@rightkit/git 0.1.0

package/README.md

@@ -0,0 +1,35 @@
+# @rightkit/git
+
+Public-repo-only GitHub Actions workflow templates for the Right/Orthic product suite. One CLI, `right-git`, that renders and installs CI lanes into a repository — and refuses to touch a private one.
+
+## Why public-only
+
+GitHub Actions minutes are free and unlimited on public repos, and billed on private ones. `@rightkit/git` enforces that boundary in code, not by convention:
+
+1. **Install-time refusal** — `right-git install`/`sync` resolves repo visibility and refuses any private or internal repo, with no override flag. Visibility fails closed: an unconfirmed repo is treated as not-public.
+2. **Run-time guard** — every rendered workflow carries an unconditional `private-repo-guard` job that fails loudly (`exit 1`) if the repo is ever flipped private after install; every other job depends on it.
+3. **Drift audit** — `right-git drift --all` re-checks visibility across managed repos.
+
+## What it does
+
+- **`right-git install|sync`** — render CI lanes (ci, qualification, package-smoke, release-candidate, publish-npm, publish-package-managers) from a `.rightgit.json` manifest into `.github/workflows/`.
+- **`right-git drift`** — detect divergence between installed workflows and templates, and orphaned managed workflows.
+- **`right-git adopt`** — import existing workflows into the template library.
+- **`right-git uninstall`** — remove every managed file, leaving zero behind.
+
+Workflows are thin callers over the repo's own scripts, so a private repo running the same gates locally executes identical checks.
+
+## Credential posture (read before enabling package-manager publishing)
+
+- **No code-signing credential ever reaches CI.** Signing and notarization stay local in `@rightkit/release`. The only publish credential in the npm lane is short-lived OIDC (trusted publishing, no long-lived token).
+- **Exception, disclosed:** the optional, opt-in `publish-package-managers` lane *does* require two owner-provisioned, long-lived tokens in GitHub Actions `secrets.*` (`HOMEBREW_TAP_TOKEN`, `WINGET_CREATE_GITHUB_TOKEN`) to open tap/manifest PRs. These are real bearer tokens, public-repo-scoped by the visibility gate but not zero-exposure. The "no signing credential in CI" invariant is specifically about code-signing material; it does not mean "no credential of any kind."
+
+Manifest input is treated as untrusted: every field flowing into rendered YAML is charset-allowlisted, so a manifest cannot inject `${{ secrets.* }}` or shell/expression syntax.
+
+## Install
+
+```sh
+npm install -g @rightkit/git   # or: npx @rightkit/git --help
+```
+
+Node builtins only; no runtime dependencies.

package/adopt.mjs

@@ -0,0 +1,96 @@
+// Pull an existing repo's hand-written workflows into review-ready template
+// candidates (DESIGN.md §4, "Cortex bootstrap"). Read-only against the
+// source repo. Never writes into templates/ directly — adopt's output is
+// mapped lane content for a human (or a follow-up Sage-authorized change)
+// to review and fold in; silently overwriting the curated, parameterized
+// template library from an arbitrary repo's raw workflow text is exactly
+// the kind of unreviewed mutation this package must not perform on its own.
+
+import fs from "node:fs";
+import path from "node:path";
+import { LANE_FILENAMES } from "./manifest.mjs";
+
+// filename (in the source repo's .github/workflows/) -> lane, for the
+// lanes that map 1:1 onto an existing file.
+const FILENAME_TO_LANE = {
+  "ci.yml": "ci",
+  "qualification.yml": "qualification",
+  "package.yml": "package-smoke",
+  "package-smoke.yml": "package-smoke",
+  "release-candidate.yml": "release-candidate",
+  "publish-npm.yml": "publish-npm",
+  "publish-package-managers.yml": "publish-package-managers",
+};
+
+/** Slice out one top-level job block from a workflow's `jobs:` map by name or predicate. */
+export function extractJobBlock(yamlText, jobNameOrPredicate) {
+  const lines = yamlText.split("\n");
+  const jobsIdx = lines.findIndex((l) => /^jobs:\s*$/.test(l));
+  if (jobsIdx === -1) return null;
+
+  const jobStarts = [];
+  for (let i = jobsIdx + 1; i < lines.length; i++) {
+    if (/^ {2}\S.*:\s*$/.test(lines[i])) jobStarts.push(i);
+  }
+
+  for (let idx = 0; idx < jobStarts.length; idx++) {
+    const start = jobStarts[idx];
+    const end = idx + 1 < jobStarts.length ? jobStarts[idx + 1] : lines.length;
+    const nameMatch = /^ {2}(\S+):/.exec(lines[start]);
+    const name = nameMatch ? nameMatch[1] : null;
+    const block = lines.slice(start, end).join("\n");
+    const matches = typeof jobNameOrPredicate === "function" ? jobNameOrPredicate(name, block) : name === jobNameOrPredicate;
+    if (matches) return { name, block };
+  }
+  return null;
+}
+
+/**
+ * Inspect <repoPath>/.github/workflows/*.yml and map filenames onto known
+ * right-git lanes. Never throws, never writes.
+ * Returns { ok, mapped: [{lane, sourceFile, content}], unmapped: string[], errors }
+ */
+export function adoptCommand(repoPath) {
+  const dir = path.join(repoPath, ".github", "workflows");
+  let entries;
+  try {
+    entries = fs.readdirSync(dir).filter((n) => n.endsWith(".yml") || n.endsWith(".yaml"));
+  } catch (error) {
+    return { ok: false, mapped: [], unmapped: [], errors: [`cannot read ${dir}: ${error.message}`] };
+  }
+
+  const mapped = [];
+  const unmapped = [];
+  const foundLanes = new Set();
+
+  for (const filename of entries) {
+    const lane = FILENAME_TO_LANE[filename];
+    if (lane) {
+      const content = fs.readFileSync(path.join(dir, filename), "utf8");
+      mapped.push({ lane, sourceFile: filename, content });
+      foundLanes.add(lane);
+      continue;
+    }
+    unmapped.push(filename);
+  }
+
+  // publish-npm has no 1:1 file in the Cortex-shaped source layout — it is a
+  // single job inside a larger release workflow (DESIGN.md §6). Best-effort
+  // extraction by scanning any remaining file for a job whose steps run
+  // `npm publish`.
+  if (!foundLanes.has("publish-npm")) {
+    for (const filename of unmapped.slice()) {
+      const content = fs.readFileSync(path.join(dir, filename), "utf8");
+      const job = extractJobBlock(content, (_name, block) => /npm publish/.test(block));
+      if (job) {
+        mapped.push({ lane: "publish-npm", sourceFile: `${filename}#${job.name}`, content: job.block });
+        foundLanes.add("publish-npm");
+        break;
+      }
+    }
+  }
+
+  return { ok: true, mapped, unmapped, errors: [] };
+}
+
+export { LANE_FILENAMES };

package/cli/right-git.mjs

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { installCommand } from "../install.mjs";
+import { syncCommand } from "../sync.mjs";
+import { driftCommand, driftAll } from "../drift.mjs";
+import { adoptCommand } from "../adopt.mjs";
+import { uninstallCommand } from "../uninstall.mjs";
+
+const commands = new Map([
+  ["install", runInstall],
+  ["sync", runSync],
+  ["drift", runDrift],
+  ["adopt", runAdopt],
+  ["uninstall", runUninstall],
+]);
+
+// F7 fix: flags that are always boolean and must never consume the next
+// argv token as a value. Without this, `drift --all <root>` (the documented
+// syntax — see printHelp below) fed `<root>` to parseFlags' generic
+// "--flag value" branch as the *value* of --all, leaving `positional` empty;
+// runDrift then fell back to `.` and silently scanned the current working
+// directory instead of the supplied workspace root. `--all=true` happened to
+// work because the `=` form never consumes a following token. Declared here
+// (above the dispatch below, which calls parseFlags synchronously at module
+// load) rather than next to parseFlags itself, to avoid a temporal-dead-zone
+// ReferenceError on a const declared after its first use point at runtime.
+const BOOLEAN_ONLY_FLAGS = new Set(["all"]);
+
+const args = process.argv.slice(2);
+const first = args[0];
+
+if (!first || first === "-h" || first === "--help") {
+  printHelp();
+  process.exit(first ? 0 : 1);
+} else if (first === "--version" || first === "-v") {
+  const pkg = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+  console.log(pkg.version);
+  process.exit(0);
+} else if (commands.has(first)) {
+  const exitCode = await commands.get(first)(args.slice(1));
+  process.exit(exitCode);
+} else {
+  console.error(`right-git: unknown command: ${first}\n`);
+  printHelp();
+  process.exit(2);
+}
+
+/** Split argv into positional args and --flag / --flag=value pairs. */
+function parseFlags(argv) {
+  const positional = [];
+  const flags = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg.startsWith("--")) {
+      const eq = arg.indexOf("=");
+      if (eq !== -1) {
+        flags[arg.slice(2, eq)] = arg.slice(eq + 1);
+      } else {
+        const key = arg.slice(2);
+        if (!BOOLEAN_ONLY_FLAGS.has(key) && i + 1 < argv.length && !argv[i + 1].startsWith("--")) {
+          flags[key] = argv[++i];
+        } else {
+          flags[key] = true;
+        }
+      }
+    } else {
+      positional.push(arg);
+    }
+  }
+  return { positional, flags };
+}
+
+function printErrors(errors) {
+  for (const error of errors || []) console.error(`  ${error}`);
+}
+
+async function runInstall(argv) {
+  const { positional, flags } = parseFlags(argv);
+  const repoPath = positional[0];
+  if (!repoPath) {
+    console.error("right-git install <repo-path> --lanes ci,qualification,...");
+    return 2;
+  }
+  const opts = {
+    lanes: typeof flags.lanes === "string" ? flags.lanes.split(",").map((s) => s.trim()).filter(Boolean) : undefined,
+    homebrewTap: flags["homebrew-tap"],
+    homebrewFormula: flags["homebrew-formula"],
+    wingetId: flags["winget-id"],
+    provenance: flags["no-provenance"] ? false : undefined,
+  };
+  const result = await installCommand(path.resolve(repoPath), opts);
+  if (!result.ok) {
+    console.error(`right-git install: failed at stage '${result.stage}'`);
+    printErrors(result.errors);
+    return 1;
+  }
+  console.log(`right-git install: wrote ${result.manifestPath} and synced ${result.plan.changes.length} workflow file(s).`);
+  return 0;
+}
+
+async function runSync(argv) {
+  const { positional, flags } = parseFlags(argv);
+  const repoPath = positional[0];
+  if (!repoPath) {
+    console.error("right-git sync <repo-path> [--dry-run]");
+    return 2;
+  }
+  const result = await syncCommand(path.resolve(repoPath), { dryRun: Boolean(flags["dry-run"]) });
+  if (!result.ok) {
+    console.error(`right-git sync: failed at stage '${result.stage}'`);
+    printErrors(result.errors);
+    return 1;
+  }
+  const changed = result.changes.filter((c) => c.action !== "unchanged");
+  console.log(changed.length === 0 ? "right-git sync: already up to date." : `right-git sync: ${changed.length} file(s) ${flags["dry-run"] ? "would change" : "changed"}.`);
+  return 0;
+}
+
+async function runDrift(argv) {
+  const { positional, flags } = parseFlags(argv);
+  if (flags.all) {
+    const root = path.resolve(positional[0] || ".");
+    const results = await driftAll(root);
+    let anyDrift = false;
+    for (const { repoPath, result } of results) {
+      if (!result.ok) {
+        console.error(`${repoPath}: error`);
+        printErrors(result.errors);
+        anyDrift = true;
+        continue;
+      }
+      console.log(`${repoPath}: visibility=${result.visibility.visibility} drift=${result.driftDetected}`);
+      for (const finding of result.findings) {
+        if (finding.status !== "match") console.log(`  ${finding.status}: ${finding.filename}`);
+      }
+      if (result.driftDetected) anyDrift = true;
+    }
+    return anyDrift ? 1 : 0;
+  }
+
+  const repoPath = positional[0];
+  if (!repoPath) {
+    console.error("right-git drift <repo-path> | right-git drift --all [workspace-root]");
+    return 2;
+  }
+  const result = await driftCommand(path.resolve(repoPath));
+  if (!result.ok) {
+    console.error("right-git drift: failed");
+    printErrors(result.errors);
+    return 1;
+  }
+  console.log(`visibility=${result.visibility.visibility} drift=${result.driftDetected}`);
+  for (const finding of result.findings) console.log(`  ${finding.status}: ${finding.filename}`);
+  return result.driftDetected ? 1 : 0;
+}
+
+async function runAdopt(argv) {
+  const { positional, flags } = parseFlags(argv);
+  const repoPath = positional[0];
+  if (!repoPath) {
+    console.error("right-git adopt <repo-path> [--out <dir>]");
+    return 2;
+  }
+  const result = adoptCommand(path.resolve(repoPath));
+  if (!result.ok) {
+    console.error("right-git adopt: failed");
+    printErrors(result.errors);
+    return 1;
+  }
+  for (const { lane, sourceFile } of result.mapped) console.log(`mapped ${lane} <- ${sourceFile}`);
+  for (const filename of result.unmapped) console.log(`unmapped: ${filename}`);
+  if (typeof flags.out === "string") {
+    fs.mkdirSync(flags.out, { recursive: true });
+    for (const { lane, content } of result.mapped) {
+      fs.writeFileSync(path.join(flags.out, `${lane}.yml`), content, "utf8");
+    }
+    console.log(`right-git adopt: wrote ${result.mapped.length} candidate template(s) to ${flags.out} for review.`);
+  }
+  return 0;
+}
+
+async function runUninstall(argv) {
+  const { positional } = parseFlags(argv);
+  const repoPath = positional[0];
+  if (!repoPath) {
+    console.error("right-git uninstall <repo-path>");
+    return 2;
+  }
+  const result = uninstallCommand(path.resolve(repoPath));
+  console.log(result.removed.length === 0 ? "right-git uninstall: no managed files found." : `right-git uninstall: removed ${result.removed.length} file(s): ${result.removed.join(", ")}`);
+  return 0;
+}
+
+function printHelp() {
+  console.log(`right-git <command> [options]
+
+Commands:
+  install <repo-path> --lanes ci,qualification,...   Write .rightgit.json and render workflows; refuses private repos
+  sync <repo-path> [--dry-run]                        Re-render templates from .rightgit.json, show diff, apply
+  drift <repo-path>                                   CI-safe check: installed workflows == rendered templates?
+  drift --all [workspace-root]                        Drift-check + re-check visibility for every managed repo found
+  adopt <repo-path> [--out <dir>]                      Map an existing repo's workflows onto right-git lanes for review
+  uninstall <repo-path>                                Remove every right-git-managed workflow file
+
+Public-repo only: install/sync refuse private, internal, or unconfirmed-visibility repos. No override flag (invariant I1).`);
+}

package/cli.test.mjs

@@ -0,0 +1,68 @@
+// CLI-level regression coverage for right-git.mjs. cli/right-git.mjs is a
+// true entrypoint (it dispatches on process.argv at module-load time), not a
+// library module, so its argument parsing can only be exercised honestly by
+// spawning it as a real subprocess with real argv — the same way the QA
+// report reproduced F7.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+import { SAMPLE_MANIFEST } from "./test-support.mjs";
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)));
+const cliPath = path.join(packageRoot, "cli", "right-git.mjs");
+
+function runCli(args, cwd) {
+  return spawnSync(process.execPath, [cliPath, ...args], { cwd, encoding: "utf8" });
+}
+
+// F7 regression: `right-git drift --all <root>` is the documented syntax
+// (see printHelp: "drift --all [workspace-root]"). The old parseFlags
+// treated `--all` like any other "--flag value" pair, so it consumed the
+// root path as --all's *value* instead of leaving it positional; runDrift
+// then fell back to `path.resolve(positional[0] || ".")`, silently scanning
+// the current working directory instead of the supplied root. Only the
+// undocumented `--all=true <root>` form worked. Prove the fix by running the
+// CLI from a cwd that has no managed repos, with the real fixture root
+// passed as a plain trailing argument, and asserting the fixture repo is the
+// one actually discovered.
+test("F7: `right-git drift --all <root>` (space-separated) scopes the scan to the given root, not process.cwd()", () => {
+  const fixtureRoot = fs.mkdtempSync(path.join(os.tmpdir(), "right-git-cli-root-"));
+  const repoDir = path.join(fixtureRoot, "managed-repo");
+  fs.mkdirSync(repoDir, { recursive: true });
+  fs.writeFileSync(path.join(repoDir, ".rightgit.json"), `${JSON.stringify(SAMPLE_MANIFEST, null, 2)}\n`, "utf8");
+  fs.writeFileSync(path.join(repoDir, "package.json"), JSON.stringify({ name: "widgets" }), "utf8");
+
+  // Deliberately not fixtureRoot and carries no managed repo of its own —
+  // if the bug is present, the CLI scans this directory instead and the
+  // fixture repo is never mentioned in the output.
+  const emptyCwd = fs.mkdtempSync(path.join(os.tmpdir(), "right-git-cli-cwd-"));
+
+  const result = runCli(["drift", "--all", fixtureRoot], emptyCwd);
+
+  const output = `${result.stdout}${result.stderr}`;
+  assert.ok(
+    output.includes(repoDir),
+    `expected 'drift --all ${fixtureRoot}' (run from an unrelated cwd) to discover ${repoDir}; got stdout=${JSON.stringify(result.stdout)} stderr=${JSON.stringify(result.stderr)}`,
+  );
+});
+
+// Non-regression: the workaround documented by the QA report, `--all=true`
+// followed by the root, must keep working exactly as before.
+test("`right-git drift --all=true <root>` still scopes the scan to the given root", () => {
+  const fixtureRoot = fs.mkdtempSync(path.join(os.tmpdir(), "right-git-cli-root-eq-"));
+  const repoDir = path.join(fixtureRoot, "managed-repo");
+  fs.mkdirSync(repoDir, { recursive: true });
+  fs.writeFileSync(path.join(repoDir, ".rightgit.json"), `${JSON.stringify(SAMPLE_MANIFEST, null, 2)}\n`, "utf8");
+  fs.writeFileSync(path.join(repoDir, "package.json"), JSON.stringify({ name: "widgets" }), "utf8");
+
+  const emptyCwd = fs.mkdtempSync(path.join(os.tmpdir(), "right-git-cli-cwd-eq-"));
+  const result = runCli(["drift", `--all=true`, fixtureRoot], emptyCwd);
+
+  const output = `${result.stdout}${result.stderr}`;
+  assert.ok(output.includes(repoDir), `expected discovery of ${repoDir}; got stdout=${JSON.stringify(result.stdout)} stderr=${JSON.stringify(result.stderr)}`);
+});

package/drift.mjs

@@ -0,0 +1,133 @@
+// Compare installed workflows against what the manifest would render today
+// (DESIGN.md §4, invariant I4: no silent forks). `--all` enumerates every
+// repo carrying a `.rightgit.json` under a workspace root and re-checks
+// visibility, flagging public->private flips (DESIGN.md §5 layer 3).
+
+import fs from "node:fs";
+import path from "node:path";
+import { assertPublic } from "./policy/visibility-gate.mjs";
+import { loadManifest } from "./manifest.mjs";
+import { renderLanes, listManagedFiles } from "./sync.mjs";
+import { MANAGED_MARKER } from "./render.mjs";
+
+const IGNORED_DIRS = new Set(["node_modules", ".git", ".pnpm-store"]);
+
+/**
+ * Drift-check one repo. Never throws. Returns:
+ * { ok, driftDetected, visibility, findings: [{filename, status}], errors }
+ * status is one of: match | mismatch | missing | unmanaged-extra | orphan
+ */
+export async function driftCommand(repoPath, deps = {}) {
+  const visibility = await assertPublic(repoPath, deps);
+
+  const loaded = loadManifest(repoPath);
+  if (!loaded.ok) {
+    // F7: a repo can carry right-git-managed workflow files (identified by
+    // MANAGED_MARKER) with no readable .rightgit.json — e.g. the manifest
+    // was deleted, never committed, or lost in an interrupted install. That
+    // is drift to report, not a tool failure to hide behind: the old
+    // behavior returned a hard `ok:false` here with no findings, which made
+    // `findManagedRepos` (below) — and therefore `drift --all` — blind to
+    // exactly this repo.
+    const orphanManaged = listManagedFiles(repoPath);
+    if (orphanManaged.length > 0) {
+      return {
+        ok: true,
+        driftDetected: true,
+        visibility,
+        findings: orphanManaged.map((filename) => ({ filename, status: "orphan" })),
+        errors: [],
+      };
+    }
+    return { ok: false, driftDetected: null, visibility, findings: [], errors: loaded.errors };
+  }
+
+  const rendered = renderLanes(loaded.manifest, repoPath);
+  const wantedFilenames = new Set(rendered.map((r) => r.filename));
+  const findings = [];
+
+  for (const { filename, content } of rendered) {
+    const target = path.join(repoPath, ".github", "workflows", filename);
+    let existing = null;
+    try {
+      existing = fs.readFileSync(target, "utf8");
+    } catch {
+      // not installed
+    }
+    if (existing === null) {
+      findings.push({ filename, status: "missing" });
+    } else if (existing !== content) {
+      findings.push({ filename, status: "mismatch" });
+    } else {
+      findings.push({ filename, status: "match" });
+    }
+  }
+
+  for (const managedFilename of listManagedFiles(repoPath)) {
+    if (!wantedFilenames.has(managedFilename)) {
+      findings.push({ filename: managedFilename, status: "unmanaged-extra" });
+    }
+  }
+
+  const driftDetected = findings.some((f) => f.status !== "match") || !visibility.allowed;
+  return { ok: true, driftDetected, visibility, findings, errors: [] };
+}
+
+/**
+ * Recursively find every repo under root carrying right-git-managed state:
+ * either a `.rightgit.json` manifest, or (F7) a `.github/workflows/*.yml`
+ * file that starts with MANAGED_MARKER with no manifest present — an
+ * "orphan" repo the old implementation never discovered because it looked
+ * only for the manifest filename.
+ */
+export function findManagedRepos(root) {
+  const found = new Set();
+  const stack = [root];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+
+    if (entries.some((e) => e.isFile() && e.name === ".rightgit.json")) {
+      found.add(dir);
+    }
+
+    if (path.basename(dir) === "workflows" && path.basename(path.dirname(dir)) === ".github") {
+      const hasManagedWorkflow = entries.some(
+        (e) => e.isFile() && (e.name.endsWith(".yml") || e.name.endsWith(".yaml")) && startsWithManagedMarker(path.join(dir, e.name)),
+      );
+      if (hasManagedWorkflow) {
+        found.add(path.dirname(path.dirname(dir)));
+      }
+    }
+
+    for (const entry of entries) {
+      if (entry.isDirectory() && !IGNORED_DIRS.has(entry.name)) {
+        stack.push(path.join(dir, entry.name));
+      }
+    }
+  }
+  return [...found];
+}
+
+function startsWithManagedMarker(filePath) {
+  try {
+    return fs.readFileSync(filePath, "utf8").startsWith(MANAGED_MARKER);
+  } catch {
+    return false;
+  }
+}
+
+/** `right-git drift --all <workspace-root>`: drift-check every managed repo found under root. */
+export async function driftAll(workspaceRoot, deps = {}) {
+  const repos = findManagedRepos(workspaceRoot);
+  const results = [];
+  for (const repoPath of repos) {
+    results.push({ repoPath, result: await driftCommand(repoPath, deps) });
+  }
+  return results;
+}

package/drift.test.mjs

@@ -0,0 +1,98 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { syncCommand } from "./sync.mjs";
+import { driftCommand, findManagedRepos } from "./drift.mjs";
+import { makeTempRepo, PUBLIC_DEPS, PRIVATE_DEPS, SAMPLE_MANIFEST } from "./test-support.mjs";
+
+test("drift reports no drift right after a clean sync", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  await syncCommand(dir, { deps: PUBLIC_DEPS });
+  const result = await driftCommand(dir, PUBLIC_DEPS);
+  assert.equal(result.ok, true);
+  assert.equal(result.driftDetected, false);
+  assert.ok(result.findings.every((f) => f.status === "match"));
+});
+
+test("drift detects a hand-mutated managed file", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  await syncCommand(dir, { deps: PUBLIC_DEPS });
+  const ciPath = path.join(dir, ".github", "workflows", "ci.yml");
+  fs.appendFileSync(ciPath, "\n# hand edit\n");
+
+  const result = await driftCommand(dir, PUBLIC_DEPS);
+  assert.equal(result.ok, true);
+  assert.equal(result.driftDetected, true);
+  const ciFinding = result.findings.find((f) => f.filename === "ci.yml");
+  assert.equal(ciFinding.status, "mismatch");
+});
+
+test("drift flags driftDetected when a lane's file is missing", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  await syncCommand(dir, { deps: PUBLIC_DEPS });
+  fs.rmSync(path.join(dir, ".github", "workflows", "ci.yml"));
+
+  const result = await driftCommand(dir, PUBLIC_DEPS);
+  assert.equal(result.driftDetected, true);
+  assert.ok(result.findings.some((f) => f.filename === "ci.yml" && f.status === "missing"));
+});
+
+test("drift flags a public->private visibility flip even with no file drift", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  await syncCommand(dir, { deps: PUBLIC_DEPS });
+  const result = await driftCommand(dir, PRIVATE_DEPS);
+  assert.equal(result.driftDetected, true);
+  assert.equal(result.visibility.allowed, false);
+});
+
+test("findManagedRepos finds every directory carrying a .rightgit.json under a root", () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "right-git-root-"));
+  const repoA = makeTempRepo(SAMPLE_MANIFEST);
+  const repoB = makeTempRepo(SAMPLE_MANIFEST);
+  fs.cpSync(repoA, path.join(root, "repo-a"), { recursive: true });
+  fs.cpSync(repoB, path.join(root, "repo-b"), { recursive: true });
+  fs.mkdirSync(path.join(root, "not-managed"));
+
+  const found = findManagedRepos(root).map((p) => path.basename(p)).sort();
+  assert.deepEqual(found, ["repo-a", "repo-b"]);
+});
+
+// F7 regression: a repo whose .rightgit.json was deleted (or never
+// committed) but whose .github/workflows/ still carries MANAGED_MARKER
+// files is an "orphan" — right-git put those workflows there, but the
+// manifest-only scan in the old findManagedRepos could never see it, so
+// `drift --all` silently skipped exactly the repos most likely to be
+// drifted (missing manifest is itself drift).
+test("findManagedRepos finds an orphan repo: managed workflow files present, .rightgit.json missing", () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "right-git-orphan-root-"));
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  fs.cpSync(dir, path.join(root, "orphan-repo"), { recursive: true });
+
+  const orphanDir = path.join(root, "orphan-repo");
+  // A synced install would leave workflow files; simulate that state
+  // directly, then remove the manifest to reproduce "manifest lost, workflow
+  // files remain".
+  fs.mkdirSync(path.join(orphanDir, ".github", "workflows"), { recursive: true });
+  fs.writeFileSync(
+    path.join(orphanDir, ".github", "workflows", "ci.yml"),
+    "# Managed by right-git — do not hand-edit. Run `right-git sync` to update.\nname: ci\n",
+    "utf8",
+  );
+  fs.rmSync(path.join(orphanDir, ".rightgit.json"));
+
+  const found = findManagedRepos(root).map((p) => path.basename(p)).sort();
+  assert.deepEqual(found, ["orphan-repo"]);
+});
+
+test("driftCommand reports an orphan repo as drift instead of a hard failure", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  await syncCommand(dir, { deps: PUBLIC_DEPS });
+  fs.rmSync(path.join(dir, ".rightgit.json"));
+
+  const result = await driftCommand(dir, PUBLIC_DEPS);
+  assert.equal(result.ok, true);
+  assert.equal(result.driftDetected, true);
+  assert.ok(result.findings.some((f) => f.status === "orphan" && f.filename === "ci.yml"));
+});