@rightkit/release 0.2.135 → 0.2.136

package/ownership-repositories.json

@@ -0,0 +1,19 @@
+{
+  "schema": 1,
+  "repositories": [
+    { "repositoryIdentity": "https://github.com/bogusyogi/coderight", "roots": ["."], "visibility": "private" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/cutright", "roots": ["."], "visibility": "private" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/genright", "roots": ["."], "visibility": "private" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/heardright", "roots": ["."], "visibility": "private" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/mailright", "roots": ["."], "visibility": "private" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/rightsites", "roots": ["."], "visibility": "private" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/scraperight", "roots": ["."], "visibility": "private" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/viewright", "roots": ["."], "visibility": "private" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/voiceright", "roots": ["."], "visibility": "private" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/postright", "roots": ["."], "visibility": "private" },
+    { "repositoryIdentity": "https://github.com/orthic-labs/cockpit", "roots": ["."], "visibility": "public" },
+    { "repositoryIdentity": "https://github.com/orthic-labs/legion", "roots": ["."], "visibility": "public" },
+    { "repositoryIdentity": "https://github.com/bogusyogi/workright", "roots": ["."], "visibility": "private" },
+    { "repositoryIdentity": "https://github.com/orthic-labs/sellright", "roots": ["."], "visibility": "public" }
+  ]
+}

package/ownership-scan-worker.mjs

@@ -1,15 +1,100 @@
 #!/usr/bin/env node
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
+import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { checkApp } from "./ownership.mjs";
-
-try {
-  const [appRoot, manifestPath] = process.argv.slice(2);
-  if (!appRoot || !manifestPath) throw new TypeError("app root and catalog path are required");
-  const report = checkApp(path.resolve(appRoot), JSON.parse(readFileSync(path.resolve(manifestPath), "utf8")));
-  process.stdout.write(`${JSON.stringify(report)}\n`);
-} catch (error) {
-  process.stderr.write(`${error.message}\n`);
-  process.exitCode = 1;
+import { spawnSync } from "./background-process.mjs";
+import { catalogDigest, contentInventory, MANIFEST_FILE, SCANNER_VERSION } from "./ownership.mjs";
+import { createOwnershipEvidence, createOwnershipEvidenceForTest } from "./ownership-evidence.mjs";
+import { canonicalRepositoryIdentity, loadTrustedExternal, sha256 } from "./ownership-approval.mjs";
+import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
+import { ownershipCacheKey, ownershipVerdict } from "./ownership-verdict.mjs";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const catalogPath = path.join(here, MANIFEST_FILE);
+const MODULE_SPECIFIERS = /^\s*(?:import|export)\s[^'";]*?from\s*['"]([^'"]+)['"]|^\s*import\s*['"]([^'"]+)['"]/gm;
+function scannerPolicyDigest() {
+  const files = new Map(), queue = [fileURLToPath(import.meta.url)];
+  while (queue.length) {
+    const file = queue.shift(); if (files.has(file)) continue;
+    const bytes = readFileSync(file); files.set(file, sha256(bytes));
+    for (const match of bytes.toString("utf8").matchAll(MODULE_SPECIFIERS)) {
+      const specifier = match[1] ?? match[2];
+      if (specifier.startsWith("node:")) continue;
+      queue.push(specifier.startsWith(".") ? createRequire(file).resolve(specifier) : fileURLToPath(import.meta.resolve(specifier)));
+    }
+  }
+  return sha256({ version: SCANNER_VERSION, files: [...files].map(([file, digest]) => ({ path: path.relative(here, file).replaceAll("\\", "/"), digest })).sort((a, b) => a.path.localeCompare(b.path)) });
+}
+
+function scanInputs(appRoot, { manifestPath = catalogPath, trustLoader = loadTrustedExternal, inventory = contentInventory, gitRunner = spawnSync, policyDigest = scannerPolicyDigest } = {}) {
+  const root = path.resolve(appRoot), manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  const state = trustLoader();
+  if (state.protection?.ok !== true && !(state.pending === true && state.enrolled === false && state.trust === null && state.protection?.reason === "external trust file is absent"))
+    throw Object.assign(new Error("protected ownership trust location was not verified"), { code: "RK_OWNERSHIP_INVALID_INPUTS" });
+  let trust = state.trust, keyLogDigest = null;
+  if (trust?.keyAuthority) {
+    const resolved = readCommittedKeyAuthority(trust);
+    if (!resolved.ok) throw Object.assign(new Error(resolved.problems.join("; ")), { code: "RK_OWNERSHIP_INVALID_INPUTS" });
+    trust = resolved.resolvedTrust; keyLogDigest = resolved.digest;
+  }
+  const origin = gitRunner("git", ["-C", root, "remote", "get-url", "origin"], { encoding: "utf8", windowsHide: true, timeout: 2500 });
+  let repositoryIdentity = null;
+  try { if (origin?.status === 0) repositoryIdentity = canonicalRepositoryIdentity(String(origin.stdout).trim()); } catch {}
+  const source = inventory(root);
+  if (typeof source.complete !== "boolean" || !Array.isArray(source.coverage) || source.complete !== (source.coverage.length === 0))
+    throw Object.assign(new Error("ownership content inventory completeness is missing or malformed"), { code: "RK_OWNERSHIP_INVALID_INPUTS" });
+  const roots = trust?.repositories?.find((entry) => entry.repositoryIdentity === repositoryIdentity)?.roots ?? ["."];
+  const approvals = roots.map((registered) => {
+    const file = path.join(root, ...(registered === "." ? [] : registered.split("/")), ".rightkit", "ownership-exceptions.json");
+    try { return { root: registered, digest: sha256(readFileSync(file)) }; }
+    catch (error) { if (error.code !== "ENOENT") throw error; return { root: registered, digest: sha256({ absent: true }) }; }
+  });
+  const inputs = {
+    contentDigest: source.digest, catalogDigest: catalogDigest(manifest),
+    trustDigest: sha256({ trust, repositoryIdentity, enrolled: state.enrolled, pending: state.pending, keyLogDigest }),
+    approvalsDigest: sha256(approvals), scannerPolicyDigest: policyDigest(),
+    protectedFloors: { minimumScannerVersion: trust?.minimumScannerVersion ?? null, minimumCatalogVersion: trust?.minimumCatalogVersion ?? null, minimumCatalogDigest: trust?.minimumCatalogDigest ?? null },
+  };
+  ownershipCacheKey(inputs);
+  return { inputs, trust, complete: source.complete, enrollmentPending: trust?.enrollmentComplete === false || state.enrolled !== true || state.pending === true,
+    metadata: { repositoryIdentity, scannerVersion: SCANNER_VERSION, catalogVersion: manifest.version ?? String(manifest.schema ?? "1"), catalogDigest: inputs.catalogDigest, coverage: source.coverage, roots: roots.map((registered) => ({ root: registered })) } };
+}
+
+export function ownershipScanInputs(appRoot) { return scanInputs(appRoot); }
+export function ownershipScanInputsForTest(appRoot, options) { return scanInputs(appRoot, options); }
+
+function scanProtected(appRoot, options, createEvidence) {
+  const before = scanInputs(appRoot, options);
+  const preliminary = { ok: true, enrollmentPending: before.enrollmentPending, violations: [], problems: [], coverage: before.metadata.coverage, metadata: before.metadata };
+  const preflight = ownershipVerdict(preliminary, before.trust);
+  if (!preflight.admit && preflight.code !== "RK_OWNERSHIP_PENDING_ENROLLMENT") return { ...before, report: { ...preliminary, ok: false }, verdict: preflight };
+  let checked;
+  try { checked = createEvidence(); }
+  catch (error) {
+    if (preflight.code !== "RK_OWNERSHIP_PENDING_ENROLLMENT") throw error;
+    const report = { ...preliminary, ok: false, problems: [error.message] };
+    return { ...before, report, verdict: ownershipVerdict(report, before.trust) };
+  }
+  const report = JSON.parse(JSON.stringify({ ...checked.result, ok: checked.ok, enrollmentPending: checked.enrollmentPending === true,
+    metadata: { ...checked.result.metadata, scannerVersion: checked.evidence.scannerVersion, catalogVersion: checked.evidence.catalogVersion } }));
+  const verdict = ownershipVerdict(report, before.trust);
+  const after = scanInputs(appRoot, options);
+  if (ownershipCacheKey(before.inputs) !== ownershipCacheKey(after.inputs) || before.complete !== after.complete || sha256(before.metadata.coverage) !== sha256(after.metadata.coverage))
+    return { error: "ownership inputs changed during protected evidence scan", code: "RK_OWNERSHIP_INPUTS_CHANGED" };
+  return { inputs: after.inputs, trust: after.trust, report, verdict, evidence: checked.evidence };
+}
+
+export function scanOwnership(appRoot) { return scanProtected(appRoot, {}, () => createOwnershipEvidence(appRoot)); }
+export function scanOwnershipForTest(appRoot, options) { return scanProtected(appRoot, options, () => createOwnershipEvidenceForTest(appRoot, options)); }
+
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
+  try {
+    const [appRoot, manifestPath, mode] = process.argv.slice(2);
+    if (!appRoot || !manifestPath || path.resolve(manifestPath) !== catalogPath || mode && mode !== "--inputs") throw new TypeError("app root & installed protected catalog path are required");
+    process.stdout.write(JSON.stringify(mode === "--inputs" ? ownershipScanInputs(path.resolve(appRoot)) : scanOwnership(path.resolve(appRoot))) + "\n");
+  } catch (error) {
+    process.stdout.write(JSON.stringify({ error: error.message, code: error.code?.startsWith("RK_OWNERSHIP_") ? error.code : "RK_OWNERSHIP_UNVERIFIED" }) + "\n");
+  }
 }

package/ownership-source.mjs

@@ -0,0 +1,39 @@
+// Code-only patterns may consume string arguments, but must start outside
+// literals/comments. Keep offsets/newlines intact for multiline call reporting.
+export function sourceNonCode(text, rust) {
+  const nonCode = new Uint8Array(text.length);
+  for (let i = 0; i < text.length;) {
+    const start = i;
+    if (text.startsWith("//", i) || text.startsWith("/*", i)) {
+      if (text[i + 1] === "/") {
+        i = text.indexOf("\n", i + 2);
+        if (i === -1) i = text.length;
+      } else {
+        i += 2;
+        let depth = 1;
+        while (i < text.length && depth) {
+          if (rust && text.startsWith("/*", i)) { depth++; i += 2; }
+          else if (text.startsWith("*/", i)) { depth--; i += 2; }
+          else i++;
+        }
+      }
+      nonCode.fill(1, start, i);
+      continue;
+    }
+    const raw = rust && (i === 0 || !/[\w]/.test(text[i - 1])) && /^(?:br|cr|r)(#*)"/.exec(text.slice(i));
+    if (raw) {
+      const closing = `"${raw[1]}`, end = text.indexOf(closing, i + raw[0].length);
+      i = end === -1 ? text.length : end + closing.length;
+    } else if (text[i] === '"' || (!rust && (text[i] === "'" || text[i] === "`")) ||
+      (rust && text[i] === "'" && /^'(?:\\(?:u\{[\da-fA-F]+\}|x[\da-fA-F]{2}|[^\r\n])|[^'\\\r\n])'/.test(text.slice(i)))) {
+      const quote = text[i++];
+      while (i < text.length) {
+        if (text[i] === "\\") i = Math.min(i + 2, text.length);
+        else if (text[i++] === quote) break;
+      }
+    } else { i++; continue; }
+    nonCode.fill(1, start, i);
+  }
+  return nonCode;
+}
+

package/ownership-staged.mjs

@@ -0,0 +1,193 @@
+// Advisory pre-commit ownership gate: scans the STAGED tree (index content), never the working tree.
+// Authoritative enforcement stays in broker admission and the release gate.
+//
+//   right-release ownership --staged [--app <dir>] [--json]
+//
+// Block-tier findings without a valid exception fail the gate. Advise-tier findings print a
+// summary and pass. A new Cargo.toml/package.json whose name or description matches a catalog
+// capability keyword is advised unless it declares that capability's owner package.
+import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse as parseToml } from "smol-toml";
+import { spawnSync } from "./background-process.mjs";
+import { checkApp, MANIFEST_FILE } from "./ownership.mjs";
+import { isBlockingFinding } from "./ownership-verdict.mjs";
+
+const releaseRoot = path.dirname(fileURLToPath(import.meta.url));
+export const DEFAULT_MANIFEST = path.join(releaseRoot, MANIFEST_FILE);
+const NEW_MANIFEST_NAMES = new Set(["Cargo.toml", "package.json"]);
+
+const cleanEnv = () => Object.fromEntries(Object.entries(process.env).filter(([key]) => !/^GIT_/i.test(key)));
+
+function git(cwd, args, { env = cleanEnv(), encoding = "buffer" } = {}) {
+  const result = spawnSync("git", ["-C", cwd, ...args], { encoding, env, maxBuffer: 512 * 1024 * 1024, windowsHide: true });
+  if (result?.error || result?.status !== 0) {
+    throw new Error(`git ${args[0]} failed${result?.stderr ? `: ${String(result.stderr).trim().slice(0, 200)}` : ""}`);
+  }
+  return result.stdout;
+}
+
+/** Repository top-level for a directory, or a thrown error when it is not a Git worktree. */
+export function repositoryRootFor(dir) {
+  return realpathSync(String(git(path.resolve(dir), ["rev-parse", "--show-toplevel"], { encoding: "utf8" })).trim());
+}
+
+/** Staged index path for this repository; honors GIT_INDEX_FILE so pre-commit hooks see the real index. */
+function stagedIndex(repoRoot) {
+  if (process.env.GIT_INDEX_FILE) return path.resolve(repoRoot, process.env.GIT_INDEX_FILE);
+  return path.resolve(repoRoot, String(git(repoRoot, ["rev-parse", "--git-path", "index"], { encoding: "utf8" })).trim());
+}
+
+function stagedEnv(repoRoot) {
+  return { ...cleanEnv(), GIT_INDEX_FILE: stagedIndex(repoRoot) };
+}
+
+/**
+ * Materialize the staged index into a throwaway worktree. The temporary repository borrows the
+ * real object store through alternates, so blobs are the exact staged bytes. The real HEAD,
+ * index, and working tree are never written.
+ */
+export function materializeStagedTree(repoRoot) {
+  const root = realpathSync(repoRoot);
+  const workdir = mkdtempSync(path.join(os.tmpdir(), "rightkit-staged-"));
+  const tree = path.join(workdir, "tree");
+  try {
+    mkdirSync(tree);
+    const init = spawnSync("git", ["init", "-q", tree], { env: cleanEnv(), windowsHide: true, encoding: "utf8" });
+    if (init.status !== 0) throw new Error("git init failed for staged scan");
+    const objects = path.resolve(root, String(git(root, ["rev-parse", "--git-path", "objects"], { encoding: "utf8" })).trim());
+    writeFileSync(path.join(tree, ".git", "objects", "info", "alternates"), `${objects}\n`);
+    copyFileSync(stagedIndex(root), path.join(tree, ".git", "index"));
+    const origin = spawnSync("git", ["-C", root, "config", "--get", "remote.origin.url"], { env: cleanEnv(), windowsHide: true, encoding: "utf8" });
+    if (origin.status === 0 && origin.stdout.trim()) git(tree, ["config", "remote.origin.url", origin.stdout.trim()], { encoding: "utf8" });
+    git(tree, ["-c", "core.autocrlf=false", "-c", "core.eol=lf", "checkout-index", "-a", "-f"], { encoding: "utf8" });
+    return { tree, cleanup: () => rmSync(workdir, { recursive: true, force: true }) };
+  } catch (error) {
+    rmSync(workdir, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/** Keyword index from the catalog: each capability id matches its hyphen, space, or underscore spellings. */
+export function capabilityKeywords(manifest) {
+  const byCapability = new Map();
+  for (const entry of manifest.capabilities ?? []) {
+    if (!byCapability.has(entry.capability)) byCapability.set(entry.capability, new Set());
+    byCapability.get(entry.capability).add(entry.package);
+  }
+  return [...byCapability].map(([capability, owners]) => ({
+    capability,
+    owners: [...owners],
+    pattern: new RegExp(`(?<![a-z0-9])${escapeRegExp(capability).replace(/-/g, "[-_ ]")}(?![a-z0-9])`, "i"),
+  }));
+}
+
+function manifestIdentity(file, bytes) {
+  const text = bytes.toString("utf8");
+  if (path.posix.basename(file) === "Cargo.toml") {
+    const parsed = parseToml(text);
+    const dependencyTables = [parsed.dependencies, parsed["dev-dependencies"], parsed["build-dependencies"], parsed.workspace?.dependencies];
+    for (const target of Object.values(parsed.target ?? {})) dependencyTables.push(target.dependencies, target["dev-dependencies"], target["build-dependencies"]);
+    const declared = new Set();
+    for (const table of dependencyTables) for (const [key, value] of Object.entries(table ?? {})) {
+      declared.add(key);
+      if (value && typeof value === "object" && typeof value.package === "string") declared.add(value.package);
+    }
+    return { name: parsed.package?.name ?? "", description: parsed.package?.description ?? "", declared };
+  }
+  const parsed = JSON.parse(text);
+  const declared = new Set();
+  for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) for (const key of Object.keys(parsed[field] ?? {})) declared.add(key);
+  return { name: parsed.name ?? "", description: parsed.description ?? "", declared };
+}
+
+/** Advisory: new staged manifests whose name/description mention a capability without declaring its owner. */
+export function newManifestAdvisories(repoRoot, manifest, { env = stagedEnv(repoRoot) } = {}) {
+  const added = git(repoRoot, ["diff", "--cached", "--name-only", "--diff-filter=A", "-z"], { env })
+    .toString("utf8").split("\0").filter(Boolean)
+    .filter((file) => NEW_MANIFEST_NAMES.has(path.posix.basename(file)));
+  const keywords = capabilityKeywords(manifest);
+  const advisories = [];
+  for (const file of added) {
+    let identity;
+    try { identity = manifestIdentity(file, git(repoRoot, ["show", `:${file}`], { env })); }
+    catch (error) { advisories.push({ file, capability: null, message: `could not parse staged manifest: ${error.message}` }); continue; }
+    const text = `${identity.name}\n${identity.description}`;
+    for (const { capability, owners, pattern } of keywords) {
+      if (!pattern.test(text)) continue;
+      if (owners.includes(identity.name)) continue;
+      if (owners.some((owner) => identity.declared.has(owner))) continue;
+      advisories.push({ file, capability, owners, message: `new manifest ${file} matches capability "${capability}" without declaring its owner (${owners.join(", ")}); use the RightKit owner or declare it` });
+    }
+  }
+  return advisories;
+}
+
+/**
+ * Scan the staged tree. `scan` and `trust` are injectable for fixtures; production loads the
+ * protected trust registry through the scanner itself.
+ */
+export function scanStaged(repoRoot, { manifest, scan = checkApp, trust, materialize = materializeStagedTree } = {}) {
+  const root = realpathSync(repoRoot);
+  const resolvedManifest = manifest ?? JSON.parse(readFileSync(DEFAULT_MANIFEST, "utf8"));
+  const staged = materialize(root);
+  let result;
+  // Hooks export GIT_DIR/GIT_INDEX_FILE; the scanner's own Git calls must address the staged copy only.
+  const saved = Object.fromEntries(Object.entries(process.env).filter(([key]) => /^GIT_/i.test(key)));
+  for (const key of Object.keys(saved)) delete process.env[key];
+  try {
+    result = scan(staged.tree, resolvedManifest, trust === undefined ? {} : { trust });
+  } finally {
+    Object.assign(process.env, saved);
+    staged.cleanup();
+  }
+  const blocking = result.violations.filter(isBlockingFinding);
+  const advisory = result.violations.filter((finding) => !isBlockingFinding(finding));
+  const keywords = newManifestAdvisories(root, resolvedManifest);
+  return {
+    ok: blocking.length === 0,
+    blocking,
+    advisory,
+    keywords,
+    problems: result.problems ?? [],
+    warnings: result.warnings ?? [],
+    coverage: result.coverage ?? [],
+    enrollmentPending: result.enrollmentPending === true,
+    covered: result.covered?.length ?? 0,
+  };
+}
+
+export function formatStagedReport(result) {
+  const lines = [];
+  for (const finding of result.blocking) lines.push(`  BLOCK ${finding.fingerprint} (${finding.package}) ${finding.file}${finding.line ? `:${finding.line}` : ""}  ${finding.text ?? ""}`);
+  for (const finding of result.advisory) lines.push(`  advise ${finding.fingerprint} (${finding.package}) ${finding.file}${finding.line ? `:${finding.line}` : ""}`);
+  for (const item of result.keywords) lines.push(`  advise ${item.message}`);
+  for (const problem of result.problems) lines.push(`  note ${problem}`);
+  for (const warning of result.warnings) lines.push(`  note ${warning}`);
+  if (result.coverage.length) lines.push(`  note ${result.coverage.length} staged path(s) unscanned by the gate; broker admission remains authoritative`);
+  const summary = `[right-release] staged ownership: ${result.blocking.length} block, ${result.advisory.length} advise, ${result.keywords.length} new-manifest advisory, ${result.covered} excepted`;
+  lines.push(result.ok ? `${summary}; passed` : `${summary}; FAILED: block-tier findings need an owner integration or a valid exception`);
+  return lines.join("\n");
+}
+
+/** CLI entry used by `right-release ownership --staged`. Returns the process exit code. */
+export function main(args, { print = (line) => console.log(line), scanner = scanStaged } = {}) {
+  const flag = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : undefined; };
+  let repoRoot;
+  try { repoRoot = repositoryRootFor(flag("--app") ?? process.cwd()); }
+  catch { print("[right-release] ownership --staged FAILED: not inside a Git repository"); return 1; }
+  let result;
+  try { result = scanner(repoRoot); }
+  catch (error) {
+    if (args.includes("--json")) print(JSON.stringify({ ok: false, error: { type: "staged-scan", message: error.message } }, null, 2));
+    else print(`[right-release] ownership --staged FAILED: ${error.message}`);
+    return 1;
+  }
+  if (args.includes("--json")) print(JSON.stringify({ ok: result.ok, blocking: result.blocking, advisory: result.advisory, keywords: result.keywords, problems: result.problems, coverage: result.coverage, enrollmentPending: result.enrollmentPending }, null, 2));
+  else print(formatStagedReport(result));
+  return result.ok ? 0 : 1;
+}

package/ownership-verdict.mjs

@@ -0,0 +1,74 @@
+import { sha256, validateOwnershipFloor, verifyRepositoryRegistration } from "./ownership-approval.mjs";
+
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+const text = (value) => typeof value === "string" && value.length > 0;
+const digest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+const fields = (value, required, optional = {}) => object(value) && Object.keys(value).every((key) => Object.hasOwn(required, key) || Object.hasOwn(optional, key))
+  && Object.entries(required).every(([key, check]) => Object.hasOwn(value, key) && check(value[key]))
+  && Object.entries(optional).every(([key, check]) => !Object.hasOwn(value, key) || check(value[key]));
+const strings = (value) => Array.isArray(value) && value.every(text);
+const nullableText = (value) => value === null || text(value);
+const string = (value) => typeof value === "string";
+const boolean = (value) => typeof value === "boolean";
+const ordinal = (value) => Number.isSafeInteger(value) && value >= 0;
+const version = (value) => text(value) && /^\d+(?:\.\d+)*$/.test(value);
+const coverage = (value) => Array.isArray(value) && value.every((entry) => fields(entry, { path: text, status: text, reason: text }, { detail: text }));
+const finding = (value, extra = {}) => fields(value, { fingerprint: text, capability: text, package: text, file: text, line: ordinal }, {
+  kind: (v) => ["source", "dependency", "transitive-dependency"].includes(v), lineText: string, ordinal, text: string, occurrenceHash: digest,
+  lockfile: text, dependencyPath: (v) => strings(v) && v.length >= 3,
+  ecosystem: text, name: text, alias: nullableText, section: text, requirement: nullableText, features: strings,
+  defaultFeatures: (v) => v === null || boolean(v), source: nullableText, resolvedVersion: nullableText, local: boolean, provenance: nullableText, tier: (v) => ["block", "advise"].includes(v), policy: text, ...extra,
+}) && (value.kind !== "transitive-dependency" || text(value.name) && text(value.resolvedVersion) && text(value.source) && strings(value.dependencyPath) && value.dependencyPath.length >= 3 && value.dependencyPath.at(-1) === value.name && value.lockfile === value.file);
+const findings = (value) => Array.isArray(value) && value.every((entry) => finding(entry));
+const provenance = (value, extra = {}) => fields(value, { kind: (v) => ["third-party", "generated"].includes(v), requestId: text, contentDigest: digest }, extra);
+const contentDigests = (value) => Array.isArray(value) && value.every((entry) => fields(entry, { path: text, digest: (v) => digest(v) || typeof v === "string" && /^git:[a-f0-9]{40,64}$/.test(v) }, { provenance }));
+const rows = (value) => Array.isArray(value) && value.every((entry) => fields(entry, { capability: text, owner: text, uses: boolean, status: text, count: ordinal }, { root: text, owners: strings }));
+const metadata = (value) => fields(value, { repositoryIdentity: nullableText, scannerVersion: text, catalogVersion: text, catalogDigest: digest, coverage }, {
+  commit: nullableText, tree: text, host: text, scannedAt: text, contentDigests, pathBase: text, pathPrefix: string,
+  provenance: (v) => Array.isArray(v) && v.every((entry) => provenance(entry, { paths: strings })),
+  exceptionDigest: digest, source: text, keyLogDigest: digest, keyCheckpoint: (v) => fields(v, { sequence: ordinal, head: digest }), rootFingerprint: digest,
+  keyAuthority: (v) => fields(v, { repositoryIdentity: text, commit: text, tree: text }),
+  roots: (v) => Array.isArray(v) && v.every((entry) => fields(entry, { root: text }, { metadata })),
+});
+const validReport = (value) => fields(value, { ok: (v) => typeof v === "boolean", enrollmentPending: (v) => typeof v === "boolean", violations: findings, problems: strings, coverage, metadata }, {
+  findings, covered: (v) => Array.isArray(v) && v.every((entry) => finding(entry, { exception: object })), rows, warnings: strings, warning: text,
+});
+/** Only `block`-tier or banned findings fail a scan; `advise` findings are reported, never refused. */
+export const isBlockingFinding = (f) => f?.policy === "banned" || f?.tier !== "advise";
+const refuse = (code, problems) => ({ admit: false, code, problems });
+
+/** One fail-closed contract for protected scan workers & broker admission. */
+export function ownershipVerdict(report, trust) {
+  if (!validReport(report)) return refuse("RK_OWNERSHIP_MALFORMED_REPORT", ["ownership report has missing, unknown, or wrong-typed fields"]);
+  if (report.enrollmentPending) return refuse("RK_OWNERSHIP_PENDING_ENROLLMENT", ["protected ownership approval enrollment is pending", ...report.problems]);
+  let registration;
+  try {
+    registration = verifyRepositoryRegistration(trust, report.metadata.repositoryIdentity, { files: [
+      ...report.violations.map((entry) => entry.file), ...(report.findings ?? []).map((entry) => entry.file),
+      ...(report.metadata.contentDigests ?? []).map((entry) => entry.path),
+    ] });
+  } catch { return refuse("RK_OWNERSHIP_INVALID_REGISTRATION", ["protected repository registry is missing or malformed"]); }
+  if (!registration.ok) return refuse("RK_OWNERSHIP_INVALID_REGISTRATION", registration.problems);
+  const scannedRoots = report.metadata.roots?.map((entry) => entry.root) ?? [report.metadata.pathPrefix?.replace(/\/$/, "") || "."];
+  if (new Set(scannedRoots).size !== scannedRoots.length || sha256([...scannedRoots].sort()) !== sha256([...registration.registration.roots].sort()))
+    return refuse("RK_OWNERSHIP_INVALID_REGISTRATION", ["scan roots do not exactly cover protected repository registration"]);
+  const floor = validateOwnershipFloor(trust, report.metadata);
+  if (!floor.ok) return refuse("RK_OWNERSHIP_POLICY_DOWNGRADE", floor.problems);
+  const incomplete = [...report.coverage, ...report.metadata.coverage].filter((entry) => entry.status !== "complete");
+  if (incomplete.length) return refuse("RK_OWNERSHIP_INCOMPLETE_COVERAGE", [...new Set(incomplete.map((entry) => entry.path + ": " + entry.reason))]);
+  const blocking = report.violations.filter(isBlockingFinding);
+  if (blocking.length) return refuse("RK_OWNERSHIP_VIOLATION", blocking.map((entry) => entry.capability + " (" + entry.fingerprint + " in " + entry.file + ") is owned by " + entry.package));
+  if (report.problems.length) return refuse("RK_OWNERSHIP_UNVERIFIED", report.problems);
+  if (!report.ok) return refuse("RK_OWNERSHIP_REPORT_FAILED", ["protected ownership scanner reported ok:false"]);
+  const advisory = report.violations.filter((entry) => !isBlockingFinding(entry));
+  if (advisory.length) return { admit: true, code: "RK_OWNERSHIP_ADVISORY", problems: advisory.map((entry) => entry.capability + " (" + entry.fingerprint + " in " + entry.file + ") is owned by " + entry.package + " [advise]") };
+  return { admit: true, code: "RK_OWNERSHIP_CLEAN", problems: [] };
+}
+
+/** SHA-256 over every required authenticated cache binding; never directory or age. */
+export function ownershipCacheKey(inputs) {
+  if (!fields(inputs, { contentDigest: digest, catalogDigest: digest, trustDigest: digest, approvalsDigest: digest, scannerPolicyDigest: digest,
+    protectedFloors: (value) => fields(value, { minimumScannerVersion: (v) => v === null || version(v), minimumCatalogVersion: (v) => v === null || version(v), minimumCatalogDigest: (v) => v === null || digest(v) }) }))
+    throw Object.assign(new TypeError("ownership cache inputs have missing, unknown, or malformed digest/floor fields"), { code: "RK_OWNERSHIP_INVALID_INPUTS" });
+  return sha256(inputs);
+}