@rightkit/release 0.2.134 → 0.2.136

package/macos-notarization.mjs

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+import { detectMacSigningSession, runMacGuiNotarization } from "./macos-signing-session.mjs";
+import { notarytoolAuthArgs } from "./notary-auth.mjs";
 
 function checkedRun(args, run) {
   const result = run("xcrun", args, { encoding: "utf8" });
@@ -10,9 +12,13 @@ function checkedRun(args, run) {
   return result.stdout ?? "";
 }
 
-export function stapleMacosArtifact(file, { run = spawnSync } = {}) {
+export function stapleMacosArtifact(file, options = {}) {
+  const { run = spawnSync, env = process.env } = options;
   file = path.resolve(file);
   if (!/\.(dmg|pkg|app)$/i.test(file)) throw new Error(`not a stapleable macOS artifact: ${file}`);
+  if (detectMacSigningSession({ env, run }).guiRunner) {
+    return { ...runMacGuiNotarization({ ...options, kind: "staple", file }).stapling[0], file };
+  }
   const probe = run("xcrun", ["stapler", "validate", file], { encoding: "utf8" });
   if (probe.error) throw new Error(`cannot validate macOS staple: ${probe.error.message}`);
   const alreadyStapled = probe.status === 0;
@@ -27,7 +33,7 @@ function fileEvidence(file) {
 
 // DMG/PKG receive their own ticket. For a separately submitted app ZIP,
 // target.notarize.app (CLI --app) identifies the bundle to staple before packaging.
-export function notarizeMacosArtifact({ archive, receiptPath, authArgs, app, run = spawnSync }) {
+export function notarizeMacosArtifact({ archive, receiptPath, authArgs, profile, app, run = spawnSync, env = process.env, ...agentOptions }) {
   archive = path.resolve(archive);
   const stapleTargets = /\.(dmg|pkg)$/i.test(archive) ? [archive] : [];
   if (app) {
@@ -36,11 +42,21 @@ export function notarizeMacosArtifact({ archive, receiptPath, authArgs, app, run
     stapleTargets.push(bundle);
   }
   if (!stapleTargets.length) throw new Error("notarization archives require notarize.app (or --app) for stapling their app bundle");
-  let result;
-  try { result = JSON.parse(checkedRun(["notarytool", "submit", archive, "--wait", "--output-format", "json", ...authArgs], run)); }
-  catch (error) { throw new Error(`macOS notarization failed for ${archive}: ${error.message}`); }
-  if (result.status !== "Accepted") throw new Error(`notarization was not accepted for ${archive}: ${result.status ?? "missing status"}`);
-  const stapling = [...new Set(stapleTargets)].map((file) => stapleMacosArtifact(file, { run }));
+  let result, stapling;
+  if (detectMacSigningSession({ env, run }).guiRunner) {
+    // SSH ignores API credential environment/argv entirely. Only profile name
+    // reaches Aqua, where Keychain authentication already works.
+    const selectedProfile = profile ?? (authArgs?.[0] === "--keychain-profile" && authArgs.length === 2 ? authArgs[1] : undefined);
+    const report = runMacGuiNotarization({ ...agentOptions, kind: "notarize", file: archive, app, profile: selectedProfile, env, run });
+    result = report.notarization;
+    stapling = report.stapling.map((item) => ({ ...item, file: stapleTargets.find((file) => realpathSync.native(file) === item.file) ?? item.file }));
+  } else {
+    authArgs ??= notarytoolAuthArgs({ profile, env });
+    try { result = JSON.parse(checkedRun(["notarytool", "submit", archive, "--wait", "--output-format", "json", ...authArgs], run)); }
+    catch (error) { throw new Error(`macOS notarization failed for ${archive}: ${error.message}`); }
+    if (result.status !== "Accepted") throw new Error(`notarization was not accepted for ${archive}: ${result.status ?? "missing status"}`);
+    stapling = [...new Set(stapleTargets)].map((file) => stapleMacosArtifact(file, { run, env }));
+  }
   // Stapling changes container bytes. Record final bytes, never the submission digest.
   const receipt = {
     schema: 1,

package/macos-signing-session.mjs

@@ -3,9 +3,10 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 
-import { requestSigningAgentSync } from "./signing-agent-client.mjs";
+import { requestSigningAgentSync, validateNotaryAgentReport } from "./signing-agent-client.mjs";
 import { installSigningAgent, requireMacGuiSession } from "./signing-agent-install.mjs";
-import { signingAgentPaths, defaultSigningRoots, ensurePrivateDirectory, privatePath, within } from "./rightkit-signing-agent.mjs";
+import { signingAgentPaths, defaultSigningRoots, ensurePrivateDirectory, privatePath, within, NOTARIZATION_TIMEOUT_MS, MAX_NOTARIZATION_TIMEOUT_MS } from "./rightkit-signing-agent.mjs";
+import { refuseManagedEnvSecrets } from "./managed-host-secrets.mjs";
 
 export class MacSigningSessionError extends Error {
   constructor(code, message) {
@@ -126,8 +127,55 @@ export function runMacCodesignCommands(commands, options = {}) {
   return results;
 }
 
+export function runMacGuiNotarization({ kind = "notarize", file, profile = "apple-dev-notary", app, validateOnly,
+  cwd = process.cwd(), env = process.env, run = spawnSync, io = fs, home = os.userInfo().homedir,
+  uid = process.getuid?.(), username = os.userInfo().username, allowedRoots, timeoutMs = NOTARIZATION_TIMEOUT_MS,
+  request = requestSigningAgentSync, install = installSigningAgent } = {}) {
+  if (!["notarize", "staple"].includes(kind) || !Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_NOTARIZATION_TIMEOUT_MS) throw new TypeError("Invalid notarization request or timeout");
+  if (kind === "notarize" && (typeof profile !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_. -]{0,127}$/.test(profile))) throw new TypeError("Notarization requires a profile name only");
+  requireMacGuiSession({ run, uid });
+  const paths = signingAgentPaths(home);
+  let roots = allowedRoots ?? defaultSigningRoots(home, env.RIGHTKIT_MANAGED_ROOT);
+  if (!allowedRoots && io.existsSync(paths.config)) {
+    privatePath(paths.config, 0o600, { io, uid });
+    roots = JSON.parse(io.readFileSync(paths.config, "utf8")).roots;
+  }
+  const plan = { schema: 1, type: kind, path: path.resolve(file), cwd: path.resolve(cwd),
+    allowedRoots: roots.filter((root) => io.existsSync(root)), timeoutMs,
+    ...(kind === "notarize" ? { profile, staple: true, ...(app ? { app: path.resolve(app) } : {}) } : { validateOnly: validateOnly === true }) };
+  const options = { home, timeoutMs: timeoutMs + 5000 };
+  let report;
+  try { report = request(plan, options); }
+  catch (error) {
+    let missing = error.code === "MAC_SIGNING_AGENT_UNAVAILABLE";
+    // Upgrade earlier installed agents once; never turn a rejected path or
+    // malformed request into an install/retry loop.
+    if (error.code === "MAC_SIGNING_AGENT_PROTOCOL") {
+      const health = request({ schema: 1, type: "health" }, { home, timeoutMs: 1500 });
+      missing = !health.capabilities?.includes(kind);
+    }
+    if (!missing) throw error;
+    install({ home, username, uid, run, io, managedRoot: env.RIGHTKIT_MANAGED_ROOT });
+    report = request(plan, options);
+  }
+  validateNotaryAgentReport(report);
+  const targets = kind === "staple" ? [plan.path] : [...new Set([...( /\.(dmg|pkg)$/i.test(plan.path) ? [plan.path] : []), ...(plan.app ? [plan.app] : [])])];
+  const canonical = (value) => (io.realpathSync.native ?? io.realpathSync)(value);
+  if (!report.ok || (kind === "notarize" && (report.notarization.status !== "Accepted" || !report.notarization.id
+    || !report.steps.some((step) => step.step === "submit" && step.exitCode === 0)))
+    || report.stapling.length !== targets.length || targets.some((target) => !report.stapling.some((item) => item.file === canonical(target)
+      && report.steps.some((step) => step.step === "validate" && step.file === item.file && step.exitCode === 0)
+      && (kind !== "notarize" || report.steps.some((step) => step.step === "staple" && step.file === item.file && step.exitCode === 0))))
+    || report.steps.some((step) => step.step !== "probe" && step.exitCode !== 0)) {
+    throw new MacSigningSessionError("MAC_SIGNING_AGENT_PROTOCOL", "Signing agent returned incomplete notarization or stapling evidence");
+  }
+  return report;
+}
+
 export function signMacUpdaterFiles(files, options = {}) {
   const { cwd = process.cwd(), env = process.env, run = spawnSync, username = os.userInfo().username } = options;
+  // Inherited updater key material must not bypass the Keychain or GUI signing agent on managed hosts.
+  refuseManagedEnvSecrets(env, ["TAURI_SIGNING_PRIVATE_KEY", "TAURI_SIGNING_PRIVATE_KEY_PASSWORD"]);
   const commands = files.map((file) => ["exec", "tauri", "signer", "sign", file]);
   const signingEnv = { ...env, TAURI_SIGNING_PRIVATE_KEY_PASSWORD: env.TAURI_SIGNING_PRIVATE_KEY_PASSWORD ?? "" };
   if (env.SSH_CONNECTION || env.SSH_TTY || env.SSH_CLIENT || (!signingEnv.TAURI_SIGNING_PRIVATE_KEY && detectMacSigningSession({ env, run }).guiRunner)) {

package/managed-cargo.mjs

@@ -1,14 +1,14 @@
+import { discoverBrokerSocket, managedControlCandidates, resolveManagedRoots } from './managed-roots.mjs';
 import { randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 
 export function managedRuntimeClient(env = process.env, platform = process.platform, exists = existsSync) {
-  const roots = [env.RIGHTKIT_MANAGED_ROOT, env.RIGHTKIT_EXTERNAL_ROOT,
-    platform === "win32" ? "D:\\.rightkit-managed" : platform === "darwin" ? "/Volumes/D/.rightkit-managed" : undefined]
-    .filter((root) => typeof root === "string" && root.length > 0);
+  const roots = managedControlCandidates({ env, platform });
+  const paths = platform === 'win32' ? path.win32 : path.posix;
   for (const root of roots) {
-    const client = path.join(root, "runtime-current", "build-control-clients", "src", "rightkit.mjs");
+    const client = paths.join(root, "runtime-current", "build-control-clients", "src", "rightkit.mjs");
     if (exists(client)) return client;
   }
   return undefined;
@@ -19,7 +19,7 @@ export function managedRuntimeClient(env = process.env, platform = process.platf
 export function acquireManagedRunLease({ command, env = process.env, platform = process.platform, exists = existsSync, pid = process.pid } = {}) {
   const client = managedRuntimeClient(env, platform, exists);
   if (!client) return { path: null, release() {} };
-  const runs = path.join(path.dirname(path.dirname(path.dirname(path.dirname(client)))), "rightkit-build-control", "global", "runs");
+  const runs = path.join(resolveManagedRoots({ env, platform }).dataRoot, "rightkit-build-control", "global", "runs");
   const file = path.join(runs, `${pid}-${randomUUID()}.json`);
   try {
     mkdirSync(runs, { recursive: true });
@@ -31,24 +31,28 @@ export function acquireManagedRunLease({ command, env = process.env, platform =
   return { path: file, release() { rmSync(file, { force: true }); } };
 }
 
-function managedHost(env) {
+export function managedHost(env) {
   return Boolean(env.RIGHTKIT_BUILD_BROKER_SOCKET)
-    || /(?:^|[;:])[^;:]*[/\\](?:\.rightkit-managed|rightkitmanagedagent)[/\\]agent-bin(?:[;:]|$)/i.test(String(env.PATH ?? ""));
+    || /(?:^|[;:])[^;:]*[/\\](?:\.rightkit-managed|rightkitmanagedagent|rightkit[/\\]build-control)[/\\]agent-bin(?:[;:]|$)/i.test(String(env.PATH ?? ""));
 }
 
-export function runCargoSync(args, options = {}) {
+export function runCargoSync(args, options = {}, { platform = process.platform, exists = existsSync, spawn = spawnSync } = {}) {
   const env = options.env ?? process.env;
-  const client = managedRuntimeClient(env);
+  const client = managedRuntimeClient(env, platform, exists);
   if (client) {
-    // The managed `rightkit` wrapper defaults the broker socket to <managed root>/broker.sock; calling the
-    // client directly must do the same, or agent shells without the variable fail metadata.
-    const root = path.dirname(path.dirname(path.dirname(path.dirname(client))));
-    const socket = path.join(root, "broker.sock");
-    const childEnv = !env.RIGHTKIT_BUILD_BROKER_SOCKET && existsSync(socket) ? { ...env, RIGHTKIT_BUILD_BROKER_SOCKET: socket } : env;
-    return spawnSync(process.execPath, [client, "cargo", ...args], { ...options, env: childEnv, cwd: process.cwd() });
-  }
-  if (managedHost(env) && process.platform === "win32") {
-    return { status: null, stdout: "", stderr: "", error: new Error("installed RightKit runtime client is unavailable for managed Cargo metadata") };
+    const socket = discoverBrokerSocket(env, { platform, exists });
+    if (platform === 'darwin' && (!socket || !exists(socket))) return unavailable('RightKit broker socket is unavailable');
+    const childEnv = socket ? { ...env, RIGHTKIT_BUILD_BROKER_SOCKET: socket } : env;
+    const result = spawn(process.execPath, [client, "cargo", ...args], { ...options, env: childEnv });
+    if (platform === 'darwin' && result.status !== 0 && /RK_BROKER_UNAVAILABLE|RightKit broker (?:unavailable|endpoint is not configured)/i.test(String(result.stderr ?? ''))) {
+      return { ...result, error: unavailable(String(result.stderr).trim()).error };
+    }
+    return result;
   }
-  return spawnSync("cargo", args, options);
+  if (platform === 'darwin' || (managedHost(env) && platform === 'win32')) return unavailable('installed RightKit runtime client is unavailable for managed Cargo metadata');
+  return spawn("cargo", args, options);
+}
+
+function unavailable(message) {
+  return { status: null, stdout: "", stderr: message, error: Object.assign(new Error(message), { code: 'RK_BROKER_UNAVAILABLE' }) };
 }

package/managed-host-secrets.mjs

@@ -0,0 +1,30 @@
+import { managedHost } from "./managed-cargo.mjs";
+
+export const MANAGED_HOST_ENV_SECRET_REFUSED = "MANAGED_HOST_ENV_SECRET_REFUSED";
+
+export class ManagedHostEnvSecretError extends Error {
+  constructor(name) {
+    super(`${name} is refused on a managed RightKit host; load the secret from the provisioned OS credential store (macOS Keychain or protected token file) instead`);
+    this.name = "ManagedHostEnvSecretError";
+    this.code = MANAGED_HOST_ENV_SECRET_REFUSED;
+    this.variable = name;
+  }
+}
+
+export function isManagedHost(env = process.env) {
+  return managedHost(env);
+}
+
+// Throws unconditionally; the message names the variable only, never its value.
+export function refuseManagedEnvSecret(name) {
+  throw new ManagedHostEnvSecretError(name);
+}
+
+// On a managed host, refuse any named environment secret that is set (non-blank).
+// Unmanaged hosts are unaffected.
+export function refuseManagedEnvSecrets(env = process.env, names = []) {
+  if (!isManagedHost(env)) return;
+  for (const name of names) {
+    if (String(env[name] ?? "").trim()) refuseManagedEnvSecret(name);
+  }
+}

package/managed-roots.mjs

@@ -0,0 +1,39 @@
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { posix, win32 } from 'node:path';
+
+/** RIGHTKIT_MANAGED_ROOT remains a data-root override for existing release callers. */
+export function resolveManagedRoots({ env = process.env, platform = process.platform, home = homedir(), controlRoot, dataRoot } = {}) {
+  const paths = platform === 'win32' ? win32 : posix;
+  const legacyRoot = platform === 'win32' ? 'D:\\.rightkit-managed' : '/Volumes/D/.rightkit-managed';
+  dataRoot ??= env.RIGHTKIT_DATA_ROOT || env.RIGHTKIT_MANAGED_ROOT || env.RIGHTKIT_EXTERNAL_ROOT || legacyRoot;
+  controlRoot ??= env.RIGHTKIT_CONTROL_ROOT || (platform === 'darwin'
+    ? paths.join(home, 'Library', 'Application Support', 'RightKit', 'build-control') : dataRoot);
+  return Object.freeze({ controlRoot, dataRoot, legacyRoot, runtimeCurrent: paths.join(controlRoot, 'runtime-current'),
+    configPath: paths.join(controlRoot, 'config.json'), socket: platform === 'win32' ? null : paths.join(controlRoot, 'broker.sock'),
+    logs: paths.join(controlRoot, 'logs'), agentBin: paths.join(controlRoot, 'agent-bin'),
+    agentPolicy: paths.join(controlRoot, 'agent-policy'), ownershipInstall: paths.join(controlRoot, 'ownership-install'),
+    // The Mac signing agent already lives on the internal disk; moving it would force a re-provision.
+    signingAgent: platform === 'darwin' ? paths.join(home, 'Library', 'Application Support', 'Orthic Labs', 'shared', 'signing-agent')
+      : paths.join(controlRoot, 'signing-agent') });
+}
+
+export function managedControlCandidates(options = {}) {
+  const platform = options.platform ?? process.platform;
+  if (!['darwin', 'win32'].includes(platform)) {
+    const env = options.env ?? process.env;
+    return [...new Set([options.controlRoot, env.RIGHTKIT_CONTROL_ROOT, options.dataRoot, env.RIGHTKIT_DATA_ROOT, env.RIGHTKIT_MANAGED_ROOT, env.RIGHTKIT_EXTERNAL_ROOT, options.clientRoot].filter(Boolean))];
+  }
+  const roots = resolveManagedRoots(options);
+  return [...new Set([roots.controlRoot, roots.dataRoot, options.clientRoot, roots.legacyRoot].filter(Boolean))];
+}
+
+export function discoverBrokerSocket(env = process.env, { exists = existsSync, ...options } = {}) {
+  if (typeof env.RIGHTKIT_BUILD_BROKER_SOCKET === 'string' && env.RIGHTKIT_BUILD_BROKER_SOCKET) return env.RIGHTKIT_BUILD_BROKER_SOCKET;
+  if ((options.platform ?? process.platform) === 'win32') return undefined;
+  for (const root of managedControlCandidates({ ...options, env })) {
+    const socket = posix.join(root, 'broker.sock');
+    if (exists(socket)) return socket;
+  }
+  return undefined;
+}

package/model-promote.mjs

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
-import { createHash } from "node:crypto";
-import { createReadStream } from "node:fs";
-import { mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { verifyArtifactFile, readVerifiedArtifact, digestBytes } from "./publication-artifacts.mjs";
+import { uploadVerifiedR2File, uploadVerifiedR2Artifact } from "./r2-verified-upload.mjs";
+import { refuseManagedEnvSecrets } from "./managed-host-secrets.mjs";
+import { realpathSync } from "node:fs";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { spawn, spawnSync } from "./background-process.mjs";
+import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import {
@@ -17,8 +19,6 @@ import { registerRightAppsRelease } from "./rightapps-register.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 
 export const RUNTIME_ARTIFACT_TRUSTED_KEY_ID = "rightkit-runtime-artifacts-2026-07";
-const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
-const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
 
 export class RuntimeArtifactPromotionError extends Error {
   constructor(code, message) {
@@ -52,8 +52,8 @@ export async function promoteRuntimeArtifact(input, deps = {}) {
   if (!input.privateKey) throw new Error("runtime artifact signing key is required");
 
   const [artifact, evidence] = await Promise.all([
-    metadata(input.artifactFile),
-    metadata(input.evidenceFile),
+    metadata(input.artifactFile, config.artifact),
+    metadata(input.evidenceFile, config.evidence),
   ]);
   assertMetadata(artifact, config.artifact, "artifact");
   if (evidence.sha256 !== config.evidence.sha256) throw new Error("evidence SHA-256 does not match promotion config");
@@ -84,6 +84,7 @@ export async function promoteRuntimeArtifact(input, deps = {}) {
       file: input.artifactFile,
       key: manifest.object.r2Key,
       lane: manifest.distribution.delivery,
+      evidence: { sha256: artifact.sha256, sizeBytes: artifact.sizeBytes },
     });
   }
   await register(envelope);
@@ -104,6 +105,7 @@ export function defaultWindowsRuntimeArtifactSigningKeyFile(env = process.env) {
 }
 
 export async function loadRuntimeArtifactSigningKey({ env = process.env, platform = process.platform, explicitFile } = {}) {
+  refuseManagedEnvSecrets(env, ["RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY", "RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE"]);
   const direct = env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY;
   if (direct?.trim()) return direct.replace(/\\n/g, "\n");
   const configuredFile = explicitFile || env.RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE;
@@ -140,7 +142,9 @@ async function main() {
       sizeBytes: raw.artifact.sizeBytes,
     },
     evidence: { sha256: raw.evidence.sha256 },
-    manifest: raw.manifest,
+    manifest: args.artifactId === undefined
+      ? raw.manifest
+      : { ...raw.manifest, artifactId: args.artifactId },
   };
   assertPromotionConfig(config);
   assertPromotionAuthority(args.authority, config.manifest.entitlement?.appKey);
@@ -187,6 +191,7 @@ artifact.sizeBytes, and evidence.sha256 must exactly match those files.
 
 Options:
   --dry-run                 Validate real files and sign, without R2 or RightApps mutations
+  --artifact-id <slug>      Override manifest.artifactId for this promotion
   --signing-key-file <pem>  Override the protected PEM path
   --key-id <id>             Must equal ${RUNTIME_ARTIFACT_TRUSTED_KEY_ID}
 
@@ -206,11 +211,13 @@ function parseArgs(args) {
   let config = "";
   let signingKeyFile;
   let keyId = process.env.RIGHTKIT_RUNTIME_ARTIFACT_KEY_ID || RUNTIME_ARTIFACT_TRUSTED_KEY_ID;
+  let artifactId;
   let dryRun = false;
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (arg === "--authority") authority = args[++i] ?? "";
     else if (arg === "--config") config = args[++i] ?? "";
+    else if (arg === "--artifact-id") artifactId = args[++i] ?? "";
     else if (arg === "--signing-key-file") signingKeyFile = args[++i] ?? "";
     else if (arg === "--key-id") keyId = args[++i] ?? "";
     else if (arg === "--dry-run") dryRun = true;
@@ -218,7 +225,7 @@ function parseArgs(args) {
   }
   if (!config) throw new Error("model promote requires --config <path>");
   if (!authority) throw new Error("model promote requires --authority <app-key>");
-  return { authority, config, signingKeyFile, keyId, dryRun };
+  return { authority, config, signingKeyFile, keyId, artifactId, dryRun };
 }
 
 function readVerificationEvidence(args, cwd) {
@@ -234,28 +241,22 @@ function git(cwd, args) {
   return result.stdout.trim();
 }
 
-async function fileMetadata(file) {
-  const info = await stat(file);
-  if (!info.isFile() || info.size <= 0) throw new Error(`promotion input is not a nonempty file: ${file}`);
-  const hash = createHash("sha256");
-  await new Promise((resolve, reject) => {
-    const stream = createReadStream(file);
-    stream.on("data", (chunk) => hash.update(chunk));
-    stream.on("error", reject);
-    stream.on("end", resolve);
-  });
-  return { sha256: hash.digest("hex"), sizeBytes: info.size };
+async function fileMetadata(file, evidence) {
+  const artifact = verifyArtifactFile(file, evidence);
+  if (artifact.sizeBytes <= 0) throw new Error(`promotion input is not a nonempty file: ${file}`);
+  return artifact;
 }
 
-async function defaultUpload({ file, content, key, lane }) {
+export async function defaultUpload({ file, content, key, lane, evidence }, deps = {}) {
   const bucketAlias = lane === "private-r2" ? "private" : "public";
   const env = runtimeArtifactUploadEnv();
-  if (file) return run(process.execPath, [UPLOAD, file, key, bucketAlias], env);
+  if (file) return uploadVerifiedR2File(file, evidence, key, bucketAlias, { ...deps, env });
   const tempRoot = await mkdtemp(path.join(os.tmpdir(), "rightkit-runtime-pointer-"));
   const pointerFile = path.join(tempRoot, "manifest.json");
   try {
-    await writeFile(pointerFile, content, { encoding: "utf8", mode: 0o600 });
-    await run(process.execPath, [UPLOAD, pointerFile, key, bucketAlias], env);
+    const bytes = Buffer.from(content);
+    await writeFile(pointerFile, bytes, { mode: 0o600 });
+    uploadVerifiedR2Artifact(readVerifiedArtifact(pointerFile, { sha256: digestBytes(bytes) }), key, bucketAlias, { ...deps, env });
   } finally {
     await rm(tempRoot, { recursive: true, force: true });
   }
@@ -265,14 +266,6 @@ async function registerRuntimeArtifact(envelope, releaseToken) {
   return registerRightAppsRelease("/v1/admin/apps/runtime-artifacts", envelope, { token: releaseToken });
 }
 
-function run(command, args, env = process.env) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { cwd: process.cwd(), env, stdio: "inherit", windowsHide: true });
-    child.on("error", reject);
-    child.on("exit", (code) => code === 0 ? resolve() : reject(new Error(`${command} exited ${code}`)));
-  });
-}
-
 async function readNonemptySecret(file) {
   const value = await readFile(file, "utf8");
   if (!value.trim()) throw new Error(`runtime artifact signing key file is empty: ${file}`);
@@ -285,7 +278,7 @@ function assertPromotionConfig(value) {
   assertExactKeys(value.evidence, ["sha256"], "evidence");
   assertExactKeys(value.manifest, [
     "artifactKind", "entitlement", "distribution", "target", "versions", "provenance", "promotion",
-  ], "manifest config");
+  ], "manifest config", ["artifactId"]);
   assertExactKeys(value.manifest.promotion, ["promotionId", "promotedAt"], "manifest config promotion");
 }
 
@@ -294,14 +287,15 @@ function assertMetadata(actual, expected, label) {
   if (actual.sizeBytes !== expected.sizeBytes) throw new Error(`${label} size does not match promotion config`);
 }
 
-function assertExactKeys(value, expected, label) {
+function assertExactKeys(value, expected, label, optional = []) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-  const allowed = new Set(expected);
+  const allowed = new Set([...expected, ...optional]);
   for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`${label} has unknown field ${key}`);
   for (const key of expected) if (!Object.hasOwn(value, key)) throw new Error(`${label}.${key} is required`);
 }
 
-if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   main().catch((error) => {
     console.error(`right-release model promote: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
     process.exitCode = 1;

package/notarize-macos.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 import { existsSync } from "node:fs";
 import path from "node:path";
-import { notarytoolAuthArgs } from "./notary-auth.mjs";
 import { notarizeMacosArtifact } from "./macos-notarization.mjs";
 
 const args = process.argv.slice(2);
@@ -24,10 +23,11 @@ if (dryRun) {
 if (process.platform !== "darwin") fail("macOS notarization must run on macOS");
 if (!existsSync(archive)) fail(`missing archive: ${archive}`);
 
-let authArgs;
-try { authArgs = notarytoolAuthArgs({ profile }); } catch (error) { fail(error.message); }
-try { notarizeMacosArtifact({ archive, receiptPath, authArgs, app }); }
-catch (error) { fail(error.message); }
+try { notarizeMacosArtifact({ archive, receiptPath, profile, app }); }
+catch (error) {
+  if (error.report) console.error(JSON.stringify(error.report));
+  fail(`${error.code ? `[${error.code}] ` : ""}${error.message}`);
+}
 
 function fail(message) {
   console.error(`right-notarize-macos: ${message}`);

package/notary-auth.mjs

@@ -1,5 +1,6 @@
 import os from "node:os";
 import path from "node:path";
+import { refuseManagedEnvSecrets } from "./managed-host-secrets.mjs";
 
 export function notarytoolAuthArgs({ profile, env = process.env } = {}) {
   // A configured profile explicitly selects Keychain authentication. Inherited
@@ -10,6 +11,9 @@ export function notarytoolAuthArgs({ profile, env = process.env } = {}) {
     }
     return ["--keychain-profile", profile.trim()];
   }
+  // Env-selected App Store Connect API auth is refused on managed hosts; the
+  // provisioned Keychain profile is the only automatic source there.
+  refuseManagedEnvSecrets(env, ["APPLE_API_KEY_PATH", "APPLE_API_KEY", "APPLE_API_ISSUER"]);
   const keyPath = env.APPLE_API_KEY_PATH?.trim();
   const keyId = env.APPLE_API_KEY?.trim();
   const issuer = env.APPLE_API_ISSUER?.trim();

package/osascript-guard.mjs

@@ -0,0 +1,24 @@
+import { realpathSync } from "node:fs";
+import { spawnSync } from "./background-process.mjs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export function automationDenied({ parentPid = process.ppid, run = spawnSync, caller: declaredCaller } = {}) {
+  const result = declaredCaller ? {} : run("/bin/ps", ["-p", String(parentPid), "-o", "command="], {
+    encoding: "utf8", timeout: 1000, shell: false,
+  });
+  const caller = declaredCaller || result.status === 0 && result.stdout?.trim() || `PID ${parentPid}`;
+  const error = new Error(`osascript blocked for caller ${caller}; use right-release dmg build for headless layout`);
+  error.code = "MAC_AUTOMATION_DENIED";
+  error.caller = caller;
+  error.parentPid = parentPid;
+  return error;
+}
+
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
+  const error = automationDenied({ caller: process.argv[2] === "--caller" ? process.argv[3] : undefined });
+  console.error(JSON.stringify({ event: "mac-automation-denied", code: error.code, caller: error.caller,
+    parentPid: error.parentPid, message: error.message }));
+  process.exitCode = 125;
+}

package/ownership-approval-command.mjs

@@ -1,16 +1,26 @@
 #!/usr/bin/env node
 // Draft/import/verify utilities. Signing is intentionally absent; native prompts own signing.
-import { readFileSync, writeFileSync } from "node:fs";
+import { readFileSync, writeFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { createDraft, loadTrustedExternal, verifyException } from "./ownership-approval.mjs";
+import { createDraft, loadTrustedExternal, policyEntryDigest, validateRecord, verifyException } from "./ownership-approval.mjs";
+import { SCANNER_VERSION } from "./ownership.mjs";
+import manifest from "./rightkit-ownership.json" with { type: "json" };
 
 function arg(args, name) { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; }
 function json(file) { return JSON.parse(readFileSync(path.resolve(file), "utf8")); }
+export function createInstalledDraft(input, { catalog = manifest, scannerVersion = SCANNER_VERSION, now = new Date() } = {}) {
+  const draft = createDraft({ ...input, issued: now.toISOString().slice(0, 10), policyDigest: policyEntryDigest(catalog, input.fingerprint), minimumScannerVersion: scannerVersion, minimumCatalogVersion: catalog.version ?? String(catalog.schema) });
+  const problems = validateRecord(draft);
+  const duration = Date.parse(draft.payload.expires) - Date.parse(draft.payload.issued);
+  if (!(duration > 0 && duration <= 90 * 86400000)) problems.push("draft expiry must be after issued and within 90 days");
+  if (problems.length) throw new Error(problems.join("; "));
+  return draft;
+}
 export function main(args) {
   if (args.includes("--draft")) {
     const input = json(arg(args, "--draft"));
-    const draft = createDraft(input);
+    const draft = createInstalledDraft(input);
     const out = arg(args, "--out");
     const data = `${JSON.stringify(draft, null, 2)}\n`;
     if (out) writeFileSync(path.resolve(out), data, { flag: "wx" }); else process.stdout.write(data);
@@ -33,7 +43,8 @@ export function main(args) {
   }
   throw new Error("usage: node ownership-approval-command.mjs --draft input.json [--out draft.json] | --import signed.json --out record.json | --verify signed.json --context scan.json");
 }
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   try { process.exitCode = main(process.argv.slice(2)); }
   catch (error) { console.error(`[right-release] ownership approval: ${error.message}`); process.exitCode = 1; }
 }