@rightkit/release 0.2.142 → 0.2.144

package/build-release.mjs

@@ -24,6 +24,7 @@ import { spawn, spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
+import { assertSourceQaAdmission } from "./release-qa-receipt.mjs";
 import { commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, verifySealedRelease, watchProgress } from "./release-state.mjs";
 import { acquireCacheLease, acquireSuiteBuildSlot, applyCachePrune, assertWriteVolumeFloors, inspectCache, inspectWriteVolumes, markCacheEntrySuccessful, planCachePrune, readCachePolicy, resolveCacheLayout, resolveSharedCacheIdentity, resolveSharedCacheRoot } from "./cache-policy.mjs";
 import { createTargetBridge } from "./target-bridge.mjs";
@@ -253,6 +254,15 @@ try {
   for (const check of preflight) {
     if (check.status !== "ok") console.error(`[right-release] preflight ${check.name}: ${check.detail}`);
   }
+  // Hardening step 4: source QA admits the candidate build/sign. The receipt digest is sealed into the manifest so
+  // upload/publication can require installed QA chained to it. Dev lanes (install-app --dev) never reach this file.
+  let qaAdmission;
+  try {
+    qaAdmission = assertSourceQaAdmission({ repoRoot: layout.repoRoot, releaseId, platform, configName: path.relative(process.cwd(), configPath) || path.basename(configPath), releaseConfigSha256: hashFile(configPath) });
+  } catch (error) {
+    if (error?.code !== "QA_ADMISSION_REFUSED") throw error;
+    fail(error.message);
+  }
 
   // A tool being INSTALLED is not the same as it being the one PATH picks. The
   // vendored-OpenSSL build shells out to `perl`, and under Git Bash/MSYS that
@@ -396,7 +406,7 @@ try {
         });
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: appRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, managedRoot });
+        sealRelease({ configRoot: appRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
@@ -436,7 +446,7 @@ function sqlCipherFeatures(text) {
     .filter((value) => /sqlcipher|openssl/i.test(value));
 }
 
-function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, managedRoot }) {
+function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot }) {
   // Every app's right-release.config.mjs names installer/updater artifacts
   // relative to its resolved native target. On a broker-managed host that
   // directory is never populated (the broker owns CARGO_TARGET_DIR and
@@ -507,6 +517,7 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     version: config.version,
     commit,
     ownershipEvidence,
+    qa: { sourceReceiptDigest: qaAdmission.digest, floorDigest: qaAdmission.floorDigest },
     platform,
     cacheKey,
     // Portable contracts sign only raw executables — installer/embedding

package/cli/right-release.mjs

@@ -23,6 +23,7 @@ const commands = new Map([
   ["mirror-root-artifact", "mirror-root-artifact.mjs"],
   ["github", "github-release.mjs"],
   ["cargo-target", "cargo-target.mjs"],
+  ["qa", "release-qa-command.mjs"],
   ["ownership", "ownership-command.mjs"],
   ["ownership-approval", "ownership-approval-command.mjs"],
   ["ownership-report", "ownership-report-command.mjs"],
@@ -183,6 +184,7 @@ Commands:
                                                       Stage SwiftPM app; build+sign MSIX (Windows) or assemble+sign+notarize .app (macOS); never uploads
   upload --release <id> --platform mac|win --tier patch|update
                                                       Upload one sealed release; never builds
+  qa --stage source|installed --platform mac|win [--release <id>]   Run rightkit-qa and write the sealed QA receipt (required to build/upload)
   publish-update --release <id> --platform mac|win --tier patch|update
                                                       Upload sealed bytes to R2 & register RightApps
   release                                             Compatibility alias for build
@@ -212,6 +214,7 @@ Commands:
   ownership approve-key <fingerprint|request.json>    Approve one pending device key from an active host
   ownership revoke-key <fingerprint>                  Revoke one active device key
   ownership trust-sync                               Advance this host's protected trust to the committed key log
+  ownership trust-compare [--json]                   Print this host's protected-trust digest (Mac is the reference)
   ownership-approval --draft <input.json> [--out <draft.json>]
                                                       Draft an exception for native owner approval
   ownership-approval --verify <signed.json> --context <scan.json>

package/github-release.mjs

@@ -7,6 +7,7 @@ import { readVerifiedArtifact, assertArtifactUnchanged, digestBytes, verifyArtif
 import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { verifySealedRelease } from "./release-state.mjs";
+import { assertInstalledQaAdmission } from "./release-qa-receipt.mjs";
 import { addonManifestSha256, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
 import { RIGHTRELEASE_MANIFEST_SIGNER, verifyManifestCatalogSignature } from "./sign-release-manifest.mjs";
 
@@ -394,6 +395,14 @@ if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(
     plan = prepareGitHubAddonRelease({ repoRoot, config, configRoot: path.dirname(configPath), ...options });
   } else {
     options.repo ||= repositoryFromRemote(repoRoot);
+    // Hardening step 4: the direct GitHub lane is a publication path too; it needs installed QA like `upload` does.
+    if (!options.dryRun) {
+      const sealed = verifySealedRelease(path.join(repoRoot, ".right-release", "sealed", options.releaseId, options.platform === "win" ? "windows" : "mac"));
+      const configPath = path.resolve("right-release.config.mjs");
+      try {
+        assertInstalledQaAdmission({ repoRoot, manifest: sealed.manifest, platform: options.platform, configName: "right-release.config.mjs", releaseConfigSha256: existsSync(configPath) ? createHash("sha256").update(readFileSync(configPath)).digest("hex") : undefined });
+      } catch (error) { if (error?.code !== "QA_ADMISSION_REFUSED") throw error; console.error(`right-release github: ${error.message}`); process.exit(1); }
+    }
     plan = prepareGitHubRelease({ repoRoot, ...options });
   }
   const result = publishGitHubRelease(plan, options);

package/install-app.mjs

@@ -2,12 +2,12 @@
 // Sanctioned, non-intrusive local app install from a signed DMG (macOS); --dev also accepts a
 // Developer ID-signed, not-notarized zip or .app.
 // Never uses a shell, osascript, AppleEvents, or foreground activation.
-import { execFile as nodeExecFile } from "./background-process.mjs";
+import { execFile as nodeExecFile, execFileSync as nodeExecFileSync } from "./background-process.mjs";
 import { detachWithRetry } from "./hdiutil-detach.mjs";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 const SIGTERM_WAIT_MS = 15_000;
 const POLL_MS = 250;
@@ -194,6 +194,59 @@ export function writeJournal(fsImpl, file, data) {
   } catch { /* directory fsync is best effort */ }
 }
 
+// --- atomic swap helper (rightkit-swap: renamex_np(RENAME_SWAP)) -------------
+
+// Errors that mean "no atomic swap here": fall back to the two-rename + journal path.
+const SWAP_FALLBACK_CODES = new Set(["ENOHELPER", "ENOTSUP", "EINVAL", "ENOSYS"]);
+const SWAP_HELPER_NAME = "rightkit-swap";
+
+// Resolve order: env RIGHTKIT_SWAP, then <package>/bin/darwin/rightkit-swap, then PATH.
+export function resolveSwapHelper({ env = process.env, fsImpl = fs, pkgDir = path.dirname(fileURLToPath(import.meta.url)) } = {}) {
+  const usable = (p) => { try { return fsImpl.statSync(p).isFile(); } catch { return false; } };
+  if (env.RIGHTKIT_SWAP && usable(env.RIGHTKIT_SWAP)) return env.RIGHTKIT_SWAP;
+  const shipped = path.join(pkgDir, "bin", "darwin", SWAP_HELPER_NAME);
+  if (usable(shipped)) return shipped;
+  for (const dir of String(env.PATH || "").split(path.delimiter)) {
+    if (dir && path.isAbsolute(dir) && usable(path.join(dir, SWAP_HELPER_NAME))) return path.join(dir, SWAP_HELPER_NAME);
+  }
+  return null;
+}
+
+function coded(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+// Sync on purpose: signal-handler rollback must be able to swap back. Throws an error whose `code`
+// is in SWAP_FALLBACK_CODES when no atomic swap is possible here (no helper, or exit 3 / ENOTSUP / EINVAL).
+export function createSwapPaths({ env = process.env, resolve = resolveSwapHelper, execFileSync = nodeExecFileSync } = {}) {
+  return (a, b) => {
+    const helper = resolve({ env });
+    if (!helper) throw coded("ENOHELPER", `${SWAP_HELPER_NAME} helper not found`);
+    try { execFileSync(helper, [a, b], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }); }
+    catch (error) {
+      const text = `${error?.stderr || ""}`.trim();
+      if (error?.code === "ENOENT" || error?.code === "EACCES") throw coded("ENOHELPER", `${helper} cannot run: ${error.code}`);
+      if (error?.status === 3 || /SWAP_UNSUPPORTED/.test(text)) throw coded("ENOTSUP", text || "atomic swap unsupported on this volume");
+      throw coded("EIO", text || error?.message || "rightkit-swap failed");
+    }
+  };
+}
+
+// Exchange two paths, falling back to three renames only when no atomic swap exists (roll-back/recovery).
+function swapBack(swapPaths, fsImpl, a, b) {
+  try { swapPaths(a, b); return "atomic"; }
+  catch (error) {
+    if (!SWAP_FALLBACK_CODES.has(error?.code)) throw error;
+    const tmp = `${a}.swapback`;
+    fsImpl.renameSync(a, tmp);
+    fsImpl.renameSync(b, a);
+    fsImpl.renameSync(tmp, b);
+    return "two-rename";
+  }
+}
+
 const defaultIsAlive = (pid) => {
   try { process.kill(pid, 0); return true; } catch (e) { return e.code === "EPERM"; }
 };
@@ -207,7 +260,7 @@ async function trashBundle(run, fsImpl, home, now, bundle, appName) {
 }
 
 // Deterministic roll-forward/back of any interrupted install journal in `dest`. Idempotent.
-export async function recoverInstalls({ dest, appName = null, run, fsImpl, home, now, event, sleep, isAlive = defaultIsAlive, selfPid = process.pid }) {
+export async function recoverInstalls({ dest, appName = null, run, fsImpl, home, now, event, sleep, isAlive = defaultIsAlive, selfPid = process.pid, swapPaths = createSwapPaths() }) {
   let names = [];
   try { names = fsImpl.readdirSync(dest).filter((n) => JOURNAL_RE.test(n)); } catch { return []; }
   if (appName) names = names.filter((n) => n === path.basename(journalPathFor(dest, appName)));
@@ -225,8 +278,28 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
     const rm = (p) => { if (p) { try { fsImpl.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } } };
     let action;
     let keepJournal = false;
+    let keepStaged = false;
     try {
-      if (!has(j.installed)) {
+      if (j.swap === "atomic") {
+        // Atomic mode: `installed` is never absent. After the exchange, `staged` holds the OLD bundle;
+        // before it, `staged` holds the new copy. The staged copy's inode (journaled) tells them apart.
+        const swapped = has(j.installed) && Number.isFinite(j.stagedIno) && fsImpl.statSync(j.installed).ino === j.stagedIno;
+        if (!has(j.installed)) {
+          if (has(j.staged)) { fsImpl.renameSync(j.staged, j.installed); action = "restored-backup"; }
+          else action = "cleared";
+        } else if (!swapped || !has(j.staged)) action = "cleared";
+        else {
+          let ok = j.phase === "verified";
+          if (!ok) { try { await verifyBundle(run, j.installed, { assess: !j.dev, staple: false }); ok = true; } catch { ok = false; } }
+          if (ok) {
+            try { await trashBundle(run, fsImpl, home, now, j.staged, path.basename(j.installed)); action = "rolled-forward"; }
+            catch { action = "rolled-forward-trash-pending"; keepJournal = true; keepStaged = true; }
+          } else {
+            swapBack(swapPaths, fsImpl, j.staged, j.installed); // staged now holds the bad new bundle
+            action = "rolled-back";
+          }
+        }
+      } else if (!has(j.installed)) {
         if (has(j.backup)) { fsImpl.renameSync(j.backup, j.installed); action = "restored-backup"; }
         else action = "cleared";
       } else if (has(j.backup)) {
@@ -245,7 +318,7 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
       event("recovery-failed", { journal: file, reason: errText(error) });
       continue; // leave the journal for the next run
     }
-    rm(j.staged);
+    if (!keepStaged) rm(j.staged);
     if (j.mount && has(j.mount)) {
       const out = await detachWithRetry({ mount: j.mount, log: (e) => event(e.event, e), sleep, detach: (args) => run("/usr/bin/hdiutil", args) });
       if (out.ok) rm(j.mountRoot);
@@ -258,9 +331,9 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
 }
 
 export async function recoverApp(opts, deps = {}) {
-  const { execFile = realExecFile, fsImpl = fs, home = os.homedir(), now = () => new Date(), sleep = (ms) => new Promise((r) => setTimeout(r, ms)), emit = () => {}, isAlive, platform = process.platform } = deps;
+  const { execFile = realExecFile, fsImpl = fs, home = os.homedir(), now = () => new Date(), sleep = (ms) => new Promise((r) => setTimeout(r, ms)), emit = () => {}, isAlive, platform = process.platform, env = process.env, swapPaths = createSwapPaths({ env }) } = deps;
   if (platform !== "darwin") throw new InstallAppError("unsupported", `install-app is not implemented on ${platform}`);
-  const results = await recoverInstalls({ dest: opts.dest, appName: opts.appName, run: (c, a) => execFile(c, a), fsImpl, home, now, event: (name, data = {}) => emit({ event: name, ...data }), sleep, isAlive });
+  const results = await recoverInstalls({ dest: opts.dest, appName: opts.appName, run: (c, a) => execFile(c, a), fsImpl, home, now, event: (name, data = {}) => emit({ event: name, ...data }), sleep, isAlive, swapPaths });
   emit({ event: "recover-done", dest: opts.dest, recovered: results.length });
   return { ok: true, recovered: results };
 }
@@ -280,6 +353,8 @@ export async function installApp(opts, deps = {}) {
     isAlive = defaultIsAlive,
     signalTarget = process,
     exit = (code) => process.exit(code),
+    env = process.env,
+    swapPaths = createSwapPaths({ env }),
   } = deps;
   const dev = opts.dev === true;
   const event = (name, data = {}) => emit({ event: name, ...(dev ? { dev: true } : {}), ...data });
@@ -298,7 +373,16 @@ export async function installApp(opts, deps = {}) {
     const s = swap;
     swap = null;
     try {
-      if (!s.final) {
+      if (s.mode === "atomic") {
+        // installed was never absent. Before the exchange only the staged copy needs removing; after it,
+        // exchange back (installed = old again, staged = the new copy) and drop the new copy. Once final,
+        // staged holds the verified-old bundle awaiting the Trash, so it must not be touched.
+        if (!s.final) {
+          if (s.swapped) swapBack(swapPaths, fsImpl, s.staged, s.installed);
+          removeQuiet(s.staged);
+          removeQuiet(s.journal);
+        }
+      } else if (!s.final) {
         if (s.stagedIn) removeQuiet(s.installed);
         if (s.backedUp && !fsImpl.existsSync(s.installed)) fsImpl.renameSync(s.backup, s.installed);
         removeQuiet(s.staged);
@@ -346,7 +430,7 @@ export async function installApp(opts, deps = {}) {
     if (!fsImpl.existsSync(inputPath)) throw new InstallAppError(`${inputKind}-missing`, `${inputKind.toUpperCase()} not found: ${inputPath}`);
     if (!fsImpl.existsSync(opts.dest)) throw new InstallAppError("dest-missing", `destination not found: ${opts.dest}`);
 
-    await recoverInstalls({ dest: opts.dest, appName: opts.appName, run, fsImpl, home, now, event, sleep, isAlive, selfPid: pid });
+    await recoverInstalls({ dest: opts.dest, appName: opts.appName, run, fsImpl, home, now, event, sleep, isAlive, selfPid: pid, swapPaths });
 
     let sourceApp = null;
     const pickApp = (dir, label) => {
@@ -408,7 +492,7 @@ export async function installApp(opts, deps = {}) {
     const journalData = { schema: 1, appName, pid, phase: "staging", dev, installed, backup, staged, mount: mountPoint, mountRoot };
     removeQuiet(staged);
     writeJournal(fsImpl, journal, journalData);
-    swap = { installed, backup, staged, journal, backedUp: false, stagedIn: false, final: false };
+    swap = { installed, backup, staged, journal, mode: null, swapped: false, backedUp: false, stagedIn: false, final: false };
     try { await run("/usr/bin/ditto", [sourceApp, staged]); }
     catch (error) {
       rollbackSwap();
@@ -426,12 +510,37 @@ export async function installApp(opts, deps = {}) {
     const quit = hadInstalled ? await quitApp(run, kill, sleep, installed) : { pids: [], killed: [] };
     event("quit", { wasRunning, pids: quit.pids, forced: quit.killed });
 
-    // Swap: old -> backup, staged -> installed. The old bundle is never trashed before the new one is verified.
+    // Swap. Preferred: one atomic exchange (renamex_np RENAME_SWAP), so `installed` is never absent even
+    // under SIGKILL; the old bundle then sits at the staged path. Fallback (no helper, or a volume without
+    // RENAME_SWAP): old -> backup, staged -> installed, journaled. The old bundle is never trashed before
+    // the new one is verified.
     failedStage = "replace";
-    writeJournal(fsImpl, journal, { ...journalData, phase: "swapping" });
-    if (hadInstalled) { fsImpl.renameSync(installed, backup); swap.backedUp = true; }
-    fsImpl.renameSync(staged, installed);
-    swap.stagedIn = true;
+    let jd = journalData;
+    let swapMode;
+    if (!hadInstalled) {
+      swapMode = "rename"; // nothing to exchange: a single rename onto an absent name is atomic
+      swap.mode = "two-rename";
+      writeJournal(fsImpl, journal, { ...jd, phase: "swapping", swap: swapMode });
+      fsImpl.renameSync(staged, installed);
+      swap.stagedIn = true;
+    } else {
+      jd = { ...journalData, swap: "atomic", backup: null, stagedIno: fsImpl.statSync(staged).ino };
+      writeJournal(fsImpl, journal, { ...jd, phase: "swapping" });
+      swap.mode = "atomic";
+      try { swapPaths(staged, installed); swap.swapped = true; swapMode = "atomic"; }
+      catch (error) {
+        if (!SWAP_FALLBACK_CODES.has(error?.code)) throw new InstallAppError("swap-failed", `atomic swap failed (${errText(error)}); previous app untouched`);
+        event("swap-fallback", { reason: error.code, detail: errText(error) });
+        swapMode = "two-rename";
+        swap.mode = "two-rename";
+        jd = { ...journalData, swap: "two-rename" };
+        writeJournal(fsImpl, journal, { ...jd, phase: "swapping" });
+        fsImpl.renameSync(installed, backup); swap.backedUp = true;
+        fsImpl.renameSync(staged, installed);
+        swap.stagedIn = true;
+      }
+      if (swapMode === "atomic") writeJournal(fsImpl, journal, { ...jd, phase: "swapped" });
+    }
     // Dev builds are not notarized: clear quarantine on the NEW bundle only so Gatekeeper does not block it.
     if (dev) {
       try { await run("/usr/bin/xattr", ["-dr", "com.apple.quarantine", installed]); }
@@ -443,18 +552,19 @@ export async function installApp(opts, deps = {}) {
     // Re-verify installed copy; on failure the catch below rolls back to the backup.
     failedStage = "reverify";
     await verifyBundle(run, installed, { assess: !dev, staple: false });
-    writeJournal(fsImpl, journal, { ...journalData, phase: "verified", mount: null, mountRoot: null });
+    writeJournal(fsImpl, journal, { ...jd, phase: "verified", mount: null, mountRoot: null });
     swap.final = true;
 
     // Only now does the old bundle go to the Trash.
     let trashed = null;
-    if (backup) {
-      try { trashed = await trashBundle(run, fsImpl, home, now, backup, appName); }
-      catch (error) { event("backup-trash-failed", { backup, reason: errText(error) }); trashed = backup; }
+    const oldBundle = swapMode === "atomic" ? staged : backup; // atomic: the exchange left the old bundle at the staged path
+    if (hadInstalled && oldBundle) {
+      try { trashed = await trashBundle(run, fsImpl, home, now, oldBundle, appName); }
+      catch (error) { event("backup-trash-failed", { backup: oldBundle, reason: errText(error) }); trashed = oldBundle; }
     }
-    if (!backup || trashed !== backup) removeQuiet(journal);
+    if (!oldBundle || trashed !== oldBundle) removeQuiet(journal);
     swap = null;
-    event("replaced", { installed, previous: trashed });
+    event("replaced", { installed, previous: trashed, swap: swapMode });
 
     // Relaunch hidden and in the background only.
     const relaunch = opts.relaunch === null ? wasRunning : opts.relaunch;
@@ -463,7 +573,7 @@ export async function installApp(opts, deps = {}) {
       await run("/usr/bin/open", ["-g", "-j", "-b", bundleId]);
       event("relaunched", { bundleId });
     }
-    const result = { ok: true, app: appName, installed, bundleId, teamId: newTeam, previous: trashed, relaunched: relaunch, ...(dev ? { dev: true } : {}) };
+    const result = { ok: true, app: appName, installed, bundleId, teamId: newTeam, previous: trashed, swap: swapMode, relaunched: relaunch, ...(dev ? { dev: true } : {}) };
     event("done", result);
     return result;
   } catch (error) {

package/ownership-approval.mjs

@@ -4,6 +4,7 @@ import { existsSync, lstatSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 import { spawnSync, windowsPowerShellEnvironment } from "./background-process.mjs";
 import { verifyKeyLog, verifyOwnershipSignature } from "./ownership-key-log.mjs";
+import { validateAllowlist } from "./ownership-dependency-allowlist.mjs";
 
 export const APPROVAL_SCHEMA = 2;
 export const REQUIRED_HOSTS = Object.freeze(["windows", "macos"]);
@@ -171,6 +172,16 @@ export function validateTrustRegistry(trust) {
   if (!Array.isArray(trust?.revokedKeyIds) || !Array.isArray(trust?.verifiedTrackingEvidence) || trust.verifiedTrackingEvidence.some((x) => !HEX.test(x))) problems.push("trust revocation or tracking evidence lists are malformed");
   if (!/^\d+(?:\.\d+)*$/.test(trust?.minimumScannerVersion ?? "") || !/^\d+(?:\.\d+)*$/.test(trust?.minimumCatalogVersion ?? "")) problems.push("scanner/catalog floors are missing or malformed");
   if (trust?.minimumCatalogDigest !== undefined && !HEX.test(trust.minimumCatalogDigest)) problems.push("minimum catalog digest is malformed");
+  // Policy bundle + allowlist are optional so trust written before they existed stays valid (treated as unpinned).
+  if (trust?.policyBundle !== undefined) {
+    const bundle = trust.policyBundle;
+    if (!bundle || typeof bundle !== "object" || Array.isArray(bundle) || bundle.schema !== 1 || !HEX.test(bundle.digest ?? "") || !HEX.test(bundle.catalogDigest ?? "")
+      || !/^\d+(?:\.\d+)*$/.test(bundle.scannerVersion ?? "") || !Array.isArray(bundle.files) || bundle.files.some((file) => typeof file?.path !== "string" || !HEX.test(file.sha256 ?? ""))) problems.push("protected policy bundle is malformed");
+  }
+  if (trust?.dependencyAllowlist !== undefined) {
+    const allowlist = validateAllowlist(trust.dependencyAllowlist);
+    if (!allowlist.ok) problems.push(`protected dependency allowlist is malformed: ${allowlist.problems[0]}`);
+  }
   if (trust?.rootFingerprint !== undefined || trust?.keyCheckpoint !== undefined) {
     if (!HEX.test(trust.rootFingerprint ?? "") || !trust.keyCheckpoint || !Number.isSafeInteger(trust.keyCheckpoint.sequence) || trust.keyCheckpoint.sequence < 0 || !HEX.test(trust.keyCheckpoint.head ?? "")) problems.push("protected key-log root pin or checkpoint is malformed");
   }
@@ -274,12 +285,14 @@ function versionAtLeast(actual, minimum) {
   }
   return true;
 }
-export function validateOwnershipFloor(trust, { scannerVersion, catalogVersion, catalogDigest } = {}) {
+export function validateOwnershipFloor(trust, { scannerVersion, catalogVersion, catalogDigest, policyBundleDigest } = {}) {
   const problems = [];
   if (!trust) return { ok: false, problems: ["external ownership trust unavailable"] };
   if (!versionAtLeast(scannerVersion, trust.minimumScannerVersion)) problems.push("scanner version missing, malformed, or below protected minimum");
   if (!versionAtLeast(catalogVersion, trust.minimumCatalogVersion)) problems.push("catalog version missing, malformed, or below protected minimum");
   if (trust.minimumCatalogDigest && trust.minimumCatalogDigest !== catalogDigest) problems.push("catalog digest below protected pinned digest");
+  // Trust written before the bundle existed has no policyBundle and stays unpinned until the next trust-sync.
+  if (trust.policyBundle?.digest && policyBundleDigest !== undefined && trust.policyBundle.digest !== policyBundleDigest) problems.push("ownership policy bundle (scanner source, catalog, registry or dependency allowlist) differs from the protected pinned bundle; run trust-sync");
   return { ok: problems.length === 0, problems };
 }
 function protectedLocation(file, platform, { runner = spawnSync, inspect = lstatSync, stat = statSync, requireNonElevated = true } = {}) {

package/ownership-command.mjs

@@ -3,7 +3,9 @@
 // the shipped manifest from each package's declaration.
 //
 //   right-release ownership [--app <dir>] [--json]
-//   right-release ownership --write-manifest [--rightkit <tools/rightkit>] [--approve-new-capabilities]
+//   right-release ownership [--app <dir>] --audit-json   (Legion governance.capability-ownership provider)
+//   right-release ownership trust-compare [--json]   (print this host's protected-trust digest)
+//   right-release ownership --write-manifest [--rightkit <rightkit>] [--approve-new-capabilities]
 // --approve-new-capabilities permits new ids during local generation only.
 // Existing owner changes are always refused; installation needs protected authorization.
 import { realpathSync } from "node:fs";
@@ -14,6 +16,8 @@ import { writeOwnershipCatalog } from "./ownership-catalog.mjs";
 import { createOwnershipEvidence } from "./ownership-evidence.mjs";
 import { spawnSync } from "./background-process.mjs";
 import { main as stagedMain } from "./ownership-staged.mjs";
+import { loadTrustedExternal } from "./ownership-approval.mjs";
+import { trustComparison } from "./ownership-policy-bundle.mjs";
 
 const packageRoot = path.dirname(fileURLToPath(import.meta.url));
 
@@ -22,11 +26,23 @@ function flag(args, name) {
   return i >= 0 ? args[i + 1] : undefined;
 }
 
-export async function main(args, { evidenceFactory = createOwnershipEvidence, gitRunner = spawnSync, print = (value) => console.log(value) } = {}) {
+/** Print this host's protected-trust digest. The Mac's digest is the reference; see docs/OWNERSHIP-ENFORCEMENT.md. */
+export function trustCompare(args, { print, trustLoader = loadTrustedExternal } = {}) {
+  let state;
+  try { state = trustLoader(); } catch (error) { print(`[right-release] trust-compare: protected trust unreadable (${error.message})`); return 1; }
+  if (!state?.trust) { print("[right-release] trust-compare: no protected trust on this host (not enrolled)"); return 1; }
+  const { digest, components } = trustComparison(state.trust);
+  if (args.includes("--json")) print(JSON.stringify({ platform: process.platform, digest, components }, null, 2));
+  else { print(`trust digest (${process.platform}): ${digest}`); for (const [name, value] of Object.entries(components)) print(`  ${name}: ${typeof value === "object" && value !== null ? JSON.stringify(value) : value ?? "none"}`); }
+  return 0;
+}
+
+export async function main(args, { evidenceFactory = createOwnershipEvidence, gitRunner = spawnSync, print = (value) => console.log(value), trustLoader = loadTrustedExternal } = {}) {
   if (args.includes("--help")) {
     print("right-release ownership [--app <dir>] [--json]\nright-release ownership --staged [--app <dir>] [--json]  (pre-commit gate: scans the index, not the working tree)\nright-release ownership --write-manifest [--rightkit <dir>] [--approve-new-capabilities]\n--approve-new-capabilities permits new capability ids during local generation only. Existing owner conflicts are always refused. Protected installation authorization remains separate.");
     return 0;
   }
+  if (args[0] === "trust-compare") return trustCompare(args, { print, trustLoader });
   if (args.includes("--staged")) return stagedMain(args, { print });
   if (["enroll", "approve-key", "revoke-key", "trust-sync"].includes(args[0])) {
     const { main: keyMain } = await import("./ownership-key-command.mjs");
@@ -48,6 +64,7 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
   try { checked = evidenceFactory(repoRoot, app); }
   catch (error) { return failClosed(args, "protected-evidence", error.message, print); }
   const result = checked.result;
+  if (args.includes("--audit-json")) return printAuditJson(result, print);
   if (args.includes("--json")) {
     const error = checked.enrollmentPending ? undefined : !checked.floor.ok
       ? { type: "ownership-floor", message: checked.floor.problems.join("; ") }
@@ -70,7 +87,36 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
   return checked.ok ? 0 : 1;
 }
 
+// Audit provider output: every scan violation (block and advise tiers) as a repo-relative finding.
+// Exit 0 whenever the scan completes; findings never change the exit code.
+export function auditFindings(result) {
+  return {
+    schemaVersion: 1,
+    findings: result.violations.map((v) => {
+      const tier = v.tier ?? "block";
+      const file = String(v.file ?? "").replaceAll("\\", "/");
+      if (!file || file.startsWith("/") || /^[A-Za-z]:/.test(file) || file === ".." || file.startsWith("../") || file.split("/").includes("..")) throw new Error(`audit finding path is outside the audited root: ${v.file}`);
+      const body = v.text ?? `${v.ecosystem ?? "dependency"} ${v.name ?? ""}`.trim();
+      const finding = { rule: String(v.fingerprint), path: file };
+      if (Number.isSafeInteger(v.line) && v.line > 0) finding.line = v.line;
+      finding.message = `${tier === "advise" ? "advise: " : ""}${v.capability} duplicates RightKit owner ${v.package} (${tier}): ${body}`;
+      return finding;
+    }),
+  };
+}
+
+function printAuditJson(result, print) {
+  try {
+    print(JSON.stringify(auditFindings(result)));
+    return 0;
+  } catch (error) {
+    console.error(`[right-release] ownership audit failed: ${error.message}`);
+    return 1;
+  }
+}
+
 function failClosed(args, type, message, print = (value) => console.log(value)) {
+  if (args.includes("--audit-json")) { console.error(`[right-release] ownership audit failed: ${message}`); return 1; }
   if (args.includes("--json")) print(JSON.stringify({ ok: false, error: { type, message }, rows: [], violations: [], covered: [], problems: [message], coverage: [], metadata: null }, null, 2));
   else print(`[right-release] ownership FAILED: ${message}`);
   return 1;