "none",
171
+ "publisherWorkflowPath": ".github/workflows/.ops-git-sync.yml",
172
+ "environment": "",
155
173
  "environmentMode": "fixed",
156
- "runnerPolicy": "qualified-measured",
174
+ "runnerPolicy": "unqualified",
157
175
  "notes": ""
158
176
  },
159
177
  {
160
- "workflowPath": ".github/workflows/.release-pipeline-version.yml",
178
+ "workflowPath": ".github/workflows/.ops-housekeeping.yml",
161
179
  "authorityClass": "governance-write",
162
180
  "publicationCapable": false,
163
181
  "capabilityIds": [],
164
182
  "credentialMode": "none",
165
183
  "publisherWorkflowMode": "fixed",
166
- "publisherWorkflowPath": ".github/workflows/.release-pipeline-version.yml",
184
+ "publisherWorkflowPath": ".github/workflows/.ops-housekeeping.yml",
167
185
  "environment": "",
168
186
  "environmentMode": "fixed",
169
187
  "runnerPolicy": "unqualified",
170
188
  "notes": ""
171
189
  },
172
190
  {
173
- "workflowPath": ".github/workflows/.release-promote.yml",
191
+ "workflowPath": ".github/workflows/.ops-observed-evidence.yml",
174
192
  "authorityClass": "product-publication",
175
193
  "publicationCapable": true,
176
194
  "capabilityIds": [
177
- "channel-ref",
178
- "github-release",
179
- "npm-publish"
195
+ "observed-evidence-publication"
180
196
  ],
181
- "credentialMode": "trusted-publishing",
197
+ "credentialMode": "oidc",
182
198
  "publisherWorkflowMode": "caller-bound",
183
- "publisherWorkflowPath": ".github/workflows/.release-promote.yml",
184
- "environment": "none",
185
- "environmentMode": "fixed",
199
+ "publisherWorkflowPath": ".github/workflows/.ops-observed-evidence.yml",
200
+ "environment": "consumer-defined",
201
+ "environmentMode": "caller-bound",
186
202
  "runnerPolicy": "qualified-measured",
187
203
  "notes": ""
188
204
  },
189
205
  {
190
- "workflowPath": ".github/workflows/build.yml",
191
- "authorityClass": "non-publication-oidc",
206
+ "workflowPath": ".github/workflows/.ops-patrol-daily.yml",
207
+ "authorityClass": "governance-write",
192
208
  "publicationCapable": false,
193
209
  "capabilityIds": [],
194
210
  "credentialMode": "none",
195
211
  "publisherWorkflowMode": "fixed",
196
- "publisherWorkflowPath": ".github/workflows/build.yml",
212
+ "publisherWorkflowPath": ".github/workflows/.ops-patrol-daily.yml",
197
213
  "environment": "",
198
214
  "environmentMode": "fixed",
199
215
  "runnerPolicy": "unqualified",
200
216
  "notes": ""
201
217
  },
202
218
  {
203
- "workflowPath": ".github/workflows/buildchain-recover.yml",
204
- "authorityClass": "product-publication",
205
- "publicationCapable": true,
206
- "capabilityIds": [
207
- "channel-ref",
208
- "github-release",
209
- "npm-publish"
210
- ],
211
- "credentialMode": "trusted-publishing",
212
- "publisherWorkflowMode": "fixed",
213
- "publisherWorkflowPath": ".github/workflows/.release-pipeline-products.yml",
214
- "environment": "none",
215
- "environmentMode": "fixed",
216
- "runnerPolicy": "qualified-measured",
217
- "notes": ""
218
- },
219
- {
220
- "workflowPath": ".github/workflows/buildchain.yml",
221
- "authorityClass": "product-publication",
222
- "publicationCapable": true,
223
- "capabilityIds": [
224
- "channel-ref",
225
- "github-release",
226
- "npm-publish"
227
- ],
228
- "credentialMode": "trusted-publishing",
219
+ "workflowPath": ".github/workflows/.ops-patrol-monthly.yml",
220
+ "authorityClass": "governance-write",
221
+ "publicationCapable": false,
222
+ "capabilityIds": [],
223
+ "credentialMode": "none",
229
224
  "publisherWorkflowMode": "fixed",
230
- "publisherWorkflowPath": ".github/workflows/.release-pipeline-products.yml",
231
- "environment": "none",
225
+ "publisherWorkflowPath": ".github/workflows/.ops-patrol-monthly.yml",
226
+ "environment": "",
232
227
  "environmentMode": "fixed",
233
- "runnerPolicy": "qualified-measured",
228
+ "runnerPolicy": "unqualified",
234
229
  "notes": ""
235
230
  },
236
231
  {
237
- "workflowPath": ".github/workflows/public-build-demo.yml",
232
+ "workflowPath": ".github/workflows/.ops-patrol-weekly.yml",
238
233
  "authorityClass": "governance-write",
239
234
  "publicationCapable": false,
240
235
  "capabilityIds": [],
241
236
  "credentialMode": "none",
242
237
  "publisherWorkflowMode": "fixed",
243
- "publisherWorkflowPath": ".github/workflows/public-build-demo.yml",
238
+ "publisherWorkflowPath": ".github/workflows/.ops-patrol-weekly.yml",
244
239
  "environment": "",
245
240
  "environmentMode": "fixed",
246
241
  "runnerPolicy": "unqualified",
247
242
  "notes": ""
248
243
  },
249
244
  {
250
- "workflowPath": ".github/workflows/public-build-publication.yml",
251
- "authorityClass": "evidence-publication",
245
+ "workflowPath": ".github/workflows/.ops-patrol.yml",
246
+ "authorityClass": "governance-write",
252
247
  "publicationCapable": false,
253
248
  "capabilityIds": [],
254
249
  "credentialMode": "none",
255
250
  "publisherWorkflowMode": "fixed",
256
- "publisherWorkflowPath": ".github/workflows/public-build-publication.yml",
251
+ "publisherWorkflowPath": ".github/workflows/.ops-patrol.yml",
257
252
  "environment": "",
258
253
  "environmentMode": "fixed",
259
254
  "runnerPolicy": "unqualified",
260
255
  "notes": ""
261
256
  },
262
257
  {
263
- "workflowPath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
258
+ "workflowPath": ".github/workflows/.ops-pipeline-delivery.yml",
264
259
  "authorityClass": "governance-write",
265
260
  "publicationCapable": false,
266
261
  "capabilityIds": [],
267
262
  "credentialMode": "none",
268
263
  "publisherWorkflowMode": "fixed",
269
- "publisherWorkflowPath": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
264
+ "publisherWorkflowPath": ".github/workflows/.ops-pipeline-delivery.yml",
270
265
  "environment": "",
271
266
  "environmentMode": "fixed",
272
267
  "runnerPolicy": "unqualified",
273
268
  "notes": ""
274
269
  },
275
270
  {
276
- "workflowPath": ".github/workflows/public-ops-bootstrap.yml",
271
+ "workflowPath": ".github/workflows/.ops-pipeline-execute.yml",
277
272
  "authorityClass": "product-publication",
278
273
  "publicationCapable": true,
279
274
  "capabilityIds": [
280
- "universal-candidate-execution"
275
+ "channel-ref",
276
+ "github-release",
277
+ "npm-publish"
281
278
  ],
282
- "credentialMode": "caller-secrets",
283
- "publisherWorkflowMode": "caller-bound",
284
- "publisherWorkflowPath": ".github/workflows/public-ops-bootstrap.yml",
279
+ "credentialMode": "trusted-publishing",
280
+ "publisherWorkflowMode": "fixed",
281
+ "publisherWorkflowPath": ".github/workflows/.release-pipeline-products.yml",
285
282
  "environment": "none",
286
283
  "environmentMode": "fixed",
287
284
  "runnerPolicy": "qualified-measured",
288
285
  "notes": ""
289
286
  },
290
287
  {
291
- "workflowPath": ".github/workflows/public-ops-dev-auto-merge.yml",
288
+ "workflowPath": ".github/workflows/.ops-stable-candidate-patrol.yml",
292
289
  "authorityClass": "governance-write",
293
290
  "publicationCapable": false,
294
291
  "capabilityIds": [],
295
292
  "credentialMode": "none",
296
293
  "publisherWorkflowMode": "fixed",
297
- "publisherWorkflowPath": ".github/workflows/public-ops-dev-auto-merge.yml",
294
+ "publisherWorkflowPath": ".github/workflows/.ops-stable-candidate-patrol.yml",
298
295
  "environment": "",
299
296
  "environmentMode": "fixed",
300
297
  "runnerPolicy": "unqualified",
301
298
  "notes": ""
302
299
  },
303
300
  {
304
- "workflowPath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
301
+ "workflowPath": ".github/workflows/.ops-warrant-cancel.yml",
305
302
  "authorityClass": "governance-write",
306
303
  "publicationCapable": false,
307
304
  "capabilityIds": [],
308
305
  "credentialMode": "none",
309
306
  "publisherWorkflowMode": "fixed",
310
- "publisherWorkflowPath": ".github/workflows/public-ops-dev-qualification-patrol.yml",
307
+ "publisherWorkflowPath": ".github/workflows/.ops-warrant-cancel.yml",
311
308
  "environment": "",
312
309
  "environmentMode": "fixed",
313
310
  "runnerPolicy": "unqualified",
314
311
  "notes": ""
315
312
  },
316
313
  {
317
- "workflowPath": ".github/workflows/public-ops-housekeeping.yml",
314
+ "workflowPath": ".github/workflows/.ops-warrant-close.yml",
318
315
  "authorityClass": "governance-write",
319
316
  "publicationCapable": false,
320
317
  "capabilityIds": [],
321
318
  "credentialMode": "none",
322
319
  "publisherWorkflowMode": "fixed",
323
- "publisherWorkflowPath": ".github/workflows/public-ops-housekeeping.yml",
320
+ "publisherWorkflowPath": ".github/workflows/.ops-warrant-close.yml",
324
321
  "environment": "",
325
322
  "environmentMode": "fixed",
326
323
  "runnerPolicy": "unqualified",
327
324
  "notes": ""
328
325
  },
329
326
  {
330
- "workflowPath": ".github/workflows/public-ops-observed-evidence.yml",
331
- "authorityClass": "product-publication",
327
+ "workflowPath": ".github/workflows/.release-artifact-attestation.yml",
328
+ "authorityClass": "evidence-publication",
332
329
  "publicationCapable": true,
333
330
  "capabilityIds": [
334
- "observed-evidence-publication"
331
+ "github-artifact-attestation"
335
332
  ],
336
333
  "credentialMode": "oidc",
337
334
  "publisherWorkflowMode": "caller-bound",
338
- "publisherWorkflowPath": ".github/workflows/public-ops-observed-evidence.yml",
335
+ "publisherWorkflowPath": ".github/workflows/.release-artifact-attestation.yml",
339
336
  "environment": "consumer-defined",
340
337
  "environmentMode": "caller-bound",
341
338
  "runnerPolicy": "qualified-measured",
342
339
  "notes": ""
343
340
  },
344
341
  {
345
- "workflowPath": ".github/workflows/public-ops-patrol-daily.yml",
346
- "authorityClass": "governance-write",
342
+ "workflowPath": ".github/workflows/.release-authority.yml",
343
+ "authorityClass": "evidence-publication",
347
344
  "publicationCapable": false,
348
345
  "capabilityIds": [],
349
346
  "credentialMode": "none",
350
347
  "publisherWorkflowMode": "fixed",
351
- "publisherWorkflowPath": ".github/workflows/public-ops-patrol-daily.yml",
348
+ "publisherWorkflowPath": ".github/workflows/.release-authority.yml",
352
349
  "environment": "",
353
350
  "environmentMode": "fixed",
354
351
  "runnerPolicy": "unqualified",
355
352
  "notes": ""
356
353
  },
357
354
  {
358
- "workflowPath": ".github/workflows/public-ops-patrol-monthly.yml",
359
- "authorityClass": "governance-write",
360
- "publicationCapable": false,
361
- "capabilityIds": [],
362
- "credentialMode": "none",
355
+ "workflowPath": ".github/workflows/.release-binary-assets.yml",
356
+ "authorityClass": "product-publication",
357
+ "publicationCapable": true,
358
+ "capabilityIds": [
359
+ "github-release"
360
+ ],
361
+ "credentialMode": "github-token",
363
362
  "publisherWorkflowMode": "fixed",
364
- "publisherWorkflowPath": ".github/workflows/public-ops-patrol-monthly.yml",
365
- "environment": "",
363
+ "publisherWorkflowPath": ".github/workflows/.release-binary-assets.yml",
364
+ "environment": "buildchain-release-assets",
366
365
  "environmentMode": "fixed",
367
- "runnerPolicy": "unqualified",
366
+ "runnerPolicy": "qualified-measured",
368
367
  "notes": ""
369
368
  },
370
369
  {
371
- "workflowPath": ".github/workflows/public-ops-patrol-weekly.yml",
372
- "authorityClass": "governance-write",
373
- "publicationCapable": false,
374
- "capabilityIds": [],
375
- "credentialMode": "none",
376
- "publisherWorkflowMode": "fixed",
377
- "publisherWorkflowPath": ".github/workflows/public-ops-patrol-weekly.yml",
378
- "environment": "",
370
+ "workflowPath": ".github/workflows/.release-candidate-promote.yml",
371
+ "authorityClass": "product-publication",
372
+ "publicationCapable": true,
373
+ "capabilityIds": [
374
+ "channel-ref",
375
+ "github-release",
376
+ "npm-publish"
377
+ ],
378
+ "credentialMode": "trusted-publishing",
379
+ "publisherWorkflowMode": "caller-bound",
380
+ "publisherWorkflowPath": ".github/workflows/.release-candidate-promote.yml",
381
+ "environment": "none",
379
382
  "environmentMode": "fixed",
380
- "runnerPolicy": "unqualified",
383
+ "runnerPolicy": "qualified-measured",
381
384
  "notes": ""
382
385
  },
383
386
  {
384
- "workflowPath": ".github/workflows/public-ops-patrol.yml",
385
- "authorityClass": "governance-write",
386
- "publicationCapable": false,
387
- "capabilityIds": [],
388
- "credentialMode": "none",
389
- "publisherWorkflowMode": "fixed",
390
- "publisherWorkflowPath": ".github/workflows/public-ops-patrol.yml",
391
- "environment": "",
387
+ "workflowPath": ".github/workflows/.release-oci-compose-preview.yml",
388
+ "authorityClass": "product-publication",
389
+ "publicationCapable": true,
390
+ "capabilityIds": [
391
+ "oci-compose-preview"
392
+ ],
393
+ "credentialMode": "caller-secrets",
394
+ "publisherWorkflowMode": "caller-bound",
395
+ "publisherWorkflowPath": ".github/workflows/.release-oci-compose-preview.yml",
396
+ "environment": "none",
392
397
  "environmentMode": "fixed",
393
- "runnerPolicy": "unqualified",
398
+ "runnerPolicy": "qualified-measured",
394
399
  "notes": ""
395
400
  },
396
401
  {
397
- "workflowPath": ".github/workflows/public-ops-pipeline.yml",
402
+ "workflowPath": ".github/workflows/.release-paper.yml",
398
403
  "authorityClass": "product-publication",
399
404
  "publicationCapable": true,
400
405
  "capabilityIds": [
401
- "channel-ref",
402
406
  "github-release",
403
407
  "npm-publish"
404
408
  ],
405
409
  "credentialMode": "trusted-publishing",
406
- "publisherWorkflowMode": "fixed",
407
- "publisherWorkflowPath": ".github/workflows/.release-pipeline-products.yml",
410
+ "publisherWorkflowMode": "caller-bound",
411
+ "publisherWorkflowPath": ".github/workflows/.release-paper.yml",
408
412
  "environment": "none",
409
413
  "environmentMode": "fixed",
410
414
  "runnerPolicy": "qualified-measured",
411
415
  "notes": ""
412
416
  },
413
417
  {
414
- "workflowPath": ".github/workflows/public-ops-recover.yml",
418
+ "workflowPath": ".github/workflows/.release-pipeline-products.yml",
415
419
  "authorityClass": "product-publication",
416
420
  "publicationCapable": true,
417
421
  "capabilityIds": [
@@ -428,92 +432,113 @@
428
432
  "notes": ""
429
433
  },
430
434
  {
431
- "workflowPath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
435
+ "workflowPath": ".github/workflows/.release-pipeline-version.yml",
432
436
  "authorityClass": "governance-write",
433
437
  "publicationCapable": false,
434
438
  "capabilityIds": [],
435
439
  "credentialMode": "none",
436
440
  "publisherWorkflowMode": "fixed",
437
- "publisherWorkflowPath": ".github/workflows/public-ops-stable-candidate-patrol.yml",
441
+ "publisherWorkflowPath": ".github/workflows/.release-pipeline-version.yml",
438
442
  "environment": "",
439
443
  "environmentMode": "fixed",
440
444
  "runnerPolicy": "unqualified",
441
445
  "notes": ""
442
446
  },
443
447
  {
444
- "workflowPath": ".github/workflows/public-ops-warrant-cancel.yml",
448
+ "workflowPath": ".github/workflows/.release-promote.yml",
449
+ "authorityClass": "product-publication",
450
+ "publicationCapable": true,
451
+ "capabilityIds": [
452
+ "channel-ref",
453
+ "github-release",
454
+ "npm-publish"
455
+ ],
456
+ "credentialMode": "trusted-publishing",
457
+ "publisherWorkflowMode": "caller-bound",
458
+ "publisherWorkflowPath": ".github/workflows/.release-promote.yml",
459
+ "environment": "none",
460
+ "environmentMode": "fixed",
461
+ "runnerPolicy": "qualified-measured",
462
+ "notes": ""
463
+ },
464
+ {
465
+ "workflowPath": ".github/workflows/.release-propagation.yml",
445
466
  "authorityClass": "governance-write",
446
467
  "publicationCapable": false,
447
468
  "capabilityIds": [],
448
469
  "credentialMode": "none",
449
470
  "publisherWorkflowMode": "fixed",
450
- "publisherWorkflowPath": ".github/workflows/public-ops-warrant-cancel.yml",
471
+ "publisherWorkflowPath": ".github/workflows/.release-propagation.yml",
451
472
  "environment": "",
452
473
  "environmentMode": "fixed",
453
474
  "runnerPolicy": "unqualified",
454
475
  "notes": ""
455
476
  },
456
477
  {
457
- "workflowPath": ".github/workflows/public-ops-warrant-close.yml",
458
- "authorityClass": "governance-write",
478
+ "workflowPath": ".github/workflows/.release-signing-authority.yml",
479
+ "authorityClass": "evidence-publication",
459
480
  "publicationCapable": false,
460
481
  "capabilityIds": [],
461
482
  "credentialMode": "none",
462
483
  "publisherWorkflowMode": "fixed",
463
- "publisherWorkflowPath": ".github/workflows/public-ops-warrant-close.yml",
484
+ "publisherWorkflowPath": ".github/workflows/.release-signing-authority.yml",
464
485
  "environment": "",
465
486
  "environmentMode": "fixed",
466
487
  "runnerPolicy": "unqualified",
467
488
  "notes": ""
468
489
  },
469
490
  {
470
- "workflowPath": ".github/workflows/public-release-artifact-attestation.yml",
471
- "authorityClass": "evidence-publication",
491
+ "workflowPath": ".github/workflows/.release-tail.yml",
492
+ "authorityClass": "product-publication",
472
493
  "publicationCapable": true,
473
494
  "capabilityIds": [
474
- "github-artifact-attestation"
495
+ "artifact.publish",
496
+ "release.activate",
497
+ "released-evidence.synthesize",
498
+ "signed-channel.commit"
475
499
  ],
476
- "credentialMode": "oidc",
477
- "publisherWorkflowMode": "caller-bound",
478
- "publisherWorkflowPath": ".github/workflows/public-release-artifact-attestation.yml",
479
- "environment": "consumer-defined",
500
+ "credentialMode": "caller-secrets",
501
+ "publisherWorkflowMode": "fixed",
502
+ "publisherWorkflowPath": ".github/workflows/.release-tail.yml",
503
+ "environment": "caller-bound",
480
504
  "environmentMode": "caller-bound",
481
505
  "runnerPolicy": "qualified-measured",
482
506
  "notes": ""
483
507
  },
484
508
  {
485
- "workflowPath": ".github/workflows/public-release-oci-compose-preview.yml",
509
+ "workflowPath": ".github/workflows/.release-web.yml",
486
510
  "authorityClass": "product-publication",
487
511
  "publicationCapable": true,
488
512
  "capabilityIds": [
489
- "oci-compose-preview"
513
+ "web-production"
490
514
  ],
491
- "credentialMode": "caller-secrets",
515
+ "credentialMode": "oidc",
492
516
  "publisherWorkflowMode": "caller-bound",
493
- "publisherWorkflowPath": ".github/workflows/public-release-oci-compose-preview.yml",
494
- "environment": "none",
495
- "environmentMode": "fixed",
517
+ "publisherWorkflowPath": ".github/workflows/.release-web.yml",
518
+ "environment": "consumer-defined",
519
+ "environmentMode": "caller-bound",
496
520
  "runnerPolicy": "qualified-measured",
497
521
  "notes": ""
498
522
  },
499
523
  {
500
- "workflowPath": ".github/workflows/public-release-paper.yml",
524
+ "workflowPath": ".github/workflows/buildchain-recover.yml",
501
525
  "authorityClass": "product-publication",
502
526
  "publicationCapable": true,
503
527
  "capabilityIds": [
528
+ "channel-ref",
504
529
  "github-release",
505
530
  "npm-publish"
506
531
  ],
507
532
  "credentialMode": "trusted-publishing",
508
- "publisherWorkflowMode": "caller-bound",
509
- "publisherWorkflowPath": ".github/workflows/public-release-paper.yml",
533
+ "publisherWorkflowMode": "fixed",
534
+ "publisherWorkflowPath": ".github/workflows/.release-pipeline-products.yml",
510
535
  "environment": "none",
511
536
  "environmentMode": "fixed",
512
537
  "runnerPolicy": "qualified-measured",
513
538
  "notes": ""
514
539
  },
515
540
  {
516
- "workflowPath": ".github/workflows/public-release-promote.yml",
541
+ "workflowPath": ".github/workflows/buildchain.yml",
517
542
  "authorityClass": "product-publication",
518
543
  "publicationCapable": true,
519
544
  "capabilityIds": [
@@ -522,268 +547,259 @@
522
547
  "npm-publish"
523
548
  ],
524
549
  "credentialMode": "trusted-publishing",
525
- "publisherWorkflowMode": "caller-bound",
526
- "publisherWorkflowPath": ".github/workflows/public-release-promote.yml",
550
+ "publisherWorkflowMode": "fixed",
551
+ "publisherWorkflowPath": ".github/workflows/.release-pipeline-products.yml",
527
552
  "environment": "none",
528
553
  "environmentMode": "fixed",
529
554
  "runnerPolicy": "qualified-measured",
530
555
  "notes": ""
531
556
  },
532
557
  {
533
- "workflowPath": ".github/workflows/public-release-propagation.yml",
534
- "authorityClass": "governance-write",
535
- "publicationCapable": false,
536
- "capabilityIds": [],
537
- "credentialMode": "none",
538
- "publisherWorkflowMode": "fixed",
539
- "publisherWorkflowPath": ".github/workflows/public-release-propagation.yml",
540
- "environment": "",
541
- "environmentMode": "fixed",
542
- "runnerPolicy": "unqualified",
543
- "notes": ""
544
- },
545
- {
546
- "workflowPath": ".github/workflows/public-release-signing-authority.yml",
547
- "authorityClass": "evidence-publication",
548
- "publicationCapable": false,
549
- "capabilityIds": [],
550
- "credentialMode": "none",
551
- "publisherWorkflowMode": "fixed",
552
- "publisherWorkflowPath": ".github/workflows/public-release-signing-authority.yml",
553
- "environment": "",
554
- "environmentMode": "fixed",
555
- "runnerPolicy": "unqualified",
556
- "notes": ""
557
- },
558
- {
559
- "workflowPath": ".github/workflows/public-release-tail.yml",
558
+ "workflowPath": ".github/workflows/public-ops-pipeline.yml",
560
559
  "authorityClass": "product-publication",
561
560
  "publicationCapable": true,
562
561
  "capabilityIds": [
563
- "artifact.publish",
564
- "release.activate",
565
- "released-evidence.synthesize",
566
- "signed-channel.commit"
562
+ "channel-ref",
563
+ "github-release",
564
+ "npm-publish"
567
565
  ],
568
- "credentialMode": "caller-secrets",
566
+ "credentialMode": "trusted-publishing",
569
567
  "publisherWorkflowMode": "fixed",
570
- "publisherWorkflowPath": ".github/workflows/public-release-tail.yml",
571
- "environment": "caller-bound",
572
- "environmentMode": "caller-bound",
568
+ "publisherWorkflowPath": ".github/workflows/.release-pipeline-products.yml",
569
+ "environment": "none",
570
+ "environmentMode": "fixed",
573
571
  "runnerPolicy": "qualified-measured",
574
572
  "notes": ""
575
573
  },
576
574
  {
577
- "workflowPath": ".github/workflows/public-release-web.yml",
575
+ "workflowPath": ".github/workflows/public-ops-recover.yml",
578
576
  "authorityClass": "product-publication",
579
577
  "publicationCapable": true,
580
578
  "capabilityIds": [
581
- "web-production"
579
+ "channel-ref",
580
+ "github-release",
581
+ "npm-publish"
582
582
  ],
583
- "credentialMode": "oidc",
584
- "publisherWorkflowMode": "caller-bound",
585
- "publisherWorkflowPath": ".github/workflows/public-release-web.yml",
586
- "environment": "consumer-defined",
587
- "environmentMode": "caller-bound",
583
+ "credentialMode": "trusted-publishing",
584
+ "publisherWorkflowMode": "fixed",
585
+ "publisherWorkflowPath": ".github/workflows/.release-pipeline-products.yml",
586
+ "environment": "none",
587
+ "environmentMode": "fixed",
588
588
  "runnerPolicy": "qualified-measured",
589
589
  "notes": ""
590
590
  }
591
591
  ],
592
592
  "workflowFacts": [
593
593
  {
594
- "path": ".github/workflows/.build-demo-adapter.yml",
595
- "signals": [],
596
- "classified": true
597
- },
598
- {
599
- "path": ".github/workflows/.build-gate-profile.yml",
594
+ "path": ".github/workflows/.build-adopter-qualification.yml",
600
595
  "signals": [],
601
596
  "classified": false
602
597
  },
603
598
  {
604
- "path": ".github/workflows/.build.yml",
599
+ "path": ".github/workflows/.build-candidate.yml",
605
600
  "signals": [
606
601
  "write-permission",
607
- "oidc",
608
- "environment"
602
+ "oidc"
609
603
  ],
610
604
  "classified": true
611
605
  },
612
606
  {
613
- "path": ".github/workflows/.ops-git-sync.yml",
607
+ "path": ".github/workflows/.build-check.yml",
608
+ "signals": [],
609
+ "classified": false
610
+ },
611
+ {
612
+ "path": ".github/workflows/.build-demo-adapter.yml",
614
613
  "signals": [],
615
614
  "classified": true
616
615
  },
617
616
  {
618
- "path": ".github/workflows/.ops-pipeline-delivery.yml",
617
+ "path": ".github/workflows/.build-demo.yml",
619
618
  "signals": [
620
619
  "write-permission"
621
620
  ],
622
621
  "classified": true
623
622
  },
624
623
  {
625
- "path": ".github/workflows/.ops-pipeline-execute.yml",
624
+ "path": ".github/workflows/.build-gate-profile.yml",
625
+ "signals": [],
626
+ "classified": false
627
+ },
628
+ {
629
+ "path": ".github/workflows/.build-publication.yml",
626
630
  "signals": [
627
- "write-permission",
628
- "oidc"
631
+ "write-permission"
629
632
  ],
630
633
  "classified": true
631
634
  },
632
635
  {
633
- "path": ".github/workflows/.release-authority.yml",
636
+ "path": ".github/workflows/.build-stage-capsule-canary.yml",
634
637
  "signals": [],
635
- "classified": true
638
+ "classified": false
636
639
  },
637
640
  {
638
- "path": ".github/workflows/.release-binary-assets.yml",
641
+ "path": ".github/workflows/.build.yml",
639
642
  "signals": [
640
643
  "write-permission",
644
+ "oidc",
641
645
  "environment"
642
646
  ],
643
647
  "classified": true
644
648
  },
645
649
  {
646
- "path": ".github/workflows/.release-pipeline-products.yml",
650
+ "path": ".github/workflows/.ops-alpha-candidate-patrol.yml",
647
651
  "signals": [
648
- "write-permission",
649
- "oidc"
652
+ "write-permission"
650
653
  ],
651
654
  "classified": true
652
655
  },
653
656
  {
654
- "path": ".github/workflows/.release-pipeline-version.yml",
657
+ "path": ".github/workflows/.ops-bootstrap.yml",
658
+ "signals": [],
659
+ "classified": true
660
+ },
661
+ {
662
+ "path": ".github/workflows/.ops-dev-auto-merge.yml",
655
663
  "signals": [
656
664
  "write-permission"
657
665
  ],
658
666
  "classified": true
659
667
  },
660
668
  {
661
- "path": ".github/workflows/.release-promote.yml",
669
+ "path": ".github/workflows/.ops-dev-qualification-patrol.yml",
670
+ "signals": [
671
+ "write-permission"
672
+ ],
673
+ "classified": true
674
+ },
675
+ {
676
+ "path": ".github/workflows/.ops-git-sync.yml",
662
677
  "signals": [],
663
678
  "classified": true
664
679
  },
665
680
  {
666
- "path": ".github/workflows/build.yml",
681
+ "path": ".github/workflows/.ops-housekeeping.yml",
682
+ "signals": [],
683
+ "classified": true
684
+ },
685
+ {
686
+ "path": ".github/workflows/.ops-observed-evidence.yml",
667
687
  "signals": [
668
- "write-permission",
669
- "oidc"
688
+ "oidc",
689
+ "environment"
670
690
  ],
671
691
  "classified": true
672
692
  },
673
693
  {
674
- "path": ".github/workflows/buildchain-recover.yml",
694
+ "path": ".github/workflows/.ops-patrol-daily.yml",
675
695
  "signals": [
676
- "write-permission",
677
- "oidc"
696
+ "write-permission"
678
697
  ],
679
698
  "classified": true
680
699
  },
681
700
  {
682
- "path": ".github/workflows/buildchain.yml",
701
+ "path": ".github/workflows/.ops-patrol-monthly.yml",
683
702
  "signals": [
684
- "write-permission",
685
- "oidc"
703
+ "write-permission"
686
704
  ],
687
705
  "classified": true
688
706
  },
689
707
  {
690
- "path": ".github/workflows/public-build-adopter-qualification.yml",
691
- "signals": [],
692
- "classified": false
708
+ "path": ".github/workflows/.ops-patrol-weekly.yml",
709
+ "signals": [
710
+ "write-permission"
711
+ ],
712
+ "classified": true
693
713
  },
694
714
  {
695
- "path": ".github/workflows/public-build-check.yml",
696
- "signals": [],
697
- "classified": false
715
+ "path": ".github/workflows/.ops-patrol.yml",
716
+ "signals": [
717
+ "write-permission"
718
+ ],
719
+ "classified": true
698
720
  },
699
721
  {
700
- "path": ".github/workflows/public-build-demo.yml",
722
+ "path": ".github/workflows/.ops-pipeline-delivery.yml",
701
723
  "signals": [
702
724
  "write-permission"
703
725
  ],
704
726
  "classified": true
705
727
  },
706
728
  {
707
- "path": ".github/workflows/public-build-publication.yml",
729
+ "path": ".github/workflows/.ops-pipeline-execute.yml",
708
730
  "signals": [
709
- "write-permission"
731
+ "write-permission",
732
+ "oidc"
710
733
  ],
711
734
  "classified": true
712
735
  },
713
736
  {
714
- "path": ".github/workflows/public-build-stage-capsule-canary.yml",
737
+ "path": ".github/workflows/.ops-release-governance.yml",
715
738
  "signals": [],
716
739
  "classified": false
717
740
  },
718
741
  {
719
- "path": ".github/workflows/public-ops-alpha-candidate-patrol.yml",
742
+ "path": ".github/workflows/.ops-stable-candidate-patrol.yml",
720
743
  "signals": [
721
744
  "write-permission"
722
745
  ],
723
746
  "classified": true
724
747
  },
725
748
  {
726
- "path": ".github/workflows/public-ops-bootstrap.yml",
749
+ "path": ".github/workflows/.ops-tail-reseal.yml",
727
750
  "signals": [],
728
- "classified": true
751
+ "classified": false
729
752
  },
730
753
  {
731
- "path": ".github/workflows/public-ops-dev-auto-merge.yml",
754
+ "path": ".github/workflows/.ops-warrant-cancel.yml",
732
755
  "signals": [
733
756
  "write-permission"
734
757
  ],
735
758
  "classified": true
736
759
  },
737
760
  {
738
- "path": ".github/workflows/public-ops-dev-qualification-patrol.yml",
761
+ "path": ".github/workflows/.ops-warrant-close.yml",
739
762
  "signals": [
740
763
  "write-permission"
741
764
  ],
742
765
  "classified": true
743
766
  },
744
767
  {
745
- "path": ".github/workflows/public-ops-housekeeping.yml",
746
- "signals": [],
747
- "classified": true
748
- },
749
- {
750
- "path": ".github/workflows/public-ops-observed-evidence.yml",
768
+ "path": ".github/workflows/.release-artifact-attestation.yml",
751
769
  "signals": [
770
+ "write-permission",
752
771
  "oidc",
753
772
  "environment"
754
773
  ],
755
774
  "classified": true
756
775
  },
757
776
  {
758
- "path": ".github/workflows/public-ops-patrol-daily.yml",
759
- "signals": [
760
- "write-permission"
761
- ],
777
+ "path": ".github/workflows/.release-authority.yml",
778
+ "signals": [],
762
779
  "classified": true
763
780
  },
764
781
  {
765
- "path": ".github/workflows/public-ops-patrol-monthly.yml",
782
+ "path": ".github/workflows/.release-binary-assets.yml",
766
783
  "signals": [
767
- "write-permission"
784
+ "write-permission",
785
+ "environment"
768
786
  ],
769
787
  "classified": true
770
788
  },
771
789
  {
772
- "path": ".github/workflows/public-ops-patrol-weekly.yml",
773
- "signals": [
774
- "write-permission"
775
- ],
790
+ "path": ".github/workflows/.release-candidate-promote.yml",
791
+ "signals": [],
776
792
  "classified": true
777
793
  },
778
794
  {
779
- "path": ".github/workflows/public-ops-patrol.yml",
795
+ "path": ".github/workflows/.release-oci-compose-preview.yml",
780
796
  "signals": [
781
797
  "write-permission"
782
798
  ],
783
799
  "classified": true
784
800
  },
785
801
  {
786
- "path": ".github/workflows/public-ops-pipeline.yml",
802
+ "path": ".github/workflows/.release-paper.yml",
787
803
  "signals": [
788
804
  "write-permission",
789
805
  "oidc"
@@ -791,7 +807,7 @@
791
807
  "classified": true
792
808
  },
793
809
  {
794
- "path": ".github/workflows/public-ops-recover.yml",
810
+ "path": ".github/workflows/.release-pipeline-products.yml",
795
811
  "signals": [
796
812
  "write-permission",
797
813
  "oidc"
@@ -799,54 +815,47 @@
799
815
  "classified": true
800
816
  },
801
817
  {
802
- "path": ".github/workflows/public-ops-release-governance.yml",
803
- "signals": [],
804
- "classified": false
805
- },
806
- {
807
- "path": ".github/workflows/public-ops-stable-candidate-patrol.yml",
818
+ "path": ".github/workflows/.release-pipeline-version.yml",
808
819
  "signals": [
809
820
  "write-permission"
810
821
  ],
811
822
  "classified": true
812
823
  },
813
824
  {
814
- "path": ".github/workflows/public-ops-tail-reseal.yml",
825
+ "path": ".github/workflows/.release-promote.yml",
815
826
  "signals": [],
816
- "classified": false
827
+ "classified": true
817
828
  },
818
829
  {
819
- "path": ".github/workflows/public-ops-warrant-cancel.yml",
830
+ "path": ".github/workflows/.release-propagation.yml",
820
831
  "signals": [
821
832
  "write-permission"
822
833
  ],
823
834
  "classified": true
824
835
  },
825
836
  {
826
- "path": ".github/workflows/public-ops-warrant-close.yml",
837
+ "path": ".github/workflows/.release-signing-authority.yml",
827
838
  "signals": [
828
- "write-permission"
839
+ "environment"
829
840
  ],
830
841
  "classified": true
831
842
  },
832
843
  {
833
- "path": ".github/workflows/public-release-artifact-attestation.yml",
834
- "signals": [
835
- "write-permission",
836
- "oidc",
837
- "environment"
838
- ],
844
+ "path": ".github/workflows/.release-tail.yml",
845
+ "signals": [],
839
846
  "classified": true
840
847
  },
841
848
  {
842
- "path": ".github/workflows/public-release-oci-compose-preview.yml",
849
+ "path": ".github/workflows/.release-web.yml",
843
850
  "signals": [
844
- "write-permission"
851
+ "write-permission",
852
+ "oidc",
853
+ "environment"
845
854
  ],
846
855
  "classified": true
847
856
  },
848
857
  {
849
- "path": ".github/workflows/public-release-paper.yml",
858
+ "path": ".github/workflows/buildchain-recover.yml",
850
859
  "signals": [
851
860
  "write-permission",
852
861
  "oidc"
@@ -854,38 +863,29 @@
854
863
  "classified": true
855
864
  },
856
865
  {
857
- "path": ".github/workflows/public-release-promote.yml",
858
- "signals": [],
859
- "classified": true
860
- },
861
- {
862
- "path": ".github/workflows/public-release-propagation.yml",
866
+ "path": ".github/workflows/buildchain.yml",
863
867
  "signals": [
864
- "write-permission"
868
+ "write-permission",
869
+ "oidc"
865
870
  ],
866
871
  "classified": true
867
872
  },
868
873
  {
869
- "path": ".github/workflows/public-release-signing-authority.yml",
874
+ "path": ".github/workflows/public-ops-pipeline.yml",
870
875
  "signals": [
871
- "environment"
876
+ "write-permission",
877
+ "oidc"
872
878
  ],
873
879
  "classified": true
874
880
  },
875
881
  {
876
- "path": ".github/workflows/public-release-tail.yml",
877
- "signals": [],
878
- "classified": true
879
- },
880
- {
881
- "path": ".github/workflows/public-release-web.yml",
882
+ "path": ".github/workflows/public-ops-recover.yml",
882
883
  "signals": [
883
884
  "write-permission",
884
- "oidc",
885
- "environment"
885
+ "oidc"
886
886
  ],
887
887
  "classified": true
888
888
  }
889
889
  ],
890
- "registryDigest": "f4dde5fb7ed1779b121df1cac64b534ebd87d9bfab3db1c441e547953d0bfac5"
890
+ "registryDigest": "2d758e625d7aadf1c0622861658a0a0df2c5af7552ea410793a71592573dc4c0"
891
891
  }