@rightkit/release 0.2.142 → 0.2.144

package/rightkit-ownership.json

@@ -137,12 +137,109 @@
     {
       "package": "rightkit-automation",
       "capability": "desktop-automation",
-      "summary": "Brand-neutral desktop automation: observe and act on any app (macOS AX, Windows UIA) through a four-tier input ladder with safety, focus guard, and evidence receipts.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "summary": "Brand-neutral desktop automation: observe and act on any app (macOS AX, Windows UIA) through a four-tier input ladder with safety, focus guard, and evidence receipts.",
+      "fingerprints": [
+        {
+          "id": "automation.api.ax-element",
+          "type": "source",
+          "pattern": "\\bAXUIElement(?:CreateApplication|CreateSystemWide|CopyAttributeValue|CopyElementAtPosition|PerformAction|SetAttributeValue|CopyActionNames)\\s*\\(",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".c",
+            ".cc",
+            ".cpp",
+            ".h",
+            ".m",
+            ".mm",
+            ".swift"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "automation.api.cgevent-synth",
+          "type": "source",
+          "pattern": "\\bCGEvent(?:CreateKeyboardEvent|CreateMouseEvent|CreateScrollWheelEvent\\w*|Post|PostToPid)\\s*\\(",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".c",
+            ".cc",
+            ".cpp",
+            ".h",
+            ".m",
+            ".mm",
+            ".swift"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "automation.api.uia-com",
+          "type": "source",
+          "pattern": "\\b(?:CUIAutomation8?|IUIAutomation(?:Element|Condition|InvokePattern|ValuePattern)?)\\b",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".c",
+            ".cc",
+            ".cpp",
+            ".h",
+            ".cs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "automation.api.sendinput",
+          "type": "source",
+          "pattern": "\\bSendInput\\s*\\(",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".c",
+            ".cc",
+            ".cpp",
+            ".h",
+            ".cs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -605,12 +702,49 @@
     {
       "package": "rightkit-framed-sidecar",
       "capability": "framed-sidecar",
-      "summary": "Bounded JSON-lines transport primitives for Right Suite sidecars.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "summary": "Bounded JSON-lines transport primitives for Right Suite sidecars.",
+      "fingerprints": [
+        {
+          "id": "sidecar.rs.json-line-read",
+          "type": "source",
+          "pattern": "\\.\\s*read_line\\s*\\(\\s*&mut\\s+\\w+\\s*\\)[^;]*;[\\s\\S]{0,160}?\\bserde_json\\s*::\\s*from_str\\s*\\(",
+          "codeOnly": true,
+          "extensions": [
+            ".rs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "sidecar.rs.length-prefix",
+          "type": "source",
+          "pattern": "\\bread_exact\\s*\\([^;]{0,60}\\)[^;]*;[\\s\\S]{0,120}?\\bu32\\s*::\\s*from_be_bytes\\s*\\(",
+          "codeOnly": true,
+          "extensions": [
+            ".rs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -674,11 +808,92 @@
       "package": "rightkit-fsindex",
       "capability": "file-index",
       "summary": "Live whole-disk file index: getattrlistbulk crawl, FSEvents upkeep, fuzzy name search, and clone- and hard-link-aware folder size rollups (logical, allocated, allocated-unique).",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "fingerprints": [
+        {
+          "id": "fsindex.api.getattrlistbulk",
+          "type": "source",
+          "pattern": "\\bgetattrlistbulk\\s*\\(",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".c",
+            ".cc",
+            ".cpp",
+            ".h",
+            ".m",
+            ".mm",
+            ".swift"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "fsindex.api.fsevent-stream",
+          "type": "source",
+          "pattern": "\\bFSEventStreamCreate(?:RelativeToDevice)?\\s*\\(",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".c",
+            ".cc",
+            ".cpp",
+            ".h",
+            ".m",
+            ".mm",
+            ".swift"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "fsindex.cargo.fsevent-sys",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "fsevent-sys",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "fsindex.cargo.fsevent",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "fsevent",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
-        "Name search and folder sizes only; content search is an opt-in cargo feature that is off by default.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -768,35 +983,63 @@
     {
       "package": "rightkit-jobs",
       "capability": "persistent-jobs",
-      "summary": "Persistent job store, runner, and stdio/CLI command contract for Right Suite engines.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Runner repair remains P1.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "rightkit-license",
-      "capability": "licensing",
-      "summary": "Right Suite license enforcement primitive — offline verification of server-signed Ed25519 entitlement tokens. The Rust (security) half of @rightkit/license.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "rightkit-llm",
-      "capability": "llm-providers",
-      "summary": "Brand-neutral BYOK LLM clients: Anthropic Messages and OpenAI-compatible chat, streaming, tool use, route failover with circuit breaker, pricing, and prompt-cache discipline.",
+      "summary": "Persistent job store, runner, and stdio/CLI command contract for Right Suite engines.",
       "fingerprints": [
         {
-          "id": "llm.cargo.async-openai",
+          "id": "jobs.sql.job-table",
+          "type": "source",
+          "pattern": "\\b(?:execute_batch|execute|exec|run|prepare)\\s*\\(\\s*(?:r#*)?[\"'`][\\s\\S]{0,60}?\\bCREATE\\s+TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?[\"`\\[]?\\w*jobs?[\"`\\]]?\\s*\\((?=[^;]{0,600}\\battempts\\b)(?=[^;]{0,600}\\bstatus\\b)",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".py"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "jobs.sql.claim-next",
+          "type": "source",
+          "pattern": "\\b(?:execute_batch|execute|exec|run|prepare|query_row)\\s*\\(\\s*(?:r#*)?[\"'`][\\s\\S]{0,40}?\\bUPDATE\\s+[\"`]?\\w*jobs?[\"`]?\\s+SET\\s+(?=[^;]{0,300}\\bstatus\\s*=\\s*['\"]?running)(?=[^;]{0,500}\\bWHERE\\b[^;]{0,200}\\bstatus\\s*=\\s*['\"]?queued)",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".py"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "jobs.cargo.apalis",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "async-openai",
+          "name": "apalis",
           "tier": "advise",
           "usageContext": {
             "hosts": [
@@ -808,10 +1051,10 @@
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "llm.cargo.anthropic",
+          "id": "jobs.cargo.sqlxmq",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "anthropic",
+          "name": "sqlxmq",
           "tier": "advise",
           "usageContext": {
             "hosts": [
@@ -823,10 +1066,10 @@
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "llm.cargo.anthropic-sdk",
+          "id": "jobs.cargo.fang",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "anthropic-sdk",
+          "name": "fang",
           "tier": "advise",
           "usageContext": {
             "hosts": [
@@ -838,10 +1081,10 @@
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "llm.npm.openai",
+          "id": "jobs.npm.bullmq",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "openai",
+          "name": "bullmq",
           "tier": "advise",
           "usageContext": {
             "hosts": [
@@ -853,10 +1096,10 @@
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "llm.npm.anthropic-ai.sdk",
+          "id": "jobs.npm.bull",
           "type": "dependency",
           "ecosystem": "npm",
-          "name": "@anthropic-ai/sdk",
+          "name": "bull",
           "tier": "advise",
           "usageContext": {
             "hosts": [
@@ -868,17 +1111,179 @@
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "llm.endpoint.provider-request",
-          "type": "source",
-          "pattern": "\\b(?:fetch|post|request)\\s*\\(\\s*[\"\\x27]https://(?:api\\.anthropic\\.com/v1/messages|api\\.openai\\.com/v1/(?:chat/completions|responses))[\"\\x27]",
-          "codeOnly": true,
-          "extensions": [
-            ".rs",
-            ".ts",
-            ".tsx",
-            ".js",
-            ".mjs",
-            ".cjs",
+          "id": "jobs.npm.agenda",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "agenda",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "jobs.npm.pg-boss",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "pg-boss",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "jobs.npm.better-queue",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "better-queue",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-license",
+      "capability": "licensing",
+      "summary": "Right Suite license enforcement primitive — offline verification of server-signed Ed25519 entitlement tokens. The Rust (security) half of @rightkit/license.",
+      "fingerprints": [
+        {
+          "id": "license.api.ed25519-verifying-key",
+          "type": "source",
+          "pattern": "\\bVerifyingKey\\s*::\\s*from_bytes\\s*\\((?=[\\s\\S]{0,600}?(?:[Ll]icen[sc]e|[Ee]ntitlement|LICEN[SC]E|ENTITLEMENT))",
+          "codeOnly": true,
+          "extensions": [
+            ".rs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-llm",
+      "capability": "llm-providers",
+      "summary": "Brand-neutral BYOK LLM clients: Anthropic Messages and OpenAI-compatible chat, streaming, tool use, route failover with circuit breaker, pricing, and prompt-cache discipline.",
+      "fingerprints": [
+        {
+          "id": "llm.cargo.async-openai",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "async-openai",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "llm.cargo.anthropic",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "anthropic",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "llm.cargo.anthropic-sdk",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "anthropic-sdk",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "llm.npm.openai",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "openai",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "llm.npm.anthropic-ai.sdk",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@anthropic-ai/sdk",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "llm.endpoint.provider-request",
+          "type": "source",
+          "pattern": "\\b(?:fetch|post|request)\\s*\\(\\s*[\"\\x27]https://(?:api\\.anthropic\\.com/v1/messages|api\\.openai\\.com/v1/(?:chat/completions|responses))[\"\\x27]",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
             ".jsx"
           ],
           "tier": "advise",
@@ -902,11 +1307,87 @@
       "package": "rightkit-logs",
       "capability": "structured-logging",
       "summary": "Privacy-safe local JSONL logging and diagnostics for Right Suite desktop apps.",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "fingerprints": [
+        {
+          "id": "logs.cargo.tracing-appender",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tracing-appender",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "logs.cargo.flexi-logger",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "flexi_logger",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "logs.cargo.log4rs",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "log4rs",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "logs.cargo.fern",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "fern",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "logs.cargo.tauri-plugin-log",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tauri-plugin-log",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
-        "JSONL logging only; no tracing/env_logger replacement claimed.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -1251,29 +1732,73 @@
     {
       "package": "rightkit-overlay",
       "capability": "desktop-overlay",
-      "summary": "Shared overlay state, hit testing, and placement policy for Right Suite apps; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "rightkit-ownership",
-      "capability": "ownership-scanner",
-      "summary": "RightKit's ownership scanner, verdict and admission: committed-tree inventory, dependency and source fingerprint findings, signed exception evaluation, the six-binding cache key, and single-flight admission for brokers.",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Declaration-only: the scanner is the enforcement point, so it has no competing-dependency fingerprints.",
-        "Shared contract fixtures live in packages/release/fixtures/ownership and are run in place by this crate's tests."
-      ]
-    },
-    {
-      "package": "rightkit-pdf",
-      "capability": "pdf-engine",
-      "summary": "Product-neutral PDF engine: inspect, compose (source-text replace / add text / OCR correction), font subsetting, staged atomic save, plus optional page merge/select and text extraction",
+      "summary": "Shared overlay state, hit testing, and placement policy for Right Suite apps",
+      "fingerprints": [
+        {
+          "id": "overlay.api.ws-ex-noactivate",
+          "type": "source",
+          "pattern": "\\bWS_EX_NOACTIVATE\\b",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".c",
+            ".cc",
+            ".cpp",
+            ".h",
+            ".cs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "overlay.api.ns-ignores-mouse",
+          "type": "source",
+          "pattern": "\\bsetIgnoresMouseEvents\\s*[(:]|\\bignoresMouseEvents\\s*=(?!=)",
+          "codeOnly": true,
+          "extensions": [
+            ".swift",
+            ".m",
+            ".mm"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-ownership",
+      "capability": "ownership-scanner",
+      "summary": "RightKit's ownership scanner, verdict and admission: committed-tree inventory, dependency and source fingerprint findings, signed exception evaluation, the six-binding cache key, and single-flight admission for brokers.",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: the scanner is the enforcement point, so it has no competing-dependency fingerprints.",
+        "Shared contract fixtures live in packages/release/fixtures/ownership and are run in place by this crate's tests."
+      ]
+    },
+    {
+      "package": "rightkit-pdf",
+      "capability": "pdf-engine",
+      "summary": "Product-neutral PDF engine: inspect, compose (source-text replace / add text / OCR correction), font subsetting, staged atomic save, plus optional page merge/select and text extraction",
       "fingerprints": [
         {
           "id": "pdf.cargo.lopdf",
@@ -1330,12 +1855,37 @@
     {
       "package": "rightkit-playback",
       "capability": "media-playback",
-      "summary": "Source-preserving FFmpeg compatibility playback preparation for Right Suite media apps.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "summary": "Source-preserving FFmpeg compatibility playback preparation for Right Suite media apps.",
+      "fingerprints": [
+        {
+          "id": "playback.ffmpeg.faststart-copy",
+          "type": "source",
+          "pattern": "\\b(?:Command\\s*::\\s*new|\\.args?|spawn\\w*|execFile\\w*|exec\\w*|outputOptions?)\\s*\\((?=[^;]{0,500}(?:[\"']copy[\"']|-c(?::v)?\\s+copy))[^;]{0,400}?(?:[\"']-movflags[\"']\\s*,\\s*[\"']\\+faststart[\"']|-movflags\\s+\\+faststart)",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -1613,23 +2163,12 @@
       "package": "rightkit-search",
       "capability": "search",
       "summary": "Product-neutral search query language: lexer, AST, operator values, SQL/FTS5 predicate compiler, snippets, and an in-memory filename index.",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Query language, FTS5 predicates/snippets & optional filename index; no generic full-text engine replacement.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "rightkit-secrets",
-      "capability": "os-credential-store",
-      "summary": "Keychain / Credential Manager access with per-app namespaces and test guards",
       "fingerprints": [
         {
-          "id": "secrets.cargo.keyring",
+          "id": "search.cargo.tantivy",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "keyring",
+          "name": "tantivy",
           "tier": "advise",
           "usageContext": {
             "hosts": [
@@ -1641,48 +2180,25 @@
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "secrets.npm.keytar",
+          "id": "search.cargo.nucleo",
           "type": "dependency",
-          "ecosystem": "npm",
-          "name": "keytar",
+          "ecosystem": "cargo",
+          "name": "nucleo",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
-        }
-      ],
-      "detection": "fingerprinted",
-      "policyNotes": [
-        "Cross-process Windows key race repair remains P1.",
-        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
-      ]
-    },
-    {
-      "package": "rightkit-service",
-      "capability": "local-services",
-      "summary": "One discovery/auth convention for Right Suite local services: service.json, ranking and takeover, current-user-only Unix socket / named pipe, per-app request allowlist.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "rightkit-settings",
-      "capability": "settings-persistence",
-      "summary": "Versioned per-app settings persistence: migrations, typed defaults, atomic writes, corruption recovery, change events.",
-      "fingerprints": [
+        },
         {
-          "id": "settings.cargo.tauri-plugin-store",
+          "id": "search.cargo.fuzzy-matcher",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "tauri-plugin-store",
+          "name": "fuzzy-matcher",
           "tier": "advise",
           "usageContext": {
             "hosts": [
@@ -1692,106 +2208,104 @@
             "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
-        }
-      ],
-      "detection": "fingerprinted",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
-      ]
-    },
-    {
-      "package": "rightkit-shell",
-      "capability": "desktop-shell",
-      "summary": "Tauri shell: tray, autostart, deep links, single instance, window state, notifications",
-      "fingerprints": [
+        },
         {
-          "id": "shell.cargo.tauri-plugin-autostart",
+          "id": "search.npm.fuse-js",
           "type": "dependency",
-          "ecosystem": "cargo",
-          "name": "tauri-plugin-autostart",
+          "ecosystem": "npm",
+          "name": "fuse.js",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "shell.cargo.tauri-plugin-deep-link",
+          "id": "search.npm.flexsearch",
           "type": "dependency",
-          "ecosystem": "cargo",
-          "name": "tauri-plugin-deep-link",
+          "ecosystem": "npm",
+          "name": "flexsearch",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "shell.cargo.tauri-plugin-single-instance",
+          "id": "search.npm.minisearch",
           "type": "dependency",
-          "ecosystem": "cargo",
-          "name": "tauri-plugin-single-instance",
+          "ecosystem": "npm",
+          "name": "minisearch",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "shell.cargo.tauri-plugin-window-state",
+          "id": "search.npm.lunr",
           "type": "dependency",
-          "ecosystem": "cargo",
-          "name": "tauri-plugin-window-state",
+          "ecosystem": "npm",
+          "name": "lunr",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "shell.cargo.tauri-plugin-notification",
+          "id": "search.npm.search-query-parser",
           "type": "dependency",
-          "ecosystem": "cargo",
-          "name": "tauri-plugin-notification",
+          "ecosystem": "npm",
+          "name": "search-query-parser",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "shell.cargo.auto-launch",
-          "type": "dependency",
-          "ecosystem": "cargo",
-          "name": "auto-launch",
+          "id": "search.sql.fts5-query",
+          "type": "source",
+          "pattern": "\\b(?:execute_batch|execute|exec|prepare|query_row|query_map|query|all|get|run)\\s*\\(\\s*(?:r#*)?[\"'`][\\s\\S]{0,300}?(?:\\b\\w*[Ff][Tt][Ss]\\w*\\s+MATCH\\s+(?:\\?\\d*|:\\w+|@\\w+|\\$\\d+)|\\b(?:bm25|snippet|highlight)\\s*\\(\\s*\\w*[Ff][Tt][Ss])",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".py"
+          ],
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
@@ -1799,52 +2313,19 @@
       "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
-      ]
-    },
-    {
-      "package": "rightkit-speech-client",
-      "capability": "shared-speech-service",
-      "summary": "Client and contract for the Orthic Labs shared speech service (one resident engine per machine), built on rightkit-service. Wire-compatible with HeardRight's v1 host.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "rightkit-sync",
-      "capability": "cloud-sync",
-      "summary": "Brand-neutral desktop/mobile cloud sync engine: change tokens, tombstones, last-writer-wins conflicts, resumable batches, offline queue, retry/backoff.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "rightkit-tauri",
-      "capability": "tauri-host-adapters",
-      "summary": "Native host services for Right Suite Tauri license and device adapters.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
-      "package": "rightkit-transcript",
-      "capability": "timed-transcripts",
-      "summary": "Product-neutral word-timed transcript contract, cue segmentation, and SRT/VTT/JSON import and export for Right Suite applications",
+      "package": "rightkit-secrets",
+      "capability": "os-credential-store",
+      "summary": "Keychain / Credential Manager access with per-app namespaces and test guards",
       "fingerprints": [
         {
-          "id": "transcript.cargo.srtparse",
+          "id": "secrets.cargo.keyring",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "srtparse",
+          "name": "keyring",
           "tier": "advise",
           "usageContext": {
             "hosts": [
@@ -1856,79 +2337,121 @@
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "transcript.cargo.subtp",
+          "id": "secrets.npm.keytar",
           "type": "dependency",
-          "ecosystem": "cargo",
-          "name": "subtp",
+          "ecosystem": "npm",
+          "name": "keytar",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
       ],
       "detection": "fingerprinted",
       "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
+        "Cross-process Windows key race repair remains P1.",
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
-      "package": "rightkit-tts",
-      "capability": "text-to-speech",
-      "summary": "Shared local QTS and operating-system speech synthesis for Right Suite apps",
+      "package": "rightkit-service",
+      "capability": "local-services",
+      "summary": "One discovery/auth convention for Right Suite local services: service.json, ranking and takeover, current-user-only Unix socket / named pipe, per-app request allowlist.",
       "fingerprints": [
         {
-          "id": "tts.cargo.tts",
-          "type": "dependency",
-          "ecosystem": "cargo",
-          "name": "tts",
+          "id": "service.api.peer-credentials",
+          "type": "source",
+          "pattern": "\\bgetpeereid\\s*\\(|\\b(?:LOCAL_PEERCRED|SO_PEERCRED)\\b",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".c",
+            ".cc",
+            ".cpp",
+            ".h",
+            ".m",
+            ".mm",
+            ".swift"
+          ],
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
-        }
-      ],
-      "detection": "fingerprinted",
-      "policyNotes": [
-        "Local QTS & OS voices need separate backend qualification.",
-        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
-      ]
-    },
-    {
-      "package": "rightkit-vad",
-      "capability": "voice-activity-detection",
-      "summary": "Product-neutral voice activity detection: Silero scorer, hysteresis/padding/chunking policy, streaming frame carry",
-      "fingerprints": [
+        },
         {
-          "id": "vad.cargo.webrtc-vad",
-          "type": "dependency",
-          "ecosystem": "cargo",
-          "name": "webrtc-vad",
+          "id": "service.api.owner-only-pipe-sddl",
+          "type": "source",
+          "pattern": "\\b(?:format!|format|sprintf)\\s*\\(\\s*[\"']D:P\\(A;;GA;;;",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".c",
+            ".cc",
+            ".cpp",
+            ".h",
+            ".cs"
+          ],
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "vad.cargo.voice_activity_detector",
+          "id": "service.discovery.service-json",
+          "type": "source",
+          "pattern": "\\b(?:join|push)\\s*\\([^()]{0,100}[\"']service\\.json[\"']\\s*\\)",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "rightkit-settings",
+      "capability": "settings-persistence",
+      "summary": "Versioned per-app settings persistence: migrations, typed defaults, atomic writes, corruption recovery, change events.",
+      "fingerprints": [
+        {
+          "id": "settings.cargo.tauri-plugin-store",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "voice_activity_detector",
+          "name": "tauri-plugin-store",
           "tier": "advise",
           "usageContext": {
             "hosts": [
@@ -1942,20 +2465,20 @@
       ],
       "detection": "fingerprinted",
       "policyNotes": [
-        "Default-feature repair & scorer parity remain required.",
+        "Package contract retained; dependency declarations do not verify integration.",
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
-      "package": "rightkit-watch",
-      "capability": "file-watching",
-      "summary": "Coalesced, ignore-aware file watching with rescan recovery",
+      "package": "rightkit-shell",
+      "capability": "desktop-shell",
+      "summary": "Tauri shell: tray, autostart, deep links, single instance, window state, notifications",
       "fingerprints": [
         {
-          "id": "watch.cargo.notify",
+          "id": "shell.cargo.tauri-plugin-autostart",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "notify",
+          "name": "tauri-plugin-autostart",
           "tier": "advise",
           "usageContext": {
             "hosts": [
@@ -1967,10 +2490,10 @@
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "watch.cargo.notify-debouncer-full",
+          "id": "shell.cargo.tauri-plugin-deep-link",
           "type": "dependency",
           "ecosystem": "cargo",
-          "name": "notify-debouncer-full",
+          "name": "tauri-plugin-deep-link",
           "tier": "advise",
           "usageContext": {
             "hosts": [
@@ -1982,17 +2505,62 @@
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "watch.npm.chokidar",
+          "id": "shell.cargo.tauri-plugin-single-instance",
           "type": "dependency",
-          "ecosystem": "npm",
-          "name": "chokidar",
+          "ecosystem": "cargo",
+          "name": "tauri-plugin-single-instance",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "shell.cargo.tauri-plugin-window-state",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tauri-plugin-window-state",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "shell.cargo.tauri-plugin-notification",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "tauri-plugin-notification",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "shell.cargo.auto-launch",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "auto-launch",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
@@ -2004,31 +2572,57 @@
       ]
     },
     {
-      "package": "@rightkit/agent-room-mcp",
-      "capability": "agent-room",
-      "summary": "Agent room MCP adapter; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "@rightkit/app-shell",
-      "capability": "app-shell-ui",
-      "summary": "Brand-neutral React frame for Right Suite desktop apps: optional fused sidebar+titlebar layout with slots, command palette, shortcut registry/help, toasts, modals, context menus, ui kit, theme hooks.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "package": "rightkit-speech-client",
+      "capability": "shared-speech-service",
+      "summary": "Client and contract for the Orthic Labs shared speech service (one resident engine per machine), built on rightkit-service. Wire-compatible with HeardRight's v1 host.",
+      "fingerprints": [
+        {
+          "id": "speech.protocol.schema-name",
+          "type": "source",
+          "pattern": "\\bschema_name\\s*[!=]=\\s*&?\\s*[\"'](?:file_transcription(?:_\\w+)?|engine_health)[\"']",
+          "codeOnly": true,
+          "extensions": [
+            ".rs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "speech.spawn.speech-service-flag",
+          "type": "source",
+          "pattern": "\\b(?:Command\\s*::\\s*new|\\.args?)\\s*\\([^;]{0,200}?[\"']--speech-service[\"']",
+          "codeOnly": true,
+          "extensions": [
+            ".rs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
-      "package": "@rightkit/ax",
-      "capability": "agent-experience-gates",
-      "summary": "Suite-wide agent-experience (AX) + agent-plugins.org conformance layer: plugin scaffolding/validation and AXA-1 static/conformance/behavioral gates over one product's MCP/CLI surface.; declaration-only detection (no precise implementation fingerprint)",
+      "package": "rightkit-sync",
+      "capability": "cloud-sync",
+      "summary": "Brand-neutral desktop/mobile cloud sync engine: change tokens, tombstones, last-writer-wins conflicts, resumable batches, offline queue, retry/backoff.; declaration-only detection (no precise implementation fingerprint)",
       "fingerprints": [],
       "detection": "declaration-only",
       "policyNotes": [
@@ -2037,22 +2631,25 @@
       ]
     },
     {
-      "package": "@rightkit/doc-render",
-      "capability": "document-rendering",
-      "summary": "Brand-neutral, read-only document renderer (Markdown, sanitized HTML, safe email frame) for Right Suite readers.",
+      "package": "rightkit-tauri",
+      "capability": "tauri-host-adapters",
+      "summary": "Native host services for Right Suite Tauri license and device adapters.",
       "fingerprints": [
         {
-          "id": "doc-render.npm.remark-parse",
-          "type": "dependency",
-          "ecosystem": "npm",
-          "name": "remark-parse",
+          "id": "tauri.rs.standard-command-fn",
+          "type": "source",
+          "pattern": "\\bfn\\s+(?:secure_update_license_(?:get|set|delete)|secure_device_id_get_or_create)\\s*\\((?![\\s\\S]{0,800}?\\b(?:rightkit_tauri|SecureService|DeviceService|AuthorizationService)\\b)",
+          "codeOnly": true,
+          "extensions": [
+            ".rs"
+          ],
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
@@ -2060,208 +2657,181 @@
       "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
-      ]
-    },
-    {
-      "package": "@rightkit/git",
-      "capability": "github-workflows",
-      "summary": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "@rightkit/hooks",
-      "capability": "lifecycle-hooks",
-      "summary": "Neutral lifecycle runtime shared by independently installable agent systems.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "stdin repair remains P1.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
-      "package": "@rightkit/i18n",
-      "capability": "localization",
-      "summary": "Shared locale catalog and React provider for Right Suite apps.",
+      "package": "rightkit-transcript",
+      "capability": "timed-transcripts",
+      "summary": "Product-neutral word-timed transcript contract, cue segmentation, and SRT/VTT/JSON import and export for Right Suite applications",
       "fingerprints": [
         {
-          "id": "i18n.npm.i18next",
+          "id": "transcript.cargo.srtparse",
           "type": "dependency",
-          "ecosystem": "npm",
-          "name": "i18next",
+          "ecosystem": "cargo",
+          "name": "srtparse",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         },
         {
-          "id": "i18n.npm.react-i18next",
+          "id": "transcript.cargo.subtp",
           "type": "dependency",
-          "ecosystem": "npm",
-          "name": "react-i18next",
+          "ecosystem": "cargo",
+          "name": "subtp",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
       ],
       "detection": "fingerprinted",
       "policyNotes": [
-        "Parked per D6; publication alone does not justify mandatory adoption.",
+        "Package contract retained; dependency declarations do not verify integration.",
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
-      "package": "@rightkit/legal",
-      "capability": "legal-assent",
-      "summary": "Legal manifest, assent receipt, and release-contract primitives for proprietary Right Suite desktop apps.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "@rightkit/legal-ui",
-      "capability": "legal-ui",
-      "summary": "The one first-run / re-acceptance legal gate screen for Right Suite desktop apps.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "@rightkit/license",
-      "capability": "licensing",
-      "summary": "The one license client for every Right Suite app (online token-exchange against the unified RightApps backend, with per-kind offline grace).; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "@rightkit/logs",
-      "capability": "structured-logging",
-      "summary": "Local-only structured logging and diagnostics client for Right Suite apps.",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Native invoke JSONL adapter; no generic JS logger replacement claimed.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "@rightkit/media-ui",
-      "capability": "media-ui",
-      "summary": "Brand-neutral media player and image viewer/editor for Right Suite apps.",
+      "package": "rightkit-tts",
+      "capability": "text-to-speech",
+      "summary": "Shared local QTS and operating-system speech synthesis for Right Suite apps",
       "fingerprints": [
         {
-          "id": "media-ui.npm.react-image-crop",
+          "id": "tts.cargo.tts",
           "type": "dependency",
-          "ecosystem": "npm",
-          "name": "react-image-crop",
+          "ecosystem": "cargo",
+          "name": "tts",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
       ],
       "detection": "fingerprinted",
       "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
+        "Local QTS & OS voices need separate backend qualification.",
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
-      "package": "@rightkit/onboarding",
-      "capability": "onboarding-ui",
-      "summary": "First-run onboarding framework: ordered steps, progress, skip/resume, legal gate first, permissions, model download and licence/trial steps.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "@rightkit/pdf-ui",
-      "capability": "pdf-ui",
-      "summary": "Brand-neutral read-only PDF viewer (pdf.js) for Right Suite apps.",
+      "package": "rightkit-vad",
+      "capability": "voice-activity-detection",
+      "summary": "Product-neutral voice activity detection: Silero scorer, hysteresis/padding/chunking policy, streaming frame carry",
       "fingerprints": [
         {
-          "id": "pdf-ui.npm.pdfjs-dist",
+          "id": "vad.cargo.webrtc-vad",
           "type": "dependency",
-          "ecosystem": "npm",
-          "name": "pdfjs-dist",
+          "ecosystem": "cargo",
+          "name": "webrtc-vad",
           "tier": "advise",
           "usageContext": {
             "hosts": [
               "macos",
               "windows"
             ],
-            "scope": "Direct PDF rendering; injected worker/configuration & authenticated owner-only transitive dependencies are permitted"
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "vad.cargo.voice_activity_detector",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "voice_activity_detector",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
           },
           "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
         }
       ],
       "detection": "fingerprinted",
       "policyNotes": [
-        "Direct pdfjs-dist can be host worker configuration; owner-only transitive use needs authenticated reachability.",
+        "Default-feature repair & scorer parity remain required.",
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
-      "package": "@rightkit/platform-ui",
-      "capability": "platform-ui",
-      "summary": "Brand-neutral platform, shortcut, and window-control primitives for Right Suite apps.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
-      "policyNotes": [
-        "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
-      ]
-    },
-    {
-      "package": "@rightkit/qa",
-      "capability": "qa-evidence",
-      "summary": "Shared QA evidence, ownership, browser helpers, and release-backdoor guards for Right Suite apps.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "package": "rightkit-watch",
+      "capability": "file-watching",
+      "summary": "Coalesced, ignore-aware file watching with rescan recovery",
+      "fingerprints": [
+        {
+          "id": "watch.cargo.notify",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "notify",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "watch.cargo.notify-debouncer-full",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "notify-debouncer-full",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "watch.npm.chokidar",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "chokidar",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
     {
-      "package": "@rightkit/qa-chrome",
-      "capability": "browser-qa",
-      "summary": "Zero-dependency Chrome for Testing resolver, launcher and graceful close for Right Suite QA harnesses.; declaration-only detection (no precise implementation fingerprint)",
+      "package": "@rightkit/agent-room-mcp",
+      "capability": "agent-room",
+      "summary": "Agent room MCP adapter; declaration-only detection (no precise implementation fingerprint)",
       "fingerprints": [],
       "detection": "declaration-only",
       "policyNotes": [
@@ -2270,14 +2840,1036 @@
       ]
     },
     {
-      "package": "@rightkit/release",
-      "capability": "release-tooling",
-      "summary": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "package": "@rightkit/app-shell",
+      "capability": "app-shell-ui",
+      "summary": "Brand-neutral React frame for Right Suite desktop apps: optional fused sidebar+titlebar layout with slots, command palette, shortcut registry/help, toasts, modals, context menus, ui kit, theme hooks.",
+      "fingerprints": [
+        {
+          "id": "app-shell.npm.cmdk",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "cmdk",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "app-shell.npm.kbar",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "kbar",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "app-shell.npm.sonner",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "sonner",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "app-shell.npm.react-hot-toast",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "react-hot-toast",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "app-shell.npm.react-toastify",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "react-toastify",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "app-shell.npm.react-hotkeys-hook",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "react-hotkeys-hook",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "app-shell.npm.tinykeys",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "tinykeys",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "app-shell.npm.hotkeys-js",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "hotkeys-js",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "app-shell.npm.mousetrap",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "mousetrap",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "app-shell.jsx.drag-region",
+          "type": "source",
+          "pattern": "\\bdata-tauri-drag-region\\b",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/ax",
+      "capability": "agent-experience-gates",
+      "summary": "Suite-wide agent-experience (AX) + agent-plugins.org conformance layer: plugin scaffolding/validation and AXA-1 static/conformance/behavioral gates over one product's MCP/CLI surface.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/doc-render",
+      "capability": "document-rendering",
+      "summary": "Brand-neutral, read-only document renderer (Markdown, sanitized HTML, safe email frame) for Right Suite readers.",
+      "fingerprints": [
+        {
+          "id": "doc-render.npm.remark-parse",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "remark-parse",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/git",
+      "capability": "github-workflows",
+      "summary": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/hooks",
+      "capability": "lifecycle-hooks",
+      "summary": "Neutral lifecycle runtime shared by independently installable agent systems.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "stdin repair remains P1.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/i18n",
+      "capability": "localization",
+      "summary": "Shared locale catalog and React provider for Right Suite apps.",
+      "fingerprints": [
+        {
+          "id": "i18n.npm.i18next",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "i18next",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "i18n.npm.react-i18next",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "react-i18next",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Parked per D6; publication alone does not justify mandatory adoption.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/legal",
+      "capability": "legal-assent",
+      "summary": "Legal manifest, assent receipt, and release-contract primitives for proprietary Right Suite desktop apps.; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
+    {
+      "package": "@rightkit/legal-ui",
+      "capability": "legal-ui",
+      "summary": "The one first-run / re-acceptance legal gate screen for Right Suite desktop apps.",
+      "fingerprints": [
+        {
+          "id": "legal.storage.assent-flag",
+          "type": "source",
+          "pattern": "\\blocalStorage\\s*\\.\\s*(?:getItem|setItem)\\s*\\(\\s*[\"'][\\w.:/-]*(?:eula|terms[-_.:]?(?:accepted|agreed)|tos[-_.:]?accepted|legal[-_.:]?(?:accepted|assent))[\\w.:/-]*[\"']",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/license",
+      "capability": "licensing",
+      "summary": "The one license client for every Right Suite app (online token-exchange against the unified RightApps backend, with per-kind offline grace).",
+      "fingerprints": [
+        {
+          "id": "license.npm.lemonsqueezy",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@lemonsqueezy/lemonsqueezy.js",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "license.npm.paddle-node-sdk",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@paddle/paddle-node-sdk",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "license.npm.polar-sdk",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@polar-sh/sdk",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "license.npm.noble-ed25519",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@noble/ed25519",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "license.endpoint.activation",
+          "type": "source",
+          "pattern": "\\b(?:fetch|post|get|request|send)\\s*\\(\\s*(?:&?format!\\s*\\(\\s*)?[`\"'](?:https?://|\\$\\{)[^`\"'\\n]*/v1/licenses/(?:activate|refresh|deactivate)\\b",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/logs",
+      "capability": "structured-logging",
+      "summary": "Local-only structured logging and diagnostics client for Right Suite apps.",
+      "fingerprints": [
+        {
+          "id": "logs.npm.electron-log",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "electron-log",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "logs.npm.tauri-plugin-log",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@tauri-apps/plugin-log",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "logs.invoke.rightkit-commands",
+          "type": "source",
+          "pattern": "\\binvoke\\s*(?:<[^>()]*>)?\\s*\\(\\s*[\"']rightkit_logs_(?:write|collect|clear)[\"']",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/media-ui",
+      "capability": "media-ui",
+      "summary": "Brand-neutral media player and image viewer/editor for Right Suite apps.",
+      "fingerprints": [
+        {
+          "id": "media-ui.npm.react-image-crop",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "react-image-crop",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/onboarding",
+      "capability": "onboarding-ui",
+      "summary": "First-run onboarding framework: ordered steps, progress, skip/resume, legal gate first, permissions, model download and licence/trial steps.",
+      "fingerprints": [
+        {
+          "id": "onboarding.npm.react-joyride",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "react-joyride",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "onboarding.npm.driver-js",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "driver.js",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "onboarding.npm.intro-js",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "intro.js",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "onboarding.npm.shepherd-js",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "shepherd.js",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "onboarding.npm.reactour-tour",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@reactour/tour",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "onboarding.npm.react-shepherd",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "react-shepherd",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "onboarding.storage.completion-flag",
+          "type": "source",
+          "pattern": "\\blocalStorage\\s*\\.\\s*(?:getItem|setItem)\\s*\\(\\s*[\"'][\\w.:/-]*(?:onboard|first[-_]?run|welcome[-_]?seen)[\\w.:/-]*[\"']",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/pdf-ui",
+      "capability": "pdf-ui",
+      "summary": "Brand-neutral read-only PDF viewer (pdf.js) for Right Suite apps.",
+      "fingerprints": [
+        {
+          "id": "pdf-ui.npm.pdfjs-dist",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "pdfjs-dist",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Direct PDF rendering; injected worker/configuration & authenticated owner-only transitive dependencies are permitted"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Direct pdfjs-dist can be host worker configuration; owner-only transitive use needs authenticated reachability.",
+        "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/platform-ui",
+      "capability": "platform-ui",
+      "summary": "Brand-neutral platform, shortcut, and window-control primitives for Right Suite apps.",
+      "fingerprints": [
+        {
+          "id": "platform.js.user-agent-sniff",
+          "type": "source",
+          "pattern": "\\bnavigator\\s*\\??\\.\\s*(?:platform|userAgent)\\s*\\??\\.\\s*(?:to(?:Lower|Upper)Case\\s*\\(\\s*\\)\\s*\\??\\.\\s*)?(?:includes|indexOf|startsWith|match|search)\\s*\\(\\s*[\"'/](?:[Mm]ac|MAC|[Ww]in|WIN|iPhone|iPad)|/[^/\\n]{0,40}\\b(?:[Mm]ac|[Ww]in|iphone|ipad)[^/\\n]{0,40}/[a-z]*\\s*\\.\\s*test\\s*\\(\\s*navigator\\s*\\.\\s*(?:platform|userAgent)\\b",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/qa",
+      "capability": "qa-evidence",
+      "summary": "Shared QA evidence, ownership, browser helpers, and release-backdoor guards for Right Suite apps.",
+      "fingerprints": [
+        {
+          "id": "qa.cdp.method-call",
+          "type": "source",
+          "pattern": "\\b(?:send|sendCommand|call|command|execute|request)\\s*\\(\\s*[\"'](?:Page\\.(?:captureScreenshot|navigate|enable)|Runtime\\.(?:evaluate|callFunctionOn)|Input\\.dispatch(?:Mouse|Key)Event|DOM\\.(?:getDocument|querySelector)|Target\\.(?:attachToTarget|createTarget))[\"']",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs",
+            ".py"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "qa.chrome.remote-debugging-flag",
+          "type": "source",
+          "pattern": "\\b(?:spawn\\w*|execFile\\w*|Command\\s*::\\s*new|\\.args?|push)\\s*\\([^;]{0,300}?[\"'`]--remote-debugging-(?:port|pipe)",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/qa-chrome",
+      "capability": "browser-qa",
+      "summary": "Zero-dependency Chrome for Testing resolver, launcher and graceful close for Right Suite QA harnesses.",
+      "fingerprints": [
+        {
+          "id": "qa-chrome.npm.chrome-launcher",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "chrome-launcher",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "qa-chrome.npm.puppeteer-browsers",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@puppeteer/browsers",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "qa-chrome.npm.chromedriver",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "chromedriver",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "qa-chrome.npm.chrome-remote-interface",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "chrome-remote-interface",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "qa-chrome.url.chrome-for-testing",
+          "type": "source",
+          "pattern": "\\b(?:fetch|get|request|download\\w*)\\s*\\(\\s*[`\"'][^`\"'\\n]*(?:googlechromelabs\\.github\\.io/chrome-for-testing|storage\\.googleapis\\.com/chrome-for-testing-public)",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs",
+            ".py"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
+      ]
+    },
+    {
+      "package": "@rightkit/release",
+      "capability": "release-tooling",
+      "summary": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
+      "fingerprints": [
+        {
+          "id": "release.sign.codesign-signtool",
+          "type": "source",
+          "pattern": "\\b(?:Command\\s*::\\s*new|spawn\\w*|execFile\\w*|exec\\w*)\\s*\\(\\s*(?:[\"`]\\s*(?:codesign\\b[^\"`';]{0,160}--sign|signtool(?:\\.exe)?\\s+sign\\b)|[\"'](?:codesign|signtool(?:\\.exe)?)[\"'][^;]{0,300}?[\"'](?:--sign|sign)[\"'])",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs",
+            ".py"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.notarize.notarytool",
+          "type": "source",
+          "pattern": "\\b(?:Command\\s*::\\s*new|spawn\\w*|execFile\\w*|exec\\w*)\\s*\\([^;]{0,200}?[\"'`\\s]notarytool\\b",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs",
+            ".py"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-builder",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "electron-builder",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-notarize",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "electron-notarize",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-notarize-scoped",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@electron/notarize",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-osx-sign",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "electron-osx-sign",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-osx-sign-scoped",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@electron/osx-sign",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.create-dmg",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "create-dmg",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.appdmg",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "appdmg",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.cargo.apple-codesign",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "apple-codesign",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
@@ -2305,45 +3897,300 @@
     {
       "package": "@rightkit/tauri",
       "capability": "tauri-host-adapters",
-      "summary": "Typed host adapters for shared Right Suite Tauri commands.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "summary": "Typed host adapters for shared Right Suite Tauri commands.",
+      "fingerprints": [
+        {
+          "id": "tauri.invoke.standard-commands",
+          "type": "source",
+          "pattern": "\\binvoke\\s*(?:<[^>()]*>)?\\s*\\(\\s*[\"'](?:secure_update_license_(?:get|set|delete)|secure_device_id_get_or_create|collect_diagnostics|clear_diagnostic_logs)[\"']",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
       "package": "@rightkit/theme",
       "capability": "theme-ui",
-      "summary": "Brand file to CSS tokens generator for Right Suite apps: light/dark/system, derived dark accent, WCAG contrast and hard-coded-colour checks, runtime brand application.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "summary": "Brand file to CSS tokens generator for Right Suite apps: light/dark/system, derived dark accent, WCAG contrast and hard-coded-colour checks, runtime brand application.",
+      "fingerprints": [
+        {
+          "id": "theme.npm.next-themes",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "next-themes",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "theme.npm.use-dark-mode",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "use-dark-mode",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "theme.npm.style-dictionary",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "style-dictionary",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "theme.npm.wcag-contrast",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "wcag-contrast",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "theme.npm.color-contrast-checker",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "color-contrast-checker",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "theme.math.relative-luminance",
+          "type": "source",
+          "pattern": "(?<![\\d.])0?\\.2126\\b[\\s\\S]{0,60}?(?<![\\d.])0?\\.7152\\b",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs",
+            ".swift"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "theme.runtime.prefers-dark",
+          "type": "source",
+          "pattern": "\\bmatchMedia\\s*\\(\\s*[\"']\\(\\s*prefers-color-scheme\\s*:\\s*dark\\s*\\)[\"']\\s*\\)",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
       "package": "@rightkit/updates",
       "capability": "update-policy",
-      "summary": "Shared runtime update policy helper for Right Suite Tauri apps.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "summary": "Shared runtime update policy helper for Right Suite Tauri apps.",
+      "fingerprints": [
+        {
+          "id": "updates.api.download-and-install",
+          "type": "source",
+          "pattern": "\\.\\s*(?:downloadAndInstall|download_and_install)\\s*\\(",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
-        "Injected updater implementations remain host-owned; ready-before-install repair remains P1.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
     {
       "package": "RightKitSwift",
       "capability": "os-credential-store",
       "summary": "Native Apple scoped credential storage and sync migration",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "fingerprints": [
+        {
+          "id": "keychain.api.secitem",
+          "type": "source",
+          "pattern": "\\bSecItem(?:Add|CopyMatching|Update|Delete)\\s*\\(",
+          "codeOnly": true,
+          "extensions": [
+            ".swift",
+            ".m",
+            ".mm",
+            ".rs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "keychain.swiftpm.keychainaccess",
+          "type": "dependency",
+          "ecosystem": "swiftpm",
+          "name": "keychainaccess",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "swiftpm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "keychain.swiftpm.keychainswift",
+          "type": "dependency",
+          "ecosystem": "swiftpm",
+          "name": "keychainswift",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "swiftpm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "keychain.swiftpm.swiftkeychainwrapper",
+          "type": "dependency",
+          "ecosystem": "swiftpm",
+          "name": "swiftkeychainwrapper",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "swiftpm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "keychain.swiftpm.valet",
+          "type": "dependency",
+          "ecosystem": "swiftpm",
+          "name": "valet",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "swiftpm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
-        "Apple-only SwiftPM owner; cannot qualify as usable on both hosts.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     }
   ],