@rightkit/release 0.2.111 → 0.2.112

package/hardeningscan.mjs

@@ -1,144 +1,144 @@
-#!/usr/bin/env node
-import { createHash } from "node:crypto";
-import { createReadStream, readFileSync, realpathSync } from "node:fs";
-import { lstat, readdir } from "node:fs/promises";
-import path from "node:path";
-import { HARDENING_RULES } from "./hardening-evidence.mjs";
-
-const rawArgs = process.argv.slice(2);
-if (rawArgs.length === 0 || rawArgs.includes("-h") || rawArgs.includes("--help")) {
-  console.error("usage: node hardeningscan.mjs [--allow-evidence <json>] <artifact-path>...");
-  process.exit(rawArgs.length === 0 ? 2 : 0);
-}
-const allowIndex = rawArgs.indexOf("--allow-evidence");
-const allowEvidencePath = allowIndex >= 0 ? rawArgs[allowIndex + 1] : null;
-if (allowIndex >= 0 && !allowEvidencePath) throw new Error("--allow-evidence requires a JSON path");
-// Only strip the flag pair when the flag is present: with allowIndex = -1,
-// filtering out index `allowIndex + 1` would silently drop the first
-// artifact path (a lone artifact arg then failed as "no artifact path").
-const args = allowIndex >= 0
-  ? rawArgs.filter((_, index) => index !== allowIndex && index !== allowIndex + 1)
-  : rawArgs;
-if (!args.length) throw new Error("at least one artifact path is required");
-
-const root = realpathSync(process.cwd());
-const findings = [];
-const evidence = allowEvidencePath ? JSON.parse(readFileSync(allowEvidencePath, "utf8")) : { allowances: [] };
-if (allowEvidencePath && (evidence.schemaVersion !== 1 || evidence.kind !== "rightkit-hardening-evidence")) {
-  throw new Error("invalid hardening evidence");
-}
-const allowances = evidence.allowances ?? [];
-for (const allowance of allowances) {
-  const sourceMatch = typeof allowance.sourceEvidence === "string" ? /^(.*):([1-9]\d*)$/.exec(allowance.sourceEvidence) : null;
-  const knownRule = HARDENING_RULES[allowance.rule];
-  if (!knownRule || allowance.exact !== knownRule.exact || !sourceMatch || !/^[a-f0-9]{64}$/.test(allowance.artifactSha256 ?? "") || !/^[a-f0-9]{64}$/.test(allowance.sourceSha256 ?? "") || allowance.sourceLine !== Number(sourceMatch[2]) || typeof allowance.rationale !== "string" || allowance.rationale.trim().length < 12) {
-    throw new Error("invalid hardening allowance source binding");
-  }
-  const sourcePath = realpathSync(path.resolve(root, sourceMatch[1]));
-  const sourceRelative = path.relative(root, sourcePath);
-  if (sourceRelative === ".." || sourceRelative.startsWith("../") || sourceRelative.startsWith("..\\") || path.isAbsolute(sourceRelative)) {
-    throw new Error("hardening allowance source escapes release root");
-  }
-  const sourceBytes = readFileSync(sourcePath);
-  if (createHash("sha256").update(sourceBytes).digest("hex") !== allowance.sourceSha256) throw new Error("hardening allowance source digest mismatch");
-  const line = sourceBytes.toString("utf8").split(/\r?\n/)[allowance.sourceLine - 1];
-  if (typeof line !== "string" || !line.includes(allowance.exact)) throw new Error("hardening allowance source token mismatch");
-}
-
-const fileNameRules = [
-  [/\.map$/i, "source map shipped"],
-  [/\.pdb$/i, "Windows debug symbols shipped"],
-  [/\.dSYM(?:$|[/\\])/i, "macOS debug symbols shipped"],
-  [/\.mlpackage(?:$|[/\\])/i, "raw CoreML package shipped"],
-  [/[/\\]docs[/\\]experiments(?:$|[/\\])/i, "experiment docs shipped"],
-  [/[/\\]\.scratch(?:$|[/\\])/i, "scratch directory shipped"],
-  [/[/\\]\.git(?:$|[/\\])/i, "git metadata shipped"],
-  [/[/\\]node_modules(?:$|[/\\])/i, "node_modules shipped"],
-  [/[/\\](?:src|tests?|benches|benchmarks)(?:$|[/\\])/i, "source/test tree shipped"],
-  [/[/\\]tdt_w15_p6(?:$|[/\\])/i, "stale TDT p6 model shipped"],
-];
-
-const contentRules = [
-  ["local-source-path", /\/Users\/adrdsouza\/claude/gi, "local source path leaked"],
-  ["local-cargo-path", /\/Users\/adrdsouza\/\.cargo/gi, "local cargo path leaked"],
-  ["local-windows-path", /C:\\Users\\adrdsouza\\(?:claude|\.cargo)/gi, "local Windows source path leaked"],
-  ["experiment-path", /docs\/experiments/gi, "experiment path leaked"],
-  ["cleanup-prompt-marker", /l3_cleanup_prompt/gi, "L3 cleanup prompt marker leaked"],
-  ["system-prompt-marker", /SYSTEM_PROMPT/gi, "system prompt marker leaked"],
-  ["secret-env-name", /OPENAI_API_KEY|ANTHROPIC_API_KEY|APPLE_PASSWORD|NOTARY_PROFILE/gi, "secret/env key name leaked"],
-  ["gpl-flag", /--enable-gpl|--enable-nonfree/gi, "GPL/nonfree ffmpeg flag leaked"],
-  ["stale-model", /tdt_w15_p6/gi, "stale TDT p6 string leaked"],
-  ["experiment-model", /Canary-Qwen|Nemotron|dqlstm|bias-experiments/gi, "experiment/model-history marker leaked"],
-];
-
-const maxPatternLen = Math.max(...contentRules.map(([, rule]) => String(rule).length), 256);
-
-function add(kind, file, message, detail = "") {
-  findings.push({ kind, file: path.relative(root, file) || file, message, detail });
-}
-
-async function walk(target) {
-  const st = await lstat(target);
-  const normalized = target.split(path.sep).join("/");
-  for (const [rule, message] of fileNameRules) if (rule.test(normalized)) add("path", target, message);
-  if (st.isDirectory()) {
-    const entries = await readdir(target);
-    await Promise.all(entries.map((name) => walk(path.join(target, name))));
-    return;
-  }
-  if (st.isFile()) await scanFile(target);
-}
-
-function scanFile(file) {
-  return new Promise((resolveScan) => {
-    const artifactSha256 = createHash("sha256").update(readFileSync(file)).digest("hex");
-    const stream = createReadStream(file, { highWaterMark: 256 * 1024 });
-    let tail = "";
-    stream.on("data", (chunk) => {
-      const text = tail + chunk.toString("latin1");
-      for (const [ruleId, rule, message] of contentRules) {
-        if (/ffmpeg-LICENSE\.txt$/i.test(file) && ruleId === "gpl-flag") continue;
-        rule.lastIndex = 0;
-        for (const match of text.matchAll(rule)) {
-          const allowed = allowances.some((allowance) =>
-            allowance.rule === ruleId &&
-            allowance.artifactSha256 === artifactSha256 &&
-            allowance.exact === match[0] &&
-            typeof allowance.sourceEvidence === "string" &&
-            typeof allowance.rationale === "string"
-          );
-          if (!allowed) add("content", file, message, rule.source);
-        }
-      }
-      tail = text.slice(-maxPatternLen);
-    });
-    stream.on("error", (error) => {
-      add("read", file, "could not scan file", error.message);
-      resolveScan();
-    });
-    stream.on("end", resolveScan);
-  });
-}
-
-for (const arg of args) {
-  const target = path.resolve(arg);
-  try {
-    await walk(target);
-  } catch (error) {
-    add("target", target, "could not scan target", error.message);
-  }
-}
-
-const unique = new Map();
-for (const finding of findings) unique.set([finding.kind, finding.file, finding.message].join("\0"), finding);
-const deduped = [...unique.values()].sort((left, right) =>
-  (left.file + " " + left.message).localeCompare(right.file + " " + right.message),
-);
-
-if (deduped.length) {
-  console.error("hardeningscan: " + deduped.length + " finding(s)");
-  for (const finding of deduped) console.error("- [" + finding.kind + "] " + finding.file + ": " + finding.message);
-  process.exit(1);
-}
-
-console.log("hardeningscan: clean");
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { createReadStream, readFileSync, realpathSync } from "node:fs";
+import { lstat, readdir } from "node:fs/promises";
+import path from "node:path";
+import { HARDENING_RULES } from "./hardening-evidence.mjs";
+
+const rawArgs = process.argv.slice(2);
+if (rawArgs.length === 0 || rawArgs.includes("-h") || rawArgs.includes("--help")) {
+  console.error("usage: node hardeningscan.mjs [--allow-evidence <json>] <artifact-path>...");
+  process.exit(rawArgs.length === 0 ? 2 : 0);
+}
+const allowIndex = rawArgs.indexOf("--allow-evidence");
+const allowEvidencePath = allowIndex >= 0 ? rawArgs[allowIndex + 1] : null;
+if (allowIndex >= 0 && !allowEvidencePath) throw new Error("--allow-evidence requires a JSON path");
+// Only strip the flag pair when the flag is present: with allowIndex = -1,
+// filtering out index `allowIndex + 1` would silently drop the first
+// artifact path (a lone artifact arg then failed as "no artifact path").
+const args = allowIndex >= 0
+  ? rawArgs.filter((_, index) => index !== allowIndex && index !== allowIndex + 1)
+  : rawArgs;
+if (!args.length) throw new Error("at least one artifact path is required");
+
+const root = realpathSync(process.cwd());
+const findings = [];
+const evidence = allowEvidencePath ? JSON.parse(readFileSync(allowEvidencePath, "utf8")) : { allowances: [] };
+if (allowEvidencePath && (evidence.schemaVersion !== 1 || evidence.kind !== "rightkit-hardening-evidence")) {
+  throw new Error("invalid hardening evidence");
+}
+const allowances = evidence.allowances ?? [];
+for (const allowance of allowances) {
+  const sourceMatch = typeof allowance.sourceEvidence === "string" ? /^(.*):([1-9]\d*)$/.exec(allowance.sourceEvidence) : null;
+  const knownRule = HARDENING_RULES[allowance.rule];
+  if (!knownRule || allowance.exact !== knownRule.exact || !sourceMatch || !/^[a-f0-9]{64}$/.test(allowance.artifactSha256 ?? "") || !/^[a-f0-9]{64}$/.test(allowance.sourceSha256 ?? "") || allowance.sourceLine !== Number(sourceMatch[2]) || typeof allowance.rationale !== "string" || allowance.rationale.trim().length < 12) {
+    throw new Error("invalid hardening allowance source binding");
+  }
+  const sourcePath = realpathSync(path.resolve(root, sourceMatch[1]));
+  const sourceRelative = path.relative(root, sourcePath);
+  if (sourceRelative === ".." || sourceRelative.startsWith("../") || sourceRelative.startsWith("..\\") || path.isAbsolute(sourceRelative)) {
+    throw new Error("hardening allowance source escapes release root");
+  }
+  const sourceBytes = readFileSync(sourcePath);
+  if (createHash("sha256").update(sourceBytes).digest("hex") !== allowance.sourceSha256) throw new Error("hardening allowance source digest mismatch");
+  const line = sourceBytes.toString("utf8").split(/\r?\n/)[allowance.sourceLine - 1];
+  if (typeof line !== "string" || !line.includes(allowance.exact)) throw new Error("hardening allowance source token mismatch");
+}
+
+const fileNameRules = [
+  [/\.map$/i, "source map shipped"],
+  [/\.pdb$/i, "Windows debug symbols shipped"],
+  [/\.dSYM(?:$|[/\\])/i, "macOS debug symbols shipped"],
+  [/\.mlpackage(?:$|[/\\])/i, "raw CoreML package shipped"],
+  [/[/\\]docs[/\\]experiments(?:$|[/\\])/i, "experiment docs shipped"],
+  [/[/\\]\.scratch(?:$|[/\\])/i, "scratch directory shipped"],
+  [/[/\\]\.git(?:$|[/\\])/i, "git metadata shipped"],
+  [/[/\\]node_modules(?:$|[/\\])/i, "node_modules shipped"],
+  [/[/\\](?:src|tests?|benches|benchmarks)(?:$|[/\\])/i, "source/test tree shipped"],
+  [/[/\\]tdt_w15_p6(?:$|[/\\])/i, "stale TDT p6 model shipped"],
+];
+
+const contentRules = [
+  ["local-source-path", /\/Users\/adrdsouza\/claude/gi, "local source path leaked"],
+  ["local-cargo-path", /\/Users\/adrdsouza\/\.cargo/gi, "local cargo path leaked"],
+  ["local-windows-path", /C:\\Users\\adrdsouza\\(?:claude|\.cargo)/gi, "local Windows source path leaked"],
+  ["experiment-path", /docs\/experiments/gi, "experiment path leaked"],
+  ["cleanup-prompt-marker", /l3_cleanup_prompt/gi, "L3 cleanup prompt marker leaked"],
+  ["system-prompt-marker", /SYSTEM_PROMPT/gi, "system prompt marker leaked"],
+  ["secret-env-name", /OPENAI_API_KEY|ANTHROPIC_API_KEY|APPLE_PASSWORD|NOTARY_PROFILE/gi, "secret/env key name leaked"],
+  ["gpl-flag", /--enable-gpl|--enable-nonfree/gi, "GPL/nonfree ffmpeg flag leaked"],
+  ["stale-model", /tdt_w15_p6/gi, "stale TDT p6 string leaked"],
+  ["experiment-model", /Canary-Qwen|Nemotron|dqlstm|bias-experiments/gi, "experiment/model-history marker leaked"],
+];
+
+const maxPatternLen = Math.max(...contentRules.map(([, rule]) => String(rule).length), 256);
+
+function add(kind, file, message, detail = "") {
+  findings.push({ kind, file: path.relative(root, file) || file, message, detail });
+}
+
+async function walk(target) {
+  const st = await lstat(target);
+  const normalized = target.split(path.sep).join("/");
+  for (const [rule, message] of fileNameRules) if (rule.test(normalized)) add("path", target, message);
+  if (st.isDirectory()) {
+    const entries = await readdir(target);
+    await Promise.all(entries.map((name) => walk(path.join(target, name))));
+    return;
+  }
+  if (st.isFile()) await scanFile(target);
+}
+
+function scanFile(file) {
+  return new Promise((resolveScan) => {
+    const artifactSha256 = createHash("sha256").update(readFileSync(file)).digest("hex");
+    const stream = createReadStream(file, { highWaterMark: 256 * 1024 });
+    let tail = "";
+    stream.on("data", (chunk) => {
+      const text = tail + chunk.toString("latin1");
+      for (const [ruleId, rule, message] of contentRules) {
+        if (/ffmpeg-LICENSE\.txt$/i.test(file) && ruleId === "gpl-flag") continue;
+        rule.lastIndex = 0;
+        for (const match of text.matchAll(rule)) {
+          const allowed = allowances.some((allowance) =>
+            allowance.rule === ruleId &&
+            allowance.artifactSha256 === artifactSha256 &&
+            allowance.exact === match[0] &&
+            typeof allowance.sourceEvidence === "string" &&
+            typeof allowance.rationale === "string"
+          );
+          if (!allowed) add("content", file, message, rule.source);
+        }
+      }
+      tail = text.slice(-maxPatternLen);
+    });
+    stream.on("error", (error) => {
+      add("read", file, "could not scan file", error.message);
+      resolveScan();
+    });
+    stream.on("end", resolveScan);
+  });
+}
+
+for (const arg of args) {
+  const target = path.resolve(arg);
+  try {
+    await walk(target);
+  } catch (error) {
+    add("target", target, "could not scan target", error.message);
+  }
+}
+
+const unique = new Map();
+for (const finding of findings) unique.set([finding.kind, finding.file, finding.message].join("\0"), finding);
+const deduped = [...unique.values()].sort((left, right) =>
+  (left.file + " " + left.message).localeCompare(right.file + " " + right.message),
+);
+
+if (deduped.length) {
+  console.error("hardeningscan: " + deduped.length + " finding(s)");
+  for (const finding of deduped) console.error("- [" + finding.kind + "] " + finding.file + ": " + finding.message);
+  process.exit(1);
+}
+
+console.log("hardeningscan: clean");

package/macos-signing-identity.mjs

@@ -1,13 +1,13 @@
-import { spawnSync } from "./background-process.mjs";
-
-export function resolveMacosDeveloperIdIdentity({ env = process.env, run = spawnSync } = {}) {
-  const configured = env.APPLE_DEVELOPER_ID?.trim();
-  if (configured) return configured;
-  const result = run("security", ["find-identity", "-v", "-p", "codesigning"], { encoding: "utf8" });
-  if (result.status !== 0) throw new Error("could not inspect macOS signing identities in Keychain");
-  const identities = [...String(result.stdout ?? "").matchAll(/"([^"\n]*Developer ID Application:[^"]+)"/g)]
-    .map((match) => match[1]);
-  if (identities.length === 1) return identities[0];
-  if (!identities.length) throw new Error("no Developer ID Application signing identity found in Keychain");
-  throw new Error(`multiple Developer ID Application signing identities found in Keychain; set APPLE_DEVELOPER_ID explicitly (${identities.join(", ")})`);
-}
+import { spawnSync } from "./background-process.mjs";
+
+export function resolveMacosDeveloperIdIdentity({ env = process.env, run = spawnSync } = {}) {
+  const configured = env.APPLE_DEVELOPER_ID?.trim();
+  if (configured) return configured;
+  const result = run("security", ["find-identity", "-v", "-p", "codesigning"], { encoding: "utf8" });
+  if (result.status !== 0) throw new Error("could not inspect macOS signing identities in Keychain");
+  const identities = [...String(result.stdout ?? "").matchAll(/"([^"\n]*Developer ID Application:[^"]+)"/g)]
+    .map((match) => match[1]);
+  if (identities.length === 1) return identities[0];
+  if (!identities.length) throw new Error("no Developer ID Application signing identity found in Keychain");
+  throw new Error(`multiple Developer ID Application signing identities found in Keychain; set APPLE_DEVELOPER_ID explicitly (${identities.join(", ")})`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.111",
+  "version": "0.2.112",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/publication-gate.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+// Publication gate: refuse to publish a shared npm package, crate, or Swift tag unless a gate
+// evidence file names the exact current commit SHA (clean tree for the package path) and carries
+// passing host run receipts from that same SHA: macOS and Windows, or macOS only for Swift.
+// Format: docs/RIGHTKIT-SHARED-PACKAGES.md, "Publication gate" -> "Evidence file format".
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { fileURLToPath } from "node:url";
+
+export const GATE_SCHEMA = 1;
+export const REQUIRED_HOSTS = Object.freeze(["darwin", "win32"]);
+// Swift packages (RightKitSwift) are Apple-only; Windows cannot run them.
+export const requiredHosts = (kind) => (kind === "swift" ? Object.freeze(["darwin"]) : REQUIRED_HOSTS);
+const SHA = /^[0-9a-f]{40}$/;
+
+export function defaultEvidencePath(workspaceRoot, kind, name) {
+  return path.join(workspaceRoot, "release-evidence", "gate", `${kind}-${name.replace(/^@/, "").replace("/", "-")}.json`);
+}
+
+function defaultGit(args, cwd) {
+  const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.error || result.status !== 0) return null;
+  return (result.stdout ?? "").trim();
+}
+
+// Returns { ok, missing[] }. Pure apart from the injected git/readFile.
+export function checkPublicationGate({ kind, name, version, packagePath, evidencePath, git = defaultGit, readFile = (p) => fs.readFileSync(p, "utf8") }) {
+  const missing = [];
+  const head = git(["rev-parse", "HEAD"], packagePath);
+  if (!head || !SHA.test(head)) missing.push(`cannot read current commit SHA for ${packagePath}`);
+  const dirty = git(["status", "--porcelain", "--", "."], packagePath);
+  if (dirty === null) missing.push(`cannot read git status for ${packagePath}`);
+  else if (dirty !== "") missing.push(`tree is not clean for ${packagePath}`);
+  let evidence = null;
+  try { evidence = JSON.parse(readFile(evidencePath)); } catch {
+    missing.push(`gate evidence file missing or unreadable: ${evidencePath}`);
+  }
+  if (evidence) {
+    if (evidence.schema !== GATE_SCHEMA) missing.push(`evidence schema must be ${GATE_SCHEMA}`);
+    if (evidence.kind !== kind || evidence.name !== name) missing.push(`evidence is for ${evidence.kind}:${evidence.name}, expected ${kind}:${name}`);
+    if (version && evidence.version !== version) missing.push(`evidence version ${evidence.version} != ${version}`);
+    if (!SHA.test(String(evidence.commit ?? ""))) missing.push("evidence commit is not a full 40-character SHA");
+    else if (head && evidence.commit !== head) missing.push(`evidence commit ${evidence.commit} != current HEAD ${head}`);
+    const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
+    for (const host of requiredHosts(kind)) {
+      const label = host === "darwin" ? "macOS" : "Windows";
+      const matching = runs.filter((run) => run?.host?.os === host);
+      if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }
+      const good = matching.some((run) => run.commit === evidence.commit
+        && Number.isInteger(run.passed) && run.passed > 0 && run.failed === 0
+        && typeof run.command === "string" && run.command.trim()
+        && typeof run.operator === "string" && run.operator.trim()
+        && typeof run.timestamp === "string" && run.timestamp.trim());
+      if (!good) missing.push(`${label} run receipt must name commit ${evidence.commit}, command, operator, timestamp, passed>0 and failed=0`);
+    }
+    if (!/^[0-9a-f]{64}$/.test(String(evidence.artifactSha256 ?? ""))) missing.push("evidence artifactSha256 must be a 64-hex hash");
+  }
+  return Object.freeze({ ok: missing.length === 0, missing });
+}
+
+// Enforce: throws on missing evidence unless dryRun (then reports and continues).
+export function enforcePublicationGate(options, { dryRun = false, write = (line) => process.stdout.write(line) } = {}) {
+  const result = checkPublicationGate(options);
+  if (result.ok) { write(`[right-release] publication gate OK for ${options.kind}:${options.name}\n`); return result; }
+  const report = `publication gate not satisfied for ${options.kind}:${options.name}:\n  - ${result.missing.join("\n  - ")}`;
+  if (dryRun) { write(`[right-release] ${report}\n[right-release] (dry-run: a real publish would be refused)\n`); return result; }
+  throw new Error(report);
+}
+
+// `right-release publish npm --package <name> [--evidence <file>] [--dry-run]`: preflight only.
+export function runNpmPreflight(argv, workspaceRoot = process.cwd()) {
+  let pkg; let evidence; const dryRun = argv.includes("--dry-run");
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === "--package") pkg = argv[++i];
+    else if (argv[i] === "--evidence") evidence = argv[++i];
+    else if (argv[i] === "--workspace") workspaceRoot = path.resolve(argv[++i]);
+    else if (argv[i] !== "--dry-run") throw new Error(`unknown publish npm option: ${argv[i]}`);
+  }
+  if (!pkg || !/^@rightkit\/[a-z0-9-]+$/.test(pkg)) throw new Error("publish npm requires --package @rightkit/<name>");
+  const packagePath = path.join(workspaceRoot, "packages", pkg.slice("@rightkit/".length));
+  const manifest = JSON.parse(fs.readFileSync(path.join(packagePath, "package.json"), "utf8"));
+  const options = { kind: "npm", name: pkg, version: manifest.version, packagePath, evidencePath: path.resolve(evidence ?? defaultEvidencePath(workspaceRoot, "npm", pkg)) };
+  enforcePublicationGate(options, { dryRun });
+  process.stdout.write("[right-release] npm preflight only: publish stays on the authenticated Windows primary checkout (pnpm publish)\n");
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
+  try { runNpmPreflight(process.argv.slice(2)); } catch (error) {
+    process.stderr.write(`right-release publish npm: ${error.message}\n`); process.exitCode = 1;
+  }
+}

package/publish-cargo.mjs

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath } from "node:url";
+import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
 
 const FORBIDDEN_PACKAGE_PATH = /(^|\/)(?:\.env(?:\.[^/]*)?|target(?:\/.*)?|node_modules(?:\/.*)?|[^/]+\.(?:p8|p12|pem|key))$/i;
 const SECRET_PATTERNS = [
@@ -16,7 +17,7 @@ export function parseCargoPublishArgs(argv, cwd = process.cwd()) {
   const crate = valueAfter(argv, "--crate");
   if (!crate) throw new Error("publish cargo requires --crate <name>");
   if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(crate)) throw new Error(`invalid crate name: ${crate}`);
-  const allowed = new Set(["--crate", "--workspace", "--dry-run", "--allow-dirty"]);
+  const allowed = new Set(["--crate", "--workspace", "--dry-run", "--allow-dirty", "--evidence"]);
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
     if (!arg.startsWith("--")) continue;
@@ -31,6 +32,7 @@ export function parseCargoPublishArgs(argv, cwd = process.cwd()) {
     dryRun,
     allowDirty,
     workspaceRoot: path.resolve(valueAfter(argv, "--workspace") ?? cwd),
+    evidence: valueAfter(argv, "--evidence"),
   };
 }
 
@@ -41,8 +43,8 @@ export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = fa
   if (allowDirty) packageArgs.push("--allow-dirty");
   const plan = [
     { label: "secret scan", internal: "secret-scan", crateDir },
-    { label: "format", command: "cargo", args: ["fmt", "--all", "--check"] },
-    { label: "tests", command: "cargo", args: ["test", "-p", crate] },
+    { label: "format", command: "cargo", args: ["fmt", "-p", crate, "--check"] },
+    { label: "tests", command: "cargo", args: ["test", "-p", crate, "--", "--test-threads=1"] },
     { label: "clippy", command: "cargo", args: ["clippy", "-p", crate, "--all-targets", "--", "-D", "warnings"] },
     { label: "package contents", command: "cargo", args: packageArgs, capture: true },
     { label: "registry dry-run", command: "cargo", args: dryRunArgs },
@@ -78,6 +80,11 @@ export function runCargoPublish(options, execute = spawnSync) {
   const crateDir = path.join(options.workspaceRoot, "crates", options.crate);
   const manifest = path.join(crateDir, "Cargo.toml");
   if (!fs.existsSync(manifest)) throw new Error(`crate manifest not found: ${manifest}`);
+  const cargoVersion = fs.readFileSync(manifest, "utf8").match(/^version\s*=\s*"([^"]+)"/m)?.[1];
+  enforcePublicationGate({
+    kind: "cargo", name: options.crate, version: cargoVersion, packagePath: crateDir,
+    evidencePath: path.resolve(options.evidence ?? defaultEvidencePath(options.workspaceRoot, "cargo", options.crate)),
+  }, { dryRun: options.dryRun });
   const plan = buildCargoPublishPlan({ ...options, crateDir });
 
   for (const step of plan) {