{ "schemaVersion": 1, "contract": "kungfu-buildchain-runtime-contract-world", "product": { "name": "Buildchain", "package": "@kungfu-tech/buildchain", "version": "4.0.0", "repository": "https://github.com/kungfu-systems/buildchain" }, "majorLine": "v4", "compatibilityPolicy": "major-compatible", "surfaces": [ { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "reusable-build", "kind": "workflow", "path": ".github/workflows/.build.yml", "publicRef": "kungfu-systems/buildchain/.github/workflows/.build.yml@v4", "requiredInputs": [], "requiredOutputs": [ "buildchain-runtime-sha", "publish-source-sha", "build-summary-artifact", "release-candidate-artifact" ], "breakingDefaults": { "buildchainRefDefault": "workflow-shell-ref-or-v3", "promoteOnlyHeavyBuildPolicy": "pr-stage-only" }, "optionalInputs": [ "buildchain-ref", "runner-preset", "platforms-json", "release-candidate", "github-artifact-attestation-subject-path", "github-artifact-attestation-platform-id", "artifact-transfer-mode", "checkout-cache-mode", "checkout-cache-fallback", "checkout-cache-timeout-seconds", "checkout-cache-fetch-attempts", "buildchain-contract-lock-path", "buildchain-contract-drift-issue-mode" ], "guarantees": [ "runtime floating refs are resolved to immutable SHAs before matrix jobs", "publish source locks are verified before heavy build jobs", "release-candidate builds do not publish registry artifacts", "contract drift is checked before heavy build jobs for stable floating refs", "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification" ], "breakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa", "auditDigest": "sha256:61494dcde9c16d102b582371ee5ba2336c7fc2f43dfd253a2d427ccbb25e00ef" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "channel-build-router", "kind": "workflow", "path": ".github/workflows/build.yml", "publicRef": "kungfu-systems/buildchain/.github/workflows/build.yml@v4", "requiredInputs": [], "requiredOutputs": [ "buildchain-channel", "buildchain-runtime-sha", "build-summary-artifact" ], "breakingDefaults": { "channelDefault": "auto", "developmentDefault": "alpha", "prereleaseDefault": "alpha", "stableReleaseDefault": "stable", "ambiguousReleasePolicy": "fail-closed" }, "optionalInputs": [ "buildchain-channel", "buildchain-ref", "buildchain-alpha-contract-lock-path", "buildchain-stable-contract-lock-path", "buildchain-contract-lock-path" ], "guarantees": [ "consumers declare one build job while Buildchain selects the matching generic major channel", "development and prerelease intent select vN-alpha", "stable release intent selects vN", "ambiguous release-like intent fails before build jobs", "explicit train and exact-SHA overrides retain the reusable build trust gate", "alpha and stable channel selections use separate consumer contract locks by default" ], "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962", "auditDigest": "sha256:8cf016da272ea41214f3b17fa6f3bb406130659c4f86c4f6dd84e15d2bd0e9fe" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "release-candidate-promote", "kind": "workflow", "path": ".github/workflows/release-candidate-promote.yml", "publicRef": "kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4", "requiredInputs": [ "channel" ], "requiredOutputs": [ "promoted-sha", "built-source-sha", "release-candidate-artifact", "release-candidate-action" ], "breakingDefaults": { "channelDefault": "auto", "alphaShellDefault": "v4-alpha", "stableShellDefault": "v4", "promoteOnlyReleaseCandidate": true, "requiredStatusCheck": "check / check" }, "optionalInputs": [ "buildchain-channel", "buildchain-ref", "buildchain-alpha-contract-lock-path", "buildchain-stable-contract-lock-path", "release-candidate-workflow-file", "release-candidate-workflow-name", "resume-candidate-repository", "resume-candidate-run-id", "resume-expected-workflow-file", "resume-expected-workflow-name", "resume-expected-source-tree", "resume-expected-candidate-root", "resume-expected-candidate-runtime-sha", "resume-buildchain-runtime-sha", "resume-transaction-id", "publish-required-artifacts-json", "release-passport-kfd-1-witness-jsons", "release-passport-kfd-2-claim-jsons", "release-passport-kfd-3-prebuild-witness-jsons", "release-passport-kfd-3-artifact-witness-jsons", "release-passport-kfd-3-artifact-verify-command", "release-passport-invariant-passport-jsons", "release-passport-invariant-passport-command", "release-passport-evidence-jsons", "release-passport-attachment-command", "github-artifact-attestation-policy-json", "github-artifact-attestation-environment", "github-artifact-attestation-retention-days", "buildchain-contract-lock-path", "buildchain-contract-drift-issue-mode", "github-release", "github-release-title", "github-release-notes" ], "publishArtifactSchema": { "requirementDigest": "optional-before-publish-required-after-publish", "exactRefResolution": "missing requirement refs resolve to the promoted exact version", "exactRefTemplate": "optional ref_template expands one {version} after exact version selection", "provenanceActions": [ "built", "reused" ], "provenanceCoordinates": [ "content", "release" ], "verificationFields": [ "public_manifest", "ref", "digest", "platform", "contract_major", "parent_digest", "smoke", "evidence" ] }, "guarantees": [ "one declarative promotion job selects matching alpha or stable workflow shell, runtime, and contract lock", "router, shell, runtime, lock, publication channel, target ref, and override identities are bound before candidate download", "train and exact-SHA runtime overrides remain limited to trusted workflow_dispatch actors", "promotion reuses PR-stage release-candidate artifacts", "promotion does not run the heavy native build matrix", "a fresh workflow event can recover an exact successful candidate run after startup or router failure", "recovery validates repository, workflow, PR, ancestry, tree, candidate roots, controller evidence, manifests, archive digests, and payload bytes before mutation", "recovery emits action reused and never silently falls back to a full build", "built source and promotion channel SHA are recorded separately", "contract drift is checked before release-candidate resolution and publish", "publish-gate source locks are created by the wrapper and enforced by promote-buildchain-ref before publish side effects", "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes" ], "compatibleBreakingDigests": [ "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf" ], "breakingDigest": "sha256:5f10c81d3f80cb417960be682921884639c40b6d875f1a3b1ffae7e652c3f468", "auditDigest": "sha256:13e000bc36e25a972e5c76bafb138cf84361237650ed28529ebd7daf7f2c3025" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "advanced-release-candidate-promote", "kind": "workflow", "path": ".github/workflows/.release-candidate-promote.yml", "publicRef": "kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4", "requiredInputs": [ "channel" ], "requiredOutputs": [ "promoted-sha", "built-source-sha", "release-candidate-artifact", "release-candidate-action" ], "breakingDefaults": { "promoteOnlyReleaseCandidate": true, "requiredStatusCheck": "check / check" }, "optionalInputs": [ "buildchain-ref", "buildchain-expected-channel", "buildchain-expected-major", "buildchain-contract-lock-path", "promotion-router-ref", "promotion-router-sha", "promotion-shell-ref", "promotion-shell-sha", "promotion-runtime-ref", "promotion-runtime-sha", "promotion-contract-lock-path", "promotion-contract-lock-digest", "promotion-publication-channel", "promotion-target-ref", "promotion-override-used", "resume-candidate-repository", "resume-candidate-run-id", "resume-expected-workflow-file", "resume-expected-workflow-name", "resume-expected-source-tree", "resume-expected-candidate-root", "resume-expected-candidate-runtime-sha", "resume-buildchain-runtime-sha", "resume-transaction-id" ], "guarantees": [ "advanced promotion verifies routed shell, runtime, lock, publication channel, and target bindings before candidate resolution", "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix", "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph" ], "compatibleBreakingDigests": [ "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0" ], "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5", "auditDigest": "sha256:adb76e2a8ddd7b8323beb6f2da775aee394c5be6992262ff053a5bc745b2a033" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "web-surface", "kind": "workflow", "path": ".github/workflows/.web-surface.yml", "publicRef": "kungfu-systems/buildchain/.github/workflows/.web-surface.yml@v4", "requiredInputs": [], "requiredOutputs": [ "buildchain-runtime-sha", "web-surface-channel", "web-surface-url", "web-surface-manifest-json" ], "breakingDefaults": { "buildchainRefDefault": "workflow-shell-ref-or-v3", "contractCompatibilityPolicy": "major-compatible", "breakingDriftPolicy": "fail-closed-before-build" }, "optionalInputs": [ "buildchain-ref", "buildchain-contract-lock-path", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "build-command", "verify-command", "artifact-path", "preview-apply", "staging-apply", "production-apply", "production-release-on-main" ], "guarantees": [ "runtime floating refs are resolved to immutable SHAs before caller build and deploy work", "contract drift is checked before caller build, web-surface render, deploy planning, and apply side effects", "compatible contract drift continues and produces a consumer issue or summary", "breaking contract drift fails closed before rendering, deployment, or release publication", "effective channel and preview alias are injected before caller build and verify commands", "channel-aware artifact host facts are checked against the deploy plan before adapter side effects" ], "breakingDigest": "sha256:27f0cb9c7d97288850d215be8696b323471c41fd1cdf3a2ff3ebf21f62541960", "auditDigest": "sha256:748e1d69ca28b631e86788de0ff359b11164b3ac1edda1b146ca49f3ac3856dc" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "auditable-demo", "kind": "workflow", "path": ".github/workflows/.auditable-demo.yml", "publicRef": "kungfu-systems/buildchain/.github/workflows/.auditable-demo.yml@v4", "requiredInputs": [ "source-artifact-name", "source-artifact-digest", "adapter-path", "renderer-image" ], "requiredOutputs": [ "source-sha", "gate-artifact-name", "gate-artifact-id", "gate-artifact-digest", "gate-artifact-url", "gate-root", "media-artifact-name", "media-artifact-id", "media-artifact-digest", "media-artifact-url", "media-root", "media-profile", "media-qualification-root" ], "breakingDefaults": { "trustedEventRequired": true, "renderMediaDefault": false, "mediaProfileDefault": "archive-v1", "artifactRetentionDaysDefault": 14, "gatePolicy": "required-before-selective-render" }, "optionalInputs": [ "buildchain-repository", "source-ref", "render-media", "media-profile", "artifact-retention-days", "require-trusted-event" ], "guarantees": [ "the source GitHub Artifact is admitted by exact same-run name and archive digest", "the checked-in consumer adapter runs from the exact consumer source with a disposable home and reduced environment", "every invocation runs an immutable network-disabled renderer smoke before emitting a qualified Gate bundle", "complete media rendering is optional and consumes only an exact passing Gate bundle", "Gate and media bundles expose both GitHub Artifact archive coordinates and deterministic member roots", "explicit web-delivery profiles independently verify codec, container, audio, dimensions, duration, byte budgets, rendition roles, and MP4 fast-start evidence", "media receipts expose content-addressed rendition facts without requiring consumers to infer roles from filenames", "Build Images owns encoding, Buildchain owns qualification and receipts, and site repositories own browser loading and accessibility behavior", "media qualification does not claim browser playback, responsive layout, reduced-motion behavior, accessibility, or production deployment" ], "breakingDigest": "sha256:425f8d3d1ba205dd6fe35a20f1dc6dad7d7c563872283e3af79fea4d5c475692", "auditDigest": "sha256:4f0051783d637ff25a1154379dc0eb77a246ad7aee18e12a5e8ff0107aa61a90" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "declarative-auditable-demo", "kind": "workflow", "path": ".github/workflows/.declarative-auditable-demo.yml", "publicRef": "kungfu-systems/buildchain/.github/workflows/.declarative-auditable-demo.yml@v4", "requiredInputs": [ "binary-artifact-name", "binary-artifact-digest", "renderer-image" ], "requiredOutputs": [ "source-sha", "capture-artifact-name", "capture-artifact-digest", "evidence-artifact-name", "evidence-artifact-digest", "publication-pr-url" ], "breakingDefaults": { "scenarioPathDefault": ".buildchain/auditable-demo.json", "renderMediaDefault": false, "materializeDefault": false, "mediaProfileDefault": "responsive-web-delivery-v1", "artifactRetentionDaysDefault": 14, "executionBoundary": "exact-binary-network-none-secret-free-60-seconds" }, "optionalInputs": [ "buildchain-repository", "source-ref", "scenario-path", "render-media", "media-profile", "materialize", "materialize-base-ref", "artifact-retention-days" ], "guarantees": [ "one versioned declaration can contain multiple demos with multiple ordered literal argv steps", "every demo uses the exact same-run standalone binary admitted by producer-owned artifact name and digest", "capture runs without network or inherited secrets and retains independent native 1080p and 720p terminal dimensions", "the generic adapter feeds the required auditable demo Gate and immutable renderer without product-specific glue", "full rendering emits a content-addressed Release Passport and idempotent protected README update pull request", "manual, alpha, and release callers use the same capture, Gate, renderer, passport, and materializer implementation", "identity, compliance, Product System metadata, package metadata, registry history, scans, and generation grant no authority" ], "breakingDigest": "sha256:0bcba689ab5060e12230db4118895242ecb48677ff581ea0360b1833bdac558c", "auditDigest": "sha256:da366842e8943c88a4f12520faf2d19c555b7530d8f6d44cf75a37b94200960d" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "promote-buildchain-ref-action", "kind": "action", "path": "actions/promote-buildchain-ref/action.yml", "publicRef": "kungfu-systems/buildchain/actions/promote-buildchain-ref@v4", "requiredInputs": [ "token", "sha", "target-ref" ], "requiredOutputs": [ "sha" ], "breakingDefaults": { "requireGovernance": false, "releasePassport": true, "requiredStatusCheck": "check / check" }, "optionalInputs": [ "publish-transaction", "publish-required-artifacts-json", "promote-only-release-candidate", "release-passport-kfd-1-witness-jsons", "release-passport-kfd-2-claim-jsons", "release-passport-kfd-3-prebuild-witness-jsons", "release-passport-kfd-3-artifact-witness-jsons", "release-passport-kfd-3-artifact-verify-command", "release-passport-invariant-passport-jsons", "release-passport-invariant-passport-command", "release-passport-evidence-jsons", "release-passport-attachment-command", "release-passport-github-artifact-attestation-policy-jsons", "github-release", "github-release-title", "github-release-notes" ], "publishArtifactSchema": { "requirementDigest": "optional-before-publish-required-after-publish", "exactRefResolution": "missing requirement refs resolve to the promoted exact version", "exactRefTemplate": "optional ref_template expands one {version} after exact version selection", "provenanceActions": [ "built", "reused" ], "provenanceCoordinates": [ "content", "release" ], "verificationFields": [ "public_manifest", "ref", "digest", "platform", "contract_major", "parent_digest", "smoke", "evidence" ] }, "guarantees": [ "protected release refs and durable release-state are finalized by Buildchain", "release passport finalization is idempotent after publish side effects", "publish transactions can require a resolved publish-gate source lock to prevent floating-ref drift", "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata bound to the authoritative publication channel and tag syntax retained as the fallback for ordinary callers" ], "compatibleBreakingDigests": [ "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874" ], "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda", "auditDigest": "sha256:8e89dd8296e68d52872ca78ba9d97c4493702eb3c33ab5315faeadbdf10d8c00" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "macos-credential-island-action", "kind": "action", "path": "actions/macos-credential-island/action.yml", "publicRef": "kungfu-systems/buildchain/actions/macos-credential-island@v4", "requiredInputs": [ "input-root", "output-root", "source-repository", "source-sha", "source-tree-sha", "buildchain-runtime-sha", "artifact-name", "expected-bundle-id", "expected-team-id", "certificate-sha1", "certificate-p12-base64", "certificate-password", "notary-api-key-p8-base64", "notary-api-key-id", "notary-api-issuer" ], "requiredOutputs": [ "evidence-path", "manifest-path", "artifact-root", "dmg-path", "zip-path", "dmg-sha256", "zip-sha256" ], "breakingDefaults": { "entitlementsProfile": "electron-desktop-v1", "credentialBoundary": "protected-caller-job", "consumerCodeExecution": "forbidden" }, "optionalInputs": [ "source-ref", "platform-id", "entitlements-profile", "artifact-stem", "artifact-relative-output" ], "guarantees": [ "the action validates a source-bound sealed app before credentials are imported", "the action accepts one exact Developer ID Application fingerprint and a Buildchain-owned entitlements profile", "consumer source and artifact-contained executables are never invoked", "the app and DMG are notarized, stapled, Gatekeeper assessed, and bound to retained evidence", "temporary keychain and API key material are cleaned in both main and post phases" ], "breakingDigest": "sha256:61866985864205770c70cbe14c3c60f479512a32c0b007b5fd6d8d65132ff8be", "auditDigest": "sha256:60c44e35de1788c4c4c2529cb491914054df0b604539758e230ff31ad6dfdab2" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "report-buildchain-issue-action", "kind": "action", "path": "actions/report-buildchain-issue/action.yml", "publicRef": "kungfu-systems/buildchain/actions/report-buildchain-issue@v4", "requiredInputs": [ "token" ], "requiredOutputs": [ "ok", "action", "issue-url", "fingerprint" ], "breakingDefaults": { "failOnError": false, "mode": "create-or-comment" }, "optionalInputs": [ "report-kind", "target-repository", "body-file", "comment-cooldown-hours" ], "guarantees": [ "issue reporting is fail-soft by default", "GitHub API 429 and 5xx failures are retried", "missing issue permissions produce a copyable summary fallback" ], "breakingDigest": "sha256:575a2cb02cdb2e61bb2e84d5bbaaf64b430aa5d7936645660b592de4549d81b0", "auditDigest": "sha256:10b766e026f8089235dfd6a9356cdbfa42c5dd290ba3003e5fcfd886432a0a34" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "release-passport-schema", "kind": "schema", "path": "packages/core/release-passport.js", "requiredInputs": [ "buildchain.release.json" ], "requiredOutputs": [ "check-report.json" ], "breakingDefaults": { "schemaVersion": 1, "contract": "kungfu-buildchain-release-passport" }, "guarantees": [ "release passport verification fails closed for malformed required evidence", "release-state SHA is recorded as a durable audit entrance" ], "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad", "auditDigest": "sha256:34f8048ea82b0696bfb7fa7d2eba2b09a5e51eaf5ab9a9857e278c7d005427dc" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "kfd-1-release-gate", "kind": "schema", "path": "packages/core/kfd-gate.js", "requiredInputs": [ "KFD-1 witness JSON" ], "requiredOutputs": [ "kfd-1 release gate evidence" ], "breakingDefaults": { "witnessContract": "kungfu-buildchain-kfd-1-witness-set", "releaseGateContract": "kungfu-buildchain-kfd-1-release-gate" }, "guarantees": [ "KFD-1 witnesses must include at least one artifact byte surface", "artifact bytes are sha256 checked before passport finalization succeeds", "KFD self contract witnesses record source/artifact hashes, self-hosting boundary, and responsibility state" ], "breakingDigest": "sha256:f46c1f67b94957ad956cf70db59a73fd5690bd67c91edf9c2d0eb8f3d1e3cf8d", "auditDigest": "sha256:f31691f36f2a7930798805cb470aff7acd3503799cb72b954c7787b1d8b3eb31" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "kfd-2-release-trust-passport-audit", "kind": "schema", "path": "packages/core/release-passport.js", "requiredInputs": [ "public release claim evidence" ], "requiredOutputs": [ "kfd-2 release trust passport audit" ], "breakingDefaults": { "releaseTrustPassportContract": "kungfu-buildchain-kfd-2-release-trust-passport-audit" }, "guarantees": [ "public release claims must bind declared sources, machine evidence, hashes, artifacts, verification, audit boundary, responsibility, and residual risk", "unbound public claims fail release passport verification", "prose-only public claims downgrade the release trust passport audit" ], "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16", "auditDigest": "sha256:34f8048ea82b0696bfb7fa7d2eba2b09a5e51eaf5ab9a9857e278c7d005427dc" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "kfd-3-collaboration-interface-release-gate", "kind": "schema", "path": "packages/core/kfd-gate.js", "requiredInputs": [ "KFD-3 prebuild witness JSON", "KFD-3 artifact witness JSON or verify command" ], "requiredOutputs": [ "kfd-3 collaboration-interface release gate evidence" ], "breakingDefaults": { "prebuildWitnessContract": "kungfu-buildchain-kfd-3-collaboration-interface-prebuild-witness", "artifactWitnessContract": "kungfu-buildchain-kfd-3-collaboration-interface-artifact-witness", "releaseGateContract": "kungfu-buildchain-kfd-3-collaboration-interface-release-gate" }, "guarantees": [ "KFD-3 pre-build witnesses must declare participant-facing public surfaces", "artifact witnesses must not expose undeclared public participant-facing surfaces", "collaborationInterface.digest mismatches fail passport verification", "KFD repository self-verification can declare docs, schemas, standards metadata, package exports, and site-consumption contracts", "KFD-3 passports expose releaseStatus, witness hashes, declared capability verification, reverse audit boundary, residual risk, and responsibility state" ], "breakingDigest": "sha256:33654f3444c893754aacc42dde3051f0a371bd17c6ef7c657c579a07159cd7c1", "auditDigest": "sha256:f31691f36f2a7930798805cb470aff7acd3503799cb72b954c7787b1d8b3eb31" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "buildchain-cli", "kind": "cli", "path": "bin/buildchain.mjs", "requiredInputs": [], "requiredOutputs": [], "breakingDefaults": { "binary": "buildchain", "moduleSystem": "esm" }, "optionalInputs": [ "validate", "lifecycle", "badges readme", "homebrew update-formula", "homebrew check", "collect github-release", "verify release-passport", "release-propagation", "infra-contract" ], "guarantees": [ "CLI commands are stable within the major line unless the contract major changes", "README badge block checks and writes are generated from machine-readable repository facts" ], "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc", "auditDigest": "sha256:377a975d16ffd1e36f5abd60538107380c3bd9e60337482af6aa5b1384742a1b" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "homebrew-distribution-index", "kind": "node-api", "path": "packages/core/homebrew.js", "requiredInputs": [ "upstream release passport" ], "requiredOutputs": [ "kungfu-buildchain-homebrew-tap-facts", "kungfu-buildchain-homebrew-tap-manifest", "Formula/*.rb" ], "breakingDefaults": { "projectType": "distribution-index", "tapManifest": "tap-manifest.json", "kfdPassedSource": "verified upstream release passport" }, "optionalInputs": [ "buildchain.toml [project] type=distribution-index", "Formula path", "manifest path", "release passport URL or local path" ], "guarantees": [ "Formula metadata is a deterministic projection of upstream release passport evidence", "tap-manifest.json is checked against upstream version, URLs, SHA-256 digests, and KFD status", "KFD passed claims fail closed unless the upstream release passport verifies the corresponding section", "CLI and JavaScript callers use the same Node API implementation" ], "breakingDigest": "sha256:148c0387ff4cea76433bbde80cd9d77c5aa67e1a29856ced33e4d819366f2213", "auditDigest": "sha256:0e978219bd6fca754d80a616d538d5825b116eec78b65857bbe5063b8c84d933" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "readme-badge-facts", "kind": "node-api", "path": "packages/core/readme-badges.js", "requiredInputs": [ "repository checkout" ], "requiredOutputs": [ "kungfu-buildchain-readme-badge-facts" ], "breakingDefaults": { "markerStart": "", "markerEnd": "", "kfdPassedSource": "verified repository-owned release passport" }, "optionalInputs": [ "buildchain.toml [badges]", "release passport URL or local path", "workflow file list", "platform declarations" ], "guarantees": [ "README badge Markdown is a deterministic projection of badge facts", "KFD passed badges require the repository's own verified release passport section", "unreleased repositories downgrade KFD status to explicit non-passed declarations", "CLI and JavaScript callers use the same Node API implementation" ], "breakingDigest": "sha256:bcd72ad6dfba8013c96f8b2f7b0a307d2e7713972a1219348f0d5ecc493939a0", "auditDigest": "sha256:13914ebabbc92ed49dd842c2aa51cc99d72b0732423c0b53a030c6458a0cd9d8" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "agent-manual-registry", "kind": "site-contract", "path": "dist/site/manual-registry.json", "requiredInputs": [], "requiredOutputs": [ "manuals", "requiredAgentManuals" ], "breakingDefaults": { "contract": "kungfu-buildchain-agent-manual-registry" }, "guarantees": [ "agent-facing packaged docs are enumerable from the npm package site bundle", "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation" ], "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2", "auditDigest": "sha256:85c040a0ee2e9e65839221e0c7682fefb544e9290a213d57e76baa54ef2add54" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "node-api-registry", "kind": "site-contract", "path": "dist/site/node-api-registry.json", "requiredInputs": [], "requiredOutputs": [ "exports" ], "breakingDefaults": { "contract": "kungfu-buildchain-node-api-registry", "moduleSystem": "module" }, "guarantees": [ "public Node import surfaces are derived from package.json exports", "agents can discover supported Node APIs without importing internal file paths" ], "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945", "auditDigest": "sha256:d905e94317be3fccf0f4f627041ba91b68623993ed896d535fda475b69b9b88d" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "controller:source-check", "kind": "controller", "path": ".github/workflows/check.yml", "requiredInputs": [], "requiredOutputs": [ "controller-plan-json", "controller-plan-digest", "controller-receipt-json", "controller-receipt-digest", "controller-receipt-status" ], "breakingDefaults": { "evidenceContract": "buildchain.controller-evidence/v1", "descriptorVersion": 1, "workflowPath": ".github/workflows/check.yml", "requiredStages": [ "resolve-runtime", "checkout-source", "install", "check", "aggregate" ], "capabilities": [ "source-acceptance", "lifecycle-check" ], "evidenceRequirements": [ "lifecycle-manifest", "lifecycle-summary", "controller-receipt" ], "inputClassificationPolicy": "buildchain-controller-input-policy/v1" }, "optionalInputs": [ "buildchain-ref", "buildchain-repository", "mode", "node-version", "require-version-state", "upload-artifacts", "working-directory" ], "controllerDescriptor": { "contract": "buildchain.controller-descriptor/v1", "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48", "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d", "inputClassifications": { "buildchain-ref": { "classification": "included", "source": "workflow-call-input" }, "buildchain-repository": { "classification": "included", "source": "workflow-call-input" }, "mode": { "classification": "included", "source": "workflow-call-input" }, "node-version": { "classification": "included", "source": "workflow-call-input" }, "require-version-state": { "classification": "included", "source": "workflow-call-input" }, "upload-artifacts": { "classification": "included", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" } } }, "guarantees": [ "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest", "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes", "redacted input values are never serialized and digest-only input values are never emitted in plaintext", "missing receipts are non-qualifying and must not be represented as a successful controller run" ], "breakingDigest": "sha256:d4bd0f2a1921bfed71a4d9104d45934555bde74a5c189f93ad79f37074c02b87", "auditDigest": "sha256:3687beefbc336c6b6d3ca2d71fe8668e13832382ac4b6fc8847ed39bb9737ec8" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "controller:build-lifecycle", "kind": "controller", "path": ".github/workflows/.build.yml", "requiredInputs": [], "requiredOutputs": [ "controller-plan-json", "controller-plan-digest", "controller-receipt-json", "controller-receipt-digest", "controller-receipt-status" ], "breakingDefaults": { "evidenceContract": "buildchain.controller-evidence/v1", "descriptorVersion": 1, "workflowPath": ".github/workflows/.build.yml", "requiredStages": [ "resolve-runtime", "resolve-source", "build", "signing-finalization", "verify", "aggregate" ], "capabilities": [ "source-lock", "lifecycle-build", "artifact-signing-finalization", "credential-island", "lifecycle-verify", "artifact-admission" ], "evidenceRequirements": [ "platform-manifests", "build-summary", "controller-receipt" ], "inputClassificationPolicy": "buildchain-controller-input-policy/v1" }, "optionalInputs": [ "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN", "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64", "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD", "BUILDCHAIN_MACOS_NOTARY_API_ISSUER", "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID", "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64", "BUILDCHAIN_PROMOTION_TOKEN", "artifact-compression-level", "artifact-finalization-command", "artifact-finalization-on-platform", "artifact-name", "artifact-name-template", "artifact-paths", "artifact-relay-s3-bucket", "artifact-relay-s3-download-role-arn", "artifact-relay-s3-oidc-audience", "artifact-relay-s3-prefix", "artifact-relay-s3-region", "artifact-relay-s3-role-arn", "artifact-relay-s3-upload-role-arn", "artifact-retention-days", "artifact-signing-request-upload-no-proxy", "artifact-transfer-mode", "aws-codebuild-project", "aws-ec2-macos-runner-label", "aws-ec2-windows-runner-label", "build-command", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-expected-channel", "buildchain-expected-major", "buildchain-ref", "buildchain-repository", "cache-dependency-lock-root", "cache-policy-root", "cache-toolchain-root", "cargo-registry-index", "checkout-cache-fallback", "checkout-cache-fetch-attempts", "checkout-cache-github-timeout-seconds", "checkout-cache-mirror-url-template", "checkout-cache-mode", "checkout-cache-reference-repository-template", "checkout-cache-timeout-seconds", "checkout-history-mode", "compiler-cache-platforms-json", "compiler-cache-provider", "compiler-cache-required", "control-runner-json", "credential-island-caller-owned", "credential-island-environment", "credential-island-macos-app-path", "credential-island-macos-platform-id", "expected-artifacts-json", "fail-fast", "gate-profile-aggregate-json", "github-artifact-attestation-platform-id", "github-artifact-attestation-signer-sha", "github-artifact-attestation-subject-path", "install-command", "kfd-agent-hub", "lifecycle-timeout-minutes", "linux-container-image", "linux-container-preset", "node-version", "platforms-json", "pre-upload-transport-smoke-artifact-root", "pre-upload-transport-smoke-scenario-path", "process-sample-interval-ms", "process-summary-path", "publish-anchor-request-json", "publish-channel", "publish-refs-json", "publish-registry", "publish-source-ref", "release-candidate", "release-candidate-family-evidence-json", "requested-parallelism", "require-build", "require-install", "require-trusted-event", "require-verify", "runner-preset", "rust-toolchain", "rustup-dist-server", "rustup-update-root", "sample-process-tree", "self-hosted-offline-fallback", "setup-node", "setup-rust", "shifu-cache-profile-digest", "shifu-cache-profile-ref", "untrusted-policy", "verify-command", "verify-substage-evidence-path", "working-directory" ], "controllerDescriptor": { "contract": "buildchain.controller-descriptor/v1", "digest": "sha256:18bd484d8425b54ad533adde64f874c151a0a90de878c5498cfb99709cb53ea3", "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d", "inputClassifications": { "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_NOTARY_API_ISSUER": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_PROMOTION_TOKEN": { "classification": "redacted", "source": "workflow-call-secret" }, "artifact-compression-level": { "classification": "included", "source": "workflow-call-input" }, "artifact-finalization-command": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-finalization-on-platform": { "classification": "included", "source": "workflow-call-input" }, "artifact-name": { "classification": "included", "source": "workflow-call-input" }, "artifact-name-template": { "classification": "included", "source": "workflow-call-input" }, "artifact-paths": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-bucket": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-download-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-oidc-audience": { "classification": "included", "source": "workflow-call-input" }, "artifact-relay-s3-prefix": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-region": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-upload-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-retention-days": { "classification": "included", "source": "workflow-call-input" }, "artifact-signing-request-upload-no-proxy": { "classification": "included", "source": "workflow-call-input" }, "artifact-transfer-mode": { "classification": "included", "source": "workflow-call-input" }, "aws-codebuild-project": { "classification": "included", "source": "workflow-call-input" }, "aws-ec2-macos-runner-label": { "classification": "digest-only", "source": "workflow-call-input" }, "aws-ec2-windows-runner-label": { "classification": "digest-only", "source": "workflow-call-input" }, "build-command": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-contract-compatibility-policy": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-drift-issue-mode": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-expected-channel": { "classification": "included", "source": "workflow-call-input" }, "buildchain-expected-major": { "classification": "included", "source": "workflow-call-input" }, "buildchain-ref": { "classification": "included", "source": "workflow-call-input" }, "buildchain-repository": { "classification": "included", "source": "workflow-call-input" }, "cache-dependency-lock-root": { "classification": "included", "source": "workflow-call-input" }, "cache-policy-root": { "classification": "included", "source": "workflow-call-input" }, "cache-toolchain-root": { "classification": "included", "source": "workflow-call-input" }, "cargo-registry-index": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-fallback": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-fetch-attempts": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-github-timeout-seconds": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-mirror-url-template": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-mode": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-reference-repository-template": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-timeout-seconds": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-history-mode": { "classification": "included", "source": "workflow-call-input" }, "compiler-cache-platforms-json": { "classification": "digest-only", "source": "workflow-call-input" }, "compiler-cache-provider": { "classification": "included", "source": "workflow-call-input" }, "compiler-cache-required": { "classification": "included", "source": "workflow-call-input" }, "control-runner-json": { "classification": "digest-only", "source": "workflow-call-input" }, "credential-island-caller-owned": { "classification": "included", "source": "workflow-call-input" }, "credential-island-environment": { "classification": "digest-only", "source": "workflow-call-input" }, "credential-island-macos-app-path": { "classification": "digest-only", "source": "workflow-call-input" }, "credential-island-macos-platform-id": { "classification": "included", "source": "workflow-call-input" }, "expected-artifacts-json": { "classification": "digest-only", "source": "workflow-call-input" }, "fail-fast": { "classification": "included", "source": "workflow-call-input" }, "gate-profile-aggregate-json": { "classification": "digest-only", "source": "workflow-call-input" }, "github-artifact-attestation-platform-id": { "classification": "included", "source": "workflow-call-input" }, "github-artifact-attestation-signer-sha": { "classification": "included", "source": "workflow-call-input" }, "github-artifact-attestation-subject-path": { "classification": "digest-only", "source": "workflow-call-input" }, "install-command": { "classification": "digest-only", "source": "workflow-call-input" }, "kfd-agent-hub": { "classification": "included", "source": "workflow-call-input" }, "lifecycle-timeout-minutes": { "classification": "included", "source": "workflow-call-input" }, "linux-container-image": { "classification": "digest-only", "source": "workflow-call-input" }, "linux-container-preset": { "classification": "included", "source": "workflow-call-input" }, "node-version": { "classification": "included", "source": "workflow-call-input" }, "platforms-json": { "classification": "digest-only", "source": "workflow-call-input" }, "pre-upload-transport-smoke-artifact-root": { "classification": "included", "source": "workflow-call-input" }, "pre-upload-transport-smoke-scenario-path": { "classification": "digest-only", "source": "workflow-call-input" }, "process-sample-interval-ms": { "classification": "included", "source": "workflow-call-input" }, "process-summary-path": { "classification": "digest-only", "source": "workflow-call-input" }, "publish-anchor-request-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publish-channel": { "classification": "included", "source": "workflow-call-input" }, "publish-refs-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publish-registry": { "classification": "included", "source": "workflow-call-input" }, "publish-source-ref": { "classification": "included", "source": "workflow-call-input" }, "release-candidate": { "classification": "included", "source": "workflow-call-input" }, "release-candidate-family-evidence-json": { "classification": "digest-only", "source": "workflow-call-input" }, "requested-parallelism": { "classification": "included", "source": "workflow-call-input" }, "require-build": { "classification": "included", "source": "workflow-call-input" }, "require-install": { "classification": "included", "source": "workflow-call-input" }, "require-trusted-event": { "classification": "included", "source": "workflow-call-input" }, "require-verify": { "classification": "included", "source": "workflow-call-input" }, "runner-preset": { "classification": "digest-only", "source": "workflow-call-input" }, "rust-toolchain": { "classification": "included", "source": "workflow-call-input" }, "rustup-dist-server": { "classification": "included", "source": "workflow-call-input" }, "rustup-update-root": { "classification": "included", "source": "workflow-call-input" }, "sample-process-tree": { "classification": "included", "source": "workflow-call-input" }, "self-hosted-offline-fallback": { "classification": "included", "source": "workflow-call-input" }, "setup-node": { "classification": "included", "source": "workflow-call-input" }, "setup-rust": { "classification": "included", "source": "workflow-call-input" }, "shifu-cache-profile-digest": { "classification": "included", "source": "workflow-call-input" }, "shifu-cache-profile-ref": { "classification": "included", "source": "workflow-call-input" }, "untrusted-policy": { "classification": "included", "source": "workflow-call-input" }, "verify-command": { "classification": "digest-only", "source": "workflow-call-input" }, "verify-substage-evidence-path": { "classification": "digest-only", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" } } }, "compatibleBreakingDigests": [ "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be", "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1" ], "guarantees": [ "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest", "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes", "redacted input values are never serialized and digest-only input values are never emitted in plaintext", "missing receipts are non-qualifying and must not be represented as a successful controller run" ], "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb", "auditDigest": "sha256:61494dcde9c16d102b582371ee5ba2336c7fc2f43dfd253a2d427ccbb25e00ef" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "controller:build-channel-router", "kind": "controller", "path": ".github/workflows/build.yml", "requiredInputs": [], "requiredOutputs": [ "controller-plan-json", "controller-plan-digest", "controller-receipt-json", "controller-receipt-digest", "controller-receipt-status" ], "breakingDefaults": { "evidenceContract": "buildchain.controller-evidence/v1", "descriptorVersion": 1, "workflowPath": ".github/workflows/build.yml", "requiredStages": [ "resolve-channel", "aggregate" ], "capabilities": [ "channel-selection", "runtime-selection", "build-delegation" ], "evidenceRequirements": [ "nested-controller-receipt", "controller-receipt" ], "inputClassificationPolicy": "buildchain-controller-input-policy/v1" }, "optionalInputs": [ "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN", "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64", "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD", "BUILDCHAIN_MACOS_NOTARY_API_ISSUER", "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID", "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64", "BUILDCHAIN_PROMOTION_TOKEN", "artifact-compression-level", "artifact-finalization-command", "artifact-finalization-on-platform", "artifact-name", "artifact-name-template", "artifact-paths", "artifact-relay-s3-bucket", "artifact-relay-s3-download-role-arn", "artifact-relay-s3-oidc-audience", "artifact-relay-s3-prefix", "artifact-relay-s3-region", "artifact-relay-s3-role-arn", "artifact-relay-s3-upload-role-arn", "artifact-retention-days", "artifact-signing-request-upload-no-proxy", "artifact-transfer-mode", "aws-codebuild-project", "aws-ec2-macos-runner-label", "aws-ec2-windows-runner-label", "build-command", "buildchain-alpha-contract-lock-path", "buildchain-channel", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-expected-channel", "buildchain-expected-major", "buildchain-ref", "buildchain-repository", "buildchain-stable-contract-lock-path", "cache-dependency-lock-root", "cache-policy-root", "cache-toolchain-root", "cargo-registry-index", "checkout-cache-fallback", "checkout-cache-fetch-attempts", "checkout-cache-github-timeout-seconds", "checkout-cache-mirror-url-template", "checkout-cache-mode", "checkout-cache-reference-repository-template", "checkout-cache-timeout-seconds", "checkout-history-mode", "compiler-cache-platforms-json", "compiler-cache-provider", "compiler-cache-required", "control-runner-json", "credential-island-caller-owned", "credential-island-environment", "credential-island-macos-app-path", "credential-island-macos-platform-id", "expected-artifacts-json", "fail-fast", "gate-profile-aggregate-json", "github-artifact-attestation-platform-id", "github-artifact-attestation-signer-sha", "github-artifact-attestation-subject-path", "install-command", "kfd-agent-hub", "lifecycle-timeout-minutes", "linux-container-image", "linux-container-preset", "node-version", "platforms-json", "pre-upload-transport-smoke-artifact-root", "pre-upload-transport-smoke-scenario-path", "process-sample-interval-ms", "process-summary-path", "publish-anchor-request-json", "publish-channel", "publish-refs-json", "publish-registry", "publish-source-ref", "release-candidate", "release-candidate-family-evidence-json", "requested-parallelism", "require-build", "require-install", "require-trusted-event", "require-verify", "runner-preset", "rust-toolchain", "rustup-dist-server", "rustup-update-root", "sample-process-tree", "self-hosted-offline-fallback", "setup-node", "setup-rust", "shifu-cache-profile-digest", "shifu-cache-profile-ref", "untrusted-policy", "verify-command", "verify-substage-evidence-path", "working-directory" ], "controllerDescriptor": { "contract": "buildchain.controller-descriptor/v1", "digest": "sha256:47b73fb19d61c06911278ce99f8433596a8539097fdc18fe11f05b0d3c2109c0", "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d", "inputClassifications": { "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_NOTARY_API_ISSUER": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_PROMOTION_TOKEN": { "classification": "redacted", "source": "workflow-call-secret" }, "artifact-compression-level": { "classification": "included", "source": "workflow-call-input" }, "artifact-finalization-command": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-finalization-on-platform": { "classification": "included", "source": "workflow-call-input" }, "artifact-name": { "classification": "included", "source": "workflow-call-input" }, "artifact-name-template": { "classification": "included", "source": "workflow-call-input" }, "artifact-paths": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-bucket": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-download-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-oidc-audience": { "classification": "included", "source": "workflow-call-input" }, "artifact-relay-s3-prefix": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-region": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-relay-s3-upload-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-retention-days": { "classification": "included", "source": "workflow-call-input" }, "artifact-signing-request-upload-no-proxy": { "classification": "included", "source": "workflow-call-input" }, "artifact-transfer-mode": { "classification": "included", "source": "workflow-call-input" }, "aws-codebuild-project": { "classification": "included", "source": "workflow-call-input" }, "aws-ec2-macos-runner-label": { "classification": "digest-only", "source": "workflow-call-input" }, "aws-ec2-windows-runner-label": { "classification": "digest-only", "source": "workflow-call-input" }, "build-command": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-alpha-contract-lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-channel": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-compatibility-policy": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-drift-issue-mode": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-expected-channel": { "classification": "included", "source": "workflow-call-input" }, "buildchain-expected-major": { "classification": "included", "source": "workflow-call-input" }, "buildchain-ref": { "classification": "included", "source": "workflow-call-input" }, "buildchain-repository": { "classification": "included", "source": "workflow-call-input" }, "buildchain-stable-contract-lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "cache-dependency-lock-root": { "classification": "included", "source": "workflow-call-input" }, "cache-policy-root": { "classification": "included", "source": "workflow-call-input" }, "cache-toolchain-root": { "classification": "included", "source": "workflow-call-input" }, "cargo-registry-index": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-fallback": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-fetch-attempts": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-github-timeout-seconds": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-mirror-url-template": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-mode": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-reference-repository-template": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-timeout-seconds": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-history-mode": { "classification": "included", "source": "workflow-call-input" }, "compiler-cache-platforms-json": { "classification": "digest-only", "source": "workflow-call-input" }, "compiler-cache-provider": { "classification": "included", "source": "workflow-call-input" }, "compiler-cache-required": { "classification": "included", "source": "workflow-call-input" }, "control-runner-json": { "classification": "digest-only", "source": "workflow-call-input" }, "credential-island-caller-owned": { "classification": "included", "source": "workflow-call-input" }, "credential-island-environment": { "classification": "digest-only", "source": "workflow-call-input" }, "credential-island-macos-app-path": { "classification": "digest-only", "source": "workflow-call-input" }, "credential-island-macos-platform-id": { "classification": "included", "source": "workflow-call-input" }, "expected-artifacts-json": { "classification": "digest-only", "source": "workflow-call-input" }, "fail-fast": { "classification": "included", "source": "workflow-call-input" }, "gate-profile-aggregate-json": { "classification": "digest-only", "source": "workflow-call-input" }, "github-artifact-attestation-platform-id": { "classification": "included", "source": "workflow-call-input" }, "github-artifact-attestation-signer-sha": { "classification": "included", "source": "workflow-call-input" }, "github-artifact-attestation-subject-path": { "classification": "digest-only", "source": "workflow-call-input" }, "install-command": { "classification": "digest-only", "source": "workflow-call-input" }, "kfd-agent-hub": { "classification": "included", "source": "workflow-call-input" }, "lifecycle-timeout-minutes": { "classification": "included", "source": "workflow-call-input" }, "linux-container-image": { "classification": "digest-only", "source": "workflow-call-input" }, "linux-container-preset": { "classification": "included", "source": "workflow-call-input" }, "node-version": { "classification": "included", "source": "workflow-call-input" }, "platforms-json": { "classification": "digest-only", "source": "workflow-call-input" }, "pre-upload-transport-smoke-artifact-root": { "classification": "included", "source": "workflow-call-input" }, "pre-upload-transport-smoke-scenario-path": { "classification": "digest-only", "source": "workflow-call-input" }, "process-sample-interval-ms": { "classification": "included", "source": "workflow-call-input" }, "process-summary-path": { "classification": "digest-only", "source": "workflow-call-input" }, "publish-anchor-request-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publish-channel": { "classification": "included", "source": "workflow-call-input" }, "publish-refs-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publish-registry": { "classification": "included", "source": "workflow-call-input" }, "publish-source-ref": { "classification": "included", "source": "workflow-call-input" }, "release-candidate": { "classification": "included", "source": "workflow-call-input" }, "release-candidate-family-evidence-json": { "classification": "digest-only", "source": "workflow-call-input" }, "requested-parallelism": { "classification": "included", "source": "workflow-call-input" }, "require-build": { "classification": "included", "source": "workflow-call-input" }, "require-install": { "classification": "included", "source": "workflow-call-input" }, "require-trusted-event": { "classification": "included", "source": "workflow-call-input" }, "require-verify": { "classification": "included", "source": "workflow-call-input" }, "runner-preset": { "classification": "digest-only", "source": "workflow-call-input" }, "rust-toolchain": { "classification": "included", "source": "workflow-call-input" }, "rustup-dist-server": { "classification": "included", "source": "workflow-call-input" }, "rustup-update-root": { "classification": "included", "source": "workflow-call-input" }, "sample-process-tree": { "classification": "included", "source": "workflow-call-input" }, "self-hosted-offline-fallback": { "classification": "included", "source": "workflow-call-input" }, "setup-node": { "classification": "included", "source": "workflow-call-input" }, "setup-rust": { "classification": "included", "source": "workflow-call-input" }, "shifu-cache-profile-digest": { "classification": "included", "source": "workflow-call-input" }, "shifu-cache-profile-ref": { "classification": "included", "source": "workflow-call-input" }, "untrusted-policy": { "classification": "included", "source": "workflow-call-input" }, "verify-command": { "classification": "digest-only", "source": "workflow-call-input" }, "verify-substage-evidence-path": { "classification": "digest-only", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" } } }, "guarantees": [ "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest", "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes", "redacted input values are never serialized and digest-only input values are never emitted in plaintext", "missing receipts are non-qualifying and must not be represented as a successful controller run" ], "breakingDigest": "sha256:30549aa26cd1e1dd81f10fe3529d3c6e3f8438a6efa0100c47ebae4d2f3d71df", "auditDigest": "sha256:8cf016da272ea41214f3b17fa6f3bb406130659c4f86c4f6dd84e15d2bd0e9fe" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "controller:shifu-gate-profile-envelope", "kind": "controller", "path": ".github/workflows/.gate-profile.yml", "requiredInputs": [], "requiredOutputs": [ "controller-plan-json", "controller-plan-digest", "controller-receipt-json", "controller-receipt-digest", "controller-receipt-status" ], "breakingDefaults": { "evidenceContract": "buildchain.controller-evidence/v1", "descriptorVersion": 1, "workflowPath": ".github/workflows/.gate-profile.yml", "requiredStages": [ "plan", "execute", "aggregate" ], "capabilities": [ "shifu-gate-profile-delegation" ], "evidenceRequirements": [ "shifu-gate-aggregate", "controller-receipt" ], "inputClassificationPolicy": "buildchain-controller-input-policy/v1" }, "optionalInputs": [ "artifact-name", "artifact-retention-days", "buildchain-ref", "buildchain-repository", "cargo-registry-index", "checkout-cache-fallback", "checkout-cache-fetch-attempts", "checkout-cache-github-timeout-seconds", "checkout-cache-mirror-url-template", "checkout-cache-mode", "checkout-cache-reference-repository-template", "checkout-cache-timeout-seconds", "gate-command-json", "gate-environment-json", "gate-plan-command-json", "gate-profile", "gate-registry", "include-advisory", "node-version", "platforms-json", "require-trusted-event", "runner-preset", "rust-toolchain", "rustup-dist-server", "rustup-update-root", "shifu-cache-profile-digest", "shifu-cache-profile-ref", "source-ref", "untrusted-policy", "working-directory" ], "controllerDescriptor": { "contract": "buildchain.controller-descriptor/v1", "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d", "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d", "inputClassifications": { "artifact-name": { "classification": "included", "source": "workflow-call-input" }, "artifact-retention-days": { "classification": "included", "source": "workflow-call-input" }, "buildchain-ref": { "classification": "included", "source": "workflow-call-input" }, "buildchain-repository": { "classification": "included", "source": "workflow-call-input" }, "cargo-registry-index": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-fallback": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-fetch-attempts": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-github-timeout-seconds": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-mirror-url-template": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-mode": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-reference-repository-template": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-timeout-seconds": { "classification": "digest-only", "source": "workflow-call-input" }, "gate-command-json": { "classification": "digest-only", "source": "workflow-call-input" }, "gate-environment-json": { "classification": "digest-only", "source": "workflow-call-input" }, "gate-plan-command-json": { "classification": "digest-only", "source": "workflow-call-input" }, "gate-profile": { "classification": "included", "source": "workflow-call-input" }, "gate-registry": { "classification": "included", "source": "workflow-call-input" }, "include-advisory": { "classification": "included", "source": "workflow-call-input" }, "node-version": { "classification": "included", "source": "workflow-call-input" }, "platforms-json": { "classification": "digest-only", "source": "workflow-call-input" }, "require-trusted-event": { "classification": "included", "source": "workflow-call-input" }, "runner-preset": { "classification": "digest-only", "source": "workflow-call-input" }, "rust-toolchain": { "classification": "included", "source": "workflow-call-input" }, "rustup-dist-server": { "classification": "included", "source": "workflow-call-input" }, "rustup-update-root": { "classification": "included", "source": "workflow-call-input" }, "shifu-cache-profile-digest": { "classification": "included", "source": "workflow-call-input" }, "shifu-cache-profile-ref": { "classification": "included", "source": "workflow-call-input" }, "source-ref": { "classification": "included", "source": "workflow-call-input" }, "untrusted-policy": { "classification": "included", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" } } }, "guarantees": [ "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest", "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes", "redacted input values are never serialized and digest-only input values are never emitted in plaintext", "missing receipts are non-qualifying and must not be represented as a successful controller run" ], "breakingDigest": "sha256:5f1868478b7ccd9fb79aea76bc771289d2ca6bd2dccd1abf57575426f1eae5fb", "auditDigest": "sha256:9c22dc647886a67250485185810978775f4eaa2efdbfdc4f959b918e3ec1e312" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "controller:web-surface", "kind": "controller", "path": ".github/workflows/.web-surface.yml", "requiredInputs": [], "requiredOutputs": [ "controller-plan-json", "controller-plan-digest", "controller-receipt-json", "controller-receipt-digest", "controller-receipt-status" ], "breakingDefaults": { "evidenceContract": "buildchain.controller-evidence/v1", "descriptorVersion": 1, "workflowPath": ".github/workflows/.web-surface.yml", "requiredStages": [ "resolve-runtime", "plan", "aggregate" ], "capabilities": [ "web-build", "web-verify", "deployment-plan", "deployment-apply", "publication-authority" ], "evidenceRequirements": [ "web-surface-plan", "controller-receipt" ], "inputClassificationPolicy": "buildchain-controller-input-policy/v1" }, "optionalInputs": [ "artifact-path", "aws-region", "build-command", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-ref", "buildchain-repository", "fail-on-release-pr-error", "github-governance-receipt-json", "node-version", "preview-apply", "preview-aws-role-arn", "preview-cleanup-apply", "preview-comment", "preview-environment", "production-apply", "production-approved", "production-aws-role-arn", "production-environment", "production-release-app-client-id", "production-release-app-id", "production-release-app-private-key", "production-release-branch-channel", "production-release-head-prefix", "production-release-label", "production-release-on-main", "production-release-pr-mode", "production-release-pr-token", "production-source-sha", "publication-admission-json", "publication-control-plane-audit-json", "publication-expected-json", "publication-gate-aggregate-json", "publication-runner-provenance-json", "publication-used-nonces-json", "release-feedback-actor-privacy", "staging-apply", "staging-aws-role-arn", "staging-environment", "verify-command", "working-directory" ], "controllerDescriptor": { "contract": "buildchain.controller-descriptor/v1", "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575", "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d", "inputClassifications": { "artifact-path": { "classification": "digest-only", "source": "workflow-call-input" }, "aws-region": { "classification": "included", "source": "workflow-call-input" }, "build-command": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-contract-compatibility-policy": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-drift-issue-mode": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-ref": { "classification": "included", "source": "workflow-call-input" }, "buildchain-repository": { "classification": "included", "source": "workflow-call-input" }, "fail-on-release-pr-error": { "classification": "included", "source": "workflow-call-input" }, "github-governance-receipt-json": { "classification": "digest-only", "source": "workflow-call-input" }, "node-version": { "classification": "included", "source": "workflow-call-input" }, "preview-apply": { "classification": "included", "source": "workflow-call-input" }, "preview-aws-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "preview-cleanup-apply": { "classification": "included", "source": "workflow-call-input" }, "preview-comment": { "classification": "included", "source": "workflow-call-input" }, "preview-environment": { "classification": "digest-only", "source": "workflow-call-input" }, "production-apply": { "classification": "included", "source": "workflow-call-input" }, "production-approved": { "classification": "included", "source": "workflow-call-input" }, "production-aws-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "production-environment": { "classification": "digest-only", "source": "workflow-call-input" }, "production-release-app-client-id": { "classification": "included", "source": "workflow-call-input" }, "production-release-app-id": { "classification": "included", "source": "workflow-call-input" }, "production-release-app-private-key": { "classification": "redacted", "source": "workflow-call-secret" }, "production-release-branch-channel": { "classification": "included", "source": "workflow-call-input" }, "production-release-head-prefix": { "classification": "included", "source": "workflow-call-input" }, "production-release-label": { "classification": "included", "source": "workflow-call-input" }, "production-release-on-main": { "classification": "included", "source": "workflow-call-input" }, "production-release-pr-mode": { "classification": "included", "source": "workflow-call-input" }, "production-release-pr-token": { "classification": "redacted", "source": "workflow-call-input" }, "production-source-sha": { "classification": "included", "source": "workflow-call-input" }, "publication-admission-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-control-plane-audit-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-expected-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-gate-aggregate-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-runner-provenance-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-used-nonces-json": { "classification": "digest-only", "source": "workflow-call-input" }, "release-feedback-actor-privacy": { "classification": "included", "source": "workflow-call-input" }, "staging-apply": { "classification": "included", "source": "workflow-call-input" }, "staging-aws-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "staging-environment": { "classification": "digest-only", "source": "workflow-call-input" }, "verify-command": { "classification": "digest-only", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" } } }, "guarantees": [ "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest", "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes", "redacted input values are never serialized and digest-only input values are never emitted in plaintext", "missing receipts are non-qualifying and must not be represented as a successful controller run" ], "breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27", "auditDigest": "sha256:748e1d69ca28b631e86788de0ff359b11164b3ac1edda1b146ca49f3ac3856dc" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "controller:publication-artifact", "kind": "controller", "path": ".github/workflows/publication-artifact.yml", "requiredInputs": [], "requiredOutputs": [ "controller-plan-json", "controller-plan-digest", "controller-receipt-json", "controller-receipt-digest", "controller-receipt-status" ], "breakingDefaults": { "evidenceContract": "buildchain.controller-evidence/v1", "descriptorVersion": 1, "workflowPath": ".github/workflows/publication-artifact.yml", "requiredStages": [ "resolve-runtime", "build", "collect", "aggregate" ], "capabilities": [ "publication-build", "publication-verify", "artifact-admission" ], "evidenceRequirements": [ "publication-manifest", "publication-passport", "controller-receipt" ], "inputClassificationPolicy": "buildchain-controller-input-policy/v1" }, "optionalInputs": [ "artifact-name", "artifact-paths", "artifact-retention-days", "build-command", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-ref", "buildchain-repository", "node-version", "package-name", "prepare-paper-package", "publish-dist-tag", "setup-node", "target-ref", "toolchain-command", "toolchain-digest", "toolchain-image", "toolchain-type", "verify-command", "working-directory" ], "controllerDescriptor": { "contract": "buildchain.controller-descriptor/v1", "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd", "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d", "inputClassifications": { "artifact-name": { "classification": "included", "source": "workflow-call-input" }, "artifact-paths": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-retention-days": { "classification": "included", "source": "workflow-call-input" }, "build-command": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-contract-compatibility-policy": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-drift-issue-mode": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-ref": { "classification": "included", "source": "workflow-call-input" }, "buildchain-repository": { "classification": "included", "source": "workflow-call-input" }, "node-version": { "classification": "included", "source": "workflow-call-input" }, "package-name": { "classification": "included", "source": "workflow-call-input" }, "prepare-paper-package": { "classification": "included", "source": "workflow-call-input" }, "publish-dist-tag": { "classification": "included", "source": "workflow-call-input" }, "setup-node": { "classification": "included", "source": "workflow-call-input" }, "target-ref": { "classification": "included", "source": "workflow-call-input" }, "toolchain-command": { "classification": "digest-only", "source": "workflow-call-input" }, "toolchain-digest": { "classification": "included", "source": "workflow-call-input" }, "toolchain-image": { "classification": "included", "source": "workflow-call-input" }, "toolchain-type": { "classification": "included", "source": "workflow-call-input" }, "verify-command": { "classification": "digest-only", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" } } }, "guarantees": [ "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest", "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes", "redacted input values are never serialized and digest-only input values are never emitted in plaintext", "missing receipts are non-qualifying and must not be represented as a successful controller run" ], "breakingDigest": "sha256:3f76502666069c2727d23efcfdb08fb80f89ced1955a69e29f11525ae88aca1d", "auditDigest": "sha256:6132e68620355e2a4d491172bc5eab58121369265baab0dee72a99218efa559a" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "controller:paper-release", "kind": "controller", "path": ".github/workflows/paper-release.yml", "requiredInputs": [], "requiredOutputs": [ "controller-plan-json", "controller-plan-digest", "controller-receipt-json", "controller-receipt-digest", "controller-receipt-status" ], "breakingDefaults": { "evidenceContract": "buildchain.controller-evidence/v1", "descriptorVersion": 1, "workflowPath": ".github/workflows/paper-release.yml", "requiredStages": [ "resolve-runtime", "build", "collect", "publication-authority", "publish", "passport", "aggregate" ], "capabilities": [ "publication-build", "artifact-admission", "publication-authority", "release-publish", "release-passport" ], "evidenceRequirements": [ "publication-manifest", "release-passport", "controller-receipt" ], "inputClassificationPolicy": "buildchain-controller-input-policy/v1" }, "optionalInputs": [ "artifact-name", "artifact-retention-days", "branch-protection-bypass-apps", "branch-protection-bypass-teams", "branch-protection-bypass-users", "build-command", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-ref", "buildchain-repository", "dry-run", "github-governance-receipt-json", "github-release", "github-release-notes", "github-release-title", "node-version", "package-name", "publication-admission-json", "publication-control-plane-audit-json", "publication-expected-json", "publication-runner-provenance-json", "publication-used-nonces-json", "publish-dist-tag", "publish-package-set-order", "release-passport-impact-json", "release-passport-output-dir", "release-passport-product-name", "required-status-check", "setup-node", "target-ref", "target-sha", "toolchain-command", "toolchain-digest", "toolchain-image", "toolchain-type", "verify-command", "working-directory" ], "controllerDescriptor": { "contract": "buildchain.controller-descriptor/v1", "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173", "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d", "inputClassifications": { "artifact-name": { "classification": "included", "source": "workflow-call-input" }, "artifact-retention-days": { "classification": "included", "source": "workflow-call-input" }, "branch-protection-bypass-apps": { "classification": "included", "source": "workflow-call-input" }, "branch-protection-bypass-teams": { "classification": "included", "source": "workflow-call-input" }, "branch-protection-bypass-users": { "classification": "included", "source": "workflow-call-input" }, "build-command": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-contract-compatibility-policy": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-drift-issue-mode": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-ref": { "classification": "included", "source": "workflow-call-input" }, "buildchain-repository": { "classification": "included", "source": "workflow-call-input" }, "dry-run": { "classification": "included", "source": "workflow-call-input" }, "github-governance-receipt-json": { "classification": "digest-only", "source": "workflow-call-input" }, "github-release": { "classification": "included", "source": "workflow-call-input" }, "github-release-notes": { "classification": "digest-only", "source": "workflow-call-input" }, "github-release-title": { "classification": "included", "source": "workflow-call-input" }, "node-version": { "classification": "included", "source": "workflow-call-input" }, "package-name": { "classification": "included", "source": "workflow-call-input" }, "publication-admission-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-control-plane-audit-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-expected-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-runner-provenance-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-used-nonces-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publish-dist-tag": { "classification": "included", "source": "workflow-call-input" }, "publish-package-set-order": { "classification": "included", "source": "workflow-call-input" }, "release-passport-impact-json": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-output-dir": { "classification": "included", "source": "workflow-call-input" }, "release-passport-product-name": { "classification": "included", "source": "workflow-call-input" }, "required-status-check": { "classification": "included", "source": "workflow-call-input" }, "setup-node": { "classification": "included", "source": "workflow-call-input" }, "target-ref": { "classification": "included", "source": "workflow-call-input" }, "target-sha": { "classification": "included", "source": "workflow-call-input" }, "toolchain-command": { "classification": "digest-only", "source": "workflow-call-input" }, "toolchain-digest": { "classification": "included", "source": "workflow-call-input" }, "toolchain-image": { "classification": "included", "source": "workflow-call-input" }, "toolchain-type": { "classification": "included", "source": "workflow-call-input" }, "verify-command": { "classification": "digest-only", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" } } }, "guarantees": [ "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest", "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes", "redacted input values are never serialized and digest-only input values are never emitted in plaintext", "missing receipts are non-qualifying and must not be represented as a successful controller run" ], "breakingDigest": "sha256:0eb318df455ef9cb737a7c2515a2411b685d34ed0bde7b5f5b173a7a42513114", "auditDigest": "sha256:43eaedc62a6e9ab4658fee9a3fb0ad729af2ca60426143543b938e725bbbfa2e" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "controller:release-candidate-promotion", "kind": "controller", "path": ".github/workflows/.release-candidate-promote.yml", "requiredInputs": [], "requiredOutputs": [ "controller-plan-json", "controller-plan-digest", "controller-receipt-json", "controller-receipt-digest", "controller-receipt-status" ], "breakingDefaults": { "evidenceContract": "buildchain.controller-evidence/v1", "descriptorVersion": 1, "workflowPath": ".github/workflows/.release-candidate-promote.yml", "requiredStages": [ "preflight", "admit-release-candidate", "publication-authority", "publish", "passport", "aggregate" ], "capabilities": [ "promotion-preflight", "artifact-admission", "publication-authority", "publish-transaction", "release-passport" ], "evidenceRequirements": [ "release-candidate-passport", "publish-evidence", "release-passport", "controller-receipt" ], "inputClassificationPolicy": "buildchain-controller-input-policy/v1" }, "optionalInputs": [ "BUILDCHAIN_ISSUE_APP_ID", "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY", "BUILDCHAIN_ISSUE_TOKEN", "BUILDCHAIN_PROMOTION_TOKEN", "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY", "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN", "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY", "allow-repository", "artifact-name", "artifact-patterns", "branch-protection-bypass-apps", "branch-protection-bypass-teams", "branch-protection-bypass-users", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-expected-channel", "buildchain-expected-major", "buildchain-issue-app-id", "buildchain-issue-app-private-key", "buildchain-issue-token", "buildchain-ref", "buildchain-repository", "channel", "declarative-release-tail", "dry-run", "github-artifact-attestation-environment", "github-artifact-attestation-policy-json", "github-artifact-attestation-retention-days", "github-governance-receipt-json", "github-release", "github-release-notes", "github-release-payload-patterns", "github-release-title", "package-manager", "promotion-contract-lock-digest", "promotion-contract-lock-path", "promotion-override-used", "promotion-publication-channel", "promotion-router-ref", "promotion-router-sha", "promotion-runtime-ref", "promotion-runtime-sha", "promotion-shell-ref", "promotion-shell-sha", "promotion-target-ref", "publication-admission-json", "publication-authority-workflow-path", "publication-auto-admission", "publication-auto-no-gate", "publication-commit-command", "publication-commit-evidence-path", "publication-consumer-predicate-id", "publication-consumer-qualification-command", "publication-consumer-qualification-controller-sha", "publication-control-plane-audit-json", "publication-expected-json", "publication-gate-aggregate-json", "publication-gate-command", "publication-gate-controller-sha", "publication-package-name", "publication-product", "publication-publisher-workflow-path", "publication-runner-provenance-json", "publication-target", "publication-used-nonces-json", "publication-used-qualification-nonces-json", "publish-artifact-kind", "publish-command", "publish-dist-tag", "publish-mode", "publish-package-main", "publish-package-set-order", "publish-rematerialize-on-resume", "publish-required-artifacts-json", "publish-target", "publish-transaction-override", "release-activation-command", "release-activation-receipt-set-path", "release-candidate-family-assignment-id", "release-candidate-family-evidence-required", "release-candidate-family-evidence-root", "release-candidate-family-initiative-id", "release-candidate-wait-seconds", "release-candidate-workflow-file", "release-candidate-workflow-name", "release-passport", "release-passport-attachment-command", "release-passport-buildchain-self-kfd", "release-passport-evidence-command", "release-passport-evidence-jsons", "release-passport-evidence-path", "release-passport-impact-json", "release-passport-invariant-passport-command", "release-passport-invariant-passport-jsons", "release-passport-kfd-1-witness-jsons", "release-passport-kfd-2-claim-jsons", "release-passport-kfd-3-artifact-verify-command", "release-passport-kfd-3-artifact-witness-jsons", "release-passport-kfd-3-prebuild-witness-jsons", "release-passport-kfd-adopter-manifest-json", "release-passport-kfd-product-gate-jsons", "release-passport-kfd-support-matrix-json", "release-passport-output-dir", "release-passport-platform-manifest-paths", "release-passport-product-name", "release-propagation-config-path", "required-artifact-count", "required-status-check", "resume-buildchain-runtime-sha", "resume-candidate-repository", "resume-candidate-run-id", "resume-expected-candidate-root", "resume-expected-candidate-runtime-sha", "resume-expected-source-tree", "resume-expected-workflow-file", "resume-expected-workflow-name", "resume-transaction-id", "runner-preset", "standalone-binary-distribution", "target-ref", "target-sha", "trusted-publishing" ], "controllerDescriptor": { "contract": "buildchain.controller-descriptor/v1", "digest": "sha256:1e812ddf411c9f4106e5ff88054e1fe6f0eb6bad76c3985d8adbc9ce5dfe345d", "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d", "inputClassifications": { "BUILDCHAIN_ISSUE_APP_ID": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_ISSUE_TOKEN": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_PROMOTION_TOKEN": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN": { "classification": "redacted", "source": "workflow-call-secret" }, "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY": { "classification": "redacted", "source": "workflow-call-secret" }, "allow-repository": { "classification": "included", "source": "workflow-call-input" }, "artifact-name": { "classification": "included", "source": "workflow-call-input" }, "artifact-patterns": { "classification": "included", "source": "workflow-call-input" }, "branch-protection-bypass-apps": { "classification": "included", "source": "workflow-call-input" }, "branch-protection-bypass-teams": { "classification": "included", "source": "workflow-call-input" }, "branch-protection-bypass-users": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-compatibility-policy": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-drift-issue-mode": { "classification": "included", "source": "workflow-call-input" }, "buildchain-contract-lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-expected-channel": { "classification": "included", "source": "workflow-call-input" }, "buildchain-expected-major": { "classification": "included", "source": "workflow-call-input" }, "buildchain-issue-app-id": { "classification": "redacted", "source": "workflow-call-secret" }, "buildchain-issue-app-private-key": { "classification": "redacted", "source": "workflow-call-secret" }, "buildchain-issue-token": { "classification": "redacted", "source": "workflow-call-secret" }, "buildchain-ref": { "classification": "included", "source": "workflow-call-input" }, "buildchain-repository": { "classification": "included", "source": "workflow-call-input" }, "channel": { "classification": "included", "source": "workflow-call-input" }, "declarative-release-tail": { "classification": "included", "source": "workflow-call-input" }, "dry-run": { "classification": "included", "source": "workflow-call-input" }, "github-artifact-attestation-environment": { "classification": "digest-only", "source": "workflow-call-input" }, "github-artifact-attestation-policy-json": { "classification": "digest-only", "source": "workflow-call-input" }, "github-artifact-attestation-retention-days": { "classification": "included", "source": "workflow-call-input" }, "github-governance-receipt-json": { "classification": "digest-only", "source": "workflow-call-input" }, "github-release": { "classification": "included", "source": "workflow-call-input" }, "github-release-notes": { "classification": "digest-only", "source": "workflow-call-input" }, "github-release-payload-patterns": { "classification": "included", "source": "workflow-call-input" }, "github-release-title": { "classification": "included", "source": "workflow-call-input" }, "package-manager": { "classification": "included", "source": "workflow-call-input" }, "promotion-contract-lock-digest": { "classification": "included", "source": "workflow-call-input" }, "promotion-contract-lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "promotion-override-used": { "classification": "included", "source": "workflow-call-input" }, "promotion-publication-channel": { "classification": "included", "source": "workflow-call-input" }, "promotion-router-ref": { "classification": "included", "source": "workflow-call-input" }, "promotion-router-sha": { "classification": "included", "source": "workflow-call-input" }, "promotion-runtime-ref": { "classification": "included", "source": "workflow-call-input" }, "promotion-runtime-sha": { "classification": "included", "source": "workflow-call-input" }, "promotion-shell-ref": { "classification": "included", "source": "workflow-call-input" }, "promotion-shell-sha": { "classification": "included", "source": "workflow-call-input" }, "promotion-target-ref": { "classification": "included", "source": "workflow-call-input" }, "publication-admission-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-authority-workflow-path": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-auto-admission": { "classification": "included", "source": "workflow-call-input" }, "publication-auto-no-gate": { "classification": "included", "source": "workflow-call-input" }, "publication-commit-command": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-commit-evidence-path": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-consumer-predicate-id": { "classification": "included", "source": "workflow-call-input" }, "publication-consumer-qualification-command": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-consumer-qualification-controller-sha": { "classification": "included", "source": "workflow-call-input" }, "publication-control-plane-audit-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-expected-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-gate-aggregate-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-gate-command": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-gate-controller-sha": { "classification": "included", "source": "workflow-call-input" }, "publication-package-name": { "classification": "included", "source": "workflow-call-input" }, "publication-product": { "classification": "included", "source": "workflow-call-input" }, "publication-publisher-workflow-path": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-runner-provenance-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-target": { "classification": "included", "source": "workflow-call-input" }, "publication-used-nonces-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-used-qualification-nonces-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publish-artifact-kind": { "classification": "included", "source": "workflow-call-input" }, "publish-command": { "classification": "digest-only", "source": "workflow-call-input" }, "publish-dist-tag": { "classification": "included", "source": "workflow-call-input" }, "publish-mode": { "classification": "included", "source": "workflow-call-input" }, "publish-package-main": { "classification": "included", "source": "workflow-call-input" }, "publish-package-set-order": { "classification": "included", "source": "workflow-call-input" }, "publish-rematerialize-on-resume": { "classification": "included", "source": "workflow-call-input" }, "publish-required-artifacts-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publish-target": { "classification": "included", "source": "workflow-call-input" }, "publish-transaction-override": { "classification": "included", "source": "workflow-call-input" }, "release-activation-command": { "classification": "digest-only", "source": "workflow-call-input" }, "release-activation-receipt-set-path": { "classification": "digest-only", "source": "workflow-call-input" }, "release-candidate-family-assignment-id": { "classification": "included", "source": "workflow-call-input" }, "release-candidate-family-evidence-required": { "classification": "included", "source": "workflow-call-input" }, "release-candidate-family-evidence-root": { "classification": "included", "source": "workflow-call-input" }, "release-candidate-family-initiative-id": { "classification": "included", "source": "workflow-call-input" }, "release-candidate-wait-seconds": { "classification": "included", "source": "workflow-call-input" }, "release-candidate-workflow-file": { "classification": "included", "source": "workflow-call-input" }, "release-candidate-workflow-name": { "classification": "included", "source": "workflow-call-input" }, "release-passport": { "classification": "included", "source": "workflow-call-input" }, "release-passport-attachment-command": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-buildchain-self-kfd": { "classification": "included", "source": "workflow-call-input" }, "release-passport-evidence-command": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-evidence-jsons": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-evidence-path": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-impact-json": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-invariant-passport-command": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-invariant-passport-jsons": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-kfd-1-witness-jsons": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-kfd-2-claim-jsons": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-kfd-3-artifact-verify-command": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-kfd-3-artifact-witness-jsons": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-kfd-3-prebuild-witness-jsons": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-kfd-adopter-manifest-json": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-kfd-product-gate-jsons": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-kfd-support-matrix-json": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-output-dir": { "classification": "included", "source": "workflow-call-input" }, "release-passport-platform-manifest-paths": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-product-name": { "classification": "included", "source": "workflow-call-input" }, "release-propagation-config-path": { "classification": "digest-only", "source": "workflow-call-input" }, "required-artifact-count": { "classification": "included", "source": "workflow-call-input" }, "required-status-check": { "classification": "included", "source": "workflow-call-input" }, "resume-buildchain-runtime-sha": { "classification": "included", "source": "workflow-call-input" }, "resume-candidate-repository": { "classification": "included", "source": "workflow-call-input" }, "resume-candidate-run-id": { "classification": "included", "source": "workflow-call-input" }, "resume-expected-candidate-root": { "classification": "included", "source": "workflow-call-input" }, "resume-expected-candidate-runtime-sha": { "classification": "included", "source": "workflow-call-input" }, "resume-expected-source-tree": { "classification": "included", "source": "workflow-call-input" }, "resume-expected-workflow-file": { "classification": "included", "source": "workflow-call-input" }, "resume-expected-workflow-name": { "classification": "included", "source": "workflow-call-input" }, "resume-transaction-id": { "classification": "included", "source": "workflow-call-input" }, "runner-preset": { "classification": "digest-only", "source": "workflow-call-input" }, "standalone-binary-distribution": { "classification": "included", "source": "workflow-call-input" }, "target-ref": { "classification": "included", "source": "workflow-call-input" }, "target-sha": { "classification": "included", "source": "workflow-call-input" }, "trusted-publishing": { "classification": "included", "source": "workflow-call-input" } } }, "guarantees": [ "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest", "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes", "redacted input values are never serialized and digest-only input values are never emitted in plaintext", "missing receipts are non-qualifying and must not be represented as a successful controller run" ], "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd", "auditDigest": "sha256:adb76e2a8ddd7b8323beb6f2da775aee394c5be6992262ff053a5bc745b2a033" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "controller:release-propagation", "kind": "controller", "path": ".github/workflows/release-propagation.yml", "requiredInputs": [], "requiredOutputs": [ "controller-plan-json", "controller-plan-digest", "controller-receipt-json", "controller-receipt-digest", "controller-receipt-status" ], "breakingDefaults": { "evidenceContract": "buildchain.controller-evidence/v1", "descriptorVersion": 1, "workflowPath": ".github/workflows/release-propagation.yml", "requiredStages": [ "resolve-runtime", "plan", "write-lock", "aggregate" ], "capabilities": [ "release-propagation-plan", "downstream-lock", "agent-native-work-envelope", "resumable-production-handoff" ], "evidenceRequirements": [ "propagation-plan", "propagation-lock", "controller-receipt" ], "inputClassificationPolicy": "buildchain-controller-input-policy/v1" }, "optionalInputs": [ "agent-work-context-json", "agent-work-mode", "buildchain-ref", "buildchain-repository", "downstream-base-ref", "downstream-branch", "downstream-prepare-command", "downstream-repository", "downstream-target", "downstream-update-command", "downstream-verify-command", "dry-run", "graph-json", "lock-path", "pr-body", "pr-title", "propagation-token", "refresh-managed-readme-badges", "source-node", "upstream-release-json" ], "controllerDescriptor": { "contract": "buildchain.controller-descriptor/v1", "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12", "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d", "inputClassifications": { "agent-work-context-json": { "classification": "digest-only", "source": "workflow-call-input" }, "agent-work-mode": { "classification": "included", "source": "workflow-call-input" }, "buildchain-ref": { "classification": "included", "source": "workflow-call-input" }, "buildchain-repository": { "classification": "included", "source": "workflow-call-input" }, "downstream-base-ref": { "classification": "included", "source": "workflow-call-input" }, "downstream-branch": { "classification": "included", "source": "workflow-call-input" }, "downstream-prepare-command": { "classification": "digest-only", "source": "workflow-call-input" }, "downstream-repository": { "classification": "included", "source": "workflow-call-input" }, "downstream-target": { "classification": "included", "source": "workflow-call-input" }, "downstream-update-command": { "classification": "digest-only", "source": "workflow-call-input" }, "downstream-verify-command": { "classification": "digest-only", "source": "workflow-call-input" }, "dry-run": { "classification": "included", "source": "workflow-call-input" }, "graph-json": { "classification": "digest-only", "source": "workflow-call-input" }, "lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "pr-body": { "classification": "digest-only", "source": "workflow-call-input" }, "pr-title": { "classification": "included", "source": "workflow-call-input" }, "propagation-token": { "classification": "redacted", "source": "workflow-call-secret" }, "refresh-managed-readme-badges": { "classification": "included", "source": "workflow-call-input" }, "source-node": { "classification": "included", "source": "workflow-call-input" }, "upstream-release-json": { "classification": "digest-only", "source": "workflow-call-input" } } }, "guarantees": [ "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest", "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes", "redacted input values are never serialized and digest-only input values are never emitted in plaintext", "missing receipts are non-qualifying and must not be represented as a successful controller run" ], "breakingDigest": "sha256:b873ceb65618972bea615afcb9c616c138ce834b3246ec7237ef87c1618d68bd", "auditDigest": "sha256:ef845b25978cd63c0fc6cbc83271e30b245f9d8605c2c25ae7e87c13a35b1302" }, { "contractVersion": 1, "stability": "stable", "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line", "id": "controller:binary-distribution", "kind": "controller", "path": ".github/workflows/binary-distribution.yml", "requiredInputs": [], "requiredOutputs": [ "controller-plan-json", "controller-plan-digest", "controller-receipt-json", "controller-receipt-digest", "controller-receipt-status" ], "breakingDefaults": { "evidenceContract": "buildchain.controller-evidence/v1", "descriptorVersion": 1, "workflowPath": ".github/workflows/binary-distribution.yml", "requiredStages": [ "resolve-runtime", "build", "verify", "bundle", "aggregate" ], "capabilities": [ "standalone-binary-build", "release-evidence-bundle", "artifact-admission" ], "evidenceRequirements": [ "release-evidence-bundle", "release-passport", "controller-receipt" ], "inputClassificationPolicy": "buildchain-controller-input-policy/v1" }, "optionalInputs": [], "controllerDescriptor": { "contract": "buildchain.controller-descriptor/v1", "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555", "registryDigest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d", "inputClassifications": {} }, "guarantees": [ "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest", "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes", "redacted input values are never serialized and digest-only input values are never emitted in plaintext", "missing receipts are non-qualifying and must not be represented as a successful controller run" ], "breakingDigest": "sha256:7c18fdd3df180db9e1f043a2286ef3f02fae60b84e42b76cd50da9cfeb77883d", "auditDigest": "sha256:d07482cd66413a2fb3781a3b76f960b8151b6231841799647fe237820de2fde6" } ], "compatibilityDigest": "sha256:7234ed200c568b1fea0e469de61ec7a67da48ede0af6290fb49b93a9e62e0b65", "contractDigest": "sha256:f37a3a710cc130919c5fcbdd73b37c21762b8a91c5351028d4873baf69e6629e" }