@rightkit/release 0.2.143 → 0.2.144

package/build-release.mjs

@@ -24,6 +24,7 @@ import { spawn, spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
+import { assertSourceQaAdmission } from "./release-qa-receipt.mjs";
 import { commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, verifySealedRelease, watchProgress } from "./release-state.mjs";
 import { acquireCacheLease, acquireSuiteBuildSlot, applyCachePrune, assertWriteVolumeFloors, inspectCache, inspectWriteVolumes, markCacheEntrySuccessful, planCachePrune, readCachePolicy, resolveCacheLayout, resolveSharedCacheIdentity, resolveSharedCacheRoot } from "./cache-policy.mjs";
 import { createTargetBridge } from "./target-bridge.mjs";
@@ -253,6 +254,15 @@ try {
   for (const check of preflight) {
     if (check.status !== "ok") console.error(`[right-release] preflight ${check.name}: ${check.detail}`);
   }
+  // Hardening step 4: source QA admits the candidate build/sign. The receipt digest is sealed into the manifest so
+  // upload/publication can require installed QA chained to it. Dev lanes (install-app --dev) never reach this file.
+  let qaAdmission;
+  try {
+    qaAdmission = assertSourceQaAdmission({ repoRoot: layout.repoRoot, releaseId, platform, configName: path.relative(process.cwd(), configPath) || path.basename(configPath), releaseConfigSha256: hashFile(configPath) });
+  } catch (error) {
+    if (error?.code !== "QA_ADMISSION_REFUSED") throw error;
+    fail(error.message);
+  }
 
   // A tool being INSTALLED is not the same as it being the one PATH picks. The
   // vendored-OpenSSL build shells out to `perl`, and under Git Bash/MSYS that
@@ -396,7 +406,7 @@ try {
         });
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: appRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, managedRoot });
+        sealRelease({ configRoot: appRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
@@ -436,7 +446,7 @@ function sqlCipherFeatures(text) {
     .filter((value) => /sqlcipher|openssl/i.test(value));
 }
 
-function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, managedRoot }) {
+function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot }) {
   // Every app's right-release.config.mjs names installer/updater artifacts
   // relative to its resolved native target. On a broker-managed host that
   // directory is never populated (the broker owns CARGO_TARGET_DIR and
@@ -507,6 +517,7 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     version: config.version,
     commit,
     ownershipEvidence,
+    qa: { sourceReceiptDigest: qaAdmission.digest, floorDigest: qaAdmission.floorDigest },
     platform,
     cacheKey,
     // Portable contracts sign only raw executables — installer/embedding

package/cli/right-release.mjs

@@ -23,6 +23,7 @@ const commands = new Map([
   ["mirror-root-artifact", "mirror-root-artifact.mjs"],
   ["github", "github-release.mjs"],
   ["cargo-target", "cargo-target.mjs"],
+  ["qa", "release-qa-command.mjs"],
   ["ownership", "ownership-command.mjs"],
   ["ownership-approval", "ownership-approval-command.mjs"],
   ["ownership-report", "ownership-report-command.mjs"],
@@ -183,6 +184,7 @@ Commands:
                                                       Stage SwiftPM app; build+sign MSIX (Windows) or assemble+sign+notarize .app (macOS); never uploads
   upload --release <id> --platform mac|win --tier patch|update
                                                       Upload one sealed release; never builds
+  qa --stage source|installed --platform mac|win [--release <id>]   Run rightkit-qa and write the sealed QA receipt (required to build/upload)
   publish-update --release <id> --platform mac|win --tier patch|update
                                                       Upload sealed bytes to R2 & register RightApps
   release                                             Compatibility alias for build
@@ -212,6 +214,7 @@ Commands:
   ownership approve-key <fingerprint|request.json>    Approve one pending device key from an active host
   ownership revoke-key <fingerprint>                  Revoke one active device key
   ownership trust-sync                               Advance this host's protected trust to the committed key log
+  ownership trust-compare [--json]                   Print this host's protected-trust digest (Mac is the reference)
   ownership-approval --draft <input.json> [--out <draft.json>]
                                                       Draft an exception for native owner approval
   ownership-approval --verify <signed.json> --context <scan.json>

package/github-release.mjs

@@ -7,6 +7,7 @@ import { readVerifiedArtifact, assertArtifactUnchanged, digestBytes, verifyArtif
 import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { verifySealedRelease } from "./release-state.mjs";
+import { assertInstalledQaAdmission } from "./release-qa-receipt.mjs";
 import { addonManifestSha256, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
 import { RIGHTRELEASE_MANIFEST_SIGNER, verifyManifestCatalogSignature } from "./sign-release-manifest.mjs";
 
@@ -394,6 +395,14 @@ if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(
     plan = prepareGitHubAddonRelease({ repoRoot, config, configRoot: path.dirname(configPath), ...options });
   } else {
     options.repo ||= repositoryFromRemote(repoRoot);
+    // Hardening step 4: the direct GitHub lane is a publication path too; it needs installed QA like `upload` does.
+    if (!options.dryRun) {
+      const sealed = verifySealedRelease(path.join(repoRoot, ".right-release", "sealed", options.releaseId, options.platform === "win" ? "windows" : "mac"));
+      const configPath = path.resolve("right-release.config.mjs");
+      try {
+        assertInstalledQaAdmission({ repoRoot, manifest: sealed.manifest, platform: options.platform, configName: "right-release.config.mjs", releaseConfigSha256: existsSync(configPath) ? createHash("sha256").update(readFileSync(configPath)).digest("hex") : undefined });
+      } catch (error) { if (error?.code !== "QA_ADMISSION_REFUSED") throw error; console.error(`right-release github: ${error.message}`); process.exit(1); }
+    }
     plan = prepareGitHubRelease({ repoRoot, ...options });
   }
   const result = publishGitHubRelease(plan, options);

package/ownership-approval.mjs

@@ -4,6 +4,7 @@ import { existsSync, lstatSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 import { spawnSync, windowsPowerShellEnvironment } from "./background-process.mjs";
 import { verifyKeyLog, verifyOwnershipSignature } from "./ownership-key-log.mjs";
+import { validateAllowlist } from "./ownership-dependency-allowlist.mjs";
 
 export const APPROVAL_SCHEMA = 2;
 export const REQUIRED_HOSTS = Object.freeze(["windows", "macos"]);
@@ -171,6 +172,16 @@ export function validateTrustRegistry(trust) {
   if (!Array.isArray(trust?.revokedKeyIds) || !Array.isArray(trust?.verifiedTrackingEvidence) || trust.verifiedTrackingEvidence.some((x) => !HEX.test(x))) problems.push("trust revocation or tracking evidence lists are malformed");
   if (!/^\d+(?:\.\d+)*$/.test(trust?.minimumScannerVersion ?? "") || !/^\d+(?:\.\d+)*$/.test(trust?.minimumCatalogVersion ?? "")) problems.push("scanner/catalog floors are missing or malformed");
   if (trust?.minimumCatalogDigest !== undefined && !HEX.test(trust.minimumCatalogDigest)) problems.push("minimum catalog digest is malformed");
+  // Policy bundle + allowlist are optional so trust written before they existed stays valid (treated as unpinned).
+  if (trust?.policyBundle !== undefined) {
+    const bundle = trust.policyBundle;
+    if (!bundle || typeof bundle !== "object" || Array.isArray(bundle) || bundle.schema !== 1 || !HEX.test(bundle.digest ?? "") || !HEX.test(bundle.catalogDigest ?? "")
+      || !/^\d+(?:\.\d+)*$/.test(bundle.scannerVersion ?? "") || !Array.isArray(bundle.files) || bundle.files.some((file) => typeof file?.path !== "string" || !HEX.test(file.sha256 ?? ""))) problems.push("protected policy bundle is malformed");
+  }
+  if (trust?.dependencyAllowlist !== undefined) {
+    const allowlist = validateAllowlist(trust.dependencyAllowlist);
+    if (!allowlist.ok) problems.push(`protected dependency allowlist is malformed: ${allowlist.problems[0]}`);
+  }
   if (trust?.rootFingerprint !== undefined || trust?.keyCheckpoint !== undefined) {
     if (!HEX.test(trust.rootFingerprint ?? "") || !trust.keyCheckpoint || !Number.isSafeInteger(trust.keyCheckpoint.sequence) || trust.keyCheckpoint.sequence < 0 || !HEX.test(trust.keyCheckpoint.head ?? "")) problems.push("protected key-log root pin or checkpoint is malformed");
   }
@@ -274,12 +285,14 @@ function versionAtLeast(actual, minimum) {
   }
   return true;
 }
-export function validateOwnershipFloor(trust, { scannerVersion, catalogVersion, catalogDigest } = {}) {
+export function validateOwnershipFloor(trust, { scannerVersion, catalogVersion, catalogDigest, policyBundleDigest } = {}) {
   const problems = [];
   if (!trust) return { ok: false, problems: ["external ownership trust unavailable"] };
   if (!versionAtLeast(scannerVersion, trust.minimumScannerVersion)) problems.push("scanner version missing, malformed, or below protected minimum");
   if (!versionAtLeast(catalogVersion, trust.minimumCatalogVersion)) problems.push("catalog version missing, malformed, or below protected minimum");
   if (trust.minimumCatalogDigest && trust.minimumCatalogDigest !== catalogDigest) problems.push("catalog digest below protected pinned digest");
+  // Trust written before the bundle existed has no policyBundle and stays unpinned until the next trust-sync.
+  if (trust.policyBundle?.digest && policyBundleDigest !== undefined && trust.policyBundle.digest !== policyBundleDigest) problems.push("ownership policy bundle (scanner source, catalog, registry or dependency allowlist) differs from the protected pinned bundle; run trust-sync");
   return { ok: problems.length === 0, problems };
 }
 function protectedLocation(file, platform, { runner = spawnSync, inspect = lstatSync, stat = statSync, requireNonElevated = true } = {}) {

package/ownership-command.mjs

@@ -3,7 +3,9 @@
 // the shipped manifest from each package's declaration.
 //
 //   right-release ownership [--app <dir>] [--json]
-//   right-release ownership --write-manifest [--rightkit <tools/rightkit>] [--approve-new-capabilities]
+//   right-release ownership [--app <dir>] --audit-json   (Legion governance.capability-ownership provider)
+//   right-release ownership trust-compare [--json]   (print this host's protected-trust digest)
+//   right-release ownership --write-manifest [--rightkit <rightkit>] [--approve-new-capabilities]
 // --approve-new-capabilities permits new ids during local generation only.
 // Existing owner changes are always refused; installation needs protected authorization.
 import { realpathSync } from "node:fs";
@@ -14,6 +16,8 @@ import { writeOwnershipCatalog } from "./ownership-catalog.mjs";
 import { createOwnershipEvidence } from "./ownership-evidence.mjs";
 import { spawnSync } from "./background-process.mjs";
 import { main as stagedMain } from "./ownership-staged.mjs";
+import { loadTrustedExternal } from "./ownership-approval.mjs";
+import { trustComparison } from "./ownership-policy-bundle.mjs";
 
 const packageRoot = path.dirname(fileURLToPath(import.meta.url));
 
@@ -22,11 +26,23 @@ function flag(args, name) {
   return i >= 0 ? args[i + 1] : undefined;
 }
 
-export async function main(args, { evidenceFactory = createOwnershipEvidence, gitRunner = spawnSync, print = (value) => console.log(value) } = {}) {
+/** Print this host's protected-trust digest. The Mac's digest is the reference; see docs/OWNERSHIP-ENFORCEMENT.md. */
+export function trustCompare(args, { print, trustLoader = loadTrustedExternal } = {}) {
+  let state;
+  try { state = trustLoader(); } catch (error) { print(`[right-release] trust-compare: protected trust unreadable (${error.message})`); return 1; }
+  if (!state?.trust) { print("[right-release] trust-compare: no protected trust on this host (not enrolled)"); return 1; }
+  const { digest, components } = trustComparison(state.trust);
+  if (args.includes("--json")) print(JSON.stringify({ platform: process.platform, digest, components }, null, 2));
+  else { print(`trust digest (${process.platform}): ${digest}`); for (const [name, value] of Object.entries(components)) print(`  ${name}: ${typeof value === "object" && value !== null ? JSON.stringify(value) : value ?? "none"}`); }
+  return 0;
+}
+
+export async function main(args, { evidenceFactory = createOwnershipEvidence, gitRunner = spawnSync, print = (value) => console.log(value), trustLoader = loadTrustedExternal } = {}) {
   if (args.includes("--help")) {
     print("right-release ownership [--app <dir>] [--json]\nright-release ownership --staged [--app <dir>] [--json]  (pre-commit gate: scans the index, not the working tree)\nright-release ownership --write-manifest [--rightkit <dir>] [--approve-new-capabilities]\n--approve-new-capabilities permits new capability ids during local generation only. Existing owner conflicts are always refused. Protected installation authorization remains separate.");
     return 0;
   }
+  if (args[0] === "trust-compare") return trustCompare(args, { print, trustLoader });
   if (args.includes("--staged")) return stagedMain(args, { print });
   if (["enroll", "approve-key", "revoke-key", "trust-sync"].includes(args[0])) {
     const { main: keyMain } = await import("./ownership-key-command.mjs");
@@ -48,6 +64,7 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
   try { checked = evidenceFactory(repoRoot, app); }
   catch (error) { return failClosed(args, "protected-evidence", error.message, print); }
   const result = checked.result;
+  if (args.includes("--audit-json")) return printAuditJson(result, print);
   if (args.includes("--json")) {
     const error = checked.enrollmentPending ? undefined : !checked.floor.ok
       ? { type: "ownership-floor", message: checked.floor.problems.join("; ") }
@@ -70,7 +87,36 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
   return checked.ok ? 0 : 1;
 }
 
+// Audit provider output: every scan violation (block and advise tiers) as a repo-relative finding.
+// Exit 0 whenever the scan completes; findings never change the exit code.
+export function auditFindings(result) {
+  return {
+    schemaVersion: 1,
+    findings: result.violations.map((v) => {
+      const tier = v.tier ?? "block";
+      const file = String(v.file ?? "").replaceAll("\\", "/");
+      if (!file || file.startsWith("/") || /^[A-Za-z]:/.test(file) || file === ".." || file.startsWith("../") || file.split("/").includes("..")) throw new Error(`audit finding path is outside the audited root: ${v.file}`);
+      const body = v.text ?? `${v.ecosystem ?? "dependency"} ${v.name ?? ""}`.trim();
+      const finding = { rule: String(v.fingerprint), path: file };
+      if (Number.isSafeInteger(v.line) && v.line > 0) finding.line = v.line;
+      finding.message = `${tier === "advise" ? "advise: " : ""}${v.capability} duplicates RightKit owner ${v.package} (${tier}): ${body}`;
+      return finding;
+    }),
+  };
+}
+
+function printAuditJson(result, print) {
+  try {
+    print(JSON.stringify(auditFindings(result)));
+    return 0;
+  } catch (error) {
+    console.error(`[right-release] ownership audit failed: ${error.message}`);
+    return 1;
+  }
+}
+
 function failClosed(args, type, message, print = (value) => console.log(value)) {
+  if (args.includes("--audit-json")) { console.error(`[right-release] ownership audit failed: ${message}`); return 1; }
   if (args.includes("--json")) print(JSON.stringify({ ok: false, error: { type, message }, rows: [], violations: [], covered: [], problems: [message], coverage: [], metadata: null }, null, 2));
   else print(`[right-release] ownership FAILED: ${message}`);
   return 1;

package/ownership-declaration.json

@@ -3,12 +3,183 @@
   "capabilities": [
     {
       "capability": "release-tooling",
-      "summary": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.; declaration-only detection (no precise implementation fingerprint)",
-      "fingerprints": [],
-      "detection": "declaration-only",
+      "summary": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
+      "fingerprints": [
+        {
+          "id": "release.sign.codesign-signtool",
+          "type": "source",
+          "pattern": "\\b(?:Command\\s*::\\s*new|spawn\\w*|execFile\\w*|exec\\w*)\\s*\\(\\s*(?:[\"`]\\s*(?:codesign\\b[^\"`';]{0,160}--sign|signtool(?:\\.exe)?\\s+sign\\b)|[\"'](?:codesign|signtool(?:\\.exe)?)[\"'][^;]{0,300}?[\"'](?:--sign|sign)[\"'])",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs",
+            ".py"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.notarize.notarytool",
+          "type": "source",
+          "pattern": "\\b(?:Command\\s*::\\s*new|spawn\\w*|execFile\\w*|exec\\w*)\\s*\\([^;]{0,200}?[\"'`\\s]notarytool\\b",
+          "codeOnly": true,
+          "extensions": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".jsx",
+            ".rs",
+            ".py"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-builder",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "electron-builder",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-notarize",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "electron-notarize",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-notarize-scoped",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@electron/notarize",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-osx-sign",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "electron-osx-sign",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.electron-osx-sign-scoped",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "@electron/osx-sign",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.create-dmg",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "create-dmg",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.npm.appdmg",
+          "type": "dependency",
+          "ecosystem": "npm",
+          "name": "appdmg",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "npm direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        },
+        {
+          "id": "release.cargo.apple-codesign",
+          "type": "dependency",
+          "ecosystem": "cargo",
+          "name": "apple-codesign",
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "macos",
+              "windows"
+            ],
+            "scope": "cargo direct competing dependency; transitive findings require authenticated reachability"
+          },
+          "tierReason": "No recorded published-version qualification for this usage context on both macOS & Windows."
+        }
+      ],
+      "detection": "fingerprinted",
       "policyNotes": [
         "Package contract retained; dependency declarations do not verify integration.",
-        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+        "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     }
   ]

package/ownership-dependency-allowlist-seed.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+// Propose or regenerate dependency-allowlist baselines from each registered repository's CURRENT direct
+// dependencies. This only edits the committed proposal file; it takes effect solely through Adrian's trust-sync.
+//   node ownership-dependency-allowlist-seed.mjs --workspace <dir> [--write]
+// Existing approvals are never removed (union with the current file); block-tier catalog dependencies
+// and RightKit packages are never recorded as approvals.
+import { existsSync, readdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { canonicalRepositoryIdentity } from "./ownership-approval.mjs";
+import { directDependencies } from "./ownership.mjs";
+import { ALLOWLIST_FILE, entryKey, isRightKitPackage, sourceKind, validateAllowlist } from "./ownership-dependency-allowlist.mjs";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const readJson = (name) => JSON.parse(readFileSync(path.join(here, name), "utf8"));
+
+// Universally approved tooling: tiny on purpose. Everything else is per-repository.
+export const SEED_GLOBAL = Object.freeze(["npm:@types/node", "npm:typescript", "npm:vitest"]);
+// A renamed repository that has no checkout of its own reuses the baseline of its current name.
+export const SEED_ALIASES = Object.freeze({ "https://github.com/orthic-labs/cockpit": "https://github.com/orthic-labs/pulse" });
+
+function localCheckouts(workspace) {
+  const found = new Map();
+  for (const name of readdirSync(workspace)) {
+    const dir = path.join(workspace, name);
+    if (!existsSync(path.join(dir, ".git"))) continue;
+    const origin = spawnSync("git", ["-C", dir, "config", "--get", "remote.origin.url"], { encoding: "utf8", windowsHide: true });
+    if (origin.status !== 0) continue;
+    try { found.set(canonicalRepositoryIdentity(origin.stdout.trim()), dir); } catch { /* not a canonical remote */ }
+  }
+  return found;
+}
+
+export function seedRepository(root, manifest) {
+  const blocked = new Set(manifest.capabilities.flatMap((c) => c.fingerprints.filter((f) => f.type === "dependency" && (f.tier ?? c.tier ?? "block") === "block").map((f) => `${f.ecosystem}:${f.name}`)));
+  const owners = manifest.capabilities.map((c) => c.package);
+  const entries = new Set(); let skippedBlock = 0, skippedFirstParty = 0, skippedRightKit = 0;
+  const deps = directDependencies(root);
+  for (const d of deps) {
+    const kind = sourceKind(d.source);
+    if (kind === "path") { skippedFirstParty += 1; continue; }
+    if (isRightKitPackage(d.name, owners)) { skippedRightKit += 1; continue; }
+    if (blocked.has(`${d.ecosystem}:${d.name}`)) { skippedBlock += 1; continue; }
+    entries.add(entryKey(d.ecosystem, d.name, kind));
+  }
+  return { entries: [...entries].sort(), direct: deps.length, skippedBlock, skippedFirstParty, skippedRightKit, unscanned: deps.coverage?.length ?? 0 };
+}
+
+export function buildSeed({ workspace, registry = readJson("ownership-repositories.json"), manifest = readJson("rightkit-ownership.json"), existing = null, log = () => {} } = {}) {
+  const checkouts = localCheckouts(workspace);
+  const previous = new Map((existing?.repositories ?? []).map((entry) => [entry.repositoryIdentity, entry]));
+  const seeded = new Map(), stats = [];
+  for (const { repositoryIdentity } of registry.repositories) {
+    const root = checkouts.get(repositoryIdentity);
+    if (!root) continue;
+    const result = seedRepository(root, manifest);
+    seeded.set(repositoryIdentity, result.entries);
+    stats.push({ repositoryIdentity, root, ...result });
+  }
+  const repositories = registry.repositories.map(({ repositoryIdentity }) => {
+    const prior = previous.get(repositoryIdentity)?.dependencies ?? [];
+    let note;
+    let fresh = seeded.get(repositoryIdentity);
+    if (!fresh && SEED_ALIASES[repositoryIdentity] && seeded.has(SEED_ALIASES[repositoryIdentity])) { fresh = seeded.get(SEED_ALIASES[repositoryIdentity]); note = `seeded from ${SEED_ALIASES[repositoryIdentity]} (same repository, renamed)`; stats.push({ repositoryIdentity, alias: SEED_ALIASES[repositoryIdentity], entries: fresh }); }
+    if (!fresh) { fresh = []; note = "no local checkout when seeded; baseline is empty until proposed"; stats.push({ repositoryIdentity, unseeded: true, entries: [] }); }
+    return { repositoryIdentity, ...(note ? { note } : {}), dependencies: [...new Set([...prior, ...fresh])].sort() };
+  });
+  const allowlist = { schema: 1, global: [...new Set([...(existing?.global ?? []), ...SEED_GLOBAL])].sort(), repositories };
+  const check = validateAllowlist(allowlist);
+  if (!check.ok) throw new Error(`generated allowlist is invalid: ${check.problems.join("; ")}`);
+  log(stats);
+  return { allowlist, stats };
+}
+
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
+  const args = process.argv.slice(2);
+  const flag = (name) => { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; };
+  const workspace = path.resolve(flag("--workspace") ?? path.resolve(here, "../../.."));
+  const file = path.join(here, ALLOWLIST_FILE);
+  const existing = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null;
+  const { allowlist, stats } = buildSeed({ workspace, existing });
+  for (const s of stats) process.stdout.write(`${s.repositoryIdentity}: ${s.entries.length} entries${s.direct !== undefined ? ` (direct ${s.direct}, first-party ${s.skippedFirstParty}, rightkit ${s.skippedRightKit}, block-tier ${s.skippedBlock}, unscanned ${s.unscanned})` : s.alias ? ` (alias of ${s.alias})` : " (UNSEEDED)"}\n`);
+  if (args.includes("--write")) { writeFileSync(file, `${JSON.stringify(allowlist, null, 2)}\n`); process.stdout.write(`wrote ${file}\n`); }
+}