@kungfu-tech/buildchain 4.1.6 → 4.1.7-alpha.0

package/contracts/fixtures/consumer-upgrade/release-v4.0.0.json

@@ -0,0 +1,815 @@
+{
+  "inputs": {
+    "buildchain-channel": {
+      "description": "Promotion workflow-shell/runtime channel: auto, alpha, or stable",
+      "default": "auto",
+      "type": "string",
+      "required": false
+    },
+    "buildchain-alpha-contract-lock-path": {
+      "description": "Consumer-owned contract lock selected for alpha promotion",
+      "default": ".buildchain/alpha-contract-lock.json",
+      "type": "string",
+      "required": false
+    },
+    "buildchain-stable-contract-lock-path": {
+      "description": "Consumer-owned contract lock selected for stable promotion",
+      "default": ".buildchain/contract-lock.json",
+      "type": "string",
+      "required": false
+    },
+    "buildchain-repository": {
+      "default": "kungfu-systems/buildchain",
+      "type": "string",
+      "required": false
+    },
+    "buildchain-ref": {
+      "description": "Optional Buildchain runtime ref. Empty uses the workflow shell ref.",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "buildchain-contract-lock-path": {
+      "description": "Consumer-owned Buildchain contract lock path",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "buildchain-contract-compatibility-policy": {
+      "description": "Contract compatibility policy: major-compatible, allow-additive, or exact",
+      "default": "major-compatible",
+      "type": "string",
+      "required": false
+    },
+    "buildchain-contract-drift-issue-mode": {
+      "description": "Consumer issue behavior for Buildchain floating-ref contract drift: off, breaking-only, or compatible-and-breaking",
+      "default": "compatible-and-breaking",
+      "type": "string",
+      "required": false
+    },
+    "allow-repository": {
+      "description": "Repository allowed to promote. Empty defaults to the caller repository.",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "channel": {
+      "description": "Promotion channel: alpha, release, or major. Empty derives from target-ref.",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "target-ref": {
+      "description": "Channel ref to promote. Defaults to the current ref name.",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "target-sha": {
+      "description": "Channel commit SHA to promote. Defaults to the current workflow SHA.",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "package-manager": {
+      "description": "Package manager recorded for audit: npm, pnpm, yarn, or custom",
+      "default": "npm",
+      "type": "string",
+      "required": false
+    },
+    "artifact-name": {
+      "description": "Base artifact name used by the PR-stage reusable build",
+      "default": "buildchain-artifact",
+      "type": "string",
+      "required": false
+    },
+    "release-candidate-workflow-file": {
+      "description": "PR-stage release-candidate workflow file name",
+      "default": "build.yml",
+      "type": "string",
+      "required": false
+    },
+    "release-candidate-workflow-name": {
+      "description": "PR-stage release-candidate workflow display name",
+      "default": "Build",
+      "type": "string",
+      "required": false
+    },
+    "release-candidate-wait-seconds": {
+      "description": "Bounded wait for the complete PR-stage release-candidate workflow, including post-required-check evidence tails",
+      "default": 10800,
+      "type": "number",
+      "required": false
+    },
+    "resume-candidate-repository": {
+      "description": "Repository that owns the sealed candidate run; empty selects normal candidate discovery",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "resume-candidate-run-id": {
+      "description": "Exact successful candidate workflow run ID to recover through this fresh workflow event",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "resume-expected-workflow-file": {
+      "description": "Exact trusted Build workflow file that produced the candidate",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "resume-expected-workflow-name": {
+      "description": "Exact trusted Build workflow display name that produced the candidate",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "resume-expected-source-tree": {
+      "description": "Optional exact candidate Git tree; required when expected candidate root is empty",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "resume-expected-candidate-root": {
+      "description": "Optional exact sha256 Release Candidate root; required when expected source tree is empty",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "resume-expected-candidate-runtime-sha": {
+      "description": "Exact Buildchain runtime SHA recorded by the original candidate",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "resume-buildchain-runtime-sha": {
+      "description": "Exact current Buildchain tooling SHA authorized to perform recovery",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "resume-transaction-id": {
+      "description": "Optional exact durable publication transaction identity to resume",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-candidate-family-evidence-required": {
+      "description": "Require exact Initiative-family evidence before protected promotion",
+      "default": false,
+      "type": "boolean",
+      "required": false
+    },
+    "release-candidate-family-evidence-root": {
+      "description": "Optional expected Initiative-family evidence content root",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-candidate-family-initiative-id": {
+      "description": "Optional expected Initiative identity",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-candidate-family-assignment-id": {
+      "description": "Optional expected child Assignment identity",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "artifact-patterns": {
+      "description": "Newline-separated payload artifact patterns expected from the RC bundle",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "required-status-check": {
+      "description": "Exact required protected-branch status check context",
+      "default": "check / check",
+      "type": "string",
+      "required": false
+    },
+    "branch-protection-bypass-apps": {
+      "description": "GitHub App slugs allowed to bypass pull-request review for Buildchain-managed generated channel ref updates",
+      "default": "github-actions",
+      "type": "string",
+      "required": false
+    },
+    "branch-protection-bypass-users": {
+      "description": "Reserved compatibility input; managed channel protection rejects user bypass actors",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "branch-protection-bypass-teams": {
+      "description": "Reserved compatibility input; managed channel protection rejects team bypass actors",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publish-target": {
+      "description": "Publish target recorded for audit: npm, github-release, custom",
+      "default": "npm",
+      "type": "string",
+      "required": false
+    },
+    "github-release": {
+      "description": "Create/update the public GitHub Release and upload Buildchain release passport/evidence assets after a complete release transaction",
+      "default": true,
+      "type": "boolean",
+      "required": false
+    },
+    "declarative-release-tail": {
+      "description": "Publish and read back GitHub Release assets through the Buildchain declarative release-tail provider plane",
+      "default": false,
+      "type": "boolean",
+      "required": false
+    },
+    "github-release-title": {
+      "description": "Optional GitHub Release title. Empty defaults to the public release tag.",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "github-release-notes": {
+      "description": "Optional GitHub Release notes. Empty uses a Buildchain release-passport asset note.",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "github-release-payload-patterns": {
+      "description": "Newline-separated basename patterns selecting PR-stage payload files for the immutable public GitHub Release",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-commit-command": {
+      "description": "Optional consumer command that commits the well-known publication authority after every artifact, passport, and public read-back prerequisite succeeds",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-commit-evidence-path": {
+      "description": "Consumer evidence JSON written by publication-commit-command under .buildchain/",
+      "default": ".buildchain/publication-commit/evidence.json",
+      "type": "string",
+      "required": false
+    },
+    "release-activation-command": {
+      "description": "Optional consumer command that completes exact site publication/readback and writes the authoritative activation receipt set",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-activation-receipt-set-path": {
+      "description": "Consumer activation receipt set written under .buildchain/",
+      "default": ".buildchain/release-activation/receipt-set.json",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-evidence-command": {
+      "description": "Optional consumer command that synthesizes released evidence only from the validated activation receipt set",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-evidence-path": {
+      "description": "Released evidence JSON written by release-passport-evidence-command under .buildchain/",
+      "default": ".buildchain/release-evidence/product-released-evidence.json",
+      "type": "string",
+      "required": false
+    },
+    "standalone-binary-distribution": {
+      "description": "Dispatch binary-distribution.yml after promotion; enable only when the caller repository provides that workflow",
+      "default": false,
+      "type": "boolean",
+      "required": false
+    },
+    "runner-preset": {
+      "description": "Runner preset recorded for audit",
+      "default": "github-hosted",
+      "type": "string",
+      "required": false
+    },
+    "trusted-publishing": {
+      "description": "Whether the publish target uses GitHub OIDC trusted publishing",
+      "default": true,
+      "type": "boolean",
+      "required": false
+    },
+    "publish-command": {
+      "description": "Optional publish command. Defaults to lifecycle.publish from buildchain.toml.",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publish-rematerialize-on-resume": {
+      "description": "Replay the consumer publish materialization step after valid durable evidence is restored; use only when the command is idempotent and recreates ephemeral Passport inputs or release assets",
+      "default": false,
+      "type": "boolean",
+      "required": false
+    },
+    "publish-transaction-override": {
+      "description": "Explicitly allow ancestry-bound finalization recovery for an already published durable transaction",
+      "default": false,
+      "type": "boolean",
+      "required": false
+    },
+    "publish-required-artifacts-json": {
+      "description": "Required publish artifacts JSON passed to the promotion action; ref_template may contain one {version} placeholder",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publish-artifact-kind": {
+      "description": "Artifact kind used when generating publish-required-artifacts-json from downloaded payloads",
+      "default": "npm",
+      "type": "string",
+      "required": false
+    },
+    "publish-mode": {
+      "description": "Publish mode passed to promote-buildchain-ref",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publish-dist-tag": {
+      "description": "Expected dist-tag passed to promote-buildchain-ref",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publish-package-set-order": {
+      "description": "Package-set ordering passed to promote-buildchain-ref",
+      "default": "as-provided",
+      "type": "string",
+      "required": false
+    },
+    "publish-package-main": {
+      "description": "Main package name for package-set ordering",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport": {
+      "description": "Generate and persist the release passport after publish finalization",
+      "default": true,
+      "type": "boolean",
+      "required": false
+    },
+    "release-propagation-config-path": {
+      "description": "Optional source-controlled package propagation capture config read from the exact finalized release SHA",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-output-dir": {
+      "description": "Release passport output directory",
+      "default": ".buildchain/release-passport",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-product-name": {
+      "description": "Product name recorded in buildchain.release.json",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-impact-json": {
+      "description": "Surface-aware release impact JSON or path passed to the release passport collector",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-kfd-1-witness-jsons": {
+      "description": "Newline- or comma-separated KFD-1 contract-world witness JSON paths passed to the release passport collector",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-kfd-2-claim-jsons": {
+      "description": "Newline- or comma-separated KFD-2 public release trust claim JSON paths passed to the release passport collector",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-kfd-3-prebuild-witness-jsons": {
+      "description": "Newline- or comma-separated KFD-3 collaboration-interface pre-build witness JSON paths passed to the release passport collector",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-kfd-3-artifact-witness-jsons": {
+      "description": "Newline- or comma-separated KFD-3 artifact-side collaboration-interface witness JSON paths passed to the release passport collector",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-kfd-3-artifact-verify-command": {
+      "description": "Product-owned command that emits KFD-3 artifact-side collaboration-interface witness JSON",
+      "default": "",
+      "type": "string"
+    },
+    "release-passport-kfd-adopter-manifest-json": {
+      "description": "Standard full-cut adopter conformance manifest JSON path",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-kfd-support-matrix-json": {
+      "description": "Legacy KFD support projection JSON path accepted only for exact manifest comparison",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-kfd-product-gate-jsons": {
+      "description": "Newline- or comma-separated KFD-4/5/7 product gate result JSON paths",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-invariant-passport-jsons": {
+      "description": "Newline- or comma-separated invariant Passport JSON paths passed to the release gate",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-invariant-passport-command": {
+      "description": "Product-owned command that emits a canonical invariant Passport JSON document",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-evidence-jsons": {
+      "description": "Newline- or comma-separated product-owned release evidence attachment paths bound to the exact release coordinates",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-attachment-command": {
+      "description": "Product-owned command that emits generated release evidence attachment paths as JSON",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "release-passport-buildchain-self-kfd": {
+      "description": "Generate Buildchain-owned KFD-1/2/3 self witnesses and claims from the checked-out package source before release passport finalization",
+      "default": false,
+      "type": "boolean",
+      "required": false
+    },
+    "github-artifact-attestation-policy-json": {
+      "description": "One GitHub artifact attestation policy JSON path from the sealed release candidate; empty disables attestation",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "github-artifact-attestation-environment": {
+      "description": "Caller-repository protected environment governing the keyless attestation",
+      "default": "buildchain-artifact-attestation",
+      "type": "string",
+      "required": false
+    },
+    "github-artifact-attestation-retention-days": {
+      "description": "Retention for offline GitHub/Sigstore evidence artifacts",
+      "default": 90,
+      "type": "number",
+      "required": false
+    },
+    "release-passport-platform-manifest-paths": {
+      "description": "Optional platform manifest paths for release passport; defaults to downloaded PR-stage payload manifests",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "required-artifact-count": {
+      "description": "Minimum downloaded payload count required before publish; npm counts package tarballs",
+      "default": 3,
+      "type": "number",
+      "required": false
+    },
+    "publication-admission-json": {
+      "description": "Fresh sealed publication admission JSON; required for non-dry-run publication",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-runner-provenance-json": {
+      "description": "Runner provenance receipt bound by the admission",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-control-plane-audit-json": {
+      "description": "Fresh external control-plane audit receipt bound by the admission",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "github-governance-receipt-json": {
+      "description": "Fresh qualifying governance receipt for the exact publication repository and target ref",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-gate-aggregate-json": {
+      "description": "Qualifying Shifu Gate aggregate or explicit consumer-owned no-Gate decision",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-gate-command": {
+      "description": "Consumer-owned read-only command that assembles a qualifying Gate aggregate from the exact downloaded release-candidate evidence",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-gate-controller-sha": {
+      "description": "Exact caller-repository commit that owns the consumer Gate command; empty uses the publication source SHA",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-expected-json": {
+      "description": "Independent exact source/runtime/product/channel/artifact bindings",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-used-nonces-json": {
+      "description": "JSON array of already consumed admission nonces",
+      "default": "[]",
+      "type": "string",
+      "required": false
+    },
+    "publication-consumer-qualification-command": {
+      "description": "Opt-in consumer-owned predicate command; writes its decision to BUILDCHAIN_PUBLICATION_QUALIFICATION_RESULT_PATH",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-consumer-qualification-controller-sha": {
+      "description": "Exact caller-repository commit that owns the consumer qualification command; empty uses the Gate controller SHA, then the publication source SHA",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-consumer-predicate-id": {
+      "description": "Stable identifier for the opt-in consumer-owned publication predicate",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-used-qualification-nonces-json": {
+      "description": "JSON array of already consumed qualification nonces",
+      "default": "[]",
+      "type": "string",
+      "required": false
+    },
+    "publication-auto-admission": {
+      "description": "Assemble sealed evidence from the caller repository's exact managed release candidate",
+      "default": false,
+      "type": "boolean",
+      "required": false
+    },
+    "publication-auto-no-gate": {
+      "description": "Explicitly declare that this managed publication has no consumer-owned Shifu Gate registry",
+      "default": false,
+      "type": "boolean",
+      "required": false
+    },
+    "publication-publisher-workflow-path": {
+      "description": "Caller workflow path bound by the provider trusted-publisher policy",
+      "default": "",
+      "type": "string",
+      "required": false
+    },
+    "publication-product": {
+      "default": "Buildchain",
+      "type": "string",
+      "required": false
+    },
+    "publication-target": {
+      "default": "npm:@kungfu-tech/buildchain",
+      "type": "string",
+      "required": false
+    },
+    "publication-package-name": {
+      "default": "@kungfu-tech/buildchain",
+      "type": "string",
+      "required": false
+    },
+    "dry-run": {
+      "description": "Plan only; do not publish or move refs",
+      "default": false,
+      "type": "boolean",
+      "required": false
+    }
+  },
+  "secrets": {
+    "BUILDCHAIN_PROMOTION_TOKEN": {
+      "description": "Optional bypass-capable token used only for generated protected ref updates",
+      "required": false
+    },
+    "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN": {
+      "description": "Optional consumer-owned credential exposed only to the final publication commit command",
+      "required": false
+    },
+    "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY": {
+      "description": "Optional consumer-owned private signing material exposed only to the final publication commit command",
+      "required": false
+    },
+    "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY": {
+      "description": "Private key for the dedicated read-only GitHub governance auditor App",
+      "required": false
+    },
+    "buildchain-issue-token": {
+      "description": "Optional token with issues:write on the Buildchain repository for workflow-friction reports",
+      "required": false
+    },
+    "BUILDCHAIN_ISSUE_TOKEN": {
+      "description": "Optional token with issues:write on the Buildchain repository for workflow-friction reports",
+      "required": false
+    },
+    "buildchain-issue-app-id": {
+      "description": "Optional GitHub App ID used to mint a Buildchain issue-report token",
+      "required": false
+    },
+    "BUILDCHAIN_ISSUE_APP_ID": {
+      "description": "Optional GitHub App ID used to mint a Buildchain issue-report token",
+      "required": false
+    },
+    "buildchain-issue-app-private-key": {
+      "description": "Optional GitHub App private key used to mint a Buildchain issue-report token",
+      "required": false
+    },
+    "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY": {
+      "description": "Optional GitHub App private key used to mint a Buildchain issue-report token",
+      "required": false
+    }
+  },
+  "outputs": {
+    "buildchain-channel": {
+      "description": "Selected promotion workflow-shell channel",
+      "value": "${{ jobs.resolve-promotion.outputs.channel }}"
+    },
+    "promotion-router-ref": {
+      "description": "Router workflow ref",
+      "value": "${{ jobs.resolve-promotion.outputs.router-ref }}"
+    },
+    "promotion-router-sha": {
+      "description": "Resolved router workflow SHA",
+      "value": "${{ jobs.resolve-promotion.outputs.router-sha }}"
+    },
+    "promotion-shell-ref": {
+      "description": "Selected advanced promotion workflow-shell ref",
+      "value": "${{ jobs.resolve-promotion.outputs.shell-ref }}"
+    },
+    "promotion-shell-sha": {
+      "description": "Resolved advanced promotion workflow-shell SHA",
+      "value": "${{ jobs.resolve-promotion.outputs.shell-sha }}"
+    },
+    "promotion-runtime-ref": {
+      "description": "Selected Buildchain runtime ref",
+      "value": "${{ jobs.resolve-promotion.outputs.runtime-ref }}"
+    },
+    "promotion-runtime-sha": {
+      "description": "Resolved Buildchain runtime SHA",
+      "value": "${{ jobs.resolve-promotion.outputs.runtime-sha }}"
+    },
+    "promotion-contract-lock-path": {
+      "description": "Selected consumer contract-lock path",
+      "value": "${{ jobs.resolve-promotion.outputs.contract-lock-path }}"
+    },
+    "promotion-contract-lock-digest": {
+      "description": "Selected consumer contract-lock sha256 digest",
+      "value": "${{ jobs.resolve-promotion.outputs.contract-lock-digest }}"
+    },
+    "promotion-publication-channel": {
+      "description": "Derived publication channel",
+      "value": "${{ jobs.resolve-promotion.outputs.publication-channel }}"
+    },
+    "promotion-target-ref": {
+      "description": "Derived promotion target ref",
+      "value": "${{ jobs.resolve-promotion.outputs.target-ref }}"
+    },
+    "promotion-override-used": {
+      "description": "Whether a trusted runtime override was used",
+      "value": "${{ jobs.resolve-promotion.outputs.override-used }}"
+    },
+    "promoted-sha": {
+      "description": "Promoted channel SHA",
+      "value": "${{ jobs.alpha.outputs.promoted-sha || jobs.stable.outputs.promoted-sha }}"
+    },
+    "built-source-sha": {
+      "description": "PR-stage built source SHA",
+      "value": "${{ jobs.alpha.outputs.built-source-sha || jobs.stable.outputs.built-source-sha }}"
+    },
+    "release-candidate-artifact": {
+      "description": "Resolved release-candidate artifact name",
+      "value": "${{ jobs.alpha.outputs.release-candidate-artifact || jobs.stable.outputs.release-candidate-artifact }}"
+    },
+    "release-candidate-action": {
+      "description": "Candidate admission action: discovered or reused",
+      "value": "${{ jobs.alpha.outputs.release-candidate-action || jobs.stable.outputs.release-candidate-action }}"
+    },
+    "release-candidate-recovery-root": {
+      "description": "Exact sha256 recovery receipt root",
+      "value": "${{ jobs.alpha.outputs.release-candidate-recovery-root || jobs.stable.outputs.release-candidate-recovery-root }}"
+    },
+    "release-candidate-recovery-receipt-artifact": {
+      "description": "Immutable recovery receipt Actions artifact name",
+      "value": "${{ jobs.alpha.outputs.release-candidate-recovery-receipt-artifact || jobs.stable.outputs.release-candidate-recovery-receipt-artifact }}"
+    },
+    "release-propagation-work-artifact": {
+      "description": "Captured package release propagation Work artifact",
+      "value": "${{ jobs.alpha.outputs.release-propagation-work-artifact || jobs.stable.outputs.release-propagation-work-artifact }}"
+    },
+    "publication-commit-evidence-path": {
+      "description": "Validated consumer publication commit evidence path",
+      "value": "${{ jobs.alpha.outputs.publication-commit-evidence-path || jobs.stable.outputs.publication-commit-evidence-path }}"
+    },
+    "publication-commit-evidence-digest": {
+      "description": "sha256 digest of validated consumer publication commit evidence",
+      "value": "${{ jobs.alpha.outputs.publication-commit-evidence-digest || jobs.stable.outputs.publication-commit-evidence-digest }}"
+    },
+    "publication-commit-url": {
+      "description": "Canonical public authority URL validated after the final commit",
+      "value": "${{ jobs.alpha.outputs.publication-commit-url || jobs.stable.outputs.publication-commit-url }}"
+    },
+    "publication-commit-payload-root": {
+      "description": "Exact public authority payload root validated after the final commit",
+      "value": "${{ jobs.alpha.outputs.publication-commit-payload-root || jobs.stable.outputs.publication-commit-payload-root }}"
+    },
+    "controller-plan-artifact": {
+      "description": "Controller plan artifact name",
+      "value": "${{ jobs.alpha.outputs.controller-plan-artifact || jobs.stable.outputs.controller-plan-artifact }}"
+    },
+    "controller-plan-json": {
+      "description": "Compact controller plan JSON",
+      "value": "${{ jobs.alpha.outputs.controller-plan-json || jobs.stable.outputs.controller-plan-json }}"
+    },
+    "controller-plan-digest": {
+      "description": "Controller plan digest",
+      "value": "${{ jobs.alpha.outputs.controller-plan-digest || jobs.stable.outputs.controller-plan-digest }}"
+    },
+    "publication-capability-digest": {
+      "description": "Sealed publication capability receipt digest",
+      "value": "${{ jobs.alpha.outputs.publication-capability-digest || jobs.stable.outputs.publication-capability-digest }}"
+    },
+    "github-artifact-attestation-id": {
+      "description": "GitHub keyless attestation id for the declared Linux release artifact",
+      "value": "${{ jobs.alpha.outputs.github-artifact-attestation-id || jobs.stable.outputs.github-artifact-attestation-id }}"
+    },
+    "github-artifact-attestation-url": {
+      "description": "GitHub keyless attestation URL",
+      "value": "${{ jobs.alpha.outputs.github-artifact-attestation-url || jobs.stable.outputs.github-artifact-attestation-url }}"
+    },
+    "github-artifact-attestation-evidence-root": {
+      "description": "Verified Buildchain attestation evidence root published with the GitHub Release",
+      "value": "${{ jobs.alpha.outputs.github-artifact-attestation-evidence-root || jobs.stable.outputs.github-artifact-attestation-evidence-root }}"
+    },
+    "github-artifact-attestation-publication-receipt-digest": {
+      "description": "Read-back verified GitHub Release evidence publication receipt digest",
+      "value": "${{ jobs.alpha.outputs.github-artifact-attestation-publication-receipt-digest || jobs.stable.outputs.github-artifact-attestation-publication-receipt-digest }}"
+    },
+    "release-tail-declaration-root": {
+      "description": "Root of the declarative release-tail contract",
+      "value": "${{ jobs.alpha.outputs.release-tail-declaration-root || jobs.stable.outputs.release-tail-declaration-root }}"
+    },
+    "release-tail-transaction-state": {
+      "description": "Final declarative release-tail transaction state",
+      "value": "${{ jobs.alpha.outputs.release-tail-transaction-state || jobs.stable.outputs.release-tail-transaction-state }}"
+    },
+    "release-tail-transaction-root": {
+      "description": "Stable declarative release-tail transaction root",
+      "value": "${{ jobs.alpha.outputs.release-tail-transaction-root || jobs.stable.outputs.release-tail-transaction-root }}"
+    },
+    "release-tail-state-root": {
+      "description": "Root of the final declarative release-tail transaction state",
+      "value": "${{ jobs.alpha.outputs.release-tail-state-root || jobs.stable.outputs.release-tail-state-root }}"
+    },
+    "release-tail-receipt-roots-json": {
+      "description": "JSON array of standardized declarative release-tail receipt roots",
+      "value": "${{ jobs.alpha.outputs.release-tail-receipt-roots-json || jobs.stable.outputs.release-tail-receipt-roots-json }}"
+    },
+    "controller-receipt-artifact": {
+      "description": "Controller receipt artifact name",
+      "value": "${{ jobs.alpha.outputs.controller-receipt-artifact || jobs.stable.outputs.controller-receipt-artifact }}"
+    },
+    "controller-receipt-json": {
+      "description": "Compact controller receipt JSON",
+      "value": "${{ jobs.alpha.outputs.controller-receipt-json || jobs.stable.outputs.controller-receipt-json }}"
+    },
+    "controller-receipt-digest": {
+      "description": "Controller receipt digest",
+      "value": "${{ jobs.alpha.outputs.controller-receipt-digest || jobs.stable.outputs.controller-receipt-digest }}"
+    },
+    "controller-receipt-status": {
+      "description": "Controller receipt status",
+      "value": "${{ jobs.alpha.outputs.controller-receipt-status || jobs.stable.outputs.controller-receipt-status }}"
+    }
+  }
+}