{ "schemaVersion": 1, "contract": "buildchain.controller-registry/v1", "controllers": [ { "schemaVersion": 1, "contract": "buildchain.controller-descriptor/v1", "id": "source-check", "version": 1, "workflow": { "id": "public-build-check", "path": ".github/workflows/public-build-check.yml" }, "inputs": { "contract-lock": { "classification": "included", "source": "workflow-call-input" }, "mode": { "classification": "included", "source": "workflow-call-input" }, "node-version": { "classification": "included", "source": "workflow-call-input" }, "require-version-state": { "classification": "included", "source": "workflow-call-input" }, "runtime-ref": { "classification": "included", "source": "workflow-call-input" }, "runtime-selection": { "classification": "included", "source": "workflow-call-input" }, "source-proof-closure-paths-json": { "classification": "digest-only", "source": "workflow-call-input" }, "source-proof-dependency-paths-json": { "classification": "digest-only", "source": "workflow-call-input" }, "source-proof-policy-paths-json": { "classification": "digest-only", "source": "workflow-call-input" }, "source-proof-required-contexts-json": { "classification": "digest-only", "source": "workflow-call-input" }, "source-proof-reuse": { "classification": "included", "source": "workflow-call-input" }, "upload-artifacts": { "classification": "included", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" } }, "expected": { "stages": [ { "id": "resolve-runtime", "required": true }, { "id": "checkout-source", "required": true }, { "id": "install", "required": true }, { "id": "check", "required": true }, { "id": "aggregate", "required": true } ], "capabilities": [ "source-acceptance", "lifecycle-check" ], "evidence": [ "lifecycle-manifest", "lifecycle-summary", "controller-receipt" ] }, "digest": "sha256:3f2f0e2f9f8a21ea3db046cb477f2534711de29745e3f40be959eef398a2e692" }, { "schemaVersion": 1, "contract": "buildchain.controller-descriptor/v1", "id": "build-lifecycle", "version": 1, "workflow": { "id": ".build", "path": ".github/workflows/.build.yml" }, "inputs": { "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_NOTARY_API_ISSUER": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_PROMOTION_TOKEN": { "classification": "redacted", "source": "workflow-call-secret" }, "config-path": { "classification": "digest-only", "source": "workflow-call-input" }, "contract-lock": { "classification": "included", "source": "workflow-call-input" }, "resume-run-id": { "classification": "included", "source": "workflow-call-input" }, "runtime-ref": { "classification": "included", "source": "workflow-call-input" }, "runtime-selection": { "classification": "included", "source": "workflow-call-input" }, "configuration-root": { "classification": "included", "source": "resolved-build-plan" } }, "expected": { "stages": [ { "id": "plan", "required": true }, { "id": "install", "required": false }, { "id": "build", "required": true }, { "id": "verify", "required": false }, { "id": "sign", "required": true }, { "id": "attest", "required": false }, { "id": "deliver", "required": true } ], "capabilities": [ "source-lock", "lifecycle-build", "artifact-signing-finalization", "credential-island", "lifecycle-verify", "artifact-admission" ], "evidence": [ "platform-manifests", "build-summary", "controller-receipt" ] }, "digest": "sha256:849a51ff18efbc2bf4668cd6ba6e08004caf5fc01de4676eade0f917d24c5fd1" }, { "schemaVersion": 1, "contract": "buildchain.controller-descriptor/v1", "id": "shifu-gate-profile-envelope", "version": 1, "workflow": { "id": ".build-gate-profile", "path": ".github/workflows/.build-gate-profile.yml" }, "inputs": { "artifact-name": { "classification": "included", "source": "workflow-call-input" }, "artifact-retention-days": { "classification": "included", "source": "workflow-call-input" }, "cargo-registry-index": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-fallback": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-fetch-attempts": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-github-timeout-seconds": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-mirror-url-template": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-mode": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-reference-repository-template": { "classification": "digest-only", "source": "workflow-call-input" }, "checkout-cache-timeout-seconds": { "classification": "digest-only", "source": "workflow-call-input" }, "contract-lock": { "classification": "included", "source": "workflow-call-input" }, "gate-command-json": { "classification": "digest-only", "source": "workflow-call-input" }, "gate-environment-json": { "classification": "digest-only", "source": "workflow-call-input" }, "gate-plan-command-json": { "classification": "digest-only", "source": "workflow-call-input" }, "gate-profile": { "classification": "included", "source": "workflow-call-input" }, "gate-registry": { "classification": "included", "source": "workflow-call-input" }, "include-advisory": { "classification": "included", "source": "workflow-call-input" }, "node-version": { "classification": "included", "source": "workflow-call-input" }, "platforms-json": { "classification": "digest-only", "source": "workflow-call-input" }, "require-trusted-event": { "classification": "included", "source": "workflow-call-input" }, "runner-preset": { "classification": "digest-only", "source": "workflow-call-input" }, "runtime-ref": { "classification": "included", "source": "workflow-call-input" }, "runtime-selection": { "classification": "included", "source": "workflow-call-input" }, "rust-toolchain": { "classification": "included", "source": "workflow-call-input" }, "rustup-dist-server": { "classification": "included", "source": "workflow-call-input" }, "rustup-update-root": { "classification": "included", "source": "workflow-call-input" }, "shifu-cache-profile-digest": { "classification": "included", "source": "workflow-call-input" }, "shifu-cache-profile-ref": { "classification": "included", "source": "workflow-call-input" }, "source-ref": { "classification": "included", "source": "workflow-call-input" }, "untrusted-policy": { "classification": "included", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" } }, "expected": { "stages": [ { "id": "plan", "required": true }, { "id": "execute", "required": true }, { "id": "aggregate", "required": true } ], "capabilities": [ "shifu-gate-profile-delegation" ], "evidence": [ "shifu-gate-aggregate", "controller-receipt" ] }, "semanticBoundary": "References the Shifu aggregate digest and status without copying project Gate identifiers or Gate policy.", "digest": "sha256:83fb2f980409ff9eb7091fc675b1f1ecd471d335945d8fa6003357f0af709dd5" }, { "schemaVersion": 1, "contract": "buildchain.controller-descriptor/v1", "id": "web-surface", "version": 1, "workflow": { "id": "public-release-web", "path": ".github/workflows/public-release-web.yml" }, "inputs": { "artifact-path": { "classification": "digest-only", "source": "workflow-call-input" }, "aws-region": { "classification": "included", "source": "workflow-call-input" }, "build-command": { "classification": "digest-only", "source": "workflow-call-input" }, "contract-lock": { "classification": "included", "source": "workflow-call-input" }, "fail-on-release-pr-error": { "classification": "included", "source": "workflow-call-input" }, "github-governance-receipt-json": { "classification": "digest-only", "source": "workflow-call-input" }, "node-version": { "classification": "included", "source": "workflow-call-input" }, "preview-apply": { "classification": "included", "source": "workflow-call-input" }, "preview-aws-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "preview-cleanup-apply": { "classification": "included", "source": "workflow-call-input" }, "preview-comment": { "classification": "included", "source": "workflow-call-input" }, "preview-environment": { "classification": "digest-only", "source": "workflow-call-input" }, "production-apply": { "classification": "included", "source": "workflow-call-input" }, "production-approved": { "classification": "included", "source": "workflow-call-input" }, "production-aws-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "production-environment": { "classification": "digest-only", "source": "workflow-call-input" }, "production-release-app-client-id": { "classification": "included", "source": "workflow-call-input" }, "production-release-app-private-key": { "classification": "redacted", "source": "workflow-call-secret" }, "production-release-branch-channel": { "classification": "included", "source": "workflow-call-input" }, "production-release-head-prefix": { "classification": "included", "source": "workflow-call-input" }, "production-release-label": { "classification": "included", "source": "workflow-call-input" }, "production-release-on-main": { "classification": "included", "source": "workflow-call-input" }, "production-release-pr-mode": { "classification": "included", "source": "workflow-call-input" }, "production-release-pr-token": { "classification": "redacted", "source": "workflow-call-secret" }, "production-source-sha": { "classification": "included", "source": "workflow-call-input" }, "publication-admission-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-control-plane-audit-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-expected-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-gate-aggregate-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-runner-provenance-json": { "classification": "digest-only", "source": "workflow-call-input" }, "publication-used-nonces-json": { "classification": "digest-only", "source": "workflow-call-input" }, "release-feedback-actor-privacy": { "classification": "included", "source": "workflow-call-input" }, "runtime-ref": { "classification": "included", "source": "workflow-call-input" }, "runtime-selection": { "classification": "included", "source": "workflow-call-input" }, "staging-apply": { "classification": "included", "source": "workflow-call-input" }, "staging-aws-role-arn": { "classification": "digest-only", "source": "workflow-call-input" }, "staging-environment": { "classification": "digest-only", "source": "workflow-call-input" }, "verify-command": { "classification": "digest-only", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" } }, "expected": { "stages": [ { "id": "resolve-runtime", "required": true }, { "id": "plan", "required": true }, { "id": "build", "required": false }, { "id": "verify", "required": false }, { "id": "publication-authority", "required": false }, { "id": "apply", "required": false }, { "id": "aggregate", "required": true } ], "capabilities": [ "web-build", "web-verify", "deployment-plan", "deployment-apply", "publication-authority" ], "evidence": [ "web-surface-plan", "controller-receipt" ] }, "digest": "sha256:8818db80d272797d84488cd5db915014edf0081b78afa8a52561f54e0deee908" }, { "schemaVersion": 1, "contract": "buildchain.controller-descriptor/v1", "id": "publication-artifact", "version": 1, "workflow": { "id": "public-build-publication", "path": ".github/workflows/public-build-publication.yml" }, "inputs": { "artifact-name": { "classification": "included", "source": "workflow-call-input" }, "artifact-paths": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-retention-days": { "classification": "included", "source": "workflow-call-input" }, "build-command": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-alpha-contract-lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "buildchain-stable-contract-lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "contract-lock": { "classification": "included", "source": "workflow-call-input" }, "node-version": { "classification": "included", "source": "workflow-call-input" }, "package-name": { "classification": "included", "source": "workflow-call-input" }, "prepare-paper-package": { "classification": "included", "source": "workflow-call-input" }, "publish-dist-tag": { "classification": "included", "source": "workflow-call-input" }, "runtime-ref": { "classification": "included", "source": "workflow-call-input" }, "runtime-selection": { "classification": "included", "source": "workflow-call-input" }, "setup-node": { "classification": "included", "source": "workflow-call-input" }, "target-ref": { "classification": "included", "source": "workflow-call-input" }, "toolchain-command": { "classification": "digest-only", "source": "workflow-call-input" }, "toolchain-digest": { "classification": "included", "source": "workflow-call-input" }, "toolchain-image": { "classification": "included", "source": "workflow-call-input" }, "toolchain-type": { "classification": "included", "source": "workflow-call-input" }, "verify-command": { "classification": "digest-only", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" } }, "expected": { "stages": [ { "id": "resolve-runtime", "required": true }, { "id": "build", "required": true }, { "id": "verify", "required": false }, { "id": "collect", "required": true }, { "id": "aggregate", "required": true } ], "capabilities": [ "publication-build", "publication-verify", "artifact-admission" ], "evidence": [ "publication-manifest", "publication-passport", "controller-receipt" ] }, "digest": "sha256:8807dfdad8dc0ae15b51616049804b8a44936d37e364d209e099f680385d81af" }, { "schemaVersion": 1, "contract": "buildchain.controller-descriptor/v1", "id": "paper-release", "version": 1, "workflow": { "id": "public-release-paper", "path": ".github/workflows/public-release-paper.yml" }, "inputs": { "BUILDCHAIN_GENERATED_WRITE_APP_CLIENT_ID": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_GENERATED_WRITE_APP_PRIVATE_KEY": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_GENERATED_WRITE_TOKEN": { "classification": "redacted", "source": "workflow-call-secret" }, "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY": { "classification": "redacted", "source": "workflow-call-secret" }, "artifact-name": { "classification": "included", "source": "workflow-call-input" }, "artifact-paths": { "classification": "digest-only", "source": "workflow-call-input" }, "artifact-retention-days": { "classification": "included", "source": "workflow-call-input" }, "branch-protection-bypass-apps": { "classification": "included", "source": "workflow-call-input" }, "contract-lock": { "classification": "included", "source": "workflow-call-input" }, "dry-run": { "classification": "included", "source": "workflow-call-input" }, "github-governance-receipt-json": { "classification": "digest-only", "source": "workflow-call-input" }, "github-release": { "classification": "included", "source": "workflow-call-input" }, "package-name": { "classification": "included", "source": "workflow-call-input" }, "publish-dist-tag": { "classification": "included", "source": "workflow-call-input" }, "publisher-workflow-path": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-impact-json": { "classification": "digest-only", "source": "workflow-call-input" }, "release-passport-output-dir": { "classification": "included", "source": "workflow-call-input" }, "release-passport-product-name": { "classification": "included", "source": "workflow-call-input" }, "required-status-check": { "classification": "included", "source": "workflow-call-input" }, "runtime-ref": { "classification": "included", "source": "workflow-call-input" }, "runtime-selection": { "classification": "included", "source": "workflow-call-input" }, "target-ref": { "classification": "included", "source": "workflow-call-input" }, "target-sha": { "classification": "included", "source": "workflow-call-input" }, "toolchain-type": { "classification": "included", "source": "workflow-call-input" }, "verify-command": { "classification": "digest-only", "source": "workflow-call-input" }, "working-directory": { "classification": "digest-only", "source": "workflow-call-input" }, "candidate-receipt-digest": { "classification": "included", "source": "admitted-publication-candidate" } }, "expected": { "stages": [ { "id": "resolve-runtime", "required": true }, { "id": "build", "required": true }, { "id": "verify", "required": false }, { "id": "collect", "required": true }, { "id": "publication-authority", "required": true }, { "id": "publish", "required": true }, { "id": "passport", "required": true }, { "id": "aggregate", "required": true } ], "capabilities": [ "publication-build", "artifact-admission", "publication-authority", "release-publish", "release-passport" ], "evidence": [ "publication-manifest", "release-passport", "controller-receipt" ] }, "digest": "sha256:f98dae8ad9a494e651690ac128cf4b1b4a6df55cfb255ecca24dae60d0d205fa" }, { "schemaVersion": 1, "contract": "buildchain.controller-descriptor/v1", "id": "release-candidate-promotion", "version": 1, "workflow": { "id": ".release-promote", "path": ".github/workflows/.release-promote.yml" }, "inputs": { "BUILDCHAIN_ISSUE_APP_ID": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_ISSUE_TOKEN": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_PROMOTION_TOKEN": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY": { "classification": "redacted", "source": "workflow-call-secret" }, "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN": { "classification": "redacted", "source": "workflow-call-secret" }, "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY": { "classification": "redacted", "source": "workflow-call-secret" }, "buildchain-issue-app-id": { "classification": "redacted", "source": "workflow-call-secret" }, "buildchain-issue-app-private-key": { "classification": "redacted", "source": "workflow-call-secret" }, "buildchain-issue-token": { "classification": "redacted", "source": "workflow-call-secret" }, "contract-lock": { "classification": "included", "source": "workflow-call-input" }, "request-json": { "classification": "digest-only", "source": "workflow-call-input" }, "runtime-ref": { "classification": "included", "source": "workflow-call-input" }, "runtime-selection": { "classification": "included", "source": "workflow-call-input" } }, "expected": { "stages": [ { "id": "preflight", "required": true }, { "id": "admit-release-candidate", "required": true }, { "id": "publication-authority", "required": true }, { "id": "publish", "required": true }, { "id": "passport", "required": true }, { "id": "aggregate", "required": true } ], "capabilities": [ "promotion-preflight", "artifact-admission", "publication-authority", "publish-transaction", "release-passport" ], "evidence": [ "release-candidate-passport", "publish-evidence", "release-passport", "controller-receipt" ] }, "digest": "sha256:699a18f875d395d830bb07c511ec7e6e9dff1ac97a057004a0e58c51d065ce19" }, { "schemaVersion": 1, "contract": "buildchain.controller-descriptor/v1", "id": "release-propagation", "version": 1, "workflow": { "id": "public-release-propagation", "path": ".github/workflows/public-release-propagation.yml" }, "inputs": { "agent-work-context-json": { "classification": "digest-only", "source": "workflow-call-input" }, "agent-work-mode": { "classification": "included", "source": "workflow-call-input" }, "contract-lock": { "classification": "included", "source": "workflow-call-input" }, "downstream-base-ref": { "classification": "included", "source": "workflow-call-input" }, "downstream-branch": { "classification": "included", "source": "workflow-call-input" }, "downstream-prepare-command": { "classification": "digest-only", "source": "workflow-call-input" }, "downstream-repository": { "classification": "included", "source": "workflow-call-input" }, "downstream-target": { "classification": "included", "source": "workflow-call-input" }, "downstream-update-command": { "classification": "digest-only", "source": "workflow-call-input" }, "downstream-verify-command": { "classification": "digest-only", "source": "workflow-call-input" }, "dry-run": { "classification": "included", "source": "workflow-call-input" }, "graph-json": { "classification": "digest-only", "source": "workflow-call-input" }, "lock-path": { "classification": "digest-only", "source": "workflow-call-input" }, "pr-body": { "classification": "digest-only", "source": "workflow-call-input" }, "pr-title": { "classification": "included", "source": "workflow-call-input" }, "propagation-token": { "classification": "redacted", "source": "workflow-call-secret" }, "refresh-managed-readme-badges": { "classification": "included", "source": "workflow-call-input" }, "runtime-ref": { "classification": "included", "source": "workflow-call-input" }, "runtime-selection": { "classification": "included", "source": "workflow-call-input" }, "source-node": { "classification": "included", "source": "workflow-call-input" }, "upstream-release-json": { "classification": "digest-only", "source": "workflow-call-input" } }, "expected": { "stages": [ { "id": "resolve-runtime", "required": true }, { "id": "plan", "required": true }, { "id": "emit-work", "required": false }, { "id": "write-lock", "required": true }, { "id": "prepare-consumer", "required": false }, { "id": "refresh-badges", "required": false }, { "id": "verify-consumer", "required": false }, { "id": "open-pr", "required": false }, { "id": "aggregate", "required": true } ], "capabilities": [ "release-propagation-plan", "downstream-lock", "agent-native-work-envelope", "resumable-production-handoff" ], "evidence": [ "propagation-plan", "propagation-lock", "controller-receipt" ] }, "digest": "sha256:bf6c18f33642654314281e4f1aaf49c16d3a8e765e62c7162ad53beaef630c76" }, { "schemaVersion": 1, "contract": "buildchain.controller-descriptor/v1", "id": "binary-distribution", "version": 1, "workflow": { "id": "self-build-binary-distribution", "path": ".github/workflows/self-build-binary-distribution.yml" }, "inputs": {}, "expected": { "stages": [ { "id": "resolve-runtime", "required": true }, { "id": "build", "required": true }, { "id": "verify", "required": true }, { "id": "bundle", "required": true }, { "id": "aggregate", "required": true } ], "capabilities": [ "standalone-binary-build", "release-evidence-bundle", "artifact-admission" ], "evidence": [ "release-evidence-bundle", "release-passport", "controller-receipt" ] }, "digest": "sha256:2e6bee5214be76d3f2b8088e23f3a61a79124696f2d69ec3cc86d793d2306ead" } ], "digest": "sha256:f3a2670f026d44ad84d482668ef5ee2a447a4f80f986c96986d61977272bdccd" }