@rightkit/git 0.1.0 → 0.2.1

package/README.md

@@ -19,6 +19,8 @@ GitHub Actions minutes are free and unlimited on public repos, and billed on pri
 
 Workflows are thin callers over the repo's own scripts, so a private repo running the same gates locally executes identical checks.
 
+Sync records exact prior bytes, refuses unmanaged same-name workflows, & preflights every target before any write. Qualification preserves schema logs with a unique required artifact.
+
 ## Credential posture (read before enabling package-manager publishing)
 
 - **No code-signing credential ever reaches CI.** Signing and notarization stay local in `@rightkit/release`. The only publish credential in the npm lane is short-lived OIDC (trusted publishing, no long-lived token).
@@ -33,3 +35,7 @@ npm install -g @rightkit/git   # or: npx @rightkit/git --help
 ```
 
 Node builtins only; no runtime dependencies.
+
+## Profiles
+
+`profile` defaults to `node`. `rust-hybrid` accepts only `ci`, requires safe relative `gate.path`, installs pinned Node plus `rustup stable`, then runs that gate. It never adds release, signing, publishing, or approval steps.

package/cli/right-git.mjs

@@ -79,7 +79,7 @@ async function runInstall(argv) {
   const { positional, flags } = parseFlags(argv);
   const repoPath = positional[0];
   if (!repoPath) {
-    console.error("right-git install <repo-path> --lanes ci,qualification,...");
+    console.error("right-git install <repo-path> --lanes ci,qualification,... [--profile node|rust-hybrid --gate-path scripts/gate.sh]");
     return 2;
   }
   const opts = {
@@ -88,6 +88,8 @@ async function runInstall(argv) {
     homebrewFormula: flags["homebrew-formula"],
     wingetId: flags["winget-id"],
     provenance: flags["no-provenance"] ? false : undefined,
+    profile: flags.profile,
+    gatePath: flags["gate-path"],
   };
   const result = await installCommand(path.resolve(repoPath), opts);
   if (!result.ok) {
@@ -196,7 +198,7 @@ function printHelp() {
   console.log(`right-git <command> [options]
 
 Commands:
-  install <repo-path> --lanes ci,qualification,...   Write .rightgit.json and render workflows; refuses private repos
+  install <repo-path> --lanes ci,... [--profile rust-hybrid --gate-path scripts/gate.sh]  Write .rightgit.json and render workflows; refuses private repos
   sync <repo-path> [--dry-run]                        Re-render templates from .rightgit.json, show diff, apply
   drift <repo-path>                                   CI-safe check: installed workflows == rendered templates?
   drift --all [workspace-root]                        Drift-check + re-check visibility for every managed repo found

package/guard-coverage.test.mjs

@@ -54,7 +54,7 @@ const FULL_MANIFEST = {
   schemaVersion: 1,
   lanes: [...KNOWN_LANES],
   matrix: { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   publish: {
     npm: { oidc: true, provenance: true },
     homebrew: { tap: "acme/homebrew-tap", formulaName: "widgets" },
@@ -218,3 +218,18 @@ test("F5: private-repo-guard job has no job-level `if` (always runs) and fails o
     );
   }
 });
+
+test("qualification preserves failing schema evidence as a unique required artifact", () => {
+  const template = fs.readFileSync(path.join(templatesDir, "qualification.yml"), "utf8");
+  assert.doesNotMatch(template, /\|\| true/);
+  assert.match(template, /set -o pipefail[\s\S]*tee qualification-schema\.log/);
+  assert.match(template, /uses: actions\/upload-artifact@v4[\s\S]*github\.run_id[\s\S]*github\.run_attempt[\s\S]*if-no-files-found: error/);
+});
+
+test("rust-hybrid ci keeps its work behind the public-repository guard", () => {
+  const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
+  const template = fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8");
+  const jobs = parseJobs(renderTemplate(template, buildRenderContext(manifest, "/repos/widgets")));
+  assert.ok(isGuarded(jobs, "private-repo-guard"));
+  assert.ok(isGuarded(jobs, "ci"));
+});

package/install.mjs

@@ -9,11 +9,11 @@ import fs from "node:fs";
 import path from "node:path";
 import { assertPublic } from "./policy/visibility-gate.mjs";
 import { MANIFEST_FILENAME, validateManifest } from "./manifest.mjs";
-import { syncCommand } from "./sync.mjs";
+import { applyPlan, planSync } from "./sync.mjs";
 
 export const DEFAULT_MATRIX = { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] };
-export const DEFAULT_PACKAGE_MANAGER = "pnpm@11.18.0";
-export const DEFAULT_TEMPLATE_VERSION = "1.0.0";
+export const DEFAULT_PACKAGE_MANAGER = "pnpm@11.24.0";
+export const DEFAULT_TEMPLATE_VERSION = "1.1.0";
 
 /**
  * opts: { lanes: string[], matrix?, packageManager?, templateVersion?,
@@ -43,6 +43,8 @@ export async function installCommand(repoPath, opts = {}, deps = {}) {
     packageManager: opts.packageManager || DEFAULT_PACKAGE_MANAGER,
     templateVersion: opts.templateVersion || DEFAULT_TEMPLATE_VERSION,
   };
+  if (opts.profile) manifest.profile = opts.profile;
+  if (opts.gatePath) manifest.gate = { path: opts.gatePath };
 
   if (lanes.includes("publish-npm")) {
     manifest.publish = { ...manifest.publish, npm: { oidc: true, provenance: opts.provenance !== false } };
@@ -65,8 +67,14 @@ export async function installCommand(repoPath, opts = {}, deps = {}) {
   const { valid, errors } = validateManifest(manifest);
   if (!valid) return { ok: false, stage: "manifest-invalid", errors };
 
-  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
-
-  const plan = await syncCommand(repoPath, { dryRun: false, deps });
-  return { ok: plan.ok, stage: "synced", errors: plan.errors || [], manifestPath, plan };
+  const manifestBytes = `${JSON.stringify(manifest, null, 2)}\n`;
+  const plan = await planSync(repoPath, deps, manifest);
+  if (!plan.ok) return { ok: false, stage: plan.stage, errors: plan.errors, plan };
+  fs.writeFileSync(manifestPath, manifestBytes, "utf8");
+  const applied = applyPlan(repoPath, plan);
+  if (!applied.ok) {
+    if (fs.readFileSync(manifestPath, "utf8") === manifestBytes) fs.rmSync(manifestPath);
+    return { ok: false, stage: applied.stage, errors: applied.errors, plan };
+  }
+  return { ok: true, stage: "synced", errors: [], manifestPath, plan };
 }

package/manifest.mjs

@@ -55,7 +55,10 @@ const TOP_LEVEL_KEYS = new Set([
   "packageManager",
   "publish",
   "templateVersion",
+  "profile",
+  "gate",
 ]);
+const GATE_PATH_RE = /^(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 
 /**
  * Validate a parsed manifest object against the right-git manifest contract.
@@ -117,6 +120,17 @@ export function validateManifest(manifest) {
     errors.push("templateVersion must be a semver string 'X.Y.Z'");
   }
 
+  const profile = manifest.profile === undefined ? "node" : manifest.profile;
+  if (profile !== "node" && profile !== "rust-hybrid") errors.push("profile must be 'node' or 'rust-hybrid'");
+  if (profile === "rust-hybrid") {
+    if (lanes.length !== 1 || lanes[0] !== "ci") errors.push("profile 'rust-hybrid' supports only lane 'ci'");
+    if (!manifest.gate || typeof manifest.gate !== "object" || Array.isArray(manifest.gate) || Object.keys(manifest.gate).some((key) => key !== "path") || typeof manifest.gate.path !== "string" || !GATE_PATH_RE.test(manifest.gate.path)) {
+      errors.push("profile 'rust-hybrid' requires gate.path with a safe relative path");
+    }
+  } else if (manifest.gate !== undefined) {
+    errors.push("gate is only valid for profile 'rust-hybrid'");
+  }
+
   const publish = manifest.publish;
   if (publish !== undefined) {
     if (publish === null || typeof publish !== "object" || Array.isArray(publish)) {
@@ -218,7 +232,12 @@ function parsePackageManager(spec) {
     yarn: "yarn install --frozen-lockfile",
   }[name];
   const runPrefix = { pnpm: "pnpm run", npm: "npm run", yarn: "yarn run" }[name];
-  return { name, version, installCommand, runPrefix };
+  const setup = {
+    pnpm: `      - uses: pnpm/action-setup@v4\n        with:\n          version: ${version}`,
+    npm: "",
+    yarn: `      - run: corepack enable && corepack prepare yarn@${version} --activate`,
+  }[name];
+  return { name, version, installCommand, runPrefix, setup };
 }
 
 function yamlFlowStringList(values) {
@@ -256,11 +275,14 @@ export function buildRenderContext(manifest, repoPath) {
     NODE_MATRIX: yamlFlowStringList(manifest.matrix.node),
     NODE_PUBLISH_VERSION: JSON.stringify(String(manifest.matrix.node[0])),
     PM_NAME: pm.name,
+    PM_VERSION: pm.version,
     PM_CACHE: pm.name,
     INSTALL_COMMAND: pm.installCommand,
     PM_RUN: pm.runPrefix,
+    PACKAGE_MANAGER_SETUP: pm.setup,
     ARTIFACT_PREFIX: artifactPrefix,
     TEMPLATE_VERSION: manifest.templateVersion,
+    GATE_PATH: manifest.gate?.path,
   };
 
   if (manifest.publish?.npm) {

package/manifest.schema.json

@@ -81,5 +81,10 @@
       "type": "string",
       "pattern": "^\\d+\\.\\d+\\.\\d+$"
     }
+    ,"profile": { "enum": ["node", "rust-hybrid"] },
+    "gate": {
+      "type": "object", "required": ["path"], "additionalProperties": false,
+      "properties": { "path": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" } }
+    }
   }
 }

package/manifest.test.mjs

@@ -6,7 +6,7 @@ const VALID_MINIMAL = {
   schemaVersion: 1,
   lanes: ["ci"],
   matrix: { os: ["ubuntu-latest"], node: ["22.13"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   templateVersion: "1.0.0",
 };
 
@@ -16,6 +16,15 @@ test("accepts a minimal valid manifest", () => {
   assert.deepEqual(errors, []);
 });
 
+test("rust-hybrid requires only ci and a safe gate path", () => {
+  const valid = { ...VALID_MINIMAL, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
+  assert.equal(validateManifest(valid).valid, true);
+  for (const path of ["/tmp/gate.sh", "../gate.sh", "scripts/gate sh", "${{ secrets.X }}", "scripts/gate;sh"]) {
+    assert.equal(validateManifest({ ...valid, gate: { path } }).valid, false, path);
+  }
+  assert.equal(validateManifest({ ...valid, lanes: ["ci", "qualification"] }).valid, false);
+});
+
 test("rejects non-object input", () => {
   for (const bad of [null, undefined, "not an object", 42, ["array"]]) {
     const { valid, errors } = validateManifest(bad);

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@rightkit/git",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
+  "license": "MIT OR Apache-2.0",
   "type": "module",
   "bin": {
     "right-git": "cli/right-git.mjs"
@@ -14,17 +15,16 @@
     "*.json"
   ],
   "sideEffects": false,
-  "scripts": {
-    "test": "node --test *.test.mjs"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/adrdsouza/claude.git",
+    "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/git"
   },
-  "packageManager": "pnpm@11.18.0"
-}
+  "scripts": {
+    "test": "node --test *.test.mjs"
+  }
+}

package/render.test.mjs

@@ -13,7 +13,7 @@ const FULL_MANIFEST = {
   schemaVersion: 1,
   lanes: [...KNOWN_LANES],
   matrix: { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   publish: {
     npm: { oidc: true, provenance: true },
     homebrew: { tap: "acme/homebrew-tap", formulaName: "widgets" },
@@ -42,6 +42,15 @@ test("every known lane has a template file and renders without an unresolved pla
   assert.equal(Object.keys(rendered).length, KNOWN_LANES.length);
 });
 
+test("rust-hybrid ci renders its pinned package manager and gate", () => {
+  const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" }, templateVersion: "1.1.0" };
+  const content = renderTemplate(fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"), buildRenderContext(manifest, "/repos/widgets"));
+  assert.match(content, /uses: pnpm\/action-setup@v4/);
+  assert.match(content, /version: 11\.24\.0/);
+  assert.match(content, /rustup toolchain install stable/);
+  assert.match(content, /bash \.\/scripts\/gate\.sh/);
+});
+
 test("render determinism: same manifest renders byte-identical output every time", () => {
   const first = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
   const second = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
@@ -50,6 +59,39 @@ test("render determinism: same manifest renders byte-identical output every time
   }
 });
 
+test("rendered workflows never request pnpm or yarn setup-node caching before package-manager activation", () => {
+  for (const packageManager of ["pnpm@11.24.0", "yarn@4.6.0"]) {
+    const rendered = renderAllLanes({ ...FULL_MANIFEST, packageManager }, "/repos/widgets");
+    for (const [lane, content] of Object.entries(rendered)) {
+      assert.doesNotMatch(
+        content,
+        /^\s*cache:\s*(?:pnpm|yarn)\s*$/m,
+        `lane ${lane} must not ask actions/setup-node for ${packageManager.split("@")[0]} caching before corepack activation`,
+      );
+    }
+  }
+});
+
+test("rendered workflows bootstrap each declared package manager safely", () => {
+  const pnpm = renderAllLanes({ ...FULL_MANIFEST, packageManager: "pnpm@11.24.0" }, "/repos/widgets");
+  for (const content of Object.values(pnpm)) {
+    assert.match(content, /uses: pnpm\/action-setup@v4/);
+    assert.match(content, /version: 11\.24\.0/);
+    assert.doesNotMatch(content, /corepack enable/);
+  }
+
+  const npm = renderAllLanes({ ...FULL_MANIFEST, packageManager: "npm@11.0.0" }, "/repos/widgets");
+  for (const content of Object.values(npm)) {
+    assert.doesNotMatch(content, /pnpm\/action-setup|corepack enable/);
+  }
+
+  const yarn = renderAllLanes({ ...FULL_MANIFEST, packageManager: "yarn@4.6.0" }, "/repos/widgets");
+  for (const content of Object.values(yarn)) {
+    assert.match(content, /corepack prepare yarn@4\.6\.0 --activate/);
+    assert.doesNotMatch(content, /pnpm\/action-setup/);
+  }
+});
+
 // F5 fix: a job-level `if: !private` on the real work job means GitHub
 // SKIPS that job entirely for a private repo — the nested "refuse" step
 // inside it is then unreachable and never runs, so nothing fails and the

package/sync.mjs

@@ -18,7 +18,9 @@ export function renderLanes(manifest, repoPath) {
   const context = buildRenderContext(manifest, repoPath);
   return manifest.lanes.map((lane) => {
     const filename = LANE_FILENAMES[lane];
-    const templatePath = path.join(TEMPLATES_DIR, filename);
+    const templatePath = manifest.profile === "rust-hybrid"
+      ? path.join(TEMPLATES_DIR, "profiles", "rust-hybrid", filename)
+      : path.join(TEMPLATES_DIR, filename);
     const templateText = fs.readFileSync(templatePath, "utf8");
     return { lane, filename, content: renderTemplate(templateText, context) };
   });
@@ -68,13 +70,15 @@ export function lineDiff(oldText, newText) {
  * managed file whose lane fell out of the manifest.
  * Returns a typed result — never throws.
  */
-export async function planSync(repoPath, deps = {}) {
+export async function planSync(repoPath, deps = {}, manifestOverride = null) {
   const visibility = await assertPublic(repoPath, deps);
   if (!visibility.allowed) {
     return { ok: false, stage: "visibility", errors: [visibility.reason], changes: [] };
   }
 
-  const loaded = loadManifest(repoPath);
+  const loaded = manifestOverride === null
+    ? loadManifest(repoPath)
+    : { ok: true, manifest: manifestOverride };
   if (!loaded.ok) {
     return { ok: false, stage: "manifest", errors: loaded.errors, changes: [] };
   }
@@ -92,24 +96,38 @@ export async function planSync(repoPath, deps = {}) {
       // not installed yet
     }
     if (existing === content) {
-      changes.push({ lane, filename, action: "unchanged", diff: [] });
+      changes.push({ lane, filename, action: "unchanged", before: existing, diff: [] });
+    } else if (existing !== null && !existing.startsWith(MANAGED_MARKER)) {
+      changes.push({ lane, filename, action: "managed-conflict", before: existing, diff: [] });
     } else {
-      changes.push({ lane, filename, action: existing === null ? "create" : "update", diff: lineDiff(existing, content), content });
+      changes.push({ lane, filename, action: existing === null ? "create" : "update", before: existing, diff: lineDiff(existing, content), content });
     }
   }
 
   for (const managedFilename of listManagedFiles(repoPath)) {
     if (!wantedFilenames.has(managedFilename)) {
-      changes.push({ lane: null, filename: managedFilename, action: "remove", diff: [] });
+      changes.push({ lane: null, filename: managedFilename, action: "remove", before: fs.readFileSync(path.join(repoPath, WORKFLOWS_SUBDIR, managedFilename), "utf8"), diff: [] });
     }
   }
 
-  return { ok: true, stage: "planned", errors: [], changes };
+  const conflicts = changes.filter((change) => change.action === "managed-conflict");
+  return conflicts.length
+    ? { ok: false, stage: "managed-conflict", errors: conflicts.map((change) => `${change.filename} is unmanaged`), changes }
+    : { ok: true, stage: "planned", errors: [], changes };
 }
 
 /** Apply a plan produced by planSync: write/update/remove files on disk. */
 export function applyPlan(repoPath, plan) {
   const dir = path.join(repoPath, WORKFLOWS_SUBDIR);
+  for (const change of plan.changes) {
+    if (change.action === "unchanged") continue;
+    const target = path.join(dir, change.filename);
+    let current = null;
+    try { current = fs.readFileSync(target, "utf8"); } catch {}
+    if (current !== change.before) {
+      return { ok: false, stage: "apply-conflict", errors: [`${change.filename} changed after planning`] };
+    }
+  }
   fs.mkdirSync(dir, { recursive: true });
   for (const change of plan.changes) {
     const target = path.join(dir, change.filename);
@@ -119,6 +137,7 @@ export function applyPlan(repoPath, plan) {
       fs.rmSync(target, { force: true });
     }
   }
+  return { ok: true, stage: "applied", errors: [] };
 }
 
 /** Full sync: plan, print diff, apply unless dryRun. Returns the plan. */
@@ -133,7 +152,8 @@ export async function syncCommand(repoPath, { dryRun = false, deps = {} } = {})
   }
 
   if (!dryRun) {
-    applyPlan(repoPath, plan);
+    const applied = applyPlan(repoPath, plan);
+    if (!applied.ok) return { ...plan, ...applied };
   }
   return plan;
 }

package/sync.test.mjs

@@ -2,7 +2,7 @@ import test from "node:test";
 import assert from "node:assert/strict";
 import fs from "node:fs";
 import path from "node:path";
-import { syncCommand } from "./sync.mjs";
+import { applyPlan, planSync, syncCommand } from "./sync.mjs";
 import { makeTempRepo, PUBLIC_DEPS, PRIVATE_DEPS, SAMPLE_MANIFEST } from "./test-support.mjs";
 
 test("sync refuses a private repo and writes nothing", async () => {
@@ -54,6 +54,27 @@ test("sync reports manifest errors instead of writing files", async () => {
   assert.equal(result.stage, "manifest");
 });
 
+test("sync refuses an unmanaged same-name workflow", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  const target = path.join(dir, ".github", "workflows", "ci.yml");
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, "name: handwritten\n", "utf8");
+  const result = await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.equal(result.stage, "managed-conflict");
+  assert.equal(fs.readFileSync(target, "utf8"), "name: handwritten\n");
+});
+
+test("apply preflights every planned byte before writing", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  const plan = await planSync(dir, PUBLIC_DEPS);
+  const target = path.join(dir, ".github", "workflows", "ci.yml");
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, "raced\n", "utf8");
+  const applied = applyPlan(dir, plan);
+  assert.equal(applied.stage, "apply-conflict");
+  assert.equal(fs.existsSync(path.join(dir, ".github", "workflows", "package-smoke.yml")), false);
+});
+
 // F15 end-to-end: a hostile `.rightgit.json` on disk — the real attack
 // surface, not just the in-memory validateManifest() unit — must be refused
 // at the manifest stage, before renderLanes() (and therefore render.mjs's

package/templates/ci.yml

@@ -37,8 +37,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node }}
-          cache: ${PM_CACHE}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test
       - run: ${PM_RUN} test:random

package/templates/package-smoke.yml

@@ -31,7 +31,7 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node scripts/test-package.mjs

package/templates/profiles/rust-hybrid/ci.yml

@@ -0,0 +1,30 @@
+# Managed by right-git — do not hand-edit. Run `right-git sync` to update.
+# Template: profiles/rust-hybrid/ci.yml | Template version: ${TEMPLATE_VERSION}
+name: ci
+on: [push, pull_request]
+permissions:
+  contents: read
+jobs:
+  private-repo-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Refuse private repository
+        if: ${{ github.event.repository.private }}
+        run: exit 1
+  ci:
+    needs: [private-repo-guard]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${OS_MATRIX}
+        node: ${NODE_MATRIX}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ matrix.node }}
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
+      - run: rustup toolchain install stable --profile minimal
+      - run: bash ./${GATE_PATH}

package/templates/publish-npm.yml

@@ -1,7 +1,6 @@
 # Managed by right-git — do not hand-edit. Run `right-git sync` to update.
 # Template: publish-npm.yml | Template version: ${TEMPLATE_VERSION}
-# Extracted from Cortex's immutable-release.yml publish-npm job only
-# (DESIGN.md §6). OIDC trusted publishing is the sole publish credential —
+# OIDC trusted publishing is the sole publish credential —
 # no long-lived npm token, no signing material (invariant I2). Runs after
 # right-release has already built/signed/notarized locally and attached
 # artifacts to the GitHub Release (DESIGN.md §7); this job publishes the
@@ -37,9 +36,9 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${NODE_PUBLISH_VERSION}
-          cache: ${PM_CACHE}
           registry-url: https://registry.npmjs.org
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node scripts/release/build-candidate.mjs --version "${{ github.event.release.tag_name }}" --platform current --out "release/candidates/publish"
       - run: node scripts/release/check-release.mjs release/candidates/publish

package/templates/publish-package-managers.yml

@@ -76,8 +76,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ruby -c release/homebrew/${HOMEBREW_FORMULA_NAME}.rb
       - name: Checkout Homebrew tap

package/templates/qualification.yml

@@ -26,8 +26,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:all
   schema:
@@ -38,10 +38,21 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
-      - run: node scripts/ci/check-schema.mjs || true
+      - name: Check schema with evidence log
+        shell: bash
+        run: |
+          set -o pipefail
+          node scripts/ci/check-schema.mjs 2>&1 | tee qualification-schema.log
+      - name: Upload schema evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: qualification-schema-${{ github.run_id }}-${{ github.run_attempt }}
+          path: qualification-schema.log
+          if-no-files-found: error
   security:
     needs: [qualification]
     runs-on: ubuntu-latest
@@ -50,8 +61,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node scripts/ci/check-network-boundary.mjs
       - name: Hostile-repository and secret-egress suite
@@ -64,8 +75,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:hardening
   conformance:
@@ -76,7 +87,7 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:conformance

package/templates/release-candidate.yml

@@ -32,8 +32,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node --test tests/release-candidate.test.mjs
       - run: node scripts/release/build-candidate.mjs --platform current --out "${{ runner.temp }}/${ARTIFACT_PREFIX}-rc"

package/test-support.mjs

@@ -28,6 +28,6 @@ export const SAMPLE_MANIFEST = {
   schemaVersion: 1,
   lanes: ["ci", "package-smoke"],
   matrix: { os: ["ubuntu-latest"], node: ["22.13"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   templateVersion: "1.0.0",
 };

package/uninstall.test.mjs

@@ -33,7 +33,7 @@ test("uninstall removes every managed file, leaving zero behind — including th
 // only ever looked at marker-bearing workflow files, so it reported success
 // while leaving the manifest behind. Reproduces the QA report's
 // "interruptedInstall" probe.
-test("F6: uninstall removes the manifest left behind by an install interrupted after the visibility check", async () => {
+test("install rolls back precisely when visibility changes after preflight", async () => {
   const dir = makeTempRepo(null);
   let calls = 0;
   const flakyDeps = {
@@ -47,13 +47,8 @@ test("F6: uninstall removes the manifest left behind by an install interrupted a
 
   const installResult = await installCommand(dir, { lanes: ["ci"] }, flakyDeps);
   assert.equal(installResult.ok, false);
-  assert.equal(installResult.stage, "synced");
-  assert.ok(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), "setup: interrupted install must still leave the manifest on disk");
-
-  const uninstallResult = uninstallCommand(dir);
-  assert.equal(uninstallResult.ok, true);
-  assert.ok(uninstallResult.removed.includes(MANIFEST_FILENAME));
-  assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false, "F6: manifest must not survive uninstall after an interrupted install");
+  assert.equal(installResult.stage, "visibility");
+  assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false);
 });
 
 test("uninstall never touches an unmanaged file in the same directory", async () => {
@@ -75,3 +70,10 @@ test("uninstall on a repo with no managed files is a no-op, not an error", () =>
   assert.equal(result.ok, true);
   assert.deepEqual(result.removed, []);
 });
+
+test("install validates before it creates a manifest", async () => {
+  const dir = makeTempRepo(null);
+  const result = await installCommand(dir, { lanes: ["not-a-lane"] }, PUBLIC_DEPS);
+  assert.equal(result.stage, "manifest-invalid");
+  assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false);
+});