@rightkit/release 0.2.135 → 0.2.137

package/ownership-key-trust.mjs

@@ -2,9 +2,10 @@ import { createHash } from "node:crypto";
 import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { spawnSync } from "./background-process.mjs";
+import { spawnSync, windowsPowerShellEnvironment } from "./background-process.mjs";
 import { canonicalJson, canonicalRepositoryIdentity, __testOnly as approvalTestOnly, evaluateWindowsAcl, validateTrustRegistry } from "./ownership-approval.mjs";
 import { verifyKeyLog } from "./ownership-key-log.mjs";
+import { SCANNER_VERSION } from "./ownership.mjs";
 
 const HEX = /^[a-f0-9]{64}$/;
 const MAX_REQUEST_BYTES = 2 * 1024 * 1024;
@@ -149,7 +150,7 @@ function ensureNoLinks(file) {
 
 function assertElevated() {
   if (process.platform === "win32") {
-    const r = spawnSync("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", "$p=New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); if (!$p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { exit 9 }"]);
+    const r = spawnSync("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", "$p=New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); if (!$p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { exit 9 }"], { env: windowsPowerShellEnvironment() });
     if (r.status !== 0) throw new Error("protected trust updater requires an elevated Administrator process");
   } else if (process.platform === "darwin") {
     if (process.getuid?.() !== 0) throw new Error("protected trust updater requires root");
@@ -158,7 +159,7 @@ function assertElevated() {
 
 function hardenWindows(directory, file, runner = spawnSync) {
   const script = "$ErrorActionPreference='Stop'; $sidSys=New-Object Security.Principal.SecurityIdentifier('S-1-5-18'); $sidAdm=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-544'); $sidUsers=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-545'); foreach($p in @($env:RK_TRUST_DIR,$env:RK_TRUST_FILE)){ $a=New-Object Security.AccessControl.DirectorySecurity; if($p -eq $env:RK_TRUST_FILE){$a=New-Object Security.AccessControl.FileSecurity}; $a.SetAccessRuleProtection($true,$false); $a.SetOwner($sidAdm); $inherit=if($p -eq $env:RK_TRUST_FILE){[Security.AccessControl.InheritanceFlags]::None}else{[Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'}; foreach($sid in @($sidSys,$sidAdm)){ $rule=New-Object Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$inherit,[Security.AccessControl.PropagationFlags]::None,'Allow'); $a.AddAccessRule($rule) }; $read=New-Object Security.AccessControl.FileSystemAccessRule($sidUsers,'ReadAndExecute',$inherit,[Security.AccessControl.PropagationFlags]::None,'Allow'); $a.AddAccessRule($read); Set-Acl -LiteralPath $p -AclObject $a }; $a=Get-Acl -LiteralPath $env:RK_TRUST_DIR; $a.SetOwner($sidSys); Set-Acl -LiteralPath $env:RK_TRUST_DIR -AclObject $a";
-  const r = runner("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: { ...process.env, RK_TRUST_DIR: directory, RK_TRUST_FILE: file } });
+  const r = runner("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: windowsPowerShellEnvironment({ RK_TRUST_DIR: directory, RK_TRUST_FILE: file }) });
   if (r.status !== 0) throw new Error("could not secure protected trust ACL");
 }
 
@@ -172,7 +173,7 @@ export const __testOnly = Object.freeze({
 });
 
 function runWindowsAclScript(script, environment) {
-  const r = spawnSync("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: { ...process.env, ...environment } });
+  const r = spawnSync("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: windowsPowerShellEnvironment(environment) });
   if (r.status !== 0) throw new Error("could not create or secure protected ownership path");
 }
 
@@ -223,7 +224,7 @@ function auditProtected(file) {
     const problems = [];
     for (const target of targets) {
       try { if (lstatSync(target).isSymbolicLink()) problems.push(`trust path contains a reparse/symlink: ${target}`); } catch { problems.push(`cannot inspect trust path: ${target}`); continue; }
-      const r = spawnSync("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: { ...process.env, RK_TRUST_CHECK_TARGET: target } });
+      const r = spawnSync("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, env: windowsPowerShellEnvironment({ RK_TRUST_CHECK_TARGET: target }) });
       if (r.status !== 0) { problems.push(`cannot inspect trust ACL: ${target}`); continue; }
       try { problems.push(...evaluateWindowsAcl(JSON.parse(r.stdout.trim()), { target, requireNonElevated: false }).problems.map((problem) => `${problem}: ${target}`)); }
       catch { problems.push(`malformed ACL result: ${target}`); }
@@ -283,6 +284,89 @@ function atomicProtectedWrite(file, trust) {
 }
 
 /** Elevated child entrypoint. Writes only the fixed native trust path. */
+const versionParts = (value) => String(value).split(".").map(Number);
+function versionAtLeast(value, floor) {
+  const a = versionParts(value), b = versionParts(floor);
+  for (let i = 0; i < Math.max(a.length, b.length); i += 1) { const x = a[i] ?? 0, y = b[i] ?? 0; if (x !== y) return x > y; }
+  return true;
+}
+/**
+ * Floors follow the installed (digest-verified) RightKit release this elevated code runs from:
+ * its own catalog digest/version and scanner version. Floors only ever rise; an older installed
+ * release leaves the existing floors untouched. The request never supplies floors.
+ */
+export function raiseFloorsToInstalledRelease(trust, { manifest = installedCatalog(), scannerVersion = SCANNER_VERSION } = {}) {
+  const catalogVersion = String(manifest?.version ?? "");
+  if (!/^\d+(?:\.\d+)*$/.test(catalogVersion) || !/^\d+(?:\.\d+)*$/.test(scannerVersion)) return trust;
+  if (!versionAtLeast(catalogVersion, trust.minimumCatalogVersion ?? "0") || !versionAtLeast(scannerVersion, trust.minimumScannerVersion ?? "0")) return trust;
+  const raised = { ...trust, minimumCatalogVersion: catalogVersion, minimumScannerVersion: scannerVersion, minimumCatalogDigest: createHash("sha256").update(canonicalJson(manifest)).digest("hex") };
+  if (!validateTrustRegistry(raised).ok) return trust;
+  return raised;
+}
+function installedCatalog() { return JSON.parse(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "rightkit-ownership.json"), "utf8")); }
+
+/** Typed, non-blocking warnings from the registry merge. The trust update still applies everything else. */
+export const REPOSITORY_DRIFT_CODE = "RK_OWNERSHIP_REPOSITORY_DRIFT";
+export const REPOSITORY_REGISTRY_MALFORMED_CODE = "RK_OWNERSHIP_REPOSITORY_REGISTRY_MALFORMED";
+const warning = (code, message, repositoryIdentity) => ({ code, type: code, message, ...(repositoryIdentity ? { repositoryIdentity } : {}) });
+const REPOSITORY_REGISTRY_FILE = "ownership-repositories.json";
+const MAX_REGISTRY_BYTES = 256 * 1024;
+const REPOSITORY_FIELDS = ["repositoryIdentity", "roots", "visibility"];
+function installedRepositoryRegistry() {
+  const file = path.join(path.dirname(fileURLToPath(import.meta.url)), REPOSITORY_REGISTRY_FILE);
+  const stat = lstatSync(file);
+  if (!stat.isFile() || stat.isSymbolicLink() || (process.platform === "win32" && (stat.attributes & 0x400)) || stat.size > MAX_REGISTRY_BYTES) throw new Error("ownership repository registry must be a bounded regular file");
+  try { return JSON.parse(readFileSync(file, "utf8")); }
+  catch { throw new Error("ownership repository registry is malformed JSON"); }
+}
+/** Fail closed: every entry must be exact, canonical, unique, and pass validateTrustRegistry's repository rules. */
+function validatedRegistryEntries(registry) {
+  if (!exactObject(registry, ["schema", "repositories"]) || registry.schema !== 1 || !Array.isArray(registry.repositories) || !registry.repositories.length) throw new Error("ownership repository registry schema is malformed");
+  const identities = new Set();
+  for (const entry of registry.repositories) {
+    if (!exactObject(entry, REPOSITORY_FIELDS)) throw new Error("ownership repository registry entries must have exactly repositoryIdentity, roots and visibility");
+    let identity;
+    try { identity = canonicalRepositoryIdentity(entry.repositoryIdentity); }
+    catch { throw new Error("ownership repository registry identity is invalid"); }
+    if (identity !== entry.repositoryIdentity) throw new Error(`ownership repository registry identity is not canonical: ${entry.repositoryIdentity}`);
+    if (identities.has(identity)) throw new Error(`ownership repository registry duplicates ${identity}`);
+    identities.add(identity);
+  }
+  // Floors are placeholders here: only the repository rules of validateTrustRegistry are being checked.
+  const probe = validateTrustRegistry({ schema: 1, minimumScannerVersion: "0", minimumCatalogVersion: "0", revokedKeyIds: [], verifiedTrackingEvidence: [], repositories: registry.repositories, provenance: [] });
+  if (!probe.ok) throw new Error(`ownership repository registry is invalid: ${probe.problems.join("; ")}`);
+  return registry.repositories.map(copyJson);
+}
+/**
+ * Additions only, from the committed sibling registry. The trust request never supplies registrations.
+ * Returns { trust, warnings }; it never throws for registry problems, so revocations and floors always apply.
+ * - An identity already registered with different roots or visibility keeps its protected entry unchanged,
+ *   that registry entry is skipped, and a RK_OWNERSHIP_REPOSITORY_DRIFT warning is returned.
+ * - A malformed registry file skips the whole registry merge with a RK_OWNERSHIP_REPOSITORY_REGISTRY_MALFORMED warning.
+ * Provenance, exceptions, and every other field are untouched. firstInstall starts from no registrations.
+ */
+export function mergeRepositoriesFromInstalledRelease(trust, { firstInstall = false, registry } = {}) {
+  if (!Array.isArray(trust?.repositories)) throw new Error("protected repository registry missing");
+  const existing = firstInstall ? [] : trust.repositories.map(copyJson);
+  let incoming;
+  try { incoming = validatedRegistryEntries(registry ?? installedRepositoryRegistry()); }
+  catch (error) { return { trust: { ...trust, repositories: existing }, warnings: [warning(REPOSITORY_REGISTRY_MALFORMED_CODE, `repository registration merge skipped: ${error.message}`)] }; }
+  const byIdentity = new Map(existing.map((entry) => [entry.repositoryIdentity, entry]));
+  const additions = [];
+  const warnings = [];
+  for (const entry of incoming) {
+    const current = byIdentity.get(entry.repositoryIdentity);
+    if (!current) { additions.push(entry); continue; }
+    if (canonicalJson(current.roots) !== canonicalJson(entry.roots) || current.visibility !== entry.visibility) {
+      warnings.push(warning(REPOSITORY_DRIFT_CODE, `protected repository registration differs from the installed release; kept protected entry, skipped registry entry: ${entry.repositoryIdentity}`, entry.repositoryIdentity));
+    }
+  }
+  const merged = { ...trust, repositories: [...existing, ...additions] };
+  const check = validateTrustRegistry(merged);
+  if (!check.ok) throw new Error(`merged protected repository registry is invalid: ${check.problems.join("; ")}`);
+  return { trust: merged, warnings };
+}
+
 export function performProtectedTrustUpdate({ log, rootFingerprint, baseline, authority } = {}) {
   assertElevated();
   const file = OWNERSHIP_TRUST_PATH[process.platform];
@@ -295,11 +379,13 @@ export function performProtectedTrustUpdate({ log, rootFingerprint, baseline, au
     // Re-read under the protected lock so every accepted checkpoint follows latest disk state.
     let existing = null;
     try { lstatSync(file); auditProtected(file); existing = readExisting(file); } catch (error) { if (error.code !== "ENOENT") throw error; existing = null; }
-    const trust = prepareTrustUpdate(existing, { log, rootFingerprint, baseline, authority });
+    const prepared = prepareTrustUpdate(existing, { log, rootFingerprint, baseline, authority });
+    const merged = mergeRepositoriesFromInstalledRelease(prepared, { firstInstall: existing == null });
+    const trust = raiseFloorsToInstalledRelease(merged.trust);
     if (trust.keyAuthority) validateCommittedAuthority(trust.keyAuthority, log, trust.rootFingerprint, trust.keyCheckpoint);
     atomicProtectedWrite(file, trust);
     auditProtected(file);
-    return { path: file, trust };
+    return { path: file, trust, warnings: merged.warnings };
   } finally { releaseLock(); }
 }
 
@@ -315,12 +401,14 @@ function readPinnedRequest(requestPath, expectedDigest) {
   } finally { closeSync(fd); }
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   try {
     if (process.argv.length !== 6 || process.argv[2] !== "--request" || process.argv[4] !== "--sha256") throw new Error("usage: ownership-key-trust.mjs --request <absolute-json> --sha256 <digest>");
     const request = readPinnedRequest(process.argv[3], process.argv[5]);
     if (!exactObject(request, ["schema", "log", "rootFingerprint", ...(Object.hasOwn(request ?? {}, "baseline") ? ["baseline"] : []), ...(Object.hasOwn(request ?? {}, "authority") ? ["authority"] : [])]) || request.schema !== 1 || !Array.isArray(request.log?.events) || request.log.schema !== 1) throw new Error("key trust request schema is malformed");
     const result = performProtectedTrustUpdate({ log: request.log, rootFingerprint: request.rootFingerprint, baseline: request.baseline, authority: request.authority });
-    process.stdout.write(`${JSON.stringify({ path: result.path, checkpoint: result.trust.keyCheckpoint })}\n`);
+    for (const item of result.warnings) process.stderr.write(`${item.code}: ${item.message}\n`);
+    process.stdout.write(`${JSON.stringify({ path: result.path, checkpoint: result.trust.keyCheckpoint, warnings: result.warnings })}\n`);
   } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 2; }
 }

package/ownership-lockfiles.mjs

@@ -0,0 +1,311 @@
+// Stage 1: resolved lock graphs, without feature or production-only pruning.
+import { parse as parseToml } from "smol-toml";
+import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+import { sha256 } from "./ownership-approval.mjs";
+
+export const OWNERSHIP_LOCKFILES = ["Cargo.lock", "pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock"];
+const sections = ["dependencies", "devDependencies", "optionalDependencies"];
+class LockError extends Error {
+  constructor(reason, message) { super(message); this.reason = reason; }
+}
+const fail = (message) => { throw new LockError("lockfile-parse-failed", message); };
+const object = (value) => value && typeof value === "object" && !Array.isArray(value);
+
+// pnpm emits a small YAML subset. Reject unsupported syntax rather than guess.
+// Split only outside quotes/flow collections (URLs, scoped names & peer suffixes are scalars).
+function splitFlow(text, delimiter) {
+  const parts = []; let quote = null, depth = 0, start = 0;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (quote) {
+      if (c === "\\" && quote === '"') { i++; continue; }
+      if (c === quote) { if (quote === "'" && text[i + 1] === "'") i++; else quote = null; }
+    } else if (c === '"' || c === "'") quote = c;
+    else if (c === "{" || c === "[") depth++;
+    else if (c === "}" || c === "]") depth--;
+    else if (!depth && c === delimiter && (delimiter !== ":" || !text[i + 1] || /\s/.test(text[i + 1]))) {
+      parts.push(text.slice(start, i)); start = i + 1;
+      if (delimiter === ":") { parts.push(text.slice(start)); return parts; }
+    }
+    if (depth < 0) fail("unbalanced YAML flow value");
+  }
+  if (quote || depth) fail("unterminated YAML value");
+  parts.push(text.slice(start)); return parts;
+}
+function scalar(raw) {
+  const value = raw.trim();
+  if (/^[&*!|>]/.test(value)) throw new LockError("lockfile-unsupported-format", "YAML anchors, tags or block scalars");
+  if (value.startsWith('"')) { try { return JSON.parse(value); } catch { fail("invalid YAML quoted scalar"); } }
+  if (value.startsWith("'")) {
+    if (!value.endsWith("'") || value.length < 2) fail("invalid YAML quoted scalar");
+    return value.slice(1, -1).replaceAll("''", "'");
+  }
+  if (value.startsWith("{")) {
+    if (!value.endsWith("}")) fail("invalid YAML flow map");
+    const out = Object.create(null);
+    if (value.slice(1, -1).trim()) for (const item of splitFlow(value.slice(1, -1), ",")) {
+      const pair = splitFlow(item.trim(), ":");
+      if (pair.length !== 2) fail("invalid YAML flow entry");
+      const key = scalar(pair[0]); if (Object.hasOwn(out, key)) fail("duplicate YAML key");
+      out[key] = scalar(pair[1]);
+    }
+    return out;
+  }
+  if (value.startsWith("[")) {
+    if (!value.endsWith("]")) fail("invalid YAML flow sequence");
+    return value.slice(1, -1).trim() ? splitFlow(value.slice(1, -1), ",").map(scalar) : [];
+  }
+  if (/[\[\]{}]/.test(value)) fail("invalid YAML scalar");
+  return value.replace(/\s+#.*$/, "");
+}
+function parsePnpmYaml(text) {
+  const root = Object.create(null), stack = [{ indent: -1, value: root }];
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.trim() || /^\s*#/.test(line)) continue;
+    if (/^\s*\t/.test(line)) fail("YAML tab indentation");
+    const indent = line.match(/^ */)[0].length;
+    while (stack.length > 1 && indent <= stack.at(-1).indent) stack.pop();
+    const parent = stack.at(-1);
+    if (indent !== parent.indent + 2 && parent.indent !== -1 || parent.indent === -1 && indent !== 0) fail("invalid YAML indentation");
+    // Block sequences occur in package metadata (os/cpu/bundledDependencies), never graph maps.
+    const content = line.slice(indent);
+    if (content.startsWith("- ")) {
+      if (!parent.sequence) {
+        if (Object.keys(parent.value).length) fail("mixed YAML collection");
+        parent.sequence = []; parent.owner[parent.key] = parent.sequence;
+      }
+      parent.sequence.push(scalar(content.slice(2))); continue;
+    }
+    if (parent.sequence) fail("mixed YAML collection");
+    const pair = splitFlow(content, ":");
+    if (pair.length !== 2) fail("invalid YAML mapping");
+    const key = scalar(pair[0]);
+    if (typeof key !== "string" || !key || Object.hasOwn(parent.value, key)) fail("invalid or duplicate YAML key");
+    const value = pair[1].trim();
+    parent.value[key] = value ? scalar(value) : Object.create(null);
+    if (!value) stack.push({ indent, value: parent.value[key], owner: parent.value, key });
+  }
+  return root;
+}
+
+function graph() {
+  const nodes = new Map(), roots = [];
+  return { nodes, roots, diagnostics: [], add(id, name, version, source, local = false) {
+    if (typeof name !== "string" || !name || typeof version !== "string" || !version) fail("package name/version missing");
+    const node = { id, name, version, source, local, edges: [] }; nodes.set(id, node); return node;
+  } };
+}
+function connect(node, target, reference, optional = false) {
+  if (!target) {
+    if (optional) return; // Optional platform packages can be absent from a resolved install.
+    (node.unresolved ??= []).push(`${node.name}: ${reference}`); return;
+  }
+  node.edges.push(target.id);
+}
+function sourceFor(value, fallback = "registry") {
+  if (typeof value === "string" && /^(git\+|git:|https?:.*\.git)/.test(value)) return value.startsWith("git+") ? value : `git+${value}`;
+  return value || fallback;
+}
+function cargoGraph(text, manifests) {
+  const lock = parseToml(text), g = graph();
+  if (!Array.isArray(lock.package) || ![1, 2, 3, 4].includes(lock.version ?? 1)) throw new LockError("lockfile-unsupported-format", "Cargo lock version/package list");
+  for (const [i, pkg] of lock.package.entries()) g.add(String(i), pkg.name, pkg.version, pkg.source ?? `path:${pkg.name}`, !pkg.source);
+  for (const [i, pkg] of lock.package.entries()) {
+    if (pkg.dependencies !== undefined && !Array.isArray(pkg.dependencies)) fail("Cargo dependencies must be a list");
+    for (const ref of pkg.dependencies ?? []) {
+      if (typeof ref !== "string") fail("invalid Cargo dependency reference");
+      const match = /^(\S+)(?: (\S+))?(?: \((.+)\))?$/.exec(ref);
+      if (!match) fail("invalid Cargo dependency reference");
+      const candidates = [...g.nodes.values()].filter((n) => n.name === match[1] && (!match[2] || n.version === match[2]) && (!match[3] || n.source === match[3]));
+      connect(g.nodes.get(String(i)), candidates.length === 1 ? candidates[0] : null, ref);
+    }
+  }
+  for (const { rel, bytes } of manifests) {
+    const pkg = parseToml(bytes.toString("utf8")).package;
+    if (!pkg) continue; // Virtual workspace: member manifests supply roots.
+    const candidates = [...g.nodes.values()].filter((n) => n.name === pkg.name && n.local && (typeof pkg.version !== "string" || n.version === pkg.version));
+    if (candidates.length !== 1) { g.diagnostics.push({ reason: "lockfile-root-unresolved", detail: rel }); continue; }
+    g.roots.push(candidates[0].id);
+  }
+  return g;
+}
+function packageLockGraph(text, manifests, lockDir) {
+  const lock = JSON.parse(text), g = graph();
+  if (![2, 3].includes(lock.lockfileVersion) || !object(lock.packages)) throw new LockError("lockfile-unsupported-format", "npm requires v2/v3 packages");
+  for (const [id, pkg] of Object.entries(lock.packages)) {
+    if (!object(pkg)) fail("invalid npm package");
+    if (pkg.link) continue;
+    const name = pkg.name ?? (id.includes("node_modules/") ? id.split("node_modules/").at(-1) : id || lock.name || "app");
+    g.add(id, name, pkg.version ?? (!id.includes("node_modules/") ? "0.0.0" : undefined), sourceFor(pkg.resolved), !id.includes("node_modules/") || /^(?:file:|link:)/.test(pkg.resolved ?? ""));
+  }
+  const resolve = (from, name) => {
+    let dir = from;
+    while (true) {
+      const id = path.posix.join(dir, "node_modules", name);
+      const linked = lock.packages[id];
+      const target = linked?.link ? g.nodes.get(path.posix.normalize(linked.resolved)) : g.nodes.get(id);
+      if (target) return target;
+      if (!dir || dir === ".") return null;
+      dir = path.posix.dirname(dir); if (dir === ".") dir = "";
+    }
+  };
+  for (const [id, node] of g.nodes) {
+    const pkg = lock.packages[id];
+    for (const section of [...(node.local ? sections : ["dependencies", "optionalDependencies"]), "peerDependencies"]) {
+      if (pkg[section] !== undefined && !object(pkg[section])) fail("invalid npm dependencies");
+      for (const name of Object.keys(pkg[section] ?? {})) connect(node, resolve(id, name), name, section === "optionalDependencies" || section === "peerDependencies" && pkg.peerDependenciesMeta?.[name]?.optional === true);
+    }
+  }
+  for (const { rel, bytes } of manifests) {
+    const id = path.posix.relative(lockDir, path.posix.dirname(rel));
+    const node = g.nodes.get(id);
+    if (!node) { g.diagnostics.push({ reason: "lockfile-root-unresolved", detail: rel }); continue; }
+    // Root display names come from app manifests, not declarations in ownership files.
+    const pkg = JSON.parse(bytes.toString("utf8"));
+    node.name = pkg.name ?? node.name;
+    for (const section of [...sections, "peerDependencies"]) for (const name of Object.keys(pkg[section] ?? {})) connect(node, resolve(id, name), name, section === "optionalDependencies" || section === "peerDependencies" && pkg.peerDependenciesMeta?.[name]?.optional === true);
+    g.roots.push(id);
+  }
+  return g;
+}
+function pnpmGraph(text, manifests, lockDir) {
+  const lock = parsePnpmYaml(text), version = String(lock.lockfileVersion), g = graph();
+  if (!/^(?:9|6)(?:\.\d+)?$/.test(version) || !object(lock.importers) || !object(lock.packages ?? {})) throw new LockError("lockfile-unsupported-format", "pnpm requires v6/v9 importers");
+  const v9 = version.startsWith("9"), packages = lock.packages ?? {}, snapshots = v9 ? lock.snapshots ?? {} : packages;
+  if (!object(snapshots)) fail("invalid pnpm snapshots");
+  const packageIdentity = (id) => {
+    const bare = id.replace(/^\//, ""), match = /^(@[^/]+\/[^@]+|[^@]+)@(.+)$/.exec(bare);
+    if (!match) throw new LockError("lockfile-unsupported-format", `pnpm package key: ${id}`);
+    return { name: match[1], version: match[2].split(/[(_]/)[0] };
+  };
+  for (const [id, pkg] of Object.entries(snapshots)) {
+    if (!object(pkg)) fail("invalid pnpm snapshot");
+    const identity = packageIdentity(id), metadata = packages[id] ?? packages[id.split("(")[0]] ?? {};
+    const resolved = metadata.resolution?.tarball ?? (metadata.resolution?.directory ? `path:${metadata.resolution.directory}` : undefined);
+    g.add(id, identity.name, metadata.version ?? identity.version, sourceFor(resolved), metadata.resolution?.type === "directory" || identity.version.startsWith("file:"));
+  }
+  for (const [id, importer] of Object.entries(lock.importers)) {
+    if (!object(importer)) fail("invalid pnpm importer");
+    g.add(`importer:${id}`, id, "0.0.0", `path:${id}`, true);
+  }
+  const resolve = (node, name, raw) => {
+    const ref = object(raw) ? raw.version : raw;
+    if (typeof ref !== "string") fail("invalid pnpm dependency version");
+    if (/^(?:link:|workspace:)/.test(ref)) {
+      if (!ref.startsWith("link:")) throw new LockError("lockfile-unresolved-dependency", ref);
+      const importer = node.id.replace(/^importer:/, "");
+      return g.nodes.get(`importer:${path.posix.normalize(path.posix.join(importer, ref.slice(5)))}`);
+    }
+    const candidates = [ref, `${name}@${ref}`, `/${name}@${ref}`];
+    const exact = candidates.map((id) => g.nodes.get(id)).find(Boolean);
+    if (exact) return exact;
+    // Aliases encode the actual package name in the version reference.
+    const normalized = ref.replace(/^npm:/, "");
+    return g.nodes.get(normalized) ?? g.nodes.get(`/${normalized}`);
+  };
+  for (const node of g.nodes.values()) {
+    const isImporter = node.id.startsWith("importer:"), pkg = isImporter ? lock.importers[node.id.slice(9)] : snapshots[node.id];
+    for (const section of isImporter ? sections : ["dependencies", "optionalDependencies"]) {
+      if (pkg[section] !== undefined && !object(pkg[section])) fail("invalid pnpm dependency map");
+      for (const [name, raw] of Object.entries(pkg[section] ?? {})) connect(node, resolve(node, name, raw), name, section === "optionalDependencies");
+    }
+  }
+  for (const { rel, bytes } of manifests) {
+    const id = path.posix.relative(lockDir, path.posix.dirname(rel)) || ".", node = g.nodes.get(`importer:${id}`);
+    if (!node) { g.diagnostics.push({ reason: "lockfile-root-unresolved", detail: rel }); continue; }
+    node.name = JSON.parse(bytes.toString("utf8")).name ?? id;
+    const pkg = JSON.parse(bytes.toString("utf8")), importer = lock.importers[id];
+    for (const section of sections) for (const name of Object.keys(pkg[section] ?? {})) if (!Object.hasOwn(importer[section] ?? {}, name)) g.diagnostics.push({ reason: "lockfile-root-unresolved", detail: `${rel}: ${section}.${name}` });
+    g.roots.push(node.id);
+  }
+  return g;
+}
+
+/** Lock bytes stay bound to the scan inventory or committed snapshot; no installed graph reads. */
+export function transitiveDependencies(appRoot, inventory, manifests, catalogOwners, coverage, contentDigests, targets) {
+  const result = [], cache = new Map(), groups = new Map(), files = new Map(inventory.files.map((file) => [file.rel, file])), targetNames = new Set(targets);
+  const diagnostic = (rel, reason, detail) => coverage.push({ path: rel, status: "unscanned", reason, ...(detail ? { detail } : {}) });
+  const read = (rel) => {
+    if (cache.has(rel)) return cache.get(rel);
+    let file = files.get(rel), bytes = file?.bytes;
+    if (!file && !inventory.committed) {
+      const absolute = path.resolve(appRoot, rel);
+      if (existsSync(absolute)) {
+        const st = lstatSync(absolute), root = realpathSync(appRoot), real = realpathSync(absolute);
+        if (!st.isFile() || st.isSymbolicLink() || !real.startsWith(`${root}${path.sep}`) || st.size > 64 * 1024 * 1024) throw new LockError("lockfile-unreadable", rel);
+        bytes = readFileSync(absolute); file = { rel, bytes };
+        diagnostic(rel, "lockfile-not-in-inventory", "lock bytes are absent from Git-listed scan inputs");
+      }
+    }
+    if (file && !bytes) throw new LockError("lockfile-unreadable", rel);
+    cache.set(rel, bytes);
+    if (bytes && !contentDigests.some((item) => item.path === rel)) contentDigests.push({ path: rel, digest: sha256(bytes) });
+    return bytes;
+  };
+  for (const manifest of manifests) {
+    const base = path.posix.basename(manifest.rel), ecosystem = base === "Cargo.toml" ? "cargo" : base === "package.json" ? "npm" : null;
+    if (!ecosystem || !manifest.bytes) continue;
+    const names = ecosystem === "cargo" ? ["Cargo.lock"] : OWNERSHIP_LOCKFILES.slice(1);
+    let dir = path.posix.dirname(manifest.rel), found = false;
+    try {
+      while (true) {
+        const locks = names.map((name) => path.posix.join(dir, name)).filter((rel) => read(rel) !== undefined);
+        if (locks.length) {
+          for (const rel of locks) {
+            if (!groups.has(rel)) groups.set(rel, { ecosystem, manifests: [] });
+            groups.get(rel).manifests.push(manifest);
+          }
+          found = true; break;
+        }
+        if (dir === ".") break;
+        dir = path.posix.dirname(dir);
+      }
+      if (!found) diagnostic(manifest.rel, "lockfile-missing", ecosystem);
+    } catch (error) { diagnostic(manifest.rel, error.reason ?? "lockfile-unreadable", error.message); }
+  }
+  for (const [rel, group] of groups) {
+    try {
+      const text = read(rel).toString("utf8"), base = path.posix.basename(rel), dir = path.posix.dirname(rel);
+      if (base === "yarn.lock") throw new LockError("lockfile-unsupported-format", "yarn transitive graph");
+      const g = group.ecosystem === "cargo" ? cargoGraph(text, group.manifests) : base === "pnpm-lock.yaml" ? pnpmGraph(text, group.manifests, dir) : packageLockGraph(text, group.manifests, dir);
+      for (const entry of g.diagnostics) diagnostic(rel, entry.reason, entry.detail);
+      for (const node of g.nodes.values()) for (const detail of node.unresolved ?? []) diagnostic(rel, "lockfile-unresolved-dependency", detail);
+      // Retain only nodes leading to block fingerprints. Unrelated lock inventory cannot
+      // multiply traversal work; owner boundaries cannot authorize app/workspace nodes.
+      const reverse = new Map(), viable = new Set();
+      for (const node of g.nodes.values()) {
+        if (!node.local && catalogOwners.has(node.name)) continue;
+        if (targetNames.has(`${group.ecosystem}:${node.name}`)) viable.add(node.id);
+        for (const id of node.edges) {
+          if (!reverse.has(id)) reverse.set(id, []);
+          reverse.get(id).push(node.id);
+        }
+      }
+      const ancestors = [...viable];
+      for (let at = 0; at < ancestors.length; at++) for (const id of reverse.get(ancestors[at]) ?? []) if (!viable.has(id)) { viable.add(id); ancestors.push(id); }
+      const seen = new Set(); let steps = 0;
+      for (const root of new Set(g.roots)) {
+        const queue = [[root]];
+        for (let at = 0; at < queue.length; at++) {
+          if (++steps > 20000) throw new LockError("lockfile-traversal-limit", "more than 20000 dependency paths");
+          const ids = queue[at], node = g.nodes.get(ids.at(-1));
+          // App/workspace names & app ownership declarations never grant an owner boundary.
+          if (ids.length > 1 && !node.local && catalogOwners.has(node.name)) continue;
+          const dependencyPath = ids.map((id) => g.nodes.get(id).name);
+          if (ids.length > 2 && targetNames.has(`${group.ecosystem}:${node.name}`)) {
+            const key = JSON.stringify([node.name, node.version, node.source, dependencyPath]);
+            if (!seen.has(key)) {
+              seen.add(key); result.push({ ecosystem: group.ecosystem, name: node.name, resolvedVersion: node.version, source: node.source, file: rel, lockfile: rel, dependencyPath });
+            }
+          }
+          for (const id of node.edges) if (viable.has(id) && !ids.includes(id)) {
+            if (queue.length >= 20000) throw new LockError("lockfile-traversal-limit", "more than 20000 dependency paths");
+            queue.push([...ids, id]);
+          }
+        }
+      }
+    } catch (error) { diagnostic(rel, error.reason ?? "lockfile-parse-failed", error.message); }
+  }
+  return result.sort((a, b) => a.dependencyPath.length - b.dependencyPath.length || JSON.stringify(a.dependencyPath).localeCompare(JSON.stringify(b.dependencyPath)));
+}

package/ownership-report-command.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn } from "./background-process.mjs";
@@ -63,7 +63,15 @@ export async function main(args, io = {}) {
     const scanned = scanResults.get(app.key);
     if (!scanned) throw new Error("configured app root missing; marked unscanned");
     if (scanned.error) throw new Error(scanned.error);
-    return scanned.value;
+    // The protected worker returns { inputs, trust, report, verdict } (or { error }); never treat
+    // that envelope itself as a report, which would read as a false zero-finding scan.
+    if (scanned.value?.error) throw new Error(`${scanned.value.code ?? "RK_OWNERSHIP_UNVERIFIED"}: ${scanned.value.error}`);
+    // A protected preflight refusal returns without evidence: nothing was scanned.
+    if (!scanned.value?.evidence && scanned.value?.verdict && !scanned.value.verdict.admit)
+      throw new Error(`${scanned.value.verdict.code}: ${(scanned.value.verdict.problems ?? []).join("; ") || "protected preflight refused"}; marked unscanned`);
+    const scan = scanned.value?.report;
+    if (!scan || typeof scan !== "object" || !Array.isArray(scan.violations) || !Array.isArray(scan.problems)) throw new Error("scanner worker returned no ownership report; marked unscanned");
+    return scan;
   } });
   const markdown = renderOwnershipMarkdown(report);
   const json = formatOwnershipJson(report);
@@ -81,7 +89,8 @@ export async function main(args, io = {}) {
   return report.apps.some((app) => app.status === "blocked" || app.status === "unscanned" || app.rows.some((row) => row.status === "blocked" || row.status === "unscanned")) ? 1 : 0;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   try { process.exitCode = await main(process.argv.slice(2)); }
   catch (error) { console.error(`[right-release] ownership report: ${error.message}`); process.exitCode = 1; }
 }

package/ownership-report.mjs

@@ -4,6 +4,7 @@ import { checkApp, EXCEPTIONS_FILE } from "./ownership.mjs";
 import { DEFAULT_APPS } from "./standalone-clone-verify.mjs";
 import { sha256 } from "./ownership-approval.mjs";
 import { findInstallerCopyScripts, findLargeRepositorySubdirectories } from "./installer-storage-doctor.mjs";
+import { ownershipAvailability, ownershipDetection } from "./ownership-availability.mjs";
 
 export const OWNERSHIP_APPS = Object.freeze([
   ...DEFAULT_APPS.map(({ key, appDir }) => ({ key, root: key === "coderight" ? key : path.posix.join(key, appDir === "." ? "" : appDir), scope: key === "coderight" ? "repository" : appDir })),
@@ -11,6 +12,9 @@ export const OWNERSHIP_APPS = Object.freeze([
   { key: "genright", root: "genright" },
   { key: "rightsites", root: "rightsites" },
   { key: "voiceright", root: "voiceright" },
+  { key: "pulse", root: "cockpit", scope: "repository" },
+  { key: "postright", root: "postright", scope: "repository" },
+  { key: "legion", root: "legion", scope: "repository" },
   { key: "membrane", root: "coderight/context/apps/membrane-hub", scope: "context/apps/membrane-hub" },
 ]);
 
@@ -22,23 +26,13 @@ function catalogVersion(manifest) {
 }
 
 export function publishedAvailability(capability, versions) {
-  const npmPackage = capability.npmPackage ?? (capability.package?.startsWith("@rightkit/") ? capability.package : undefined);
-  const cargoPackage = capability.cargoPackage ?? (capability.package?.startsWith("rightkit-") ? capability.package : undefined);
-  const npmVersion = npmPackage && (versions.npm?.[npmPackage] ?? versions.stagedNpm?.[npmPackage]);
-  const cargoVersion = cargoPackage && (versions.cargo?.[cargoPackage] ?? versions.stagedCargo?.[cargoPackage]);
-  const swift = capability.package === "rightkit-swift" ? (versions.swift?.["rightkit-swift"] ?? versions.stagedSwift?.["rightkit-swift"]) : undefined;
-  const published = [];
-  if (npmVersion) published.push({ registry: "npm", package: npmPackage, version: npmVersion, state: versions.npm?.[npmPackage] ? "registry-pinned" : "staged-unverified" });
-  if (cargoVersion) published.push({ registry: "crates.io", package: cargoPackage, version: cargoVersion, state: versions.cargo?.[cargoPackage] ? "registry-pinned" : "staged-unverified" });
-  if (swift) published.push({ registry: "SwiftPM", package: "rightkit-swift", version: swift.version, url: swift.url, state: versions.swift?.["rightkit-swift"] ? "registry-pinned" : "staged-unverified" });
-  return published;
+  return ownershipAvailability(capability, versions);
 }
 
 function statusFor(row, report) {
   if (report.enrollmentPending && (row.status === "blocked" || row.status === "blocked-by-findings")) return "enrollment-pending";
   if (row.status === "blocked" || row.status === "blocked-by-findings") return "blocked";
   if (row.status === "excepted") return "excepted";
-  if (row.status === "qa-only") return "qa-only";
   if (row.status === "verified-integration") return "verified-integration";
   if (row.status === "declared-dependency" || row.uses === true) return "declared-dependency";
   if (report.coverage?.length) return "unscanned";
@@ -60,14 +54,22 @@ function exceptionRequests(root, app, report) {
 }
 
 function asRecord(app, root, scope, report, manifest, versions, scannedAt, storageFindings = []) {
+  const policies = new Map(manifest.capabilities.flatMap((entry) => entry.fingerprints.map((fingerprint) => [fingerprint.id, fingerprint])));
+  const isAdvice = (finding) => policies.get(finding.fingerprint)?.tier === "advise";
+  const advisories = (report.findings ?? report.violations ?? []).filter(isAdvice);
+  report = { ...report, violations: (report.violations ?? []).filter((finding) => !isAdvice(finding)) };
   const meta = report.metadata ?? {};
-  const findings = (report.findings ?? []).map((f) => ({ fingerprint: f.fingerprint, capability: f.capability, file: f.file, line: f.line ?? 0, occurrenceHash: f.occurrenceHash ?? sha256(canonicalJson(f)), ...(f.qaOnly ? { qaOnly: true } : {}) }));
+  const findings = (report.findings ?? []).map((f) => ({ fingerprint: f.fingerprint, capability: f.capability, file: f.file, line: f.line ?? 0, occurrenceHash: f.occurrenceHash ?? sha256(canonicalJson(f)) }));
   const files = [...new Set(findings.map((f) => f.file))].sort();
   const contentDigestSource = meta.contentDigests ? "scanner-inputs" : "finding-occurrences-only";
   const contentDigests = meta.contentDigests ?? findings.map((f) => ({ path: f.file, digest: f.occurrenceHash, kind: "finding-occurrence" }));
   const rows = (report.rows ?? []).map((row) => {
-    const catalogEntry = manifest.capabilities.find((c) => c.capability === row.capability || c.package === row.owner);
-    return { ...row, status: statusFor(row, report), available: catalogEntry ? publishedAvailability(catalogEntry, versions) : [] };
+    const catalogEntries = manifest.capabilities.filter((c) => c.capability === row.capability);
+    const declarationOnly = catalogEntries.length > 0 && catalogEntries.every((entry) => ownershipDetection(entry) === "declaration-only");
+    let status = statusFor(row, report);
+    if (declarationOnly && status === "verified-integration") status = row.uses ? "declared-dependency" : "not-detected";
+    if (status === "blocked" && !report.violations.some((finding) => finding.capability === row.capability) && advisories.some((finding) => finding.capability === row.capability)) status = "advisory";
+    return { ...row, status, detection: declarationOnly ? "declaration-only" : "fingerprinted", available: catalogEntries.flatMap((entry) => publishedAvailability(entry, versions)) };
   });
   const enrollmentIsPending = report.enrollmentPending === true;
   const record = {
@@ -90,13 +92,14 @@ function asRecord(app, root, scope, report, manifest, versions, scannedAt, stora
     coverage: report.coverage ?? [],
     rows,
     findings,
+    advisories,
     violations: report.violations ?? [],
     covered: report.covered ?? [],
     problems: report.problems ?? [],
     warnings: report.warnings ?? [],
     storageFindings,
   };
-  record.resultDigest = sha256(canonicalJson({ app: record.app, commit: record.commit, catalogDigest: record.catalogDigest, contentDigests: record.contentDigests, coverage: record.coverage, rows: record.rows, problems: record.problems, warnings: record.warnings, storageFindings: record.storageFindings, enrollmentPending: record.enrollmentPending }));
+  record.resultDigest = sha256(canonicalJson({ app: record.app, commit: record.commit, catalogDigest: record.catalogDigest, contentDigests: record.contentDigests, coverage: record.coverage, rows: record.rows, advisories: record.advisories, problems: record.problems, warnings: record.warnings, storageFindings: record.storageFindings, enrollmentPending: record.enrollmentPending }));
   record.exceptionRequests = exceptionRequests(root, app, report);
   return record;
 }
@@ -143,8 +146,8 @@ export function renderOwnershipMarkdown(report) {
     const state = app.status ?? (states.has("blocked") ? "blocked" : states.has("unscanned") || app.coverage.length ? "unscanned" : "scanned");
     lines.push(`| ${app.app} | ${app.scope ?? "."} | ${state} | ${app.commit ?? "unknown"} | ${app.host ?? "unknown"} | ${app.scanAgeSeconds}s | ${app.findings.length} | ${app.coverage.length} |`);
   }
-  lines.push("", "## Capability status", "", "| App | Capability | Status | Published availability |", "|---|---|---|---|");
-  for (const app of report.apps) for (const row of app.rows) lines.push(`| ${app.app} | ${row.capability} | ${row.status} | ${row.available.map((x) => `${x.package}@${x.version} (${x.state})`).join(", ") || "none recorded"} |`);
+  lines.push("", "## Capability status", "", "| App | Capability | Status | Detection | Availability |", "|---|---|---|---|---|");
+  for (const app of report.apps) for (const row of app.rows) lines.push(`| ${app.app} | ${row.capability} | ${row.status} | ${row.detection} | ${row.available.map((x) => `${x.package}@${x.version} (${x.state})`).join(", ") || "none recorded"} |`);
   lines.push("", `Blocks: ${report.blocks.length} · Exception requests awaiting verification: ${report.exceptionRequests.length}`, "", "Exception requests are unverified records; only scanner-validated signed exceptions are reported as excepted.", "");
   if (report.warnings?.length) {
     lines.splice(-2, 0, "## Warnings", "", ...report.warnings.map((warning) => `- ${warning.app}: WARNING: ${warning.message}; ${warning.findings.length} finding(s), ${warning.problems.length} problem(s) retained as diagnostics`), "");