{
  "schemaVersion": 1,
  "contract": "buildchain.controller-registry/v1",
  "controllers": [
    {
      "schemaVersion": 1,
      "contract": "buildchain.controller-descriptor/v1",
      "id": "source-check",
      "version": 1,
      "workflow": {
        "id": "check",
        "path": ".github/workflows/check.yml"
      },
      "inputs": {
        "buildchain-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "node-version": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "require-version-state": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "upload-artifacts": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "working-directory": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        }
      },
      "expected": {
        "stages": [
          {
            "id": "resolve-runtime",
            "required": true
          },
          {
            "id": "checkout-source",
            "required": true
          },
          {
            "id": "install",
            "required": true
          },
          {
            "id": "check",
            "required": true
          },
          {
            "id": "aggregate",
            "required": true
          }
        ],
        "capabilities": [
          "source-acceptance",
          "lifecycle-check"
        ],
        "evidence": [
          "lifecycle-manifest",
          "lifecycle-summary",
          "controller-receipt"
        ]
      },
      "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48"
    },
    {
      "schemaVersion": 1,
      "contract": "buildchain.controller-descriptor/v1",
      "id": "build-lifecycle",
      "version": 1,
      "workflow": {
        "id": ".build",
        "path": ".github/workflows/.build.yml"
      },
      "inputs": {
        "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_PROMOTION_TOKEN": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "artifact-compression-level": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-finalization-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-finalization-on-platform": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-name-template": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-paths": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-bucket": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-download-role-arn": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-oidc-audience": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-prefix": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-region": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-role-arn": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-upload-role-arn": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-retention-days": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-signing-request-upload-no-proxy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-transfer-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "aws-codebuild-project": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "aws-ec2-macos-runner-label": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "aws-ec2-windows-runner-label": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "build-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-contract-compatibility-policy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-drift-issue-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-lock-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-expected-channel": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-expected-major": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "cache-dependency-lock-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "cache-policy-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "cache-toolchain-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "cargo-registry-index": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-fallback": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-fetch-attempts": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-github-timeout-seconds": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-mirror-url-template": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-mode": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-reference-repository-template": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-timeout-seconds": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-history-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "compiler-cache-platforms-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "compiler-cache-provider": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "compiler-cache-required": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "control-runner-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "credential-island-caller-owned": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "credential-island-environment": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "credential-island-macos-app-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "credential-island-macos-platform-id": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "expected-artifacts-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "fail-fast": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "gate-profile-aggregate-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "github-artifact-attestation-platform-id": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "github-artifact-attestation-signer-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "github-artifact-attestation-subject-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "install-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "kfd-agent-hub": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "lifecycle-timeout-minutes": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "linux-container-image": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "linux-container-preset": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "node-version": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "platforms-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "pre-upload-transport-smoke-artifact-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "pre-upload-transport-smoke-scenario-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "process-sample-interval-ms": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "process-summary-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publish-anchor-request-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publish-channel": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-refs-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publish-registry": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-source-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-candidate": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-candidate-family-evidence-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "requested-parallelism": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "require-build": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "require-install": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "require-trusted-event": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "require-verify": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "runner-preset": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "rust-toolchain": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "rustup-dist-server": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "rustup-update-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "sample-process-tree": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "self-hosted-offline-fallback": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "setup-node": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "setup-rust": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "shifu-cache-profile-digest": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "shifu-cache-profile-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "untrusted-policy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "verify-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "verify-substage-evidence-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "working-directory": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        }
      },
      "expected": {
        "stages": [
          {
            "id": "resolve-runtime",
            "required": true
          },
          {
            "id": "resolve-source",
            "required": true
          },
          {
            "id": "anchored-release-preflight",
            "required": false
          },
          {
            "id": "build",
            "required": true
          },
          {
            "id": "signing-finalization",
            "required": true
          },
          {
            "id": "credential-island",
            "required": false
          },
          {
            "id": "verify",
            "required": true
          },
          {
            "id": "aggregate",
            "required": true
          }
        ],
        "capabilities": [
          "source-lock",
          "lifecycle-build",
          "artifact-signing-finalization",
          "credential-island",
          "lifecycle-verify",
          "artifact-admission"
        ],
        "evidence": [
          "platform-manifests",
          "build-summary",
          "controller-receipt"
        ]
      },
      "digest": "sha256:18bd484d8425b54ad533adde64f874c151a0a90de878c5498cfb99709cb53ea3"
    },
    {
      "schemaVersion": 1,
      "contract": "buildchain.controller-descriptor/v1",
      "id": "build-channel-router",
      "version": 1,
      "workflow": {
        "id": "build",
        "path": ".github/workflows/build.yml"
      },
      "inputs": {
        "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_PROMOTION_TOKEN": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "artifact-compression-level": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-finalization-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-finalization-on-platform": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-name-template": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-paths": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-bucket": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-download-role-arn": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-oidc-audience": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-prefix": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-region": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-role-arn": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-relay-s3-upload-role-arn": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-retention-days": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-signing-request-upload-no-proxy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-transfer-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "aws-codebuild-project": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "aws-ec2-macos-runner-label": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "aws-ec2-windows-runner-label": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "build-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-alpha-contract-lock-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-channel": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-compatibility-policy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-drift-issue-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-lock-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-expected-channel": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-expected-major": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-stable-contract-lock-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "cache-dependency-lock-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "cache-policy-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "cache-toolchain-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "cargo-registry-index": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-fallback": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-fetch-attempts": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-github-timeout-seconds": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-mirror-url-template": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-mode": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-reference-repository-template": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-timeout-seconds": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-history-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "compiler-cache-platforms-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "compiler-cache-provider": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "compiler-cache-required": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "control-runner-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "credential-island-caller-owned": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "credential-island-environment": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "credential-island-macos-app-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "credential-island-macos-platform-id": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "expected-artifacts-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "fail-fast": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "gate-profile-aggregate-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "github-artifact-attestation-platform-id": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "github-artifact-attestation-signer-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "github-artifact-attestation-subject-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "install-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "kfd-agent-hub": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "lifecycle-timeout-minutes": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "linux-container-image": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "linux-container-preset": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "node-version": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "platforms-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "pre-upload-transport-smoke-artifact-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "pre-upload-transport-smoke-scenario-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "process-sample-interval-ms": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "process-summary-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publish-anchor-request-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publish-channel": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-refs-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publish-registry": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-source-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-candidate": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-candidate-family-evidence-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "requested-parallelism": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "require-build": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "require-install": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "require-trusted-event": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "require-verify": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "runner-preset": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "rust-toolchain": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "rustup-dist-server": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "rustup-update-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "sample-process-tree": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "self-hosted-offline-fallback": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "setup-node": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "setup-rust": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "shifu-cache-profile-digest": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "shifu-cache-profile-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "untrusted-policy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "verify-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "verify-substage-evidence-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "working-directory": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        }
      },
      "expected": {
        "stages": [
          {
            "id": "resolve-channel",
            "required": true
          },
          {
            "id": "override",
            "required": false
          },
          {
            "id": "alpha",
            "required": false
          },
          {
            "id": "stable",
            "required": false
          },
          {
            "id": "aggregate",
            "required": true
          }
        ],
        "capabilities": [
          "channel-selection",
          "runtime-selection",
          "build-delegation"
        ],
        "evidence": [
          "nested-controller-receipt",
          "controller-receipt"
        ]
      },
      "digest": "sha256:47b73fb19d61c06911278ce99f8433596a8539097fdc18fe11f05b0d3c2109c0"
    },
    {
      "schemaVersion": 1,
      "contract": "buildchain.controller-descriptor/v1",
      "id": "shifu-gate-profile-envelope",
      "version": 1,
      "workflow": {
        "id": ".gate-profile",
        "path": ".github/workflows/.gate-profile.yml"
      },
      "inputs": {
        "artifact-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-retention-days": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "cargo-registry-index": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-fallback": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-fetch-attempts": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-github-timeout-seconds": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-mirror-url-template": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-mode": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-reference-repository-template": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "checkout-cache-timeout-seconds": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "gate-command-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "gate-environment-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "gate-plan-command-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "gate-profile": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "gate-registry": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "include-advisory": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "node-version": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "platforms-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "require-trusted-event": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "runner-preset": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "rust-toolchain": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "rustup-dist-server": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "rustup-update-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "shifu-cache-profile-digest": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "shifu-cache-profile-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "source-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "untrusted-policy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "working-directory": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        }
      },
      "expected": {
        "stages": [
          {
            "id": "plan",
            "required": true
          },
          {
            "id": "execute",
            "required": true
          },
          {
            "id": "aggregate",
            "required": true
          }
        ],
        "capabilities": [
          "shifu-gate-profile-delegation"
        ],
        "evidence": [
          "shifu-gate-aggregate",
          "controller-receipt"
        ]
      },
      "semanticBoundary": "References the Shifu aggregate digest and status without copying project Gate identifiers or Gate policy.",
      "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d"
    },
    {
      "schemaVersion": 1,
      "contract": "buildchain.controller-descriptor/v1",
      "id": "web-surface",
      "version": 1,
      "workflow": {
        "id": ".web-surface",
        "path": ".github/workflows/.web-surface.yml"
      },
      "inputs": {
        "artifact-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "aws-region": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "build-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-contract-compatibility-policy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-drift-issue-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-lock-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "fail-on-release-pr-error": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "github-governance-receipt-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "node-version": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "preview-apply": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "preview-aws-role-arn": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "preview-cleanup-apply": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "preview-comment": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "preview-environment": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "production-apply": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "production-approved": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "production-aws-role-arn": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "production-environment": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "production-release-app-client-id": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "production-release-app-id": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "production-release-app-private-key": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "production-release-branch-channel": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "production-release-head-prefix": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "production-release-label": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "production-release-on-main": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "production-release-pr-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "production-release-pr-token": {
          "classification": "redacted",
          "source": "workflow-call-input"
        },
        "production-source-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publication-admission-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-control-plane-audit-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-expected-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-gate-aggregate-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-runner-provenance-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-used-nonces-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-feedback-actor-privacy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "staging-apply": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "staging-aws-role-arn": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "staging-environment": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "verify-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "working-directory": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        }
      },
      "expected": {
        "stages": [
          {
            "id": "resolve-runtime",
            "required": true
          },
          {
            "id": "plan",
            "required": true
          },
          {
            "id": "build",
            "required": false
          },
          {
            "id": "verify",
            "required": false
          },
          {
            "id": "publication-authority",
            "required": false
          },
          {
            "id": "apply",
            "required": false
          },
          {
            "id": "aggregate",
            "required": true
          }
        ],
        "capabilities": [
          "web-build",
          "web-verify",
          "deployment-plan",
          "deployment-apply",
          "publication-authority"
        ],
        "evidence": [
          "web-surface-plan",
          "controller-receipt"
        ]
      },
      "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575"
    },
    {
      "schemaVersion": 1,
      "contract": "buildchain.controller-descriptor/v1",
      "id": "publication-artifact",
      "version": 1,
      "workflow": {
        "id": "publication-artifact",
        "path": ".github/workflows/publication-artifact.yml"
      },
      "inputs": {
        "artifact-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-paths": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "artifact-retention-days": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "build-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-contract-compatibility-policy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-drift-issue-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-lock-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "node-version": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "package-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "prepare-paper-package": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-dist-tag": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "setup-node": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "target-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "toolchain-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "toolchain-digest": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "toolchain-image": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "toolchain-type": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "verify-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "working-directory": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        }
      },
      "expected": {
        "stages": [
          {
            "id": "resolve-runtime",
            "required": true
          },
          {
            "id": "build",
            "required": true
          },
          {
            "id": "verify",
            "required": false
          },
          {
            "id": "collect",
            "required": true
          },
          {
            "id": "aggregate",
            "required": true
          }
        ],
        "capabilities": [
          "publication-build",
          "publication-verify",
          "artifact-admission"
        ],
        "evidence": [
          "publication-manifest",
          "publication-passport",
          "controller-receipt"
        ]
      },
      "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd"
    },
    {
      "schemaVersion": 1,
      "contract": "buildchain.controller-descriptor/v1",
      "id": "paper-release",
      "version": 1,
      "workflow": {
        "id": "paper-release",
        "path": ".github/workflows/paper-release.yml"
      },
      "inputs": {
        "artifact-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-retention-days": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "branch-protection-bypass-apps": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "branch-protection-bypass-teams": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "branch-protection-bypass-users": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "build-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-contract-compatibility-policy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-drift-issue-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-lock-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "dry-run": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "github-governance-receipt-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "github-release": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "github-release-notes": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "github-release-title": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "node-version": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "package-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publication-admission-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-control-plane-audit-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-expected-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-runner-provenance-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-used-nonces-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publish-dist-tag": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-package-set-order": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-passport-impact-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-output-dir": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-passport-product-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "required-status-check": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "setup-node": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "target-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "target-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "toolchain-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "toolchain-digest": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "toolchain-image": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "toolchain-type": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "verify-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "working-directory": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        }
      },
      "expected": {
        "stages": [
          {
            "id": "resolve-runtime",
            "required": true
          },
          {
            "id": "build",
            "required": true
          },
          {
            "id": "verify",
            "required": false
          },
          {
            "id": "collect",
            "required": true
          },
          {
            "id": "publication-authority",
            "required": true
          },
          {
            "id": "publish",
            "required": true
          },
          {
            "id": "passport",
            "required": true
          },
          {
            "id": "aggregate",
            "required": true
          }
        ],
        "capabilities": [
          "publication-build",
          "artifact-admission",
          "publication-authority",
          "release-publish",
          "release-passport"
        ],
        "evidence": [
          "publication-manifest",
          "release-passport",
          "controller-receipt"
        ]
      },
      "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173"
    },
    {
      "schemaVersion": 1,
      "contract": "buildchain.controller-descriptor/v1",
      "id": "release-candidate-promotion",
      "version": 1,
      "workflow": {
        "id": ".release-candidate-promote",
        "path": ".github/workflows/.release-candidate-promote.yml"
      },
      "inputs": {
        "BUILDCHAIN_ISSUE_APP_ID": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_ISSUE_TOKEN": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_PROMOTION_TOKEN": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "allow-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "artifact-patterns": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "branch-protection-bypass-apps": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "branch-protection-bypass-teams": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "branch-protection-bypass-users": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-compatibility-policy": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-drift-issue-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-contract-lock-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "buildchain-expected-channel": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-expected-major": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-issue-app-id": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "buildchain-issue-app-private-key": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "buildchain-issue-token": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "buildchain-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "channel": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "declarative-release-tail": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "dry-run": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "github-artifact-attestation-environment": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "github-artifact-attestation-policy-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "github-artifact-attestation-retention-days": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "github-governance-receipt-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "github-release": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "github-release-notes": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "github-release-payload-patterns": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "github-release-title": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "package-manager": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "promotion-contract-lock-digest": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "promotion-contract-lock-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "promotion-override-used": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "promotion-publication-channel": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "promotion-router-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "promotion-router-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "promotion-runtime-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "promotion-runtime-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "promotion-shell-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "promotion-shell-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "promotion-target-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publication-admission-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-authority-workflow-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-auto-admission": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publication-auto-no-gate": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publication-commit-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-commit-evidence-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-consumer-predicate-id": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publication-consumer-qualification-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-consumer-qualification-controller-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publication-control-plane-audit-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-expected-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-gate-aggregate-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-gate-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-gate-controller-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publication-package-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publication-product": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publication-publisher-workflow-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-runner-provenance-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-target": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publication-used-nonces-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publication-used-qualification-nonces-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publish-artifact-kind": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publish-dist-tag": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-package-main": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-package-set-order": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-rematerialize-on-resume": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-required-artifacts-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "publish-target": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "publish-transaction-override": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-activation-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-activation-receipt-set-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-candidate-family-assignment-id": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-candidate-family-evidence-required": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-candidate-family-evidence-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-candidate-family-initiative-id": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-candidate-wait-seconds": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-candidate-workflow-file": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-candidate-workflow-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-passport": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-passport-attachment-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-buildchain-self-kfd": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-passport-evidence-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-evidence-jsons": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-evidence-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-impact-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-invariant-passport-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-invariant-passport-jsons": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-kfd-1-witness-jsons": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-kfd-2-claim-jsons": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-kfd-3-artifact-verify-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-kfd-3-artifact-witness-jsons": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-kfd-3-prebuild-witness-jsons": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-kfd-adopter-manifest-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-kfd-product-gate-jsons": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-kfd-support-matrix-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-output-dir": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-passport-platform-manifest-paths": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "release-passport-product-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "release-propagation-config-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "required-artifact-count": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "required-status-check": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "resume-buildchain-runtime-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "resume-candidate-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "resume-candidate-run-id": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "resume-expected-candidate-root": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "resume-expected-candidate-runtime-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "resume-expected-source-tree": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "resume-expected-workflow-file": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "resume-expected-workflow-name": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "resume-transaction-id": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "runner-preset": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "standalone-binary-distribution": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "target-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "target-sha": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "trusted-publishing": {
          "classification": "included",
          "source": "workflow-call-input"
        }
      },
      "expected": {
        "stages": [
          {
            "id": "preflight",
            "required": true
          },
          {
            "id": "admit-release-candidate",
            "required": true
          },
          {
            "id": "publication-authority",
            "required": true
          },
          {
            "id": "publish",
            "required": true
          },
          {
            "id": "passport",
            "required": true
          },
          {
            "id": "aggregate",
            "required": true
          }
        ],
        "capabilities": [
          "promotion-preflight",
          "artifact-admission",
          "publication-authority",
          "publish-transaction",
          "release-passport"
        ],
        "evidence": [
          "release-candidate-passport",
          "publish-evidence",
          "release-passport",
          "controller-receipt"
        ]
      },
      "digest": "sha256:1e812ddf411c9f4106e5ff88054e1fe6f0eb6bad76c3985d8adbc9ce5dfe345d"
    },
    {
      "schemaVersion": 1,
      "contract": "buildchain.controller-descriptor/v1",
      "id": "release-propagation",
      "version": 1,
      "workflow": {
        "id": "release-propagation",
        "path": ".github/workflows/release-propagation.yml"
      },
      "inputs": {
        "agent-work-context-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "agent-work-mode": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "buildchain-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "downstream-base-ref": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "downstream-branch": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "downstream-prepare-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "downstream-repository": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "downstream-target": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "downstream-update-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "downstream-verify-command": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "dry-run": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "graph-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "lock-path": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "pr-body": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        },
        "pr-title": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "propagation-token": {
          "classification": "redacted",
          "source": "workflow-call-secret"
        },
        "refresh-managed-readme-badges": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "source-node": {
          "classification": "included",
          "source": "workflow-call-input"
        },
        "upstream-release-json": {
          "classification": "digest-only",
          "source": "workflow-call-input"
        }
      },
      "expected": {
        "stages": [
          {
            "id": "resolve-runtime",
            "required": true
          },
          {
            "id": "plan",
            "required": true
          },
          {
            "id": "emit-work",
            "required": false
          },
          {
            "id": "write-lock",
            "required": true
          },
          {
            "id": "prepare-consumer",
            "required": false
          },
          {
            "id": "refresh-badges",
            "required": false
          },
          {
            "id": "verify-consumer",
            "required": false
          },
          {
            "id": "open-pr",
            "required": false
          },
          {
            "id": "aggregate",
            "required": true
          }
        ],
        "capabilities": [
          "release-propagation-plan",
          "downstream-lock",
          "agent-native-work-envelope",
          "resumable-production-handoff"
        ],
        "evidence": [
          "propagation-plan",
          "propagation-lock",
          "controller-receipt"
        ]
      },
      "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12"
    },
    {
      "schemaVersion": 1,
      "contract": "buildchain.controller-descriptor/v1",
      "id": "binary-distribution",
      "version": 1,
      "workflow": {
        "id": "binary-distribution",
        "path": ".github/workflows/binary-distribution.yml"
      },
      "inputs": {},
      "expected": {
        "stages": [
          {
            "id": "resolve-runtime",
            "required": true
          },
          {
            "id": "build",
            "required": true
          },
          {
            "id": "verify",
            "required": true
          },
          {
            "id": "bundle",
            "required": true
          },
          {
            "id": "aggregate",
            "required": true
          }
        ],
        "capabilities": [
          "standalone-binary-build",
          "release-evidence-bundle",
          "artifact-admission"
        ],
        "evidence": [
          "release-evidence-bundle",
          "release-passport",
          "controller-receipt"
        ]
      },
      "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555"
    }
  ],
  "digest": "sha256:34776744f57db27b04eec061ea5ff01043b72119475a2bf623c87834cb30bb3d"
}
