@rightkit/git 0.2.0 → 0.2.2

package/README.md

@@ -19,6 +19,8 @@ GitHub Actions minutes are free and unlimited on public repos, and billed on pri
 
 Workflows are thin callers over the repo's own scripts, so a private repo running the same gates locally executes identical checks.
 
+Sync records exact prior bytes, refuses unmanaged same-name workflows, & preflights every target before any write. Qualification preserves schema logs with a unique required artifact.
+
 ## Credential posture (read before enabling package-manager publishing)
 
 - **No code-signing credential ever reaches CI.** Signing and notarization stay local in `@rightkit/release`. The only publish credential in the npm lane is short-lived OIDC (trusted publishing, no long-lived token).
@@ -36,4 +38,4 @@ Node builtins only; no runtime dependencies.
 
 ## Profiles
 
-`profile` defaults to `node`. `rust-hybrid` accepts only `ci`, requires safe relative `gate.path`, installs pinned Node plus `rustup stable`, then runs that gate. It never adds release, signing, publishing, or approval steps.
+`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus `rustup stable`, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot }`; RightGit passes an isolated `RIGHT_GIT_ARTIFACT_ROOT`, checks it, & uploads it as an unsigned handoff. It never signs, finalizes, publishes releases, or receives signing credentials.

package/guard-coverage.test.mjs

@@ -54,7 +54,7 @@ const FULL_MANIFEST = {
   schemaVersion: 1,
   lanes: [...KNOWN_LANES],
   matrix: { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   publish: {
     npm: { oidc: true, provenance: true },
     homebrew: { tap: "acme/homebrew-tap", formulaName: "widgets" },
@@ -219,6 +219,13 @@ test("F5: private-repo-guard job has no job-level `if` (always runs) and fails o
   }
 });
 
+test("qualification preserves failing schema evidence as a unique required artifact", () => {
+  const template = fs.readFileSync(path.join(templatesDir, "qualification.yml"), "utf8");
+  assert.doesNotMatch(template, /\|\| true/);
+  assert.match(template, /set -o pipefail[\s\S]*tee qualification-schema\.log/);
+  assert.match(template, /uses: actions\/upload-artifact@v4[\s\S]*github\.run_id[\s\S]*github\.run_attempt[\s\S]*if-no-files-found: error/);
+});
+
 test("rust-hybrid ci keeps its work behind the public-repository guard", () => {
   const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
   const template = fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8");

package/install.mjs

@@ -9,10 +9,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { assertPublic } from "./policy/visibility-gate.mjs";
 import { MANIFEST_FILENAME, validateManifest } from "./manifest.mjs";
-import { syncCommand } from "./sync.mjs";
+import { applyPlan, planSync } from "./sync.mjs";
 
 export const DEFAULT_MATRIX = { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] };
-export const DEFAULT_PACKAGE_MANAGER = "pnpm@11.18.0";
+export const DEFAULT_PACKAGE_MANAGER = "pnpm@11.24.0";
 export const DEFAULT_TEMPLATE_VERSION = "1.1.0";
 
 /**
@@ -67,8 +67,14 @@ export async function installCommand(repoPath, opts = {}, deps = {}) {
   const { valid, errors } = validateManifest(manifest);
   if (!valid) return { ok: false, stage: "manifest-invalid", errors };
 
-  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
-
-  const plan = await syncCommand(repoPath, { dryRun: false, deps });
-  return { ok: plan.ok, stage: "synced", errors: plan.errors || [], manifestPath, plan };
+  const manifestBytes = `${JSON.stringify(manifest, null, 2)}\n`;
+  const plan = await planSync(repoPath, deps, manifest);
+  if (!plan.ok) return { ok: false, stage: plan.stage, errors: plan.errors, plan };
+  fs.writeFileSync(manifestPath, manifestBytes, "utf8");
+  const applied = applyPlan(repoPath, plan);
+  if (!applied.ok) {
+    if (fs.readFileSync(manifestPath, "utf8") === manifestBytes) fs.rmSync(manifestPath);
+    return { ok: false, stage: applied.stage, errors: applied.errors, plan };
+  }
+  return { ok: true, stage: "synced", errors: [], manifestPath, plan };
 }

package/manifest.mjs

@@ -57,8 +57,10 @@ const TOP_LEVEL_KEYS = new Set([
   "templateVersion",
   "profile",
   "gate",
+  "candidate",
 ]);
 const GATE_PATH_RE = /^(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+const PACKAGE_SCRIPT_RE = /^[A-Za-z0-9][A-Za-z0-9:_-]*$/;
 
 /**
  * Validate a parsed manifest object against the right-git manifest contract.
@@ -123,7 +125,9 @@ export function validateManifest(manifest) {
   const profile = manifest.profile === undefined ? "node" : manifest.profile;
   if (profile !== "node" && profile !== "rust-hybrid") errors.push("profile must be 'node' or 'rust-hybrid'");
   if (profile === "rust-hybrid") {
-    if (lanes.length !== 1 || lanes[0] !== "ci") errors.push("profile 'rust-hybrid' supports only lane 'ci'");
+    if (lanes.some((lane) => lane !== "ci" && lane !== "release-candidate") || !lanes.includes("ci")) {
+      errors.push("profile 'rust-hybrid' requires lane 'ci' and supports optional lane 'release-candidate'");
+    }
     if (!manifest.gate || typeof manifest.gate !== "object" || Array.isArray(manifest.gate) || Object.keys(manifest.gate).some((key) => key !== "path") || typeof manifest.gate.path !== "string" || !GATE_PATH_RE.test(manifest.gate.path)) {
       errors.push("profile 'rust-hybrid' requires gate.path with a safe relative path");
     }
@@ -131,6 +135,31 @@ export function validateManifest(manifest) {
     errors.push("gate is only valid for profile 'rust-hybrid'");
   }
 
+  const candidate = manifest.candidate;
+  if (candidate !== undefined) {
+    if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) {
+      errors.push("candidate must be an object");
+    } else {
+      for (const key of Object.keys(candidate)) {
+        if (!["buildScript", "checkScript", "artifactRoot"].includes(key)) errors.push(`unknown candidate field: ${key}`);
+      }
+      for (const key of ["buildScript", "checkScript"]) {
+        if (typeof candidate[key] !== "string" || !PACKAGE_SCRIPT_RE.test(candidate[key])) {
+          errors.push(`candidate.${key} must be one safe package script name`);
+        }
+      }
+      if (typeof candidate.artifactRoot !== "string" || !GATE_PATH_RE.test(candidate.artifactRoot)) {
+        errors.push("candidate.artifactRoot must be one safe relative path");
+      }
+    }
+  }
+  if (profile === "rust-hybrid" && lanes.includes("release-candidate") && candidate === undefined) {
+    errors.push("rust-hybrid release-candidate lane requires candidate { buildScript, checkScript, artifactRoot }");
+  }
+  if (profile !== "rust-hybrid" && candidate !== undefined) {
+    errors.push("candidate is only valid for profile 'rust-hybrid'");
+  }
+
   const publish = manifest.publish;
   if (publish !== undefined) {
     if (publish === null || typeof publish !== "object" || Array.isArray(publish)) {
@@ -232,7 +261,12 @@ function parsePackageManager(spec) {
     yarn: "yarn install --frozen-lockfile",
   }[name];
   const runPrefix = { pnpm: "pnpm run", npm: "npm run", yarn: "yarn run" }[name];
-  return { name, version, installCommand, runPrefix };
+  const setup = {
+    pnpm: `      - uses: pnpm/action-setup@v4\n        with:\n          version: ${version}`,
+    npm: "",
+    yarn: `      - run: corepack enable && corepack prepare yarn@${version} --activate`,
+  }[name];
+  return { name, version, installCommand, runPrefix, setup };
 }
 
 function yamlFlowStringList(values) {
@@ -274,9 +308,13 @@ export function buildRenderContext(manifest, repoPath) {
     PM_CACHE: pm.name,
     INSTALL_COMMAND: pm.installCommand,
     PM_RUN: pm.runPrefix,
+    PACKAGE_MANAGER_SETUP: pm.setup,
     ARTIFACT_PREFIX: artifactPrefix,
     TEMPLATE_VERSION: manifest.templateVersion,
     GATE_PATH: manifest.gate?.path,
+    CANDIDATE_BUILD_SCRIPT: manifest.candidate?.buildScript,
+    CANDIDATE_CHECK_SCRIPT: manifest.candidate?.checkScript,
+    CANDIDATE_ARTIFACT_ROOT: manifest.candidate?.artifactRoot,
   };
 
   if (manifest.publish?.npm) {

package/manifest.schema.json

@@ -85,6 +85,16 @@
     "gate": {
       "type": "object", "required": ["path"], "additionalProperties": false,
       "properties": { "path": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" } }
+    },
+    "candidate": {
+      "type": "object",
+      "required": ["buildScript", "checkScript", "artifactRoot"],
+      "additionalProperties": false,
+      "properties": {
+        "buildScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+        "checkScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+        "artifactRoot": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" }
+      }
     }
   }
 }

package/manifest.test.mjs

@@ -6,7 +6,7 @@ const VALID_MINIMAL = {
   schemaVersion: 1,
   lanes: ["ci"],
   matrix: { os: ["ubuntu-latest"], node: ["22.13"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   templateVersion: "1.0.0",
 };
 
@@ -16,13 +16,21 @@ test("accepts a minimal valid manifest", () => {
   assert.deepEqual(errors, []);
 });
 
-test("rust-hybrid requires only ci and a safe gate path", () => {
+test("rust-hybrid supports ci plus a configured unsigned release-candidate lane", () => {
   const valid = { ...VALID_MINIMAL, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
   assert.equal(validateManifest(valid).valid, true);
   for (const path of ["/tmp/gate.sh", "../gate.sh", "scripts/gate sh", "${{ secrets.X }}", "scripts/gate;sh"]) {
     assert.equal(validateManifest({ ...valid, gate: { path } }).valid, false, path);
   }
   assert.equal(validateManifest({ ...valid, lanes: ["ci", "qualification"] }).valid, false);
+  const candidate = {
+    ...valid,
+    lanes: ["ci", "release-candidate"],
+    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "legion-unsigned" },
+  };
+  assert.equal(validateManifest(candidate).valid, true);
+  assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, buildScript: "echo unsafe" } }).valid, false);
+  assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, artifactRoot: "../escape" } }).valid, false);
 });
 
 test("rejects non-object input", () => {

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
+  "license": "MIT OR Apache-2.0",
   "type": "module",
   "bin": {
     "right-git": "cli/right-git.mjs"
@@ -20,7 +21,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/adrdsouza/claude.git",
+    "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/git"
   },
   "scripts": {

package/render.test.mjs

@@ -13,7 +13,7 @@ const FULL_MANIFEST = {
   schemaVersion: 1,
   lanes: [...KNOWN_LANES],
   matrix: { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   publish: {
     npm: { oidc: true, provenance: true },
     homebrew: { tap: "acme/homebrew-tap", formulaName: "widgets" },
@@ -45,11 +45,32 @@ test("every known lane has a template file and renders without an unresolved pla
 test("rust-hybrid ci renders its pinned package manager and gate", () => {
   const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" }, templateVersion: "1.1.0" };
   const content = renderTemplate(fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"), buildRenderContext(manifest, "/repos/widgets"));
-  assert.match(content, /corepack prepare pnpm@11\.18\.0 --activate/);
+  assert.match(content, /uses: pnpm\/action-setup@v4/);
+  assert.match(content, /version: 11\.24\.0/);
   assert.match(content, /rustup toolchain install stable/);
   assert.match(content, /bash \.\/scripts\/gate\.sh/);
 });
 
+test("rust-hybrid release candidate renders product scripts, artifact handoff, and no signing secret", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "widgets-unsigned" },
+    templateVersion: "1.2.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  assert.match(content, /pnpm run ci:candidate/);
+  assert.match(content, /pnpm run ci:candidate-check/);
+  assert.match(content, /RIGHT_GIT_ARTIFACT_ROOT/);
+  assert.match(content, /actions\/upload-artifact@v4/);
+  assert.doesNotMatch(content, /secrets\.|AZURE_|APPLE_|certificate|private.key/i);
+});
+
 test("render determinism: same manifest renders byte-identical output every time", () => {
   const first = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
   const second = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
@@ -59,7 +80,7 @@ test("render determinism: same manifest renders byte-identical output every time
 });
 
 test("rendered workflows never request pnpm or yarn setup-node caching before package-manager activation", () => {
-  for (const packageManager of ["pnpm@11.18.0", "yarn@4.6.0"]) {
+  for (const packageManager of ["pnpm@11.24.0", "yarn@4.6.0"]) {
     const rendered = renderAllLanes({ ...FULL_MANIFEST, packageManager }, "/repos/widgets");
     for (const [lane, content] of Object.entries(rendered)) {
       assert.doesNotMatch(
@@ -71,6 +92,26 @@ test("rendered workflows never request pnpm or yarn setup-node caching before pa
   }
 });
 
+test("rendered workflows bootstrap each declared package manager safely", () => {
+  const pnpm = renderAllLanes({ ...FULL_MANIFEST, packageManager: "pnpm@11.24.0" }, "/repos/widgets");
+  for (const content of Object.values(pnpm)) {
+    assert.match(content, /uses: pnpm\/action-setup@v4/);
+    assert.match(content, /version: 11\.24\.0/);
+    assert.doesNotMatch(content, /corepack enable/);
+  }
+
+  const npm = renderAllLanes({ ...FULL_MANIFEST, packageManager: "npm@11.0.0" }, "/repos/widgets");
+  for (const content of Object.values(npm)) {
+    assert.doesNotMatch(content, /pnpm\/action-setup|corepack enable/);
+  }
+
+  const yarn = renderAllLanes({ ...FULL_MANIFEST, packageManager: "yarn@4.6.0" }, "/repos/widgets");
+  for (const content of Object.values(yarn)) {
+    assert.match(content, /corepack prepare yarn@4\.6\.0 --activate/);
+    assert.doesNotMatch(content, /pnpm\/action-setup/);
+  }
+});
+
 // F5 fix: a job-level `if: !private` on the real work job means GitHub
 // SKIPS that job entirely for a private repo — the nested "refuse" step
 // inside it is then unreachable and never runs, so nothing fails and the

package/sync.mjs

@@ -70,13 +70,15 @@ export function lineDiff(oldText, newText) {
  * managed file whose lane fell out of the manifest.
  * Returns a typed result — never throws.
  */
-export async function planSync(repoPath, deps = {}) {
+export async function planSync(repoPath, deps = {}, manifestOverride = null) {
   const visibility = await assertPublic(repoPath, deps);
   if (!visibility.allowed) {
     return { ok: false, stage: "visibility", errors: [visibility.reason], changes: [] };
   }
 
-  const loaded = loadManifest(repoPath);
+  const loaded = manifestOverride === null
+    ? loadManifest(repoPath)
+    : { ok: true, manifest: manifestOverride };
   if (!loaded.ok) {
     return { ok: false, stage: "manifest", errors: loaded.errors, changes: [] };
   }
@@ -94,24 +96,38 @@ export async function planSync(repoPath, deps = {}) {
       // not installed yet
     }
     if (existing === content) {
-      changes.push({ lane, filename, action: "unchanged", diff: [] });
+      changes.push({ lane, filename, action: "unchanged", before: existing, diff: [] });
+    } else if (existing !== null && !existing.startsWith(MANAGED_MARKER)) {
+      changes.push({ lane, filename, action: "managed-conflict", before: existing, diff: [] });
     } else {
-      changes.push({ lane, filename, action: existing === null ? "create" : "update", diff: lineDiff(existing, content), content });
+      changes.push({ lane, filename, action: existing === null ? "create" : "update", before: existing, diff: lineDiff(existing, content), content });
     }
   }
 
   for (const managedFilename of listManagedFiles(repoPath)) {
     if (!wantedFilenames.has(managedFilename)) {
-      changes.push({ lane: null, filename: managedFilename, action: "remove", diff: [] });
+      changes.push({ lane: null, filename: managedFilename, action: "remove", before: fs.readFileSync(path.join(repoPath, WORKFLOWS_SUBDIR, managedFilename), "utf8"), diff: [] });
     }
   }
 
-  return { ok: true, stage: "planned", errors: [], changes };
+  const conflicts = changes.filter((change) => change.action === "managed-conflict");
+  return conflicts.length
+    ? { ok: false, stage: "managed-conflict", errors: conflicts.map((change) => `${change.filename} is unmanaged`), changes }
+    : { ok: true, stage: "planned", errors: [], changes };
 }
 
 /** Apply a plan produced by planSync: write/update/remove files on disk. */
 export function applyPlan(repoPath, plan) {
   const dir = path.join(repoPath, WORKFLOWS_SUBDIR);
+  for (const change of plan.changes) {
+    if (change.action === "unchanged") continue;
+    const target = path.join(dir, change.filename);
+    let current = null;
+    try { current = fs.readFileSync(target, "utf8"); } catch {}
+    if (current !== change.before) {
+      return { ok: false, stage: "apply-conflict", errors: [`${change.filename} changed after planning`] };
+    }
+  }
   fs.mkdirSync(dir, { recursive: true });
   for (const change of plan.changes) {
     const target = path.join(dir, change.filename);
@@ -121,6 +137,7 @@ export function applyPlan(repoPath, plan) {
       fs.rmSync(target, { force: true });
     }
   }
+  return { ok: true, stage: "applied", errors: [] };
 }
 
 /** Full sync: plan, print diff, apply unless dryRun. Returns the plan. */
@@ -135,7 +152,8 @@ export async function syncCommand(repoPath, { dryRun = false, deps = {} } = {})
   }
 
   if (!dryRun) {
-    applyPlan(repoPath, plan);
+    const applied = applyPlan(repoPath, plan);
+    if (!applied.ok) return { ...plan, ...applied };
   }
   return plan;
 }

package/sync.test.mjs

@@ -2,7 +2,7 @@ import test from "node:test";
 import assert from "node:assert/strict";
 import fs from "node:fs";
 import path from "node:path";
-import { syncCommand } from "./sync.mjs";
+import { applyPlan, planSync, syncCommand } from "./sync.mjs";
 import { makeTempRepo, PUBLIC_DEPS, PRIVATE_DEPS, SAMPLE_MANIFEST } from "./test-support.mjs";
 
 test("sync refuses a private repo and writes nothing", async () => {
@@ -54,6 +54,27 @@ test("sync reports manifest errors instead of writing files", async () => {
   assert.equal(result.stage, "manifest");
 });
 
+test("sync refuses an unmanaged same-name workflow", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  const target = path.join(dir, ".github", "workflows", "ci.yml");
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, "name: handwritten\n", "utf8");
+  const result = await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.equal(result.stage, "managed-conflict");
+  assert.equal(fs.readFileSync(target, "utf8"), "name: handwritten\n");
+});
+
+test("apply preflights every planned byte before writing", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  const plan = await planSync(dir, PUBLIC_DEPS);
+  const target = path.join(dir, ".github", "workflows", "ci.yml");
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, "raced\n", "utf8");
+  const applied = applyPlan(dir, plan);
+  assert.equal(applied.stage, "apply-conflict");
+  assert.equal(fs.existsSync(path.join(dir, ".github", "workflows", "package-smoke.yml")), false);
+});
+
 // F15 end-to-end: a hostile `.rightgit.json` on disk — the real attack
 // surface, not just the in-memory validateManifest() unit — must be refused
 // at the manifest stage, before renderLanes() (and therefore render.mjs's

package/templates/ci.yml

@@ -37,7 +37,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test
       - run: ${PM_RUN} test:random

package/templates/package-smoke.yml

@@ -31,6 +31,7 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node scripts/test-package.mjs

package/templates/profiles/rust-hybrid/ci.yml

@@ -24,6 +24,7 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node }}
-      - run: corepack enable && corepack prepare ${PM_NAME}@${PM_VERSION} --activate
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: rustup toolchain install stable --profile minimal
       - run: bash ./${GATE_PATH}

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -0,0 +1,49 @@
+# Managed by right-git — do not hand-edit. Run `right-git sync` to update.
+# Template: profiles/rust-hybrid/release-candidate.yml | Template version: ${TEMPLATE_VERSION}
+# Public CI produces unsigned candidates only. Signing credentials, finalization,
+# release publication, & stable bootstrap publication remain protected-host work.
+name: release-candidate
+on:
+  workflow_dispatch:
+  push:
+    tags: ['v*']
+permissions:
+  contents: read
+jobs:
+  private-repo-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Refuse private repository
+        if: ${{ github.event.repository.private }}
+        run: exit 1
+  candidate:
+    needs: [private-repo-guard]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${OS_MATRIX}
+        node: ${NODE_MATRIX}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ matrix.node }}
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
+      - run: rustup toolchain install stable --profile minimal
+      - run: ${INSTALL_COMMAND}
+      - name: Build unsigned release candidate
+        run: ${PM_RUN} ${CANDIDATE_BUILD_SCRIPT}
+        env:
+          RIGHT_GIT_ARTIFACT_ROOT: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}
+      - name: Check unsigned release candidate
+        run: ${PM_RUN} ${CANDIDATE_CHECK_SCRIPT}
+        env:
+          RIGHT_GIT_ARTIFACT_ROOT: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}
+      - name: Upload unsigned candidate handoff
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${ARTIFACT_PREFIX}-unsigned-${{ matrix.os }}-${{ matrix.node }}
+          path: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}/**
+          if-no-files-found: error

package/templates/publish-npm.yml

@@ -1,7 +1,6 @@
 # Managed by right-git — do not hand-edit. Run `right-git sync` to update.
 # Template: publish-npm.yml | Template version: ${TEMPLATE_VERSION}
-# Extracted from Cortex's immutable-release.yml publish-npm job only
-# (DESIGN.md §6). OIDC trusted publishing is the sole publish credential —
+# OIDC trusted publishing is the sole publish credential —
 # no long-lived npm token, no signing material (invariant I2). Runs after
 # right-release has already built/signed/notarized locally and attached
 # artifacts to the GitHub Release (DESIGN.md §7); this job publishes the
@@ -38,7 +37,8 @@ jobs:
         with:
           node-version: ${NODE_PUBLISH_VERSION}
           registry-url: https://registry.npmjs.org
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node scripts/release/build-candidate.mjs --version "${{ github.event.release.tag_name }}" --platform current --out "release/candidates/publish"
       - run: node scripts/release/check-release.mjs release/candidates/publish

package/templates/publish-package-managers.yml

@@ -76,7 +76,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ruby -c release/homebrew/${HOMEBREW_FORMULA_NAME}.rb
       - name: Checkout Homebrew tap

package/templates/qualification.yml

@@ -26,7 +26,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:all
   schema:
@@ -37,9 +38,21 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
-      - run: node scripts/ci/check-schema.mjs || true
+      - name: Check schema with evidence log
+        shell: bash
+        run: |
+          set -o pipefail
+          node scripts/ci/check-schema.mjs 2>&1 | tee qualification-schema.log
+      - name: Upload schema evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: qualification-schema-${{ github.run_id }}-${{ github.run_attempt }}
+          path: qualification-schema.log
+          if-no-files-found: error
   security:
     needs: [qualification]
     runs-on: ubuntu-latest
@@ -48,7 +61,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node scripts/ci/check-network-boundary.mjs
       - name: Hostile-repository and secret-egress suite
@@ -61,7 +75,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:hardening
   conformance:
@@ -72,6 +87,7 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:conformance

package/templates/release-candidate.yml

@@ -32,7 +32,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node --test tests/release-candidate.test.mjs
       - run: node scripts/release/build-candidate.mjs --platform current --out "${{ runner.temp }}/${ARTIFACT_PREFIX}-rc"

package/test-support.mjs

@@ -28,6 +28,6 @@ export const SAMPLE_MANIFEST = {
   schemaVersion: 1,
   lanes: ["ci", "package-smoke"],
   matrix: { os: ["ubuntu-latest"], node: ["22.13"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   templateVersion: "1.0.0",
 };

package/uninstall.test.mjs

@@ -33,7 +33,7 @@ test("uninstall removes every managed file, leaving zero behind — including th
 // only ever looked at marker-bearing workflow files, so it reported success
 // while leaving the manifest behind. Reproduces the QA report's
 // "interruptedInstall" probe.
-test("F6: uninstall removes the manifest left behind by an install interrupted after the visibility check", async () => {
+test("install rolls back precisely when visibility changes after preflight", async () => {
   const dir = makeTempRepo(null);
   let calls = 0;
   const flakyDeps = {
@@ -47,13 +47,8 @@ test("F6: uninstall removes the manifest left behind by an install interrupted a
 
   const installResult = await installCommand(dir, { lanes: ["ci"] }, flakyDeps);
   assert.equal(installResult.ok, false);
-  assert.equal(installResult.stage, "synced");
-  assert.ok(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), "setup: interrupted install must still leave the manifest on disk");
-
-  const uninstallResult = uninstallCommand(dir);
-  assert.equal(uninstallResult.ok, true);
-  assert.ok(uninstallResult.removed.includes(MANIFEST_FILENAME));
-  assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false, "F6: manifest must not survive uninstall after an interrupted install");
+  assert.equal(installResult.stage, "visibility");
+  assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false);
 });
 
 test("uninstall never touches an unmanaged file in the same directory", async () => {
@@ -75,3 +70,10 @@ test("uninstall on a repo with no managed files is a no-op, not an error", () =>
   assert.equal(result.ok, true);
   assert.deepEqual(result.removed, []);
 });
+
+test("install validates before it creates a manifest", async () => {
+  const dir = makeTempRepo(null);
+  const result = await installCommand(dir, { lanes: ["not-a-lane"] }, PUBLIC_DEPS);
+  assert.equal(result.stage, "manifest-invalid");
+  assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false);
+});