@rightkit/release 0.2.135 → 0.2.137

package/ownership-approval.mjs

@@ -2,10 +2,10 @@
 import { createHash, createPublicKey, verify as cryptoVerify } from "node:crypto";
 import { existsSync, lstatSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "./background-process.mjs";
+import { spawnSync, windowsPowerShellEnvironment } from "./background-process.mjs";
 import { verifyKeyLog, verifyOwnershipSignature } from "./ownership-key-log.mjs";
 
-export const APPROVAL_SCHEMA = 1;
+export const APPROVAL_SCHEMA = 2;
 export const REQUIRED_HOSTS = Object.freeze(["windows", "macos"]);
 export const DEFAULT_TRUST_PATH = Object.freeze({
   win32: path.join("C:\\ProgramData", "Orthic Labs", "RightKit", "ownership", "trust.json"),
@@ -89,31 +89,75 @@ export function keyIdForPublicKey(host, publicKey) {
   return prefix + createHash("sha256").update(key.export({ type: "spki", format: "der" })).digest("hex");
 }
 export function occurrenceHash(finding) {
-  return sha256({ fingerprint: finding.fingerprint, file: finding.file, line: finding.line ?? 0, text: finding.text ?? "" });
+  if (!finding || !validFingerprint(finding.fingerprint) || !occurrencePath(finding.file)) throw new Error("invalid occurrence fingerprint or path");
+  const kind = finding.kind ?? (finding.ecosystem ? "dependency" : "source");
+  if (kind === "source") {
+    if (typeof finding.lineText !== "string" || /[\r\n]/.test(finding.lineText) || !Number.isSafeInteger(finding.ordinal) || finding.ordinal < 0) throw new Error("source occurrence requires full lineText and nonnegative ordinal");
+    return sha256({ v: 2, kind, fingerprint: finding.fingerprint, path: finding.file, lineText: finding.lineText, ordinal: finding.ordinal });
+  }
+  if (kind === "transitive-dependency") {
+    if (!["cargo", "npm"].includes(finding.ecosystem) || typeof finding.name !== "string" || !finding.name || typeof finding.resolvedVersion !== "string" || !finding.resolvedVersion || typeof finding.source !== "string" || !finding.source
+      || !Array.isArray(finding.dependencyPath) || finding.dependencyPath.length < 3 || finding.dependencyPath.some((name) => typeof name !== "string" || !name) || finding.dependencyPath.at(-1) !== finding.name) throw new Error("malformed transitive dependency occurrence identity");
+    return sha256({ v: 2, kind, fingerprint: finding.fingerprint, path: finding.file, ecosystem: finding.ecosystem, name: finding.name, resolvedVersion: finding.resolvedVersion, source: finding.source, dependencyPath: finding.dependencyPath });
+  }
+  if (kind !== "dependency") throw new Error("unknown occurrence kind");
+  const ecosystem = finding.ecosystem === "swiftpm" ? "swift" : finding.ecosystem;
+  if (!["cargo", "npm", "swift"].includes(ecosystem) || typeof finding.name !== "string" || !finding.name || typeof finding.section !== "string" || !finding.section
+    || !nullableString(finding.alias) || !nullableString(finding.requirement) || !nullableString(finding.resolvedVersion)
+    || !Array.isArray(finding.features) || finding.features.some((x) => typeof x !== "string" || !x)
+    || ![true, false, null].includes(finding.defaultFeatures) || typeof finding.source !== "string" || !/^(?:registry|git\+[^\s]+|path:.+)$/.test(finding.source)) throw new Error("malformed dependency occurrence identity");
+  return sha256({ v: 2, kind, fingerprint: finding.fingerprint, path: finding.file, ecosystem, name: finding.name, alias: finding.alias, section: finding.section, requirement: finding.requirement,
+    features: [...new Set(finding.features)].sort(), defaultFeatures: finding.defaultFeatures, source: finding.source, resolvedVersion: finding.resolvedVersion });
+}
+// Schema-v2 envelopes retain source/dependency kinds; lock routes are dependency occurrences.
+const exceptionOccurrenceKind = (f) => f.kind === "transitive-dependency" ? "dependency" : f.kind ?? (f.ecosystem ? "dependency" : "source");
+function nullableString(value) { return value === null || typeof value === "string" && value.length > 0; }
+function validFingerprint(value) { return typeof value === "string" && /^[a-z0-9][a-z0-9._-]{1,127}$/.test(value) && !HEX.test(value); }
+function occurrencePath(value) { return typeof value === "string" && !!value && value !== "." && exactRepositoryPath(value) && !/^[A-Za-z]:/.test(value); }
+function exactKeys(value, keys) { return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("\0") === [...keys].sort().join("\0"); }
+function validDate(value) { return typeof value === "string" && /^\d{4}-\d{2}-\d{2}$/.test(value) && !Number.isNaN(Date.parse(`${value}T00:00:00Z`)) && new Date(`${value}T00:00:00Z`).toISOString().slice(0, 10) === value; }
+export function policyEntryDigest(manifest, fingerprint) {
+  if (!validFingerprint(fingerprint) || !Array.isArray(manifest?.capabilities) || manifest.capabilities.some((c) => !Array.isArray(c?.fingerprints))) throw new Error(`missing or malformed catalog policy entry: ${fingerprint}`);
+  const matches = (manifest?.capabilities ?? []).flatMap((c) => (c.fingerprints ?? []).filter((f) => f.id === fingerprint).map((f) => ({ ...f, capability: c.capability, package: c.package, tier: f.tier ?? c.tier })));
+  if (matches.length !== 1 || !matches[0].capability || !matches[0].package || !matches[0].tier) throw new Error(`missing, ambiguous, or malformed catalog policy entry: ${fingerprint}`);
+  return sha256(matches[0]);
 }
 export function approvalPayload(record) {
   return record?.payload;
 }
 
-function validateRecord(record) {
+export function validateRecord(record) {
   const p = [];
-  if (!record || record.schema !== APPROVAL_SCHEMA || !record.payload || !record.signature) return ["malformed or unsigned approval record"];
+  if (!exactKeys(record, ["schema", "payload", "signature"]) || record.schema !== APPROVAL_SCHEMA) return ["approval envelope must use schema 2 and exactly schema, payload, signature"];
   const r = record.payload;
-  for (const key of ["repositoryIdentity", "catalogDigest", "fingerprint", "paths", "occurrenceHashes", "reason", "owner", "expires", "requestId", "trackingRef"]) {
-    if (r[key] === undefined || r[key] === "" || (Array.isArray(r[key]) && !r[key].length)) p.push(`missing ${key}`);
-  }
+  if (!exactKeys(r, ["repositoryIdentity", "fingerprint", "policyDigest", "minimumScannerVersion", "minimumCatalogVersion", "occurrences", "reason", "owner", "issued", "expires", "requestId", "trackingRef"])) return ["approval payload has missing or unknown keys"];
   if (typeof r.repositoryIdentity !== "string" || r.repositoryIdentity.length > 512) p.push("invalid repository identity");
-  if (!HEX.test(r.catalogDigest ?? "")) p.push("invalid catalog digest");
-  if (!Array.isArray(r.paths) || r.paths.some((x) => typeof x !== "string" || !x || x.startsWith("/") || x.includes("\\") || x.split("/").some((s) => !s || s === "." || s === "..") || /[*?\[\]{}]/.test(x))) p.push("paths must be exact repository-relative paths");
-  if (!Array.isArray(r.occurrenceHashes) || r.occurrenceHashes.some((x) => !HEX.test(x)) || new Set(r.occurrenceHashes).size !== r.occurrenceHashes.length) p.push("invalid occurrence hashes");
-  if (!/^\d{4}-\d{2}-\d{2}$/.test(r.expires ?? "") || Number.isNaN(Date.parse(`${r.expires}T00:00:00Z`)) || new Date(`${r.expires}T00:00:00Z`).toISOString().slice(0, 10) !== r.expires) p.push("invalid expiry date");
+  try { if (canonicalRepositoryIdentity(r.repositoryIdentity) !== r.repositoryIdentity) p.push("approval repository identity is not canonical"); } catch { p.push("invalid repository identity"); }
+  if (!validFingerprint(r.fingerprint)) p.push("invalid catalog fingerprint id");
+  if (typeof r.policyDigest !== "string" || !HEX.test(r.policyDigest)) p.push("invalid policy digest");
+  for (const key of ["minimumScannerVersion", "minimumCatalogVersion"]) if (typeof r[key] !== "string" || !/^\d+(?:\.\d+)*$/.test(r[key])) p.push(`invalid ${key}`);
+  if (!Array.isArray(r.occurrences) || !r.occurrences.length || r.occurrences.length > 256) p.push("occurrences must contain 1 to 256 entries");
+  else {
+    const pairs = new Set();
+    for (const item of r.occurrences) {
+      if (!exactKeys(item, ["path", "kind", "hash"]) || !occurrencePath(item.path) || !["source", "dependency"].includes(item.kind) || typeof item.hash !== "string" || !HEX.test(item.hash)) { p.push("occurrences require exact repository-relative path, known kind, and hex hash"); continue; }
+      const pair = `${item.path}\0${item.hash}`;
+      if (pairs.has(pair)) p.push("duplicate occurrence path/hash pair");
+      pairs.add(pair);
+    }
+  }
+  if (!validDate(r.issued)) p.push("invalid issued date");
+  if (!validDate(r.expires)) p.push("invalid expiry date");
   if (typeof r.requestId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{2,127}$/.test(r.requestId)) p.push("invalid request id");
   let trackingUrl;
   try { trackingUrl = new URL(r.trackingRef?.url); } catch {}
-  if (!trackingUrl || trackingUrl.protocol !== "https:" || !trackingUrl.hostname || trackingUrl.username || trackingUrl.password || typeof r.trackingRef.id !== "string" || !r.trackingRef.id || r.trackingRef.verified !== true) p.push("tracking reference must be verified and https-backed");
+  if (!exactKeys(r.trackingRef, ["id", "url", "verified"]) || typeof r.trackingRef.url !== "string" || !trackingUrl || trackingUrl.protocol !== "https:" || !trackingUrl.hostname || trackingUrl.username || trackingUrl.password || typeof r.trackingRef.id !== "string" || !r.trackingRef.id || r.trackingRef.verified !== true) p.push("tracking reference must be verified and https-backed");
   if (typeof r.reason !== "string" || !r.reason.trim() || r.reason.length > 4000) p.push("invalid approval reason");
   if (typeof r.owner !== "string" || !r.owner.trim() || r.owner.length > 256) p.push("invalid owner");
-  if (!record.signature.keyId || !record.signature.host || typeof record.signature.value !== "string" || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(record.signature.value) || Buffer.from(record.signature.value, "base64").toString("base64") !== record.signature.value) p.push("malformed signature envelope");
+  if (record.signature !== null) {
+    const s = record.signature;
+    if (!exactKeys(s, ["keyId", "host", "value"]) || !REQUIRED_HOSTS.includes(s.host) || typeof s.keyId !== "string" || !new RegExp(`^${s.host === "windows" ? "win" : "mac"}-[a-f0-9]{64}$`).test(s.keyId) || typeof s.value !== "string" || !s.value || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(s.value) || Buffer.from(s.value, "base64").toString("base64") !== s.value) p.push("malformed signature envelope");
+  }
   return p;
 }
 
@@ -204,8 +248,12 @@ export function verifyProtectedProvenance(trust, { repositoryIdentity, paths, fi
   return match ? { ok: true, problems: [], record: match } : { ok: false, problems: ["no protected provenance record matches paths and content"] };
 }
 
-export function createDraft({ repositoryIdentity, catalogDigest, fingerprint, findings, paths, reason, owner, expires, requestId, trackingRef }) {
-  const payload = { repositoryIdentity: canonicalRepositoryIdentity(repositoryIdentity), catalogDigest, fingerprint, paths: [...new Set(paths ?? [])].sort(), occurrenceHashes: findings.map(occurrenceHash).sort(), reason, owner, expires, requestId, trackingRef };
+export function createDraft({ repositoryIdentity, policyDigest, fingerprint, findings, minimumScannerVersion, minimumCatalogVersion, reason, owner, issued = new Date().toISOString().slice(0, 10), expires, requestId, trackingRef }) {
+  if (!validDate(issued)) throw new Error("invalid issued date");
+  if (!Array.isArray(findings)) throw new Error("draft findings must be an array of current occurrences");
+  const deadline = new Date(`${issued}T00:00:00Z`); deadline.setUTCDate(deadline.getUTCDate() + 90);
+  const occurrences = findings.map((f) => ({ path: f.file, kind: exceptionOccurrenceKind(f), hash: occurrenceHash(f) })).sort((a, b) => a.path.localeCompare(b.path) || a.hash.localeCompare(b.hash));
+  const payload = { repositoryIdentity: canonicalRepositoryIdentity(repositoryIdentity), policyDigest, fingerprint, minimumScannerVersion, minimumCatalogVersion, occurrences, reason, owner, issued, expires: expires ?? deadline.toISOString().slice(0, 10), requestId: requestId ?? null, trackingRef: trackingRef ?? null };
   return { schema: APPROVAL_SCHEMA, payload, signature: null };
 }
 
@@ -234,25 +282,25 @@ export function validateOwnershipFloor(trust, { scannerVersion, catalogVersion,
   if (trust.minimumCatalogDigest && trust.minimumCatalogDigest !== catalogDigest) problems.push("catalog digest below protected pinned digest");
   return { ok: problems.length === 0, problems };
 }
-function protectedLocation(file, platform) {
+function protectedLocation(file, platform, { runner = spawnSync, inspect = lstatSync, stat = statSync, requireNonElevated = true } = {}) {
   const problems = [];
   if (platform === "win32") {
     const dirs = [];
     let current = path.dirname(file);
     while (true) {
       dirs.push(current);
-      if (current.toLowerCase() === "c:\\") break;
+      if (path.dirname(current) === current) break;
       current = path.dirname(current);
     }
     dirs.push(file);
     for (const target of dirs) {
-      try { if (lstatSync(target).isSymbolicLink()) problems.push(`trust path contains a reparse/symlink: ${target}`); } catch { problems.push(`cannot inspect trust path: ${target}`); continue; }
+      try { if (inspect(target).isSymbolicLink()) problems.push(`trust path contains a reparse/symlink: ${target}`); } catch { problems.push(`cannot inspect trust path: ${target}`); continue; }
       const script = "$ErrorActionPreference='Stop'; $a=Get-Acl -LiteralPath $env:RK_TRUST_CHECK_TARGET; $item=Get-Item -Force -LiteralPath $env:RK_TRUST_CHECK_TARGET; $id=[Security.Principal.WindowsIdentity]::GetCurrent(); $p=New-Object Security.Principal.WindowsPrincipal($id); $ownerSid=$a.GetOwner([Security.Principal.SecurityIdentifier]).Value; $ownerName=$a.Owner; $out=[ordered]@{ownerSID=$ownerSid;ownerName=$ownerName;attributes=$item.Attributes.ToString();directory=[bool]$item.PSIsContainer;nonempty=(!$item.PSIsContainer -or [System.IO.Directory]::EnumerateFileSystemEntries($item.FullName).GetEnumerator().MoveNext());elevated=$p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator);access=@($a.Access | ForEach-Object { [ordered]@{identitySID=$_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value;type=$_.AccessControlType.ToString();mask=[int64]$_.FileSystemRights.value__;propagationFlags=[int]$_.PropagationFlags} })}; $out | ConvertTo-Json -Compress -Depth 5";
-      const r = spawnSync("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: { ...process.env, RK_TRUST_CHECK_TARGET: target } });
+      const r = runner("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: windowsPowerShellEnvironment({ RK_TRUST_CHECK_TARGET: target }) });
       if (r.status !== 0) { problems.push(`cannot inspect trust ACL: ${target}`); continue; }
       try {
         const acl = JSON.parse(r.stdout.trim());
-        const result = evaluateWindowsAcl(acl, { target });
+        const result = evaluateWindowsAcl(acl, { target, requireNonElevated });
         problems.push(...result.problems.map((problem) => `${problem}: ${target}`));
       } catch { problems.push(`malformed ACL result: ${target}`); }
     }
@@ -260,15 +308,15 @@ function protectedLocation(file, platform) {
   }
   let current = file;
   while (true) {
-    try { if (lstatSync(current).isSymbolicLink()) problems.push(`trust path contains a symlink: ${current}`); } catch { problems.push(`cannot inspect trust path: ${current}`); }
+    try { if (inspect(current).isSymbolicLink()) problems.push(`trust path contains a symlink: ${current}`); } catch { problems.push(`cannot inspect trust path: ${current}`); }
     try {
-      const st = statSync(current);
+      const st = stat(current);
       if (st.uid !== 0 || (st.mode & 0o022)) problems.push(`trust location is not root-owned/private: ${current}`);
     } catch { problems.push(`cannot inspect trust location: ${current}`); }
-    const acl = spawnSync("/bin/ls", ["-lde", current], { encoding: "utf8", windowsHide: true });
+    const acl = runner("/bin/ls", ["-lde", current], { encoding: "utf8", windowsHide: true });
     if (acl.status !== 0) problems.push(`cannot inspect trust ACL: ${current}`);
     else for (const line of acl.stdout.split(/\r?\n/).slice(1)) {
-      if (!/allow/i.test(line) || !/\b(?:write|delete|append|writeattr|writeextattr|chown|delete_child|add_file|add_subdirectory)\b/i.test(line)) continue;
+      if (!/allow/i.test(line) || !/\b(?:writesecurity|chown|write|delete|append|writeattr|writeextattr|delete_child|add_file|add_subdirectory)\b/i.test(line)) continue;
       if (!/^\s*\d+:\s+user:root\s+allow\b/i.test(line)) problems.push(`trust ACL grants write authority to a non-root principal: ${current}`);
     }
     const parent = path.dirname(current);
@@ -290,10 +338,12 @@ export function loadTrustedExternal() {
   if (trust.schema !== 1) throw new Error("ownership trust file schema is unsupported");
   const trustCheck = validateTrustRegistry(trust);
   if (!trustCheck.ok) throw new Error(trustCheck.problems.join("; "));
+  const normalize = (id) => typeof id === "string" ? id.replace(/^(?:win-|mac-)/i, "").toLowerCase() : "";
+  const revoked = new Set((trust.revokedKeyIds ?? []).map(normalize));
   for (const host of REQUIRED_HOSTS) {
     const entry = trust.hosts?.[host];
     if (!entry?.keyId && !entry?.publicKeyPem) continue;
-    if (!entry.keyId || !entry.publicKeyPem || entry.keyId !== keyIdForPublicKey(host, entry.publicKeyPem)) throw new Error(`invalid or mismatched ${host} approval key enrollment`);
+    if (!entry.keyId || !entry.publicKeyPem || normalize(entry.keyId) !== normalize(keyIdForPublicKey(host, entry.publicKeyPem))) throw new Error(`invalid or mismatched ${host} approval key enrollment`);
     const key = createPublicKey(entry.publicKeyPem);
     if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") throw new Error(`${host} approval key must be P-256`);
   }
@@ -301,21 +351,28 @@ export function loadTrustedExternal() {
   const hostKeys = REQUIRED_HOSTS.map((host) => trust.hosts?.[host]);
   const enrolled = trust.rootFingerprint
     ? Boolean(HEX.test(trust.rootFingerprint) && trust.keyCheckpoint && Number.isSafeInteger(trust.keyCheckpoint.sequence) && trust.keyCheckpoint.sequence >= 0 && HEX.test(trust.keyCheckpoint.head ?? "")) // Provisional; scan paths replace this from verified log history.
-    : hostKeys.every((host) => host?.keyId && host.publicKeyPem && !trust.revokedKeyIds?.includes(host.keyId))
-      && hostKeys[0]?.keyId !== hostKeys[1]?.keyId && hostKeys[0]?.publicKeyPem !== hostKeys[1]?.publicKeyPem;
+    : hostKeys.every((host) => host?.keyId && host.publicKeyPem && !revoked.has(normalize(host.keyId)))
+      && normalize(hostKeys[0]?.keyId) !== normalize(hostKeys[1]?.keyId) && hostKeys[0]?.publicKeyPem !== hostKeys[1]?.publicKeyPem;
   return { enrolled, pending: !enrolled, protection: protectionResult, trust, path: file };
 }
 
 // Test-only seam: production callers must use loadTrustedExternal's fixed canonical path.
-export const __testOnly = Object.freeze({ protectedLocation });
+export const __testOnly = Object.freeze({ protectedLocation, signatureProblems });
 
 function signatureProblems(record, trust) {
-  const s = record.signature;
+  const s = record?.signature;
+  if (!s || !trust) return ["signature or protected trust is missing"];
+  if (!Array.isArray(trust.revokedKeyIds ?? [])) return ["protected revoked key IDs are malformed"];
+  if (trust.rootFingerprint && !Array.isArray(trust.ownershipKeys)) return ["protected ownership key authority is malformed"];
+  const ids = new Map();
+  const normalize = (id) => { if (!ids.has(id)) ids.set(id, typeof id === "string" ? id.replace(/^(?:win-|mac-)/i, "").toLowerCase() : ""); return ids.get(id); };
+  const normalizedId = normalize(s.keyId);
+  if (!HEX.test(normalizedId)) return ["signing key ID is malformed"];
+  const revoked = new Set((trust.revokedKeyIds ?? []).map(normalize));
   if (!REQUIRED_HOSTS.includes(s.host)) return ["unknown signing host"];
-  if (trust.revokedKeyIds?.includes(s.keyId)) return ["signing key is revoked"];
+  if (revoked.has(normalizedId)) return ["signing key is revoked"];
   if (trust.rootFingerprint) {
-    const normalizedId = String(s.keyId).replace(/^(?:win-|mac-)/, "");
-    const key = trust.ownershipKeys?.find((candidate) => candidate.keyId === normalizedId && candidate.platform === s.host);
+    const key = trust.ownershipKeys?.find((candidate) => normalize(candidate.keyId) === normalizedId && candidate.platform === s.host);
     if (!key) return ["signing key is not active in protected ownership key log"];
     try {
       const valid = verifyOwnershipSignature(key.publicKeyPem, Buffer.from(canonicalJson(approvalPayload(record))), Buffer.from(s.value, "base64"));
@@ -323,12 +380,12 @@ function signatureProblems(record, trust) {
     } catch { return ["malformed signature or public key"]; }
   }
   const host = trust.hosts?.[s.host];
-  if (!host || host.keyId !== s.keyId || !host.publicKeyPem) return ["signing key is not enrolled for host"];
+  if (!host || normalize(host.keyId) !== normalizedId || !host.publicKeyPem) return ["signing key is not enrolled for host"];
   const keys = REQUIRED_HOSTS.map((name) => trust.hosts?.[name]);
-  if (!keys.every((k) => k?.keyId && k.publicKeyPem && !trust.revokedKeyIds?.includes(k.keyId)) || keys[0]?.keyId === keys[1]?.keyId || keys[0]?.publicKeyPem === keys[1]?.publicKeyPem) return ["pending: distinct Windows and macOS approval keys must be enrolled"];
+  if (!keys.every((k) => k?.keyId && k.publicKeyPem && !revoked.has(normalize(k.keyId))) || normalize(keys[0]?.keyId) === normalize(keys[1]?.keyId) || keys[0]?.publicKeyPem === keys[1]?.publicKeyPem) return ["pending: distinct Windows and macOS approval keys must be enrolled"];
   try {
     const publicKey = createPublicKey(host.publicKeyPem);
-    if (s.keyId !== keyIdForPublicKey(s.host, publicKey)) return ["signing key ID does not match enrolled public key"];
+    if (normalizedId !== normalize(keyIdForPublicKey(s.host, publicKey))) return ["signing key ID does not match enrolled public key"];
     const valid = cryptoVerify("sha256", Buffer.from(canonicalJson(approvalPayload(record))), publicKey, Buffer.from(s.value, "base64"));
     return valid ? [] : ["invalid signature"];
   } catch { return ["malformed signature or public key"];
@@ -336,13 +393,28 @@ function signatureProblems(record, trust) {
 }
 
 /** Verify signature, protected enrollment, floor, and exact scan coverage. */
-export function verifyException(record, { repositoryIdentity, catalogDigest, findings, trust, today = new Date().toISOString().slice(0, 10), scannerVersion, catalogVersion } = {}) {
+export function verifyException(record, { repositoryIdentity, catalogDigest, policyDigest, findings, trust, today = new Date().toISOString().slice(0, 10), scannerVersion, catalogVersion } = {}) {
   const problems = validateRecord(record);
   if (problems.length) return { ok: false, problems };
-  if (!trust) return { ok: false, problems: ["pending: external ownership trust is not enrolled"] };
-  const p = signatureProblems(record, trust);
-  if (p.length) return { ok: false, problems: p };
   const r = record.payload;
+  if (!validDate(today)) return { ok: false, problems: ["invalid verification date"] };
+  if (r.issued > today) problems.push("approval issued date is in the future");
+  const duration = Date.parse(`${r.expires}T00:00:00Z`) - Date.parse(`${r.issued}T00:00:00Z`);
+  if (duration <= 0 || duration > 90 * 86400000) problems.push("approval expiry must be after issued and within 90 days");
+  if (r.expires < today) problems.push(`approval expired ${r.expires}`);
+  if (problems.length) return { ok: false, problems };
+  if (!versionAtLeast(scannerVersion, r.minimumScannerVersion)) problems.push("scanner version missing, malformed, or below approval minimum");
+  if (!versionAtLeast(catalogVersion, r.minimumCatalogVersion)) problems.push("catalog version missing, malformed, or below approval minimum");
+  if (!trust) problems.push("pending: external ownership trust is not enrolled");
+  else problems.push(...validateOwnershipFloor(trust, { scannerVersion, catalogVersion, catalogDigest }).problems);
+  if (problems.length) return { ok: false, problems };
+  if (typeof policyDigest !== "string" || !HEX.test(policyDigest) || r.policyDigest !== policyDigest) return { ok: false, problems: ["ownership fingerprint policy digest missing or changed"] };
+  if (!Array.isArray(findings)) return { ok: false, problems: ["current findings missing or malformed"] };
+  let current;
+  try { current = findings.filter((f) => f.fingerprint === r.fingerprint).map((f) => ({ path: f.file, kind: exceptionOccurrenceKind(f), hash: occurrenceHash(f) })); }
+  catch (error) { return { ok: false, problems: [error.message] }; }
+  for (const item of r.occurrences) if (!current.some((f) => f.path === item.path && f.hash === item.hash && f.kind === item.kind)) problems.push(`baseline occurrence changed or missing: ${item.path} (${item.hash})`);
+  if (problems.length) return { ok: false, problems };
   const trackingEvidence = sha256({ repositoryIdentity: r.repositoryIdentity, requestId: r.requestId, trackingRef: r.trackingRef });
   if (!trust.verifiedTrackingEvidence?.includes(trackingEvidence)) problems.push("tracking reference lacks protected verification evidence");
   let recordIdentity, currentIdentity;
@@ -352,15 +424,8 @@ export function verifyException(record, { repositoryIdentity, catalogDigest, fin
   if (recordIdentity && currentIdentity && recordIdentity !== currentIdentity) problems.push("repository identity changed");
   const registration = verifyRepositoryRegistration(trust, r.repositoryIdentity, { files: (findings ?? []).map((f) => f.file) });
   problems.push(...registration.problems);
-  if (r.catalogDigest !== catalogDigest) problems.push("ownership catalog digest changed");
-  if (!/^\d{4}-\d{2}-\d{2}$/.test(today) || Number.isNaN(Date.parse(`${today}T00:00:00Z`)) || new Date(`${today}T00:00:00Z`).toISOString().slice(0, 10) !== today) problems.push("invalid verification date");
-  else if (r.expires < today) problems.push(`approval expired ${r.expires}`);
-  const floor = validateOwnershipFloor(trust, { scannerVersion, catalogVersion, catalogDigest });
-  problems.push(...floor.problems);
-  const selected = (findings ?? []).filter((f) => f.fingerprint === r.fingerprint && r.paths.includes(f.file));
-  const actual = selected.map(occurrenceHash).sort();
-  if (canonicalJson(actual) !== canonicalJson([...r.occurrenceHashes].sort())) problems.push("baseline occurrence set changed");
-  if (!actual.length) problems.push("approval is stale and matches no current occurrences");
+  if (record.signature === null) problems.push("unsigned approval record");
+  else if (!problems.length) problems.push(...signatureProblems(record, trust));
   return { ok: problems.length === 0, problems };
 }
 

package/ownership-availability.mjs

@@ -0,0 +1,25 @@
+// Publication evidence, rollout staging & adopted pins are separate states.
+export function ownershipAvailability(entry, versions) {
+  const name = entry.package;
+  const ecosystem = name === "RightKitSwift" || name === "rightkit-swift" ? "swift"
+    : name?.startsWith("@rightkit/") ? "npm" : "cargo";
+  const key = ecosystem === "swift" ? "rightkit-swift" : name;
+  const stagedMap = { npm: "stagedNpm", cargo: "stagedCargo", swift: "stagedSwift" }[ecosystem];
+  const pinned = versions[ecosystem]?.[key];
+  const recorded = versions.registry?.[ecosystem]?.[key];
+  const staged = versions[stagedMap]?.[key];
+  const versionOf = (value) => typeof value === "string" ? value : value?.version;
+  const publishedVersion = versionOf(recorded ?? pinned);
+  const rows = [];
+  const add = (value, state) => {
+    const version = versionOf(value);
+    if (version) rows.push({ registry: { npm: "npm", cargo: "crates.io", swift: "SwiftPM" }[ecosystem], package: key, version, state, ...(value?.url ? { url: value.url } : {}) });
+  };
+  add(recorded ?? pinned, recorded ? "registry-recorded" : "registry-pinned");
+  if (versionOf(staged) && versionOf(staged) !== publishedVersion) add(staged, "staged-unverified");
+  return rows;
+}
+
+export function ownershipDetection(entry) {
+  return entry.detection ?? (entry.fingerprints?.length ? "fingerprinted" : "declaration-only");
+}

package/ownership-catalog-config.json

@@ -0,0 +1,18 @@
+{
+  "version": "3.0.0",
+  "newCapabilityApprovalFlag": "--approve-new-capabilities",
+  "approvalScope": "Local catalog generation only; installation still requires protected authorization. This flag cannot approve owner changes.",
+  "ownerFamilies": [
+    { "capability": "agent-room", "packages": ["agent-room-core", "@rightkit/agent-room-mcp"], "reason": "Native room core & MCP adapter share room contract" },
+    { "capability": "licensing", "packages": ["rightkit-license", "@rightkit/license"], "reason": "Native entitlement enforcement & renderer/network client have separate roles" },
+    { "capability": "structured-logging", "packages": ["rightkit-logs", "@rightkit/logs"], "reason": "Native JSONL writer & typed renderer invoke adapter" },
+    { "capability": "text-to-speech", "packages": ["rightkit-qts", "rightkit-qts-ggml", "rightkit-qts-ggml-sys", "rightkit-tts"], "reason": "Speech facade & its QTS inference, safe-wrapper & FFI layers" },
+    { "capability": "os-credential-store", "packages": ["rightkit-secrets", "RightKitSwift"], "reason": "Cross-platform Rust & Apple-native Swift credential APIs" },
+    { "capability": "desktop-shell", "packages": ["rightkit-shell", "@rightkit/shell"], "reason": "Native Tauri shell & typed renderer bridge" },
+    { "capability": "tauri-host-adapters", "packages": ["rightkit-tauri", "@rightkit/tauri"], "reason": "Native license/device services & renderer command adapters" }
+  ],
+  "testOwners": [
+    { "path": "crates/rightkit-control/examples/control-test-app/Cargo.toml", "package": "control-test-app", "reason": "Unpublished desktop-control test fixture" },
+    { "path": "crates/rightkit-shell/example-app/Cargo.toml", "package": "shell-example-app", "reason": "Unpublished standalone shell demonstration & test host" }
+  ]
+}

package/ownership-catalog.mjs

@@ -0,0 +1,94 @@
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse as parseToml } from "smol-toml";
+import { ownershipAvailability } from "./ownership-availability.mjs";
+
+const releaseRoot = path.dirname(fileURLToPath(import.meta.url));
+export const CATALOG_CONFIG = JSON.parse(readFileSync(new URL("./ownership-catalog-config.json", import.meta.url)));
+const json = (file) => JSON.parse(readFileSync(file, "utf8"));
+
+export function validateCatalogChanges(previous, next, { approveNewCapabilities = false } = {}) {
+  const owners = new Map();
+  for (const entry of previous.capabilities ?? []) {
+    if (!owners.has(entry.capability)) owners.set(entry.capability, new Set());
+    owners.get(entry.capability).add(entry.package);
+  }
+  const newOwners = new Map();
+  const declarations = new Set();
+  for (const entry of next.capabilities) {
+    const declaration = `${entry.capability}:${entry.package}`;
+    if (declarations.has(declaration)) throw new Error(`ownership: duplicate owner declaration ${declaration}`);
+    declarations.add(declaration);
+    const known = owners.get(entry.capability);
+    if (known && !known.has(entry.package)) throw new Error(`ownership: ${entry.capability} already belongs to ${[...known].join(", ")}; refusing ${entry.package}`);
+    if (!known && !approveNewCapabilities) throw new Error(`ownership: new capability ${entry.capability} requires ${CATALOG_CONFIG.newCapabilityApprovalFlag}`);
+    if (!known && newOwners.has(entry.capability) && newOwners.get(entry.capability) !== entry.package) throw new Error(`ownership: conflicting new owners for ${entry.capability}`);
+    newOwners.set(entry.capability, entry.package);
+  }
+}
+
+// Package declarations are canonical. Availability always comes from versions,
+// never from package versions, descriptions, or generated consumer snapshots.
+export function generateOwnershipCatalog(root) {
+  const capabilities = [], ids = new Set();
+  const versions = json(path.join(root, "packages/release/rightkit-versions.json"));
+  for (const group of ["crates", "packages", "swift"]) {
+    const parent = path.join(root, group);
+    if (!existsSync(parent)) continue;
+    for (const name of readdirSync(parent).sort()) {
+      const dir = path.join(parent, name);
+      const file = path.join(dir, name === "release" && group === "packages" ? "ownership-declaration.json" : "rightkit-ownership.json");
+      if (!existsSync(file)) continue;
+      const declaration = json(file);
+      if (declaration.schema !== undefined) throw new Error(`ownership: generated catalog cannot be an owner declaration: ${file}`);
+      const actual = group === "crates" ? parseToml(readFileSync(path.join(dir, "Cargo.toml"), "utf8")).package?.name
+        : group === "packages" ? json(path.join(dir, "package.json")).name : existsSync(path.join(dir, "Package.swift")) ? /\bname\s*:\s*"([^"]+)"/.exec(readFileSync(path.join(dir, "Package.swift"), "utf8"))?.[1] : null;
+      if (!actual || declaration.package !== actual) throw new Error(`ownership: declaration owner differs from package metadata: ${file}`);
+      for (const entry of declaration.capabilities ?? []) {
+        if (entry.package !== undefined || !/^[a-z0-9][a-z0-9._-]{1,127}$/.test(entry.capability) || !Array.isArray(entry.fingerprints)) throw new Error(`ownership: malformed declaration: ${file}`);
+        const owner = { package: actual, ...entry };
+        if (owner.detection !== (owner.fingerprints.length ? "fingerprinted" : "declaration-only")) throw new Error(`ownership: explicit detection required: ${file}`);
+        for (const f of owner.fingerprints) {
+          if (!/^[a-z0-9][a-z0-9._-]{1,127}$/.test(f.id) || ids.has(f.id)) throw new Error(`ownership: invalid or duplicate fingerprint ${f.id}`);
+          ids.add(f.id);
+          if (!["block", "advise"].includes(f.tier) || !f.usageContext || !f.tierReason) throw new Error(`ownership: per-fingerprint tier & context required: ${f.id}`);
+          if (f.type === "dependency") {
+            if (!["cargo", "npm", "swiftpm"].includes(f.ecosystem) || !f.name || /^(@rightkit\/|rightkit-)/.test(f.name)) throw new Error(`ownership: imprecise dependency: ${f.id}`);
+          } else if (f.type === "source") {
+            if (!f.codeOnly || !f.extensions?.length) throw new Error(`ownership: source fingerprint must be code & extension scoped: ${f.id}`);
+            new RegExp(f.pattern);
+          } else throw new Error(`ownership: unknown fingerprint type: ${f.id}`);
+          // A banned dependency blocks regardless of owner qualification: the ban stands even
+          // when no replacement is used. It names the authority that imposed it.
+          if (f.tier === "block" && f.policy === "banned") {
+            if (f.type !== "dependency" || !f.policyAuthority) throw new Error(`ownership: banned fingerprint needs a dependency & policyAuthority: ${f.id}`);
+          } else if (f.tier === "block") {
+            const published = ownershipAvailability(owner, versions).find((row) => row.state !== "staged-unverified");
+            const q = f.qualification;
+            if (!published || q?.version !== published.version || !["macos", "windows"].every((host) => q.hosts?.includes(host)) || !q.evidence?.length) throw new Error(`ownership: block fingerprint lacks published two-host qualification: ${f.id}`);
+          }
+        }
+        capabilities.push(owner);
+      }
+    }
+  }
+  const families = new Map();
+  for (const entry of capabilities) {
+    if (!families.has(entry.capability)) families.set(entry.capability, new Set());
+    families.get(entry.capability).add(entry.package);
+  }
+  for (const [capability, owners] of families) if (owners.size > 1) {
+    const family = CATALOG_CONFIG.ownerFamilies.find((entry) => entry.capability === capability);
+    if (!family?.reason || owners.size !== family.packages.length || [...owners].some((owner) => !family.packages.includes(owner))) throw new Error(`ownership: conflicting owner family ${capability}`);
+  }
+  const internalOwners = json(path.join(root, "packages/release/ownership-internal-owners.json")).owners;
+  return { schema: 1, version: CATALOG_CONFIG.version, capabilities, internalOwners };
+}
+
+export function writeOwnershipCatalog(root, { approveNewCapabilities = false, previous = json(path.join(releaseRoot, "rightkit-ownership.json")), output = path.join(root, "packages/release/rightkit-ownership.json") } = {}) {
+  const catalog = generateOwnershipCatalog(root);
+  validateCatalogChanges(previous, catalog, { approveNewCapabilities });
+  writeFileSync(output, `${JSON.stringify(catalog, null, 2)}\n`);
+  return catalog;
+}

package/ownership-command.mjs

@@ -3,16 +3,19 @@
 // the shipped manifest from each package's declaration.
 //
 //   right-release ownership [--app <dir>] [--json]
-//   right-release ownership --write-manifest [--rightkit <tools/rightkit>]
-import { readFileSync, realpathSync, writeFileSync } from "node:fs";
+//   right-release ownership --write-manifest [--rightkit <tools/rightkit>] [--approve-new-capabilities]
+// --approve-new-capabilities permits new ids during local generation only.
+// Existing owner changes are always refused; installation needs protected authorization.
+import { realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { aggregateOwnership, formatTable, MANIFEST_FILE } from "./ownership.mjs";
+import { formatTable } from "./ownership.mjs";
+import { writeOwnershipCatalog } from "./ownership-catalog.mjs";
 import { createOwnershipEvidence } from "./ownership-evidence.mjs";
 import { spawnSync } from "./background-process.mjs";
+import { main as stagedMain } from "./ownership-staged.mjs";
 
 const packageRoot = path.dirname(fileURLToPath(import.meta.url));
-const shipped = path.join(packageRoot, MANIFEST_FILE);
 
 function flag(args, name) {
   const i = args.indexOf(name);
@@ -20,17 +23,21 @@ function flag(args, name) {
 }
 
 export async function main(args, { evidenceFactory = createOwnershipEvidence, gitRunner = spawnSync, print = (value) => console.log(value) } = {}) {
-  if (["enroll", "approve-key", "revoke-key"].includes(args[0])) {
+  if (args.includes("--help")) {
+    print("right-release ownership [--app <dir>] [--json]\nright-release ownership --staged [--app <dir>] [--json]  (pre-commit gate: scans the index, not the working tree)\nright-release ownership --write-manifest [--rightkit <dir>] [--approve-new-capabilities]\n--approve-new-capabilities permits new capability ids during local generation only. Existing owner conflicts are always refused. Protected installation authorization remains separate.");
+    return 0;
+  }
+  if (args.includes("--staged")) return stagedMain(args, { print });
+  if (["enroll", "approve-key", "revoke-key", "trust-sync"].includes(args[0])) {
     const { main: keyMain } = await import("./ownership-key-command.mjs");
     return keyMain(args, { runner: gitRunner, print });
   }
   if (args.includes("--write-manifest")) {
     const root = path.resolve(flag(args, "--rightkit") ?? path.join(packageRoot, "..", ".."));
-    const manifest = aggregateOwnership(root);
-    writeFileSync(shipped, `${JSON.stringify(manifest, null, 2)}\n`);
-    const { syncOwnershipCatalog } = await import("../build-control-clients/src/ownership-catalog-sync.mjs");
-    syncOwnershipCatalog({ source: packageRoot });
-    console.log(`[right-release] ownership manifest: ${manifest.capabilities.length} capabilities -> ${shipped}`);
+    const manifest = writeOwnershipCatalog(root, { approveNewCapabilities: args.includes("--approve-new-capabilities") });
+    const { syncConsumerCopies } = await import("./rightkit-sync.mjs");
+    syncConsumerCopies(root);
+    print(`[right-release] ownership manifest: ${manifest.capabilities.length} owner rows -> ${path.join(root, "packages/release/rightkit-ownership.json")}`);
     return 0;
   }
   const app = path.resolve(flag(args, "--app") ?? process.cwd());
@@ -57,6 +64,9 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
     for (const p of result.problems) print(`  ${checked.enrollmentPending ? "DIAGNOSTIC" : "EXCEPTION"} ${p}`);
     print(checked.enrollmentPending ? `[right-release] ${checked.warning}` : checked.ok ? "[right-release] ownership passed" : `[right-release] ownership FAILED: ${[...result.problems, ...checked.floor.problems].join("; ") || "move these to RightKit or add a reviewed, dated exception"}`);
   }
+  // CI lanes may pass `--advisory-when-pending`: before approval keys are enrolled the scan asserts
+  // nothing, so findings print as diagnostics and the step exits 0. Release lanes never pass it.
+  if (checked.enrollmentPending && args.includes("--advisory-when-pending")) return 0;
   return checked.ok ? 0 : 1;
 }
 

package/ownership-declaration.json

@@ -0,0 +1,15 @@
+{
+  "package": "@rightkit/release",
+  "capabilities": [
+    {
+      "capability": "release-tooling",
+      "summary": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    }
+  ]
+}

package/ownership-default-policy.json

@@ -6,16 +6,6 @@
   "minimumCatalogDigest": "875594919178efe146b32276cb21e21a715ca787fb1cc39db425b21bafb02df6",
   "revokedKeyIds": [],
   "verifiedTrackingEvidence": [],
-  "repositories": [
-    { "repositoryIdentity": "https://github.com/bogusyogi/coderight", "roots": ["."], "visibility": "private" },
-    { "repositoryIdentity": "https://github.com/bogusyogi/cutright", "roots": ["."], "visibility": "private" },
-    { "repositoryIdentity": "https://github.com/bogusyogi/genright", "roots": ["."], "visibility": "private" },
-    { "repositoryIdentity": "https://github.com/bogusyogi/heardright", "roots": ["."], "visibility": "private" },
-    { "repositoryIdentity": "https://github.com/bogusyogi/mailright", "roots": ["."], "visibility": "private" },
-    { "repositoryIdentity": "https://github.com/bogusyogi/rightsites", "roots": ["."], "visibility": "private" },
-    { "repositoryIdentity": "https://github.com/bogusyogi/scraperight", "roots": ["."], "visibility": "private" },
-    { "repositoryIdentity": "https://github.com/bogusyogi/viewright", "roots": ["."], "visibility": "private" },
-    { "repositoryIdentity": "https://github.com/bogusyogi/voiceright", "roots": ["."], "visibility": "private" }
-  ],
+  "repositories": [],
   "provenance": []
 }

package/ownership-evidence.mjs

@@ -3,7 +3,7 @@ import { readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
-import { catalogDigest as scanCatalogDigest, checkApp, checkCommittedApp, MANIFEST_FILE, SCANNER_VERSION } from "./ownership.mjs";
+import { catalogDigest as scanCatalogDigest, checkApp, checkAppForTest, checkCommittedApp, checkCommittedAppForTest, MANIFEST_FILE, SCANNER_VERSION } from "./ownership.mjs";
 import { acquireCommittedSource, assertCommittedCheckoutClean, committedSourceDataForInternalUse } from "./committed-source.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
 import { canonicalRepositoryIdentity, loadTrustedExternal, resolveKeyLogTrust, sha256, validateOwnershipFloor, verifyRepositoryRegistration } from "./ownership-approval.mjs";
@@ -29,7 +29,7 @@ function createEvidence(repoRoot, {
   committed = false,
   requireCleanCheckout = false,
   allowPendingAdvisory = false,
-} = {}) {
+} = {}, readAuthority = readCommittedKeyAuthority, scanCommitted = checkCommittedApp) {
   const root = path.resolve(repoRoot);
   const manifestBytes = readFileSync(manifestPath);
   const manifest = JSON.parse(manifestBytes.toString("utf8"));
@@ -48,7 +48,7 @@ function createEvidence(repoRoot, {
   const source = useCommittedSource ? acquireCommittedSource(root, { requiredPaths: [...(trustState.trust?.provenance ?? []).flatMap((record) => record.paths ?? []), ...(trustState.trust?.rootFingerprint && !trustState.trust?.keyAuthority ? [".rightkit/ownership-keys.json"] : [])] }) : null;
   let keyLogEvidence = null;
   if (trustState.trust?.keyAuthority) {
-    const resolved = readCommittedKeyAuthority(trustState.trust);
+    const resolved = readAuthority(trustState.trust);
     if (!resolved.ok) throw new Error(`protected ownership key authority failed: ${resolved.problems.join("; ")}`);
     trustState = { ...trustState, trust: resolved.resolvedTrust, enrolled: resolved.resolvedTrust.enrollmentComplete, pending: !resolved.resolvedTrust.enrollmentComplete };
     enrollmentPending = trustState.pending;
@@ -116,7 +116,7 @@ function createEvidence(repoRoot, {
   const scans = (scanRoots.length ? scanRoots : [requestedRoot]).map((registered) => {
     const absolute = registered === "." ? root : path.resolve(root, ...registered.split("/"));
     const scanned = useCommittedSource
-      ? checkCommittedApp(absolute, manifest, { trust: trustState.trust, expectedCommit: commit, expectedTree: tree, source })
+      ? scanCommitted(absolute, manifest, { trust: trustState.trust, expectedCommit: commit, expectedTree: tree, source })
       : scan(absolute, manifest, { trust: { trust: trustState.trust, enrolled: trustState.enrolled, pending: enrollmentPending }, scannerVersion, catalogVersion, ...(enrollmentPending ? { enrollmentPendingAdvisory: true } : {}) });
     if (repositoryIdentity && canonicalRepositoryIdentity(scanned.metadata?.repositoryIdentity) !== repositoryIdentity) throw new Error(`ownership evidence: scanner observed a different repository identity under ${registered}`);
     if (useCommittedSource && scanned.metadata?.commit !== commit) throw new Error(`ownership evidence: scanner observed a different source commit under ${registered}`);
@@ -171,7 +171,7 @@ function createEvidence(repoRoot, {
     checkedAt: new Date().toISOString(),
   };
   const warning = enrollmentPending ? "WARNING: ownership approval enrollment is pending; findings remain backlog diagnostics and no protected evidence or approvals are asserted" : undefined;
-  return { ok: enrollmentPending || (result.ok && floor.ok && contentCoverage.length === 0), ...(enrollmentPending ? { enrollmentPending: true, warning } : {}), evidence, result, floor, contentCoverage };
+  return { ok: !enrollmentPending && result.ok && floor.ok && contentCoverage.length === 0, ...(enrollmentPending ? { enrollmentPending: true, warning } : {}), evidence, result, floor, contentCoverage };
 }
 
 /** Create scan evidence bound to committed source, catalog, and signed exceptions. */
@@ -186,12 +186,14 @@ export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot)
 
 // Injection seam is deliberately named for tests and is not used by release commands.
 export function createOwnershipEvidenceForTest(repoRoot, options) {
-  return createEvidence(repoRoot, options);
+  const reader = options?.readAuthorityForTest;
+  return createEvidence(repoRoot, { ...options, scan: options?.scan ?? ((root, manifest, context) => checkAppForTest(root, manifest, { ...context, readAuthorityForTest: reader })) }, reader,
+    (root, manifest, context) => checkCommittedAppForTest(root, manifest, { ...context, readAuthorityForTest: reader }));
 }
 
 /** Test-only access to the production committed-tree evidence path. */
 export function createCommittedOwnershipEvidenceForTest(repoRoot, options = {}) {
-  return createEvidence(repoRoot, { ...options, committed: true });
+  return createOwnershipEvidenceForTest(repoRoot, { ...options, committed: true });
 }
 
 /** Entry point for an OS-protected local hook/adapter on private repositories. */
@@ -207,7 +209,7 @@ export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot)
 }
 
 export function verifyOwnershipEvidenceForTest(expected, repoRoot, options) {
-  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => createEvidence(repoRoot, options));
+  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => createOwnershipEvidenceForTest(repoRoot, options));
 }
 
 function verifyEvidence(expected, repoRoot, _scanRoot, createCurrent) {