@rightkit/git 0.2.25 → 0.2.27

package/README.md

@@ -1,43 +1,59 @@
 # @rightkit/git
 
-Public-repo-only GitHub Actions workflow templates for the Right/Orthic product suite. One CLI, `right-git`, that renders and installs CI lanes into a repository — and refuses to touch a private one.
+Public-repository-only GitHub Actions workflow layer for Right Suite products. The CLI `right-git` renders and installs CI lanes into `.github/workflows/` from a `.rightgit.json` manifest.
 
-## Why public-only
+| Item | Value |
+|---|---|
+| Where it runs | Build and release tooling (repository CI setup) |
+| Rust pair | None |
+| Version | see INDEX.md |
+| License | MIT OR Apache-2.0 |
 
-GitHub Actions minutes are free and unlimited on public repos, and billed on private ones. `@rightkit/git` enforces that boundary in code, not by convention:
+## Commands
 
-1. **Install-time refusal** — `right-git install`/`sync` resolves repo visibility and refuses any private or internal repo, with no override flag. Visibility fails closed: an unconfirmed repo is treated as not-public.
-2. **Run-time guard** — every rendered workflow carries an unconditional `private-repo-guard` job that fails loudly (`exit 1`) if the repo is ever flipped private after install; every other job depends on it.
-3. **Drift audit** — `right-git drift --all` re-checks visibility across managed repos.
+- `right-git install <repo> --lanes ci,...` writes `.rightgit.json` and renders workflows.
+- `right-git sync` re-renders installed workflows from the manifest.
+- `right-git drift --all` checks installed workflows against templates and re-checks visibility.
+- `right-git adopt` imports existing workflows into the template library.
+- `right-git uninstall` removes every managed file.
 
-## What it does
+`install` and `sync` refuse private, internal and unconfirmed-visibility repositories. There is no override flag.
 
-- **`right-git install|sync`** — render CI lanes (ci, qualification, package-smoke, release-candidate, publish-npm, publish-package-managers) from a `.rightgit.json` manifest into `.github/workflows/`.
-- **`right-git drift`** — detect divergence between installed workflows and templates, and orphaned managed workflows.
-- **`right-git adopt`** — import existing workflows into the template library.
-- **`right-git uninstall`** — remove every managed file, leaving zero behind.
+## Optional QA evidence upload (rust-hybrid)
 
-Workflows are thin callers over the repo's own scripts, so a private repo running the same gates locally executes identical checks.
+Set `qaEvidencePath` in `.rightgit.json` to upload the gate's QA output as a workflow artifact. The path is relative to `$RUNNER_TEMP`; the rendered step uses `${{ runner.temp }}/<path>`. Absolute paths and expression syntax are rejected.
 
-Sync records exact prior bytes, refuses unmanaged same-name workflows, & preflights every target before any write. Qualification preserves schema logs with a unique required artifact.
+```json
+{
+  "profile": "rust-hybrid",
+  "gate": { "path": "scripts/gate.sh" },
+  "qaEvidencePath": "pulse-hub-qa",
+  "qaEvidenceRetentionDays": 14
+}
+```
 
-## Credential posture (read before enabling package-manager publishing)
+- The step runs after the gate with `if: always()` and `if-no-files-found: ignore`.
+- Artifact name: `qa-evidence-${{ matrix.os || runner.os }}-${{ github.run_attempt }}`.
+- `qaEvidenceRetentionDays` is an integer from 1 to 90 and defaults to 7. It requires `qaEvidencePath`.
+- Omit the key and the rendered `ci.yml` is unchanged.
 
-- **Signing credentials stay environment-scoped.** Opt-in Windows candidates use GitHub OIDC with Azure Artifact Signing. Opt-in macOS candidates use a temporary runner keychain plus Apple API-key notarization. Signing jobs run only for `v*` tag refs; manual dispatch produces unsigned candidates only. npm publishing uses short-lived OIDC.
-- **Exception, disclosed:** the optional, opt-in `publish-package-managers` lane *does* require two owner-provisioned, long-lived tokens in GitHub Actions `secrets.*` (`HOMEBREW_TAP_TOKEN`, `WINGET_CREATE_GITHUB_TOKEN`) to open tap/manifest PRs. These are real bearer tokens, public-repo-scoped by the visibility gate but not zero-exposure. The "no signing credential in CI" invariant is specifically about code-signing material; it does not mean "no credential of any kind."
+## Entry points
 
-Manifest input is treated as untrusted: every field flowing into rendered YAML is charset-allowlisted, so a manifest cannot inject `${{ secrets.* }}` or shell/expression syntax.
+No importable API. The package has no `main` and no `exports` map. The supported surface is the `right-git` bin.
 
-## Install
+## Peer dependencies
 
-```sh
-npm install -g @rightkit/git   # or: npx @rightkit/git --help
-```
+None. No runtime dependencies (Node builtins only).
 
-Node builtins only; no runtime dependencies.
+## Example
 
-## Profiles
+```sh
+pnpm add -D @rightkit/git
+pnpm exec right-git install . --lanes ci
+pnpm exec right-git drift --all
+```
 
-`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus Rust, then runs product-owned package scripts. `rustCache.workspaces` declares every independent Cargo workspace whose `target` directory participates in dependency caching. Rust-hybrid workflows also enable source-aware sccache compilation caching, reuse one stable cache namespace across CI & candidate jobs, & keep workspace-crate artifacts out of rust-cache to prevent stale exact hits. Candidate configuration is `{ buildScript, checkScript, artifactRoot, os, targets?, signWindows?, signMacos?, releaseChain? }`. Legacy `os` remains supported & derives one target per runner; explicit `targets` is `{ os, platform, architecture }[]`, independent of main CI matrix. Each target maps to native runner, Rust target triple, exact unsigned artifact, & platform signing matrix. Supported platform values are `windows`, `macos`, `linux`; architectures are `x86_64`, `arm64`. RightGit always uploads an unsigned handoff. `signWindows: true` adds Azure OIDC signing. `signMacos: true` adds Developer ID signing plus notarization from protected environment secrets.
+## Known issues
 
-`releaseChain` lets RightGit own full protected DAG while product scripts own artifact semantics: `{ windowsFinalizeScript, macosFinalizeScript?, installedQualificationScript, publishScript, qualificationRunnerVariable, publishSecrets? }`. Generated ordering is unsigned candidate → platform signing/finalization → installed qualification → publication. It deliberately rejects more than one Windows target or more than one macOS target because its installed-qualification/publish handoff has one canonical signed artifact per platform. Every protected job is tag-gated, publication needs successful installed qualification plus macOS finalization when enabled, & only publish job receives declared publication secrets plus `contents: write`.
+- The optional `publish-package-managers` lane needs two long-lived tokens in GitHub Actions secrets. Their names and scope are in the package templates, and they are not zero-exposure. Read `docs/rules/github-access.md` in the workspace before enabling it.
+- Manifest fields are charset-checked before they reach workflow YAML.

package/guard-coverage.test.mjs

@@ -166,12 +166,11 @@ function isGuarded(jobs, jobName, visiting = new Set()) {
 }
 
 function renderAllLanes() {
-  const context = buildRenderContext(FULL_MANIFEST, "/repos/widgets");
   const rendered = {};
   for (const lane of FULL_MANIFEST.lanes) {
     const templatePath = path.join(templatesDir, LANE_FILENAMES[lane]);
     const templateText = fs.readFileSync(templatePath, "utf8");
-    rendered[lane] = renderTemplate(templateText, context);
+    rendered[lane] = renderTemplate(templateText, buildRenderContext(FULL_MANIFEST, "/repos/widgets", lane));
   }
   return rendered;
 }

package/manifest.mjs

@@ -59,9 +59,17 @@ const TOP_LEVEL_KEYS = new Set([
   "profile",
   "gate",
   "rustCache",
+  "qaEvidencePath",
+  "qaEvidenceRetentionDays",
   "candidate",
   "ownership",
 ]);
+// Optional QA evidence upload (rust-hybrid ci only). qaEvidencePath is a safe
+// relative path under $RUNNER_TEMP; it renders as `${{ runner.temp }}/<path>`.
+const QA_EVIDENCE_DEFAULT_RETENTION_DAYS = 7;
+const QA_EVIDENCE_MAX_RETENTION_DAYS = 90;
+// Pinned to the same upload-artifact release the rust-hybrid release-candidate template uses.
+const UPLOAD_ARTIFACT_PIN = "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4";
 const GATE_PATH_RE = /^(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 const RUST_WORKSPACE_PATH_RE = /^(?:\.|(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*)$/;
 const PACKAGE_SCRIPT_RE = /^[A-Za-z0-9][A-Za-z0-9:_-]*$/;
@@ -160,6 +168,21 @@ export function validateManifest(manifest) {
     errors.push("gate is only valid for profile 'rust-hybrid'");
   }
 
+  if (manifest.qaEvidencePath !== undefined) {
+    if (profile !== "rust-hybrid") {
+      errors.push("qaEvidencePath is only valid for profile 'rust-hybrid'");
+    } else if (typeof manifest.qaEvidencePath !== "string" || !GATE_PATH_RE.test(manifest.qaEvidencePath)) {
+      errors.push("qaEvidencePath must be a safe relative path under $RUNNER_TEMP (no '..', whitespace, leading '/', or expression syntax)");
+    }
+  }
+  if (manifest.qaEvidenceRetentionDays !== undefined) {
+    if (manifest.qaEvidencePath === undefined) {
+      errors.push("qaEvidenceRetentionDays requires qaEvidencePath");
+    } else if (!Number.isInteger(manifest.qaEvidenceRetentionDays) || manifest.qaEvidenceRetentionDays < 1 || manifest.qaEvidenceRetentionDays > QA_EVIDENCE_MAX_RETENTION_DAYS) {
+      errors.push(`qaEvidenceRetentionDays must be an integer from 1 to ${QA_EVIDENCE_MAX_RETENTION_DAYS}`);
+    }
+  }
+
   const rustCache = manifest.rustCache;
   if (rustCache !== undefined) {
     if (profile !== "rust-hybrid") {
@@ -990,15 +1013,42 @@ export function deriveProjectName(repoPath) {
  * validated manifest plus the target repo's derived project name.
  */
 /** Every managed public workflow runs ownership scanning; repository metadata cannot opt it out. */
-export function ownershipStep(manifest) {
+export function ownershipStep(manifest, lane = "ci") {
   const { name } = parsePackageManager(manifest.packageManager);
   const command = name === "pnpm" ? "pnpm exec right-release ownership --app ."
     : name === "npm" ? "npm exec -- right-release ownership --app ."
       : "yarn exec right-release ownership --app .";
-  return `\n      - name: RightKit ownership (protected registry roots)\n        shell: bash\n        run: test "$(git rev-parse HEAD)" = "\${{ github.event_name == 'workflow_dispatch' && inputs.source_revision || github.sha }}" && ${command}`;
+  // Only release-candidate dispatches declare source_revision. Referencing
+  // inputs.source_revision from other lanes makes actionlint reject their
+  // generated workflows, even when guarded by an event-name expression.
+  const sourceRevision = lane === "release-candidate"
+    ? "\${{ inputs.source_revision }}"
+    : "\${{ github.sha }}";
+  return `\n      - name: RightKit ownership (protected registry roots)\n        shell: bash\n        run: test "$(git rev-parse HEAD)" = "${sourceRevision}" && ${command}`;
+}
+
+/**
+ * Optional QA evidence upload, rendered after the rust-hybrid gate step.
+ * Returns "" when qaEvidencePath is unset, so the rendered workflow stays
+ * byte-identical to a manifest without the key.
+ */
+export function qaEvidenceStep(manifest) {
+  if (manifest.qaEvidencePath === undefined) return "";
+  const retentionDays = manifest.qaEvidenceRetentionDays ?? QA_EVIDENCE_DEFAULT_RETENTION_DAYS;
+  return [
+    "      - name: Upload QA evidence",
+    "        if: always()",
+    `        uses: ${UPLOAD_ARTIFACT_PIN}`,
+    "        with:",
+    "          name: qa-evidence-${{ matrix.os || runner.os }}-${{ github.run_attempt }}",
+    `          path: \${{ runner.temp }}/${manifest.qaEvidencePath}`,
+    `          retention-days: ${retentionDays}`,
+    "          if-no-files-found: ignore",
+    "",
+  ].join("\n");
 }
 
-export function buildRenderContext(manifest, repoPath) {
+export function buildRenderContext(manifest, repoPath, lane = "ci") {
   const pm = parsePackageManager(manifest.packageManager);
   const projectName = deriveProjectName(repoPath);
   const artifactPrefix = projectName.toLowerCase().replace(/[^a-z0-9-]+/g, "-");
@@ -1024,7 +1074,8 @@ export function buildRenderContext(manifest, repoPath) {
     WINDOWS_SIGNING_JOB: windowsSigningJob(manifest, pm, artifactPrefix),
     MACOS_SIGNING_JOB: macosSigningJob(manifest, pm, artifactPrefix),
     RELEASE_CHAIN_JOBS: releaseChainJobs(manifest, pm, artifactPrefix),
-    OWNERSHIP_STEP: ownershipStep(manifest),
+    OWNERSHIP_STEP: ownershipStep(manifest, lane),
+    QA_EVIDENCE_STEP: qaEvidenceStep(manifest),
   };
 
   // Every key below is populated ONLY when its source manifest section is

package/manifest.schema.json

@@ -116,6 +116,18 @@
       "type": "object", "required": ["path"], "additionalProperties": false,
       "properties": { "path": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" } }
     },
+    "qaEvidencePath": {
+      "type": "string",
+      "description": "rust-hybrid only. Safe relative path under $RUNNER_TEMP where the gate writes QA evidence; rendered as ${{ runner.temp }}/<path> and uploaded with if: always().",
+      "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$"
+    },
+    "qaEvidenceRetentionDays": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 90,
+      "default": 7,
+      "description": "rust-hybrid only, requires qaEvidencePath. Artifact retention in days."
+    },
     "candidate": {
       "type": "object",
       "required": ["buildScript", "checkScript", "admissionScript", "stageSummaryScript", "artifactRoot", "os"],

package/manifest.test.mjs

@@ -389,3 +389,17 @@ test("F15 non-regression: realistic homebrew/winget/matrix values still validate
   });
   assert.equal(result.valid, true, JSON.stringify(result.errors));
 });
+
+test("qaEvidencePath and qaEvidenceRetentionDays are optional, rust-hybrid only, and charset-checked", () => {
+  const valid = { ...VALID_MINIMAL, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
+  assert.equal(validateManifest({ ...valid, qaEvidencePath: "pulse-hub-qa" }).valid, true);
+  assert.equal(validateManifest({ ...valid, qaEvidencePath: "pulse-hub-qa", qaEvidenceRetentionDays: 30 }).valid, true);
+  for (const qaEvidencePath of ["/abs", "../up", "pulse hub", "${{ runner.temp }}/x", "a;b", "", null]) {
+    assert.equal(validateManifest({ ...valid, qaEvidencePath }).valid, false, String(qaEvidencePath));
+  }
+  for (const qaEvidenceRetentionDays of [0, 91, 1.5, "7"]) {
+    assert.equal(validateManifest({ ...valid, qaEvidencePath: "pulse-hub-qa", qaEvidenceRetentionDays }).valid, false, String(qaEvidenceRetentionDays));
+  }
+  assert.equal(validateManifest({ ...valid, qaEvidenceRetentionDays: 7 }).valid, false, "retention requires a path");
+  assert.equal(validateManifest({ ...VALID_MINIMAL, qaEvidencePath: "pulse-hub-qa" }).valid, false, "node profile rejects qaEvidencePath");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.25",
+  "version": "0.2.27",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -24,12 +24,11 @@ const FULL_MANIFEST = {
 };
 
 function renderAllLanes(manifest, repoPath) {
-  const context = buildRenderContext(manifest, repoPath);
   const rendered = {};
   for (const lane of manifest.lanes) {
     const templatePath = path.join(templatesDir, LANE_FILENAMES[lane]);
     const templateText = fs.readFileSync(templatePath, "utf8");
-    rendered[lane] = renderTemplate(templateText, context);
+    rendered[lane] = renderTemplate(templateText, buildRenderContext(manifest, repoPath, lane));
   }
   return rendered;
 }
@@ -60,6 +59,7 @@ test("rust-hybrid ci renders its pinned package manager and gate", () => {
   assert.match(content, /changed=true[\s\S]*\^0\{40\}\$[\s\S]*git cat-file -e[\s\S]*git diff --name-only --diff-filter=ACDMRTUXB/);
   assert.match(content, /--diff-filter=ACDMRTUXB/, "deleted Rust inputs must trigger Rust setup");
   assert.match(content, /\*\.rs\|Cargo\.toml[\s\S]*scripts\/gate\.sh/);
+  assert.doesNotMatch(content, /\|build\.rs\||\|\*\/build\.rs\|/);
   assert.match(content, /\.rightgit\.json\|\.github\/workflows\/\*\.yml\|\.github\/workflows\/\*\.yaml/);
   assert.equal((content.match(/if: steps\.rust-changes\.outputs\.required == 'true'/g) ?? []).length, 3);
   assert.match(content, /RIGHT_GIT_RUST_CHANGED: \$\{\{ steps\.rust-changes\.outputs\.changed \}\}/);
@@ -94,6 +94,15 @@ test("ordinary CI templates cancel superseded runs on the same ref", () => {
   assert.match(generic, /cancel-in-progress: true/);
 });
 
+test("ownership revision expression matches each lane trigger contract", () => {
+  const rendered = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
+  assert.match(rendered.ci, /git rev-parse HEAD\)" = "\$\{\{ github\.sha \}\}/);
+  assert.doesNotMatch(rendered.ci, /inputs\.source_revision/);
+  assert.match(rendered["publish-package-managers"], /git rev-parse HEAD\)" = "\$\{\{ github\.sha \}\}/);
+  assert.doesNotMatch(rendered["publish-package-managers"], /inputs\.source_revision/);
+  assert.match(rendered["release-candidate"], /git rev-parse HEAD\)" = "\$\{\{ inputs\.source_revision \}\}/);
+});
+
 test("rust-hybrid ci preserves a declared macOS-only lane", () => {
   const manifest = {
     ...FULL_MANIFEST,
@@ -195,7 +204,7 @@ test("rust-hybrid release candidate can opt into OIDC Windows signing without lo
   };
   const content = renderTemplate(
     fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
-    buildRenderContext(manifest, "/repos/widgets"),
+    buildRenderContext(manifest, "/repos/widgets", "release-candidate"),
   );
   assert.match(content, /environment: release/);
   // Tag-last contract: signing is gated on the admitted, same-run
@@ -212,7 +221,7 @@ test("rust-hybrid release candidate can opt into OIDC Windows signing without lo
   // out the exact admitted revision by SHA, never by resolving HEAD after a
   // ref-triggered checkout.
   assert.match(content, /windows-sign:[\s\S]*?ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+fetch-depth: 0\n\s+persist-credentials: false/);
-  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision \|\| github\.sha/);
+  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision/);
   assert.ok(content.includes("LEGION_SOURCE_REVISION: ${{ env.RIGHT_GIT_SOURCE_REVISION }}"));
   assert.doesNotMatch(content, /LEGION_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
   assert.doesNotMatch(content, /secrets\.|client-secret|private.key/i);
@@ -240,7 +249,7 @@ test("rust-hybrid release candidate can opt into protected macOS signing & notar
   };
   const content = renderTemplate(
     fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
-    buildRenderContext(manifest, "/repos/widgets"),
+    buildRenderContext(manifest, "/repos/widgets", "release-candidate"),
   );
   assert.match(content, /macos-sign:/);
   assert.match(content, /macos-sign:\n    needs: \[admission, candidate\]\n    if: \$\{\{ needs\.admission\.outputs\.signed_qualification == 'true' \}\}/);
@@ -251,7 +260,7 @@ test("rust-hybrid release candidate can opt into protected macOS signing & notar
   assert.match(content, /right-release build --platform mac --skip-checks/);
   assert.match(content, /secrets\.APPLE_API_KEY_BASE64/);
   assert.match(content, /macos-sign:[\s\S]*?ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+fetch-depth: 0\n\s+persist-credentials: false/);
-  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision \|\| github\.sha/);
+  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision/);
   assert.ok(content.includes("LEGION_SOURCE_REVISION: ${{ env.RIGHT_GIT_SOURCE_REVISION }}"));
   assert.doesNotMatch(content, /LEGION_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
   assert.match(content, /security delete-keychain/);
@@ -287,7 +296,7 @@ test("rust-hybrid multi-architecture candidates bind every native target to exac
   };
   const content = renderTemplate(
     fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
-    buildRenderContext(manifest, "/repos/widgets"),
+    buildRenderContext(manifest, "/repos/widgets", "release-candidate"),
   );
   for (const [runner, triple] of [["windows-2025", "x86_64-pc-windows-msvc"], ["windows-11-arm", "aarch64-pc-windows-msvc"], ["macos-15", "aarch64-apple-darwin"], ["macos-15-intel", "x86_64-apple-darwin"]]) {
     assert.match(content, new RegExp(`os: ${JSON.stringify(runner).replace(/[.*+?^${}()|[\\]\\]/g, "\\$&")}`));
@@ -338,7 +347,7 @@ test("rust-hybrid release chain preserves signed candidate, installed qualificat
   };
   const content = renderTemplate(
     fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
-    buildRenderContext(manifest, "/repos/widgets"),
+    buildRenderContext(manifest, "/repos/widgets", "release-candidate"),
   );
   assert.match(content, /windows-sign:[\s\S]*pnpm run release:finalize:win/);
   assert.match(content, /macos-sign:[\s\S]*pnpm run release:finalize:mac/);
@@ -372,7 +381,7 @@ test("rust-hybrid release chain preserves signed candidate, installed qualificat
   assert.match(content, /CLOUDFLARE_API_TOKEN: \$\{\{ secrets\.CLOUDFLARE_API_TOKEN \}\}/);
   // Ownership scan binds to the source revision input before admission emits
   // that same revision for every downstream job.
-  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision \|\| github\.sha/);
+  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision/);
   assert.doesNotMatch(content, /RIGHT_GIT_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
   // candidate, windows-sign, macos-sign, installed-qualification and publish all
   // check out the admitted revision with full history; admission checks out
@@ -430,7 +439,7 @@ test("every 'run <script>' in a full release-chain workflow names a script the m
   };
   const content = renderTemplate(
     fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
-    buildRenderContext(manifest, "/repos/widgets"),
+    buildRenderContext(manifest, "/repos/widgets", "release-candidate"),
   );
   const declaredScripts = new Set([
     manifest.candidate.buildScript,
@@ -491,7 +500,7 @@ test("release chain: installed-qualification has a stage summary and publish dow
   };
   const content = renderTemplate(
     fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
-    buildRenderContext(manifest, "/repos/widgets"),
+    buildRenderContext(manifest, "/repos/widgets", "release-candidate"),
   );
   const installedQualificationJob = content.slice(
     content.search(/^ {2}installed-qualification:\n {4}needs:/m),
@@ -689,7 +698,7 @@ test("every job checking out an admitted revision fetches full history", () => {
   };
   const content = renderTemplate(
     fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
-    buildRenderContext(manifest, "/repos/widgets"),
+    buildRenderContext(manifest, "/repos/widgets", "release-candidate"),
   );
   const checkouts = content
     .split(/^ {6}- uses: actions\/checkout@/m)
@@ -732,7 +741,7 @@ test("release-candidate template exposes a dry_run input threaded through admiss
   };
   const content = renderTemplate(
     fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
-    buildRenderContext(manifest, "/repos/widgets"),
+    buildRenderContext(manifest, "/repos/widgets", "release-candidate"),
   );
   assert.match(content, /^      dry_run:\n        description: .*\n        required: false\n        type: boolean\n        default: false$/m);
   assert.match(content, /dry_run: \$\{\{ steps\.admit\.outputs\.dry_run \}\}/);
@@ -785,7 +794,7 @@ function environmentManifest(environments) {
 function renderRelease(manifest) {
   return renderTemplate(
     fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
-    buildRenderContext(manifest, "/repos/widgets"),
+    buildRenderContext(manifest, "/repos/widgets", "release-candidate"),
   );
 }
 
@@ -820,3 +829,24 @@ test("ci.yml ownership check cannot be removed by deleting optional repo metadat
   const without = renderTemplate(template, buildRenderContext(structuredClone(FULL_MANIFEST), "/repos/widgets"));
   assert.match(without, /RightKit ownership \(protected registry roots\)/);
 });
+
+test("rust-hybrid ci uploads QA evidence after the gate only when qaEvidencePath is set", () => {
+  const base = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" }, templateVersion: "1.1.0" };
+  const template = fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8");
+
+  const unset = renderTemplate(template, buildRenderContext(structuredClone(base), "/repos/widgets"));
+  assert.doesNotMatch(unset, /upload-artifact|QA evidence|runner\.temp/);
+  assert.match(unset, /CARGO_PROFILE_TEST_DEBUG: "0"\n$/);
+
+  const set = renderTemplate(template, buildRenderContext({ ...structuredClone(base), qaEvidencePath: "pulse-hub-qa" }, "/repos/widgets"));
+  assert.ok(set.indexOf("bash ./scripts/gate.sh") < set.indexOf("- name: Upload QA evidence"), "upload must follow the gate step");
+  assert.match(
+    set,
+    /      - name: Upload QA evidence\n        if: always\(\)\n        uses: actions\/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4\n        with:\n          name: qa-evidence-\$\{\{ matrix\.os \|\| runner\.os \}\}-\$\{\{ github\.run_attempt \}\}\n          path: \$\{\{ runner\.temp \}\}\/pulse-hub-qa\n          retention-days: 7\n          if-no-files-found: ignore\n$/,
+  );
+  // The upload step is the only difference between the two renders.
+  assert.equal(set.replace(/      - name: Upload QA evidence[\s\S]*$/, ""), unset);
+
+  const custom = renderTemplate(template, buildRenderContext({ ...structuredClone(base), qaEvidencePath: "pulse-hub-qa", qaEvidenceRetentionDays: 30 }, "/repos/widgets"));
+  assert.match(custom, /retention-days: 30\n/);
+});

package/rightkit-ownership.json

@@ -0,0 +1,15 @@
+{
+  "package": "@rightkit/git",
+  "capabilities": [
+    {
+      "capability": "github-workflows",
+      "summary": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    }
+  ]
+}

package/sync.mjs

@@ -31,8 +31,8 @@ function releaseChainDependencyError(repoPath, manifest) {
 
 /** Render every lane declared in the manifest. Returns { lane, filename, content }[]. */
 export function renderLanes(manifest, repoPath) {
-  const context = buildRenderContext(manifest, repoPath);
   return manifest.lanes.map((lane) => {
+    const context = buildRenderContext(manifest, repoPath, lane);
     const filename = LANE_FILENAMES[lane];
     const templatePath = manifest.profile === "rust-hybrid"
       ? path.join(TEMPLATES_DIR, "profiles", "rust-hybrid", filename)

package/templates/profiles/rust-hybrid/ci.yml

@@ -45,7 +45,7 @@ jobs:
               changed=false
               while IFS= read -r changed_path; do
                 case "$changed_path" in
-                  *.rs|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|build.rs|*/build.rs|rust-toolchain|*/rust-toolchain|rust-toolchain.toml|*/rust-toolchain.toml|.cargo/*|*/.cargo/*|.rightgit.json|.github/workflows/*.yml|.github/workflows/*.yaml|${GATE_PATH})
+                  *.rs|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|rust-toolchain|*/rust-toolchain|rust-toolchain.toml|*/rust-toolchain.toml|.cargo/*|*/.cargo/*|.rightgit.json|.github/workflows/*.yml|.github/workflows/*.yaml|${GATE_PATH})
                     changed=true
                     break
                     ;;
@@ -93,3 +93,4 @@ ${RUST_CACHE_WORKSPACES}
           CARGO_INCREMENTAL: "0"
           CARGO_PROFILE_DEV_DEBUG: "0"
           CARGO_PROFILE_TEST_DEBUG: "0"
+${QA_EVIDENCE_STEP}

package/templates/publish-npm.yml

@@ -43,10 +43,30 @@ ${PACKAGE_MANAGER_SETUP}
 ${OWNERSHIP_STEP}
       - run: node scripts/release/build-candidate.mjs --version "${{ github.event.release.tag_name }}" --platform current --out "release/candidates/publish"
       - run: node scripts/release/check-release.mjs release/candidates/publish
+      # check-release must supply publication-evidence.json with artifactSha256.
+      # Capture gated bytes before publication; never hash the source path during readback.
       - id: tarball
         shell: bash
         run: |
-          TARBALL="release/candidates/publish/$(node -e 'const c=require("./release/candidates/publish/compatibility.json");process.stdout.write(c.packageName.replace(/^@/, "").replace("/", "-")+"-"+c.version+".tgz")')"
-          test -f "$TARBALL"
-          echo "path=$TARBALL" >> "$GITHUB_OUTPUT"
+          node --input-type=module <<'NODE'
+          import fs from 'node:fs';
+          import { prepareNpmPublication } from '@rightkit/release/publication-gate.mjs';
+          const root = 'release/candidates/publish';
+          const c = JSON.parse(fs.readFileSync(`${root}/compatibility.json`));
+          const tarball = `${root}/${c.packageName.replace(/^@/, '').replace('/', '-')}-${c.version}.tgz`;
+          const proof = prepareNpmPublication({ name: c.packageName, version: c.version, tarball, evidencePath: `${root}/publication-evidence.json` });
+          // Only safe single-line metadata may enter GitHub outputs.
+          for (const value of [tarball, proof.name, proof.version]) if (/[\r\n]/.test(value)) throw new Error('unsafe npm publication identity');
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, `path=${tarball}\nname=${proof.name}\nversion=${proof.version}\nsha1=${proof.sha1}\n`);
+          NODE
       - run: npm publish "${{ steps.tarball.outputs.path }}"${NPM_PROVENANCE_FLAG} --access public
+      - name: Require registry byte equality
+        env:
+          NPM_PUBLICATION_NAME: ${{ steps.tarball.outputs.name }}
+          NPM_PUBLICATION_VERSION: ${{ steps.tarball.outputs.version }}
+          NPM_PUBLICATION_SHA1: ${{ steps.tarball.outputs.sha1 }}
+        run: |
+          node --input-type=module <<'NODE'
+          import { verifyNpmRegistryBytes } from '@rightkit/release/publication-gate.mjs';
+          verifyNpmRegistryBytes({ name: process.env.NPM_PUBLICATION_NAME, version: process.env.NPM_PUBLICATION_VERSION, sha1: process.env.NPM_PUBLICATION_SHA1 });
+          NODE