@qijenchen/design-system 0.1.0-beta.13 → 0.1.0-beta.131

package/ds-canonical/fork/consumer/lock.json

@@ -0,0 +1,189 @@
+{
+  "$schema": "./lock.schema.json",
+  "schemaVersion": 1,
+  "role": "template-consumer",
+  "release": {
+    "designSystem": "0.1.0-beta.131",
+    "storybookConfig": "0.1.0-beta.131"
+  },
+  "upgradeTrust": {
+    "schemaVersion": 1,
+    "repository": "ajenchen/design-system",
+    "workflow": ".github/workflows/release.yml",
+    "workflowRef": "refs/heads/main",
+    "provenancePredicate": "https://slsa.dev/provenance/v1",
+    "builderId": "https://github.com/actions/runner/github-hosted",
+    "immutableRelease": true,
+    "releaseBomAsset": "release-bom.json",
+    "upgradePackages": [
+      "@qijenchen/design-system",
+      "@qijenchen/storybook-config"
+    ],
+    "releasePackages": [
+      "@qijenchen/design-system",
+      "@qijenchen/governance",
+      "@qijenchen/storybook-config"
+    ]
+  },
+  "upgradeProtocol": {
+    "schemaVersion": 2,
+    "protocolId": "protected-base-reconstruction-v2",
+    "legacyEntryMode": "one-time-reviewed-full-snapshot-pr",
+    "bootstrapEvidenceContract": "consumer-governance-bootstrap-readback-v1",
+    "controlPlaneUpdateMode": "recurring-reviewed-full-snapshot-pr",
+    "controlPlaneUpdateEvidenceContract": "consumer-governance-control-plane-update-readback-v1",
+    "controlPlaneUpdatePlanner": "infra/governance/bin/consumerctl.mjs",
+    "ordinaryUpgradeMode": "protected-base-disposable-reconstruction",
+    "protectedBaseVerifier": "scripts/verify-upgrade-evidence.mjs",
+    "candidateCodeExecutionAllowed": false,
+    "physicalPowerLossDurabilityClaimed": false,
+    "specificationSha256": "230c59f39901dc7bf1fb44c14b56c8b4bb6666db3ef2e6182fa85433e57b1f44",
+    "schemaSha256": "b443dbcf314f50e315b2d5376416b57e1b1c1f1a6231ddc8983283219c62dfad",
+    "implementationSha256": "98b74118fb5b410b77ad2994aa9105fa7609c7353822f8c5213cce54d94f0af4"
+  },
+  "payload": {
+    "forkCorpusLockSha256": "893ce7dd6bd882d2f7e1657f48e12106fc18e5db089c4581cc2f99ec77004baf",
+    "discoveryPolicySha256": "fba289aeeb5a3f11139b9589f7ab08b5e8c8799c7bdf8f0ea57ebfeb8e7c9da6",
+    "providerMaterializersSha256": "732e85b01a12e7dd19469e26e4427f0e0cfe5117a78fc9f69c2f0f89702f463a",
+    "providerLifecycleSha256": "60ca28e8c4667aa44b43d7f1a2e0720aae5f0769e5110f8d7a4392d50fa19ff3",
+    "providerInventorySha256": "00adf1c4f6b3367055a9cc3fdfe658660771b4c9931f696e12761a95076ad92c",
+    "executionRuntimeSha256": "d9377cc45308731f287d7b1711b7c38fc4e02ff8f84729bcbbf01bb52d136904",
+    "commonInstructionSha256": "a72c51a412d6cdb3961d691744013c8362e826626a330cecf4a296a6f4d93a5c",
+    "providerArtifactDigests": {
+      "claude": {
+        "instructionSha256": "f56a44c730506258cc7e2581dbdd31bfd1e6d13d60dc8a8ee8bcc398228453fb",
+        "hookSha256": "5853d1fa036ce174cd67f19ea7e4971797f145e47e32c5201b8556146f895244",
+        "skillsSha256": "fe4a632bdd7ce5f474cadcd6ed5c4c1c54c9f8c4fbeddb3f9a5375ee0219d5a9",
+        "treeDigests": {}
+      },
+      "codex": {
+        "instructionSha256": "a72c51a412d6cdb3961d691744013c8362e826626a330cecf4a296a6f4d93a5c",
+        "hookSha256": "d834c4cfa5a38d13660e5f1a17f80c71e2c83a4394f6858468230cae4d08a104",
+        "skillsSha256": "611ee0bf8e283c622458009dfd0b9f3bfba64de10d76d1d7817e1c8cdb524a1f",
+        "treeDigests": {}
+      },
+      "generic": {
+        "instructionSha256": null,
+        "hookSha256": null,
+        "skillsSha256": null,
+        "treeDigests": {}
+      }
+    },
+    "mergeSurfaceDigests": {
+      "claude": "5853d1fa036ce174cd67f19ea7e4971797f145e47e32c5201b8556146f895244"
+    },
+    "governanceCheckSha256": "1c4c4455910f1e88aebb84add9f756717395519d84913beafaa654a9f1c3126e",
+    "utilityRegistrySha256": "ac430d50ee82c19eb678f725c00eec23a0e25b33ec4bad81d3bf6e2fa9fa64ff",
+    "sharedSkillsSha256": "46a3e1f3e7a7263e1c0032724eb6f91eae14f388087096a83904c3d135ef65b7",
+    "sharedSkillCount": 11,
+    "requiredScripts": {
+      "audit:a11y": "node scripts/audit-consumer-a11y.mjs",
+      "governance:check": "node node_modules/@qijenchen/design-system/ds-canonical/fork/consumer/governance-check.mjs --repo . --hooks-off",
+      "lint:imports": "node scripts/lint-ds-internal-imports.mjs",
+      "setup:all": "node scripts/setup-workspace.mjs",
+      "setup:governance": "node scripts/setup-governance.mjs",
+      "setup:provider-cli": "node scripts/setup-provider-cli-toolchain.mjs",
+      "sync-all": "node scripts/sync-all.mjs",
+      "sync:workspace-dependencies": "node scripts/sync-exact-workspace-dependencies.mjs"
+    },
+    "managedFiles": {
+      ".devcontainer/devcontainer-lock.json": "f2ba8f75963ada855fef0707be6313fec9dce6742d32f414f79c4c370d8de3f3",
+      ".devcontainer/devcontainer.json": "79ebd4ccf0f1207a7ce1f31e51c40b052feeb1b8d51467d7e4e171410c70db24",
+      ".devcontainer/onboard-banner.sh": "fd87b372e48ff079afb0b257c5e5c28fcf58637b2589a508987460a66c2b8b75",
+      ".devcontainer/post-create.mjs": "6bc05d2597a54e8f6a5a087901e92ccc89acc3d5873d96ad20814f8f539a146b",
+      ".github/workflows/audit.yml": "3cb259c8d83d8d378a6d282b0cde0a8884d96c51cf49e655405c3e416e646726",
+      ".npmrc": "79eff2d98653857c11ab6a0354fa62685a72ec214545e7fdfabc450e91b7ba63",
+      "governance/consumer-governance.md": "4545d0dac5d869c58ec26f37ff6ed70a255f61f9cf406efd41e99a9aeaa885b2",
+      "governance/provider-cli-toolchain.json": "6bc607cb6ac299b332d35ca871c838b54e367d96775ad0e759c827a0e3ca10cc",
+      "governance/provider-cli-toolchain.package-lock.json": "fe7115dcbb9c096cc9c2aff069282636b942995399ace5dfd9ba68a7280d465f",
+      "governance/schemas/issuer-registry.schema.json": "52616f59420942b96b33001e00d2c9a23ca3aa14dc236d8cb2aa9756787bfb90",
+      "governance/schemas/visual-baseline-review-policy.schema.json": "29eb02c844515e6e94a063503c4682e8a1a87a3976b26067e725e5491cc6bc45",
+      "governance/trust/issuers.json": "b4da935a9d39239f99fdb15f9ee0a05b538ac0c427b32b77fce8010560fdef2b",
+      "governance/visual-baseline-review-policy.json": "339179f3bb7805f067c40cb22509734fa3f1cf2834129e64f6e0bf08aa70b334",
+      "schemas/provider-cli-toolchain.schema.json": "7e5c6c14c8a9295373f56df968afdb8cb8888764ce1b060993a655ccec8ac61d",
+      "scripts/audit-consumer-a11y.mjs": "f3ed24be76d87ffbcaed08f39491d385a14f0e870a5b952e3407ba0ef0cd4e08",
+      "scripts/check-plugin-installed.mjs": "f2a673cc011743fe51f87746b9aebbd3332378cd2732088eda621e16a3c74386",
+      "scripts/consumer-source-harness.mjs": "725072155d0b15b373bf6befb333cd2085dc8a38fff8538b4f4c8ea56f9c5308",
+      "scripts/lib/a11y-static-server.mjs": "3ae8ca74a66ca5f155d1a1d0c97280d41f07556274c8c077705a489ebe6a7018",
+      "scripts/lib/canonical-path-containment.mjs": "0244e31dc3be5015bed3efd65a5a77086a2e4676e9ac79cd0801c8cde6a74fcd",
+      "scripts/lib/closed-tool-execution.mjs": "eacd0cd92c5bff03e40ff4e82c02fae9bf2e6f543f157eef3d41c3ed8b7d3cb6",
+      "scripts/lib/consumer-control-plane-policy.mjs": "51aba211bb2f755eff7fa48bb060f9835356a62d2643ab5049147a9896c7bb72",
+      "scripts/lib/exact-workspace-dependencies.mjs": "b4921ad903a3ed3d901187d406a87270190945c5ca1874b089e80df898d47a97",
+      "scripts/lib/governance-dependency-bootstrap.mjs": "0598ec2f7b2975f5948072bc9fdb7f24682f3e0abed3cca36696dd869dfc0ffc",
+      "scripts/lib/provider-lifecycle.mjs": "9aabb2c98efc454b8555308a34830e6590b034b10a63f76f788fbd4cf37ce7e7",
+      "scripts/lib/verified-exact-npm-runtime.mjs": "811ed3390a4ff6b4e818a5ce8b5c0ce34e10f48fb443b6177d6e4c8e14fa9670",
+      "scripts/lib/workspace-post-create.mjs": "f3ddc6db740d5c4d48b1c6e16c55222325e4d1c16fe6644a455e7b7e5bea0a0d",
+      "scripts/lib/worktree-fingerprint.mjs": "70a8bdbceade964d009f6a46c9e57a93bc9fd58c28971ea14ad1b5ffeaaf7250",
+      "scripts/lint-ds-internal-imports.mjs": "86edd952fb5c3871896515440693abeb08c1d1da9f887fa073b9ddda1363f572",
+      "scripts/product-template-scaffold-lock.mjs": "7fc069b6ba5f62907eed574d9ae53c5202463fd79b55aa41101b3e2587e99072",
+      "scripts/refresh-fork-launchers.mjs": "8d2058e9b32307a80e3a564f18abac6ea093d09e79164f468af5e1893217283f",
+      "scripts/release-bom-contract.mjs": "75d736f86c7f695dc88a1982d547998d510e8050c4847abe387227b6662b87c2",
+      "scripts/schemas/product-template-scaffold-lock.schema.json": "1318af59f12546b3cda059a1d94923d9a969bef4c5a476ebb46e42f8c853d19a",
+      "scripts/schemas/release-bom.schema.json": "6969482588a25533dc1896be63c3c9629aced1cbeb745b99822db764682dc4a4",
+      "scripts/schemas/upgrade-evidence-receipt.schema.json": "a464b3dcc8f3f94ca997f5771e14626cc400c101e4e7625ff416a89f2af37bbc",
+      "scripts/setup-governance.mjs": "2d5bf5ef149595854681c5744a431c2c231ead7d8699571a453783b39e556518",
+      "scripts/setup-provider-cli-toolchain.mjs": "b34e11d02a7aa71d001ef8f1a42af4cf97d1b8b82360f5779cb927370f5ee15a",
+      "scripts/setup-workspace.mjs": "95dc0fef1f7570efe277a66f7edf4640055ad6abbae0245615eceb9b041560e9",
+      "scripts/sync-all.mjs": "613e10b71405805af900ad328d6baf0ae0ce3a02e58085aab6984163b7f8ad1a",
+      "scripts/sync-exact-workspace-dependencies.mjs": "29ce6aaab16fd7a939eff6e556e8548291fad28df88d578627153c9508bf6e31",
+      "scripts/verify-consumer-css-entry.mjs": "a16545ea8d4f5224d8133f0bb0b68d5489d8e106fe7594488a78e0e5718b99cc",
+      "scripts/verify-upgrade-evidence.mjs": "db1eddbcb8b155891642fa695594120113af35140818d88c21cf88756f88ee19",
+      "scripts/verify-upgrade-provenance.mjs": "8a643a60eaf64bf131a2a4da197d5670a52e4705d11402b53fb32ae93302f6ef",
+      "scripts/workflow-static-validation.mjs": "8e12bf2d73fc5e1200ddc6cc8437b27433fcd71f7d85d79b56756dcaac667305"
+    }
+  },
+  "providers": {
+    "claude": {
+      "schemaVersion": 1,
+      "generated": true,
+      "instruction": "CLAUDE.md",
+      "hooks": ".claude/settings.json",
+      "skills": ".claude/skills",
+      "capabilities": {
+        "nativeHooks": true,
+        "hookEnforcement": "native-feedback-plus-ci",
+        "hardGate": "provider-neutral-ci-required"
+      },
+      "exclusions": []
+    },
+    "codex": {
+      "schemaVersion": 1,
+      "generated": true,
+      "instruction": "AGENTS.md",
+      "hooks": ".codex/hooks.json",
+      "skills": ".agents/skills",
+      "capabilities": {
+        "nativeHooks": true,
+        "hookEnforcement": "native-feedback-plus-ci",
+        "hardGate": "provider-neutral-ci-required"
+      },
+      "exclusions": []
+    },
+    "generic": {
+      "schemaVersion": 1,
+      "generated": false,
+      "instruction": "AGENTS.md",
+      "hooks": null,
+      "skills": ".agents/skills",
+      "capabilities": {
+        "nativeHooks": false,
+        "hookEnforcement": "ci-only",
+        "hardGate": "provider-neutral-ci-required"
+      },
+      "exclusions": [
+        {
+          "scope": "native-hooks",
+          "reasonCode": "NATIVE_HOOK_API_UNAVAILABLE",
+          "detail": "This runtime has no declared native hook surface; hook-independent governance checks remain authoritative."
+        },
+        {
+          "scope": "provider-skills",
+          "reasonCode": "NO_DISCOVERY_SURFACE_DECLARED",
+          "detail": "This abstract provider has no independent skill discovery surface; a concrete provider must register one before generation."
+        }
+      ]
+    }
+  },
+  "authority": "provider-neutral governance check + protected CI",
+  "generatedBy": "scripts/build-fork-governance.mjs"
+}

package/ds-canonical/fork/consumer/lock.schema.json

@@ -0,0 +1,338 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Qijenchen consumer governance lock",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "$schema",
+    "schemaVersion",
+    "role",
+    "release",
+    "upgradeTrust",
+    "upgradeProtocol",
+    "payload",
+    "providers",
+    "authority",
+    "generatedBy"
+  ],
+  "properties": {
+    "$schema": {
+      "const": "./lock.schema.json"
+    },
+    "schemaVersion": {
+      "const": 1
+    },
+    "role": {
+      "const": "template-consumer"
+    },
+    "release": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "designSystem",
+        "storybookConfig"
+      ],
+      "properties": {
+        "designSystem": {
+          "type": "string"
+        },
+        "storybookConfig": {
+          "type": "string"
+        }
+      }
+    },
+    "upgradeTrust": {
+      "const": {
+        "schemaVersion": 1,
+        "repository": "ajenchen/design-system",
+        "workflow": ".github/workflows/release.yml",
+        "workflowRef": "refs/heads/main",
+        "provenancePredicate": "https://slsa.dev/provenance/v1",
+        "builderId": "https://github.com/actions/runner/github-hosted",
+        "immutableRelease": true,
+        "releaseBomAsset": "release-bom.json",
+        "upgradePackages": [
+          "@qijenchen/design-system",
+          "@qijenchen/storybook-config"
+        ],
+        "releasePackages": [
+          "@qijenchen/design-system",
+          "@qijenchen/governance",
+          "@qijenchen/storybook-config"
+        ]
+      }
+    },
+    "upgradeProtocol": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schemaVersion",
+        "protocolId",
+        "legacyEntryMode",
+        "bootstrapEvidenceContract",
+        "controlPlaneUpdateMode",
+        "controlPlaneUpdateEvidenceContract",
+        "controlPlaneUpdatePlanner",
+        "ordinaryUpgradeMode",
+        "protectedBaseVerifier",
+        "candidateCodeExecutionAllowed",
+        "physicalPowerLossDurabilityClaimed",
+        "specificationSha256",
+        "schemaSha256",
+        "implementationSha256"
+      ],
+      "properties": {
+        "schemaVersion": {
+          "const": 2
+        },
+        "protocolId": {
+          "const": "protected-base-reconstruction-v2"
+        },
+        "legacyEntryMode": {
+          "const": "one-time-reviewed-full-snapshot-pr"
+        },
+        "bootstrapEvidenceContract": {
+          "const": "consumer-governance-bootstrap-readback-v1"
+        },
+        "controlPlaneUpdateMode": {
+          "const": "recurring-reviewed-full-snapshot-pr"
+        },
+        "controlPlaneUpdateEvidenceContract": {
+          "const": "consumer-governance-control-plane-update-readback-v1"
+        },
+        "controlPlaneUpdatePlanner": {
+          "const": "infra/governance/bin/consumerctl.mjs"
+        },
+        "ordinaryUpgradeMode": {
+          "const": "protected-base-disposable-reconstruction"
+        },
+        "protectedBaseVerifier": {
+          "const": "scripts/verify-upgrade-evidence.mjs"
+        },
+        "candidateCodeExecutionAllowed": {
+          "const": false
+        },
+        "physicalPowerLossDurabilityClaimed": {
+          "const": false
+        },
+        "specificationSha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "schemaSha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "implementationSha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        }
+      }
+    },
+    "payload": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "forkCorpusLockSha256",
+        "discoveryPolicySha256",
+        "providerMaterializersSha256",
+        "providerLifecycleSha256",
+        "providerInventorySha256",
+        "executionRuntimeSha256",
+        "commonInstructionSha256",
+        "providerArtifactDigests",
+        "mergeSurfaceDigests",
+        "governanceCheckSha256",
+        "utilityRegistrySha256",
+        "sharedSkillsSha256",
+        "sharedSkillCount",
+        "requiredScripts",
+        "managedFiles"
+      ],
+      "properties": {
+        "forkCorpusLockSha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "discoveryPolicySha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "providerMaterializersSha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "providerLifecycleSha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "providerInventorySha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "executionRuntimeSha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "commonInstructionSha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "providerArtifactDigests": {
+          "type": "object",
+          "minProperties": 1,
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "instructionSha256",
+              "hookSha256",
+              "skillsSha256",
+              "treeDigests"
+            ],
+            "properties": {
+              "instructionSha256": {
+                "type": [
+                  "string",
+                  "null"
+                ],
+                "pattern": "^[a-f0-9]{64}$"
+              },
+              "hookSha256": {
+                "type": [
+                  "string",
+                  "null"
+                ],
+                "pattern": "^[a-f0-9]{64}$"
+              },
+              "skillsSha256": {
+                "type": [
+                  "string",
+                  "null"
+                ],
+                "pattern": "^[a-f0-9]{64}$"
+              },
+              "treeDigests": {
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string",
+                  "pattern": "^[a-f0-9]{64}$"
+                }
+              }
+            }
+          }
+        },
+        "mergeSurfaceDigests": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          }
+        },
+        "governanceCheckSha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "utilityRegistrySha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "sharedSkillsSha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "sharedSkillCount": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "requiredScripts": {
+          "type": "object",
+          "minProperties": 1,
+          "additionalProperties": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "managedFiles": {
+          "type": "object",
+          "minProperties": 1,
+          "additionalProperties": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          }
+        }
+      }
+    },
+    "providers": {
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "schemaVersion",
+          "generated",
+          "instruction",
+          "hooks",
+          "skills",
+          "capabilities",
+          "exclusions"
+        ],
+        "properties": {
+          "schemaVersion": {
+            "const": 1
+          },
+          "generated": {
+            "type": "boolean"
+          },
+          "instruction": {
+            "type": "string",
+            "minLength": 1
+          },
+          "hooks": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "skills": {
+            "type": "string",
+            "minLength": 1
+          },
+          "capabilities": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "nativeHooks",
+              "hookEnforcement",
+              "hardGate"
+            ],
+            "properties": {
+              "nativeHooks": {
+                "type": "boolean"
+              },
+              "hookEnforcement": {
+                "enum": [
+                  "native-feedback-plus-ci",
+                  "ci-only"
+                ]
+              },
+              "hardGate": {
+                "const": "provider-neutral-ci-required"
+              }
+            }
+          },
+          "exclusions": {
+            "type": "array"
+          }
+        }
+      }
+    },
+    "authority": {
+      "const": "provider-neutral governance check + protected CI"
+    },
+    "generatedBy": {
+      "const": "scripts/build-fork-governance.mjs"
+    }
+  }
+}

package/ds-canonical/fork/consumer/managed-files/0235cf6b3fd402a3717881dc205b5bf77aed7632e7d7d6f1811a40e3033bd816.blob

@@ -0,0 +1,145 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://qijenchen.dev/schemas/upgrade-evidence-receipt-v2.schema.json",
+  "title": "Qijenchen protected-base upgrade evidence receipt v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "baseSha",
+    "version",
+    "patchSha256",
+    "treeSha256",
+    "paths",
+    "operations",
+    "previousCorpus",
+    "incomingCorpus",
+    "provenance",
+    "authoritySha256",
+    "toolchain"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 2 },
+    "baseSha": { "$ref": "#/$defs/gitObject" },
+    "version": { "$ref": "#/$defs/version" },
+    "patchSha256": { "$ref": "#/$defs/sha256" },
+    "treeSha256": { "$ref": "#/$defs/gitObject" },
+    "paths": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/repositoryPath" }
+    },
+    "operations": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/operation" }
+    },
+    "previousCorpus": { "$ref": "#/$defs/corpus" },
+    "incomingCorpus": { "$ref": "#/$defs/corpus" },
+    "provenance": { "$ref": "#/$defs/provenance" },
+    "authoritySha256": { "$ref": "#/$defs/sha256" },
+    "toolchain": { "$ref": "#/$defs/toolchain" }
+  },
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "gitObject": { "type": "string", "pattern": "^[a-f0-9]{40}([a-f0-9]{24})?$" },
+    "version": {
+      "type": "string",
+      "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\\+[0-9A-Za-z][0-9A-Za-z.-]*)?$"
+    },
+    "repositoryPath": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!\\.git(?:/|$))[^\\u0000\\r\\n\\\\]+$"
+    },
+    "corpus": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "releaseVersion",
+        "consumerBomSha256",
+        "forkCorpusLockSha256",
+        "manifestSha256",
+        "providerLifecycleSha256"
+      ],
+      "properties": {
+        "releaseVersion": { "$ref": "#/$defs/version" },
+        "consumerBomSha256": { "$ref": "#/$defs/sha256" },
+        "forkCorpusLockSha256": { "$ref": "#/$defs/sha256" },
+        "manifestSha256": { "$ref": "#/$defs/sha256" },
+        "providerLifecycleSha256": { "$ref": "#/$defs/sha256" }
+      }
+    },
+    "package": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "version", "integrity"],
+      "properties": {
+        "name": { "enum": ["@qijenchen/design-system", "@qijenchen/storybook-config"] },
+        "version": { "$ref": "#/$defs/version" },
+        "integrity": { "type": "string", "pattern": "^sha512-[A-Za-z0-9+/]+={0,2}$" }
+      }
+    },
+    "provenance": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "repository",
+        "workflow",
+        "tag",
+        "tagObject",
+        "gitCommit",
+        "gitTree",
+        "bomSha256",
+        "releaseAssetDigest",
+        "releaseSetSha256",
+        "finalizationReceiptSha256",
+        "releaseTrustEvidenceSha256",
+        "packages"
+      ],
+      "properties": {
+        "repository": { "const": "ajenchen/design-system" },
+        "workflow": { "const": ".github/workflows/release.yml" },
+        "tag": { "type": "string", "pattern": "^v\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\\+[0-9A-Za-z][0-9A-Za-z.-]*)?$" },
+        "tagObject": { "$ref": "#/$defs/gitObject" },
+        "gitCommit": { "$ref": "#/$defs/gitObject" },
+        "gitTree": { "$ref": "#/$defs/gitObject" },
+        "bomSha256": { "$ref": "#/$defs/sha256" },
+        "releaseAssetDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "releaseSetSha256": { "$ref": "#/$defs/sha256" },
+        "finalizationReceiptSha256": { "oneOf": [{ "$ref": "#/$defs/sha256" }, { "type": "null" }] },
+        "releaseTrustEvidenceSha256": { "oneOf": [{ "$ref": "#/$defs/sha256" }, { "type": "null" }] },
+        "packages": {
+          "type": "array",
+          "prefixItems": [
+            { "allOf": [{ "$ref": "#/$defs/package" }, { "type": "object", "properties": { "name": { "const": "@qijenchen/design-system" } } }] },
+            { "allOf": [{ "$ref": "#/$defs/package" }, { "type": "object", "properties": { "name": { "const": "@qijenchen/storybook-config" } } }] }
+          ],
+          "items": false,
+          "minItems": 2,
+          "maxItems": 2
+        }
+      }
+    },
+    "operation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "status"],
+      "properties": {
+        "path": { "$ref": "#/$defs/repositoryPath" },
+        "status": { "enum": ["A", "M", "D"] }
+      }
+    },
+    "toolchain": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["node", "npm"],
+      "properties": {
+        "node": { "type": "string", "pattern": "^v\\d+\\.\\d+\\.\\d+$" },
+        "npm": { "const": "11.19.0" }
+      }
+    }
+  }
+}