@kungfu-tech/kfd 1.0.0-alpha.2 → 1.0.0-alpha.20

package/.buildchain/kfd-2/kfd-foundation.trust-assessment.json

@@ -0,0 +1,238 @@
+{
+  "schemaVersion": 1,
+  "contract": "kfd-2-trust-assessment",
+  "standard": "kfd-2",
+  "assessedClaims": {
+    "schemaId": "https://kfd.libkungfu.dev/schemas/kfd-2/trust-claims.schema.json",
+    "path": ".buildchain/kfd-2/kfd-foundation.trust-claims.json",
+    "digest": "sha256:516fe8d96ddecbf4ebb32315fc1b5658e3e56c4180aca97eac2a9ab2c9208679"
+  },
+  "result": "warning",
+  "projection": {
+    "kind": "generic",
+    "description": "Generic KFD-2 assessment of KFD-owned foundation and practice guideline claims."
+  },
+  "assessments": [
+    {
+      "id": "assess-kfd-1-contract-world-trust",
+      "claimId": "kfd-1-contract-world-trust",
+      "subject": {
+        "kind": "contract-world",
+        "id": "kfd-1-surface-register",
+        "standard": "kfd-1",
+        "description": "KFD-1 non-drifting fact-source and compatibility-impact surface register."
+      },
+      "result": "pass",
+      "facts": [
+        {
+          "type": "file",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "standards.json",
+          "digest": "sha256:68aae8bbfcce0776e5f5317e133ae1b494a41ecdea1f992bb51f71d1e75f2ca4",
+          "description": "Fact standards.json is present and hashable."
+        },
+        {
+          "type": "schema",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "schemas/kfd-1/contract-world.schema.json",
+          "digest": "sha256:412d22385cd81a72798cc649c5ddfa961b6ae91ec2727d4300261a55fa5036f3",
+          "description": "Fact schemas/kfd-1/contract-world.schema.json is present and hashable."
+        }
+      ],
+      "evidence": [
+        {
+          "type": "schema",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "schemas/kfd-1/contract-world.schema.json",
+          "digest": "sha256:412d22385cd81a72798cc649c5ddfa961b6ae91ec2727d4300261a55fa5036f3",
+          "description": "KFD-1 contract-world schema is published as a package surface."
+        },
+        {
+          "type": "file",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "scripts/check.mjs",
+          "digest": "sha256:43cd81dcff761004098722f4b69a7e9939fe9559d4785344dd3344933e241f82",
+          "description": "The package check gate validates the KFD-1 schema, surface register, witness, and hashes."
+        }
+      ],
+      "auditBoundary": {
+        "scope": "KFD package KFD-1 surface-register, schema, witness, and self-verification gate",
+        "enumerability": "closed-world"
+      },
+      "responsibility": {
+        "owner": "KFD maintainers",
+        "sourceOwner": "KFD maintainers",
+        "verificationOwner": "KFD package self-verification",
+        "decisionOwner": "KFD maintainers"
+      },
+      "residualRisk": []
+    },
+    {
+      "id": "assess-kfd-3-collaboration-interface-trust",
+      "claimId": "kfd-3-collaboration-interface-trust",
+      "subject": {
+        "kind": "collaboration-interface",
+        "id": "kfd-3-collaboration-interface",
+        "standard": "kfd-3",
+        "description": "KFD package collaboration interface for humans, agents, maintainers, package consumers, site consumers, and release systems."
+      },
+      "result": "warning",
+      "facts": [
+        {
+          "type": "file",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": ".buildchain/kfd-3/collaboration-interface.json",
+          "digest": "sha256:fa41128be4ee57a4a40b76d4d7a063c01d7c2e5c53aec2b9c6db819c7a27b22b",
+          "description": "Fact .buildchain/kfd-3/collaboration-interface.json is present and hashable."
+        }
+      ],
+      "evidence": [
+        {
+          "type": "schema",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "schemas/kfd-3/collaboration-interface.schema.json",
+          "digest": "sha256:6526be8e59d2f0f645e7f67a8f63a93f017a2dac62701147d49c5f391c5483a3",
+          "description": "KFD-3 collaboration interface schema is published."
+        },
+        {
+          "type": "file",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": ".buildchain/kfd-3/collaboration-interface.json",
+          "digest": "sha256:fa41128be4ee57a4a40b76d4d7a063c01d7c2e5c53aec2b9c6db819c7a27b22b",
+          "description": "KFD-3 source collaboration interface declares reachable participant-facing surfaces and value evidence."
+        },
+        {
+          "type": "file",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "scripts/check.mjs",
+          "digest": "sha256:43cd81dcff761004098722f4b69a7e9939fe9559d4785344dd3344933e241f82",
+          "description": "The package check gate validates KFD-3 interface closure and witness parity."
+        }
+      ],
+      "auditBoundary": {
+        "scope": "KFD participant-facing collaboration surfaces, extension paths, and shipped witness files",
+        "enumerability": "closed-world"
+      },
+      "responsibility": {
+        "owner": "KFD maintainers",
+        "sourceOwner": "KFD maintainers",
+        "verificationOwner": "KFD package self-verification",
+        "decisionOwner": "KFD maintainers"
+      },
+      "residualRisk": [
+        {
+          "id": "human-language-interpretation",
+          "definedBy": "https://kfd.libkungfu.dev/schemas/kfd-2/trust-taxonomy.schema.json#/$defs/residualRisk",
+          "riskType": "natural-language-semantic-risk",
+          "trustImpact": "downgrade-warning",
+          "machineProvability": "not-exhaustively-enumerable",
+          "agentAction": "semantic-review-required",
+          "reason": "Natural-language standard interpretation is inspectable and reviewable but cannot be exhaustively proved from package bytes.",
+          "owner": "KFD maintainers"
+        }
+      ]
+    },
+    {
+      "id": "assess-kfd-4-observer-perspective-trust",
+      "claimId": "kfd-4-observer-perspective-trust",
+      "subject": {
+        "kind": "observer-perspective",
+        "id": "kfd-4-observer-perspective",
+        "standard": "kfd-4",
+        "description": "KFD-4 observer-perspective schema for perspective-bearing timeline views."
+      },
+      "result": "pass",
+      "facts": [
+        {
+          "type": "file",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "decisions/KFD-4.md",
+          "digest": "sha256:7077a6446c8baa60d85426780cb7b2bee488133196b6f53d74f0eb151f6e26e4",
+          "description": "Fact decisions/KFD-4.md is present and hashable."
+        },
+        {
+          "type": "file",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "standards.json",
+          "digest": "sha256:68aae8bbfcce0776e5f5317e133ae1b494a41ecdea1f992bb51f71d1e75f2ca4",
+          "description": "Fact standards.json is present and hashable."
+        },
+        {
+          "type": "schema",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "schemas/kfd-4/observer-perspective.schema.json",
+          "digest": "sha256:e6ae8849b04c326b4ae5efafa08b08dc0f3fcf6844f6956735ff7327c2cfd69c",
+          "description": "Fact schemas/kfd-4/observer-perspective.schema.json is present and hashable."
+        }
+      ],
+      "evidence": [
+        {
+          "type": "schema",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "schemas/kfd-4/observer-perspective.schema.json",
+          "digest": "sha256:e6ae8849b04c326b4ae5efafa08b08dc0f3fcf6844f6956735ff7327c2cfd69c",
+          "description": "KFD-4 observer-perspective schema is published."
+        },
+        {
+          "type": "file",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "standards.json",
+          "digest": "sha256:68aae8bbfcce0776e5f5317e133ae1b494a41ecdea1f992bb51f71d1e75f2ca4",
+          "description": "Standards metadata exposes the KFD-4 schema ID, path, interface version, and concept names."
+        },
+        {
+          "type": "file",
+          "result": "pass",
+          "machineProvability": "machine-verifiable",
+          "path": "scripts/check.mjs",
+          "digest": "sha256:43cd81dcff761004098722f4b69a7e9939fe9559d4785344dd3344933e241f82",
+          "description": "The package check gate validates the KFD-4 schema and standards metadata."
+        }
+      ],
+      "auditBoundary": {
+        "scope": "KFD-4 decision text, observer-perspective schema, standards metadata, and self-verification gate",
+        "enumerability": "closed-world"
+      },
+      "responsibility": {
+        "owner": "KFD maintainers",
+        "sourceOwner": "KFD maintainers",
+        "verificationOwner": "KFD package self-verification",
+        "decisionOwner": "KFD maintainers"
+      },
+      "residualRisk": []
+    }
+  ],
+  "unboundClaims": [],
+  "downgradeReasons": [
+    {
+      "id": "kfd-3-natural-language-semantics",
+      "riskType": "natural-language-semantic-risk",
+      "trustImpact": "downgrade-warning",
+      "reason": "KFD-3 exposes machine-checkable collaboration surfaces and value evidence, but the human-language meaning of trusted value and non-coercive cooperation remains a reviewable semantic responsibility.",
+      "agentAction": "semantic-review-required",
+      "source": "kfd-3-collaboration-interface-trust"
+    }
+  ],
+  "responsibility": {
+    "owner": "KFD maintainers",
+    "sourceOwner": "KFD maintainers",
+    "verificationOwner": "KFD package self-verification",
+    "decisionOwner": "KFD maintainers"
+  },
+  "schemaEvolution": {
+    "compatibilityRule": "Compatible additions may keep schemaVersion 1; semantic, required-field, verification-meaning, or responsibility-boundary changes require a new interface version or contract."
+  }
+}

package/.buildchain/kfd-2/kfd-foundation.trust-claims.json

@@ -0,0 +1,225 @@
+{
+  "schemaVersion": 1,
+  "contract": "kfd-2-trust-claims",
+  "standard": "kfd-2",
+  "projection": {
+    "kind": "generic",
+    "description": "KFD self-dogfood claims for assessing KFD-1, KFD-3, and KFD-4 from the generic KFD-2 trust model."
+  },
+  "claims": [
+    {
+      "id": "kfd-1-contract-world-trust",
+      "statement": "KFD-1 is trustable as the KFD package contract-world rule because its surface register, schema, witness, and verification command are inspectable from committed package facts.",
+      "subject": {
+        "kind": "contract-world",
+        "id": "kfd-1-surface-register",
+        "standard": "kfd-1",
+        "description": "KFD-1 non-drifting fact-source and compatibility-impact surface register."
+      },
+      "facts": [
+        {
+          "kind": "file",
+          "path": "standards.json",
+          "sha256": "68aae8bbfcce0776e5f5317e133ae1b494a41ecdea1f992bb51f71d1e75f2ca4"
+        },
+        {
+          "kind": "schema",
+          "path": "schemas/kfd-1/contract-world.schema.json",
+          "sha256": "412d22385cd81a72798cc649c5ddfa961b6ae91ec2727d4300261a55fa5036f3"
+        }
+      ],
+      "evidence": [
+        {
+          "type": "schema",
+          "pointer": {
+            "kind": "schema",
+            "path": "schemas/kfd-1/contract-world.schema.json",
+            "sha256": "412d22385cd81a72798cc649c5ddfa961b6ae91ec2727d4300261a55fa5036f3"
+          },
+          "machineProvability": "machine-verifiable",
+          "description": "KFD-1 contract-world schema is published as a package surface."
+        },
+        {
+          "type": "file",
+          "pointer": {
+            "kind": "file",
+            "path": "scripts/check.mjs",
+            "sha256": "43cd81dcff761004098722f4b69a7e9939fe9559d4785344dd3344933e241f82"
+          },
+          "machineProvability": "machine-verifiable",
+          "description": "The package check gate validates the KFD-1 schema, surface register, witness, and hashes."
+        }
+      ],
+      "verification": {
+        "command": "node scripts/check.mjs",
+        "expectedResult": "pass"
+      },
+      "auditBoundary": {
+        "scope": "KFD package KFD-1 surface-register, schema, witness, and self-verification gate",
+        "enumerability": "closed-world"
+      },
+      "residualRisk": [],
+      "responsibility": {
+        "owner": "KFD maintainers",
+        "sourceOwner": "KFD maintainers",
+        "verificationOwner": "KFD package self-verification",
+        "decisionOwner": "KFD maintainers"
+      },
+      "status": "enforced"
+    },
+    {
+      "id": "kfd-3-collaboration-interface-trust",
+      "statement": "KFD-3 is trustable as a participant-facing collaboration interface because KFD publishes the declared interface, explicit value evidence, prebuild witness, artifact witness, extension path, and closure check.",
+      "subject": {
+        "kind": "collaboration-interface",
+        "id": "kfd-3-collaboration-interface",
+        "standard": "kfd-3",
+        "description": "KFD package collaboration interface for humans, agents, maintainers, package consumers, site consumers, and release systems."
+      },
+      "facts": [
+        {
+          "kind": "file",
+          "path": ".buildchain/kfd-3/collaboration-interface.json",
+          "sha256": "fa41128be4ee57a4a40b76d4d7a063c01d7c2e5c53aec2b9c6db819c7a27b22b"
+        }
+      ],
+      "evidence": [
+        {
+          "type": "schema",
+          "pointer": {
+            "kind": "schema",
+            "path": "schemas/kfd-3/collaboration-interface.schema.json",
+            "sha256": "6526be8e59d2f0f645e7f67a8f63a93f017a2dac62701147d49c5f391c5483a3"
+          },
+          "machineProvability": "machine-verifiable",
+          "description": "KFD-3 collaboration interface schema is published."
+        },
+        {
+          "type": "file",
+          "pointer": {
+            "kind": "file",
+            "path": ".buildchain/kfd-3/collaboration-interface.json",
+            "sha256": "fa41128be4ee57a4a40b76d4d7a063c01d7c2e5c53aec2b9c6db819c7a27b22b"
+          },
+          "machineProvability": "machine-verifiable",
+          "description": "KFD-3 source collaboration interface declares reachable participant-facing surfaces and value evidence."
+        },
+        {
+          "type": "file",
+          "pointer": {
+            "kind": "file",
+            "path": "scripts/check.mjs",
+            "sha256": "43cd81dcff761004098722f4b69a7e9939fe9559d4785344dd3344933e241f82"
+          },
+          "machineProvability": "machine-verifiable",
+          "description": "The package check gate validates KFD-3 interface closure and witness parity."
+        }
+      ],
+      "verification": {
+        "command": "node scripts/check.mjs",
+        "expectedResult": "warning"
+      },
+      "auditBoundary": {
+        "scope": "KFD participant-facing collaboration surfaces, extension paths, and shipped witness files",
+        "enumerability": "closed-world"
+      },
+      "residualRisk": [
+        {
+          "id": "human-language-interpretation",
+          "definedBy": "https://kfd.libkungfu.dev/schemas/kfd-2/trust-taxonomy.schema.json#/$defs/residualRisk",
+          "riskType": "natural-language-semantic-risk",
+          "trustImpact": "downgrade-warning",
+          "machineProvability": "not-exhaustively-enumerable",
+          "agentAction": "semantic-review-required",
+          "reason": "Natural-language standard interpretation is inspectable and reviewable but cannot be exhaustively proved from package bytes.",
+          "owner": "KFD maintainers"
+        }
+      ],
+      "responsibility": {
+        "owner": "KFD maintainers",
+        "sourceOwner": "KFD maintainers",
+        "verificationOwner": "KFD package self-verification",
+        "decisionOwner": "KFD maintainers"
+      },
+      "status": "enforced"
+    },
+    {
+      "id": "kfd-4-observer-perspective-trust",
+      "statement": "KFD-4 is trustable as an observer-perspective interface because KFD publishes the schema, standards metadata, decision text, and verification gate for observer-relative timeline views.",
+      "subject": {
+        "kind": "observer-perspective",
+        "id": "kfd-4-observer-perspective",
+        "standard": "kfd-4",
+        "description": "KFD-4 observer-perspective schema for perspective-bearing timeline views."
+      },
+      "facts": [
+        {
+          "kind": "file",
+          "path": "decisions/KFD-4.md",
+          "sha256": "7077a6446c8baa60d85426780cb7b2bee488133196b6f53d74f0eb151f6e26e4"
+        },
+        {
+          "kind": "file",
+          "path": "standards.json",
+          "sha256": "68aae8bbfcce0776e5f5317e133ae1b494a41ecdea1f992bb51f71d1e75f2ca4"
+        },
+        {
+          "kind": "schema",
+          "path": "schemas/kfd-4/observer-perspective.schema.json",
+          "sha256": "e6ae8849b04c326b4ae5efafa08b08dc0f3fcf6844f6956735ff7327c2cfd69c"
+        }
+      ],
+      "evidence": [
+        {
+          "type": "schema",
+          "pointer": {
+            "kind": "schema",
+            "path": "schemas/kfd-4/observer-perspective.schema.json",
+            "sha256": "e6ae8849b04c326b4ae5efafa08b08dc0f3fcf6844f6956735ff7327c2cfd69c"
+          },
+          "machineProvability": "machine-verifiable",
+          "description": "KFD-4 observer-perspective schema is published."
+        },
+        {
+          "type": "file",
+          "pointer": {
+            "kind": "file",
+            "path": "standards.json",
+            "sha256": "68aae8bbfcce0776e5f5317e133ae1b494a41ecdea1f992bb51f71d1e75f2ca4"
+          },
+          "machineProvability": "machine-verifiable",
+          "description": "Standards metadata exposes the KFD-4 schema ID, path, interface version, and concept names."
+        },
+        {
+          "type": "file",
+          "pointer": {
+            "kind": "file",
+            "path": "scripts/check.mjs",
+            "sha256": "43cd81dcff761004098722f4b69a7e9939fe9559d4785344dd3344933e241f82"
+          },
+          "machineProvability": "machine-verifiable",
+          "description": "The package check gate validates the KFD-4 schema and standards metadata."
+        }
+      ],
+      "verification": {
+        "command": "node scripts/check.mjs",
+        "expectedResult": "pass"
+      },
+      "auditBoundary": {
+        "scope": "KFD-4 decision text, observer-perspective schema, standards metadata, and self-verification gate",
+        "enumerability": "closed-world"
+      },
+      "residualRisk": [],
+      "responsibility": {
+        "owner": "KFD maintainers",
+        "sourceOwner": "KFD maintainers",
+        "verificationOwner": "KFD package self-verification",
+        "decisionOwner": "KFD maintainers"
+      },
+      "status": "enforced"
+    }
+  ],
+  "schemaEvolution": {
+    "compatibilityRule": "Compatible additions may keep schemaVersion 1; semantic, required-field, verification-meaning, or responsibility-boundary changes require a new interface version or contract."
+  }
+}

package/.buildchain/kfd-2/public-release-trust.claim.json

@@ -0,0 +1,131 @@
+{
+  "id": "kfd-public-release-trust",
+  "public": true,
+  "claim": "The KFD npm release is backed by declared source facts, machine-readable evidence, artifact coordinates, verification, audit boundary, responsibility, and explicit residual-risk state.",
+  "sourceBindings": [
+    {
+      "path": "package.json",
+      "sha256": "25ae49f5ab1c34d07d066b7e8fbe49284808bbf10b3c3b2ebe06373be1020854",
+      "id": "package-version-and-exports"
+    },
+    {
+      "path": "kfd.release.json",
+      "sha256": "128788929dadbf25aa60283c5c5a7f79afd971627c378edd7d85546ee2038f22",
+      "id": "anchored-release-version"
+    },
+    {
+      "path": "registry.json",
+      "sha256": "003842480fb9b3b8847735db729bc94bace4f60a25e730df839f4cb74c9f1ab5",
+      "id": "decision-registry"
+    },
+    {
+      "path": "standards.json",
+      "sha256": "68aae8bbfcce0776e5f5317e133ae1b494a41ecdea1f992bb51f71d1e75f2ca4",
+      "id": "standards-metadata"
+    },
+    {
+      "path": "release-impact.json",
+      "sha256": "685f65d10491593d28321431eee315bb5fbbedd2d1ccec0747f4a37547b3124a",
+      "id": "release-impact-ledger"
+    },
+    {
+      "path": "buildchain.toml",
+      "sha256": "0dc1179d59b634df364871ea18a66251781321c80a6f7bcb9e3fcf5a48ef738a",
+      "id": "buildchain-release-contract"
+    },
+    {
+      "path": "buildchain.contract-lock.json",
+      "sha256": "b01c166a59bec6d73e882a69d9d91fbb98f1132558a417f4654c19889af6f0b9",
+      "id": "buildchain-runtime-contract-lock"
+    }
+  ],
+  "machineEvidence": [
+    {
+      "path": "scripts/check.mjs",
+      "sha256": "43cd81dcff761004098722f4b69a7e9939fe9559d4785344dd3344933e241f82",
+      "id": "self-verification-command"
+    },
+    {
+      "path": ".github/workflows/build.yml",
+      "sha256": "264cd15db6f872c72fc58bcd476d1a3a476ec54b520b05268e213f5b59692f5b",
+      "id": "buildchain-build-workflow"
+    },
+    {
+      "path": ".github/workflows/buildchain-ref-promotion.yml",
+      "sha256": "754a44cedfc174f35dcf54414c04b636bbc0a85e2272f5de8e899a70ee05d7bd",
+      "id": "buildchain-promotion-workflow"
+    },
+    {
+      "path": "schemas/kfd-2/trust-taxonomy.schema.json",
+      "sha256": "a663d301a663cadb8567e3010361f5a630b76b6518ed7603dfd58cbd4e64a658",
+      "id": "kfd-2-trust-taxonomy-schema"
+    },
+    {
+      "path": "schemas/kfd-2/trust-claims.schema.json",
+      "sha256": "5f452a5973502273f0249116b3a4171549a84515d8ba5286a09f173db4f0e03a",
+      "id": "kfd-2-trust-claims-schema"
+    },
+    {
+      "path": "schemas/kfd-2/trust-assessment.schema.json",
+      "sha256": "cdb56fb16d0d2e91e4a9ebaff9cefc212a70fd22701e1185ca75d66af6172a51",
+      "id": "kfd-2-trust-assessment-schema"
+    },
+    {
+      "path": "schemas/kfd-2/release-claims.schema.json",
+      "sha256": "0f52c4a9949f62163a0fbe14fefc2f2f93f548ae18b6b5c07eb87aedca4c0be0",
+      "id": "kfd-2-release-claims-schema"
+    },
+    {
+      "path": "schemas/kfd-2/release-trust-passport.schema.json",
+      "sha256": "df7f828605f680f3ff52fe3468cbf8f5e20151fac0d5c31cd9a0de9765efecc1",
+      "id": "kfd-2-release-trust-passport-schema"
+    }
+  ],
+  "hashes": {
+    "package-version-and-exports": "25ae49f5ab1c34d07d066b7e8fbe49284808bbf10b3c3b2ebe06373be1020854",
+    "anchored-release-version": "128788929dadbf25aa60283c5c5a7f79afd971627c378edd7d85546ee2038f22",
+    "decision-registry": "003842480fb9b3b8847735db729bc94bace4f60a25e730df839f4cb74c9f1ab5",
+    "standards-metadata": "68aae8bbfcce0776e5f5317e133ae1b494a41ecdea1f992bb51f71d1e75f2ca4",
+    "release-impact-ledger": "685f65d10491593d28321431eee315bb5fbbedd2d1ccec0747f4a37547b3124a",
+    "buildchain-release-contract": "0dc1179d59b634df364871ea18a66251781321c80a6f7bcb9e3fcf5a48ef738a",
+    "buildchain-runtime-contract-lock": "b01c166a59bec6d73e882a69d9d91fbb98f1132558a417f4654c19889af6f0b9",
+    "self-verification-command": "43cd81dcff761004098722f4b69a7e9939fe9559d4785344dd3344933e241f82",
+    "buildchain-build-workflow": "264cd15db6f872c72fc58bcd476d1a3a476ec54b520b05268e213f5b59692f5b",
+    "buildchain-promotion-workflow": "754a44cedfc174f35dcf54414c04b636bbc0a85e2272f5de8e899a70ee05d7bd",
+    "kfd-2-trust-taxonomy-schema": "a663d301a663cadb8567e3010361f5a630b76b6518ed7603dfd58cbd4e64a658",
+    "kfd-2-trust-claims-schema": "5f452a5973502273f0249116b3a4171549a84515d8ba5286a09f173db4f0e03a",
+    "kfd-2-trust-assessment-schema": "cdb56fb16d0d2e91e4a9ebaff9cefc212a70fd22701e1185ca75d66af6172a51",
+    "kfd-2-release-claims-schema": "0f52c4a9949f62163a0fbe14fefc2f2f93f548ae18b6b5c07eb87aedca4c0be0",
+    "kfd-2-release-trust-passport-schema": "df7f828605f680f3ff52fe3468cbf8f5e20151fac0d5c31cd9a0de9765efecc1"
+  },
+  "artifacts": [
+    {
+      "name": "@kungfu-tech/kfd",
+      "version": "1.0.0-alpha.20",
+      "path": "package.json",
+      "sha256": "25ae49f5ab1c34d07d066b7e8fbe49284808bbf10b3c3b2ebe06373be1020854"
+    },
+    {
+      "name": "kfd-release-anchor",
+      "version": "1.0.0-alpha.20",
+      "path": "kfd.release.json",
+      "sha256": "128788929dadbf25aa60283c5c5a7f79afd971627c378edd7d85546ee2038f22"
+    }
+  ],
+  "verification": {
+    "result": "passed",
+    "command": "node scripts/check.mjs"
+  },
+  "auditBoundary": {
+    "scope": "KFD public npm package release facts, package exports, release governance files, and Buildchain release-passport inputs",
+    "enumerability": "closed-world"
+  },
+  "responsibility": {
+    "owner": "KFD maintainers",
+    "sourceOwner": "KFD maintainers",
+    "verificationOwner": "KFD package self-verification",
+    "releaseDecisionOwner": "KFD maintainers",
+    "releasePassportProofOwner": "Buildchain"
+  },
+  "residualRisk": []
+}