@rightkit/release 0.2.135 → 0.2.137

package/rightkit-ownership.json

@@ -1,7 +1,150 @@
 {
   "schema": 1,
-  "version": "1",
+  "version": "3.0.0",
   "capabilities": [
+    {
+      "package": "agent-room-core",
+      "capability": "agent-room",
+      "summary": "Shared agent room state, events, turns and local HTTP host; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Authenticated human-seat join repair remains P1.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "rightkit-agent-tools",
+      "capability": "agent-tools",
+      "summary": "One typed tool interface for agents over rightkit-automation, rightkit-control, rightkit-browser and each app's engine commands (via rightkit-service), plus the `right-ctl <app> <command>` CLI.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "rightkit-align",
+      "capability": "script-alignment",
+      "summary": "Local script-to-ASR word alignment for Right Suite narration: pronunciation normalisation, edit-distance alignment with per-token lexical and timing confidence, rejection of mismatched and ambiguous anchors, and control-name coverage floors",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: the alignment algorithm is not an ownership fingerprint.",
+        "Consumes rightkit-transcript words; holds no audio, models or I/O."
+      ]
+    },
+    {
+      "package": "rightkit-asr",
+      "capability": "speech-recognition",
+      "summary": "Internal reconciled Parakeet ONNX + Whisper (CoreML / whisper.cpp) decoding runtime for Right Suite applications",
+      "fingerprints": [
+        {
+          "id": "asr.cargo.whisper-rs",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "whisper-rs",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "asr.cargo.whisper-rs-sys",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "whisper-rs-sys",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Internal unpublished crate; Parakeet/Whisper feature qualification required.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-audio",
+      "capability": "audio",
+      "summary": "Shared audio for Right Suite apps: typed FFmpeg filter graphs, loudness gates, room tone, ducking, WAV I/O, and cpal capture with resample/downmix/recovery.",
+      "fingerprints": [
+        {
+          "id": "audio.cargo.cpal",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "cpal",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "audio.cargo.hound",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "hound",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "audio.cargo.rubato",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "rubato",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Capture, WAV I/O & resampling are distinct feature contexts.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-automation",
+      "capability": "desktop-automation",
+      "summary": "Brand-neutral desktop automation: observe and act on any app (macOS AX, Windows UIA) through a four-tier input ladder with safety, focus guard, and evidence receipts.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
     {
       "package": "rightkit-browser",
       "capability": "browser-automation",
@@ -11,73 +154,243 @@
           "id": "browser.cargo.chromiumoxide",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "chromiumoxide"
+          "name": "chromiumoxide",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "browser.cargo.headless_chrome",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "headless_chrome"
+          "name": "headless_chrome",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "browser.cargo.fantoccini",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "fantoccini"
+          "name": "fantoccini",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "browser.cargo.thirtyfour",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "thirtyfour"
+          "name": "thirtyfour",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "browser.npm.puppeteer",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "puppeteer"
+          "name": "puppeteer",
+          "tier": "block",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "Banned by owner policy; use rightkit-browser (Rust) or @rightkit/qa QaPage (raw CDP)",
+          "policy": "banned",
+          "policyAuthority": "Adrian 2026-10-08: no Puppeteer or Playwright anywhere, tests included"
         },
         {
           "id": "browser.npm.puppeteer-core",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "puppeteer-core"
+          "name": "puppeteer-core",
+          "tier": "block",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "Banned by owner policy; use rightkit-browser (Rust) or @rightkit/qa QaPage (raw CDP)",
+          "policy": "banned",
+          "policyAuthority": "Adrian 2026-10-08: no Puppeteer or Playwright anywhere, tests included"
         },
         {
           "id": "browser.npm.playwright-core",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "playwright-core"
+          "name": "playwright-core",
+          "tier": "block",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Browser automation/QA candidate; CDP, assertions, accessibility & native WebDriver parity are unqualified"
+          },
+          "tierReason": "Banned by owner policy; use rightkit-browser (Rust) or @rightkit/qa QaPage (raw CDP)",
+          "policy": "banned",
+          "policyAuthority": "Adrian 2026-10-08: no Puppeteer or Playwright anywhere, tests included"
         },
         {
           "id": "browser.npm.playwright",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "playwright"
+          "name": "playwright",
+          "tier": "block",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Browser automation/QA candidate; CDP, assertions, accessibility & native WebDriver parity are unqualified"
+          },
+          "tierReason": "Banned by owner policy; use rightkit-browser (Rust) or @rightkit/qa QaPage (raw CDP)",
+          "policy": "banned",
+          "policyAuthority": "Adrian 2026-10-08: no Puppeteer or Playwright anywhere, tests included"
         },
         {
           "id": "browser.npm.playwright-test",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "@playwright/test"
+          "name": "@playwright/test",
+          "tier": "block",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Browser automation/QA candidate; CDP, assertions, accessibility & native WebDriver parity are unqualified"
+          },
+          "tierReason": "Banned by owner policy; use rightkit-browser (Rust) or @rightkit/qa QaPage (raw CDP)",
+          "policy": "banned",
+          "policyAuthority": "Adrian 2026-10-08: no Puppeteer or Playwright anywhere, tests included"
         },
         {
           "id": "browser.npm.selenium-webdriver",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "selenium-webdriver"
+          "name": "selenium-webdriver",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Browser automation/QA candidate; CDP, assertions, accessibility & native WebDriver parity are unqualified"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "browser.cargo.webdriver",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "webdriver"
-        },
+          "name": "webdriver",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Browser automation/QA candidate; CDP, assertions, accessibility & native WebDriver parity are unqualified"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "CDP replacement does not establish WebDriver, Playwright assertion or QA feature parity.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-cache",
+      "capability": "disk-cache",
+      "summary": "Disk cache primitive with a hard size cap, LRU eviction that survives restarts, atomic writes and group invalidation, plus stable-prefix prompt-cache keys.",
+      "fingerprints": [
         {
-          "id": "browser.source.chrome-discovery",
-          "type": "source",
-          "pattern": "Google[\\\\/]+Chrome[\\\\/]+Application[\\\\/]+chrome\\.exe|Google Chrome\\.app/Contents/MacOS/Google Chrome"
+          "id": "cache.cargo.cacache",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "cacache",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-channel-memory",
+      "capability": "channel-memory",
+      "summary": "Channel memory schema (channel-memory.v1, pending in tools/rightkit/contracts-pending) with serde types, schema and semantic validation, version gate, authoritative proof citation, and scope checks shared by PostRight P3 and GenRight G7.",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration.",
+        "Revisioned daemon storage and conflict handling belong to the daemon (RK10); this crate validates records only."
+      ]
+    },
+    {
+      "package": "rightkit-compose",
+      "capability": "composition-model",
+      "summary": "Evaluated composition model for Right Suite video: layered video, stills, cursor sprites with hotspots, procedural backgrounds, rounded clipping, shadows, motion blur, canvas-space overlays and an independently timed webcam, with keyframed transforms, crops and opacity; pure per-frame evaluation shared by preview and export",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: the composition contract and evaluation are not an ownership fingerprint.",
+        "No renderer, codec or I/O lives in this crate; CutRight and the typed FFmpeg export consume its FrameDescription."
+      ]
+    },
+    {
+      "package": "rightkit-contracts",
+      "capability": "content-contracts",
+      "summary": "Versioned content-pipeline contracts (content brief, delivery envelope, record session and event, demo plan, daemon API) with embedded JSON Schema, serde types, semantic checks, and major-version negotiation.",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
       ]
     },
     {
@@ -89,53 +402,135 @@
           "id": "control.cargo.enigo",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "enigo"
+          "name": "enigo",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "control.cargo.rdev",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "rdev"
+          "name": "rdev",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "control.cargo.uiautomation",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "uiautomation"
+          "name": "uiautomation",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "control.cargo.accessibility-sys",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "accessibility-sys"
+          "name": "accessibility-sys",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "control.npm.nut-js",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "@nut-tree/nut-js"
+          "name": "@nut-tree/nut-js",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "control.npm.robotjs",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "robotjs"
-        },
-        {
-          "id": "control.api.cgevent-post",
-          "type": "source",
-          "pattern": "\\bCGEventPost(ToPid)?\\s*\\("
-        },
-        {
-          "id": "control.api.ax-element",
-          "type": "source",
-          "pattern": "\\bAXUIElementCreate(Application|SystemWide)\\s*\\("
-        },
+          "name": "robotjs",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Native accessibility, embedded control & global input need separate host/permission qualification.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-crash",
+      "capability": "crash-reporting",
+      "summary": "Privacy-first panic capture, redacted crash reports, native dumps and support bundles for Right Suite apps.",
+      "fingerprints": [
         {
-          "id": "control.api.sendinput",
-          "type": "source",
-          "pattern": "\\bSendInput\\s*\\("
+          "id": "crash.cargo.human-panic",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "human-panic",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-daemon",
+      "capability": "daemon-host",
+      "summary": "Daemon host: HTTPS listener, device enrolment and signed requests, OAuth callback and signed webhook route classes, bounded blake3-keyed resumable uploads, compare-and-swap mutations, durable state and lifecycle events (daemon-api v1).",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
       ]
     },
     {
@@ -147,20 +542,37 @@
           "id": "db.cargo.rusqlite",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "rusqlite"
-        },
-        {
-          "id": "db.cargo.sqlx",
-          "type": "dependency",
-          "ecosystem": "cargo",
-          "name": "sqlx"
+          "name": "rusqlite",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "db.npm.better-sqlite3",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "better-sqlite3"
+          "name": "better-sqlite3",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Owns SQLite bootstrap, not schemas, migrations, queries or non-SQLite databases; sqlcipher rekey gate remains P1.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -172,8 +584,329 @@
           "id": "embed.cargo.fastembed",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "fastembed"
+          "name": "fastembed",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-framed-sidecar",
+      "capability": "framed-sidecar",
+      "summary": "Bounded JSON-lines transport primitives for Right Suite sidecars.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "rightkit-fs",
+      "capability": "safe-filesystem",
+      "summary": "Safe state directories, atomic writes, cross-process locks, owner-only files, and stable file identity for Right Suite apps.",
+      "fingerprints": [
+        {
+          "id": "fs.cargo.fs2",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "fs2",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "fs.cargo.fs4",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "fs4",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "fs.cargo.atomicwrites",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "atomicwrites",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Windows path fallback differs from Unix descriptor-pinned behavior.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-fsindex",
+      "capability": "file-index",
+      "summary": "Live whole-disk file index: getattrlistbulk crawl, FSEvents upkeep, fuzzy name search, and clone- and hard-link-aware folder size rollups (logical, allocated, allocated-unique).",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Name search and folder sizes only; content search is an opt-in cargo feature that is off by default.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "rightkit-hotkeys",
+      "capability": "global-hotkeys",
+      "summary": "Global shortcuts and low-level input hooks for Right Suite apps: chord parsing, conflict detection, CGEventTap/WH_KEYBOARD_LL primitives, push-to-talk state.",
+      "fingerprints": [
+        {
+          "id": "hotkeys.cargo.global-hotkey",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "global-hotkey",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "hotkeys.cargo.tauri-plugin-global-shortcut",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tauri-plugin-global-shortcut",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-http",
+      "capability": "http-client",
+      "summary": "Brand-neutral blocking HTTP client for Right Suite apps: timeouts, retry/backoff with Retry-After, SSE streaming, redacted secrets, and untrusted web-text wrapping.",
+      "fingerprints": [
+        {
+          "id": "http.cargo.reqwest",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "reqwest",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Blocking HTTP only; async reqwest is outside current replacement contract"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "http.cargo.ureq",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "ureq",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Blocking HTTP only; reqwest async transport replacement remains P3.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-jobs",
+      "capability": "persistent-jobs",
+      "summary": "Persistent job store, runner, and stdio/CLI command contract for Right Suite engines.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Runner repair remains P1.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "rightkit-license",
+      "capability": "licensing",
+      "summary": "Right Suite license enforcement primitive — offline verification of server-signed Ed25519 entitlement tokens. The Rust (security) half of @rightkit/license.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "rightkit-llm",
+      "capability": "llm-providers",
+      "summary": "Brand-neutral BYOK LLM clients: Anthropic Messages and OpenAI-compatible chat, streaming, tool use, route failover with circuit breaker, pricing, and prompt-cache discipline.",
+      "fingerprints": [
+        {
+          "id": "llm.cargo.async-openai",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "async-openai",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "llm.cargo.anthropic",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "anthropic",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "llm.cargo.anthropic-sdk",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "anthropic-sdk",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "llm.npm.openai",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "openai",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "llm.npm.anthropic-ai.sdk",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@anthropic-ai/sdk",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "llm.endpoint.provider-request",
+          "type": "source",
+          "pattern": "\\b(?:fetch|post|request)\\s*\\(\\s*[\"\\x27]https://(?:api\\.anthropic\\.com/v1/messages|api\\.openai\\.com/v1/(?:chat/completions|responses))[\"\\x27]",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Unpublished BYOK client; generic OpenAI-compatible routes need feature parity review.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-logs",
+      "capability": "structured-logging",
+      "summary": "Privacy-safe local JSONL logging and diagnostics for Right Suite desktop apps.",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "JSONL logging only; no tracing/env_logger replacement claimed.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
       ]
     },
     {
@@ -185,19 +918,106 @@
           "id": "mcp.cargo.rmcp",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "rmcp"
+          "name": "rmcp",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "mcp.npm.sdk",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "@modelcontextprotocol/sdk"
+          "name": "@modelcontextprotocol/sdk",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Client/server & transport contexts differ; trust hash repair remains P1.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-media",
+      "capability": "media-pipelines",
+      "summary": "Verified FFmpeg artifact and lifecycle primitives for Right Suite media pipelines.",
+      "fingerprints": [
+        {
+          "id": "media.cargo.ffmpeg-sidecar",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "ffmpeg-sidecar",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "mcp.protocol.initialized",
-          "type": "source",
-          "pattern": "[\"']notifications/initialized[\"']"
+          "id": "media.npm.fluent-ffmpeg",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "fluent-ffmpeg",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-models",
+      "capability": "model-installation",
+      "summary": "Shared local-model manifest and installer for Right Suite apps: revisions and quantizations, resumable verified downloads, archive extraction, atomic activation, rollback, and hardware fit.",
+      "fingerprints": [
+        {
+          "id": "models.cargo.hf-hub",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "hf-hub",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -209,62 +1029,139 @@
           "id": "oauth.cargo.oauth2",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "oauth2"
+          "name": "oauth2",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "oauth.cargo.openidconnect",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "openidconnect"
+          "name": "openidconnect",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "oauth.cargo.yup-oauth2",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "yup-oauth2"
+          "name": "yup-oauth2",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "oauth.npm.simple-oauth2",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "simple-oauth2"
+          "name": "simple-oauth2",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "oauth.npm.oauth4webapi",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "oauth4webapi"
-        },
-        {
-          "id": "oauth.endpoint.github",
-          "type": "source",
-          "pattern": "github\\.com/login/(oauth/(authorize|access_token)|device/code)"
-        },
-        {
-          "id": "oauth.endpoint.google",
-          "type": "source",
-          "pattern": "accounts\\.google\\.com/o/oauth2|oauth2\\.googleapis\\.com/(token|device/code)"
-        },
-        {
-          "id": "oauth.endpoint.openai",
-          "type": "source",
-          "pattern": "auth\\.openai\\.com/oauth/(authorize|token)"
-        },
+          "name": "oauth4webapi",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-ocr",
+      "capability": "ocr",
+      "summary": "Product-neutral OCR: Apple Vision / Windows.Media.Ocr native backends with per-line geometry, isolated worker, and verified two-stage ONNX fallback",
+      "fingerprints": [
         {
-          "id": "oauth.endpoint.apple",
-          "type": "source",
-          "pattern": "appleid\\.apple\\.com/auth/(authorize|token)"
+          "id": "ocr.cargo.leptess",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "leptess",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "oauth.endpoint.cloudflare",
-          "type": "source",
-          "pattern": "dash\\.cloudflare\\.com/oauth2/(auth|token)"
+          "id": "ocr.cargo.tesseract",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tesseract",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "oauth.device-grant",
-          "type": "source",
-          "pattern": "urn:ietf:params:oauth:grant-type:device_code"
+          "id": "ocr.npm.tesseract.js",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "tesseract.js",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Internal unpublished OCR; native & ONNX backends need separate qualification.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -276,28 +1173,169 @@
           "id": "ort.cargo.ort",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "ort"
+          "name": "ort",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "ort.npm.onnxruntime-node",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "onnxruntime-node"
+          "name": "onnxruntime-node",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "ort.env.dylib",
           "type": "source",
           "pattern": "\\b(?:set_var|remove_var)\\s*\\(\\s*(?:\"ORT_DYLIB_PATH\"|ORT_DYLIB_PATH)\\s*(?=[,)])|\\bprocess\\s*\\.\\s*env\\s*\\.\\s*ORT_DYLIB_PATH\\s*=(?!=|>)|\\bdelete\\s+process\\s*\\.\\s*env\\s*\\.\\s*ORT_DYLIB_PATH\\b",
           "codeOnly": true,
-          "extensions": [".rs", ".ts", ".tsx", ".js", ".mjs", ".cjs", ".jsx"]
+          "extensions": [
+            ".rs",
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "ort.api.init",
           "type": "source",
           "pattern": "\\bort\\s*::\\s*init(?:_from)?\\s*\\(",
           "codeOnly": true,
-          "extensions": [".rs"]
+          "extensions": [
+            ".rs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Registry publication is recorded despite stale unpublished README; runtime/provider qualification remains required.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-overlay",
+      "capability": "desktop-overlay",
+      "summary": "Shared overlay state, hit testing, and placement policy for Right Suite apps; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "rightkit-ownership",
+      "capability": "ownership-scanner",
+      "summary": "RightKit's ownership scanner, verdict and admission: committed-tree inventory, dependency and source fingerprint findings, signed exception evaluation, the six-binding cache key, and single-flight admission for brokers.",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: the scanner is the enforcement point, so it has no competing-dependency fingerprints.",
+        "Shared contract fixtures live in packages/release/fixtures/ownership and are run in place by this crate's tests."
+      ]
+    },
+    {
+      "package": "rightkit-pdf",
+      "capability": "pdf-engine",
+      "summary": "Product-neutral PDF engine: inspect, compose (source-text replace / add text / OCR correction), font subsetting, staged atomic save, plus optional page merge/select and text extraction",
+      "fingerprints": [
+        {
+          "id": "pdf.cargo.lopdf",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "lopdf",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "pdf.cargo.pdf-extract",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "pdf-extract",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "pdf.npm.pdf-lib",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "pdf-lib",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "save.rs repair gates first adoption.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-playback",
+      "capability": "media-playback",
+      "summary": "Source-preserving FFmpeg compatibility playback preparation for Right Suite media apps.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
       ]
     },
     {
@@ -309,19 +1347,37 @@
           "id": "process.cargo.process-wrap",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "process-wrap"
+          "name": "process-wrap",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "process.cargo.command-group",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "command-group"
-        },
-        {
-          "id": "process.api.kill-on-job-close",
-          "type": "source",
-          "pattern": "JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE"
+          "name": "command-group",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -333,26 +1389,173 @@
           "id": "qa.npm.webdriverio",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "webdriverio"
+          "name": "webdriverio",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Browser automation/QA candidate; CDP, assertions, accessibility & native WebDriver parity are unqualified"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "qa.npm.wdio-cli",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "@wdio/cli"
+          "name": "@wdio/cli",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "qa.npm.axe-playwright",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "@axe-core/playwright"
+          "name": "@axe-core/playwright",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Browser automation/QA candidate; CDP, assertions, accessibility & native WebDriver parity are unqualified"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "qa.cargo.tauri-driver",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "tauri-driver"
+          "name": "tauri-driver",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Published 0.2.12 differs from staged 0.2.13; native QA is distinct from browser accessibility assertions.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-qts",
+      "capability": "text-to-speech",
+      "summary": "Qwen3 TTS inference (GGUF + GGML), vendored from yet-another-ai/qts v0.2.0 for RightKit",
+      "fingerprints": [
+        {
+          "id": "qts.cargo.qts",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "qts",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Rust library alias qts is adoption, not competing dependency when package is rightkit-qts.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-qts-ggml",
+      "capability": "text-to-speech",
+      "summary": "Thin safe wrappers over rightkit-qts-ggml-sys for rightkit-qts, vendored from yet-another-ai/qts v0.2.0",
+      "fingerprints": [
+        {
+          "id": "qts-ggml.cargo.qts-ggml",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "qts-ggml",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Low-level component consumed via rightkit-tts; no direct application adoption requirement.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-qts-ggml-sys",
+      "capability": "text-to-speech",
+      "summary": "Low-level FFI bindings to ggml (CPU, Metal, Vulkan, BLAS) for rightkit-qts, vendored from yet-another-ai/qts v0.2.0",
+      "fingerprints": [
+        {
+          "id": "qts-ggml-sys.cargo.qts-ggml-sys",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "qts-ggml-sys",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "FFI component consumed via rightkit-tts; no direct application adoption requirement.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-record",
+      "capability": "screen-recording",
+      "summary": "Platform-neutral recorder core: start/stop/status lifecycle with partial-bundle quarantine and stale-session recovery, immutable hashed session bundles (record-session v1 manifest, record-event v1 telemetry), per-field redaction before persistence, bundle verification, the step-to-frame reader, and the helper wire protocol (length-prefixed JSON via rightkit-framed-sidecar) with ProcessBackend and serve_backend. Windows capture (Windows.Graphics.Capture and Media Foundation, src/windows, cfg(windows)) and the rightkit-record-helper binary live in this crate.",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: the lifecycle, bundle writer, redaction, protocol and reader are not an ownership fingerprint.",
+        "Windows capture lives in this crate (src/windows, cfg(windows)) and is served out of process by rightkit-record-helper in serve mode.",
+        "rightkit-process owns helper spawning, supervision and restart; this crate only speaks the protocol over the streams it is given.",
+        "The macOS helper is not in this crate. It will implement Backend in its own helper and serve the same protocol."
+      ]
+    },
+    {
+      "package": "rightkit-review",
+      "capability": "content-review",
+      "summary": "Shared review capability: typed deterministic checks over a media or brief description, declared holds, a hard-capped repair loop, an advisory judge interface that cannot override deterministic failures, and versioned verdict records.",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration.",
+        "Consumers (GenRight G6, CutRight C10, PostRight P4) own their review policy and copy; this crate owns the checks and verdict semantics."
       ]
     },
     {
@@ -364,24 +1567,57 @@
           "id": "sandbox.cargo.landlock",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "landlock"
+          "name": "landlock",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "linux"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "Linux-only usage context; owner is not a qualified replacement on both required hosts."
         },
         {
           "id": "sandbox.cargo.seccompiler",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "seccompiler"
-        },
-        {
-          "id": "sandbox.api.appcontainer",
-          "type": "source",
-          "pattern": "\\b(CreateAppContainerProfile|DeriveAppContainerSidFromAppContainerName|PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES)\\b"
-        },
-        {
-          "id": "sandbox.api.seatbelt",
-          "type": "source",
-          "pattern": "\\bsandbox_init\\b|sandbox-exec\\b"
+          "name": "seccompiler",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "linux"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "Linux-only usage context; owner is not a qualified replacement on both required hosts."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "landlock/seccompiler indicate Linux-only usage, not macOS/Windows replacement paths; shutdown repair remains P1.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-scenario",
+      "capability": "scenario-runtime",
+      "summary": "Shared scenario interpreter and durable state machine for the RightKit scenario runtime: perform separated from observe_until, idempotency keys, append-only fsync step journal with resume into observe, leases with fencing tokens, cooperative cancellation with a deadline, retake replay with postcondition comparison, and the remote worker transport trait boundary",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: the interpreter, journal, lease and retake machinery are not an ownership fingerprint.",
+        "No networking, GUI driving or capture lives in this crate; workers implement StepDriver and remote transport implements WorkerTransport in later slices."
+      ]
+    },
+    {
+      "package": "rightkit-search",
+      "capability": "search",
+      "summary": "Product-neutral search query language: lexer, AST, operator values, SQL/FTS5 predicate compiler, snippets, and an in-memory filename index.",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Query language, FTS5 predicates/snippets & optional filename index; no generic full-text engine replacement.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
       ]
     },
     {
@@ -393,30 +1629,75 @@
           "id": "secrets.cargo.keyring",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "keyring"
-        },
-        {
-          "id": "secrets.cargo.security-framework",
-          "type": "dependency",
-          "ecosystem": "cargo",
-          "name": "security-framework"
+          "name": "keyring",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "secrets.npm.keytar",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "keytar"
-        },
-        {
-          "id": "secrets.api.wincred",
-          "type": "source",
-          "pattern": "\\bCred(Write|Read|Delete|Enumerate)W?\\b"
-        },
+          "name": "keytar",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Cross-process Windows key race repair remains P1.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-service",
+      "capability": "local-services",
+      "summary": "One discovery/auth convention for Right Suite local services: service.json, ranking and takeover, current-user-only Unix socket / named pipe, per-app request allowlist.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "rightkit-settings",
+      "capability": "settings-persistence",
+      "summary": "Versioned per-app settings persistence: migrations, typed defaults, atomic writes, corruption recovery, change events.",
+      "fingerprints": [
         {
-          "id": "secrets.api.secitem",
-          "type": "source",
-          "pattern": "\\bSecItem(Add|CopyMatching|Update|Delete)\\b"
+          "id": "settings.cargo.tauri-plugin-store",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tauri-plugin-store",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -428,38 +1709,241 @@
           "id": "shell.cargo.tauri-plugin-autostart",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "tauri-plugin-autostart"
+          "name": "tauri-plugin-autostart",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "shell.cargo.tauri-plugin-deep-link",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "tauri-plugin-deep-link"
+          "name": "tauri-plugin-deep-link",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "shell.cargo.tauri-plugin-single-instance",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "tauri-plugin-single-instance"
+          "name": "tauri-plugin-single-instance",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "shell.cargo.tauri-plugin-window-state",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "tauri-plugin-window-state"
+          "name": "tauri-plugin-window-state",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "shell.cargo.tauri-plugin-notification",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "tauri-plugin-notification"
+          "name": "tauri-plugin-notification",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "shell.cargo.auto-launch",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "auto-launch"
+          "name": "auto-launch",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-speech-client",
+      "capability": "shared-speech-service",
+      "summary": "Client and contract for the Orthic Labs shared speech service (one resident engine per machine), built on rightkit-service. Wire-compatible with HeardRight's v1 host.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "rightkit-sync",
+      "capability": "cloud-sync",
+      "summary": "Brand-neutral desktop/mobile cloud sync engine: change tokens, tombstones, last-writer-wins conflicts, resumable batches, offline queue, retry/backoff.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "rightkit-tauri",
+      "capability": "tauri-host-adapters",
+      "summary": "Native host services for Right Suite Tauri license and device adapters.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "rightkit-transcript",
+      "capability": "timed-transcripts",
+      "summary": "Product-neutral word-timed transcript contract, cue segmentation, and SRT/VTT/JSON import and export for Right Suite applications",
+      "fingerprints": [
+        {
+          "id": "transcript.cargo.srtparse",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "srtparse",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "transcript.cargo.subtp",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "subtp",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-tts",
+      "capability": "text-to-speech",
+      "summary": "Shared local QTS and operating-system speech synthesis for Right Suite apps",
+      "fingerprints": [
+        {
+          "id": "tts.cargo.tts",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tts",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Local QTS & OS voices need separate backend qualification.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-vad",
+      "capability": "voice-activity-detection",
+      "summary": "Product-neutral voice activity detection: Silero scorer, hysteresis/padding/chunking policy, streaming frame carry",
+      "fingerprints": [
+        {
+          "id": "vad.cargo.webrtc-vad",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "webrtc-vad",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "vad.cargo.voice_activity_detector",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "voice_activity_detector",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Default-feature repair & scorer parity remain required.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -471,33 +1955,438 @@
           "id": "watch.cargo.notify",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "notify"
+          "name": "notify",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "watch.cargo.notify-debouncer-full",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "notify-debouncer-full"
+          "name": "notify-debouncer-full",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
           "id": "watch.npm.chokidar",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "chokidar"
+          "name": "chokidar",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
-      "package": "RightKitSwift",
-      "capability": "os-credential-store",
-      "summary": "Native Apple scoped credential storage and sync migration",
+      "package": "@rightkit/agent-room-mcp",
+      "capability": "agent-room",
+      "summary": "Agent room MCP adapter; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/app-shell",
+      "capability": "app-shell-ui",
+      "summary": "Brand-neutral React frame for Right Suite desktop apps: optional fused sidebar+titlebar layout with slots, command palette, shortcut registry/help, toasts, modals, context menus, ui kit, theme hooks.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/ax",
+      "capability": "agent-experience-gates",
+      "summary": "Suite-wide agent-experience (AX) + agent-plugins.org conformance layer: plugin scaffolding/validation and AXA-1 static/conformance/behavioral gates over one product's MCP/CLI surface.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/doc-render",
+      "capability": "document-rendering",
+      "summary": "Brand-neutral, read-only document renderer (Markdown, sanitized HTML, safe email frame) for Right Suite readers.",
       "fingerprints": [
         {
-          "id": "secrets.swift.scoped-migration",
-          "type": "source",
-          "pattern": "\\bfunc\\s+copySyncedToDeviceOnly\\s*\\("
+          "id": "doc-render.npm.remark-parse",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "remark-parse",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/git",
+      "capability": "github-workflows",
+      "summary": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/hooks",
+      "capability": "lifecycle-hooks",
+      "summary": "Neutral lifecycle runtime shared by independently installable agent systems.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "stdin repair remains P1.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/i18n",
+      "capability": "localization",
+      "summary": "Shared locale catalog and React provider for Right Suite apps.",
+      "fingerprints": [
+        {
+          "id": "i18n.npm.i18next",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "i18next",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "i18n.npm.react-i18next",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "react-i18next",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Parked per D6; publication alone does not justify mandatory adoption.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/legal",
+      "capability": "legal-assent",
+      "summary": "Legal manifest, assent receipt, and release-contract primitives for proprietary Right Suite desktop apps.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/legal-ui",
+      "capability": "legal-ui",
+      "summary": "The one first-run / re-acceptance legal gate screen for Right Suite desktop apps.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/license",
+      "capability": "licensing",
+      "summary": "The one license client for every Right Suite app (online token-exchange against the unified RightApps backend, with per-kind offline grace).; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/logs",
+      "capability": "structured-logging",
+      "summary": "Local-only structured logging and diagnostics client for Right Suite apps.",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Native invoke JSONL adapter; no generic JS logger replacement claimed.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/media-ui",
+      "capability": "media-ui",
+      "summary": "Brand-neutral media player and image viewer/editor for Right Suite apps.",
+      "fingerprints": [
+        {
+          "id": "media-ui.npm.react-image-crop",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "react-image-crop",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/onboarding",
+      "capability": "onboarding-ui",
+      "summary": "First-run onboarding framework: ordered steps, progress, skip/resume, legal gate first, permissions, model download and licence/trial steps.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/pdf-ui",
+      "capability": "pdf-ui",
+      "summary": "Brand-neutral read-only PDF viewer (pdf.js) for Right Suite apps.",
+      "fingerprints": [
+        {
+          "id": "pdf-ui.npm.pdfjs-dist",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "pdfjs-dist",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Direct PDF rendering; injected worker/configuration & authenticated owner-only transitive dependencies are permitted"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Direct pdfjs-dist can be host worker configuration; owner-only transitive use needs authenticated reachability.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/platform-ui",
+      "capability": "platform-ui",
+      "summary": "Brand-neutral platform, shortcut, and window-control primitives for Right Suite apps.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/qa",
+      "capability": "qa-evidence",
+      "summary": "Shared QA evidence, ownership, browser helpers, and release-backdoor guards for Right Suite apps.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/qa-chrome",
+      "capability": "browser-qa",
+      "summary": "Zero-dependency Chrome for Testing resolver, launcher and graceful close for Right Suite QA harnesses.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/release",
+      "capability": "release-tooling",
+      "summary": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/settings-ui",
+      "capability": "settings-ui",
+      "summary": "Settings panel frame and standard sections (appearance, updates, license, legal, diagnostics, models, API keys, about) persisted through rightkit-settings.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/shell",
+      "capability": "desktop-shell",
+      "summary": "Typed renderer bridge for the rightkit-shell Tauri crate: window controls, menu/tray events, deep links, autostart, rich clipboard, engine calls.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/tauri",
+      "capability": "tauri-host-adapters",
+      "summary": "Typed host adapters for shared Right Suite Tauri commands.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
       ]
+    },
+    {
+      "package": "@rightkit/theme",
+      "capability": "theme-ui",
+      "summary": "Brand file to CSS tokens generator for Right Suite apps: light/dark/system, derived dark accent, WCAG contrast and hard-coded-colour checks, runtime brand application.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/updates",
+      "capability": "update-policy",
+      "summary": "Shared runtime update policy helper for Right Suite Tauri apps.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Injected updater implementations remain host-owned; ready-before-install repair remains P1.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "RightKitSwift",
+      "capability": "os-credential-store",
+      "summary": "Native Apple scoped credential storage and sync migration",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Apple-only SwiftPM owner; cannot qualify as usable on both hosts.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    }
+  ],
+  "internalOwners": [
+    {
+      "package": "@rightkit/build-control-broker",
+      "path": "packages/build-control-broker/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-clients",
+      "path": "packages/build-control-clients/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-core",
+      "path": "packages/build-control-core/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-phase0",
+      "path": "packages/build-control-phase0/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-policy",
+      "path": "packages/build-control-policy/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-staging",
+      "path": "packages/build-control-staging/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-phase0-macos",
+      "path": "packages/build-control-phase0/macos/package.json",
+      "reason": "Private native build-control feasibility fixture"
+    },
+    {
+      "package": "@rightkit/build-control-phase0-windows",
+      "path": "packages/build-control-phase0/windows/package.json",
+      "reason": "Private native build-control feasibility fixture"
     }
   ]
 }