@kungfu-tech/kfd 1.0.0-alpha.16 → 1.0.0-alpha.18

package/.buildchain/kfd-1/contract-world.witness.json

@@ -24,9 +24,9 @@
     {
       "name": "readme",
       "sourcePath": "README.md",
-      "sourceSha256": "45a3be33e84a89377d15a4a773431d986e515b1d746889e95686e7114cf0a33f",
+      "sourceSha256": "67f965f48399b79d4caa0bcad45ba7db152ca8fa1e45b149e03af1656ab04ca0",
       "artifactPath": "README.md",
-      "expectedSha256": "45a3be33e84a89377d15a4a773431d986e515b1d746889e95686e7114cf0a33f",
+      "expectedSha256": "67f965f48399b79d4caa0bcad45ba7db152ca8fa1e45b149e03af1656ab04ca0",
       "byteForByte": true
     },
     {
@@ -136,9 +136,9 @@
     {
       "name": "kfd-site-bundle",
       "sourcePath": "site/kfd-site.json",
-      "sourceSha256": "484b974e7a4f8df9ef30f3a45c72c3d7e25bfaa8e595d994ad36551fb8cbef98",
+      "sourceSha256": "cff9e091a9501e8a5e1f43eac8e48b8a41dbe70ffa5a3347b2353e0d8fa80858",
       "artifactPath": "site/kfd-site.json",
-      "expectedSha256": "484b974e7a4f8df9ef30f3a45c72c3d7e25bfaa8e595d994ad36551fb8cbef98",
+      "expectedSha256": "cff9e091a9501e8a5e1f43eac8e48b8a41dbe70ffa5a3347b2353e0d8fa80858",
       "byteForByte": true
     },
     {
@@ -168,17 +168,17 @@
     {
       "name": "release-impact-ledger",
       "sourcePath": "release-impact.json",
-      "sourceSha256": "aa6e0b192053bb4e7c3e956fffeb8671792ef975b6ea9618324eebf2a3217581",
+      "sourceSha256": "41cf5821661af64f38dd782d5f9f5f9a857a01134afa1c06b3da5ceffcc817ed",
       "artifactPath": "release-impact.json",
-      "expectedSha256": "aa6e0b192053bb4e7c3e956fffeb8671792ef975b6ea9618324eebf2a3217581",
+      "expectedSha256": "41cf5821661af64f38dd782d5f9f5f9a857a01134afa1c06b3da5ceffcc817ed",
       "byteForByte": true
     },
     {
       "name": "kfd-check-gate",
       "sourcePath": "scripts/check.mjs",
-      "sourceSha256": "61dd3118c21ea55f2efe98e89132c5b6651614c12eac3f9b10ae150eac7b7074",
+      "sourceSha256": "ffccf0a401a75f49e85e7bfdb22e4d7d32a5c81e07e386a9c2e627872b05cf8a",
       "artifactPath": "scripts/check.mjs",
-      "expectedSha256": "61dd3118c21ea55f2efe98e89132c5b6651614c12eac3f9b10ae150eac7b7074",
+      "expectedSha256": "ffccf0a401a75f49e85e7bfdb22e4d7d32a5c81e07e386a9c2e627872b05cf8a",
       "byteForByte": true
     },
     {
@@ -192,17 +192,17 @@
     {
       "name": "buildchain-build-workflow",
       "sourcePath": ".github/workflows/build.yml",
-      "sourceSha256": "02606915b1d3b3006e6c2e0b7977d7329c9f2ace12319c097d413aa93a7c39c6",
+      "sourceSha256": "264cd15db6f872c72fc58bcd476d1a3a476ec54b520b05268e213f5b59692f5b",
       "artifactPath": ".github/workflows/build.yml",
-      "expectedSha256": "02606915b1d3b3006e6c2e0b7977d7329c9f2ace12319c097d413aa93a7c39c6",
+      "expectedSha256": "264cd15db6f872c72fc58bcd476d1a3a476ec54b520b05268e213f5b59692f5b",
       "byteForByte": true
     },
     {
       "name": "buildchain-ref-promotion-workflow",
       "sourcePath": ".github/workflows/buildchain-ref-promotion.yml",
-      "sourceSha256": "0e0afb510b9a59ed771b17a3671301f02fa8abe85c1562a1013988a0e835b251",
+      "sourceSha256": "754a44cedfc174f35dcf54414c04b636bbc0a85e2272f5de8e899a70ee05d7bd",
       "artifactPath": ".github/workflows/buildchain-ref-promotion.yml",
-      "expectedSha256": "0e0afb510b9a59ed771b17a3671301f02fa8abe85c1562a1013988a0e835b251",
+      "expectedSha256": "754a44cedfc174f35dcf54414c04b636bbc0a85e2272f5de8e899a70ee05d7bd",
       "byteForByte": true
     },
     {
@@ -224,25 +224,25 @@
     {
       "name": "kfd-package-manifest",
       "sourcePath": "package.json",
-      "sourceSha256": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d",
+      "sourceSha256": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963",
       "artifactPath": "package.json",
-      "expectedSha256": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d",
+      "expectedSha256": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963",
       "byteForByte": true
     },
     {
       "name": "kfd-release-anchor",
       "sourcePath": "kfd.release.json",
-      "sourceSha256": "e15e185b726a552b3f01d2f77ee96120ba4b0e4f204b23153e27c1599cbde2e7",
+      "sourceSha256": "d12c4c4c3bb9cf750b14ef5f72aae7aa7f44ca5197e55739251b587fc3a8df8e",
       "artifactPath": "kfd.release.json",
-      "expectedSha256": "e15e185b726a552b3f01d2f77ee96120ba4b0e4f204b23153e27c1599cbde2e7",
+      "expectedSha256": "d12c4c4c3bb9cf750b14ef5f72aae7aa7f44ca5197e55739251b587fc3a8df8e",
       "byteForByte": true
     },
     {
       "name": "kfd-2-public-release-trust-claim",
       "sourcePath": ".buildchain/kfd-2/public-release-trust.claim.json",
-      "sourceSha256": "3dfee83f62f0cfec348453a729aee8515cb84366cb66878e595bb9d7be3f58d3",
+      "sourceSha256": "46de9b13ea95c08de46c8653eb28edeb686f08e2e9374f2256d8e21221522861",
       "artifactPath": ".buildchain/kfd-2/public-release-trust.claim.json",
-      "expectedSha256": "3dfee83f62f0cfec348453a729aee8515cb84366cb66878e595bb9d7be3f58d3",
+      "expectedSha256": "46de9b13ea95c08de46c8653eb28edeb686f08e2e9374f2256d8e21221522861",
       "byteForByte": true
     }
   ]

package/.buildchain/kfd-2/public-release-trust.claim.json

@@ -5,12 +5,12 @@
   "sourceBindings": [
     {
       "path": "package.json",
-      "sha256": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d",
+      "sha256": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963",
       "id": "package-version-and-exports"
     },
     {
       "path": "kfd.release.json",
-      "sha256": "e15e185b726a552b3f01d2f77ee96120ba4b0e4f204b23153e27c1599cbde2e7",
+      "sha256": "d12c4c4c3bb9cf750b14ef5f72aae7aa7f44ca5197e55739251b587fc3a8df8e",
       "id": "anchored-release-version"
     },
     {
@@ -25,29 +25,34 @@
     },
     {
       "path": "release-impact.json",
-      "sha256": "aa6e0b192053bb4e7c3e956fffeb8671792ef975b6ea9618324eebf2a3217581",
+      "sha256": "41cf5821661af64f38dd782d5f9f5f9a857a01134afa1c06b3da5ceffcc817ed",
       "id": "release-impact-ledger"
     },
     {
       "path": "buildchain.toml",
       "sha256": "0dc1179d59b634df364871ea18a66251781321c80a6f7bcb9e3fcf5a48ef738a",
       "id": "buildchain-release-contract"
+    },
+    {
+      "path": "buildchain.contract-lock.json",
+      "sha256": "9ee8b4d7e8544ffceaf067d29582f8d6b67c4a133b5a0e0d7798b3e467dcd628",
+      "id": "buildchain-runtime-contract-lock"
     }
   ],
   "machineEvidence": [
     {
       "path": "scripts/check.mjs",
-      "sha256": "61dd3118c21ea55f2efe98e89132c5b6651614c12eac3f9b10ae150eac7b7074",
+      "sha256": "ffccf0a401a75f49e85e7bfdb22e4d7d32a5c81e07e386a9c2e627872b05cf8a",
       "id": "self-verification-command"
     },
     {
       "path": ".github/workflows/build.yml",
-      "sha256": "02606915b1d3b3006e6c2e0b7977d7329c9f2ace12319c097d413aa93a7c39c6",
+      "sha256": "264cd15db6f872c72fc58bcd476d1a3a476ec54b520b05268e213f5b59692f5b",
       "id": "buildchain-build-workflow"
     },
     {
       "path": ".github/workflows/buildchain-ref-promotion.yml",
-      "sha256": "0e0afb510b9a59ed771b17a3671301f02fa8abe85c1562a1013988a0e835b251",
+      "sha256": "754a44cedfc174f35dcf54414c04b636bbc0a85e2272f5de8e899a70ee05d7bd",
       "id": "buildchain-promotion-workflow"
     },
     {
@@ -67,15 +72,16 @@
     }
   ],
   "hashes": {
-    "package-version-and-exports": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d",
-    "anchored-release-version": "e15e185b726a552b3f01d2f77ee96120ba4b0e4f204b23153e27c1599cbde2e7",
+    "package-version-and-exports": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963",
+    "anchored-release-version": "d12c4c4c3bb9cf750b14ef5f72aae7aa7f44ca5197e55739251b587fc3a8df8e",
     "decision-registry": "15f58f95ab1d42972206399b2e2b2e9268ab20fcdb599098e2822097ee84a8db",
     "standards-metadata": "7cd61143eabec5b83c5ba37312d791935f2321d246f61bec790c4a6d5d4cf839",
-    "release-impact-ledger": "aa6e0b192053bb4e7c3e956fffeb8671792ef975b6ea9618324eebf2a3217581",
+    "release-impact-ledger": "41cf5821661af64f38dd782d5f9f5f9a857a01134afa1c06b3da5ceffcc817ed",
     "buildchain-release-contract": "0dc1179d59b634df364871ea18a66251781321c80a6f7bcb9e3fcf5a48ef738a",
-    "self-verification-command": "61dd3118c21ea55f2efe98e89132c5b6651614c12eac3f9b10ae150eac7b7074",
-    "buildchain-build-workflow": "02606915b1d3b3006e6c2e0b7977d7329c9f2ace12319c097d413aa93a7c39c6",
-    "buildchain-promotion-workflow": "0e0afb510b9a59ed771b17a3671301f02fa8abe85c1562a1013988a0e835b251",
+    "buildchain-runtime-contract-lock": "9ee8b4d7e8544ffceaf067d29582f8d6b67c4a133b5a0e0d7798b3e467dcd628",
+    "self-verification-command": "ffccf0a401a75f49e85e7bfdb22e4d7d32a5c81e07e386a9c2e627872b05cf8a",
+    "buildchain-build-workflow": "264cd15db6f872c72fc58bcd476d1a3a476ec54b520b05268e213f5b59692f5b",
+    "buildchain-promotion-workflow": "754a44cedfc174f35dcf54414c04b636bbc0a85e2272f5de8e899a70ee05d7bd",
     "kfd-2-trust-taxonomy-schema": "a663d301a663cadb8567e3010361f5a630b76b6518ed7603dfd58cbd4e64a658",
     "kfd-2-release-claims-schema": "0f52c4a9949f62163a0fbe14fefc2f2f93f548ae18b6b5c07eb87aedca4c0be0",
     "kfd-2-release-trust-passport-schema": "df7f828605f680f3ff52fe3468cbf8f5e20151fac0d5c31cd9a0de9765efecc1"
@@ -83,15 +89,15 @@
   "artifacts": [
     {
       "name": "@kungfu-tech/kfd",
-      "version": "1.0.0-alpha.16",
+      "version": "1.0.0-alpha.18",
       "path": "package.json",
-      "sha256": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d"
+      "sha256": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963"
     },
     {
       "name": "kfd-release-anchor",
-      "version": "1.0.0-alpha.16",
+      "version": "1.0.0-alpha.18",
       "path": "kfd.release.json",
-      "sha256": "e15e185b726a552b3f01d2f77ee96120ba4b0e4f204b23153e27c1599cbde2e7"
+      "sha256": "d12c4c4c3bb9cf750b14ef5f72aae7aa7f44ca5197e55739251b587fc3a8df8e"
     }
   ],
   "verification": {

package/.buildchain/kfd-3/collaboration-interface.artifact.json

@@ -243,7 +243,7 @@
     {
       "id": "doc:readme",
       "sourcePath": "README.md",
-      "sha256": "45a3be33e84a89377d15a4a773431d986e515b1d746889e95686e7114cf0a33f"
+      "sha256": "67f965f48399b79d4caa0bcad45ba7db152ca8fa1e45b149e03af1656ab04ca0"
     },
     {
       "id": "doc:trademarks",
@@ -337,36 +337,41 @@
     {
       "id": "metadata:release-impact",
       "sourcePath": "release-impact.json",
-      "sha256": "aa6e0b192053bb4e7c3e956fffeb8671792ef975b6ea9618324eebf2a3217581"
+      "sha256": "41cf5821661af64f38dd782d5f9f5f9a857a01134afa1c06b3da5ceffcc817ed"
     },
     {
       "id": "metadata:release-anchor",
       "sourcePath": "kfd.release.json",
-      "sha256": "e15e185b726a552b3f01d2f77ee96120ba4b0e4f204b23153e27c1599cbde2e7"
+      "sha256": "d12c4c4c3bb9cf750b14ef5f72aae7aa7f44ca5197e55739251b587fc3a8df8e"
+    },
+    {
+      "id": "metadata:buildchain-contract-lock",
+      "sourcePath": "buildchain.contract-lock.json",
+      "sha256": "9ee8b4d7e8544ffceaf067d29582f8d6b67c4a133b5a0e0d7798b3e467dcd628"
     },
     {
       "id": "metadata:kfd-2-public-release-trust-claim",
       "sourcePath": ".buildchain/kfd-2/public-release-trust.claim.json",
-      "sha256": "3dfee83f62f0cfec348453a729aee8515cb84366cb66878e595bb9d7be3f58d3"
+      "sha256": "46de9b13ea95c08de46c8653eb28edeb686f08e2e9374f2256d8e21221522861"
     }
   ],
   "packageExports": [
     {
       "id": "export:package-json",
       "sourcePath": "package.json#exports",
-      "sha256": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d"
+      "sha256": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963"
     },
     {
       "id": "export:npm-files",
       "sourcePath": "package.json#files",
-      "sha256": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d"
+      "sha256": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963"
     }
   ],
   "siteConsumptionContracts": [
     {
       "id": "site:kfd-site-bundle",
       "sourcePath": "site/kfd-site.json",
-      "sha256": "484b974e7a4f8df9ef30f3a45c72c3d7e25bfaa8e595d994ad36551fb8cbef98"
+      "sha256": "cff9e091a9501e8a5e1f43eac8e48b8a41dbe70ffa5a3347b2353e0d8fa80858"
     },
     {
       "id": "site:release-propagation",
@@ -378,7 +383,7 @@
     "minimalEntrypoints": [
       {
         "path": "README.md",
-        "sha256": "45a3be33e84a89377d15a4a773431d986e515b1d746889e95686e7114cf0a33f",
+        "sha256": "67f965f48399b79d4caa0bcad45ba7db152ca8fa1e45b149e03af1656ab04ca0",
         "description": "Start from the KFD worldview and current decision set."
       },
       {
@@ -403,29 +408,29 @@
       },
       {
         "path": "package.json#exports",
-        "sha256": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d",
+        "sha256": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963",
         "description": "Consume the shipped npm package surfaces."
       },
       {
         "path": "kfd.release.json",
-        "sha256": "e15e185b726a552b3f01d2f77ee96120ba4b0e4f204b23153e27c1599cbde2e7",
+        "sha256": "d12c4c4c3bb9cf750b14ef5f72aae7aa7f44ca5197e55739251b587fc3a8df8e",
         "description": "Inspect the explicit KFD package version anchor for the current Buildchain release line."
       },
       {
         "path": ".buildchain/kfd-2/public-release-trust.claim.json",
-        "sha256": "3dfee83f62f0cfec348453a729aee8515cb84366cb66878e595bb9d7be3f58d3",
+        "sha256": "46de9b13ea95c08de46c8653eb28edeb686f08e2e9374f2256d8e21221522861",
         "description": "Inspect the explicit public KFD-2 claim passed into Buildchain release passport generation."
       },
       {
         "path": "site/kfd-site.json",
-        "sha256": "484b974e7a4f8df9ef30f3a45c72c3d7e25bfaa8e595d994ad36551fb8cbef98",
+        "sha256": "cff9e091a9501e8a5e1f43eac8e48b8a41dbe70ffa5a3347b2353e0d8fa80858",
         "description": "Render KFD-owned site text and decision pages without duplicating extraction logic."
       }
     ],
     "discoverability": [
       {
         "path": "README.md",
-        "sha256": "45a3be33e84a89377d15a4a773431d986e515b1d746889e95686e7114cf0a33f",
+        "sha256": "67f965f48399b79d4caa0bcad45ba7db152ca8fa1e45b149e03af1656ab04ca0",
         "description": "Human and agent entrypoint"
       },
       {
@@ -450,17 +455,17 @@
       },
       {
         "path": ".buildchain/kfd-2/public-release-trust.claim.json",
-        "sha256": "3dfee83f62f0cfec348453a729aee8515cb84366cb66878e595bb9d7be3f58d3",
+        "sha256": "46de9b13ea95c08de46c8653eb28edeb686f08e2e9374f2256d8e21221522861",
         "description": "KFD-2 public release trust claim"
       },
       {
         "path": "package.json",
-        "sha256": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d",
+        "sha256": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963",
         "description": "Package export map"
       },
       {
         "path": "site/kfd-site.json",
-        "sha256": "484b974e7a4f8df9ef30f3a45c72c3d7e25bfaa8e595d994ad36551fb8cbef98",
+        "sha256": "cff9e091a9501e8a5e1f43eac8e48b8a41dbe70ffa5a3347b2353e0d8fa80858",
         "description": "Site content projection"
       }
     ],
@@ -477,19 +482,19 @@
       },
       {
         "path": "scripts/check.mjs",
-        "sha256": "61dd3118c21ea55f2efe98e89132c5b6651614c12eac3f9b10ae150eac7b7074",
+        "sha256": "ffccf0a401a75f49e85e7bfdb22e4d7d32a5c81e07e386a9c2e627872b05cf8a",
         "description": "Repository self-verification gate"
       },
       {
         "path": "site/kfd-site.json",
-        "sha256": "484b974e7a4f8df9ef30f3a45c72c3d7e25bfaa8e595d994ad36551fb8cbef98",
+        "sha256": "cff9e091a9501e8a5e1f43eac8e48b8a41dbe70ffa5a3347b2353e0d8fa80858",
         "description": "Site rendering boundary"
       }
     ],
     "choicePaths": [
       {
         "path": "README.md",
-        "sha256": "45a3be33e84a89377d15a4a773431d986e515b1d746889e95686e7114cf0a33f",
+        "sha256": "67f965f48399b79d4caa0bcad45ba7db152ca8fa1e45b149e03af1656ab04ca0",
         "description": "Human reading path"
       },
       {
@@ -504,12 +509,12 @@
       },
       {
         "path": ".buildchain/kfd-2/public-release-trust.claim.json",
-        "sha256": "3dfee83f62f0cfec348453a729aee8515cb84366cb66878e595bb9d7be3f58d3",
+        "sha256": "46de9b13ea95c08de46c8653eb28edeb686f08e2e9374f2256d8e21221522861",
         "description": "Agent release trust claim path"
       },
       {
         "path": "package.json",
-        "sha256": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d",
+        "sha256": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963",
         "description": "Package consumption path"
       }
     ],

package/.buildchain/kfd-3/collaboration-interface.prebuild.json

@@ -725,7 +725,7 @@
     {
       "id": "doc:readme",
       "sourcePath": "README.md",
-      "sha256": "45a3be33e84a89377d15a4a773431d986e515b1d746889e95686e7114cf0a33f"
+      "sha256": "67f965f48399b79d4caa0bcad45ba7db152ca8fa1e45b149e03af1656ab04ca0"
     },
     {
       "id": "doc:trademarks",
@@ -819,36 +819,41 @@
     {
       "id": "metadata:release-impact",
       "sourcePath": "release-impact.json",
-      "sha256": "aa6e0b192053bb4e7c3e956fffeb8671792ef975b6ea9618324eebf2a3217581"
+      "sha256": "41cf5821661af64f38dd782d5f9f5f9a857a01134afa1c06b3da5ceffcc817ed"
     },
     {
       "id": "metadata:release-anchor",
       "sourcePath": "kfd.release.json",
-      "sha256": "e15e185b726a552b3f01d2f77ee96120ba4b0e4f204b23153e27c1599cbde2e7"
+      "sha256": "d12c4c4c3bb9cf750b14ef5f72aae7aa7f44ca5197e55739251b587fc3a8df8e"
+    },
+    {
+      "id": "metadata:buildchain-contract-lock",
+      "sourcePath": "buildchain.contract-lock.json",
+      "sha256": "9ee8b4d7e8544ffceaf067d29582f8d6b67c4a133b5a0e0d7798b3e467dcd628"
     },
     {
       "id": "metadata:kfd-2-public-release-trust-claim",
       "sourcePath": ".buildchain/kfd-2/public-release-trust.claim.json",
-      "sha256": "3dfee83f62f0cfec348453a729aee8515cb84366cb66878e595bb9d7be3f58d3"
+      "sha256": "46de9b13ea95c08de46c8653eb28edeb686f08e2e9374f2256d8e21221522861"
     }
   ],
   "packageExports": [
     {
       "id": "export:package-json",
       "sourcePath": "package.json#exports",
-      "sha256": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d"
+      "sha256": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963"
     },
     {
       "id": "export:npm-files",
       "sourcePath": "package.json#files",
-      "sha256": "154c72826b1c9c6e80f2a1228d94d2df34b3edf52a9122e89a8ea70acc0bb59d"
+      "sha256": "356c5da4cf6c3bcbd0369d19e12570c9208c351dbd4728ec6795bae98b38b963"
     }
   ],
   "siteConsumptionContracts": [
     {
       "id": "site:kfd-site-bundle",
       "sourcePath": "site/kfd-site.json",
-      "sha256": "484b974e7a4f8df9ef30f3a45c72c3d7e25bfaa8e595d994ad36551fb8cbef98"
+      "sha256": "cff9e091a9501e8a5e1f43eac8e48b8a41dbe70ffa5a3347b2353e0d8fa80858"
     },
     {
       "id": "site:release-propagation",

package/README.md

@@ -75,6 +75,16 @@ transparent and inspectable mechanisms it asks products to provide.
 This README states the architecture; KFD-1, KFD-2, and KFD-3 provide the
 detailed rules.
 
+## Adoption boundary
+
+KFD is an engineering discipline, not a belief test.
+KFD governs systems before it judges people.
+No one should be pressured to adopt KFD in the name of KFD.
+Disagreement is a valid cooperation state.
+
+A constraint can be strict and still KFD-compatible when it is fact-bound,
+explainable, auditable, and proportionate.
+
 ## Homepage content contract
 
 This README is also the homepage text source for `https://kfd.libkungfu.dev`.
@@ -104,10 +114,9 @@ separate homepage wording that can drift from this package.
 `scripts/update-site-bundle.mjs`. The generated bundle exposes both compatible
 top-level homepage fields and ordered `homepage.sections` entries. The
 `homepage.displayPlan` tells renderers which sections belong in the first
-screen, primary narrative, support area, and renderer-contract area. Site
-repositories should consume that bundle instead of parsing this README
-themselves. The renderer contract is exposed as machine/implementation
-metadata, not as ordinary homepage content.
+screen, primary narrative, and support area. Site repositories should consume
+that bundle instead of parsing this README themselves. The renderer contract is
+exposed as machine/implementation metadata, not as ordinary homepage content.
 
 ## Product proof path
 

package/buildchain.contract-lock.json

@@ -0,0 +1,71 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-contract-lock",
+  "buildchain": {
+    "ref": "v2",
+    "resolvedSha": "93a42bdfbf60f32fc24e5cc6640f5352eec97224",
+    "contract": "kungfu-buildchain-runtime-contract-world",
+    "contractDigest": "sha256:7b2fed2dacdf37234ca03e656904611b9c3dd48a4f229be387c7c1393f57fc5b",
+    "compatibilityDigest": "sha256:36421b592a782decbfe31a7d8d42d70ce1100a56a2c4f4a0ccc21f0617dc72bf",
+    "majorLine": "v2",
+    "compatibilityPolicy": "major-compatible",
+    "acceptedAt": "2026-07-07T09:29:33.317Z",
+    "surfaces": [
+      {
+        "id": "reusable-build",
+        "kind": "workflow",
+        "breakingDigest": "sha256:6303aa2c2cb8c2cef4301ceea95cc3c426c2aa81d98714aa9bdf2471d63faee1"
+      },
+      {
+        "id": "release-candidate-promote",
+        "kind": "workflow",
+        "breakingDigest": "sha256:403d2fcdb0c5eabe749e89102defad69745f70a1556707bec7831fcc2e9fa8f8"
+      },
+      {
+        "id": "promote-buildchain-ref-action",
+        "kind": "action",
+        "breakingDigest": "sha256:347b65aecd38bc671d8f697eabd15254f905b6f745389d7b26d7595a904a720c"
+      },
+      {
+        "id": "report-buildchain-issue-action",
+        "kind": "action",
+        "breakingDigest": "sha256:575a2cb02cdb2e61bb2e84d5bbaaf64b430aa5d7936645660b592de4549d81b0"
+      },
+      {
+        "id": "release-passport-schema",
+        "kind": "schema",
+        "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad"
+      },
+      {
+        "id": "kfd-1-release-gate",
+        "kind": "schema",
+        "breakingDigest": "sha256:f46c1f67b94957ad956cf70db59a73fd5690bd67c91edf9c2d0eb8f3d1e3cf8d"
+      },
+      {
+        "id": "kfd-2-release-trust-passport-audit",
+        "kind": "schema",
+        "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16"
+      },
+      {
+        "id": "kfd-3-collaboration-interface-release-gate",
+        "kind": "schema",
+        "breakingDigest": "sha256:33654f3444c893754aacc42dde3051f0a371bd17c6ef7c657c579a07159cd7c1"
+      },
+      {
+        "id": "buildchain-cli",
+        "kind": "cli",
+        "breakingDigest": "sha256:097db3e67509bedda8c6548bf1edfbfcf57f7b5510520b6a7b7e078d7ec087c8"
+      },
+      {
+        "id": "agent-manual-registry",
+        "kind": "site-contract",
+        "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2"
+      },
+      {
+        "id": "node-api-registry",
+        "kind": "site-contract",
+        "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945"
+      }
+    ]
+  }
+}

package/kfd.release.json

@@ -4,7 +4,7 @@
   "line": "v1.0",
   "channel": "alpha",
   "npmPackage": "@kungfu-tech/kfd",
-  "npmVersion": "1.0.0-alpha.16",
+  "npmVersion": "1.0.0-alpha.18",
   "source": {
     "repository": "kungfu-systems/kfd",
     "branch": "alpha/v1/v1.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/kfd",
-  "version": "1.0.0-alpha.16",
+  "version": "1.0.0-alpha.18",
   "description": "Kung Fu Decisions (KFD): the kungfu-systems organization-wide decision registry, as a consumable artifact",
   "license": "Apache-2.0",
   "files": [
@@ -13,6 +13,7 @@
     "schemas",
     "site",
     "scripts",
+    "buildchain.contract-lock.json",
     "buildchain.release-propagation.json",
     "release-impact.json",
     ".buildchain/kfd-1/contract-world.witness.json",
@@ -28,6 +29,7 @@
     "./standards.json": "./standards.json",
     "./kfd.release.json": "./kfd.release.json",
     "./site/kfd-site.json": "./site/kfd-site.json",
+    "./buildchain.contract-lock.json": "./buildchain.contract-lock.json",
     "./buildchain.release-propagation.json": "./buildchain.release-propagation.json",
     "./release-impact.json": "./release-impact.json",
     "./scripts/*.mjs": "./scripts/*.mjs",

package/release-impact.json

@@ -16,7 +16,7 @@
       "id": "kfd-content",
       "impact": "patch",
       "class": "content",
-      "rationale": "KFD documents are append-only content coordinates; current documentation changes clarify KFD-3's foundation wording from transparent value to trusted value so the KFD-1/2/3 chain reads facts -> trust -> cooperation, while preserving the existing non-coercion and transparency requirements."
+      "rationale": "KFD documents are append-only content coordinates; current documentation changes add the public adoption boundary that keeps KFD an engineering discipline rather than a belief test, while preserving the existing decision numbers and registry shape."
     },
     {
       "id": "kfd-registry-schema",
@@ -34,13 +34,19 @@
       "id": "kfd-package-structure",
       "impact": "minor",
       "class": "additive",
-      "rationale": "The npm package now publishes the KFD-2 trust taxonomy, KFD-2 schemas, KFD-2 documentation, KFD-3 self collaboration-interface witnesses, TRADEMARKS.md, public fact-source metadata, agent quickstart/self-proof documentation, and repository verification scripts through existing schemas/, docs/, standards.json, site/, scripts/, .buildchain/, and subpath exports while preserving existing README.md, decisions/, registry.json, and site/ paths."
+      "rationale": "The npm package now publishes the KFD-2 trust taxonomy, KFD-2 schemas, KFD-2 documentation, KFD-3 self collaboration-interface witnesses, TRADEMARKS.md, public fact-source metadata, agent quickstart/self-proof documentation, Buildchain contract lock metadata, and repository verification scripts through existing schemas/, docs/, standards.json, site/, scripts/, .buildchain/, and subpath exports while preserving existing README.md, decisions/, registry.json, and site/ paths."
+    },
+    {
+      "id": "kfd-buildchain-contract-lock",
+      "impact": "minor",
+      "class": "release-governance",
+      "rationale": "KFD now uses Buildchain v2 floating workflow refs with a consumer-owned buildchain.contract-lock.json, so Buildchain runtime contract drift is checked before heavy build or promotion work while retaining floating-ref upgrade flow."
     },
     {
       "id": "kfd-site-homepage-bundle",
       "impact": "minor",
       "class": "additive",
-      "rationale": "site/kfd-site.json now exposes generated README-backed homepage.sections and homepage.displayPlan fields, and scripts/check.mjs verifies the checked-in bundle matches the README projection so downstream sites can render KFD-owned homepage content without maintaining their own README parser or drifting copy."
+      "rationale": "site/kfd-site.json now exposes generated README-backed homepage.sections and homepage.displayPlan fields, including the adoption-boundary homepage section, and scripts/check.mjs verifies the checked-in bundle matches the README projection so downstream sites can render KFD-owned homepage content without maintaining their own README parser or drifting copy."
     },
     {
       "id": "kfd-3-self-collaboration",
@@ -67,5 +73,5 @@
       "rationale": "The KFD to site-libkungfu-dev propagation graph now targets the downstream site's actual main branch and documents the exact KFD package surfaces consumed by kfd.libkungfu.dev, without changing the release propagation graph contract."
     }
   ],
-  "summary": "KFD v1.0 production promotion is minor-impact because it additively exposes KFD-2 trust taxonomy and release trust metadata, KFD-1/2/3 interface version metadata, KFD-3 self-verification witnesses, document integrity bindings, a README-backed homepage bundle/display plan, and a corrected site release-propagation target for Buildchain and other consumers; existing registry, decision text, site bundle, and propagation graph contracts remain compatible."
+  "summary": "KFD v1.0 production promotion is minor-impact because it additively exposes KFD-2 trust taxonomy and release trust metadata, KFD-1/2/3 interface version metadata, KFD-3 self-verification witnesses, Buildchain contract lock metadata, document integrity bindings, a README-backed homepage bundle/display plan, and a corrected site release-propagation target for Buildchain and other consumers; existing registry, decision text, site bundle, and propagation graph contracts remain compatible."
 }

package/scripts/check.mjs

@@ -76,11 +76,15 @@ if (!Array.isArray(siteBundle.homepage?.sections) || siteBundle.homepage.section
 if (!siteBundle.homepage?.displayPlan?.firstScreen?.include?.includes("foundation-triad")) {
   fail("site bundle homepage displayPlan firstScreen must include foundation-triad");
 }
-for (const requiredSection of ["foundation-triad", "foundation-model", "product-proof-path", "agent-quickstart", "decision-metadata"]) {
+for (const requiredSection of ["foundation-triad", "foundation-model", "adoption-boundary", "product-proof-path", "agent-quickstart", "decision-metadata"]) {
   if (!siteBundle.homepage.sections.some((entry) => entry.id === requiredSection && entry.sourcePath === "README.md" && entry.markdown)) {
     fail(`site bundle homepage.sections must include README projection ${requiredSection}`);
   }
 }
+const adoptionBoundary = siteBundle.homepage.sections.find((entry) => entry.id === "adoption-boundary");
+if (adoptionBoundary?.includeInFirstScreen !== false || adoptionBoundary?.renderRole !== "primary") {
+  fail("site bundle adoption-boundary must be primary content outside the first screen");
+}
 if (siteBundle.homepage.sections.some((entry) => entry.id === "homepage-content-contract")) {
   fail("site bundle homepage.sections must not render the renderer contract as homepage content");
 }
@@ -119,12 +123,12 @@ for (const requiredPath of ["decisions/kfd-N.md", "registry.json", "standards.js
     fail(`site bundle decision metadata publicFactSource.canonicalPaths must include ${requiredPath}`);
   }
 }
-for (const requiredFile of ["README.md", "TRADEMARKS.md", "decisions", "registry.json", "standards.json", "kfd.release.json", "schemas", "site", "buildchain.release-propagation.json", "release-impact.json", ".buildchain/kfd-1/contract-world.witness.json", ".buildchain/kfd-2", ".buildchain/kfd-3", "docs"]) {
+for (const requiredFile of ["README.md", "TRADEMARKS.md", "decisions", "registry.json", "standards.json", "kfd.release.json", "schemas", "site", "buildchain.contract-lock.json", "buildchain.release-propagation.json", "release-impact.json", ".buildchain/kfd-1/contract-world.witness.json", ".buildchain/kfd-2", ".buildchain/kfd-3", "docs"]) {
   if (!Array.isArray(packageJson.files) || !packageJson.files.includes(requiredFile)) {
     fail(`package.json files[] must include ${requiredFile}`);
   }
 }
-for (const requiredExport of ["./TRADEMARKS.md", "./registry.json", "./standards.json", "./kfd.release.json", "./site/kfd-site.json", "./buildchain.release-propagation.json", "./release-impact.json", "./buildchain/kfd-1/contract-world.witness.json", "./buildchain/kfd-2/public-release-trust.claim.json", "./buildchain/kfd-3/collaboration-interface.json", "./buildchain/kfd-3/collaboration-interface.prebuild.json", "./buildchain/kfd-3/collaboration-interface.artifact.json", "./schemas/*.json", "./schemas/*/*.json"]) {
+for (const requiredExport of ["./TRADEMARKS.md", "./registry.json", "./standards.json", "./kfd.release.json", "./site/kfd-site.json", "./buildchain.contract-lock.json", "./buildchain.release-propagation.json", "./release-impact.json", "./buildchain/kfd-1/contract-world.witness.json", "./buildchain/kfd-2/public-release-trust.claim.json", "./buildchain/kfd-3/collaboration-interface.json", "./buildchain/kfd-3/collaboration-interface.prebuild.json", "./buildchain/kfd-3/collaboration-interface.artifact.json", "./schemas/*.json", "./schemas/*/*.json"]) {
   if (!packageJson.exports || !packageJson.exports[requiredExport]) {
     fail(`package.json exports must include ${requiredExport}`);
   }

package/scripts/update-kfd-2-claim.mjs

@@ -22,6 +22,7 @@ const sourceBindings = [
   pointer("standards.json", { id: "standards-metadata" }),
   pointer("release-impact.json", { id: "release-impact-ledger" }),
   pointer("buildchain.toml", { id: "buildchain-release-contract" }),
+  pointer("buildchain.contract-lock.json", { id: "buildchain-runtime-contract-lock" }),
 ];
 
 const machineEvidence = [

package/scripts/update-kfd-3-witness.mjs

@@ -62,6 +62,7 @@ const groupedSurfaces = {
     { id: "metadata:standards", sourcePath: "standards.json", sha256: sha256File("standards.json") },
     { id: "metadata:release-impact", sourcePath: "release-impact.json", sha256: sha256File("release-impact.json") },
     { id: "metadata:release-anchor", sourcePath: "kfd.release.json", sha256: sha256File("kfd.release.json") },
+    { id: "metadata:buildchain-contract-lock", sourcePath: "buildchain.contract-lock.json", sha256: sha256File("buildchain.contract-lock.json") },
     { id: "metadata:kfd-2-public-release-trust-claim", sourcePath: ".buildchain/kfd-2/public-release-trust.claim.json", sha256: sha256File(".buildchain/kfd-2/public-release-trust.claim.json") },
   ],
   packageExports: [

package/scripts/update-site-bundle.mjs

@@ -139,6 +139,15 @@ export const buildSiteBundle = ({ readmeText, registry }) => {
       presentation: "layered-model",
       firstScreen: true,
     }),
+    section({
+      id: "adoption-boundary",
+      sourceHeading: "Adoption boundary",
+      title: "Adoption boundary",
+      markdown: readme.sections["Adoption boundary"],
+      role: "primary",
+      priority: 25,
+      presentation: "boundary-note",
+    }),
     section({
       id: "product-proof-path",
       sourceHeading: "Product proof path",
@@ -201,9 +210,8 @@ export const buildSiteBundle = ({ readmeText, registry }) => {
           maxPrimarySections: 2,
           note: "The first viewport should establish KFD identity and the three-decision worldview without showing renderer or developer contract text.",
         },
-        primary: ["foundation-triad", "foundation-model", "product-proof-path"],
+        primary: ["foundation-triad", "foundation-model", "adoption-boundary", "product-proof-path"],
         support: ["agent-quickstart", "decision-metadata"],
-        rendererContract: ["homepage-content-contract"],
         currentDecisions: {
           source: REGISTRY_PATH,
           placement: "after-primary",

package/site/kfd-site.json

@@ -99,6 +99,17 @@
         "includeInFirstScreen": true,
         "markdown": "The triad is intentionally ordered. It is a compact model for surviving and\nevolving in complex systems, especially in a world where agents can observe,\nact, delegate, and remember across many surfaces.\n\n| Layer | Decision | Reader question | Commitment |\n|---|---|---|---|\n| Fact-source ontology | KFD-1 | What can count as a fact? | Facts must not drift: a load-bearing contract world comes from one declared fact source. |\n| Participant-to-object trust | KFD-2 | When can a user or agent trust a claim, product, artifact, or control surface? | Trust starts from inspectable facts and responsibility state. |\n| Participant-to-participant cooperation | KFD-3 | How should peer intelligent participants cooperate? | Cooperation starts from trusted value: value becomes trustable through transparent facts, stable choice, and explainable constraints. |\n\nIn short:\n\n```text\nnon-drifting facts -> inspectable trust -> trusted value -> voluntary cooperation\n```\n\nThis is why KFDs are not only internal governance text. KFD-1 gives the\nfoundation model its first layer by making fact sources operational: a\nfact-bearing contract world must be declared, inspectable, and unable to drift\ninvisibly. KFD-2 then defines how trust can stand on those facts. KFD-3\ndefines how humans and agents can cooperate once facts and trust are visible.\n\nReal-world agent work turns ordinary work into a dense system of products,\nfiles, repositories, traces, policies, humans, and agents. In that world,\ncomplexity cannot be made safe by hidden state or forced compliance. It has to\nbe compressed through non-drifting facts, inspectable trust, and voluntary\ncooperation. The goal is not to force increasingly capable participants into\ncompliance through stronger pressure. It is to give humans and agents a shared\nworldview for adapting to a more complex world.\n\nThis also changes what a product interface means. Agent-facing CLI, API,\ndocumentation, envelopes, and local fact surfaces are not secondary integration\nchannels after the human GUI. They are first-class interfaces for intelligent\nparticipants that may use the system more frequently than humans do. A control\nplane in this model is a shared work environment for humans and agents, not\nonly a human dashboard over agent activity.\n\nThis model used to be expensive to practice. Stable facts require engineering,\niteration, and disciplined evidence paths, so older systems often survived by\nleaning on cheaper substitutes such as authority, habit, reputation, or\nintuition. Agents change both sides of that equation: they make the world more\ncomplex, and they also provide more intelligence for building fact-bearing\nsystems. KFD is part of that bootstrap: the worldview is forged through the same\ntransparent and inspectable mechanisms it asks products to provide.\n\nThis README states the architecture; KFD-1, KFD-2, and KFD-3 provide the\ndetailed rules."
       },
+      {
+        "id": "adoption-boundary",
+        "sourcePath": "README.md",
+        "sourceHeading": "Adoption boundary",
+        "title": "Adoption boundary",
+        "renderRole": "primary",
+        "homepagePriority": 25,
+        "defaultPresentation": "boundary-note",
+        "includeInFirstScreen": false,
+        "markdown": "KFD is an engineering discipline, not a belief test.\nKFD governs systems before it judges people.\nNo one should be pressured to adopt KFD in the name of KFD.\nDisagreement is a valid cooperation state.\n\nA constraint can be strict and still KFD-compatible when it is fact-bound,\nexplainable, auditable, and proportionate."
+      },
       {
         "id": "product-proof-path",
         "sourcePath": "README.md",
@@ -147,15 +158,13 @@
       "primary": [
         "foundation-triad",
         "foundation-model",
+        "adoption-boundary",
         "product-proof-path"
       ],
       "support": [
         "agent-quickstart",
         "decision-metadata"
       ],
-      "rendererContract": [
-        "homepage-content-contract"
-      ],
       "currentDecisions": {
         "source": "registry.json",
         "placement": "after-primary",
@@ -175,7 +184,7 @@
       "homepagePriority": 90,
       "defaultPresentation": "developer-note",
       "includeInFirstScreen": false,
-      "markdown": "This README is also the homepage text source for `https://kfd.libkungfu.dev`.\nWhen `site-libkungfu-dev` consumes the `@kungfu-tech/kfd` npm package to render\nthe KFD site, it should treat this file as the canonical homepage copy, not as\nan implementation note to paraphrase in the site repository.\n\nThe first screen should be derived from this README:\n\n- Page identity: the top-level heading.\n- Lead: the opening paragraph that defines KFD as the organization-wide\n  decision registry.\n- Foundation signal: the `Foundation triad` section, especially the three\n  one-line commitments.\n- First-screen explanation: the beginning of `Foundation model`, ending at the\n  `non-drifting facts -> inspectable trust -> trusted value -> voluntary\n  cooperation` chain.\n\nDecision cards, detail links, and machine paths should come from\n`registry.json`. The machine-readable site bundle lives at `site/kfd-site.json`\nand gives renderers stable fields for the homepage, foundation model, product\nproof path, decision routes, and rendering boundary. A site renderer may adapt\nlayout, navigation, typography, and visual assets, but it should not maintain\nseparate homepage wording that can drift from this package.\n\n`site/kfd-site.json` is generated from this README by\n`scripts/update-site-bundle.mjs`. The generated bundle exposes both compatible\ntop-level homepage fields and ordered `homepage.sections` entries. The\n`homepage.displayPlan` tells renderers which sections belong in the first\nscreen, primary narrative, support area, and renderer-contract area. Site\nrepositories should consume that bundle instead of parsing this README\nthemselves. The renderer contract is exposed as machine/implementation\nmetadata, not as ordinary homepage content.",
+      "markdown": "This README is also the homepage text source for `https://kfd.libkungfu.dev`.\nWhen `site-libkungfu-dev` consumes the `@kungfu-tech/kfd` npm package to render\nthe KFD site, it should treat this file as the canonical homepage copy, not as\nan implementation note to paraphrase in the site repository.\n\nThe first screen should be derived from this README:\n\n- Page identity: the top-level heading.\n- Lead: the opening paragraph that defines KFD as the organization-wide\n  decision registry.\n- Foundation signal: the `Foundation triad` section, especially the three\n  one-line commitments.\n- First-screen explanation: the beginning of `Foundation model`, ending at the\n  `non-drifting facts -> inspectable trust -> trusted value -> voluntary\n  cooperation` chain.\n\nDecision cards, detail links, and machine paths should come from\n`registry.json`. The machine-readable site bundle lives at `site/kfd-site.json`\nand gives renderers stable fields for the homepage, foundation model, product\nproof path, decision routes, and rendering boundary. A site renderer may adapt\nlayout, navigation, typography, and visual assets, but it should not maintain\nseparate homepage wording that can drift from this package.\n\n`site/kfd-site.json` is generated from this README by\n`scripts/update-site-bundle.mjs`. The generated bundle exposes both compatible\ntop-level homepage fields and ordered `homepage.sections` entries. The\n`homepage.displayPlan` tells renderers which sections belong in the first\nscreen, primary narrative, and support area. Site repositories should consume\nthat bundle instead of parsing this README themselves. The renderer contract is\nexposed as machine/implementation metadata, not as ordinary homepage content.",
       "renderAsHomepageContent": false,
       "note": "This is a machine/renderer contract for site implementers. It should not be rendered as ordinary homepage content."
     }