@rightkit/release 0.2.120 → 0.2.122

package/ownership-evidence.mjs

@@ -0,0 +1,224 @@
+import { createHash } from "node:crypto";
+import { readFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { catalogDigest as scanCatalogDigest, checkApp, checkCommittedApp, MANIFEST_FILE, SCANNER_VERSION } from "./ownership.mjs";
+import { acquireCommittedSource, assertCommittedCheckoutClean, committedSourceDataForInternalUse } from "./committed-source.mjs";
+import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
+import { canonicalRepositoryIdentity, loadTrustedExternal, resolveKeyLogTrust, sha256, validateOwnershipFloor, verifyRepositoryRegistration } from "./ownership-approval.mjs";
+
+const digestFile = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
+
+function git(root, args, runner = spawnSync) {
+  const result = runner("git", ["-C", root, ...args], { encoding: "utf8", windowsHide: true });
+  if (result?.status !== 0) throw new Error(`ownership evidence: git ${args.join(" ")} failed`);
+  return String(result.stdout).trim();
+}
+
+function rootContains(root, candidate) {
+  return root === "." || candidate === root || candidate.startsWith(`${root}/`);
+}
+
+function createEvidence(repoRoot, {
+  scanRoot = repoRoot,
+  manifestPath = path.join(path.dirname(fileURLToPath(import.meta.url)), MANIFEST_FILE),
+  scan = checkApp,
+  trustLoader = loadTrustedExternal,
+  gitRunner = spawnSync,
+  committed = false,
+  requireCleanCheckout = false,
+  allowPendingAdvisory = false,
+} = {}) {
+  const root = path.resolve(repoRoot);
+  const manifestBytes = readFileSync(manifestPath);
+  const manifest = JSON.parse(manifestBytes.toString("utf8"));
+  let trustState = trustLoader();
+  const pendingWithoutTrust = trustState.pending === true && trustState.enrolled === false && trustState.trust === null
+    && trustState.protection?.ok === false && trustState.protection?.reason === "external trust file is absent";
+  if (trustState.protection?.ok !== true && !pendingWithoutTrust) throw new Error("protected ownership trust location was not verified");
+  if (!trustState.trust && !pendingWithoutTrust) throw new Error("protected ownership trust registry is missing");
+  let enrollmentPending = trustState.enrolled !== true;
+  if (committed && enrollmentPending && !allowPendingAdvisory && !trustState.trust?.rootFingerprint) throw new Error("protected ownership evidence requires both distinct, unrevoked approval keys to be enrolled");
+  // A valid protected registry with incomplete key enrollment can still drive
+  // a useful local backlog scan. It cannot produce a source binding or verify
+  // approval signatures, so this result is deliberately advisory.
+  const useCommittedSource = committed && (!enrollmentPending || Boolean(trustState.trust?.rootFingerprint));
+  if (useCommittedSource && requireCleanCheckout) assertCommittedCheckoutClean(root);
+  const source = useCommittedSource ? acquireCommittedSource(root, { requiredPaths: [...(trustState.trust?.provenance ?? []).flatMap((record) => record.paths ?? []), ...(trustState.trust?.rootFingerprint && !trustState.trust?.keyAuthority ? [".rightkit/ownership-keys.json"] : [])] }) : null;
+  let keyLogEvidence = null;
+  if (trustState.trust?.keyAuthority) {
+    const resolved = readCommittedKeyAuthority(trustState.trust);
+    if (!resolved.ok) throw new Error(`protected ownership key authority failed: ${resolved.problems.join("; ")}`);
+    trustState = { ...trustState, trust: resolved.resolvedTrust, enrolled: resolved.resolvedTrust.enrollmentComplete, pending: !resolved.resolvedTrust.enrollmentComplete };
+    enrollmentPending = trustState.pending;
+    keyLogEvidence = { keyLogDigest: resolved.digest, keyCheckpoint: resolved.keyCheckpoint, rootFingerprint: resolved.rootFingerprint, keyAuthority: resolved.authority };
+    if (!resolved.resolvedTrust.ownershipKeys.length) throw new Error("protected ownership key authority has no active approval keys");
+  } else if (trustState.trust?.rootFingerprint) {
+    const keySource = source ?? acquireCommittedSource(root, { requiredPaths: [".rightkit/ownership-keys.json"] });
+    const sourceData = committedSourceDataForInternalUse(keySource);
+    if (!sourceData) throw new Error("protected ownership key log requires authenticated committed source");
+    const entry = sourceData.entries.find((item) => item.rel === ".rightkit/ownership-keys.json");
+    const resolved = resolveKeyLogTrust(trustState.trust, entry?.bytes);
+    if (!resolved.ok) throw new Error(`protected ownership key log failed: ${resolved.problems.join("; ")}`);
+    trustState = { ...trustState, trust: resolved.trust, enrolled: resolved.trust.enrollmentComplete, pending: !resolved.trust.enrollmentComplete };
+    enrollmentPending = trustState.pending;
+    keyLogEvidence = { keyLogDigest: resolved.keyLogDigest, keyCheckpoint: resolved.checkpoint, rootFingerprint: resolved.trust.rootFingerprint };
+    if (!resolved.trust.ownershipKeys.length) throw new Error("protected ownership key authority has no active approval keys");
+  }
+  if (useCommittedSource && requireCleanCheckout) assertCommittedCheckoutClean(root, { expectedCommit: source.commit, expectedTree: source.tree });
+  const commit = useCommittedSource ? source.commit : git(root, ["rev-parse", "HEAD"], gitRunner);
+  const tree = useCommittedSource ? source.tree : git(root, ["rev-parse", `${commit}^{tree}`], gitRunner);
+  const scannerVersion = SCANNER_VERSION;
+  const catalogVersion = manifest.version ?? String(manifest.schema ?? "1");
+  const catalogDigest = scanCatalogDigest(manifest);
+  // When a protected registry exists, key enrollment controls signing
+  // authority; scanner and catalog floors still apply during pending enrollment.
+  const floor = trustState.trust
+    ? validateOwnershipFloor(trustState.trust, { scannerVersion, catalogVersion, catalogDigest })
+    : { ok: false, problems: ["protected ownership floor is unavailable until trust registry enrollment"] };
+  // Real paths on both sides: Git's root is resolved (macOS /private/var), callers may pass /var or /tmp.
+  const real = (p) => { try { return realpathSync(p); } catch { return path.resolve(p); } };
+  const requestedRoot = path.relative(real(root), real(scanRoot)).replaceAll("\\", "/") || ".";
+  if (requestedRoot.startsWith("../") || requestedRoot === ".." || path.isAbsolute(requestedRoot)) throw new Error("ownership evidence scan root must be inside repository");
+  const evidenceDiagnostics = [];
+  let repositoryIdentity = null;
+  let registrationCheck = null;
+  if (trustState.trust) {
+    try {
+      const origin = useCommittedSource ? source.origin : git(root, ["remote", "get-url", "origin"], gitRunner);
+      repositoryIdentity = canonicalRepositoryIdentity(origin);
+      registrationCheck = verifyRepositoryRegistration(trustState.trust, repositoryIdentity);
+      if (!registrationCheck.ok) {
+        if (!enrollmentPending) throw new Error(registrationCheck.problems.join("; "));
+        evidenceDiagnostics.push(...registrationCheck.problems);
+      }
+    } catch (error) {
+      if (!enrollmentPending) throw error;
+      evidenceDiagnostics.push(`protected registration unavailable during pending enrollment: ${error.message}`);
+      repositoryIdentity = null;
+      registrationCheck = null;
+    }
+  }
+  const registration = registrationCheck?.registration ?? null;
+  const requestedRootRegistered = registration?.roots.some((registered) => rootContains(registered, requestedRoot)) ?? false;
+  if (registration && !requestedRootRegistered) {
+    if (!enrollmentPending) throw new Error(`release app root is outside protected ownership roots: ${requestedRoot}`);
+    evidenceDiagnostics.push(`requested scan root is outside protected ownership roots during pending enrollment: ${requestedRoot}`);
+  }
+
+  // The release app's manifest/config can be nested, but the external registry
+  // defines repository coverage. Scan every protected root so a nested release
+  // cannot omit sibling packages or engine source by narrowing scanRoot.
+  const scanRoots = registration?.roots ? [...registration.roots] : [];
+  if (!requestedRootRegistered && !scanRoots.includes(requestedRoot)) scanRoots.push(requestedRoot);
+  const scans = (scanRoots.length ? scanRoots : [requestedRoot]).map((registered) => {
+    const absolute = registered === "." ? root : path.resolve(root, ...registered.split("/"));
+    const scanned = useCommittedSource
+      ? checkCommittedApp(absolute, manifest, { trust: trustState.trust, expectedCommit: commit, expectedTree: tree, source })
+      : scan(absolute, manifest, { trust: { trust: trustState.trust, enrolled: trustState.enrolled, pending: enrollmentPending }, scannerVersion, catalogVersion, ...(enrollmentPending ? { enrollmentPendingAdvisory: true } : {}) });
+    if (repositoryIdentity && canonicalRepositoryIdentity(scanned.metadata?.repositoryIdentity) !== repositoryIdentity) throw new Error(`ownership evidence: scanner observed a different repository identity under ${registered}`);
+    if (useCommittedSource && scanned.metadata?.commit !== commit) throw new Error(`ownership evidence: scanner observed a different source commit under ${registered}`);
+    if (scanned.metadata?.catalogDigest !== catalogDigest) throw new Error(`ownership evidence: scanner observed a different catalog under ${registered}`);
+    if (keyLogEvidence?.keyAuthority && JSON.stringify(scanned.metadata?.keyAuthority) !== JSON.stringify(keyLogEvidence.keyAuthority)) throw new Error(`ownership evidence: scanner observed a different shared key authority under ${registered}`);
+    const repositoryPaths = scanned.metadata?.pathBase === "repository";
+    const prefix = registered === "." || repositoryPaths ? "" : `${registered}/`;
+    return { root: registered, scanned, prefix };
+  });
+  const rebase = (entry, prefix) => ({ ...entry, ...(entry.path ? { path: `${prefix}${entry.path}` } : {}), ...(entry.file ? { file: `${prefix}${entry.file}` } : {}) });
+  const contentCoverage = scans.flatMap(({ scanned, prefix }) => (scanned.metadata?.coverage ?? []).map((entry) => rebase(entry, prefix)));
+  const contentDigests = scans.flatMap(({ scanned, prefix }) => (scanned.metadata?.contentDigests ?? []).map((entry) => ({ ...entry, path: `${prefix}${entry.path}` }))).sort((a, b) => a.path.localeCompare(b.path));
+  const contentDigest = sha256(contentDigests);
+  const approvals = scans.map(({ root: registered, scanned }) => {
+    if (useCommittedSource) return { root: registered, digest: scanned.metadata?.exceptionDigest ?? sha256([]) };
+    const exceptionsPath = path.join(root, ...(registered === "." ? [] : registered.split("/")), ".rightkit", "ownership-exceptions.json");
+    try { return { root: registered, digest: digestFile(exceptionsPath) }; }
+    catch (error) { if (error?.code !== "ENOENT") throw error; return { root: registered, digest: sha256([]) }; }
+  });
+  const approvalsDigest = enrollmentPending ? null : sha256(approvals);
+  const result = {
+    ok: scans.every(({ scanned }) => scanned.ok),
+    findings: scans.flatMap(({ scanned, prefix }) => (scanned.findings ?? []).map((entry) => rebase(entry, prefix))),
+    violations: scans.flatMap(({ scanned, prefix }) => (scanned.violations ?? []).map((entry) => rebase(entry, prefix))),
+    problems: [...scans.flatMap(({ scanned }) => scanned.problems ?? []), ...evidenceDiagnostics, ...(enrollmentPending ? floor.problems : [])],
+    rows: scans.flatMap(({ scanned, root: registered }) => (scanned.rows ?? []).map((row) => ({ ...row, root: registered }))),
+    covered: scans.flatMap(({ scanned, prefix }) => (scanned.covered ?? []).map((entry) => rebase(entry, prefix))),
+    coverage: contentCoverage,
+    metadata: {
+      repositoryIdentity, commit, tree, catalogDigest, contentDigests, coverage: contentCoverage,
+      pathBase: "repository", pathPrefix: "",
+      roots: scans.map(({ root: registered, scanned }) => ({ root: registered, metadata: scanned.metadata })),
+    },
+  };
+  const evidence = {
+    schema: 1,
+    repositoryIdentity: repositoryIdentity ? canonicalRepositoryIdentity(result.metadata?.repositoryIdentity) : null,
+    source: enrollmentPending ? "enrollment-pending-advisory" : useCommittedSource ? "committed-git-tree" : "mutable-checkout-test-seam",
+    ...(enrollmentPending ? {} : { commit, tree }),
+    catalogDigest,
+    catalogVersion,
+    scannerVersion,
+    approvalsDigest,
+    trustEnrolled: !enrollmentPending,
+    ...(keyLogEvidence ?? {}),
+    floorOk: floor.ok,
+    visibility: registration?.visibility ?? null,
+    registrationDigest: registration ? sha256(registration) : null,
+    registeredRoots: registration ? [...registration.roots] : [],
+    contentDigest: enrollmentPending ? null : contentDigest,
+    checkedAt: new Date().toISOString(),
+  };
+  const warning = enrollmentPending ? "WARNING: ownership approval enrollment is pending; findings remain backlog diagnostics and no protected evidence or approvals are asserted" : undefined;
+  return { ok: enrollmentPending || (result.ok && floor.ok && contentCoverage.length === 0), ...(enrollmentPending ? { enrollmentPending: true, warning } : {}), evidence, result, floor, contentCoverage };
+}
+
+/** Create scan evidence bound to committed source, catalog, and signed exceptions. */
+export function createOwnershipEvidence(repoRoot, scanRoot = repoRoot) {
+  return createEvidence(repoRoot, { scanRoot, committed: true, requireCleanCheckout: true, allowPendingAdvisory: true });
+}
+
+/** Alias spelling makes the immutable-source contract explicit at adapter boundaries. */
+export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot) {
+  return createEvidence(repoRoot, { scanRoot, committed: true, requireCleanCheckout: true });
+}
+
+// Injection seam is deliberately named for tests and is not used by release commands.
+export function createOwnershipEvidenceForTest(repoRoot, options) {
+  return createEvidence(repoRoot, options);
+}
+
+/** Test-only access to the production committed-tree evidence path. */
+export function createCommittedOwnershipEvidenceForTest(repoRoot, options = {}) {
+  return createEvidence(repoRoot, { ...options, committed: true });
+}
+
+/** Entry point for an OS-protected local hook/adapter on private repositories. */
+export function runProtectedLocalOwnershipCheck(repoRoot, scanRoot = repoRoot) {
+  const checked = createCommittedOwnershipEvidence(repoRoot, scanRoot);
+  if (checked.evidence.visibility !== "private") throw new Error("protected local ownership adapter only accepts registered private repositories");
+  return checked;
+}
+
+/** Re-scan exact source and compare every sealed binding before release upload. */
+export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot) {
+  return verifyEvidence(expected, repoRoot, scanRoot, () => createCommittedOwnershipEvidence(repoRoot, scanRoot));
+}
+
+export function verifyOwnershipEvidenceForTest(expected, repoRoot, options) {
+  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => createEvidence(repoRoot, options));
+}
+
+function verifyEvidence(expected, repoRoot, _scanRoot, createCurrent) {
+  if (!expected || expected.schema !== 1) return { ok: false, reason: "sealed ownership evidence is missing or malformed" };
+  let current;
+  try { current = createCurrent(); }
+  catch (error) { return { ok: false, reason: error.message }; }
+  for (const key of ["repositoryIdentity", "source", "commit", "tree", "catalogDigest", "catalogVersion", "scannerVersion", "approvalsDigest", "keyLogDigest", "keyCheckpoint", "rootFingerprint", "keyAuthority", "visibility", "registrationDigest", "registeredRoots", "contentDigest"]) {
+    const unchanged = key === "registeredRoots" || key === "keyCheckpoint" || key === "keyAuthority"
+      ? JSON.stringify(expected[key]) === JSON.stringify(current.evidence[key])
+      : expected[key] === current.evidence[key];
+    if (!unchanged) return { ok: false, reason: `ownership evidence ${key} changed after build` };
+  }
+  if (!current.ok) return { ok: false, reason: "current ownership scan fails or has incomplete coverage" };
+  return { ok: true, evidence: current.evidence };
+}

package/ownership-git-inventory.mjs

@@ -0,0 +1,195 @@
+// Working-tree inventory constrained to Git's tracked & non-ignored path set.
+import { lstatSync, readFileSync, realpathSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { sha256 } from "./ownership-approval.mjs";
+
+const MAX_LIST_BYTES = 32 * 1024 * 1024;
+const MAX_BLOB_BATCH_BYTES = 256 * 1024 * 1024;
+const DEFAULT_MAX_FILE_BYTES = 2 * 1024 * 1024;
+const CACHE_LIMIT = 128 * 1024 * 1024;
+const blobCache = new Map();
+let cacheBytes = 0;
+
+function gitEnv() {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !/^GIT_/i.test(key)));
+  Object.assign(env, { GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null", GIT_OPTIONAL_LOCKS: "0", GIT_TERMINAL_PROMPT: "0" });
+  return env;
+}
+
+function runGit(root, repositoryRoot, args, { input, maxBuffer = MAX_LIST_BYTES } = {}) {
+  const executable = process.platform === "win32" ? "C:\\Program Files\\Git\\cmd\\git.exe" : "/usr/bin/git";
+  const result = spawnSync(executable, ["-C", root, "--no-replace-objects", "-c", "core.fsmonitor=false", "-c", `core.hooksPath=${os.devNull}`, "-c", `safe.directory=${repositoryRoot}`, ...args], {
+    encoding: "buffer", env: gitEnv(), windowsHide: true, maxBuffer, timeout: 2500, ...(input ? { input } : {}),
+  });
+  if (result?.error || result?.status !== 0) throw new Error(`ownership inventory: git ${args[0]} failed${result?.error?.code ? ` (${result.error.code})` : ""}`);
+  return result.stdout;
+}
+
+function remember(oid, bytes) {
+  if (bytes.length > CACHE_LIMIT) return;
+  const key = `gitblob:${oid}`;
+  if (blobCache.has(key)) { cacheBytes -= blobCache.get(key).length; blobCache.delete(key); }
+  blobCache.set(key, bytes); cacheBytes += bytes.length;
+  while (cacheBytes > CACHE_LIMIT && blobCache.size) {
+    const first = blobCache.keys().next().value;
+    cacheBytes -= blobCache.get(first).length; blobCache.delete(first);
+  }
+  return blobCache.get(key);
+}
+
+function decodePath(bytes) {
+  return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+
+function readGitBlobs(root, repositoryRoot, oids) {
+  if (!oids.length) return new Map();
+  const input = Buffer.from(`${oids.join("\n")}\n`);
+  const output = runGit(root, repositoryRoot, ["cat-file", "--batch"], { input, maxBuffer: MAX_BLOB_BATCH_BYTES });
+  const result = new Map(); let offset = 0;
+  for (const expected of oids) {
+    const lineEnd = output.indexOf(0x0a, offset);
+    if (lineEnd < 0) throw new Error("ownership inventory: malformed Git blob header");
+    const [oid, type, sizeText] = output.subarray(offset, lineEnd).toString("ascii").split(" ");
+    const size = Number(sizeText), start = lineEnd + 1, end = start + size;
+    if (oid !== expected || type !== "blob" || !Number.isSafeInteger(size) || size < 0 || size > MAX_BLOB_BATCH_BYTES || end >= output.length || output[end] !== 0x0a) throw new Error("ownership inventory: invalid Git blob");
+    result.set(expected, Buffer.from(output.subarray(start, end))); offset = end + 1;
+  }
+  if (offset !== output.length) throw new Error("ownership inventory: unexpected Git blob output");
+  return result;
+}
+
+export function gitListedInventory(appRoot, { relevant = () => true, protectedPaths = [], maxFileBytes = DEFAULT_MAX_FILE_BYTES, repositoryRoot = appRoot } = {}) {
+  const root = path.resolve(appRoot);
+  let safeRoot;
+  try { safeRoot = realpathSync(repositoryRoot); }
+  catch (error) { return { files: [], coverage: [{ path: ".", status: "unscanned", reason: `repository-root-unavailable:${error.code ?? "error"}` }] }; }
+  let listing, dirtyBytes;
+  try {
+    listing = runGit(root, safeRoot, ["ls-files", "--stage", "--cached", "--others", "--exclude-standard", "-z"]);
+    dirtyBytes = runGit(root, safeRoot, ["diff-files", "--name-only", "-z", "--no-ext-diff", "--no-textconv", "--relative"]);
+  } catch (error) { return { files: [], coverage: [{ path: ".", status: "unscanned", reason: `git-inventory-failed:${error.message}` }] }; }
+  const dirty = new Set(dirtyBytes.length ? dirtyBytes.subarray(0, dirtyBytes.length - (dirtyBytes.at(-1) === 0 ? 1 : 0)).toString("utf8").split("\0") : []);
+  const entries = new Map(), coverage = [];
+  try {
+    let offset = 0;
+    while (offset < listing.length) {
+      const end = listing.indexOf(0, offset); if (end < 0) throw new Error("malformed NUL listing");
+      const record = listing.subarray(offset, end); offset = end + 1;
+      const tab = record.indexOf(0x09);
+      const candidate = tab < 0 ? "" : record.subarray(0, tab).toString("ascii");
+      if (tab >= 0 && /^(?:100644|100755|120000|160000) [0-9a-f]{40,64} \d$/.test(candidate)) {
+        const header = record.subarray(0, tab).toString("ascii").split(" ");
+        const rel = decodePath(record.subarray(tab + 1));
+        if (header.length !== 3 || !/^(?:100644|100755|120000|160000)$/.test(header[0]) || !/^[0-9a-f]{40,64}$/.test(header[1]) || !/^\d$/.test(header[2])) throw new Error("malformed stage entry");
+        const entry = entries.get(rel) ?? { rel, stages: [] };
+        entry.stages.push({ mode: header[0], oid: header[1], stage: Number(header[2]) }); entries.set(rel, entry);
+      } else {
+        const rel = decodePath(record);
+        if (!entries.has(rel)) entries.set(rel, { rel, stages: [], untracked: true });
+      }
+    }
+  } catch (error) {
+    coverage.push({ path: ".", status: "unscanned", reason: `git-listing-invalid:${error.message}` });
+    return { files: [], coverage };
+  }
+  const protectedSet = new Set(protectedPaths);
+  const relevantEntries = [...entries.values()].filter((entry) => {
+    if (entry.stages.some((item) => item.stage !== 0) || entry.stages.length > 1) return false;
+    let selected = false;
+    try { selected = protectedSet.has(entry.rel) || relevant(entry.rel); }
+    catch (error) { coverage.push({ path: entry.rel, status: "unscanned", reason: `relevance-check-failed:${error.message}` }); }
+    entry.relevant = selected;
+    if (selected) {
+      let sizeLimit;
+      try { sizeLimit = typeof maxFileBytes === "function" ? maxFileBytes(entry.rel) : maxFileBytes; }
+      catch (error) {
+        entry.overLimit = true;
+        coverage.push({ path: entry.rel, status: "unscanned", reason: `size-limit-check-failed:${error.message}` });
+      }
+      entry.maxFileBytes = Number.isSafeInteger(sizeLimit) && sizeLimit >= 0 ? sizeLimit : DEFAULT_MAX_FILE_BYTES;
+      try { entry.stat = lstatSync(path.join(root, ...entry.rel.split("/"))); }
+      catch (error) {
+        entry.statError = error;
+        if (error.code === "ENOENT") coverage.push({ path: entry.rel, status: "unscanned", reason: "deleted" });
+        else coverage.push({ path: entry.rel, status: "unscanned", reason: `stat-failed:${error.code ?? "error"}` });
+      }
+      if (entry.stat?.isSymbolicLink()) {
+        entry.symlink = true; coverage.push({ path: entry.rel, status: "unscanned", reason: "symlink" });
+      } else if (entry.stat && !entry.stat.isFile()) {
+        entry.nonFile = true; coverage.push({ path: entry.rel, status: "unscanned", reason: "not-regular-file" });
+      }
+      if (entry.stat?.isFile() && dirty.has(entry.rel) && entry.stat.size > entry.maxFileBytes) {
+        entry.overLimit = true;
+        coverage.push({ path: entry.rel, status: "unscanned", reason: "file-over-size-limit" });
+      }
+    }
+    return selected && !entry.statError && !entry.symlink && !entry.nonFile && !entry.overLimit && entry.stages[0]?.mode !== "120000" && entry.stages[0]?.mode !== "160000";
+  });
+  const blobOids = [...new Set(relevantEntries.filter((entry) => !entry.overLimit && entry.stages[0]?.oid && !dirty.has(entry.rel) && !blobCache.has(`gitblob:${entry.stages[0].oid}`)).map((entry) => entry.stages[0].oid))];
+  let fetched;
+  try { fetched = readGitBlobs(root, safeRoot, blobOids); }
+  catch (error) { return { files: [], coverage: [{ path: ".", status: "unscanned", reason: `git-blob-read-failed:${error.message}` }] }; }
+  for (const entry of relevantEntries) {
+    const oid = entry.stages[0]?.oid;
+    if (!oid || dirty.has(entry.rel) || entry.overLimit) continue;
+    const bytes = blobCache.get(`gitblob:${oid}`) ?? fetched.get(oid);
+    if (!bytes) continue;
+    entry.cleanBlobSize = bytes.length;
+    if (bytes.length > entry.maxFileBytes) {
+      entry.overLimit = true;
+      coverage.push({ path: entry.rel, status: "unscanned", reason: "file-over-size-limit" });
+    } else remember(oid, bytes);
+  }
+  const files = [];
+  for (const entry of entries.values()) {
+    const { rel } = entry, abs = path.join(root, ...rel.split("/"));
+    if (entry.stages.some((item) => item.stage !== 0) || entry.stages.length > 1) { coverage.push({ path: rel, status: "unscanned", reason: "git-index-conflict" }); continue; }
+    const indexed = entry.stages[0];
+    if (indexed?.mode === "160000") { coverage.push({ path: rel, status: "unscanned", reason: "gitlink" }); continue; }
+    const mode = indexed?.mode;
+    if (mode === "120000") { coverage.push({ path: rel, status: "unscanned", reason: "symlink" }); continue; }
+    const isRelevant = entry.relevant ?? false;
+    const isDirty = !indexed || dirty.has(rel);
+    const cleanIrrelevantRegular = !isRelevant && !isDirty && indexed?.oid && ["100644", "100755"].includes(mode);
+    let stat = entry.stat;
+    if (!cleanIrrelevantRegular) {
+      try { stat ??= lstatSync(abs); }
+      catch (error) {
+        if (error.code === "ENOENT") coverage.push({ path: rel, status: "unscanned", reason: "deleted" });
+        else coverage.push({ path: rel, status: "unscanned", reason: `stat-failed:${error.code ?? "error"}` });
+        continue;
+      }
+      if (stat.isSymbolicLink()) { coverage.push({ path: rel, status: "unscanned", reason: "symlink" }); continue; }
+      if (!stat.isFile()) { coverage.push({ path: rel, status: "unscanned", reason: "not-regular-file" }); continue; }
+    }
+    const inNodeModules = rel.split("/").includes("node_modules");
+    let bytes, oid = indexed?.oid, digest, cacheKey;
+    if (isRelevant && entry.overLimit) {
+      // Size-limit coverage was already recorded before any blob or file read.
+    } else if (isRelevant) {
+      try {
+        if (!isDirty && oid && blobCache.has(`gitblob:${oid}`)) bytes = blobCache.get(`gitblob:${oid}`);
+        else if (!isDirty && oid && fetched.has(oid)) bytes = fetched.get(oid);
+        else if (isDirty) {
+          if (stat.size > entry.maxFileBytes) {
+            coverage.push({ path: rel, status: "unscanned", reason: "file-over-size-limit" });
+          } else bytes = readFileSync(abs);
+        } else {
+          coverage.push({ path: rel, status: "unscanned", reason: "git-blob-cache-miss" });
+        }
+      } catch (error) { coverage.push({ path: rel, status: "unscanned", reason: `file-read-failed:${error.code ?? "error"}` }); continue; }
+      if (bytes && bytes.length > entry.maxFileBytes) {
+        coverage.push({ path: rel, status: "unscanned", reason: "file-over-size-limit" });
+        bytes = undefined;
+      }
+      if (bytes && isDirty) { digest = sha256(bytes); cacheKey = `sha256:${digest}`; }
+      else if (bytes) { digest = `git:${oid}`; cacheKey = `gitblob:${oid}`; }
+    } else if (!isDirty && oid) { digest = `git:${oid}`; cacheKey = `gitblob:${oid}`; }
+    files.push({ rel, abs, size: bytes?.length ?? entry.cleanBlobSize ?? stat?.size, bytes, oid, digest, cacheKey, inNodeModules });
+  }
+  return { files, coverage };
+}
+
+export function clearGitListedInventoryCacheForTests() { blobCache.clear(); cacheBytes = 0; }

package/ownership-helper-paths.json

@@ -0,0 +1,11 @@
+{
+  "schema": 1,
+  "windows": {
+    "path": "C:\\Users\\adrds\\.rightkit-managed\\ownership-approval\\windows\\content-8d12e39ee6bac3bf8332df8dc61c74637e2eda6becbcc39746fe1ed5a1fe7ef6\\RightKit.OwnershipApproval.Windows.exe",
+    "sha256": "8d12e39ee6bac3bf8332df8dc61c74637e2eda6becbcc39746fe1ed5a1fe7ef6"
+  },
+  "macos": {
+    "path": "/Users/adrdsouza/.rightkit-managed/ownership-approval/macos/content-54224936edb74c9044dbaaa38a0773ee77acec21826237572b9b7c67a87b8ccc/ownership-approval",
+    "sha256": "54224936edb74c9044dbaaa38a0773ee77acec21826237572b9b7c67a87b8ccc"
+  }
+}

package/ownership-key-authority.mjs

@@ -0,0 +1,85 @@
+import { createHash } from "node:crypto";
+import { realpathSync, statSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { canonicalRepositoryIdentity, resolveKeyLogTrust } from "./ownership-approval.mjs";
+
+const LOG_PATH = ".rightkit/ownership-keys.json";
+const MAX_LOG_BYTES = 2 * 1024 * 1024;
+const executable = process.platform === "win32" ? "C:\\Program Files\\Git\\cmd\\git.exe" : "/usr/bin/git";
+const cache = new Map();
+
+function gitEnv() {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !/^GIT_/i.test(key)));
+  env.GIT_CONFIG_NOSYSTEM = "1";
+  env.GIT_CONFIG_GLOBAL = process.platform === "win32" ? "NUL" : "/dev/null";
+  env.GIT_OPTIONAL_LOCKS = "0";
+  env.GIT_TERMINAL_PROMPT = "0";
+  return env;
+}
+
+function git(root, args, encoding = "utf8") {
+  const safeDirectory = process.platform === "win32" ? root.replaceAll("\\", "/") : root;
+  const result = spawnSync(executable, ["-C", root, "--no-replace-objects", "-c", `safe.directory=${safeDirectory}`, "-c", "core.fsmonitor=false", "-c", `core.hooksPath=${process.platform === "win32" ? "NUL" : "/dev/null"}`, ...args], {
+    encoding, env: gitEnv(), windowsHide: true, maxBuffer: MAX_LOG_BYTES + 4096, timeout: 15_000,
+  });
+  if (result?.error || result?.status !== 0) throw new Error(`authority Git ${args[0]} failed`);
+  return result.stdout;
+}
+
+function validateAuthority(authority) {
+  if (!authority || typeof authority !== "object" || Array.isArray(authority)
+    || Object.keys(authority).sort().join("\0") !== ["checkoutPath", "repositoryIdentity"].sort().join("\0")) throw new Error("protected key authority fields are malformed");
+  if (typeof authority.checkoutPath !== "string" || !path.isAbsolute(authority.checkoutPath) || authority.checkoutPath.includes("\0")) throw new Error("protected key authority checkoutPath must be absolute");
+  const repositoryIdentity = canonicalRepositoryIdentity(authority.repositoryIdentity);
+  if (repositoryIdentity !== authority.repositoryIdentity) throw new Error("protected key authority identity must be canonical");
+  const checkoutPath = realpathSync(authority.checkoutPath);
+  if (!statSync(checkoutPath).isDirectory()) throw new Error("protected key authority checkoutPath must be a directory");
+  return { repositoryIdentity, checkoutPath };
+}
+
+/** Read one exact key-log blob from the protected authority checkout's Git HEAD. */
+export function readCommittedKeyAuthority(trust) {
+  try {
+    const expected = validateAuthority(trust?.keyAuthority);
+    const top = String(git(expected.checkoutPath, ["rev-parse", "--show-toplevel"])).trim();
+    const normalizedTop = process.platform === "win32" ? path.resolve(top).toLowerCase() : path.resolve(top);
+    const normalizedExpected = process.platform === "win32" ? expected.checkoutPath.toLowerCase() : expected.checkoutPath;
+    if (normalizedTop !== normalizedExpected) throw new Error("protected key authority checkoutPath must be exact Git repository root");
+    const origin = String(git(expected.checkoutPath, ["config", "--get", "remote.origin.url"])).trim();
+    if (canonicalRepositoryIdentity(origin) !== expected.repositoryIdentity) throw new Error("authority repository origin does not match protected identity");
+    const commit = String(git(expected.checkoutPath, ["rev-parse", "--verify", "HEAD^{commit}"])).trim();
+    const tree = String(git(expected.checkoutPath, ["rev-parse", "--verify", `${commit}^{tree}`])).trim();
+    const listing = git(expected.checkoutPath, ["ls-tree", "-z", commit, "--", LOG_PATH], "buffer");
+    const rows = listing.toString("utf8").split("\0").filter(Boolean);
+    if (rows.length !== 1) throw new Error("authority committed key log is missing or ambiguous");
+    const match = rows[0].match(/^(100644|100755) blob ([0-9a-f]{40}|[0-9a-f]{64})\t\.rightkit\/ownership-keys\.json$/);
+    if (!match) throw new Error("authority key log must be a regular committed blob, not a symlink or unsupported mode");
+    const oid = match[2];
+    const size = Number(String(git(expected.checkoutPath, ["cat-file", "-s", oid])).trim());
+    if (!Number.isSafeInteger(size) || size < 0 || size > MAX_LOG_BYTES) throw new Error("authority key log exceeds 2 MiB or has invalid size");
+    const bytes = git(expected.checkoutPath, ["cat-file", "blob", oid], "buffer");
+    if (!Buffer.isBuffer(bytes) || bytes.length !== size) throw new Error("authority key log blob size changed during read");
+    const algorithm = oid.length === 64 ? "sha256" : "sha1";
+    const blobOid = createHash(algorithm).update(`blob ${bytes.length}\0`).update(bytes).digest("hex");
+    if (blobOid !== oid) throw new Error("authority key log blob hash does not match committed tree");
+    const key = `${oid}:${trust.rootFingerprint}:${trust.keyCheckpoint?.sequence}:${trust.keyCheckpoint?.head}`;
+    let result = cache.get(key);
+    if (!result) {
+      const resolved = resolveKeyLogTrust(trust, bytes);
+      if (!resolved.ok) throw new Error(`authority key log verification failed: ${resolved.problems.join("; ")}`);
+      result = { bytes, digest: resolved.keyLogDigest, rootFingerprint: resolved.trust.rootFingerprint, keyCheckpoint: resolved.checkpoint };
+      cache.set(key, result);
+      if (cache.size > 64) cache.delete(cache.keys().next().value);
+    }
+    // Re-resolve on each call so current protected policy is always merged into
+    // the cached chain result; approval-policy changes never reuse stale trust.
+    const resolved = resolveKeyLogTrust(trust, result.bytes);
+    if (!resolved.ok) throw new Error(`authority key log verification failed: ${resolved.problems.join("; ")}`);
+    return { ok: true, problems: [], bytes: Buffer.from(result.bytes), digest: result.digest, rootFingerprint: result.rootFingerprint, keyCheckpoint: result.keyCheckpoint, resolvedTrust: resolved.trust, authority: { repositoryIdentity: expected.repositoryIdentity, commit, tree } };
+  } catch (error) {
+    return { ok: false, problems: [error?.message ?? "protected key authority could not be read"] };
+  }
+}
+
+export const __testOnly = Object.freeze({ MAX_LOG_BYTES });