@rightkit/git 0.2.23 → 0.2.25

package/manifest.mjs

@@ -60,6 +60,7 @@ const TOP_LEVEL_KEYS = new Set([
   "gate",
   "rustCache",
   "candidate",
+  "ownership",
 ]);
 const GATE_PATH_RE = /^(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 const RUST_WORKSPACE_PATH_RE = /^(?:\.|(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*)$/;
@@ -188,9 +189,17 @@ export function validateManifest(manifest) {
       errors.push("candidate must be an object");
     } else {
       for (const key of Object.keys(candidate)) {
-        if (!["buildScript", "checkScript", "artifactRoot", "os", "targets", "signWindows", "signMacos", "releaseChain"].includes(key)) errors.push(`unknown candidate field: ${key}`);
+        if (!["buildScript", "checkScript", "admissionScript", "stageSummaryScript", "artifactRoot", "os", "targets", "signWindows", "signMacos", "releaseChain"].includes(key)) errors.push(`unknown candidate field: ${key}`);
       }
-      for (const key of ["buildScript", "checkScript"]) {
+      // admissionScript & stageSummaryScript are required for EVERY release-candidate
+      // lane, not just signed/full-releaseChain ones: the tag-last workflow's
+      // `admission` job (dispatch-envelope validation) and the `candidate` job's
+      // stage-summary init/finalize steps are unconditional parts of the rendered
+      // template, independent of candidate.signWindows/signMacos/releaseChain. If
+      // either script were only required inside the optional releaseChain object,
+      // an unsigned release-candidate manifest (no releaseChain at all) would still
+      // render those unconditional steps with an unresolved script name.
+      for (const key of ["buildScript", "checkScript", "admissionScript", "stageSummaryScript"]) {
         if (typeof candidate[key] !== "string" || !PACKAGE_SCRIPT_RE.test(candidate[key])) {
           errors.push(`candidate.${key} must be one safe package script name`);
         }
@@ -252,19 +261,36 @@ export function validateManifest(manifest) {
       }
       if (candidate.releaseChain !== undefined) {
         const chain = candidate.releaseChain;
-        const allowedChainKeys = ["windowsFinalizeScript", "macosFinalizeScript", "installedQualificationScript", "publishScript", "qualificationRunnerVariable", "publishSecrets"];
+        // admissionScript & stageSummaryScript live on candidate directly (see
+        // above) — the full signed release chain adds evidenceVerificationScript
+        // (runs before publish, verifying aggregated same-run evidence) plus the
+        // finalize/qualify/publish scripts.
+        const allowedChainKeys = ["evidenceVerificationScript", "windowsFinalizeScript", "macosFinalizeScript", "installedQualificationScript", "publishScript", "qualificationRunnerVariable", "publishSecrets", "environments"];
         if (chain === null || typeof chain !== "object" || Array.isArray(chain)) {
           errors.push("candidate.releaseChain must be an object");
         } else {
           for (const key of Object.keys(chain)) {
             if (!allowedChainKeys.includes(key)) errors.push(`unknown candidate.releaseChain field: ${key}`);
           }
-          for (const key of ["windowsFinalizeScript", "installedQualificationScript", "publishScript"]) {
+          for (const key of ["evidenceVerificationScript", "windowsFinalizeScript", "installedQualificationScript", "publishScript"]) {
             if (typeof chain[key] !== "string" || !PACKAGE_SCRIPT_RE.test(chain[key])) {
               errors.push(`candidate.releaseChain.${key} must be one safe package script name`);
             }
           }
           if (chain.macosFinalizeScript !== undefined && (typeof chain.macosFinalizeScript !== "string" || !PACKAGE_SCRIPT_RE.test(chain.macosFinalizeScript))) {
+          if (chain.environments !== undefined) {
+            const environments = chain.environments;
+            if (environments === null || typeof environments !== "object" || Array.isArray(environments)) {
+              errors.push("candidate.releaseChain.environments must be an object");
+            } else {
+              for (const key of Object.keys(environments)) {
+                if (!["signing", "qualification", "publication"].includes(key)) errors.push(`unknown candidate.releaseChain.environments field: ${key}`);
+                else if (typeof environments[key] !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/.test(environments[key])) {
+                  errors.push(`candidate.releaseChain.environments.${key} must be one safe GitHub environment name`);
+                }
+              }
+            }
+          }
             errors.push("candidate.releaseChain.macosFinalizeScript must be one safe package script name");
           }
           if (typeof chain.qualificationRunnerVariable !== "string" || !GITHUB_VARIABLE_RE.test(chain.qualificationRunnerVariable)) {
@@ -286,6 +312,18 @@ export function validateManifest(manifest) {
   if (profile === "rust-hybrid" && lanes.includes("release-candidate") && candidate === undefined) {
     errors.push("rust-hybrid release-candidate lane requires candidate { buildScript, checkScript, artifactRoot }");
   }
+
+  if (manifest.ownership !== undefined) {
+    if (!manifest.ownership || typeof manifest.ownership !== "object" || Array.isArray(manifest.ownership)
+      || Object.keys(manifest.ownership).some((key) => key !== "roots")) {
+      errors.push("ownership must be an object containing only roots");
+    } else if (!Array.isArray(manifest.ownership.roots) || manifest.ownership.roots.length === 0
+      || manifest.ownership.roots.some((root) => typeof root !== "string" || (root !== "." && !/^(?!.*\.\.)(?!.*\\)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(root)) || root.startsWith("/"))) {
+      errors.push("ownership.roots must contain safe, non-empty repository-relative paths");
+    } else if (new Set(manifest.ownership.roots).size !== manifest.ownership.roots.length) {
+      errors.push("ownership.roots must not contain duplicates");
+    }
+  }
   if (profile !== "rust-hybrid" && candidate !== undefined) {
     errors.push("candidate is only valid for profile 'rust-hybrid'");
   }
@@ -452,6 +490,15 @@ const ARTIFACT_SIGNING_CLIENT_SHA256 = "74BD7D27E6CE1051409C38D9B46BC8DF0400ECD6
 const WINDOWS_SDK_BUILD_TOOLS_VERSION = "10.0.26100.4188";
 const WINDOWS_SDK_BUILD_TOOLS_SHA256 = "180DEB372659029864C10A0C04787833234D64AACD1D2C0661D2C00295D8E022";
 
+// Signing and publication credentials must be reachable behind distinct
+// protected environments, so a job that may sign cannot also publish. Products
+// opt in per environment; absent configuration keeps the single `release`
+// environment they use today, so enabling the split cannot strand secrets.
+function releaseEnvironment(manifest, role) {
+	const configured = manifest?.candidate?.releaseChain?.environments?.[role];
+	return typeof configured === "string" && configured.length > 0 ? configured : "release";
+}
+
 function windowsSigningJob(manifest, pm, artifactPrefix) {
   if (manifest.candidate?.signWindows !== true) return "";
   const nodeVersion = String(manifest.matrix.node[0]);
@@ -462,7 +509,7 @@ function windowsSigningJob(manifest, pm, artifactPrefix) {
   const finalizeEnvironment = releaseChain
     ? `          RIGHT_GIT_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-windows-candidate
           RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/finalized-windows
-          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`
+          RIGHT_GIT_SOURCE_REVISION: \${{ needs.admission.outputs.source_revision }}`
     : `          LEGION_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-windows-candidate
           LEGION_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`;
   const uploadPath = releaseChain
@@ -470,9 +517,9 @@ function windowsSigningJob(manifest, pm, artifactPrefix) {
     : "            dist/releases/windows/**\n            .right-release/receipts/windows-*.json";
   return `
   windows-sign:
-    needs: [candidate]
-    if: \${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.signed_qualification == true) }}
-    environment: release
+    needs: [admission, candidate]
+    if: \${{ needs.admission.outputs.signed_qualification == 'true' }}
+    environment: ${releaseEnvironment(manifest, "signing")}
     strategy:
       fail-fast: false
       matrix:
@@ -483,9 +530,10 @@ ${signingMatrix(manifest, "windows")}
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Resolve checked-out source revision
-        shell: pwsh
-        run: '"RIGHT_GIT_SOURCE_REVISION=$(git rev-parse HEAD)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append'
+        with:
+          ref: \${{ needs.admission.outputs.source_revision }}
+          fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${nodeVersion}
@@ -495,10 +543,24 @@ ${pm.setup}
         with:
           targets: \${{ matrix.targetTriple }}
       - run: ${pm.installCommand}
+      - name: Initialize Windows signing stage summary
+        run: ${pm.runPrefix} ${manifest.candidate.stageSummaryScript}
+        env:
+          RIGHT_GIT_STAGE_ACTION: init
+          RIGHT_GIT_STAGE_ROOT: \${{ runner.temp }}/right-git-stage-summary
+          RIGHT_GIT_STAGE_EVIDENCE_ROOT: \${{ runner.temp }}/finalized-windows
+          RIGHT_GIT_STAGE: windows-sign
+          RIGHT_GIT_STAGE_PRODUCER: windows-sign-\${{ matrix.architecture }}
+          RIGHT_GIT_RELEASE_VERSION: \${{ needs.admission.outputs.version }}
+          RIGHT_GIT_SOURCE_REVISION: \${{ needs.admission.outputs.source_revision }}
+          RIGHT_GIT_RELEASE_PLATFORM: \${{ matrix.platform }}
+          RIGHT_GIT_RELEASE_ARCHITECTURE: \${{ matrix.architecture }}
+          RIGHT_GIT_RUN_ID: \${{ github.run_id }}
+          RIGHT_GIT_RUN_ATTEMPT: \${{ github.run_attempt }}
       - name: Download exact unsigned Windows candidate
         uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
         with:
-          name: ${artifactPrefix}-unsigned-\${{ matrix.platform }}-\${{ matrix.architecture }}-${nodeVersion}
+          name: ${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-candidate-\${{ matrix.platform }}-\${{ matrix.architecture }}-\${{ needs.admission.outputs.version }}-\${{ needs.admission.outputs.source_revision }}
           path: \${{ runner.temp }}/unsigned-windows-candidate
       - name: Authenticate to Azure with GitHub OIDC
         uses: azure/login@${AZURE_LOGIN_SHA} # v3
@@ -531,13 +593,38 @@ ${finalizeEnvironment}
           AZURE_ARTIFACT_SIGNING_ENDPOINT: \${{ vars.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
           AZURE_ARTIFACT_SIGNING_ACCOUNT: \${{ vars.AZURE_ARTIFACT_SIGNING_ACCOUNT }}
           AZURE_ARTIFACT_SIGNING_PROFILE: \${{ vars.AZURE_ARTIFACT_SIGNING_PROFILE }}
+      - name: Finalize Windows signing stage summary
+        if: \${{ always() }}
+        run: ${pm.runPrefix} ${manifest.candidate.stageSummaryScript}
+        env:
+          RIGHT_GIT_STAGE_ACTION: finalize
+          RIGHT_GIT_STAGE_ROOT: \${{ runner.temp }}/right-git-stage-summary
+          RIGHT_GIT_STAGE_EVIDENCE_ROOT: \${{ runner.temp }}/finalized-windows
+          RIGHT_GIT_STAGE: windows-sign
+          RIGHT_GIT_STAGE_PRODUCER: windows-sign-\${{ matrix.architecture }}
+          RIGHT_GIT_STAGE_STATUS: \${{ job.status == 'success' && 'SUCCEEDED' || 'FAILED' }}
+          RIGHT_GIT_STAGE_EXIT_CODE: \${{ job.status == 'success' && '0' || '1' }}
+          RIGHT_GIT_RELEASE_VERSION: \${{ needs.admission.outputs.version }}
+          RIGHT_GIT_SOURCE_REVISION: \${{ needs.admission.outputs.source_revision }}
+          RIGHT_GIT_RELEASE_PLATFORM: \${{ matrix.platform }}
+          RIGHT_GIT_RELEASE_ARCHITECTURE: \${{ matrix.architecture }}
+          RIGHT_GIT_RUN_ID: \${{ github.run_id }}
+          RIGHT_GIT_RUN_ATTEMPT: \${{ github.run_attempt }}
       - name: Upload signed Windows candidate
+        if: \${{ always() }}
         uses: actions/upload-artifact@${UPLOAD_ARTIFACT_SHA} # v4
         with:
-          name: ${artifactPrefix}-signed-windows-\${{ matrix.architecture }}-${nodeVersion}
+          name: ${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-signed-windows-\${{ matrix.architecture }}-\${{ needs.admission.outputs.version }}-\${{ needs.admission.outputs.source_revision }}
           path: |
 ${uploadPath}
           if-no-files-found: error
+      - name: Upload Windows signing stage summary
+        if: \${{ always() }}
+        uses: actions/upload-artifact@${UPLOAD_ARTIFACT_SHA} # v4
+        with:
+          name: ${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-summary-windows-sign-\${{ matrix.architecture }}-\${{ needs.admission.outputs.version }}-\${{ needs.admission.outputs.source_revision }}
+          path: \${{ runner.temp }}/right-git-stage-summary/stage-summary.json
+          if-no-files-found: error
 `.trimEnd();
 }
 
@@ -551,7 +638,7 @@ function macosSigningJob(manifest, pm, artifactPrefix) {
   const finalizeEnvironment = releaseChain
     ? `          RIGHT_GIT_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-macos-candidate
           RIGHT_GIT_FINALIZED_MACOS_ROOT: \${{ runner.temp }}/finalized-macos
-          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`
+          RIGHT_GIT_SOURCE_REVISION: \${{ needs.admission.outputs.source_revision }}`
     : `          LEGION_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-macos-candidate
           LEGION_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`;
   const uploadPath = releaseChain
@@ -559,9 +646,9 @@ function macosSigningJob(manifest, pm, artifactPrefix) {
     : "            dist/releases/mac/**\n            .right-release/receipts/macos-*.json";
   return `
   macos-sign:
-    needs: [candidate]
-    if: \${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.signed_qualification == true) }}
-    environment: release
+    needs: [admission, candidate]
+    if: \${{ needs.admission.outputs.signed_qualification == 'true' }}
+    environment: ${releaseEnvironment(manifest, "signing")}
     strategy:
       fail-fast: false
       matrix:
@@ -571,9 +658,10 @@ ${signingMatrix(manifest, "macos")}
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Resolve checked-out source revision
-        shell: bash
-        run: printf 'RIGHT_GIT_SOURCE_REVISION=%s\\n' "$(git rev-parse HEAD)" >> "$GITHUB_ENV"
+        with:
+          ref: \${{ needs.admission.outputs.source_revision }}
+          fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${nodeVersion}
@@ -583,10 +671,24 @@ ${pm.setup}
         with:
           targets: \${{ matrix.targetTriple }}
       - run: ${pm.installCommand}
+      - name: Initialize macOS signing stage summary
+        run: ${pm.runPrefix} ${manifest.candidate.stageSummaryScript}
+        env:
+          RIGHT_GIT_STAGE_ACTION: init
+          RIGHT_GIT_STAGE_ROOT: \${{ runner.temp }}/right-git-stage-summary
+          RIGHT_GIT_STAGE_EVIDENCE_ROOT: \${{ runner.temp }}/finalized-macos
+          RIGHT_GIT_STAGE: macos-sign
+          RIGHT_GIT_STAGE_PRODUCER: macos-sign-\${{ matrix.architecture }}
+          RIGHT_GIT_RELEASE_VERSION: \${{ needs.admission.outputs.version }}
+          RIGHT_GIT_SOURCE_REVISION: \${{ needs.admission.outputs.source_revision }}
+          RIGHT_GIT_RELEASE_PLATFORM: \${{ matrix.platform }}
+          RIGHT_GIT_RELEASE_ARCHITECTURE: \${{ matrix.architecture }}
+          RIGHT_GIT_RUN_ID: \${{ github.run_id }}
+          RIGHT_GIT_RUN_ATTEMPT: \${{ github.run_attempt }}
       - name: Download exact unsigned macOS candidate
         uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
         with:
-          name: ${artifactPrefix}-unsigned-\${{ matrix.platform }}-\${{ matrix.architecture }}-${nodeVersion}
+          name: ${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-candidate-\${{ matrix.platform }}-\${{ matrix.architecture }}-\${{ needs.admission.outputs.version }}-\${{ needs.admission.outputs.source_revision }}
           path: \${{ runner.temp }}/unsigned-macos-candidate
       - name: Install Apple signing identity in temporary keychain
         shell: bash
@@ -618,13 +720,38 @@ ${finalizeEnvironment}
           APPLE_DEVELOPER_ID: \${{ vars.APPLE_DEVELOPER_ID }}
           APPLE_API_KEY: \${{ secrets.APPLE_API_KEY }}
           APPLE_API_ISSUER: \${{ secrets.APPLE_API_ISSUER }}
+      - name: Finalize macOS signing stage summary
+        if: \${{ always() }}
+        run: ${pm.runPrefix} ${manifest.candidate.stageSummaryScript}
+        env:
+          RIGHT_GIT_STAGE_ACTION: finalize
+          RIGHT_GIT_STAGE_ROOT: \${{ runner.temp }}/right-git-stage-summary
+          RIGHT_GIT_STAGE_EVIDENCE_ROOT: \${{ runner.temp }}/finalized-macos
+          RIGHT_GIT_STAGE: macos-sign
+          RIGHT_GIT_STAGE_PRODUCER: macos-sign-\${{ matrix.architecture }}
+          RIGHT_GIT_STAGE_STATUS: \${{ job.status == 'success' && 'SUCCEEDED' || 'FAILED' }}
+          RIGHT_GIT_STAGE_EXIT_CODE: \${{ job.status == 'success' && '0' || '1' }}
+          RIGHT_GIT_RELEASE_VERSION: \${{ needs.admission.outputs.version }}
+          RIGHT_GIT_SOURCE_REVISION: \${{ needs.admission.outputs.source_revision }}
+          RIGHT_GIT_RELEASE_PLATFORM: \${{ matrix.platform }}
+          RIGHT_GIT_RELEASE_ARCHITECTURE: \${{ matrix.architecture }}
+          RIGHT_GIT_RUN_ID: \${{ github.run_id }}
+          RIGHT_GIT_RUN_ATTEMPT: \${{ github.run_attempt }}
       - name: Upload signed & notarized macOS candidate
+        if: \${{ always() }}
         uses: actions/upload-artifact@${UPLOAD_ARTIFACT_SHA} # v4
         with:
-          name: ${artifactPrefix}-signed-macos-\${{ matrix.architecture }}-${nodeVersion}
+          name: ${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-signed-macos-\${{ matrix.architecture }}-\${{ needs.admission.outputs.version }}-\${{ needs.admission.outputs.source_revision }}
           path: |
 ${uploadPath}
           if-no-files-found: error
+      - name: Upload macOS signing stage summary
+        if: \${{ always() }}
+        uses: actions/upload-artifact@${UPLOAD_ARTIFACT_SHA} # v4
+        with:
+          name: ${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-summary-macos-sign-\${{ matrix.architecture }}-\${{ needs.admission.outputs.version }}-\${{ needs.admission.outputs.source_revision }}
+          path: \${{ runner.temp }}/right-git-stage-summary/stage-summary.json
+          if-no-files-found: error
       - name: Remove Apple signing material
         if: \${{ always() }}
         shell: bash
@@ -641,30 +768,72 @@ function releaseChainJobs(manifest, pm, artifactPrefix) {
   const windowsRunner = windowsTarget.os;
   const windowsArchitecture = windowsTarget.architecture;
   const macosTarget = candidateTargets(manifest.candidate).find((target) => target.platform === "macos");
-  const nodeVersion = String(manifest.matrix.node[0]);
-  const macosDependency = manifest.candidate.signMacos === true ? ", macos-sign" : "";
-  const macosSuccess = manifest.candidate.signMacos === true ? " && needs.macos-sign.result == 'success'" : "";
-  const macosDownload = manifest.candidate.signMacos === true
+  const signMacos = manifest.candidate.signMacos === true;
+  const macosDependency = signMacos ? ", macos-sign" : "";
+  const macosSuccess = signMacos ? " && needs.macos-sign.result == 'success'" : "";
+  // Run- and identity-bound: matches exactly what windows-sign/macos-sign
+  // uploaded (see windowsSigningJob/macosSigningJob) — no matrix context is
+  // available in these non-matrixed jobs, so the platform architecture is a
+  // literal derived from the manifest's single windows/macos target.
+  const VERSION = "${{ needs.admission.outputs.version }}";
+  const SOURCE_REVISION = "${{ needs.admission.outputs.source_revision }}";
+  const windowsSignedArtifact = `${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-signed-windows-${windowsArchitecture}-${VERSION}-${SOURCE_REVISION}`;
+  const windowsSummaryArtifact = `${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-summary-windows-sign-${windowsArchitecture}-${VERSION}-${SOURCE_REVISION}`;
+  const macosSignedArtifact = signMacos ? `${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-signed-macos-${macosTarget.architecture}-${VERSION}-${SOURCE_REVISION}` : "";
+  const macosSummaryArtifact = signMacos ? `${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-summary-macos-sign-${macosTarget.architecture}-${VERSION}-${SOURCE_REVISION}` : "";
+  // Candidate stage summaries are per (platform, architecture) — see the
+  // `Upload candidate stage summary` step in the template. releaseChain
+  // requires at most one target per signing platform (validateManifest), so
+  // exactly one candidate-windows summary and at most one candidate-macos
+  // summary exist for this manifest.
+  const candidateWindowsSummaryArtifact = `${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-summary-candidate-windows-${windowsArchitecture}-${VERSION}-${SOURCE_REVISION}`;
+  const candidateMacosSummaryArtifact = signMacos ? `${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-summary-candidate-macos-${macosTarget.architecture}-${VERSION}-${SOURCE_REVISION}` : "";
+  const qualificationArtifact = `${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-installed-qualification-${VERSION}-${SOURCE_REVISION}`;
+  const qualificationSummaryArtifact = `${artifactPrefix}-\${{ github.run_id }}-\${{ github.run_attempt }}-summary-installed-qualification-${VERSION}-${SOURCE_REVISION}`;
+  const macosDownload = signMacos
     ? `      - name: Download same-run signed & notarized macOS release
         uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
         with:
-          name: ${artifactPrefix}-signed-macos-${macosTarget.architecture}-${nodeVersion}
+          name: ${macosSignedArtifact}
           path: \${{ runner.temp }}/right-git-release/macos`
     : "";
+  const macosSummaryDownload = signMacos
+    ? `      - name: Download same-run macOS signing stage summary
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${macosSummaryArtifact}
+          path: \${{ runner.temp }}/right-git-release/stage-summaries/macos-sign`
+    : "";
+  const candidateMacosSummaryDownload = signMacos
+    ? `      - name: Download same-run candidate (macOS) stage summary
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${candidateMacosSummaryArtifact}
+          path: \${{ runner.temp }}/right-git-release/stage-summaries/candidate-macos`
+    : "";
+  const finalizedMacosEnv = signMacos ? `\n          RIGHT_GIT_FINALIZED_MACOS_ROOT: \${{ runner.temp }}/right-git-release/macos` : "";
+  // Evidence must be bound to this exact run — not merely this
+  // version+source_revision — so a stale artifact from a different run
+  // cannot satisfy verification. Every job/step from installed-qualification
+  // onward carries RIGHT_GIT_RUN_ID/RIGHT_GIT_RUN_ATTEMPT alongside version
+  // and source_revision.
+  const runIdentityEnv = `          RIGHT_GIT_RUN_ID: \${{ github.run_id }}
+          RIGHT_GIT_RUN_ATTEMPT: \${{ github.run_attempt }}`;
   const publishSecretEnvironment = (chain.publishSecrets ?? [])
     .map((name) => `          ${name}: \${{ secrets.${name} }}`)
     .join("\n");
   return `
   installed-qualification:
-    needs: [candidate, windows-sign]
-    if: \${{ always() && (startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.signed_qualification == true)) && needs.candidate.result == 'success' }}
-    environment: release
+    needs: [admission, candidate, windows-sign]
+    if: \${{ always() && needs.admission.outputs.signed_qualification == 'true' && needs.candidate.result == 'success' }}
+    environment: ${releaseEnvironment(manifest, "qualification")}
     runs-on: \${{ vars.${chain.qualificationRunnerVariable} || '${windowsRunner}' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Resolve checked-out source revision
-        shell: pwsh
-        run: '"RIGHT_GIT_SOURCE_REVISION=$(git rev-parse HEAD)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append'
+        with:
+          ref: \${{ needs.admission.outputs.source_revision }}
+          fetch-depth: 0
+          persist-credentials: false
       - name: Fail closed when protected finalization is absent
         if: \${{ needs.windows-sign.result != 'success' }}
         shell: pwsh
@@ -673,64 +842,128 @@ function releaseChainJobs(manifest, pm, artifactPrefix) {
       - name: Download same-run finalized Windows release
         uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
         with:
-          name: ${artifactPrefix}-signed-windows-${windowsArchitecture}-${nodeVersion}
+          name: ${windowsSignedArtifact}
           path: \${{ runner.temp }}/right-git-release/windows
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: ${nodeVersion}
+          node-version: ${String(manifest.matrix.node[0])}
           package-manager-cache: false
 ${pm.setup}
       - run: ${pm.installCommand}
+      - name: Initialize installed-qualification stage summary
+        run: ${pm.runPrefix} ${manifest.candidate.stageSummaryScript}
+        env:
+          RIGHT_GIT_STAGE_ACTION: init
+          RIGHT_GIT_STAGE_ROOT: \${{ runner.temp }}/right-git-stage-summary
+          RIGHT_GIT_STAGE_EVIDENCE_ROOT: \${{ runner.temp }}/right-git-release/qualification
+          RIGHT_GIT_STAGE: installed-qualification
+          RIGHT_GIT_STAGE_PRODUCER: installed-qualification
+          RIGHT_GIT_RELEASE_VERSION: \${{ needs.admission.outputs.version }}
+          RIGHT_GIT_SOURCE_REVISION: \${{ needs.admission.outputs.source_revision }}
+${runIdentityEnv}
       - name: Run installed-artifact qualification
         run: ${pm.runPrefix} ${chain.installedQualificationScript}
         env:
           GH_TOKEN: \${{ github.token }}
           RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/right-git-release/windows
           RIGHT_GIT_QUALIFICATION_EVIDENCE_ROOT: \${{ runner.temp }}/right-git-release/qualification
-          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}
+          RIGHT_GIT_RELEASE_VERSION: \${{ needs.admission.outputs.version }}
+          RIGHT_GIT_SOURCE_REVISION: \${{ needs.admission.outputs.source_revision }}
+      - name: Finalize installed-qualification stage summary
+        if: \${{ always() }}
+        run: ${pm.runPrefix} ${manifest.candidate.stageSummaryScript}
+        env:
+          RIGHT_GIT_STAGE_ACTION: finalize
+          RIGHT_GIT_STAGE_ROOT: \${{ runner.temp }}/right-git-stage-summary
+          RIGHT_GIT_STAGE_EVIDENCE_ROOT: \${{ runner.temp }}/right-git-release/qualification
+          RIGHT_GIT_STAGE: installed-qualification
+          RIGHT_GIT_STAGE_PRODUCER: installed-qualification
+          RIGHT_GIT_STAGE_STATUS: \${{ job.status == 'success' && 'SUCCEEDED' || 'FAILED' }}
+          RIGHT_GIT_STAGE_EXIT_CODE: \${{ job.status == 'success' && '0' || '1' }}
+          RIGHT_GIT_RELEASE_VERSION: \${{ needs.admission.outputs.version }}
+          RIGHT_GIT_SOURCE_REVISION: \${{ needs.admission.outputs.source_revision }}
+${runIdentityEnv}
       - name: Upload installed qualification evidence
+        if: \${{ always() }}
         uses: actions/upload-artifact@${UPLOAD_ARTIFACT_SHA} # v4
         with:
-          name: ${artifactPrefix}-installed-qualification-${nodeVersion}
+          name: ${qualificationArtifact}
           path: \${{ runner.temp }}/right-git-release/qualification/**
           if-no-files-found: error
+      - name: Upload installed-qualification stage summary
+        if: \${{ always() }}
+        uses: actions/upload-artifact@${UPLOAD_ARTIFACT_SHA} # v4
+        with:
+          name: ${qualificationSummaryArtifact}
+          path: \${{ runner.temp }}/right-git-stage-summary/stage-summary.json
+          if-no-files-found: error
   publish:
-    needs: [installed-qualification${macosDependency}]
-    if: \${{ startsWith(github.ref, 'refs/tags/v') && needs.installed-qualification.result == 'success'${macosSuccess} }}
-    environment: release
+    needs: [admission, installed-qualification${macosDependency}]
+    if: \${{ needs.admission.outputs.publish == 'true' && needs.installed-qualification.result == 'success'${macosSuccess} }}
+    environment: ${releaseEnvironment(manifest, "publication")}
     runs-on: \${{ vars.${chain.qualificationRunnerVariable} || '${windowsRunner}' }}
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Resolve checked-out source revision
-        shell: pwsh
-        run: '"RIGHT_GIT_SOURCE_REVISION=$(git rev-parse HEAD)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append'
+        with:
+          ref: \${{ needs.admission.outputs.source_revision }}
+          fetch-depth: 0
+          persist-credentials: false
       - name: Download same-run finalized Windows release
         uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
         with:
-          name: ${artifactPrefix}-signed-windows-${windowsArchitecture}-${nodeVersion}
+          name: ${windowsSignedArtifact}
           path: \${{ runner.temp }}/right-git-release/windows
 ${macosDownload}
       - name: Download same-run installed qualification evidence
         uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
         with:
-          name: ${artifactPrefix}-installed-qualification-${nodeVersion}
+          name: ${qualificationArtifact}
           path: \${{ runner.temp }}/right-git-release/qualification
+      - name: Download same-run candidate (Windows) stage summary
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${candidateWindowsSummaryArtifact}
+          path: \${{ runner.temp }}/right-git-release/stage-summaries/candidate-windows
+${candidateMacosSummaryDownload}
+      - name: Download same-run Windows signing stage summary
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${windowsSummaryArtifact}
+          path: \${{ runner.temp }}/right-git-release/stage-summaries/windows-sign
+${macosSummaryDownload}
+      - name: Download same-run installed-qualification stage summary
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${qualificationSummaryArtifact}
+          path: \${{ runner.temp }}/right-git-release/stage-summaries/installed-qualification
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: ${nodeVersion}
+          node-version: ${String(manifest.matrix.node[0])}
           package-manager-cache: false
 ${pm.setup}
       - run: ${pm.installCommand}
+      - name: Verify aggregated release evidence
+        run: ${pm.runPrefix} ${chain.evidenceVerificationScript}
+        env:
+          GH_TOKEN: \${{ github.token }}
+          RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/right-git-release/windows${finalizedMacosEnv}
+          RIGHT_GIT_QUALIFICATION_EVIDENCE_ROOT: \${{ runner.temp }}/right-git-release/qualification
+          RIGHT_GIT_STAGE_SUMMARY_ROOT: \${{ runner.temp }}/right-git-release/stage-summaries
+          RIGHT_GIT_RELEASE_VERSION: \${{ needs.admission.outputs.version }}
+          RIGHT_GIT_SOURCE_REVISION: \${{ needs.admission.outputs.source_revision }}
+${runIdentityEnv}
       - name: Publish qualified signed release
         run: ${pm.runPrefix} ${chain.publishScript}
         env:
           GH_TOKEN: \${{ github.token }}
-          RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/right-git-release/windows
-          RIGHT_GIT_FINALIZED_MACOS_ROOT: \${{ runner.temp }}/right-git-release/macos
+          RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/right-git-release/windows${finalizedMacosEnv}
           RIGHT_GIT_QUALIFICATION_EVIDENCE_ROOT: \${{ runner.temp }}/right-git-release/qualification
-          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}
+          RIGHT_GIT_STAGE_SUMMARY_ROOT: \${{ runner.temp }}/right-git-release/stage-summaries
+          RIGHT_GIT_RELEASE_VERSION: \${{ needs.admission.outputs.version }}
+          RIGHT_GIT_SOURCE_REVISION: \${{ needs.admission.outputs.source_revision }}
+${runIdentityEnv}
 ${publishSecretEnvironment}
 `.trimEnd();
 }
@@ -756,6 +989,15 @@ export function deriveProjectName(repoPath) {
  * Build the flat placeholder -> value map used by render.mjs, from a
  * validated manifest plus the target repo's derived project name.
  */
+/** Every managed public workflow runs ownership scanning; repository metadata cannot opt it out. */
+export function ownershipStep(manifest) {
+  const { name } = parsePackageManager(manifest.packageManager);
+  const command = name === "pnpm" ? "pnpm exec right-release ownership --app ."
+    : name === "npm" ? "npm exec -- right-release ownership --app ."
+      : "yarn exec right-release ownership --app .";
+  return `\n      - name: RightKit ownership (protected registry roots)\n        shell: bash\n        run: test "$(git rev-parse HEAD)" = "\${{ github.event_name == 'workflow_dispatch' && inputs.source_revision || github.sha }}" && ${command}`;
+}
+
 export function buildRenderContext(manifest, repoPath) {
   const pm = parsePackageManager(manifest.packageManager);
   const projectName = deriveProjectName(repoPath);
@@ -777,19 +1019,40 @@ export function buildRenderContext(manifest, repoPath) {
     PACKAGE_MANAGER_SETUP: pm.setup,
     ARTIFACT_PREFIX: artifactPrefix,
     TEMPLATE_VERSION: manifest.templateVersion,
-    GATE_PATH: manifest.gate?.path,
     RUST_CACHE_WORKSPACES: rustWorkspaces.map((workspace) => `            ${workspace} -> target`).join("\n"),
     RUST_REQUIRED_FOR_GATE: manifest.rustCache?.requiredForGate === true ? "true" : "false",
-    CANDIDATE_BUILD_SCRIPT: manifest.candidate?.buildScript,
-    CANDIDATE_CHECK_SCRIPT: manifest.candidate?.checkScript,
-    CANDIDATE_ARTIFACT_ROOT: manifest.candidate?.artifactRoot,
-    CANDIDATE_OS_MATRIX: yamlFlowStringList(manifest.candidate?.os ?? manifest.matrix.os),
-    CANDIDATE_MATRIX: candidateMatrix(manifest),
     WINDOWS_SIGNING_JOB: windowsSigningJob(manifest, pm, artifactPrefix),
     MACOS_SIGNING_JOB: macosSigningJob(manifest, pm, artifactPrefix),
     RELEASE_CHAIN_JOBS: releaseChainJobs(manifest, pm, artifactPrefix),
+    OWNERSHIP_STEP: ownershipStep(manifest),
   };
 
+  // Every key below is populated ONLY when its source manifest section is
+  // actually present — mirroring the publish.npm/homebrew/winget pattern.
+  // This keeps the fail-closed check just below honest: a key that is
+  // legitimately inapplicable to this manifest (e.g. CANDIDATE_* for a
+  // non-rust-hybrid manifest, GATE_PATH for a non-rust-hybrid profile) is
+  // simply ABSENT from the context rather than present-with-undefined, so
+  // render.mjs's own `Object.hasOwn` check does the right thing if a
+  // template ever references a token this manifest didn't opt into.
+  if (manifest.gate) {
+    context.GATE_PATH = manifest.gate.path;
+  }
+  if (manifest.candidate) {
+    context.CANDIDATE_BUILD_SCRIPT = manifest.candidate.buildScript;
+    context.CANDIDATE_CHECK_SCRIPT = manifest.candidate.checkScript;
+    context.CANDIDATE_ARTIFACT_ROOT = manifest.candidate.artifactRoot;
+    context.CANDIDATE_OS_MATRIX = yamlFlowStringList(manifest.candidate.os ?? manifest.matrix.os);
+    context.CANDIDATE_MATRIX = candidateMatrix(manifest);
+    // admissionScript & stageSummaryScript are required candidate fields
+    // (see validateManifest) whenever release-candidate is configured at
+    // all — the admission job and the candidate job's stage-summary steps
+    // are unconditional parts of the rendered template, independent of
+    // signing/releaseChain.
+    context.RELEASE_ADMISSION_SCRIPT = manifest.candidate.admissionScript;
+    context.RELEASE_STAGE_SUMMARY_SCRIPT = manifest.candidate.stageSummaryScript;
+  }
+
   if (manifest.publish?.npm) {
     context.NPM_PROVENANCE_FLAG = manifest.publish.npm.provenance ? " --provenance" : "";
   }
@@ -801,5 +1064,21 @@ export function buildRenderContext(manifest, repoPath) {
     context.WINGET_PACKAGE_IDENTIFIER = manifest.publish.winget.packageIdentifier;
   }
 
+  // F-undefined-script fix: render.mjs's `Object.hasOwn` check only proves a
+  // key EXISTS in the context — it does not prove the key resolved to a real
+  // value. Every field above that is sourced from an optional manifest path
+  // (candidate.*, candidate.releaseChain.* via the job-builder functions,
+  // gate.path) must resolve to a real string once its guarding `if` above
+  // decided the section applies; a bug in one of those guards (or a
+  // mis-nested manifest field) must fail the render loudly here rather than
+  // silently emit a literal "undefined" into a workflow file that GitHub
+  // Actions will then try to execute as a real step (e.g. `run: pnpm run
+  // undefined`).
+  for (const [key, value] of Object.entries(context)) {
+    if (value === undefined || value === null) {
+      throw new Error(`buildRenderContext: placeholder \${${key}} resolved to ${value} — check the manifest's candidate/releaseChain/gate/publish configuration`);
+    }
+  }
+
   return context;
 }