@rightkit/release 0.2.121 → 0.2.123

package/ownership-key-log.mjs

@@ -0,0 +1,185 @@
+import { constants, createHash, createPublicKey, verify as cryptoVerify } from "node:crypto";
+
+const HEX = /^[a-f0-9]{64}$/;
+const DOMAIN = "rightkit.ownership-key-log.v1";
+const REQUEST_TYPE = "rightkit.ownership-key-request.v1";
+const PLATFORMS = new Set(["windows", "macos"]);
+const OPERATIONS = new Set(["root", "add", "revoke"]);
+const exact = (value, keys) => value && typeof value === "object" && !Array.isArray(value)
+  && Object.keys(value).sort().join("\0") === [...keys].sort().join("\0");
+const canonicalJson = (value) => {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+};
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+const validText = (s, max) => typeof s === "string" && s.trim().length > 0 && s.length <= max && !/[\u0000-\u001f\u007f]/.test(s);
+
+export function keyFingerprint(pem) {
+  const key = createPublicKey(pem);
+  const ec = key.asymmetricKeyType === "ec" && key.asymmetricKeyDetails?.namedCurve === "prime256v1";
+  const rsa = key.asymmetricKeyType === "rsa" && key.asymmetricKeyDetails?.modulusLength === 2048 && key.asymmetricKeyDetails?.publicExponent === 65537n;
+  if (!ec && !rsa) throw new Error("key must be P-256 ECDSA or RSA-2048 with exponent 65537");
+  return digest(key.export({ type: "spki", format: "der" }));
+}
+
+export function verifyOwnershipSignature(publicKeyPem, payloadBytes, signatureBytes) {
+  try {
+    const key = createPublicKey(publicKeyPem);
+    const message = Buffer.from(payloadBytes);
+    const signature = Buffer.from(signatureBytes);
+    if (!Buffer.isBuffer(payloadBytes) && !(payloadBytes instanceof Uint8Array)) return false;
+    if (!Buffer.isBuffer(signatureBytes) && !(signatureBytes instanceof Uint8Array)) return false;
+    if (message.length > 1_000_000 || signature.length > 256) return false;
+    keyFingerprint(publicKeyPem);
+    if (key.asymmetricKeyType === "rsa") {
+      if (signature.length !== 256) return false;
+      return cryptoVerify("sha256", message, { key, padding: constants.RSA_PKCS1_PSS_PADDING, saltLength: 32 }, signature)
+        || cryptoVerify("sha256", message, { key, padding: constants.RSA_PKCS1_PADDING }, signature);
+    }
+    return cryptoVerify("sha256", message, key, signature);
+  } catch { return false; }
+}
+
+export function validateKeyRecord(record) {
+  const problems = [];
+  if (!exact(record, ["keyId", "publicKeyPem", "platform", "deviceName"])) return ["key record fields are malformed"];
+  if (!HEX.test(record.keyId ?? "")) problems.push("key id must be a lowercase SHA-256 fingerprint");
+  if (!PLATFORMS.has(record.platform)) problems.push("key platform is invalid");
+  if (!validText(record.deviceName, 128)) problems.push("device name must be nonempty and at most 128 characters");
+  if (typeof record.publicKeyPem !== "string" || record.publicKeyPem.length > 4096
+    || !/^-----BEGIN PUBLIC KEY-----\r?\n[\s\S]+\r?\n-----END PUBLIC KEY-----\r?\n?$/.test(record.publicKeyPem)) problems.push("public key PEM must be a bounded SPKI public key");
+  else {
+    try {
+      const key = createPublicKey(record.publicKeyPem);
+      if (keyFingerprint(record.publicKeyPem) !== record.keyId) problems.push("key id does not match public key");
+      if (key.asymmetricKeyType === "rsa" && record.platform !== "windows") problems.push("RSA keys are permitted only for Windows devices");
+    } catch { problems.push("public key must be P-256 SPKI or Windows RSA-2048 SPKI"); }
+  }
+  return problems;
+}
+
+export function eventHash(event) {
+  return digest(Buffer.from(canonicalJson(event?.payload), "utf8"));
+}
+
+const payloadKeys = ["domain", "rootFingerprint", "sequence", "previousHash", "operation", "subject", "signerKeyId"];
+function validatePayload(payload) {
+  const problems = [];
+  if (!exact(payload, payloadKeys)) return ["event payload fields are malformed"];
+  if (payload.domain !== DOMAIN) problems.push("event domain is invalid");
+  if (!HEX.test(payload.rootFingerprint ?? "")) problems.push("root fingerprint is invalid");
+  if (!Number.isSafeInteger(payload.sequence) || payload.sequence < 0) problems.push("event sequence is invalid");
+  if (payload.sequence === 0 ? payload.previousHash !== null : !HEX.test(payload.previousHash ?? "")) problems.push("event previous hash is invalid");
+  if (!OPERATIONS.has(payload.operation)) problems.push("event operation is invalid");
+  if (!HEX.test(payload.signerKeyId ?? "")) problems.push("event signer key id is invalid");
+  if (payload.operation === "revoke") {
+    if (!exact(payload.subject, ["keyId"]) || !HEX.test(payload.subject?.keyId ?? "")) problems.push("revocation subject is malformed");
+  } else problems.push(...validateKeyRecord(payload.subject).map((p) => `subject ${p}`));
+  return problems;
+}
+
+export function verifyKeyLog(log, { rootFingerprint, checkpoint } = {}) {
+  const problems = [];
+  const fail = (message) => problems.push(message);
+  if (!exact(log, ["schema", "events"]) || log.schema !== 1 || !Array.isArray(log.events)) {
+    return { ok: false, problems: ["key log schema or events are malformed"], keys: [], allKeys: [], revokedKeyIds: [], checkpoint: null, rootFingerprint: null, rootPublicKeyPem: null };
+  }
+  if (!HEX.test(rootFingerprint ?? "")) fail("pinned root fingerprint is required");
+  if (log.events.length === 0) fail("key log must contain a signed root event");
+  if (log.events.length > 10_000) fail("key log exceeds 10000 events");
+  if (problems.length) return { ok: false, problems, keys: [], allKeys: [], revokedKeyIds: [], checkpoint: null, rootFingerprint: rootFingerprint ?? null, rootPublicKeyPem: null };
+  const keys = new Map();
+  const allKeys = new Map();
+  const revoked = new Set();
+  let rootPem = null;
+  let previousHash = null;
+  for (let i = 0; i < log.events.length; i++) {
+    const event = log.events[i];
+    if (!exact(event, ["schema", "payload", "signature"]) || event.schema !== 1
+      || (event.signature !== null && !exact(event.signature, ["keyId", "host", "value"]))) { fail(`event ${i} envelope is malformed or unsigned`); break; }
+    const payload = event.payload;
+    const payloadProblems = validatePayload(payload);
+    if (payloadProblems.length) { payloadProblems.forEach((p) => fail(`event ${i}: ${p}`)); break; }
+    if (payload.sequence !== i) { fail(`event ${i} sequence is not contiguous`); break; }
+    if (payload.previousHash !== previousHash) { fail(`event ${i} previous hash does not match log head`); break; }
+    if (rootFingerprint && payload.rootFingerprint !== rootFingerprint) { fail(`event ${i} root fingerprint does not match pin`); break; }
+    if (i === 0 && payload.operation !== "root") { fail("first event must establish root"); break; }
+    if (i > 0 && payload.operation === "root") { fail(`event ${i} cannot replace root`); break; }
+    if (!rootFingerprint && i === 0 && payload.rootFingerprint !== payload.subject.keyId) { fail("root event fingerprint does not match root key"); break; }
+
+    const signer = i === 0 ? payload.subject : keys.get(payload.signerKeyId);
+    if (!signer || signer.keyId !== payload.signerKeyId || revoked.has(payload.signerKeyId)) { fail(`event ${i} signer is not active`); break; }
+    const signerKey = createPublicKey(signer.publicKeyPem);
+    const rsaSigner = signerKey.asymmetricKeyType === "rsa";
+    if (event.signature === null) {
+      const permittedWindowsAnchor = i === 0 && payload.operation === "root" && signer.platform === "windows" && rsaSigner
+        && payload.rootFingerprint === rootFingerprint && payload.rootFingerprint === payload.subject.keyId;
+      if (!permittedWindowsAnchor) { fail(`event ${i} unsigned root is not a pinned Windows RSA genesis checkpoint`); break; }
+    } else {
+      const maxLength = rsaSigner ? 344 : 128;
+      const signatureBytes = typeof event.signature.value === "string" ? Buffer.from(event.signature.value, "base64") : Buffer.alloc(0);
+      if (event.signature.keyId !== payload.signerKeyId || event.signature.host !== signer.platform || typeof event.signature.value !== "string"
+        || event.signature.value.length > maxLength
+        || (rsaSigner ? event.signature.value.length !== 344 || signatureBytes.length !== 256 : event.signature.value.length > 128 || signatureBytes.length === 0)
+        || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(event.signature.value)
+        || signatureBytes.toString("base64") !== event.signature.value) { fail(`event ${i} signature envelope does not match signer`); break; }
+      const verified = verifyOwnershipSignature(signer.publicKeyPem, Buffer.from(canonicalJson(payload), "utf8"), signatureBytes);
+      if (!verified) { fail(`event ${i} signature is invalid`); break; }
+    }
+
+    if (i === 0) {
+      if (payload.signerKeyId !== payload.subject.keyId || payload.rootFingerprint !== keyFingerprint(payload.subject.publicKeyPem)) { fail("root event is not self-signed or pin does not match"); break; }
+      rootPem = payload.subject.publicKeyPem;
+      keys.set(signer.keyId, signer);
+      allKeys.set(signer.keyId, signer);
+    } else if (payload.operation === "add") {
+      if (allKeys.has(payload.subject.keyId)) { fail(`event ${i} adds a duplicate or previously revoked key`); break; }
+      keys.set(payload.subject.keyId, payload.subject);
+      allKeys.set(payload.subject.keyId, payload.subject);
+    } else if (payload.operation === "revoke") {
+      if (!keys.has(payload.subject.keyId)) { fail(`event ${i} revokes a key that is not active`); break; }
+      keys.delete(payload.subject.keyId);
+      revoked.add(payload.subject.keyId);
+    }
+    previousHash = eventHash(event);
+  }
+  const head = log.events.length ? previousHash : null;
+  const current = { sequence: log.events.length - 1, head };
+  if (!problems.length && checkpoint !== undefined) {
+    if (!exact(checkpoint, ["sequence", "head"]) || !Number.isSafeInteger(checkpoint.sequence) || checkpoint.sequence < 0 || !HEX.test(checkpoint.head ?? "")) fail("protected checkpoint is malformed");
+    else if (current.sequence < checkpoint.sequence) fail("key log is shorter than protected checkpoint");
+    else if (log.events[checkpoint.sequence] && eventHash(log.events[checkpoint.sequence]) !== checkpoint.head) fail("key log forks before or at protected checkpoint");
+  }
+  const pin = rootFingerprint ?? (log.events[0]?.payload?.rootFingerprint ?? null);
+  return { ok: problems.length === 0, problems, keys: [...keys.values()], allKeys: [...allKeys.values()], revokedKeyIds: [...revoked], checkpoint: current, rootFingerprint: pin, rootPublicKeyPem: rootPem };
+}
+
+export function createKeyEvent(log, { operation, subject, signerKeyId } = {}) {
+  if (!OPERATIONS.has(operation) || !HEX.test(signerKeyId ?? "")) throw new Error("operation and signer key id are required");
+  const events = log?.events ?? [];
+  const pin = events[0]?.payload?.rootFingerprint ?? (operation === "root" ? subject?.keyId : null);
+  const emptyLog = !log || (log.schema === 1 && Array.isArray(log.events) && log.events.length === 0);
+  const state = emptyLog && operation === "root"
+    ? { ok: true, problems: [], keys: [], allKeys: [] }
+    : verifyKeyLog(log ?? { schema: 1, events: [] }, { rootFingerprint: pin });
+  if (!state.ok) throw new Error(`cannot extend invalid key log: ${state.problems.join("; ")}`);
+  const seq = events.length;
+  const previousHash = seq ? eventHash(events[seq - 1]) : null;
+  const payload = { domain: DOMAIN, rootFingerprint: pin, sequence: seq, previousHash, operation, subject, signerKeyId };
+  const errors = validatePayload(payload);
+  if (errors.length) throw new Error(errors.join("; "));
+  if (operation === "root" && (seq !== 0 || signerKeyId !== subject.keyId || pin !== subject.keyId)) throw new Error("root event must be first and self-signed");
+  if (operation !== "root" && !state.keys.some((key) => key.keyId === signerKeyId)) throw new Error("signer is not active");
+  if (operation === "add" && state.allKeys.some((key) => key.keyId === subject.keyId)) throw new Error("key already appeared in log");
+  if (operation === "revoke" && !state.keys.some((key) => key.keyId === subject.keyId)) throw new Error("revoked key is not active");
+  return { schema: 1, payload, signature: null };
+}
+
+export function verifyKeyRequest(request, { rootFingerprint } = {}) {
+  const problems = [];
+  if (!exact(request, ["schema", "type", "rootFingerprint", "key"]) || request.schema !== 1 || request.type !== REQUEST_TYPE) problems.push("key request schema or type is malformed");
+  if (request?.rootFingerprint !== rootFingerprint || !HEX.test(rootFingerprint ?? "")) problems.push("key request root fingerprint does not match pin");
+  problems.push(...validateKeyRecord(request?.key).map((p) => `request key ${p}`));
+  return { ok: problems.length === 0, problems };
+}

package/ownership-key-trust.mjs

@@ -0,0 +1,326 @@
+import { createHash } from "node:crypto";
+import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { canonicalJson, canonicalRepositoryIdentity, __testOnly as approvalTestOnly, evaluateWindowsAcl, validateTrustRegistry } from "./ownership-approval.mjs";
+import { verifyKeyLog } from "./ownership-key-log.mjs";
+
+const HEX = /^[a-f0-9]{64}$/;
+const MAX_REQUEST_BYTES = 2 * 1024 * 1024;
+const MAX_TRUST_BYTES = 2 * 1024 * 1024;
+export const OWNERSHIP_TRUST_PATH = Object.freeze({
+  win32: "C:\\ProgramData\\Orthic Labs\\RightKit\\ownership\\trust.json",
+  darwin: "/Library/Application Support/Orthic Labs/RightKit/ownership/trust.json",
+});
+
+function copyJson(value) { return JSON.parse(JSON.stringify(value)); }
+function exactObject(value, keys) { return value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("\0") === [...keys].sort().join("\0"); }
+function sameCheckoutPath(left, right) {
+  const a = path.resolve(left), b = path.resolve(right);
+  return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+
+export function normalizeKeyAuthority(authority) {
+  if (!exactObject(authority, ["repositoryIdentity", "checkoutPath"])) throw new Error("key authority fields must be exactly repositoryIdentity and checkoutPath");
+  let repositoryIdentity;
+  try { repositoryIdentity = canonicalRepositoryIdentity(authority.repositoryIdentity); }
+  catch { throw new Error("key authority repository identity is invalid"); }
+  if (repositoryIdentity !== authority.repositoryIdentity) throw new Error("key authority repository identity must be canonical HTTPS");
+  if (typeof authority.checkoutPath !== "string" || !path.isAbsolute(authority.checkoutPath) || authority.checkoutPath.includes("\0")) throw new Error("key authority checkout path must be absolute");
+  const checkoutPath = path.resolve(authority.checkoutPath);
+  if (!checkoutPath) throw new Error("key authority checkout path is invalid");
+  return { repositoryIdentity, checkoutPath };
+}
+
+/** Merge a fully verified key log into protected policy without changing policy fields. */
+export function prepareTrustUpdate(existing, { log, rootFingerprint, baseline, authority } = {}) {
+  if (!HEX.test(rootFingerprint ?? "")) throw new Error("root fingerprint must be a lowercase SHA-256 SPKI fingerprint");
+  const current = existing == null ? null : copyJson(existing);
+  if (current && (current.schema !== 1 || typeof current !== "object" || Array.isArray(current))) throw new Error("protected trust schema is unsupported");
+  if (current && Object.hasOwn(current, "rootFingerprint") && !current.keyCheckpoint) throw new Error("protected root trust lacks checkpoint; refusing update");
+  if (!current && baseline && (Object.hasOwn(baseline, "rootFingerprint") || Object.hasOwn(baseline, "keyCheckpoint") || Object.hasOwn(baseline, "keyAuthority"))) throw new Error("first-install baseline may contain policy only");
+  if (current && !validateTrustRegistry(current).ok) throw new Error(`existing protected policy is invalid: ${validateTrustRegistry(current).problems.join("; ")}`);
+  if (!current && baseline && !validateTrustRegistry(baseline).ok) throw new Error(`first-install policy baseline is invalid: ${validateTrustRegistry(baseline).problems.join("; ")}`);
+  if (current?.rootFingerprint && current.rootFingerprint !== rootFingerprint) throw new Error("protected root pin differs; refusing root rotation");
+  const incomingAuthority = authority === undefined ? undefined : normalizeKeyAuthority(authority);
+  const existingAuthority = current?.keyAuthority === undefined ? undefined : normalizeKeyAuthority(current.keyAuthority);
+  if (existingAuthority && (!sameCheckoutPath(existingAuthority.checkoutPath, current.keyAuthority.checkoutPath) || existingAuthority.repositoryIdentity !== current.keyAuthority.repositoryIdentity)) throw new Error("protected key authority is not canonical");
+  if (existingAuthority && incomingAuthority && (existingAuthority.repositoryIdentity !== incomingAuthority.repositoryIdentity || !sameCheckoutPath(existingAuthority.checkoutPath, incomingAuthority.checkoutPath))) throw new Error("protected key authority differs; refusing repository or checkout relocation");
+  const priorCheckpoint = current?.keyCheckpoint;
+  const state = verifyKeyLog(log, { rootFingerprint, ...(priorCheckpoint ? { checkpoint: priorCheckpoint } : {}) });
+  if (!state.ok) throw new Error(`key log rejected: ${state.problems.join("; ")}`);
+  if (!state.checkpoint || state.checkpoint.sequence < 0 || !HEX.test(state.checkpoint.head ?? "")) throw new Error("key log has no root checkpoint");
+  let policy;
+  if (current) policy = current;
+  else {
+    if (!baseline || typeof baseline !== "object" || Array.isArray(baseline) || baseline.schema !== 1) throw new Error("first root pin requires a schema 1 policy baseline");
+    policy = copyJson(baseline);
+  }
+  const selectedAuthority = current?.keyAuthority ?? incomingAuthority;
+  return { ...policy, schema: 1, rootFingerprint, keyCheckpoint: state.checkpoint, ...(selectedAuthority ? { keyAuthority: selectedAuthority } : {}) };
+}
+
+function runNativeGit(checkoutPath, args, runner = spawnSync) {
+  const nullConfig = process.platform === "win32" ? "NUL" : "/dev/null";
+  const nativeGit = process.platform === "win32" ? "C:\\Program Files\\Git\\cmd\\git.exe" : process.platform === "darwin" ? "/usr/bin/git" : "/usr/bin/git";
+  const fixedPath = process.platform === "win32" ? "C:\\Windows\\System32;C:\\Windows" : "/usr/bin:/bin:/usr/sbin:/sbin";
+  const env = {
+    PATH: fixedPath,
+    ...(process.platform === "win32" ? { SystemRoot: "C:\\Windows", WINDIR: "C:\\Windows" } : {}),
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_GLOBAL: nullConfig,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_OPTIONAL_LOCKS: "0",
+    GIT_NO_REPLACE_OBJECTS: "1",
+    GIT_PAGER: "cat",
+  };
+  const r = runner(nativeGit, ["--no-replace-objects", "-c", "core.fsmonitor=false", "-c", `core.hooksPath=${nullConfig}`, "-c", `safe.directory=${checkoutPath}`, "-C", checkoutPath, ...args], { encoding: null, windowsHide: true, timeout: 10000, maxBuffer: MAX_REQUEST_BYTES, env });
+  if (r.error || r.status !== 0 || !Buffer.isBuffer(r.stdout) || r.stdout.length > MAX_REQUEST_BYTES) throw new Error(`bounded native Git query failed: ${args[0]}`);
+  return r.stdout;
+}
+
+function readCommittedAuthorityData(authority, rootFingerprint, checkpoint, runner = spawnSync) {
+  const normalized = normalizeKeyAuthority(authority);
+  let realCheckout;
+  try { realCheckout = realpathSync.native(normalized.checkoutPath); }
+  catch { throw new Error("key authority checkout path does not exist"); }
+  if (!sameCheckoutPath(realCheckout, normalized.checkoutPath)) throw new Error("key authority checkout path is not its canonical local path");
+  const top = runNativeGit(realCheckout, ["rev-parse", "--show-toplevel"], runner).toString("utf8").trim();
+  if (!sameCheckoutPath(realpathSync.native(top), realCheckout)) throw new Error("key authority path must be repository root");
+  const origin = runNativeGit(realCheckout, ["config", "--local", "--get", "remote.origin.url"], runner).toString("utf8").trim();
+  let canonicalOrigin;
+  try { canonicalOrigin = canonicalRepositoryIdentity(origin); }
+  catch { throw new Error("key authority repository origin is invalid"); }
+  if (canonicalOrigin !== normalized.repositoryIdentity) throw new Error("key authority repository origin does not match protected identity");
+  const commit = runNativeGit(realCheckout, ["rev-parse", "--verify", "HEAD^{commit}"], runner).toString("utf8").trim();
+  if (!/^[a-f0-9]{40,64}$/.test(commit)) throw new Error("repository HEAD commit identifier is malformed");
+  const tree = runNativeGit(realCheckout, ["rev-parse", "--verify", `${commit}^{tree}`], runner).toString("utf8").trim();
+  const treeEntry = runNativeGit(realCheckout, ["ls-tree", "-z", "--full-tree", commit, "--", ".rightkit/ownership-keys.json"], runner).toString("utf8");
+  const entries = treeEntry.split("\0").filter(Boolean);
+  if (entries.length !== 1) throw new Error("committed ownership key log is missing or ambiguous");
+  const match = entries[0].match(/^(100644|100755) blob ([a-f0-9]{40,64})\t\.rightkit\/ownership-keys\.json$/);
+  if (!match) throw new Error("committed ownership key log must be a regular blob, not a gitlink or special entry");
+  const committedBytes = runNativeGit(realCheckout, ["show", `${commit}:.rightkit/ownership-keys.json`], runner);
+  if (committedBytes.length > MAX_REQUEST_BYTES) throw new Error("committed ownership key log exceeds size limit");
+  const worktreePath = path.join(realCheckout, ".rightkit", "ownership-keys.json");
+  let worktreeStat;
+  try { worktreeStat = lstatSync(worktreePath); } catch { throw new Error("committed ownership key log is missing from protected checkout"); }
+  if (!worktreeStat.isFile() || worktreeStat.isSymbolicLink() || (process.platform === "win32" && (worktreeStat.attributes & 0x400)) || worktreeStat.size > MAX_REQUEST_BYTES) throw new Error("working checkout ownership key log must be a bounded regular file");
+  const currentBytes = readFileSync(worktreePath);
+  if (!currentBytes.equals(committedBytes)) throw new Error("working checkout ownership key log differs from committed bytes");
+  let committedLog;
+  try { committedLog = JSON.parse(committedBytes.toString("utf8")); }
+  catch { throw new Error("committed ownership key log is malformed JSON"); }
+  const state = verifyKeyLog(committedLog, { rootFingerprint, checkpoint });
+  if (!state.ok) throw new Error(`committed key log rejected: ${state.problems.join("; ")}`);
+  if (!/^[a-f0-9]{40,64}$/.test(tree)) throw new Error("repository tree identifier is malformed");
+  return { log: committedLog, bytes: committedBytes, digest: createHash("sha256").update(committedBytes).digest("hex"), rootFingerprint: state.rootFingerprint, keyCheckpoint: state.checkpoint, authority: { repositoryIdentity: normalized.repositoryIdentity, commit, tree } };
+}
+
+function validateCommittedAuthority(authority, log, rootFingerprint, checkpoint, runner = spawnSync) {
+  const committed = readCommittedAuthorityData(authority, rootFingerprint, checkpoint, runner);
+  if (canonicalJson(committed.log) !== canonicalJson(log)) throw new Error("request key log differs from committed ownership key log");
+  return committed.authority;
+}
+
+/** Read & verify authority-bound committed key state from its pinned local checkout. */
+export function readCommittedKeyAuthority(trust) {
+  try {
+    if (!trust?.keyAuthority || !HEX.test(trust.rootFingerprint ?? "") || !trust.keyCheckpoint) throw new Error("protected key authority, root pin, or checkpoint is unavailable");
+    return { ok: true, ...readCommittedAuthorityData(trust.keyAuthority, trust.rootFingerprint, trust.keyCheckpoint) };
+  } catch (error) { return { ok: false, problems: [error.message] }; }
+}
+
+function ensureNoLinks(file) {
+  const parsed = path.parse(file);
+  let current = parsed.root;
+  const pieces = file.slice(parsed.root.length).split(path.sep).filter(Boolean);
+  for (const part of pieces) {
+    current = path.join(current, part);
+    try {
+      const st = lstatSync(current);
+      if (st.isSymbolicLink() || (process.platform === "win32" && (st.attributes & 0x400))) throw new Error(`trust path contains a symlink or reparse point: ${current}`);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+}
+
+function assertElevated() {
+  if (process.platform === "win32") {
+    const r = spawnSync("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", "$p=New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); if (!$p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { exit 9 }"]);
+    if (r.status !== 0) throw new Error("protected trust updater requires an elevated Administrator process");
+  } else if (process.platform === "darwin") {
+    if (process.getuid?.() !== 0) throw new Error("protected trust updater requires root");
+  } else throw new Error(`protected trust update unsupported platform: ${process.platform}`);
+}
+
+function hardenWindows(directory, file, runner = spawnSync) {
+  const script = "$ErrorActionPreference='Stop'; $sidSys=New-Object Security.Principal.SecurityIdentifier('S-1-5-18'); $sidAdm=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-544'); $sidUsers=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-545'); foreach($p in @($env:RK_TRUST_DIR,$env:RK_TRUST_FILE)){ $a=New-Object Security.AccessControl.DirectorySecurity; if($p -eq $env:RK_TRUST_FILE){$a=New-Object Security.AccessControl.FileSecurity}; $a.SetAccessRuleProtection($true,$false); $a.SetOwner($sidAdm); $inherit=if($p -eq $env:RK_TRUST_FILE){[Security.AccessControl.InheritanceFlags]::None}else{[Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'}; foreach($sid in @($sidSys,$sidAdm)){ $rule=New-Object Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$inherit,[Security.AccessControl.PropagationFlags]::None,'Allow'); $a.AddAccessRule($rule) }; $read=New-Object Security.AccessControl.FileSystemAccessRule($sidUsers,'ReadAndExecute',$inherit,[Security.AccessControl.PropagationFlags]::None,'Allow'); $a.AddAccessRule($read); Set-Acl -LiteralPath $p -AclObject $a }; $a=Get-Acl -LiteralPath $env:RK_TRUST_DIR; $a.SetOwner($sidSys); Set-Acl -LiteralPath $env:RK_TRUST_DIR -AclObject $a";
+  const r = runner("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: { ...process.env, RK_TRUST_DIR: directory, RK_TRUST_FILE: file } });
+  if (r.status !== 0) throw new Error("could not secure protected trust ACL");
+}
+
+export const __testOnly = Object.freeze({
+  runWindowsAclSetupInDisposableDirectory(directory, runner) {
+    const file = path.join(directory, "trust.json");
+    hardenWindows(directory, file, runner);
+    return { directory, file };
+  },
+  validateCommittedAuthority,
+});
+
+function runWindowsAclScript(script, environment) {
+  const r = spawnSync("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: { ...process.env, ...environment } });
+  if (r.status !== 0) throw new Error("could not create or secure protected ownership path");
+}
+
+function setWindowsDirectoryAcl(directory) {
+  const script = "$ErrorActionPreference='Stop'; $d=$env:RK_TRUST_DIR; $sidSys=New-Object Security.Principal.SecurityIdentifier('S-1-5-18'); $sidAdm=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-544'); $sidUsers=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-545'); $a=New-Object Security.AccessControl.DirectorySecurity; $a.SetAccessRuleProtection($true,$false); $a.SetOwner($sidAdm); foreach($sid in @($sidSys,$sidAdm)){ $a.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($sid,'FullControl','ContainerInherit,ObjectInherit','None','Allow'))) }; $a.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($sidUsers,'ReadAndExecute','ContainerInherit,ObjectInherit','None','Allow'))); Set-Acl -LiteralPath $d -AclObject $a";
+  runWindowsAclScript(script, { RK_TRUST_DIR: directory });
+}
+
+function prepareDirectory(directory) {
+  ensureNoLinks(directory);
+  if (process.platform === "win32") {
+    const root = path.parse(directory).root;
+    const remainder = directory.slice(root.length).split(path.sep).filter(Boolean);
+    let current = root;
+    for (const part of remainder) {
+      current = path.join(current, part);
+      let created = false;
+      try { const st = lstatSync(current); if (!st.isDirectory() || st.isSymbolicLink() || (st.attributes & 0x400)) throw new Error(`protected trust parent is unsafe: ${current}`); }
+      catch (error) { if (error.code !== "ENOENT") throw error; mkdirSync(current); created = true; }
+      if (created) setWindowsDirectoryAcl(current);
+      else auditProtected(current);
+    }
+  } else {
+    const root = "/";
+    const remainder = directory.slice(root.length).split(path.sep).filter(Boolean);
+    let current = root;
+    for (const part of remainder) {
+      current = path.join(current, part);
+      let created = false;
+      try { const st = lstatSync(current); if (!st.isDirectory() || st.isSymbolicLink()) throw new Error(`protected trust parent is unsafe: ${current}`); }
+      catch (error) { if (error.code !== "ENOENT") throw error; mkdirSync(current, { mode: 0o755 }); created = true; }
+      if (created) {
+        const chown = spawnSync("/usr/sbin/chown", ["root:wheel", current]);
+        const chmod = spawnSync("/bin/chmod", ["755", current]);
+        if (chown.status !== 0 || chmod.status !== 0) throw new Error(`could not secure protected ownership directory: ${current}`);
+      } else auditProtected(current);
+    }
+  }
+}
+
+function auditProtected(file) {
+  if (process.platform === "win32") {
+    let current = path.dirname(file);
+    const targets = [];
+    while (true) { targets.push(current); if (current.toLowerCase() === "c:\\") break; current = path.dirname(current); }
+    targets.push(file);
+    const script = "$ErrorActionPreference='Stop'; $a=Get-Acl -LiteralPath $env:RK_TRUST_CHECK_TARGET; $item=Get-Item -Force -LiteralPath $env:RK_TRUST_CHECK_TARGET; $out=[ordered]@{ownerSID=$a.GetOwner([Security.Principal.SecurityIdentifier]).Value;ownerName=$a.Owner;attributes=$item.Attributes.ToString();directory=[bool]$item.PSIsContainer;nonempty=(!$item.PSIsContainer -or [System.IO.Directory]::EnumerateFileSystemEntries($item.FullName).GetEnumerator().MoveNext());elevated=$true;access=@($a.Access | ForEach-Object { [ordered]@{identitySID=$_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value;type=$_.AccessControlType.ToString();mask=[int64]$_.FileSystemRights.value__;propagationFlags=[int]$_.PropagationFlags} })}; $out | ConvertTo-Json -Compress -Depth 5";
+    const problems = [];
+    for (const target of targets) {
+      try { if (lstatSync(target).isSymbolicLink()) problems.push(`trust path contains a reparse/symlink: ${target}`); } catch { problems.push(`cannot inspect trust path: ${target}`); continue; }
+      const r = spawnSync("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: { ...process.env, RK_TRUST_CHECK_TARGET: target } });
+      if (r.status !== 0) { problems.push(`cannot inspect trust ACL: ${target}`); continue; }
+      try { problems.push(...evaluateWindowsAcl(JSON.parse(r.stdout.trim()), { target, requireNonElevated: false }).problems.map((problem) => `${problem}: ${target}`)); }
+      catch { problems.push(`malformed ACL result: ${target}`); }
+    }
+    if (problems.length) throw new Error(`protected trust audit failed: ${problems.join("; ")}`);
+    return;
+  }
+  const result = approvalTestOnly.protectedLocation(file, process.platform);
+  if (!result.ok) throw new Error(`protected trust audit failed: ${result.problems.join("; ")}`);
+}
+
+function readExisting(file) {
+  try {
+    const st = lstatSync(file);
+    if (st.isSymbolicLink() || !st.isFile() || st.size > MAX_TRUST_BYTES) throw new Error("existing protected trust must be a bounded regular file");
+    return JSON.parse(readFileSync(file, "utf8"));
+  } catch (error) { if (error.code === "ENOENT") return null; throw error; }
+}
+
+function acquireUpdateLock(directory) {
+  const lock = path.join(directory, ".key-trust-update.lock");
+  let fd;
+  try { fd = openSync(lock, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600); }
+  catch (error) { if (error.code === "EEXIST") throw new Error("another ownership trust update is active; refusing concurrent update"); throw error; }
+  try { writeFileSync(fd, `${process.pid}\n`); fsyncSync(fd); }
+  catch (error) { closeSync(fd); try { unlinkSync(lock); } catch {} throw error; }
+  closeSync(fd);
+  return () => { try { unlinkSync(lock); } catch (error) { if (error.code !== "ENOENT") throw error; } };
+}
+
+function atomicProtectedWrite(file, trust) {
+  const directory = path.dirname(file);
+  const temp = path.join(directory, `.trust-${process.pid}-${Date.now()}.tmp`);
+  let fd;
+  try {
+    fd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
+    writeFileSync(fd, `${JSON.stringify(trust, null, 2)}\n`);
+    fsyncSync(fd);
+    closeSync(fd); fd = undefined;
+    if (process.platform === "win32") hardenWindows(directory, temp);
+    else {
+      const chown = spawnSync("/usr/sbin/chown", ["root:wheel", temp]);
+      if (chown.status !== 0) throw new Error("could not set protected trust file owner");
+      const modeFd = openSync(temp, constants.O_RDONLY);
+      try { fchmodSync(modeFd, 0o644); } finally { closeSync(modeFd); }
+    }
+    renameSync(temp, file);
+    if (process.platform !== "win32") {
+      const dirFd = openSync(directory, constants.O_RDONLY);
+      try { fsyncSync(dirFd); } finally { closeSync(dirFd); }
+    }
+  } catch (error) {
+    if (fd !== undefined) closeSync(fd);
+    try { unlinkSync(temp); } catch {}
+    throw error;
+  }
+}
+
+/** Elevated child entrypoint. Writes only the fixed native trust path. */
+export function performProtectedTrustUpdate({ log, rootFingerprint, baseline, authority } = {}) {
+  assertElevated();
+  const file = OWNERSHIP_TRUST_PATH[process.platform];
+  const directory = path.dirname(file);
+  prepareDirectory(directory);
+  auditProtected(directory);
+  ensureNoLinks(file);
+  const releaseLock = acquireUpdateLock(directory);
+  try {
+    // Re-read under the protected lock so every accepted checkpoint follows latest disk state.
+    let existing = null;
+    try { lstatSync(file); auditProtected(file); existing = readExisting(file); } catch (error) { if (error.code !== "ENOENT") throw error; existing = null; }
+    const trust = prepareTrustUpdate(existing, { log, rootFingerprint, baseline, authority });
+    if (trust.keyAuthority) validateCommittedAuthority(trust.keyAuthority, log, trust.rootFingerprint, trust.keyCheckpoint);
+    atomicProtectedWrite(file, trust);
+    auditProtected(file);
+    return { path: file, trust };
+  } finally { releaseLock(); }
+}
+
+function readPinnedRequest(requestPath, expectedDigest) {
+  if (!path.isAbsolute(requestPath) || !HEX.test(expectedDigest ?? "")) throw new Error("request path and SHA-256 digest are required");
+  const fd = openSync(requestPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const st = fstatSync(fd);
+    if (!st.isFile() || st.size < 2 || st.size > MAX_REQUEST_BYTES) throw new Error("request must be a bounded regular file");
+    const bytes = readFileSync(fd);
+    if (createHash("sha256").update(bytes).digest("hex") !== expectedDigest) throw new Error("request bytes do not match pinned SHA-256");
+    return JSON.parse(bytes.toString("utf8"));
+  } finally { closeSync(fd); }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
+  try {
+    if (process.argv.length !== 6 || process.argv[2] !== "--request" || process.argv[4] !== "--sha256") throw new Error("usage: ownership-key-trust.mjs --request <absolute-json> --sha256 <digest>");
+    const request = readPinnedRequest(process.argv[3], process.argv[5]);
+    if (!exactObject(request, ["schema", "log", "rootFingerprint", ...(Object.hasOwn(request ?? {}, "baseline") ? ["baseline"] : []), ...(Object.hasOwn(request ?? {}, "authority") ? ["authority"] : [])]) || request.schema !== 1 || !Array.isArray(request.log?.events) || request.log.schema !== 1) throw new Error("key trust request schema is malformed");
+    const result = performProtectedTrustUpdate({ log: request.log, rootFingerprint: request.rootFingerprint, baseline: request.baseline, authority: request.authority });
+    process.stdout.write(`${JSON.stringify({ path: result.path, checkpoint: result.trust.keyCheckpoint })}\n`);
+  } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 2; }
+}

package/ownership-report-command.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawn } from "./background-process.mjs";
+import { OWNERSHIP_APPS, formatOwnershipJson, buildOwnershipReport, renderOwnershipMarkdown } from "./ownership-report.mjs";
+import { MANIFEST_FILE } from "./ownership.mjs";
+
+const packageRoot = path.dirname(fileURLToPath(import.meta.url));
+const defaultWorkspace = path.resolve(packageRoot, "../../../..");
+const MAX_SCAN_OUTPUT_BYTES = 32 * 1024 * 1024;
+const flag = (args, name) => { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; };
+
+function scanWorker(appRoot, manifestPath, timeoutMs) {
+  return new Promise((resolve) => {
+    const worker = path.join(packageRoot, "ownership-scan-worker.mjs");
+    const child = spawn(process.execPath, [worker, appRoot, manifestPath], { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "", stderr = "", outputBytes = 0, settled = false;
+    const finish = (value) => { if (settled) return; settled = true; clearTimeout(timer); resolve(value); };
+    child.stdout.setEncoding("utf8"); child.stderr.setEncoding("utf8");
+    const collect = (target) => (chunk) => {
+      outputBytes += Buffer.byteLength(chunk);
+      if (outputBytes > MAX_SCAN_OUTPUT_BYTES) { child.kill(); finish({ error: `scanner output exceeded ${MAX_SCAN_OUTPUT_BYTES} bytes; marked unscanned` }); return; }
+      if (target === "stdout") stdout += chunk; else stderr += chunk;
+    };
+    child.stdout.on("data", collect("stdout")); child.stderr.on("data", collect("stderr"));
+    child.once("error", (error) => finish({ error: `scanner worker failed to start: ${error.message}` }));
+    child.once("close", (code) => {
+      if (code !== 0) return finish({ error: stderr.trim() || `scanner worker exited ${code}` });
+      try { finish({ value: JSON.parse(stdout) }); } catch (error) { finish({ error: `scanner worker returned invalid JSON: ${error.message}` }); }
+    });
+    const timer = setTimeout(() => { child.kill(); finish({ error: `scan exceeded ${timeoutMs} ms limit; marked unscanned` }); }, timeoutMs);
+  });
+}
+
+async function scanConfiguredApps(workspaceRoot, manifest, timeoutMs) {
+  const results = new Map();
+  let cursor = 0;
+  const worker = async () => {
+    for (;;) {
+      const index = cursor++;
+      if (index >= OWNERSHIP_APPS.length) return;
+      const app = OWNERSHIP_APPS[index];
+      const appRoot = path.resolve(workspaceRoot, app.root);
+      if (!existsSync(appRoot)) continue;
+      results.set(app.key, await scanWorker(appRoot, path.join(packageRoot, MANIFEST_FILE), timeoutMs));
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(3, OWNERSHIP_APPS.length) }, worker));
+  return results;
+}
+
+export async function main(args, io = {}) {
+  const workspaceRoot = path.resolve(flag(args, "--workspace") ?? defaultWorkspace);
+  const manifest = JSON.parse(readFileSync(path.join(packageRoot, MANIFEST_FILE), "utf8"));
+  const versions = JSON.parse(readFileSync(path.join(packageRoot, "rightkit-versions.json"), "utf8"));
+  const timeoutMs = Number(flag(args, "--timeout-ms") ?? 60_000);
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1_000 || timeoutMs > 300_000) throw new TypeError("--timeout-ms must be between 1000 and 300000");
+  const scanResults = await scanConfiguredApps(workspaceRoot, manifest, timeoutMs);
+  const report = buildOwnershipReport({ workspaceRoot, manifest, versions, scanner: (root, catalog) => {
+    const app = OWNERSHIP_APPS.find((entry) => path.resolve(workspaceRoot, entry.root) === path.resolve(root));
+    if (!app) throw new Error("app root is not in configured app list");
+    const scanned = scanResults.get(app.key);
+    if (!scanned) throw new Error("configured app root missing; marked unscanned");
+    if (scanned.error) throw new Error(scanned.error);
+    return scanned.value;
+  } });
+  const markdown = renderOwnershipMarkdown(report);
+  const json = formatOwnershipJson(report);
+  const markdownPath = flag(args, "--markdown");
+  const jsonPath = flag(args, "--json-out");
+  if (markdownPath) writeFileSync(path.resolve(markdownPath), markdown);
+  if (jsonPath) writeFileSync(path.resolve(jsonPath), json);
+  if (args.includes("--json")) (io.stdout ?? process.stdout).write(json);
+  else {
+    if (!markdownPath && !jsonPath) (io.stdout ?? process.stdout).write(markdown);
+    (io.stderr ?? process.stderr).write(`[right-release] ownership report: ${report.apps.length} apps, ${report.blocks.length} deduplicated blocks, ${report.exceptionRequests.length} pending exception requests\n`);
+    if (markdownPath) (io.stderr ?? process.stderr).write(`[right-release] Markdown: ${path.resolve(markdownPath)}\n`);
+    if (jsonPath) (io.stderr ?? process.stderr).write(`[right-release] JSON: ${path.resolve(jsonPath)}\n`);
+  }
+  return report.apps.some((app) => app.status === "blocked" || app.status === "unscanned" || app.rows.some((row) => row.status === "blocked" || row.status === "unscanned")) ? 1 : 0;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { process.exitCode = await main(process.argv.slice(2)); }
+  catch (error) { console.error(`[right-release] ownership report: ${error.message}`); process.exitCode = 1; }
+}